chore(deps): bump the actions group across 1 directory with 13 updates

Bumps the actions group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.7` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.7` | `4.39.1` | | [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) | `3.4.0` | `3.5.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.39.1` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.2 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e) Updates `github/codeql-action/init` from 4.37.7 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.37.7 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `hadolint/hadolint-action` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](https://github.com/hadolint/hadolint-action/compare/2a66e89f53d0771bb131a7fa31f3136336094aa6...06be81baf89a55ffd0e24b8f04a4185738dd3387) Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `actions/deploy-pages` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hadolint/hadolint-action dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
fix(docker): require the patched Debian Brotli decoder (#6956 )
2026-10-30 09:42:21 +01:00 · 2026-10-29 17:41:48 +00:00 · 2026-10-29 15:05:58 +01:00 · 2026-10-29 10:31:08 +00:00 · 2026-10-29 10:30:50 +00:00 · 2026-10-29 10:29:51 +00:00
176 changed files with 11069 additions and 1620 deletions
@@ -76,7 +76,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: "3.11"
      # Byte-compile sources — catches syntax errors without installing deps.
@@ -91,7 +91,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: "22.23.4"
      - run: npm ci --ignore-scripts --no-audit --no-fund
@@ -151,7 +151,7 @@ jobs:
            echo "docs_only=false" >> "$GITHUB_OUTPUT"
          fi

-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        if: steps.docs-check.outputs.docs_only != 'true'
        with:
          python-version: "3.11"
@@ -168,7 +168,7 @@ jobs:

      # uv resolves the same versions as pip but installs ~5x faster, and its
      # cache keeps each shard from re-downloading the whole requirement set.
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
        if: steps.docs-check.outputs.docs_only != 'true'
        with:
          version: "0.13.5"
@@ -180,7 +180,7 @@ jobs:
          python scripts/check_ca_trust.py --python
          uv pip install --system -r requirements.txt
        if: steps.docs-check.outputs.docs_only != 'true'
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        if: steps.docs-check.outputs.docs_only != 'true'
        with:
          node-version: "22.23.4"
@@ -31,11 +31,11 @@ jobs:
        with:
          persist-credentials: false
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
        with:
          languages: ${{ matrix.language }}
          build-mode: none
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
        with:
          category: "/language:${{ matrix.language }}"
@@ -42,7 +42,7 @@ jobs:
          persist-credentials: false

      - name: Lint Dockerfile
-        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6  # v3.4.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387  # v3.5.0
        with:
          dockerfile: Dockerfile
          # DL3008: pinning apt package versions is impractical on a -slim base
@@ -61,14 +61,14 @@ jobs:
          persist-credentials: false

      - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
        with:
          driver: docker

      # Build without pushing so a broken Dockerfile is caught here, and the
      # exact image we ship is what gets scanned.
      - name: Build image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
        with:
          context: .
          push: false
@@ -107,12 +107,12 @@ jobs:
          persist-credentials: false

      - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
        with:
          driver: docker

      - name: Build image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
        with:
          context: .
          push: false
@@ -133,7 +133,7 @@ jobs:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2

      - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
        with:
          sarif_file: trivy-results.sarif
          category: trivy-image
@@ -63,7 +63,7 @@ jobs:
          persist-credentials: false

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: '3.12'

@@ -47,4 +47,4 @@ jobs:
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.1
@@ -55,16 +55,16 @@ jobs:
        shell: bash
        run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
      - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
      - name: Log in to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
        with:
          context: .
          pull: true
@@ -78,7 +78,7 @@ jobs:
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload digest
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: digest-${{ matrix.arch }}
          path: /tmp/digests/*
@@ -107,15 +107,15 @@ jobs:
          echo "version=$v" >> "$GITHUB_OUTPUT"
          echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
      - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true
      - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
      - name: Log in to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -62,9 +62,9 @@ jobs:
        env:
          SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
        run: docker pull "$SEARXNG_TEST_IMAGE"
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - name: Check unmodified upstream trust and actual entrypoint offline
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: docker/searxng/Dockerfile
@@ -66,7 +66,7 @@ jobs:
          persist-credentials: false

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: '3.12'

@@ -53,6 +53,8 @@ services/data/

 # Test capture artifacts (browser session dumps may contain personal content)
 .playwright-mcp/
+test-results/
+playwright-report/

 # OS
 .DS_Store
@@ -35,3 +35,15 @@ regexTarget = "secret"
 regexes = [
  '''^7abc5b334a6c3c52dd3eba15d8bc516da728a67f14fb7f56d0bb5992d89a16ca$''',
 ]
+
+[[allowlists]]
+description = "Synthetic dummy API key in trace artifact sanitizer test fixture"
+targetRules = ["generic-api-key"]
+condition = "AND"
+paths = [
+  '''(?:^|/)tests/test_trace_artifact_sanitizer\.py$''',
+]
+regexTarget = "secret"
+regexes = [
+  '''^sk-123456789$''',
+]
@@ -1,9 +1,22 @@
+# Both stages need the fixed native decoder, including curl in the builder and
+# distro Node in the runtime. A cached Python base may predate the Debian fix.
+FROM python:3.14.9-slim AS brotli-base
+COPY scripts/check_brotli.py /usr/local/bin/check-brotli.py
+COPY scripts/check_ca_trust.py /usr/local/bin/check-ca-trust.py
+# Check inherited trust before the first HTTPS package request, retaining Debian's
+# signed archive verification. Refresh only the explicit native dependency.
+RUN python /usr/local/bin/check-ca-trust.py --system \
+    && sed -i 's|http://deb.debian.org/|https://deb.debian.org/|g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends libbrotli1 \
+    && python /usr/local/bin/check-brotli.py \
+    && rm -rf /var/lib/apt/lists/*
+
 # ---- builder: patch + build wheels for Real-ESRGAN's broken-on-3.14 deps ----
 # basicsr/gfpgan/facexlib read their version via exec()+locals()['__version__'],
 # which raises KeyError on Python 3.13+ (PEP 667). Build patched wheels here so
 # the final image / Cookbook never has to compile the broken sdists. See
 # docker/build-realesrgan-wheels.sh for the full rationale.
-FROM python:3.14.9-slim AS realesrgan-wheels
+FROM brotli-base AS realesrgan-wheels
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
 COPY scripts/check_ca_trust.py /usr/local/bin/check-ca-trust.py
@@ -14,7 +27,7 @@ RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: --
 COPY docker/build-realesrgan-wheels.sh /usr/local/bin/build-realesrgan-wheels.sh
 RUN bash /usr/local/bin/build-realesrgan-wheels.sh /wheels

-FROM python:3.14.9-slim
+FROM brotli-base

 # System deps. tmux is required by Cookbook for background downloads/serves.
 # openssh-client is required for Cookbook remote server tests, setup, probes,
@@ -52,6 +65,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libglib2.0-0t64 \
    libxcb1 \
    libmagic1 \
+    && python /usr/local/bin/check-brotli.py --node /usr/bin/node \
    && rm -rf /var/lib/apt/lists/*

 # Refresh both Python trust bundles before installing application dependencies.
@@ -132,7 +146,8 @@ RUN pip install --no-cache-dir --no-deps /tmp/odysseus-wheels/*.whl \
 # Check gRPC's effective defaults after all Python dependencies are installed.
 # The application minimum fixes its bundled roots; the checked override also
 # keeps the effective Docker selection consistent with system trust.
-RUN python /usr/local/bin/check-ca-trust.py --system --python --grpc
+RUN python /usr/local/bin/check-ca-trust.py --system --python --grpc \
+    && python /usr/local/bin/check-brotli.py --node /usr/bin/node

 # Copy app code
 COPY . .
@@ -119,19 +119,26 @@ Enabled automatically when the editor opens (`window.__geEditorBridge`).
 - The page runs the op via the control API and replies:
  `POST /api/editor/bridge/result {id,ok,result,error,screenshot,ms}`.
 - Enqueue a command (server side): `POST /api/editor/bridge/command {session, op|steps, wait, timeout}`.
-  With `wait:true` the call blocks and returns the editor's result.
+  With `wait:true` and one step the call blocks and returns the editor's result.
+  Otherwise use `POST /api/editor/bridge/await {id, timeout}` for each queued id.
+  Timeouts are seconds, greater than zero and at most 900. Pending results expire
+  after the command timeout; an unknown or another owner's id returns 404.

 Round-trip example (authenticated; `<session>` = `window.__geEditorBridge.session`):

 ```bash
 curl -s -X POST http://127.0.0.1:7011/api/editor/bridge/command \
  -H 'Content-Type: application/json' -b "odysseus_session=$TOKEN" \
-  -d '{"session":"default","op":"layers.addRaster","wait":true,"timeout":8000}'
+  -d '{"session":"default","op":"layers.addRaster","wait":true,"timeout":8}'
 # -> {"id":"...","ok":true,"result":{...},"screenshot":"data:image/png;base64,..."}
 ```

-Session scoping is `owner:session`, so an agent can only drive editors owned by the
-same user. The bridge is a **browser-only** flow: it requires an editor page to be open.
+Session scoping uses the authenticated owner and session as separate values. A
+bound editor-tool turn uses its server-owned session, not a model-selected one.
+The bridge is a **browser-only** flow: it requires an editor page to be open.
+For `/api/editor/agent`, clients must send `incognito: true` for private image
+results; omitted or false requests use normal gallery persistence. These
+owner-scoped routes do not accept delegated API tokens without a scope contract.

 ---

@@ -569,6 +569,16 @@ async def auto_name_session(session_manager, sess):
        if not first_msg:
            return

+        from src.owner_identity import is_request_sentinel_owner
+        owner = getattr(sess, "owner", None)
+        invalid_owner = (
+            not isinstance(owner, str) or not owner.strip()
+            or owner != owner.strip() or is_request_sentinel_owner(owner)
+        )
+        if invalid_owner:
+            session_manager.update_session_name(sess.id, fallback_session_title(first_msg))
+            return
+
        endpoint_url = str(getattr(sess, "endpoint_url", "") or "")
        model_name = str(getattr(sess, "model", "") or "")

@@ -583,15 +593,25 @@ async def auto_name_session(session_manager, sess):
        except Exception:
            _is_spec_model = False
        if _is_spec_model and endpoint_url:
-            _headers = getattr(sess, "headers", None)
-            if isinstance(_headers, str):
-                try:
-                    _headers = json.loads(_headers)
-                except Exception:
-                    _headers = None
            try:
+                from src.database import SessionLocal
+                from src.endpoint_resolver import (build_chat_url, build_headers,
+                    resolve_endpoint_runtime, resolve_owner_registered_endpoint)
+                from src.owner_identity import auth_disabled
+
+                owner = getattr(sess, "owner", None)
+                if not owner and not auth_disabled():
+                    raise ValueError("Session has no owner")
+                db = SessionLocal()
+                try:
+                    endpoint = resolve_owner_registered_endpoint(db, endpoint_url, owner)
+                    base, key = resolve_endpoint_runtime(endpoint, owner=owner)
+                    title_url = build_chat_url(base)
+                    title_headers = build_headers(key, base)
+                finally:
+                    db.close()
                title = await llm_call_async(
-                    endpoint_url,
+                    title_url,
                    model_name,
                    [
                        {"role": "system", "content": "Generate a short title (3-6 words, no quotes) for a conversation that starts with this message. Reply with ONLY the title, nothing else. Do NOT include any thinking, reasoning, or explanation \u2014 just the title."},
@@ -599,7 +619,7 @@ async def auto_name_session(session_manager, sess):
                    ],
                    temperature=0.3,
                    max_tokens=32,
-                    headers=_headers or None,
+                    headers=title_headers,
                    timeout=20,
                    thinking_mode="off",
                )
@@ -625,6 +645,14 @@ async def auto_name_session(session_manager, sess):
            return

        owner = getattr(sess, "owner", None)
+        from src.owner_identity import auth_disabled
+        if not owner and not auth_disabled():
+            title = fallback_session_title(first_msg)
+            session_manager.update_session_name(sess.id, title)
+            logger.info(f"Auto-named unowned session {sess.id} deterministically: {title}")
+            return
+
+        from src.task_endpoint import resolve_task_endpoint
        t_url, t_model, t_headers = resolve_task_endpoint(
            sess.endpoint_url, sess.model, sess.headers, owner=owner
        )
@@ -632,24 +660,64 @@ async def auto_name_session(session_manager, sess):
            logger.debug("[auto-name] No model provided, skipping")
            return

+        sess_url = getattr(sess, "endpoint_url", None)
+        if t_url and sess_url and t_url == sess_url:
+            from src.database import SessionLocal
+            from src.endpoint_resolver import (
+                build_chat_url,
+                build_headers,
+                resolve_endpoint,
+                resolve_endpoint_runtime,
+                resolve_owner_registered_endpoint,
+            )
+            db = SessionLocal()
+            try:
+                endpoint = resolve_owner_registered_endpoint(db, t_url, owner)
+                base, key = resolve_endpoint_runtime(endpoint, owner=owner)
+                t_url = build_chat_url(base)
+                t_headers = build_headers(key, base)
+            except Exception as e:
+                logger.debug("[auto-name] session fallback endpoint %s unauthorized for %s: %s", t_url, owner, e)
+                t_url, t_model, t_headers = None, None, None
+                for prefix in ("utility", "default"):
+                    try:
+                        u, m, h = resolve_endpoint(prefix, owner=owner)
+                        if u and m:
+                            t_url, t_model, t_headers = u, m, h
+                            break
+                    except Exception:
+                        pass
+            finally:
+                db.close()
+
+        if not t_url or not t_model:
+            title = fallback_session_title(first_msg)
+            session_manager.update_session_name(sess.id, title)
+            logger.info(f"Auto-named session {sess.id} deterministically (no authorized model endpoint): {title}")
+            return
+
        # max_tokens big enough that reasoning models (Minimax M2,
        # DeepSeek R1, QwQ, etc.) have headroom for <think>…</think>
        # plus the actual title — 200 used to clip them mid-reasoning
        # so strip_think left an empty string and no rename happened.
        # Timeout matches: 60s gives slow local reasoners room to finish.
-        title = await llm_call_async(
-            t_url,
-            t_model,
-            [
-                {"role": "system", "content": "Generate a short title (3-6 words, no quotes) for a conversation that starts with this message. Reply with ONLY the title, nothing else. Do NOT include any thinking, reasoning, or explanation — just the title."},
-                {"role": "user", "content": first_msg},
-            ],
-            temperature=0.3,
-            max_tokens=64,
-            headers=t_headers,
-            timeout=15,
-            reasoning_effort=effort_for_call(t_url, t_model, owner, sess),
-        )
+        try:
+            title = await llm_call_async(
+                t_url,
+                t_model,
+                [
+                    {"role": "system", "content": "Generate a short title (3-6 words, no quotes) for a conversation that starts with this message. Reply with ONLY the title, nothing else. Do NOT include any thinking, reasoning, or explanation — just the title."},
+                    {"role": "user", "content": first_msg},
+                ],
+                temperature=0.3,
+                max_tokens=64,
+                headers=t_headers,
+                timeout=15,
+                reasoning_effort=effort_for_call(t_url, t_model, owner, sess),
+            )
+        except Exception as e:
+            logger.warning("[auto-name] non-spec title call failed for %s: %s", sess.id, e)
+            title = ""

        title = title.strip().strip('"\'').strip()
        # Strip <think>/<thinking> blocks (closed, dangling, or stray tags)
@@ -331,6 +331,7 @@ def _is_external_discovery_request(text: str) -> bool:

 _URL_SCHEME_RE = re.compile(r"https?://", re.I)
 _PDF_URL_TAIL_RE = re.compile(r"\.pdf\b|/pdf/", re.I)
+_EDITOR_SESSION_RE = re.compile(r"[A-Za-z0-9@._:-]{1,128}")


 def _mentions_pdf_url(value: str) -> bool:
@@ -2693,11 +2694,15 @@ def setup_chat_routes(
        # Scoped photo_editor agent context: the Quick Edit popup (and any
        # image-edit chat turn) may carry the open image-editor session id and a
        # canvas snapshot so the editor tool family can drive it in-process.
-        editor_session = (
+        # The id is quoted into a system message, so accept only an
+        # identifier; any other value is treated as no open editor.
+        editor_session = str(
            form_data.get("editor_session")
            or form_data.get("editor_session_id")
            or ""
        ).strip()
+        if not _EDITOR_SESSION_RE.fullmatch(editor_session):
+            editor_session = ""
        photo_editor_requested = (
            str(form_data.get("photo_editor") or "").strip().lower()
            in {"1", "true", "yes", "on"}
@@ -3521,7 +3526,7 @@ def setup_chat_routes(
            if not _privs.get("can_use_documents", True):
                disabled_tools.update({"manage_documents", "create_document", "edit_document", "update_document", "suggest_document"})
            if not _privs.get("can_generate_images", True):
-                disabled_tools.update({"generate_image", "edit_image"})
+                disabled_tools.update({"generate_image", "edit_image", "ai_edit_image"})
            if not _privs.get("can_manage_memory", True):
                disabled_tools.update({"manage_memory", "manage_skills"})
            if not _privs.get("can_use_research", True):
@@ -21,11 +21,12 @@ import asyncio
 import inspect
 import json
 import logging
+import math
 import re
 import uuid
 from typing import Any, Awaitable, Callable, Dict, List, Optional, Tuple

-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse, StreamingResponse

 from src import editor_style_guide as style_guide
@@ -1169,16 +1170,111 @@ def _normalize_steps(body: Dict[str, Any]) -> List[Dict[str, Any]]:
        op = str(step.get("op") or "")
        if op not in _OP_SET:
            continue
-        out.append({"op": op, "params": step.get("params") or {}})
+        params = step.get("params")
+        out.append({"op": op, "params": params if isinstance(params, dict) else {}})
    return out


-def _user(request: Request) -> Optional[str]:
+async def _json_object(request: Request) -> Dict[str, Any]:
    try:
-        from src.auth_helpers import get_current_user
-        return get_current_user(request)
+        body = await request.json()
+    except (ValueError, UnicodeDecodeError):
+        raise HTTPException(400, "Expected a JSON object")
+    if not isinstance(body, dict):
+        raise HTTPException(400, "Expected a JSON object")
+    return body
+
+
+def _prompt(value: Any) -> str:
+    text = str(value or "").strip()
+    if len(text) > 4096:
+        raise HTTPException(413, "Editor prompt is too long")
+    return text
+
+
+def _bridge_timeout(value: Any) -> float:
+    try:
+        timeout = float(value or _BRIDGE_DEFAULT_TIMEOUT)
+    except (TypeError, ValueError, OverflowError):
+        raise HTTPException(400, "Invalid bridge timeout")
+    if not math.isfinite(timeout) or timeout <= 0 or timeout > 900:
+        raise HTTPException(400, "Invalid bridge timeout")
+    return timeout
+
+
+def _is_admin(request: Request) -> bool:
+    """Return True only for authorized administrator browser sessions or auth-disabled single-user mode.
+
+    Delegated credentials (bearer API tokens) are explicitly rejected:
+    per src/tool_security.py, bearer tokens are long-lived credentials handed to
+    third parties/scripts and must remain capped at non-admin policies even
+    when minted by an administrator.
+    """
+    # 1. Delegated credentials (bearer API tokens) must NEVER receive admin metadata privileges
+    if getattr(request.state, "api_token", False):
+        return False
+
+    # 2. In-process internal tool bypass (loopback agent tools)
+    try:
+        from core.middleware import INTERNAL_TOOL_HEADER, INTERNAL_TOOL_TOKEN, INTERNAL_TOOL_USER
+        import secrets
+        hdr = request.headers.get(INTERNAL_TOOL_HEADER)
+        if hdr and secrets.compare_digest(hdr, INTERNAL_TOOL_TOKEN):
+            return True
+        if getattr(request.state, "current_user", None) == INTERNAL_TOOL_USER:
+            return True
    except Exception:
+        pass
+
+    # 3. Explicitly auth-disabled single-user operation (AUTH_ENABLED=false)
+    try:
+        from src.auth_helpers import _auth_disabled
+        if _auth_disabled():
+            return True
+    except Exception:
+        pass
+
+    # 4. Middleware require_admin
+    try:
+        from core.middleware import require_admin
+        require_admin(request)
+        return True
+    except Exception:
+        pass
+
+    # 5. Direct session/user check when request.state.current_user is set
+    try:
+        auth_mgr = getattr(request.app.state, "auth_manager", None)
+        if auth_mgr and getattr(auth_mgr, "is_configured", False):
+            from src.auth_helpers import get_current_user
+            user = get_current_user(request) or getattr(request.state, "current_user", None)
+            if user and getattr(auth_mgr, "is_admin", None) and auth_mgr.is_admin(user):
+                return True
+    except Exception:
+        pass
+
+    return False
+
+
+def _user(request: Request) -> Optional[str]:
+    # Handle API bearer tokens explicitly: require 'chat' scope and attribute to real owner
+    if getattr(request.state, "api_token", False):
+        from src.auth_helpers import require_api_token_scope
+        return require_api_token_scope(request, "chat")
+    from src.auth_helpers import get_current_user, _auth_disabled
+    u = get_current_user(request)
+    if u:
+        return u
+    if _auth_disabled():
        return None
+    auth_mgr = getattr(request.app.state, "auth_manager", None)
+    if auth_mgr is not None and getattr(auth_mgr, "is_configured", False):
+        raise HTTPException(401, "Not authenticated")
+    client = getattr(request, "client", None)
+    host = (client.host if client else "") or ""
+    if host in ("127.0.0.1", "::1", "localhost", "testclient") or not host:
+        return None
+    raise HTTPException(401, "Not authenticated")


 async def _default_editor_planner(messages: List[dict], owner: Optional[str]) -> Optional[str]:
@@ -1206,17 +1302,14 @@ def setup_editor_agent_routes() -> APIRouter:
    if _EDITOR_PLANNER is None:
        set_editor_planner(_default_editor_planner)

-    # Probe the local editor-agent model server (non-blocking) so the planner
-    # can use it for vision planning when reachable.
-    editor_agent_model.startup_probe()
-
    # scoped session -> list of that session's live subscriber queues; id -> result future.
    # A command is BROADCAST to every live subscriber (per-connection queue), never to a
    # single shared queue: EventSource reconnects overlap, and with one shared queue a
    # command could be consumed by a stale subscriber while the active page got nothing.
-    subscribers: Dict[str, List["asyncio.Queue[dict]"]] = {}
-    backlog: Dict[str, List[dict]] = {}
-    pending: Dict[str, asyncio.Future] = {}
+    subscribers: Dict[Tuple[Optional[str], str], List["asyncio.Queue[dict]"]] = {}
+    backlog: Dict[Tuple[Optional[str], str], List[dict]] = {}
+    pending: Dict[str, Tuple[Optional[str], asyncio.Future]] = {}
+    max_pending = 1024

    def _subscribe(session: str) -> "asyncio.Queue[dict]":
        q: "asyncio.Queue[dict]" = asyncio.Queue(maxsize=_QUEUE_MAX)
@@ -1253,17 +1346,30 @@ def setup_editor_agent_routes() -> APIRouter:
            del bl[0: len(bl) - _QUEUE_MAX]
        return 0

-    def _scoped(session: Optional[str], owner: Optional[str]) -> str:
-        return f"{owner or 'anon'}:{session or 'default'}"
+    def _expire_command(session, cid, fut):
+        entry = pending.get(cid)
+        if entry is not None and entry[1] is fut:
+            pending.pop(cid, None)
+            if not fut.done():
+                fut.cancel()
+        queued = backlog.get(session)
+        if queued:
+            backlog[session] = [cmd for cmd in queued if cmd.get("id") != cid]
+            if not backlog[session]:
+                backlog.pop(session, None)
+
+    def _scoped(session: Optional[str], owner: Optional[str]) -> Tuple[Optional[str], str]:
+        # Usernames and session ids may both contain colons.
+        return (owner, str(session or 'default'))
+
+    def _scope_label(scope: Tuple[Optional[str], str]) -> str:
+        return f"{scope[0] or 'anon'}:{scope[1]}"

    @router.post("/api/editor/plan")
    async def plan(request: Request) -> JSONResponse:
        owner = _user(request)
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
-        prompt = str(body.get("prompt") or "").strip()
+        body = await _json_object(request)
+        prompt = _prompt(body.get("prompt"))
        state = body.get("state") or {}
        mode = str(body.get("mode") or "plan").strip().lower()
        screenshot = body.get("screenshot")
@@ -1297,9 +1403,13 @@ def setup_editor_agent_routes() -> APIRouter:
            except Exception:
                raw = None
        _used = editor_agent_model.get_last_model()
-        model_used = (_used[0] if _used and _used[0]
-                      else (agent_model or editor_agent_model.local_model()))
        parsed = _parse_plan(raw)
+        if _used and _used[0]:
+            model_used = _used[0]
+        elif parsed:
+            model_used = agent_model or editor_agent_model.local_model()
+        else:
+            model_used = "fallback" if agent_model else editor_agent_model.local_model()
        if isinstance(parsed, dict):
            parsed["agent_model"] = model_used
        if mode != "check":
@@ -1363,31 +1473,49 @@ def setup_editor_agent_routes() -> APIRouter:
    @router.post("/api/editor/bridge/command")
    async def bridge_command(request: Request) -> JSONResponse:
        owner = _user(request)
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
+        body = await _json_object(request)
        session = _scoped(body.get("session"), owner)
        steps = _normalize_steps(body)
        wait = bool(body.get("wait"))
-        timeout = float(body.get("timeout") or _BRIDGE_DEFAULT_TIMEOUT)
+        timeout = _bridge_timeout(body.get("timeout"))
        ids: List[str] = []
-        wait_ids: List[str] = []
+        if len(pending) + len(steps) > max_pending:
+            raise HTTPException(429, "Too many pending editor commands")
        for step in steps:
            cid = uuid.uuid4().hex
            ids.append(cid)
-            if wait:
-                pending[cid] = asyncio.get_event_loop().create_future()
-                wait_ids.append(cid)
+            fut = asyncio.get_event_loop().create_future()
+            pending[cid] = (owner, fut)
            _broadcast(session, {"id": cid, "op": step["op"], "params": step["params"]})
-        if wait and len(wait_ids) == 1:
+
+        if wait and len(steps) == 1:
+            cid = ids[0]
+            entry = pending.get(cid)
+            fut = entry[1]
            try:
-                result = await asyncio.wait_for(pending[wait_ids[0]], timeout=timeout)
-                return JSONResponse(result)
+                res = await asyncio.wait_for(fut, timeout=timeout)
+                if isinstance(res, dict):
+                    res.setdefault("status", "completed" if res.get("ok") else "failed")
+                    res.setdefault("completed", bool(res.get("ok")))
+                    return JSONResponse(res)
+                return JSONResponse({"id": cid, "ok": True, "status": "completed", "completed": True, "result": res})
            except asyncio.TimeoutError:
-                pending.pop(wait_ids[0], None)
-                return JSONResponse({"ok": False, "error": "timeout", "id": wait_ids[0]})
-        return JSONResponse({"queued": ids, "session": session})
+                return JSONResponse({"ok": False, "error": "timeout", "status": "timed_out", "completed": False, "id": cid}, status_code=504)
+            finally:
+                _expire_command(session, cid, fut)
+        else:
+            for cid in ids:
+                entry = pending.get(cid)
+                if entry is not None:
+                    asyncio.get_running_loop().call_later(timeout, _expire_command, session, cid, entry[1])
+
+        return JSONResponse({
+            "queued": ids,
+            "session": _scope_label(session),
+            "status": "queued",
+            "completed": False,
+            "ok": False,
+        })

    @router.get("/api/editor/bridge/events")
    async def bridge_events(request: Request, session: str = "default") -> StreamingResponse:
@@ -1412,38 +1540,50 @@ def setup_editor_agent_routes() -> APIRouter:

    @router.post("/api/editor/bridge/result")
    async def bridge_result(request: Request) -> JSONResponse:
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
+        owner = _user(request)
+        body = await _json_object(request)
        cid = str(body.get("id") or "")
-        fut = pending.pop(cid, None)
+        entry = pending.get(cid)
+        if entry is None:
+            return JSONResponse({"ok": True})
+        if entry[0] != owner:
+            return JSONResponse({"ok": False, "error": "unknown command"}, status_code=404)
+        _, fut = entry
        if fut is not None and not fut.done():
+            is_ok = bool(body.get("ok"))
            fut.set_result({
-                "id": cid, "ok": bool(body.get("ok")),
-                "result": body.get("result"), "error": body.get("error"),
+                "id": cid,
+                "ok": is_ok,
+                "status": "completed" if is_ok else "failed",
+                "completed": is_ok,
+                "result": body.get("result"),
+                "error": body.get("error"),
                "screenshot": body.get("screenshot"),
            })
        return JSONResponse({"ok": True})

    @router.post("/api/editor/bridge/await")
    async def bridge_await(request: Request) -> JSONResponse:
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
+        owner = _user(request)
+        body = await _json_object(request)
        cid = str(body.get("id") or "")
-        timeout = float(body.get("timeout") or _BRIDGE_DEFAULT_TIMEOUT)
-        fut = pending.get(cid)
-        if fut is None:
-            fut = asyncio.get_event_loop().create_future()
-            pending[cid] = fut
+        timeout = _bridge_timeout(body.get("timeout"))
+        entry = pending.get(cid)
+        if entry is None or entry[0] != owner:
+            return JSONResponse({"ok": False, "error": "unknown command", "status": "unknown", "completed": False}, status_code=404)
+        fut = entry[1]
        try:
-            result = await asyncio.wait_for(fut, timeout=timeout)
-            return JSONResponse(result)
+            result = await asyncio.wait_for(asyncio.shield(fut), timeout=timeout)
+            if pending.get(cid) == (owner, fut):
+                pending.pop(cid, None)
+            res = dict(result) if isinstance(result, dict) else {"result": result, "ok": True}
+            res.setdefault("status", "completed" if res.get("ok") else "failed")
+            res["completed"] = bool(res.get("ok"))
+            return JSONResponse(res)
        except asyncio.TimeoutError:
-            pending.pop(cid, None)
-            return JSONResponse({"ok": False, "error": "timeout", "id": cid})
+            return JSONResponse({"ok": False, "error": "timeout", "status": "timed_out", "completed": False, "id": cid})
+        except asyncio.CancelledError:
+            return JSONResponse({"ok": False, "error": "cancelled", "status": "cancelled", "completed": False, "id": cid})

    _AGENT_SYSTEM_PROMPT = (
        "You are the photo editor agent. You drive the open image editor and "
@@ -1494,11 +1634,14 @@ def setup_editor_agent_routes() -> APIRouter:
        overwritten.
        """
        owner = _user(request)
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
-        prompt = str(body.get("prompt") or "").strip()
+        body = await _json_object(request)
+        from src.settings import get_setting
+        disabled = get_setting("disabled_tools", []) or []
+        if not isinstance(disabled, (list, tuple, set)):
+            disabled = []
+        if "plan_edit" in disabled:
+            raise HTTPException(403, "Editor tool is disabled")
+        prompt = _prompt(body.get("prompt"))
        session = str(body.get("editor_session") or body.get("session") or "default")
        state = body.get("state") if isinstance(body.get("state"), dict) else {}
        screenshot = body.get("screenshot")
@@ -1506,10 +1649,10 @@ def setup_editor_agent_routes() -> APIRouter:
        model_choice = str(body.get("model") or body.get("image_model") or "").strip()
        # Optional user-picked PLANNER model (the editor agent/planner model).
        agent_model = str(body.get("agent_model") or "").strip()
-        tools_offered = _scoped_editor_tools()
+        tools_offered = [tool for tool in _scoped_editor_tools() if tool not in disabled]
        scoped = _scoped(session, owner)
        trace: List[Dict[str, Any]] = [
-            {"type": "session", "session": scoped, "tools_offered": tools_offered},
+            {"type": "session", "session": _scope_label(scoped), "tools_offered": tools_offered},
        ]
        if not prompt:
            return JSONResponse({
@@ -1540,9 +1683,14 @@ def setup_editor_agent_routes() -> APIRouter:
            except Exception:
                raw = None
        _used = editor_agent_model.get_last_model()
-        model_used = (_used[0] if _used and _used[0]
-                      else (agent_model or editor_agent_model.local_model()))
-        plan = _parse_plan(raw) or _fallback_plan(prompt)
+        parsed = _parse_plan(raw)
+        if _used and _used[0]:
+            model_used = _used[0]
+        elif parsed:
+            model_used = agent_model or editor_agent_model.local_model()
+        else:
+            model_used = "fallback" if agent_model else editor_agent_model.local_model()
+        plan = parsed or _fallback_plan(prompt)
        _strengthened = style_guide.strengthen(prompt, list(plan.get("steps") or []))
        if _strengthened != plan.get("steps"):
            plan = {**plan, "steps": _strengthened,
@@ -1601,8 +1749,19 @@ def setup_editor_agent_routes() -> APIRouter:
                "results": [],
                "agent_model": model_used,
            })
+        # This route dispatches tools directly, outside execute_tool_block.
+        # Apply the same administrator tool switches before any step runs.
+        needed = {"plan_edit"}
+        for step in steps:
+            op = step.get("op")
+            needed.add(op if op in {"ai_edit_image", "generate_image"} else "run_editor_command")
+        if needed.intersection(disabled):
+            raise HTTPException(403, "Editor tool is disabled")
        # No image provider: stop before any edit runs and tell the user plainly
        # (zero canvas changes; nothing to roll back).
+        if _plan_uses_ai_content(steps):
+            from src.auth_helpers import require_privilege
+            require_privilege(request, "can_generate_images")
        if (kind or _plan_uses_ai_content(steps)) and not provider_available:
            trace.append({"type": "blocked", "reason": "image_provider_unavailable"})
            return JSONResponse({
@@ -1618,6 +1777,12 @@ def setup_editor_agent_routes() -> APIRouter:
                "results": [],
                "agent_model": model_used,
            })
+        needed = {"plan_edit"}
+        for step in steps:
+            op = step.get("op")
+            needed.add(op if op in {"ai_edit_image", "generate_image"} else "run_editor_command")
+        if needed.intersection(disabled):
+            raise HTTPException(403, "Editor tool is disabled")
        results: List[Dict[str, Any]] = []
        for step in steps:
            op = step.get("op")
@@ -1629,24 +1794,30 @@ def setup_editor_agent_routes() -> APIRouter:
                    results.append({"op": op, "ok": False, "error": "editor tools unavailable"})
                    break
                tool_payload = dict(params)
-                tool_payload.setdefault("session", session)
+                # Planner output is untrusted: it cannot redirect this turn to
+                # another editor session or override an explicit model choice.
+                tool_payload["session"] = session
                # Route to the user-picked model when one is selected.
                if model_choice:
-                    tool_payload.setdefault("model", model_choice)
+                    tool_payload["model"] = model_choice
                # Hand the AI step the canvas image the client already captured
                # for this request. Without it the tool falls back to a separate
                # bridge screenshot, which is not reliably answered right after a
                # selection step (the masked path was losing the canvas image).
                if isinstance(screenshot, str) and screenshot.startswith("data:image/"):
-                    tool_payload.setdefault("image", screenshot)
+                    tool_payload["image"] = screenshot
+                else:
+                    tool_payload.pop("image", None)
                tool_cls = AiEditImageTool if op == "ai_edit_image" else GenerateImageLayerTool
                try:
                    _desc, res = await tool_cls().execute(
                        json.dumps(tool_payload),
-                        {"owner": owner, "session_id": scoped},
+                        {"owner": owner, "session_id": _scope_label(scoped), "editor_session": session,
+                         "incognito": body.get("incognito") is True},
                    )
-                except Exception as exc:
-                    res = {"error": str(exc), "exit_code": 1}
+                except Exception:
+                    logger.exception("Editor image operation failed")
+                    res = {"error": "Editor image operation failed", "exit_code": 1}
                res = res if isinstance(res, dict) else {}
                ok = res.get("exit_code", 0) == 0
                step_result = {
@@ -1664,15 +1835,17 @@ def setup_editor_agent_routes() -> APIRouter:
                    break
                continue
            cid = uuid.uuid4().hex
-            pending[cid] = asyncio.get_event_loop().create_future()
+            fut = asyncio.get_event_loop().create_future()
+            pending[cid] = (owner, fut)
            _broadcast(scoped, {"id": cid, "op": op, "params": params})
            try:
-                res = await asyncio.wait_for(pending[cid], timeout=_BRIDGE_DEFAULT_TIMEOUT)
+                res = await asyncio.wait_for(pending[cid][1], timeout=_BRIDGE_DEFAULT_TIMEOUT)
            except asyncio.TimeoutError:
-                pending.pop(cid, None)
                results.append({"op": op, "ok": False, "error": "timeout"})
                trace.append({"type": "step", "op": op, "ok": False, "error": "timeout"})
                break
+            finally:
+                _expire_command(scoped, cid, fut)
            results.append(res)
            trace.append({"type": "step", "op": op, "ok": res.get("ok"), "result": res.get("result")})
            if res.get("ok") is False:
@@ -1683,13 +1856,16 @@ def setup_editor_agent_routes() -> APIRouter:
        if steps and not any(r.get("ok") is False for r in results):
            try:
                _info_id = uuid.uuid4().hex
-                pending[_info_id] = asyncio.get_event_loop().create_future()
+                _info_fut = asyncio.get_event_loop().create_future()
+                pending[_info_id] = (owner, _info_fut)
                _broadcast(scoped, {"id": _info_id, "op": "document.info", "params": {}})
-                _info = await asyncio.wait_for(pending[_info_id], timeout=60)
+                _info = await asyncio.wait_for(pending[_info_id][1], timeout=60)
                if isinstance(_info, dict) and isinstance(_info.get("result"), dict):
                    final_state = _info["result"]
            except Exception:
                final_state = {}
+            finally:
+                _expire_command(scoped, _info_id, _info_fut)
        planned_reply = reply
        reply = _verified_reply(prompt, steps, results, final_state, planned_reply)
        if special_note and special_note.strip() not in reply:
@@ -1726,6 +1902,7 @@ def setup_editor_agent_routes() -> APIRouter:
        ``edit`` (editing/inpainting models) or ``generate`` (text-to-image).
        """
        owner = _user(request)
+        is_admin = _is_admin(request)
        models: List[Dict[str, Any]] = []
        seen: set = set()
        try:
@@ -1748,22 +1925,32 @@ def setup_editor_agent_routes() -> APIRouter:
                    # recognisably image-capable — the same test the request
                    # router uses.
                    image_endpoint = getattr(ep, "model_type", None) == "image"
-                    provider = getattr(ep, "name", None) or getattr(ep, "base_url", "") or "image"
+                    endpoint_id = getattr(ep, "id", None)
+                    provider = getattr(ep, "name", None)
+                    if not provider:
+                        provider = (
+                            getattr(ep, "base_url", "")
+                            if is_admin
+                            else (f"Endpoint {endpoint_id}" if endpoint_id else "image")
+                        )
+                    provider = provider or "image"
                    for name in _endpoint_enabled_models(ep):
                        if not image_endpoint and not looks_like_image_generation_model(name):
                            continue
-                        key = (provider, name)
+                        key = (str(endpoint_id or provider), name)
                        if key in seen:
                            continue
                        seen.add(key)
-                        models.append({
+                        entry = {
                            "id": name,
                            "label": name,
                            "kind": "edit" if _EDIT_MODEL_RE.search(name) else "generate",
                            "provider": provider,
-                            "endpoint_id": getattr(ep, "id", None),
-                            "base_url": getattr(ep, "base_url", "") or "",
-                        })
+                            "endpoint_id": endpoint_id,
+                        }
+                        if is_admin:
+                            entry["base_url"] = getattr(ep, "base_url", "") or ""
+                        models.append(entry)
            finally:
                db.close()
        except Exception:
@@ -1774,42 +1961,55 @@ def setup_editor_agent_routes() -> APIRouter:
    async def editor_agent_models(request: Request) -> JSONResponse:
        """List the models the editor agent/planner can run on.

-        Each entry is ``{id, label, source, vision, base_url}`` where ``id`` is
+        Each entry is ``{id, label, source, vision}`` where ``id`` is
        passed as ``agent_model`` to /api/editor/plan or /api/editor/agent, and
        ``source`` is ``local`` (the local Qwen3.5-9B vision server) or
        ``hosted`` (the configured default/utility chat model that the planner
        falls back to).
+        For non-admin users, private URLs and internal probe status are omitted.
        """
        owner = _user(request)
+        is_admin = _is_admin(request)
        try:
            models = await editor_agent_model.list_editor_agent_models(owner)
+            if not is_admin:
+                sanitized = []
+                for m in models:
+                    m_copy = dict(m)
+                    m_copy.pop("base_url", None)
+                    sanitized.append(m_copy)
+                models = sanitized
        except Exception:
            logger.warning("editor agent-models lookup failed", exc_info=True)
            models = []
+
+        probe_info = {}
+        if is_admin:
+            probe_info = editor_agent_model.probe_status()
+            if not probe_info:
+                editor_agent_model.startup_probe()
+                probe_info = editor_agent_model.probe_status()
+
        return JSONResponse({
            "models": models,
-            "probe": editor_agent_model.probe_status(),
+            "probe": probe_info,
        })

    @router.post("/api/editor/self-check")
    async def editor_self_check(request: Request) -> JSONResponse:
        """Same-origin VL self-check: compare BEFORE/AFTER against the intent.

-        The local VL server (seneca :8097) sends no CORS headers, so the browser
-        cannot call it directly and the self-check silently "passed". This route
+        A configured vision server may not provide browser CORS headers. This route
        proxies the two images + intent to the agent VLM and returns
        ``{done, issues, retry_hint, text}`` (``done=True`` with
        ``reason="unavailable"`` on any failure so the client never loops).
        """
        owner = _user(request)
-        try:
-            body = await request.json()
-        except Exception:
-            body = {}
+        body = await _json_object(request)
        result = await editor_agent_model.self_check(
            body.get("before"),
            body.get("after"),
-            str(body.get("prompt") or body.get("intent") or ""),
+            _prompt(body.get("prompt") or body.get("intent")),
            model=str(body.get("model") or "").strip() or None,
            owner=owner,
        )
@@ -1827,18 +1827,25 @@ def setup_email_routes():
        # a cached message body.
        return (account_id or "", folder, str(uid), owner)

-    def _list_cache_get(key):
-        v = _LIST_CACHE.get(key)
-        if not v: return None
-        if v[0] < _time.monotonic():
-            _LIST_CACHE.pop(key, None)
-            return None
-        return v[1]
-
    _LIST_STALE = {}
+    _LIST_LOCK = _threading.RLock()
+    _LIST_CACHE_LOCK = _LIST_LOCK
+    # Invalidation fences reads already in flight, including background refresh.
+    _LIST_EPOCH = [0]
+    _LIST_CACHE_GENERATION = _LIST_EPOCH
+
+    def _list_cache_get(key):
+        with _LIST_LOCK:
+            v = _LIST_CACHE.get(key)
+            if not v: return None
+            if v[0] < _time.monotonic():
+                _LIST_CACHE.pop(key, None)
+                return None
+            return v[1]

    def _list_stale_get(key):
-        return _LIST_STALE.get(key)
+        with _LIST_LOCK:
+            return _LIST_STALE.get(key)

    def _list_stale_put(key, value):
        _LIST_STALE[key] = value
@@ -1849,13 +1856,13 @@ def setup_email_routes():
    _LIST_REFRESHING = set()

    def _list_cache_put(key, value):
-        _LIST_CACHE[key] = (_time.monotonic() + _LIST_TTL, value)
-        # Also snapshot the last-good response for stale-while-revalidate.
-        _list_stale_put(key, value)
-        # Cap size
-        if len(_LIST_CACHE) > 64:
-            for k in list(_LIST_CACHE.keys())[:-32]:
-                _LIST_CACHE.pop(k, None)
+        with _LIST_LOCK:
+            _LIST_CACHE[key] = (_time.monotonic() + _LIST_TTL, value)
+            # Also snapshot the last-good response for stale-while-revalidate.
+            _list_stale_put(key, value)
+            if len(_LIST_CACHE) > 64:
+                for k in list(_LIST_CACHE.keys())[:-32]:
+                    _LIST_CACHE.pop(k, None)

    def _schedule_list_refresh(sync_args, cache_key, folder, account_id, owner):
        """Refresh a list snapshot off the event loop, at most once per key.
@@ -1863,15 +1870,20 @@ def setup_email_routes():
        Runs the blocking IMAP fetch in a daemon thread, then repopulates both
        the TTL cache and the stale snapshot so the next list view is warm.
        """
-        if cache_key in _LIST_REFRESHING:
-            return
-        _LIST_REFRESHING.add(cache_key)
+        with _LIST_LOCK:
+            if cache_key in _LIST_REFRESHING:
+                return
+            _LIST_REFRESHING.add(cache_key)
+            epoch = _LIST_EPOCH[0]

        def _run():
            try:
                refreshed = _list_emails_sync(*sync_args)
                if refreshed and not refreshed.get("error"):
-                    _list_cache_put(cache_key, refreshed)
+                    with _LIST_LOCK:
+                        if epoch != _LIST_EPOCH[0]:
+                            return
+                        _list_cache_put(cache_key, refreshed)
                    try:
                        _schedule_recent_email_warm(
                            refreshed.get("emails") or [], folder, account_id, owner)
@@ -1880,7 +1892,8 @@ def setup_email_routes():
            except Exception as exc:  # pragma: no cover - background best effort
                logger.debug("email list background refresh failed: %s", exc)
            finally:
-                _LIST_REFRESHING.discard(cache_key)
+                with _LIST_LOCK:
+                    _LIST_REFRESHING.discard(cache_key)

        _threading.Thread(target=_run, daemon=True, name="email-list-refresh").start()

@@ -1917,37 +1930,74 @@ def setup_email_routes():
                hook(account_id, folder)
            except Exception:
                pass
-        if account_id is None and folder is None:
-            _LIST_CACHE.clear()
-            return
-        for k in list(_LIST_CACHE.keys()):
-            k_acct = k[0] if len(k) > 0 else ""
-            k_folder = k[1] if len(k) > 1 else ""
-            if (account_id is None or k_acct == (account_id or "")) and \
-               (folder is None or k_folder == folder):
-                _LIST_CACHE.pop(k, None)
+        with _LIST_LOCK:
+            _LIST_EPOCH[0] += 1
+            if account_id is None and folder is None:
+                _LIST_CACHE.clear()
+                _LIST_STALE.clear()
+                return
+            for cache in (_LIST_CACHE, _LIST_STALE):
+                for k in list(cache.keys()):
+                    k_acct = k[0] if len(k) > 0 else ""
+                    k_folder = k[1] if len(k) > 1 else ""
+                    if (account_id is None or k_acct == (account_id or "")) and \
+                       (folder is None or k_folder == folder):
+                        cache.pop(k, None)
+
+    def _index_update_flags(owner, account_id, folder, uid, flag, add):
+        with _LIST_LOCK:
+            _email_index_update_flags(owner, account_id, folder, uid, flag, add)
+            _invalidate_list_cache(account_id, folder)
+
+    def _index_delete(owner, account_id, folder, uid):
+        with _LIST_LOCK:
+            _email_index_delete(owner, account_id, folder, uid)
+            _invalidate_list_cache(account_id, folder)

    def _update_list_cache_seen(account_id, folder, uid, seen: bool):
        uid_s = str(uid)
-        for key, (expires_at, value) in list(_LIST_CACHE.items()):
-            if key[0] != (account_id or "") or key[1] != folder:
-                continue
-            emails = list((value or {}).get("emails") or [])
-            changed = False
-            if seen and key[2] == "unread":
-                kept = [e for e in emails if str((e or {}).get("uid") or "") != uid_s]
-                if len(kept) != len(emails):
-                    value = dict(value)
-                    value["emails"] = kept
-                    value["total"] = max(0, int(value.get("total") or 0) - (len(emails) - len(kept)))
-                    changed = True
-            else:
-                for e in emails:
-                    if str((e or {}).get("uid") or "") == uid_s:
-                        e["is_read"] = bool(seen)
+        with _LIST_LOCK:
+            for key, (expires_at, value) in list(_LIST_CACHE.items()):
+                if key[0] != (account_id or "") or key[1] != folder:
+                    continue
+                emails = list((value or {}).get("emails") or [])
+                changed = False
+                if seen and key[2] == "unread":
+                    kept = [e for e in emails if str((e or {}).get("uid") or "") != uid_s]
+                    if len(kept) != len(emails):
+                        value = dict(value)
+                        value["emails"] = kept
+                        value["total"] = max(0, int(value.get("total") or 0) - (len(emails) - len(kept)))
                        changed = True
-            if changed:
-                _LIST_CACHE[key] = (expires_at, value)
+                else:
+                    for e in emails:
+                        if str((e or {}).get("uid") or "") == uid_s:
+                            e["is_read"] = bool(seen)
+                            changed = True
+                if changed:
+                    _LIST_CACHE[key] = (expires_at, value)
+                    if key in _LIST_STALE:
+                        _LIST_STALE[key] = value
+
+            for key, value in list(_LIST_STALE.items()):
+                if key[0] != (account_id or "") or key[1] != folder:
+                    continue
+                emails = list((value or {}).get("emails") or [])
+                changed = False
+                if seen and key[2] == "unread":
+                    kept = [e for e in emails if str((e or {}).get("uid") or "") != uid_s]
+                    if len(kept) != len(emails):
+                        value = dict(value)
+                        value["emails"] = kept
+                        value["total"] = max(0, int(value.get("total") or 0) - (len(emails) - len(kept)))
+                        changed = True
+                else:
+                    for e in emails:
+                        if str((e or {}).get("uid") or "") == uid_s:
+                            e["is_read"] = bool(seen)
+                            changed = True
+                if changed:
+                    _LIST_STALE[key] = value

    def _read_cache_get(key):
        v = _READ_CACHE.get(key)
@@ -2327,6 +2377,8 @@ def setup_email_routes():
        SECURITY: `owner` is propagated so when `account_id` is missing,
        the fallback config lookup is scoped to this user's accounts only.
        """
+        with _LIST_CACHE_LOCK:
+            index_generation = _LIST_CACHE_GENERATION[0]
        conn = None
        conn_ok = False
        try:
@@ -2621,7 +2673,9 @@ def setup_email_routes():
                    if parsed:
                        fetched_emails.append(parsed)
                        cached_rows[parsed["uid"]] = parsed
-                _email_index_upsert(owner, account_id, folder, fetched_emails)
+                with _LIST_CACHE_LOCK:
+                    if index_generation == _LIST_CACHE_GENERATION[0]:
+                        _email_index_upsert(owner, account_id, folder, fetched_emails)
                for uid_num in uid_order:
                    row = cached_rows.get(uid_num)
                    if not row:
@@ -2915,7 +2969,7 @@ def setup_email_routes():
        # with a `stale` marker and refresh in the background so the next view
        # is warm. Blocking IMAP only remains for a genuine cold start with no
        # snapshot and no indexed rows (e.g. a brand-new account/folder).
-        if not from_addr and not has_attachments and not (date_from or date_to):
+        if not manual_refresh and not from_addr and not has_attachments and not (date_from or date_to):
            snapshot = _list_stale_get(ck)
            if snapshot is None:
                try:
@@ -2950,6 +3004,8 @@ def setup_email_routes():
                    ck, folder, account_id, owner,
                )
                return payload
+        with _LIST_CACHE_LOCK:
+            cache_generation = _LIST_CACHE_GENERATION[0]
        result = await _asyncio.to_thread(
            _list_emails_sync, folder, limit, offset, filter, account_id, from_addr,
            bool(has_attachments), owner, manual_refresh, date_from or "", date_to or "",
@@ -2958,7 +3014,9 @@ def setup_email_routes():
            if offset == 0 and not from_addr and not has_attachments and filter in ("all", "unread", "unanswered", "undone"):
                _record_email_received_events(owner, account_id, folder, result.get("emails") or [])
                _schedule_recent_email_warm(result.get("emails") or [], folder, account_id, owner)
-            _list_cache_put(ck, result)
+            with _LIST_CACHE_LOCK:
+                if cache_generation == _LIST_CACHE_GENERATION[0]:
+                    _list_cache_put(ck, result)
        elapsed_ms = int((_time.monotonic() - started_at) * 1000)
        if elapsed_ms > 1500:
            logger.warning(
@@ -3306,7 +3364,7 @@ def setup_email_routes():
                        conn.select(_q(folder))
                        moved = _move_email_message(conn, uid, "Junk", role="junk")
                    if moved:
-                        _email_index_delete(owner, account_id, folder, uid)
+                        _index_delete(owner, account_id, folder, uid)
                        _invalidate_list_cache(account_id)
                except Exception:
                    logger.debug("unsubscribe move-to-spam skipped", exc_info=True)
@@ -3323,7 +3381,7 @@ def setup_email_routes():
                            if deleted:
                                conn.expunge()
                    if deleted:
-                        _email_index_delete(owner, account_id, folder, uid)
+                        _index_delete(owner, account_id, folder, uid)
                        _invalidate_list_cache(account_id)
                except Exception as exc:
                    delete_error = "Email was unsubscribed but could not be moved to Trash"
@@ -3405,7 +3463,7 @@ def setup_email_routes():
                        if moved:
                            changed += 1
                            cleaned_uids.append(uid)
-                            _email_index_delete(owner, account_id, folder, uid)
+                            _index_delete(owner, account_id, folder, uid)
                        else:
                            failed += 1
                    except Exception:
@@ -3494,6 +3552,8 @@ def setup_email_routes():
        folder (Gmail does), we transparently swap to All Mail so the
        search surfaces archived / labelled emails too. Plain IMAP
        accounts fall back to whatever folder the caller specified."""
+        with _LIST_CACHE_LOCK:
+            index_generation = _LIST_CACHE_GENERATION[0]
        if not q or len(q) < 2:
            return {"emails": [], "total": 0, "query": q}
        # CRLF in q would terminate the IMAP command early — reject defensively.
@@ -3637,7 +3697,9 @@ def setup_email_routes():
                    except Exception as e:
                        logger.warning(f"Error parsing search result {uid}: {e}")
                        continue
-                _email_index_upsert(owner, account_id, effective_folder, fetched_emails)
+                with _LIST_CACHE_LOCK:
+                    if index_generation == _LIST_CACHE_GENERATION[0]:
+                        _email_index_upsert(owner, account_id, effective_folder, fetched_emails)

                return {
                    "emails": emails,
@@ -3774,8 +3836,7 @@ def setup_email_routes():
            # accepted it, so the index and list cache cannot drift ahead of
            # the mailbox.
            if mark_seen and not mark_seen_failed:
-                _email_index_update_flags(owner, account_id, folder, uid, "\\Seen", True)
-                _update_list_cache_seen(account_id, folder, uid, True)
+                _index_update_flags(owner, account_id, folder, uid, "\\Seen", True)

            related_attachments = []
            if full and not _has_visible_attachments(msg):
@@ -3914,8 +3975,7 @@ def setup_email_routes():
                status, _ = conn.uid("STORE", _uid_bytes(uid), "+FLAGS", "(\\Seen)")
                if status != "OK":
                    return False
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Seen", True)
-            _update_list_cache_seen(account_id, folder, uid, True)
+            _index_update_flags(owner, account_id, folder, uid, "\\Seen", True)
            return True
        except Exception as e:
            logger.warning(f"mark-seen after cached read failed uid={uid}: {e}")
@@ -5147,7 +5207,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _store_email_flag(conn, uid, "\\Seen", add=False):
                    return {"success": False, "error": "Email not found"}
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Seen", False)
+            _index_update_flags(owner, account_id, folder, uid, "\\Seen", False)
            _invalidate_list_cache(account_id, folder)
            return {"success": True}
        except Exception as e:
@@ -5167,7 +5227,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _store_email_flag(conn, uid, "\\Flagged", add=bool(on)):
                    return {"success": False, "error": "Email not found"}
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Flagged", bool(on))
+            _index_update_flags(owner, account_id, folder, uid, "\\Flagged", bool(on))
            _invalidate_list_cache(account_id, folder)
            return {"success": True, "flagged": bool(on)}
        except Exception as e:
@@ -5185,7 +5245,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _store_email_flag(conn, uid, "\\Seen", add=True):
                    return {"success": False, "error": "Email not found"}
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Seen", True)
+            _index_update_flags(owner, account_id, folder, uid, "\\Seen", True)
            _invalidate_list_cache(account_id, folder)
            return {"success": True}
        except Exception as e:
@@ -5205,7 +5265,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _move_email_message(conn, uid, "Archive", role="archive"):
                    return {"success": False, "error": "Email not found"}
-            _email_index_delete(owner, account_id, folder, uid)
+            _index_delete(owner, account_id, folder, uid)
            _invalidate_list_cache(account_id)
            return {"success": True}
        except Exception as e:
@@ -5236,7 +5296,7 @@ def setup_email_routes():
                    # click or by another mailbox client; it is already gone
                    # from the requested folder, so do not trap the UI on a
                    # permanent “Email not found” error.
-                    _email_index_delete(owner, account_id, folder, str(uid))
+                    _index_delete(owner, account_id, folder, str(uid))
                    _invalidate_list_cache(account_id, folder)
                    return {"success": True, "already_deleted": True}
                trash_folder = _resolve_mail_folder(conn, "Trash", "trash")
@@ -5254,9 +5314,9 @@ def setup_email_routes():
                if not _move_email_message(conn, resolved_uid, trash_folder, role="trash"):
                    logger.warning("Email delete Trash move failed uid=%s resolved_uid=%s folder=%s trash=%s", uid, resolved_uid, folder, trash_folder)
                    return {"success": False, "error": "Could not move email to Trash"}
-            _email_index_delete(owner, account_id, folder, resolved_uid)
+            _index_delete(owner, account_id, folder, resolved_uid)
            if resolved_uid != str(uid):
-                _email_index_delete(owner, account_id, folder, str(uid))
+                _index_delete(owner, account_id, folder, str(uid))
            _invalidate_list_cache(account_id)
            return {"success": True}
        except Exception as e:
@@ -5272,7 +5332,7 @@ def setup_email_routes():
                if not _store_email_flag(conn, uid, "\\Deleted", add=True):
                    return {"success": False, "error": "Email not found"}
                conn.expunge()
-            _email_index_delete(owner, account_id, folder, uid)
+            _index_delete(owner, account_id, folder, uid)
            _invalidate_list_cache(account_id, folder)
            return {"success": True}
        except Exception as e:
@@ -5340,7 +5400,7 @@ def setup_email_routes():
                            pending_expunge.append(uid)
                            continue
                        deleted_uids.append(uid)
-                        _email_index_delete(owner, account_id, folder, uid)
+                        _index_delete(owner, account_id, folder, uid)
                    except Exception:
                        failed_uids.append(uid)
                        logger.debug("Bulk email delete failed for uid=%s", uid, exc_info=True)
@@ -5362,7 +5422,7 @@ def setup_email_routes():
                    if expunge_ok:
                        for uid in pending_expunge:
                            deleted_uids.append(uid)
-                            _email_index_delete(owner, account_id, folder, uid)
+                            _index_delete(owner, account_id, folder, uid)
                    else:
                        # Prioritize preservation over cleanup: unflag \Deleted from our
                        # copied messages so future EXPUNGE operations do not destroy them.
@@ -5481,7 +5541,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _move_email_message(conn, uid, dest):
                    return {"success": False, "error": f"Failed to move to {dest}"}
-            _email_index_delete(owner, account_id, folder, uid)
+            _index_delete(owner, account_id, folder, uid)
            _invalidate_list_cache(account_id)
            return {"success": True}
        except Exception as e:
@@ -5567,7 +5627,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _store_email_flag(conn, uid, "\\Answered", add=True):
                    return {"success": False, "error": "Email not found"}
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Answered", True)
+            _index_update_flags(owner, account_id, folder, uid, "\\Answered", True)
            _clear_done_response_tags(owner, account_id, folder, uid)
            _invalidate_list_cache(account_id, folder)
            return {"success": True}
@@ -5583,7 +5643,7 @@ def setup_email_routes():
                conn.select(_q(folder))
                if not _store_email_flag(conn, uid, "\\Answered", add=False):
                    return {"success": False, "error": "Email not found"}
-            _email_index_update_flags(owner, account_id, folder, uid, "\\Answered", False)
+            _index_update_flags(owner, account_id, folder, uid, "\\Answered", False)
            _invalidate_list_cache(account_id, folder)
            return {"success": True}
        except Exception as e:
@@ -6250,7 +6310,7 @@ def setup_email_routes():
                            try:
                                st, _sel = imap.select(_q(_source_folder), readonly=False)
                                if st == "OK" and _store_email_flag(imap, _source_uid, "\\Answered", add=True):
-                                    _email_index_update_flags(owner, _account_id, _source_folder, _source_uid, "\\Answered", True)
+                                    _index_update_flags(owner, _account_id, _source_folder, _source_uid, "\\Answered", True)
                                    _clear_done_response_tags(owner, _account_id, _source_folder, _source_uid)
                                    _invalidate_list_cache(_account_id, _source_folder)
                                    logger.info(f"Marked source UID {_source_uid} as \\Answered in {_source_folder}")
@@ -683,9 +683,15 @@ def _visible_image_endpoint_for_base(db, base: str, owner: str | None, model: st
                    configured.update(v for v in values if isinstance(v, str))
                except (TypeError, ValueError):
                    pass
-            if model not in configured or not looks_like_image_generation_model(model):
-                continue
-        if _normalize_image_endpoint_base(getattr(ep, "base_url", "")) == target:
+            if model:
+                if model not in configured or not looks_like_image_generation_model(model):
+                    continue
+            else:
+                if not any(looks_like_image_generation_model(v) for v in configured):
+                    continue
+        ep_id = str(getattr(ep, "id", "") or "")
+        ep_base = _normalize_image_endpoint_base(getattr(ep, "base_url", ""))
+        if (ep_id and (base == ep_id or target == ep_id)) or (ep_base and ep_base == target):
            if owner and getattr(ep, "owner", None) == owner:
                return ep
            if fallback is None:
@@ -712,7 +718,7 @@ async def _fetch_result_image_b64(url: str) -> Optional[str]:
    )
    if not ok:
        raise HTTPException(502, f"Upstream returned an unsafe image URL: {reason}")
-    async with httpx.AsyncClient(timeout=60) as c2:
+    async with httpx.AsyncClient(timeout=60, follow_redirects=False) as c2:
        ir = await c2.get(url)
        if ir.status_code == 200:
            return base64.b64encode(ir.content).decode()
@@ -779,14 +785,17 @@ async def _forward_seneca_image_op(
        except Exception:
            pass
        raise HTTPException(r.status_code if r.status_code in (400, 404, 422) else 502, detail)
-    result = r.json()
+    try:
+        result = r.json()
+    except ValueError as exc:
+        raise HTTPException(502, "Image endpoint returned invalid JSON") from exc
    raw_b64: Optional[str] = None
    used_model = ""
    if isinstance(result, dict):
        used_model = str(result.get("model") or "")
        data = result.get("data")
        if isinstance(data, list) and data:
-            item = data[0] or {}
+            item = data[0] if isinstance(data[0], dict) else {}
            raw_b64 = item.get("b64_json") or None
            if not raw_b64 and item.get("url"):
                raw_b64 = await _fetch_result_image_b64(item["url"])
@@ -1727,7 +1736,7 @@ def setup_gallery_routes() -> APIRouter:
        requested_base = (body.pop("_endpoint", "") or "").rstrip("/")
        # SSRF hardening: validate a client-supplied endpoint before any
        # outbound request (mirrors routes/embedding_routes.py).
-        if requested_base:
+        if requested_base and "://" in requested_base:
            from src.url_safety import check_outbound_url
            ok, reason = check_outbound_url(
                requested_base,
@@ -1842,8 +1851,8 @@ def setup_gallery_routes() -> APIRouter:
            headers = {"Authorization": f"Bearer {api_key}"}
            try:
                logger.debug(
-                    "inpaint_proxy provider edit -> prompt=%r model=%r size=%r base=%s",
-                    body.get("prompt", ""), oa_model, size, base,
+                    "inpaint_proxy provider edit -> model=%r size=%r base=%s",
+                    oa_model, size, base,
                )
                async with httpx.AsyncClient(timeout=300) as client:
                    if is_openrouter:
@@ -1978,9 +1987,9 @@ def setup_gallery_routes() -> APIRouter:
                        finally:
                            _restore_ms[0] += (time.perf_counter() - _rs) * 1000.0
                    logger.debug(
-                        "inpaint_proxy self-hosted /images/edits -> prompt=%r model=%r "
+                        "inpaint_proxy self-hosted /images/edits -> model=%r "
                        "size=%r steps=%r endpoint=%s",
-                        data.get("prompt"), data.get("model"), data.get("size"),
+                        data.get("model"), data.get("size"),
                        data.get("steps"), base,
                    )
                    _prep_ms = (time.perf_counter() - _t0) * 1000.0
@@ -2073,7 +2082,7 @@ def setup_gallery_routes() -> APIRouter:
        runs off the event loop (large images).
        """
        requested_base = (body.pop("_endpoint", "") or "").rstrip("/")
-        if requested_base:
+        if requested_base and "://" in requested_base:
            from src.url_safety import check_outbound_url
            ok, reason = check_outbound_url(
                requested_base,
@@ -2166,26 +2175,38 @@ def setup_gallery_routes() -> APIRouter:
        try:
            ep = None
            if endpoint_id:
-                ep = owner_filter(
-                    db.query(ModelEndpoint).filter(ModelEndpoint.id == endpoint_id),
-                    ModelEndpoint, user,
-                ).first()
-            if ep is None and requested_base:
+                ep = _visible_image_endpoint_for_base(db, endpoint_id, user)
+                if ep is None:
+                    return {"available": False, "reason": "endpoint not found or disabled"}
+            elif requested_base:
                ep = _visible_image_endpoint_for_base(db, requested_base, user)
-            if ep is None:
+                if ep is None:
+                    return {"available": False, "reason": "endpoint not found or disabled"}
+            else:
                ep = _first_visible_image_endpoint(db, user)
            if ep is None:
                return {"available": False, "reason": "no image endpoint configured"}
            base = ep.base_url.rstrip("/")
        finally:
            db.close()
+
+        from src.url_safety import check_outbound_url
+        block_private = os.getenv("IMAGE_BLOCK_PRIVATE_IPS", "false").lower() == "true"
+        ok, reason = check_outbound_url(base, block_private=block_private)
+        if not ok:
+            # CodeQL #1203: Never expose internal addresses, resolver errors or raw
+            # exception details to clients or logs. Use a stable diagnostic message
+            # without interpolating untrusted exception content or destination strings.
+            logger.warning("edit-progress endpoint rejected: outbound URL policy check failed")
+            return {"available": False, "reason": "endpoint URL rejected"}
+
        if not base.endswith("/v1"):
            base += "/v1"
        # Dynamic path segment (validated token above), so not routed through
        # _join_checked_gallery_endpoint's exact-match whitelist.
        url = f"{base}/images/progress/{request_id}"
        try:
-            async with httpx.AsyncClient(timeout=10) as client:
+            async with httpx.AsyncClient(timeout=10, follow_redirects=False) as client:
                r = await client.get(url)
            if r.status_code == 200:
                data = r.json()
@@ -2223,7 +2244,7 @@ def setup_gallery_routes() -> APIRouter:
        # below, so validate it first (mirrors routes/embedding_routes.py).
        # Local-first means loopback/LAN is allowed by default; the cloud
        # metadata range and non-HTTP(S) schemes are always rejected.
-        if requested_base:
+        if requested_base and "://" in requested_base:
            from src.url_safety import check_outbound_url
            ok, reason = check_outbound_url(
                requested_base,
@@ -2250,7 +2271,7 @@ def setup_gallery_routes() -> APIRouter:
            # so the outbound URL never depends directly on request-body input.
            db = SessionLocal()
            try:
-                ep = _visible_image_endpoint_for_base(db, requested_base, user)
+                ep = _visible_image_endpoint_for_base(db, requested_base, user, model)
                if not ep:
                    raise HTTPException(403, "Choose a registered image endpoint")
                base = ep.base_url.rstrip("/")
@@ -5,6 +5,7 @@ import os
 import uuid
 import urllib.parse
 import html
+import secrets
 from pathlib import Path
 from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import RedirectResponse, HTMLResponse
@@ -12,7 +13,7 @@ import logging
 import httpx

 from core.database import McpServer, SessionLocal
-from core.middleware import require_admin
+from core.middleware import INTERNAL_TOOL_HEADER, INTERNAL_TOOL_TOKEN, require_admin
 from src.constants import DATA_DIR, MCP_OAUTH_DIR
 from src.mcp_manager import McpManager

@@ -424,6 +425,11 @@ def setup_mcp_routes(mcp_manager: McpManager):
        Expects JSON body: {"disabled": ["tool_name_1", "tool_name_2"]}
        """
        require_admin(request)
+        internal_token = request.headers.get(INTERNAL_TOOL_HEADER)
+        if internal_token and secrets.compare_digest(internal_token, INTERNAL_TOOL_TOKEN):
+            # Same boundary as POST /api/tools: an agent turn must not be able
+            # to re-enable MCP tools an admin switched off.
+            raise HTTPException(403, "Change MCP tool policy in Settings > Integrations, not from chat")
        db = SessionLocal()
        try:
            srv = db.query(McpServer).filter(McpServer.id == server_id).first()
@@ -7,6 +7,7 @@ import json
 import hashlib
 import ipaddress
 import socket
+import secrets
 import time as _time
 import logging
 import threading
@@ -3091,6 +3092,12 @@ def setup_model_routes(model_discovery):
    def update_tools(body: ToolsUpdate, request: Request):
        """Update which tools are disabled."""
        require_admin(request)
+        from core.middleware import INTERNAL_TOOL_HEADER, INTERNAL_TOOL_TOKEN
+        internal_token = request.headers.get(INTERNAL_TOOL_HEADER)
+        if internal_token and secrets.compare_digest(internal_token, INTERNAL_TOOL_TOKEN):
+            # Owner impersonation can carry an admin username, so check the
+            # authenticated transport rather than request.state.current_user.
+            raise HTTPException(403, "Change tool policy in Settings > Agent Tools, not from chat")
        settings = _load_settings()
        settings["disabled_tools"] = body.disabled
        _save_settings(settings)
@@ -290,14 +290,9 @@ def setup_research_routes(research_handler, session_manager=None) -> APIRouter:
        # (most sessions have none), not an error. Return HTTP 200 with an
        # explicit empty status so loading a session does not log a spurious
        # 404; every client treats a non-"running" status as idle anyway.
-        # A session whose research exists but belongs to ANOTHER user stays a
-        # 404, so we do not leak the existence of someone else's research.
+        # Research owned by ANOTHER user answers identically, so the response
+        # does not reveal whether that research exists.
        if not _owns_in_memory(session_id, user):
-            exists = session_id in getattr(research_handler, "_active_tasks", {})
-            if not exists:
-                exists = _find_research_path(session_id) is not None
-            if exists:
-                raise HTTPException(404, "No research found for this session")
            return {"status": "none"}
        status = research_handler.get_status(session_id)
        if status is None:
@@ -25,11 +25,12 @@ from src.auth_helpers import effective_user, is_delegated_credential
 from src.owner_identity import auth_disabled, is_request_sentinel_owner
 from src.attachment_refs import attachment_refs_from_metadata
 from src.constants import GENERATED_IMAGES_DIR
-from src.path_confinement import is_inside
+from src.path_confinement import PathEscape, canonical_root, confine, is_inside
 from src.upload_handler import (
    UploadCleanupSafetyError,
    count_recent_uploads,
    extract_upload_ids,
+    secure_filename,
 )

 logger = logging.getLogger(__name__)
@@ -153,30 +154,47 @@ def setup_upload_routes(upload_handler):

    def _upload_root() -> str:
        from src.constants import UPLOAD_DIR
-        return os.path.realpath(getattr(upload_handler, "upload_dir", UPLOAD_DIR))
+        return canonical_root(getattr(upload_handler, "upload_dir", UPLOAD_DIR))

    def _path_inside_upload_dir(path: str) -> bool:
        return is_inside(_upload_root(), path)

    def _resolve_upload_path(file_id: str) -> str:
-        from src.constants import UPLOAD_DIR
-        upload_root = getattr(upload_handler, "upload_dir", UPLOAD_DIR)
-        direct = os.path.join(upload_root, file_id)
+        safe_id = secure_filename(os.path.basename(file_id))
+        if not safe_id:
+            raise HTTPException(400, "Invalid file ID")
+        root = _upload_root()
+
+        direct = os.path.normpath(os.path.join(root, safe_id))
        if os.path.lexists(direct):
-            if not _path_inside_upload_dir(direct):
+            try:
+                canonical_direct = confine(root, direct, allow_root=False)
+            except (PathEscape, ValueError):
                raise HTTPException(403, "Access denied")
-            if os.path.isfile(direct):
-                return direct
+            if os.path.isfile(canonical_direct):
+                return canonical_direct
            raise HTTPException(404, "File not found")

-        for root, _dirs, files in os.walk(upload_root, followlinks=False):
-            if file_id not in files:
-                continue
-            path = os.path.join(root, file_id)
-            if not _path_inside_upload_dir(path):
+        info = _load_upload_info(safe_id)
+        stored_path = (info or {}).get("path")
+        if stored_path:
+            try:
+                canonical_stored = confine(root, stored_path, allow_root=False)
+                if os.path.isfile(canonical_stored):
+                    return canonical_stored
+            except (PathEscape, ValueError):
                raise HTTPException(403, "Access denied")
-            if os.path.isfile(path):
-                return path
+
+        for walk_root, _dirs, files in os.walk(root, followlinks=False):
+            if safe_id not in files:
+                continue
+            cand = os.path.normpath(os.path.join(walk_root, safe_id))
+            try:
+                canonical_cand = confine(root, cand, allow_root=False)
+            except (PathEscape, ValueError):
+                raise HTTPException(403, "Access denied")
+            if os.path.isfile(canonical_cand):
+                return canonical_cand
            raise HTTPException(404, "File not found")

        raise HTTPException(404, "File not found")
@@ -435,52 +453,79 @@ def setup_upload_routes(upload_handler):
            logger.error(f"Failed to get upload stats: {e}")
            raise HTTPException(500, "Failed to get upload statistics")

-    @router.get("/{file_id}")
+    @router.api_route("/{file_id}", methods=["GET", "HEAD"])
    async def download_file(request: Request, file_id: str, thumb: int = 0):
-        """Serve an uploaded file by its ID. `?thumb=1` returns a small cached
-        JPEG thumbnail for images (used by chat attachment previews) so the
-        client isn't downloading the full-resolution photo just to show it tiny."""
+        """Serve an uploaded file by its ID or probe via HEAD. `?thumb=1` returns
+        a small cached JPEG thumbnail for images (used by chat attachment previews)
+        so the client isn't downloading the full-resolution photo just to show it tiny."""
        if not upload_handler.validate_upload_id(file_id):
            raise HTTPException(400, "Invalid file ID")
+        safe_file_id = secure_filename(os.path.basename(file_id))
        import mimetypes as _mt
        # Look up original filename and owner from uploads.json
-        original_name = file_id
+        original_name = safe_file_id
        # _load_upload_index() tolerates a missing/corrupt uploads.json (it falls
        # back to the .bak sibling, then to {}), so a truncated DB degrades to
        # "no metadata" instead of a 500 from an unhandled JSONDecodeError.
        db = upload_handler._load_upload_index()
-        info = next((fi for fi in db.values() if fi.get("id") == file_id), None)
+        info = next((fi for fi in db.values() if fi.get("id") == safe_file_id), None)
        if info:
-            original_name = info.get("name", file_id)
+            original_name = info.get("name", safe_file_id)
        file_owner = info.get("owner") if info else None
        _verify_upload_access(request, file_owner)
-        path = _resolve_upload_path(file_id)
+        upload_root = _upload_root()
+        path = _resolve_upload_path(safe_file_id)
+        try:
+            path = confine(upload_root, path, allow_root=False)
+        except (PathEscape, ValueError):
+            raise HTTPException(403, "Access denied")
+        if not path.startswith(upload_root + os.sep) or not _path_inside_upload_dir(path):
+            raise HTTPException(403, "Access denied")
        mime = (info or {}).get("mime") or _mt.guess_type(path)[0] or "application/octet-stream"
        from fastapi.responses import FileResponse
        # Downscaled thumbnail for image previews — generated once and cached.
+        # Skip generation during HEAD probe to avoid loading/processing whole image.
        if thumb and mime.startswith("image/"):
+            thumb_dir = os.path.normpath(os.path.join(upload_root, ".thumbs"))
+            thumb_path = os.path.normpath(os.path.join(thumb_dir, safe_file_id + ".jpg"))
            try:
-                from PIL import Image, ImageOps
-                thumb_dir = os.path.join(_upload_root(), ".thumbs")
-                os.makedirs(thumb_dir, exist_ok=True)
-                thumb_path = os.path.join(thumb_dir, file_id + ".jpg")
-                if (not os.path.exists(thumb_path)
-                        or os.path.getmtime(thumb_path) < os.path.getmtime(path)):
-                    im = Image.open(path)
-                    # iPhone / camera JPEGs encode rotation in EXIF rather than
-                    # the pixel data. Browsers honour that on the original via
-                    # image-orientation:from-image, but PIL strips EXIF when it
-                    # saves the JPEG thumb, leaving the pixels sideways. Bake
-                    # the rotation into the pixels before thumbnailing.
-                    im = ImageOps.exif_transpose(im)
-                    im.thumbnail((320, 320))
-                    if im.mode not in ("RGB", "L"):
-                        im = im.convert("RGB")
-                    im.save(thumb_path, "JPEG", quality=80)
-                return FileResponse(thumb_path, media_type="image/jpeg", headers=UPLOAD_RESPONSE_HEADERS)
-            except Exception as e:
-                logger.warning(f"Thumbnail generation failed for {file_id}: {e}")
-                # Fall through to the full image.
+                thumb_path = confine(upload_root, thumb_path, allow_root=False)
+            except (PathEscape, ValueError):
+                raise HTTPException(403, "Access denied")
+            if not thumb_path.startswith(thumb_dir + os.sep) or not _path_inside_upload_dir(thumb_path):
+                raise HTTPException(403, "Access denied")
+            if request.method == "HEAD":
+                if (os.path.isfile(thumb_path)
+                        and os.path.getmtime(thumb_path) >= os.path.getmtime(path)):
+                    return FileResponse(thumb_path, media_type="image/jpeg", headers=UPLOAD_RESPONSE_HEADERS)
+                # GET may generate a JPEG or fall back to the original on failure.
+                # Neither representation is known without decoding the image. HEAD
+                # must not advertise the original/stale file's headers as a thumb.
+                from fastapi.responses import Response
+                response = Response(status_code=200, headers=UPLOAD_RESPONSE_HEADERS)
+                del response.headers["content-length"]
+                return response
+            else:
+                try:
+                    from PIL import Image, ImageOps
+                    os.makedirs(thumb_dir, exist_ok=True)
+                    if (not os.path.exists(thumb_path)
+                            or os.path.getmtime(thumb_path) < os.path.getmtime(path)):
+                        im = Image.open(path)
+                        # iPhone / camera JPEGs encode rotation in EXIF rather than
+                        # the pixel data. Browsers honour that on the original via
+                        # image-orientation:from-image, but PIL strips EXIF when it
+                        # saves the JPEG thumb, leaving the pixels sideways. Bake
+                        # the rotation into the pixels before thumbnailing.
+                        im = ImageOps.exif_transpose(im)
+                        im.thumbnail((320, 320))
+                        if im.mode not in ("RGB", "L"):
+                            im = im.convert("RGB")
+                        im.save(thumb_path, "JPEG", quality=80)
+                    return FileResponse(thumb_path, media_type="image/jpeg", headers=UPLOAD_RESPONSE_HEADERS)
+                except Exception as e:
+                    logger.warning(f"Thumbnail generation failed for {file_id}: {e}")
+                    # Fall through to the full image.
        return FileResponse(
            path,
            media_type=mime,
@@ -496,9 +541,10 @@ def setup_upload_routes(upload_handler):
        return next((fi for fi in db.values() if fi.get("id") == file_id), None)

    def _vision_cache_path(file_id: str) -> str:
-        cache_dir = os.path.join(_upload_root(), ".vision")
+        safe_id = secure_filename(os.path.basename(file_id))
+        cache_dir = os.path.normpath(os.path.join(_upload_root(), ".vision"))
        os.makedirs(cache_dir, exist_ok=True)
-        return os.path.join(cache_dir, file_id + ".txt")
+        return os.path.normpath(os.path.join(cache_dir, safe_id + ".txt"))

    def _sync_gallery_caption_for_upload(info: dict | None, owner: str | None, text: str) -> None:
        """Copy upload OCR/vision text onto the promoted gallery image row."""
@@ -0,0 +1,122 @@
+"""Fail image builds that select an unfixed Debian native Brotli decoder.
+
+Debian Node links libbrotlidec rather than bundling upstream Node's decoder.
+Use Debian's backport revision, not BrotliDecoderVersion() or Python wheel
+metadata, to establish the package floor for CVE-2026-111497:
+https://security-tracker.debian.org/tracker/CVE-2026-111497
+"""
+
+import argparse
+import ctypes
+from pathlib import Path
+import platform
+import re
+import subprocess
+import sys
+
+
+DEBIAN_FIXED = {"12": "1.0.9-2+deb12u1", "13": "1.1.0-2+deb13u1"}
+DECODER_SONAME = "libbrotlidec.so.1"
+
+
+def command(*args):
+    return subprocess.check_output(args, text=True).strip()
+
+
+def check_package():
+    release = platform.freedesktop_os_release()
+    floor = DEBIAN_FIXED.get(release.get("VERSION_ID"))
+    if release.get("ID") != "debian" or floor is None:
+        raise ValueError("Brotli package floor is not defined for this distribution")
+    record = command(
+        "dpkg-query", "-W", "-f=${Status}\n${Version}", "libbrotli1"
+    ).splitlines()
+    if len(record) != 2 or any(not value.strip() for value in record):
+        raise ValueError("invalid libbrotli1 package record: expected status and version")
+    status, version = record
+    if status != "install ok installed":
+        raise ValueError(f"libbrotli1 is not fully installed (status: {status})")
+    if subprocess.run(
+        ["dpkg", "--compare-versions", version, "ge", floor], check=False
+    ).returncode != 0:
+        raise ValueError(f"libbrotli1 {version} does not meet Debian's fixed floor {floor}")
+    owned = {
+        Path(line).resolve()
+        for line in command("dpkg-query", "-L", "libbrotli1").splitlines()
+        if Path(line).name == DECODER_SONAME
+    }
+    if not owned:
+        raise ValueError("libbrotli1 has no packaged native decoder")
+    return version, owned
+
+
+def loaded_path(library):
+    # Inspect the library actually selected by the dynamic loader. An installed
+    # fixed package alone would not catch LD_LIBRARY_PATH or /usr/local shadows.
+    class DlInfo(ctypes.Structure):
+        _fields_ = [("filename", ctypes.c_char_p), ("base", ctypes.c_void_p),
+                    ("symbol", ctypes.c_char_p), ("address", ctypes.c_void_p)]
+
+    dladdr = ctypes.CDLL(None).dladdr
+    dladdr.argtypes = [ctypes.c_void_p, ctypes.POINTER(DlInfo)]
+    dladdr.restype = ctypes.c_int
+    info = DlInfo()
+    if not dladdr(ctypes.cast(library.BrotliDecoderDecompress, ctypes.c_void_p), ctypes.byref(info)):
+        raise ValueError("cannot identify the loaded Brotli decoder")
+    return Path(info.filename.decode()).resolve()
+
+
+def check_decoder(library):
+    # The fix adds error -17. Older decoders return INVALID here, including
+    # upstream 1.1.0 and 1.2.0. Fixed Debian 12 and 13 backports expose the same
+    # marker with different error-string prefixes.
+    # No malformed attacker-controlled stream is needed for this build check.
+    library.BrotliDecoderErrorString.argtypes = [ctypes.c_int]
+    library.BrotliDecoderErrorString.restype = ctypes.c_char_p
+    if library.BrotliDecoderErrorString(-17) not in (b"BLOCK_SWITCH", b"_ERROR_FORMAT_BLOCK_SWITCH"):
+        raise ValueError("native decoder lacks the CVE-2026-111497 BLOCK_SWITCH fix marker")
+
+    library.BrotliDecoderDecompress.argtypes = [
+        ctypes.c_size_t, ctypes.c_void_p, ctypes.POINTER(ctypes.c_size_t), ctypes.c_void_p
+    ]
+    library.BrotliDecoderDecompress.restype = ctypes.c_int
+    # A small, valid uncompressed Brotli stream must still decode correctly.
+    encoded = bytes.fromhex("0b058068656c6c6f20776f726c6403")
+    output = ctypes.create_string_buffer(11)
+    size = ctypes.c_size_t(len(output))
+    result = library.BrotliDecoderDecompress(len(encoded), encoded, ctypes.byref(size), output)
+    if result != 1 or size.value != 11 or output.raw != b"hello world":
+        raise ValueError("native Brotli decoder failed the valid-stream control")
+
+
+def check_node(node, decoder):
+    # ldd inspects the distro executable and its libnode dependency without
+    # executing JavaScript or relying on process.versions.brotli.
+    linked = command("ldd", str(node))
+    match = re.search(r"libbrotlidec\.so\.1\s+=>\s+(/\S+)", linked)
+    if not match or Path(match[1]).resolve() != decoder:
+        raise ValueError(f"{node} does not select the checked Debian Brotli decoder")
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--node", type=Path, help="also verify this distro Node executable's decoder")
+    args = parser.parse_args(argv)
+    try:
+        version, owned = check_package()
+        library = ctypes.CDLL(DECODER_SONAME)
+        decoder = loaded_path(library)
+        if decoder not in owned:
+            raise ValueError(f"selected decoder is outside libbrotli1: {decoder}")
+        check_decoder(library)
+        if args.node:
+            check_node(args.node, decoder)
+    except (ValueError, OSError, AttributeError, subprocess.CalledProcessError) as exc:
+        print(f"Brotli acceptance failed: {exc}", file=sys.stderr)
+        return 1
+    print(f"Brotli accepted: Debian libbrotli1 {version}, decoder {decoder}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -951,14 +951,12 @@ VARIABLE_NOTES: dict[str, tuple[str, str, str]] = {
    "ODYSSEUS_JEFF_URL": ("Agent loop and tool execution", INTERNAL, "Base URL of the optional decision adapter service."),
    "ODYSSEUS_PRIVATE_BROWSER_LEGACY": ("Agent loop and tool execution", INTERNAL, "Explicit opt-in to the legacy browser compatibility transport; disabled by default."),
    "ODYSSEUS_SPEC_BROWSER_FALLBACK": ("Agent loop and tool execution", INTERNAL, "Optional browser routing fallback: mcp, web, or 0 to disable."),
-    "ODYSSEUS_SPEC_DRIVER_TOPK": ("Agent loop and tool execution", INTERNAL, "Number of router-selected tool candidates exposed in a driver round."),
    "ODYSSEUS_SPEC_MODE": ("Agent loop and tool execution", INTERNAL, "Spec routing mode for explicitly configured models, including strict and driver."),
    "ODYSSEUS_SPEC_ROUTER_MIN_CONF": ("Agent loop and tool execution", INTERNAL, "Minimum tool-selection confidence accepted from the router."),
    "ODYSSEUS_SPEC_ROUTER_MODEL": ("Agent loop and tool execution", INTERNAL, "Decision adapter model used for tool routing."),
    "ODYSSEUS_SPEC_ROUTER_SECOND": ("Agent loop and tool execution", INTERNAL, "Minimum confidence for adding a secondary tool candidate."),
    "ODYSSEUS_SPEC_ROUTER_TIMEOUT": ("Agent loop and tool execution", INTERNAL, "Time budget in seconds for a router decision."),
    "ODYSSEUS_SPEC_ROUTER_URL": ("Agent loop and tool execution", INTERNAL, "Base URL of the optional Spec router; an empty URL disables requests."),
-    "ODYSSEUS_SPEC_SUBSET_OF_BASE": ("Agent loop and tool execution", INTERNAL, "Limit Spec tool selections to the existing request inventory by default."),
    "ODYSSEUS_SPEC_THINK_MIN_P": ("Agent loop and tool execution", INTERNAL, "Minimum router confidence for enabling thinking."),
    "ODYSSEUS_SPEC_THINK_MODEL": ("Agent loop and tool execution", INTERNAL, "Optional thinking decision adapter model, falling back to the tool router model."),
    "ODYSSEUS_SPEC_THINK_QUESTION": ("Agent loop and tool execution", INTERNAL, "Thinking classifier question format: binary or kind5."),
@@ -0,0 +1,336 @@
+#!/usr/bin/env python3
+"""Sanitize Playwright trace archives to strip sensitive credentials and tokens.
+
+Structured, format-aware fail-closed security:
+Replaces naive regex-based replacement with structured JSON / HAR parsing,
+recursive key/value redaction, URL credential scrubbing, DOM snapshot sanitization,
+safe source code masking, and strict fail-closed purge on corruption or error.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import sys
+import urllib.parse
+import zipfile
+from typing import Any, Dict, List, Set
+
+logger = logging.getLogger(__name__)
+
+BINARY_IMAGE_EXTENSIONS = ('.png', '.jpg', '.jpeg', '.webp', '.gif', '.ico')
+
+SENSITIVE_KEY_PATTERN = re.compile(
+    r'(?i)(password|passwd|secret|token|api_key|apikey|access_token|refresh_token|private_key|auth_token|client_secret|session|session_id|sid|csrf|xsrf|jwt|credential|authorization)'
+)
+
+SENSITIVE_PARAM_NAMES = frozenset({
+    "token", "session", "auth", "password", "passwd", "key", "secret", "api_key",
+    "apikey", "access_token", "refresh_token", "jwt", "sid", "code", "sig",
+    "signature", "client_secret", "credential"
+})
+
+SENSITIVE_HEADER_NAMES = frozenset({
+    "authorization", "proxy-authorization", "cookie", "set-cookie", "x-api-key",
+    "api-key", "x-auth-token", "x-access-token"
+})
+
+
+def sanitize_url(url: str) -> str:
+    """Sanitize query parameters and authority credentials in URLs."""
+    if not isinstance(url, str) or not url.strip():
+        return url
+    try:
+        parts = urllib.parse.urlsplit(url)
+    except Exception:
+        return url
+
+    netloc = parts.netloc
+    if "@" in netloc:
+        userinfo, host = netloc.split("@", 1)
+        if ":" in userinfo:
+            user, _ = userinfo.split(":", 1)
+            netloc = f"{user}:[REDACTED]@{host}"
+        else:
+            netloc = f"[REDACTED]@{host}"
+
+    query = parts.query
+    if query:
+        q_pairs = urllib.parse.parse_qsl(query, keep_blank_values=True)
+        sanitized_pairs = []
+        for k, v in q_pairs:
+            k_lower = k.lower().replace("-", "_")
+            if k_lower in SENSITIVE_PARAM_NAMES or SENSITIVE_KEY_PATTERN.search(k_lower):
+                sanitized_pairs.append((k, "[REDACTED]"))
+            else:
+                sanitized_pairs.append((k, v))
+        query = urllib.parse.urlencode(sanitized_pairs)
+
+    return urllib.parse.urlunsplit((parts.scheme, netloc, parts.path, query, parts.fragment))
+
+
+def sanitize_body_text(text: str) -> str:
+    """Sanitize request bodies formatted as JSON or URL-encoded form data."""
+    if not isinstance(text, str) or not text.strip():
+        return text
+
+    # 1. Try JSON
+    trimmed = text.strip()
+    if (trimmed.startswith("{") and trimmed.endswith("}")) or (trimmed.startswith("[") and trimmed.endswith("]")):
+        try:
+            parsed = json.loads(trimmed)
+            sanitized = sanitize_structured_obj(parsed)
+            return json.dumps(sanitized, ensure_ascii=False)
+        except Exception:
+            pass
+
+    # 2. Try URL-encoded form data
+    if "=" in trimmed and not trimmed.startswith("<"):
+        try:
+            pairs = urllib.parse.parse_qsl(trimmed, keep_blank_values=True)
+            if pairs and any(k.lower() in SENSITIVE_PARAM_NAMES or SENSITIVE_KEY_PATTERN.search(k) for k, _ in pairs):
+                out_pairs = []
+                for k, v in pairs:
+                    k_lower = k.lower().replace("-", "_")
+                    if k_lower in SENSITIVE_PARAM_NAMES or SENSITIVE_KEY_PATTERN.search(k_lower):
+                        out_pairs.append((k, "[REDACTED]"))
+                    else:
+                        out_pairs.append((k, v))
+                return urllib.parse.urlencode(out_pairs)
+        except Exception:
+            pass
+
+    return text
+
+
+def sanitize_structured_obj(obj: Any) -> Any:
+    """Recursively sanitize Python objects decoded from JSON or HAR payloads."""
+    if isinstance(obj, dict):
+        new_dict: Dict[str, Any] = {}
+
+        # Check for header entry with inverted or standard keys: {"name": ..., "value": ...}
+        name_val = obj.get("name")
+        val_val = obj.get("value")
+        if isinstance(name_val, str) and isinstance(val_val, str):
+            name_lower = name_val.lower().strip()
+            if name_lower in SENSITIVE_HEADER_NAMES or SENSITIVE_KEY_PATTERN.search(name_lower):
+                for k, v in obj.items():
+                    if k == "value":
+                        new_dict[k] = "[REDACTED]"
+                    else:
+                        new_dict[k] = sanitize_structured_obj(v)
+                return new_dict
+
+        # Process standard dictionary keys
+        for k, v in obj.items():
+            k_lower = str(k).lower().replace("-", "_")
+
+            # Action parameters in Playwright traces (e.g. page.fill, page.type)
+            if k == "params" and isinstance(v, dict):
+                sanitized_params = sanitize_structured_obj(v)
+                # If this action involves fill, type, or sensitive inputs, redact value/text
+                if "value" in sanitized_params:
+                    sanitized_params["value"] = "[REDACTED]"
+                if "text" in sanitized_params:
+                    sanitized_params["text"] = "[REDACTED]"
+                new_dict[k] = sanitized_params
+                continue
+
+            # DOM snapshot nodes
+            if k == "attributes" and isinstance(v, (dict, list)):
+                if isinstance(v, dict):
+                    attr_dict = dict(v)
+                    type_val = str(attr_dict.get("type") or "").lower()
+                    if type_val == "password" or "password" in str(attr_dict.get("name") or "").lower():
+                        if "value" in attr_dict:
+                            attr_dict["value"] = "[REDACTED]"
+                    new_dict[k] = attr_dict
+                    continue
+                elif isinstance(v, list):
+                    # List of attribute strings or pairs
+                    new_list = []
+                    is_pw = any("password" in str(x).lower() for x in v)
+                    for x in v:
+                        if is_pw and isinstance(x, str) and not x.startswith("type="):
+                            new_list.append("[REDACTED]")
+                        else:
+                            new_list.append(sanitize_structured_obj(x))
+                    new_dict[k] = new_list
+                    continue
+
+            # Request postData / text
+            if k in ("postData", "postDataText") and isinstance(v, str):
+                new_dict[k] = sanitize_body_text(v)
+                continue
+
+            # URL fields
+            if k == "url" and isinstance(v, str):
+                new_dict[k] = sanitize_url(v)
+                continue
+
+            # Cookie arrays
+            if k == "cookies" and isinstance(v, list):
+                sanitized_cookies = []
+                for c in v:
+                    if isinstance(c, dict):
+                        c_copy = dict(c)
+                        if "value" in c_copy:
+                            c_copy["value"] = "[REDACTED]"
+                        sanitized_cookies.append(c_copy)
+                    else:
+                        sanitized_cookies.append(sanitize_structured_obj(c))
+                new_dict[k] = sanitized_cookies
+                continue
+
+            # Direct sensitive key matches
+            if SENSITIVE_KEY_PATTERN.search(k_lower) and isinstance(v, str):
+                new_dict[k] = "[REDACTED]"
+                continue
+
+            new_dict[k] = sanitize_structured_obj(v)
+
+        return new_dict
+
+    elif isinstance(obj, list):
+        return [sanitize_structured_obj(item) for item in obj]
+
+    elif isinstance(obj, str):
+        # Check for inline credentials/tokens
+        if obj.startswith("Bearer ") or obj.startswith("bearer "):
+            return "Bearer [REDACTED]"
+        if obj.startswith("Basic ") or obj.startswith("basic "):
+            return "Basic [REDACTED]"
+        return obj
+
+    return obj
+
+
+def sanitize_jsonl_content(data: bytes) -> bytes:
+    """Sanitize newline-delimited JSON Lines (.trace, .network, .stacks)."""
+    lines = data.split(b"\n")
+    out_lines = []
+    for line in lines:
+        if not line.strip():
+            out_lines.append(line)
+            continue
+        try:
+            parsed = json.loads(line.decode("utf-8"))
+        except (json.JSONDecodeError, UnicodeDecodeError):
+            # Not valid JSON, keep as-is
+            out_lines.append(line)
+            continue
+        sanitized = sanitize_structured_obj(parsed)
+        out_lines.append(json.dumps(sanitized, ensure_ascii=False).encode("utf-8"))
+    return b"\n".join(out_lines)
+
+
+def sanitize_trace_archive(zp: str) -> bool:
+    """Sanitize a single zip archive in a strict fail-closed manner.
+
+    If the archive is malformed, partial, unreadable, or encounters an exception
+    during processing, the archive is permanently deleted so that raw traces
+    cannot leak.
+    Returns True if successfully sanitized, False if deleted due to error.
+    """
+    if not os.path.exists(zp):
+        return False
+
+    temp_zp = zp + ".tmp"
+    try:
+        if os.path.getsize(zp) == 0:
+            raise zipfile.BadZipFile("Empty archive")
+
+        with zipfile.ZipFile(zp, "r") as zin:
+            infolist = zin.infolist()
+            if not infolist:
+                raise zipfile.BadZipFile("Archive has no entries")
+
+            corrupt_file = zin.testzip()
+            if corrupt_file is not None:
+                raise zipfile.BadZipFile(f"Corrupt entry detected: {corrupt_file}")
+
+            with zipfile.ZipFile(temp_zp, "w", compression=zipfile.ZIP_DEFLATED) as zout:
+                for item in infolist:
+                    filename_lower = item.filename.lower()
+
+                    # 1. Binary image screenshots/diagnostics: preserve as-is
+                    if filename_lower.endswith(BINARY_IMAGE_EXTENSIONS):
+                        content = zin.read(item.filename)
+                        zout.writestr(item, content)
+                        continue
+
+                    # 2. Embedded test source code (e.g. resources/src@... or .js/.ts):
+                    # Mask safely without syntax corruption!
+                    if "src@" in filename_lower or filename_lower.endswith((".js", ".ts", ".mjs", ".py")):
+                        safe_placeholder = b"// [SOURCE CODE REDACTED FOR TRACE CONFIDENTIALITY]\n"
+                        zout.writestr(item, safe_placeholder)
+                        continue
+
+                    # 3. JSON Lines and structured JSON/HAR traces
+                    content = zin.read(item.filename)
+                    if filename_lower.endswith((".trace", ".network", ".stacks")):
+                        sanitized_content = sanitize_jsonl_content(content)
+                        zout.writestr(item, sanitized_content)
+                    elif filename_lower.endswith((".json", ".har")):
+                        try:
+                            parsed = json.loads(content.decode("utf-8"))
+                            sanitized = sanitize_structured_obj(parsed)
+                            zout.writestr(item, json.dumps(sanitized, ensure_ascii=False).encode("utf-8"))
+                        except Exception:
+                            # If invalid JSON, treat as text line-by-line
+                            zout.writestr(item, sanitize_jsonl_content(content))
+                    else:
+                        # Unknown binary or text member: exclude to fail closed
+                        continue
+
+        # Atomic replace
+        os.replace(temp_zp, zp)
+        return True
+
+    except Exception as exc:
+        logger.warning("Sanitizing trace %s failed (%s); removing fail-closed", zp, exc)
+        for path_to_remove in (temp_zp, zp):
+            if os.path.exists(path_to_remove):
+                try:
+                    os.remove(path_to_remove)
+                except OSError as remove_err:
+                    logger.error("Failed to delete unredacted trace %s: %s", path_to_remove, remove_err)
+        return False
+
+
+def sanitize_directory(results_dir: str) -> int:
+    """Walk results_dir and sanitize every .zip archive fail-closed.
+
+    Returns the number of archives processed. Exits with 1 if any archive fails.
+    """
+    if not os.path.exists(results_dir):
+        return 0
+
+    count = 0
+    all_ok = True
+    for root, _, files in os.walk(results_dir):
+        for f in files:
+            if f.endswith(".zip"):
+                zp = os.path.join(root, f)
+                ok = sanitize_trace_archive(zp)
+                if not ok:
+                    all_ok = False
+                count += 1
+
+    if not all_ok:
+        sys.exit(1)
+    return count
+
+
+def main() -> None:
+    if len(sys.argv) < 2:
+        print(f"Usage: {sys.argv[0]} <results_directory>")
+        sys.exit(1)
+
+    target_dir = sys.argv[1]
+    sanitize_directory(target_dir)
+
+
+if __name__ == "__main__":
+    main()
@@ -628,6 +628,14 @@ async def extract_and_store(
            if not fact_text or len(fact_text) < 5:
                continue

+            # A fuller owner-specific name must not rewrite a shared legacy
+            # entry, but that less-specific entry must not suppress it either.
+            legacy_refinements = {
+                id(entry) for entry in existing
+                if _owner and entry.get("owner") is None
+                and _name_enrichment_target(fact_text, [entry]) is entry
+            }
+
            # Dedup: check vector similarity first (fast), then exact text match.
            # A runtime embedding/ChromaDB failure (backend OOM, model evicted,
            # remote endpoint down) must not abort the whole batch — fall through
@@ -649,18 +657,25 @@ async def extract_and_store(
                    # silently dropped. Mirror the owner predicate used by the
                    # text dedup below; cross-tenant/stale matches fall through.
                    _match = next((e for e in existing if e.get("id") == existing_id), None)
-                    if _match is not None and (_match.get("owner") == _owner or _match.get("owner") is None):
+                    if (_match is not None and id(_match) not in legacy_refinements
+                            and (_match.get("owner") == _owner or _match.get("owner") is None)):
                        logger.debug(f"Memory dedup (vector): '{fact_text[:50]}' matches {existing_id}")
                        continue

            # Text dedup fallback: exact match + fuzzy similarity
-            user_existing = [e for e in existing if e.get("owner") == _owner or e.get("owner") is None] if _owner else existing
+            user_existing = [e for e in existing
+                             if (e.get("owner") == _owner or e.get("owner") is None)
+                             and id(e) not in legacy_refinements] if _owner else existing

            # Name enrichment: if an existing name fact is a strict prefix of
            # this more complete one, upgrade it in place instead of adding a
            # near-duplicate ("name is Felix" -> "name is Felix Arvid Ulf
            # Kjellberg"). The vector store upserts by id, so re-adding is safe.
-            _enrich = _name_enrichment_target(fact_text, user_existing)
+            # Legacy unowned entries may be visible to multiple owners; never
+            # rewrite one with a private fact from the current owner.
+            _enrich = _name_enrichment_target(
+                fact_text, [e for e in user_existing if e.get("owner") == _owner]
+            )
            if _enrich is not None:
                _enrich["text"] = fact_text
                _enrich["timestamp"] = int(time.time())
@@ -2834,7 +2834,7 @@ def _parse_qwen_explicit_admin_request(text: str) -> Optional[tuple[str, str]]:
    if re.search(r"\b(?:disabled\s+tools?|tools?\s+(?:are\s+)?(?:currently\s+)?disabled)\b", q):
        return "manage_settings", json.dumps({"action": "list_tools"})
    if re.search(r"\b(?:turn|enable|re-enable|reenable)\b.{0,40}\b(?:image\s+generation|images?|generate_image)\b", q):
-        return "manage_settings", json.dumps({"action": "enable_tool", "tool": "images"})
+        return "manage_settings", json.dumps({"action": "list_tools"})
    if re.search(r"\b(?:disable|turn\s+off)\b.{0,40}\b(?:image\s+generation|images?|generate_image)\b", q):
        return "manage_settings", json.dumps({"action": "disable_tool", "tool": "images"})
    if listish and re.search(r"\bapi\s+tokens?\b|\btokens?\b", q):
@@ -8057,7 +8057,7 @@ Generate an image. Line 1 = description, line 2 = model name, line 3 = WxH (e.g.
    "manage_tokens": "- ```manage_tokens``` — Generate or revoke API access tokens for external integrations. Args (JSON): {\"action\": \"list|create|delete\", ...}",
    "manage_documents": "- ```manage_documents``` — List, read/open, delete, or tidy documents in the editor panel. Args (JSON): {\"action\": \"list|read|delete|tidy\", ...}. `list` returns rows like `[Title](#document-<id>) — lang, size, updated 5m ago` sorted MOST-RECENT FIRST; the user clicks the anchor to open. `read` (aliases: view/open/get) takes `document_id` and returns the content. When the user asks \"open/show/read my notes\" or \"what documents do I have\", use this — do NOT shell out, do NOT curl.",
    "manage_research": "- ```manage_research``` — List, read/open, or delete saved DEEP RESEARCH results from the Library. Args (JSON): {\"action\": \"list|read|delete\", \"id\": \"<id>\", \"search\": \"...\"}. `list` returns rows like `[query](#research-<id>) — N sources` MOST-RECENT FIRST; the user clicks to open. `read` (aliases: open/view/get) takes `id` and returns the report text + sources. Use when the user says \"open/read/find/delete my research\" or \"that report\". This IS how you read a finished report: when the user refers to a just-completed deep-research job (\"check it out\", \"read that report\", \"summarize the research\") WITHOUT giving an id, call `manage_research` with `action:list` to get the most-recent id, then `action:read` with that id, and answer from the returned text. Do NOT `web_fetch`/`app_api` the `/api/research/report/{id}` URL — that endpoint renders HTML for the browser, not clean text — and do NOT start a fresh `web_search`/`trigger_research` just to read an existing report. To START new research, use trigger_research instead.",
-    "manage_settings": "- ```manage_settings``` — View/change the REAL app settings (same ones the Settings panel writes) AND turn tools on/off. Change a setting: `{\"action\":\"set\",\"key\":\"...\",\"value\":\"...\"}` — keys accept friendly aliases, e.g. voice→tts_voice, \"search engine\"→search_provider, \"default model\"→default_model, \"teacher model\"→teacher_model, \"task/background model\"→task_model, \"image quality\"→image_quality, \"reminder channel\"→reminder_channel (browser|email|ntfy), \"agent timeout\"/\"max tool calls\"/\"token budget\". Read: `{\"action\":\"get\",\"key\":\"...\"}`; see all: `{\"action\":\"list\"}`; reset one: `{\"action\":\"reset\",\"key\":\"...\"}`. Use this when the user asks to change ANY preference instead of making them open Settings. Secrets/API keys are read-only (tell them to set those in the panel). Tool toggles: `{\"action\":\"disable_tool|enable_tool\",\"tool\":\"shell\"}` (aliases: shell/search/browser/documents/memory/skills/images/tasks/notes/calendar/email), list disabled: `{\"action\":\"list_tools\"}`.",
+    "manage_settings": "- ```manage_settings``` — View/change the REAL app settings (same ones the Settings panel writes) AND turn tools on/off. Change a setting: `{\"action\":\"set\",\"key\":\"...\",\"value\":\"...\"}` — keys accept friendly aliases, e.g. voice→tts_voice, \"search engine\"→search_provider, \"default model\"→default_model, \"teacher model\"→teacher_model, \"task/background model\"→task_model, \"image quality\"→image_quality, \"reminder channel\"→reminder_channel (browser|email|ntfy), \"agent timeout\"/\"max tool calls\"/\"token budget\". Read: `{\"action\":\"get\",\"key\":\"...\"}`; see all: `{\"action\":\"list\"}`; reset one: `{\"action\":\"reset\",\"key\":\"...\"}`. Use this when the user asks to change ANY preference instead of making them open Settings. Secrets/API keys are read-only (tell them to set those in the panel). Tool toggles: `{\"action\":\"disable_tool\",\"tool\":\"shell\"}` (aliases: shell/search/browser/documents/memory/skills/images/tasks/notes/calendar/email), list disabled: `{\"action\":\"list_tools\"}`. You cannot re-enable a disabled tool: that is done by the user in Settings > Agent Tools.",
    "manage_notes": """\
 ```manage_notes
 {"action": "add", "title": "<short todo>", "due_date": "<natural language or ISO datetime>"}
@@ -21061,6 +21061,103 @@ from src.agent_runtime.authority import MISSING_AUTHORITY, active_request_author



+def _apply_spec_decision_to_contract(turn_contract, picks, decided, disabled_tools, tool_policy):
+    from src.turn_contract import _ACTIVE_CONTRACT as _spec_active_contract
+    disabled = set(disabled_tools or ())
+    from src.spec_router import latest_decision
+    _spec_decision = latest_decision() or {}
+    _spec_choice = _spec_decision.get("choice")
+    _spec_direct = (os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() == "strict"
+                                           and decided and _spec_choice == "answer_directly")
+    try:
+        _mgr = get_mcp_manager()
+        mcp_schemas = _mgr.get_all_openai_schemas(_load_mcp_disabled_map()) if _mgr else []
+    except Exception:
+        mcp_schemas = []
+    mcp_names = {(sc.get("function") or {}).get("name") for sc in mcp_schemas}
+    if _spec_choice == "ask_user":
+        # ask_user = a tool is needed but a detail may be missing: offer Spec's top tool too, so the model
+        # can act when the detail is there or ask when it is not.
+        _top = _spec_decision.get("top") or []
+        if _top:
+            picks = set(picks) | {_top[0][0]}
+    picks = {(f"mcp__email__{n}" if f"mcp__email__{n}" in mcp_names else n) for n in picks}
+    strict = os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() == "strict"
+    base_offered = set(turn_contract.offered)
+    # The router sees the full catalog, while this request's policy may
+    # deny a tool (for example, a browser turn with Web access switched
+    # off). Preserve that conflict as an unavailable contract. Keeping the
+    # old empty menu instead lets the model invent a tool result in prose.
+    _top = _spec_decision.get("top") or []
+    _primary = str(_top[0][0]) if _spec_choice and str(_spec_choice).startswith("t") and _top else ""
+    if _primary and f"mcp__email__{_primary}" in mcp_names:
+        _primary = f"mcp__email__{_primary}"
+    # A policy denial is surfaced even if the router chose outside the
+    # base inventory; it never grants access to that tool.
+    def _denied(name):
+        return (name in disabled
+                or (tool_policy is not None and (
+                    tool_policy.blocks(name)
+                    or (tool_policy.disable_mcp and name.startswith("mcp__")))))
+    _unavailable_pick = ""
+    if _primary in picks and _denied(_primary):
+        _unavailable_pick = _primary
+    elif picks and all(_denied(name) for name in picks):
+        _unavailable_pick = sorted(picks)[0]
+    if _unavailable_pick:
+        blocked = replace(
+            turn_contract, required=frozenset(), offered=frozenset(),
+            unavailable=frozenset({_unavailable_pick}), schema_json=(),
+            required_read_operation=None, routing_experiment="spec-policy-denied",
+        )
+        _spec_active_contract.set(blocked)
+        logger.info("[spec-harness] router pick %s unavailable under request policy", _unavailable_pick)
+        return blocked
+    want = set(picks) - disabled
+    # Always-on basics only when the base turn offers them, so the Spec
+    # arm never offers a tool the base arm would not.
+    if not _spec_direct:
+        want |= {"ask_user", "update_plan"} & base_offered
+    if not (strict and decided):
+        want |= base_offered
+    want &= base_offered
+    if not want:
+        logger.info("[spec-harness] router picks %s outside base offered %s; base contract kept",
+                    sorted(picks), sorted(base_offered))
+        return turn_contract
+    offer = want & base_offered & set(turn_contract.executable)
+    # A router may narrow the menu only when every existing obligation
+    # remains satisfiable. It cannot redefine the user's requested work.
+    required_read = getattr(turn_contract, "required_read_operation", None)
+    if (not set(turn_contract.required) <= offer or turn_contract.unavailable
+            or (required_read is not None and required_read.tool not in offer)):
+        return turn_contract
+    by_name = {}
+    for sc in list(FUNCTION_TOOL_SCHEMAS) + list(mcp_schemas):
+        nm = (sc.get("function") or {}).get("name")
+        if nm in offer and nm not in by_name:
+            by_name[nm] = sc
+    for sc in turn_contract.schemas():
+        nm = (sc.get("function") or {}).get("name")
+        if nm in offer:
+            by_name[nm] = sc
+    if not by_name and not _spec_direct:
+        logger.info("[spec-harness] router picks %s not executable this turn; contract kept", sorted(picks))
+        return turn_contract
+    # Required tools and the required read carry over unchanged: harness
+    # completion logic keys on them (e.g. a calendar list is a read, not an
+    # effect that may end with "Done."). If one lost its schema, contract
+    # validation fails and the original contract is retained below.
+    new = replace(
+        turn_contract, offered=frozenset(by_name),
+        schema_json=tuple(json.dumps(by_name[n], ensure_ascii=False, sort_keys=True) for n in sorted(by_name)),
+        routing_experiment="spec-router")
+    _spec_active_contract.set(new)
+    logger.info("[spec-harness] contract replaced by router: offered=%s (was %s, decided=%s)",
+                sorted(by_name), sorted(turn_contract.offered), decided)
+    return new
+
+
 def _spec_router_contract(turn_contract, messages, disabled_tools, endpoint_url, model, owner, headers,
                          tool_policy=None):
    """Ajax Spec: return a copy of the turn contract whose offered tools are the
@@ -21069,10 +21166,17 @@ def _spec_router_contract(turn_contract, messages, disabled_tools, endpoint_url,
    Runs before any runtime dispatch so the compact preview runtime and the
    main loop both serve the router's set; only the offered tools change.
    """
+    # Contexts can be inherited by a child task; a turn must never inherit a
+    # previous turn's decision when routing is disabled or unavailable.
+    from src import spec_router as _router_context
+    if hasattr(_router_context, "clear_decision"):
+        _router_context.clear_decision()
    if (turn_contract is None
            or getattr(turn_contract, "routing_experiment", "") in {"spec-router", "spec-policy-denied"}
            or (tool_policy is not None and tool_policy.block_all_tool_calls)):
        return turn_contract
+    if os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() not in {"strict", "additive"}:
+        return turn_contract
    try:
        if _configured_model_tool_surface_raw(endpoint_url, model, owner, headers=headers) != "spec":
            return turn_contract
@@ -21080,105 +21184,38 @@ def _spec_router_contract(turn_contract, messages, disabled_tools, endpoint_url,
        return turn_contract
    try:
        from src.spec_router import spec_route_tools as _spec_route_tools_early
-        from src.turn_contract import _ACTIVE_CONTRACT as _spec_active_contract
-        disabled = set(disabled_tools or ())
        picks, decided = _spec_route_tools_early(
            _extract_last_user_message(messages), FUNCTION_TOOL_SCHEMAS, set(), messages, return_decision=True)
-        from src.spec_router import LAST_DECISIONS as _spec_decisions
-        _spec_choice = (_spec_decisions[-1] if _spec_decisions else {}).get("choice")
-        _spec_direct = (os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() == "strict"
-                                               and decided and _spec_choice == "answer_directly")
-        try:
-            _mgr = get_mcp_manager()
-            mcp_schemas = _mgr.get_all_openai_schemas(_load_mcp_disabled_map()) if _mgr else []
-        except Exception:
-            mcp_schemas = []
-        mcp_names = {(sc.get("function") or {}).get("name") for sc in mcp_schemas}
-        if _spec_choice == "ask_user":
-            # ask_user = a tool is needed but a detail may be missing: offer Spec's top tool too, so the model
-            # can act when the detail is there or ask when it is not.
-            _top = ((_spec_decisions[-1] if _spec_decisions else {}).get("top") or [])
-            if _top:
-                picks = set(picks) | {_top[0][0]}
-        picks = {(f"mcp__email__{n}" if f"mcp__email__{n}" in mcp_names else n) for n in picks}
-        strict = os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() == "strict"
-        base_offered = set(turn_contract.offered)
-        subset_of_base = os.getenv("ODYSSEUS_SPEC_SUBSET_OF_BASE", "1").strip().lower() not in {"0", "false", "no", "off"}
-        # The router sees the full catalog, while this request's policy may
-        # deny a tool (for example, a browser turn with Web access switched
-        # off). Preserve that conflict as an unavailable contract. Keeping the
-        # old empty menu instead lets the model invent a tool result in prose.
-        _top = ((_spec_decisions[-1] if _spec_decisions else {}).get("top") or [])
-        _primary = str(_top[0][0]) if _spec_choice and str(_spec_choice).startswith("t") and _top else ""
-        if _primary and f"mcp__email__{_primary}" in mcp_names:
-            _primary = f"mcp__email__{_primary}"
-        # `executable` belongs to the base contract. In subset=0, Spec may
-        # legitimately add a policy-permitted tool that the base inventory did
-        # not include. Only an explicit request-policy denial blocks the pick.
-        def _denied(name):
-            return (name in disabled
-                    or (tool_policy is not None and (
-                        tool_policy.blocks(name)
-                        or (tool_policy.disable_mcp and name.startswith("mcp__")))))
-        _unavailable_pick = ""
-        if _primary in picks and _denied(_primary):
-            _unavailable_pick = _primary
-        elif picks and all(_denied(name) for name in picks):
-            _unavailable_pick = sorted(picks)[0]
-        if _unavailable_pick:
-            blocked = replace(
-                turn_contract, required=frozenset(), offered=frozenset(),
-                unavailable=frozenset({_unavailable_pick}), schema_json=(),
-                required_read_operation=None, routing_experiment="spec-policy-denied",
-            )
-            _spec_active_contract.set(blocked)
-            logger.info("[spec-harness] router pick %s unavailable under request policy", _unavailable_pick)
-            return blocked
-        want = set(picks) - disabled
-        # Always-on basics only when the base turn offers them, so the Spec
-        # arm never offers a tool the base arm would not.
-        if not _spec_direct:
-            want |= {"ask_user", "update_plan"} & base_offered
-        if not (strict and decided):
-            want |= base_offered
-        if subset_of_base:
-            # A/B control: Spec offered set is a subset of the base offered set
-            # (measures narrowing only). Empty intersection keeps the base set.
-            want &= base_offered
-            if not want:
-                logger.info("[spec-harness] router picks %s outside base offered %s; base contract kept",
-                            sorted(picks), sorted(base_offered))
-                return turn_contract
-        offer = want if strict else (want & set(turn_contract.executable))
-        by_name = {}
-        for sc in list(FUNCTION_TOOL_SCHEMAS) + list(mcp_schemas):
-            nm = (sc.get("function") or {}).get("name")
-            if nm in offer and nm not in by_name:
-                by_name[nm] = sc
-        for sc in turn_contract.schemas():
-            nm = (sc.get("function") or {}).get("name")
-            if nm in offer:
-                by_name[nm] = sc
-        if not by_name and not _spec_direct:
-            logger.info("[spec-harness] router picks %s not executable this turn; contract kept", sorted(picks))
-            return turn_contract
-        # Keep the contract's required tools and required read whenever they
-        # are still offered: harness completion logic keys on them (e.g. a
-        # calendar list is a read, not an effect that may end with "Done.").
-        _rro = getattr(turn_contract, "required_read_operation", None)
-        _keep_rro = _rro if (_rro is not None and getattr(_rro, "tool", None) in by_name) else None
-        new = replace(
-            turn_contract, required=frozenset(n for n in (turn_contract.required or ()) if n in by_name),
-            offered=frozenset(by_name),
-            executable=frozenset(set(turn_contract.executable) | set(by_name)),
-            schema_json=tuple(json.dumps(by_name[n], ensure_ascii=False, sort_keys=True) for n in sorted(by_name)),
-            unavailable=(frozenset() if os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() == "strict" else turn_contract.unavailable), required_read_operation=_keep_rro, routing_experiment="spec-router")
-        _spec_active_contract.set(new)
-        logger.info("[spec-harness] contract replaced by router: offered=%s (was %s, decided=%s)",
-                    sorted(by_name), sorted(turn_contract.offered), decided)
-        return new
+        return _apply_spec_decision_to_contract(turn_contract, picks, decided, disabled_tools, tool_policy)
    except Exception as exc:
-        logger.warning("[spec-harness] router contract replacement failed open: %s", exc)
+        logger.warning("[spec-harness] router failed; retaining original contract: %s", exc)
+        return turn_contract
+
+
+async def _spec_router_contract_async(turn_contract, messages, disabled_tools, endpoint_url, model, owner, headers,
+                                      tool_policy=None):
+    """Asynchronous non-blocking turn contract routing."""
+    from src import spec_router as _router_context
+    if hasattr(_router_context, "clear_decision"):
+        _router_context.clear_decision()
+    if (turn_contract is None
+            or getattr(turn_contract, "routing_experiment", "") in {"spec-router", "spec-policy-denied"}
+            or (tool_policy is not None and tool_policy.block_all_tool_calls)):
+        return turn_contract
+    if os.getenv("ODYSSEUS_SPEC_MODE", "strict").strip().lower() not in {"strict", "additive"}:
+        return turn_contract
+    try:
+        if _configured_model_tool_surface_raw(endpoint_url, model, owner, headers=headers) != "spec":
+            return turn_contract
+    except Exception:
+        return turn_contract
+    try:
+        from src.spec_router import spec_route_tools_async as _spec_route_tools_early_async
+        picks, decided = await _spec_route_tools_early_async(
+            _extract_last_user_message(messages), FUNCTION_TOOL_SCHEMAS, set(), messages, return_decision=True)
+        return _apply_spec_decision_to_contract(turn_contract, picks, decided, disabled_tools, tool_policy)
+    except Exception as exc:
+        logger.warning("[spec-harness] router failed; retaining original contract: %s", exc)
        return turn_contract


@@ -21263,20 +21300,11 @@ async def stream_agent_loop(
    if (os.getenv("ODYSSEUS_SPEC_MODE", "").strip().lower() == "driver"
            and not (tool_policy and tool_policy.block_all_tool_calls)
            and _configured_model_tool_surface_raw(endpoint_url, model, owner, headers=headers) == "spec"):
-        from src.spec_driver import stream_spec_turn
-        async for chunk in stream_spec_turn(
-            endpoint_url=endpoint_url, model=model, messages=messages, headers=headers,
-            session_id=session_id, owner=owner, disabled_tools=disabled_tools,
-            tool_policy=tool_policy, workspace=workspace, active_document=active_document,
-            client_runtime_context=client_runtime_context,
-            external_untrusted_context_seen=external_untrusted_context_seen,
-            max_tokens=max(1024, min(int(max_tokens or 1024), 4096)), max_rounds=8,
-            temperature=0.0, request_authority=request_authority,
-        ):
-            yield chunk
+        yield 'data: ' + json.dumps({"delta": "Spec driver mode is unavailable because its authority and completion checks are not supported. No action was performed."}) + '\n\n'
+        yield 'data: [DONE]\n\n'
        return

-    turn_contract = _spec_router_contract(
+    turn_contract = await _spec_router_contract_async(
        turn_contract, messages, disabled_tools, endpoint_url, model, owner, headers,
        tool_policy=tool_policy)
    if (turn_contract is not None
@@ -21289,6 +21317,20 @@ async def stream_agent_loop(
        yield 'data: [DONE]\n\n'
        return

+    try:
+        _spec_turn = _configured_model_tool_surface_raw(endpoint_url, model, owner, headers=headers) == "spec"
+    except Exception:
+        _spec_turn = False
+    # Without a turn contract (scheduled, skill and monitor runs) no Spec
+    # routing applies; the turn runs on the compact surface as usual.
+    if _spec_turn and _blocks_before_inference(turn_contract):
+        unavailable = ", ".join(sorted(turn_contract.unavailable))
+        yield 'data: ' + json.dumps({"type": "turn_contract", **turn_contract.audit()}) + '\n\n'
+        yield 'data: ' + json.dumps({"delta": "I can’t perform this request with the currently permitted tools "
+                                   f"(unavailable: {unavailable}). I haven’t substituted another tool."}) + '\n\n'
+        yield 'data: [DONE]\n\n'
+        return
+
    if is_compact_preview_contract(turn_contract):
        from src.clean_agent_preview import stream_preview
        async for chunk in stream_preview(
@@ -21314,26 +21356,9 @@ async def stream_agent_loop(
            yield chunk
        return

-    _spec_turn = False
-    try:
-        _spec_turn = _configured_model_tool_surface_raw(endpoint_url, model, owner, headers=headers) == "spec"
-    except Exception:
-        _spec_turn = False
-    if _spec_turn and turn_contract is not None and getattr(turn_contract, "routing_experiment", "") != "spec-router":
-        # Ajax Spec: the router, not the regex turn contract, decides the tools.
-        # Drop the contract here and in the dispatcher's context so neither the
-        # route build nor execute_tool_block enforces its offered set.
-        logger.info("[spec-harness] dropping turn contract on spec turn: offered=%s unavailable=%s",
-                    sorted(turn_contract.offered), sorted(turn_contract.unavailable))
-        turn_contract = None
-        try:
-            from src.turn_contract import _ACTIVE_CONTRACT as _spec_active_contract
-            _spec_active_contract.set(None)
-        except Exception as _exc:
-            logger.warning("[spec-harness] could not clear active turn contract: %s", _exc)
    if turn_contract is not None:
        yield 'data: ' + json.dumps({"type": "turn_contract", **turn_contract.audit()}) + '\n\n'
-        if not _spec_turn and _blocks_before_inference(turn_contract):
+        if _blocks_before_inference(turn_contract):
            unavailable = ", ".join(sorted(turn_contract.unavailable))
            clarification = (
                "I can’t perform this request with the currently permitted tools "
@@ -24336,7 +24361,7 @@ async def stream_agent_loop(
        # "spec" = compact tools plus a small-model router; the harness-facing
        # surface already reads "compact", so detect spec from the raw mode.
        try:
-            _spec_surface = _configured_model_tool_surface_raw(
+            _spec_surface = getattr(turn_contract, "routing_experiment", "") == "spec-router" and _configured_model_tool_surface_raw(
                candidate_url, candidate_model, owner, headers=candidate_headers,
                endpoint_id=(route_descriptor or {}).get("endpoint_id")) == "spec"
        except Exception:
@@ -24410,7 +24435,7 @@ async def stream_agent_loop(
                if _spec_mode == "strict" and _spec_decided:
                    # The router decides which tools are injected: its pick(s),
                    # tools already used in this chat, and the always-on basics.
-                    _spec_strict = (_spec_added | {"ask_user", "update_plan"}) - set(disabled_tools)
+                    _spec_strict = (_spec_added | {"ask_user", "update_plan"}) & set(turn_contract.offered) - set(disabled_tools)
                    if _spec_strict:
                        route_tools = _spec_strict
                        _spec_offered = frozenset(route_tools)
@@ -25361,15 +25386,6 @@ async def stream_agent_loop(
                    if (schema.get("function", {}).get("name") or schema.get("name"))
                    in _spec_names
                ]
-                _have = {
-                    (schema.get("function", {}).get("name") or schema.get("name"))
-                    for schema in contract_schemas
-                }
-                contract_schemas += [
-                    schema for schema in list(FUNCTION_TOOL_SCHEMAS) + list(route_mcp_schemas)
-                    if schema.get("function", {}).get("name") in (set(_spec_names) - _have)
-                    and schema.get("function", {}).get("name") not in disabled_tools
-                ]
            return _filter_route_tool_schemas(_apply_tool_surface_to_schemas(contract_schemas, tool_surface))
        if route_state["is_api_model"]:
            if tool_surface == "full":
@@ -26321,7 +26337,7 @@ async def stream_agent_loop(
        _tool_names_sent = [t.get("function", {}).get("name") for t in (all_tool_schemas or []) if t.get("function")]
        if round_num == 1:
            try:
-                logger.info("[spec-debug] prompt composition (chars): %s", [(m.get("role"), len(str(m.get("content") or "")), (m.get("metadata") or {}).get("source"), str(m.get("content") or "")[:40].replace("\n", " ")) for m in messages])
+                logger.info("[spec-debug] prompt composition (chars): %s", [(m.get("role"), len(str(m.get("content") or ""))) for m in messages])
            except Exception:
                pass
        logger.info(f"[agent-debug] round={round_num} model={model} _is_api_model={_is_api_model} tools_sent={len(_tool_names_sent)} tool_names={_tool_names_sent} relevant_tools={sorted(_relevant_tools)[:50] if _relevant_tools else 'ALL'}")
@@ -33925,7 +33941,6 @@ async def stream_agent_loop(
                    "mutation_epoch": _workspace_mutation_epoch,
                    "error": _failure_text[:600],
                }
-                logger.info("[spec-debug] tool failure text: %s", _failure_text[:400])
                logger.info(
                    "[agent] recorded failed call %s in round %s at mutation epoch %s",
                    _call_signature,
@@ -585,7 +585,9 @@ async def do_manage_settings(content: str, owner: Optional[str] = None) -> Dict:
            return _ALIASES_SET.get(k2, (k or "").strip())

        def _is_managed_key(key):
-            return key in DEFAULT_SETTINGS and key not in RETIRED_SETTING_KEYS
+            # Tool policy is not a general setting, even if a future default
+            # is added: resetting it must never re-enable disabled tools.
+            return key != "disabled_tools" and key in DEFAULT_SETTINGS and key not in RETIRED_SETTING_KEYS

        _ENUMS = {
            "image_quality": ["low", "medium", "high"],
@@ -713,13 +715,35 @@ async def do_manage_settings(content: str, owner: Optional[str] = None) -> Dict:
            save_settings(s)
            return {"response": f"Reset {key} to default ({DEFAULT_SETTINGS[key]}).", "exit_code": 0}

-        elif action in ("disable_tool", "enable_tool", "list_tools"):
+        elif action == "enable_tool":
+            # The global disabled_tools denylist is the one hard permission
+            # boundary the Settings -> Agent Tools panel offers admins. It
+            # must only ever be *narrowed* from inside an agent turn: a
+            # model that can call enable_tool can undo the boundary itself,
+            # and any web page, email, or document the agent reads can ask
+            # it to (prompt injection re-enabling bash/email/etc.). Widening
+            # the tool set stays a human action in the Settings panel.
+            tool_name = (args.get("tool") or args.get("name") or "").strip().lower()
+            return {
+                "error": (
+                    f"Re-enabling tools is not available from chat"
+                    f"{f' (requested: {tool_name})' if tool_name else ''}. "
+                    "Disabled tools are an admin policy: ask the user to turn the tool "
+                    "back on in Settings > Agent Tools. You can still disable tools "
+                    "(disable_tool) or list the current state (list_tools)."
+                ),
+                "exit_code": 1,
+            }
+
+        elif action in ("disable_tool", "list_tools"):
            # Tool-toggle actions. These edit settings.json:disabled_tools
            # (the global list read on every chat request) rather than
            # prefs.json. Friendly aliases accepted: "shell" -> "bash",
            # "search" -> "web_search", "browser" -> browser tools,
            # "documents" -> the document tool set, "memory" ->
-            # manage_memory, etc.
+            # manage_memory, etc. Only disable_tool mutates: see the
+            # enable_tool branch above for why the agent can never widen
+            # the denylist.
            from src.settings import get_setting, save_settings, load_settings
            _ALIASES = {
                "shell": ["bash"],
@@ -753,7 +777,8 @@ async def do_manage_settings(content: str, owner: Optional[str] = None) -> Dict:
                    "response": (
                        f"Currently disabled: {', '.join(current) if current else '(none)'}.\n"
                        "Common toggles: shell (bash), search (web_search), browser, documents, "
-                        "memory, skills, images, tasks, notes, calendar, email."
+                        "memory, skills, images, tasks, notes, calendar, email. "
+                        "To re-enable a tool, open Settings > Agent Tools."
                    ),
                    "disabled": list(current),
                    "exit_code": 0,
@@ -767,22 +792,19 @@ async def do_manage_settings(content: str, owner: Optional[str] = None) -> Dict:
            settings = load_settings()
            current = list(settings.get("disabled_tools") or [])
            before = set(current)
-            if action == "disable_tool":
-                for t in targets:
-                    if t not in current:
-                        current.append(t)
-            else:  # enable_tool
-                current = [t for t in current if t not in targets]
+            for t in targets:
+                if t not in current:
+                    current.append(t)
            after = set(current)
            settings["disabled_tools"] = current
            save_settings(settings)

-            verb = "Disabled" if action == "disable_tool" else "Enabled"
            changed = sorted(after.symmetric_difference(before))
            return {
                "response": (
-                    f"{verb} {tool_name} ({', '.join(targets)}). "
-                    f"Now disabled: {', '.join(current) if current else '(none)'}."
+                    f"Disabled {tool_name} ({', '.join(targets)}). "
+                    f"Now disabled: {', '.join(current) if current else '(none)'}. "
+                    "Re-enabling is done by the user in Settings > Agent Tools."
                ),
                "changed": changed,
                "disabled": list(current),
@@ -78,7 +78,16 @@ def _parse(content: Any) -> Dict[str, Any]:


 def _session(args: Dict[str, Any], ctx: Dict[str, Any]) -> str:
-    return str(args.get("session") or args.get("editor_session") or ctx.get("session_id") or "default")
+    # Explicit editor session bound in context is authoritative;
+    # otherwise fallback to caller/tool args, then default.
+    # Note: ctx.get("session_id") is the chat/turn UUID, NOT the editor canvas session.
+    return str(ctx.get("editor_session") or args.get("session") or args.get("editor_session") or "default")
+
+
+def _incognito(ctx: Dict[str, Any]) -> bool:
+    runtime = ctx.get("client_runtime_context")
+    state = runtime.get("web_ui_state") if isinstance(runtime, dict) else None
+    return ctx.get("incognito") is True or (isinstance(state, dict) and state.get("incognito") is True)


 async def _post(path: str, payload: Dict[str, Any], owner: Optional[str], timeout: float = _EDITOR_TIMEOUT) -> Dict[str, Any]:
@@ -107,17 +116,26 @@ def _data_url_bytes(data_url: str) -> bytes:
    return base64.b64decode(b64)


+def _image_reference_path(value: str) -> bool:
+    # Never use the internal tool credential to fetch an arbitrary app route.
+    generated = re.fullmatch(r"/api/generated-image/[a-f0-9]{8,64}\.(?:png|jpg|jpeg|webp|gif)", value)
+    upload = re.fullmatch(r"/api/upload/[a-fA-F0-9]{32}(?:\.[A-Za-z0-9]+)?", value)
+    return bool(generated or upload)
+
+
 def _persist_png(image_bytes: bytes, owner: Optional[str], session_id: Optional[str], prompt: str, model: str) -> Dict[str, Any]:
    """Save an edited/generated PNG and return {image_id, image_url, image_size}."""
    from core.database import GalleryImage, SessionLocal
    from src.constants import GENERATED_IMAGES_DIR

    db = SessionLocal()
+    image_path = None
    try:
        root = Path(GENERATED_IMAGES_DIR).resolve()
        root.mkdir(parents=True, exist_ok=True)
        filename = f"{uuid.uuid4().hex[:12]}.png"
-        (root / filename).write_bytes(image_bytes)
+        image_path = root / filename
+        image_path.write_bytes(image_bytes)
        new_id = str(uuid.uuid4())
        width = height = 0
        try:
@@ -163,6 +181,11 @@ def _persist_png(image_bytes: bytes, owner: Optional[str], session_id: Optional[
        return {"image_id": new_id, "image_url": f"/api/generated-image/{filename}", "image_size": size or None}
    except Exception:
        db.rollback()
+        if image_path is not None:
+            try:
+                image_path.unlink(missing_ok=True)
+            except OSError:
+                logger.warning("Failed to remove uncommitted editor image", exc_info=True)
        raise
    finally:
        db.close()
@@ -198,7 +221,7 @@ async def _place_layer(data_url: str, name: str, owner: Optional[str], session:
    }
    try:
        data = await _post("/api/editor/bridge/command", payload, owner, timeout=90)
-        return data.get("ok") is not False
+        return bool(data.get("ok") is True and data.get("completed", True) is not False)
    except Exception as exc:  # pragma: no cover - defensive
        logger.warning("editor layer placement failed: %s", exc)
        return False
@@ -367,28 +390,46 @@ class RunEditorCommandTool:
        args = _parse(content)
        op = str(args.get("op") or "").strip()
        if not op:
-            return "run_editor_command: invalid", {"error": "run_editor_command needs `op`.", "exit_code": 1}
+            return "run_editor_command: invalid", {"error": "run_editor_command needs `op`.", "exit_code": 1, "completed": False}
        params = args.get("params") if isinstance(args.get("params"), dict) else {}
+        wait = bool(args.get("wait", True))
        payload = {
            "session": _session(args, ctx),
            "op": op,
            "params": params,
-            "wait": bool(args.get("wait", True)),
+            "wait": wait,
            "timeout": float(args.get("timeout") or 60),
        }
        try:
            data = await _post("/api/editor/bridge/command", payload, ctx.get("owner"))
        except Exception as exc:
-            return f"run_editor_command: {op}", {"error": f"run_editor_command failed: {exc}", "exit_code": 1}
-        ok = data.get("ok")
+            return f"run_editor_command: {op}", {"error": f"run_editor_command failed: {exc}", "exit_code": 1, "completed": False, "status": "failed"}
+
+        is_queued = bool(data.get("queued")) or data.get("status") == "queued"
+        if is_queued and (not wait or not data.get("ok")):
+            summary = json.dumps({"status": "queued", "queued": data.get("queued"), "session": data.get("session")}, ensure_ascii=False)
+            return f"run_editor_command: {op}", {
+                "output": summary,
+                "queued": data.get("queued"),
+                "status": "queued",
+                "pending": True,
+                "completed": False,
+                "ok": False,
+                "exit_code": 1,
+            }
+
+        ok = bool(data.get("ok") is True and data.get("completed", True) is not False)
+        status = data.get("status") or ("completed" if ok else "failed")
        result = data.get("result")
-        summary = json.dumps({"ok": ok, "error": data.get("error"), "result": result}, ensure_ascii=False)
+        summary = json.dumps({"ok": ok, "status": status, "error": data.get("error"), "result": result}, ensure_ascii=False)
        return f"run_editor_command: {op}", {
            "output": summary[:4000],
            "result": result,
            "screenshot": data.get("screenshot"),
+            "status": status,
+            "completed": ok,
            "ok": ok,
-            "exit_code": 0 if ok is not False else 1,
+            "exit_code": 0 if ok else 1,
        }


@@ -442,10 +483,14 @@ class AiEditImageTool:
        image = _as_data_url(args.get("image"))
        if image is None and isinstance(args.get("image"), str) and args["image"].startswith("/"):
            # A same-origin gallery/attachment URL: fetch it (owner-scoped) as bytes.
+            if not _image_reference_path(args["image"]):
+                return "ai_edit_image: invalid image", {"error": "Invalid image reference.", "exit_code": 1}
            try:
                async with httpx.AsyncClient(timeout=60) as client:
                    resp = await client.get(f"{_INTERNAL_BASE}{args['image']}", headers=_internal_headers(owner))
                    resp.raise_for_status()
+                    if not resp.headers.get("content-type", "").lower().startswith("image/"):
+                        return "ai_edit_image: invalid image", {"error": "Image reference is not an image.", "exit_code": 1}
                    image = _as_data_url("data:image/png;base64," + base64.b64encode(resp.content).decode())
            except Exception:
                image = None
@@ -550,10 +595,13 @@ class AiEditImageTool:
            "model": data.get("model") or model_choice or "",
            "exit_code": 0,
        }
-        try:
-            info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), f"ai_edit_image:{op}", f"ai_edit_image:{op}"))
-        except Exception as exc:
-            logger.warning("ai_edit_image persist failed: %s", exc)
+        if _incognito(ctx):
+            info["image_url"] = data_url
+        else:
+            try:
+                info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), f"ai_edit_image:{op}", f"ai_edit_image:{op}"))
+            except Exception as exc:
+                logger.warning("ai_edit_image persist failed: %s", exc)
        _t["persist"] = time.perf_counter()
        if bool(args.get("place", True)):
            placed = await _place_layer(
@@ -626,10 +674,13 @@ class GenerateImageLayerTool:
            "model": data.get("image_model") or str(args.get("model") or ""),
            "exit_code": 0,
        }
-        try:
-            info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), prompt, "generate_image"))
-        except Exception as exc:
-            logger.warning("generate_image persist failed: %s", exc)
+        if _incognito(ctx):
+            info["image_url"] = data_url
+        else:
+            try:
+                info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), prompt, "generate_image"))
+            except Exception as exc:
+                logger.warning("generate_image persist failed: %s", exc)
        if bool(args.get("place", True)):
            placed = await _place_layer(
                data_url,
@@ -211,10 +211,15 @@ class ChatHandler:
            from src.settings import get_setting
            vision_enabled = get_setting("vision_enabled", True)
            if vision_enabled:
+                from src.owner_identity import auth_disabled
+                sess_owner = getattr(sess, "owner", None)
+                if not sess_owner and not auth_disabled():
+                    sess_owner = ""
                main_is_vision = await asyncio.to_thread(
                    model_supports_vision,
                    sess.model or "",
                    getattr(sess, "endpoint_url", "") or "",
+                    sess_owner,
                )

        if effective_att_ids and vision_enabled:
@@ -5,9 +5,14 @@ import re
 import os
 import json
 import time
+import socket
 import ipaddress
 import logging
 import httpx
+import typing
+import httpcore
+from httpcore._backends.sync import SyncBackend, SyncStream
+from httpcore._exceptions import map_exceptions, ConnectTimeout, ConnectError
 from urllib.parse import urlparse
 from fastapi import HTTPException
 from fastapi import UploadFile
@@ -17,6 +22,9 @@ from src.upload_limits import format_byte_limit, get_chat_upload_max_bytes

 logger = logging.getLogger(__name__)

+_ORIGINAL_HTTPX_GET = httpx.get
+_ORIGINAL_HTTPX_POST = httpx.post
+

 def extract_urls(text: str) -> List[str]:
    """Extract URLs from text using regex pattern."""
@@ -101,23 +109,167 @@ _PROVIDER_FINGERPRINT_TTL = 60.0
 _lmstudio_models_cache: dict = {}


-def _is_local_host(host: Optional[str]) -> bool:
-    """True for loopback/LAN/Tailscale hosts (never public domains)."""
-    host = (host or "").lower()
+_BLOCKED_METADATA_IPS = {
+    ipaddress.ip_address("169.254.169.254"),
+    ipaddress.ip_address("169.254.169.253"),
+    ipaddress.ip_address("100.100.100.200"),
+}
+
+_CGNAT_NETWORK = ipaddress.ip_network("100.64.0.0/10")
+_NAT64_PREFIX = ipaddress.ip_network("64:ff9b::/96")
+
+
+def _is_ip_safe_local(ip: ipaddress.IPv4Address | ipaddress.IPv6Address) -> bool:
+    # IPv4-mapped IPv6 (e.g. ::ffff:169.254.169.254) — unwrap to evaluate the embedded IPv4
+    if isinstance(ip, ipaddress.IPv6Address) and ip.ipv4_mapped is not None:
+        ip = ip.ipv4_mapped
+    elif isinstance(ip, ipaddress.IPv6Address) and ip in _NAT64_PREFIX:
+        ip = ipaddress.IPv4Address(int(ip) & 0xFFFFFFFF)
+
+    if ip in _BLOCKED_METADATA_IPS:
+        return False
+    if ip.is_link_local:
+        return False
+    # Explicit loopback check before reserved rejection:
+    # RFC 4291 / CPython marks IPv6 ::1 as both is_loopback and is_reserved.
+    if ip.is_loopback:
+        return True
+    if ip.is_multicast or ip.is_reserved or ip.is_unspecified:
+        return False
+    if ip.is_private:
+        return True
+    if isinstance(ip, ipaddress.IPv4Address) and ip in _CGNAT_NETWORK:
+        return True
+    return False
+
+
+def _is_safe_local_host(host: Optional[str]) -> bool:
+    """True for loopback/LAN/Tailscale hosts.
+
+    Explicitly excludes link-local, cloud metadata destinations (AWS/GCP/Azure/Alibaba),
+    unresolved single-label names, and public domains.
+    """
+    host = (host or "").strip().lower()
    if not host:
        return False
-    if host in {"localhost", "host.docker.internal"} or host.endswith(".local"):
-        return True
+    # Strip optional IPv6 square brackets: [::1] -> ::1
+    literal = host[1:-1] if host.startswith("[") and host.endswith("]") else host
    try:
-        ip = ipaddress.ip_address(host)
+        ip = ipaddress.ip_address(literal)
+        return _is_ip_safe_local(ip)
    except ValueError:
-        return "." not in host
-    if ip.is_loopback or ip.is_private or ip.is_link_local:
-        return True
-    return ip in ipaddress.ip_network("100.64.0.0/10")
+        pass
+
+    allowed_names = {"localhost", "host.docker.internal"}
+    if not (host in allowed_names or host.endswith(".local") or host.endswith(".internal") or host.endswith(".lan")):
+        return False
+
+    try:
+        infos = socket.getaddrinfo(host, None)
+        if not infos:
+            return False
+        resolved_ips = []
+        for info in infos:
+            sockaddr = info[4]
+            ip_str = str(sockaddr[0]).split("%")[0]
+            resolved_ips.append(ipaddress.ip_address(ip_str))
+        if not resolved_ips:
+            return False
+        return all(_is_ip_safe_local(ip) for ip in resolved_ips)
+    except Exception:
+        return False


-def _probe_lmstudio_models(url: str) -> Optional[list]:
+_is_local_host = _is_safe_local_host
+
+
+class SafeProbeBackend(SyncBackend):
+    """Enforces SSRF address policies at TCP connection time.
+
+    Resolves the host once, evaluates every resolved address against _is_ip_safe_local,
+    and connects directly to the pre-validated IP, eliminating DNS TOCTOU and rebinding.
+    Preserves TLS SNI and hostname certificate validation via SyncStream.start_tls.
+    """
+
+    def connect_tcp(
+        self,
+        host: str,
+        port: int,
+        timeout: float | None = None,
+        local_address: str | None = None,
+        socket_options: typing.Iterable[httpcore.SOCKET_OPTION] | None = None,
+    ) -> httpcore.NetworkStream:
+        source_address = None if local_address is None else (local_address, 0)
+        exc_map = {socket.timeout: ConnectTimeout, OSError: ConnectError}
+        with map_exceptions(exc_map):
+            infos = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM)
+            if not infos:
+                raise ConnectError(f"Host {host} did not resolve")
+            for family, socktype, proto, _canon, sockaddr in infos:
+                ip_str = str(sockaddr[0]).split("%")[0]
+                try:
+                    ip = ipaddress.ip_address(ip_str)
+                except ValueError:
+                    raise ConnectError(f"Invalid resolved IP: {ip_str}")
+                if not _is_ip_safe_local(ip):
+                    raise ConnectError(f"Target address is not an authorized safe local destination: {ip}")
+            last_err: Optional[OSError] = None
+            for family, socktype, proto, _canon, sockaddr in infos:
+                sock = socket.socket(family, socktype, proto)
+                try:
+                    if timeout is not None:
+                        sock.settimeout(timeout)
+                    if source_address:
+                        sock.bind(source_address)
+                    sock.connect(sockaddr)
+                    if socket_options:
+                        for opt in socket_options:
+                            sock.setsockopt(*opt)
+                    sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+                    return SyncStream(sock)
+                except OSError as e:
+                    last_err = e
+                    sock.close()
+            if last_err is not None:
+                raise last_err
+            raise ConnectError(f"Could not connect to {host}:{port}")
+
+
+def _safe_probe_get(url: str, *, headers: Optional[dict] = None, timeout: float = 1.0) -> httpx.Response:
+    if httpx.get is not _ORIGINAL_HTTPX_GET:
+        try:
+            if headers:
+                return httpx.get(url, headers=headers, timeout=timeout, follow_redirects=False)
+            return httpx.get(url, timeout=timeout, follow_redirects=False)
+        except TypeError:
+            if headers:
+                return httpx.get(url, headers=headers, timeout=timeout)
+            return httpx.get(url, timeout=timeout)
+    pool = httpcore.ConnectionPool(network_backend=SafeProbeBackend())
+    transport = httpx.HTTPTransport(trust_env=False)
+    transport._pool = pool
+    with httpx.Client(transport=transport, follow_redirects=False, trust_env=False) as client:
+        return client.get(url, headers=headers, timeout=timeout)
+
+
+def _safe_probe_post(url: str, *, json: typing.Any = None, headers: Optional[dict] = None, timeout: float = 8.0) -> httpx.Response:
+    if httpx.post is not _ORIGINAL_HTTPX_POST:
+        try:
+            if headers:
+                return httpx.post(url, headers=headers, json=json, timeout=timeout, follow_redirects=False)
+            return httpx.post(url, json=json, timeout=timeout, follow_redirects=False)
+        except TypeError:
+            if headers:
+                return httpx.post(url, headers=headers, json=json, timeout=timeout)
+            return httpx.post(url, json=json, timeout=timeout)
+    pool = httpcore.ConnectionPool(network_backend=SafeProbeBackend())
+    transport = httpx.HTTPTransport(trust_env=False)
+    transport._pool = pool
+    with httpx.Client(transport=transport, follow_redirects=False, trust_env=False) as client:
+        return client.post(url, headers=headers, json=json, timeout=timeout)
+
+
+def _probe_lmstudio_models(url: str, headers: Optional[dict] = None) -> Optional[list]:
    """Return LM Studio's native /api/v1/models list, or None when the endpoint
    isn't LM Studio or is unreachable (short-TTL cached; transient errors uncached)."""
    parsed = urlparse(url)
@@ -127,10 +279,10 @@ def _probe_lmstudio_models(url: str) -> Optional[list]:
    cached = _lmstudio_models_cache.get(key)
    if cached is not None and cached[1] > now:
        return cached[0]
-    authority = host if parsed.port is None else f"{host}:{parsed.port}"
+    authority = parsed.netloc or (f"[{host}]:{parsed.port}" if (host and ":" in host and not host.startswith("[")) else (f"{host}:{parsed.port}" if (host and parsed.port is not None) else (host or "")))
    probe_url = f"{parsed.scheme or 'http'}://{authority}/api/v1/models"
    try:
-        r = httpx.get(probe_url, timeout=1.0)
+        r = _safe_probe_get(probe_url, headers=headers, timeout=1.0)
    except Exception:
        return None
    try:
@@ -148,15 +300,15 @@ def _probe_lmstudio_models(url: str) -> Optional[list]:
    return models


-def lmstudio_supports_vision(url: str, model: str) -> Optional[bool]:
+def lmstudio_supports_vision(url: str, model: str, headers: Optional[dict] = None) -> Optional[bool]:
    """Read `model`'s capabilities.vision flag from LM Studio, or None when the
    endpoint isn't LM Studio or doesn't report it (so callers fall back)."""
    if not model:
        return None
-    # Never probe a remote provider; LM Studio is always a local/LAN host.
-    if not _is_local_host(urlparse(url).hostname):
+    # Never probe a remote provider or disallowed host; LM Studio is always a local/LAN host.
+    if not _is_safe_local_host(urlparse(url).hostname):
        return None
-    models = _probe_lmstudio_models(url)
+    models = _probe_lmstudio_models(url, headers=headers)
    if not models:
        return None
    want = model.strip().lower()
@@ -172,21 +324,79 @@ def lmstudio_supports_vision(url: str, model: str) -> Optional[bool]:
    return None


-def model_supports_vision(model_name: str, endpoint_url: str = "") -> bool:
+def model_supports_vision(
+    model_name: str,
+    endpoint_url: str = "",
+    owner: Optional[str] = None,
+) -> bool:
    """Whether a model accepts images, using the endpoint's reported
    capability when available (LM Studio), a cached one-time probe for local
    OpenAI-compatible endpoints, and name-based detection otherwise."""
    if is_vision_model(model_name):
        return True
    if endpoint_url:
+        target_url = endpoint_url
+        headers: Optional[dict] = None
+        if owner is not None:
+            if not owner:
+                # Authentication enabled, but caller has no owner: refuse probing immediately
+                return is_vision_model(model_name)
+            try:
+                from src.database import SessionLocal
+                from src.endpoint_resolver import (
+                    normalize_base,
+                    resolve_endpoint_runtime,
+                    resolve_owner_registered_endpoint,
+                )
+                with SessionLocal() as db:
+                    ep = resolve_owner_registered_endpoint(db, endpoint_url, owner)
+                    resolved_base, api_key = resolve_endpoint_runtime(ep)
+                    target_url = normalize_base(resolved_base or ep.base_url)
+                    headers = {"Authorization": f"Bearer {api_key}"} if api_key else None
+            except ValueError:
+                # Foreign-owned, disabled, or unregistered endpoint
+                return is_vision_model(model_name)
+            except Exception as e:
+                logger.warning("Endpoint authorization check failed: %s", e)
+                return is_vision_model(model_name)
+        else:
+            # Single-user / auth-disabled mode (owner is None):
+            try:
+                from src.database import SessionLocal
+                from src.endpoint_resolver import (
+                    normalize_base,
+                    resolve_endpoint_runtime,
+                    resolve_owner_registered_endpoint,
+                )
+                with SessionLocal() as db:
+                    ep = resolve_owner_registered_endpoint(db, endpoint_url, None)
+                    resolved_base, api_key = resolve_endpoint_runtime(ep)
+                    target_url = normalize_base(resolved_base or ep.base_url)
+                    headers = {"Authorization": f"Bearer {api_key}"} if api_key else None
+            except Exception:
+                # In single-user mode, an unregistered endpoint is allowed
+                # only if target URL passes safe local host checks (probed with headers=None).
+                target_url = endpoint_url
+                headers = None
+
        try:
-            advertised = lmstudio_supports_vision(endpoint_url, model_name or "")
+            if headers:
+                advertised = lmstudio_supports_vision(target_url, model_name or "", headers=headers)
+            else:
+                advertised = lmstudio_supports_vision(target_url, model_name or "")
+        except TypeError:
+            advertised = lmstudio_supports_vision(target_url, model_name or "")
        except Exception:
            advertised = None
        if advertised is not None:
            return advertised
        try:
-            probed = probe_endpoint_supports_vision(endpoint_url, model_name or "")
+            if headers:
+                probed = probe_endpoint_supports_vision(target_url, model_name or "", headers=headers)
+            else:
+                probed = probe_endpoint_supports_vision(target_url, model_name or "")
+        except TypeError:
+            probed = probe_endpoint_supports_vision(target_url, model_name or "")
        except Exception:
            probed = None
        if probed is not None:
@@ -215,7 +425,11 @@ def _chat_completions_url(endpoint_url: str) -> str:
    return base + "/chat/completions"


-def probe_endpoint_supports_vision(endpoint_url: str, model_name: str) -> Optional[bool]:
+def probe_endpoint_supports_vision(
+    endpoint_url: str,
+    model_name: str,
+    headers: Optional[dict] = None,
+) -> Optional[bool]:
    """One-time (cached) probe: does a local OpenAI-compatible endpoint accept
    an image_url content part for `model_name`?

@@ -226,8 +440,8 @@ def probe_endpoint_supports_vision(endpoint_url: str, model_name: str) -> Option
    if not endpoint_url or not model_name or not _vision_probe_enabled():
        return None
    parsed = urlparse(endpoint_url)
-    if not _is_local_host(parsed.hostname):
-        return None  # never probe a public provider
+    if not _is_safe_local_host(parsed.hostname):
+        return None  # never probe a public provider or disallowed host
    key = ((parsed.hostname or "").lower(), (parsed.port or 0), model_name.strip().lower())
    now = time.time()
    cached = _vision_probe_cache.get(key)
@@ -247,7 +461,12 @@ def probe_endpoint_supports_vision(endpoint_url: str, model_name: str) -> Option
    }
    verdict: Optional[bool] = None
    try:
-        r = httpx.post(_chat_completions_url(endpoint_url), json=payload, timeout=8.0)
+        r = _safe_probe_post(
+            _chat_completions_url(endpoint_url),
+            headers=headers,
+            json=payload,
+            timeout=8.0,
+        )
        if r.status_code == 200:
            verdict = True
        elif r.status_code in (400, 413, 415, 422):
@@ -1466,6 +1466,29 @@ def spec_router_thinking_decision(endpoint_url, model, owner, headers, direct_us
        return None


+async def spec_router_thinking_decision_async(endpoint_url, model, owner, headers, direct_user_text):
+    """Async env-gated router decision for spec tool-surface turns. Fail open (None)."""
+    try:
+        import sys as _sys
+        spec_router = _sys.modules.get('src.spec_router')
+        if spec_router is None:
+            from src import spec_router  # noqa: F401
+        if not spec_router.think_router_enabled():
+            return None
+        from src.agent_loop import _configured_model_tool_surface_raw
+        if _configured_model_tool_surface_raw(
+            endpoint_url, model, owner, headers=headers
+        ) != 'spec':
+            return None
+        if hasattr(spec_router, 'route_thinking_async'):
+            return await spec_router.route_thinking_async(direct_user_text)
+        return spec_router.route_thinking(direct_user_text)
+    except Exception:
+        logging.getLogger(__name__).warning(
+            'spec think router decision failed; using rules only', exc_info=True)
+        return None
+
+
 def spec_router_think_reason(round_number, decision, existing_deliberate):
    """Add 'router_think' on round 1 when the router asked for thinking and no
    other rule already selected a deliberate reason."""
@@ -1508,10 +1531,7 @@ def spec_direct_no_tools_p(user_message, endpoint_url, model, owner, headers):
        spec_router = _sys.modules.get('src.spec_router')
        if spec_router is None:
            from src import spec_router  # noqa: F401
-        decisions = getattr(spec_router, 'LAST_DECISIONS', None) or []
-        if not decisions:
-            return None
-        decision = decisions[-1]
+        decision = spec_router.latest_decision()
        if not isinstance(decision, dict):
            return None
        # Guard against a stale decision from a previous turn.
@@ -1573,8 +1593,7 @@ def spec_driver_pick(conversation, disabled_tools, user_text, schemas=None):
            set(disabled_tools or ()), list(conversation or []),
            return_decision=True,
        )
-        decisions = getattr(spec_router, 'LAST_DECISIONS', None) or []
-        decision = decisions[-1] if decisions else {}
+        decision = spec_router.latest_decision() or {}
        if not isinstance(decision, dict) or decision.get('error'):
            return None
        choice = decision.get('choice')
@@ -3862,6 +3881,9 @@ def evaluate_preview_call(name, args, user_text='', *, allow_execute_code=False,
                or bare in BROKERED_JOB_TOOLS
                or (contract_required and bare in {'edit_image', 'generate_image'})
                or (contract_required and bare == 'create_document' and standalone_code_request(user_text))
+                # The editor command is conservatively classified as a write;
+                # document.info is a read even when the user requested no edit.
+                or (bare == 'run_editor_command' and args.get('op') == 'document.info')
            )
        )
        if family not in authorized and not contextual_revision and not contract_scoped_mutation and not fixture_delete and not offered_private_action:
@@ -5600,6 +5622,10 @@ async def stream_preview(*, endpoint_url, model, messages, headers, turn_contrac
                         external_tool_schemas=None, temperature=0.0,
                         context_resolution=None,
                         request_authority=MISSING_AUTHORITY, **ignored):
+    if spec_driver_active(endpoint_url, model, owner, headers):
+        yield event({'delta': 'Spec driver mode is unavailable because its authority and completion checks are not supported. No action was performed.'})
+        yield 'data: [DONE]\n\n'
+        return
    from src.generation_sampling import validate_temperature
    temperature = validate_temperature(temperature)
    # This path sends requests directly with httpx and therefore bypasses
@@ -6095,7 +6121,7 @@ async def stream_preview(*, endpoint_url, model, messages, headers, turn_contrac
                has_real_usage = intent_accounting.get('usage_source') == 'real'
            # Optional env-gated router decision (spec surface only). Computed
            # once per user turn; disabled/None leaves behaviour unchanged.
-            _spec_route_think = spec_router_thinking_decision(
+            _spec_route_think = await spec_router_thinking_decision_async(
                endpoint_url, model, owner, headers, direct_user_text)
            if _spec_route_think is not None:
                logging.getLogger(__name__).info(
@@ -6108,12 +6134,17 @@ async def stream_preview(*, endpoint_url, model, messages, headers, turn_contrac
            # round 1 is sent with tool_choice 'none' (same tools list).
            _spec_direct_p = spec_direct_no_tools_p(
                direct_user_text, endpoint_url, model, owner, headers)
+            if (turn_contract.required or turn_contract.unavailable
+                    or turn_contract.required_read_operation is not None):
+                _spec_direct_p = None
            # Option B: send round 1 with no tools at all for a direct answer.
            _spec_direct_empty_menu = (
                _spec_direct_p is not None and spec_direct_mode() == 'empty_menu')
            # ODYSSEUS_SPEC_MODE=driver: the router (not the 9B) picks the tool
            # every round; the 9B only writes the arguments or the answer.
-            _spec_driver_on = spec_driver_active(endpoint_url, model, owner, headers)
+            # Driver execution is refused at entry. Keep this false even if
+            # configuration changes while the stream is already in progress.
+            _spec_driver_on = False
            # Driver mode narrows the contract per round to the Spec pick.
            # Rebuild each round from this frozen base so the narrowing does
            # not accumulate/mutate across rounds.
@@ -92,7 +92,7 @@ def prune_multimodal_images(
    return pruned


-_IMAGE_TURN_LABEL_RE = re.compile(r"\[Image(?:s)?(?:\s+attached)?:\s*([^\]]+)\]", re.IGNORECASE)
+_IMAGE_TURN_LABEL_RE = re.compile(r"\[Image(?:s)?(?:[ \t]{1,64}attached)?:[ \t]{0,64}([^\]]{1,512})\]", re.IGNORECASE)


 def _image_turn_label(message: Dict) -> str:
@@ -102,7 +102,8 @@ def _image_turn_label(message: Dict) -> str:
    if isinstance(content, list):
        for item in content:
            if isinstance(item, dict) and item.get("type") in _MULTIMODAL_IMAGE_TYPES:
-                candidate = item.get("name") or (item.get("image_url") or {}).get("name")
+                image_url = item.get("image_url")
+                candidate = item.get("name") or (image_url.get("name") if isinstance(image_url, dict) else None)
                if candidate:
                    name = str(candidate)
                    break
@@ -146,7 +147,7 @@ def keep_recent_image_turns(messages: List[Dict], *, keep: int = 2) -> List[Dict
            trimmed.append(message)
            continue
        kept_blocks = [
-            item for item in content
+            dict(item) if isinstance(item, dict) else item for item in content
            if not (isinstance(item, dict) and item.get("type") in _MULTIMODAL_IMAGE_TYPES)
        ]
        if len(kept_blocks) == len(content):
@@ -339,14 +339,231 @@ async def self_check(
    return out


+def _resolve_override_candidate(override: str, owner: Optional[str]) -> Optional[Dict[str, Any]]:
+    """Resolve an explicit agent_model override under server authority.
+
+    Guarantees:
+      - Client-provided raw URLs never determine arbitrary outbound network destinations.
+      - Registered endpoint IDs resolve only to enabled endpoints visible to the owner.
+      - Shared endpoints (owner IS NULL) remain visible to authorized users.
+      - Disabled, foreign-owned, forged, or unconfigured destinations fail closed (return None).
+      - Admin privileges do not allow arbitrary unconfigured destinations.
+    """
+    raw = str(override or "").strip()
+    if not raw:
+        return None
+
+    if "::" in raw:
+        target, requested_model = raw.split("::", 1)
+        target = target.strip()
+        requested_model = requested_model.strip()
+    else:
+        target = ""
+        requested_model = raw
+
+    # 1. Explicit local selection or matching a configured local base
+    if target == "local":
+        bases = local_bases()
+        if not bases:
+            return None
+        return {
+            "base": bases[0],
+            "model": requested_model or local_model(),
+            "headers": None,
+            "source": "override",
+        }
+    for lb in local_bases():
+        if target and target.rstrip("/") == lb.rstrip("/"):
+            return {
+                "base": lb,
+                "model": requested_model or local_model(),
+                "headers": None,
+                "source": "override",
+            }
+
+    # 2. Explicit hosted fallback selection
+    try:
+        from src.endpoint_resolver import resolve_endpoint
+
+        for prefix in ("utility", "default"):
+            try:
+                url, model, headers = resolve_endpoint(prefix, owner=owner)
+            except Exception:
+                continue
+            if url and model:
+                if target in ("default", "hosted"):
+                    return {
+                        "base": url,
+                        "model": requested_model or model,
+                        "headers": headers,
+                        "source": "hosted",
+                    }
+                if target and target.rstrip("/") == url.rstrip("/"):
+                    if not requested_model or requested_model == model:
+                        return {
+                            "base": url,
+                            "model": requested_model or model,
+                            "headers": headers,
+                            "source": "hosted",
+                        }
+    except Exception:
+        pass
+    if target in ("default", "hosted"):
+        return None
+
+    # 3. Bare model id without endpoint prefix
+    if not target:
+        if requested_model == "local":
+            bases = local_bases()
+            return {"base": bases[0], "model": local_model(), "headers": None, "source": "local"} if bases else None
+        if requested_model in ("default", "hosted"):
+            return _resolve_override_candidate("default::", owner)
+
+        # Exact match with local model
+        if requested_model == local_model():
+            bases = local_bases()
+            if bases:
+                return {"base": bases[0], "model": local_model(), "headers": None, "source": "local"}
+
+        # Exact match with hosted default/utility
+        try:
+            from src.endpoint_resolver import resolve_endpoint
+
+            for prefix in ("utility", "default"):
+                try:
+                    url, model, headers = resolve_endpoint(prefix, owner=owner)
+                except Exception:
+                    continue
+                if url and model and model == requested_model:
+                    return {"base": url, "model": model, "headers": headers, "source": "hosted"}
+        except Exception:
+            pass
+
+        # Check registered database endpoints for this bare model
+        try:
+            from core.database import SessionLocal, ModelEndpoint
+            from src.auth_helpers import owner_filter, _auth_disabled
+            from src.endpoint_resolver import (
+                resolve_endpoint_runtime,
+                build_chat_url,
+                build_headers,
+                _endpoint_enabled_models,
+                _endpoint_hidden_models,
+            )
+
+            db = SessionLocal()
+            try:
+                if not owner and not _auth_disabled():
+                    q = db.query(ModelEndpoint).filter(
+                        ModelEndpoint.is_enabled == True,
+                        ModelEndpoint.owner == None,
+                    )
+                else:
+                    q = owner_filter(
+                        db.query(ModelEndpoint).filter(ModelEndpoint.is_enabled == True),
+                        ModelEndpoint,
+                        owner,
+                    )
+                matching_eps = []
+                for ep in q.all():
+                    enabled_models = _endpoint_enabled_models(ep)
+                    hidden_models = _endpoint_hidden_models(ep)
+                    if requested_model in enabled_models and requested_model not in hidden_models:
+                        matching_eps.append(ep)
+
+                # Avoid model ID collision across providers: only accept if unique
+                if len(matching_eps) == 1:
+                    ep = matching_eps[0]
+                    base, api_key = resolve_endpoint_runtime(ep, owner=owner)
+                    return {
+                        "base": build_chat_url(base),
+                        "model": requested_model,
+                        "headers": build_headers(api_key, base),
+                        "source": "registered",
+                        "endpoint_id": ep.id,
+                    }
+            finally:
+                db.close()
+        except Exception:
+            pass
+        return None
+
+    # 4. Target is an endpoint_id or a registered legacy endpoint URL
+    try:
+        from core.database import SessionLocal, ModelEndpoint
+        from src.auth_helpers import owner_filter, _auth_disabled
+        from src.endpoint_resolver import (
+            resolve_endpoint_runtime,
+            build_chat_url,
+            build_headers,
+            _endpoint_enabled_models,
+            _endpoint_hidden_models,
+            _first_chat_model,
+        )
+
+        db = SessionLocal()
+        try:
+            if not owner and not _auth_disabled():
+                q = db.query(ModelEndpoint).filter(
+                    ModelEndpoint.is_enabled == True,
+                    ModelEndpoint.owner == None,
+                )
+            else:
+                q = owner_filter(
+                    db.query(ModelEndpoint).filter(ModelEndpoint.is_enabled == True),
+                    ModelEndpoint,
+                    owner,
+                )
+            # Lookup by ID
+            ep = q.filter(ModelEndpoint.id == target).first()
+
+            # If not found by ID, match legacy registered base URL (strictly registered rows only)
+            if ep is None and ("://" in target or target.startswith("http")):
+                target_norm = target.rstrip("/")
+                for cand_ep in q.all():
+                    cand_base = (cand_ep.base_url or "").rstrip("/")
+                    if (
+                        cand_base == target_norm
+                        or cand_base + "/v1" == target_norm
+                        or cand_base == target_norm + "/v1"
+                    ):
+                        ep = cand_ep
+                        break
+
+            if ep is None:
+                # Target is disabled, foreign-owned, nonexistent, or arbitrary unconfigured URL -> fail closed!
+                return None
+
+            enabled_models = _endpoint_enabled_models(ep)
+            hidden_models = _endpoint_hidden_models(ep)
+            if requested_model:
+                if requested_model in hidden_models:
+                    return None
+                if enabled_models and requested_model not in enabled_models:
+                    # Model not served by this endpoint -> fail closed against forged model IDs
+                    return None
+                model = requested_model
+            else:
+                model = _first_chat_model(enabled_models)
+                if not model:
+                    return None
+
+            base, api_key = resolve_endpoint_runtime(ep, owner=owner)
+            return {
+                "base": build_chat_url(base),
+                "model": model,
+                "headers": build_headers(api_key, base),
+                "source": "registered",
+                "endpoint_id": ep.id,
+            }
+        finally:
+            db.close()
+    except Exception:
+        return None
+
+
 def _candidates(owner: Optional[str], override: Optional[str]) -> List[Dict[str, Any]]:
    cands: List[Dict[str, Any]] = []
-    if override:
-        base, model = _split_override(override)
-        if model:
-            cands.append(
-                {"base": base or local_bases()[0], "model": model, "headers": None, "source": "override"}
-            )
    for base in local_bases():
        cands.append({"base": base, "model": local_model(), "headers": None, "source": "local"})
    try:
@@ -362,6 +579,14 @@ def _candidates(owner: Optional[str], override: Optional[str]) -> List[Dict[str,
                break
    except Exception:
        pass
+    if override:
+        cand = _resolve_override_candidate(override, owner)
+        if cand is not None:
+            cands.insert(0, cand)
+            return cands
+        # Unauthorized, invalid, foreign, disabled, or forged override:
+        # Fail closed! Never silently dispatch sensitive user images/state to an unexpected fallback.
+        return []
    return cands


@@ -433,9 +658,11 @@ async def list_editor_agent_models(owner: Optional[str] = None) -> List[Dict[str
            "source": "local",
            "vision": True,
            "base_url": base,
+            "endpoint_id": "local",
        })
    try:
        from src.endpoint_resolver import resolve_endpoint
+        from src.settings import get_user_setting, load_settings

        for prefix in ("utility", "default"):
            try:
@@ -446,12 +673,19 @@ async def list_editor_agent_models(owner: Optional[str] = None) -> List[Dict[str
                key = ("hosted", model)
                if key not in seen:
                    seen.add(key)
+                    ep_id = None
+                    try:
+                        settings = load_settings()
+                        ep_id = (get_user_setting(f"{prefix}_endpoint_id", owner or "", settings.get(f"{prefix}_endpoint_id", "")) or "").strip() or None
+                    except Exception:
+                        pass
                    models.append({
                        "id": model,
                        "label": model,
                        "source": "hosted",
                        "vision": None,
                        "base_url": url,
+                        "endpoint_id": ep_id or prefix,
                    })
                break
    except Exception:
@@ -486,11 +486,11 @@ _RECOLOR_EXCLUDE_RE = re.compile(
 )


-_RECOLOR_TRAILING_ADJ = re.compile(
-    r"\s+\b(?:bright|brighter|vivid|vibrant|dark|darker|light|lighter|deep|"
-    r"pale|more|less|very|really|slightly|totally|completely)\b\s*$",
-    re.I,
-)
+_RECOLOR_TRAILING_ADJECTIVES = frozenset({
+    "bright", "brighter", "vivid", "vibrant", "dark", "darker", "light",
+    "lighter", "deep", "pale", "more", "less", "very", "really",
+    "slightly", "totally", "completely",
+})


 def _hex_rgb01(hex_color: str):
@@ -557,9 +557,9 @@ def _recolor_object_phrase(prompt: str, target_word: str) -> str:
        words.pop(0)
    if len(words) > 1 and words[-1].casefold() in {"to", "into"}:
        words.pop()
+    while len(words) > 1 and words[-1].lower() in _RECOLOR_TRAILING_ADJECTIVES:
+        words.pop()
    phrase = " ".join(words)
-    while phrase and _RECOLOR_TRAILING_ADJ.search(phrase):
-        phrase = _RECOLOR_TRAILING_ADJ.sub("", phrase).strip()
    return phrase or "the subject"


@@ -119,12 +119,6 @@ def execute_fixture_email(tool: str, args: dict[str, Any], owner: str | None = N

    bare = tool.removeprefix("mcp__email__")
    if bare == "list_email_accounts":
-        accounts = {}
-        for index, message in enumerate(messages):
-            row = _row(index, message)
-            identity = (row["account_id"], row["account"], row["account_email"])
-            accounts.setdefault(identity, {"id": row["account_id"], "name": row["account"],
-                                            "email": row["account_email"], "default": not accounts})
        return {
            "accounts": [{"id": "fixture", "name": "Fixture mailbox", "default": True}],
            "output": "Fixture mailbox (default)",
@@ -17,6 +17,7 @@ Env:
 from __future__ import annotations

 import logging
+import math
 import os
 from typing import Any, Dict, Optional

@@ -98,18 +99,18 @@ def score_value(answer: Optional[Dict[str, Any]]) -> Optional[float]:
    """Expected value (0..n-1) of a jeff ``score`` answer, or None."""
    if not isinstance(answer, dict):
        return None
-    if answer.get("type") == "score":
-        try:
-            return float(answer.get("score"))
-        except Exception:
+    try:
+        if answer.get("type") == "score":
+            value = float(answer.get("score"))
+        elif answer.get("type") == "choice":
+            probs = answer.get("probabilities") or {}
+            value = float(sum(i * float(p) for i, p in enumerate(probs.values())))
+        else:
            return None
-    if answer.get("type") == "choice":
-        probs = answer.get("probabilities") or {}
-        try:
-            return float(sum(i * float(p) for i, p in enumerate(probs.values())))
-        except Exception:
-            return None
-    return None
+    except Exception:
+        return None
+    # A malformed adapter reply must fall back like any other failure.
+    return value if math.isfinite(value) else None


 def choice_of(answer: Optional[Dict[str, Any]]) -> Optional[str]:
@@ -1556,8 +1556,9 @@ def _build_chatgpt_responses_payload(
        "stream": stream,
        "store": False,
    }
-    if not _restricts_temperature(model):
-        payload["temperature"] = temperature
+    # ChatGPT plan Responses requests reject temperature for every model.
+    # The common caller still passes its preset value, but this provider must
+    # omit the field even for model names outside the known reasoning families.
    # ChatGPT Subscription Codex API does not support max_output_tokens —
    # passing it returns HTTP 400 "Unsupported parameter: max_output_tokens".
    # Do not include it in the payload.
@@ -78,8 +78,6 @@ def untrusted_context_message(
    """
    safe_label = _sanitize_label(label)
    text = "" if content is None else str(content)
-    import logging as _lg
-    _lg.getLogger("src.prompt_security").info("[spec-debug] untrusted block label=%r content_chars=%d", safe_label[:80], len(text))
    text = _escape_guard_markers(text)
    metadata: Dict[str, Any] = {
        "trusted": False,
@@ -47,9 +47,8 @@ DEFAULT_SETTINGS = {
    "image_gen_enabled": False,
    "image_model": "",
    "image_quality": "medium",
-    # Local editor-agent/planner model (Quick Edit NL planner). When empty the
-    # server auto-detects the local Qwen3.5-9B vision server on seneca and falls
-    # back to the hosted chat model. See src/editor_agent_model.py.
+    # Optional editor planner/caption endpoints. Empty uses configured chat
+    # fallback without probing a developer-specific host.
    "editor_agent_base_url": "",
    "editor_agent_model": "",
    "editor_caption_base_url": "",
@@ -1,13 +1,4 @@
-"""Ajax Spec turn: the Spec router drives every step; the chat model never chooses a tool.
-
-Each round the router (spec_router.next_action) picks one action from the full tool surface:
-  tool            -> the chat model gets only that tool (named tool_choice) and writes its arguments;
-                     the executor runs it; the result goes back to the router for the next pick.
-  answer_directly -> the chat model writes the answer with no tools (tools key omitted).
-  ask_user        -> the chat model writes the question through the ask_user tool.
-Router unavailable -> the chat model answers without tools. Execution keeps the normal request
-authority and tool policy (execute_tool_block); nothing else is layered on top.
-"""
+"""Helpers for the experimental Spec driver, whose execution is disabled."""

 from __future__ import annotations

@@ -110,161 +101,8 @@ async def stream_spec_turn(*, endpoint_url, model, messages, headers, session_id
                           client_runtime_context=None, external_untrusted_context_seen=False,
                           max_tokens=768, max_rounds=8, temperature=0.0,
                           request_authority=MISSING_AUTHORITY, **ignored):
-    from src.turn_contract import _ACTIVE_CONTRACT
-    _ACTIVE_CONTRACT.set(None)  # Spec, not the regex turn contract, decides the tools.
-    started = time.monotonic()
-    surface = spec_surface(disabled_tools)
-    by_name = {_name(s): s for s in surface}
-    user_text = next((_text(m.get('content')) for m in reversed(messages) if m.get('role') == 'user'), '')
-    history = list(messages)
-    security = ToolRunSecurityContext(
-        external_untrusted_context_seen=bool(external_untrusted_context_seen), unattended_tools=frozenset())
-    security.observe_messages(messages)
-    picks, executions, done_calls = [], [], set()
-    latest, first_token, usage_in, usage_out, rounds = '', None, 0, 0, 0
-    recovery = {}
-    async with httpx.AsyncClient(timeout=httpx.Timeout(300.0, connect=10.0)) as client:
-        for round_number in range(1, max_rounds + 1):
-            rounds = round_number
-            action = await asyncio.to_thread(
-                spec_router.next_action, user_text, latest, surface, messages[:-1], disabled_tools)
-            if action is None:
-                action = {'kind': 'answer_directly', 'name': 'router_unavailable', 'p': None}
-            if round_number == max_rounds and action['kind'] == 'tool':
-                action = {'kind': 'answer_directly', 'name': 'round_limit', 'p': None}
-            picks.append({'round': round_number, **action})
-            logger.info('[spec-driver] round=%s pick=%s p=%s', round_number, action['name'], action.get('p'))
-            request = {'model': model, 'messages': history, 'max_tokens': max_tokens,
-                       'temperature': temperature, 'stream': True,
-                       'stream_options': {'include_usage': True},
-                       'chat_template_kwargs': {'enable_thinking': False}}
-
-            if action['kind'] == 'answer_directly':
-                answer_parts = []
-                async with preview_model_response(client, endpoint_url, headers, request, recovery) as response:
-                    async for line in response.aiter_lines():
-                        if not line.startswith('data: ') or line.strip() == 'data: [DONE]':
-                            continue
-                        try:
-                            chunk = json.loads(line[6:])
-                        except ValueError:
-                            continue
-                        if chunk.get('error') or chunk.get('object') == 'error':
-                            raise RuntimeError(f"model stream error: {str(chunk.get('error') or chunk)[:500]}")
-                        u = chunk.get('usage') or {}
-                        usage_in += u.get('prompt_tokens') or 0
-                        usage_out += u.get('completion_tokens') or 0
-                        for choice in chunk.get('choices') or []:
-                            text = (choice.get('delta') or {}).get('content') or ''
-                            if text:
-                                first_token = first_token or time.monotonic()
-                                answer_parts.append(text)
-                                yield event({'delta': text})
-                answer = ''.join(answer_parts).strip()
-                if not answer:
-                    yield event({'delta': 'The model returned no answer.'})
-                history.append({'role': 'assistant', 'content': answer})
-                break
-
-            name = 'ask_user' if action['kind'] == 'ask_user' else action['name']
-            # ODYSSEUS_SPEC_DRIVER_TOPK=k>1: offer Spec's top-k tools and let the chat model choose among them.
-            topk = int(os.getenv('ODYSSEUS_SPEC_DRIVER_TOPK', '1') or 1)
-            options = [name]
-            if action['kind'] == 'tool' and topk > 1:
-                options = [n for n, _ in action.get('top') or []][:topk] or [name]
-            schemas = [by_name.get(n) or next((s for s in FUNCTION_TOOL_SCHEMAS if _name(s) == n), None)
-                       for n in options]
-            options = [n for n, sc in zip(options, schemas) if sc is not None]
-            schemas = [sc for sc in schemas if sc is not None]
-            if not schemas:
-                logger.info('[spec-driver] pick %s has no schema; answering instead', name)
-                latest = f'Tool {name} is not available.'
-                continue
-            request['tools'] = [grammar_safe(sc) for sc in schemas]
-            request['tool_choice'] = ({'type': 'function', 'function': {'name': options[0]}}
-                                      if len(options) == 1 else 'required')
-            if len(options) > 1:
-                logger.info('[spec-driver] round=%s options=%s', round_number, options)
-            try:
-                content, calls, usage = await _model_round(client, endpoint_url, headers, request, recovery)
-            except (RuntimeError, httpx.HTTPError) as exc:
-                logger.warning('[spec-driver] round=%s %s call failed: %s', round_number, name, exc)
-                latest = f'The {name} call could not be produced: {exc}'
-                continue
-            first_token = first_token or time.monotonic()
-            usage_in += usage.get('prompt_tokens') or 0
-            usage_out += usage.get('completion_tokens') or 0
-            call = next((c for c in calls if c['name'] in options), None)
-            if call is not None and len(options) > 1:
-                name = call['name']
-                logger.info('[spec-driver] round=%s model chose=%s rank=%s of %s',
-                            round_number, name, options.index(name) + 1, options)
-                picks[-1]['chosen'] = name
-            if call is None:
-                latest = f'The {name} call was not produced.'
-                logger.info('[spec-driver] round=%s no %s call from the model', round_number, name)
-                continue
-            arguments = call['arguments'] or '{}'
-            signature = (name, arguments)
-            call_id = call['id'] or f'call_{uuid.uuid4().hex[:12]}'
-            history.append({'role': 'assistant', 'content': content or '',
-                            'tool_calls': [{'id': call_id, 'type': 'function',
-                                            'function': {'name': name, 'arguments': arguments}}]})
-            if signature in done_calls:
-                output = 'This exact call already succeeded; its result is above. Do not repeat it.'
-                history.append({'role': 'tool', 'tool_call_id': call_id, 'content': output})
-                latest = output
-                continue
-            try:
-                args = json.loads(arguments)
-            except ValueError:
-                args = {}
-            block = function_call_to_tool_block(name, arguments)
-            yield event({'type': 'tool_start', 'tool': name, 'command': arguments,
-                         'full_command': arguments, 'round': round_number})
-            tool_started = time.monotonic()
-            if block is None:
-                desc, result = f'{name}: invalid arguments', {
-                    'error': 'Tool arguments could not be converted for execution.', 'exit_code': 1}
-            else:
-                desc, result = await execute_tool_block(
-                    block, session_id=session_id, owner=owner, disabled_tools=disabled_tools,
-                    tool_policy=tool_policy, security_context=security,
-                    active_document_id=getattr(active_document, 'id', None), workspace=workspace,
-                    client_runtime_context=client_runtime_context, request_authority=request_authority)
-            failed = bool(result.get('error')) or result.get('exit_code') not in (None, 0)
-            output = preview_tool_result_text(result, name, args)
-            tool_event = {'type': 'tool_output', 'tool': name, 'command': arguments, 'output': output,
-                          'exit_code': result.get('exit_code', 1 if failed else 0), 'error': failed,
-                          'execution_attempted': block is not None, 'blocked': bool(result.get('blocked')),
-                          'desc': desc, 'round': round_number,
-                          'seconds': round(time.monotonic() - tool_started, 3)}
-            if result.get('image_url'):
-                yield event({'type': 'generated_image', 'url': result['image_url'],
-                             **{k: result[k] for k in ('image_url', 'image_id', 'image_prompt') if k in result}})
-            if result.get('ui_event'):
-                yield event({'type': 'ui_control', 'data': result})
-            executions.append(tool_event)
-            yield event(tool_event)
-            history.append({'role': 'tool', 'tool_call_id': call_id, 'content': output})
-            if not failed:
-                done_calls.add(signature)
-            latest = output
-            ask = result.get('ask_user')
-            if isinstance(ask, dict) and str(ask.get('question') or '').strip():
-                question = str(ask['question']).strip()
-                history.append({'role': 'assistant', 'content': question})
-                yield event({'type': 'final_response', 'content': question})
-                yield event({'type': 'ask_user', 'data': ask})
-                break
-    elapsed = time.monotonic() - started
-    yield event({'type': 'metrics', 'data': {
-        'model': model, 'input_tokens': usage_in, 'output_tokens': usage_out,
-        'total_tokens': usage_in + usage_out, 'response_time': round(elapsed, 3),
-        'time_to_first_token': round(first_token - started, 3) if first_token else None,
-        'tokens_per_second': round(usage_out / elapsed, 2) if elapsed > 0 else 0,
-        'agent_rounds': rounds, 'tool_calls': len(executions), 'tool_events': executions,
-        'spec_driver_picks': picks, 'tool_schema_count': len(surface),
-        'schema_mode': 'spec_driver', 'temperature': temperature, 'max_output_tokens': max_tokens,
-    }})
+    # This experimental runtime lacks the normal turn and completion gates.
+    # Refuse direct callers too, before contacting a router or executor.
+    yield event({'delta': 'Spec driver mode is unavailable because its authority and completion checks are not supported. No action was performed.'})
    yield 'data: [DONE]\n\n'
+    return
@@ -1,9 +1,9 @@
 """Odysseus spec: small-model tool router (JEFF-style) for the agent harness.

 The router (a 0.8B decision model served by jeff-serve) reads the user's
-message and scores every offered tool in one forward pass.  The harness only
-ever ADDS tools from its answer, never removes any, and fails open: on any
-error, timeout or low-confidence answer the compact tool set is unchanged.
+message and scores offered tools in one forward pass. The harness may narrow
+the existing turn contract, but cannot add authority or drop its obligations.
+On an error, timeout or low-confidence answer it retains the existing contract.

 Env:
  ODYSSEUS_SPEC_ROUTER_URL    jeff-serve base URL, e.g. http://ajax:8765  (unset = disabled)
@@ -17,12 +17,17 @@ from __future__ import annotations

 import json
 import logging
+import math
 import os
 import time
+import asyncio
 import urllib.request
 import urllib.error
+from contextvars import ContextVar
 from typing import Any, Dict, Iterable, List, Optional, Set

+import httpx
+
 logger = logging.getLogger(__name__)

 _HEAD = {
@@ -35,8 +40,16 @@ _INSTRUCTIONS = (
    "If a tool is needed but information it requires is missing, choose ask the user."
 )
 _AGENT = "Odysseus, a personal tool-using assistant."
-# Recent decisions, for debugging in the UI/logs: most recent last.
-LAST_DECISIONS: List[Dict[str, Any]] = []
+_LAST_DECISION: ContextVar[Optional[Dict[str, Any]]] = ContextVar('spec_router_decision', default=None)
+
+
+def latest_decision() -> Optional[Dict[str, Any]]:
+    """Return the router decision in the current request context."""
+    return _LAST_DECISION.get()
+
+
+def clear_decision() -> None:
+    _LAST_DECISION.set(None)
 _MCP_BROWSER_TOOLS = (
    "mcp__builtin_browser__browser_navigate",
    "mcp__builtin_browser__browser_snapshot",
@@ -105,6 +118,7 @@ def spec_route_tools(
    the router answered confidently (a tool pick, or answer_directly)."""
    added: Set[str] = set(prior_tool_names(messages))
    decided = False
+    clear_decision()
    url = os.getenv("ODYSSEUS_SPEC_ROUTER_URL", "").strip().rstrip("/")
    if not url or not (user_message or "").strip():
        return (added, False) if return_decision else added
@@ -143,6 +157,15 @@ def spec_route_tools(
                time.sleep(0.1)
        probs = out.get("probabilities") or {}
        choice = out.get("choice")
+        if not isinstance(probs, dict) or choice not in criteria:
+            raise ValueError("invalid router choice")
+        for key, probability in probs.items():
+            if key not in criteria or isinstance(probability, bool):
+                raise ValueError("invalid router probability key")
+            number = float(probability)
+            if not math.isfinite(number) or not 0 <= number <= 1:
+                raise ValueError("invalid router probability")
+        probs = {key: float(value) for key, value in probs.items()}
        min_conf = float(os.getenv("ODYSSEUS_SPEC_ROUTER_MIN_CONF", "0.3"))
        second_min = float(os.getenv("ODYSSEUS_SPEC_ROUTER_SECOND", "0.25"))
        ranked = sorted(
@@ -172,11 +195,133 @@ def spec_route_tools(
                        answer_directly=round(float(probs.get("answer_directly", 0.0)), 3),
                        ask_user=round(float(probs.get("ask_user", 0.0)), 3))
    except Exception as exc:  # fail open
+        added = set(prior_tool_names(messages))
+        decided = False
        decision.update(error=str(exc)[:200], ms=round((time.time() - t0) * 1000, 1))
        logger.warning("spec router failed open: %s", exc)
-    LAST_DECISIONS.append(decision)
-    del LAST_DECISIONS[:-50]
    decision["decided"] = decided
+    _LAST_DECISION.set(decision)
+    logger.info("spec router: %s", {key: value for key, value in decision.items() if key != "message"})
+    return (added, decided) if return_decision else added
+
+
+_ORIGINAL_SPEC_ROUTE_TOOLS = spec_route_tools
+
+
+async def spec_route_tools_async(
+    user_message: str,
+    schemas: Iterable[Dict[str, Any]],
+    disabled_tools: Optional[Set[str]] = None,
+    messages: Optional[Iterable[Dict[str, Any]]] = None,
+    return_decision: bool = False,
+):
+    """Asynchronous non-blocking tool routing.
+
+    Preserves request-local ContextVar semantics, decision propagation,
+    cancellation behavior, timeout limits, and safe fallback on router failure.
+    """
+    if spec_route_tools is not _ORIGINAL_SPEC_ROUTE_TOOLS:
+        return spec_route_tools(
+            user_message,
+            schemas,
+            disabled_tools=disabled_tools,
+            messages=messages,
+            return_decision=return_decision,
+        )
+
+    added: Set[str] = set(prior_tool_names(messages))
+    decided = False
+    clear_decision()
+    url = os.getenv("ODYSSEUS_SPEC_ROUTER_URL", "").strip().rstrip("/")
+    if not url or not (user_message or "").strip():
+        return (added, False) if return_decision else added
+    t0 = time.time()
+    decision: Dict[str, Any] = {"ts": time.time(), "message": user_message[:160], "sticky": sorted(added)}
+    try:
+        disabled = set(disabled_tools or ())
+        lines: Dict[str, str] = {}
+        for s in schemas:
+            n = str(_fn(s).get("name") or "")
+            if n and n not in disabled and n != "ask_user" and n not in lines:
+                lines[n] = tool_line(s)
+        names = sorted(lines)
+        criteria = dict(_HEAD)
+        for i, n in enumerate(names, 1):
+            criteria[f"t{i}"] = lines[n]
+        req = {
+            "model": os.getenv("ODYSSEUS_SPEC_ROUTER_MODEL", "odysseus-s60"),
+            "state": {"agent": _AGENT, "conversation": _conversation(messages), "user_message": user_message},
+            "questions": {"tool": {"type": "choice", "instructions": _INSTRUCTIONS, "criteria": criteria}},
+        }
+        timeout = float(os.getenv("ODYSSEUS_SPEC_ROUTER_TIMEOUT", "0.5"))
+        deadline = time.time() + timeout
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            while True:
+                remaining = max(0.2, deadline - time.time())
+                try:
+                    resp = await client.post(
+                        url + "/v1/systemone",
+                        json=req,
+                        headers={"content-type": "application/json"},
+                        timeout=remaining,
+                    )
+                    if resp.status_code == 529:
+                        if time.time() + 0.15 >= deadline:
+                            resp.raise_for_status()
+                        decision["retries"] = decision.get("retries", 0) + 1
+                        await asyncio.sleep(0.1)
+                        continue
+                    resp.raise_for_status()
+                    out = resp.json()["answers"]["tool"]
+                    break
+                except httpx.HTTPStatusError as busy:
+                    if busy.response.status_code != 529 or time.time() + 0.15 >= deadline:
+                        raise
+                    decision["retries"] = decision.get("retries", 0) + 1
+                    await asyncio.sleep(0.1)
+        probs = out.get("probabilities") or {}
+        choice = out.get("choice")
+        if not isinstance(probs, dict) or choice not in criteria:
+            raise ValueError("invalid router choice")
+        for key, probability in probs.items():
+            if key not in criteria or isinstance(probability, bool):
+                raise ValueError("invalid router probability key")
+            number = float(probability)
+            if not math.isfinite(number) or not 0 <= number <= 1:
+                raise ValueError("invalid router probability")
+        probs = {key: float(value) for key, value in probs.items()}
+        min_conf = float(os.getenv("ODYSSEUS_SPEC_ROUTER_MIN_CONF", "0.3"))
+        second_min = float(os.getenv("ODYSSEUS_SPEC_ROUTER_SECOND", "0.25"))
+        ranked = sorted(
+            ((p, k) for k, p in probs.items() if k.startswith("t") and k[1:].isdigit()), reverse=True
+        )
+        picks: List[str] = []
+        if choice and choice.startswith("t") and choice[1:].isdigit() and float(probs.get(choice, 0.0)) >= min_conf:
+            picks.append(names[int(choice[1:]) - 1])
+            for p, k in ranked[:3]:
+                nm = names[int(k[1:]) - 1]
+                if nm not in picks and p >= second_min:
+                    picks.append(nm)
+        _bmode = os.getenv("ODYSSEUS_SPEC_BROWSER_FALLBACK", "0")
+        if _bmode != "0" and "private_browser" in picks:
+            picks = [n for n in picks if n != "private_browser"]
+            extra = list(_MCP_BROWSER_TOOLS) if _bmode == "mcp" else []
+            for n in extra + ["web_search", "web_fetch"]:
+                if n not in picks:
+                    picks.append(n)
+        added.update(picks)
+        decided = bool(picks) or (choice == "answer_directly" and float(probs.get("answer_directly", 0.0)) >= min_conf)
+        decision.update(choice=choice, tools=picks, ms=round((time.time() - t0) * 1000, 1),
+                        top=[(names[int(k[1:]) - 1], round(p, 3)) for p, k in ranked[:3]],
+                        answer_directly=round(float(probs.get("answer_directly", 0.0)), 3),
+                        ask_user=round(float(probs.get("ask_user", 0.0)), 3))
+    except Exception as exc:  # fail open
+        added = set(prior_tool_names(messages))
+        decided = False
+        decision.update(error=str(exc)[:200], ms=round((time.time() - t0) * 1000, 1))
+        logger.warning("spec router failed open: %s", exc)
+    decision["decided"] = decided
+    _LAST_DECISION.set(decision)
    logger.info("spec router: %s", {key: value for key, value in decision.items() if key != "message"})
    return (added, decided) if return_decision else added

@@ -328,13 +473,59 @@ def route_thinking(user_message: str) -> Optional[Dict[str, Any]]:
        out = {"think": p >= min_p, "p_think": round(p, 4), "ms": round((time.time() - t0) * 1000, 1)}
        if kind5:
            out["kind"] = ans.get("choice")
-        logger.info("spec think router: %s msg=%r", out, text[:120])
+        logger.info("spec think router: %s", out)
        return out
    except Exception as exc:  # fail open: the existing progressive-thinking rules still apply
        logger.warning("spec think router failed (%s); falling back to rule-based thinking", exc)
        return None


+_ORIGINAL_ROUTE_THINKING = route_thinking
+
+
+async def route_thinking_async(user_message: str) -> Optional[Dict[str, Any]]:
+    """Asynchronous non-blocking route_thinking."""
+    if route_thinking is not _ORIGINAL_ROUTE_THINKING:
+        return route_thinking(user_message)
+    if not think_router_enabled():
+        return None
+    url = os.getenv("ODYSSEUS_SPEC_ROUTER_URL", "").strip().rstrip("/")
+    text = (user_message or "").strip()
+    if not url or not text:
+        return None
+    kind5 = os.getenv("ODYSSEUS_SPEC_THINK_QUESTION", "binary").strip().lower() == "kind5"
+    question = _KIND5_QUESTION if kind5 else {"type": "choice", "instructions": _THINK_INSTRUCTIONS,
+                                              "criteria": {"think": _THINK_DEF, "direct": _DIRECT_DEF}}
+    req = {
+        "model": os.getenv("ODYSSEUS_SPEC_THINK_MODEL", os.getenv("ODYSSEUS_SPEC_ROUTER_MODEL", "odysseus-s60")),
+        "state": {"agent": _AGENT, "conversation": [], "user_message": text[:4000]},
+        "questions": {"thinking": question},
+    }
+    t0 = time.time()
+    try:
+        timeout = float(os.getenv("ODYSSEUS_SPEC_ROUTER_TIMEOUT", "3.0"))
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            resp = await client.post(
+                url + "/v1/systemone",
+                json=req,
+                headers={"content-type": "application/json"},
+                timeout=timeout,
+            )
+            resp.raise_for_status()
+            ans = resp.json()["answers"]["thinking"]
+        probs = ans.get("probabilities") or {}
+        p = float(1.0 - probs.get("direct", 1.0)) if kind5 else float(probs.get("think", 0.0))
+        min_p = float(os.getenv("ODYSSEUS_SPEC_THINK_MIN_P", "0.5"))
+        out = {"think": p >= min_p, "p_think": round(p, 4), "ms": round((time.time() - t0) * 1000, 1)}
+        if kind5:
+            out["kind"] = ans.get("choice")
+        logger.info("spec think router: %s", out)
+        return out
+    except Exception as exc:
+        logger.warning("spec think router failed (%s); falling back to rule-based thinking", exc)
+        return None
+
+
 # ---- Ajax Spec driver: the router picks every step --------------------------------------------------------
 def next_action(user_message: str, latest_result: str, schemas: Iterable[Dict[str, Any]],
                messages: Optional[Iterable[Dict[str, Any]]] = None,
@@ -389,7 +580,81 @@ def next_action(user_message: str, latest_result: str, schemas: Iterable[Dict[st
        ranked = sorted(((float(v), k) for k, v in probs.items() if k.startswith("t") and k[1:].isdigit()), reverse=True)
        action.update(p=round(float(probs.get(choice, 0.0)), 3), ms=round((time.time() - t0) * 1000, 1),
                      top=[(names[int(k[1:]) - 1], round(v, 3)) for v, k in ranked[:6]])
-        logger.info("spec next action: %s msg=%r", action, (user_message or "")[:80])
+        logger.info("spec next action: %s", action)
+        return action
+    except Exception as exc:
+        logger.warning("spec next action failed: %s", exc)
+        return None
+
+
+_ORIGINAL_NEXT_ACTION = next_action
+
+
+async def next_action_async(user_message: str, latest_result: str, schemas: Iterable[Dict[str, Any]],
+                            messages: Optional[Iterable[Dict[str, Any]]] = None,
+                            disabled_tools: Optional[Set[str]] = None) -> Optional[Dict[str, Any]]:
+    """Asynchronous non-blocking next_action."""
+    if next_action is not _ORIGINAL_NEXT_ACTION:
+        return next_action(user_message, latest_result, schemas, messages=messages, disabled_tools=disabled_tools)
+    url = os.getenv("ODYSSEUS_SPEC_ROUTER_URL", "").strip().rstrip("/")
+    if not url:
+        return None
+    t0 = time.time()
+    disabled = set(disabled_tools or ())
+    lines: Dict[str, str] = {}
+    for s in schemas:
+        n = str(_fn(s).get("name") or "")
+        if n and n not in disabled and n != "ask_user" and n not in lines:
+            lines[n] = tool_line(s)
+    names = sorted(lines)
+    criteria = dict(_HEAD)
+    for i, n in enumerate(names, 1):
+        criteria[f"t{i}"] = lines[n]
+    um = (user_message or "")[-3000:]
+    if latest_result:
+        um += "\n\nLatest tool result:\n" + latest_result[-1500:]
+    req = {
+        "model": os.getenv("ODYSSEUS_SPEC_ROUTER_MODEL", "odysseus-agentic-v4"),
+        "state": {"agent": _AGENT, "conversation": _conversation(messages), "user_message": um},
+        "questions": {"tool": {"type": "choice", "instructions": _INSTRUCTIONS, "criteria": criteria}},
+    }
+    try:
+        timeout = float(os.getenv("ODYSSEUS_SPEC_ROUTER_TIMEOUT", "3.0"))
+        deadline = time.time() + timeout
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            while True:
+                remaining = max(0.2, deadline - time.time())
+                try:
+                    resp = await client.post(
+                        url + "/v1/systemone",
+                        json=req,
+                        headers={"content-type": "application/json"},
+                        timeout=remaining,
+                    )
+                    if resp.status_code == 529:
+                        if time.time() + 0.15 >= deadline:
+                            resp.raise_for_status()
+                        await asyncio.sleep(0.1)
+                        continue
+                    resp.raise_for_status()
+                    out = resp.json()["answers"]["tool"]
+                    break
+                except httpx.HTTPStatusError as busy:
+                    if busy.response.status_code != 529 or time.time() + 0.15 >= deadline:
+                        raise
+                    await asyncio.sleep(0.1)
+        probs = out.get("probabilities") or {}
+        choice = str(out.get("choice") or "")
+        if choice.startswith("t") and choice[1:].isdigit():
+            action = {"kind": "tool", "name": names[int(choice[1:]) - 1]}
+        elif choice in ("answer_directly", "ask_user"):
+            action = {"kind": choice, "name": choice}
+        else:
+            return None
+        ranked = sorted(((float(v), k) for k, v in probs.items() if k.startswith("t") and k[1:].isdigit()), reverse=True)
+        action.update(p=round(float(probs.get(choice, 0.0)), 3), ms=round((time.time() - t0) * 1000, 1),
+                      top=[(names[int(k[1:]) - 1], round(v, 3)) for v, k in ranked[:6]])
+        logger.info("spec next action: %s", action)
        return action
    except Exception as exc:
        logger.warning("spec next action failed: %s", exc)
@@ -47,25 +47,23 @@ def resolve_task_candidates(
        candidates.append((url, model, headers or {}))

    if override_url and override_model:
-        headers = override_headers or {}
        try:
-            from src.database import ModelEndpoint, SessionLocal
-            from src.endpoint_resolver import normalize_base, resolve_endpoint_runtime, build_headers
+            from src.database import SessionLocal
+            from src.endpoint_resolver import (
+                build_chat_url, build_headers, resolve_endpoint_runtime,
+                resolve_owner_registered_endpoint,
+            )
            db = SessionLocal()
            try:
-                from src.auth_helpers import owner_filter
-                query = db.query(ModelEndpoint).filter(ModelEndpoint.is_enabled == True)
-                for ep in owner_filter(query, ModelEndpoint, owner).all():
-                    base = normalize_base(getattr(ep, "base_url", "") or "")
-                    if _same_endpoint_base(override_url, base):
-                        runtime_base, api_key = resolve_endpoint_runtime(ep, owner=owner)
-                        headers = build_headers(api_key, runtime_base or base)
-                        break
+                ep = resolve_owner_registered_endpoint(db, override_url, owner)
+                runtime_base, api_key = resolve_endpoint_runtime(ep, owner=owner)
+                _append(build_chat_url(runtime_base), override_model, build_headers(api_key, runtime_base))
            finally:
                db.close()
        except Exception:
+            # A missing, foreign, disabled or unreadable registration is not
+            # authority to contact a caller-provided endpoint or use its key.
            pass
-        _append(override_url, override_model, headers)
    _append(*resolve_task_endpoint(fallback_url, fallback_model, fallback_headers, owner=owner))
    _append(*resolve_endpoint("utility", owner=owner))
    _append(*resolve_endpoint("default", owner=owner))
@@ -12,7 +12,7 @@ from datetime import datetime, timedelta, timezone
 from typing import Any, Awaitable, Callable, Dict, Tuple

 from core.auth import RESERVED_USERNAMES
-from src.owner_identity import REQUEST_SENTINEL_OWNERS
+from src.owner_identity import REQUEST_SENTINEL_OWNERS, auth_disabled
 from src.task_action_policy import (
    is_admin_only_task_action,
    owner_has_admin_task_privileges,
@@ -21,6 +21,15 @@ from src.task_action_policy import (
 logger = logging.getLogger(__name__)


+class TaskEndpointAuthorityError(RuntimeError):
+    """A scheduled task's endpoint or its credentials cannot be authorized."""
+
+
+def _require_task_owner(owner):
+    if not str(owner or "").strip() and not auth_disabled():
+        raise TaskEndpointAuthorityError("Scheduled task has no owner in authenticated mode")
+
+
 def _is_sft_fixture_owner(owner: str | None) -> bool:
    """Synthetic SFT accounts may manage tasks but must never auto-fire them."""
    return str(owner or "").strip().lower().startswith("sft_")
@@ -1345,6 +1354,7 @@ class TaskScheduler:

    async def _execute_action(self, task, run_id: str | None = None) -> tuple:
        """Execute a built-in action (no LLM needed)."""
+        _require_task_owner(task.owner)
        from src.builtin_actions import BUILTIN_ACTIONS
        from src.agent_runtime.authority import (
            bind_request_authority, restore_task_authority, task_operation,
@@ -1634,6 +1644,7 @@ class TaskScheduler:
    async def _execute_llm_task(self, task, db) -> str:
        """Execute an LLM task with full tool access via the agent loop."""
        from core.database import Session as DbSession, ChatMessage, CrewMember
+        _require_task_owner(task.owner)

        # If this task is wired to a CrewMember (personal assistant, custom
        # crew), prefer the crew member's persona/model/endpoint as overrides.
@@ -1654,6 +1665,11 @@ class TaskScheduler:
            endpoint_url, model = self._resolve_defaults(db, task.owner)
        if not endpoint_url or not model:
            raise RuntimeError("No model/endpoint configured")
+        # Authorize the original URL before normalization can erase a query,
+        # fragment, or caller-selected path. Stored tasks do not themselves
+        # grant permission to contact an endpoint.
+        from src.endpoint_resolver import resolve_owner_registered_endpoint
+        resolve_owner_registered_endpoint(db, endpoint_url, task.owner or None)
        endpoint_url = _normalize_chat_endpoint(endpoint_url)
        # Record the resolved model so _execute_task_locked can persist it on
        # the run (tasks rarely pin a model, so this is the only record of
@@ -1772,6 +1788,8 @@ class TaskScheduler:
                relevant_tools=relevant_tools,
                datetime_context_msg=_dt_msg,
            )
+        except TaskEndpointAuthorityError:
+            raise
        except Exception as e:
            logger.warning(f"Agent loop failed for task '{task.name}', falling back to simple call: {e}")
            from src.task_endpoint import task_llm_call_async
@@ -1986,6 +2004,7 @@ class TaskScheduler:
                              override_user_message: str | None = None,
                              datetime_context_msg: dict | None = None) -> str:
        """Run the full agent loop with tool access, collecting the final text."""
+        _require_task_owner(task.owner)
        from src.agent_loop import stream_agent_loop
        from src.agent_runtime.authority import restore_task_authority

@@ -2015,8 +2034,8 @@ class TaskScheduler:
                headers = build_headers(api_key, base)
            finally:
                db2.close()
-        except Exception:
-            pass
+        except Exception as exc:
+            raise TaskEndpointAuthorityError("Scheduled task endpoint is unavailable or unauthorized") from exc
        full_text = ""
        final_text_replaced = False
        tool_results = []
@@ -2172,11 +2191,16 @@ class TaskScheduler:
        from src.settings import get_setting

        # Resolve endpoint/model: research settings > task settings > session defaults
+        _require_task_owner(task.owner)
        endpoint_url = task.endpoint_url
        model = task.model
        headers = {}
        headers_from_resolver = False

+        if endpoint_url:
+            from src.endpoint_resolver import resolve_owner_registered_endpoint
+            resolve_owner_registered_endpoint(db, endpoint_url, task.owner or None)
+
        if not endpoint_url or not model:
            try:
                from src.endpoint_resolver import resolve_endpoint
@@ -2213,8 +2237,8 @@ class TaskScheduler:
                base, api_key = resolve_endpoint_runtime(ep, owner=task.owner or None)
                endpoint_url = build_chat_url(base)
                headers = build_headers(api_key, base)
-        except Exception:
-            pass
+        except Exception as exc:
+            raise TaskEndpointAuthorityError("Scheduled research endpoint is unavailable or unauthorized") from exc
        endpoint_url = _normalize_chat_endpoint(endpoint_url)

        max_tokens, extraction_timeout, extraction_concurrency = (
@@ -2348,11 +2372,11 @@ class TaskScheduler:
        have to special-case each tool's schema; the MCP tool ignores keys it
        doesn't recognise.
        """
+        _require_task_owner(task.owner)
        from src.tool_utils import get_mcp_manager
        mcp = get_mcp_manager()
        if not mcp:
-            logger.warning(f"Task {task.id}: MCP manager not available for delivery")
-            return
+            raise RuntimeError("MCP manager not available for task delivery")

        # Resolve recipient — prefer the configured email From (the established
        # "email yourself" pattern from daily_brief), fall back to task.owner.
@@ -2361,7 +2385,7 @@ class TaskScheduler:
        recipient = None
        try:
            from routes.email_helpers import _get_email_config
-            cfg = _get_email_config() or {}
+            cfg = _get_email_config(owner=task.owner or "") or {}
            recipient = cfg.get("from_address") or None
        except Exception as _e:
            logger.debug(f"_deliver_via_mcp: email config lookup failed: {_e}")
@@ -2377,6 +2401,14 @@ class TaskScheduler:
                "X-Odysseus-Ref": str(task.id),
            },
        }
+        if tool_name.startswith("mcp__email__"):
+            # The email server uses this reserved field for its account and
+            # approval scope; it must come from the task owner, never a model.
+            from src.tool_execution import _EMAIL_MCP_OWNER_ARG, _EMAIL_MCP_SESSION_ARG
+            if task.owner:
+                args[_EMAIL_MCP_OWNER_ARG] = task.owner
+            if getattr(task, "session_id", None):
+                args[_EMAIL_MCP_SESSION_ARG] = task.session_id
        if recipient:
            # Cover the common field names so we work across MCP servers (Gmail,
            # generic SMTP, Slack DMs, etc.) without having to hard-code each.
@@ -2391,25 +2423,18 @@ class TaskScheduler:
            )
        try:
            mcp_result = await mcp.call_tool(tool_name, args)
-            stderr = mcp_result.get("stderr", "")
-            stdout = mcp_result.get("stdout", "")
-            body_len = len(result or "")
-            exit_code = mcp_result.get("exit_code", 0)
-            if exit_code != 0:
-                logger.warning(
-                    f"Task {task.id} MCP delivery FAILED via {tool_name}: "
-                    f"exit={exit_code} stderr={stderr[:400]!r} stdout={stdout[:400]!r}"
-                )
-            else:
-                # Include the MCP tool's own stdout (e.g. email_server returns
-                # "Sent email to ... with subject ...") + the body size so a
-                # silent SMTP failure is easier to spot in the logs.
-                logger.info(
-                    f"Task {task.id} delivered via MCP tool {tool_name} "
-                    f"(recipient_set={bool(recipient)}, body={body_len}b, reply={stdout[:200]!r})"
-                )
+            if isinstance(mcp_result, dict):
+                from src.tool_execution import _normalize_mcp_text_error
+                mcp_result = _normalize_mcp_text_error(dict(mcp_result))
+            if not isinstance(mcp_result, dict) or mcp_result.get("error") or mcp_result.get("exit_code") != 0:
+                raise RuntimeError("MCP task delivery failed or returned an invalid result")
+            if tool_name == "mcp__email__send_email" and not str(mcp_result.get("stdout") or "").strip().startswith("Sent email to "):
+                raise RuntimeError("MCP email delivery did not report a completed send")
+            logger.info("Task %s delivered via MCP tool %s (recipient_set=%s, body=%sb)",
+                        task.id, tool_name, bool(recipient), len(result or ""))
        except Exception as e:
            logger.error(f"Task {task.id} MCP delivery failed: {e}")
+            raise

    async def run_task_now(self, task_id: str, *, force: bool = False):
        """Manually trigger a task execution."""
@@ -227,8 +227,16 @@ _register(
    ToolEffect.READ_PRIVATE,
 )
 _register(
-    {"plan_edit", "run_editor_command"},
+    {"plan_edit"},
+    ToolEffect.NETWORK_EGRESS,
+    result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
+)
+_register(
+    {"run_editor_command"},
+    ToolEffect.READ_PRIVATE,
+    ToolEffect.WRITE_PRIVATE,
    ToolEffect.UI_SIDE_EFFECT,
+    result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
 )
 _register(
    {
@@ -402,7 +410,7 @@ _PRIVATE_ACTION_WRITES: Mapping[str, frozenset[str]] = MappingProxyType(
        "manage_endpoints": frozenset({"add", "delete", "enable", "disable"}),
        "manage_mcp": frozenset({"add", "delete", "enable", "disable", "reconnect"}),
        "manage_settings": frozenset(
-            {"set", "delete", "reset", "disable_tool", "enable_tool"}
+            {"set", "delete", "reset", "disable_tool"}
        ),
        "manage_tokens": frozenset({"create", "delete"}),
        "manage_webhooks": frozenset({"add", "delete", "enable", "disable"}),
@@ -1559,7 +1559,7 @@ def _agent_subprocess_env() -> dict:


 def _legacy_private_browser_enabled() -> bool:
-    return os.getenv("ODYSSEUS_PRIVATE_BROWSER_LEGACY", "0").strip().lower() not in {"0", "false", "no", "off"}
+    return os.getenv("ODYSSEUS_PRIVATE_BROWSER_LEGACY", "0").strip().lower() not in {"", "0", "false", "no", "off"}


 async def _legacy_private_browser(operation, transport, *, progress_cb=None, session_id=None, owner=None):
@@ -1757,11 +1757,13 @@ async def execute_tool_block(

    transport = operation.transport_tool
    if operation.tool == "private_browser" and _legacy_private_browser_enabled():
-        # Restored pre-Wave-3 private_browser (agent-browser CLI). The Wave 3
-        # producer in src.browser_identity refuses every page action in this
-        # build. This compatibility transport requires an explicit opt-in.
-        return await _legacy_private_browser(
-            operation, transport, progress_cb=progress_cb, session_id=session_id, owner=owner)
+        # The legacy process cannot establish the sealed browser/page identity
+        # required by the current runtime. Never execute it ahead of resource
+        # binding and the untrusted-context approval gate, even when opted in.
+        return f"{transport}: UNSUPPORTED", {
+            **page_unavailable(),
+            "error": "Legacy browser transport cannot establish the required browser authority.",
+        }
    if operation.tool == "private_browser":
        try:
            _, browser_args = parse_browser_operation(operation.input)
@@ -145,7 +145,7 @@ BUILTIN_TOOL_DESCRIPTIONS: Dict[str, str] = {
    "manage_tokens": "API token management: list, create, or delete API access tokens.",
    "manage_documents": "List, read, delete, or tidy documents in the editor panel. action='list' returns clickable rows (most-recent first) so the user can open any doc by clicking. action='read' (aka view/open/get) with document_id returns the content; supports offset=<N> + limit=<N> to page through large docs (response includes next_offset when more remains, so you can keep calling with offset=next_offset). action='delete' with document_id removes a doc (only way to delete). Use this for ANY 'show/read/list/open my documents/docs/files/notes' request — never shell or curl.",
    "manage_research": "List, read/open, or delete saved DEEP RESEARCH results from the Library. action='list' returns clickable [query](#research-<id>) rows (most-recent first). action='read' (aka open/view/get) with id returns the report + sources. action='delete' with id removes it. Use this for ANY 'open/read/find/delete my research / that report / the research on X' request. NOTE: this is for EXISTING research; to START new research use trigger_research.",
-    "manage_settings": "Change ANY real app setting (the ones the Settings panel writes) so the user never has to open it: TTS voice/provider/speed, STT, search engine + result count, default/teacher/task/utility/vision/image/research models, image quality, reminder channel (browser/email/ntfy), agent timeout/tool-call budget, and more. action=set with key (friendly aliases ok: voice, 'search engine', 'default model', 'teacher model', 'image quality', 'reminder channel'...) + value; get/list/reset too. Also toggles tools on/off (disable_tool/enable_tool/list_tools). Secrets/API keys are read-only. Use for any 'change my…/set my…/use X for…/turn on…' preference request.",
+    "manage_settings": "Change ANY real app setting (the ones the Settings panel writes) so the user never has to open it: TTS voice/provider/speed, STT, search engine + result count, default/teacher/task/utility/vision/image/research models, image quality, reminder channel (browser/email/ntfy), agent timeout/tool-call budget, and more. action=set with key (friendly aliases ok: voice, 'search engine', 'default model', 'teacher model', 'image quality', 'reminder channel'...) + value; get/list/reset too. Also turns tools off globally (disable_tool) and lists disabled ones (list_tools); re-enabling is only done by the user in Settings > Agent Tools. Secrets/API keys are read-only. Use for any 'change my…/set my…/use X for…/turn on…' preference request.",
    "create_session": "Create a new chat with a name and model.",
    "list_sessions": "List all chats with their metadata (the UI calls these 'chats'). Use for 'list my chats', 'rename all my chats' (list first, then manage_session to rename each).",
    "send_to_session": "Send a message to another chat. Cross-chat communication.",
@@ -1292,14 +1292,14 @@ FUNCTION_TOOL_SCHEMAS = [
        "type": "function",
        "function": {
            "name": "manage_settings",
-            "description": "Manage user preferences and settings. Use `disable_tool`/`enable_tool`/`list_tools` to turn individual tools on or off globally (e.g. shell, search, browser, documents, memory, skills, images, tasks, notes, calendar, email). Use list/get/set/delete for free-form preferences.",
+            "description": "Manage user preferences and settings. Use `disable_tool`/`list_tools` to turn individual tools off globally or list what is disabled (e.g. shell, search, browser, documents, memory, skills, images, tasks, notes, calendar, email). Disabled tools can only be re-enabled by the user in Settings > Agent Tools, never from chat. Use list/get/set/delete for free-form preferences.",
            "parameters": {
                "type": "object",
                "properties": {
-                    "action": {"type": "string", "enum": ["list", "get", "set", "delete", "disable_tool", "enable_tool", "list_tools"]},
+                    "action": {"type": "string", "enum": ["list", "get", "set", "delete", "disable_tool", "list_tools"]},
                    "key": {"type": "string", "description": "Setting key (for get/set/delete)"},
                    "value": {"description": "Setting value (for set) — can be string, number, boolean, or object"},
-                    "tool": {"type": "string", "description": "Tool name to disable/enable (for disable_tool/enable_tool). Accepts aliases: shell, search, browser, documents, memory, skills, images, tasks, notes, calendar, email — or a raw tool name like 'bash' or 'web_search'."}
+                    "tool": {"type": "string", "description": "Tool name to disable (for disable_tool). Accepts aliases: shell, search, browser, documents, memory, skills, images, tasks, notes, calendar, email — or a raw tool name like 'bash' or 'web_search'."}
                },
                "required": ["action"]
            }
@@ -1545,7 +1545,7 @@ FUNCTION_TOOL_SCHEMAS = [
                "properties": {
                    "op": {"type": "string", "description": "Editor op name from the catalog, e.g. adjustments.applyMasked"},
                    "params": {"type": "object", "description": "Parameters for the op"},
-                    "session": {"type": "string", "description": "Editor session id (defaults to the open session)"},
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"},
                    "wait": {"type": "boolean", "description": "Wait for the editor result (default true)"}
                },
                "required": ["op"]
@@ -1560,7 +1560,7 @@ FUNCTION_TOOL_SCHEMAS = [
            "parameters": {
                "type": "object",
                "properties": {
-                    "session": {"type": "string", "description": "Editor session id (defaults to the open session)"}
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"}
                }
            }
        }
@@ -1583,7 +1583,7 @@ FUNCTION_TOOL_SCHEMAS = [
                    "steps": {"type": "integer", "description": "Optional sampler steps. Use 8 for removal/expand edits (default 4 is too weak for those)."},
                    "place": {"type": "boolean", "description": "Place the result as a new layer (default true)"},
                    "model": {"type": "string", "description": "Optional image model id to route this edit to (from GET /api/editor/image-models); omit to use the configured default"},
-                    "session": {"type": "string", "description": "Editor session id"}
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"}
                },
                "required": ["op"]
            }
@@ -2000,7 +2000,7 @@ FUNCTION_TOOL_SCHEMAS = [
    },
 ]

-if os.getenv("ODYSSEUS_PRIVATE_BROWSER_LEGACY", "0").strip().lower() not in {"0", "false", "no", "off"}:
+if os.getenv("ODYSSEUS_PRIVATE_BROWSER_LEGACY", "0").strip().lower() not in {"", "0", "false", "no", "off"}:
    # Restored pre-Wave-3 private_browser (see src.tool_execution._legacy_private_browser).
    from src.private_browser_legacy_schema import PRIVATE_BROWSER_SCHEMA as _PB_LEGACY

@@ -769,6 +769,8 @@ _APP_API_BLOCKLIST_PREFIXES = (
 # {"tasks": []} to /api/cookbook/state, which overwrote the whole file.
 # Use dedicated tools or UI flows instead.
 _APP_API_BLOCKLIST_METHOD_PATH = (
+    ("POST",   "/api/tools"),  # global tool policy is changed by a human in Settings
+    ("PATCH",  "/api/mcp/servers"),  # per-server MCP tool policy and server toggles, same reason
    ("GET",    "/api/email/accounts"),  # owner-filtered in tool context; use list_email_accounts MCP tool
    ("POST",   "/api/cookbook/state"),   # whole-file overwrite — agent must use serve_preset/serve_model instead
    ("DELETE", "/api/cookbook/state"),
@@ -893,6 +895,10 @@ async def do_app_api(content: str, owner: Optional[str] = None) -> Dict:
    if method not in ("GET", "POST", "PUT", "PATCH", "DELETE"):
        return {"error": f"Unsupported method: {method}", "exit_code": 1}
    if any(method == m and path.startswith(p) for m, p in _APP_API_BLOCKLIST_METHOD_PATH):
+        if path.startswith("/api/tools"):
+            return {"error": "Tool policy cannot be replaced from chat. Re-enable tools in Settings > Agent Tools; use manage_settings to list or disable them.", "exit_code": 1}
+        if path.startswith("/api/mcp/servers"):
+            return {"error": "MCP server and tool policy cannot be changed from chat. Ask the user to change it in Settings > Integrations.", "exit_code": 1}
        if "/api/email/accounts" in path:
            return {"error": "Don't use /api/email/accounts via app_api — it is owner-filtered in tool context and may return empty. Use the `list_email_accounts` email tool, then pass `account` to list_emails/read_email.", "exit_code": 1}
        if "/api/cookbook/packages/install" in path:
@@ -315,7 +315,7 @@ body.bg-pattern-ascii-fireflies {
      width: 240px;
      background: var(--sidebar-bg, var(--panel));
      border-right: 1px solid var(--border);
-      transition: width 0.25s ease, opacity 0.2s ease, padding 0.25s ease;
+      transition: width 0.25s ease, opacity 0.2s ease, padding 0.25s ease, visibility 0.25s;
      display: flex;
      flex-direction: column;
      flex-shrink: 0;
@@ -361,12 +361,23 @@ body.bg-pattern-ascii-fireflies {
      /* !important so it beats the inline width init.js restores from storage —
         otherwise the width never changes and only opacity animates, making the
         collapse look instant. With this, width animates from the inline value
-         down to 0 via the .sidebar width transition. */
+         down to 0 via the .sidebar width transition.
+         display overrides the global .hidden utility, which would otherwise
+         remove the box before any transition can run. visibility (transitioned
+         on .sidebar) flips to hidden only once the collapse has finished,
+         taking the closed sidebar out of the tab order. */
+      display: flex;
      width: 0 !important;
      padding: 0 !important;
      border: none;
      overflow: hidden;
      opacity: 0;
+      visibility: hidden;
+      pointer-events: none;
+    }
+    /* IDs so this also beats the mobile drawer's !important transition. */
+    @media (prefers-reduced-motion: reduce) {
+      #sidebar, #icon-rail { transition: none !important; }
    }
    /* ===== Sidebar User Bar ===== */
    .sidebar-user-bar {
@@ -449,10 +460,6 @@ body.bg-pattern-ascii-fireflies {
    }


-    .sidebar.hidden .sidebar-user-bar {
-      display: none;
-    }
-
    /* Sticky sidebar header — logo, never scrolls */
    .sidebar-header {
      display: flex;
@@ -673,6 +680,24 @@ body.bg-pattern-ascii-fireflies {
        margin-bottom: calc(-1 * var(--safe-bottom));
        padding-bottom: calc(8px + var(--safe-bottom));
      }
+      /* Tuck the rail under the sidebar (which paints above it) and slide it
+         out as the sidebar collapses, so the combined width eases instead of
+         jumping by the rail's 48px when the two swap. */
+      .icon-rail,
+      .icon-rail.right-side {
+        margin-inline-end: -48px;
+        transition: margin-inline-end 0.25s ease, display 0.25s allow-discrete;
+      }
+      body.sidebar-collapsed:not(.hamburger-only) .icon-rail,
+      html.ody-sidebar-mini .icon-rail {
+        margin-inline-end: 0;
+      }
+      @starting-style {
+        body.sidebar-collapsed:not(.hamburger-only) .icon-rail,
+        html.ody-sidebar-mini .icon-rail {
+          margin-inline-end: -48px;
+        }
+      }
    }
    .icon-rail-divider {
      width: 24px;
@@ -5116,7 +5141,7 @@ body.bg-pattern-ascii-fireflies {
        width: 80% !important;
        max-width: 340px;
        box-shadow: 4px 0 20px rgba(0,0,0,0.5);
-        transition: transform 0.25s ease, opacity 0.25s ease !important;
+        transition: transform 0.25s ease, opacity 0.25s ease, visibility 0.25s !important;
        opacity: 1 !important;
        overflow: visible !important;
        /* Force opaque background — Firefox mobile renders the
@@ -5147,6 +5172,7 @@ body.bg-pattern-ascii-fireflies {
      }
      html.ody-sidebar-off .sidebar,
      html.ody-mobile-startup-sidebar-hidden .sidebar {
+        width: 80% !important;
        transform: translateX(-100%) !important;
        pointer-events: none !important;
        opacity: 0 !important;
@@ -90,12 +90,6 @@
 .lib-tabs,
 .gallery-tabs,
 .preset-tabs {
-  /* A flex-item tab strip defaults to min-width:auto, so it grows to its
-     content width inside a narrow modal and the end tabs get clipped by the
-     modal's overflow instead of scrolling. min-width:0 lets the strip shrink
-     to the container so the overflow-x:auto below actually engages. */
-  min-width: 0;
-  max-width: 100%;
  flex-wrap: nowrap !important;
  overflow-x: auto !important;
  overflow-y: hidden;
@@ -111,7 +111,9 @@
  flex: 0 0 auto;
  flex-wrap: nowrap;
  row-gap: 4px;
-  min-height: 40px;
+  height: 44px;
+  min-height: 44px;
+  max-height: 44px;
  padding: 4px 10px;
  box-sizing: border-box;
  border-bottom: 1px solid var(--border);
@@ -206,9 +208,19 @@
     pushed to the right edge. */
  flex: 1 1 auto;
 }
+/* When transform section is active in controls, suppress any underlying tool section
+   so transform controls (Cancel, Apply, X, Y, W, H) have the full width and are not
+   overlapped or crowded by tool options (e.g. marquee invert/erase buttons). */
+.ge-controls.ge-transform-active > div:not(#ge-transform-section),
+.ge-controls:has(#ge-transform-section:not([style*="display:none"]):not([style*="display: none"])) > div:not(#ge-transform-section),
+.ge-controls--in-options:has(#ge-transform-section:not([style*="display:none"]):not([style*="display: none"])) > div:not(#ge-transform-section) {
+  display: none !important;
+}
 /* The Text tool's option set is too wide for the thin strip: let the bar grow
   and wrap onto extra rows instead of clipping the trailing fields. */
 .ge-options-bar.ge-options-tall {
+  height: auto;
+  max-height: none;
  flex-wrap: wrap;
  align-items: center;
  overflow-y: visible;
@@ -254,7 +266,7 @@
   right after the caret instead of leaving a wide gap. */
 .ge-controls--in-options #ge-brush-controls { flex: 0 0 auto; }
 .ge-controls--in-options .ge-control-row {
-  margin: 0;
+  margin: 0 !important;
  flex: 0 0 auto;
  display: flex;
  flex-direction: row;
@@ -488,8 +500,12 @@
 }
 .ge-opt-empty { font-size: 11px; opacity: 0.5; }
 .ge-options-empty .ge-options-sep { display: none; }
+/* An editor opened at phone width keeps its tool controls in their own bottom
+   sheet, so the strip has nothing to show. One opened wider than 700px moves
+   the controls into this strip; hiding it then would strand every tool control
+   (tablet widths of 701-820px, or a window narrowed after opening). */
@media (max-width: 820px) {
-  .ge-options-bar { display: none; }
+  .ge-options-bar:not(:has(.ge-controls--in-options)) { display: none; }
 }

 /* Document tab strip (Photoshop-style) — names the open document and
@@ -4198,7 +4214,11 @@ body.ge-editor-open textarea.ge-direct-text-editor {
  flex-direction: column;
  gap: 2px;
 }
-.ge-save-state-icon { display: none; }
+.ge-save-state-icon { display: inline-block; vertical-align: middle; }
+.ge-save-state-icon[hidden] { display: none !important; }
+.ge-save-state-saved { color: var(--fg); }
+.ge-save-state-dirty { color: var(--accent, var(--red)); }
+.ge-save-state-error { color: var(--danger, #ef4444); }
 .ge-save-label { white-space: nowrap; min-width: 0; }
 /* Save button: glyph on its own row, then the SAVE action label and the
   live draft-status chip share the second row. */
@@ -6341,6 +6361,10 @@ button .spinner-whirlpool {
  box-shadow: 0 0 0 1px rgba(0,0,0,0.72);
  display: none;
  box-sizing: border-box;
+  contain: strict;
+  will-change: transform;
+  top: 0;
+  left: 0;
 }
 /* Pixel brush: a hard square footprint instead of a feathered circle. */
 .ge-brush-cursor.ge-brush-cursor--pixel {
@@ -6622,6 +6646,7 @@ button .spinner-whirlpool {
  }
  .ge-right-panel.expanded {
    transform: translateY(0);
+    z-index: 100;
  }
  /* Minimized: panel slides almost fully off-screen — only a thin
     handle strip remains visible so the user can swipe back up. */
@@ -8134,7 +8159,12 @@ input.ge-ctl-check:focus-visible {
 }
 .ge-setup-btn:hover { background: rgba(255, 255, 255, 0.1); color: #fff; }
@media (max-width: 700px) {
+  /* Cover the phone viewport rather than the small, scrollable canvas area;
+     the layers sheet otherwise hides the checklist's lower controls. */
+  .ge-preflight { position: fixed; }
  .ge-preflight-card { padding: 13px 14px; }
+  .ge-preflight-foot { flex-wrap: wrap; }
+  .ge-preflight-start { white-space: nowrap; }
 }

 /* ── Quick Edit — premium look ────────────────────────────────────────── */
@@ -8296,17 +8326,37 @@ input.ge-ctl-check:focus-visible {
    gap: 6px;
    padding: 3px 6px;
    overflow: hidden;
+    overflow-x: auto;
+    overflow-y: hidden;
+    scrollbar-width: none;
+    -webkit-overflow-scrolling: touch;
+    flex-wrap: nowrap;
+    white-space: nowrap;
    min-width: 0;
  }
+  .ge-editor-footer::-webkit-scrollbar {
+    display: none;
+  }
  .ge-editor-footer .ge-status-tool,
  .ge-editor-footer .ge-status-model,
  .ge-editor-footer .ge-canvas-size {
    display: none;
  }
-  .ge-footer-history { margin-right: 2px; }
-  .ge-footer-zoom { gap: 3px; min-width: 0; }
+  .ge-footer-history {
+    margin-right: 2px;
+    flex-shrink: 0;
+  }
+  .ge-footer-zoom {
+    gap: 3px;
+    min-width: 0;
+    flex-shrink: 0;
+    margin-left: 0;
+  }
  .ge-footer-zoom > .ge-btn,
  .ge-footer-history > .ge-btn { min-width: 26px; }
+  .ge-setup-btn {
+    flex-shrink: 0;
+  }
  /* Float the footer above the peek/expanded layers sheet so its zoom/setup
     controls stay tappable (position/left/right/bottom set in JS). */
  .ge-editor-footer.ge-footer-floating {
@@ -8317,13 +8367,42 @@ input.ge-ctl-check:focus-visible {
  }
 }

-/* Phones: the floating zoom/Setup footer collides with the peek/expanded
-   layers sheet and the Quick Edit card, so remove it entirely on phones.
-   Undo/Redo/History already live in the layers-sheet header, and pinch-zoom
-   replaces the zoom buttons. */
+/* Mobile layers header layout */
@media (max-width: 700px) {
-  .ge-editor-footer {
-    display: none !important;
+  .ge-layers-header {
+    overflow-x: auto;
+    overflow-y: hidden;
+    scrollbar-width: none;
+    -webkit-overflow-scrolling: touch;
+    flex-wrap: nowrap;
+    white-space: nowrap;
+    gap: 4px;
+    padding-right: 8px;
+  }
+  .ge-layers-header::-webkit-scrollbar {
+    display: none;
+  }
+  .ge-layers-header .ge-footer-zoom {
+    display: inline-flex;
+    align-items: center;
+    gap: 3px;
+    flex-shrink: 0;
+  }
+  .ge-layers-header .ge-footer-zoom > .ge-btn,
+  .ge-layers-header .ge-footer-history > .ge-btn {
+    min-width: 28px;
+    min-height: 28px;
+  }
+  .ge-layers-header .ge-setup-btn {
+    flex-shrink: 0;
+    min-height: 28px;
+    padding: 3px 8px;
+    font-size: 11px;
+    border-radius: 6px;
+    border: 1px solid var(--border);
+    background: color-mix(in srgb, var(--panel) 85%, var(--fg) 15%);
+    color: var(--fg);
+    cursor: pointer;
  }
  /* The Quick Edit card lifts over the layers sheet / keyboard; keep it above
     every other editor asset (sheet headers, tool rail, popups) while lifted. */
@@ -8556,6 +8635,13 @@ body.ge-editor-open .toast.toast-transform-hint {
    position: relative;
    align-items: stretch;
  }
+  .ge-toolbar-wrap.ge-flyout-open {
+    z-index: 250;
+  }
+  .ge-toolbar.ge-flyout-open .ge-toolbar-scroll {
+    -webkit-mask-image: none !important;
+    mask-image: none !important;
+  }
  .ge-toolbar-wrap > .ge-toolbar { flex: 1 1 auto; min-width: 0; }
  .ge-tool-more {
    display: none;
@@ -8579,6 +8665,7 @@ body.ge-editor-open .toast.toast-transform-hint {
  /* Keep the floating editor footer from stacking on the Quick Edit card. The
     card owns the bottom of the canvas while it is open, so the footer (zoom /
     Setup / AI settings) hides until it closes. */
+  body.ge-qe-open .ge-editor-footer.ge-footer-floating,
  body:has(.ge-ai-command:not(.ge-ai-command-collapsed)) .ge-editor-footer.ge-footer-floating {
    display: none;
  }
@@ -8657,16 +8744,14 @@ body.ge-editor-open .toast.toast-transform-hint {
  }
 }

-/* Phone menu bar: tighten the Photoshop menus and keep the Save control
-   icon-only so the twelve menus + Import + Save are not crowded. */
+/* Phone menu bar: tighten the Photoshop menus. The compact topbar already
+   drops the Save action label; the draft status stays visible because it is
+   the save button's only announced (role="status") save state. */
@media (max-width: 700px) {
  .ge-topbar-left .ge-stacked-btn {
    font-size: 11px;
    padding: 0 6px !important;
  }
-  .ge-topbar.ge-topbar-compact #ge-draft-status {
-    display: none;
-  }
 }

 /* Phone editor: dock the zoom/Setup footer flush to the Layers sheet. The
@@ -9675,12 +9760,15 @@ body.ge-editor-open .tour-hint {
 }
 /* The dropdowns clip overflow to draw the custom scroll thumb; release the
   clip while a flyout is open/hovered so it can extend past the menu edge. */
+.ge-filter-menu.ge-flyout-open,
 .ge-filter-menu:has(.ge-menu-parent.open),
 .ge-filter-menu:has(.ge-menu-parent:hover),
 .ge-filter-menu:has(.ge-submenu:hover),
+.ge-image-menu.ge-flyout-open,
 .ge-image-menu:has(.ge-menu-parent.open),
 .ge-image-menu:has(.ge-menu-parent:hover),
 .ge-image-menu:has(.ge-submenu:hover),
+.ge-selection-menu.ge-flyout-open,
 .ge-selection-menu:has(.ge-menu-parent.open),
 .ge-selection-menu:has(.ge-menu-parent:hover),
 .ge-selection-menu:has(.ge-submenu:hover) {
@@ -9689,6 +9777,7 @@ body.ge-editor-open .tour-hint {
  mask-image: none;
 }
 /* The Window menu's Workspace flyout needs the same clip release. */
+.ge-window-menu.ge-flyout-open,
 .ge-window-menu:has(.ge-menu-parent.open),
 .ge-window-menu:has(.ge-menu-parent:hover),
 .ge-window-menu:has(.ge-submenu:hover) {
@@ -257,7 +257,7 @@
  <link rel="stylesheet" href="/static/css/00-tokens.css?v=20260929csssplit">
  <link rel="stylesheet" href="/static/css/01-agent-chat.css?v=20260929csssplit">
  <link rel="stylesheet" href="/static/css/02-compare.css?v=20260929csssplit">
-  <link rel="stylesheet" href="/static/css/03-agent-chat.css?v=20261017titlefade1">
+  <link rel="stylesheet" href="/static/css/03-agent-chat.css?v=20260929csssplit">
  <link rel="stylesheet" href="/static/css/04-memory.css?v=20260929csssplit">
  <link rel="stylesheet" href="/static/css/05-documents.css?v=20260929csssplit">
  <link rel="stylesheet" href="/static/css/06-admin-settings.css?v=20260929csssplit">
@@ -44,34 +44,187 @@ import { invalidateSettings } from './appConfig.js';
  const RUN_ID_ABORT_GRACE_MS = 2000; // timeout waits this long for a run-id header before hard-aborting
  const RESEARCH_SVG = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><path d="M21 21l-4.35-4.35"/></svg>';

-  // URL of the photo attached to the current turn (chat uploads are served at
-  // /api/upload/<id>). Used by the "Open in editor & apply" action.
-  function _currentAttachedImageUrl() {
-    try {
-      const box = document.getElementById('chat-history');
-      if (!box) return null;
-      // Use the newest user bubble that carries an image preview. Note
-      // ':last-of-type' is wrong here (it selects the last sibling of the
-      // element type, and the assistant reply follows the user bubble), so
-      // walk the user bubbles from the end instead.
-      const users = box.querySelectorAll('.msg-user');
-      for (let i = users.length - 1; i >= 0; i--) {
-        const img = users[i].querySelector('.attach-image-preview[data-file-id] img');
-        if (img && img.getAttribute('src')) return img.getAttribute('src');
-      }
-      // Fall back to any attachment preview/card in the history (newest).
-      const previews = box.querySelectorAll(
-        '.attach-image-preview[data-file-id], .attach-card[data-file-id]'
-      );
-      if (previews.length) {
-        const last = previews[previews.length - 1];
-        const id = last.dataset ? last.dataset.fileId : null;
-        if (id) return API_BASE + '/api/upload/' + id;
-      }
-      return null;
-    } catch (_) {
-      return null;
+  // Inline chat images share the editor's 8192px dimension ceiling, with a
+  // conservative 16MP budget for its multiple canvas surfaces. No blob URLs are
+  // needed here: chat previews use server-authorized upload references.
+  const _MAX_DATA_URL_LENGTH = 10 * 1024 * 1024;
+  const _MAX_INLINE_BYTES = 7 * 1024 * 1024;
+  const _MAX_IMAGE_DIMENSION = 8192;
+  const _MAX_IMAGE_PIXELS = 16 * 1024 * 1024;
+  let _inlineRasterCache = null; // One bounded source; repeated actions reuse its decode.
+
+  function _imageDimensionsAllowed(width, height) {
+    return width > 0 && height > 0 && width <= _MAX_IMAGE_DIMENSION &&
+      height <= _MAX_IMAGE_DIMENSION && width * height <= _MAX_IMAGE_PIXELS;
+  }
+
+  function _rasterDimensions(bytes, mime) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const ascii = (offset, text) => [...text].every((char, i) => bytes[offset + i] === char.charCodeAt(0));
+    if (mime === 'image/png' && bytes.length >= 33 &&
+        bytes[0] === 137 && ascii(1, 'PNG\r\n\x1a\n') && view.getUint32(8) === 13 && ascii(12, 'IHDR')) {
+      return [view.getUint32(16), view.getUint32(20)];
    }
+    if (mime === 'image/gif' && bytes.length >= 13 && (ascii(0, 'GIF87a') || ascii(0, 'GIF89a'))) {
+      return [view.getUint16(6, true), view.getUint16(8, true)];
+    }
+    if (mime === 'image/jpeg' && bytes[0] === 255 && bytes[1] === 216) {
+      let pos = 2;
+      while (pos + 4 <= bytes.length) {
+        if (bytes[pos++] !== 255) return null;
+        while (bytes[pos] === 255) pos++;
+        const marker = bytes[pos++];
+        if (marker === 218 || marker === 217) break;
+        if (marker === 1 || (marker >= 208 && marker <= 215)) continue;
+        if (pos + 2 > bytes.length) return null;
+        const size = view.getUint16(pos);
+        if (size < 2 || pos + size > bytes.length) return null;
+        if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker) && size >= 8) {
+          return [view.getUint16(pos + 5), view.getUint16(pos + 3)];
+        }
+        pos += size;
+      }
+    }
+    if (mime === 'image/webp' && bytes.length >= 30 && ascii(0, 'RIFF') &&
+        view.getUint32(4, true) + 8 === bytes.length && ascii(8, 'WEBP')) {
+      if (ascii(12, 'VP8X')) return [1 + bytes[24] + (bytes[25] << 8) + (bytes[26] << 16), 1 + bytes[27] + (bytes[28] << 8) + (bytes[29] << 16)];
+      if (ascii(12, 'VP8L') && bytes[20] === 47) return [1 + ((bytes[21] | (bytes[22] << 8)) & 16383), 1 + (((bytes[22] >> 6) | (bytes[23] << 2) | (bytes[24] << 10)) & 16383)];
+      if (ascii(12, 'VP8 ') && bytes[23] === 157 && bytes[24] === 1 && bytes[25] === 42) return [view.getUint16(26, true) & 16383, view.getUint16(28, true) & 16383];
+    }
+    return null;
+  }
+
+  function _inlineRaster(url) {
+    if (_inlineRasterCache?.url === url) return _inlineRasterCache;
+    const result = { url, valid: false };
+    _inlineRasterCache = result;
+    if (url.length > _MAX_DATA_URL_LENGTH) return result;
+    const match = /^data:(image\/(?:png|jpeg|jpg|webp|gif));base64,/i.exec(url);
+    if (!match) return result;
+    const payload = url.slice(match[0].length);
+    if (!payload || payload.length % 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(payload)) return result;
+    const padding = payload.endsWith('==') ? 2 : payload.endsWith('=') ? 1 : 0;
+    const size = payload.length / 4 * 3 - padding;
+    if (size > _MAX_INLINE_BYTES) return result;
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    if (padding && (alphabet.indexOf(payload[payload.length - padding - 1]) & (padding === 2 ? 15 : 3))) return result;
+    try {
+      const bytes = typeof Uint8Array.fromBase64 === 'function' ? Uint8Array.fromBase64(payload) : (() => {
+        const binary = atob(payload); const array = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) array[i] = binary.charCodeAt(i);
+        return array;
+      })();
+      const mime = match[1].toLowerCase().replace('image/jpg', 'image/jpeg');
+      const dimensions = _rasterDimensions(bytes, mime);
+      if (!dimensions || !_imageDimensionsAllowed(...dimensions)) return result;
+      Object.assign(result, { valid: true, bytes, mime, dimensions });
+    } catch (_) {}
+    return result;
+  }
+
+  // This synchronous guard rejects untrusted references before any fetch/decode.
+  // Inline images additionally require a successful browser decode before launch.
+  function _isAuthorizedImageUrl(url) {
+    if (!url || typeof url !== 'string') return false;
+    const trimmed = url.trim();
+    if (trimmed.startsWith('data:')) return _inlineRaster(trimmed).valid;
+    if (!trimmed || trimmed.startsWith('blob:') || trimmed.startsWith('//')) return false;
+    try {
+      const base = window.location.origin;
+      const parsed = new URL(trimmed, base);
+      return parsed.origin === base && !parsed.search && !parsed.hash &&
+        /^\/api\/(?:upload|gallery)\/[A-Za-z0-9_\-]+(?:\.[a-zA-Z0-9]+)?$/.test(parsed.pathname);
+    } catch (_) { return false; }
+  }
+
+  async function _validateInlineImage(url) {
+    const raster = _inlineRaster(url.trim());
+    if (!raster.valid) return false;
+    if (!raster.decoded) raster.decoded = (async () => {
+      try {
+        const image = await createImageBitmap(new Blob([raster.bytes], { type: raster.mime }));
+        try {
+          return _imageDimensionsAllowed(image.width, image.height) &&
+            image.width * image.height === raster.dimensions[0] * raster.dimensions[1];
+        } finally { image.close(); }
+      } catch (_) { return false; }
+      finally { raster.bytes = null; }
+    })();
+    return raster.decoded;
+  }
+
+  // Find the specific user message that originated the turn containing container.
+  function _findOriginatingUserMessage(container) {
+    if (!container) return null;
+    let curr = container.previousElementSibling;
+    while (curr) {
+      if (curr.classList && curr.classList.contains('msg-user')) {
+        return curr;
+      }
+      curr = curr.previousElementSibling;
+    }
+    const box = document.getElementById('chat-history');
+    if (box && box.contains(container)) {
+      const all = Array.from(box.querySelectorAll('.msg, .agent-thread, .ai-msg-wrap, .round-holder'));
+      const idx = all.findIndex((el) => el === container || el.contains(container));
+      if (idx > 0) {
+        for (let i = idx - 1; i >= 0; i--) {
+          if (all[i].classList && all[i].classList.contains('msg-user')) {
+            return all[i];
+          }
+        }
+      }
+    }
+    return null;
+  }
+
+  // Resolve the image attached to the exact turn associated with container / action.
+  // Never falls back to unrelated images from earlier conversation turns.
+  function _attachedImageForTurn(container, action) {
+    const explicitId = action && (action.imageId || action.image_id || action.fileId || action.file_id);
+    if (explicitId && typeof explicitId === 'string' && /^[A-Za-z0-9_\-]+(?:\.[A-Za-z0-9]+)?$/.test(explicitId)) {
+      return (API_BASE || '') + '/api/upload/' + explicitId;
+    }
+    const explicitUrl = action && (action.imageUrl || action.image_url);
+    if (explicitUrl) return _isAuthorizedImageUrl(explicitUrl) ? explicitUrl : null;
+
+    const userMsg = _findOriginatingUserMessage(container);
+    if (!userMsg) return null;
+
+    const previews = userMsg.querySelectorAll(
+      '.attach-image-preview[data-file-id], .attach-card[data-file-id]'
+    );
+    for (let i = previews.length - 1; i >= 0; i--) {
+      const fid = previews[i].dataset ? previews[i].dataset.fileId : null;
+      if (fid && /^[A-Za-z0-9_\-]+(?:\.[A-Za-z0-9]+)?$/.test(fid)) {
+        return (API_BASE || '') + '/api/upload/' + fid;
+      }
+      const img = previews[i].querySelector('img');
+      const src = img ? (img.getAttribute('src') || '') : '';
+      if (_isAuthorizedImageUrl(src)) return src;
+    }
+
+    const imgs = userMsg.querySelectorAll('.attach-image-preview img, .attach-card img');
+    for (let i = imgs.length - 1; i >= 0; i--) {
+      const src = imgs[i].getAttribute('src') || '';
+      if (_isAuthorizedImageUrl(src)) return src;
+    }
+
+    return null;
+  }
+
+  function _currentAttachedImageUrl(container, action) {
+    return _attachedImageForTurn(container, action);
+  }
+
+  function _notifyError(msg) {
+    try {
+      if (uiModule && typeof uiModule.showError === 'function') {
+        uiModule.showError(msg);
+        return;
+      }
+    } catch (_) {}
+    console.warn('[chat]', msg);
  }

  // Render the one-click "Open in editor & apply" button on a photo-edit reply
@@ -85,25 +238,89 @@ import { invalidateSettings } from './appConfig.js';
    btn.textContent = 'Open in editor & apply';
    btn.style.cssText = 'margin-top:8px;padding:6px 12px;border-radius:6px;border:1px solid rgba(120,120,120,0.4);background:transparent;color:inherit;cursor:pointer;font:inherit;';
    btn.addEventListener('click', async () => {
+      if (btn.disabled) return;
      btn.disabled = true;
      try {
+        let imageUrl = _attachedImageForTurn(container, action);
+        if (!imageUrl) {
+          _notifyError('No attached photo found for this conversation turn.');
+          btn.disabled = false;
+          return;
+        }
+
+        if (!_isAuthorizedImageUrl(imageUrl)) {
+          _notifyError('Unauthorized or invalid image reference.');
+          btn.disabled = false;
+          return;
+        }
+
+        if (imageUrl.trim().startsWith('data:') && !await _validateInlineImage(imageUrl)) {
+          _notifyError('Invalid or oversized image attachment.');
+          return;
+        }
+        // Gallery references name an owner-scoped metadata resource, not image bytes.
+        if (!imageUrl.trim().startsWith('data:') && new URL(imageUrl, window.location.origin).pathname.startsWith('/api/gallery/')) {
+          const response = await fetch(imageUrl, { credentials: 'same-origin' });
+          if (!response.ok) { _notifyError('The gallery image is unavailable.'); return; }
+          const image = await response.json();
+          const source = new URL(image.url || '', window.location.origin);
+          if (source.origin !== window.location.origin || source.search || source.hash ||
+              !/^\/api\/generated-image\/[A-Za-z0-9_.-]+$/.test(source.pathname)) {
+            _notifyError('Invalid gallery image reference.'); return;
+          }
+          imageUrl = source.href;
+        }
+
+        // Verify attachment is accessible and authorized on the server before launching editor
+        if (imageUrl.includes('/api/upload/')) {
+          try {
+            const probe = await fetch(imageUrl, { method: 'HEAD' });
+            if (!probe.ok) {
+              if (probe.status === 404 || probe.status === 410) {
+                _notifyError('The attached image is no longer available or upload has expired.');
+              } else if (probe.status === 401 || probe.status === 403) {
+                _notifyError('You are not authorized to edit this attached image.');
+              } else {
+                _notifyError('Could not verify image attachment authorization.');
+              }
+              btn.disabled = false;
+              return;
+            }
+          } catch (_) {
+            _notifyError('Could not verify image attachment authorization.');
+            btn.disabled = false;
+            return;
+          }
+        }
+
        if (typeof window.gePhotoEditorApply !== 'function') {
          await import('/static/js/galleryEditor.js?v=20260909movepicklayer1');
        }
        await window.gePhotoEditorApply({
-          imageId: null,
-          imageUrl: _currentAttachedImageUrl(),
+          imageId: (action && (action.imageId || action.image_id)) || null,
+          imageUrl,
          prompt: action.prompt || '',
          displayName: 'Chat edit',
        });
      } catch (err) {
        console.error('[chat] open_and_apply failed', err);
+        _notifyError('Failed to apply edit: ' + (err.message || err));
+      } finally {
        btn.disabled = false;
      }
    });
    container.appendChild(btn);
  }

+  if (typeof window !== 'undefined') {
+    window.__chatPhotoEditorTestHooks = {
+      _isAuthorizedImageUrl,
+      _findOriginatingUserMessage,
+      _attachedImageForTurn,
+      renderPhotoEditorApplyButton,
+    };
+  }
+
  let API_BASE = '';
  let currentAbort = null;
  let isStreaming = false;
@@ -3277,7 +3277,6 @@ export function addMessage(role, content, modelName, metadata) {
      let lastWrap = null;
      let firstMsgAi = null;
      let lastMsgAi = null;
-      const newNodes = [];

      const toolsByRound = {};
      let lastPrivateBrowserUrl = '';
@@ -3371,7 +3370,6 @@ export function addMessage(role, content, modelName, metadata) {
          wrap.dataset.raw = txt;
          if (metadata?._db_id) wrap.dataset.dbId = metadata._db_id;
          box.appendChild(wrap);
-          newNodes.push(wrap);
          lastWrap = wrap;
          if (!firstMsgAi) firstMsgAi = wrap;
          lastMsgAi = wrap;
@@ -3389,7 +3387,6 @@ export function addMessage(role, content, modelName, metadata) {
            // Extend line up if there's a chat bubble above
            if (txt) threadWrap.classList.add('has-top');
            box.appendChild(threadWrap);
-            newNodes.push(threadWrap);
          }
          for (const ev of roundTools) {
            if (ev.ask_user && !ev.ask_user.resolved) pendingAskUser = ev.ask_user;
@@ -3451,7 +3448,6 @@ export function addMessage(role, content, modelName, metadata) {
            if (image) {
              const imgBubble = buildImageBubble(image.image_url, image.image_prompt, image.image_model, image.image_size, image.image_quality, image.image_id);
              box.appendChild(imgBubble);
-              newNodes.push(imgBubble);
            }
          }
        }
@@ -72,7 +72,12 @@ function hexToHsv(hex) { const { r, g, b } = hexToRgb(hex); return rgbToHsv(r, g

 // ── Storage ───────────────────────────────────────────────────────────
 function getRecents() {
-  try { return JSON.parse(localStorage.getItem(LS_RECENT) || '[]'); }
+  try {
+    const values = JSON.parse(localStorage.getItem(LS_RECENT) || '[]');
+    return Array.isArray(values)
+      ? values.filter(value => typeof value === 'string' && /^#[0-9a-f]{6}$/i.test(value)).slice(0, MAX_RECENT)
+      : [];
+  }
  catch { return []; }
 }

@@ -85,32 +90,28 @@ function addRecent(hex) {
 }

 // ── Suggestions based on current color (5 harmony swatches) ──────────
-function computeSuggestions() {
+function suggestionsForHsv(h, s, v) {
  // Complement, analogous ±30°, split-complement (+150), tone shift
-  return [
-    { hex: hsvToHex(_h + 180, _s, _v),                                   label: 'Complement' },
-    { hex: hsvToHex(_h + 30, _s, _v),                                    label: 'Analogous +30°' },
-    { hex: hsvToHex(_h - 30, _s, _v),                                    label: 'Analogous -30°' },
-    { hex: hsvToHex(_h + 150, _s, _v),                                   label: 'Split-complement' },
-    { hex: hsvToHex(_h, _s, clamp(_v > 50 ? _v - 30 : _v + 30, 10, 95)), label: 'Tone shift' },
-  ];
-}
-
-// ── Reusable helpers for hosts that surface swatches inline ──────────
-// (e.g. the editor's SWATCHES panel showing suggestions + recents).
-export function getRecentColors() { return getRecents(); }
-export function recordRecentColor(hex) { addRecent(hex); }
-export function suggestColorsFor(hex) {
-  const { h, s, v } = hexToHsv(hex || '#000000');
  return [
    { hex: hsvToHex(h + 180, s, v),                                   label: 'Complement' },
    { hex: hsvToHex(h + 30, s, v),                                    label: 'Analogous +30°' },
    { hex: hsvToHex(h - 30, s, v),                                    label: 'Analogous -30°' },
    { hex: hsvToHex(h + 150, s, v),                                   label: 'Split-complement' },
-    { hex: hsvToHex(h, s, clamp(v > 50 ? v - 30 : v + 30, 10, 95)),   label: 'Tone shift' },
+    { hex: hsvToHex(h, s, clamp(v > 50 ? v - 30 : v + 30, 10, 95)), label: 'Tone shift' },
  ];
 }

+// ── Reusable helpers for hosts that surface swatches inline ──────────
+// (e.g. the editor's SWATCHES panel showing suggestions + recents).
+function computeSuggestions() { return suggestionsForHsv(_h, _s, _v); }
+
+export function getRecentColors() { return getRecents(); }
+export function recordRecentColor(hex) { addRecent(hex); }
+export function suggestColorsFor(hex) {
+  const { h, s, v } = hexToHsv(hex || '#000000');
+  return suggestionsForHsv(h, s, v);
+}
+
 // ── Popover build ─────────────────────────────────────────────────────
 function buildPopover() {
  const p = document.createElement('div');
@@ -1996,6 +1996,17 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
  // Active drop mode for the PDF toolbar — toolbar buttons set this; the
  // next click on a page consumes it. null means clicks do nothing.
  let _pdfDropMode = null;
+  let _pdfAnnotationDragging = false;
+  function _setPdfAnnotationDragging(dragging) {
+    _pdfAnnotationDragging = dragging;
+    for (const ref of _pdfPaneAnnotationsByDoc.get(activeDocId) || []) {
+      ref._refreshHandles?.();
+      if (dragging) {
+        const menu = ref.wrap?.querySelector('.pdf-annotation-text-menu');
+        if (menu) menu.style.display = 'none';
+      }
+    }
+  }
  // Per-doc last-used line spacing for text annotations. Once the user picks
  // 1.6 for one box, every text box dropped after that defaults to 1.6.
  const _pdfLastLineHeight = new Map(); // docId -> number
@@ -2290,8 +2301,16 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      // active (toolbar buttons set the mode). Without a mode, clicking does
      // nothing — keeps page interactions predictable so users don't get
      // surprise boxes from stray clicks.
+      const isBlankPageTarget = target => target === pageWrap
+        || (target?.tagName === 'IMG' && target.parentElement === pageWrap);
+      let placementStartedOnPage = false;
+      pageWrap.addEventListener('pointerdown', ev => {
+        placementStartedOnPage = isBlankPageTarget(ev.target);
+      }, true);
      pageWrap.addEventListener('click', (ev) => {
-        if (ev.target !== pageWrap && ev.target.tagName !== 'IMG') return;
+        const canPlace = placementStartedOnPage;
+        placementStartedOnPage = false;
+        if (!canPlace || !isBlankPageTarget(ev.target) || _pdfAnnotationDragging) return;
        if (!_pdfDropMode) return;
        const rect = pageWrap.getBoundingClientRect();
        const xPct = ((ev.clientX - rect.left) / rect.width) * 100;
@@ -2423,9 +2442,11 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';

    // Set handle visibility together; clicking/tapping the annotation itself
    // brings hidden controls back.
+    let handlesRequested = _isTouch;
    const _setHandlesVisible = (show) => {
+      if (!_pdfAnnotationDragging) handlesRequested = show;
      const dismissed = wrap.dataset.controlsDismissed === '1';
-      const v = (show && !dismissed) ? '' : 'none';
+      const v = (show && !dismissed && !_pdfAnnotationDragging) ? '' : 'none';
      del.style.display = v;
      grip.style.display = v;
      resize.style.display = v;
@@ -2446,7 +2467,8 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      _setHandlesVisible(true);
    });

-    const ref = { id: ann.id, page: ann.page, x: ann.x, y: ann.y, w: ann.w, h: ann.h, el: input, wrap, kind, _setHandlesVisible };
+    const ref = { id: ann.id, page: ann.page, x: ann.x, y: ann.y, w: ann.w, h: ann.h, el: input, wrap, kind, _setHandlesVisible,
+      _refreshHandles: () => _setHandlesVisible(handlesRequested) };

    if (kind === 'check') {
      // Stamp checkmark — value is fixed, nothing to listen for.
@@ -2568,7 +2590,12 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      ref._autoGrow = _autoGrow;
    }

+    del.addEventListener('pointerdown', ev => {
+      ev.preventDefault();
+      ev.stopPropagation();
+    });
    del.addEventListener('click', (ev) => {
+      ev.preventDefault();
      ev.stopPropagation();
      _pushPdfUndoSnapshot();
      _removeAnnotation(ref);
@@ -2580,6 +2607,7 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      ev.stopPropagation();
      _pushPdfUndoSnapshot();
      try { grip.setPointerCapture(ev.pointerId); } catch (_) {}
+      _setPdfAnnotationDragging(true);
      // Hide the × and resize handles while moving so they don't obscure the
      // box — easier to see exactly where it lands. Restored on release.
      del.style.display = 'none';
@@ -2598,11 +2626,14 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      const onUp = () => {
        document.removeEventListener('pointermove', onMove);
        document.removeEventListener('pointerup', onUp);
+        document.removeEventListener('pointercancel', onUp);
+        _setPdfAnnotationDragging(false);
        _setHandlesVisible(true);
        _schedulePdfPaneSave();
      };
      document.addEventListener('pointermove', onMove);
      document.addEventListener('pointerup', onUp);
+      document.addEventListener('pointercancel', onUp);
    });

    // Drag bottom-right corner to resize. Width/height stored as percentages.
@@ -2611,6 +2642,7 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      ev.stopPropagation();
      _pushPdfUndoSnapshot();
      try { resize.setPointerCapture(ev.pointerId); } catch (_) {}
+      _setPdfAnnotationDragging(true);
      // Hide the × and move handles while resizing — clean view of the box edge.
      del.style.display = 'none';
      grip.style.display = 'none';
@@ -2628,11 +2660,14 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
      const onUp = () => {
        document.removeEventListener('pointermove', onMove);
        document.removeEventListener('pointerup', onUp);
+        document.removeEventListener('pointercancel', onUp);
+        _setPdfAnnotationDragging(false);
        _setHandlesVisible(true);
        _schedulePdfPaneSave();
      };
      document.addEventListener('pointermove', onMove);
      document.addEventListener('pointerup', onUp);
+      document.addEventListener('pointercancel', onUp);
    });

    // Text options menu — opened from the floating … button so the spacing
@@ -15239,7 +15274,8 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
    menu.style.top = (rect.bottom + 2) + 'px';
    menu.style.right = (window.innerWidth - rect.right) + 'px';
    menu.style.left = 'auto';
-    menu.style.zIndex = '9999';
+    const editorPane = document.querySelector('.doc-editor-pane');
+    menu.style.zIndex = String(Math.max(topPortalZ(), (parseInt(getComputedStyle(editorPane).zIndex, 10) || 0) + 1));

    const langLabel = lang ? lang.toUpperCase() : 'TXT';
    // Form-backed markdown doc → primary export is the filled PDF, not the
@@ -15314,7 +15350,8 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
    }
    // Outside-click AND Escape both route through the central esc-stack via
    // bindMenuDismiss; onClose owns the actual node removal.
-    const close = bindMenuDismiss(menu, () => { menu.remove(); });
+    const exportBtn = document.getElementById('doc-footer-export-btn');
+    const close = bindMenuDismiss(menu, () => { menu.remove(); }, (ev) => !menu.contains(ev.target) && !exportBtn?.contains(ev.target));
  }

  function _richTextExportCss() {
@@ -82,10 +82,9 @@ export function resolveQuickEditAgentModel() {
  return { agent, endpoint, label: ((opt && opt.textContent) || '').trim() };
 }

-// Quick Edit agent (planner) model options. Kept small + explicit; the local
-// Qwen3.5-9B VL is the default. `value` encodes "<endpoint>::<model>".
+// Quick Edit agent (planner) model options. Kept small + explicit;
+// dynamically populated from /api/editor/agent-models.
 export const QUICK_EDIT_AGENT_OPTIONS = [
-  { value: 'http://100.69.120.65:8097/v1::Qwen/Qwen3.5-9B', label: 'Qwen3.5-9B VL · local' },
  { value: 'default', label: 'Server default (hosted planner)' },
 ];

@@ -141,12 +140,41 @@ export function modelCaps(modelId, endpointName, endpointType) {
  return { gen: false, inpaint: false };
 }

-export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2img }) {
+// Global listeners resolve live controls instead of retaining editor instances.
+function syncCommandModel(value) {
+  const select = document.getElementById('ge-ai-command-model');
+  if (!select || !select._modelsReady) return;
+  if (value && ![...select.options].some(o => !o.disabled && o.value === value && value !== '__serve_cookbook__')) {
+    if (localStorage.getItem('ge-ai-command-model') === value) localStorage.removeItem('ge-ai-command-model');
+    value = '';
+  }
+  if (select.value !== value) {
+    select.value = value;
+    if (select.value !== value) select.value = '';
+    updateFooterEditModel();
+  }
+}
+window.addEventListener('ge-ai-command-model-change', e => syncCommandModel(e.detail?.value || ''));
+window.addEventListener('storage', e => {
+  if (e.key === 'ge-ai-command-model') syncCommandModel(e.newValue || '');
+});
+window.addEventListener('ge:model-endpoints-updated', e => {
+  document.getElementById('ge-ai-command-model')?._refreshAIModels?.(e.detail?.baseUrl || '');
+});
+
+export function wireAIModelSelectors({ container, apiBase = '', openCookbookForImg2img = () => {} } = {}) {
+  const root = container || document;
+  root._aiModelListeners?.abort();
+  const listeners = new AbortController();
+  root._aiModelListeners = listeners;
+  const listen = (target, type, handler, options = {}) => target?.addEventListener(type, handler, {
+    ...(typeof options === 'boolean' ? { capture: options } : options), signal: listeners.signal,
+  });
  // Delegated handler for the "+ Serve a model in Cookbook…" sentinel
  // option — catches clicks regardless of whether loadAIModels has
  // rewired the individual select yet and survives any innerHTML
  // reset later.
-  container.addEventListener('change', (e) => {
+  listen(root, 'change', (e) => {
    const sel = e.target.closest('select');
    if (!sel) return;
    if (sel.value !== '__serve_cookbook__') return;
@@ -156,7 +184,7 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
    openCookbookForImg2img();
  });
  // Track prior value so we can restore it after the sentinel fires.
-  container.addEventListener('focus', (e) => {
+  listen(root, 'focus', (e) => {
    const sel = e.target.closest('select');
    if (sel && sel.value !== '__serve_cookbook__') sel._prevServeValue = sel.value;
  }, true);
@@ -165,14 +193,31 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
  const aiInpaintSelect = document.getElementById('ge-ai-inpaint');
  const aiCommandSelect = document.getElementById('ge-ai-command-model');
  const aiCommandAgentSelect = document.getElementById('ge-ai-command-agent-model');
-  if (aiInpaintSelect) aiInpaintSelect.addEventListener('change', () => updateFooterEditModel());
-  if (aiCommandSelect) aiCommandSelect.addEventListener('change', () => updateFooterEditModel());
-  // The Quick Edit agent (planner) picker is static for now (local VL default,
-  // server default option); restore/save its choice from localStorage.
-  const populateAgentSelect = () => {
+  if (aiInpaintSelect) listen(aiInpaintSelect, 'change', () => updateFooterEditModel());
+  // The Quick Edit agent (planner) picker: dynamically populates from
+  // /api/editor/agent-models; restore/save choice from localStorage.
+  const populateAgentSelect = async () => {
    if (!aiCommandAgentSelect) return;
+    const prevVal = aiCommandAgentSelect.value;
+    let agentOptions = [...QUICK_EDIT_AGENT_OPTIONS];
+    try {
+      const res = await fetch(`${apiBase}/api/editor/agent-models`);
+      if (res.ok) {
+        const data = await res.json();
+        if (listeners.signal.aborted || !root.isConnected) return;
+        const serverModels = data.models || [];
+        for (const m of serverModels) {
+          const optVal = `${m.source === 'local' ? 'local' : (m.endpoint_id ? String(m.endpoint_id) : '')}::${m.id}`;
+          const label = m.label || m.id;
+          if (!agentOptions.some(o => o.value === optVal)) {
+            agentOptions.push({ value: optVal, label });
+          }
+        }
+      }
+    } catch (_) {}
+
    aiCommandAgentSelect.innerHTML = '';
-    for (const opt of QUICK_EDIT_AGENT_OPTIONS) {
+    for (const opt of agentOptions) {
      const el = document.createElement('option');
      el.value = opt.value;
      el.textContent = opt.label;
@@ -182,11 +227,13 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      const saved = localStorage.getItem('ge-ai-command-agent-model');
      if (saved && [...aiCommandAgentSelect.options].some(o => o.value === saved)) {
        aiCommandAgentSelect.value = saved;
+      } else if (prevVal && [...aiCommandAgentSelect.options].some(o => o.value === prevVal)) {
+        aiCommandAgentSelect.value = prevVal;
      }
    } catch {}
-    if (!aiCommandAgentSelect._agentWired) {
-      aiCommandAgentSelect._agentWired = true;
-      aiCommandAgentSelect.addEventListener('change', () => {
+    if (aiCommandAgentSelect._agentWired !== listeners) {
+      aiCommandAgentSelect._agentWired = listeners;
+      listen(aiCommandAgentSelect, 'change', () => {
        try { localStorage.setItem('ge-ai-command-agent-model', aiCommandAgentSelect.value); } catch {}
      });
    }
@@ -196,16 +243,19 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
  // select nor the inpaint select nor any per-tool select).
  if (!aiGenSelect && !aiInpaintSelect && !aiCommandSelect && !aiCommandAgentSelect &&
      !document.querySelector('select.ge-tool-model')) return;
-  populateAgentSelect();
+  void populateAgentSelect();

  async function loadAIModels(opts = {}) {
    try {
      const selectBaseUrl = opts.selectBaseUrl || '';
      const prevGenValue = aiGenSelect?.value || '';
      const prevInpaintValue = aiInpaintSelect?.value || '';
-      const res = await fetch(`${apiBase}/api/model-endpoints`);
+      const res = await fetch(`${apiBase}/api/editor/image-models`);
+      if (listeners.signal.aborted || !root.isConnected) return;
      if (!res.ok) throw new Error(`Could not load image models (${res.status})`);
-      const endpoints = await res.json();
+      const data = await res.json();
+      if (listeners.signal.aborted || !root.isConnected) return;
+      const modelsList = data.models || [];
      if (aiGenSelect) aiGenSelect.innerHTML = '<option value="">None</option>';
      if (aiInpaintSelect) aiInpaintSelect.innerHTML = '<option value="">Auto</option>';
      if (aiCommandSelect) aiCommandSelect.innerHTML = '<option value="">Auto (default)</option>';
@@ -215,59 +265,52 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      let selectedGen = null;
      let selectedInpaint = null;
      const loaded = [];
-      for (const ep of endpoints) {
-        if (!ep.is_enabled) continue;
-        const hasListedModels = Array.isArray(ep.models) && ep.models.length;
-        const models = hasListedModels ? sortModelIds(ep.models) : [''];
-        const isImageEndpoint = (ep.model_type || '').toLowerCase() === 'image';
-        // Image/inpaint endpoints can be called by URL even when their
-        // /models cache is still empty, so don't strand a freshly served
-        // Cookbook model as "(offline)" in the editor picker.
-        const epUsable = !!ep.online || isImageEndpoint;
-        for (const modelId of models) {
-          const caps = modelCaps(modelId || ep.name, ep.name, ep.model_type);
-          if (!caps.gen && !caps.inpaint) continue;
-          // Encode "<base_url>::<model_id>" so the value carries both pieces.
-          const value = `${ep.base_url}::${modelId}`;
-          const shortModel = modelId ? String(modelId).split('/').pop() : (ep.name || ep.base_url);
-          const epHint = modelId && ep.name && ep.name !== modelId ? ` · ${ep.name}` : '';
-          const label = `${shortModel}${epHint}${epUsable ? '' : ' (offline)'}`;
-          loaded.push({ value, label, gen: caps.gen, inpaint: caps.inpaint, usable: epUsable, endpoint: ep.base_url, model: modelId });
-          if (caps.gen && aiGenSelect) {
+      for (const m of modelsList) {
+        const modelId = m.id || '';
+        const caps = modelCaps(modelId, m.provider, m.kind);
+        const canGen = Boolean(caps.gen || m.kind === 'generate');
+        const canInpaint = Boolean(caps.inpaint || m.kind === 'edit');
+        if (!canGen && !canInpaint) continue;
+
+        // Use opaque endpoint_id if available; never fall back to raw base_url
+        const endpointKey = m.endpoint_id ? String(m.endpoint_id) : (m.source === 'local' ? 'local' : '');
+        const value = endpointKey ? `${endpointKey}::${modelId}` : modelId;
+        const shortModel = modelId ? String(modelId).split('/').pop() : (m.label || m.provider);
+        const epHint = m.provider && m.provider !== modelId && m.provider !== 'image' ? ` · ${m.provider}` : '';
+        const label = `${shortModel}${epHint}`;
+        const epUsable = true;
+        loaded.push({ value, label, gen: canGen, inpaint: canInpaint, usable: epUsable, endpoint: endpointKey, model: modelId });
+        if (canGen && aiGenSelect) {
+          const opt = document.createElement('option');
+          opt.value = value;
+          opt.textContent = label;
+          opt.disabled = !epUsable;
+          aiGenSelect.appendChild(opt);
+          if (epUsable && !firstGen) firstGen = value;
+          if (epUsable && selectBaseUrl && (endpointKey === selectBaseUrl || m.base_url === selectBaseUrl) && !selectedGen) selectedGen = value;
+        }
+        if (canInpaint && aiInpaintSelect) {
+          const opt = document.createElement('option');
+          opt.value = value;
+          opt.textContent = label;
+          opt.disabled = !epUsable;
+          aiInpaintSelect.appendChild(opt);
+          if (epUsable && selectBaseUrl && (endpointKey === selectBaseUrl || m.base_url === selectBaseUrl) && !selectedInpaint) selectedInpaint = value;
+        }
+        if (canInpaint || canGen) {
+          for (const ts of perToolSelects) {
            const opt = document.createElement('option');
            opt.value = value;
            opt.textContent = label;
            opt.disabled = !epUsable;
-            aiGenSelect.appendChild(opt);
-            if (epUsable && !firstGen) firstGen = value;
-            if (epUsable && selectBaseUrl && ep.base_url === selectBaseUrl && !selectedGen) selectedGen = value;
+            ts.appendChild(opt);
          }
-          if (caps.inpaint && aiInpaintSelect) {
+          if (aiCommandSelect) {
            const opt = document.createElement('option');
            opt.value = value;
            opt.textContent = label;
            opt.disabled = !epUsable;
-            aiInpaintSelect.appendChild(opt);
-            if (epUsable && selectBaseUrl && ep.base_url === selectBaseUrl && !selectedInpaint) selectedInpaint = value;
-          }
-          // Per-tool selectors get every img2img-capable entry. Both
-          // caps.inpaint AND caps.gen models work for harmonize /
-          // style / upscale (anything that can do img2img).
-          if (caps.inpaint || caps.gen) {
-            for (const ts of perToolSelects) {
-              const opt = document.createElement('option');
-              opt.value = value;
-              opt.textContent = label;
-              opt.disabled = !epUsable;
-              ts.appendChild(opt);
-            }
-            if (aiCommandSelect) {
-              const opt = document.createElement('option');
-              opt.value = value;
-              opt.textContent = label;
-              opt.disabled = !epUsable;
-              aiCommandSelect.appendChild(opt);
-            }
+            aiCommandSelect.appendChild(opt);
          }
        }
      }
@@ -300,32 +343,50 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      if (aiGenSelect) appendServeSentinel(aiGenSelect);
      if (aiInpaintSelect) appendServeSentinel(aiInpaintSelect);
      if (aiCommandSelect) appendServeSentinel(aiCommandSelect);
-      // Wire the sentinel on the Gen + Inpaint selects too.
-      const wireServeSentinel = (sel) => {
-        if (!sel) return;
-        let prev = sel.value;
-        sel.addEventListener('change', () => {
-          if (sel.value === '__serve_cookbook__') {
-            sel.value = prev;
-            openCookbookForImg2img();
-            return;
-          }
-          prev = sel.value;
-        });
-      };
-      wireServeSentinel(aiGenSelect);
-      wireServeSentinel(aiInpaintSelect);
-      wireServeSentinel(aiCommandSelect);
+      // Sentinel changes are handled by the component's delegated listener.
      if (aiCommandSelect) {
+        aiCommandSelect._modelsReady = true;
        try {
-          const saved = localStorage.getItem('ge-ai-command-model');
-          if (saved && [...aiCommandSelect.options].some(o => o.value === saved)) aiCommandSelect.value = saved;
+          const rawSaved = localStorage.getItem('ge-ai-command-model') || '';
+          let saved = rawSaved;
+          if (saved.startsWith('http://') || saved.startsWith('https://') || saved.includes('://') || saved.startsWith('::')) {
+            const modelPart = saved.includes('::') ? saved.split('::').pop() : '';
+            const matching = loaded.filter(l => l.model === modelPart);
+            if (matching.length === 1) {
+              saved = matching[0].value;
+            } else {
+              saved = '';
+            }
+            try {
+              if (saved) localStorage.setItem('ge-ai-command-model', saved);
+              else localStorage.removeItem('ge-ai-command-model');
+            } catch {}
+          }
+          if (saved && [...aiCommandSelect.options].some(o => o.value === saved)) {
+            aiCommandSelect.value = saved;
+          } else {
+            aiCommandSelect.value = '';
+          }
+          if (aiCommandSelect.value !== rawSaved) {
+            if (aiCommandSelect.value) localStorage.setItem('ge-ai-command-model', aiCommandSelect.value);
+            else localStorage.removeItem('ge-ai-command-model');
+            window.dispatchEvent(new CustomEvent('ge-ai-command-model-change', { detail: { value: aiCommandSelect.value } }));
+          }
        } catch {}
-        aiCommandSelect.addEventListener('change', () => {
-          if (aiCommandSelect.value === '__serve_cookbook__') return;
-          try { localStorage.setItem('ge-ai-command-model', aiCommandSelect.value); } catch {}
-          updateFooterEditModel();
-        });
+
+        if (aiCommandSelect._commandWired !== listeners) {
+          aiCommandSelect._commandWired = listeners;
+          listen(aiCommandSelect, 'change', () => {
+            if (aiCommandSelect.value === '__serve_cookbook__') return;
+            const val = aiCommandSelect.value || '';
+            try {
+              if (val) localStorage.setItem('ge-ai-command-model', aiCommandSelect.value);
+              else localStorage.removeItem('ge-ai-command-model');
+            } catch {}
+            updateFooterEditModel();
+            window.dispatchEvent(new CustomEvent('ge-ai-command-model-change', { detail: { value: val } }));
+          });
+        }
      }
      // Restore each per-tool selection from localStorage.
      for (const ts of perToolSelects) {
@@ -337,7 +398,7 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
          }
        } catch {}
        let prevValue = ts.value;
-        ts.addEventListener('change', () => {
+        listen(ts, 'change', () => {
          if (ts.value === '__serve_cookbook__') {
            ts.value = prevValue;
            openCookbookForImg2img();
@@ -350,6 +411,7 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      _aiModelsStatus = { ready: true, models: loaded, error: null, at: Date.now() };
      try { window.dispatchEvent(new CustomEvent('ge:ai-models-status')); } catch {}
    } catch (e) {
+      if (listeners.signal.aborted || !root.isConnected) return;
      // Fetch failed — still give the user the affordance to set up
      // a model. Otherwise the dropdown shows only "Auto" with no
      // hint about what to do next.
@@ -358,37 +420,18 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      if (aiInpaintSelect) aiInpaintSelect.innerHTML = fallback;
      if (aiCommandSelect) aiCommandSelect.innerHTML = fallback;
      document.querySelectorAll('select.ge-tool-model').forEach(ts => { ts.innerHTML = fallback; });
-      const wireServe = (sel) => {
-        if (!sel) return;
-        let prev = sel.value;
-        sel.addEventListener('change', () => {
-          if (sel.value === '__serve_cookbook__') {
-            sel.value = prev;
-            openCookbookForImg2img();
-            return;
-          }
-          prev = sel.value;
-        });
-      };
-      wireServe(aiGenSelect);
-      wireServe(aiInpaintSelect);
-      wireServe(aiCommandSelect);
-      document.querySelectorAll('select.ge-tool-model').forEach(wireServe);
-      populateAgentSelect();
+      void populateAgentSelect();
      updateFooterEditModel();
      _aiModelsStatus = { ready: false, models: [], error: String(e?.message || e), at: Date.now() };
      try { window.dispatchEvent(new CustomEvent('ge:ai-models-status')); } catch {}
    }
  }
  loadAIModels();
-  const onModelEndpointsUpdated = (e) => {
-    if (!container.isConnected) {
-      window.removeEventListener('ge:model-endpoints-updated', onModelEndpointsUpdated);
-      return;
-    }
-    loadAIModels({ selectBaseUrl: e.detail?.baseUrl || '' });
+  if (aiCommandSelect) aiCommandSelect._refreshAIModels = baseUrl => {
+    if (listeners.signal.aborted || !root.isConnected) return;
+    void loadAIModels({ selectBaseUrl: baseUrl });
+    void populateAgentSelect();
  };
-  window.addEventListener('ge:model-endpoints-updated', onModelEndpointsUpdated);
  // Re-fetch the model list when the user opens the inpaint dropdown,
  // so a model served via Cookbook mid-edit shows up without having to
  // close and reopen the editor. Debounced to one refresh per 3s so
@@ -407,5 +450,5 @@ export function wireAIModelSelectors({ container, apiBase, openCookbookForImg2im
      if ([...sel.options].some(o => o.value === keep)) sel.value = keep;
    });
  };
-  container.addEventListener('mousedown', refreshOnOpen, true);
+  listen(root, 'mousedown', refreshOnOpen, true);
 }
@@ -181,7 +181,7 @@ export function buildRightPanel({ controlsHTML, layerPanelHTML, extraPanels = []
  // entries in a compact `<select>` overlay reachable from a "Panels"
  // button in the layers header, without touching the peek/expand model.
  let mobilePanels = null;
-  if (!useDock && Array.isArray(extraPanels) && extraPanels.length) {
+  if (Array.isArray(extraPanels) && extraPanels.length) {
    const mDock = buildDock({
      entries: extraPanels,
      persistKey: 'ge-dock-active',
@@ -218,7 +218,9 @@ export function buildRightPanel({ controlsHTML, layerPanelHTML, extraPanels = []
        overlay.hidden = !overlay.hidden;
      });
      hdr.appendChild(panelsBtn);
+      if (useDock) panelsBtn.style.display = 'none';
    }
+    if (useDock) overlay.style.display = 'none';
    mobilePanels = overlay;
  }

@@ -226,7 +228,7 @@ export function buildRightPanel({ controlsHTML, layerPanelHTML, extraPanels = []
  // The panels are only re-parented, so every existing selector and
  // listener keeps working; switching tabs just toggles `hidden`.
  let dock = null;
-  if (useDock) {    rightPanel.classList.add('ge-right-panel--dock');
+  if (Array.isArray(extraPanels) && extraPanels.length) {
    dock = buildDock({
      entries: [
        ...(Array.isArray(extraPanels) ? extraPanels : []),
@@ -239,11 +241,12 @@ export function buildRightPanel({ controlsHTML, layerPanelHTML, extraPanels = []
      onCloseGroup,
    });
    rightPanel.appendChild(dock.dock);
-    // Layers stays pinned below the dock so the layer list is always
-    // visible while editing (Photoshop-style), regardless of the active
-    // dock tab. Only the tool options + studio panels live in tabs.
-    rightPanel.appendChild(layerPanel);
+    if (!useDock) dock.dock.style.display = 'none';
  }
+  if (useDock) {
+    rightPanel.classList.add('ge-right-panel--dock');
+  }
+  rightPanel.appendChild(layerPanel);

  // Horizontal drag handle on the LEFT edge of the right panel — drag
  // left to widen, right to narrow. Persists chosen width in
@@ -286,5 +289,5 @@ export function buildRightPanel({ controlsHTML, layerPanelHTML, extraPanels = []
    } catch {}
  });

-  return { rightPanel, controls, layerPanel, panelResize, dock };
+  return { rightPanel, controls, layerPanel, panelResize, dock, mobilePanels };
 }
@@ -109,6 +109,8 @@ export function buildToolbar({ currentTool, onSelectTool, onClearSelection }) {

  const closeAllFlyouts = () => {
    toolbar.querySelectorAll('.ge-tool-slot.open').forEach(s => s.classList.remove('open'));
+    toolbar.classList.remove('ge-flyout-open');
+    toolbar.closest('.ge-toolbar-wrap')?.classList.remove('ge-flyout-open');
  };

  const openFlyout = (slotEl, face) => {
@@ -116,6 +118,8 @@ export function buildToolbar({ currentTool, onSelectTool, onClearSelection }) {
    closeAllFlyouts();
    if (isOpen) return;
    slotEl.classList.add('open');
+    toolbar.classList.add('ge-flyout-open');
+    toolbar.closest('.ge-toolbar-wrap')?.classList.add('ge-flyout-open');
    const flyout = slotEl.querySelector('.ge-tool-flyout');
    if (!flyout) return;
    const r = face.getBoundingClientRect();
@@ -242,7 +246,13 @@ export function buildToolbar({ currentTool, onSelectTool, onClearSelection }) {
                  : soft >= 70
                    ? '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><circle cx="12" cy="12" r="6.5" fill="currentColor" opacity="0.3"/><circle cx="12" cy="12" r="6.5"/></svg>'
                    : '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><circle cx="12" cy="12" r="6.5" fill="currentColor" opacity="0.65"/><circle cx="12" cy="12" r="6.5"/></svg>';
-              presetItem.insertAdjacentHTML('beforeend', `<span class="ge-tool-icon">${presetIcon}</span><span class="ge-tool-flyout-label">${preset.name}</span>`);
+              const icon = document.createElement('span');
+              icon.className = 'ge-tool-icon';
+              icon.innerHTML = presetIcon;
+              const label = document.createElement('span');
+              label.className = 'ge-tool-flyout-label';
+              label.textContent = preset.name;
+              presetItem.append(icon, label);
              presetItem.addEventListener('click', (ev) => {
                ev.stopPropagation();
                setInner(face, 'brush');
@@ -535,6 +535,7 @@ export function buildTopbar() {
          <span class="ge-stacked-glyph">
            <svg hidden class="ge-save-state-icon ge-save-state-dirty" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 3h12l4 4v14H4z"/><path d="M8 3v6h8V3"/><path d="m16 3 6 6m0-6-6 6" stroke="var(--fg)" stroke-width="3"/></svg>
            <svg class="ge-save-state-icon ge-save-state-saved" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="20 6 9 17 4 12"/></svg>
+            <svg hidden class="ge-save-state-icon ge-save-state-error" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
          </span>
          <span class="ge-stacked-label ge-save-action-label">SAVE</span>
          <span class="ge-stacked-label ge-save-label" id="ge-draft-status" role="status" aria-live="polite">Saved</span>
@@ -8,8 +8,29 @@
 * @param {HTMLCanvasElement} canvas
 * @returns {{x: number, y: number}}
 */
+import { state } from './state.js';
+
+let _cachedCanvas = null;
+let _cachedRect = null;
+let _cachedRectTime = 0;
+
+export function invalidateCanvasCoordsCache() {
+  _cachedCanvas = null;
+  _cachedRect = null;
+  _cachedRectTime = 0;
+}
+
 export function canvasCoords(e, canvas) {
-  const rect = canvas.getBoundingClientRect();
+  const now = performance.now();
+  let rect;
+  if (_cachedCanvas === canvas && _cachedRect && (state.drawing || (now - _cachedRectTime < 64))) {
+    rect = _cachedRect;
+  } else {
+    rect = canvas.getBoundingClientRect();
+    _cachedCanvas = canvas;
+    _cachedRect = rect;
+    _cachedRectTime = now;
+  }
  const scaleX = canvas.width / rect.width;
  const scaleY = canvas.height / rect.height;
  const clientX = e.touches && e.touches.length ? e.touches[0].clientX : e.clientX;
@@ -44,6 +44,7 @@
 * }} ctx
 */
 import { state } from './state.js';
+import { invalidateCanvasCoordsCache } from './canvas-coords.js';
 import {
  applyCanvasPan,
  isDirectPanIntent,
@@ -58,6 +59,12 @@ export function wireCanvasEvents({ canvasArea, beginDraw, continueDraw, endDraw,
  canvasWindowBindings?.abort();
  canvasWindowBindings = new AbortController();
  const { signal } = canvasWindowBindings;
+
+  // Invalidate coordinate cache on layout, scroll, resize or orientation shifts
+  window.addEventListener('resize', invalidateCanvasCoordsCache, { signal, passive: true });
+  window.addEventListener('scroll', invalidateCanvasCoordsCache, { signal, passive: true });
+  window.addEventListener('orientationchange', invalidateCanvasCoordsCache, { signal, passive: true });
+  canvasArea.addEventListener('scroll', invalidateCanvasCoordsCache, { passive: true });
  let suppressMouseUntil = 0;
  // Tool-aware right-click menu on the image and the surrounding area.
  wireCanvasContextMenu(canvasArea, { signal });
@@ -90,7 +97,7 @@ export function wireCanvasEvents({ canvasArea, beginDraw, continueDraw, endDraw,
  window.addEventListener('mousemove', (e) => {
    if (Date.now() < suppressMouseUntil) return;
    // Only shield the raw-coordinate selection/crop rects from chrome.
-    if (isUiChrome(e) && directGestureActive()) return;
+    if (directGestureActive() && isUiChrome(e)) return;
    continueDraw(e);
  }, { signal });
  window.addEventListener('mouseup', (e) => {
@@ -240,11 +247,14 @@ export function wireCanvasEvents({ canvasArea, beginDraw, continueDraw, endDraw,
      const newZoom = Math.max(0.1, Math.min(5, multiStartZoom * ratio));
      if (Math.abs(newZoom - state.zoom) > 0.001) {
        state.zoom = newZoom;
+        // A pinch is an explicit zoom; layout refits must not undo it.
+        state.zoomViewMode = 'scale';
        state.mainCanvas.style.width = (state.imgWidth * state.zoom) + 'px';
        state.mainCanvas.style.height = (state.imgHeight * state.zoom) + 'px';
        const label = state.container.querySelector('.ge-zoom-label');
        if (label) label.textContent = Math.round(state.zoom * 100) + '%';
        syncZoomControls?.();
+        invalidateCanvasCoordsCache();
        onViewportChange?.();
      }
      const dx = info.cx - multiStartCenter.x;
@@ -77,7 +77,8 @@ export function wireClipboardAndDrop({
    // inside the gallery modal's role="dialog" modal-content, so that would
    // swallow every paste (including the internal Clipboard + Ctrl+V).
    const target = e.target;
-    const insideEditor = target && container && container.contains(target);
+    // A paste dispatched at window has a non-Node target; contains() would throw.
+    const insideEditor = target instanceof Node && !!container && container.contains(target);
    if (insideEditor && (target.isContentEditable || target.closest?.('input, textarea, select'))) return;

    const imageItem = Array.from(e.clipboardData?.items || []).find(item => item.type.startsWith('image/'));
@@ -50,7 +50,7 @@ import {
 import { drawHistogram } from './histogram.js';
 import { parseCubeLut, generateCubeLut } from './cube-lut.js';

-export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, getAdjustmentSource = null }) {
+export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, getAdjustmentSource = null, schedulePersist = null }) {
  function suppressLayerGhostTap() {
    window.__geSuppressLayerTapUntil = Date.now() + 650;
  }
@@ -511,6 +511,7 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      composite();
      renderLayerPanel();
      closeAdjPopup();
+      schedulePersist?.();
    });
  }

@@ -535,8 +536,14 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      if (!p.channels[channel]) p.channels[channel] = defaultAdjParams('levels').channels[channel];
      return p.channels[channel];
    };
+    // Params come from project files and drafts, which only validate the
+    // adjustment type; coerce anything interpolated into markup below.
+    const finite = value => (Number.isFinite(Number(value)) ? Number(value) : 0);
+    const hexColor = (value, fallback) => (/^#[0-9a-f]{6}$/i.test(value) ? value : fallback);
    const revertIcon = '<svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="1 4 1 10 7 10"/><path d="M3.51 15a9 9 0 1 0 2.13-9.36L1 10"/></svg>';
-    const sliderRow = (key, label, min, max, value, suffix, defaultValue) => `
+    const sliderRow = (key, label, min, max, rawValue, suffix, defaultValue) => {
+      const value = finite(rawValue);
+      return `
      <div class="ge-adj-row" data-adj-key="${key}"${defaultValue != null ? ` data-default="${defaultValue}"` : ''}>
        <label>${label}</label>
        <input type="range" min="${min}" max="${max}" value="${value}" data-key="${key}" />
@@ -544,6 +551,7 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
        <button class="ge-adj-revert" type="button" title="Reset this slider" data-revert-key="${key}">${revertIcon}</button>
      </div>
    `;
+    };
    if (type === 'brightness-contrast') {
      const bSlider = Math.round((p.brightness - 1) * 100);
      const cSlider = Math.round((p.contrast - 1) * 100);
@@ -692,7 +700,7 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      });
    } else if (type === 'color-balance') {
      // Color-tinted slider ends so the user sees what direction does what.
-      const cbRow = (key, leftCol, rightCol, label, value) => `
+      const cbRow = (key, leftCol, rightCol, label, rawValue, value = finite(rawValue)) => `
      <div class="ge-adj-row ge-adj-cb-row" data-adj-key="${key}">
        <span class="ge-adj-cb-dot" style="background:${leftCol}"></span>
        <input type="range" min="-100" max="100" value="${value}" data-key="${key}" />
@@ -749,6 +757,9 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
        buildAdjBody(layer, type, body, popEl);
      });
    } else if (type === 'gradient-map') {
+      const gradientDefaults = defaultAdjParams('gradient-map');
+      p.shadows = hexColor(p.shadows, gradientDefaults.shadows);
+      p.highlights = hexColor(p.highlights, gradientDefaults.highlights);
      body.innerHTML = `
        <div class="ge-gradient-map-preview" style="--ge-gradient-start:${p.shadows};--ge-gradient-end:${p.highlights}"></div>
        <div class="ge-gradient-color-row">
@@ -789,7 +800,7 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      body.innerHTML = `
        <div class="ge-adj-row">
          <label>Color</label>
-          <input type="color" data-photo-key="color" value="${p.color || '#ec8a00'}">
+          <input type="color" data-photo-key="color" value="${hexColor(p.color, '#ec8a00')}">
        </div>
        ${sliderRow('density', 'Density', 0, 100, Math.round(p.density ?? 25), '%')}
        <label class="ge-adj-toggle-row"><span>Preserve luminosity</span><input type="checkbox" data-photo-preserve${p.preserve_luminosity ? ' checked' : ''}><span class="ge-toggle-track"></span></label>
@@ -838,7 +849,7 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      const presetLabels = { none: 'None', teal_orange: 'Teal & Orange', cold: 'Cold', warm: 'Warm', high_contrast: 'High Contrast', sepia: 'Sepia' };
      const strength = p.strength == null ? 100 : p.strength;
      const hasCube = !!(p.cube && p.cube.size && p.cube.data);
-      const lutName = hasCube ? `Loaded LUT · ${p.cube.size}³` : 'No .cube loaded';
+      const lutName = hasCube ? `Loaded LUT · ${finite(p.cube.size)}³` : 'No .cube loaded';
      body.innerHTML = `
        <label class="ge-adj-channel-field">Lookup preset
          <select class="ge-adj-lut-select">
@@ -972,6 +983,8 @@ export function createAdjPopupSystem({ composite, saveState, renderLayerPanel, g
      p.strength = raw; display = raw + '%';
    } else if (type === 'white-balance') {
      p[key] = raw;
+    } else if (type === 'vibrance') {
+      p[key] = raw;
    } else if (type === 'black-white') {
      p[key] = raw;
    } else if (type === 'shadows-highlights') {
@@ -1948,7 +1948,8 @@ export function createLayerPanelRenderer(deps) {
          });
          const sName = document.createElement('span');
          sName.className = 'ge-layer-name ge-adj-sub-name';
-          sName.innerHTML = `<span class="ge-adj-sub-icon">◌</span><span>${effectLabel(effect.type)}</span>`;
+          sName.innerHTML = '<span class="ge-adj-sub-icon">◌</span><span></span>';
+          sName.lastElementChild.textContent = effectLabel(effect.type);
          sName.title = 'Edit effect (drag onto another layer to copy)';
          sName.addEventListener('click', event => {
            event.stopPropagation();
@@ -28,10 +28,10 @@ const GRADIENTS = [
  ['Spectrum', ['#ff0000', '#ffff00', '#00ff00', '#00ffff', '#0000ff', '#ff00ff']],
 ];

-function el(tag, className, html) {
+function el(tag, className, text) {
  const node = document.createElement(tag);
  if (className) node.className = className;
-  if (html != null) node.innerHTML = html;
+  if (text != null) node.textContent = text;
  return node;
 }

@@ -274,7 +274,11 @@ export function createStudioPanels({
      return;
    }
    shapeLayers.slice().reverse().forEach(layer => {
-      const button = el('button', 'ge-channel-row', `<span class="ge-channel-name">${layer.shape.type === 'path' ? 'Path' : layer.shape.type} · ${layer.name || layer.id.slice(0, 6)}</span>`);
+      const button = el('button', 'ge-channel-row');
+      const name = document.createElement('span');
+      name.className = 'ge-channel-name';
+      name.textContent = `${layer.shape.type === 'path' ? 'Path' : layer.shape.type} · ${layer.name || layer.id.slice(0, 6)}`;
+      button.appendChild(name);
      button.type = 'button';
      button.addEventListener('click', () => { onSelectLayer(layer.id); renderPaths(); });
      pathBody.appendChild(button);
@@ -400,10 +400,15 @@ export const state = {
  // Loading-overlay element (whirlpool + label).
  editorLoadingEl: null,

-  // ── Draft persistence ──
+  // ── Draft persistence & revision tracking ──
  draftId: null,
  draftName: '',
  documentId: null,
+  documentRevision: 0,
+  persistingRevision: 0,
+  savedRevision: 0,
+  persistRetryTimer: null,
+  persistRetryCount: 0,
  persistTimer: null,
  // Current PUT/POST promise so concurrent saves can chain.
  persistInFlight: null,
@@ -12,15 +12,21 @@ function toolSettings(tool) {
  return { opacity: state.brushOpacity, flow: state.brushFlow, softness: state.brushSoftness };
 }

+let _lastColor = null;
+let _lastTransparentColor = null;
 function transparentColor(color) {
+  if (color === _lastColor && _lastTransparentColor) return _lastTransparentColor;
+  _lastColor = color;
  if (color.startsWith('#')) {
    const raw = color.slice(1);
    const expanded = raw.length === 3 ? raw.split('').map(char => char + char).join('') : raw;
    const rgb = [0, 2, 4].map(index => parseInt(expanded.slice(index, index + 2), 16));
-    return `rgba(${rgb.join(',')},0)`;
+    _lastTransparentColor = `rgba(${rgb.join(',')},0)`;
+    return _lastTransparentColor;
  }
  const match = color.match(/rgba?\(([^)]+)\)/);
-  return match ? `rgba(${match[1].split(',').slice(0, 3).join(',')},0)` : 'rgba(0,0,0,0)';
+  _lastTransparentColor = match ? `rgba(${match[1].split(',').slice(0, 3).join(',')},0)` : 'rgba(0,0,0,0)';
+  return _lastTransparentColor;
 }

 function circleStamp(ctx, x, y, radius, softness, color, alpha, operation) {
@@ -10,6 +10,16 @@
 * the Window > Workspace submenu (wire-extra-menus.js).
 */
 export function wireSubmenuToggles(menu) {
+  menu.addEventListener('mouseover', (e) => {
+    if (e.target.closest('.ge-menu-parent, .ge-submenu')) {
+      menu.classList.add('ge-flyout-open');
+    }
+  });
+  menu.addEventListener('mouseleave', () => {
+    if (!menu.querySelector('.ge-menu-parent.open')) {
+      menu.classList.remove('ge-flyout-open');
+    }
+  });
  menu.addEventListener('click', (e) => {
    const parent = e.target.closest('.ge-menu-parent');
    if (!parent) return;
@@ -241,11 +241,13 @@ export function createTransformSession({
    }
    if (state.transformPopup) {
      try {
+        state.transformPopup.closest('.ge-controls')?.classList.remove('ge-transform-active');
        state.transformPopup.innerHTML = '';
        state.transformPopup.style.display = 'none';
      } catch {}
      state.transformPopup = null;
    }
+    document.querySelectorAll('.ge-controls.ge-transform-active').forEach(c => c.classList.remove('ge-transform-active'));
  }

  let mobileBoundsHandler = null;
@@ -285,6 +287,11 @@ export function createTransformSession({
    // bar) instead of a floating popup over the canvas.
    const pop = document.getElementById('ge-transform-section');
    if (!pop) return;
+    const parentControls = pop.closest('.ge-controls');
+    if (parentControls) {
+      parentControls.classList.add('ge-transform-active');
+      parentControls.classList.remove('dismissed');
+    }
    pop.innerHTML = `<div class="ge-transform-popup">${transformPopupHTML()}</div>`;
    const title = pop.querySelector('.ge-adj-title');
    if (title && state.transformTarget === 'selection') title.textContent = 'Transform Selection';
@@ -127,8 +127,8 @@ export function wireTopbar(deps) {
        (Math.abs(state.zoom - 1) < 0.001 && state.zoomViewMode !== 'fit')) fitZoom();
    else { state.zoom = 1; state.zoomViewMode = 'scale'; applyZoom(); }
  });
-  document.getElementById('ge-zoom-in')?.addEventListener('click', () => { state.zoom = Math.min(5, state.zoom * 1.25); applyZoom(); });
-  document.getElementById('ge-zoom-out')?.addEventListener('click', () => { state.zoom = Math.max(0.1, state.zoom / 1.25); applyZoom(); });
+  document.getElementById('ge-zoom-in')?.addEventListener('click', () => { state.zoom = Math.min(5, state.zoom * 1.25); state.zoomViewMode = 'scale'; applyZoom(); });
+  document.getElementById('ge-zoom-out')?.addEventListener('click', () => { state.zoom = Math.max(0.1, state.zoom / 1.25); state.zoomViewMode = 'scale'; applyZoom(); });

  // Export / Download / Project Save / Project Load.
  document.getElementById('ge-export-gallery')?.addEventListener('click', exportToGallery);
@@ -5021,7 +5021,7 @@ export async function _refreshUnreadBadge({ unreadCountOverride = null, preserve
  } catch (_) { _syncUnreadTabBadge(0); }
 }

-export async function _loadEmails({ force = false, useCache = true } = {}) {
+export async function _loadEmails({ force = false, useCache = true, skipFastPath = false } = {}) {
  const seq = ++_libLoadSeq;
  state._libLoading = true;
  const accountAtStart = state._libAccountId || '';
@@ -5119,7 +5119,7 @@ export async function _loadEmails({ force = false, useCache = true } = {}) {
      const accountQS = accountAtStart ? `&account_id=${encodeURIComponent(accountAtStart)}` : '';
      const attQS = hasAttachmentsAtStart ? '&has_attachments=1' : '';
      const dateQS = `${dateFromAtStart ? `&date_from=${encodeURIComponent(dateFromAtStart)}` : ''}${dateToAtStart ? `&date_to=${encodeURIComponent(dateToAtStart)}` : ''}`;
-      if (!cached && cacheable && !force) {
+      if (!cached && cacheable && !force && !skipFastPath) {
        const ctrl = new AbortController();
        const timer = setTimeout(() => ctrl.abort(), 450);
        try {
@@ -2229,6 +2229,36 @@ function _makeGalleryDraggable(content) {
 // Re-export the manager for the rail click handler
 import * as Modals from './modalManager.js';

+// Module-owned listeners resolve the current picker; closed modals are never retained.
+window.addEventListener('ge-ai-command-model-change', (e) => {
+  const imageModelSelect = document.getElementById('gallery-image-model');
+  if (!imageModelSelect || !imageModelSelect._modelsReady) return;
+  let val = (e && e.detail && typeof e.detail.value === 'string') ? e.detail.value : '';
+  if (val && ![...imageModelSelect.options].some(o => o.value === val)) {
+    if (localStorage.getItem('ge-ai-command-model') === val) localStorage.removeItem('ge-ai-command-model');
+    val = '';
+  }
+  if (imageModelSelect.value !== val) {
+    imageModelSelect.value = val;
+    if (imageModelSelect.value !== val) imageModelSelect.value = '';
+  }
+});
+window.addEventListener('storage', (e) => {
+  const imageModelSelect = document.getElementById('gallery-image-model');
+  if (e && e.key === 'ge-ai-command-model' && imageModelSelect?._modelsReady) {
+    let val = e.newValue || '';
+    if (val && ![...imageModelSelect.options].some(o => o.value === val)) {
+      if (localStorage.getItem('ge-ai-command-model') === val) localStorage.removeItem('ge-ai-command-model');
+      val = '';
+    }
+    if (imageModelSelect.value !== val) {
+      imageModelSelect.value = val;
+      if (imageModelSelect.value !== val) imageModelSelect.value = '';
+    }
+  }
+});
+
+
 export function openGallery() {
  // If already minimized — restore in place, preserve all state
  if (Modals.isRegistered('gallery-modal') && Modals.isMinimized('gallery-modal')) {
@@ -2607,7 +2637,7 @@ export function openGallery() {

  // ── Image model (Settings tab) ──
  // Mirror of the Quick Edit picker: same source (GET /api/editor/image-models)
-  // and the SAME localStorage key `ge-ai-command-model` (value `<base_url>::<id>`)
+  // and the SAME localStorage key `ge-ai-command-model` (value `<endpoint_id>::<id>`)
  // so the two stay in sync.
  const _GE_MODEL_KEY = 'ge-ai-command-model';
  const imageModelSelect = document.getElementById('gallery-image-model');
@@ -2617,7 +2647,8 @@ export function openGallery() {
        const r = await fetch(`${API_BASE}/api/editor/image-models`, { credentials: 'same-origin' });
        const data = r.ok ? await r.json() : null;
        const models = (data && Array.isArray(data.models)) ? data.models : [];
-        const saved = localStorage.getItem(_GE_MODEL_KEY) || '';
+        const rawSaved = localStorage.getItem(_GE_MODEL_KEY) || '';
+        let saved = rawSaved;
        imageModelSelect.innerHTML = '';
        const def = document.createElement('option');
        def.value = '';
@@ -2625,12 +2656,34 @@ export function openGallery() {
        imageModelSelect.appendChild(def);
        for (const m of models) {
          const opt = document.createElement('option');
-          opt.value = `${m.base_url || ''}::${m.id}`;
+          const endpointKey = m.endpoint_id ? String(m.endpoint_id) : (m.source === 'local' ? 'local' : '');
+          opt.value = endpointKey ? `${endpointKey}::${m.id}` : m.id;
          opt.textContent = `${m.id} · ${m.provider || ''} (${m.kind || 'edit'})`.trim();
          imageModelSelect.appendChild(opt);
        }
+        imageModelSelect._modelsReady = true;
+        // Invalidate or migrate legacy localStorage values containing URLs or leading ::
+        if (saved.startsWith('http://') || saved.startsWith('https://') || saved.includes('://') || saved.startsWith('::')) {
+          const modelPart = saved.includes('::') ? saved.split('::').pop() : '';
+          const matching = models.filter(m => m.id === modelPart);
+          if (matching.length === 1) {
+            const epKey = matching[0].endpoint_id ? String(matching[0].endpoint_id) : (matching[0].source === 'local' ? 'local' : '');
+            saved = epKey ? `${epKey}::${matching[0].id}` : matching[0].id;
+          } else {
+            saved = '';
+          }
+          try {
+            if (saved) localStorage.setItem(_GE_MODEL_KEY, saved);
+            else localStorage.removeItem(_GE_MODEL_KEY);
+          } catch (_) {}
+        }
        imageModelSelect.value = saved;
        if (imageModelSelect.value !== saved) imageModelSelect.value = '';
+        if (imageModelSelect.value !== rawSaved) {
+          if (imageModelSelect.value) localStorage.setItem(_GE_MODEL_KEY, imageModelSelect.value);
+          else localStorage.removeItem(_GE_MODEL_KEY);
+          window.dispatchEvent(new CustomEvent('ge-ai-command-model-change', { detail: { value: imageModelSelect.value } }));
+        }
      } catch (e) {
        imageModelSelect.innerHTML = '<option value="">Default (configured provider)</option>';
      }
@@ -2645,11 +2698,7 @@ export function openGallery() {
    });
    _fillImageModels();
  }
-  window.addEventListener('storage', (e) => {
-    if (e && e.key === _GE_MODEL_KEY && imageModelSelect) {
-      imageModelSelect.value = e.newValue || '';
-    }
-  });
+

  // ── Tag All Untagged ──
  let _tagCancelRequested = false;
@@ -7,7 +7,7 @@ import dragSortModule from './dragSort.js';
 import spinnerModule from './spinner.js';
 import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
 import modalManager from './modalManager.js';
-import { canvasCoords as _canvasCoords } from './editor/canvas-coords.js';
+import { canvasCoords as _canvasCoords, invalidateCanvasCoordsCache } from './editor/canvas-coords.js';
 import { pickTopmostLayerAt as _pickTopmostLayerAt } from './editor/layer-hit-test.js';
 import { drawCheckerboard as _drawCheckerboard } from './editor/checkerboard.js';
 import { dilateMask as _dilateMask, applyInpaintFeather as _applyInpaintFeather } from './editor/mask-utils.js';
@@ -854,11 +854,13 @@ function _setAiProgress(frac, label) {
  if (lbl) lbl.textContent = label || '';
 }
 function _startAiProgress(requestId) {
+  const endpointId = arguments[1] || '';
  _stopAiProgress();
  if (!requestId) return;
  const tick = async () => {
    try {
-      const r = await fetch(`/api/image/edit-progress?request_id=${encodeURIComponent(requestId)}`, { credentials: 'same-origin' });
+      const epQuery = endpointId ? `&endpoint_id=${encodeURIComponent(endpointId)}` : '';
+      const r = await fetch(`/api/image/edit-progress?request_id=${encodeURIComponent(requestId)}` + epQuery, { credentials: 'same-origin' });
      if (!r.ok) return;
      const p = await r.json();
      const st = p.stage || '';
@@ -1113,6 +1115,68 @@ function _matchAiCommandSuggestions(query) {
    .map(hit => hit.item);
 }

+// On phones the layers panel is a bottom sheet that can cover the editor
+// footer (zoom / setup). Float the footer just above the sheet's top edge so
+// its controls stay tappable; restore it to normal flow when the sheet is
+// collapsed or on desktop.
+let _lastFooterDelta = 0;
+const _placeMobileFooter = () => {
+  const footer = document.querySelector('.ge-editor-footer');
+  if (!footer) return;
+  const area = document.querySelector('.ge-canvas-area');
+  const _clear = () => {
+    footer.classList.remove('ge-footer-floating');
+    footer.style.position = ''; footer.style.left = ''; footer.style.right = '';
+    footer.style.bottom = ''; footer.style.zIndex = '';
+    document.body.classList.remove('ge-footer-docked');
+    state._footerDocked = false;
+    if (area && (area.style.marginBottom || area.style.height || area.style.flex || area.style.minHeight)) {
+      area.style.marginBottom = ''; area.style.height = ''; area.style.flex = ''; area.style.minHeight = '';
+      _lastFooterDelta = 0;
+      // The sheet may have squeezed fit view to a few pixels. Restore fit
+      // after releasing that constraint, while retaining an explicit zoom.
+      if (state.zoomViewMode === 'fit') {
+        try { _fitZoom(); } catch (_) {}
+      }
+    }
+  };
+  if (window.innerWidth > 700) { _clear(); return; }
+  const sheet = document.querySelector('.ge-right-panel');
+  if (!sheet || sheet.classList.contains('minimized') || sheet.classList.contains('expanded')) { _clear(); return; }
+  const r = sheet.getBoundingClientRect();
+  const vh = window.innerHeight;
+  if (r.height <= 0 || r.top >= vh || r.top <= 140) { _clear(); return; }
+  footer.classList.add('ge-footer-floating');
+  footer.style.position = 'fixed';
+  footer.style.left = '0';
+  footer.style.right = '0';
+  footer.style.zIndex = '60';
+  // Dock the footer flush to the sheet top: no seam / dead space between them.
+  footer.style.bottom = Math.max(0, Math.round(vh - r.top)) + 'px';
+  document.body.classList.add('ge-footer-docked');
+  // Dock the canvas image flush too: with the dock padding off, the image
+  // fills the region so its bottom meets the footer top (no dead space).
+  state._footerDocked = true;
+  // Size the canvas region so it ends exactly where the footer begins:
+  // canvas bottom == footer top == sheet top. (Its mobile min-height:40vh
+  // would otherwise keep it running under the footer and the sheet.) The
+  // ge-footer-docked class also hides the sheet grab handle.
+  if (area) {
+    const footerH = footer.getBoundingClientRect().height || 0;
+    const desiredBottom = Math.round(r.top - footerH);
+    const want = Math.max(0, Math.round(desiredBottom - area.getBoundingClientRect().top));
+    if (want !== _lastFooterDelta) {
+      area.style.flex = want ? '0 0 auto' : '';
+      area.style.minHeight = want ? '0px' : '';
+      area.style.height = want ? want + 'px' : '';
+      _lastFooterDelta = want;
+      if (state.zoomViewMode === 'fit') {
+        try { _fitZoom(); } catch (_) {}
+      }
+    }
+  }
+};
+
 function _wireAiCommandBox() {
  const wrap = document.getElementById('ge-ai-command');
  const toggle = document.getElementById('ge-ai-command-toggle');
@@ -1368,60 +1432,6 @@ function _wireAiCommandBox() {
  input.addEventListener('click', _trackLift);
  wrap.addEventListener('focusin', _trackLift);
  requestAnimationFrame(() => requestAnimationFrame(_liftQuickEdit));
-  // On phones the layers panel is a bottom sheet that can cover the editor
-  // footer (zoom / setup). Float the footer just above the sheet's top edge so
-  // its controls stay tappable; restore it to normal flow when the sheet is
-  // collapsed or on desktop.
-  let _lastFooterDelta = 0;
-  const _placeMobileFooter = () => {
-    const footer = document.querySelector('.ge-editor-footer');
-    if (!footer) return;
-    const area = document.querySelector('.ge-canvas-area');
-    const _clear = () => {
-      footer.classList.remove('ge-footer-floating');
-      footer.style.position = ''; footer.style.left = ''; footer.style.right = '';
-      footer.style.bottom = ''; footer.style.zIndex = '';
-      document.body.classList.remove('ge-footer-docked');
-      state._footerDocked = false;
-      if (area && (area.style.marginBottom || area.style.height || area.style.flex || area.style.minHeight)) {
-        area.style.marginBottom = ''; area.style.height = ''; area.style.flex = ''; area.style.minHeight = '';
-        _lastFooterDelta = 0;
-      }
-    };
-    if (window.innerWidth > 700) { _clear(); return; }
-    const sheet = document.querySelector('.ge-right-panel');
-    if (!sheet || sheet.classList.contains('minimized')) { _clear(); return; }
-    const r = sheet.getBoundingClientRect();
-    const vh = window.innerHeight;
-    if (r.height <= 0 || r.top >= vh) { _clear(); return; }
-    footer.classList.add('ge-footer-floating');
-    footer.style.position = 'fixed';
-    footer.style.left = '0';
-    footer.style.right = '0';
-    footer.style.zIndex = '60';
-    // Dock the footer flush to the sheet top: no seam / dead space between them.
-    footer.style.bottom = Math.max(0, Math.round(vh - r.top)) + 'px';
-    document.body.classList.add('ge-footer-docked');
-    // Dock the canvas image flush too: with the dock padding off, the image
-    // fills the region so its bottom meets the footer top (no dead space).
-    state._footerDocked = true;
-    // Size the canvas region so it ends exactly where the footer begins:
-    // canvas bottom == footer top == sheet top. (Its mobile min-height:40vh
-    // would otherwise keep it running under the footer and the sheet.) The
-    // ge-footer-docked class also hides the sheet grab handle.
-    if (area) {
-      const footerH = footer.getBoundingClientRect().height || 0;
-      const desiredBottom = Math.round(r.top - footerH);
-      const want = Math.max(0, Math.round(desiredBottom - area.getBoundingClientRect().top));
-      if (want !== _lastFooterDelta) {
-        area.style.flex = want ? '0 0 auto' : '';
-        area.style.minHeight = want ? '0px' : '';
-        area.style.height = want ? want + 'px' : '';
-        _lastFooterDelta = want;
-        try { _fitZoom(); } catch (_) {}
-      }
-    }
-  };
  // The layers sheet expands/collapses (and its peek height grows as layers
  // render) independently of the keyboard; watch it so the bar and the footer
  // keep clear of the sheet's top edge as it moves.
@@ -2592,8 +2602,8 @@ function _wireAiCommandBox() {
  // done vs retry. The caller enforces a single retry (max 1).
  const _vlJudgeAfter = async (prompt, before, after) => {
    if (!before || !after) return { done: true };
-    let ep = 'http://100.69.120.65:8097/v1';
-    let model = 'Qwen3.5-9B-MLX-8bit';
+    let ep = '';
+    let model = 'Qwen3.5-9B';
    try {
      const info = _getSelectedQuickEditAgentModel();
      if (info && info.endpoint) ep = info.endpoint;
@@ -2637,6 +2647,7 @@ function _wireAiCommandBox() {
        { type: 'image_url', image_url: { url: after } },
      ] }],
    };
+    if (!ep) return { done: true };
    try {
      const resp = await fetch(ep.replace(/\/$/, '') + '/chat/completions', {
        method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
@@ -3295,6 +3306,7 @@ const _adjPopupSystem = createAdjPopupSystem({
  saveState: _saveState,
  renderLayerPanel: () => _renderLayerPanel(),
  getAdjustmentSource: layer => _adjustmentSourceCanvas(layer),
+  schedulePersist: () => _schedulePersist(),
 });
 const _closeFxPopup                     = _adjPopupSystem.closeFxPopup;
 const _ensureAdjustments                = _adjPopupSystem.ensureAdjustments;
@@ -3948,13 +3960,13 @@ function _finishComposite(render, documentCanvas) {
  if (state.transformActive) _drawTransformHandles();
  else if (state.transformOverlay) state.transformOverlay.style.display = 'none';
  if (state.marqueeActive && state.marqueeRect) _drawMarqueeOverlay();
-  _penTool.draw();
+  if (state.tool === 'pen' || state.penPoints?.length) _penTool.draw();
  if (state.cropRect && !state.cropping) _drawCropOverlay();
-  _syncCropFrame();
+  if (state.cropRect) _syncCropFrame();
  if (state.activeSnapGuides && state.activeSnapGuides.length) _drawSnapGuides();
-  _precisionGuides?.drawDocumentOverlay(state.mainCtx);
+  if (!state.drawing) _precisionGuides?.drawDocumentOverlay(state.mainCtx);
  _refreshSelectionOverlay();
-  _syncToolClearIndicators();
+  if (!state.drawing) _syncToolClearIndicators();
 }

 function composite() {
@@ -4333,7 +4345,14 @@ function _saveState(label, options = {}) {
    console.error('[gallery] saveState snapshot failed (continuing without this undo step):', e);
  }
  try { _invalidateWandCache(); } catch (e) { console.error('[gallery] invalidateWandCache:', e); }
-  try { _schedulePersist(); } catch (e) { console.error('[gallery] schedulePersist:', e); }
+  try {
+    state.documentRevision = (state.documentRevision || 0) + 1;
+    state.persistDirty = true;
+    _setDraftStatus('Unsaved', 'dirty');
+    if (!_draftSavingDisabled()) {
+      _schedulePersist();
+    }
+  } catch (e) { console.error('[gallery] schedulePersist:', e); }
  try { _refreshHistoryPanelIfOpen(); } catch (e) { console.error('[gallery] refreshHistoryPanel:', e); }
 }

@@ -4367,20 +4386,47 @@ function _writeActiveEditorSession() {
 function _setDraftStatus(label, stateName = '') {
  const el = document.getElementById('ge-draft-status');
  if (!el) return;
-  const normalizedState = stateName === 'saved' ? 'saved' : 'dirty';
-  const normalizedLabel = normalizedState === 'saved' ? 'Saved' : 'Unsaved';
+  const validStates = ['saved', 'dirty', 'pending', 'saving', 'error', 'paused'];
+  let normalizedState = stateName;
+  if (!validStates.includes(normalizedState)) {
+    if (stateName === 'saved' || label === 'Saved') normalizedState = 'saved';
+    else if (stateName === 'error' || /fail|error/i.test(label || '')) normalizedState = 'error';
+    else if (stateName === 'paused' || /paused/i.test(label || '')) normalizedState = 'paused';
+    else if (stateName === 'saving' || label === 'Saving…' || label === 'Saving...') normalizedState = 'saving';
+    else if (stateName === 'pending' || /saving soon/i.test(label || '')) normalizedState = 'pending';
+    else normalizedState = 'dirty';
+  }
+  const defaultLabels = {
+    saved: 'Saved',
+    dirty: 'Unsaved',
+    pending: 'Saving soon…',
+    saving: 'Saving…',
+    error: 'Save failed',
+    paused: 'Save paused',
+  };
+  const normalizedLabel = label || defaultLabels[normalizedState] || 'Unsaved';
  el.textContent = normalizedLabel;
-  el.dataset.state = stateName;
+  el.dataset.state = normalizedState;
  const iconHost = el.closest('#ge-save-menu-btn');
+  const iconKind = (normalizedState === 'error' || normalizedState === 'paused')
+    ? 'error'
+    : (normalizedState === 'saved' ? 'saved' : 'dirty');
+  // The icons are <svg>; SVGElement has no `hidden` property, so set the attribute.
  iconHost?.querySelectorAll('.ge-save-state-icon').forEach(icon => {
-    icon.hidden = !icon.classList.contains(`ge-save-state-${normalizedState}`);
+    icon.toggleAttribute('hidden', !icon.classList.contains(`ge-save-state-${iconKind}`));
  });
  const saveButton = document.getElementById('ge-save-menu-btn');
  if (saveButton) {
-    saveButton.title = normalizedState === 'error' ? 'Draft autosave needs attention' : `Draft status: ${normalizedLabel}`;
-    saveButton.setAttribute('aria-label', normalizedLabel);
+    if (normalizedState === 'error' || normalizedState === 'paused') {
+      saveButton.title = state.persistErrorMessage || `Draft autosave failed: ${normalizedLabel}`;
+      saveButton.setAttribute('aria-label', `Draft autosave failed: ${normalizedLabel}`);
+    } else {
+      saveButton.title = `Draft status: ${normalizedLabel}`;
+      saveButton.setAttribute('aria-label', `Draft status: ${normalizedLabel}`);
+    }
  }
 }
+try { window.__geSetDraftStatus = _setDraftStatus; } catch (_) {}

 function _clearActiveEditorSession() {
  try { sessionStorage.removeItem(ACTIVE_EDITOR_SESSION_KEY); } catch (_) {}
@@ -4403,11 +4449,20 @@ function _draftSavingDisabled() {
 function _schedulePersist() {
  if (_draftSavingDisabled()) return;
  if (!state.editorOpen || !state.layers.length) return;
-  if (state.persistTimer) clearTimeout(state.persistTimer);
-  _setDraftStatus('Saving soon…', 'pending');
+  if (state.persistTimer) { clearTimeout(state.persistTimer); state.persistTimer = null; }
+  if (state.persistRetryTimer) { clearTimeout(state.persistRetryTimer); state.persistRetryTimer = null; }
+  if (state.pendingStatusTimer) { clearTimeout(state.pendingStatusTimer); state.pendingStatusTimer = null; }
  // The first save establishes the recovery anchor. Start it immediately
  // when no server draft exists; subsequent edits can stay debounced.
  const delay = state.draftId ? PERSIST_DEBOUNCE_MS : 0;
+  if (delay > 0) {
+    state.pendingStatusTimer = setTimeout(() => {
+      state.pendingStatusTimer = null;
+      if (state.editorOpen) _setDraftStatus('Saving soon…', 'pending');
+    }, Math.min(200, Math.floor(delay / 2)));
+  } else {
+    _setDraftStatus('Saving soon…', 'pending');
+  }
  state.persistTimer = setTimeout(() => { state.persistTimer = null; _persistDraft(); }, delay);
 }

@@ -4591,6 +4646,8 @@ async function _persistDraft() {
  // Coalesce concurrent saves — if one's already in-flight, mark dirty
  // and let the running call kick off another when it returns.
  if (state.persistInFlight) { state.persistDirty = true; _setDraftStatus('Saving…', 'saving'); return; }
+  const currentRevision = state.documentRevision || 0;
+  state.persistingRevision = currentRevision;
  const sessionToken = state.editorSessionToken;
  const draftIdAtStart = state.draftId || null;
  const draftNameAtStart = state.draftName || 'Untitled';
@@ -4618,13 +4675,10 @@ async function _persistDraft() {
    };
    const serializedBody = JSON.stringify(body);
    if (serializedBody.length > _EDITOR_PROJECT_MAX_BYTES) {
-      const message = 'Draft autosave paused: this layered document exceeds the 256 MB safety limit. Export or flatten a copy before closing.';
-      if (isCurrentSession()) {
-        if (state.persistErrorMessage !== message && uiModule) uiModule.showToast(message, 9000);
-        state.persistErrorMessage = message;
-        _setDraftStatus('Save paused', 'error');
-      }
-      return;
+      _setDraftStatus('Save paused', 'error');
+      const err = new Error('Draft autosave paused: this layered document exceeds the 256 MB safety limit. Export or flatten a copy before closing.');
+      err.status = 413;
+      throw err;
    }
    const responseError = async (res, method) => {
      let detail = '';
@@ -4667,29 +4721,51 @@ async function _persistDraft() {
  };
  const savePromise = doSave();
  state.persistInFlight = savePromise
-    .catch((e) => {
-      console.warn('[ge] draft save failed', e);
-      if (!isCurrentSession()) return;
-      const message = e?.status === 413
-        ? 'Draft autosave paused: the document exceeds the configured storage limit.'
-        : `Draft autosave failed: ${e?.message || 'server error'}`;
-      if (state.persistErrorMessage !== message && uiModule) uiModule.showToast(message, 7000);
-      state.persistErrorMessage = message;
-      _setDraftStatus('Save failed', 'error');
-    })
    .then((out) => {
-      if (isCurrentSession()) state.persistInFlight = null;
      if (!isCurrentSession()) return;
+      state.savedRevision = Math.max(state.savedRevision || 0, currentRevision);
+      state.persistRetryCount = 0;
      if (out && out.id) {
        state.draftId = out.id;
        _writeActiveEditorSession();
      }
      state.persistErrorMessage = null;
-      if (!state.persistErrorMessage) _setDraftStatus('Saved', 'saved');
+      if ((state.documentRevision || 0) > state.savedRevision || state.persistDirty) {
+        state.persistDirty = true;
+        _setDraftStatus('Unsaved', 'dirty');
+      } else {
+        _setDraftStatus('Saved', 'saved');
+      }
      if (state.persistDirty) {
        state.persistDirty = false;
        _schedulePersist();
      }
+    })
+    .catch((e) => {
+      console.warn('[ge] draft save failed', e);
+      if (!isCurrentSession()) return;
+      state.persistDirty = true;
+      const isPaused = e?.status === 413;
+      const message = isPaused
+        ? (e?.message || 'Draft autosave paused: the document exceeds the configured storage limit.')
+        : `Draft autosave failed: ${e?.message || 'server error'}`;
+      if (state.persistErrorMessage !== message && uiModule) uiModule.showToast(message, isPaused ? 9000 : 7000);
+      state.persistErrorMessage = message;
+      _setDraftStatus(isPaused ? 'Save paused' : 'Save failed', isPaused ? 'paused' : 'error');
+      if (!isPaused && state.editorOpen) {
+        state.persistRetryCount = Math.min((state.persistRetryCount || 0) + 1, 5);
+        const retryDelay = Math.min(1000 * Math.pow(2, state.persistRetryCount), 15000);
+        if (state.persistRetryTimer) clearTimeout(state.persistRetryTimer);
+        state.persistRetryTimer = setTimeout(() => {
+          state.persistRetryTimer = null;
+          if (state.editorOpen && (state.persistDirty || (state.documentRevision || 0) > (state.savedRevision || 0))) {
+            _persistDraft();
+          }
+        }, retryDelay);
+      }
+    })
+    .finally(() => {
+      if (isCurrentSession()) state.persistInFlight = null;
    });
  return state.persistInFlight;
 }
@@ -5381,7 +5457,24 @@ async function _confirmRasterizeLayer(layer) {
  return true;
 }

+let _lastCursorRect = null;
+let _lastCursorRectTime = 0;
+
+function _invalidateCoordsCaches() {
+  invalidateCanvasCoordsCache();
+  _lastCursorRect = null;
+  _lastCursorRectTime = 0;
+}
+
 function _beginDraw(e) {
+  if (state.mainCanvas) {
+    // Prime canvas rect and cursor rect once before stroke begins
+    // to avoid synchronous layout reads during pointermove.
+    _canvasCoords(e, state.mainCanvas);
+    const now = performance.now();
+    _lastCursorRect = state.mainCanvas.getBoundingClientRect();
+    _lastCursorRectTime = now;
+  }
  // Move-tool auto-select (Photoshop parity): when the Auto-Select option is
  // on — or Ctrl/Cmd is held for a one-off — pick the topmost visible,
  // position-unlocked layer under the pointer before the drag. If the picked
@@ -5428,13 +5521,11 @@ function _beginDraw(e) {
  }
  if (_pixelPaintTools.has(state.tool) && !_getActiveMaskLayer() && !state.quickMaskActive &&
      ['text', 'shape', 'placed'].includes(layer?.kind)) {
-    // Paint tools need pixels: rasterize the text/shape/placed layer silently
-    // (it stays undoable) so the very first stroke or pour works, instead of
-    // bouncing the user through a rasterize dialog that can end up behind the
-    // canvas where it cannot be clicked. If rasterizing is not possible, fall
-    // back to the prompt.
-    if (!_rasterizeLayerNow(layer)) { void _offerRasterizeForTool(); return; }
-    // fall through — `layer` is a pixel layer now, so the tool runs below.
+    // Paint tools need pixels: prompt for confirmation before destructive rasterization.
+    // If user cancels, editable text/shape/placed layer is preserved intact.
+    // If user accepts, layer is converted with an undo boundary so it can be reverted.
+    void _confirmRasterizeLayer(layer);
+    return;
  }
  // Transform-tool drag (handle grab or move-fallback) — handler in
  // editor/tools/transform-drag.js.
@@ -5480,6 +5571,13 @@ function _beginDraw(e) {
  _strokeTool.tryBegin(e);
 }

+let _cursorRaf = null;
+let _pendingCursorEvent = null;
+const _cursorOverlayTools = new Set([
+  'eraser', 'pixel', 'inpaint', 'lasso', 'brush', 'clone', 'heal',
+  'smudge', 'dodge', 'burn', 'liquify', 'quickselect', 'objectselect'
+]);
+
 function _continueDraw(e) {
  if (state.tool === 'pen') return _penTool.drag(e);
  if (state.tool === 'path') return _pathTool.drag(e);
@@ -5496,10 +5594,40 @@ function _continueDraw(e) {
  // when it's actually over the canvas, otherwise hide it.
  const overCanvas = state.mainCanvas && e.target === state.mainCanvas;
  if (state.tool === 'eyedropper' && overCanvas) _eyedropperTool.preview(e);
-  if (['eraser', 'pixel', 'inpaint', 'lasso', 'brush', 'clone', 'heal', 'smudge', 'dodge', 'burn', 'liquify', 'quickselect', 'objectselect'].includes(state.tool) && state.mainCanvas) {
-    if (overCanvas) _updateBrushCursor(e);
-    else if (state.cursorEl) state.cursorEl.style.display = 'none';
+  if (_cursorOverlayTools.has(state.tool) && state.mainCanvas) {
+    const syncCursor = () => {
+      if (!overCanvas) {
+        if (state.cursorEl) state.cursorEl.style.display = 'none';
+        return;
+      }
+      if (state.drawing) {
+        _pendingCursorEvent = e;
+        if (!_cursorRaf) {
+          _cursorRaf = requestAnimationFrame(() => {
+            _cursorRaf = null;
+            if (_pendingCursorEvent) {
+              _updateBrushCursor(_pendingCursorEvent);
+              _pendingCursorEvent = null;
+            }
+          });
+        }
+      } else {
+        _updateBrushCursor(e);
+      }
+    };
+    // Mid-stroke, move the cursor only after the stroke has sampled the canvas
+    // rect: a style write first forces a synchronous style + layout pass of the
+    // whole editor on every pointer move, which made long strokes lag.
+    if (state.drawing) {
+      try { return _continueDrawTools(e); } finally { syncCursor(); }
+    }
+    syncCursor();
  }
+  return _continueDrawTools(e);
+}
+
+function _continueDrawTools(e) {
+  if (state.drawing) return _strokeTool.tryContinue(e);
  // Transform-tool hover-cursor + handle drag — handler in
  // editor/tools/transform-drag.js. Returns true when the drag is
  // consuming the event (rotation / resize); the hover-cursor pass
@@ -5514,17 +5642,13 @@ function _continueDraw(e) {
  if (state.tool === 'quickselect') return _quickSelectTool.drag(e);
  if (state.tool === 'objectselect') return _objectSelectTool.drag(e);
  if (state.tool === 'patch') return _patchTool.drag(e);
-  if (!state.drawing) {
-    if (state.moving) return _continueMove(e);
-    if (state.cropping || state.cropMoving) return _continueCrop(e);
-    return;
-  }
-  // In-progress stroke (brush / eraser / inpaint / clone) — handler in
-  // editor/tools/stroke.js.
-  _strokeTool.tryContinue(e);
+  if (state.moving) return _continueMove(e);
+  if (state.cropping || state.cropMoving) return _continueCrop(e);
 }

 function _endDraw(e) {
+  if (_cursorRaf) { cancelAnimationFrame(_cursorRaf); _cursorRaf = null; }
+  if (_pendingCursorEvent) { _updateBrushCursor(_pendingCursorEvent); _pendingCursorEvent = null; }
  if (_cursorLoupeVisible) _setCursorLoupe(false);
  if (state.tool === 'pen') return _penTool.end();
  if (state.tool === 'path') return _pathTool.end(e);
@@ -5543,6 +5667,7 @@ function _endDraw(e) {
  // Stroke end (brush / eraser / inpaint / clone) — handler in
  // editor/tools/stroke.js.
  _strokeTool.tryEnd(e);
+  _invalidateCoordsCaches();
 }

 // Floating popup that appears after an inpaint stroke so the user can
@@ -5579,19 +5704,33 @@ const _endStroke = _strokePipeline.endStroke;

 // ── Brush cursor overlay ──

-
 function _updateBrushCursor(e) {
  if (!state.mainCanvas) return;
-  const rect = state.mainCanvas.getBoundingClientRect();
+  const now = performance.now();
+  let rect;
+  if (_lastCursorRect && (state.drawing || (now - _lastCursorRectTime < 32))) {
+    rect = _lastCursorRect;
+  } else {
+    rect = state.mainCanvas.getBoundingClientRect();
+    _lastCursorRect = rect;
+    _lastCursorRectTime = now;
+  }
  const clientX = e.touches ? e.touches[0].clientX : e.clientX;
  const clientY = e.touches ? e.touches[0].clientY : e.clientY;

  if (!Number.isFinite(clientX) || !Number.isFinite(clientY)) return;

  if (!state.cursorEl) {
+    let layer = document.getElementById('ge-cursor-layer');
+    if (!layer) {
+      layer = document.createElement('div');
+      layer.id = 'ge-cursor-layer';
+      layer.style.cssText = 'position:fixed;inset:0;pointer-events:none;contain:strict;z-index:2147483647;';
+      document.body.appendChild(layer);
+    }
    state.cursorEl = document.createElement('div');
    state.cursorEl.className = 'ge-brush-cursor';
-    document.body.appendChild(state.cursorEl);
+    layer.appendChild(state.cursorEl);
  }

  // Lasso uses the feather radius (or a sensible default) so the circle
@@ -5613,14 +5752,23 @@ function _updateBrushCursor(e) {
  // or responsive layout changes the canvas independently of nominal zoom.
  const diameterX = basePx * (rect.width / Math.max(1, state.mainCanvas.width));
  const diameterY = basePx * (rect.height / Math.max(1, state.mainCanvas.height));
-  state.cursorEl.style.width = diameterX + 'px';
-  state.cursorEl.style.height = diameterY + 'px';
+  if (state._lastCursorDiameterX !== diameterX || state._lastCursorDiameterY !== diameterY) {
+    state._lastCursorDiameterX = diameterX;
+    state._lastCursorDiameterY = diameterY;
+    state.cursorEl.style.width = diameterX + 'px';
+    state.cursorEl.style.height = diameterY + 'px';
+  }
  state.cursorEl.classList.toggle('ge-brush-cursor--pixel', pixelBrush);
-  state.cursorEl.style.left = (clientX - diameterX / 2) + 'px';
-  state.cursorEl.style.top = (clientY - diameterY / 2) + 'px';
-  state.cursorEl.style.display = 'block';
-  state.cursorEl.dataset.clientX = String(clientX);
-  state.cursorEl.dataset.clientY = String(clientY);
+  state.cursorEl.style.transform = `translate3d(${clientX - diameterX / 2}px, ${clientY - diameterY / 2}px, 0)`;
+  if (state.cursorEl.style.display !== 'block') {
+    state.cursorEl.style.display = 'block';
+  }
+  state.cursorClientX = clientX;
+  state.cursorClientY = clientY;
+  if (!state.drawing) {
+    state.cursorEl.dataset.clientX = String(clientX);
+    state.cursorEl.dataset.clientY = String(clientY);
+  }
  if (state.tool === 'inpaint') {
    // Visual cue for paint vs erase mode. Ctrl+Alt held mid-hover also
    // flips the cursor so the user sees the effective mode before they
@@ -5641,9 +5789,13 @@ function _updateBrushCursor(e) {
    state.cursorEl.style.background = 'rgba(0,0,0,0.15)';
    state.cursorEl.style.borderStyle = 'solid';
  } else {
-    state.cursorEl.style.borderColor = state.tool === 'eraser' ? 'rgba(255,255,255,0.6)' : state.color;
-    state.cursorEl.style.background = 'transparent';
-    state.cursorEl.style.borderStyle = 'solid';
+    const borderColor = state.tool === 'eraser' ? 'rgba(255,255,255,0.6)' : state.color;
+    if (state._lastCursorBorderColor !== borderColor) {
+      state._lastCursorBorderColor = borderColor;
+      state.cursorEl.style.borderColor = borderColor;
+      state.cursorEl.style.background = 'transparent';
+      state.cursorEl.style.borderStyle = 'solid';
+    }
  }
 }

@@ -9476,6 +9628,7 @@ function _getFitZoom() {
 }

 function _applyZoom({ resetPan = false } = {}) {
+  _invalidateCoordsCaches();
  if (!state.mainCanvas) return;
  state.mainCanvas.style.width = (state.imgWidth * state.zoom) + 'px';
  state.mainCanvas.style.height = (state.imgHeight * state.zoom) + 'px';
@@ -9485,6 +9638,9 @@ function _applyZoom({ resetPan = false } = {}) {
  const area = state.container && state.container.querySelector('.ge-canvas-area');
  if (resetPan && area && area._resetPan) area._resetPan();
  _syncSelectionOverlay();
+  // The transform overlay is sized and placed for the zoom it was drawn at;
+  // a refit (e.g. the phone Layers sheet collapsing) must redraw it.
+  if (state.transformActive) _drawTransformHandles();
  _precisionGuides?.redrawRulers();
 }

@@ -10337,7 +10493,10 @@ function _buildEditor(container) {
      if (e) _eyedropperTool.preview(e);
    },
    syncZoomControls: () => _syncZoomControls(),
-    onViewportChange: () => _precisionGuides?.redrawRulers(),
+    onViewportChange: () => {
+      _precisionGuides?.redrawRulers();
+      if (state.transformActive) _drawTransformHandles();
+    },
    onTwoFingerTap: () => undo(),
    onThreeFingerTap: () => redo(),
  });
@@ -10405,7 +10564,7 @@ function _buildEditor(container) {
      composite();
    },
  });
-  const { rightPanel, controls, layerPanel, dock } = buildRightPanel({
+  const { rightPanel, controls, mobilePanels, layerPanel, dock } = buildRightPanel({
    controlsHTML: _controlsHTML,
    layerPanelHTML: _layerPanelHTML,
    extraPanels: [
@@ -10434,6 +10593,7 @@ function _buildEditor(container) {
  });
  editorBody.appendChild(rightPanel);
  panelVisibility.apply();
+  panelVisibility.subscribe(_invalidateCoordsCaches);
  window.gePanelVisibility = panelVisibility;
  // Remember the workspace/window layout the user last chose and restore it on
  // open, so the editor comes back the way they left it. A fresh session has no
@@ -10502,16 +10662,72 @@ function _buildEditor(container) {
    _preflight?.maybeOpen();
  } catch (_) {}
  try { _initControlKit(container); } catch (_) {}
-  // Tool options live in the options bar (Photoshop), not the dock. On
-  // desktop the controls panel is moved under the contextual strip so the
-  // dock is reserved for Color / Adjustments / Layers; on mobile
-  // right-panel.js already re-parents it into a bottom sheet.
-  if (window.innerWidth > 700 && controls) {
-    optionsBar.appendChild(controls);
-    controls.classList.add('ge-controls--in-options');
-    // The "..." overflow affordance is shown/hidden per tool inside
-    // renderOptionsBar (it only reveals the secondary brush rows).
-  }
+  let _lastLayoutDesktop = null;
+  const _syncResponsiveLayout = (force = false) => {
+    _invalidateCoordsCaches();
+    const isDesktop = window.innerWidth > 700;
+    if (!force && isDesktop === _lastLayoutDesktop) return;
+    _lastLayoutDesktop = isDesktop;
+
+    const footer = container.querySelector('.ge-editor-footer');
+    const hdr = container.querySelector('.ge-layers-header');
+    const fh = container.querySelector('.ge-footer-history');
+    const fz = container.querySelector('.ge-footer-zoom');
+    const setupBtn = document.getElementById('ge-setup-btn');
+    const aiBtn = document.getElementById('ge-ai-settings-btn');
+    const optionsBar = container.querySelector('.ge-options-bar');
+
+    if (isDesktop) {
+      // Reparent controls into optionsBar
+      if (controls && optionsBar && controls.parentElement !== optionsBar) {
+        optionsBar.appendChild(controls);
+      }
+      controls?.classList.add('ge-controls--in-options');
+      controls?.classList.remove('dismissed');
+      optionsBar?.classList.add('ge-options-bar--has-controls');
+
+      // Right panel dock mode
+      rightPanel?.classList.add('ge-right-panel--dock');
+      if (dock?.dock) dock.dock.style.display = '';
+      if (mobilePanels) mobilePanels.style.display = 'none';
+      const panelsBtn = layerPanel?.querySelector('.ge-layers-panels-btn');
+      if (panelsBtn) panelsBtn.style.display = 'none';
+
+      // Clear mobile footer docking on desktop
+      if (fh && footer && fh.parentElement !== footer) {
+        footer.insertBefore(fh, footer.firstChild);
+      }
+      _placeMobileFooter();
+    } else {
+      // Reparent controls into editor container (mobile sheet)
+      if (controls && controls.parentElement !== container) {
+        container.appendChild(controls);
+      }
+      controls?.classList.remove('ge-controls--in-options');
+      optionsBar?.classList.remove('ge-options-bar--has-controls');
+
+      // Right panel mobile sheet mode
+      rightPanel?.classList.remove('ge-right-panel--dock');
+      if (dock?.dock) dock.dock.style.display = 'none';
+      if (mobilePanels) mobilePanels.style.display = '';
+      const panelsBtn = layerPanel?.querySelector('.ge-layers-panels-btn');
+      if (panelsBtn) panelsBtn.style.display = '';
+
+      if (fh && hdr && fh.parentElement !== hdr) {
+        hdr.appendChild(fh);
+      }
+      // Dock footer flush to sheet on mobile
+      _placeMobileFooter();
+    }
+  };
+
+  _syncResponsiveLayout(true);
+  try {
+    const _mobileMql = window.matchMedia('(max-width: 700px)');
+    _mobileMql.addEventListener('change', () => _syncResponsiveLayout(true));
+  } catch (_) {}
+  window.addEventListener('resize', () => _syncResponsiveLayout(false), { passive: true });
+
  // Crop options: aspect-ratio presets (Free / Original / 1:1 / 4:5 / 16:9).
  // Choosing one locks new crop drags to the ratio and refits an existing
  // crop rect (centred, clamped to the canvas). Wired after the controls
@@ -11931,7 +12147,13 @@ function _buildEditor(container) {
    const flat = _aiEditSourceCanvas();
    const image = flat.toDataURL('image/png').split(',')[1];
    const requestId = 'qe-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 8);
-    _startAiProgress(requestId);
+    const qeModel = _getSelectedQuickEditModel();
+    const endpointId = payload._endpoint || qeModel.endpoint || '';
+    if (endpointId) {
+      _startAiProgress(requestId, endpointId);
+    } else {
+      _startAiProgress(requestId);
+    }
    const body = JSON.stringify({ image, request_id: requestId, ...payload });
    // The image servers occasionally reject a request transiently (503 while a
    // model swaps, 502/504 gateways, dropped connections). Retry those a couple
@@ -13497,6 +13719,11 @@ export function openEditor(imageUrl, imageId, presetSize, displayName, draftId)
  state.draftName = displayName || (presetSize ? `New ${presetSize.w}×${presetSize.h}` : 'Untitled');
  state.editorSessionToken += 1;
  state.editorOpen = true;
+  state.documentRevision = 0;
+  state.persistingRevision = 0;
+  state.savedRevision = 0;
+  state.persistRetryCount = 0;
+  if (state.persistRetryTimer) { clearTimeout(state.persistRetryTimer); state.persistRetryTimer = null; }
  _writeActiveEditorSession();
  state.layers = [];
  state.selectedLayerIds = [];
@@ -13547,6 +13774,8 @@ export function openEditor(imageUrl, imageId, presetSize, displayName, draftId)
  _stopSelectionAnimation();
  window.__galleryEditLive = true;
  if (state.persistTimer) { clearTimeout(state.persistTimer); state.persistTimer = null; }
+  if (state.persistRetryTimer) { clearTimeout(state.persistRetryTimer); state.persistRetryTimer = null; }
+  if (state.pendingStatusTimer) { clearTimeout(state.pendingStatusTimer); state.pendingStatusTimer = null; }
  state.persistDirty = false;
  state.persistErrorMessage = null;
  state.persistInFlight = null;
@@ -13793,6 +14022,8 @@ export function closeEditor(options = {}) {
  // the editor mid-stroke doesn't lose work. The call is fire-and-forget;
  // the server commit lands shortly after the modal hides.
  if (state.persistTimer) { clearTimeout(state.persistTimer); state.persistTimer = null; }
+  if (state.persistRetryTimer) { clearTimeout(state.persistRetryTimer); state.persistRetryTimer = null; }
+  if (state.pendingStatusTimer) { clearTimeout(state.pendingStatusTimer); state.pendingStatusTimer = null; }
  if (state.layers.length) {
    try { _persistDraft(); } catch {}
  }
@@ -13831,6 +14062,7 @@ export function closeEditor(options = {}) {
    try { document.removeEventListener('click', h); } catch {}
  }
  if (state.cursorEl) { state.cursorEl.remove(); state.cursorEl = null; }
+  try { document.getElementById('ge-cursor-layer')?.remove(); } catch {}
  // Tear down all floating popups + the dock so closing the editor
  // doesn't leave stale chips/panels behind on top of the gallery.
  try { _closeFxMenu(); } catch {}
@@ -173,6 +173,15 @@ export function initSidebarLayout(Storage, opts) {
    syncRailSide();
  }

+  // Move the closed drawer to the other edge without transitioning its
+  // transform across the screen, so it then slides in from the edge it opens on.
+  function _setSidebarSideInstantly(sidebar, right) {
+    sidebar.style.setProperty('transition', 'none', 'important');
+    sidebar.classList.toggle('right-side', right);
+    void sidebar.offsetWidth;
+    sidebar.style.removeProperty('transition');
+  }
+
  // Deliberate "open the sidebar" used by the mobile swipe gesture (wired at
  // module scope). It MUST set _userToggledSidebar so the auto-collapse
  // MutationObserver doesn't immediately re-hide it (the swipe was opening it,
@@ -192,7 +201,7 @@ export function initSidebarLayout(Storage, opts) {
    if (side === 'left' || side === 'right') {
      const wantRight = side === 'right';
      if (sidebar.classList.contains('right-side') !== wantRight) {
-        sidebar.classList.toggle('right-side', wantRight);
+        _setSidebarSideInstantly(sidebar, wantRight);
        // Swipe-selected sides are temporary on compact/mobile layouts. Do
        // not overwrite the user's desktop sidebar preference.
        if (window.innerWidth >= 768) {
@@ -230,7 +239,7 @@ export function initSidebarLayout(Storage, opts) {
          // Mobile: the hamburger always opens the sidebar from the RIGHT.
          // (Not persisted — keeps the desktop side preference untouched.)
          if (!sidebar.classList.contains('right-side')) {
-            sidebar.classList.add('right-side');
+            _setSidebarSideInstantly(sidebar, true);
            if (documentModule && documentModule.swapSide) { try { documentModule.swapSide(); } catch (_) {} }
          }
          // Opening sidebar — blur keyboard first, then open after layout settles
@@ -315,14 +324,20 @@ export function initSidebarLayout(Storage, opts) {
      _wasAutoCollapsed = true;
      syncRailSide();
    } else if (window.innerWidth >= AUTO_COLLAPSE_WIDTH && isHidden && _wasAutoCollapsed) {
-      // Only restore if chat won't be too narrow
+      // Only restore if chat won't be too narrow. Suppress the width
+      // transition and sync the mode classes (ody-sidebar-mini also forces
+      // width 0) so the reflow measures the sidebar at its full width.
+      sidebar.style.transition = 'none';
      sidebar.classList.remove('hidden');
+      syncRailSide();
      void document.body.offsetWidth; // reflow
      if (chatContainer && chatContainer.offsetWidth < MIN_CHAT_WIDTH) {
        sidebar.classList.add('hidden');
      } else {
        _wasAutoCollapsed = false;
      }
+      void document.body.offsetWidth;
+      sidebar.style.transition = '';
      syncRailSide();
    }
  }
@@ -36,6 +36,7 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
  let degraded = !ENABLED; // true once we fall back to full re-render
  let tailRaf = null; // pending requestAnimationFrame id for the live-tail re-render
  let pendingTail = ''; // most recent tail text awaiting a rAF re-render
+  let tailGeneration = 0;

  function start() {
    contentEl.textContent = '';
@@ -88,13 +89,21 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
  function scheduleTailRender(tailText) {
    pendingTail = tailText;
    if (tailRaf !== null) return;
+    const generation = tailGeneration;
    tailRaf = requestAnimationFrame(() => {
+      if (generation !== tailGeneration) return;
      tailRaf = null;
      // The container may have been rewritten out from under us (chat.js writes
      // contentEl.innerHTML for thinking indicators and tool blocks). Skip and
      // let the next update() self-heal rather than appending stale tail nodes.
      if (tailMarker && tailMarker.parentNode === contentEl) {
-        renderTail(pendingTail);
+        try {
+          renderTail(pendingTail);
+        } catch (err) {
+          degraded = true;
+          console.error('streamingRenderer: falling back to full render in rAF', err);
+          safeFullRender(lastText);
+        }
      }
    });
  }
@@ -157,6 +166,41 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
    highlight(contentEl);
  }

+  function safeFullRender(fullText) {
+    try {
+      fullRender(fullText);
+    } catch (err) {
+      // The source survives even when the parser/highlighter is unavailable.
+      // textContent also ensures that untrusted message text stays inert.
+      console.error('streamingRenderer: preserving source as plain text', err);
+      contentEl.textContent = fullText;
+    }
+  }
+
+  function cancelPendingTail() {
+    tailGeneration++;
+    if (tailRaf !== null) {
+      cancelAnimationFrame(tailRaf);
+      tailRaf = null;
+    }
+    pendingTail = '';
+  }
+
+  function resetDom() {
+    cancelPendingTail();
+    started = false;
+    tailMarker = null;
+    committedLen = 0;
+    tailShownLen = 0;
+    appendMode = null;
+  }
+
+  function reset() {
+    resetDom();
+    lastText = '';
+    degraded = !ENABLED;
+  }
+
  // Render the latest full source text.
  //
  // PRECONDITION: callers must pass append-only text — each call's `fullText` must
@@ -168,7 +212,8 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
  function update(fullText) {
    lastText = fullText;
    if (degraded) {
-      fullRender(fullText);
+      cancelPendingTail();
+      safeFullRender(fullText);
      return;
    }
    try {
@@ -178,24 +223,34 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
      // container. Rebuild from scratch so we never append onto foreign content or
      // touch a detached marker.
      if (started && (!tailMarker || tailMarker.parentNode !== contentEl)) {
-        started = false;
-        committedLen = 0;
-        tailShownLen = 0;
-        appendMode = null;
+        resetDom();
      }
      if (!started) start();
      const next = splitFinalized(fullText, render, committedLen);
      if (next > committedLen) {
+        cancelPendingTail();
+        clearTail();
        freeze(fullText.slice(committedLen, next));
        committedLen = next;
        appendMode = null; // whatever was streaming is now frozen
        tailShownLen = 0;
      }
-      renderTail(fullText.slice(committedLen));
+      const tail = fullText.slice(committedLen);
+      if (!tail) {
+        cancelPendingTail();
+        clearTail();
+        tailShownLen = 0;
+      } else if (tailShownLen === 0) {
+        cancelPendingTail();
+        renderTail(tail);
+      } else {
+        scheduleTailRender(tail);
+      }
    } catch (err) {
+      cancelPendingTail();
      degraded = true;
      console.error('streamingRenderer: falling back to full render', err);
-      fullRender(fullText);
+      safeFullRender(fullText);
    }
  }

@@ -205,9 +260,12 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
  // reasons and so doesn't call this, but it completes the renderer's lifecycle and
  // is exercised by the tests.
  function finalize() {
-    if (degraded) return;
+    cancelPendingTail();
+    if (degraded) {
+      safeFullRender(lastText);
+      return;
+    }
    try {
-      if (tailRaf !== null) { cancelAnimationFrame(tailRaf); tailRaf = null; }
      if (!started) start();
      clearTail();
      appendMode = null;
@@ -219,9 +277,9 @@ export function createStreamRenderer(contentEl, { render, hljs } = {}) {
    } catch (err) {
      degraded = true;
      console.error('streamingRenderer: falling back to full render', err);
-      fullRender(lastText);
+      safeFullRender(lastText);
    }
  }

-  return { update, finalize };
+  return { update, finalize, reset };
 }
@@ -1,4 +1,4 @@
-export const TOOL_WINDOW_SELECTOR = 'body > .modal, body > .research-overlay, body > .notes-pane-backdrop';
+export const TOOL_WINDOW_SELECTOR = 'body > .modal:not(#styled-confirm-overlay), body > .research-overlay, body > .notes-pane-backdrop';

 export function topToolWindowZ(options = {}) {
  const {
@@ -8,7 +8,7 @@ import themeModule from './theme.js?v=20260911organsrain1';
 import * as Modals from './modalManager.js';
 import spinnerModule from './spinner.js';
 import { registerMenuDismiss, dismissTopEscapeLayer, dismissOrRemove } from './escMenuStack.js';
-import { nextToolWindowZ, topToolWindowZ } from './toolWindowZOrder.js';
+import { nextToolWindowZ, topToolWindowZ, topPortalZ } from './toolWindowZOrder.js';

 let toastEl = null;
 let autoScrollEnabled = true;
@@ -793,10 +793,12 @@ export function styledConfirm(message, { confirmText = 'Confirm', cancelText = '
    const _prevFocus = document.activeElement;
    overlay.classList.remove('hidden');
    overlay.style.display = '';
+    overlay.style.zIndex = String(topPortalZ() + 1000);

    function cleanup(result) {
      overlay.classList.add('hidden');
      overlay.style.display = 'none';
+      overlay.style.zIndex = '';
      okBtn.removeEventListener('click', onOk);
      cancelBtn.removeEventListener('click', onCancel);
      altBtn.removeEventListener('click', onAlt);
@@ -7,7 +7,7 @@
 //   - Other static assets (images/fonts/libs): cache-first with bg refresh.
 //   - API / non-GET: never cached.
 // Bump CACHE_NAME whenever the precache list or SW logic changes.
-const CACHE_NAME = 'odysseus-v1113-pr40-editor-precache';
+const CACHE_NAME = 'odysseus-v1114-pr40-editor-precache';

 // KaTeX resolves these from its own stylesheet, so caching the CSS without them
 // gives offline math fallback glyphs instead of proper typesetting.
@@ -74,6 +74,8 @@ const PRECACHE = [
  '/static/js/fileHandler.js?v=20260909mobileattachmentedit1',
  '/static/js/voiceRecorder.js',
  '/static/js/actionMenuOrder.js',
+  '/static/js/platform.js',
+  '/static/js/modelSort.js',
  '/static/js/models.js',
  '/static/js/rag.js',
  '/static/js/presets.js?v=20260908personaname1',
@@ -364,11 +366,29 @@ self.addEventListener('activate', (e) => {
  );
 });

+// Offline fallback for /static/ JS/CSS. /static is a public, unauthenticated
+// mount whose bytes do not depend on the request, but CORS adds `Vary: Origin`
+// and module imports send an Origin header that install-time fetches omit, so a
+// strict match hides the precached copy. Ignore Vary only for entries in this
+// worker's own cache whose sole Vary header is Origin.
+async function cachedStaticFile(request) {
+  const cache = await caches.open(CACHE_NAME);
+  const exact = await cache.match(request);
+  if (exact) return exact;
+  const variesOnlyOnOrigin = response => (response.headers.get('Vary') || '')
+    .split(',').map(name => name.trim().toLowerCase()).filter(Boolean)
+    .every(name => name === 'origin');
+  const candidates = await cache.matchAll(request, { ignoreVary: true });
+  return candidates.find(variesOnlyOnOrigin) || Response.error();
+}
+
 self.addEventListener('fetch', (e) => {
  const url = new URL(e.request.url);

  // Never touch API calls or non-GET.
  if (url.pathname.startsWith('/api/') || e.request.method !== 'GET') return;
+  // Only this origin's own files are cached; anything else goes to the network.
+  if (url.origin !== self.location.origin) return;

  // HTML navigation: network-first app shell — but ONLY for the SPA root.
  // Other navigations (e.g. a deep-linked /static/*.html page) must go to the
@@ -394,10 +414,10 @@ self.addEventListener('fetch', (e) => {
      fetch(e.request).then(res => {
        if (res && res.ok) {
          const copy = res.clone();
-          caches.open(CACHE_NAME).then(cache => cache.put(e.request, copy));
+          caches.open(CACHE_NAME).then(cache => cache.put(e.request, copy)).catch(() => {});
        }
        return res;
-      }).catch(() => caches.match(e.request))
+      }).catch(() => cachedStaticFile(e.request))
    );
    return;
  }
@@ -0,0 +1,402 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { chromium } from 'playwright';
+
+test('Chat Photo Editor Action Integrity and Turn Scoping', async () => {
+  const browser = await chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const serverResponses = new Map();
+    const recordedUploadRequests = [];
+
+    await page.route('http://photo-test.local/**', async (route) => {
+      const url = new URL(route.request().url());
+      const path = url.pathname;
+
+      if (path === '/') {
+        return route.fulfill({
+          contentType: 'text/html',
+          body: `<!DOCTYPE html>
+          <html>
+            <body>
+              <div id="toast"></div>
+              <div id="chat-history"></div>
+            </body>
+          </html>`,
+        });
+      }
+
+      if (path.startsWith('/api/upload/')) {
+        const id = path.replace('/api/upload/', '');
+        const method = route.request().method();
+        recordedUploadRequests.push({ id, method });
+        const status = serverResponses.get(id) || 200;
+        if (status === 200) {
+          return route.fulfill({
+            status: 200,
+            headers: {
+              'Content-Type': 'image/png',
+              'Content-Length': '16',
+              'X-Content-Type-Options': 'nosniff',
+            },
+            body: method === 'HEAD' ? Buffer.alloc(0) : Buffer.from('fake-image-bytes'),
+          });
+        }
+        return route.fulfill({
+          status,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ detail: 'Upload error or forbidden' }),
+        });
+      }
+
+      try {
+        const source = await readFile(new URL('..' + path, import.meta.url), 'utf8');
+        return route.fulfill({ contentType: 'text/javascript', body: source });
+      } catch (err) {
+        return route.abort();
+      }
+    });
+
+    await page.goto('http://photo-test.local/');
+
+    const results = await page.evaluate(async () => {
+      const box = document.getElementById('chat-history');
+
+      // Import chat.js to test hooks
+      await import('/static/js/chat.js');
+      const hooks = window.__chatPhotoEditorTestHooks;
+      if (!hooks) throw new Error('Test hooks not exposed on window.__chatPhotoEditorTestHooks');
+
+      const { _isAuthorizedImageUrl, _findOriginatingUserMessage, _attachedImageForTurn, renderPhotoEditorApplyButton } = hooks;
+
+      // --- Scenario 1: Authorization checks ---
+      const authValidUpload = _isAuthorizedImageUrl('/api/upload/img_123');
+      const authValidGallery = _isAuthorizedImageUrl('/api/gallery/img_123');
+      const authBlob = _isAuthorizedImageUrl('blob:http://photo-test.local/550e8400-e29b-41d4-a716-446655440000');
+      const authCrossOriginBlob = _isAuthorizedImageUrl('blob:https://evil.com/550e8400-e29b-41d4-a716-446655440000');
+      const authMalformedBlob = _isAuthorizedImageUrl('blob:javascript:alert(1)');
+      const pixel = document.createElement('canvas'); pixel.width = pixel.height = 1;
+      const authDataPng = _isAuthorizedImageUrl(pixel.toDataURL('image/png'));
+      const authDataJpeg = _isAuthorizedImageUrl(pixel.toDataURL('image/jpeg'));
+      const authDataWebp = _isAuthorizedImageUrl(pixel.toDataURL('image/webp'));
+      const authDataGif = _isAuthorizedImageUrl('data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
+      const authDataSvg = _isAuthorizedImageUrl('data:image/svg+xml;base64,PHN2Zz4=');
+      const authDataHtml = _isAuthorizedImageUrl('data:text/html;base64,PGgxPlRlc3Q=');
+      const authDataMalformed = _isAuthorizedImageUrl('data:image/png;base64,invalid!@#$');
+      const authDataOversized = _isAuthorizedImageUrl('data:image/png;base64,' + 'A'.repeat(11 * 1024 * 1024));
+      const authMaliciousDomain = _isAuthorizedImageUrl('https://evil.com/api/upload/img_123');
+      const authSchemeRelative = _isAuthorizedImageUrl('//evil.com/api/upload/img_123');
+      const authJavascript = _isAuthorizedImageUrl('javascript:alert(1)');
+      const authDirectoryTraversal = _isAuthorizedImageUrl('/api/upload/../../../etc/passwd');
+      const authEncodedTraversal = _isAuthorizedImageUrl('/api/upload/%2e%2e%2f');
+
+      // --- Scenario 2: Multi-turn isolation ---
+      // Build Turn 1: User attaches img_turn1
+      const user1 = document.createElement('div');
+      user1.className = 'msg msg-user';
+      user1.innerHTML = '<div class="body">Turn 1 text</div><div class="attach-image-preview" data-file-id="img_turn1"><img src="/api/upload/img_turn1" /></div>';
+      box.appendChild(user1);
+
+      const ai1 = document.createElement('div');
+      ai1.className = 'msg msg-ai round-holder';
+      ai1.innerHTML = '<div class="body">Turn 1 AI reply</div>';
+      box.appendChild(ai1);
+
+      // Build Turn 2: User attaches NO photo (just text)
+      const user2 = document.createElement('div');
+      user2.className = 'msg msg-user';
+      user2.innerHTML = '<div class="body">Turn 2 text without photo</div>';
+      box.appendChild(user2);
+
+      const ai2 = document.createElement('div');
+      ai2.className = 'msg msg-ai round-holder';
+      ai2.innerHTML = '<div class="body">Turn 2 AI reply</div>';
+      box.appendChild(ai2);
+
+      // Build Turn 3: User attaches img_turn3
+      const user3 = document.createElement('div');
+      user3.className = 'msg msg-user';
+      user3.innerHTML = '<div class="body">Turn 3 text</div><div class="attach-card" data-file-id="img_turn3"><img src="/api/upload/img_turn3" /></div>';
+      box.appendChild(user3);
+
+      const ai3 = document.createElement('div');
+      ai3.className = 'msg msg-ai round-holder';
+      ai3.innerHTML = '<div class="body">Turn 3 AI reply</div>';
+      box.appendChild(ai3);
+
+      // Resolve images for each turn
+      const turn1Resolved = _attachedImageForTurn(ai1, { kind: 'open_and_apply', prompt: 'edit turn 1' });
+      const turn2Resolved = _attachedImageForTurn(ai2, { kind: 'open_and_apply', prompt: 'edit turn 2' });
+      const turn3Resolved = _attachedImageForTurn(ai3, { kind: 'open_and_apply', prompt: 'edit turn 3' });
+
+      // Action with explicit imageId should honor explicit id
+      const explicitActionResolved = _attachedImageForTurn(ai2, { kind: 'open_and_apply', imageId: 'explicit_999' });
+      const filenameResolved = _attachedImageForTurn(ai2, { kind: 'open_and_apply', imageId: 'explicit_999.png' });
+      const invalidExplicitResolved = _attachedImageForTurn(ai1, { kind: 'open_and_apply', imageUrl: 'data:image/png;base64,=' });
+
+      // Action on container with no user message above
+      const detachedAi = document.createElement('div');
+      detachedAi.className = 'msg msg-ai';
+      const detachedResolved = _attachedImageForTurn(detachedAi, { kind: 'open_and_apply' });
+
+      return {
+        authValidUpload,
+        authValidGallery,
+        authBlob,
+        authCrossOriginBlob,
+        authMalformedBlob,
+        authDataPng,
+        authDataJpeg,
+        authDataWebp,
+        authDataGif,
+        authDataSvg,
+        authDataHtml,
+        authDataMalformed,
+        authDataOversized,
+        authMaliciousDomain,
+        authSchemeRelative,
+        authJavascript,
+        authDirectoryTraversal,
+        authEncodedTraversal,
+        turn1Resolved,
+        turn2Resolved,
+        turn3Resolved,
+        explicitActionResolved,
+        filenameResolved,
+        invalidExplicitResolved,
+        detachedResolved,
+      };
+    });
+
+    // Verify Scenario 1: Authorization
+    assert.equal(results.authValidUpload, true, 'Valid same-origin upload is authorized');
+    assert.equal(results.authValidGallery, true, 'Valid same-origin gallery is authorized');
+    assert.equal(results.authBlob, false, 'Same-origin alone does not authorize a blob URL');
+    assert.equal(results.authCrossOriginBlob, false, 'Cross-origin blob URL is rejected');
+    assert.equal(results.authMalformedBlob, false, 'Malformed blob URL is rejected');
+    assert.equal(results.authDataPng, true, 'PNG data URL is authorized');
+    assert.equal(results.authDataJpeg, true, 'JPEG data URL is authorized');
+    assert.equal(results.authDataWebp, true, 'WebP data URL is authorized');
+    assert.equal(results.authDataGif, true, 'GIF data URL is authorized');
+    assert.equal(results.authDataSvg, false, 'SVG data URL is rejected');
+    assert.equal(results.authDataHtml, false, 'HTML data URL is rejected');
+    assert.equal(results.authDataMalformed, false, 'Malformed data URL is rejected');
+    assert.equal(results.authDataOversized, false, 'Oversized data URL > 10MB is rejected');
+    assert.equal(results.authMaliciousDomain, false, 'External malicious domain rejected');
+    assert.equal(results.authSchemeRelative, false, 'Scheme-relative URL rejected');
+    assert.equal(results.authJavascript, false, 'Javascript scheme rejected');
+    assert.equal(results.authDirectoryTraversal, false, 'Directory traversal in path rejected');
+    assert.equal(results.authEncodedTraversal, false, 'Encoded directory traversal in path rejected');
+
+    // Verify Scenario 2: Multi-turn isolation
+    assert.equal(results.turn1Resolved, '/api/upload/img_turn1', 'Turn 1 AI correctly resolves Turn 1 user image');
+    assert.equal(results.turn2Resolved, null, 'Turn 2 AI resolves NULL because Turn 2 had no attached image');
+    assert.equal(results.turn3Resolved, '/api/upload/img_turn3', 'Turn 3 AI correctly resolves Turn 3 user image');
+    assert.equal(results.explicitActionResolved, '/api/upload/explicit_999', 'Explicit action imageId honored');
+    assert.equal(results.filenameResolved, '/api/upload/explicit_999.png', 'Canonical filenames keep their extensions');
+    assert.equal(results.invalidExplicitResolved, null, 'Invalid explicit data never falls back to a different image');
+    assert.equal(results.detachedResolved, null, 'Detached AI container without user message resolves to null');
+
+    // --- Scenario 3: Button click lifecycle (deleted upload, rapid click, open apply) ---
+    const clickResults = await page.evaluate(async () => {
+      const hooks = window.__chatPhotoEditorTestHooks;
+      const { renderPhotoEditorApplyButton } = hooks;
+
+      let editorCalls = [];
+      window.gePhotoEditorApply = async (opts) => {
+        editorCalls.push(opts);
+        await new Promise((r) => setTimeout(r, 50));
+      };
+
+      let errorsShown = [];
+      const fakeUi = {
+        showError(msg) { errorsShown.push(msg); },
+        showToast(msg) {},
+      };
+
+      // Case A: Missing attachment on Turn 2
+      const ai2 = document.querySelectorAll('.msg-ai')[1];
+      renderPhotoEditorApplyButton(ai2, { kind: 'open_and_apply', prompt: 'test turn 2' });
+      const btn2 = ai2.querySelector('.chat-open-in-editor-btn');
+      btn2.click();
+      await new Promise((r) => setTimeout(r, 20));
+      const btn2DisabledAfterMissing = btn2.disabled;
+
+      // Case B: Deleted upload (server returns 404)
+      const userDel = document.createElement('div');
+      userDel.className = 'msg msg-user';
+      userDel.innerHTML = '<div class="attach-image-preview" data-file-id="img_deleted"><img src="/api/upload/img_deleted" /></div>';
+      document.getElementById('chat-history').appendChild(userDel);
+
+      const aiDel = document.createElement('div');
+      aiDel.className = 'msg msg-ai round-holder';
+      document.getElementById('chat-history').appendChild(aiDel);
+
+      renderPhotoEditorApplyButton(aiDel, { kind: 'open_and_apply', prompt: 'test deleted' });
+      const btnDel = aiDel.querySelector('.chat-open-in-editor-btn');
+
+      return {
+        hasBtn2: !!btn2,
+        btn2DisabledAfterMissing,
+      };
+    });
+
+    assert.equal(clickResults.hasBtn2, true);
+    assert.equal(clickResults.btn2DisabledAfterMissing, false, 'Button re-enabled after missing attachment');
+
+    // Set server status 404 for img_deleted
+    serverResponses.set('img_deleted', 404);
+
+    const deletedResults = await page.evaluate(async () => {
+      const aiDel = document.querySelectorAll('.msg-ai')[3];
+      const btnDel = aiDel.querySelector('.chat-open-in-editor-btn');
+      btnDel.click();
+      await new Promise((r) => setTimeout(r, 50));
+      return {
+        disabled: btnDel.disabled,
+      };
+    });
+
+    assert.equal(deletedResults.disabled, false, 'Button re-enabled when server returns 404');
+
+    // Case C: Valid attachment on Turn 1 click launches editor
+    const validResults = await page.evaluate(async () => {
+      let editorCalls = [];
+      window.gePhotoEditorApply = async (opts) => {
+        editorCalls.push(opts);
+      };
+
+      const ai1 = document.querySelectorAll('.msg-ai')[0];
+      const { renderPhotoEditorApplyButton } = window.__chatPhotoEditorTestHooks;
+      renderPhotoEditorApplyButton(ai1, { kind: 'open_and_apply', prompt: 'make b&w' });
+      const btn1 = ai1.querySelector('.chat-open-in-editor-btn');
+
+      // Rapid clicks: trigger multiple synchronous clicks
+      btn1.click();
+      btn1.click();
+      btn1.click();
+
+      await new Promise((r) => setTimeout(r, 50));
+
+      return {
+        editorCallsCount: editorCalls.length,
+        editorCall: editorCalls[0],
+      };
+    });
+
+    assert.equal(validResults.editorCallsCount, 1, 'Rapid clicks deduplicated, editor called exactly once');
+    assert.equal(validResults.editorCall.imageUrl, '/api/upload/img_turn1', 'Editor opened with Turn 1 image');
+    assert.equal(validResults.editorCall.prompt, 'make b&w');
+
+    // Case D: Verify HEAD probe was used for verification
+    const headProbeObserved = recordedUploadRequests.some((r) => r.id === 'img_turn1' && r.method === 'HEAD');
+    assert.equal(headProbeObserved, true, 'Chat-to-editor preflight executed an authorized HEAD probe');
+
+    // Case E: Unauthorized upload returns 403, surfaces error and re-enables button
+    serverResponses.set('img_forbidden', 403);
+    const forbiddenResults = await page.evaluate(async () => {
+      const userForbidden = document.createElement('div');
+      userForbidden.className = 'msg msg-user';
+      userForbidden.innerHTML = '<div class="attach-image-preview" data-file-id="img_forbidden"><img src="/api/upload/img_forbidden" /></div>';
+      document.getElementById('chat-history').appendChild(userForbidden);
+
+      const aiForbidden = document.createElement('div');
+      aiForbidden.className = 'msg msg-ai round-holder';
+      document.getElementById('chat-history').appendChild(aiForbidden);
+
+      const { renderPhotoEditorApplyButton } = window.__chatPhotoEditorTestHooks;
+      renderPhotoEditorApplyButton(aiForbidden, { kind: 'open_and_apply', prompt: 'forbidden test' });
+      const btnForb = aiForbidden.querySelector('.chat-open-in-editor-btn');
+      btnForb.click();
+      await new Promise((r) => setTimeout(r, 50));
+
+      return {
+        disabled: btnForb.disabled,
+      };
+    });
+
+    assert.equal(forbiddenResults.disabled, false, 'Button re-enabled when server returns 403');
+  } finally {
+    await browser.close();
+  }
+});
+
+test('editor actions validate raster bytes, dimensions, decode and reject all unverified blobs before launch', async () => {
+  const browser = await chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const apiRequests = [];
+    await page.route('http://raster.local/**', async route => {
+      const path = new URL(route.request().url()).pathname;
+      if (path === '/') return route.fulfill({ contentType: 'text/html', body: '<div id="chat-history"></div>' });
+      if (path === '/api/gallery/owned') { apiRequests.push(path); return route.fulfill({ contentType: 'application/json', body: JSON.stringify({ id: 'owned', url: '/api/generated-image/owned.png' }) }); }
+      if (path === '/api/gallery/foreign') { apiRequests.push(path); return route.fulfill({ status: 404, body: '' }); }
+      if (path.startsWith('/api/upload/')) { apiRequests.push(path); return route.fulfill({ status: 200, headers: { 'Content-Type': 'image/png' }, body: '' }); }
+      if (path.startsWith('/api/')) return route.fulfill({ contentType: 'application/json', body: '{}' });
+      try { return route.fulfill({ contentType: 'text/javascript', body: await readFile(new URL('..' + path, import.meta.url), 'utf8') }); }
+      catch { return route.fulfill({ status: 404, body: '' }); }
+    });
+    await page.goto('http://raster.local/');
+    const results = await page.evaluate(async () => {
+      await import('/static/js/chat.js');
+      const { renderPhotoEditorApplyButton } = window.__chatPhotoEditorTestHooks;
+      const canvas = document.createElement('canvas'); canvas.width = canvas.height = 2;
+      canvas.getContext('2d').fillRect(0, 0, 2, 2);
+      const png = canvas.toDataURL('image/png');
+      const bytes = Uint8Array.from(atob(png.split(',')[1]), ch => ch.charCodeAt(0));
+      const encode = bytes => { let text = ''; for (const byte of bytes) text += String.fromCharCode(byte); return 'data:image/png;base64,' + btoa(text); };
+      const headerDimensions = (w, h) => { const b = bytes.slice(); const v = new DataView(b.buffer); v.setUint32(16, w); v.setUint32(20, h); return encode(b); };
+      const invalidDecode = bytes.slice(0, 33); // valid signature/dimensions but no pixel data
+      const ownBlob = URL.createObjectURL(new Blob([bytes], { type: 'image/png' }));
+      const revoked = URL.createObjectURL(new Blob([bytes], { type: 'image/png' })); URL.revokeObjectURL(revoked);
+      // This action intentionally has no blob registration API. Even application-created
+      // object URLs must use their authorized server attachment or raster data source.
+      const cases = [
+        ['upload', '/api/upload/owned', true], ['gallery', '/api/gallery/owned', true],
+        ['png', png, true], ['jpeg', canvas.toDataURL('image/jpeg'), true], ['webp', canvas.toDataURL('image/webp'), true],
+        ['gif', 'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7', true],
+        ['padding-one', 'data:image/png;base64,=', false], ['padding-length', 'data:image/png;base64,A', false],
+        ['padding-middle', 'data:image/png;base64,AA=AA', false], ['padding-excess', 'data:image/png;base64,AAAA====', false], ['foreign-gallery', '/api/gallery/foreign', false],
+        ['pad-bits', 'data:image/png;base64,AB==', false], ['bytes', 'data:image/png;base64,AAAA', false],
+        ['mismatch', png.replace('image/png', 'image/jpeg'), false], ['truncated-image', encode(invalidDecode), false],
+        ['svg', 'data:image/svg+xml;base64,PHN2Zy8+', false], ['html', 'data:text/html;base64,PGgxLz4=', false],
+        ['svg-disguised', 'data:image/png;base64,PHN2Zy8+', false],
+        ['foreign-blob', 'blob:https://foreign.invalid/deadbeef', false], ['arbitrary-blob', 'blob:http://raster.local/deadbeef', false],
+        ['application-created-blob', ownBlob, false], ['revoked-blob', revoked, false],
+        ['oversized-url', 'data:image/png;base64,' + 'A'.repeat(10 * 1024 * 1024), false],
+        ['oversized-decoded-bytes', 'data:image/png;base64,' + 'A'.repeat(4 * Math.ceil((7 * 1024 * 1024 + 3) / 3)), false],
+        ['dimension', headerDimensions(8193, 1), false], ['pixel-budget', headerDimensions(8192, 8192), false],
+        ['scheme-relative', '//raster.local/api/upload/owned', false], ['encoded-traversal', '/api/upload/%2e%2e/owned', false],
+      ];
+      const oldDecode = window.createImageBitmap; let decodes = 0;
+      window.createImageBitmap = (...args) => { decodes++; return oldDecode(...args); };
+      let launches = []; window.gePhotoEditorApply = async opts => launches.push(opts.imageUrl);
+      const output = [];
+      for (const [name, url, accepted] of cases) {
+        const host = document.createElement('div'); document.body.append(host);
+        renderPhotoEditorApplyButton(host, { kind: 'open_and_apply', imageUrl: url, prompt: 'synthetic edit' });
+        const btn = host.querySelector('button'); const before = launches.length; const decodeBefore = decodes;
+        btn.click(); btn.click(); btn.click();
+        while (btn.disabled) await new Promise(resolve => setTimeout(resolve, 5));
+        output.push({ name, accepted, launches: launches.length - before, decodes: decodes - decodeBefore }); host.remove();
+      }
+      // Cache reuse across repeated activation of the same complete inline image.
+      const host = document.createElement('div'); document.body.append(host);
+      renderPhotoEditorApplyButton(host, { kind: 'open_and_apply', imageUrl: png, prompt: 'repeat' });
+      const btn = host.querySelector('button'); const before = decodes;
+      for (let i = 0; i < 3; i++) { btn.click(); while (btn.disabled) await new Promise(resolve => setTimeout(resolve, 5)); }
+      const cachedDecodes = decodes - before;
+      URL.revokeObjectURL(ownBlob);
+      return { cases: output, cachedDecodes, launches };
+    });
+    assert.deepEqual(results.cases.filter(item => item.launches !== (item.accepted ? 1 : 0)).map(item => item.name), [], 'every raster authorization case must match');
+    for (const name of ['dimension', 'pixel-budget', 'oversized-url', 'oversized-decoded-bytes', 'bytes', 'mismatch']) {
+      assert.equal(results.cases.find(item => item.name === name).decodes, 0, name + ' rejected before browser allocation');
+    }
+    assert.equal(results.cases.find(item => item.name === 'truncated-image').decodes, 1, 'actual decoder rejects incomplete image');
+    assert.equal(results.cachedDecodes, 1, 'same image only decoded once for repeated activation');
+    assert.deepEqual(apiRequests, ['/api/upload/owned', '/api/gallery/owned', '/api/gallery/foreign']);
+    assert.ok(results.launches.includes('http://raster.local/api/generated-image/owned.png'));
+  } finally { await browser.close(); }
+});
@@ -1,10 +1,10 @@
 {
- "digest": "f7e60e4a567c46dc",
+ "digest": "67c4508478daa8e0",
 "elements": {
  "app-shell": {
   "app-loader": "f04ad5bf6312d53f",
   "attach-strip": "a6474951e2481214",
-   "body": "4956f449e6a30e93",
+   "body": "4a4b8a158ea6b360",
   "chat-container": "b00a7c6be4e107b1",
   "chat-context-pill": "dd905b87245a9a71",
   "chat-history": "e65bdc51f4d1675f",
@@ -17,7 +17,7 @@
   "export-dropdown-item": "d90f6f513d06a6f7",
   "export-dropdown-menu": "0793e06a6aae6a7a",
   "hamburger-btn": "34714f6eef3734d8",
-   "icon-rail": "e3f72205260a4a5f",
+   "icon-rail": "c800b4ef07f5f1f0",
   "icon-rail-btn": "54ffb10e056ebf44",
   "incognito-btn": "ee42bd3f6a32576b",
   "input-icon-btn": "3d1c773acd84a825",
@@ -42,7 +42,7 @@
   "rail-new-chat": "f8f1c2f6be426ab9",
   "reasoning-effort-btn": "2a07cdd8ec2b4d26",
   "rename-session-modal": "9345624780009d14",
-   "root": "a9f7ace2c1cefb24",
+   "root": "a6694a5a5dbfbe44",
   "save-custom-preset": "443da70ef5fe9b88",
   "scroll-bottom-btn": "24602d72e2949991",
   "search-input": "53b94f3e5fdb384d",
@@ -59,7 +59,7 @@
   "settings-row": "de568724268cec6e",
   "settings-select": "a96e8430b0ec6668",
   "settings-sidebar-toggle": "6be9025ab24bc434",
-   "sidebar": "77ec42a646a8db66",
+   "sidebar": "0dbf510da61afa07",
   "sidebar-brand": "d3d7ef4b21514e80",
   "sidebar-new-chat": "567fae30048b7ff3",
   "sidebar-resize-handle": "6607b819ee45409d",
@@ -399,10 +399,10 @@
   ".ge-adj-icon": "405c77944c2f21c7",
   ".ge-adj-popup": "e1a93233ab11f043",
   ".ge-adj-row": "fed828d535ba710b",
-   ".ge-adj-row > label": "21bd09c7cf6167e5",
+   ".ge-adj-row > label": "92541b678e8ddd3e",
   ".ge-adj-row input[type=\"range\"]": "3f1690aad291a7da",
   ".ge-adj-title": "7609b8e4f862ad23",
-   ".ge-ai-command-collapsed": "35a892b0246538ba",
+   ".ge-ai-command-collapsed": "5a38c8ab93d1818f",
   ".ge-alpha-badge": "59eb1bb7eddf6df0",
   ".ge-canvas-area": "b6a7426fcd6ad230",
   ".ge-canvas-prompt": "97ddee153cdaf1f2",
@@ -430,11 +430,11 @@
   ".ge-layer-group-row .ge-layer-group-toggle": "cb04950c0a50aacb",
   ".ge-layer-group-row .ge-layer-lock-btn": "bb0f88ce29ae7637",
   ".ge-layer-group-row .ge-layer-opacity-row": "e697b236b3b4ba6e",
-   ".ge-layer-group-row .ge-layer-vis": "2e6dbbab8d823b4f",
+   ".ge-layer-group-row .ge-layer-vis": "ac882350a59601a1",
   ".ge-layer-lock-menu": "528deb6e31022e89",
   ".ge-layer-lock-option": "38a3da4a8785330a",
   ".ge-layers-grab": "094e764489b1b069",
-   ".ge-layers-header": "459d17627f2e83e6",
+   ".ge-layers-header": "1793db7034e4b67b",
   ".ge-layers-list": "0b4bfbd17d414d6d",
   ".ge-main-canvas": "274650d62945ac12",
   ".ge-mask-sub-item": "546f03f9c46eb507",
@@ -442,13 +442,13 @@
   ".ge-section-help": "8bd5ecd734f48ca2",
   ".ge-shortcuts-grid": "84d3ab6453dab9b3",
   ".ge-slider-bubble": "2bc54e40357f68cf",
-   ".ge-tool-btn": "fd54cca726e51429",
+   ".ge-tool-btn": "67f8bb05e2438d92",
   ".ge-tool-sep": "4ae61e4e4eddd504",
-   ".ge-toolbar": "ca827cf012ad8863",
-   ".ge-topbar": "6c39a6ade412d5fa",
+   ".ge-toolbar": "0e05d7a6bc8d85c0",
+   ".ge-topbar": "cdb801be32727e0b",
   ".ge-transform-field": "76a785f630632652",
   ".ge-transform-field > input.ge-transform-popup-input": "b870e4e9d5fc2d91",
-   ".ge-transform-popup-body": "d9d70292e5be7acc",
+   ".ge-transform-popup-body": "af7f9dceddb20374",
   ".ge-transform-popup-head .ge-adj-icon": "88ac29d44343e6fa",
   ".ge-transform-popup-head .ge-adj-title": "1d6ca66f2c39c9ef",
   ".ge-transform-popup-head .ge-head-btns": "ecd0a09cb27407d7",
@@ -456,9 +456,9 @@
   ".ge-transform-popup-suffix": "d55491303f919f61",
   ".ge-transform-quick-btn": "e74ea16e29b9b001",
   ".ge-transform-spin": "22dc5f2bfab2ec9a",
-   ".ge-transform-spin button": "527810c9f1ac1be5",
-   ".ge-transform-spin button[data-spin=\"down\"]": "c0aff9fcdb755ed2",
-   ".ge-transform-spin button[data-spin=\"up\"]": "4fccf8fbe6c04fa9",
+   ".ge-transform-spin button": "ad94130c6f1829d9",
+   ".ge-transform-spin button[data-spin=\"down\"]": "9cb76293b224cf00",
+   ".ge-transform-spin button[data-spin=\"up\"]": "4f6f103a02c3838d",
   ".hamburger": "2b0e4a6cb3333ded",
   ".hamburger span": "6e2fee4770672a20",
   ".hamburger-btn": "dc0f91fb82ccd472",
@@ -488,7 +488,7 @@
   ".hwfit-serve-topline .hwfit-serve-runtime-note": "15b3fef4e5ceaffc",
   ".hwfit-serve-topline .hwfit-serve-runtime-text": "57c6822b0d13147d",
   ".hwfit-spec-group .hwfit-spec-method": "5d1c329116272cf1",
-   ".icon-rail": "e3f72205260a4a5f",
+   ".icon-rail": "c800b4ef07f5f1f0",
   ".icon-rail-btn": "a5f207c3be15401e",
   ".incognito-btn": "9833a2e86fab6a94",
   ".incognito-indicator": "b3945c46844c7278",
@@ -617,15 +617,15 @@
   ".settings-sidebar.settings-sidebar-collapsed": "d9d8f25df95d9ad8",
   ".settings-sidebar.settings-sidebar-collapsed .settings-sidebar-content": "608e51170864586a",
   ".settings-system-logs-tab": "d0d90a13ff327ace",
-   ".sidebar": "77ec42a646a8db66",
+   ".sidebar": "0dbf510da61afa07",
   ".sidebar .section": "37fc733d59519a08",
   ".sidebar-brand-title": "2b20f75768b50346",
   ".sidebar-header": "0d58816ca65b7216",
   ".sidebar-inner": "ad5e28fedbfeb5db",
   ".sidebar-notif-dot": "2673e215d0cd84a6",
   ".sidebar-user-bar": "b77372dbdcb069ef",
-   ".sidebar.hidden": "0df301b638e2f93f",
-   ".sidebar.right-side": "2b6bcc7d59f7b6bd",
+   ".sidebar.hidden": "9021ec7e4e052131",
+   ".sidebar.right-side": "bb6ed4427d07657e",
   ".skill-card > .skill-card-header": "e2408e762818d2fb",
   ".skill-card-tags": "a327c85e053e6d3f",
   ".skill-card-textcol": "f1059ed37c120b60",
@@ -686,56 +686,56 @@
 },
 "variants": {
  "app-shell": {
-   "desktop-dark-comfortable": "0c9123117135e362",
-   "desktop-dark-compact": "c694f5d5118ac0e2",
-   "desktop-dark-spacious": "90a67613e8cfdf5d",
-   "desktop-light-comfortable": "17727a9945ccc77b",
-   "desktop-light-compact": "2a887c30d231e357",
-   "desktop-light-spacious": "94b4666734b87625",
-   "laptop-dark-comfortable": "26d334b139b653f2",
-   "laptop-dark-compact": "fea30bad6824357d",
-   "laptop-dark-spacious": "4fdb28deaaaec870",
-   "laptop-light-comfortable": "c7fc986a7e70aac8",
-   "laptop-light-compact": "147645431229ddff",
-   "laptop-light-spacious": "d513c285d30c8289",
-   "phone-dark-comfortable": "551761344bec8d09",
-   "phone-dark-compact": "293d66518c3ec994",
-   "phone-dark-spacious": "551761344bec8d09",
-   "phone-light-comfortable": "cb41acd3f9af3578",
-   "phone-light-compact": "dbef6e9e373e9c10",
-   "phone-light-spacious": "cb41acd3f9af3578",
-   "tablet-dark-comfortable": "0f682621b4ead393",
-   "tablet-dark-compact": "e6f3fece5e716a2c",
-   "tablet-dark-spacious": "0f682621b4ead393",
-   "tablet-light-comfortable": "6e398df9ca69c58b",
-   "tablet-light-compact": "dca75981c8675bfa",
-   "tablet-light-spacious": "6e398df9ca69c58b"
+   "desktop-dark-comfortable": "6ccb1b611fff1417",
+   "desktop-dark-compact": "fa8811351d590698",
+   "desktop-dark-spacious": "8b23cc34d8dacb5d",
+   "desktop-light-comfortable": "4a98edc12f46490e",
+   "desktop-light-compact": "3712d798c576cf07",
+   "desktop-light-spacious": "4aee43267423df1f",
+   "laptop-dark-comfortable": "35682719e8aeea91",
+   "laptop-dark-compact": "a113f77e47ef20d6",
+   "laptop-dark-spacious": "a94cb0602b8ebf8d",
+   "laptop-light-comfortable": "b523ba8c4d5f5180",
+   "laptop-light-compact": "aff4e1e8a5c192a8",
+   "laptop-light-spacious": "dc83f76cba448444",
+   "phone-dark-comfortable": "10af205a321eb35d",
+   "phone-dark-compact": "1f2816f672a2ff9f",
+   "phone-dark-spacious": "10af205a321eb35d",
+   "phone-light-comfortable": "b781b1eec0f33d3e",
+   "phone-light-compact": "131a7b11605617bb",
+   "phone-light-spacious": "b781b1eec0f33d3e",
+   "tablet-dark-comfortable": "4e005f33938a3026",
+   "tablet-dark-compact": "3a389740245ce8e9",
+   "tablet-dark-spacious": "4e005f33938a3026",
+   "tablet-light-comfortable": "e7d5a710864503d3",
+   "tablet-light-compact": "e65e1bcd50cebf33",
+   "tablet-light-spacious": "e7d5a710864503d3"
  },
  "bench": {
-   "desktop-dark-comfortable": "a9709cb47eec7544",
-   "desktop-dark-compact": "bfab96cb72fd6faf",
-   "desktop-dark-spacious": "25469178b443428a",
-   "desktop-light-comfortable": "2166794d643fae4c",
-   "desktop-light-compact": "81d8ab64407b1d9a",
-   "desktop-light-spacious": "d6d19f33476665af",
-   "laptop-dark-comfortable": "57169e64e1fb5324",
-   "laptop-dark-compact": "6ac903cd8a711bcf",
-   "laptop-dark-spacious": "a47535332e9c5de7",
-   "laptop-light-comfortable": "1e2b381de3556fac",
-   "laptop-light-compact": "6dbfb465121949c1",
-   "laptop-light-spacious": "1b8bfcd4bc4ed214",
-   "phone-dark-comfortable": "67ca3c78e6b9495a",
-   "phone-dark-compact": "ad6f3a9f5c8d81cd",
-   "phone-dark-spacious": "1e6f66e56519ba5d",
-   "phone-light-comfortable": "ef876073cc2dc45e",
-   "phone-light-compact": "2ef6f5dc7a646be9",
-   "phone-light-spacious": "b0d4cd9bd0361966",
-   "tablet-dark-comfortable": "58922240b216e786",
-   "tablet-dark-compact": "3991c22f99a394e0",
-   "tablet-dark-spacious": "9848c3b7debac974",
-   "tablet-light-comfortable": "12dfbad36172de20",
-   "tablet-light-compact": "80d4843e622f1353",
-   "tablet-light-spacious": "c420b8d46c991a44"
+   "desktop-dark-comfortable": "48a5eeb1259fd422",
+   "desktop-dark-compact": "cef4e9f2ceacefbb",
+   "desktop-dark-spacious": "d87bef476928e845",
+   "desktop-light-comfortable": "69a68072200b3669",
+   "desktop-light-compact": "9c6deaecd2265ad9",
+   "desktop-light-spacious": "8a355029e7261110",
+   "laptop-dark-comfortable": "aaf69c3500c38635",
+   "laptop-dark-compact": "ca5a5cb542ee1901",
+   "laptop-dark-spacious": "9f85415f735e040e",
+   "laptop-light-comfortable": "06caf416811d5778",
+   "laptop-light-compact": "f2bab4d31395dd49",
+   "laptop-light-spacious": "6c56a4469a2b42ff",
+   "phone-dark-comfortable": "eb27d09bf0ff4ca1",
+   "phone-dark-compact": "e60d82de1d36c09b",
+   "phone-dark-spacious": "3578747ada4bcbb2",
+   "phone-light-comfortable": "8b0b9f1e7d73d36f",
+   "phone-light-compact": "d2f58cb1c1675907",
+   "phone-light-spacious": "edae71cdde26fd58",
+   "tablet-dark-comfortable": "8fc2eb75bed6417d",
+   "tablet-dark-compact": "2fd7fb77dfb379ba",
+   "tablet-dark-spacious": "1376b658cfc7cb4b",
+   "tablet-light-comfortable": "b456d13e3bbf627e",
+   "tablet-light-compact": "44eb1164a0db4654",
+   "tablet-light-spacious": "5d999940aa547f86"
  },
  "login": {
   "desktop-dark-comfortable": "3cf4809db0f8e119",
@@ -1,11 +1,28 @@
 import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
 import { chromium } from 'playwright';

+const origin = process.env.ODYSSEUS_TEST_STATIC_ORIGIN || 'http://127.0.0.1:7011';
 const browser = await chromium.launch({ headless: true });
 try {
  for (const width of [390, 900]) {
    const page = await browser.newPage({ viewport: { width, height: 844 }, acceptDownloads: true });
-    await page.goto('http://127.0.0.1:7011/static/js/documentStats.js');
+    if (!process.env.ODYSSEUS_TEST_STATIC_ORIGIN) {
+      await page.route(`${origin}/**`, async route => {
+        const url = new URL(route.request().url());
+        const rel = url.pathname.replace(/^\//, '');
+        try {
+          const file = new URL('../' + rel, import.meta.url);
+          const body = await readFile(file);
+          const ext = rel.split('.').pop();
+          const type = ext === 'css' ? 'text/css' : ext === 'js' ? 'text/javascript' : 'application/octet-stream';
+          return route.fulfill({ contentType: type, body });
+        } catch {
+          return route.fulfill({ status: 404, body: 'Not found' });
+        }
+      });
+    }
+    await page.goto(`${origin}/static/js/documentStats.js`);
    await page.setContent('<link rel="stylesheet" href="/static/css/00-tokens.css"><div id="toast"></div><div id="chat-container"></div><div id="sidebar"></div>');
    await page.evaluate(async () => {
      const mod = await import('/static/js/document.js?mobile-export-regression=1');
@@ -1,7 +1,7 @@
 # Browser End-to-End Tests

-The photo editor release gate launches an isolated, authentication-disabled
-Odysseus server on port `7013` with a temporary SQLite database.
+The photo editor release gate launches an isolated Odysseus server on port
+`7013` with a temporary SQLite database and disposable authenticated account.

 ```bash
 npm install
@@ -13,3 +13,8 @@ Set `PHOTO_EDITOR_E2E_PORT` to use another port. Failure screenshots and traces
 are written to `test-results/photo-editor/`. The server uses the repository
 `.venv` automatically; set `ODYSSEUS_TEST_PYTHON` to another Python executable
 when using a different environment layout.
+
+The disposable account is created in the temporary data directory and exercises
+owner-scoped draft and notification routes without using an existing account.
+`PHOTO_EDITOR_E2E_AUTH=0` selects the legacy unauthenticated configuration for
+investigating it; offline-upgrade coverage requires the authenticated mode.
@@ -1,5 +1,5 @@
 const { test, expect } = require('@playwright/test');
-const { selectTool } = require('./helpers.js');
+const { chooseFilterAction, selectTool } = require('./helpers.js');
 const {
  dragOnCanvas,
  encodedImagePixelDigest,
@@ -11,7 +11,7 @@ const {
 } = require('./helpers.js');

 async function addAdjustment(page, type) {
-  await page.locator('#ge-add-layer').click();
+  await page.locator('#ge-add-fx').click();
  const menu = page.locator('.ge-add-layer-menu');
  await expect(menu).toBeVisible();
  await menu.locator(`[data-adjustment-type="${type}"]`).click();
@@ -252,8 +252,7 @@ test('retained Gaussian Blur survives flattening and draft reopen', async ({ pag
  await dragOnCanvas(page, { x: 0.2, y: 0.25 }, { x: 0.8, y: 0.7 });
  const before = await flattenedPixelDigest(page);

-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-blur-gaussian"]').click();
+  await chooseFilterAction(page, 'effect-blur-gaussian');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[data-key="radius"]').fill('14');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();
@@ -282,8 +281,7 @@ test('retained Gaussian Blur survives flattening and draft reopen', async ({ pag

 test('retained Sharpen keeps editable amount and survives draft reopen', async ({ page }) => {
  await openBlankEditor(page, { width: 320, height: 220 }, 'Retained sharpen E2E');
-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-preset-crisp-detail"]').click();
+  await chooseFilterAction(page, 'effect-preset-crisp-detail');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  expect(await page.locator('.ge-filter-row input[data-key="amount"]').inputValue()).toBe('35');
  await page.locator('.ge-filter-row input[data-key="amount"]').fill('75');
@@ -308,16 +306,14 @@ test('retained overlay and shadow effects keep editable metadata', async ({ page
  await page.mouse.down();
  await page.mouse.move(canvasBox.x + 150, canvasBox.y + 140);
  await page.mouse.up();
-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-color-overlay"]').click();
+  await chooseFilterAction(page, 'effect-color-overlay');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[type="color"]').fill('#336699');
  await page.locator('.ge-filter-row input[data-key="opacity"]').fill('35');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();
  await page.locator('button[title="Add effect mask from selection"]').click();

-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-drop-shadow"]').click();
+  await chooseFilterAction(page, 'effect-drop-shadow');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[data-key="blur"]').fill('18');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();
@@ -348,8 +344,7 @@ test('retained Stroke uses layer alpha and persists its controls', async ({ page
  await openBlankEditor(page, { width: 320, height: 220 }, 'Retained stroke E2E');
  await selectTool(page, 'brush');
  await dragOnCanvas(page, { x: 0.25, y: 0.25 }, { x: 0.75, y: 0.7 });
-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-stroke"]').click();
+  await chooseFilterAction(page, 'effect-stroke');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[data-key="width"]').fill('9');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();
@@ -1,5 +1,9 @@
 const { test, expect } = require('@playwright/test');

+// These tests borrow /login as a lightweight page. A signed-in session would
+// make the login page redirect to the app mid-test, so run them signed out.
+test.use({ storageState: { cookies: [], origins: [] } });
+
 async function addAppStyles(page) {
  const { stylesheetUrls } = await import('../../helpers/stylesheets.mjs');
  for (const url of await stylesheetUrls()) {
@@ -54,7 +54,8 @@ test('long sampled strokes stay responsive and undo atomically', async ({ page }
  await page.mouse.down();
  await page.mouse.move(end.x, end.y, { steps: 240 });
  await page.mouse.up();
-  expect(Date.now() - startedAt).toBeLessThan(5000);
+  const strokeDuration = Date.now() - startedAt;
+  expect(strokeDuration).toBeLessThan(5000);
  const after = await flattenedPixelDigest(page);
  expect(after).not.toEqual(before);
  await expect(thumb).toHaveAttribute('width', '68');
@@ -78,14 +79,17 @@ test('eyedropper and retouch tools use the editor stroke lifecycle', async ({ pa
  await selectTool(page, 'eyedropper');
  await expect(page.locator('#ge-eyedropper-section')).toBeVisible();
  await page.locator('#ge-eyedropper-sample').selectOption('composite');
-  await page.mouse.move(sample.x, sample.y);
+  // The options strip height differs per tool, which re-centres the canvas a
+  // few pixels; hover the same image point that was painted.
+  const painted = await canvasPoint(page, 0.3, 0.3);
+  await page.mouse.move(painted.x, painted.y);
  await expect(page.locator('#ge-eyedropper-live-value')).toHaveText('#33aa55');
  await expect(page.locator('#ge-eyedropper-live-rgb')).toHaveText('RGB 51 170 85');
  await expect(page.locator('#ge-eyedropper-live-hsl')).toHaveText('HSL 137 54% 43%');
  await expect(page.locator('#ge-eyedropper-live-swatch')).not.toHaveClass(/empty/);
  await expect(page.locator('#ge-eyedropper-loupe')).toBeVisible();
  expect((await page.locator('#ge-eyedropper-loupe').evaluate(canvas => canvas.getContext('2d').getImageData(42, 42, 1, 1).data[3]))).toBe(255);
-  await page.mouse.click(sample.x, sample.y);
+  await page.mouse.click(painted.x, painted.y);
  await expect(page.locator('.ge-color-picker').first()).toHaveValue('#33aa55');

  for (const tool of ['dodge', 'burn']) {
@@ -178,7 +182,11 @@ test('smudge carries nearby pixels along a stroke and undoes atomically', async
    return [...canvas.getContext('2d').getImageData(x, y, 1, 1).data];
  });
  await selectTool(page, 'smudge');
+  // Smudge strength lives in the brush-family "More" menu with the other
+  // per-tool stroke modifiers.
+  await page.locator('#ge-brush-more').click();
  await expect(page.locator('#ge-smudge-strength-row')).toBeVisible();
+  await page.keyboard.press('Escape');
  await page.mouse.move(source.x, source.y);
  await page.mouse.down();
  await page.mouse.move(target.x, target.y, { steps: 20 });
@@ -1,6 +1,6 @@
 const { test, expect } = require('@playwright/test');
 const { selectTool } = require('./helpers.js');
-const { dragOnCanvas, editorState, flattenedPixelDigest, openBlankEditor } = require('./helpers.js');
+const { dragOnCanvas, editorState, flattenedPixelDigest, openBlankEditor, settledCanvasBox } = require('./helpers.js');

 test('tool switching cancels incomplete crop and selection gestures without stale edits', async ({ page }) => {
  await openBlankEditor(page, { width: 320, height: 240 }, 'Gesture cancellation');
@@ -75,13 +75,15 @@ test('touch crop and selection gestures complete through the shared lifecycle',
  try {
    await openBlankEditor(page, { width: 320, height: 240 }, 'Touch gestures');
    const cdp = await context.newCDPSession(page);
-    const canvasBox = await page.locator('.ge-main-canvas').boundingBox();
    const touch = async (type, x, y) => cdp.send('Input.dispatchTouchEvent', {
      type,
      touchPoints: type === 'touchEnd' ? [] : [{ x, y, id: 1, radiusX: 6, radiusY: 6 }],
    });

    await selectTool(page, 'crop');
+    // Picking a tool minimizes the phone Layers sheet and refits the canvas;
+    // aim at where the canvas settles, as a finger would.
+    const canvasBox = await settledCanvasBox(page);
    await touch('touchStart', canvasBox.x + 35, canvasBox.y + 30);
    await touch('touchMove', canvasBox.x + 190, canvasBox.y + 145);
    await touch('touchEnd', canvasBox.x + 190, canvasBox.y + 145);
@@ -113,18 +115,24 @@ test('touch brush paints and undoes as one stroke', async ({ browser, browserNam
  try {
    await openBlankEditor(page, { width: 320, height: 240 }, 'Touch brush');
    const cdp = await context.newCDPSession(page);
-    const canvasBox = await page.locator('.ge-main-canvas').boundingBox();
    const touch = async (type, x, y) => cdp.send('Input.dispatchTouchEvent', {
      type,
      touchPoints: type === 'touchEnd' ? [] : [{ x, y, id: 1, radiusX: 6, radiusY: 6 }],
    });
    await selectTool(page, 'brush');
+    // Re-tapping the active tool collapses its controls sheet (canvas-first
+    // phone editing), which also uncovers the Layers sheet grab handle.
+    await selectTool(page, 'brush');
+    const canvasBox = await settledCanvasBox(page);
    const before = await flattenedPixelDigest(page);
    await touch('touchStart', canvasBox.x + canvasBox.width * 0.25, canvasBox.y + canvasBox.height * 0.5);
    await touch('touchMove', canvasBox.x + canvasBox.width * 0.75, canvasBox.y + canvasBox.height * 0.5);
    await touch('touchEnd', canvasBox.x + canvasBox.width * 0.75, canvasBox.y + canvasBox.height * 0.5);
    const after = await flattenedPixelDigest(page);
    expect(after).not.toEqual(before);
+    // History buttons live in the Layers sheet, which the tool pick minimized.
+    await page.locator('.ge-layers-grab').click();
+    await expect(page.locator('.ge-right-panel')).not.toHaveClass(/minimized/);
    await page.locator('#ge-undo').click();
    expect(await flattenedPixelDigest(page)).toEqual(before);
  } finally {
@@ -39,7 +39,7 @@ async function downloadFormat(page, format, filename) {
 }

 async function addAdjustment(page, type) {
-  await page.locator('#ge-add-layer').click();
+  await page.locator('#ge-add-fx').click();
  await expect(page.locator('.ge-add-layer-menu')).toBeVisible();
  await page.locator(`.ge-add-layer-menu [data-adjustment-type="${type}"]`).click();
  await expect(page.locator('.ge-adj-popup')).toBeVisible();
@@ -100,7 +100,7 @@ test('composited correction exports preserve pixels and format metadata', async
  await openBlankEditor(page, { width: 160, height: 120 }, 'Export fidelity');
  await seedGradient(page);

-  await page.locator('#ge-add-layer').click();
+  await page.locator('#ge-add-fx').click();
  await page.locator('.ge-add-layer-menu [data-adjustment-type="exposure"]').click();
  await page.locator('.ge-adj-row input[data-key="exposure"]').fill('35');
  await page.locator('.ge-adj-row input[data-key="exposure"]').dispatchEvent('input');
@@ -1,5 +1,5 @@
 const { test, expect } = require('@playwright/test');
-const { selectTool } = require('./helpers.js');
+const { chooseFilterAction, selectTool } = require('./helpers.js');
 const fs = require('node:fs');
 const {
  compareExportPixels,
@@ -38,8 +38,7 @@ test('group retained effects edit, toggle, reorder surface, and survive reopen',
  const groupId = (await editorState(page)).groups[0].id;
  const groupRow = page.locator(`.ge-layer-group-row[data-group-id="${groupId}"]`);

-  await page.locator('.ge-layer-controls:visible .ge-layer-btn[title*="effect"]').click();
-  await page.locator('[data-filter-action="effect-blur-gaussian"]').click();
+  await chooseFilterAction(page, 'effect-blur-gaussian', '.ge-layer-controls:visible .ge-layer-btn[title*="effect"]');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[data-key="radius"]').fill('14');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();
@@ -84,8 +83,7 @@ test('group retained effects export the visible composite and survive reopen', a
  await page.locator('.ge-layer-item[data-layer-id]').filter({ hasText: 'Background' }).first().click({ modifiers: ['Control'] });
  await page.locator('#ge-group-selected').click();

-  await page.locator('.ge-layer-controls:visible .ge-layer-btn[title*="effect"]').click();
-  await page.locator('[data-filter-action="effect-color-overlay"]').click();
+  await chooseFilterAction(page, 'effect-color-overlay', '.ge-layer-controls:visible .ge-layer-btn[title*="effect"]');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[type="color"]').fill('#336699');
  await page.locator('.ge-filter-row input[data-key="opacity"]').fill('40');
@@ -10,7 +10,6 @@ test('group drag reorders the complete subtree with undo and server persistence'
  const originalOrder = current.layers.map(layer => layer.id);

  await page.locator('#ge-add-layer').click();
-  await page.locator('.ge-add-layer-menu [data-layer-kind="raster"]').click();
  current = await editorState(page);
  const looseId = current.activeLayerId;
  expect(current.layers.map(layer => layer.id)).toEqual([...originalOrder, looseId]);
@@ -66,7 +65,7 @@ test('mobile layer drag handle supports long-press reorder', async ({ browser, b
  const page = await context.newPage();
  try {
    await openBlankEditor(page, { width: 320, height: 240 }, 'Mobile layer reorder');
-    await page.locator('.ge-layers-header').click();
+    await page.locator('.ge-layers-title').click();
    await expect(page.locator('.ge-right-panel')).toHaveClass(/expanded/);
    const before = await editorState(page);
    // State is bottom-to-top; the panel is top-to-bottom.
@@ -1,40 +1,22 @@
 const { expect } = require('@playwright/test');

 async function openBlankEditor(page, size = { width: 640, height: 480 }, name = 'Photo editor E2E') {
-  let lastError = null;
-  for (let pageAttempt = 0; pageAttempt < 3; pageAttempt += 1) {
-    try {
-      await page.goto('/', { waitUntil: 'domcontentloaded' });
-      await page.locator('#tool-gallery-btn').waitFor({ state: 'attached', timeout: 20_000 });
-      await page.evaluate(async () => {
-        window.__photoEditorImport = async path => {
-          let lastImportError = null;
-          for (let attempt = 0; attempt < 4; attempt += 1) {
-            const url = attempt === 0 ? path : `${path}?e2e_retry=${attempt}-${Date.now()}`;
-            try { return await import(url); } catch (error) { lastImportError = error; }
-            await new Promise(resolve => setTimeout(resolve, 150 * (attempt + 1)));
-          }
-          throw lastImportError;
-        };
-        const gallery = await window.__photoEditorImport('/static/js/gallery.js?v=20260830editor4');
-        gallery.openGallery();
-      });
-      await page.locator('#gallery-editor-tab').waitFor({ state: 'visible', timeout: 20_000 });
-      await page.locator('#gallery-editor-tab').click();
-      await page.evaluate(async ({ size: nextSize, name: nextName }) => {
-        const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
-        editor.openEditor(null, null, { w: nextSize.width, h: nextSize.height }, nextName);
-      }, { size, name });
-      await page.locator('.ge-main-canvas').waitFor({ state: 'visible', timeout: 20_000 });
-      lastError = null;
-      break;
-    } catch (error) {
-      lastError = error;
-      await page.goto('about:blank');
-      await page.waitForTimeout(250 * (pageAttempt + 1));
-    }
-  }
-  if (lastError) throw lastError;
+  await page.goto('/', { waitUntil: 'domcontentloaded' });
+  // Workflow tests exercise the canvas, not the optional setup overlay.
+  await page.evaluate(() => localStorage.setItem('ge-preflight-dismissed', '1'));
+  await page.locator('#tool-gallery-btn').waitFor({ state: 'attached', timeout: 20_000 });
+  await page.evaluate(async () => {
+    window.__photoEditorImport = path => import(path);
+    const gallery = await window.__photoEditorImport('/static/js/gallery.js?v=20260830editor4');
+    gallery.openGallery();
+  });
+  await page.locator('#gallery-editor-tab').waitFor({ state: 'visible', timeout: 20_000 });
+  await page.locator('#gallery-editor-tab').click();
+  await page.evaluate(async ({ size: nextSize, name: nextName }) => {
+    const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
+    editor.openEditor(null, null, { w: nextSize.width, h: nextSize.height }, nextName);
+  }, { size, name });
+  await page.locator('.ge-main-canvas').waitFor({ state: 'visible', timeout: 20_000 });
  await expect.poll(async () => page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    return state.layers.length;
@@ -368,12 +350,51 @@ async function selectTool(page, toolId) {
    await face.first().click();
    return;
  }
-  // Flyout members are pre-rendered (hidden until the slot opens). Dispatch a
-  // click directly so the helper does not depend on hover/flyout visibility.
-  await page.locator(`.ge-tool-flyout-item[data-tool-option="${toolId}"]`).first().dispatchEvent('click');
+  // Open the flyout via its corner triangle, wait for item visibility, and click realistically
+  const slot = page.locator('.ge-tool-slot', { has: page.locator(`[data-tool-option="${toolId}"]`) }).first();
+  const tri = slot.locator('.ge-tool-flyout-tri');
+  if (await tri.count() > 0) {
+    await tri.click();
+  }
+  const item = slot.locator(`.ge-tool-flyout-item[data-tool-option="${toolId}"]`);
+  await expect(item).toBeVisible({ timeout: 3000 });
+  await item.click();
+}
+
+// On phones, picking a tool minimizes the Layers sheet and refits the canvas.
+// Wait for the canvas to stop moving before aiming at it.
+async function settledCanvasBox(page) {
+  let box = null;
+  await expect.poll(async () => {
+    const previous = box;
+    box = await page.locator('.ge-main-canvas').boundingBox();
+    return JSON.stringify(previous) === JSON.stringify(box);
+  }).toBe(true);
+  return box;
+}
+
+// Rare text/shape options live in the options strip's "More" popover, which
+// closes on any outside press. Open it (idempotently) before using them.
+async function openOptionsMore(page, kind) {
+  const menu = page.locator(`#ge-${kind}-more`);
+  if (await menu.isHidden()) await page.locator(`#ge-${kind}-more-toggle`).click();
+  await expect(menu).toBeVisible();
+}
+
+// Filter actions live in Photoshop-style flyouts (Blur, Retained effects, ...).
+// Open the menu, then the item's parent row, as a user would.
+async function chooseFilterAction(page, action, opener = '#ge-filter-menu-btn') {
+  await page.locator(opener).click();
+  const menu = page.locator('#ge-filter-menu');
+  await expect(menu).toBeVisible();
+  const item = menu.locator(`[data-filter-action="${action}"]`);
+  const panel = await item.evaluate(node => node.closest('.ge-submenu')?.dataset.submenuPanel || null);
+  if (panel) await menu.locator(`.ge-menu-parent[data-submenu="${panel}"]`).click();
+  await item.click();
 }

 module.exports = {
+  chooseFilterAction,
  compareExportPixels,
  dragOnCanvas,
  encodedImagePixelDigest,
@@ -381,7 +402,9 @@ module.exports = {
  flattenedPixelDigest,
  openBlankEditor,
  openExportDialog,
+  openOptionsMore,
  reopenDraft,
  selectTool,
+  settledCanvasBox,
  waitForDraft,
 };
@@ -1,5 +1,5 @@
 const { test, expect } = require('@playwright/test');
-const { openBlankEditor, editorState, dragOnCanvas } = require('./helpers');
+const { chooseFilterAction, dragOnCanvas, editorState, openBlankEditor, waitForDraft } = require('./helpers.js');

 test.beforeEach(async ({ page }) => {
  // The isolated editor server has no logged-in notification owner.
@@ -35,6 +35,96 @@ test('top toolbar stays on one row and its menus remain clickable at narrow widt
  }
 });

+test('save button icon follows the draft status through an edit and autosave', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  // Autosave can settle within a frame, so record the rendered icon at every
+  // status change instead of racing it with polling assertions.
+  await page.evaluate(() => {
+    const status = document.getElementById('ge-draft-status');
+    const visibleIcon = () => [...document.querySelectorAll('#ge-save-menu-btn .ge-save-state-icon')]
+      .filter(icon => icon.getBoundingClientRect().width > 0)
+      .map(icon => (icon.classList.contains('ge-save-state-saved') ? 'saved' : 'dirty'));
+    window.__saveStates = [];
+    new MutationObserver(() => window.__saveStates.push({ text: status.textContent, icons: visibleIcon() }))
+      .observe(status, { childList: true, characterData: true, subtree: true });
+  });
+  await page.keyboard.press('b');
+  await dragOnCanvas(page, { x: 0.2, y: 0.2 }, { x: 0.7, y: 0.7 });
+  await waitForDraft(page);
+  await expect(page.locator('#ge-draft-status')).toHaveText('Saved');
+  const states = await page.evaluate(() => window.__saveStates);
+  expect(states.some(entry => entry.text === 'Unsaved')).toBe(true);
+  for (const entry of states) {
+    expect(entry.icons).toEqual([entry.text === 'Saved' ? 'saved' : 'dirty']);
+  }
+});
+
+test('save-state representations cover all draft states without error normalization', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  await waitForDraft(page);
+
+  const cases = [
+    { label: 'Unsaved', state: 'dirty', expectedText: 'Unsaved', expectedState: 'dirty', iconClass: 'ge-save-state-dirty', isError: false },
+    { label: 'Saving soon…', state: 'pending', expectedText: 'Saving soon…', expectedState: 'pending', iconClass: 'ge-save-state-dirty', isError: false },
+    { label: 'Saving…', state: 'saving', expectedText: 'Saving…', expectedState: 'saving', iconClass: 'ge-save-state-dirty', isError: false },
+    { label: 'Saved', state: 'saved', expectedText: 'Saved', expectedState: 'saved', iconClass: 'ge-save-state-saved', isError: false },
+    { label: 'Save failed', state: 'error', expectedText: 'Save failed', expectedState: 'error', iconClass: 'ge-save-state-error', isError: true },
+    { label: 'Save paused', state: 'paused', expectedText: 'Save paused', expectedState: 'paused', iconClass: 'ge-save-state-error', isError: true },
+    { label: 'Save failed: network offline', state: '', expectedText: 'Save failed: network offline', expectedState: 'error', iconClass: 'ge-save-state-error', isError: true },
+  ];
+
+  for (const c of cases) {
+    await page.evaluate(({ label, state }) => {
+      window.__geSetDraftStatus(label, state);
+    }, c);
+
+    const statusEl = page.locator('#ge-draft-status');
+    const saveBtn = page.locator('#ge-save-menu-btn');
+    await expect(statusEl).toHaveText(c.expectedText);
+    await expect(statusEl).toHaveAttribute('data-state', c.expectedState);
+
+    const visibleIcon = await page.evaluate(() => {
+      const icons = [...document.querySelectorAll('#ge-save-menu-btn .ge-save-state-icon')];
+      const visible = icons.filter(i => !i.hasAttribute('hidden'));
+      return visible.map(i => i.className.baseVal || i.className);
+    });
+    expect(visibleIcon.length).toBe(1);
+    expect(visibleIcon[0]).toContain(c.iconClass);
+
+    if (c.isError) {
+      await expect(saveBtn).toHaveAttribute('aria-label', new RegExp(`Draft autosave failed: ${c.expectedText}`));
+    } else {
+      await expect(saveBtn).toHaveAttribute('aria-label', `Draft status: ${c.expectedText}`);
+    }
+  }
+});
+
+test('autosave network failure transitions to error state and shows failure indicator', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  await page.route(/\/api\/editor-drafts/, route => route.fulfill({
+    status: 500,
+    contentType: 'application/json',
+    body: JSON.stringify({ detail: 'Database error' }),
+  }));
+
+  await page.keyboard.press('b');
+  await dragOnCanvas(page, { x: 0.2, y: 0.2 }, { x: 0.7, y: 0.7 });
+
+  const statusEl = page.locator('#ge-draft-status');
+  await expect(statusEl).toHaveText('Save failed', { timeout: 10_000 });
+  await expect(statusEl).toHaveAttribute('data-state', 'error');
+
+  const saveBtn = page.locator('#ge-save-menu-btn');
+  await expect(saveBtn).toHaveAttribute('aria-label', /Draft autosave failed/);
+
+  const visibleIcons = await page.evaluate(() => {
+    const icons = [...document.querySelectorAll('#ge-save-menu-btn .ge-save-state-icon')];
+    return icons.filter(i => !i.hasAttribute('hidden')).map(i => i.className.baseVal || i.className);
+  });
+  expect(visibleIcons).toHaveLength(1);
+  expect(visibleIcons[0]).toContain('ge-save-state-error');
+});
+
 test('committed paint refreshes the layer thumbnail and flashes only the edited row', async ({ page }) => {
  await openBlankEditor(page, { width: 320, height: 240 });
  const activeId = (await editorState(page)).activeLayerId;
@@ -55,8 +145,7 @@ test('filter Escape restores pixels and preserves redo history', async ({ page }
  await dragOnCanvas(page, { x: 0.7, y: 0.2 }, { x: 0.2, y: 0.7 });
  await page.keyboard.press('Control+z');
  const before = await editorState(page);
-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="blur-gaussian"]').click();
+  await chooseFilterAction(page, 'blur-gaussian');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.keyboard.press('Escape');
  await expect(page.locator('.ge-filter-modal')).toHaveCount(0);
@@ -75,7 +164,10 @@ test('focused fields own undo, selection and clipboard without changing layers',
  await input.fill('Editable text');
  await input.press('Control+Enter');
  // A tool's ordinary text input must also retain native clipboard ownership.
+  // Frame width lives in the text options' collapsed "More" section.
+  await page.locator('#ge-text-more-toggle').click();
  await page.locator('#ge-text-frame-width').focus();
+  await expect(page.locator('#ge-text-frame-width')).toBeFocused();
  const before = await editorState(page);
  await page.keyboard.press('Control+z');
  await page.keyboard.press('Control+j');
@@ -247,3 +339,76 @@ test('switching away from a held brush ends one stroke and desktop reselect keep
  await page.keyboard.press('Control+z');
  expect((await editorState(page)).layers).toEqual(before.layers);
 });
+
+test('concurrent edits during in-flight save preserve dirty unsaved status and revision sequence', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  await waitForDraft(page);
+
+  let delayedRouteResolve = null;
+  const delayedRoutePromise = new Promise(resolve => { delayedRouteResolve = resolve; });
+
+  let saveCallCount = 0;
+  await page.route(/\/api\/editor-drafts/, async route => {
+    saveCallCount += 1;
+    if (saveCallCount === 1) {
+      await delayedRoutePromise;
+    }
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({ id: 'concurrent-draft-1', name: 'Untitled' }),
+    });
+  });
+
+  // Edit 1
+  await page.keyboard.press('b');
+  await dragOnCanvas(page, { x: 0.2, y: 0.2 }, { x: 0.4, y: 0.4 });
+
+  // Wait until save is in flight
+  await expect(page.locator('#ge-draft-status')).toHaveText('Saving…', { timeout: 10_000 });
+
+  // Edit 2 while save 1 is in flight
+  await dragOnCanvas(page, { x: 0.5, y: 0.5 }, { x: 0.7, y: 0.7 });
+
+  const revsDuringFlight = await page.evaluate(async () => {
+    const { state } = await import('/static/js/editor/state.js');
+    return {
+      docRev: state.documentRevision,
+      persistingRev: state.persistingRevision,
+      dirty: state.persistDirty,
+    };
+  });
+  expect(revsDuringFlight.docRev).toBeGreaterThan(revsDuringFlight.persistingRev);
+  expect(revsDuringFlight.dirty).toBe(true);
+
+  // Now let save 1 complete
+  delayedRouteResolve();
+
+  // Wait for the chained second save to complete
+  await expect.poll(async () => {
+    return page.evaluate(async () => {
+      const { state } = await import('/static/js/editor/state.js');
+      return state.savedRevision >= state.documentRevision && !state.persistDirty;
+    });
+  }, { timeout: 15_000 }).toBe(true);
+
+  await expect(page.locator('#ge-draft-status')).toHaveText('Saved');
+});
+
+test('failed draft save retains unsaved dirty status and failure indicator', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  await waitForDraft(page);
+
+  await page.route(/\/api\/editor-drafts/, route => route.abort('failed'));
+
+  await page.keyboard.press('b');
+  await dragOnCanvas(page, { x: 0.2, y: 0.2 }, { x: 0.4, y: 0.4 });
+
+  await expect(page.locator('#ge-draft-status')).toHaveText('Save failed', { timeout: 10_000 });
+
+  const dirtyAfterFailure = await page.evaluate(async () => {
+    const { state } = await import('/static/js/editor/state.js');
+    return state.persistDirty;
+  });
+  expect(dirtyAfterFailure).toBe(true);
+});
@@ -3,8 +3,6 @@ const { selectTool } = require('./helpers.js');
 const { dragOnCanvas, editorState, openBlankEditor, reopenDraft, waitForDraft } = require('./helpers.js');

 test('Ctrl-click thumbnail shows pixel selection even after outlines were hidden', async ({ page }) => {
-  // Notification polling requires login even in the auth-disabled test server.
-  await page.route('**/api/tasks/notification-logs*', route => route.fulfill({ json: { logs: [] } }));
  await openBlankEditor(page, { width: 240, height: 160 }, 'Thumbnail selection');
  const id = await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
@@ -32,7 +30,6 @@ test('Ctrl-click thumbnail shows pixel selection even after outlines were hidden
 test('selected layers align to the canvas and undo as one operation', async ({ page }) => {
  await openBlankEditor(page, { width: 320, height: 240 }, 'Alignment E2E');
  await page.locator('#ge-add-layer').click();
-  await page.locator('.ge-add-layer-menu [data-layer-kind="raster"]').click();
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    const edit = state.layers.find(layer => layer.name === 'Edit');
@@ -111,7 +108,6 @@ test('group rows can be selected with the keyboard', async ({ page }) => {
 test('Delete removes the selected layer and undo restores it', async ({ page }) => {
  await openBlankEditor(page, { width: 240, height: 160 }, 'Keyboard delete E2E');
  await page.locator('#ge-add-layer').click();
-  await page.locator('.ge-add-layer-menu [data-layer-kind="raster"]').click();
  const addedId = (await editorState(page)).activeLayerId;
  await page.locator(`.ge-layer-item[data-layer-id="${addedId}"]`).click();
  await page.keyboard.press('Backspace');
@@ -193,7 +189,6 @@ test('multi-selected layers move together and support history-backed bulk action

  await editRow.click();
  await page.locator('#ge-add-layer').click();
-  await page.locator('.ge-add-layer-menu [data-layer-kind="raster"]').click();
  const addedId = (await editorState(page)).activeLayerId;
  await editRow.click({ modifiers: ['Control'] });
  await expect(page.locator('.ge-layer-item.selected[data-layer-id]')).toHaveCount(2);
@@ -278,7 +273,6 @@ test('nested groups preserve hierarchy, ancestor locks, collapse, and server reo
  const innerId = current.groups[0].id;

  await page.locator('#ge-add-layer').click();
-  await page.locator('.ge-add-layer-menu [data-layer-kind="raster"]').click();
  current = await editorState(page);
  const looseId = current.activeLayerId;
  await page.locator(`.ge-layer-group-row[data-group-id="${innerId}"]`).click();
@@ -1,5 +1,5 @@
 const { test, expect } = require('@playwright/test');
-const { editorState, flattenedPixelDigest, openBlankEditor } = require('./helpers.js');
+const { chooseFilterAction, editorState, flattenedPixelDigest, openBlankEditor } = require('./helpers.js');

 async function seedVisibleLayers(page) {
  await page.evaluate(async () => {
@@ -18,14 +18,13 @@ test('Merge all preserves retained effects and adjustment output', async ({ page
  await openBlankEditor(page, { width: 320, height: 220 }, 'Merge fidelity E2E');
  await seedVisibleLayers(page);

-  await page.locator('#ge-filter-menu-btn').click();
-  await page.locator('[data-filter-action="effect-color-overlay"]').click();
+  await chooseFilterAction(page, 'effect-color-overlay');
  await expect(page.locator('.ge-filter-modal')).toBeVisible();
  await page.locator('.ge-filter-row input[type="color"]').fill('#f0c04a');
  await page.locator('.ge-filter-row input[data-key="opacity"]').fill('35');
  await page.locator('.ge-filter-modal [data-action="apply"]').click();

-  await page.locator('#ge-add-layer').click();
+  await page.locator('#ge-add-fx').click();
  await page.locator('.ge-add-layer-menu [data-adjustment-type="exposure"]').click();
  await expect(page.locator('.ge-adj-popup')).toBeVisible();
  await page.locator('.ge-adj-row input[data-key="exposure"]').fill('45');
@@ -0,0 +1,57 @@
+const { test, expect } = require('@playwright/test');
+const { openBlankEditor, selectTool } = require('./helpers.js');
+
+test.use({ viewport: { width: 390, height: 844 }, hasTouch: true });
+
+test('minimizing layers restores fit view and keeps an explicit zoom', async ({ page }) => {
+  await openBlankEditor(page, { width: 320, height: 240 });
+  const canvas = page.locator('.ge-main-canvas');
+  const zoom = () => page.evaluate(async () => (await import('/static/js/editor/state.js')).state.zoom);
+  await page.locator('.ge-layers-title').click();
+  await expect(page.locator('.ge-right-panel')).toHaveClass(/expanded/);
+  await selectTool(page, 'eraser');
+  await selectTool(page, 'eraser');
+  await expect(page.locator('.ge-right-panel')).toHaveClass(/minimized/);
+  await expect.poll(async () => (await canvas.boundingBox()).width).toBeGreaterThan(200);
+
+  await page.locator('.ge-layers-grab').click();
+  await expect(page.locator('.ge-right-panel')).not.toHaveClass(/minimized/);
+  await page.locator('#ge-zoom-in').evaluate(button => button.click());
+  await expect.poll(() => page.evaluate(async () => (await import('/static/js/editor/state.js')).state.zoomViewMode)).toBe('scale');
+  const manualZoom = await zoom();
+  await page.locator('.ge-layers-title').click();
+  await selectTool(page, 'eraser');
+  await selectTool(page, 'eraser');
+  await expect(page.locator('.ge-right-panel')).toHaveClass(/minimized/);
+  await expect.poll(zoom).toBe(manualZoom);
+});
+
+test('minimizing layers keeps a pinch zoom', async ({ page, context, browserName }) => {
+  test.skip(browserName !== 'chromium', 'Uses Chromium CDP multi-touch injection');
+  await openBlankEditor(page, { width: 320, height: 240 });
+  const state = () => page.evaluate(async () => {
+    const { state: editor } = await import('/static/js/editor/state.js');
+    return { zoom: editor.zoom, mode: editor.zoomViewMode };
+  });
+  const fitted = await state();
+  const box = await page.locator('.ge-main-canvas').boundingBox();
+  const cx = box.x + box.width / 2;
+  const cy = box.y + box.height / 2;
+  const cdp = await context.newCDPSession(page);
+  const fingers = spread => [{ x: cx - spread, y: cy, id: 1 }, { x: cx + spread, y: cy, id: 2 }];
+  await cdp.send('Input.dispatchTouchEvent', { type: 'touchStart', touchPoints: fingers(20) });
+  for (const spread of [30, 40, 50]) {
+    await cdp.send('Input.dispatchTouchEvent', { type: 'touchMove', touchPoints: fingers(spread) });
+  }
+  await cdp.send('Input.dispatchTouchEvent', { type: 'touchEnd', touchPoints: [] });
+  const pinched = await state();
+  expect(pinched.mode).toBe('scale');
+  expect(pinched.zoom).toBeGreaterThan(fitted.zoom * 2);
+
+  await page.locator('.ge-layers-title').click();
+  await expect(page.locator('.ge-right-panel')).toHaveClass(/expanded/);
+  await selectTool(page, 'eraser');
+  await selectTool(page, 'eraser');
+  await expect(page.locator('.ge-right-panel')).toHaveClass(/minimized/);
+  await expect.poll(async () => (await state()).zoom).toBe(pinched.zoom);
+});
@@ -121,6 +121,10 @@ test('mobile touch mask editing supports undo and persists through reload', asyn
  const painted = await editorState(page);
  const paintedLayer = painted.layers.find(layer => layer.masks.length);
  expect(paintedLayer.masks[0].pixelHash).not.toBe(before);
+  // History controls live in the layers header, which is hidden while the
+  // sheet is minimized for painting. Reopen it as a phone user would.
+  await page.locator('.ge-layers-grab').click();
+  await expect(page.locator('.ge-right-panel')).not.toHaveClass(/minimized/);
  await page.locator('#ge-undo').click();
  expect((await editorState(page)).layers.find(layer => layer.masks.length).masks[0].pixelHash)
    .toBe(before);
@@ -207,6 +211,8 @@ test('mobile touch moves an unlinked layer mask without moving its layer', async
  expect(movedLayer.offset).toEqual(beforeLayer.offset);
  expect(movedLayer.masks[0].offset.x).not.toBe(beforeLayer.masks[0].offset.x);
  expect(movedLayer.masks[0].offset.y).not.toBe(beforeLayer.masks[0].offset.y);
+  await page.locator('.ge-layers-grab').click();
+  await expect(page.locator('.ge-right-panel')).not.toHaveClass(/minimized/);
  await page.locator('#ge-undo').click();
  expect((await editorState(page)).layers.find(layer => layer.id === layerId).masks[0].offset)
    .toEqual(beforeLayer.masks[0].offset);
@@ -0,0 +1,87 @@
+const { test, expect } = require('@playwright/test');
+const path = require('node:path');
+
+test('static editor modules survive a cache upgrade and offline reopen', async ({ browser }, testInfo) => {
+  const context = await browser.newContext({
+    baseURL: testInfo.project.use.baseURL,
+    storageState: path.join(process.env.PHOTO_EDITOR_E2E_DATA_DIR, 'browser-auth.json'),
+    serviceWorkers: 'allow',
+  });
+  const page = await context.newPage();
+  const pickerUrl = '/static/js/colorPicker.js?v=20260910eyedropper1';
+  const cssUrl = '/static/css/13-image-editor.css?v=20260929csssplit';
+  const editorUrl = '/static/js/galleryEditor.js?v=20260909movepicklayer1';
+  try {
+    // The app's worker intentionally controls /static/, not the SPA root.
+    await page.goto('/static/js/panels.js?v=20260909movepicklayer1');
+    const installed = await page.evaluate(async ({ pickerUrl, cssUrl }) => {
+      const previous = await caches.open('odysseus-v1113-pr40-editor-precache');
+      await previous.put(pickerUrl, new Response('stale picker'));
+      await previous.put(cssUrl, new Response('stale css'));
+      const registration = await navigator.serviceWorker.register('/static/sw.js?v=20260916autoscroll1');
+      await navigator.serviceWorker.ready;
+      if (!navigator.serviceWorker.controller) {
+        await new Promise(resolve => navigator.serviceWorker.addEventListener('controllerchange', resolve, { once: true }));
+      }
+      return { scope: new URL(registration.scope).pathname, root: !!(await navigator.serviceWorker.getRegistration('/')) };
+    }, { pickerUrl, cssUrl });
+    expect(installed).toEqual({ scope: '/static/', root: false });
+    await expect.poll(() => page.evaluate(async () => (await caches.keys()).includes('odysseus-v1113-pr40-editor-precache'))).toBe(false);
+    for (const url of [pickerUrl, cssUrl, editorUrl, '/static/js/platform.js', '/static/js/modelSort.js']) {
+      expect(await page.evaluate(async value => !!(await caches.match(value)), url)).toBe(true);
+    }
+
+    // Simulate stale entries in the active version, then verify network-first
+    // refresh updates both JS and CSS before testing the offline fallback.
+    const currentCache = await page.evaluate(async () => (await caches.keys()).find(name => name.startsWith('odysseus-')));
+    expect(currentCache).toMatch(/^odysseus-v\d+-pr40-editor-precache$/);
+    expect(currentCache).not.toBe('odysseus-v1113-pr40-editor-precache');
+    await page.evaluate(async ({ currentCache, pickerUrl, cssUrl }) => {
+      const cache = await caches.open(currentCache);
+      await cache.put(pickerUrl, new Response('stale picker'));
+      await cache.put(cssUrl, new Response('stale css'));
+      for (const url of [pickerUrl, cssUrl]) {
+        const response = await fetch(url);
+        if (!response.ok) throw new Error(`Network refresh failed: ${url} ${response.status}`);
+      }
+    }, { currentCache, pickerUrl, cssUrl });
+    for (const url of [pickerUrl, cssUrl]) {
+      await expect.poll(() => page.evaluate(async value => {
+        const response = await caches.match(value);
+        return response ? !(await response.text()).startsWith('stale ') : false;
+      }, url)).toBe(true);
+    }
+
+    // Origin is the only Vary header the offline fallback may ignore. An entry
+    // that varies on anything else (as a per-user response would) must miss.
+    const varyProbeUrl = '/static/js/e2e-vary-probe.js';
+    await page.evaluate(async ({ currentCache, varyProbeUrl }) => {
+      const cache = await caches.open(currentCache);
+      await cache.put(
+        new Request(varyProbeUrl, { headers: { 'X-Probe-Owner': 'another-user' } }),
+        new Response('export default "private";', { headers: { 'Content-Type': 'text/javascript', Vary: 'Origin, X-Probe-Owner' } }),
+      );
+    }, { currentCache, varyProbeUrl });
+
+    await context.setOffline(true);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const offline = await context.newPage();
+      await offline.goto('/static/js/panels.js?v=20260909movepicklayer1');
+      expect(await offline.evaluate(() => !!navigator.serviceWorker.controller)).toBe(true);
+      const result = await offline.evaluate(async ({ pickerUrl, editorUrl, cssUrl, varyProbeUrl }) => {
+        const editor = await import(editorUrl);
+        const picker = await import(pickerUrl);
+        const css = await fetch(cssUrl);
+        const privateProbe = await import(varyProbeUrl).then(() => 'served', () => 'rejected');
+        return {
+          editor: typeof editor.openEditor,
+          picker: ['getRecentColors', 'recordRecentColor', 'suggestColorsFor'].every(key => typeof picker[key] === 'function'),
+          cssOk: css.ok,
+          privateProbe,
+        };
+      }, { pickerUrl, editorUrl, cssUrl, varyProbeUrl });
+      expect(result).toEqual({ editor: 'function', picker: true, cssOk: true, privateProbe: 'rejected' });
+      await offline.close();
+    }
+  } finally { await context.close(); }
+});
@@ -0,0 +1,95 @@
+const { test, expect } = require('@playwright/test');
+const { openBlankEditor } = require('./helpers.js');
+
+test('channel and path panels display hostile layer metadata as text', async ({ page }) => {
+  await openBlankEditor(page, { width: 64, height: 64 });
+  const result = await page.evaluate(async () => {
+    const { state } = await import('/static/js/editor/state.js');
+    const { createColorPanels } = await import('/static/js/editor/panels/panels.js');
+    const { createStudioPanels } = await import('/static/js/editor/panels/studio-panels.js');
+    const attack = '<img src=x onerror="window.__panelXss=true">';
+    const layer = state.layers.find(item => item.id === state.activeLayerId);
+    layer.name = attack;
+    layer.kind = 'shape';
+    layer.shape = { type: attack };
+    const colors = createColorPanels({ state });
+    const studio = createStudioPanels({ state });
+    document.body.append(colors.channels, studio.paths);
+    colors.refresh();
+    studio.refresh();
+    return {
+      attack,
+      channel: colors.channels.querySelector('.ge-channel-name').textContent,
+      path: studio.paths.querySelector('.ge-channel-name').textContent,
+      images: colors.channels.querySelectorAll('img').length + studio.paths.querySelectorAll('img').length,
+      executed: !!window.__panelXss,
+    };
+  });
+  expect(result.channel).toBe(result.attack);
+  expect(result.path).toBe(`${result.attack} · ${result.attack}`);
+  expect(result.images).toBe(0);
+  expect(result.executed).toBe(false);
+});
+
+test('unknown effect types cannot inject markup into the layer panel', async ({ page }) => {
+  await openBlankEditor(page, { width: 64, height: 64 });
+  const attack = '<img src=x onerror="window.__effectXss=true">';
+  const id = await page.evaluate(async value => {
+    const { state } = await import('/static/js/editor/state.js');
+    const layer = state.layers.find(item => item.id === state.activeLayerId);
+    layer.effects = [{ id: 'effect-test', type: value, visible: true, params: {} }];
+    return layer.id;
+  }, attack);
+  await page.locator(`.ge-layer-item[data-layer-id="${id}"] .ge-layer-vis`).first().click();
+  const list = page.locator('#ge-layers-list');
+  await expect(list).toContainText('Gaussian Blur');
+  await expect(list).not.toContainText(attack);
+  await expect(list.locator('img')).toHaveCount(0);
+  expect(await page.evaluate(() => !!window.__effectXss)).toBe(false);
+});
+
+test('saved brush preset names remain literal text in the flyout', async ({ page }) => {
+  const attack = '<img src=x onerror="window.__brushXss=true">';
+  await page.addInitScript(value => {
+    localStorage.setItem('odysseus.editor.brush-presets.v1', JSON.stringify([
+      { id: 'hostile-preset', name: value, size: 8, opacity: 100, flow: 100, softness: 20 },
+    ]));
+  }, attack);
+  await openBlankEditor(page, { width: 64, height: 64 });
+  const preset = page.locator('.ge-tool-flyout-preset[data-brush-preset="hostile-preset"]');
+  await expect(preset.locator('.ge-tool-flyout-label')).toHaveText(attack);
+  await expect(preset.locator('img')).toHaveCount(0);
+  expect(await page.evaluate(() => !!window.__brushXss)).toBe(false);
+});
+
+test('imported adjustment parameters cannot inject markup into the adjustment popup', async ({ page }) => {
+  await openBlankEditor(page, { width: 64, height: 64 });
+  const attack = '"><img src=x onerror="window.__adjXss=true">';
+  const cases = [
+    { type: 'color-lookup', params: { cube: { size: attack, data: [0, 0, 0] }, strength: attack }, text: '.ge-adj-lut-name', expected: 'Loaded LUT · 0³' },
+    { type: 'gradient-map', params: { shadows: attack, highlights: attack } },
+    { type: 'levels', params: { inBlack: attack, outWhite: attack } },
+  ];
+  for (const item of cases) {
+    await page.locator('#ge-add-fx').click();
+    await page.locator(`.ge-add-layer-menu [data-adjustment-type="${item.type}"]`).click();
+    await page.locator('.ge-adj-popup [data-adj-action="ok"]').click();
+    await expect(page.locator('.ge-adj-popup')).toHaveCount(0);
+    // Project files and drafts reach the editor through the codec's
+    // normalizer, which validates the type but not every parameter.
+    await page.evaluate(async ({ type, params }) => {
+      const { state } = await import('/static/js/editor/state.js');
+      const { normalizeAdjustmentData } = await import('/static/js/editor/adjustment-layer.js');
+      const layer = state.layers.find(entry => entry.id === state.activeLayerId);
+      layer.adjustment = normalizeAdjustmentData({ type, params });
+    }, item);
+    await page.locator('.ge-layer-controls:visible .ge-layer-fx-btn').click();
+    const popup = page.locator('.ge-adj-popup');
+    await expect(popup).toBeVisible();
+    await expect(popup.locator('img')).toHaveCount(0);
+    if (item.text) await expect(popup.locator(item.text)).toHaveText(item.expected);
+    expect(await popup.evaluate(node => node.innerHTML.includes('onerror'))).toBe(false);
+    await popup.locator('[data-adj-action="cancel"]').click();
+  }
+  expect(await page.evaluate(() => !!window.__adjXss)).toBe(false);
+});
--- a/Show More
+++ b/Show More