diff --git a/README.md b/README.md
index 3ef0fca6..e8d01692 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ once; without it the run fails partway through with a 401/403 from the Hub.
 
 ## Drive it from an agent
 
-Then just ask. The agent has 62 tools covering the whole surface — the
+Then just ask. The agent has 65 tools covering the whole surface — the
 workflow catalog, the real diffusers pipeline signatures, the job queue, the
 gallery, the model cache:
 
diff --git a/docs/ACCELERATION.md b/docs/ACCELERATION.md
index 1d64c59c..e864eb7b 100644
--- a/docs/ACCELERATION.md
+++ b/docs/ACCELERATION.md
@@ -8,14 +8,29 @@ For ready-made configurations that combine these levers per model family, see [R
 
 Applied at pipeline load time via the `cache` configuration. Hooks auto-reset between runs.
 
+`validate_workflow` warns (it never refuses) about two cache settings that cost a render to find out:
+
+- **`cache_short_schedule`: a threshold cache on a short schedule.** `first_block` and `mag` decide each step's skip on a residual threshold, and the consecutive steps of a short schedule differ too much for it: under 20 `num_inference_steps` such a cache will likely skip nothing and still perturbs the result. On MiniMax-H3 a `first_block` cache at `0.05` skipped nothing at 12 steps and took 22% off at 30 ([FirstBlockCache](#firstblockcache)). Drop the cache or run 20 steps or more. A turbo schedule (9 steps or fewer) never benefits. `taylorseer` and `faster` skip on a fixed interval and `text_kv` skips no step, so the rule does not apply to them.
+- **`taylorseer_state_unestimated`: TaylorSeer's state is not in the VRAM estimate.** Said whenever `taylorseer` is set - see [TaylorSeerCache](#taylorseercache).
+
 ### Models diffusers has not registered
 
 `first_block`, `mag` and `layer_skip` look a model's transformer block class up in
 diffusers' own registry and raise when it is absent, which is how a model that supports
 `enable_cache()` ends up with no usable cache. [cache_blocks.json](../dw/cache_blocks.json)
 fills those gaps in, registering the missing block metadata on demand; entries become
-redundant, not wrong, once diffusers registers the same class upstream. MiniMax-H3 and
-LTX-2 are listed there today.
+redundant, not wrong, once diffusers registers the same class upstream. MiniMax-H3,
+LTX-2 and Qwen-Image-2.1 are listed there today.
+
+Qwen-Image-2.1's pipeline keeps a key/value cache of its own (`use_kv_cache`, on by
+default) that drops the text tokens from the sequence after the first step. `first_block`
+and `mag` compare one step's residual against the previous one, so the sequence length
+changing under them fails the second step; pass `"use_kv_cache": false` in the step's
+`arguments` to cache it.
+
+A transformer that does not support `enable_cache()` at all - Z-Image's, for one - takes
+no cache of any type. The step still runs, uncached, and the job carries a warning that the
+cache was not applied.
 
 LTX-2's block needs one thing more than the metadata diffusers defines. It returns two
 streams - video and audio - and diffusers reads the second one back out of a forward
@@ -40,7 +55,7 @@ Simplest and broadest support. Compares first-block residuals to decide whether
 }
 ```
 
-Higher threshold = more speedup, more quality loss. Start with `0.05` and increase to taste.
+Higher threshold = more speedup, more quality loss. Start with `0.05` and increase to taste. On MiniMax-H3 (RTX 3090, 1344x768, 4 references) `0.05` took 22% off a 30-step base-model job and nothing off a 12-step or turbo one, which it never skips; `torch.compile` there cost 289 s on the first pass for ~1% per pass, `text_kv` did nothing on Ref2VA, and `taylorseer` ran out of memory. Every MiniMax-H3 template takes a `cache` argument, `null` (off) by default and wired to the H3 step only: pass `{"type": "first_block", "threshold": 0.05}` rather than editing the JSON, and only at ~20 or more base steps, never with the turbo LoRAs.
 
 **Example:** [step-caching.json](../workflows/templates/step-caching.json)
 
@@ -63,7 +78,7 @@ Magnitude-based caching with error accumulation. Requires `num_inference_steps`
 | -------- | ------- | ----------- |
 | `mag_ratios` | required | Preset name or explicit per-step ratio array — see below |
 | `threshold` | 0.06 | Accumulated error threshold for skipping |
-| `num_inference_steps` | required | Must match pipeline arguments |
+| `num_inference_steps` | required | The transformer forwards the call runs: the pipeline's `num_inference_steps`, except where the scheduler runs fewer (MiniMax-H3 runs one fewer) |
 | `max_skip_steps` | 3 | Max consecutive steps to skip |
 | `retention_ratio` | 0.2 | Fraction of initial steps where skipping is disabled |
 | `calibrate` | false | Measure ratios for a new model instead of skipping — see below |
@@ -75,7 +90,7 @@ MagCache needs to know how each denoising step's output magnitude typically beha
 - **A preset name** — `"mag_ratios": "flux"` resolves to the ratios diffusers ships for Flux. Any preset a later diffusers release adds is usable by name without a change here.
 - **An explicit array** — `"mag_ratios": [1.0, 0.98, 0.96, ...]`. The array is interpolated automatically when its length differs from `num_inference_steps`, so ratios measured at one step count can be reused at another.
 
-For a model with no preset, run once with `"calibrate": true`. Calibration skips nothing and logs the measured ratios at the end of the run; paste that array into `mag_ratios` and drop the `calibrate` flag for subsequent runs.
+For a model with no preset, run once with `"calibrate": true`. Calibration skips nothing. At the end of the run the measured ratios appear as a job warning and a `log` event (`get_job`'s `warnings`, `get_job_events`, `export_job`): `MagCache calibration (N steps): [ ... ] — paste into mag_ratios`. While calibrating, the run's own `num_inference_steps` is the step count, so the cache's can be left at its default (a mismatch is reported as a warning). The cache attaches to a pipeline's `transformer`, and only one that supports `enable_cache()`: a UNet pipeline such as SD 1.5 has no transformer, and Z-Image's transformer has no cache support, so both get a warning that the cache was not applied and no calibration. Paste that array into `mag_ratios` and drop the `calibrate` flag for subsequent runs. `N` is the forwards the run actually made, which is not always the call's `num_inference_steps`: MiniMax-H3's scheduler turns N sigmas into N - 1 evaluations, so a 30-step H3 call reports 29 ratios. Set the cache's `num_inference_steps` to that `N` when you paste them, so each ratio lines up with its forward. A pipeline that runs classifier-free guidance as two transformer passes in their own `cond` and `uncond` cache contexts (Qwen-Image-2.1 with `true_cfg_scale` above 1 and a `negative_prompt`, or the other Qwen-Image pipelines) keeps a separate state for each, so it emits **two** lists, each labeled `[cond]` or `[uncond]`; use the `cond` one, since `mag_ratios` takes one array. A guidance-distilled pipeline such as Flux, or one that batches both passes into one forward emits one unlabeled list.
 
 ```json
 "cache": { "type": "mag", "calibrate": true, "num_inference_steps": 28 }
@@ -96,7 +111,9 @@ Taylor series approximation of cached outputs:
 | Property | Default | Description |
 | -------- | ------- | ----------- |
 | `cache_interval` | 5 | Full computation every N steps |
-| `max_order` | 1 | Taylor series order (higher = better approximation, more memory) |
+| `max_order` | 1 | Taylor series order (higher = better approximation, and more state kept on the GPU) |
+
+TaylorSeer keeps per-block state on the GPU that no `vram_estimate` charges, so a job that fits without the cache can run out of memory with it. On MiniMax-H3 at 1344x768, 30 steps and `max_order` 1, a run that `validate_workflow` had passed ran out of memory 2 min in on a 24 GB card. Validate says so as `taylorseer_state_unestimated` whenever `taylorseer` is set, with the job's estimate and the card's capacity when both are known; the state itself is on top of that figure, and is not sized.
 
 ### FasterCache
 
@@ -110,6 +127,10 @@ Experimental, video-oriented. Uses FFT frequency decomposition:
 
 Best for video models like CogVideoX. No additional parameters needed for basic use.
 
+| Property | Default | Description |
+| -------- | ------- | ----------- |
+| `is_guidance_distilled` | false | Set `true` for a guidance-distilled model (FLUX.1-dev, FLUX.1-Krea-dev), where `guidance_scale` is an embedding and the transformer sees a batch of 1. FasterCache otherwise assumes a cond/uncond batch of 2 and fails at the first step with `tuple index out of range` (#895). Validate cannot tell a distilled model from a CFG one, so it does not check this |
+
 ### TextKVCache
 
 Caches the transformer's key/value projections of the (unchanging) text
@@ -123,6 +144,10 @@ embeddings across denoising steps, recomputing only what the latents need:
 
 No parameters.
 
+### Reading the skip counts
+
+A step that set a `cache` reports `timing.cache` on its manifest entry (fields in [WORKSPACES.md](WORKSPACES.md#step-timing)). `hit_rate` is the fraction of denoiser forwards whose remaining blocks were skipped. It counts forwards, not steps: classifier-free guidance runs two per step, so a 30-step run is 60 forwards. Only `first_block` and `mag` are counted; `taylorseer`, `faster` and `text_kv` report null counts. A cache with zero skips can still change the output, so a 0-skip run is not guaranteed bit-identical to an uncached one. With `first_block` the head block always runs, and enabling any cache wraps the blocks in hooks that recompute the residual (the tail's output minus the head's, in the transformer's dtype), which changes the order and precision of operations; the MiniMax-H3 matrix run P2 saw a changed output with nothing skipped. Judge quality against an uncached run, not against `skipped == 0`. A threshold sweep (#875) reads `hit_rate` against quality.
+
 ## Attention Backends
 
 Select the attention implementation diffusers uses for the duration of each pipeline call, via a context manager wrapped around `pipeline(...)`:
@@ -136,15 +161,15 @@ Select the attention implementation diffusers uses for the duration of each pipe
 
 Common values: `"flash"`, `"flash_hub"`, `"sage"`, `"sage_hub"`, `"native"`, `"flex"`. The full set is diffusers' `AttentionBackendName` enum - availability depends on what's installed (`flash-attn`, `sageattention`, etc.) and the platform. `_hub`-suffixed backends are fetched from the Hugging Face Hub kernel registry on first use, which needs the `kernels` package installed (`pip install kernels`) - it is not a dw dependency, and no bundled workflow sets a backend, so each runs on a plain install. diffusers also refuses a Hub kernel whose publisher it does not list as trusted - `sage_hub` among them, since SageAttention 2 comes from `SageAttention/sage-attention` - until `DIFFUSERS_TRUST_REMOTE_KERNELS=true`, which allows remote code from any such publisher. On an RTX 3090 `sage_hub` measured about 30% faster per MiniMax-H3 step (13.8 s against 19.2 s at 960x544x124, 54.7 s against 81.2 s at 345 frames); the local `sage` backend needs `sageattention>=2.1.1`, which PyPI does not carry.
 
-The MiniMax-H3 baselines expose this as a variable: `attention_backend` on
-[video-with-audio.json](../workflows/templates/minimax/video-with-audio.json),
-[video-with-audio-768p.json](../workflows/templates/minimax/video-with-audio-768p.json),
-[image-to-video.json](../workflows/templates/minimax/image-to-video.json) and
-[reference-to-video.json](../workflows/templates/minimax/reference-to-video.json), pinned
-on the transformer and `null` by default. Pass `attention_backend=sage_hub` to a box with
-the `kernels` package and `DIFFUSERS_TRUST_REMOTE_KERNELS=true` in its `.env`; on MPS
-leave it null. The other H3 templates take the same key under `components.transformer`
-(`transformer_ref` for a ref2va workflow). LTX-2.5 cannot use it: its transformer
+Every MiniMax-H3 template in [templates/minimax/](../workflows/templates/minimax/)
+exposes this as a variable: `attention_backend`, pinned on the H3 step's transformer
+(`components.transformer`, or `components.transformer_ref` for a ref2va workflow) and
+`null` by default. That covers the shots, chains and episodes - `dialogue-short`,
+`shots-batch`, `music-video` and `storyboard` among them - and only their H3 steps: a
+Z-Image still or Music3 song beside an H3 shot keeps the process default. Pass
+`attention_backend=sage_hub` to a box with the `kernels` package and
+`DIFFUSERS_TRUST_REMOTE_KERNELS=true` in its `.env`; on MPS leave it null, since a
+CUDA-only kernel fails there at load (validation warns, below). LTX-2.5 cannot use it: its transformer
 passes an attention mask, and sage attention refuses one ("`attn_mask` is not supported
 for sage attention", measured 2026-10-10), so the LTX templates expose no backend.
 
@@ -160,6 +185,8 @@ A component can also pin its backend persistently instead, via `set_attention_ba
 
 Prefer the pinned form for a compiled component - the per-call context manager switches implementations under the compiled graph and forces a recompile on every run.
 
+The flash, flash-3, sage and xformers backends need CUDA, `_hub` variants included. On a server whose device is not CUDA (`mps`, `cpu`), `validate_workflow` warns `attention_backend_unavailable` for one set at pipeline or component level, naming the backend and the device: the job would fail at load. It never refuses, and a `native`-family backend never warns. A backend diffusers adds later is not on the list until dw's is updated, and draws no warning.
+
 Either form stays on what it names. diffusers' `set_attention_backend` also makes its backend the process-wide default, which the persistent worker would keep for every later model; dw restores the default after pinning, so an H3 `sage_hub` pin cannot reach a Music3 or LTX job that follows it. The server-wide default is `DIFFUSERS_ATTN_BACKEND` in `.env` - leave it `native`, since it reaches every model and sage cannot serve all of them.
 
 ## Attention Slicing
@@ -201,10 +228,11 @@ Compile a component once it is fully configured - the graph captures final dtype
 Typical gains are 1.3-1.5x on diffusion transformers, and compilation stacks with the caches above. Notes:
 
 - **First run pays the compile cost.** The [server](SERVER.md)'s persistent worker keeps compiled pipelines loaded between runs, so the cost is paid once per session rather than once per generation. A new session still retraces, but the kernels it built come back from the on-disk cache, which dw keeps across reboots (`TORCHINDUCTOR_CACHE_DIR`, see [Environment Defaults](#environment-defaults)). SDNQ's `triton.jit`/autotune kernels are cached separately by Triton itself (`TRITON_CACHE_DIR`, else `$TRITON_HOME/.triton/cache`, else `~/.triton/cache`); dw sets no `TRITON_*` variable and leaves that cache where it is, shared with any other Triton user on the machine. Both caches' sizes show in `get_server_info`'s `caches` and `GET /api/caches`, and `DELETE /api/caches/{name}` empties one ([SERVER.md](SERVER.md)); the next first step of each shape pays the compile or re-autotune again (100-300 s per shape on MiniMax-H3 for Triton).
+- **Measure the cold cost from `timing`.** A pipeline step's manifest entry carries `timing` ([WORKSPACES.md](WORKSPACES.md#step-timing)): on a cold run the compile cost is about `first_pass_s - pass_s`, and `compiled` says whether compile was on. `pass_s` is wall time at step boundaries, not kernel time - on CUDA kernels run asynchronously, so a pass boundary is when the host saw it.
 - **Pin the attention backend** on a compiled component (`"attention_backend"` in the same `components` entry) rather than using the pipeline-level per-call context manager, which forces recompiles.
 - **Quantize-on-load time is a separate cost.** An SDNQ on-the-fly component re-reads and re-quantizes its bf16 weights on every cold load; `DW_QUANTIZED_CACHE=1` saves the quantized result and reads it back instead - see [QUANTIZATION.md](QUANTIZATION.md#cached-on-the-fly-dw_quantized_cache).
-- **Composes with offloading**: apply `group_offload` and `compile` on the same component and the offload hooks are installed first, as required. Skipped with a warning on MPS.
-- **Don't combine `fullgraph` with a `cache`**: the cache hooks decide skip-or-compute per step, a data-dependent branch diffusers wraps in `torch.compiler.disable` - it needs the graph break that `fullgraph: true` forbids. Compile with the default (partial) graph mode when a cache is active.
+- **Composes with offloading**: apply `group_offload` and `compile` on the same component and the offload hooks are installed first, as required. Skipped with a warning on MPS. The compile cost is paid again every time the worker releases the pipeline ("Workflow changed - releasing cached models"), i.e. on any workflow change, so it pays off only across many runs of one workflow at one shape.
+- **Don't combine `fullgraph` with a `cache`**: the cache hooks decide skip-or-compute per step, a data-dependent branch diffusers wraps in `torch.compiler.disable` - it needs the graph break that `fullgraph: true` forbids. Compile with the default (partial) graph mode when a cache is active. `validate_workflow` warns `compile_fullgraph_with_cache` on a component that sets `fullgraph: true` in a pipeline with a `cache`.
 - **TorchAO quantization needs compile to be fast** - see [QUANTIZATION.md](QUANTIZATION.md#torchao).
 
 **Example:** [flux-dev-compile.json](../workflows/models/flux-dev-compile.json), [flux-torchao.json](../workflows/models/flux-torchao.json)
@@ -306,7 +334,7 @@ For faster model downloads, optionally `pip install hf_transfer` and set `HF_HUB
 
 Apple Silicon has narrower acceleration support than CUDA:
 
-- No flash-attn, no Triton, no bitsandbytes - `attention_backend` is effectively CUDA-only; use `"native"`-family backends or leave it unset on MPS. `compile` is skipped with a warning (inductor support on MPS is immature). A workflow that loads a bitsandbytes checkpoint (`flux2-dev`, `multi-image-reference`) or a TorchAO int4 config (`flux-torchao`) has no Mac path yet.
+- No flash-attn, no Triton, no bitsandbytes - `attention_backend` is effectively CUDA-only; use `"native"`-family backends or leave it unset on MPS. Validate warns `attention_backend_unavailable` for a CUDA-only one ([Attention Backends](#attention-backends)). `compile` is skipped with a warning (inductor support on MPS is immature). A workflow that loads a bitsandbytes checkpoint (`flux2-dev`, `multi-image-reference`) or a TorchAO int4 config (`flux-torchao`) has no Mac path yet.
 - Workflows written for CUDA are adapted rather than refused: a `cuda` device becomes `mps`, SDNQ's `quantization_device` follows it and its quantized matmul is switched off (it runs through `torch._int_mm`, ~500x slower on MPS), group-offload CUDA streams are dropped, and `"offload": "sequential"` becomes `"model"`. Each change is logged as a warning.
 - Attention slicing is automatic; set `disable_attention_slicing` for SDXL-family models (head dim 64), where it is 2.4x slower in attention. It helps SD 1.5.
 - `float16` can produce NaN values on Apple Silicon - use `bfloat16`; dw only warns, it doesn't override the dtype for you.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 43f13588..4cc5c11c 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -31,12 +31,14 @@ one to open.
 | Quantized component cache | `dw/quantized_cache.py`: `load_components`, `from_pretrained`, `cache_key` | A key that can't pin the weights isn't cached, the cache never fails a job, and the save comes before pruning, so an entry is the whole component. | `tests/test_quantized_cache.py` |
 | LoRAs | `dw/pipeline_processors/adapters.py`: `active_loras`, `load_loras` | A `loras` entry whose `model_name` is null is switched off. | `tests/test_lora_disable.py::TestLoadLoras::test_an_all_null_entry_loads_nothing` |
 | Step progress | `dw/pipeline_processors/progress.py`: `reported_progress_bars` | A pipeline with no step callback reports its denoise steps through its progress bars. | `tests/test_modular_progress.py::test_every_advance_of_the_bar_is_reported` |
+| Step timing | `dw/pipeline_processors/timing.py`: `StepTimer`, `step_timer`, `timed_step`, `mark` | Only a pipeline step that ran is timed, on the worker's monotonic clock: `step_timer` opens a `StepTimer` for a step with a `pipeline` or `pipeline_reference` and None for any other, which also hides an outer step's timer from a composed child. Load, call, denoise start, each pass and save reach the open timer through `mark`, and nowhere else. Denoise start is never taken inside a compiled region: a whole-compiled denoiser (`_compiled_call_impl` set) has that callable wrapped for the call instead of a forward pre-hook, which `fullgraph: true` cannot trace. A span with a missing mark is null, never guessed. `record_step` puts the reading on the step's manifest entry and `step_end`, and a reused step gets no `timing`. A chain sums its pipeline calls into one `timing` with `segments: N`. `ManifestEntry.timing` declares the shape (`docs/WORKSPACES.md` *Step timing*). | `tests/test_step_timing.py::test_a_missing_denoise_start_nulls_encode_and_first_pass`, `tests/test_step_timing.py::test_a_reused_step_carries_no_timing_even_when_one_is_passed`, `tests/test_step_timing.py::test_a_chain_sums_its_segments_and_takes_one_median_over_both`, `tests/test_step_timing.py::test_a_task_step_run_through_the_step_loop_has_no_timing`, `tests/test_step_timing.py::test_the_denoise_hook_marks_the_first_forward_once_and_removes_itself`, `tests/test_step_timing.py::test_a_fullgraph_compiled_denoiser_runs_and_still_gets_the_start_mark` |
+| Step-cache skip counts | `dw/pipeline_processors/timing.py`: `CacheCounter`, `counting_forwards`, `report_cache_stats`, `StepTimer.cache_counted`; `dw/pipeline_processors/components.py`: `stateful_cache_context`, `get_cache_transformer` | For `first_block` and `mag`, a forward hook on the cache transformer counts computed or skipped once per forward, reading the leader hook's `should_compute` inside the cond/uncond `cache_context` the pipeline opened, so classifier-free guidance counts both forwards. `stateful_cache_context` registers the hook for one pipeline call; its `finally` emits `cache_stats` before `_reset_stateful_cache()` and removes the hook after the event. Private diffusers state that has moved gives null counts and one `cache_stats_unavailable` warning, and never fails the run; `taylorseer`, `faster` and `text_kv` report type and config only, with no warning. The counts reach the step's `timing.cache` only through `StepTimer.cache_counted`; a chain sums its calls' counts, and a null in any call nulls the sum. A step with no `cache` has no `cache` key and no event (`docs/ACCELERATION.md` *Reading the skip counts*). | `tests/test_cache_stats.py::test_cfg_counts_two_forwards_per_step_and_they_add_up`, `tests/test_cache_stats.py::test_the_event_names_the_step_and_segment_and_goes_out_before_the_reset`, `tests/test_cache_stats.py::test_moved_hook_state_nulls_the_counts_warns_once_and_the_run_finishes`, `tests/test_cache_stats.py::test_the_private_diffusers_names_are_where_the_counter_reads_them`, `tests/test_cache_stats.py::test_the_timer_sums_counts_and_nulls_on_any_null`, `tests/test_cache_stats.py::test_types_without_a_decision_report_type_only_and_no_warning` |
 | Community pipelines | `dw/community_pipelines/` (e.g. `pipeline_ltx2_refine.py`: `LTX2RefinePipeline`), `dw/introspection.py`: `community_pipelines`, `load_allowed_class` | A pipeline dw ships is named by its dotted path (`dw.community_pipelines.<module>.<Class>`), loads untrusted because it is under `dw`, and is listed by `list_pipelines` and resolved by `get_pipeline_signature` - only the modules in that directory, never a caller-chosen import. `LTX2RefinePipeline` VAE-encodes `video` at `width` x `height` and passes it unnormalized as `latents`, because `LTX2Pipeline.prepare_latents` normalizes 5-D latents itself. | `tests/test_ltx2_refine_pipeline.py::TestIntrospection::test_only_the_shipped_modules_resolve`, `tests/test_ltx2_refine_pipeline.py::TestEncode::test_the_latents_are_left_unnormalized_for_the_parent` |
 | Adding a task | `dw/tasks/registry.py`: `register_command`, `RegistryTable` | A task is a function registered with `@register_command`, and the signature of its implementation is its argument schema. Its validate-time rules are declared on the same decorator - `domains`, `choices`, `static_check`, `whole_numbers` and `media_arguments` - and `TASK_ARGUMENT_DOMAINS`, `TASK_ARGUMENT_CHOICES`, `TASK_STATIC_CHECKS`, `TASK_WHOLE_NUMBER_ARGUMENTS` and `TASK_MEDIA_ARGUMENTS` are read-only views derived from them, so there is no second table to forget (#692). The registry lives in `dw/tasks/registry.py`; `dw/tasks/task.py` re-exports it, and a task module may register its own handler, as `dw/tasks/beats.py` does, provided `dw/tasks/task.py` imports it (`docs/TASKS.md` *Adding a task*). The built-in handlers are grouped by family the same way - `dw/tasks/audio_handlers.py`, `dw/tasks/video_handlers.py`, `dw/tasks/finish_handlers.py` and `dw/tasks/model_handlers.py` (#790) - and `dw/tasks/task.py` keeps the general-purpose commands, the processor dispatch and `Task`. | `tests/test_task_discovery.py::TestDescribeTask::test_signature_becomes_the_schema`, `tests/test_task_registry_rules.py::test_every_derived_table_is_the_registrys_view`, `tests/test_task_registry_rules.py::test_every_static_check_is_registered_to_exactly_one_command`, `tests/test_task_registry_rules.py::test_every_media_argument_is_a_parameter_of_its_command` |
 | Task argument domains | `dw/task_domains.py`: `check_arguments`, `task_argument_errors`; `dw/task_problems.py`: `face_track_errors`, `beats_errors`, `cuts_errors`, `lut_errors` | A numeric domain that a signature cannot express is declared on the command's `@register_command(domains=...)`, and it is checked at validation and again at run time. A numeric argument is read by `whole_number` or `real_number`, the only numeric coercion in `dw/tasks/`, and validation applies the same rule (`number_problem`), so a value is refused at both or at neither: `"3.0"` is a whole number, `"3.5"` for one of `whole_numbers` is not, and `true` is no number (#774). `Task.run` coerces every declared argument through `coerce_arguments` before dispatch, so a handler sees a number, and an argument that has no range besides being a number declares `finite`. A command's cross-argument rules are its registered `static_check`, which `task_argument_errors` runs at validation (`attribute_voices`' `voices_argument_errors`, kept in `dw/tasks/voice_attribution.py`, among them). A literal enum choice (`choice_errors`) is refused at validation by the same module. The per-family rules past a single domain live in `dw/task_problems.py`, which reads `task_domains`' helpers and is never imported by it (`task_argument_errors` reaches them only through the registered `static_check`, so `import_cycles` stays 0; #790): the `ingredients_grid` image count against `max_images` (`ingredients_grid_errors`), and `crop_face_track`'s cross-argument rules (`face_track_problems`, `face_track_errors`: crop size a multiple of the step's `multiple` (32 by default), `remainder` below `modulus`, `gate_zero` above `gate_full`, padding and confidence limits), which the task checks again at run time, as `analyze_beats`' are too (`beats_problems`, `beats_errors`: `min_bpm` below `max_bpm`, and anchors that are one kind per list, ascending, with whole beat indexes; `tests/test_analyze_beats.py`), and `plan_cuts`' (`cuts_problems`, `cuts_errors`: a bare-string transcript (`transcript_problem`, which `plan_cuts` also calls at run time), `min_scene_s` above `max_scene_s`, `segment_by: "beat"` without beats), and `apply_lut`'s (`lut_source_problem`, `palette_problem`, `lut_errors`: exactly one of `lut` or `palette`, and a palette of 2..16 `#rrggbb` colours, re-checked at run time by `check_lut_source`), and `check_face_detector_source` vets its Hub repo and `.onnx` file before any download. `select`'s index stays in `task_domains` with the other media-timing rules (`select_index_problem`, `select_rule_problems`: a whole number, at least 0, and below the candidate count when the count is known, i.e. at run time or when `candidates` is a written list). | `tests/test_task_domains.py::TestTheStaticPass::test_a_negative_frame_count_is_refused_at_its_path`, `tests/test_numeric_coercion.py::TestGradeExposure::test_a_string_number_grades_like_the_number`, `tests/test_task_domains.py::TestAtRunTime::test_slice_audio_refuses_a_negative_count`, `tests/test_ingredients_grid.py::TestStaticValidation::test_bad_layout_and_fit`, `tests/test_face_track.py::TestStaticValidation::test_bad_literal_is_an_error_at_its_argument`, `tests/test_face_track.py::TestCropFaceTrack::test_bad_arguments_are_refused_at_run_time`, `tests/test_face_track.py::TestStaticValidation::test_a_declared_grid_is_accepted`, `tests/test_face_track.py::TestDetectorSource::test_traversing_repo_is_refused`, `tests/test_select_validation.py::TestSelectErrors::test_an_out_of_range_literal_index_names_both_ends`, `tests/test_lut.py::TestPaletteAtValidate::test_both_refuse_naming_the_two`, `tests/test_lut.py::TestPalette::test_a_bad_palette_refuses_naming_the_entry` |
 | Variables | `dw/variables.py`: `set_variables`, `argument_errors`, `resolve_variable_values` | `argument_errors` folds a caller's arguments in exactly as `set_variables` does when a run starts, so a bad name or value is refused before anything is queued. | `tests/test_variables.py::test_argument_errors_reports_a_dict_passed_for_a_string_variable` |
 | List variables from the CLI | `dw/run.py`, `dw/variables.py`: `get_value` | A `name=value` string given for a list variable is split on commas, so a list of objects can only be passed as JSON over the API or MCP. | `tests/test_variables.py::test_set_variables_list_default_splits_on_comma` |
-| `for_each` expansion | `dw/for_each.py`: `expand_for_each` | Each entry becomes an ordinary step named `<step>@<entry>`, after substitution and before the reference check. | `tests/test_for_each.py::TestNaming::test_member_name_joins_with_at` |
+| `for_each` expansion | `dw/for_each.py`: `expand_for_each`, `group_of` | Each entry becomes an ordinary step named `<step>@<entry>`, after substitution and before the reference check. | `tests/test_for_each.py::TestNaming::test_member_name_joins_with_at` |
 | Optional entry field | `dw/for_each.py`: `_optional_item`, `_item_fields` | `{"item": "field", "default": X}` reads an entry field with a fallback; without `default` it is the plain required read, and `list_fields` / `entry_field_warnings` count the field as one entries take. The editor's string scan needs no twin code, only the shared case file. | `tests/test_for_each.py::TestOptionalItem::test_a_present_field_wins_and_an_absent_one_takes_the_default`, `tests/test_ui_twins.py::test_the_engine_decides_each_shared_reference_case` |
 | Previous results | `dw/previous_results.py`: `get_iterations`, `previous_result_reference_errors` | Several `previous_result:` references in one step multiply into a cartesian product. | `tests/test_previous_results.py::TestGetIterations::test_multiple_references_create_cartesian_product` |
 | Previous-result check | `dw/previous_results.py`: `previous_result_reference_errors` | A literal reference to a step that is not earlier in the workflow is a validation error. | `tests/test_previous_results.py::TestStaticReferenceChecking::test_a_step_cannot_reference_itself_or_a_later_one` |
@@ -57,6 +59,7 @@ one to open.
 | Packaged builtins | `dw/library.py`: `builtin_root`, `resolve_sub_workflow_reference` | `builtin:` names the packaged `dw/workflows/`, not the top-level `workflows/` examples. | `tests/test_sub_workflow_resolver.py::TestTheResolver::test_a_builtin_resolves_in_the_packaged_root` |
 | Sub-workflow paths | `dw/library.py`: `resolve_sub_workflow_reference`, `resolve_sub_workflow` | A sub-workflow path is confined to the root it resolves in. The search order is in the docstring of `resolve_sub_workflow`. | `tests/test_sub_workflow_resolver.py::TestTheResolver::test_a_path_escaping_its_root_is_refused` |
 | Workspace | `dw/workspace.py`: `resolve_workspace`, `set_workspace` | `--workspace` beats `DW_WORKSPACE`, which beats the setting, which beats a working directory that looks like a workspace, which beats `~/diffusers-workspace`. | `tests/test_workspace.py::TestResolution::test_a_flag_wins_over_everything`, `tests/test_workspace.py::TestResolution::test_a_bare_working_directory_falls_back_to_the_home_workspace` |
+| Workspace copy | `dw/workspace_copy.py`: `copy_between` | Copies runs and asset-library entries between workspaces under one root: media hard-linked, sidecars always copied, never a symlink; an asset keeps its library-relative path and its note and kept-shots entry are merged into the destination folder's sidecars; all or nothing, a differing asset refusing runs too; `vN` renumbered by `runs.copy_runs_in` under the run lock; entries checked by `security.validate_output_prefix`. | `tests/test_workspace_copy.py` |
 | Realized workflow | `dw/realize.py`: `realize_workflow`, `dw/runs.py`: `write_realized_workflow` | Each run directory holds `workflow.json`, with the run's arguments, seed and stored prompt text pinned. | `tests/test_realize.py::TestVariablesAndSeed::test_arguments_become_the_variable_defaults`, `tests/test_runs.py::TestRealizedWorkflow::test_the_run_directory_holds_a_realized_copy` |
 
 ## Runs and outputs
@@ -64,7 +67,9 @@ one to open.
 | Concept | Owner | Rule | Enforced by |
 | --- | --- | --- | --- |
 | Run directories | `dw/runs.py`: `open_run`, `workflow_identity`, `new_run_id` | Each execution writes into `<output_dir>/<identity>/<run id>/` with a `manifest.json`, unless the flat layout is chosen (the test pins the flat-layout exception). | `tests/test_runs.py::TestRunDirectories::test_the_flat_layout_writes_where_it_always_did` |
-| Run versions | `dw/runs.py`: `open_run`, `run_versions`, `record_run_versions` | A run takes its number once, when it opens, so deleting a middle run leaves a gap rather than renumbering. | `tests/test_runs.py::TestRunVersions::test_a_deleted_middle_run_leaves_a_gap_rather_than_renumbering`, `tests/test_runs.py::TestRunVersions::test_runs_started_in_the_same_second_still_number_upward` |
+| A file's role (final / intermediate / input) | `dw/roles.py` | Decided per step: result.role, then a final/intermediate subfolder, then data flow (a step a media-writing or unsaved consumer reads is intermediate). Engine records it at run end, with `role_declared` where result.role stated it; the server reports only recorded roles, so an older run has none. At read time the gallery (`GET /api/gallery`, its `role=` filter, the metadata route) also demotes a file a later run of the same workspace read - an `output:` input (an unpinned `latest` is the newest run started before the reader) or an `asset:` keep_output kept from it - unless its role was declared (`consumed_outputs`, `listed_role`, once per listing; no manifest is rewritten). | `tests/test_roles.py`, `tests/test_roles.py::test_a_file_a_later_run_read_is_consumed`, `tests/test_roles.py::test_listed_role`, `tests/test_gallery_roles.py::test_a_file_a_later_run_read_lists_as_intermediate`, `tests/test_gallery_roles.py::test_a_declared_final_stays_final` |
+| Notes on runs, files, assets, workspaces | dw/notes.py | notes.json beside what it describes (run dir or asset dir; a file's own note else the run's), workspace.json at a workspace root; only the server writes them, never the engine; ≤4000 chars, plain text. | tests/test_notes.py |
+| Run versions | `dw/runs.py`: `open_run`, `run_versions`, `record_run_versions`, `copy_runs_in` | A run takes its number once, when it opens (or, copied in from another workspace, when `copy_runs_in` places it), so deleting a middle run leaves a gap rather than renumbering. | `tests/test_runs.py::TestRunVersions::test_a_deleted_middle_run_leaves_a_gap_rather_than_renumbering`, `tests/test_runs.py::TestRunVersions::test_runs_started_in_the_same_second_still_number_upward` |
 | Run-version surfaces | `dw/runs.py`: `run_versions`, `dw/server/routes/gallery.py`, `dw/server/outputs.py`, `dw_mcp/tools_catalog.py`: `list_gallery`, `ui/src/lib/pages/GalleryPage.svelte` | Only `dw/runs.py` computes the number, and every other module reads it back. | `tests/test_runs.py::TestRunVersions::test_an_output_reference_can_name_a_run_by_its_version` |
 | Result subfolders | `dw/subfolders.py`: `subfolder_errors`, `dw/security.py`: `SUBFOLDER_PATTERN` | A step's `result.subfolder` is checked for shape at validation. | `tests/test_subfolders.py::TestValidationErrorsIntegration::test_validation_errors_reports_a_bad_subfolder` |
 | Template subfolder roles | `workflows/templates/`, `dw/workflows/` | Every saving step of a template is marked `final` or `intermediate`, with at least one `final`, and packaged builtins stay unmarked. | `tests/test_template_subfolders.py::test_every_saving_step_of_a_template_names_its_role`, `tests/test_template_subfolders.py::test_the_packaged_builtins_stay_unmarked` |
@@ -86,20 +91,22 @@ one to open.
 | Concept | Owner | Rule | Enforced by |
 | --- | --- | --- | --- |
 | Validation registry | `dw/validation.py`: `ERROR_CHECKS`, `WARNING_CHECKS`, `run_checks` | A check is one `Check` in a registry, and a check that raises becomes one `internal` finding while the rest still run. | `tests/test_validation.py::TestExceptionPolicy::test_a_raising_check_is_one_internal_error_and_the_rest_still_run` |
-| Step-value checks | `dw/step_value_checks.py`: `fps_errors`, `null_media_errors`, `select_errors`, `chain_prompts_errors` | The only caller of these checks is the error registry. | `dw/validation.py`: `ERROR_CHECKS` |
+| Step-value checks | `dw/step_value_checks.py`: `fps_errors`, `cache_errors`, `null_media_errors`, `select_errors`, `chain_prompts_errors` | The only caller of these checks is the error registry. | `dw/validation.py`: `ERROR_CHECKS` |
 | Admission | `dw/server/admission.py`: `admit` | Validate, submit, rerun and enhance load and check a request once, and `JobManager.submit` does not check it again. | `tests/test_admission.py::test_a_submit_expands_once` |
 | Variable constraints | `dw/variable_constraints.py`: `apply_constraints`; the grid arithmetic `aligned` / `aligned_down` | A model's rule about a value is declared in the workflow's `variable_constraints`, and it is checked at validation and again before anything loads. `plan_cuts` (and its static check) rounds render lengths through `aligned` / `aligned_down`, never its own copy, so a planned `num_frames` is one the template's constraint accepts; `crop_face_track` pads its crops to the step's `modulus`/`remainder` grid through `aligned` too (`padding_to_grid`). | `tests/test_variable_constraints.py::TestTheGrid::test_without_snap_an_off_grid_value_is_refused_not_rounded`, `tests/test_variable_constraints.py::TestTheGrid::test_plan_cuts_rounds_through_the_constraint_owner`, `tests/test_face_track.py::TestPadding::test_padding_to_grid_rounds_through_the_constraint_owner`, `tests/test_variable_constraints.py::TestTheRunTimePass::test_an_illegal_value_is_refused_before_anything_loads` |
-| Bound acknowledgement | `dw/plan.py`: `fingerprint`, `dw/server/admission.py`: `check_bound_acknowledgement` | A bound `acknowledged_cost` is refused with 409 when the plan's fingerprint or its required downloads changed. | `tests/test_server.py::TestBoundRerun::test_a_rerun_bound_to_a_stale_plan_is_refused`, `tests/test_server.py::TestBoundAcknowledgement::test_a_matching_fingerprint_queues` |
+| Bound acknowledgement | `dw/plan.py`: `fingerprint`, `dw/server/admission.py`: `check_bound_acknowledgement` | A bound `acknowledged_cost` is refused with 409 when the plan's fingerprint or its required downloads changed. The fingerprint is keyed only by what can change the output: `DOCUMENTATION_KEYS` (`cost`, `cost_drivers`, `vram_estimate`, descriptions, catalog shape/traits), a constraint's `reason` and a result's role, subfolder and file name are left out, of the workflow and of each composed child; every schema key is sorted into left out or kept. A number digests by value, not spelling (`12.0` as `12`), and the seed stays out (#85). | `tests/test_plan.py::TestFingerprintKeys::test_the_exclusion_lists_are_pinned`, `tests/test_plan.py::TestTheCatalogH3Template::test_a_client_round_trip_keeps_it`, `tests/test_plan.py::TestFingerprintKeys::test_every_top_level_schema_key_is_sorted`, `tests/test_server.py::TestBoundRerun::test_a_rerun_bound_to_a_stale_plan_is_refused`, `tests/test_server.py::TestBoundAcknowledgement::test_a_matching_fingerprint_queues` |
 | Per-repo gating | `dw/plan.py`: `build_plan` | Each gated repo, including a `loras` entry's repo, is probed and reported on its own. | `tests/test_plan.py::TestDownloadsRequired::test_a_gated_repo_this_token_lacks_access_to_is_blocked` |
 | Observed cost | `dw/server/observed_cost.py`: `declared_drivers`, `ObservedCosts._on_this_card`, `ObservedCosts.card` | `observed` comes only from this box's finished jobs on the named card (the one `route` names, for `plan.estimate`), else the server's own card; `ObservedCosts.card` owns a card's (kind, name, default). Rows are matched by card name whatever index they ran on (a job from before jobs carried a `device` counts only while the server is on the default card), and never writes `cost`. Cold and warm runs are reported separately. | `tests/test_observed_cost.py::TestColdIsNotWarm::test_the_two_are_reported_separately_each_with_its_runs`, `tests/test_observed_cost.py::TestByCard::test_only_rows_from_this_card_count_whichever_index_they_had`, `tests/test_observed_cost.py::TestByCard::test_rows_from_before_jobs_carried_a_device_do_not_count_off_the_default_card` |
-| The estimate | `dw/plan.py`: `estimate`, `_tempered` | `plan.estimate` quotes the observed figure ahead of the curated one, and blends it toward the curated figure below three runs. | `tests/test_plan.py::TestObservedEstimate::test_history_beats_a_curated_figure`, `tests/test_plan.py::TestLowConfidenceObservedEstimate::test_a_single_run_blends_toward_the_curated_figure` |
+| The estimate | `dw/plan.py`: `estimate`, `_tempered`; the driver scaling is `dw/cost_scaling.py`: `scale_curated`, `_driver_scaling` | `plan.estimate` quotes the observed figure ahead of the curated one, and blends it toward the curated figure below three runs. A `cost` entry is measured at the workflow's variable defaults; a run moving `num_inference_steps`, `width`/`height` or `num_frames` (per list entry, summed) scales it in proportion (`scale_curated`, which `dw/server/deps.py` reuses for an inherited figure), basis `derived` with `scaled` naming each axis, times the list-length re-price, and that scaled figure is what a thin observed one blends toward (#866). | `tests/test_plan.py::TestObservedEstimate::test_history_beats_a_curated_figure`, `tests/test_plan.py::TestLowConfidenceObservedEstimate::test_a_single_run_blends_toward_the_curated_figure`, `tests/test_plan.py::TestDriverScaling::test_steps_canvas_and_frames_multiply`, `tests/test_plan.py::TestScalingAccuracy::test_within_thirty_percent` |
 | Cost drivers | `dw/server/observed_cost.py`: `declared_drivers` | A cost driver that names no declared variable is dropped. | `tests/test_observed_cost.py::TestComparability::test_a_driver_naming_no_variable_is_dropped`, `tests/test_observed_cost.py::TestTheCatalogsDriversAreReal::test_every_declared_driver_is_a_variable_of_its_workflow` |
 | Raw workflow GET | `dw/server/routes/library.py`: `get_workflow` | The raw workflow GET is served verbatim, with no `observed`, because the editor saves what it reads. | — |
 | VRAM projection | `dw/vram_estimate.py`, `dw/guides.py`: `guide_lengths` | A template's `vram_estimate` is projected per step after `for_each` expansion, and only the largest step over the ceiling is reported. With `bytes_per_guide_voxel` declared, each guide the step lays in (its own non-null `guides` plus a guide chain's) adds its snapped frames times the canvas; an unprobeable clip is charged at `num_frames`, and validate, admission and run project the same number. | `tests/test_vram_estimate.py::test_only_the_largest_over_ceiling_step_is_reported_once_per_cost_entry`, `tests/test_vram_guides.py::test_validate_apply_and_required_agree_on_a_guided_definition` |
 | H3 Ref2VA VRAM numbers | `workflows/templates/minimax/` | Every Ref2VA template declares `base_gb` 16.0, `bytes_per_voxel` 28.71 and `gb_per_reference` 1.0. | `tests/test_h3_vram_ceiling.py::test_every_ref2va_minimax_template_declares_gb_per_reference` |
 | Inherited VRAM ceiling | `dw/vram_inheritance.py`, `dw/server/deps.py`: `ceiling_index` (the catalog parse is `_catalog_listing`, shared with the cost lookup below) | A workflow with no `vram_estimate` is matched against the catalog by pipeline identity, and is warned, never refused. | `tests/test_vram_inheritance.py::test_every_template_declaring_one_identity_declares_the_same_numbers` |
-| Inherited cost | `dw/server/deps.py`: `inherited_observed`, `dw/vram_inheritance.py`: `inherited_differences`, `dw/plan.py`: `_observed` (basis `inherited`), `dw/server/routes/jobs.py`: `_inherited_cost_warnings` | An inline workflow (no catalog name) is priced from the observed runs of the catalog template with the same `component_type` + `model_name` + `workflow` key as `vram_inheritance`; the template with the most cold runs wins, then name. `differs` lists offload, quantization and frame count set differently from the template. It is warned, never refused. | `tests/test_inherited_cost.py::TestPricedByPipelineIdentity::test_an_inline_copy_inherits_the_templates_runs`, `tests/test_inherited_cost.py::TestDifferences::test_offload_quantization_and_frames_are_named`, `tests/test_inherited_cost.py::TestThePlanReportsIt::test_the_estimate_is_inherited_and_the_validate_answer_warns` |
-| H3 adapter partition | `dw/adapter_compatibility.py` | An FL2VA LoRA on a reference step is refused, and a LoRA whose file name says neither `ref2v` nor `fl2v` is warned. | `tests/test_h3_adapters.py::TestWhatIsRefused::test_a_keyframe_adapter_on_the_reference_path`, `tests/test_h3_adapters.py::TestWhatIsRefused::test_an_unrecognised_name_is_a_warning_not_a_refusal` |
+| Inherited cost | `dw/server/deps.py`: `inherited_observed`, `dw/vram_inheritance.py`: `inherited_differences`, `dw/plan.py`: `_observed` (basis `inherited`), `dw/server/routes/jobs.py`: `_inherited_cost_warnings` | An inline workflow (no catalog name) is priced from the observed runs of the catalog template with the same `component_type` + `model_name` + `workflow` key as `vram_inheritance`; the template with the most cold runs wins, then name. `differs` lists offload, quantization, frame count, attention backend, cache, LoRA and reference count (the `references` list lengths, per-entry `item:` ones read off the `for_each` list; named, not scaled, #915) set differently from the template, and sets `low_confidence` when it lists any (#866). More pipeline steps than the template run (a `for_each` counted per member, against the list the bucket ran, so a fallback to the default bucket re-prices a longer list) re-price its minutes linearly, and the mean frames, inference steps, width and height per pipeline step are scaled by `scale_curated` itself - the one rule the catalog figure uses, so an inline copy and its template quote one request alike - with `scaled` naming why and `low_confidence` set (#851, #866). It is warned, never refused. | `tests/test_inherited_cost.py::TestPricedByPipelineIdentity::test_an_inline_copy_inherits_the_templates_runs`, `tests/test_inherited_cost.py::TestDifferences::test_offload_quantization_and_frames_are_named`, `tests/test_inherited_cost.py::TestDifferences::test_a_reference_count_other_than_the_templates_is_named`, `tests/test_inherited_cost.py::TestThePlanReportsIt::test_the_estimate_is_inherited_and_the_validate_answer_warns`, `tests/test_inherited_cost.py::TestTheTemplateAndAnInlineCopyAgree::test_the_same_minutes_within_rounding`, `tests/test_inherited_cost.py::TestAListLongerThanTheFallbackBucket::test_an_inline_six_shot_copy_scales_by_members` |
+| Projected host-RAM peak | `dw/server/host_ram_need.py`: `memory_key`, `projected_peak`, `host_memory_block`; the fit is `dw/host_memory_projection.py`: `projected_mb`; history by key is `dw/server/job_history.py`: `peaks_for_key` | A run's memory key is the sorted pipeline identity of its pipeline steps plus every `quantization_config` / `offload` / `group_offload` value, with arguments substituted through `replace_variables`; never the workflow's name, so a renamed or inline copy shares the template's history. `observed` is the max peak over this machine's successful same-key runs and comes ahead of the list-run fit, unless the shape holds its pipeline across the list and the fit is the larger (the key leaves list length out, #910); with neither there is no figure. It never refuses; dispatch may delay a start on it (`dw/server/dispatch.py`: `Dispatcher._next_dispatch`, #869) (`Admission.host_ram_need`, validate's `plan.host_memory`). | `tests/test_host_ram_need.py::TestMemoryKey::test_an_inline_copy_without_its_metadata_has_the_same_key`, `tests/test_host_ram_need.py::TestMemoryKey::test_a_different_weights_dtype_is_a_different_key`, `tests/test_host_ram_need.py::TestProjectedPeak::test_an_observed_peak_beats_the_fit`, `tests/test_host_ram_need.py::TestALongerListThanObserved::test_an_accumulating_list_takes_the_larger_fit`, `tests/test_host_ram_need.py::TestProjectedPeak::test_a_failed_run_is_not_observed`, `tests/test_host_ram_need.py::TestValidateRoute::test_an_observed_run_is_the_plans_host_memory` |
+| Acceleration warnings | `dw/acceleration_warnings.py`: `acceleration_warnings`, `CACHE_MIN_USEFUL_STEPS`, `CUDA_ONLY_ATTENTION_BACKENDS` (the last entry of `WARNING_CHECKS`) | An acceleration setting that can't pay off (a `first_block`/`mag` cache under `CACHE_MIN_USEFUL_STEPS`, any `taylorseer` cache, `compile.fullgraph` with a cache, a cache on a pipeline class with no transformer or whose transformer lacks `enable_cache()`, a CUDA-only `attention_backend` on a non-CUDA device) is a warning and never a refusal, and an unresolvable value (steps, backend, device) leaves it silent. | `tests/test_validation.py::TestAccelerationWarnings::test_warnings_never_refuse`, `tests/test_validation.py::TestAccelerationWarnings::test_steps_that_resolve_to_nothing_are_silent`, `tests/test_validation.py::TestAccelerationWarnings::test_an_unknown_device_is_silent`, `tests/test_validation.py::TestAccelerationWarnings::test_an_unresolvable_backend_is_silent_on_mps` |
+| H3 adapter partition | `dw/adapter_compatibility.py`; the server's index is `dw/server/deps.py` `lora_index` | The LoRA catalog decides first, on the server only: a `proven` entry's `workflow` refuses a step in the other partition, a `trial`/`rejected` entry's only warns. A file no entry places falls to its name: an FL2VA LoRA on a reference step is refused, and one whose name says neither `ref2v` nor `fl2v` is warned. | `tests/test_h3_adapters.py::TestWhatIsRefused::test_a_keyframe_adapter_on_the_reference_path`, `tests/test_h3_adapters.py::TestWhatIsRefused::test_an_unrecognised_name_is_a_warning_not_a_refusal`, `tests/test_h3_adapters.py::TestTheCatalogDecidesFirst::test_a_proven_entry_refuses_the_other_partition`, `tests/test_h3_adapters.py::TestTheCatalogDecidesFirst::test_a_weaker_entry_only_warns`, `tests/test_server_loras.py::TestTheCatalogPlacesAnAdapter::test_a_trial_entry_warns_and_promoting_it_refuses` |
 | H3 audio hold, refine and guide layout | Five modules, imported one way: `dw/pipeline_processors/h3_rules.py` holds the names and rules, torch- and diffusers-free (`refine_problems`, the per-argument refine rules asked before validation and before the call; `not_h3`, the step rule; `snap_guide_length`, `guide_frame_problem`, `guide_chain_problems`, `guide_end_problem`; `CHAIN_CONTINUITY_MODES`; the chunk constants), `dw/pipeline_processors/h3_hold.py` puts the hold and refine blocks in (`insert_audio_hold`, `core_denoise_sequences`, `refines`), and `dw/pipeline_processors/h3_guides.py` the guide layout (`LAYOUT_ANCHORS`, `insert_guides`), which imports `h3_hold` and never the reverse; the blocks themselves, and the arithmetic they run, are `dw/pipeline_processors/h3_hold_steps.py` (`encode_audio_span`, `refine_sigmas`) and `dw/pipeline_processors/h3_guide_steps.py` (`splice_guide_rows`), which import diffusers when they load, so the two owners import them only inside `blocks()` and `guide_blocks()` (#790), and `h3_guide_steps` imports `h3_hold_steps` and never the reverse (`_with_guides` in `dw/pipeline_processors/pipeline.py` adds its blocks for a `guides` call), `dw/guides.py`: the `guides` validation check and the chain `continuity: "guide"` check, `guide_chain_errors`, which asks the `guides` check's own step rule (`_takes_guides_problem`, built on `h3_rules.not_h3` and `REFERENCE_WORKFLOWS`) and reads the mode names from `h3_rules.CHAIN_CONTINUITY_MODES`, the names `chain.py`'s `CONTINUITY_MODES` is zipped against (both registered in `dw/validation.py`; a `previous_result:` guide is checked at run time), `dw/hold_audio.py`: `hold_audio_errors`, `refine_strength_errors` | The one place dw modifies a diffusers modular pipeline's block graph: three blocks go in, before `set_timesteps`, `denoise` and `after_denoise`, in every H3 core-denoise sequence (the whole graph and the `workflow=`-pruned flat graph), and they are no-ops without `hold_audio` / `refine_strength`. A `hold_audio` path is opened only after `locations.validate_media_path` against the step's workflow directory. `dw/introspection.py` builds the same graph without weights, hold included, so `get_pipeline_signature` lists a modular pipeline's block inputs. The copies of diffusers behaviour are pinned to the installed diffusers: `shifted_sigma_grid` (the spacing `refine_sigmas` rests on) to stock `set_timesteps`, `GUIDE_FRAMES_PER_CHUNK`/`GUIDE_LATENTS_PER_CHUNK` to the H3 video VAE's `clip_length` and latents per clip, and every name in `LAYOUT_ANCHORS` (`_fill_audio_positions` among them) to `before_denoise`. | `tests/test_h3_hold_audio.py::TestAnchors::test_inserted_next_to_the_anchors_in_every_shape`, `tests/test_h3_hold_audio.py::TestHoldAudioLocation::test_a_path_outside_the_roots_is_refused_at_the_call`, `tests/test_h3_hold_audio.py::TestRefusals::test_a_non_h3_step_is_refused`, `tests/test_h3_hold_audio.py::TestSignature::test_the_h3_signature_shows_hold_audio`, `tests/test_h3_refine.py::TestAnchors::test_inserted_before_denoise_in_every_shape`, `tests/test_h3_refine.py::TestSigmaGridDrift::test_the_full_grid_is_stock_set_timesteps`, `tests/test_h3_guides.py::TestChunkDrift::test_frames_per_chunk_is_the_vae_clip_length`, `tests/test_h3_guides.py::TestChunkDrift::test_latents_per_chunk_is_the_vae_tokens_per_clip`, `tests/test_h3_guides.py::TestAnchors::test_installed_diffusers_has_every_anchor`, `tests/test_guide_chain_validation.py::TestRefused::test_the_step_rule_is_the_guides_rule`, `tests/test_guide_chain_validation.py::TestRefused::test_every_run_mode_is_known_to_validate`, `tests/test_h3_rules.py::test_h3_rules_imports_neither_torch_nor_diffusers`, `tests/test_h3_rules.py::test_the_block_owners_import_no_diffusers` |
 | IC-LoRA reference scale | `workflows/templates/ltx2/` | The three conditioning templates run at `reference_downscale_factor: 1`, and the two upscalers at 2. | `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_reference_is_encoded_at_the_output_resolution`, `tests/test_ltx2_ic_loras.py::TestTheGenerativeUpscaleMatchesTheSameCard::test_it_loads_the_upscaler_at_factor_two` |
 | IC-LoRA numbers | `workflows/templates/ltx2/` | Every number in the IC-LoRA templates comes from the vendor's model card. | `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_strength_is_the_cards_default`, `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_defaults_are_the_trained_bucket` |
@@ -109,10 +116,10 @@ one to open.
 
 | Concept | Owner | Rule | Enforced by |
 | --- | --- | --- | --- |
-| Step cache | `dw/step_cache.py`, `dw/workflow_run.py`: `cache_lookup` | A seeded rerun with unchanged inputs is served from the cache, marked `reused: true`, and writes nothing; `POST /api/memory/clear` (`dw/server/routes/system.py`: `clear_memory`) drops it. | `tests/test_workflow_step_cache.py::test_cache_hit_marks_its_manifest_entry_and_event_reused`, `tests/test_workflow_step_cache.py::test_second_run_with_unchanged_step_reuses_cached_result` |
+| Step cache | `dw/step_cache.py`, `dw/workflow_run.py`: `cache_lookup` | A seeded rerun with unchanged inputs is served from the cache, marked `reused: true`, and writes nothing; `POST /api/memory/clear` (`dw/server/routes/system.py`: `clear_memory`) drops it. A step's key is only what can change its output: workflow metadata (`cost_drivers`, `vram_estimate`, descriptions) never reaches it and a result's `role` is dropped (`NON_OUTPUT_RESULT_KEYS`); attention backend, cache config, dtype and LoRA stay, and so do `subfolder` and `file_base_name`, because a hit republishes the cached paths. | `tests/test_workflow_step_cache.py::TestOutputKeys::test_the_exclusion_list_is_pinned`, `tests/test_workflow_step_cache.py::TestOutputKeys::test_metadata_alone_is_a_hit`, `tests/test_workflow_step_cache.py::test_cache_hit_marks_its_manifest_entry_and_event_reused`, `tests/test_workflow_step_cache.py::test_second_run_with_unchanged_step_reuses_cached_result` |
 | No seed, no cache | `dw/workflow_run.py`: `prepare_run` | A workflow that sets no `seed` skips the cache. | `tests/test_workflow_step_cache.py::TestCacheHits::test_an_unseeded_workflow_has_no_hits` |
 | A different result | `dw/server/routes/jobs.py`, `dw_mcp/tools_jobs.py`: `rerun_job` | `rerun` with `new_seed` draws a fresh seed into the workflow's seed variable. | `tests/test_rerun_new_seed.py::test_a_rerun_with_a_new_seed_draws_one_into_that_variable` |
-| Worker protocol | `dw/worker_protocol.py`: `parse_reply` | Every command and reply is a frozen dataclass that travels as a wire dict. | `tests/test_worker_messages.py::test_from_wire_inverts_to_wire`, `tests/test_worker_messages.py::test_an_unknown_reply_type_is_kept_whole_rather_than_raised` |
+| Worker protocol | `dw/worker_protocol.py`: `parse_reply` | Every command and reply is a frozen dataclass that travels as a wire dict. A run event's keys sit beside the wire's own `type`, so an event's `type` key (`cache_stats`' cache type) crosses as `event_type` and comes back as `type`. | `tests/test_worker_messages.py::test_from_wire_inverts_to_wire`, `tests/test_cache_stats.py::test_the_event_crosses_the_worker_wire_with_its_cache_type`, `tests/test_worker_messages.py::test_an_unknown_reply_type_is_kept_whole_rather_than_raised` |
 | Persistent worker | `dw/worker.py`, `dw/worker_manager.py`, `dw/serve.py` | Jobs run in spawned workers (one per card) that keep models loaded, so a change to engine code needs a server restart. | — |
 | Worker card pinning | `dw/devices.py`: `worker_environment`, `pinned_environment`, `resolve_serve_devices`, `check_device_present`, `label_of` | A worker named with a CUDA index is spawned with `CUDA_VISIBLE_DEVICES` set to that card and `DW_DEVICE=cuda` (a bare `cuda` pins nothing), so index-0 reads inside it measure its own card; `--devices`/`devices` takes one entry per worker (a card named twice, or a bare `cuda` in a list of several, is refused), a card the box lacks is refused at startup naming the cards present, and a job stores the card it ran on as `device_ordinal` and `device_card` (#693), job and history alike: rerun affinity reads the ordinal, observed cost buckets by the card, and the `device` label `"cuda:N <card name>"` is only `label_of` joining the two - nothing splits a label back apart. | `tests/test_worker_manager.py::TestWorkerPinning::test_a_cuda_index_pins_the_worker_through_the_environment`, `tests/test_worker_manager.py::TestWorkerPinning::test_a_bare_cuda_sets_no_pin`, `tests/test_serve_main.py::TestConfigureDevices::test_a_refusal_exits_with_code_2`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_the_machine_lacks_is_refused_naming_the_cards_present`, `tests/test_serve_main.py::TestResolveServeDevices::test_two_entries_are_both_kept`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_named_twice_is_refused` |
 | Failed-run reporting | `dw/worker.py`, `dw/worker_protocol.py`: `Failed`, `Cancelled` | A failed or cancelled run's reply still carries the manifest of the steps that ran. | `tests/test_worker_execute.py::test_failure_carries_the_manifest_of_the_steps_that_ran`, `tests/test_worker_execute.py::test_cancellation_carries_the_manifest_too` |
@@ -124,9 +131,11 @@ one to open.
 | Concept | Owner | Rule | Enforced by |
 | --- | --- | --- | --- |
 | Opening media | `dw/media.py` | This is the only module that calls `av.open`. It imports no torch and no step types. | `tests/test_media_layering.py::test_av_open_appears_only_in_media`, `tests/test_media_layering.py::test_media_imports_no_step_types` (no torch: —) |
+| Frame moments and crops | `dw/media_frames.py`: `moment_index`, `parse_crop` | One `at` grammar ("frame:N", or seconds at the clip's fps; negative counts back from the end for `get_output_frames` and is refused by `compare_outputs`) and one `[x, y, width, height]` crop parse serve `get_output_frames` and `compare_outputs`. Only the bounds policy is the caller's: `get_output_frames` refuses a moment past the end and clamps a crop (`_moment_to_index`, `resolve_crop_box`); `compare_outputs` blanks a past-end cell and refuses a crop that doesn't fit an output. | `tests/test_media_compare.py::test_resolve_moments_refuses_what_get_output_frames_refuses`, `tests/test_media_compare.py::test_crop_box_refuses_a_malformed_box_as_resolve_crop_box_does` |
+| Output comparison | `dw/media_compare.py`: `compare`, `psnr`, `ssim`, `mean_abs_diff`, `check_request`, `crop_box` | Metrics always compare the same pixels: one shared crop is the measured region, and per-output crops are display only, leaving metrics on the full frame. An output whose size differs from the baseline's, or a moment past its end, gets null metrics with a reason; nothing is resized to force a number. SSIM is on Rec. 601 luma (SSIM's convention, not `image_ops.luma`). It runs in the server process and decodes through `dw/media.py` and `open_bounded`. | `tests/test_compare_route.py::test_a_shared_crop_is_the_region_measured`, `tests/test_compare_route.py::test_per_output_crops_are_display_only`, `tests/test_compare_route.py::test_a_size_mismatch_gets_no_numbers_and_says_why`, `tests/test_compare_route.py::test_a_moment_past_the_shorter_clip_is_a_blank_cell` |
 | Signal processing | `dw/dsp.py` | It measures and transforms waveforms, decides nothing, and imports nothing from `dw`. | `tests/test_media_layering.py::test_dsp_imports_nothing_from_dw` |
 | Assessment probes | `dw/tasks/assess.py`, `dw/assessment_rules.py` | Exactly three registered commands are assessment probes. Each measures a finished file, and every rule names a real probe field. | `tests/test_assessment_rules.py::TestRuleProbesAreRealCommands::test_assessment_is_exactly_the_three_probes`, `tests/test_assessment_rules.py::TestRuleProbesAreRealCommands::test_every_rule_names_a_registered_json_command` |
-| Script check | `dw/tasks/script_check.py`: `check`; `dw/script_lines.py`: `parse_lines`, `parse_shots`, `shot_names_error` | `check_script` aligns a take's heard words to its expected lines and guards out words heard over silence and repetition loops (Whisper's hallucination over music). It builds its findings with `assessment_rules.finding()` and reads the guard's floor and window (`DEAD_AIR_FLOOR_DBFS`, `DEAD_AIR_WINDOW`) rather than copying them; the loudest-window measure is `dsp.loudest_window_dbfs` (`script_check.word_level` wraps it), which `transcribe_audio`'s `suspect: "silent"` mark reads with the same floor and window; the repetition-loop detector (`script_lines.looped_texts`, `REPEAT_RUN_MIN`, `REPEAT_MAX_PERIOD`) lives in `dw/script_lines.py` and backs both `check_script`'s `repetition` discard and `transcribe_audio`'s `suspect: "repetition"`, and `script_lines.suspect_runs`/`SUSPECT_LEFT_OUT` are what `plan_cuts` groups and leaves out suspect chunks by - so neither task imports the other. It is not an assessment probe and adds nothing to `RULES`. Its literal `lines` is refused at validation through `task_problems` (`script_lines_errors`), which calls the same `parse_lines` the task runs, and a literal `shots` through the same `parse_shots` and `shot_names_error`; the parsers live in `dw/script_lines.py`, not the task, so that `task_problems` reaches them without importing `script_check` (the `import_cycles` ratchet in `scripts/arch_metrics.py`). Its shot map comes from `assess.resolve_shots`, the one the probes use, never a copy; it places each shot on the soundtrack with `assess.sample_span`, decides repeated shot names with `shots.duplicate_shot_names`, and asks `locations.is_http_url` whether the take is a URL. | `tests/test_script_check.py::TestRegistration::test_registered_as_json_command_without_assessment_flag`, `tests/test_script_check.py::TestEmptyLines::test_words_only_over_silence_are_discarded_not_found`, `tests/test_script_check.py::TestLinesErrors::test_literal_with_a_colon_is_not_a_reference` |
+| Script check | `dw/tasks/script_check.py`: `check`; `dw/script_lines.py`: `parse_lines`, `parse_shots`, `shot_names_error` | `check_script` aligns a take's heard words to its expected lines and guards out words heard over silence and repetition loops (Whisper's hallucination over music). It builds its findings with `assessment_rules.finding()` and reads the guard's floor and window (`DEAD_AIR_FLOOR_DBFS`, `DEAD_AIR_WINDOW`) rather than copying them; the loudest-window measure is `dsp.loudest_window_dbfs` (`script_check.word_level` wraps it), which `transcribe_audio`'s `suspect: "silent"` mark reads with the same floor and window; the repetition-loop detector (`script_lines.looped_texts`, `REPEAT_RUN_MIN`, `REPEAT_MAX_PERIOD`) lives in `dw/script_lines.py` and backs both `check_script`'s `repetition` discard and `transcribe_audio`'s `suspect: "repetition"`, and `script_lines.suspect_runs`/`SUSPECT_LEFT_OUT` are what `plan_cuts` groups and leaves out suspect chunks by - so neither task imports the other. It is not an assessment probe and adds nothing to `RULES`. Its literal `lines` is refused at validation through `task_problems` (`script_lines_errors`), which calls the same `parse_lines` the task runs, and a literal `shots` through the same `parse_shots` and `shot_names_error`; the parsers live in `dw/script_lines.py`, not the task, so that `task_problems` reaches them without importing `script_check` (the `import_cycles` ratchet in `scripts/arch_metrics.py`). A line's `shot` may be the short `@name` of the one recorded shot that carries it (`script_lines.matching_shot_names`, `with_full_shot_names`, shared by the task and the literal-`shots` check); which member key a recorded name carries comes from `references.member_keys`, beside `MEMBER_SEPARATOR` and `for_each.member_name`, never a re-derived pattern: a key ends at the first character outside `references.VARIABLE_NAME_CHARACTERS`, the set `security.validate_variable_name` (which checks a for_each entry's name) builds its pattern from. With `audio` an `output:`/`asset:`/path whose run manifest records shots, `dw/shot_span_preflight.py: script_shot_name_errors` (the `script_shot_names` error check) runs `shot_names_error` at validation, reading the map through `runs.shots_beside`. Its shot map comes from `assess.resolve_shots`, the one the probes use, never a copy; it places each shot on the soundtrack with `assess.sample_span`, decides repeated shot names with `shots.duplicate_shot_names`, and asks `locations.is_http_url` whether the take is a URL. | `tests/test_script_check.py::TestRegistration::test_registered_as_json_command_without_assessment_flag`, `tests/test_script_check.py::TestEmptyLines::test_words_only_over_silence_are_discarded_not_found`, `tests/test_script_check.py::TestLinesErrors::test_literal_with_a_colon_is_not_a_reference`, `tests/test_script_check.py::TestShotValidation::test_a_short_member_name_matches_the_one_shot_carrying_it`, `tests/test_script_check.py::TestShotValidation::test_a_valid_variable_name_comes_back_whole_as_a_member_key`, `tests/test_shot_span_preflight.py::TestScriptShotNames::test_a_wrong_shot_name_is_an_error_at_validate_time` |
 | Audio sync against a source slice | `dw/tasks/measure_sync.py`: `measure_sync`; `dw/dsp.py`: `envelope_lag` | `measure_sync` cross-correlates the onset envelopes of a shot's audio and its source slice and answers the lag and a 0-1 confidence. A positive lag means the audio is LATE (its events fall after the reference's), negative early; `lag_seconds` is None for a silent or flat track. It builds its findings (`sync_unmeasurable`, `sync_low_confidence`, `audio_out_of_sync`) with `assessment_rules.finding()` over module-local rule dicts and adds nothing to `RULES`; it reads the silence floor from `beats.SILENT_DBFS`. `envelope_lag` imports nothing from `dw`. | `tests/test_measure_sync.py::TestLag::test_late_audio_is_a_positive_lag`, `tests/test_measure_sync.py::TestLag::test_early_audio_is_a_negative_lag`, `tests/test_measure_sync.py::TestUnmeasurable::test_a_silent_reference_has_no_lag` |
 
 ## Security and architecture guardrails
@@ -150,12 +159,12 @@ one to open.
 | App factory | `dw/server/app.py`: `create_app` | `create_app` builds the JobManager and `app.state`, installs the middleware and registers the routes, and all state lives in the JobManager. | — |
 | Routers | `dw/server/routes/*.py`, `dw/server/routes/__init__.py`: `ROUTERS`, `include_routers`, `include_file_routes` | Routers register in `ROUTERS` order, because a greedy `{name:path}` route must come after its specific siblings. The files router comes later, after `/mcp`. | `tests/test_server_downloads.py::test_download_workflow_sets_content_disposition_attachment` |
 | Job queue | `dw/server/jobs.py`: `JobManager`; `dw/server/job_results.py`: `consume_results` | A dispatcher thread hands queued jobs, in queue order, to the pool's workers (`Worker pool dispatch`); each worker runs one job at a time, and `consume_results` folds that worker's replies into the job, naming files relative to the job's own `output_dir`. A job carries its own `output_dir`, `asset_dir` and `workflow_dir`, so it stays in its workspace. | `tests/test_server_workspaces.py::TestRunning::test_rerun_stays_in_the_workspace_it_ran_in` (FIFO: —) |
-| Worker pool dispatch | `dw/server/jobs.py`: `JobManager._next_dispatch`; `dw/server/pool.py`: `WorkerSlot`, `check_fits`, `largest_ceiling_gb`; `dw/vram_estimate.py`: `required_vram_gb`; `dw/server/admission.py`: `pool_capacity` | `--devices` runs one worker per card; a queued job goes to a free card that fits what it needs (none starts while a cache clear holds dispatch, `dw disk caches`), a job that fits no free card keeps its place while a smaller one behind it takes the card, a job bigger than every card is refused at submit, and cancel or a crash touches only the worker running that job. On a backend no `cost` entry describes, a declared `vram_estimate` is held at admission to the pool's largest card, so a job the first card cannot hold is not refused when a larger card can hold it. | `tests/test_worker_pool.py::TestConcurrency::test_two_workers_run_two_jobs_at_once`, `tests/test_worker_pool.py::TestBackfill::test_a_job_too_big_for_the_free_card_waits_while_a_smaller_one_takes_it`, `tests/test_worker_pool.py::TestFitAtSubmit::test_a_job_too_big_for_every_card_is_refused_naming_the_largest`, `tests/test_worker_pool.py::TestCancel::test_cancel_reaches_the_worker_running_the_job`, `tests/test_worker_pool.py::TestCrashIsolation::test_a_crashed_worker_fails_only_its_own_job`, `tests/test_worker_pool.py::TestOomRanking::test_the_later_started_worker_is_ranked_first`, `tests/test_worker_pool.py::TestFitAtSubmit::test_a_job_only_the_larger_card_holds_is_admitted` |
+| Worker pool dispatch | `dw/server/dispatch.py`: `Dispatcher._next_dispatch`, `Dispatcher._host_ram_wait` (mixed into `JobManager`); `dw/server/pool.py`: `WorkerSlot`, `check_fits`, `largest_ceiling_gb`, `host_ram_wait`; `dw/vram_estimate.py`: `required_vram_gb`; `dw/server/admission.py`: `pool_capacity` | `--devices` runs one worker per card; a queued job goes to a free card that fits what it needs (none starts while a cache clear holds dispatch, `dw disk caches`), a job that fits no free card keeps its place while a smaller one behind it takes the card, a job bigger than every card is refused at submit, a job that fits a free card is also held while its projected host-RAM peak exceeds `MemAvailable` less what running jobs have yet to add plus the idle worker's own RSS (a job alone is never held, no figure or no RAM reading means no gate, a smaller job behind a held one starts, and the dispatcher re-checks every 10 s; #869), and cancel or a crash touches only the worker running that job. On a backend no `cost` entry describes, a declared `vram_estimate` is held at admission to the pool's largest card, so a job the first card cannot hold is not refused when a larger card can hold it. | `tests/test_worker_pool.py::TestConcurrency::test_two_workers_run_two_jobs_at_once`, `tests/test_worker_pool.py::TestBackfill::test_a_job_too_big_for_the_free_card_waits_while_a_smaller_one_takes_it`, `tests/test_worker_pool.py::TestFitAtSubmit::test_a_job_too_big_for_every_card_is_refused_naming_the_largest`, `tests/test_worker_pool.py::TestCancel::test_cancel_reaches_the_worker_running_the_job`, `tests/test_worker_pool.py::TestCrashIsolation::test_a_crashed_worker_fails_only_its_own_job`, `tests/test_worker_pool.py::TestOomRanking::test_each_dispatch_scores_its_worker_highest`, `tests/test_worker_pool.py::TestFitAtSubmit::test_a_job_only_the_larger_card_holds_is_admitted`, `tests/test_worker_pool.py::TestHostRamGate::test_a_job_the_host_cannot_hold_beside_the_running_one_is_held`, `tests/test_worker_pool.py::TestHostRamGate::test_a_job_alone_is_never_held`, `tests/test_worker_pool.py::TestHostRamGate::test_a_smaller_job_starts_past_a_held_one` |
 | Card affinity | `dw/server/pool.py`: `choose_slot`; `dw/server/jobs.py`: `JobManager.route`; `dw/worker_protocol.py`: `workflow_identity` | Among the free cards a job fits it goes to the rerun's original card, else the card whose worker last ran its workflow identity (`workflow_identity`, the one rule the worker caches by too), else one with no worker running, else the first in `--devices` order; a cache probe and `plan.estimate` (`priced_for`) ask about the card `route` names, and memory is read and cleared per card. | `tests/test_worker_pool.py::TestIdentityAffinity::test_a_second_run_lands_on_the_card_that_ran_the_workflow_first`, `tests/test_worker_pool.py::TestRerunAffinity::test_a_rerun_lands_on_the_original_card_when_it_is_free`, `tests/test_worker_pool.py::TestProbeRouting::test_the_probe_goes_to_the_worker_the_job_would_be_routed_to`, `tests/test_worker_pool.py::TestMemoryPerCard::test_a_named_card_running_a_job_is_refused_though_the_other_is_idle` |
 | Per-card memory and cache | `dw/server/worker_memory.py`: `memory_status`, `clear_memory`, `probe_cache` | Each card keeps its own last memory reading; an idle card's worker is asked live, a busy one answers with the run's last report and says why it is not live, and a clear leaves a card running a job alone. Every request takes the card's lock with a bounded wait, and a card's lock is never taken while the JobManager's lock is held. | `tests/test_worker_pool.py::TestMemoryPerCard::test_a_named_card_running_a_job_is_refused_though_the_other_is_idle`, `tests/test_worker_pool.py::TestProbeRouting::test_the_probe_goes_to_the_worker_the_job_would_be_routed_to`, `tests/test_server.py::test_memory_says_why_a_reading_is_not_the_worker_s` |
 | dw disk caches | `dw/disk_caches.py`; `dw/server/jobs.py`: `JobManager.hold_dispatch`; `dw/server/routes/system.py`: `clear_cache`, `delete_cache_entry` | Members `inductor`, `triton`, `quantized`. Clear only a root carrying the `.dw-cache` marker, never while a job is running or queued (`quantized` also not during a model download); an entry delete takes only a 64-hex id, checked before any path is built; clear renames into `.clearing-*` then deletes. The busy check and the dispatch hold are one step in `JobManager.hold_dispatch`, kept for the whole clear or entry delete: a job submitted meanwhile is accepted but stays queued until it ends. | `tests/test_disk_caches.py`, `tests/test_disk_caches.py::test_job_submitted_during_a_clear_waits_for_it` |
 | Job-to-run link | `dw/server/job_record.py`, `dw/server/jobs.py`: `JobManager.realized` | A job records `run_id`, `run_dir` and `run_version`, and `JobManager.realized` reads that run's `workflow.json`, confined to the output root. | `tests/test_server_jobs.py::test_realized_reads_the_file_the_run_wrote`, `tests/test_server_jobs.py::test_realized_refuses_a_run_dir_that_escapes_the_output_root` |
-| Job history | `dw/server/job_history.py`: `JobHistory` | Finished jobs persist in `jobs.sqlite`, in WAL mode, so the Jobs view survives a restart. | `tests/test_server.py::test_job_history_survives_restart_and_reruns`, `tests/test_job_history_wal.py::test_the_jobs_database_uses_wal_mode` |
+| Job history | `dw/server/job_history.py`: `JobHistory`, `_ADDED_COLUMNS` | Finished jobs persist in `jobs.sqlite`, in WAL mode, so the Jobs view survives a restart. A database from an older release gains each column it lacks from the `_ADDED_COLUMNS` table when it is opened. | `tests/test_server.py::test_job_history_survives_restart_and_reruns`, `tests/test_job_history_wal.py::test_the_jobs_database_uses_wal_mode`, `tests/test_server_jobs.py::test_a_v0_13_0_database_gains_the_columns_added_since` |
 | HTTP security | `dw/server/http_security.py`: `install_middleware`, `query_token_ok` | Every API route needs the token, and only a route marked `query_token_ok` takes it as `?token=`. | `tests/test_security_auth.py::TestTheTokenGate::test_every_api_spelling_needs_the_token`, `tests/test_security_auth.py::TestTheTokenGate::test_the_query_token_is_refused_where_it_is_not_allowed` |
 | Prompt enhancement | `dw/server/enhancers.py`: `PRESETS`, `_T2I_SYSTEM_PROMPT` | `PRESETS` is the Enhance panel's menu (label, curated LLMs, preselect hints); a preset's family-specific knowledge, its spec, lives in a builtin under `dw/workflows/`, never in Python. `t2i`'s generic, family-agnostic system prompt stays in Python. A third preset moves the menu into builtin metadata (#696). | `tests/test_prompt_library.py::test_every_enhancer_preset_targets_a_known_family`, `tests/test_server.py::TestEnhance::test_presets_are_listed`, `tests/test_server.py::TestEnhance::test_enhance_workflows_are_schema_valid`, `tests/test_server.py::TestEnhance::test_an_unknown_preset_is_a_client_error` |
 
@@ -190,6 +199,6 @@ one to open.
 | The editors' document | `ui/src/lib/editorShell.svelte.ts`: `DocumentEditor` | The workflow and prompt editors keep one rule each for the view (remembered per editor), the JSON draft (a failed parse pins it), dirty against the last load or save, the save path, and the tab-close guard. | `ui/src/lib/editorShell.test.ts`, `ui/src/lib/pages/PromptEditorPage.test.ts`, `ui/src/lib/pages/EditorPage.test.ts` |
 | UI polling | `ui/src/lib/poll.ts`: `poll`, `sleep` | A page that refreshes on a timer starts it through `poll` and stops it with the function `poll` returns. | `ui/src/lib/poll.test.ts` |
 | Workspace state in the UI | `ui/src/lib/workspaceState.svelte.ts`: `workspace` | The current workspace is one `$state`; `api.ts` reads it from here, so the request layer imports no page state. | `import_cycles` in `ui/scripts/arch-metrics.mjs` |
-| The UI's response contract | `dw/server/api_models.py`: `ApiModel`, `send_rejected_responses`; `scripts/dump_openapi.py` | Every JSON route `api.ts` calls declares a response model, and `types.ts` re-exports the types generated from it (`ui/src/lib/generated/`). The payload does not change: an absent key stays absent (`response_model_exclude_unset`), a sometimes-sent key is `sometimes()`. Runtime is lenient - an undeclared key passes and a rejected response is logged and sent as built; tests, the e2e server and the dump run strict (`DW_STRICT_RESPONSES=1`). The document is generated under the FastAPI and Pydantic `constraints-openapi.txt` pins: CI installs them, and the dump refuses to write under others. | `tests/test_api_contract.py`, `tests/test_ui_twins.py::test_every_json_route_the_ui_calls_declares_its_response`, CI's "Response contract" step |
+| The UI's response contract | `dw/server/api_models.py` (the models; it re-exports `dw/server/api_models_base.py`: `ApiModel`, `send_rejected_responses`, and the library routes' models in `dw/server/api_models_library.py`); `scripts/dump_openapi.py` | Every JSON route `api.ts` calls declares a response model, and `types.ts` re-exports the types generated from it (`ui/src/lib/generated/`). The payload does not change: an absent key stays absent (`response_model_exclude_unset`), a sometimes-sent key is `sometimes()`. Runtime is lenient - an undeclared key passes and a rejected response is logged and sent as built; tests, the e2e server and the dump run strict (`DW_STRICT_RESPONSES=1`). The document is generated under the FastAPI and Pydantic `constraints-openapi.txt` pins: CI installs them, and the dump refuses to write under others. | `tests/test_api_contract.py`, `tests/test_ui_twins.py::test_every_json_route_the_ui_calls_declares_its_response`, CI's "Response contract" step |
 | Where `--live` appears | `ui/src/app.css` (its header) | The state colour marks machine state only, in the files `ui/scripts/design-rules.test.ts` lists. | `ui/scripts/design-rules.test.ts` |
 | UI architecture ratchet | `ui/scripts/arch-metrics.mjs` | No metric rises above `docs/stabilization/ui/baseline.json`. | the `ui` job in `.github/workflows/ci.yml`; `npm run preflight` |
diff --git a/docs/LORAS.md b/docs/LORAS.md
index 788cf6cb..5aa164c0 100644
--- a/docs/LORAS.md
+++ b/docs/LORAS.md
@@ -165,8 +165,14 @@ exact - an adapter on the wrong base usually loads and is quietly worse.
 (the turbo keyframe files are `["t2va", "fl2va"]`). `proven` and `rejected` entries need `evidence`; a rejected
 entry's first note is why. The schema is `GET /api/lora-schema`.
 
+The server's validate enforces that `workflow` (#870): a step whose workflow
+sits in the other partition is refused when the entry is `proven`, and only
+warned when it is `trial` or `rejected`. Without a covering entry the file
+name decides (`ref2v` / `fl2v`), as in `dw/adapter_compatibility.py`.
+
 Promotion: a trial that worked is saved with `save_lora` (or
-`PUT /api/loras/{name}`) as `proven`, its job id in `evidence`.
+`PUT /api/loras/{name}`) as `proven`, its job id in `evidence`. Promoting
+it is also what makes its `workflow` refuse a mismatched step.
 
 ## Finding LoRAs on the Hub
 
diff --git a/docs/MCP.md b/docs/MCP.md
index 820c4831..436c0bbb 100644
--- a/docs/MCP.md
+++ b/docs/MCP.md
@@ -187,7 +187,7 @@ Nothing in this sequence costs GPU time.
 
 ## Tool reference
 
-62 tools in six groups. Names and arguments below are transcribed from
+65 tools in six groups. Names and arguments below are transcribed from
 `dw_mcp/tools_*.py` — nothing here is renamed or reshaped for the docs.
 
 ### Catalog (read-only)
@@ -203,7 +203,9 @@ a request nothing on disk covers.
 The instructions also say the engine runs **one job per GPU** - one worker
 per `dw.serve --devices` card, each running its own job from the one shared
 queue - and point at `get_health`'s `workers` for what each card is running.
-A job record's `device` (`get_job`, `list_jobs`) names the card it ran on.
+A job record's `device` (`get_job`, `list_jobs`) names the card it ran on,
+and a job started by `rerun_job` carries `rerun_of`, the id of the job it
+reran (absent on a fresh submit).
 
 A request usually names a *subject* ("a lego movie trailer set in the marvel
 universe") while the catalog is written in *shapes* - a single image, an image
@@ -230,8 +232,8 @@ when no single workflow covers it.
 | `get_memory()` | `device` | Get VRAM and RAM statistics: `workers` has one reading per card (the top level repeats the first card's), and `device` (`cuda:1`) asks for that card alone. `gpu_*` is the card; `host_memory_rss_mb` / `host_memory_peak_rss_mb` are the worker process's resident and high-water host memory, beside the machine's `host_memory_total_mb` / `host_memory_available_mb`; on Linux `host_memory_rss_anon_mb` / `host_memory_rss_file_mb` split the resident figure into memory the worker owns and mapped-file pages (memory-mapped checkpoint weights) the kernel can drop, so a loader that maps rather than copies raises the resident and peak figures without raising committed memory (#709) - read both, since an offloading workflow keeps its weights in host RAM and the card says little about what it holds (a host field is absent, not null, where the platform cannot measure it). `host_pinned_reserved_mb` / `host_pinned_allocated_mb`, when present, are torch's pinned-host cache - the staging buffers group offloading moves weights through, part of `host_memory_rss_mb` and invisible in every `gpu_*` figure, which is what a worker holding GB after releasing every model is usually holding (#98). `live: true` means `info` was measured now and is the worker's own memory; only live readings are comparable with each other. `live: false` with `info: null` (and `stale: false`) means nothing has been measured because nothing is resident; `live: false` with a populated `info` is a cached earlier reading, with `reason` (`job_running`, `worker_stopped`, `worker_busy`, `worker_unreachable`) and `age_seconds` - one cached while a job loads a model understates what is resident, so ask again when the card is idle rather than comparing it with a live figure |
 | `get_health()` | — | Check that the server is alive, and which machine answered: `version`, `device`, whether any model process is resident (`worker_alive`), and the queue depth. The engine runs one job per GPU: `workers` has one entry per card - `device`, `name`, `vram_gb`, `alive`, its own `current_job`, and the worker's `host_memory_rss_mb` while it runs - and the top-level `current_job` is the longest-running job. `worker_alive: false` is the normal idle state on a server that has not run a job since startup or the last memory clear - not a fault - the on-demand worker starts with the next job (#206) |
 | `get_server_info()` | — | What this installation can do and where it keeps things: `device` (the accelerator a run will use), `version`, the `workspace` this session is working in and the workflow/asset/output/prompt `directories` of *that* workspace, the bind address and port, whether a token is required, and whether MCP is mounted. Check the device before authoring - a CUDA-only choice (bitsandbytes, `torch.compile`, flash attention) is not available on an `mps` or `cpu` server. `runtime` (#222) reports the Python version, torch version and the CUDA version torch was built against, the NVIDIA driver version (when `nvidia-smi` is reachable), and the installed versions of diffusers, transformers, accelerate, bitsandbytes, peft, safetensors and sentencepiece (`null` for one not installed) - for diagnosing an environment mismatch between boxes without shelling in. `caches` lists dw's disk caches (`inductor`, `triton`, `quantized`), each with `name`, `bytes`, `files`, `enabled`, `clearable` and `disk_free`, plus `entry_count` for a cache with entries, and `cache_entries=true` lists them (`id`, `model`, `subfolder`, `component`, `bytes`, `files`, `unreadable`, `created`, `last_hit`; the quantizer and dtype are not in `/api/caches`); it is omitted when the server has no `/api/caches`. There is no MCP tool to clear one - that is `DELETE /api/caches/{name}` or `.../entries/{entry}` ([SERVER.md](SERVER.md)) |
-| `list_jobs(limit=20, status=None, workspace=None)` | optional `limit` (newest N), `status` (one state or a comma-separated set of `queued`, `running`, `succeeded`, `failed`, `cancelled`), `workspace` | List queued, running and recent jobs, **newest first**. Bounded by default: the unbounded listing was over a client's tool-result limit on a server with a few months of history, which made it a tool that could not be called at all. `total` says how many matched and `truncated`/`next` say so when the answer was cut - raise `limit` or narrow with `status`. Without `workspace`, a named workspace lists its own jobs and the default one lists every job the server holds |
-| `list_gallery(limit=50, subfolder=None, only_orphans=False, workspace=None, folder=None, version=None)` | `limit`, `subfolder`, `only_orphans`, `workspace`, `folder`, `version` | List generated output files, newest first. A name is `<workflow>/<run id>/<file>`, where `<file>` may sit in the subfolder the step chose (`final/episode.mp4`); each entry carries `folder` (the workflow) and `subfolder` (by convention `final` or `intermediate`, `''` when the step chose none, any path the workflow wrote otherwise), and `subfolder="final"` lists only deliverables. Each entry carries `run_id` and `version` - that run's ordinal among the workflow's runs, which is how one of several runs that wrote the same basename is named to a person: the web UI labels the same file `v5`. The number is assigned when the run opens and never renumbered, so deleting a run leaves a gap rather than sliding the rest down (a failed run, or a rerun that reused every step, leaves one too - it took a number and may have nothing to list), and it is `null` under the flat output layout, which has no runs. `folder` with `version` lists that one run's files, and `output:<folder>/v5/<file>` names one in a workflow; every other tool takes `name`. Each entry also carries a ready-made `url`, already scoped to the workspace that made it - a hand-built `/outputs/<name>` URL 404s for anything but the default workspace. `only_orphans=True` inverts the call: instead of files, it returns run directories with no media anywhere under them (`runs`, each `{name, mtime}`) - a run whose output was deleted before `delete_output` could remove it by name, or one that failed before writing anything; `subfolder` does not apply in this mode, and `name` is exactly what `delete_output` accepts (#170). `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
+| `list_jobs(limit=20, status=None, workspace=None)` | optional `limit` (newest N), `status` (one state or a comma-separated set of `queued`, `running`, `succeeded`, `failed`, `cancelled`), `workspace` | List queued, running and recent jobs, **newest first** (a queued job held for host RAM carries `waiting_for`). Bounded by default: the unbounded listing was over a client's tool-result limit on a server with a few months of history, which made it a tool that could not be called at all. `total` says how many matched and `truncated`/`next` say so when the answer was cut - raise `limit` or narrow with `status`. Without `workspace`, a named workspace lists its own jobs and the default one lists every job the server holds |
+| `list_gallery(limit=50, subfolder=None, only_orphans=False, workspace=None, folder=None, version=None, media=False, role=None)` | `limit`, `subfolder`, `only_orphans`, `workspace`, `folder`, `version`, `media`, `role` | List generated output files, newest first. A name is `<workflow>/<run id>/<file>`, where `<file>` may sit in the subfolder the step chose (`final/episode.mp4`); each entry carries `folder` (the workflow) and `subfolder` (by convention `final` or `intermediate`, `''` when the step chose none, any path the workflow wrote otherwise), and `subfolder="final"` lists only deliverables. Each entry also carries `role`, `final` or `intermediate` (null for a flat-layout file with no run; `intermediate` once a later step or a later run read the file, unless `result.role` declared it); `role=["final"]` lists only those, and the `role` filter defaults to every file. See `dw/roles.py` for how a role is decided. A file starred in the web UI's gallery (its keep mark) carries `starred: true`; an unstarred one carries no `starred`. Each entry carries `run_id` and `version` - that run's ordinal among the workflow's runs, which is how one of several runs that wrote the same basename is named to a person: the web UI labels the same file `v5`. The number is assigned when the run opens and never renumbered, so deleting a run leaves a gap rather than sliding the rest down (a failed run, or a rerun that reused every step, leaves one too - it took a number and may have nothing to list), and it is `null` under the flat output layout, which has no runs. `folder` with `version` lists that one run's files, and `output:<folder>/v5/<file>` names one in a workflow; every other tool takes `name`. Each entry also carries a ready-made `url`, already scoped to the workspace that made it - a hand-built `/outputs/<name>` URL 404s for anything but the default workspace. `only_orphans=True` inverts the call: instead of files, it returns run directories with no media anywhere under them (`runs`, each `{name, mtime}`) - a run whose output was deleted before `delete_output` could remove it by name, or one that failed before writing anything; `subfolder` does not apply in this mode, and `name` is exactly what `delete_output` accepts (#170). `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `get_gallery_metadata(name, envelope=False, workspace=None, interval_seconds=None)` | `name`, `workspace` | Get the metadata embedded in a generated file — or, when `name` is an `asset:` reference, what an *input* asset holds (`source` says which; `job` is null for an asset). Reading an input's duration, frame count, fps and sample rate before a run is how a caller learns the `total_frames`, `fps` and `sample_rate` a workflow expects it to supply: the exact workflow and arguments that produced it, and, for audio/video, a `media` block (duration, rate, channels, fps, size, peak/mean dBFS) and `findings` - each level problem the server measured against `dw/audio_qc.py`'s thresholds (`full_scale`, `near_silent`), with the fix. Only an image (PNG/JPEG/WebP) embeds `metadata` this way — it is always null for audio and video, and `next` then points at `get_job_workflow(job_id)` when `job` is known, or says a kept asset carries no provenance at all when it isn't. `envelope=true` adds `media.envelope` — `rms_dbfs` and `peak_dbfs` one entry per second, or per `interval_seconds` (default 1.0, 0.05 to 3600; 0.1 places a vocal onset; a finer-than-default width that would need over 2400 bins is refused with the interval that fits) — which is what locates something in a track rather than measuring the whole of it. `media.shots` is set on an output joined from shots: one `{name, start_frame, num_frames, start_sample, num_samples}` per shot, as the join measured them (see the run manifest in docs/WORKFLOW_GUIDE.md), else null. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 
 ### Media
@@ -243,6 +245,7 @@ when no single workflow covers it.
 | `get_output_frames(name, at=None, seams=None, count=None, boundaries=None, names=None, max_dimension=512, hear=None, workspace=None)` | `name`, `at`, `seams`, `count`, `boundaries`, `names`, `max_dimension`, `hear`, `workspace` | See a generated video as frames, since there is no video content type over MCP (#193). One selector per call: `count` for an evenly spaced contact sheet, `at` for moments (seconds or `"frame:N"`), `seams` (true, or seam numbers from 1) for the last frame before and first frame after each join side by side (each pair carries `difference`, the mean pixel change across the join, 0-255 - rank seams by it and look at the worst). `boundaries` and `names` are modifiers of `seams` only - passing either alongside `at` or `count` is refused, naming the offending argument(s). On an output joined from shots (`concat_videos`, `dissolve_videos`, a chained step) `seams` alone is enough: the seams and their names are the `media.shots` its run recorded. For any other file pass `boundaries` - each later shot's first frame, the running sum of the shots' `frame_count` from `get_gallery_metadata` on their own `intermediate/` files - and `names` to name them; either one given overrides the recorded value. Tiles are fitted to `max_dimension` and, when the set would exceed the 4MB budget, shrunk together rather than dropped; the text part lists each tile and says so. `hear=N` also returns N seconds of soundtrack centred on each `at` moment, after its image - the way to check a hit point or lip-sync without reconciling two clocks; a mute clip keeps its frames and says `no soundtrack` |
 | `get_output_text(name, max_characters=20000, workspace=None)` | `name`, `max_characters`, `workspace` | Read a text output — a prompt enhancement, or any step whose result is `text/plain` or JSON. Reports the file's real length and whether it was truncated. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `assess_output(name, probe=None, detail=False, workspace=None)` | `name` (a gallery name or `asset:`), `probe`, `detail`, `workspace` | Measure a finished cut on the server, without queueing: the assessment probes (`analyze_shots`, `analyze_seams`, `analyze_sync_drift`) run in the server process over one decode of the file, beside whatever job holds the GPU. Shot boundaries are the ones its run recorded (the manifest for an output, the `keep_output` sidecar for an asset). The answer merges every applicable probe's `findings` (`{rule, severity, at, value, threshold, says}`) with `rules_applied`, `rules_skipped` and `not_applicable` (`{probe: why}` - a still, a mute file, a file with no recorded shots); `detail=true` adds each probe's full body under `probes`, and `probe=` returns that one probe's full body. `probe` is checked against the three names before anything else is read, and an unknown one is refused naming them. Findings are places to look, not verdicts: drill in with `get_output_frames(seams=[n])` / `get_output_audio(start, duration)`. See *Assessing a run's output* in docs/WORKFLOW_GUIDE.md |
+| `compare_outputs(names, at=None, crop=None, baseline=None, max_dimension=384, workspace=None)` | `names`, `at`, `crop`, `baseline`, `max_dimension`, `workspace` | Read-only, queues nothing: 2-8 outputs (gallery names or `asset:`) as one grid, a row per output (labelled with its row number and short name, `(baseline)` on the baseline) and a column per moment, each cell stamped `frame N`, with PSNR, SSIM and mean absolute difference against `baseline` (default the first name). `at` is 1-8 moments (seconds or `"frame:N"`, never negative: unlike `get_output_frames`, a negative moment is a 400, not counted back from the end); they resolve to one frame index against the baseline (the first video if the baseline is a still) and every output is read at that same frame number; default 4 evenly spaced frames of the shortest video. A frame past an output's end is a blank cell and its metrics cell says `past end (N frames)`; `fps_differs` flags videos with different frame rates, where the same frame number is not the same second. All stills: one column, `at` ignored with a note; a still among videos repeats in every column. Metrics are per non-baseline output at source resolution: `psnr_db` (`identical` when equal), `ssim` (luma, 11x11 Gaussian window, sigma 1.5) and `mean_abs_diff` (0-255), per column and as mean/min/max. `crop` is `[x,y,w,h]`: one shared box is the region shown and measured (`region` reads `crop [...]`); a list of one box per name is display only and metrics stay on the full frame (no crop is `full frame`). A crop must lie wholly inside every output's frame, else 400 (stricter than `get_output_frames`, which clamps). An output whose size differs from the baseline gets null metrics with the reason `size differs from baseline: WxH vs WxH` - it is never resized. `max_dimension` is the longest side of each cell; the grid is held to 4 MiB and shrunk whole when over (never below 64 px per cell), `downscaled_to` null when nothing shrank. Returns the grid image and a text summary. Errors: 400 bad shape, out-of-bounds crop, every moment past every end, or not an image or video; 404 unknown name; 413 over the decode pixel limit; 422 undecodable file. See *Assessing a run's output* in [the workflow guide](WORKFLOW_GUIDE.md#assessing-a-runs-output) |
 | `download_output(name, destination=None, overwrite=False, workspace=None)` | `name`, `destination`, `overwrite`, `workspace` | Save one output file to local disk, of any content type. `destination` may be a full path or a directory; `~` expands and missing parent directories are created. `overwrite=True` is required to replace a file already at the resolved path. Over the stdio `dw-mcp`, omitting `destination` saves under the output's own name in the current working directory. Over a `dw.serve --mcp` endpoint the file lands on the server confined to that workspace (a relative path is joined onto it), and `destination` is required there - an omitted one is refused rather than dropped loose in the workspace root, where nothing can find or delete it later (#353); use the `url` `list_gallery` reports, `get_output_image`/`get_output_audio`/`get_output_frames` for inline content, or `keep_output` to make it a named asset instead. Returns nothing to the conversation but where the file landed — unlike the other media tools, the point is a file on disk, not a payload in context. Writes on the machine running the MCP server - over `dw.serve --mcp` that is the GPU box. A write that fails there (a path that exists only on the client, for instance) comes back as an error naming the server-side write and the client-side alternatives, not as an anonymous tool failure. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `delete_output(name=None, workspace=None, job_id=None)` | exactly one of `name` / `job_id`, `workspace` | Permanently remove one generated file from the output directory, or - with `name` a `<workflow>/<run id>` run directory, or with `job_id` - a whole run. By `job_id` the server reads the run directory from the job record and the root the job ran in (`DELETE /api/jobs/{id}/run`), and the reply is `job_id`, `run_dir`, `deleted` and `run_swept`; a job that never wrote a run directory, an unknown one, or one still queued or running is an error. `workspace` names the workspace for a `name` delete without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 
@@ -274,14 +277,16 @@ tools) rather than relying on the session pin.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. A reference set the model would refuse - too many images, videos or audio clips, or, for MiniMax-H3, audio as the only reference - is an error here too, rather than a failure minutes into a run you acknowledged. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required`, `estimate` (with `basis`) and `elided_steps` for the arguments given; quote from it. `steps` counts what will run: a step nothing reads and which saves no file does not run, and is named in `elided_steps` instead |
+| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. A reference set the model would refuse - too many images, videos or audio clips, or, for MiniMax-H3, audio as the only reference - is an error here too, rather than a failure minutes into a run you acknowledged. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required`, `estimate` (with `basis`), `host_memory` (`{projected_mb, basis, runs}`, the projected host-RAM peak; `basis` is `observed` from same-key successful runs on this machine or `fit`; absent when there is no figure) and `elided_steps` for the arguments given; quote from it. `steps` counts what will run: a step nothing reads and which saves no file does not run, and is named in `elided_steps` instead |
 | `list_workspaces()` | — | The server's workspaces and which one this session is using. Each has its own workflows, assets and outputs; the prompt library is shared by all of them |
 | `use_workspace(name)` | `name` | Work in that workspace for the rest of the session - every later call reads and writes there. This is how to keep your work out of another agent's namespace rather than sharing the default one. Checked against the server, so a typo fails here rather than scoping every later call to nothing. On a `dw.serve --mcp` endpoint the pin is shared by every connected client (#298, see the note above the table) - a `warning` field appears when this call overwrote a pin already pointed away from `default` |
 | `create_workspace(name, use=False)` | `name`, `use` | Create a workspace. Pass use=true to switch this session to it as well; otherwise the session stays where it was and the result says so. The result names the workspace (`name`, `default`, `current`, `next`), not its folders - `list_workspaces(detail=true)` is the opt-in for those. `use=true` carries the same mounted-server caveat and `warning` field as `use_workspace` |
+| `copy_to_workspace(destination, runs=None, assets=None, source=None)` | `destination`, `runs`, `assets`, `source` | Copy runs and assets from one workspace into another. Each `runs` entry is `<workflow>/<run id>` as `list_gallery` names it, or a bare `<workflow>` for all its runs; each `assets` entry is a path as after `asset:`, or a folder (`proj/`) for every file under it, keeping its path, note and kept shots. `source` defaults to this session's workspace. Free: no `acknowledged_cost`. Media is hard-linked (a copy across devices falls back to a real copy) and JSON sidecars are always copied, so an edit in one workspace never reaches the other. All or nothing; a run or identical asset the destination already has is skipped as `already_present`, a different file at an asset's path refuses the whole request, so a repeat is idempotent, and a `vN` it already uses is renumbered after its highest and reported in `renumbered`. Warnings: `unresolved_output_refs`, `absolute_paths`, `no_jobs`. A copied run has no job record - it shows in `list_gallery` and resolves as an `output:` reference, not in `list_jobs`. A run whose job is still queued or running is refused. To move, copy then `delete_output` the source runs and `delete_asset` the source assets. See [Workspaces](WORKSPACES.md#copying-between-workspaces) |
 | `delete_workspace(name, acknowledged_cost=False)` | `name`, `acknowledged_cost` | Permanently delete a workspace and everything in it. Refuses without the acknowledgement, reporting what it would remove |
 | `list_assets(limit=50, prefix)` | `limit`, `prefix` | The input media on the server, each with the `asset:` reference a workflow argument carries. Look here before asking for a file - what a workflow needs may already be there. `libraries` names the roots searched and which are writable; `shadowed` lists names a nearer library hides. Newest first; `prefix` keeps names starting with it (e.g. `cast/`), `limit` bounds the answer, `total` is the count matched before the cut |
-| `keep_output(name, asset_name=None, overwrite=False, shared=False, workspace=None)` | `name`, optional `asset_name`, `overwrite`, `shared`, `workspace` | Keep a generated file as an input asset under a stable `asset:` name, so a later workflow can rely on it. The copy happens on the server: nothing is downloaded or re-uploaded. `asset_name` may name a folder and takes the kept file's extension when it has none; `shared=true` keeps it in the library every workspace shares, which is where a recurring cast belongs. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
-| `upload_asset(file_path=None, content=None, asset_name=None, shared=False)` | exactly one of `file_path` or `content` (base64), optional `asset_name`, `shared` | Push an image, video or audio file, or a `.cube` 3D LUT for `apply_lut`, into the server's asset library and get back its `asset:` reference. `file_path` is read from the machine the MCP server runs on, so this is how an input reaches a dw.serve running somewhere else - but only when the caller shares a filesystem with that machine. `content` is the alternative for an agent that does not: the bytes travel inline, base64-encoded, in the tool call itself, capped at 4MB (well under `file_path`'s 200MB) because inline bytes compete with the calling agent's own context budget rather than being a bulk-transfer path (#203). `asset_name` is required with `content` (there is no file name to infer one from) and, either way, stores it under a readable name (`cast/priya-voice.wav`) instead of a random one; `shared=true` puts it in the library every workspace shares |
+| `keep_output(name, asset_name=None, overwrite=False, shared=False, workspace=None, note=None)` | `name`, optional `asset_name`, `overwrite`, `shared`, `workspace`, `note` | Keep a generated file as an input asset under a stable `asset:` name, so a later workflow can rely on it. The copy happens on the server: nothing is downloaded or re-uploaded. `note` is kept with the asset; left out, the source file's note is copied. `asset_name` may name a folder and takes the kept file's extension when it has none; `shared=true` keeps it in the library every workspace shares, which is where a recurring cast belongs. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
+| `set_note(target, note=None, workspace=None)` | `target` (a run `<workflow>/<run id>`, a gallery file name, `asset:<name>` or `workspace:<name>`), `note`, `workspace` | Set the note on a run, an output file, an asset or a workspace; null or `""` clears it. Plain text up to 4000 characters saying what the thing is for - what a run tested, why a file is the keeper. Free: no `acknowledged_cost`. Returns `{target, note, note_source}`. `run_workflow(note=...)` sets a run's note at submission and it shows on every file the run wrote; `list_gallery`, `list_assets`, `list_workspaces` and `list_jobs` carry each note clipped to 200 characters (`note_truncated: true` when cut), while `get_job` and `get_gallery_metadata` return it whole. `get_job` shows the run's current note, so one set here after submission replaces the submitted one. `workspace` names the workspace a run or file name is read in for this one call without switching the session to it - the same pin `run_workflow` takes |
+| `upload_asset(file_path=None, content=None, asset_name=None, shared=False, note=None)` | exactly one of `file_path` or `content` (base64), optional `asset_name`, `shared`, `note` (kept with the asset) | Push an image, video or audio file, or a `.cube` 3D LUT for `apply_lut`, into the server's asset library and get back its `asset:` reference. `file_path` is read from the machine the MCP server runs on, so this is how an input reaches a dw.serve running somewhere else - but only when the caller shares a filesystem with that machine. `content` is the alternative for an agent that does not: the bytes travel inline, base64-encoded, in the tool call itself, capped at 4MB (well under `file_path`'s 200MB) because inline bytes compete with the calling agent's own context budget rather than being a bulk-transfer path (#203). `asset_name` is required with `content` (there is no file name to infer one from) and, either way, stores it under a readable name (`cast/priya-voice.wav`) instead of a random one; `shared=true` puts it in the library every workspace shares |
 | `delete_asset(name)` | `name` | Permanently remove one file from the asset library, by the name `list_assets` reports. Deletes from whichever library holds it - this workspace's own before the shared one; one from a read-only examples library is refused. Any workflow still carrying that `asset:` reference stops loading |
 | `save_workflow(name, workflow)` | `name`, `workflow` | Save a workflow into the server's writable workflow directory, overwriting any existing workflow of that name there. A name that currently resolves to a read-only source (an examples directory) is not overwritten - the copy lands in the writable directory and shadows it |
 | `delete_workflow(name)` | `name` | Permanently delete a stored workflow |
@@ -310,12 +315,12 @@ references written in the same session.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `run_workflow(workflow_path=None, inline_workflow=None, arguments=None, acknowledged_cost=False, workspace=None, wait_seconds=0)` | exactly one of `workflow_path` (a catalog name from `list_workflows`, with or without `.json`, or a path to a workflow file on the server) or `inline_workflow`, optional `arguments`, `acknowledged_cost`, `workspace`, `wait_seconds` | Queue a workflow for generation. Returns as soon as the job is queued - unless `wait_seconds` is above 0, in which case the call then waits on the queued job exactly as `wait_for_job(job_id, timeout_seconds=wait_seconds)` would (same per-call cap, clamped not honoured) and the result carries the queued-job fields plus that wait's (`status`, `still_running`, `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds`, `timeout_capped`, the slim `job`); when the cap covers the job's runtime one call is the run and the wait, and a `still_running: true` result is followed with `wait_for_job` as before. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate, and nothing is waited on |
-| `get_job(job_id)` | `job_id` | Get a job's status, warnings, output manifest, error and traceback; each manifest entry's `subfolder` is the in-run subfolder the step declared - by convention `final` for the deliverable, `intermediate` for scratch, `''` for none. A running job also carries `progress` (below) |
+| `run_workflow(workflow_path=None, inline_workflow=None, arguments=None, acknowledged_cost=False, workspace=None, wait_seconds=0, note=None)` | exactly one of `workflow_path` (a catalog name from `list_workflows`, with or without `.json`, or a path to a workflow file on the server) or `inline_workflow`, optional `arguments`, `acknowledged_cost`, `workspace`, `wait_seconds`, `note` | Queue a workflow for generation. Returns as soon as the job is queued - unless `wait_seconds` is above 0, in which case the call then waits on the queued job exactly as `wait_for_job(job_id, timeout_seconds=wait_seconds)` would (same per-call cap, clamped not honoured) and the result carries the queued-job fields plus that wait's (`status`, `still_running`, `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds`, `timeout_capped`, the slim `job`); when the cap covers the job's runtime one call is the run and the wait, and a `still_running: true` result is followed with `wait_for_job` as before. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate, and nothing is waited on. `note` says what the run is for (see `set_note`) |
+| `get_job(job_id)` | `job_id` | Get a job's status, warnings, output manifest, error and traceback; each manifest entry's `subfolder` is the in-run subfolder the step declared - by convention `final` for the deliverable, `intermediate` for scratch, `''` for none. A running job also carries `progress` (below); a queued job held for host RAM carries `waiting_for` (#869) |
 | `get_job_workflow(job_id)` | `job_id` | The REST equivalent is `GET /api/jobs/{id}/workflow` (see [SERVER.md](SERVER.md#jobs-api)). The workflow the job actually ran. `realized: true` means every mutable input is pinned (arguments, seed, prompts, `output:latest`); `false` means the job predates run tracking and this is the definition as submitted. Pass it to `save_workflow` to keep it under a name |
 | `export_job(job_id, overwrite=False)` | `job_id`, `overwrite` | Gather one finished job into `<workspace>/exports/<job id>/` on the server: the realized workflow, the run's manifest, the job row, a README, and copies of the assets, earlier-run inputs and outputs. Returns the directory, a zip URL, the file list with sizes and the total. The three JSON files are in the zip, not repeated here - get_job_workflow and get_job serve them individually. **The directory is on the machine running the server**, like `download_output`'s destination. The zip needs no token (`/exports/*.zip` is ungated like `/outputs`, #592), so `auth_required` is false and the agent fetches `open_url` itself (prefixing a relative one with the server address) and unpacks it into `exports/` under the session's working directory (a deliverable, not a temp file) - the archive already unpacks into one folder named after the job id, so do not create that folder first; only an agent without HTTP gives the user `open_url`. `true` is kept as a forward guard for a gated zip, when `open_url` is handed to the person instead |
 | `get_job_events(job_id, after=-1, limit=200)` | `job_id`, `after`, `limit` | Get a page of a job's progress events |
-| `wait_for_job(job_id, timeout_seconds=20)` | `job_id`, `timeout_seconds` | Block until a job reaches a terminal status, or `timeout_seconds` elapses. **One call blocks for at most the server's cap** — 55 seconds unless the deployment sets `DW_MCP_MAX_WAIT_SECONDS` higher, and the tool's description states the live value; a larger `timeout_seconds` is clamped, not honoured. Ask for the job's `plan.estimate` plus a margin: under the cap that is one call for the whole job, over it one call per cap. A deployment raises the cap only as far as its clients (and anything between them and the server) hold one silent HTTP request open - Claude Code's limit is `MCP_TOOL_TIMEOUT`. Every reply carries `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds` and `timeout_capped`, so a capped return is distinguishable from an elapsed one. Use instead of hand-polling `get_job`/`get_job_events` in a loop; if it returns `still_running: true`, call it again. Returns a slim job - status, warnings, error, `run_id` and `run_version` (the run's `v5`, as the gallery labels it), and the manifest once finished - without the arguments; `get_job` has those. A running job also carries `progress` (below) |
+| `wait_for_job(job_id, timeout_seconds=20)` | `job_id`, `timeout_seconds` | Block until a job reaches a terminal status, or `timeout_seconds` elapses. **One call blocks for at most the server's cap** — 55 seconds unless the deployment sets `DW_MCP_MAX_WAIT_SECONDS` higher, and the tool's description states the live value; a larger `timeout_seconds` is clamped, not honoured. Ask for the job's `plan.estimate` plus a margin: under the cap that is one call for the whole job, over it one call per cap. A deployment raises the cap only as far as its clients (and anything between them and the server) hold one silent HTTP request open - Claude Code's limit is `MCP_TOOL_TIMEOUT`. Every reply carries `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds` and `timeout_capped`, so a capped return is distinguishable from an elapsed one. Use instead of hand-polling `get_job`/`get_job_events` in a loop; if it returns `still_running: true`, call it again. Returns a slim job - status, warnings, error, `run_id` and `run_version` (the run's `v5`, as the gallery labels it), and the manifest once finished - without the arguments; `get_job` has those. A running job also carries `progress` (below); a queued job held for host RAM carries `waiting_for` |
 | `cancel_job(job_id)` | `job_id` | Ask a queued or running job to stop |
 | `clear_memory()` | `device` | Drop every loaded pipeline and the step cache on each idle card - `device`'s alone when named - freeing VRAM/RAM immediately instead of waiting for the next job to evict one model for another. Also drops the step cache, so a seeded workflow that would otherwise reuse cached results regenerates on its next run. A card running a job is skipped (`workers` reports it `job_running`); refused with a 409 when no card asked about is idle, so wait and retry rather than expecting this call to block (#221, #677) |
 | `rerun_job(job_id, acknowledged_cost=False, new_seed=False)` | `job_id`, `acknowledged_cost`, `new_seed` | Queue a fresh job from a previous job's stored specification. Costs GPU time, so it passes the same gate as `run_workflow`. `new_seed=true` draws a fresh seed into the workflow's seed variable — without it a seeded workflow's rerun repeats its arguments exactly and the step cache serves the whole run from the earlier one's files (`reused: true`), generating nothing. `get_job_workflow`'s `seed_variable` says whether there is one - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate |
@@ -328,7 +333,7 @@ references written in the same session.
 | `list_models()` | — | (Catalog) List what the Hugging Face cache holds, largest first |
 | `download_model(repo_id, acknowledged_cost=False)` | `repo_id`, `acknowledged_cost` | Fetch a model repo into the cache. Costs disk and bandwidth, so it passes the gate. Returns as soon as the download starts |
 | `list_downloads()` | — | List downloads the server is running or recently ran |
-| `cancel_download(download_id)` | `download_id` | Stop a running download. Partial files stay cached and resume on a retry |
+| `cancel_download(download_id)` | `download_id` | Stop a running download; the record shows `cancel_requested: true` until it is `cancelled`. Partial files stay cached and resume on a retry |
 | `delete_model(repo, acknowledged_cost=False)` | `repo`, `acknowledged_cost` | Delete every cached revision of one repo. Not recoverable locally |
 | `get_diffusers_state()` | — | Installed diffusers version, its git commit, and any update in flight |
 | `update_diffusers(acknowledged_cost=False)` | `acknowledged_cost` | Upgrade diffusers to GitHub HEAD in the background |
@@ -398,9 +403,12 @@ The intended loop:
    terminal/not-terminal status. Each event carries `at`, seconds since the
    job started, so where a step's time went is a subtraction between two
    events - `step_start` to `generating` is the lead-in a reused pipeline
-   still pays, `generating` to the first `pipeline_step` the encoding
+   still pays; `generating` is emitted when the pipeline call starts, so
+   `generating` to the first `pipeline_step` is the encoding plus the first
+   denoise pass (`timing.encode_s` on the manifest entry is the encoding alone)
 4. `get_job(job_id)` for the finished manifest (or the error and traceback,
-   if it failed)
+   if it failed). A pipeline step's entry carries `timing` - load, encode,
+   denoise, decode and save seconds ([WORKSPACES.md](WORKSPACES.md#step-timing))
 5. `get_output_image(name)` to look at a result image
 6. `get_output_frames(name, count=12)` to look at a result video, and
    `get_output_audio(name, start, duration)` to hear it
diff --git a/docs/RECIPES_24GB.md b/docs/RECIPES_24GB.md
index 5d1346f1..1ed6c2c8 100644
--- a/docs/RECIPES_24GB.md
+++ b/docs/RECIPES_24GB.md
@@ -116,7 +116,7 @@ pipeline-level `offload`. The working 24GB configuration at 960x544:
 | `text_encoder` | `remove_modules: ["lm_head"]` - the encoder path never calls it |
 | `text_encoder.model` | SDNQ int4, `truncate_layers: {"language_model.layers": 51}`, `group_offload` `leaf_level` |
 | `vae`, `audio_vae` | SDNQ int8, `device: "cuda"`, `residency: "on_demand"` |
-| pipeline | `cache: first_block` (`threshold: 0.1`) on the 20-step ref2va workflows only - measured on the 9-step turbo schedule it never skips (consecutive distilled steps differ too much for the threshold), so the turbo examples omit it rather than hold cache state for nothing |
+| pipeline | `cache: first_block` (`threshold: 0.05`) only on a ~30-step base-model run (`lora_model_name: null`): -22% denoise there, identical staging and faces. It skips nothing at 12 steps or on a turbo schedule (consecutive distilled steps differ too much), and every H3 template takes it as a `cache` argument (null by default): `{"type": "first_block", "threshold": 0.05}`. Measured on a 3090 with `sage_hub`; see the `minimax-h3` skill's `references/quality-and-speed.md` |
 
 The VAEs are the piece worth calling out. They hold roughly 3GiB, are used only to
 encode references and decode the result, and group offloading them is worse than useless
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index e1fcf87c..997e7f1a 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -7,6 +7,115 @@ notes from commits at tag time (see below). This section is a scratch pad
 for items a branch's author wants the next release note to name; clear it
 when a release ships.
 
+### 0.14.0
+
+<!-- Drafted from v0.13.0..develop (7b72a7de). Paste into the GitHub release body once the tag has published: gh release edit v0.14.0 --notes-file ... -->
+
+A release about what a run is and what it will cost. Gallery files say
+whether they are a final or an intermediate, anything can carry a note, and
+runs copy between workspaces. The cost estimate scales with steps, canvas
+and frames instead of quoting a flat figure that was up to 12x off, and a
+queued job waits for host RAM rather than being OOM-killed.
+
+**Roles and notes** (#855-#858)
+
+- Gallery files are tagged final or intermediate (inferred when a workflow
+  doesn't say), and the gallery opens on finals. A run lists what it was
+  Made from.
+- A file a later run in the workspace read, through `output:` or an asset
+  kept from it, lists as intermediate, so a project's shots, narration and
+  score step aside once the cut that uses them exists. A step that sets
+  `result.role: "final"` stays final. The `script-to-video` and
+  `series-episodes` skills have ingredient workflows declare
+  `"role": "intermediate"` (#928).
+- Runs, files, assets and workspaces take an optional note: `note` on
+  `run_workflow`, `upload_asset` and `keep_output`, and MCP `set_note`.
+  Every listing carries notes; the web UI edits them in place as Markdown.
+- Starring a file keeps it. A rerun records the job it reran (`rerun_of`).
+- `copy_to_workspace` copies whole runs, with manifests, and asset-library
+  entries into another workspace (#853, #859, #860).
+
+**Cost and host RAM** (#866, #869, #881)
+
+- The estimate scales as steps x canvas x frames against the template's
+  defaults (`basis: "derived"`, `scaled` names the axes). Any other driver
+  that moves keeps the figure and sets `low_confidence`; H3 adds weights,
+  LoRA, attention and cache as drivers. On the H3 matrix it lands within
+  30% (B3->L5: 32.3 min quoted, 29.5 run), and an inline copy prices
+  within 2% of its template (#906-#908, #915, #916, #921).
+- A queued job is held at dispatch while its projected host-RAM peak won't
+  fit, and stays `queued` with `waiting_for` and a `queue_wait` event. It
+  is never held with nothing else running. On a 125 GB, 2x 3090 host a
+  second int8 H3 job waited ("needs ~87 GB, ~57 GB free") while two int4
+  jobs ran at once (#909, #910).
+- An OOM kill now takes the newest dispatch, not the earlier job (#881).
+
+**Timing and caches** (#867, #868, #905)
+
+- Manifest entries carry per-step timing (`first_pass_s`, `pass_s`) and
+  step-cache skip counts (`cache_stats`). A `first_pass_slow` warning names
+  a warm pipeline's slow first pass (#924: 202 s against 37 s/pass).
+- Validate warns on acceleration that can't pay off or won't run: a cache
+  on a short schedule or with no transformer to attach to, `fullgraph`
+  with a cache, a CUDA-only attention backend, and an unbraced type name
+  under a `*_dtype` key (#887, #904, #926).
+- The plan fingerprint and step cache key only on what changes the output,
+  so metadata edits and `12.0` vs `12` no longer miss the cache (#905,
+  #911).
+- Every H3 template exposes `attention_backend` and `cache` (#883, #884).
+  MagCache calibration now reports its ratios on H3 (#927); with them,
+  MagCache 0.06 ran the cinema final in 18.1 min, 39% under L5 (#875).
+
+**H3 quality ramp** (#861, #862, #882)
+
+- The `minimax-h3` skill has measured draft -> final rungs. TV: L1 (~5.4
+  min) -> L7 (~7.2 min), changing only `weights_dtype`. Cinema: B3 (~12.9
+  min) -> L5 (~29.5 min), changing only steps. Staging carries at the same
+  seed; the skill says what to approve at each tier.
+- A proven LoRA catalog entry decides which H3 step an adapter fits,
+  ahead of its filename (#870, #888).
+
+**Compare, sweeps and check-script** (#871, #872, #919-#925)
+
+- `compare_outputs` puts 2-4 outputs side by side with PSNR/SSIM; the web
+  UI's Compare page plays them in sync and lists the differing arguments.
+  The workspaces guide has a Running a sweep section.
+- check-script refuses a wrong shot name at validate, adds
+  `unscripted_speech` and `speech_not_transcribed`, and levels its input
+  so the verdict no longer depends on loudness.
+
+**Web UI**
+
+- A running-jobs chip, a tab title that tracks the running job, measured
+  run times on cards, drag-and-drop upload, and keyboard culling in the
+  gallery.
+
+**Fixes**
+
+- `cancel_download` stops queued files and shows `cancel_requested`
+  (#899); a model download records `refs/main`, so it reads complete.
+  `cancel_job` takes effect during a load (#892).
+- A kept asset keeps its lineage and its job survives the workspace's
+  deletion (#902, #913, #917, #918).
+- `get_gallery_metadata` measures an image, and `include_workflow=false`
+  omits the embedded workflow (#922).
+- An inline copy of a list-driven template is no longer quoted the
+  template's default-length price unscaled.
+- The host-RAM gate no longer under-projects a list-driven run whose peak
+  grows with the list.
+- Whole-module `compile: {fullgraph: true}` no longer fails at the first
+  denoise step after the timing hook.
+- FasterCache runs on FLUX.1-dev (#897); denoise time on mps is no longer
+  billed to decode (#896).
+- The gallery's sort no longer stalls each keystroke on a large library.
+
+**Dependencies and deploy**
+
+- No dependency floors changed.
+- `scripts/dw-serve.service` sets `OOMPolicy=continue`, so one worker's
+  OOM kill no longer stops the server. Reinstall the unit to pick it up.
+- The jobs history gains a `memory_key` column, migrated on start.
+
 ### 0.13.0
 
 <!-- Drafted from v0.12.0..develop. Paste into the GitHub release body once the tag has published: gh release edit v0.13.0 --notes-file ... -->
@@ -140,9 +249,10 @@ hallucinations as lyrics.
 
 **Fixes**
 
-- The inherited cost estimate is withheld when an inline workflow runs
-  more steps or frames than the template it came from, instead of
-  quoting the template's number (#821: a 7x under-quote).
+- The inherited cost estimate is re-priced linearly when an inline
+  workflow runs more steps or frames than the template it came from,
+  instead of quoting the template's number (#821: a 7x under-quote); the
+  estimate carries `scaled` (why) and `low_confidence` (#851).
 - `assess_output` shot findings carry `index` and `start_frame`, so a
   repeated shot name is unambiguous (#835).
 - `dialogue-short` and `music-video` expose `match_levels_dbfs` (#836).
diff --git a/docs/SERVER.md b/docs/SERVER.md
index 9e403bcb..5dd42d32 100644
--- a/docs/SERVER.md
+++ b/docs/SERVER.md
@@ -201,17 +201,17 @@ running:
 | Route | What it does |
 | --- | --- |
 | `POST /api/jobs` | Queue a run: `{"workflow_path": ...}` or an inline `{"workflow": {...}, "base_dir": ...}`, plus `arguments` for variable overrides. `workflow_path` accepts a stored workflow name as listed by `/api/workflows` (with or without `.json`, nested names included), or a relative/absolute path that still resolves under `--workflow-dir` - confined the same way the `/api/workflows` CRUD routes are; a path that names a real file outside that directory is rejected with 400, not opened. Answers with argument warnings from signature checking. Takes an optional `acknowledged_cost`: `true` is recorded as `acknowledged: boolean`; the object `{fingerprint, minutes, downloads}` from a validate answer's `plan` is `bound` - the server re-plans the run for the arguments given and answers **409** when the fingerprint differs or a repo in `downloads_required` is not in `downloads` (a download that has since vanished is not a refusal); the body is `{"detail": {message, reason: "fingerprint" \| "downloads" \| "unplannable", acknowledged, plan, acknowledge}}` with the current plan, so the caller re-quotes from it, and `acknowledge` - the `{fingerprint, minutes, downloads}` to resend - whenever there is a plan. A `null` in `downloads` (a URL with no repo) is ignored. `minutes` is recorded, never compared. Nothing is required: the web UI and every caller that sends nothing are `acknowledged: none`, and every job answer and history row carries `acknowledged` (and `acknowledged_cost` when bound). `POST /api/jobs/{id}/rerun` takes the same field and checks against the stored spec; a fresh seed does not change a fingerprint. |
-| `GET /api/jobs?workspace=&status=&limit=` | Queue + history summaries, oldest first, with `total` beside them. `status` narrows to one state or a comma-separated set (`queued`, `running`, `succeeded`, `failed`, `cancelled`; anything else is a 400); `limit` keeps the newest N, and `total` still reports how many matched, so a bounded answer cannot be mistaken for a complete one. Each summary carries `device`, the card the job ran on (`"cuda:1 NVIDIA GeForce RTX 3090"`; null while queued and for older jobs). No parameters means every job, which is what the web UI polls |
-| `GET /api/jobs/{id}` | Full detail: spec, events, manifest, error. A manifest entry for a step served from the step cache carries `reused: true`. Every entry carries `subfolder` - the in-run subfolder the step's `result.subfolder` chose, `''` for none. A `for_each` step appears in the manifest as its members (`shot@wide_open`, `shot@closeup`), because the manifest records what ran; the run's `workflow.json` keeps the `for_each` form, because it records what was asked Carries `output_kinds`: each manifest file mapped to its media kind (`image`, `video`, `audio`, `text`, or null), and each file-carrying run event (`step_end`) carries the same map for its own files. |
+| `GET /api/jobs?workspace=&status=&limit=` | Queue + history summaries, oldest first, with `total` beside them. `status` narrows to one state or a comma-separated set (`queued`, `running`, `succeeded`, `failed`, `cancelled`; anything else is a 400); `limit` keeps the newest N, and `total` still reports how many matched, so a bounded answer cannot be mistaken for a complete one. Each summary carries `device`, the card the job ran on (`"cuda:1 NVIDIA GeForce RTX 3090"`; null while queued and for older jobs), and `rerun_of`, present on a job started by rerun: the id of the job it reran; absent for a fresh submit. No parameters means every job, which is what the web UI polls |
+| `GET /api/jobs/{id}` | Full detail: spec, events, manifest, error. A manifest entry for a step served from the step cache carries `reused: true`. Every entry carries `subfolder` - the in-run subfolder the step's `result.subfolder` chose, `''` for none. A `for_each` step appears in the manifest as its members (`shot@wide_open`, `shot@closeup`), because the manifest records what ran; the run's `workflow.json` keeps the `for_each` form, because it records what was asked Carries `output_kinds`: each manifest file mapped to its media kind (`image`, `video`, `audio`, `text`, or null), and each file-carrying run event (`step_end`) carries the same map for its own files. The entry of a pipeline step that ran carries `timing` (see [Step timing](WORKSPACES.md#step-timing)). Carries `rerun_of` - present on a job started by rerun: the id of the job it reran; absent for a fresh submit. |
 | `DELETE /api/jobs/{id}/run` | Delete the run directory a finished job wrote, whole, from the output root the job ran against (no workspace selector applies): `{job_id, run_dir, deleted, run_swept}`. 404 for an unknown job or one with no run directory, 409 for one still queued or running |
 | `GET /api/jobs/{id}/workflow` | The workflow the job ran: `{id, definition, realized, seed_variable}`. `seed_variable` names the variable a `new_seed` rerun would draw into (null when the workflow has none), read from the workflow as written rather than the realized copy, whose seed is pinned. `realized: true` is the copy the run itself wrote (`workflow.json` in its run directory), with arguments, seed, prompts and `output:latest` pinned; `false` falls back to the submitted definition, which is what a job from before run tracking has. 404 means neither is readable - the job itself still is. The equivalent MCP tool is `get_job_workflow` (see [MCP.md](MCP.md#diagnose)) |
 | `POST /api/jobs/{id}/export?workspace=&overwrite=` | Gather one finished job into `<workspace>/exports/<job id>/`: `workflow.json`, `manifest.json`, `job.json`, `README.md`, `assets/`, `inputs/`, `outputs/`. 201 with the file list, total bytes, anything it could not find, a `zip_url`, and the three JSON files inline. 404 unknown job, 409 for a job still running or an existing export without `overwrite` |
 | `GET /exports/{id}.zip?workspace=` | The same tree as one archive, built on request rather than kept as a second copy. Entries are named `<job id>/<relative path>`. Ungated exactly as `/outputs` is |
-| `GET /api/jobs/{id}/events` | Server-sent events stream; `?after=N` / `Last-Event-ID` replay missed events, so reconnects are lossless. Every event carries `seq` and `at` - seconds since the job started (since it was queued, for the events before that) - so a step's cost is a subtraction: `step_start` to `generating` is what a reused pipeline still pays before it runs, `generating` to the first `pipeline_step` is the prompt and reference encoding |
+| `GET /api/jobs/{id}/events` | Server-sent events stream; `?after=N` / `Last-Event-ID` replay missed events, so reconnects are lossless. Every event carries `seq` and `at` - seconds since the job started (since it was queued, for the events before that) - so a step's cost is a subtraction: `step_start` to `generating` is what a reused pipeline still pays before it runs; `generating` is emitted when the pipeline call starts, so `generating` to the first `pipeline_step` is the prompt and reference encoding plus the first denoise pass (`timing.encode_s` in the manifest is the encoding alone; see [Step timing](WORKSPACES.md#step-timing)). The server keeps only the last 200 events, so on a long job the early ones are gone |
 | `GET /api/jobs/{id}/event-log?after=-1&limit=200` | The same events as the SSE stream, as one JSON page: `{id, status, events, last_seq, truncated, note}`. `after` is exclusive; page by passing back the previous `last_seq`. A job restored from history serves the bounded event tail persisted with it; a job that finished before events were retained returns an empty list and a `note` saying so. |
 | `POST /api/jobs/{id}/cancel` | Cooperative cancel (takes effect at the next step boundary or denoise step) |
-| `POST /api/jobs/{id}/rerun` | Re-queue a finished job's spec. Body `{"new_seed": true}` draws a fresh seed into the workflow's seed variable instead of repeating the original arguments; 400 when the workflow pins its seed to a literal or names none. A plain rerun of a seeded workflow is served whole from the step cache — the earlier run's files, republished with `reused: true`, generating nothing |
-| `POST /api/jobs/{id}/move` | Reorder a queued job: `{"direction": "up"\|"down"\|"front"\|"back"}`. Job listings carry each waiting job's `queue_position`. |
+| `POST /api/jobs/{id}/rerun` | Re-queue a finished job's spec. Body `{"new_seed": true}` draws a fresh seed into the workflow's seed variable instead of repeating the original arguments; 400 when the workflow pins its seed to a literal or names none. A plain rerun of a seeded workflow is served whole from the step cache — the earlier run's files, republished with `reused: true`, generating nothing. The new job's summary and detail carry `rerun_of`: the id of the job it reran (absent on a fresh submit) |
+| `POST /api/jobs/{id}/move` | Reorder a queued job: `{"direction": "up"\|"down"\|"front"\|"back"}`. Job listings carry each waiting job's `queue_position`, and `waiting_for` while one is held for host RAM. |
 
 Each worker runs one job at a time, so with one device (the default) one job
 runs at a time; submissions queue in order, and the waiting portion of the
@@ -228,10 +228,34 @@ on one card); else any card. A card's size is its GiB rounded up (a 3090
 counts as 24), which a `cost` figure is compared to; a declared estimate is
 held to the card's GiB to one decimal (a 3090's 23.6), the same ceiling
 admission checks it against. Cancel reaches only the worker running that job, and a worker
-crash fails only its own job. The worker started later gets a higher Linux
-`oom_score_adj` (+100 over the highest other live worker), so a host-RAM
-squeeze kills the later job; nothing is written with one worker. There is no
-host-RAM gate at dispatch: two big jobs can still exhaust host RAM together.
+crash fails only its own job. Each dispatch sets its worker's Linux
+`oom_score_adj` to 1000 and every other live worker's back to the value it was
+spawned with (the server's own, e.g. 200 under a systemd user unit - the kernel
+refuses an unprivileged write below that), so a host-RAM squeeze kills the
+newest job whatever the workers' sizes; nothing is written with one worker, and
+a write the kernel refuses is a warning on the job. Under systemd the unit needs
+`OOMPolicy=continue` (`scripts/dw-serve.service` sets it): the default `stop`
+answers one worker's OOM kill by stopping the whole server, every other job
+with it. A
+queued job may also carry a projected host-RAM peak (see
+`host_ram_need`, #869). When it fits a free card, dispatch checks host RAM
+too: available is `MemAvailable` less, for each running job, what that job's
+projected peak still has to add beyond its worker's resident size now, and
+the job is held while its peak exceeds available plus the resident size of
+the idle worker it would reuse. A running job with no figure is charged
+nothing extra, since `MemAvailable` already reflects what it holds. Backfill
+applies: a smaller job behind a held one may start. With no other job
+running a job is never held, so it waits only for running jobs, never
+forever; a job with no figure is never held; and where the host's RAM cannot
+be read (macOS without psutil) there is no gate. With one card only one job
+runs, so the gate is never exercised. A held job is re-checked every 10 s,
+since memory can free outside dw. The hold emits one `queue_wait` event
+(`reason: "host_ram"`, message `waiting for host RAM: needs ~N GB, ~M GB
+free`; not a `warning`, so nothing lands in the job's `warnings`), and job
+detail and summaries carry `waiting_for` - that message - only while the job
+is queued and held. The web UI shows it beside "#n in line". The gate never
+refuses a submit (#243); it only delays a start, and the OOM ranking above
+(#881) stays the backstop for a wrong projection.
 Among the free cards a job fits, dispatch prefers the one it has an affinity
 for: a rerun goes to the card that ran the original, and any job to the card
 whose worker last ran the same workflow (the same file, or an inline
@@ -244,6 +268,13 @@ card the job would be dispatched to now, and the estimate names it in
 `priced_for`. Memory is per card: `GET /api/memory` and `POST
 /api/memory/clear` take an optional `device`.
 
+### Step timing
+
+A pipeline step's manifest entry carries `timing`, where its time went; the
+fields are in [WORKSPACES.md](WORKSPACES.md#step-timing), which MCP serves as
+`get_guide("workspaces", section="Step timing")`. A step that set a `cache` also
+carries `timing.cache`, its skip counts (see the `cache_stats` event below).
+
 ### Progress events
 
 Every event in the stream carries a `seq` and an `event` name:
@@ -260,7 +291,8 @@ Every event in the stream carries a `seq` and an `event` name:
 | `pipeline_step` | each denoise step | `step`, `total_steps`. Emitted for a pipeline that takes a `callback_on_step_end`, and for a `ModularPipeline` (H3, LTX-2, Qwen-Image), which takes none - there the denoise block's own progress bar is what reports |
 | `phase` | the step changes what it is doing | `phase`, `detail` |
 | `pipeline_released` | a step with `release_pipeline` drops its pipeline | `step`, `index`, `gpu_memory_allocated_mb` and `gpu_memory_allocated_before_mb` (both `null` where the backend cannot say). Emitted between the step's generation and its files being written, which is where the release happens - so the ordering is readable off the event stream rather than by trying to poll memory through a sub-second write |
-| `warning` | a step finds something wrong with what it is about to write | `message`, plus a `kind` and the figures behind it (`level_spread`: `spread_db`, `measure`, `command`; `fps_mismatch`: `declared_fps`, `source_fps`; `audio_no_headroom`: `file`, `peak_dbfs` - a deliverable at or above -0.5 dBFS, which an mp3 or AAC encode decodes over full scale; `step_elided`: `step`, `overridden_by` when a supplied argument is what made it unreferenced). Also appended to the job's `warnings`, prefixed with the step it fired in - the event keeps the moment, `warnings` keeps it where a caller polling the finished job will look, since a warning about the artifact outlives the run that noticed it |
+| `warning` | a step finds something wrong with what it is about to write | `message`, plus a `kind` and the figures behind it (`level_spread`: `spread_db`, `measure`, `command`; `fps_mismatch`: `declared_fps`, `source_fps`; `audio_no_headroom`: `file`, `peak_dbfs` - a deliverable at or above -0.5 dBFS, which an mp3 or AAC encode decodes over full scale; `step_elided`: `step`, `overridden_by` when a supplied argument is what made it unreferenced; `cache_stats_unavailable`: `cache_type` - the installed diffusers moved the private hook state dw reads, so the step's cache counts are null; the run is unaffected). Also appended to the job's `warnings`, prefixed with the step it fired in - the event keeps the moment, `warnings` keeps it where a caller polling the finished job will look, since a warning about the artifact outlives the run that noticed it |
+| `cache_stats` | a pipeline call that set a `cache` finishes its denoise, once per call | `step`, `segment` (only on a chain segment, e.g. `segment 1/3`), and the fields of `timing.cache`: `type`, `threshold`, `forwards`, `computed`, `skipped`, `hit_rate`. Counts are null for a cache diffusers keeps no per-forward decision for. For watching live (`get_job_events(kinds=["cache_stats"])`); the manifest entry's `timing.cache` is the record |
 | `workflow_end` | the run finishes | `manifest` |
 
 A step spends most of its wall clock outside the denoise loop, and
@@ -373,10 +405,19 @@ The editor's forms come from these; they are just as usable from scripts:
   `weight_name` carrying neither `ref2v` nor `fl2v` cannot be placed, so it
   is a `warnings` entry naming the rule rather than a refusal - a
   reference-trained checkpoint nobody has named yet still gets through.
+  The LoRA catalog is read first (#870): a `proven` entry for that
+  `model_name` and `weight_name` whose `workflow` sits in one partition
+  decides it, so a `ref2va` step loading a file the catalog proves for
+  `t2va`/`fl2va` is refused, whatever its name says. A `trial` or
+  `rejected` entry's `workflow` only warns; promoting the entry to `proven`
+  is what makes it refuse. The CLI and the worker have no catalog and keep
+  the file-name rule alone.
 
   A valid answer also carries `plan`, what the run will execute for those
   arguments: `fingerprint` (`sha256:…` over the realized, expanded
-  definition with the seed and the documentation keys removed and
+  definition with the seed and every key that cannot change the output
+  (cost, `cost_drivers`, `vram_estimate`, descriptions, a result's role,
+  subfolder and file name) removed and
   `output:…/latest/…` left unpinned - the same work hashes the same, a
   longer list or an edited stored prompt does not); `steps`, the expanded
   member count; `list_entries`, `{variable: length}` for each `for_each`
@@ -415,7 +456,16 @@ The editor's forms come from these; they are just as usable from scripts:
   ones it was measured with), `per_entry` (re-priced from a measured
   per-entry rate, when the entry carries `per_entry`), `derived` (the
   stored total extrapolated linearly over a list whose length the caller
-  changed - an estimate, not a measurement), `other_device` (no entry for
+  changed, or scaled in proportion along `num_inference_steps`,
+  `width` x `height` and `num_frames` - per entry in a list, summed - that
+  the caller moved off the variable defaults a `cost` entry is measured at,
+  with `scaled` naming each moved axis; an estimate, not a measurement; a
+  non-numeric value of one of those is `unknown`). Any other declared
+  driver moved off its default - H3's `weights_dtype` or LoRA, a music
+  `audio_duration` - has no rule to scale by: the (scaled) figure is kept
+  under whatever basis it has, with `low_confidence` true and `differs`
+  naming the drivers that moved, because it was measured at another setting
+  of them; `other_device` (no entry for
   the serving backend; the first entry's figure, which is a warning rather
   than a quote) or `unknown` (no cost block, or more than one list changed
   so there is nothing honest to extrapolate along) or `inherited` (an
@@ -423,11 +473,21 @@ The editor's forms come from these; they are just as usable from scripts:
   `observed` runs of the catalog template that loads the same pipeline -
   `component_type` + `model_name` + `workflow`, as the VRAM ceiling is
   inherited - with `inherited_from` naming it and `differs` listing what the
-  workflow sets differently among offload, quantization and frame count;
-  validate warns when it does, and never refuses); a composed child's
+  workflow sets differently among offload, quantization, frame count,
+  attention backend, cache and LoRA; more pipeline steps, frames, inference
+  steps or canvas pixels than the template's run re-price it in proportion,
+  as the catalog figure is scaled, with `scaled` naming each axis; an
+  inherited figure has `low_confidence` true when `differs` lists anything
+  or the figure was scaled; validate warns when it does, and never
+  refuses); a composed child's
   cost is added to a curated figure and `partial` is true when a child has
   none - an `observed` figure already measured the whole run, children
-  included, so nothing is added to it and `partial` is false. `plan` is `null` when
+  included, so nothing is added to it and `partial` is false; and
+  `host_memory`, `{projected_mb, basis, runs}`, the run's projected host-RAM
+  peak - `basis` is `observed` (the largest job peak RSS of this machine's
+  successful runs with the same memory key) or `fit` (the list-run projection
+  from the workflow's own history), and the key is absent when there is no
+  figure. `plan` is `null` when
   it could not be built; an invalid answer carries no `plan` key.
 
 ## Files and models
@@ -533,7 +593,13 @@ The editor's forms come from these; they are just as usable from scripts:
   `?subfolder=` filter independently (`?version=` too - with `?folder=`,
   the one run the gallery labels `v4`), and the reply's `folders` and
   `subfolders` list every distinct value over the whole tree, `''` always a
-  member of each so root-level files stay selectable
+  member of each so root-level files stay selectable. Each entry also
+  carries `role`, `final` or `intermediate` (null for a flat-layout file with
+  no run; `intermediate` once a later run read the file, unless the step's
+  `result.role` declared it), and `GET /api/gallery?role=final` lists only
+  those (repeatable; a null role counts as final). See `dw/roles.py` for how
+  a role is decided;
+  the metadata route reports the file's `role` and the run's `inputs` too
 - `GET /api/gallery/{name:path}/download` — download an output file
 - `GET /api/builtin-workflows` — the packaged fragments a sub-workflow step
   names as `builtin:<name>.json` (`dw/workflows/`), which no workflow listing
@@ -551,6 +617,33 @@ The editor's forms come from these; they are just as usable from scripts:
   they apply `X-DW-Crop` and `X-DW-Downscaled-To`. Takes `?token=`
 - `GET /api/gallery/{name}/frames` takes `max_total_bytes`: over it, every
   tile shrinks to one shared size and `downscaled_to` says which
+- `POST /api/gallery/compare` — two to eight outputs side by side, and how far each is
+  from a baseline; read-only, queues nothing. Body: `names` (2-8 gallery names or
+  `asset:` references, one row each), `at` (1-8 moments, seconds or `"frame:N"`;
+  default 4 evenly spaced frames of the shortest video), `crop` (`[x, y, w, h]`: the
+  region shown and measured; or one box per name, shown only), `baseline` (default
+  the first name), `max_dimension` (default 384, longest side of each cell) and
+  `max_total_bytes`. Moments resolve to one frame index against the baseline (the
+  first video if the baseline is a still) and every output is read at that frame
+  number; a frame past an output's end is a blank cell. A still among videos repeats
+  in every column; all stills give one column and `at` is ignored with a note. A crop
+  must lie wholly inside every output's frame (400 otherwise). Reply: `image` (the
+  grid as base64 PNG: `data`, `mime_type`, `width`, `height`; a row per output under a
+  label band, each cell stamped `frame N`), `downscaled_to` (over `max_total_bytes` the
+  whole grid shrinks, never below 64 px per cell; null when nothing shrank),
+  `baseline`, `region` (`full frame`, `crop [...]`, or `full frame (per-output crops
+  are display only)`), `fps_differs` (videos with different frame rates, so one
+  frame number is not one second), `columns` (`{moment, frame}`), `rows` (name, kind,
+  size, crop, and for a video `frame_count` and `fps`), `metrics` and `notes`. A
+  `metrics` entry per non-baseline output holds `cells` (one per column:
+  `psnr_db`, `ssim`, `mean_abs_diff`, `reason`) and `psnr_db`/`ssim`/`mean_abs_diff`
+  summaries (`mean`, `min`, `max`), measured at source resolution; PSNR is
+  `identical` when equal and SSIM is on luma (11x11 Gaussian window, sigma 1.5). An
+  output whose size differs from the baseline gets null metrics and the `reason`
+  `size differs from baseline: WxH vs WxH`, never a resize; a cell past an end says
+  `past end (N frames)`. Errors: 400 bad request, out-of-bounds crop, every moment
+  past every end, or not an image or video; 404 unknown name; 413 over the decode
+  pixel limit; 422 undecodable file
 - `POST /api/gallery/archive` — `{"names": [...]}` (1-1000) bundles a
   multi-file selection into one zip, named by each file's gallery-relative
   path so output subfolders survive. A browser cannot zip on its own and
@@ -573,6 +666,21 @@ The editor's forms come from these; they are just as usable from scripts:
   `exports/` sits beside the workspace's own folders, holding one directory per
   exported job. It is a reserved name: no workspace can be called `exports`, and
   the folder is never listed as one.
+- `POST /api/workspaces/{destination}/copy` (`{"source": ..., "runs": [...],
+  "assets": [...]}`) — copy runs and assets from one workspace into another.
+  A `runs` entry is `<workflow>/<run id>`, or a bare `<workflow>` for all its
+  runs; an `assets` entry is a library-relative path as after `asset:`, or a
+  folder (`proj/`) for every file under it. Naming neither, a source equal to
+  the destination, a path that escapes or reaches a symlink, or a sidecar
+  named directly is a 400, an unknown workspace, run or asset a 404, and a
+  server without a workspace root, a destination that is not writable, a run
+  whose job is still queued or running, or a different file already at an
+  asset's path a 409 (`detail.conflicts` names every one). All or
+  nothing. The reply is `{source, destination, copied: {runs, assets},
+  already_present, renumbered, warnings: {unresolved_output_refs,
+  absolute_paths, no_jobs}, bytes_linked, bytes_copied}`; `renumbered` maps
+  `"<workflow>/<run id>"` to `{"from": 3, "to": 7}`. What is copied and how is
+  in [WORKSPACES.md](WORKSPACES.md#copying-between-workspaces).
 - `GET /api/assets` — the asset library: input media, each with the
   `asset:` reference a workflow carries rather than a path, since a path
   only means something on the server's own machine. Empty rather than an
@@ -707,8 +815,8 @@ The editor's forms come from these; they are just as usable from scripts:
   machine answered. `current_job` is the longest-running job and `worker_alive`
   is true if any worker is alive; `workers` has one entry per card (one with a
   single device): `{device, name, vram_gb, current_job, alive,
-  host_memory_rss_mb}` - `device` is the ordinal (`cuda:1`) and `name` the
-  GPU's own name, the two halves of a job's `device` - the last absent when the worker process isn't running
+  host_memory_rss_mb, pid, oom_score_adj}` - `device` is the ordinal (`cuda:1`) and `name` the
+  GPU's own name, the two halves of a job's `device` - the last three absent when the worker process isn't running (`oom_score_adj` is read from `/proc` at call time, so it shows the kernel's value: 1000 for the latest dispatch's worker in a pool, the spawn-time value - the server's own - for the others)
 - `POST /api/memory/clear` (#221) — drops every loaded pipeline and the step
   cache on each idle card (MCP `clear_memory`), and returns the memory
   reading taken right after. A card running a job is left alone: `workers`
@@ -728,6 +836,60 @@ The editor's forms come from these; they are just as usable from scripts:
   without shelling in; the machine's non-loopback `addresses`; a client
   composes its URLs from an address, the port and the MCP path
 
+## Notes
+
+A note is optional plain text on a run, on a file in a run, on an asset or
+on a workspace, saying what it is for. At most 4,000 characters (longer is
+a 400); `null` or `""` clears it. Only the server writes notes: a run's and
+its files' live in `notes.json` in the run directory, an asset's in
+`notes.json` in its library directory, and a workspace's in `workspace.json`
+at its root (`dw/notes.py`).
+
+`PUT /api/notes?workspace=` with `{"target": ..., "note": ...}` sets or
+clears one. `target` is one of:
+
+- a gallery file name (`output:` accepted) - that file's own note. A
+  flat-layout file has no run directory and answers 409 `notes need a run
+  directory`;
+- a run directory, `<identity>/<run id>` - the run note;
+- `asset:<name>` - resolved down the asset search path the way the asset
+  delete resolves it, a read-only examples tree answering 403;
+- `workspace:<name>`, `workspace:default` for the root's own (409 on a
+  server with no workspace root).
+
+The answer is `{target, note, note_source}`: the target's effective note
+after the write, and whether it is the file's own (`"file"`) or its run's
+(`"run"`); `note_source` is null for a workspace and when there is no note.
+A file's **effective note** is its own, else its run's. An unknown target or
+one that would leave its root is a 404 (a name a workspace cannot take, or
+an invalid asset name, a 400), and a write that fails a 500. Notes are free
+metadata and need no `acknowledged_cost`.
+
+Notes are set at creation too:
+
+- `POST /api/jobs` takes `note`. It is kept on the job (`note` in every job
+  summary and detail, and in history) and written as the run note when the
+  worker reports the run directory (`run_start`); a rerun carries it
+  forward.
+- `POST /api/uploads?note=` keeps it beside the upload. An upload over an
+  existing name takes its own note or none, never the old file's.
+- `POST /api/assets/keep` takes `note`; without one the kept asset takes the
+  source file's effective note.
+
+They are read back on every listing: a gallery entry's `note` is the
+effective one; the metadata route carries `note`, `note_source` and the
+run's `run_note`; an asset entry and a workspace entry carry `note`. Each is
+absent when unset. Deleting an output drops its note and its star; deleting
+an asset drops its note and its kept provenance and shots, so a later file
+under the same name inherits none of them.
+
+`PUT /api/stars` with `{"name": <gallery file name>, "starred": true|false}`
+stars or unstars one output file - the "keep" mark for culling a run. A star
+is stored in the run's `notes.json` (`"starred": [...]`) beside its notes, and
+the gallery listing carries `"starred": true` on a starred file. Only a file
+in a run directory can be starred: a flat-layout file has no run directory
+and answers 409, and a run, asset or workspace target is a 400.
+
 ## Security model
 
 The server is built to serve **your own GPU to your own browser**, not the
diff --git a/docs/TASKS.md b/docs/TASKS.md
index 6bcf24af..974c80d3 100644
--- a/docs/TASKS.md
+++ b/docs/TASKS.md
@@ -3007,7 +3007,7 @@ The step's `result.content_type` must be `"application/json"`; read the answer w
 | Argument | Required | Description |
 | -------- | -------- | ----------- |
 | `audio` | Yes | The take - a path, `asset:`/`output:` reference, or an earlier step's audio or video (its soundtrack is taken) |
-| `lines` | Yes | The expected lines in order: a list of strings or `{text, shot}` objects, `shot` naming the take's shot the line belongs in. Markup is stripped (below). `[]` means no speech is expected |
+| `lines` | Yes | The expected lines in order: a list of strings or `{text, shot}` objects, `shot` naming the take's shot the line belongs in; a shot name the map holds more than once (a cut joined from episodes sharing names) also needs `start_frame` on the line, `{text, shot, start_frame}`, and findings call it `name#start_frame`. Markup is stripped (below). `[]` means no speech is expected |
 | `shots` | No | The take's shot map, `[{name, start_frame, num_frames, start_sample, num_samples}]`. Default: the take's own `.shots` (an earlier step's video), else the run manifest or `keep_output` sidecar beside an `asset:`/`output:` file - resolved as the assessment probes resolve them (`assess.resolve_shots`). The argument wins over both |
 | `similarity` | No | Least similarity, 0..1, of a line's heard words to its expected words before it is a `line_mismatch` (default `0.85`) |
 | `model_name` | No | HuggingFace ID of a Whisper-class ASR model (default `openai/whisper-base`) |
@@ -3023,8 +3023,10 @@ Markup stripped from an expected line: `<d>[Language] ...</d>`, `<scenetrans>`,
 | `line_clipped_at_end` | A line's last heard word ends inside the final `CLIP_TAIL_SECONDS` of its shot (when the line has one) or of the file, and that tail is still above `GUARD_FLOOR_DBFS` | The tail's level in dBFS / `GUARD_FLOOR_DBFS` | `{line, seconds, word, shot}` - `shot` when the line has one |
 | `speech_where_silent` | `lines` is `[]` and words were heard above the floor and outside a repetition loop | Number of words heard / 0 | `{line: null, seconds, word}` - the first; `shot` when shots are known |
 | `speech_in_silent_shot` | Shots are known, at least one line names a shot, and words were heard above the floor and outside a repetition loop in a shot no line names. A word is in the shot its midpoint falls in; one a line in another shot matched (a word straddling the cut) is that line's, not counted | Number of words heard in the shot / 0 | `{line: null, seconds, word, shot}` - the shot's first counted word, `seconds` no earlier than the shot's start |
+| `unscripted_speech` | Shots are known and a line names the shot; words were heard inside it that align to no line (a line spoken twice, an ad-lib) | Number of unmatched words in the shot / 0 | `{line: null, seconds, end, word, shot, repeats_line}` - the first such word; `repeats_line` is true when those words repeat or contain one of the shot's lines |
+| `speech_not_transcribed` | Between two words of one matched line there is a gap of `UNHEARD_MIN_SECONDS` or more, or one of its words lasts `UNHEARD_MIN_SECONDS` + 2 `UNHEARD_MARGIN_SECONDS` or more, and the interior (trimmed by `UNHEARD_MARGIN_SECONDS` each side) holds a window above `UNHEARD_FLOOR_DBFS`: audible speech the ASR left out of its text, which the line's timing absorbed (#923) | The gap's length in seconds / `UNHEARD_FLOOR_DBFS` | `{line, seconds, end, shot}` - `shot` when the line has one |
 
-Every finding is severity `warn`; `at.shot` is set whenever the shot is known. A rule that does not apply to the call is listed in `rules_skipped` with its reason: `speech_in_silent_shot` is skipped when no shots are known (`line_clipped_at_end` then looks at the file's end only), when the shots carry neither a sample span nor a frame span the take's frame rate can place, or when no line names a shot (no shot is known to be meant silent).
+Every finding is severity `warn`; `at.shot` is set whenever the shot is known. A rule that does not apply to the call is listed in `rules_skipped` with its reason: `speech_in_silent_shot` and `unscripted_speech` are skipped when no shots are known (`line_clipped_at_end` then looks at the file's end only), when the shots carry neither a sample span nor a frame span the take's frame rate can place, or when no line names a shot (no shot is known to be meant silent).
 
 The thresholds are module constants in `dw/tasks/script_check.py`, deliberately not in `RULES` (`dw/assessment_rules.py`): every rule there must fire on a synthetic file that holds no script. The answer echoes them under `thresholds`.
 
@@ -3032,6 +3034,7 @@ The thresholds are module constants in `dw/tasks/script_check.py`, deliberately
 | -------- | ----- | --------------------- |
 | `DEFAULT_SIMILARITY` | 0.85 | A line below this similarity is a `line_mismatch` (the `similarity` argument overrides it) |
 | `GUARD_FLOOR_DBFS` | -65 dBFS (= `DEAD_AIR_FLOOR_DBFS`, `shot_dead_air`'s floor) | A heard word whose loudest window is at or below it is discarded as unheard; also the level a clipped tail must exceed |
+| `UNHEARD_MIN_SECONDS` / `UNHEARD_MARGIN_SECONDS` / `UNHEARD_FLOOR_DBFS` | 1.0 s / 0.25 s / -40 dBFS | A gap in a line's words (or a stretched word) this long, with a window above the floor in its margin-trimmed interior, is a `speech_not_transcribed` |
 | `GUARD_WINDOW_SECONDS` | 0.05 s (= `DEAD_AIR_WINDOW`, `shot_dead_air`'s window) | The window a heard word is measured in - its loudest one, so a span overhanging a pause does not average a real word away |
 | `CLIP_TAIL_SECONDS` | 0.25 s | The final stretch of the file a line's last word must end in to be `line_clipped_at_end` |
 | `REPEAT_RUN_MIN` | 6 | Heard words repeating the same unit this many times over, back to back, are a repetition loop: every chunk holding one is discarded (`reason: "repetition"`), however loud |
diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md
index 94a43ab4..c69a7fe6 100644
--- a/docs/WORKFLOW_GUIDE.md
+++ b/docs/WORKFLOW_GUIDE.md
@@ -270,6 +270,15 @@ produces the shape it needs, and is about to write JSON. `get_schema` says what
 is *well-formed*; this section says what the engine *does* with a well-formed
 document, which is where a draft that validates still fails.
 
+When exploring variations, pass `note` to `run_workflow` saying what each run
+tests ("video_shift 5 against 3"), and call `set_note` to mark the keeper: the
+note is shown with every file the run made. Each file carries a `role`
+(`final` or `intermediate`) inferred from how a step's output is used - a file
+a later run reads (`output:`, or an `asset:` kept from it) lists as
+intermediate too; set `result.role` on a step to override it when the default
+is wrong, and set `"role": "intermediate"` on a workflow whose deliverable is an
+ingredient a later assembly consumes.
+
 ### References
 
 An argument value is a reference when it begins with one of these prefixes.
@@ -702,7 +711,9 @@ by the source, and `validate_workflow` names the entries to add or drop.
    a measured per-entry rate re-priced for your list; `catalog` is a
    measured total for a run whose lists are the ones it was measured with;
    `derived` is that total extrapolated over a list you changed the length
-   of - say it is an estimate; `inherited` is an inline workflow priced
+   of, or scaled along the steps, canvas or frames you moved off the
+   defaults it was measured at (`scaled` names each axis that moved) - say
+   it is an estimate; `inherited` is an inline workflow priced
    from this box's runs of the catalog template with the same pipeline
    (`inherited_from`) - say it is an approximation, and relay the warning
    if offload, quantization or frame count differ; `other_device` is a figure from another
@@ -761,7 +772,7 @@ by the source, and `validate_workflow` names the entries to add or drop.
    arguments={"input_audio": "output:<name>", "lines": [...]})` first (free;
    it takes an audio file or a video's muxed soundtrack directly, and
    `lines` is the script in order, H3 markup allowed, `{text, shot}` to name
-   a line's shot, `[]` for a take that should be silent), then
+   a line's shot (plus `start_frame` when the cut repeats that shot's name), `[]` for a take that should be silent), then
    `run_workflow(..., acknowledged_cost={"fingerprint": ..., "minutes": ...,
    "downloads": [...]})` bound to that plan with `wait_seconds=60`, then
    `get_output_text` on the result, and `delete_output(job_id=...)` the
@@ -971,7 +982,12 @@ longer than that is truncated with an ellipsis in every listing.
 Declare `shape`, `traits` or `summary` at the top level only when derivation
 gets it wrong; a declaration that merely repeats the derivation is noise that
 rots when the rules change, and the repo's catalog tests refuse it. `cost` is
-never derived — leave it absent until a run has been measured. That makes it
+never derived — leave it absent until a run has been measured. A `cost` entry
+is measured at the workflow's variable defaults: a run that moves
+`num_inference_steps`, `width`/`height` or `num_frames` (per entry in a list,
+summed) is quoted scaled in proportion to them, so a figure measured at some
+other size or step count is re-priced to the defaults before it is written
+(dialogue-short's 42 min at 1344x768 is 21.2 at its 960x544). That makes it
 the catalog's verified marker as well: an entry carrying `cost` has been run
 to completion on the device it names, and one without has only been authored
 — its description may still say what it has not been able to check (VRAM at
@@ -986,7 +1002,12 @@ reports the result as `observed` beside the curated `cost`, so a 345-frame
 run never informs a 124-frame figure and a list driver buckets on its length.
 Declaring none is not neutral: the figure then falls back to runs that
 overrode nothing at all, which most real runs do, so a measured workflow with
-no drivers keeps answering "unknown". Each name must be a variable the
+no drivers keeps answering "unknown". A driver the estimate cannot scale
+along - anything but steps, width, height and frames, such as a weights
+dtype, a LoRA name or an audio duration - still splits the buckets (a text
+value buckets by its exact value). When a run moves one off its default, the
+curated figure is kept but carries `low_confidence: true`, and `differs`
+names the drivers, since it was measured at the default. Each name must be a variable the
 workflow declares — `tests/test_observed_cost.py` sweeps the catalog for one
 that is not, since a driver bucketing on nothing looks exactly like a driver
 that works.
@@ -1067,6 +1088,23 @@ story wanted is the cut working, and a level step into a quieter scene can
 be the scene. Tell the person what you confirmed, not what the probe
 reported.
 
+**Comparing outputs.** `compare_outputs(names)` (`POST /api/gallery/compare`)
+lays 2-8 outputs (variations, reruns, the same shot with and without a speed
+setting) in one grid, a row per output and a column per moment, every output
+read at the same frame number, and measures each against a `baseline` (default
+the first). Per non-baseline output it reports PSNR (dB, higher is closer;
+`identical` when equal), SSIM (structure on luma, 1.0 identical) and mean
+absolute difference (0-255, lower is closer), at source resolution, per column
+and as mean/min/max. A shared `crop` is the region both shown and measured; one
+box per name is display only and the metrics stay on the full frame; the reply's
+`region` says which. Outputs of a different size get no numbers (never resized).
+A bare PSNR means little alone; these bands, measured on full frames, are a
+reading aid, not thresholds: about 44 dB is rerun noise (same settings,
+nondeterministic kernels); 23-27 dB means the numerics changed (a different
+cache, attention backend or quantization) but the shot is the same; about 19 dB
+means it was re-staged (the composition changed). Look at the grid before
+trusting a number.
+
 **Remediation.** A *recut* reruns only the join over the shots the run
 already made: each entry in `videos` is `output:` + the run's
 `intermediate/` shot file. That is cheap, and generates nothing new. A
@@ -1219,6 +1257,9 @@ For components the pipeline loads itself — which is all of a modular pipeline'
   `diffusion_decoder`, for example).
 - `attention_backend` — a persistent `set_attention_backend` on one component, which a
   compiled component needs (the pipeline-level `attention_backend` applies per call).
+  Every MiniMax-H3 template wires an `attention_backend` variable (default `null`) here,
+  on its H3 step's `transformer` or `transformer_ref`; see
+  [ACCELERATION.md](ACCELERATION.md) for `sage_hub` and what it needs.
 - `attn_processor_type` — the attention processor the component runs, constructed with no
   arguments and handed to `set_attn_processor`. The `unet` and `transformer` blocks cover
   those two; this covers any other component that carries attention (LTX-2.5's
@@ -1516,10 +1557,18 @@ A `cache` block speeds up inference by skipping redundant computation:
 `cache` wraps diffusers' own cache hooks - `type` is one of `first_block`, `faster`,
 `mag`, `taylorseer` or `text_kv`, each with its own tuning fields (`threshold`,
 `num_inference_steps`, `max_skip_steps`, `retention_ratio`, `cache_interval`,
-`max_order`, `mag_ratios`, `calibrate` — see [dw/workflow_schema.json](../dw/workflow_schema.json) for which
+`max_order`, `mag_ratios`, `calibrate`, `is_guidance_distilled` — see [dw/workflow_schema.json](../dw/workflow_schema.json) for which
 fields apply to which type). See
 [workflows/templates/step-caching.json](../workflows/templates/step-caching.json).
 
+`cache` can also be a whole-object `variable:` reference, which must resolve to a cache
+object or to `null`. A variable resolving to `null` drops the key: no cache, and the only
+true "off", since an installed `first_block` hook changes the output even when it skips
+nothing. The substituted object is checked against the cache shape at validate, so
+`{"type": "bogus"}` or a bare `"first_block"` is refused, naming the field. Every
+MiniMax-H3 template exposes a `cache` variable (default `null`) on its H3 step:
+`"arguments": {"cache": {"type": "first_block", "threshold": 0.05}}`.
+
 ### Device and Dtype
 
 Device is auto-detected (CUDA > MPS > CPU). Dtype is set per-component:
@@ -2609,6 +2658,26 @@ is pinned to, not for every workspace that happens to hold a matching run.
 Deleting a workspace takes its cache entries with it, the same as deleting
 its `outputs/` directory would.
 
+The step cache is also per card and per workflow identity. Identity is the stored
+workflow's name, or an inline workflow's `id`; entries are keyed on the definition `id`
+and step name (`StepCache.get` in `dw/step_cache.py`), and an inline job's identity is
+`("inline", id)` (`workflow_identity` in `dw/worker_protocol.py`). Switching identity on a
+card empties that card's cache (the worker's `_cleanup_all` calls `step_cache.clear()`),
+so:
+
+- running any other workflow on the card in between starts the next run cold: A, then B,
+  then A runs the second A cold. This is the common case. On a multi-card server
+  warm-identity routing (`choose_slot` in `dw/server/pool.py`) mostly avoids it unless
+  that card is busy; on a single card it happens every time.
+- a renamed copy, a new inline `id`, or switching between a stored workflow and its
+  inline copy also starts cold.
+
+To reuse cached upstream steps, rerun the same workflow (same name, or the same inline
+`id`), for example with `rerun_job` or changed arguments. Only arguments that reach
+*later* steps leave the earlier steps cached: changing an argument the expensive first
+step reads re-runs that step. To check before running, `validate_workflow`'s
+`plan.cached_steps` says how many steps would be reused.
+
 ## Type System
 
 Dynamic type conversion applies to certain values:
diff --git a/docs/WORKSPACES.md b/docs/WORKSPACES.md
index f7964b40..4bfdf31d 100644
--- a/docs/WORKSPACES.md
+++ b/docs/WORKSPACES.md
@@ -212,6 +212,11 @@ run fails part way, since the files it did write are on disk either way. A
 sub-workflow is part of its parent's run: it writes into the same directory and
 rolls up into the same manifest.
 
+A pipeline step that ran also carries `timing` in its `manifest.json` entry
+(and in the same entry of the job's manifest from the API or MCP `get_job`):
+load, encode, denoise, decode and save seconds. A reused, task or composed
+step has none. See [Step timing](#step-timing).
+
 An unchanged rerun still reuses the step cache: it writes no new files and its
 manifest reports the earlier run's, marked `"reused": true`. The cache is
 validated against the output *root* a run writes into, which is the pinned
@@ -230,11 +235,65 @@ A later workflow names what an earlier run made with an `output:` reference —
 longer needs files copied back by hand. See
 [Output References](WORKFLOW_GUIDE.md#output-references).
 
+Each step's entry in `manifest.json` records its `role`, `final` or
+`intermediate` (and `role_declared` when the step's `result.role` stated it),
+from that one run's data flow. The gallery reads across runs as well: a file a
+later run in the same workspace read - by an `output:` reference, or by an
+`asset:` that `keep_output` kept from it - lists as `intermediate`, so a
+project's shots, narration and score stop reading as finals once the assembly
+that cuts them has run. Nothing is rewritten; a role `result.role` declared
+`final` stays final, and a run from before roles stays unknown. See
+`dw/roles.py`.
+
 To keep the previous layout — everything at the output root, with only a
 `workflows/`-mirroring subfolder — use `--output-layout flat`, `DW_OUTPUT_LAYOUT=flat`,
 or `"output_layout": "flat"` in settings. Scripts that glob the output directory
 are the reason to.
 
+### Step timing
+
+A manifest entry for a pipeline step that ran - in `GET /api/jobs/{id}`, in
+MCP `get_job`, and on that step's `step_end` event - carries `timing`: where
+the step's time went. It is measured in the worker on its monotonic clock, not
+taken from event timestamps, because the job keeps only the last 200 events and
+the load and encode events are gone from a long job. Every `_s` is seconds to
+0.1. A field whose mark never happened is null, never guessed.
+
+| Field | Meaning |
+|---|---|
+| `load_s` | Loading or fetching the step's pipeline, cached or not |
+| `load_cached` | `true` if the pipeline came from the worker's cache, `false` if any part loaded fresh, null if the step loaded nothing |
+| `encode_s` | Call start to the first denoiser forward (or a modular pipeline's denoise bar opening): prompt and reference encoding and preparation |
+| `denoise_s` | First denoiser forward to the last pass's end. The whole call when the pipeline reports no passes; `encode_s` and `decode_s` are then null |
+| `passes` | Denoise passes the pipeline actually ran: one per iteration of its denoise loop, so one per scheduler timestep. This is not always `num_inference_steps`: SD 1.5's default PNDM scheduler runs 21 passes at 20 steps (N+1 from 2 steps up). `denoise_s` ≈ `first_pass_s + (passes − 1) × pass_s` |
+| `first_pass_s` | The first pass, which carries any compile warm-up |
+| `pass_s` | Median of passes 2..n; null with fewer than two passes |
+| `compiled` | The denoiser runs through `torch.compile` |
+| `decode_s` | Last pass's end to the call's return: VAE decode and post-processing |
+| `save_s` | Writing the step's files |
+| `segments` | Pipeline calls summed into this timing. A chain step sums its segments into one timing with `segments: N`; a step that iterates counts each call. 1 for a plain step |
+
+A step that set a `cache` also carries `timing.cache`: `{type, threshold, forwards, computed, skipped, hit_rate}`. `forwards` counts denoiser forwards, not steps - classifier-free guidance runs two per step (cond and uncond), so it is a whole multiple of `passes` - and `computed + skipped == forwards`; `hit_rate` is `skipped / forwards` to 3 places. A chain sums the counts over its segments. Counted for `first_block` and `mag` (`mag` also reports `num_inference_steps`, `max_skip_steps`, `retention_ratio`, `calibrate`); `taylorseer` (with `cache_interval`, `max_order`), `faster` and `text_kv` keep no per-forward decision in diffusers, so they report `type` and their config keys with `threshold` and every count null. A step with no cache has no `cache` key. If the installed diffusers moved the hook state dw reads, the counts are null and one `warning` event with `kind: "cache_stats_unavailable"` is emitted; the run never fails for it. The same fields arrive live as a `cache_stats` event ([SERVER.md](SERVER.md#progress-events)). See [Reading the skip counts](ACCELERATION.md#reading-the-skip-counts).
+
+A step served from the step cache (`reused: true`) has no `timing`, nor does a
+task step or a composed (sub-workflow) step. A failed or cancelled step has no
+manifest entry, so no timing. Job summaries and history are unchanged.
+
+### Host-memory history
+
+Each finished job's history row records a `memory_key`: a digest of the
+run's pipeline identities (`component_type`, `model_name`, `workflow` of
+every pipeline step) and every `quantization_config`, `offload` and
+`group_offload` value, with the caller's arguments resolved. The
+workflow's name is not in it, so a renamed or inline copy of a template
+shares the template's history, and a different `weights_dtype` or offload
+is a different key. From it the server projects a run's host-RAM peak:
+`observed` (the largest job peak RSS among this machine's successful runs
+with the same key), else `fit` (the list-run projection from the
+workflow's own history), else no figure. Rows recorded before the column
+existed have no key and count as no data. Validate reports it as
+`plan.host_memory`.
+
 ## Several workspaces on one server
 
 Everything above describes one workspace. `dw.serve` goes one step
@@ -324,6 +383,125 @@ A workspace is a **namespace, not a security boundary**. The API token is
 all-or-nothing: anything that can reach the server can name any workspace on
 it. Use them to keep work apart, not to keep it private.
 
+## Copying between workspaces
+
+A run is self-contained on disk, so copying its folder into another
+workspace's `outputs/` is what makes it resolvable there. `copy_to_workspace`
+(MCP) and `POST /api/workspaces/{destination}/copy` ([SERVER.md](SERVER.md))
+do that for runs, named `<workflow>/<run id>` or, for all of a workflow's runs,
+a bare `<workflow>`, and for assets, named as after `asset:` (`cast/iris.png`,
+or a folder such as `proj/` for every file under it). An asset keeps its
+library-relative path, so `uploads/` stays `uploads/` and an `asset:` reference
+means the same file in both workspaces. Its note and its kept-shots entry (the
+folder's `notes.json` and `manifest.json`, including where it was kept from)
+are merged into the destination folder's own sidecars, which are written
+fresh: naming a sidecar directly is a 400, since it travels with its files.
+
+Media is hard-linked, so a copy costs almost no disk, falling back to a real
+copy across devices. JSON sidecars (the manifest, `workflow.json`, notes,
+any `.json`) are always copied, never linked: they are edited in place, and a
+link would carry an edit in one workspace into the other. Nothing follows or
+creates a symlink.
+
+The copy is all or nothing: every entry is checked before anything is written.
+A run whose run id the destination already has is the same run, so it is
+skipped and listed as `already_present`, and repeating a copy changes nothing.
+A run whose job is still queued or running is refused, since its manifest is
+not final. An asset the destination already holds with the same bytes is
+skipped as `already_present` too; a different file at that path is a conflict,
+never replaced. Every conflict, runs and assets alike, is named in one 409
+before anything is written.
+
+Because a copied asset is a hard link, nothing edits media in place: an upload
+over an existing name writes a new file and renames it into place, and
+`keep_output` and `delete_asset` unlink first, so an edit in one workspace
+never reaches the other.
+
+A run keeps its `vN` unless the destination already uses that number for the
+workflow. Then this request's runs of that workflow are renumbered after the
+destination's highest, in run-id order, under the run lock so a concurrent run
+cannot take the same number. `renumbered` reports each `from` and `to`. Pinned
+`output:` references name run ids, so none of them break.
+
+The reply carries warnings, not refusals: `unresolved_output_refs` (a run's
+`output:` input that does not resolve in the destination), `absolute_paths`
+(manifest paths that still point into the source workspace, reported relative
+to the source workspace's root) and `no_jobs`. A copied run has no job record, so it appears in
+the gallery and resolves as an `output:` reference, but not in `list_jobs`.
+
+A move is a copy, then a delete of the source runs (`delete_output`, or
+`DELETE` on the gallery runs) and assets (`delete_asset`); there is no move that could lose a run halfway.
+
+## Running a sweep
+
+A sweep answers one quality or speed question by rendering the same request
+under several configurations, changing one factor at a time, and keeping the
+results together. There is no sweep tool: every step is one call to a tool
+dw already has.
+
+1. **One workspace per experiment.** `create_workspace` a workspace for it,
+   then `use_workspace`. Put the question and the factor list in its
+   workspace note, so the experiment explains itself to the next session:
+   `set_note("workspace:<name>", "Q: does steps change the face? factors: steps 4/8/12")`.
+
+2. **A base workflow with every factor as a variable.** If a catalog
+   template already exposes the factor as a variable (`get_workflow(name,
+   variables_only=true)`), run the template. Otherwise `get_workflow` it,
+   add a variable for each factor, put `variable:<name>` where the value
+   was, and `save_workflow` the copy into the experiment's workspace.
+   `text-to-image` fixes `num_inference_steps` at 25, so a steps sweep saves a copy
+   with `"steps": 25` under `variables` and `"num_inference_steps":
+   "variable:steps"` in the step. A factor that is a dtype or a quantization
+   name keeps its braces in the default, `"{nf4}"`, so it reaches the
+   pipeline as a string ([Types and escaping](WORKFLOW_GUIDE.md#types-and-escaping)).
+   Keep the template's `cost` block in the copy, or `plan.estimate` has no
+   basis to quote from.
+
+3. **Pin the seed, change one factor per variant.** Every variant passes the
+   same `seed` in `arguments`, and differs from the base in one factor only.
+   A factor can change the cost, so `validate_workflow` each variant with its
+   `arguments`, quote each one's `plan.estimate`, and get one go-ahead
+   for the whole list.
+
+4. **One `run_workflow` per variant, with a `note`.** The note's first line
+   is the overrides, `steps=8` or `steps=20 attention=sage`, so a listing
+   that clips notes still shows which variant is which. Call `wait_for_job`
+   until the variant finishes before submitting the next. The server holds a
+   second large variant until the host can hold it beside the first (see
+   [SERVER.md](SERVER.md)), so waiting is for ordering, not for memory.
+
+5. **Only the latest run of a step is cached.** The step cache holds one
+   entry per workflow step: its most recent run. A variant whose step and
+   seed match that run, such as the same variant submitted twice in a row,
+   is served from the cache: its manifest marks the step `"reused": true`
+   and lists that run's files ([Runs](#runs)). Going back to an earlier
+   variant after another one has run renders it again. Each card's worker
+   keeps its own cache, and a server restart empties them. Either way a
+   re-render is expected, not a failed variant.
+
+6. **The results table.** `list_jobs(workspace=<name>)` gives each variant's
+   job id, status and note. `get_job` on each gives its arguments, step
+   `timing` ([Step timing](#step-timing)) and files.
+
+7. **Assess each output with `set_note`.** Put the note on the output file
+   (its gallery name, as `list_gallery` gives it). The first line is the
+   score and who judged it, then one `key: value` line per facet:
+
+   ```
+   score 4/5 · judged_by claude-opus-5-5
+   faces: sharp, eyes aligned
+   staging: matches the brief
+   defects: none
+   ```
+
+   `get_gallery_metadata` returns the whole note. `list_gallery` and
+   `list_jobs` clip a note to its first 200 characters, so keep the
+   first line short: it is what a listing shows.
+
+8. **Keep the winner.** `keep_output` the winning file under a stable
+   `asset:` name, and put the conclusion (the answer, and the variant that
+   gave it) in the workspace note.
+
 ## Where this is going
 
 The resolver, the workflow search path with writes confined to the writable
diff --git a/docs/proposals/complete/acceleration-warnings-complete.md b/docs/proposals/complete/acceleration-warnings-complete.md
new file mode 100644
index 00000000..b6435857
--- /dev/null
+++ b/docs/proposals/complete/acceleration-warnings-complete.md
@@ -0,0 +1,128 @@
+# Validate warnings for acceleration settings that can't pay off (#868)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-14). Don approved plan v2 on 2026-10-14. Stage A, #887, shipped the
+same day at `develop` @ `c96e9531` and was verified on mini-ai (mps).
+
+## The idea
+
+Don's H3 quality matrix on lem (2x RTX 3090 24 GB, workspace `h3-quality`)
+had three acceleration settings that each took a render to show they were
+wrong, though all three could be known at validate time:
+
+1. **P2:** a `first_block` cache at 0.05 on 12 base steps skipped nothing
+   (12.79 vs 12.89 min) and still changed the output (PSNR 25.6 dB).
+2. **P5:** `taylorseer` (`cache_interval` 3, `max_order` 1, 30 steps,
+   1344x768, 4 refs) passed validate and ran out of memory 2 min in (job
+   a28aa8ffb931).
+3. **P3:** `compile: {repeated_blocks: true}` on a group-offloaded int8
+   transformer added 289 s on the first pass and saved about 0.6 s per pass
+   after that. The worker released the compiled pipeline on every workflow
+   change, so the cost was paid again each time.
+
+## Verdict and scope
+
+**Build smaller, in one stage.** #1 and #2 became validate warnings. The
+same check picked up two related rules: `fullgraph` with a cache
+(`ACCELERATION.md` stated it and nothing checked it) and a CUDA-only
+attention backend on a server that isn't CUDA (#865's agreed follow-up).
+#3 is docs only.
+
+Corrections the plan made to the proposal:
+- **No turbo-LoRA clause.** Every turbo schedule in the catalog is 9 steps
+  or fewer, so `steps < 20` already covers it. Detecting turbo would mean
+  matching filenames in the engine, which CLAUDE.md forbids.
+- **Threshold caches only** (`first_block`, `mag`). `taylorseer` and
+  `faster` skip on a fixed interval, and `text_kv` skips no steps.
+- **TaylorSeer is not charged in the estimate.** `vram_estimate` errors
+  are hard and `required_vram_gb` drives dispatch, so charging the state
+  would turn a warning into a refusal. The engine also holds no
+  architecture data to size it with. So #2 is a separate warning, and
+  neither the code nor the docs give a state size.
+
+## Decisions (Don's review of plan v1, 2026-10-14)
+
+- **Q1.** #3 is docs only, no warning.
+- **Q2.** `mag` is included in the short-schedule rule.
+- **Q3.** The `fullgraph` + cache warning is included.
+- **Q4.** The TaylorSeer warning always fires when TaylorSeer is set.
+- **Changes:** add `attention_backend_unavailable`, keyed on a named set of
+  backends rather than the `_hub` suffix. Shrink the #3 docs to one fact
+  (compile is paid again when the worker releases the pipeline). Give no
+  TaylorSeer state size. Keep 20 steps as the single threshold: nothing
+  between 12 and 30 steps had been measured, and #875 measures 20.
+
+## What was built
+
+### Stage A, #887: `acceleration_warnings`
+
+- **Engine:** `dw/acceleration_warnings.py`. It is registered as the last
+  entry of `WARNING_CHECKS` in `dw/validation.py`, and it resolves values
+  through variables and arguments. Strings use the existing
+  `<path>: <code>: <message>` form, so no wire shape changed. The codes:
+  - `cache_short_schedule`: a `first_block`/`mag` cache where the resolved
+    `num_inference_steps` is below `CACHE_MIN_USEFUL_STEPS` (20).
+  - `taylorseer_state_unestimated`: always fires on `type: taylorseer`, and
+    names `max_order`. It adds "estimated at X of Y GB" only when the
+    workflow declares a `vram_estimate` and the device capacity is known.
+  - `compile_fullgraph_with_cache`: a component with `compile.fullgraph:
+    true` in a pipeline that has a cache.
+  - `attention_backend_unavailable`: a backend in
+    `CUDA_ONLY_ATTENTION_BACKENDS` (the flash, flash-3, sage and xformers
+    families plus `aiter_fa2_hub`, Hub kernels included), at pipeline or component
+    level, on a known device that isn't CUDA. The device is compared with
+    `get_device_type()`.
+  - A value that can't be resolved, or an unknown device, keeps its
+    warning silent. No warning ever refuses.
+- **Save path:** `_write_validated` (`dw/server/routes/library.py`) runs
+  only selected warning checks, not the whole registry. It now also runs
+  `acceleration_warnings`, so `save_workflow` returns the same codes as
+  `validate_workflow`. This was the tester's bounce (see below).
+- **Map:** `docs/ARCHITECTURE.md`, *Validation, plan and cost*, has an
+  *Acceleration warnings* row.
+- **Docs:** `docs/ACCELERATION.md` names all four codes, gives the P5 OOM
+  configuration with no state size, says the compile cost is paid again
+  whenever the worker releases the pipeline, covers `fullgraph` with a
+  cache, and has the backend warning in the MPS notes. It also removes the
+  old line saying that validation doesn't check the backend.
+- **Tests:** `tests/test_validation.py::TestAccelerationWarnings` covers
+  every boundary through the real `validate` path, checks that no catalog
+  workflow emits the three device-independent codes, and checks that none
+  of the codes refuses.
+  `tests/test_validate_arguments.py::test_save_workflow_carries_the_acceleration_warnings`
+  covers the save route.
+
+Deviations from the plan, all recorded on #887: the check lives in its own
+module instead of inline in `validation.py`; `aiter_fa2_hub` is in the
+CUDA-only set; a `for_each` step's members share one path, so each code
+appears once per path.
+
+## Verified
+
+On mini-ai (mps), over MCP only: C-F446 to C-F453. The case that
+`attention_backend_unavailable` stays silent on CUDA needs a CUDA server.
+On mps it is covered only by unit tests with a patched device.
+
+## Bounces per stage
+
+- **Stage A, #887: 2.**
+  - **Architecture review (1):** the new module had no row in
+    `docs/ARCHITECTURE.md`. The row was added (`547a82c6`).
+  - **Tester (1):** C-F451 step 2. `save_workflow` didn't return the
+    acceleration warnings, because the plan wrongly assumed save runs the
+    whole `WARNING_CHECKS` registry. Fixed in `bf448a2a` (`c96e9531`).
+
+The stage cost isn't recorded, because the stage comments give no `usage:`
+figures. The plan estimated $4-5.
+
+## Deferred
+
+- **#3 as a warning** (Q1). It is docs only. Reconsider if an agent keeps
+  paying the compile cost across workflow changes.
+- **Sizing TaylorSeer state** in the estimate. The engine has no
+  architecture data, and the estimate drives dispatch and refusal.
+- **A `mag.num_inference_steps` / pipeline-steps mismatch warning.** The
+  schema says the two must match, and nothing checks it. It hasn't yet been
+  shown to cost a render. Don decides whether it becomes its own issue.
+- **The 20-step threshold** is a heuristic. #875's threshold experiments
+  may move it, and it is a single constant.
diff --git a/docs/proposals/complete/catalog-adapter-check-complete.md b/docs/proposals/complete/catalog-adapter-check-complete.md
new file mode 100644
index 00000000..7f832ee7
--- /dev/null
+++ b/docs/proposals/complete/catalog-adapter-check-complete.md
@@ -0,0 +1,133 @@
+# Catalog-backed H3 adapter partition check (#870)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-14). Plan v2 approved by Don as "build smaller" on 2026-10-14;
+one stage, #888 (A), verified on lem.
+
+## The report
+
+On the H3 quality matrix (lem, workspace `h3-quality`), the fal Realism
+People LoRA (`fal/MiniMax-H3-Realism-People-LoRA`,
+`h3-realism-people-t2v-i2v-r2v.safetensors`) was put on a Ref2VA
+(`transformer_ref`) step to fix faces. It was inert and cost a full render
+to find out. `dw/adapter_compatibility.py` decided from the filename tokens
+`ref2v` / `fl2v`; this name has neither (its `r2v` even suggests reference
+support), so validate only warned "names neither". The file's safetensors
+`__metadata__` says `base_model: minimax-h3-fl2va`. On FL2VA/I2VA it works
+(R3: 4/5 faces).
+
+The ask was to read that header during validation and prefer `base_model`
+over the filename.
+
+## Decisions
+
+- **Plan v1: build smaller.** The catalog already said it:
+  `loras/minimax-h3/realism-people.json` had `"workflow": "t2va"`,
+  `"status": "proven"`. The check just never asked the catalog. Wire the
+  catalog in; cut the header read, because:
+  1. it is I/O on the hottest validation path (every validate, admit,
+     `for_each` member and composed child), which is free and offline today;
+  2. a local-path read during validate is a directory-existence oracle
+     (`plan.py` refuses exactly that);
+  3. a ranged Hub GET breaks "`lora_hub.py` is the only place dw searches
+     the Hub";
+  4. `__metadata__` is uploader-written: it shouldn't turn a warning into a
+     refusal;
+  5. only one vendor key (`base_model`) was evidence.
+- **Q1:** a catalog entry that disagrees with the filename token warns,
+  never refuses. **Q2:** the revision is ignored. **Q3:** not needed (if a
+  `save_lora` pre-fill comes back, trust `base_model` only).
+- **Build stop on v1 (#888, 2026-10-14):** v1 assumed the catalog was
+  layered per workspace. It isn't: `server_lora_library(state)` is one
+  library shared by every workspace, so one agent-written trial entry would
+  refuse a file server-wide.
+- **Don's ruling (a) → plan v2:** keep the one shared catalog, add no
+  layering. **Only a `proven` entry can refuse**; a `trial` or `rejected`
+  entry that conflicts with the step's partition warns, naming the entry
+  and its status. No new evidence requirement on `proven`. Scope narrower
+  than v1.
+- **Non-goals held:** no header reads, no Hub request from validation, no
+  non-H3 base-model checks, no change to the filename rule, no per-workspace
+  catalogs, no MCP/REST/syntax change.
+
+## What was built
+
+**Stage A, #888** (server + data + docs), `feat/870-A-catalog-adapter-check`
+(27674293, 687e288a), merged to `develop` as `9a210585`:
+
+- **`adapter_compatibility.catalog_index(entries)`**: `(model_name,
+  weight_name) -> (entry, workflows, status)`, revision ignored. With no
+  index the result is the old rule.
+- **Partition, not workflow** (`_catalog_partition`): all of
+  `{t2va, fl2va}` is `transformer`, `ref2va` is `transformer_ref`, a mix
+  decides nothing.
+- **Status order:** a `proven` conflict is an error naming the entry
+  ("catalog entry 'minimax-h3/realism-people' (proven) lists it for 't2va,
+  fl2va', which denoises against 'transformer'…"); a `trial`/`rejected`
+  conflict is a warning naming the entry and status; an agreeing entry
+  clears "names neither" but a `trial` one never lifts a filename-token
+  error; a `proven` entry that disagrees with a token is a warning naming
+  both.
+- **Callers:** `deps.lora_index(state)` is built from the shared
+  `catalog_entries(state)` (moved from `routes/loras.py` to `deps.py`, so
+  `list_loras` and validation read one function), cached on
+  `state.lora_indexes` keyed on the listing's (name, path, mtime). Passed by
+  `admit_for` (`/api/validate`, submit, rerun, enhance-admit) and the save
+  path in `routes/library.py`. The CLI `dw.validate`, the worker and
+  `warn_adapters` pass none: the server is stricter than the worker, never
+  looser.
+- **Data:** `realism-people.json` `workflow` is `["t2va","fl2va"]`,
+  `use_when` says "not reference-to-video", new `evidence` note (#870); it
+  stays `proven`.
+- **Docs:** the module docstring, `docs/ARCHITECTURE.md`, `docs/SERVER.md`,
+  `docs/LORAS.md` (a `proven` entry's `workflow` is enforced on the server;
+  a `trial` one only warns; promoting is what makes it refuse), and the
+  `minimax-h3` skill's `checkpoints-and-loras.md` ("validate refuses it on
+  `ref2va`").
+- **Tests:** `tests/test_h3_adapters.py` (`test_a_proven_*`,
+  `test_a_weaker_*`, `test_no_index_is_todays_rule`, null/mixed fallback,
+  `arguments.<name>` path, `test_one_build_per_listing_for_every_member`,
+  `test_a_trial_entry_warns_and_promoting_it_refuses`); the
+  `workflows/**/*.json` sweep also runs with the packaged catalog.
+
+**Deviations from the plan**, both accepted at verify:
+- Two entries covering the same file: the index keeps the stronger status
+  (proven > trial > rejected).
+- A `trial` conflict on a no-token file gives the entry's warning *in place
+  of* "names neither", not both.
+
+## Bounces per stage
+
+| Stage | Bounces | Cause |
+|---|---|---|
+| A, #888 | 0 (1 build stop) | The build stopped on v1's per-workspace catalog assumption; re-planned as v2 (Don's ruling (a)), re-decomposed and re-specced. Verified first time on v2. |
+
+No stage comment names `usage:` figures, so per-stage cost is not recorded.
+The plan estimated ~$3-5.
+
+## Verification notes
+
+- Verified over MCP on lem `develop` @ f73088a5: M-F142-M-F145, M-F147,
+  M-F152 and M-F153 pass. M-F142(c): `run_workflow` with Realism on
+  `reference-to-video` is refused at `arguments.lora_weight_name` with no
+  job queued.
+- M-F144(b): the `ref2v` turbo on `fl2va` is refused by the proven catalog
+  message (`minimax-h3/turbo-reference (proven)`), not the filename message;
+  v2 lets a proven entry decide.
+- M-F146 (v1 workspace layering) contradicts v2 and was not run; retiring it
+  is dkackman/harnest#122.
+- mini-ai (MPS) was not checked, and its restart is Don's.
+
+## Deferred
+
+- **Reading safetensors headers**, reopened only by a second render lost to
+  a LoRA the catalog doesn't cover, or a run of uncatalogued H3 trials that
+  keep saying "names neither". It would go into `save_lora` /
+  `recommend_loras` (which already read Hub headers via `lora_hub.py`) to
+  *pre-fill* an entry's `workflow`, trusting `base_model` only; the
+  validator stays free.
+- **Edges with no shipped entry** (a `proven` entry against its own token, a
+  mixed list, a `rejected` entry with a `workflow`): unit-tested only, since
+  probing them over MCP needs a `save_lora` write to the shared catalog.
+- **CLI `dw.validate` stays on the filename rule** (documented; the safe
+  direction).
diff --git a/docs/proposals/complete/compare-outputs-complete.md b/docs/proposals/complete/compare-outputs-complete.md
new file mode 100644
index 00000000..49abc5dd
--- /dev/null
+++ b/docs/proposals/complete/compare-outputs-complete.md
@@ -0,0 +1,131 @@
+# `compare_outputs`: aligned grids and diff metrics across runs (#871)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-14). The idea came from the H3 quality matrix on lem (workspace
+`h3-quality`). Every judgement there needed local tooling: ffmpeg contact
+sheets, `tools/facegrid2.py` face crops and `ffmpeg psnr` against a baseline.
+A text-only MCP client can do none of that. Plan v1 was designed on #871.
+Don's review made v2, which says metrics always compare the same pixels and
+moves the plugin pointer out of the full `SKILL.md`. Don approved v2. It was
+built as one stage, #889. The plan comment on #871 stays the full design;
+this is the record of what shipped.
+
+## The problem
+
+Judging "did this knob change the picture, and how much" across runs took
+N `get_output_frames` calls, aligned by eye, and nothing in dw computed PSNR
+or SSIM. The numeric half could not be done from a client without ffmpeg.
+
+## Verdict: build smaller
+
+Cut from the proposal, with what would bring each back:
+- **`crops: "faces"`** (stage B, deferred and not filed). YuNet is already in
+  `dw/tasks/face_track.py`, so it needs no new dependency. *Trigger:* a field
+  report showing per-output coordinates are still the bottleneck. *To settle
+  before filing:* where the YuNet weights are downloaded. `face_track`
+  downloads them in the worker; stage B would otherwise fetch them in the
+  server process.
+- **`same_staging`.** dw reports findings, not verdicts. The matrix's bands
+  are in the guide as a reading aid instead: ~44 dB is rerun noise, 23–27 dB
+  is changed numerics, ~19 dB is a re-staged shot. *Trigger:* two or more
+  comparison sessions read the bands the same way and want it as a field.
+- **`layout`.** A sheet and a grid are the same output with more or fewer
+  columns.
+- **Saving the grid.** dw has no run-less output. The grid comes back
+  inline, like `get_output_frames`. *Trigger:* someone asks to keep one, as a
+  `keep_as` that writes to the asset library.
+
+Non-goals stayed out: `latest`/`vN` expansion in names, audio comparison,
+and resizing outputs to make different sizes comparable.
+
+## Plan history
+
+- **v1:** per-output crops computed metrics whenever the boxes were the same
+  size, and a pointer line went in `minimax-h3/SKILL.md`.
+- **v2 (approved):** Don's review settled that **metrics always compare the
+  same pixels**. One shared crop is both what is shown and what is measured.
+  Per-output crops are display only, and metrics then cover the full frame.
+  The plugin pointer moved to `minimax-h3/references/quality-and-speed.md`,
+  because `SKILL.md` was at 12,282 of 12,288 bytes. The route became a sync
+  `def` so decode and SSIM run in FastAPI's threadpool. Q1: a new tool. Q2:
+  per-output crops, with the rule above. Q3: raise `SURFACE_BUDGET` with a
+  dated ledger entry.
+
+## What was built
+
+### Stage A (#889): `compare_outputs` and `POST /api/gallery/compare`
+
+Commits f15ca771 (the route and `dw/media_compare.py`), 9c3c23a2 (the MCP
+tool and tests), 74700668 (docs and the OpenAPI snapshot), 93d06dbe (map
+rows and the single owners for the `at` and crop parses) and 99f04d67
+(negative moments refused, `max` in the reply).
+- **Engine:** `dw/media_compare.py` owns `compare`, `psnr`, `ssim` (601
+  luma, 11×11 Gaussian window, σ 1.5, numpy + `cv2.GaussianBlur`, no
+  `skimage`), `mean_abs_diff`, `check_request` and `crop_box`. The grid
+  reuses `dw/media_frames.py`'s compositor. It runs in the server process,
+  needs no GPU and queues nothing.
+- **Reply:** one grid image, with rows for outputs in the given order
+  (labelled, `(baseline)` marked) and columns for moments (each cell stamped
+  `frame N`). It also has a text summary per non-baseline output, per column
+  and as mean/min/max, with `identical_columns` counted apart so ∞ doesn't
+  skew the mean. It names the `region` measured.
+- **Nulls with a reason, never a resize:** `size differs from baseline: WxH
+  vs WxH`. A moment past an output's end gives a blank cell and `past end (N
+  frames)`. `fps_differs` flags clips compared by frame number at different
+  rates.
+- **Shared owners:** `media_frames.moment_index` owns the `at` grammar and
+  `media_frames.parse_crop` owns the `[x, y, w, h]` parse. They are used by
+  both `get_output_frames` and `compare_outputs`, and each tool keeps its own
+  bounds policy. `docs/ARCHITECTURE.md` *Media and DSP* has an **Output
+  comparison** row and a **Frame moments and crops** row.
+- **Surface:** the MCP tool count went from 64 to 65. `SURFACE_BUDGET` is
+  14,990, with a dated ledger entry for the measured 14,989.25.
+- **Docs:** `docs/MCP.md` (a tool row), `docs/SERVER.md` (the route),
+  `docs/WORKFLOW_GUIDE.md` *Assessing a run's output* → "Comparing outputs"
+  (the metrics, the region rule and the dB bands as a reading aid), and
+  `quality-and-speed.md` (one line).
+- **Tests:** engine tests in `tests/test_media_compare.py`, route tests on
+  real PyAV-encoded clips and PNGs in `tests/test_compare_route.py`, and MCP
+  pins and summary tests in `tests/test_mcp_server.py`.
+
+**Deviations from the plan:**
+1. **A crop must lie inside every output's frame, or it is a 400.**
+   `get_output_frames` clamps instead. Clamping per output would measure a
+   different region in each row.
+2. **The summary gives mean, min and max**, more than the plan's "mean and
+   min". `max` was dropped from the MCP text at first and restored in
+   99f04d67.
+3. **A grid that can't shrink without going under the 64 px per-cell floor
+   comes back unshrunk**, with `downscaled_to` null and a note that it is
+   over budget. It does not claim a shrink that didn't happen.
+4. **Negative moments are refused** (`'frame:-1' is negative - moments count
+   from the start of the clip`). `get_output_frames` still counts them back
+   from the end. That makes two bounds-policy differences from frames'
+   grammar: this one and past-end. It came from acceptance case C-F463,
+   through `moment_index(from_end=False)`.
+
+## Verification and bounces
+
+| Stage | Bounces | What bounced |
+|---|---|---|
+| #889 | 2 | Architecture review: there was no map row for `dw/media_compare.py`, and it had second owners of the `at` grammar and the crop parse (fixed 93d06dbe). Verify on mini-ai: C-F463 call 9, where `frame:-1` and `-1.0` wrapped to the end of the clip instead of being refused (fixed 99f04d67). |
+
+- #889 was verified on mps (mini-ai, develop @ 5ff05cf5) against C-F454 to
+  C-F466 and SE-F049. All 14 cases pass. Nothing in the stage is
+  CUDA-specific.
+- Cost is not recorded: the stage comments name no `usage:` figures.
+
+## Found along the way
+
+- **The fixture literal in C-F454/C-F459:** `qr_code` squares its output, so
+  S is 640×640, not 640×384. The tester filed a suite amendment on harnest.
+- **Cosmetic, not changed:** in a one-column grid (stills), row labels are
+  clipped at the cell width.
+- **Not a server issue:** C-F466's tool-count check is vacuous over MCP,
+  because no tool reply states the count.
+
+## Follow-up
+
+#861, #875, #862 and #865 each end in "is variant X the same as baseline?".
+They can now answer that over MCP with `compare_outputs` instead of local
+ffmpeg.
diff --git a/docs/proposals/complete/estimate-scaling-complete.md b/docs/proposals/complete/estimate-scaling-complete.md
new file mode 100644
index 00000000..6196db5f
--- /dev/null
+++ b/docs/proposals/complete/estimate-scaling-complete.md
@@ -0,0 +1,115 @@
+# Scale the curated estimate instead of dropping or repeating it (#866)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-15). Plan v4, approved by Don as "build smaller" on 2026-10-14 (v1 → v2:
+Q1-Q5 and the fingerprint ruling. v2 → v3: the stage 0 re-plan. v3 → v4: two
+fixes to stage A's acceptance). Four stages: #905 (0), #906 (A), #907 (B) and #908 (C),
+all verified on lem.
+
+## The report
+
+`POST /api/validate` quoted ~42 min for the ep 6 dialogue-short no matter what
+changed. The H3 quality matrix (lem, workspace `h3-quality`, 15 rungs of one
+Ref2VA shot, 124 frames, 4 refs) measured the same shot at 3.5 to 44.2 min,
+depending on canvas, weights, LoRA, steps, attention and cache. Agents quote
+`plan.estimate` before every run, so the quote was off by up to 12x in either
+direction. It was the tenth estimate bug in this class (#267, #255, #301,
+#589, #590, #593, #796, #821, #851).
+
+The code check (plan v1, at a27ad5aa) found that the flat figure had three
+sources, not one:
+- **Catalog path.** A move of steps, canvas or frames off the defaults made
+  `_own_price` return `basis: unknown`. It was not scaled.
+- **Default bucket.** Runs that differed only in weights, LoRA, attention or
+  cache landed in it, because those were not drivers.
+- **Inherited path.** `_scale_past_template` scaled by pipeline-step count
+  and frames only, not by `num_inference_steps` or the canvas.
+
+## What was built
+
+- **Stage 0 (#905): the fingerprint and step cache are keyed only by what
+  changes the output.**
+  - `cost_drivers`, `vram_estimate` and the other documentation and cost
+    metadata no longer reach the plan fingerprint or the step cache keys. The
+    exclusion list is pinned by a test.
+  - Integral floats are canonicalized in the fingerprint, so `12.0` and `12`
+    digest alike. That was the inline vs. by-name mismatch.
+  - Seed stays out of the fingerprint (the #85 contract). The step cache keys
+    on it.
+  - The step cache keeps `subfolder` and `file_base_name`, because a hit
+    replays files to their recorded paths.
+- **Stage A (#906): the catalog figure scales.**
+  - `scale_curated` gives
+    `minutes = curated × steps/steps₀ × (w·h)/(w₀·h₀) × frames/frames₀` on the
+    four generic driver names (`num_inference_steps`, `width`, `height`,
+    `num_frames`). `num_frames` is summed across a list's entries.
+  - The result is `basis: "derived"`, and `scaled` names each axis that moved.
+  - It multiplies with list-length repricing (`_repriced`). `_tempered` blends
+    toward the scaled figure.
+  - A non-numeric driver value still gives `unknown`.
+  - The rule "a `cost` entry is measured at the workflow's variable defaults"
+    is written in the schema and WORKFLOW_GUIDE.
+  - dialogue-short's `cost` was re-priced from 42 to 21.2 for its 960x544
+    defaults.
+  - The 30% accuracy bar is `TestScalingAccuracy`: B4→B1 16.5 vs 15.1, B4→B5
+    13.0 vs 11.8, B3→L5 32.3 vs 29.5.
+  - The UI's `derived` wording shows `scaled`.
+- **Stage B (#907): unscalable drivers.**
+  - Any other declared scalar driver that moves off its default keeps the
+    (scaled) figure, sets `low_confidence` and is listed in `differs`. This
+    holds for every template, with no engine allow-list.
+  - The H3 templates add `weights_dtype`, `lora_model_name`,
+    `attention_backend` and `cache` to `cost_drivers`, so an int8 or native
+    attention run no longer pools with the default bucket. LoRA buckets by its
+    exact name.
+  - Thanks to stage 0, the new drivers leave H3 fingerprints unchanged.
+- **Stage C (#908): the inherited path scales the same way.**
+  - `_scale_past_template` reuses `scale_curated`'s steps and canvas ratios,
+    so there is one owner and inline and template quotes agree (C-F484:
+    within 2%).
+  - `inherited_differences` compares attention, cache and LoRA too, through
+    `replace_variables` (no second owner of substitution).
+  - A reference the definition doesn't declare compares as null.
+  - Numbers compare by value: `same_number` moved to `dw/variables.py` and is
+    shared with the fingerprint.
+
+## What was cut or deferred, and why
+
+- **Compile as a cost driver.** No H3 template exposes a `compile` variable,
+  and a driver must be a declared variable. It comes back if a template
+  exposes compile.
+- **A learned fixed + passes × s/pass fit.** Deferred by Don. Plain
+  proportional scaling over-quotes by about 9-10% on the matrix pairs,
+  because it ignores load, encode and decode time. It is also slightly
+  under-superlinear in pixels (2.27x measured for 1.98x pixels). Both are
+  inside the 30% bar. A miss past 30% is the trigger to build the fit.
+- **`passes = steps − 1`.** That is H3 scheduler knowledge, so it can't live
+  in the engine. The engine uses a plain step ratio (Q2).
+- **Price precedence for a saved copy with its own `cost` and no runs**
+  (catalog vs. inherited) is unchanged (v3 review).
+- **The step cache across identities.** A renamed or inline copy can't hit
+  the cache: it is per card and cleared on an identity switch. That is a
+  memory-policy change, filed as #912 (idea).
+- **The validate probe ignores the card's warm identity**, so it can report
+  `cached_steps` that the run's identity switch then clears. Filed as #911
+  (bug).
+
+## Bounces per stage
+
+| Stage | Verify bounces | Architecture bounces | Notes |
+|---|---|---|---|
+| #905 (0) | 1 | 0 | The bounce showed that v2's "a metadata-only copy hits the step cache" can't hold under the cache's per-identity scope. Re-planned as v3 (in-place edit only), plus the integral-float fix. |
+| #906 (A) | 0 | 0 | |
+| #907 (B) | 0 | 0 | |
+| #908 (C) | 3 | 2 | Architecture: a second owner of the scaling rule, then a second owner of `variable:` substitution. Both were folded into the single owners. Verify: C-F485 `differs: ["LoRA"]` at the defaults, three times. Parked after the 4th hand-off; Don ruled that the plan stands. The causes were an undeclared null-default variable and then `lora_scale` 1.0 vs 1 after a client's JSON round trip. |
+
+Cost per stage: the stage comments record no `usage:` figures, so none is
+given here. The plan estimated ~$2 / $5 / $3 / $4.
+
+## Rules this feature added
+
+- A `cost` entry is measured at the workflow's variable defaults.
+- The plan fingerprint and the step cache are keyed only by what can change
+  the output (pinned in `docs/ARCHITECTURE.md` and its tests).
+- A number is its value, not its spelling, in the fingerprint and in the
+  inherited-cost comparison.
diff --git a/docs/proposals/complete/h3-keyframe-audio-complete.md b/docs/proposals/complete/h3-keyframe-audio-complete.md
new file mode 100644
index 00000000..8e694ad3
--- /dev/null
+++ b/docs/proposals/complete/h3-keyframe-audio-complete.md
@@ -0,0 +1,103 @@
+# A locked H3 frame that lip-syncs to a song (#852)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-14). Plan v0 (the issue body's *Proposed*) approved by Don on
+2026-10-13 and capped at four H3 renders on lem; three stages: #877 (A) and
+#878 (B) verified, #879 (C) closed not planned by its own condition.
+
+## The report
+
+A field report: for a music-video finale, an agent had to choose between a
+still camera and real lip-sync. `first-and-last-frame` (FL2VA) pins the
+frames and holds a wide two-shot, but takes no audio. `reference-to-video` /
+`music-video` (Ref2VA) lip-syncs to the song, but the camera drifts on wide
+two-shots. It rendered the finale as solos.
+
+MiniMax's Ref2VA prompt guide lists `keyframe completion` as a task type
+(an image as the target video's first frame, keyframe or last frame), and
+task types combine with ` + `. So `[keyframe completion + audio reuse]` is
+a valid Ref2VA task. Whether Ref2VA, which treats the keyframe as a
+reference anchor, holds a locked two-shot as FL2VA does was untested.
+
+## Decisions
+
+- **Don's ruling (2026-10-13):** approved as proposed, capped at four H3
+  renders on lem, all on one wide two-shot and one ~8 s song slice, each
+  with its `plan.estimate` quoted first. Either outcome becomes a
+  `minimax-h3` skill line; a template variant only if the recipe holds and
+  needs a shape of its own.
+- **Routing (2026-10-14):** first routed to the tester, whose handoff
+  session couldn't run it; Don re-routed it to the lead as an approved
+  experiment.
+
+## What was found (stage A, #877)
+
+Same still (`asset:h3-keyframe-audio-two-shot.jpg`) and 8 s duet slice
+(`asset:h3-keyframe-audio-duet-8s.wav`, 192 frames at 24 fps, 960x544) for
+all four. The man sings 0-2.8 s, the woman 4.4-7.3 s.
+
+| # | Job | Variant | Time | Camera hold | Lip-sync |
+|---|-----|---------|------|-------------|----------|
+| 1 | `03c511a226bd` | Ref2VA, `<Picture 1>` first frame + `<Audio 1>` (`hold_audio`) | 13.3 min | Holds, static all 8 s; frame 0 re-creates the still (a touch wider), not its pixels | Right singer on each line |
+| 2 | `d2f11181111b` | The same plus `<Picture 2>` last frame | 19.3 min | Holds, but the last frame does not land on the still | Right; no better than run 1 |
+| 3 | `d8afb9f2d9e1` | FL2VA baseline, no audio | 6.2 min | Exact: first and last frames pixel for pixel | n/a, self-generated soundtrack |
+| 4 | `97b8d792cdf2` | `music-video` baseline | ~9.6 min | Static, but in its own framing, not the still | Right, same quality as run 1 |
+
+**Verdict: holds, first frame only.** The keyframe is honoured as a
+composition, not as pixels; only FL2VA gives pixel-exact frames, and it
+can't carry the song. A last frame costs 45% more and doesn't land. Run 1
+carries the keeper note. Every job was kept on lem.
+
+Quoted estimates: runs 1 and 2 at 12.0 min (basis `inherited` from
+`reference-to-video`, low confidence); runs 3 and 4 came back `unknown`
+(no catalog cost or observed runs for those shapes at one shot).
+
+## What was built
+
+**Stage B, #878** (plugin), `develop` @ `fba35f24`:
+
+- One `minimax-h3` skill line under *Which shape is the request*, after
+  *Pinned to a picture*: "A locked frame that lip-syncs to a song (FL2VA
+  takes no audio): Ref2VA `[keyframe completion + audio reuse]`,
+  `<Picture 1>` the first frame, `<Audio 1>` the song, held with
+  `hold_audio`", plus the framing-not-pixels and last-frame limits.
+- Room under the 12,288 B cap came from rewording, with no rule dropped
+  (12,259 B after).
+- `tests/test_plugin_skills.py`:
+  `test_the_locked_frame_lip_sync_recipe_names_real_task_types` pins the
+  task string, "FL2VA takes no audio" and `hold_audio` in the skill, both
+  task types in `dw/workflows/h3_context_ir.json`, and `hold_audio` on
+  `music-video`'s ref2va step.
+- No plugin version bump: the plugin's version is the engine's and the
+  release script bumps both (`test_the_plugin_version_is_the_engine_version`).
+
+**Stage C, #879: not built.** The recipe lives entirely in the prompt: in
+Ref2VA a keyframe is an image reference the prompt names as the first
+frame. `templates/minimax/music-video` already takes it with arguments: the
+still as `singer_reference` (or an entry's `singer`), the song as `song`,
+the task in the entry's `prompt`, and the slice held by `hold_audio`. That
+configuration validated on lem with no warnings, eliding `draw_singer` and
+`write_song`. A new template or per-entry option would duplicate it.
+
+## Bounces per stage
+
+| Stage | Bounces |
+|---|---|
+| A, #877 | 0 |
+| B, #878 | 0 |
+| C, #879 | n/a (not built) |
+
+No stage comment names `usage:` figures, so per-stage cost is not recorded.
+GPU time on lem: 48.4 min across the four renders, plus prep jobs
+`b215107ef20a`, `a3fe84296132` and `f40f7f4ac95d`.
+
+## Deferred
+
+- **Pointing the skill line at `music-video`.** The line names no template;
+  a short follow-up could name `templates/minimax/music-video` with the
+  still as `singer_reference`, if it fits under the cap. Left for Don to
+  route (#879).
+- **C-F409 to C-F411** (stage C's cases) are to be retired by the curator,
+  since #879 closed not planned.
+- **Catalog cost for one-shot FL2VA and `music-video`**: both quoted
+  `unknown` here. Runs 3 and 4 are now observed runs on lem.
diff --git a/docs/proposals/complete/h3-quality-ramp-complete.md b/docs/proposals/complete/h3-quality-ramp-complete.md
new file mode 100644
index 00000000..bf826e4a
--- /dev/null
+++ b/docs/proposals/complete/h3-quality-ramp-complete.md
@@ -0,0 +1,127 @@
+# H3 quality ramp: draft -> final tiers (#862)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-15). Don approved plan v2 on 2026-10-14. Its one stage, #882,
+shipped on 2026-10-15 and is at `develop` @ `426b764b`. It was verified on
+lem (CUDA) against the `regression-complete` workspace.
+
+## The idea
+
+Nothing in the plugin told an agent how to spend GPU time on quality. Every
+H3 render before Don's quality matrix used int4 + a turbo LoRA, because the
+templates default to that, and Known Issues faces smeared (2-2.5/5). The
+matrix on lem (2x RTX 3090) showed a large, predictable trade-off. The base
+model (no LoRA) at int8 gave photographic faces (4/5) at 2-4x the time.
+Within one staging family, a cheap draft carried its staging to the final
+at the same seed. The issue proposed a cross-cutting `quality-ramp` skill:
+which tier to draft at, what to approve there, and what never to change
+between tiers.
+
+## Verdict and scope
+
+**Build smaller.** No new skill and no new file. The ramp is a `## Ramp`
+section in the existing `plugins/dw/skills/minimax-h3/references/quality-and-speed.md`.
+It expands that file's "Draft then final" bullet. #863 had already put the
+ladder, the speed levers and the composition invariants there, so the
+section adds only the process around them.
+
+Why not a top-level skill: only H3 has a measured ladder, and `minimax-h3`
+already loads on every H3 request. A new skill would cost up to 12 KB per
+trigger and rows in the README, CLAUDE.md and the skill test.
+
+Corrections the plan made to the proposal:
+- **TV path L1 -> L7, not L0 -> L7.** L0 changes the canvas. L0 stays as a
+  throwaway sketch. Plan v2 first said L0's staging doesn't carry. #861 then
+  measured L0 -> L7 holding on 3 of 3 seeds, so Don corrected the build:
+  L0 is for blocking only because it smears faces, not because its staging
+  moves.
+- **No pin test.** The numbers and the advice sit in one file.
+- **The base rung doesn't clear `lora_disabled`.** The warning is
+  unconditional on a null LoRA (`dw/adapter_compatibility.py`). The section
+  calls it expected on both cinema tiers.
+
+## Decisions (Don's review of plan v1, 2026-10-14)
+
+- **Q1.** A section in the existing `quality-and-speed.md`, not a new file
+  or skill.
+- **Q2.** Wait for #861's seed runs before stating carryover claims.
+- **Q3.** Quote `plan.estimate` once #866 lands, and the ladder until then.
+- **Q4.** Ship L7 as the TV final, marked "not confirmed by ear or in
+  playback".
+- **Ruling on dkackman/harnest#116:** #865 landed first, so P1 is L5 plus
+  the template's `cache` argument, and `sage_hub` is an `attention_backend`
+  argument on every H3 template. The plan's saved-copy path was dropped.
+
+## What was built
+
+### Stage 1, #882: the `## Ramp` section
+
+- **`quality-and-speed.md` `## Ramp`:**
+  1. *Pick the path*, a table by target. TV: L1 (~5.4 min) -> L7 (~7.2 min);
+     only `weights_dtype` changes. Cinema: B3 (~12.9 min) -> L5 (~29.5 min)
+     or P1 (~23.1 min, + `cache` `{"type": "first_block", "threshold": 0.05}`);
+     only `num_inference_steps` changes, plus `cache` for P1. Close-up: ship
+     C1. Each rung's arguments are spelled out. L0 is a sketch, B4 is never
+     a cinema draft (2 of 4 seeds).
+  2. *What carries*: a pointer to the *Quality ladder* rules, plus
+     identical seed/canvas/prompt/references and "blocking carries, props
+     sometimes don't", each with its #861 seed count.
+  3. *What to approve* at draft and at final; re-roll only at the draft.
+  4. *How to judge*: face crops and a contact sheet via
+     `get_output_frames`, `check-script`, a 1-5 score with `set_note`, and
+     what Claude can't judge (audio by ear, motion in playback).
+  5. *Cost*: `plan.estimate` (#866), but the rung's ladder minutes when the
+     estimate is `low_confidence`, which every `sage_hub` rung is.
+- **`dialogue-short` at 1344x768** (the bounce fix): the default `shots[4]`
+  (`tag`) is 141 frames with 4 references, over the 124-frame ceiling. The
+  section says to copy `variables.shots`, set `shots[4].num_frames` to 124
+  (or drop a reference), and pass the list unchanged at both tiers.
+- **`minimax-h3/SKILL.md`:** the "Smeary faces" line reworded to cover
+  draft -> final tiers, with no new line (12,278 of 12,288 bytes).
+- **`script-to-video/SKILL.md`:** a one-line pointer for H3 shots in the
+  test-render passage.
+- **Deviations:** no plugin version bump, because `plugin.json`'s version
+  must equal `pyproject.toml`'s and `scripts/release.sh` moves both. The
+  README and CLAUDE.md are unchanged.
+
+## Verified
+
+Cases C-F414 to C-F419, in `regression-suite-complete.md`; all six now
+pass, with no GPU spend (`validate_workflow` only). C-F416 to C-F418
+validate B3/L5/P1 on `dialogue-short` with the 124-frame `shots`, each with
+one `lora_disabled` warning per shot. The tester also checked the "drop a
+reference" option: a 3-reference `tag` at 141 frames validates.
+
+Whether a session *follows* the section isn't tested over MCP. Don judges
+that on his next H3 episode.
+
+## Bounces per stage
+
+- **Stage 1, #882: 1.** C-F416, C-F417 and C-F418 failed: the cinema path
+  sent `dialogue-short` to 1344x768, where its default 141-frame `tag` shot
+  is refused by the VRAM ceiling. Fixed in `6834d687` (`426b764b`) with the
+  `dialogue-short` paragraph above. Docs only; the template's default was
+  left alone (960x544 fits it).
+
+Stage costs aren't recorded, because the stage comments give no `usage:`
+figures. The plan estimated about $2.
+
+## Deferred
+
+- **MagCache as the cinema-final cache.** After #882 was built, #875 and
+  #927 measured M2 (MagCache 0.06 with calibrated H3 ratios, 18.1 min,
+  -39% against L5), and Don chose it over `first_block` 0.05; `first_block`
+  0.08 (P6, 19.5 min) is the fallback. The section still names P1 as the
+  cache final, and the file's closing "Open:" line still lists
+  `first_block` at 20 steps, P1 on a close-up or a second seed, and
+  MagCache calibration as open. All are answered on #862's body. Updating
+  the section needs the 29 ratios as a `cache` argument, so it is a
+  follow-up edit with its own check, not a close-out doc fix.
+- **A top-level `quality-ramp` skill.** What brings it back: a measured
+  ladder for a second family (LTX-2.5, Flux). The family-agnostic half
+  (tier rules, approval per tier, judging) would then move up into
+  `skills/quality-ramp/`, and each family keeps its own ladder.
+- **The 12-step base floor** stays advice (B6 at 8 steps duplicated a
+  character; 10 was never tried). An engine rule is #868's territory.
+- **L1 = L7 on more seeds.** The TV pair itself is measured on one seed;
+  the section says so.
diff --git a/docs/proposals/complete/h3-template-acceleration-complete.md b/docs/proposals/complete/h3-template-acceleration-complete.md
new file mode 100644
index 00000000..5568f66a
--- /dev/null
+++ b/docs/proposals/complete/h3-template-acceleration-complete.md
@@ -0,0 +1,156 @@
+# H3 templates expose `attention_backend` and `cache` (#865)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-14). Don approved plan v1 on 2026-10-14. Stage A, #883, and stage
+B, #884, shipped the same day. The last of them is at `develop` @
+`340e31d1`. Both were verified on lem (CUDA), and stage A also on mini-ai
+(mps).
+
+## The idea
+
+Don's H3 quality matrix on lem (2x RTX 3090 24 GB, workspace `h3-quality`)
+had to rebuild workflows with `tools/ladder.py` to reach the cinema
+configuration. `attention_backend` existed on only four H3 templates, and
+no template exposed `cache`. Both knobs were measured wins: `sage_hub` was
+23-33% faster with no quality loss, and `first_block` 0.05 saved 22% at 30
+base steps. The issue also proposed a `quality` tier variable that would
+set the coupled tier settings (canvas, weights, LoRA, steps, shifts,
+cache, attention) together.
+
+## Verdict and scope
+
+**Build smaller.** Part 1 shipped: `attention_backend` and `cache` are now
+variables on every H3 template. Part 2, the tier presets, was cut. Once
+part 1 landed, every tier can be reached with plain `arguments`, so the
+tier table belongs in the `minimax-h3` skill as ready-to-pass argument
+sets (#862).
+
+Corrections the plan made to the proposal:
+- **`cache` couldn't be a variable.** The raw workflow is checked against
+  the schema before substitution, and the schema required `cache` to be an
+  object. So the schema had to widen, and the substituted value had to be
+  checked at validate time, or `{"type":"bogus"}` would pass validate and
+  fail at load.
+- **The engine already supported H3 caching.** `MiniMaxH3TransformerBlock`
+  was already registered in `dw/cache_blocks.json`.
+- **Scope is the H3 transformer steps only.** Z-Image steps, Music3's
+  `write_song`, `music.json`, `music-video-cuts.json` and
+  `compose-workflows.json` get nothing.
+- **sage_hub is CUDA-only, and validation didn't check it.** That became
+  #868's `attention_backend_unavailable` warning (see
+  `acceleration-warnings-complete.md`).
+
+## Decisions (Don's review of plan v1, 2026-10-14)
+
+- **Q1.** Cut the presets. The tiers live in the skill as argument sets.
+- **Q2.** `cache` is a whole-object variable, not a `cache_threshold`
+  number. #867's P2 found that installing the `first_block` hook changes
+  the output even when it skips nothing (PSNR 25.6 dB at 12 steps). A
+  threshold of 0 therefore isn't off. Only `null`, which drops the key,
+  turns the cache off.
+- **Q3.** Template defaults are unchanged: int4 + turbo LoRA, and both new
+  variables `null`. This also answers the issue's int8 question: int8 is a
+  tier choice the skill states, not a template default.
+- **Notes:** stage B's check joins the expanded-definition checks in
+  `dw/validation.py`, so MCP `validate_workflow`, run-time validation and
+  `for_each` members all get it. Stage B also replaces #863's "edit the
+  JSON" text in `docs/RECIPES_24GB.md` and the skill's
+  `quality-and-speed.md` with the argument.
+
+The issue's open question about automatically reducing `num_frames` or refs
+at 1344x768 is answered no: the VRAM ceiling warning already reports it,
+and silently changing the shot would be worse.
+
+## What was built
+
+### Stage A, #883: `attention_backend` on every H3 template
+
+- **Templates:** 15 templates gained an `attention_backend` variable
+  (default `null`, no constraint), wired at the H3 step's transformer
+  component in the same form as `video-with-audio.json`. They are
+  `first-and-last-frame`, `last-frame-only`, `chained-segments`,
+  `composable-references`, the three `chain-*` templates, `enhance-prompt`,
+  `enhance-prompt-with-image`, `voice-timbre-reference`,
+  `generated-subject-reference`, `storyboard`, and the `shot` `for_each`
+  step of `dialogue-short`, `shots-batch` and `music-video`. The four
+  templates that already had the variable are unchanged, which makes 19 in
+  total.
+- **Tests:** in `tests/test_catalog_structure.py`, every template with a
+  `MiniMaxAI/MiniMax-H3` step must wire the variable, and only H3 steps may.
+  Two `replace_variables` tests run on `dialogue-short`.
+- **Docs:** `docs/ACCELERATION.md`, `docs/WORKFLOW_GUIDE.md`,
+  `workflows/templates/minimax/README.md`, and the `minimax-h3` skill
+  ("CUDA: `attention_backend=sage_hub`; null elsewhere"). `COMPACT_BUDGET`
+  went from 10_700 to 10_800.
+- **Deviation:** the ref2va templates wire the backend at
+  `components.transformer_ref`, as `reference-to-video.json` already did,
+  not at `components.transformer`.
+
+### Stage B, #884: `cache` as a whole-object variable
+
+- **Schema:** `pipeline_configuration.cache` in `dw/workflow_schema.json`
+  is `["object","string"]` with `"pattern": "^variable:"`, so a literal
+  string such as `"first_block"` still fails the raw schema.
+- **Engine:** `cache_errors` in `dw/step_value_checks.py` is registered in
+  `ERROR_CHECKS` and checks the substituted, `for_each`-expanded value
+  against the schema's cache object shape. It reads that shape from the
+  schema, and narrows number-or-string fields (today, `threshold`) to
+  number, because every reference has been substituted by then. A
+  substituted `null` drops the key, so no cache is built.
+- **Templates:** all 19 H3 templates gained `cache` (default `null`), wired
+  in the H3 step's `pipeline.configuration` only.
+- **Tests:** `tests/test_validation.py::TestCacheVariable` and
+  `TestCacheVariableOnAForEachTemplate`; catalog wiring tests;
+  `test_turbo_schedules_carry_no_block_cache` now checks the effective
+  default. `COMPACT_BUDGET` went from 10_800 to 10_850.
+- **Docs:** the cache section of `WORKFLOW_GUIDE.md`, the H3 row in
+  `RECIPES_24GB.md`, `ACCELERATION.md`, the minimax templates README, and
+  the skill's `quality-and-speed.md` (use the cache only at about 20 or
+  more base steps, never with the turbo LoRAs; `null` is off). The
+  `docs/ARCHITECTURE.md` **Step-value checks** row names `cache_errors`.
+- **Deviations:** an invalid cache on a `for_each` step is reported once,
+  naming the member, not once per member. `step-caching.json` was added to
+  `LEGITIMATE_MENTIONS`. No `breaking-change` label, because the schema only
+  widens.
+
+## Verified
+
+Cases C-F420 to C-F429. The CUDA runs on lem: `dialogue-short` with
+`sage_hub` (job `4637d362563a`, about 28 min against a 38.6 min estimate),
+and a 30-step no-LoRA `dialogue-short` with `first_block` 0.05 at 960x544
+(job `a104407184ad`, about 67 min).
+
+Suite follow-ups the tester left open:
+- C-F420, C-F422 and C-F423 say `components.transformer` and expect a
+  substituted key in `get_job_workflow`, which keeps step references
+  unsubstituted. The tester sent the wording to a suite amendment.
+- C-F428 at 1344x768 is refused by the VRAM gate on a 3090 and passed at
+  960x544. The resize is dkackman/harnest#114.
+- C-F417 (pending #882) expects `attention_backend` and `cache` to be
+  refused on `dialogue-short`, which no longer holds. Its amendment is
+  owed by whoever verifies #865.
+- No runtime event names the attention backend actually applied. The
+  tester is filing that observability gap separately.
+
+## Bounces per stage
+
+- **Stage A, #883: 0.**
+- **Stage B, #884: 2.**
+  - **Architecture review (1):** the `docs/ARCHITECTURE.md` Step-value
+    checks row didn't name `cache_errors`. Fixed at `92c3952f`.
+  - **Tester (1):** C-F425 / C-F426 value 7. A string `threshold` passed
+    validate, because the check reused the schema's `["number","string"]`
+    type. Fixed in `e07fbf38` (`340e31d1`).
+
+Stage costs aren't recorded, because the stage comments give no `usage:`
+figures. The plan estimated $3-4 for A and $4-6 for B.
+
+## Deferred
+
+- **Tier presets** (a `presets` block, Q1). What would bring them back: a
+  `field-report` showing a session mis-coupled a tier even with the
+  skill's table, or a second family with a measured ladder that wants the
+  same mechanism.
+- **The tier table as argument sets in `minimax-h3`** is #862's work.
+- **Per-device resolution of `attention_backend`.** The default stays
+  `null`. #868 warns about a CUDA-only backend on a server that isn't CUDA.
diff --git a/docs/proposals/complete/host-ram-dispatch-gate-complete.md b/docs/proposals/complete/host-ram-dispatch-gate-complete.md
new file mode 100644
index 00000000..dde69f65
--- /dev/null
+++ b/docs/proposals/complete/host-ram-dispatch-gate-complete.md
@@ -0,0 +1,120 @@
+# Hold a queued job for host RAM at dispatch (#869)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-15). Plan v2, approved by Don as "build smaller" on 2026-10-14 (v1 →
+v2: Don's answers folded in as decisions D1-D3, no scope change). Two stages:
+#909 (A) and #910 (B), both verified on lem. Part 2 of the report (the wrong
+job died) was split out and shipped as #881.
+
+## The report
+
+On 2026-10-13, lem (2x RTX 3090, 125 GB host RAM) dispatched two int8 H3
+Ref2VA jobs to its two cards at once. Each holds ~62-63 GB RSS after load, and
+two don't fit. The earlier job was SIGKILLed by the OOM killer and the later
+one died with SIGTERM. The dispatcher (#462) routed on VRAM need only, and
+`host_memory_projection` produced validate warnings only. Three places told
+agents to work around it by hand: the workspaces guide ("wait between
+variants"), the `minimax-h3` quality reference ("One int8 job at a time") and
+`tools/ladder.py` waiting for lem to be idle.
+
+The code sweep (plan v1) found:
+- **History had no (pipeline, weights dtype) key.** The dtype is usually a
+  template variable feeding a `quantization_config`, and history grouped by
+  workflow name. So the plan added a *memory key* computed from the admitted
+  definition.
+- **`host_memory_projection` projects list runs only.** On its own it would
+  never have figured an H3 shot.
+- **"Free" can't be MemAvailable alone.** A job that is still loading hasn't
+  reached its peak, so each running job's remaining growth is charged.
+- **A `warning` event sticks to `job.warnings` for good.** A queue wait is a
+  moment, not a fact about the result, so it gets its own event and field.
+- **The dispatcher only woke on submit, finish, hold release or shutdown.** A
+  held job needs a timed re-check.
+
+## What was built
+
+- **Stage A (#909): memory key and projected peak, nothing gated.**
+  - A `memory_key TEXT` history column (migrated with `ALTER TABLE`; older
+    rows are NULL and count as no data), written by `record()`. The key is the
+    sorted `pipeline_identity` of each pipeline step plus every
+    `quantization_config`, `offload` and `group_offload` value, with the
+    caller's arguments substituted through the single owner of `variable:`
+    substitution. Renamed and inline copies of one template share a key;
+    `weights_dtype` int4 and int8 don't.
+  - `dw/server/host_ram_need.py: projected_peak` returns `observed` (the max
+    `host_memory_job_peak_rss_mb` over successful same-key runs, D2), else
+    `fit` (`host_memory_projection.projected_mb`, a list run), else None.
+  - `host_memory_projection` now shares one `_projection` between
+    `projected_mb` and `host_memory_warnings`. The warning text and its 0.9 ×
+    total-RAM ceiling are unchanged.
+  - `Admission.host_ram_need`, threaded through submit, rerun and enhance.
+  - Validate's `plan.host_memory: {projected_mb, basis, runs}`, absent with
+    no figure.
+- **Stage B (#910): the gate.**
+  - `_host_needs` beside `_needs` in `JobManager`. The rule lives in
+    `dw/server/pool.py: host_ram_wait`: `available = MemAvailable − Σ running
+    max(0, projected_peak − worker RSS now)`, and a job is held while its
+    peak exceeds `available` plus the RSS of the idle worker it would reuse.
+  - Backfill: a held job keeps its place and smaller jobs behind it may start.
+  - Escapes: never held with no other job running, never held without a
+    figure, and no gate when `host_memory_stats()` can't read MemAvailable.
+  - While any job is held, the dispatcher re-checks every 10 s
+    (`HOST_RAM_RECHECK_SECONDS`), so memory freed outside dw is seen.
+  - A `queue_wait` event (`reason: "host_ram"`, "waiting for host RAM: needs
+    ~N GB, ~M GB free"), once per hold, never a `warning` (D1).
+  - `waiting_for` on the job summary and detail while queued and held: REST,
+    regenerated `openapi.json` and `api-schema.ts`, MCP `get_job`,
+    `list_jobs` and `wait_for_job`, and the UI's `JobHeader.svelte`.
+  - Cancel clears it; `move` wakes the dispatcher.
+  - Docs: SERVER.md states the rule and its escapes; WORKSPACES.md and the
+    `minimax-h3` quality reference drop the wait-by-hand advice; MCP.md and
+    the ARCHITECTURE.md dispatch row name the owners.
+
+On lem the verify held a second int8 H3 job ("needs ~87 GB, ~57 GB free")
+with cuda:1 idle and started it the instant the first finished, while two
+int4 jobs (~47 GB observed each) started at once.
+
+## What was cut or deferred, and why
+
+- **Refusal at submit.** Never: host RAM is this machine's state, not the
+  caller's choice, and #243's warn-not-refuse rule stands.
+- **A "would wait now" prediction in validate's plan.** It guesses at a
+  queue that changes before submit. *Back when:* a field report of agents
+  submitting blind and being surprised by `waiting_for`.
+- **A new job status.** Don's answer: the job stays `queued`, and
+  `waiting_for` says why.
+- **`num_frames`, resolution and reference count in the memory key** (D3).
+  *Back when:* under-holding shows up from a key collision across sizes.
+  #881's OOM ranking is the backstop.
+- **Pipelines inside a composed child workflow** are not in the parent's
+  key (stage A deviation).
+- **No plugin version bump.** The plugin version is pinned to the engine's
+  and the release script bumps both.
+
+## Bounces per stage
+
+| Stage | Verify bounces | Architecture bounces | Notes |
+|---|---|---|---|
+| #909 (A) | 1 | 1 | Architecture (two findings in one bounce): a second owner of `variable:` substitution in `host_ram_need`, folded into the single owner, and the new module had no ARCHITECTURE.md row. Verify: C-F488 expected a projection warning that #243's 0.9 ceiling never emits at ~61.6 GB on lem. No code change; Don approved the case amendment. |
+| #910 (B) | 0 | 1 | Architecture: the ARCHITECTURE.md dispatch row didn't name `pool.py: host_ram_wait` as the owner of the hold rule. |
+
+C-F495 (single worker or MPS, dispatch unchanged) was not run on lem, which
+has two workers, so it stays `pending: #910`.
+
+Cost per stage: the stage comments record no `usage:` figures, so none is
+given here. The plan estimated $4-6 (A) and $5-6 (B).
+
+## Found on the way
+
+- `validate_workflow` accepted `weights_dtype: "int8"` unbraced, and the run
+  failed at load. Fixed as #926 (validate warns on an unbraced type name
+  under a `*_dtype` key).
+
+## Rules this feature added
+
+- Dispatch may delay a job for host RAM but never refuses one; a job with no
+  other job running is never held.
+- A queue wait is a `queue_wait` event and a live `waiting_for`, never a
+  `warning`.
+- The observed host-RAM figure is the max over same-memory-key successful
+  runs on this machine.
diff --git a/docs/proposals/complete/multi-gpu-workers-complete.md b/docs/proposals/complete/multi-gpu-workers-complete.md
index 37e4c4e1..5e44eb2e 100644
--- a/docs/proposals/complete/multi-gpu-workers-complete.md
+++ b/docs/proposals/complete/multi-gpu-workers-complete.md
@@ -106,7 +106,8 @@ Every shape change is additive: none is a `breaking-change`.
 ## Deferred, and what brings each back
 
 - **Host-RAM admission gate** (Q3). *Back when:* a field report of a
-  cross-job OOM kill.
+  cross-job OOM kill. That came as #869, and the gate shipped (dispatch
+  delays, never refuses): `host-ram-dispatch-gate-complete.md`.
 - **An `overlapped` flag on jobs, excluded from observed cost** (Q4).
   *Back when:* the contention skew in cold medians is measured.
 - **`list_workflows`' cost listing per card.** It still quotes the
diff --git a/docs/proposals/complete/step-timing-complete.md b/docs/proposals/complete/step-timing-complete.md
new file mode 100644
index 00000000..8dd85f4e
--- /dev/null
+++ b/docs/proposals/complete/step-timing-complete.md
@@ -0,0 +1,135 @@
+# Per-step timing and step-cache skip counts (#867)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-14). The idea came from the H3 quality matrix on lem (workspace
+`h3-quality`), which had to rebuild phase minutes and s/pass from the event
+log with `tools/phases.py`, and could only infer from s/pass whether a
+`first_block` cache had skipped anything. Plan v1 was designed on #867. Don's
+review made v2, which moved the carrier to the manifest entry and added a
+real-pipeline cache-context test. Don approved v2. It was built as stages
+#885 (1) and #886 (2). The plan comment on #867 stays the full design; this
+is the record of what shipped.
+
+## The problem
+
+Two questions had no answer from dw: *where did a generation step's time
+go*, and *did the step cache skip anything*. A script could rebuild the
+first from events, but only while the 200-event history tail still held
+load and encode. Nothing could rebuild the second, because diffusers' cache
+hooks keep only the latest decision.
+
+## Verdict: build smaller
+
+Cut from the proposal, with what would bring each back:
+- **`compile_s` as its own field.** Compile is lazy and runs inside the
+  first denoise forward, so dw can't separate it. Shipped instead:
+  `first_pass_s`, `pass_s` (the median of the rest) and `compiled`. On a
+  cold run, compile ≈ `first_pass_s − pass_s`. *Trigger:* a diffusers or
+  torch hook that reports compile time.
+- **`skipped_passes_equiv`.** It is `skipped` in other units.
+- **Skip counts for `taylorseer`, `faster`, `text_kv`.** Their hooks keep no
+  per-forward decision, so they report type and config with null counts
+  (Don, Q3). *Trigger:* a matrix run that needs them. For taylorseer, the
+  route is to wrap `_measure_should_compute`.
+
+Non-goals stayed out: pricing from timings (#866), per-block stats, UI
+display, and timing on `wait_for_job` (Don, Q1).
+
+## Plan history
+
+- **v1:** a top-level `JobDetail.timing` list, kept in a new history column.
+- **v2 (approved):** Don's review moved `timing` onto each step's
+  `ManifestEntry`. That entry already has `extra="allow"`, is stored in
+  history and is written to the run's `manifest.json`. The change dropped the
+  history column, the migration and the `Job` fold, and timing survives
+  export. Stage 2's first test became a tiny real pipeline with CFG, to catch
+  a counter that reads outside the nested `cache_context("cond"/"uncond")`.
+  Q1–Q4: no `wait_for_job` timing, one summed entry per chain step,
+  TaylorSeer type-only, timing first.
+
+## What was built
+
+### Stage 1 (#885): `timing` on manifest entries
+
+Commits 6342ab36 (engine), 7dd0bf89 (tests and docs), 831fc660 (map row,
+`workflow_run.py` back under its size ceiling) and 23bb31d5 (the `passes`
+ruling).
+- `StepTimer` (`dw/pipeline_processors/timing.py`) runs on the worker's
+  monotonic clock. It records `load_s`, `load_cached`, `encode_s`,
+  `denoise_s`, `passes`, `first_pass_s`, `pass_s`, `compiled`, `decode_s`,
+  `save_s` and `segments`, rounded to 0.1. A mark that never fired gives
+  `null`.
+- The denoise start comes from a self-removing denoiser pre-forward hook on
+  callback pipelines, and from the denoise bar opening on modular pipelines.
+- The timing dict reaches the manifest entry and `step_end` through
+  `record_step`. A reused step has no `timing`. A chain step gets one summed
+  entry.
+- `ManifestEntry.timing` and `StepTiming` are in the API contract, with
+  OpenAPI and the UI types regenerated. `docs/SERVER.md` and `docs/MCP.md`
+  correct "generating → first step is encode". `docs/WORKSPACES.md` has a
+  *Step timing* field table. `docs/ACCELERATION.md` explains how to read
+  `first_pass_s − pass_s`.
+
+**Ruling made in the build:** `passes` counts the denoise passes that
+actually ran (one per scheduler timestep), not `num_inference_steps`. SD
+1.5's PNDM runs N+1 timesteps in PLMS mode (20 → 21). Reporting 20 would
+have broken `denoise_s ≈ first_pass_s + (passes − 1) × pass_s`, which #866
+needs. Only descriptions changed. The suite's `passes: 20` literals in
+C-F430 and C-F434 were sent for amendment (dkackman/harnest#110, #111).
+
+### Stage 2 (#886): `timing.cache` and the `cache_stats` event
+
+Commits 95f9cffa, ca8ad005 (folded into `timing.py`), ea5943dd (map row) and
+0ead3b7f (the event's wire fix).
+- A forward hook on the cache transformer, registered in
+  `stateful_cache_context`, reads the leader hook's `should_compute` once
+  per forward, inside the pipeline's cond/uncond context. It counts
+  `forwards`, `computed` and `skipped` for `first_block` and `mag`, and
+  reports `hit_rate = skipped / forwards` to 3 places. `mag` also reports its
+  config keys. A chain sums its segments' counts.
+- One `cache_stats` event per pipeline call, emitted before dw resets the
+  cache state. It carries `step` and, on a chain segment, `segment`.
+- If the installed diffusers moves the private hook state, the counts are
+  null, one `cache_stats_unavailable` warning fires, and the run continues.
+  Pin tests on the installed diffusers check the hook names and state
+  attributes.
+- `docs/ACCELERATION.md` *Reading the skip counts*: a 0-skip run is not
+  bit-identical to an uncached one (the matrix's P2 finding).
+
+**Deviations:** there is no separate `cache_stats.py`, and
+`StepTiming.cache` is typed as an open `dict` rather than its own model,
+because the architecture ratchet refused a new module and a crossing of
+`api_models.py`'s line ceiling. The shape is the same. The MCP surface
+budget went from 14,990 to 15,005 (+15 description tokens, dated).
+
+## Verification and bounces
+
+| Stage | Bounces | What bounced |
+|---|---|---|
+| #885 | 2 | Architecture review: there was no map row for the new owner (fixed 831fc660). Verify on mini-ai: C-F430 `passes` was N+1 (ruled correct, docs 23bb31d5). |
+| #886 | 2 | Architecture review: there was no map row (fixed ea5943dd). Verify on mini-ai: no `cache_stats` event ever reached the job, because the event's own `type` key collided on the worker wire (fixed 0ead3b7f, which sends it as `event_type`). |
+
+- #885 was verified on mps (mini-ai) and cross-checked on CUDA (lem). The
+  modular-pipeline case (C-F433) was proven on lem against a MiniMax Music3
+  job, since neither box has a modular image template.
+- #886 was verified on mps against an inline FLUX.1-dev pipeline. SD 1.5 has
+  no transformer, so `first_block` is "not applied" there, and Z-Image
+  refuses `enable_cache()`. The H3-on-CUDA case (C-F445) is now an ordinary
+  case for lem. It had not run when #886 closed.
+- Cost is not recorded: the stage comments name no `usage:` figures.
+
+## Found along the way (filed separately)
+
+- #895: `validate_workflow` accepted `faster` on guidance-distilled
+  FLUX.1-dev, and the run then failed inside diffusers' FasterCache hook.
+  Fixed on develop (0dcf45ad).
+- `validate_workflow` reported `downloads_required: []` for FLUX.1-dev
+  before a ~33 GB download (raised by the #886 tester).
+- MiniMax Music3 accepted `num_inference_steps` without a warning and ran
+  40 passes anyway (noted on #885, not filed).
+
+## Follow-up
+
+#866's estimator, and `observed_cost.py`'s cold/warm split, can now read
+`timing.load_s`, `load_cached`, `passes` and `pass_s`. That work belongs to
+#866.
diff --git a/docs/proposals/complete/sweeps-complete.md b/docs/proposals/complete/sweeps-complete.md
new file mode 100644
index 00000000..f8d868f6
--- /dev/null
+++ b/docs/proposals/complete/sweeps-complete.md
@@ -0,0 +1,115 @@
+# Sweeps and experiment tracking: a written method, not a server feature (#872)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-14). The idea came from the H3 quality matrix on lem (workspace
+`h3-quality`, 31 rungs, 83 notes). It was run entirely outside dw, with two
+local scripts: `tools/ladder.py` built and submitted one workflow per rung and
+polled for an idle server, and `tools/push_notes.py` wrote the notes back.
+Plan v1 was designed on #872. #890's verify bounce made v2, which Don
+approved. It was built as one docs stage, #890. The plan comment on #872
+stays the full design; this is the record of what shipped.
+
+This supersedes `sweeps-and-comparison.md` (the U6 scoping notes behind #379,
+closed not planned), which is deleted. Its comparison half shipped as
+`compare_outputs` (#871, `complete/compare-outputs-complete.md`). Its sweep
+half is answered here by a method. Its batch rerun is Q1 below, not taken.
+Its server-side `sweep` field design stays in git history if it is revived.
+
+## The problem
+
+"Render this shot under N configurations, one factor at a time, and keep the
+results together" is how every quality or speed question gets answered. dw
+had no written method for it, so every session rebuilt ladder.py.
+
+## Verdict: build smaller
+
+Every step of the scripts maps onto a tool dw already has. What was missing
+was the method, so the feature is one guide section. Cut, with what would
+bring each back:
+- **A server sweep** (`sweep=` on `run_workflow`, a batch object, a
+  multi-job wait). The two things the script fought belong to other issues:
+  waiting for an idle server is #869 (dispatch is not host-RAM-aware), and a
+  workflow per rung is #865 (H3's accelerator knobs aren't variables).
+  *Trigger:* a field report, after #865 and #869 land, that one call per
+  variant cost real context or time.
+- **Structured notes** (JSON or score fields on `set_note`, filter and sort
+  by score). A note holds 4,000 characters, and a first-line convention makes
+  a score readable in a listing. The server change is wide: `dw/notes.py`,
+  the sqlite `note TEXT` column, eight `api_models.py` fields, the UI note
+  editor and pages, eight test files, `list_page`'s read-after-limit, and
+  `"note"` already meaning a hint string in six MCP responses. *Trigger:* a
+  second experiment needs server-side ranking by score, or #871's grids need
+  to order by score.
+- **An experiment object.** A workspace already is one.
+
+Non-goals stayed out: server-side batching, typed notes, score filter or
+sort, an experiment object, comparison grids.
+
+## Plan history
+
+- **v1:** item 5 said same-seed reruns of an unchanged step are cache hits,
+  and the acceptance repeated an *earlier* variant.
+- **v2 (approved):** #890's verify showed `dw/step_cache.py` keeps one entry
+  per `(workflow, step)`: the latest run only. Item 5 became "only the latest
+  run of a step is cached", and the acceptance repeat is of the latest
+  variant. Item 2 now says a saved copy keeps the template's `cost` block, so
+  `plan.estimate` still has a basis. A step cache keyed per input
+  fingerprint was not pursued: it is engine work, and it weighs against
+  #368's byte cap.
+- **Questions:** Q1 (`arguments` + `note` on `rerun_job`): no, since
+  `save_workflow` plus `run_workflow` covers it. Q2: the note convention is
+  a first line `score N/5 · judged_by <who>`, then one `key: value` line per
+  facet. Q3: the section lives in `WORKSPACES.md`.
+
+## What was built
+
+### Stage A (#890): `## Running a sweep` in `docs/WORKSPACES.md`
+
+Commits 83ba2bd2 (v1 section and test) and 2aecdb5d (v2: latest-run-only
+caching, keep the cost block), merged to `develop` at c243b994.
+`get_guide("workspaces", section="Running a sweep")` serves it. It covers:
+1. one workspace per experiment, with the question and factors in its
+   workspace note;
+2. a base workflow with every factor as a variable: the template if it
+   exposes the factor, else a `save_workflow` copy that keeps the `cost`
+   block (and the `{}` note for dtype values);
+3. a pinned seed in `arguments`, one factor per variant, and each variant's
+   `plan.estimate` quoted for one go-ahead;
+4. one `run_workflow` per variant with a `note` whose first line is the
+   overrides, and `wait_for_job` before the next (#869: drop that sentence
+   when #869 ships);
+5. only the latest run of a step is cached, each card's worker has its own
+   cache, and a restart empties it, so a re-render is not a failed variant;
+6. `list_jobs(workspace=…)` and `get_job` for the results table;
+7. `set_note` assessments in the Q2 form;
+8. `keep_output` of the winner, and the conclusion in the workspace note.
+
+`tests/test_server_guides.py` asserts the section resolves and names the
+tools it tells an agent to call. No MCP or REST surface changed, and
+`SURFACE_BUDGET` is untouched.
+
+## Verification and bounces
+
+| Stage | Bounces | What bounced |
+|---|---|---|
+| #890 | 1 | Verify on mini-ai: C-F469. Going back to an earlier variant (steps=8 after 4/8/12) re-rendered instead of being `reused`, against v1 item 5. The plan was wrong, not the build, so it was re-planned as v2 (2aecdb5d). |
+
+- #890 was verified on mps (mini-ai, develop @ c243b994) against C-F467 to
+  C-F470. All four pass. Nothing in the stage is CUDA-specific.
+- Cost is not recorded: the stage comments name no `usage:` figures.
+
+## Found along the way
+
+- **A reused workspace name shows old jobs.** `list_jobs(workspace=)` in a
+  recreated `regression-sweep` returned six `historical: true` jobs from the
+  deleted workspace of the same name. The tester proposed on the harness repo
+  that the cases count non-historical jobs only.
+- **Note limits, as verified:** 4,000 characters accepted and read back in
+  full by `get_gallery_metadata`; 4,001 refused; `list_gallery` clips at
+  about 200 with `note_truncated: true`.
+
+## Follow-up
+
+#861, #875 and #862 are each a sweep, and can follow the section instead of
+a local script. Pair it with `compare_outputs` (#871) for judging. When #869
+ships, remove step 4's wait sentence.
diff --git a/docs/proposals/complete/workspace-copy-complete.md b/docs/proposals/complete/workspace-copy-complete.md
new file mode 100644
index 00000000..7fc3c65e
--- /dev/null
+++ b/docs/proposals/complete/workspace-copy-complete.md
@@ -0,0 +1,160 @@
+# Copy runs and assets between workspaces: `copy_to_workspace` (#853)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-13). Plan v2 was approved by Don on 2026-10-13. Stage A, #859, and
+stage B, #860, shipped the same day, at `develop` @ `b8a26e26` and
+`d084ea6a`, and were verified on mini-ai (mps).
+
+## The idea
+
+A field report: an agent needed to move a project's work (the Soviet-anthem
+assets and runs) from the `default` workspace into a workspace of its own.
+No tool did it (`move_job` only reorders the queue), so the agent
+re-uploaded every file and deleted the originals by hand. A re-upload loses
+provenance: the file becomes an `uploads/` asset with no manifest and no
+`output:` reference.
+
+## Verdict and scope (Don, 2026-10-13)
+
+**Build, in two stages.** Don's scope ruling came before the plan:
+
+1. **Copy only, no move.** A move is a copy followed by `delete_output` /
+   `delete_asset`, which already require `acknowledged_cost`. So there is no
+   new destructive path, and no jobs-DB `workspace`/`run_dir` rows are
+   rewritten.
+2. **In scope:** asset-library entries and whole runs
+   (`<workflow>/<run id>/` with manifests). Saved workflows and prompts are
+   out of scope. Prompts are already shared by the whole root.
+3. **`output:` references** are workspace-relative and are never
+   rewritten. A copied manifest that names a run not in the destination
+   gives a warning, not a refusal.
+4. **Confinement:** both workspaces are under one root, checked with the
+   existing validators. Copying into the shared library stays with
+   `keep_output(shared=true)`.
+
+This also settled #854's deferred question about root placement for
+uploads: a copied asset keeps its library-relative path exactly, so
+`uploads/x` stays `uploads/x`.
+
+## Decisions (Don's review of plan v1, 2026-10-13)
+
+- **Q1. Hard-link or copy?** Hard-link **media only**, falling back to
+  `copy2`. JSON sidecars (`manifest.json`, `workflow.json`, `notes.json`,
+  `job.json`, any `.json`) are always copied, because `record_kept_shots`
+  and `write_realized_workflow` write in place, so a linked sidecar would
+  carry an edit across workspaces.
+- **Q2.** No `acknowledged_cost` on the copy: it never overwrites.
+- **Q3.** A colliding `vN` is renumbered after the destination's highest,
+  in run-id order, and the reply maps old to new.
+- **Q4.** `SURFACE_BUDGET` was raised by the measured size, with a dated
+  note, once per stage.
+- **Q5.** Copied runs get no jobs-DB rows. They appear in `list_gallery`
+  but not in `list_jobs`, and the reply and `WORKSPACES.md` say so.
+
+## What was built
+
+### Stage A, #859: copy runs
+
+- **Engine:** `dw/workspace_copy.py`.
+  - Both workspaces resolve through `named_workspace`. Every path gets
+    `validate_path` with that side's folder as the base. A symlink
+    anywhere on a source path or inside a run is refused, and a
+    `ConfiguredWorkspace` (no root) is refused with 409.
+  - All or nothing: every entry is checked before anything is written. A
+    run id the destination already holds goes to `already_present` and is
+    skipped, so a repeat copy is idempotent. A run whose job is queued or
+    running is refused by name (409).
+  - Media is hard-linked, falling back to a copy, and `.json` is always
+    copied. Warnings: `unresolved_output_refs`, `absolute_paths`, and the
+    no-jobs note. Afterwards it calls `forget_workspace_usage()`.
+- **Run versions:** after the architecture review, numbering moved to
+  `dw/runs.py: copy_runs_in(source_identity_dir, identity_dir, run_ids,
+  place)`. It runs under `run_lock_path`, next to `record_run_versions`.
+- **Run-entry shape:** `security.validate_output_prefix`, which shares one
+  `_OUTPUT_SEGMENT` with `OUTPUT_REFERENCE_PATTERN`. An entry with an empty
+  segment (`wf/`, `wf//<run>`) is refused, not normalized.
+- **Route:** `POST /api/workspaces/{destination:path}/copy` in
+  `dw/server/routes/library.py`, with body `{source, runs, assets}`.
+- **MCP:** `copy_to_workspace(destination, runs, assets, source=None)`, a
+  thin client of the route, registered `WRITES`.
+- **Outside the plan:** `set_note` was registered as an MCP tool. The
+  notes feature (`a6483383`) had written it, documented it and named it in
+  the server instructions, but never registered it, and the acceptance
+  case for note independence needed it. Tool count: 62 → 64.
+- **Outside the plan:** `api_path` now encodes `.`/`..` segments
+  (`%2E`), so httpx no longer drops them. The fix is in the shared
+  `path_segment`, so it covers every MCP tool that builds a path.
+
+### Stage B, #860: copy assets
+
+- `copy_between` replaced `copy_runs` as the engine entry point. `runs` and
+  `assets` are both optional, but at least one is required (400 if
+  neither is given).
+- An asset entry is a library-relative file or a folder (`proj/` or
+  `proj`), and an `asset:` prefix is accepted. `copied.assets` lists each
+  file copied, expanded from a folder.
+- Each file's entries in its folder's `notes.json` and `manifest.json`
+  (kept shots) are merged into fresh destination sidecars.
+  `provenance.workspace` keeps naming the source. A sidecar can't be named
+  directly (400), and a folder copy doesn't copy sidecars as files.
+- Identical bytes at the path go into `already_present`. Different bytes
+  are a conflict, and they refuse the whole request, runs included (409,
+  `detail.conflicts`).
+- **Outside the plan:** the plan's risk said "copy, don't link, any path
+  that edits media in place". The build found one such writer:
+  `upload_media` wrote over an existing name with `open(path, "wb")`. It
+  now writes a temp file and `os.replace`s it, so linking stays safe. This
+  also fixes an existing bug, where an upload over a `keep_output` link
+  changed the linked original.
+
+### Tests and docs
+
+- `tests/test_workspace_copy.py`, on the real engine and route with no
+  mocks of the copy. It covers sidecar independence, the hard-link check
+  (same inode when `os.link` succeeds), traversal, symlinks, conflicts and
+  renumbering.
+- `SURFACE_BUDGET` was raised once per stage, plus once for `set_note`. It
+  ended at 14_700.
+- Docs: `docs/WORKSPACES.md` ("Copying between workspaces"),
+  `docs/MCP.md`, `docs/SERVER.md`, `docs/ARCHITECTURE.md` (the "Workspace
+  copy" row), and the regenerated OpenAPI documents.
+
+## Verified
+
+On mini-ai (mps), over MCP only. Stage A: C-F395 to C-F402 and SE-F047.
+Stage B: C-F403 to C-F405 and SE-F048. Nothing here needs CUDA: it is all
+filesystem work.
+
+## Bounces per stage
+
+- **Stage A, #859: 2.**
+  - **Architecture review (1):** three second-owner findings: the
+    reference prefix was spelled locally, run-version numbering lived
+    outside `dw/runs.py`, and the output name shape was restated. All three
+    were fixed by calling the owners.
+  - **Tester (1):**
+    - C-F398 couldn't run, because no MCP tool could change a note
+      (`set_note` was unregistered).
+    - SE-F047: `wf/` was normalized instead of refused, and bad
+      destination names missed the route (a bare 404, or a 405 when httpx
+      dropped `.`/`..`) instead of getting "No such workspace".
+  - The tester also filed three case-text problems as harnest#104; they
+    weren't counted.
+- **Stage B, #860: 0.** The tester didn't count one SE-F048 arm:
+  `asset:proj/x.wav` was accepted, which the plan allows. It was filed as a
+  case amendment, harnest#106.
+
+Cost per stage isn't recorded: the stage comments name no `usage:`
+figures. The plan estimated $8–12 for both.
+
+## Deferred
+
+- **A UI for copying.** It wasn't wanted for the field report. Build it if
+  copying from the web UI is ever asked for.
+- **Jobs-DB rows for copied runs** (Q5). `get_job` and `job_provenance`
+  are empty for a copied run. Revisit if an agent needs job provenance on a
+  copy.
+- **Saved workflows and prompts.** Out of scope by Don's ruling.
+- **The `absolute_paths` warning on inline runs.** Every inline run warns
+  the inline workflow's path. It's accurate, but the tester called it
+  noise. Quiet it if it misleads an agent.
diff --git a/docs/proposals/sweeps-and-comparison.md b/docs/proposals/sweeps-and-comparison.md
deleted file mode 100644
index 8ce4a9f4..00000000
--- a/docs/proposals/sweeps-and-comparison.md
+++ /dev/null
@@ -1,293 +0,0 @@
-# Proposal: parameter sweeps, batch rerun, and side-by-side comparison
-
-Status: **not committed** - scoping notes written against audit finding U6.
-Nothing here should be implemented without a fresh look at whether it is
-still worth the cost.
-
-## U6, as filed
-
-> No parameter sweep, no side-by-side run comparison, no batch rerun.
-
-`JobManager.rerun(job_id)` (`dw/server/jobs.py:347`) re-submits exactly the
-spec a previous job carried - `workflow_path`/`workflow`/`base_dir` plus that
-job's `arguments` dict, unchanged - through `manager.submit(...)`. One job
-id in, one new job id out. `POST /api/jobs/{job_id}/rerun`
-(`dw/server/app.py:440`) is a thin wrapper over that. There is no notion of
-"rerun this with prompt A, B, and C" or "run this same workflow at
-`num_inference_steps` 20/30/40 and show me all three." A user who wants that
-today opens `JobPage`, hits rerun, waits, edits `arguments` by hand, reruns
-again - once per value, serially, with no grouping tying the results
-together afterward.
-
-## 1. Sweep spec: reuse `previous_result`'s cartesian machinery, or something new?
-
-### What the existing machinery actually does
-
-`dw/previous_results.py:get_iterations()` is the engine's cartesian-product
-expansion. It walks one step's argument template, finds every
-`previous_result:` reference (`find_previous_result_refs`), and for each
-combination of values those references could take, produces one full
-argument dict via `itertools.product`. It is guarded by `MAX_ITERATIONS =
-10000`. This is what turns "4 images x 3 masks" into 12 pipeline calls -
-**within a single running job, at a single step**, fed by artifacts an
-earlier step already produced. It has no notion of a job boundary, a
-workflow *variable*, or anything the manager's `submit()`/`rerun()` sees:
-by the time `get_iterations` runs, the job is already `RUNNING` and the
-worker process is deep inside `step.py`.
-
-A sweep, by contrast, needs to vary a **workflow variable** (`variable:` -
-`dw/arguments.py:389` - the substitution class fed by
-`JobRequest.arguments`, a flat `Dict[str, Any]`) *before* a job is even
-submitted, and it needs the result to be N separate jobs the queue can run,
-track, cancel, and display individually - not N pipeline calls fused inside
-one job's manifest and one event stream.
-
-### Recommendation: a new construct at the API/submission layer, not a reuse of `previous_result`
-
-Reusing `get_iterations` directly is the wrong fit and loses on three counts:
-
-- **Wrong axis.** It expands references to *prior step output* inside one
-  running job. A sweep expands *submission-time variable values* into
-  *multiple jobs*. Coercing a sweep into a `previous_result:`-shaped
-  reference would require either inventing a fake "step" whose artifacts are
-  the sweep values (semantically backwards - nothing produced them) or
-  running `get_iterations` in the manager instead of the worker, which
-  is a rewrite of what the function is for, not a reuse of it.
-- **Wrong granularity for the rest of this doc's asks.** Batch grouping,
-  per-run cancellation, and a comparison UI all need N distinct job rows
-  with their own ids, statuses, and manifests (section 2). A cartesian
-  expansion *inside* one job gives one job id, one manifest, one event
-  stream carrying all N outputs interleaved - exactly the shape the
-  Gallery/JobPage side-by-side view (section 3) would then have to un-merge.
-- **Wrong safety envelope.** `MAX_ITERATIONS = 10000` exists to bound
-  in-process pipeline calls sharing one GPU worker's memory within a single
-  job's lifetime. A sweep is bounded by "how many jobs am I willing to queue
-  and wait for" - a much smaller number in practice (worth a much lower
-  default cap, see below) and a different kind of limit (queue depth /
-  wall-clock, not memory).
-
-Concretely, add a `sweep` field to the job submission request rather than
-extending `arguments`:
-
-```jsonc
-POST /api/jobs
-{
-  "workflow_path": "workflows/models/z-image.json",
-  "arguments": { "prompt": "a cat", "num_images_per_prompt": 4 },
-  "sweep": { "variable": "steps", "values": [20, 30, 40] }
-}
-```
-
-`sweep.variable` names one key already present (or addable) in `arguments`;
-`sweep.values` is the list to substitute it with. The manager expands this
-into N `submit()` calls, one per value, each with `arguments` overridden at
-that key - reusing `submit()`'s existing validation (schema, path security,
-argument warnings) unchanged, per job. This is deliberately the *simplest*
-construct that satisfies "vary argument X over these values": a single
-variable name and a flat value list, not a workflow-JSON-level DSL. See
-section 6 for why multi-argument sweeps are phase 2, not phase 1.
-
-**Alternative considered and rejected**: a `sweep` block inside the workflow
-JSON itself (schema-level, like `steps`/`variables`). This was rejected
-because a sweep is a property of *one submission*, not of the workflow
-definition - the same `ZImage.json` should be sweepable over `steps` today
-and over `prompt` tomorrow without editing the file each time, matching how
-`arguments` already overrides workflow variables per-submission rather than
-being baked into the JSON. It would also entangle `dw/workflow_schema.json`
-and schema validation with a concern that belongs to the job queue, not the
-engine - workflows run standalone via `dw.run` with no queue underneath
-them at all.
-
-## 2. Batch grouping in `JobManager`
-
-`Job.__init__` (`dw/server/jobs.py:200`) has no batch concept; `Job.spec`
-carries only what one run needs. Minimal additions:
-
-- **`Job`**: a `batch_id: Optional[str]` field, `None` for an ordinary job.
-  All jobs from one sweep submission (or one batch rerun, section 4) share
-  a `uuid4().hex[:12]` batch id, generated once by the new
-  `submit_sweep()`/`rerun_batch()` entry point, the same id-shape `Job.id`
-  already uses.
-- **`Job.summary()`/`detail()`**: include `batch_id` (default `None`) so
-  `JobsPage`/`JobPage` can group without a second lookup.
-- **`JobHistory` (sqlite)**: add a `batch_id TEXT` column via the same
-  additive-`ALTER TABLE` pattern already used for `events`
-  (`jobs.py:74-76`: check `PRAGMA table_info`, add the column if absent, old
-  rows keep `NULL`). No migration script, no version table - the codebase's
-  existing convention for schema growth in this file. `recent_summaries()`
-  and `_to_detail()` add `batch_id` to their `SELECT`s and dict.
-- **`JobManager`**: a `submit_batch(base_kwargs, variable, values)` method
-  that loops `values`, calling the existing `submit()` once per value with
-  `arguments = {**base_kwargs['arguments'], variable: value}`, stamping the
-  shared `batch_id` onto each returned `Job` before queuing. Validation
-  failure on one value should not silently drop the rest of the batch or
-  submit a partial batch invisibly - fail the whole request before any job
-  is queued (validate every expanded arg dict first, exactly as `submit()`
-  already validates before queuing today), so a batch is all-or-nothing at
-  submission time even though the N jobs run independently afterward.
-- **No change to `_run_loop`/`_run_job`/`_consume_results`.** Batch jobs are
-  ordinary jobs in the pending queue - `batch_id` is metadata for grouping
-  and display, not a new execution mode. This keeps the one-worker-FIFO
-  invariant untouched, which matters: nothing about sweeps should imply
-  concurrent GPU use.
-
-`GET /api/jobs` already returns everything `list()` produces; adding
-`batch_id` to summaries is enough for the UI to group client-side (`Map` by
-`batch_id`, matching the existing `statusFilter`-driven `$derived` filter in
-`JobsPage.svelte:16`) without a new endpoint. A `GET /api/jobs?batch_id=...`
-filter is a nice-to-have, not required for phase 1, since the full list is
-already small enough to filter client-side (`recent_summaries(limit=200)`).
-
-## 3. UI surface
-
-Per U5's finding, `ArgumentsEditor.svelte` is the right home for the sweep
-*control* - sweeps vary an argument, and this is the component that already
-owns per-argument rendering (`ui/src/lib/editor/ArgumentsEditor.svelte:88-159`,
-one `.row` per key with its widget chosen by `widgetFor`). Concretely:
-
-- **`ArgumentsEditor.svelte`**: next to each row's existing input, a small
-  toggle ("sweep this") that swaps the single-value widget for a
-  comma/newline-separated value-list input (reusing the `textarea`/`json`
-  widget machinery already present for other multi-value cases, e.g. the
-  `widget === 'json'` branch at line 119). Only one row may be in sweep mode
-  at a time for phase 1 (single-argument sweep, see section 6) - the
-  component enforces this by clearing any other row's sweep state when one
-  is turned on, not by hiding the toggle elsewhere, so the constraint is
-  visible rather than silent. The submitting caller (wherever `args` is
-  currently POSTed to `/api/jobs`, e.g. the workflow run page) reads this
-  state and, when a row is in sweep mode, sends `sweep: {variable, values}`
-  instead of folding the value into `arguments` directly.
-
-- **`JobsPage.svelte`**: this list is already a flat, filterable table
-  (`nameFilter`/`statusFilter`, `$derived` over `jobs`, `ui/src/lib/pages/JobsPage.svelte:10-17`).
-  Grouping needs a small, additive change: when consecutive/matching
-  `batch_id`s are present, render a collapsed batch header row (workflow
-  name, value list summary, aggregate status - "3 running, 1 succeeded")
-  that expands to the same per-job `<a href="#/jobs/{id}">` rows already
-  rendered today (`JobsPage.svelte:91-145`). Jobs with no `batch_id` render
-  exactly as they do now - this is additive, not a rewrite of the list.
-
-- **`JobPage.svelte`**: currently one job's detail plus a `Rerun` button
-  (`JobPage.svelte:163`, `api.rerunJob(jobId).then((j) => go('jobs', j.id))`).
-  When `job.batch_id` is set, add a small "N other runs in this batch" link
-  that navigates to a new comparison view (below) rather than trying to
-  cram side-by-side comparison into the single-job page, which is laid out
-  for one job's manifest/events/warnings and shouldn't be overloaded.
-
-- **Side-by-side comparison - new, not a GalleryPage retrofit.**
-  `GalleryPage.svelte` is a *file* browser (loaded outputs across all jobs,
-  filtered by folder/name, `ui/src/lib/pages/GalleryPage.svelte:20-93`) -
-  its unit is a file, not a job, and it already resolves `sourceJob` per
-  file for the "open the job that produced this file" link
-  (`GalleryPage.svelte:79`, `284-287`). Comparison's unit is a *batch*, and
-  what a comparison view needs (fixed set of N jobs, N argument-value
-  headers, N result grids side by side) doesn't fit Gallery's filtered,
-  open-ended file list without twisting its query model. The concrete,
-  low-risk answer is a new route/page, `BatchPage.svelte`
-  (`#/batches/{batch_id}`), fed by `GET /api/jobs?batch_id=...` (section 2):
-  one column per job, each column's header showing the swept value and
-  status chip (reusing `JobPage`'s `<span class="chip {job.status}">`
-  pattern), each column's body showing that job's manifest thumbnails
-  (reusing whatever `JobPage`/`GalleryPage` already use to render an output
-  file - the manifest-to-thumbnail logic should be factored out once shared
-  between three call sites rather than copied a third time). Diffing
-  (pixel-level or metadata-level) is explicitly out of phase 1 (section 6).
-
-## 4. Batch rerun
-
-Extending single-job rerun to a batch is small if `rerun()` and the new
-`submit_batch()` compose: a `rerun_batch(batch_id)` method collects every
-job (live + historical, same `jobs.get`/`history.get` fallback `rerun()`
-already does at `jobs.py:349-366`) sharing that `batch_id`, reads each one's
-stored `spec`/`arguments` pair, and resubmits each through `submit()` under
-a *new* shared `batch_id` - it does not reuse the old one, so history keeps
-the original batch and the rerun batch as distinct groups rather than
-silently merging reruns into an old batch's row count. Route:
-`POST /api/jobs/batches/{batch_id}/rerun` (`201`, mirroring
-`POST /api/jobs/{job_id}/rerun`), returning the list of newly queued job
-summaries plus the new `batch_id`. `JobsPage`'s batch header (section 3)
-gets a "rerun batch" action next to (not replacing) each row's existing
-single-job rerun.
-
-One thing this does *not* need to solve: rerunning a batch with *different*
-sweep values than the original. Phase 1 batch rerun replays the same N
-values that already ran (useful after a code/model update, or to retry a
-partially-failed batch) - "rerun with new values" is just submitting a new
-sweep from `ArgumentsEditor`, not a rerun-batch concern.
-
-## 5. Interaction with cancellation (S6)
-
-`JobManager.cancel(job_id)` (`jobs.py:408`) already operates per-job: pop
-from `_pending` and finish immediately if `QUEUED`, forward to
-`worker_manager.cancel()` if it's the one `RUNNING` job. Nothing about batch
-grouping changes that mechanism - a batch's jobs are ordinary queue entries,
-so per-job cancel already works unmodified once `batch_id` exists on `Job`.
-
-What's worth adding, cheaply, is a **"cancel batch" convenience** that is
-sugar over the existing per-job call, not new cancellation semantics: a
-`cancel_batch(batch_id)` on `JobManager` that calls the existing `cancel()`
-for every job (live or historical no-op) sharing that `batch_id` - queued
-ones drop instantly, the one currently running gets the same
-`worker_manager.cancel()` signal a single cancel would, the rest stay queued
-until their turn (matching FIFO - there is still exactly one worker). This
-is a loop over the existing method, not a change to `cancel()`'s contract,
-matching how `aggressive-cancellation.md` frames the cooperative-flag model
-as something to build *on top of*, not around. UI: one "cancel batch" button
-on the `JobsPage` batch header and on `BatchPage`, next to (not replacing)
-each job's own per-row cancel - a user who only dislikes one variant's
-progress shouldn't have to kill the whole batch to stop it.
-
-## 6. Effort/risk and phasing
-
-**Phase 1 (minimal, recommended scope):**
-- Single-argument sweep only (`sweep: {variable, values}`), values as a
-  flat list of scalars matching the variable's existing type - no nested
-  sweeps, no cross-argument products.
-- `JobManager.submit_batch()` + sqlite `batch_id` column + `batch_id` on
-  `Job.summary()`/`detail()`. `POST /api/jobs` accepts an optional `sweep`
-  field (`JobRequest` gains `sweep: Optional[SweepRequest]`); the manager
-  branches to `submit_batch` when present, otherwise unchanged single-job
-  `submit()`.
-- A **low** cap on sweep size distinct from `MAX_ITERATIONS` - values in the
-  range of 2-20 make sense for a queue a person is going to sit and watch
-  fill up job-by-job; something like `MAX_SWEEP_VALUES = 25` guards against
-  a fat-fingered value list serializing hundreds of multi-minute jobs onto
-  the one worker. Reject at submission (`ValueError`, same 400 path
-  `submit()` already uses), before anything is queued.
-- `JobsPage` grouping (collapsed batch rows), `ArgumentsEditor` sweep toggle
-  on one row at a time, a minimal `BatchPage` grid view (thumbnails + status
-  per value, no diffing).
-- Batch cancel (section 5) - genuinely cheap once `batch_id` exists, worth
-  bundling into phase 1 rather than deferring.
-- Rough size: comparable to or smaller than `aggressive-cancellation.md`'s
-  own estimate for its "option 2" - a few hundred lines split across
-  `jobs.py`/`app.py` (backend, well-contained, extends patterns already in
-  the file) and a similar amount of new Svelte (`BatchPage.svelte` new,
-  `ArgumentsEditor`/`JobsPage`/`JobPage` each get a focused, additive
-  change). No changes to `step.py`, `previous_results.py`, `worker.py`, or
-  the schema - this stays entirely in the server/UI layer, which keeps risk
-  low: a bug here cannot corrupt a running job's execution, only its
-  submission/grouping/display.
-
-**Phase 2 (later, only if phase 1 sees use):**
-- Multi-argument sweeps (`sweep: {variables: [...], values: [[...], ...]}`
-  or a Cartesian `{variable: values}` map) - genuinely more complex: needs
-  its own combination-explosion guard analogous to `MAX_ITERATIONS`, a
-  richer `ArgumentsEditor` UI (more than one row in sweep mode at once, with
-  a combination-count preview so a user sees "12 jobs" before submitting),
-  and a comparison grid that's 2-D instead of a single row of columns.
-- Batch rerun with edited values (rerun this batch's *shape* against a new
-  value list, not just a replay).
-- Comparison-view diffing: metadata diff (which arguments actually differ
-  between two jobs in a batch - trivial, just a dict diff over stored
-  `spec`/`arguments`) as a cheap first step; visual/pixel diffing of output
-  images as a materially bigger, separate piece of work if wanted at all.
-- `GET /api/jobs?batch_id=...` as a real server-side filter, if the client-
-  side `Map`-group in `JobsPage` ever becomes a real cost (it won't at
-  `recent_summaries(limit=200)` scale).
-
-Phase 1 deliberately stops short of anything that touches `dw/step.py`,
-`dw/pipeline.py`, or the worker protocol - a sweep is purely "submit N jobs
-instead of 1, remember they're related." That's what keeps this a
-server/UI-layer feature rather than an engine change, and why it's scoped
-smaller than U6's framing might suggest at first read.
diff --git a/docs/proposals/todo.md b/docs/proposals/todo.md
index 31886077..a992807a 100644
--- a/docs/proposals/todo.md
+++ b/docs/proposals/todo.md
@@ -10,7 +10,7 @@ original Tier 1 items and both fully-finished proposals (`score-and-select`,
 `script-to-video-agent-skill`) were removed.
 
 Since 2026-09-23 every open item below is also a GitHub issue labeled
-`feature` (#374, #379, #380, and #244 for `resume.md`; #375 was declined, #376, #377 and #378 shipped), parked with Don. Its
+`feature` (#374, #380, and #244 for `resume.md`; #375 and #379 were declined, #376, #377 and #378 shipped), parked with Don. Its
 `priority:N` label mirrors the tier here. Work starts from the issue.
 
 ## Tier 1 — do these first (small, scoped, clear payoff)
@@ -31,16 +31,102 @@ remaining deferred fix is recorded in
    rehydrating the step cache from disk manifests is a correctness-sensitive
    engine change (step identity matching, partial-state edge cases). High
    complexity.
-8. **sweeps-and-comparison.md** — valuable once doing real side-by-side
-   comparisons, but it's a new job-schema field, batch semantics, and a new
-   UI page. Its own doc says "nothing here should be implemented without a
-   fresh look."
 9. **maintenance-screen.md — the full UI page** — Phase 0 (WAL mode) shipped
    2026-09-20; the maintenance/observability page itself (orphan listing,
    disk usage, job pruning) is the remaining, much bigger ask.
 
 ## Shipped since the ranking
 
+- **H3 quality ramp: draft -> final tiers** (#862, stage #882), shipped
+  2026-10-15. A `## Ramp` section in the `minimax-h3` skill's
+  `references/quality-and-speed.md`, not a new skill: TV L1 -> L7, cinema
+  B3 -> L5/P1, ship a close-up draft, with the arguments per rung, what
+  carries (with #861's seed counts), what to approve per tier, how to judge
+  and how to quote cost. Record, including what was deferred (MagCache M2
+  as the cinema-final cache, a top-level skill once a second family has a
+  ladder): `complete/h3-quality-ramp-complete.md`.
+- **Dispatch holds a queued job for host RAM** (#869, stages #909-#910),
+  shipped 2026-10-15. A job waits `queued`, with a `queue_wait` event and a
+  live `waiting_for`, while its projected peak (the max observed for its
+  memory key, else the list fit) won't fit beside the running jobs. It is
+  never refused, and never held alone. Record, including what was deferred
+  (a validate "would wait" prediction, frame count in the key):
+  `complete/host-ram-dispatch-gate-complete.md`.
+- **`plan.estimate` scales the curated figure** (#866, stages #905-#908),
+  shipped 2026-10-15. A move of `num_inference_steps`, `width`/`height` or
+  `num_frames` off the defaults now scales the catalog or inherited figure
+  in proportion (`basis: "derived"`, `scaled` names the axes) instead of
+  quoting `unknown` or the flat figure. Any other declared driver (H3
+  weights, LoRA, attention, cache) keeps the figure with `low_confidence`
+  and `differs`. The fingerprint and step cache are keyed only by what
+  changes the output. Record, including what was cut (compile as a driver,
+  the learned fixed + per-pass fit) and follow-ups #911 and #912:
+  `complete/estimate-scaling-complete.md`.
+
+- **H3 adapter check reads the LoRA catalog first** (#870, stage #888),
+  shipped 2026-10-14. On the server, validate and admission look up the
+  LoRA in the shared catalog: a `proven` entry whose `workflow` puts it on
+  the other partition refuses the step (Realism People on `ref2va`), a
+  `trial`/`rejected` one only warns, naming the entry; uncatalogued files
+  keep the filename rule. Record, including what was cut (reading the
+  safetensors header, any Hub request from validation):
+  `complete/catalog-adapter-check-complete.md`.
+
+- **Running a sweep: a written method, not a server feature** (#872, stage
+  #890), shipped 2026-10-14. `## Running a sweep` in `docs/WORKSPACES.md`
+  (`get_guide("workspaces", section="Running a sweep")`) writes down the
+  loop the H3 quality matrix ran with local scripts: one workspace per
+  experiment, factors as variables, a pinned seed, one noted `run_workflow`
+  per variant with `wait_for_job` between, `set_note` assessments in the
+  `score N/5 · judged_by <who>` form. It supersedes
+  `sweeps-and-comparison.md` (#379), now deleted. Record, including what was
+  cut (`sweep=` on `run_workflow`, structured notes, an experiment object,
+  `arguments` on `rerun_job`): `complete/sweeps-complete.md`.
+
+- **`compare_outputs`: aligned grids and diff metrics across runs** (#871,
+  stage #889), shipped 2026-10-14. A read-only MCP tool and `POST
+  /api/gallery/compare` return one grid of 2–8 outputs × 1–8 moments, plus
+  PSNR, SSIM and mean abs diff against a baseline. One shared crop is the
+  region shown and measured; per-output crops are display only. This is the
+  read-only comparison half of the old `sweeps-and-comparison.md`, without
+  batches or a UI. Record,
+  including what was cut (`crop="faces"` as a deferred stage B,
+  `same_staging`, saving the grid): `complete/compare-outputs-complete.md`.
+
+- **Per-step timing and step-cache skip counts** (#867, stages #885-#886),
+  shipped 2026-10-14. Each pipeline step's manifest entry carries `timing`
+  (load, encode, denoise, passes, first and median pass, decode, save), and
+  a cached step adds `timing.cache` (forwards, computed, skipped,
+  `hit_rate`) plus one `cache_stats` event. Record, including what was cut
+  (`compile_s`, counts for `taylorseer`/`faster`/`text_kv`, with their
+  triggers): `complete/step-timing-complete.md`.
+
+- **H3 templates expose `attention_backend` and `cache`** (#865, stages
+  #883-#884), shipped 2026-10-14. Every MiniMax-H3 template takes both as
+  variables (default `null`, wired to the H3 step only). `cache` is a
+  whole-object variable: the schema accepts `variable:` there, and
+  validation checks the substituted object (`cache_errors`). The tier
+  presets were cut; the tiers live in the `minimax-h3` skill as argument
+  sets (#862). Record: `complete/h3-template-acceleration-complete.md`.
+
+- **Validate warnings for acceleration settings that can't pay off** (#868,
+  stage #887), shipped 2026-10-14. `validate_workflow` and `save_workflow`
+  warn (never refuse) on `cache_short_schedule` (a `first_block`/`mag` cache
+  under 20 steps), `taylorseer_state_unestimated`,
+  `compile_fullgraph_with_cache` and `attention_backend_unavailable` (a
+  CUDA-only backend on a server that isn't CUDA). Compile under offload is
+  docs only. Record, including what was deferred (TaylorSeer state sizing,
+  a `mag` step-mismatch check): `complete/acceleration-warnings-complete.md`.
+
+- **Copy runs and assets between workspaces** (#853, stages #859-#860),
+  shipped 2026-10-13. `copy_to_workspace` and `POST
+  /api/workspaces/{destination}/copy` copy whole runs (with manifests) and
+  asset-library entries (with their notes and kept shots) between two
+  workspaces under one root. The copy is all or nothing, never overwrites
+  and is idempotent. Media is hard-linked, sidecars are copied, and
+  colliding versions are renumbered. A move is a copy followed by the
+  delete tools. Record, including what was deferred (a UI, job rows for
+  copied runs, workflows and prompts): `complete/workspace-copy-complete.md`.
 - **List and clear dw's own disk caches** (#828, stages #832-#834), shipped
   2026-10-11. A registry (`dw/disk_caches.py`) of `inductor`, `triton` (Triton's
   own `~/.triton/cache`, left in place) and the `quantized` cache, with
@@ -237,6 +323,12 @@ remaining deferred fix is recorded in
   Record, including what was deferred (a host-RAM gate, an overlap flag on
   observed cost, per-card catalog cost, with their triggers):
   `complete/multi-gpu-workers-complete.md`.
+- **A locked H3 frame that lip-syncs to a song** (#852, stages
+  #877-#879), shipped 2026-10-14. Four renders on lem found Ref2VA
+  `[keyframe completion + audio reuse]` with a first frame holds a wide
+  two-shot and lip-syncs the right singer; a last frame doesn't help. One
+  `minimax-h3` skill line; no template, since `music-video` takes the
+  recipe with arguments. Record: `complete/h3-keyframe-audio-complete.md`.
 
 ## Declined
 
diff --git a/docs/stabilization/baseline.json b/docs/stabilization/baseline.json
index 303dabdb..a4e7bc90 100644
--- a/docs/stabilization/baseline.json
+++ b/docs/stabilization/baseline.json
@@ -1,10 +1,10 @@
 {
-  "modules": 208,
+  "modules": 219,
   "modules_over_size_ceiling": 0,
   "functions_over_150_lines": 0,
   "prefix_literals": 0,
   "prefix_handling": 0,
-  "test_dw_patch_targets": 326,
+  "test_dw_patch_targets": 327,
   "claude_md_lines": 129,
   "duplicate_blocks": 0,
   "complex_functions": 2,
diff --git a/docs/superpowers/plans/2026-10-12-roles-and-notes.md b/docs/superpowers/plans/2026-10-12-roles-and-notes.md
new file mode 100644
index 00000000..02ce353c
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-12-roles-and-notes.md
@@ -0,0 +1,2317 @@
+# Roles and Notes Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:**
+- Every file a run writes carries a role, `final` or `intermediate`, and
+  every run records the files it read as `input`s.
+- Runs, run files, assets and workspaces can carry an optional plain-text
+  note.
+- Roles and notes are surfaced through the HTTP API, MCP and the web UI,
+  and roles become the gallery's main way to navigate.
+
+**Architecture:**
+- **`dw/roles.py`** decides a step's role from:
+  - its `result.role`;
+  - its `result.subfolder` convention;
+  - or the data flow, i.e. which later step consumes it and whether that
+    consumer writes media.
+
+  The engine writes the role into each manifest step entry when the run
+  ends. The server infers it, with the same function, for runs that
+  predate this change.
+- **`dw/notes.py`** owns two stores:
+  - a `notes.json` in a directory, which holds a run note and per-file
+    notes, and serves both run directories and asset-library directories;
+  - a `workspace.json` at a workspace root.
+
+  The server writes a submitted run note into `notes.json` when the
+  worker's `run_start` event names the run directory, so the engine never
+  touches notes. One `PUT /api/notes` route edits any note. MCP gains
+  `set_note` and a `note` parameter on `run_workflow`, `upload_asset` and
+  `keep_output`.
+
+**Tech Stack:**
+- Python 3 (FastAPI, pydantic, pytest with xdist);
+- Svelte 5 with runes and Vitest;
+- openapi-typescript codegen;
+- sqlite job history.
+
+**Spec:** `docs/superpowers/specs/2026-10-12-roles-and-notes-design.md`
+
+**Deviation from spec:** asset notes go in the asset directory's
+`notes.json`, the same format as a run directory's, not in the
+`manifest.json` sidecar. `record_kept_shots` deletes that sidecar whenever
+its last shots or provenance entry goes, which would take the notes with
+it. One format for both stores is also simpler. Task 5 updates the spec
+table.
+
+## Global Constraints
+
+- Note: plain text. At most `4000` characters, otherwise HTTP 400. An
+  empty or whitespace-only string, or null, clears the note. Never
+  rendered as HTML or markdown, so never `{@html}` in the UI.
+- Role values: `"final"`, `"intermediate"`, `"input"`. Only `final` and
+  `intermediate` are valid in `result.role`.
+- Sidecar file names:
+  - `notes.json` in a run directory or an asset directory;
+  - `workspace.json` at a workspace root.
+- Every `dw/` module stays at or under 1,100 lines. `dw/workflow_run.py`
+  is already at 1,013, so keep additions there minimal.
+- The architecture ratchet (`scripts/arch_metrics.py --check
+  docs/stabilization/baseline.json`) must pass. This plan adds exactly two
+  modules (`dw/roles.py` and `dw/notes.py`), so `modules` goes from 208 to
+  210. That rise needs Don's approval, and Task 1's commit names it
+  (`modules 208 -> 210: dw/roles.py, dw/notes.py, roles-and-notes spec`).
+  Add no other new Python module: routes go in existing route files, and
+  MCP code goes in existing `dw_mcp` files.
+- Every JSON route the UI calls declares a response model in
+  `dw/server/api_models.py`, with `response_model_exclude_unset`. Keys
+  sent only sometimes use `sometimes(...)`.
+- After any API model change:
+  - run `python scripts/dump_openapi.py`, under the `constraints-openapi.txt`
+    pins;
+  - run `cd ui && npm run gen:api`;
+  - commit both generated files.
+
+  `ui/src/lib/types.ts` only re-exports.
+- A new JSON route that `ui/src/lib/api.ts` calls must be added to
+  `tests/test_api_contract.py`'s `UI_READ_ROUTES`, or
+  `tests/test_ui_twins.py` fails.
+- Bits UI is imported only under `ui/src/lib/ui/`.
+- Security:
+  - every filesystem write lands on a path checked by
+    `validate_output_path(path, root)` against its root, with a non-None
+    root;
+  - no `eval`, `exec` or `shell=True`;
+  - targets are resolved through the existing validated resolvers.
+- Run Python tests with `DW_DEVICE=cpu venv/bin/python -m pytest ...`. The
+  local venv has torch.
+- Never `git add -A` under `ui/`, because Don edits `ui/package.json`. Add
+  files by name.
+- Commit messages end with `Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>`.
+- Work on branch `feat/roles-and-notes`, cut from `develop`.
+
+## Review Focus
+
+These failure modes have no spec line but are likely to bite. Each has a
+test in the task that owns it.
+
+1. **A note edited while its run is still going.** The engine never writes
+   `notes.json` and the server serializes its own writes, so an edit
+   during a run must survive the run's final manifest write. Pinned in
+   Task 6: `test_note_set_during_run_survives_manifest_rewrite`.
+2. **Deleting the last output of a run that has a note.** The run
+   directory must still be pruned, and must not be left behind holding
+   only `notes.json`. Pinned in Task 5: `test_run_with_only_notes_is_pruned_and_orphan`.
+3. **Re-uploading an asset under the name of a deleted one.** It must not
+   inherit the old note or provenance. Pinned in Task 6:
+   `test_deleted_asset_leaves_no_note_or_provenance`.
+4. **A `PUT /api/notes` target with traversal, an absolute path, or a
+   `workspace:` name that does not exist.** Expect 400 or 404, with
+   nothing written outside the root. Pinned in Task 6:
+   `test_put_note_refuses_traversal_targets`.
+5. **A run whose consumer step saved nothing** (`save: false`) between two
+   media steps. The upstream step must still be `intermediate`. Pinned in
+   Task 1: `test_unsaved_consumer_still_demotes`.
+
+---
+
+## Stage 1: Roles
+
+### Task 1: `dw/roles.py` and the `result.role` schema field
+
+**Files:**
+- Create: `dw/roles.py`
+- Modify: `dw/workflow_schema.json`. The result block's properties sit
+  near `save` and `subfolder` (around line 1230). Add `role`.
+- Modify: `docs/ARCHITECTURE.md`. Add one row for roles.
+- Modify: `docs/stabilization/baseline.json`. `modules` goes from 208 to
+  210. Task 5 adds the second module, so raise it once, here, and name
+  both in the commit message.
+- Test: `tests/test_roles.py`
+
+**Interfaces:**
+- Produces:
+  - `FINAL = "final"`, `INTERMEDIATE = "intermediate"`, `INPUT = "input"`,
+    `ROLES = (FINAL, INTERMEDIATE)`
+  - `step_roles(steps: list[dict], manifest_steps: list[dict]) -> dict[str, str]`.
+    `steps` is the *expanded* definition's `"steps"`. The result maps step
+    name to role, for every step named in `steps` or in a manifest
+    entry's `step`. A manifest entry carrying `parent_step` takes its
+    parent step's role.
+  - `annotate_roles(steps: list[dict], manifest_steps: list[dict]) -> list[dict]`
+    returns copies of `manifest_steps`, each with `"role"` set. An entry
+    whose `step` is unknown gets `FINAL`.
+  - `run_inputs(steps: list[dict]) -> list[dict]` returns
+    `[{"reference": "asset:x.png", "kind": "asset"}, {"reference": "output:...", "kind": "output"}]`,
+    with duplicates removed and in first-use order. It is read from the
+    expanded steps' arguments.
+  - `entry_role(entry: dict) -> str | None` returns a manifest entry's
+    recorded role, or None.
+
+- [ ] **Step 1: Write the failing tests**
+
+```python
+# tests/test_roles.py
+from dw.roles import FINAL, INTERMEDIATE, annotate_roles, run_inputs, step_roles
+
+
+def _step(name, result=None, args=None):
+    step = {"name": name, "task": {"command": "noop", "arguments": args or {}}}
+    if result is not None:
+        step["result"] = result
+    return step
+
+
+def _entry(step, *files, **extra):
+    return {"step": step, "files": list(files), **extra}
+
+
+def test_leaf_media_step_is_final_and_consumed_one_intermediate():
+    steps = [
+        _step("image"),
+        _step("video", args={"image": "previous_result:image"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "b.mp4")]
+    assert step_roles(steps, manifest) == {"image": INTERMEDIATE, "video": FINAL}
+
+
+def test_property_reference_counts_as_consumption():
+    steps = [
+        _step("stems"),
+        _step("mix", args={"audio": "previous_result:stems.vocals"}),
+    ]
+    manifest = [_entry("stems", "v.wav"), _entry("mix", "m.wav")]
+    assert step_roles(steps, manifest)["stems"] == INTERMEDIATE
+
+
+def test_text_only_consumer_does_not_demote():
+    steps = [
+        _step("video"),
+        _step("check", args={"video": "previous_result:video"}),
+    ]
+    manifest = [_entry("video", "v.mp4"), _entry("check", "report.json")]
+    roles = step_roles(steps, manifest)
+    assert roles == {"video": FINAL, "check": FINAL}
+
+
+def test_unsaved_consumer_still_demotes():
+    steps = [
+        _step("image"),
+        _step("latent", args={"image": "previous_result:image"}),
+        _step("video", args={"latent": "previous_result:latent"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "v.mp4")]
+    roles = step_roles(steps, manifest)
+    assert roles["image"] == INTERMEDIATE
+    assert roles["latent"] == INTERMEDIATE
+    assert roles["video"] == FINAL
+
+
+def test_explicit_role_wins_over_inference_and_subfolder():
+    steps = [
+        _step("image", result={"role": "final", "subfolder": "intermediate"}),
+        _step("video", args={"image": "previous_result:image"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "v.mp4")]
+    assert step_roles(steps, manifest)["image"] == FINAL
+
+
+def test_subfolder_convention_including_nested():
+    steps = [
+        _step("a", result={"subfolder": "intermediate/shots"}),
+        _step("b", result={"subfolder": "final/act-1"}),
+    ]
+    manifest = [_entry("a", "x.png"), _entry("b", "y.png")]
+    assert step_roles(steps, manifest) == {"a": INTERMEDIATE, "b": FINAL}
+
+
+def test_other_subfolder_name_falls_through_to_inference():
+    steps = [_step("a", result={"subfolder": "shots"})]
+    assert step_roles(steps, [_entry("a", "x.png")]) == {"a": FINAL}
+
+
+def test_from_previous_result_key_counts():
+    steps = [
+        _step("seg"),
+        _step("inpaint", args={"mask": {"from_previous_result": "seg"}}),
+    ]
+    manifest = [_entry("seg", "m.png"), _entry("inpaint", "o.png")]
+    assert step_roles(steps, manifest)["seg"] == INTERMEDIATE
+
+
+def test_dotted_step_name_resolves_by_longest_match():
+    steps = [
+        _step("v1.0"),
+        _step("up", args={"image": "previous_result:v1.0"}),
+    ]
+    manifest = [_entry("v1.0", "a.png"), _entry("up", "b.png")]
+    assert step_roles(steps, manifest)["v1.0"] == INTERMEDIATE
+
+
+def test_for_each_members_are_steps_of_their_own():
+    steps = [
+        _step("shot@0"),
+        _step("shot@1"),
+        _step(
+            "join",
+            args={"videos": ["previous_result:shot@0", "previous_result:shot@1"]},
+        ),
+    ]
+    manifest = [
+        _entry("shot@0", "0.mp4"),
+        _entry("shot@1", "1.mp4"),
+        _entry("join", "j.mp4"),
+    ]
+    roles = step_roles(steps, manifest)
+    assert roles["shot@0"] == roles["shot@1"] == INTERMEDIATE
+    assert roles["join"] == FINAL
+
+
+def test_child_entries_take_parent_step_role():
+    steps = [
+        _step("child", args={}),
+        _step("score", args={"video": "previous_result:child"}),
+    ]
+    manifest = [
+        _entry("render", "r.mp4", parent_step="child"),
+        _entry("score", "s.mp4"),
+    ]
+    annotated = annotate_roles(steps, manifest)
+    assert annotated[0]["role"] == INTERMEDIATE
+    assert annotated[1]["role"] == FINAL
+
+
+def test_annotate_roles_copies_and_defaults_unknown_to_final():
+    manifest = [_entry("ghost", "g.png")]
+    annotated = annotate_roles([], manifest)
+    assert annotated[0]["role"] == FINAL
+    assert "role" not in manifest[0]
+
+
+def test_run_inputs_dedups_in_first_use_order():
+    steps = [
+        _step("a", args={"image": "asset:cast/iris.png", "mask": "output:w/r/m.png"}),
+        _step("b", args={"images": ["asset:cast/iris.png", "asset:bg.png"]}),
+    ]
+    assert run_inputs(steps) == [
+        {"reference": "asset:cast/iris.png", "kind": "asset"},
+        {"reference": "output:w/r/m.png", "kind": "output"},
+        {"reference": "asset:bg.png", "kind": "asset"},
+    ]
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_roles.py -v -n0`
+Expected: FAIL with `ModuleNotFoundError: No module named 'dw.roles'`.
+
+- [ ] **Step 3: Write `dw/roles.py`**
+
+```python
+"""The role of each file a run wrote - final or intermediate - and the
+inputs it read.
+
+The gallery mixes a run's deliverable with the scratch files that went
+into it. The 'final'/'intermediate' result subfolder convention separates
+them for the catalog templates, but the engine treats no folder name
+specially and a hand-built workflow rarely sets one. A role is decided per
+step, first rule wins:
+
+1. the step's `result.role` ('final' or 'intermediate');
+2. its `result.subfolder`, when that is or starts with one of those names;
+3. the data flow: a step a later step consumes (a previous_result
+   reference) is intermediate when that consumer writes media or saves
+   nothing at all, and final otherwise - a consumer that writes only text
+   or JSON (a transcript, check_script, plan_cuts) reads a deliverable, it
+   does not make one out of it.
+
+A composed child's rolled-up manifest entries carry `parent_step` and take
+that step's role. The engine records roles when a run ends; the server
+infers them with the same function for a run that predates this. Inputs
+are the asset: and output: references the expanded steps carry - a run's
+'made from' list. This module names no model.
+"""
+
+from .references import ASSET, OUTPUT, is_ref, iter_previous_result_references
+from .security import (
+    ALLOWED_AUDIO_EXTENSIONS,
+    ALLOWED_IMAGE_EXTENSIONS,
+    ALLOWED_VIDEO_EXTENSIONS,
+)
+from .step_cache import reference_resolves_to
+
+FINAL = "final"
+INTERMEDIATE = "intermediate"
+INPUT = "input"
+ROLES = (FINAL, INTERMEDIATE)
+ROLE_KEY = "role"
+
+_MEDIA_EXTENSIONS = frozenset(
+    ALLOWED_IMAGE_EXTENSIONS | ALLOWED_VIDEO_EXTENSIONS | ALLOWED_AUDIO_EXTENSIONS
+)
+_INPUT_KINDS = ((ASSET, "asset"), (OUTPUT, "output"))
+
+
+def _declared_role(step):
+    """Rules 1 and 2: the role a step's result block states, or None."""
+    result = step.get("result")
+    if not isinstance(result, dict):
+        return None
+    role = result.get(ROLE_KEY)
+    if role in ROLES:
+        return role
+    subfolder = result.get("subfolder")
+    if isinstance(subfolder, str):
+        head = subfolder.split("/", 1)[0]
+        if head in ROLES:
+            return head
+    return None
+
+
+def _writes_only_text(files):
+    """Whether a consumer saved files and none of them is media."""
+    if not files:
+        return False
+    return not any(
+        str(name).lower().endswith(tuple(_MEDIA_EXTENSIONS)) for name in files
+    )
+
+
+def _files_by_step(manifest_steps):
+    files = {}
+    for entry in manifest_steps or []:
+        if not isinstance(entry, dict):
+            continue
+        # A child's entry is its composing step's output in the parent
+        name = entry.get("parent_step") or entry.get("step")
+        files.setdefault(name, []).extend(entry.get("files") or [])
+    return files
+
+
+def step_roles(steps, manifest_steps):
+    """Each step's role, by name - see the module docstring for the rules."""
+    steps = [s for s in steps or [] if isinstance(s, dict) and "name" in s]
+    files = _files_by_step(manifest_steps)
+    names = [s["name"] for s in steps]
+    roles = {}
+    for step in steps:
+        declared = _declared_role(step)
+        if declared:
+            roles[step["name"]] = declared
+    for consumer in steps:
+        if _writes_only_text(files.get(consumer["name"])):
+            continue
+        for _path, reference, _via in iter_previous_result_references(
+            consumer, descend_into_from=True
+        ):
+            if not isinstance(reference, str):
+                continue
+            target = max(
+                (n for n in names if reference_resolves_to(reference, n)),
+                key=len,
+                default=None,
+            )
+            if target is not None and target not in roles:
+                roles[target] = INTERMEDIATE
+    for name in list(names) + list(files):
+        roles.setdefault(name, FINAL)
+    return roles
+
+
+def annotate_roles(steps, manifest_steps):
+    """Copies of `manifest_steps`, each with its step's `role`."""
+    roles = step_roles(steps, manifest_steps)
+    annotated = []
+    for entry in manifest_steps or []:
+        if not isinstance(entry, dict):
+            annotated.append(entry)
+            continue
+        name = entry.get("parent_step") or entry.get("step")
+        annotated.append({**entry, ROLE_KEY: roles.get(name, FINAL)})
+    return annotated
+
+
+def entry_role(entry):
+    """A manifest entry's recorded role, or None when it predates roles."""
+    role = entry.get(ROLE_KEY) if isinstance(entry, dict) else None
+    return role if role in ROLES else None
+
+
+def _walk_strings(value):
+    if isinstance(value, str):
+        yield value
+    elif isinstance(value, dict):
+        for item in value.values():
+            yield from _walk_strings(item)
+    elif isinstance(value, list):
+        for item in value:
+            yield from _walk_strings(item)
+
+
+def run_inputs(steps):
+    """The asset: and output: references the steps read, in first-use order."""
+    seen = []
+    for step in steps or []:
+        if not isinstance(step, dict):
+            continue
+        for value in _walk_strings(step):
+            for prefix, kind in _INPUT_KINDS:
+                if is_ref(prefix, value) and value not in (
+                    s["reference"] for s in seen
+                ):
+                    seen.append({"reference": value, "kind": kind})
+    return seen
+```
+
+There are two judgment points here. In `step_roles`, a declared role is
+never overridden by inference: that is the "explicit wins" rule. Steps
+that are not declared get `INTERMEDIATE` from any consumer that is not
+text-only.
+
+`dw/references.py` is the only module allowed to spell a reference
+prefix (`PREFIX_OWNERS` in `scripts/arch_metrics.py`). That is why this
+module imports `ASSET` and `OUTPUT` and never writes `"asset:"`.
+
+- [ ] **Step 4: Add `role` to the schema**
+
+In `dw/workflow_schema.json`, next to `"save"` in the result block's
+`properties`, add:
+
+```json
+"role": {
+    "description": "What this step's files are to whoever looks at the run: 'final' (a deliverable) or 'intermediate' (made for a later step). Optional: without it a subfolder named 'final' or 'intermediate' decides, else a step a later media-writing step consumes is intermediate and every other step is final. May be a 'variable:' reference.",
+    "anyOf": [
+        {"enum": ["final", "intermediate"]},
+        {"type": "string", "pattern": "^variable:"}
+    ]
+}
+```
+
+Check how `subfolder` declares its `variable:` allowance in the same
+block, and mirror that exactly if it differs.
+
+- [ ] **Step 5: Add a schema test**
+
+Append to `tests/test_roles.py`:
+
+```python
+import pytest
+from dw.validation import (
+    validate_workflow_definition,
+)  # use the name tests/test_schema*.py use
+
+
+@pytest.mark.parametrize(
+    "role,ok",
+    [("final", True), ("intermediate", True), ("input", False), ("keeper", False)],
+)
+def test_schema_role_values(role, ok):
+    workflow = {
+        "id": "t",
+        "steps": [
+            {
+                "name": "s",
+                "task": {"command": "noop", "arguments": {}},
+                "result": {"role": role},
+            }
+        ],
+    }
+    errors = validate_workflow_definition(workflow)
+    assert (not errors) == ok
+```
+
+Before writing this, `grep -rn "def validate" dw/validation.py`, and use
+the schema-validation entry point that the existing schema tests import.
+Adapt the call and the shape of its return value to match.
+
+- [ ] **Step 6: Run the tests**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_roles.py -v -n0`
+Expected: all PASS.
+
+- [ ] **Step 7: Add the architecture map row and raise the baseline**
+
+In `docs/ARCHITECTURE.md`, add a row in the table that holds the run and
+manifest rows, using the same column shape:
+
+`| A file's role (final / intermediate / input) | dw/roles.py | Decided per step: result.role, then a final/intermediate subfolder, then data flow (a step a media-writing or unsaved consumer reads is intermediate). Engine records it at run end; the server infers it identically for older runs. | tests/test_roles.py |`
+
+Set `"modules": 210` in `docs/stabilization/baseline.json`.
+
+Run: `venv/bin/python scripts/arch_metrics.py --check docs/stabilization/baseline.json`
+Expected: pass. The current count is 209 with `dw/roles.py`, which is
+under 210.
+
+Run: `venv/bin/python -m pytest tests/test_architecture_map.py -n0 -q`
+Expected: PASS.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add dw/roles.py dw/workflow_schema.json tests/test_roles.py docs/ARCHITECTURE.md docs/stabilization/baseline.json
+git commit -m "feat(roles): decide each step's role - final, intermediate - and a run's inputs
+
+modules 208 -> 210: dw/roles.py (this commit) and dw/notes.py (notes
+stage), per the roles-and-notes spec, approved by Don.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+### Task 2: The engine records roles and inputs in the manifest
+
+**Files:**
+- Modify: `dw/workflow_run.py`:
+  - `RunRecord`, around line 95: add a field;
+  - `open_run`, line 616: keep the expanded steps;
+  - `write_run_manifest`, line 209: annotate.
+- Test: `tests/test_run_manifest_roles.py`
+
+**Interfaces:**
+- Consumes: `annotate_roles(steps, manifest_steps)` and `run_inputs(steps)`
+  from Task 1.
+- Produces: a terminal `manifest.json` has:
+  - `steps[i]["role"]` on every entry;
+  - a top-level `"inputs": [{"reference", "kind"}]`.
+
+  A `"running"` manifest carries `inputs` but no roles.
+
+- [ ] **Step 1: Write the failing test**
+
+Find an existing test that runs a small workflow end to end on the CPU
+and reads its `manifest.json`: `grep -rln "manifest.json" tests/ | head`,
+and prefer the one using noop or utility tasks. Copy its fixture pattern.
+The test:
+
+```python
+# tests/test_run_manifest_roles.py
+import json, os
+# reuse the fixture/helper the chosen existing test uses to run a workflow
+# into a tmp output dir and return the run directory
+
+
+def test_terminal_manifest_records_roles_and_inputs(
+    run_workflow_into, tmp_path, asset_png
+):
+    workflow = {
+        "id": "roles-e2e",
+        "steps": [
+            # two utility steps that write images, the second reading the first,
+            # e.g. an image-processor task over an asset - pick tasks the chosen
+            # fixture's workflows already use so no model is downloaded
+        ],
+    }
+    run_dir = run_workflow_into(workflow)
+    manifest = json.load(open(os.path.join(run_dir, "manifest.json")))
+    roles = {e["step"]: e["role"] for e in manifest["steps"]}
+    assert roles == {"first": "intermediate", "second": "final"}
+    assert manifest["inputs"] == [{"reference": f"asset:{asset_png}", "kind": "asset"}]
+```
+
+Fill the step list with two real, model-free image tasks from
+`docs/TASKS.md`, for example the resize or crop tasks the
+image-processors template uses. Check that the chosen fixture can serve
+an `asset:` file. If no end-to-end fixture fits, unit-test
+`write_run_manifest` directly instead:
+- construct a `RunRecord` and a minimal stand-in `workflow` with
+  `manifest`, `_run_dir`, `_run_version`, `_elided_steps`, `name` and
+  `file_spec`;
+- set `record.expanded_steps`;
+- assert the written file.
+
+- [ ] **Step 2: Run it to verify it fails**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_run_manifest_roles.py -v -n0`
+Expected: FAIL with `KeyError: 'role'`.
+
+- [ ] **Step 3: Implement it**
+
+In `dw/workflow_run.py`:
+
+```python
+from .roles import annotate_roles, run_inputs
+```
+
+Add to `RunRecord`, after `annotations`:
+
+```python
+    # The expanded steps the run executed - what roles and inputs are read from
+    expanded_steps: list = field(default_factory=list)
+```
+
+In `open_run`, at the top, after `record.run_id = None`:
+
+```python
+    record.expanded_steps = prepared.workflow_def.get("steps") or []
+```
+
+In `write_run_manifest`, replace the `"steps": [...]` value with a local
+computed before the `write_manifest(...)` call, and add `"inputs"`:
+
+```python
+    steps = [
+        {
+            **entry,
+            "files": manifest_relative_files(entry.get("files"), workflow._run_dir),
+            **_relative_shots(entry, workflow._run_dir),
+        }
+        for entry in workflow.manifest
+    ]
+    # Roles once the run has ended - a running manifest would show the
+    # newest step as final until its consumer runs (dw/roles.py)
+    if status != "running":
+        steps = annotate_roles(record.expanded_steps, steps)
+```
+
+Then use `"steps": steps,` and add `"inputs": run_inputs(record.expanded_steps),`
+after `"arguments"`.
+
+Keep the net addition to roughly 12 lines.
+
+Run: `wc -l dw/workflow_run.py`
+Expected: at or under 1,030.
+
+- [ ] **Step 4: Run the test and the run and manifest suites**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_run_manifest_roles.py tests/ -k "manifest or run_dir or runs" -q`
+Expected: PASS. If an existing test compares the full manifest dict for
+equality, update its expectation to include `role` and `inputs`. Those
+fields are the intended change.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/workflow_run.py tests/test_run_manifest_roles.py
+git commit -m "feat(roles): the engine records each step's role and the run's inputs in its manifest
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also `git add` any existing test files whose expectations you updated,
+naming each one.
+
+### Task 3: Server and MCP surface roles
+
+**Files:**
+- Modify: `dw/server/routes/gallery.py`:
+  - `_gallery_entries`, line 57: add `role`;
+  - `GET /api/gallery`, around line 163: add the `role` filter.
+- Modify: `dw/server/routes/media.py`. In `GET /api/gallery/{name}/metadata`,
+  around line 69, add `role` and `inputs`.
+- Modify: `dw/server/api_models.py`:
+  - `GalleryFile`, line 781;
+  - `GalleryMetadata`, line 843.
+- Modify: `dw_mcp/catalog.py`:
+  - `list_gallery` logic, around line 229, and its compact projection;
+  - `get_gallery_metadata`, line 285.
+- Modify: `dw_mcp/tools_catalog.py`. `list_gallery` at line 255 gains a
+  `role` parameter.
+- Modify: `ui/src/lib/generated/openapi.json` and
+  `ui/src/lib/generated/api-schema.ts`, regenerated.
+- Modify: `docs/SERVER.md` and `docs/MCP.md`, gallery sections, one
+  paragraph each.
+- Test: `tests/test_gallery_roles.py`
+
+**Interfaces:**
+- Consumes: `annotate_roles`, `entry_role` and `ROLES` from Task 1, and
+  the manifests Task 2 writes.
+- Produces:
+  - `run_roles(run_dir: str) -> dict[str, str]`, a module-level function
+    in `dw/server/routes/gallery.py`. It maps a file's path relative to
+    the run directory, `/`-separated, to its role. It reads
+    `manifest.json` and uses recorded roles where they are present.
+    Otherwise it expands the realized `workflow.json` and calls
+    `annotate_roles`. If neither file is readable it returns `{}`. Cache
+    it in a module dict keyed by `(run_dir, manifest mtime)`, bounded at
+    512 entries and evicting oldest first.
+  - `GalleryFile.role: Literal["final","intermediate"] | None`
+  - `GalleryMetadata.role` (the same type), and
+    `GalleryMetadata.inputs: list[GalleryInput]` with
+    `GalleryInput{reference: str, kind: Literal["asset","output"]}`, both
+    via `sometimes()`.
+  - `GET /api/gallery?role=final&role=intermediate`, a repeatable query.
+    Leaving it out returns everything. A file with `role` None counts as
+    final for filtering.
+  - MCP `list_gallery(..., role: list[str] | None = None)`. The compact
+    projection gains `role`.
+
+- [ ] **Step 1: Write the failing tests**
+
+```python
+# tests/test_gallery_roles.py
+import json, os
+# use the TestClient / app fixture tests/test_server.py uses for /api/gallery
+# (grep "api/gallery" tests/test_server.py for the fixture names)
+
+
+def _write_run(root, identity, run_id, steps, realized=None, files=()):
+    run_dir = os.path.join(root, identity, run_id)
+    os.makedirs(run_dir, exist_ok=True)
+    for f in files:
+        path = os.path.join(run_dir, f)
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        open(path, "wb").write(b"\x89PNG\r\n\x1a\n")
+    json.dump(
+        {"run_id": run_id, "version": 1, "status": "succeeded", "steps": steps},
+        open(os.path.join(run_dir, "manifest.json"), "w"),
+    )
+    if realized is not None:
+        json.dump(realized, open(os.path.join(run_dir, "workflow.json"), "w"))
+    return run_dir
+
+
+def test_recorded_roles_reach_the_listing(client, output_root):
+    _write_run(
+        output_root,
+        "wf",
+        "20261012-000000-aaaa",
+        [
+            {"step": "a", "files": ["a.png"], "role": "intermediate"},
+            {"step": "b", "files": ["b.png"], "role": "final"},
+        ],
+        files=["a.png", "b.png"],
+    )
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["role"] == "intermediate"
+    assert files["b.png"]["role"] == "final"
+
+
+def test_older_run_roles_inferred_from_realized_workflow(client, output_root):
+    realized = {
+        "id": "wf",
+        "steps": [
+            {"name": "a", "task": {"command": "noop", "arguments": {}}},
+            {
+                "name": "b",
+                "task": {
+                    "command": "noop",
+                    "arguments": {"image": "previous_result:a"},
+                },
+            },
+        ],
+    }
+    _write_run(
+        output_root,
+        "wf",
+        "20261012-000001-bbbb",
+        [{"step": "a", "files": ["a.png"]}, {"step": "b", "files": ["b.png"]}],
+        realized=realized,
+        files=["a.png", "b.png"],
+    )
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["role"] == "intermediate"
+    assert files["b.png"]["role"] == "final"
+
+
+def test_role_filter(client, output_root):
+    _write_run(
+        output_root,
+        "wf",
+        "20261012-000002-cccc",
+        [
+            {"step": "a", "files": ["a.png"], "role": "intermediate"},
+            {"step": "b", "files": ["final/b.png"], "role": "final"},
+        ],
+        files=["a.png", "final/b.png"],
+    )
+    finals = client.get("/api/gallery", params={"role": "final"}).json()["files"]
+    assert [f["label"] for f in finals] == ["b.png"]
+
+
+def test_flat_file_has_null_role_and_passes_final_filter(client, output_root):
+    os.makedirs(os.path.join(output_root, "loose"), exist_ok=True)
+    open(os.path.join(output_root, "loose", "x.png"), "wb").write(b"\x89PNG\r\n\x1a\n")
+    entries = client.get("/api/gallery", params={"role": "final"}).json()["files"]
+    loose = [f for f in entries if f["label"] == "x.png"]
+    assert loose and loose[0].get("role") is None
+
+
+def test_metadata_carries_role_and_inputs(client, output_root):
+    run_dir = _write_run(
+        output_root,
+        "wf",
+        "20261012-000003-dddd",
+        [{"step": "b", "files": ["b.png"], "role": "final"}],
+        files=["b.png"],
+    )
+    manifest_path = os.path.join(run_dir, "manifest.json")
+    manifest = json.load(open(manifest_path))
+    manifest["inputs"] = [{"reference": "asset:iris.png", "kind": "asset"}]
+    json.dump(manifest, open(manifest_path, "w"))
+    meta = client.get("/api/gallery/wf/20261012-000003-dddd/b.png/metadata").json()
+    assert meta["role"] == "final"
+    assert meta["inputs"] == [{"reference": "asset:iris.png", "kind": "asset"}]
+```
+
+Match the run-id format to `is_run_id` in `dw/runs.py`, and match the
+fixture names (`client`, `output_root`) to what `tests/test_server.py`
+already uses, renaming where needed. Add an MCP test in the existing MCP
+catalog test file (`grep -ln "list_gallery" tests/`) asserting that
+`role` appears in the compact projection and that `role=["final"]` is
+forwarded as a query parameter.
+
+- [ ] **Step 2: Run them to verify they fail**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_gallery_roles.py -v -n0`
+Expected: FAIL, because `role` is missing from the entries.
+
+- [ ] **Step 3: Implement `run_roles` and the listing**
+
+In `dw/server/routes/gallery.py`:
+
+```python
+from ...roles import ROLES, annotate_roles, entry_role
+from ...runs import _read_manifest  # already used nearby? reuse the existing import
+
+_ROLE_CACHE = {}
+_ROLE_CACHE_LIMIT = 512
+
+
+def _realized_steps(run_dir):
+    """The realized workflow's expanded steps, or None."""
+    path = os.path.join(run_dir, REALIZED_FILE_NAME)
+    try:
+        with open(path) as handle:
+            definition = json.load(handle)
+        return Workflow(definition, None, path).expanded_definition().get("steps") or []
+    except Exception:  # an unreadable or unexpandable record leaves roles unknown
+        return None
+
+
+def run_roles(run_dir):
+    """Each file of a run, relative to the run directory, mapped to its role."""
+    manifest_path = os.path.join(run_dir, MANIFEST_FILE_NAME)
+    try:
+        key = (run_dir, os.stat(manifest_path).st_mtime_ns)
+    except OSError:
+        return {}
+    if key in _ROLE_CACHE:
+        return _ROLE_CACHE[key]
+    manifest = _read_manifest(run_dir) or {}
+    steps = [e for e in manifest.get("steps") or [] if isinstance(e, dict)]
+    if steps and any(entry_role(e) is None for e in steps):
+        expanded = _realized_steps(run_dir)
+        if expanded is not None:
+            steps = annotate_roles(expanded, steps)
+    roles = {}
+    for entry in steps:
+        role = entry_role(entry)
+        if role:
+            for name in entry.get("files") or []:
+                roles[str(name).replace(os.sep, "/")] = role
+    if len(_ROLE_CACHE) >= _ROLE_CACHE_LIMIT:
+        _ROLE_CACHE.pop(next(iter(_ROLE_CACHE)))
+    _ROLE_CACHE[key] = roles
+    return roles
+```
+
+`Workflow` comes from `...workflow`. Check that
+`Workflow(definition, output_dir=None, file_spec=path)` constructs
+without touching the filesystem, as `dw/server/routes/library.py:303`
+does, and copy that call's arguments.
+
+In `_gallery_entries`, add `role` to each entry. Compute the run
+directory as `os.path.join(root, folder, run_id)` when `run_id` is set.
+The relative name inside it is `relative_name` with the
+`f"{folder}/{run_id}/"` prefix removed. Then:
+
+```python
+entry["role"] = (
+    run_roles(os.path.join(root, folder, run_id)).get(inner_name) if run_id else None
+)
+```
+
+Add a `role: list[str] | None = Query(None)` parameter to the gallery
+route. After building the entries, filter:
+
+```python
+    if role:
+        wanted = set(role)
+        files = [f for f in files if (f.get("role") or "final") in wanted]
+```
+
+Refuse any value outside `ROLES` with a 400.
+
+In `api_models.py`:
+- `GalleryFile` gains `role: Literal["final", "intermediate"] | None = sometimes("...")`;
+- add the `GalleryInput` model;
+- `GalleryMetadata` gains `role` and `inputs`.
+
+In `media.py`'s metadata route, for an output name (not `asset:`):
+- set `role` from `run_roles(run_dir).get(inner_name)`;
+- set `inputs` from the manifest's `inputs` when present.
+
+Reuse the route's existing run-directory resolution. It already finds
+the manifest for `job`, `shots` and so on.
+
+- [ ] **Step 4: MCP**
+
+In `dw_mcp/tools_catalog.py`, `list_gallery` gains:
+
+```python
+role: Annotated[
+    list[Literal["final", "intermediate"]] | None,
+    Field(
+        description="Only files of these roles. A deliverable is 'final', a file a later step consumed is 'intermediate'. Omit for every file - intermediates matter when diagnosing a run."
+    ),
+] = (None,)
+```
+
+Forward it as the repeated `role` query parameter in `dw_mcp/catalog.py`,
+and add `"role"` to the gallery compact projection tuple. Match the
+`Annotated` and `Field` style the neighbouring parameters use.
+
+- [ ] **Step 5: Regenerate the contract and run the tests**
+
+```bash
+venv/bin/python scripts/dump_openapi.py
+(cd ui && npm run gen:api)
+DW_DEVICE=cpu venv/bin/python -m pytest tests/test_gallery_roles.py tests/test_server.py tests/test_api_contract.py tests/test_ui_twins.py -q
+venv/bin/python scripts/surface_snapshot.py --check || venv/bin/python scripts/surface_snapshot.py
+```
+
+Expected: PASS. Run `scripts/surface_snapshot.py --help` first to learn
+its update flag, then update the snapshot.
+
+- [ ] **Step 6: Docs**
+
+`docs/SERVER.md`, gallery section:
+
+> Each entry carries `role`, `final` or `intermediate` (null for a flat-layout file with no run), and `GET /api/gallery?role=final` lists only those. See `dw/roles.py` for how a role is decided.
+
+`docs/MCP.md`, `list_gallery`: the same sentence, plus "the `role` filter
+defaults to every file".
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add dw/server/routes/gallery.py dw/server/routes/media.py dw/server/api_models.py dw_mcp/catalog.py dw_mcp/tools_catalog.py tests/test_gallery_roles.py ui/src/lib/generated/openapi.json ui/src/lib/generated/api-schema.ts docs/SERVER.md docs/MCP.md
+git commit -m "feat(roles): gallery entries and metadata carry role and inputs; role filter on the listing and list_gallery
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add the surface snapshot file and any MCP test file you touched, by
+name.
+
+### Task 4: UI roles
+
+**Files:**
+- Create: `ui/src/lib/gallery/RoleTag.svelte`
+- Modify: `ui/src/lib/pages/GalleryPage.svelte`:
+  - the `subfolder` state at line 22 is replaced by role chips;
+  - the `subfolders` derivation at line 53 is removed from the top bar.
+- Modify: the gallery tile component. `grep -n "label" ui/src/lib/pages/GalleryPage.svelte`
+  finds where tiles render. Add the `RoleTag` ahead of the label.
+- Modify: `ui/src/lib/gallery/GalleryDetail.svelte`, the meta block at
+  lines 173-225. The order becomes role tag, (the note slot comes in
+  Task 8), Settings collapsed, Made from, and Location last.
+- Modify: `ui/src/lib/pages/JobPage.svelte`. Group results as Final
+  (expanded), then Intermediate (collapsed when there are finals), then
+  Made from.
+- Modify: `ui/src/lib/assets/AssetDetail.svelte`. Add a "kept from
+  <workflow> v<n>" line when the metadata's `job` or provenance is
+  present.
+- Modify: `ui/src/lib/api.ts`. `gallery()` gains an optional
+  `roles?: string[]` that it serializes as repeated `role` parameters.
+- Test: `ui/src/lib/gallery/RoleTag.test.ts`, `ui/src/lib/pages/GalleryPage.test.ts`
+  (extend it if it exists, otherwise create it), and `ui/src/lib/pages/JobPage.test.ts`
+  (extend it).
+
+**Interfaces:**
+- Consumes: `GalleryFile.role`, `GalleryMetadata.role` and
+  `GalleryMetadata.inputs`, from the regenerated `api-schema.ts`, through
+  `types.ts` re-exports. Add the re-exports for `GalleryInput`.
+- Produces: `RoleTag` with props `{ role: 'final' | 'intermediate' | 'input' | null }`.
+  It renders nothing for null. Task 8 places notes next to it.
+
+- [ ] **Step 1: Write the failing component test**
+
+```ts
+// ui/src/lib/gallery/RoleTag.test.ts
+import { render, screen } from '@testing-library/svelte'
+import { describe, expect, it } from 'vitest'
+import RoleTag from './RoleTag.svelte'
+
+describe('RoleTag', () => {
+  it.each([
+    ['final', 'Final'],
+    ['intermediate', 'Intermediate'],
+    ['input', 'Input'],
+  ])('renders %s', (role, text) => {
+    render(RoleTag, { role })
+    const tag = screen.getByText(text)
+    expect(tag.dataset.role).toBe(role)
+  })
+
+  it('renders nothing for a null role', () => {
+    const { container } = render(RoleTag, { role: null })
+    expect(container.textContent?.trim()).toBe('')
+  })
+})
+```
+
+Check the existing component tests for the render helper this repo uses
+(`grep -rln "@testing-library/svelte" ui/src | head -3`), and match their
+imports.
+
+- [ ] **Step 2: Run it to verify it fails**
+
+Run: `cd ui && npx vitest run src/lib/gallery/RoleTag.test.ts`
+Expected: FAIL, because the module is not found.
+
+- [ ] **Step 3: Implement `RoleTag.svelte`**
+
+```svelte
+<script lang="ts">
+  let { role }: { role: 'final' | 'intermediate' | 'input' | null | undefined } = $props()
+  const text = { final: 'Final', intermediate: 'Intermediate', input: 'Input' }
+</script>
+
+{#if role}
+  <span class="role-tag" data-role={role}>{text[role]}</span>
+{/if}
+
+<style>
+  .role-tag {
+    display: inline-block;
+    padding: 0.05rem 0.4rem;
+    border-radius: 999px;
+    font-size: 0.7rem;
+    font-weight: 600;
+    line-height: 1.4;
+    white-space: nowrap;
+  }
+  .role-tag[data-role='final'] {
+    background: var(--accent);
+    color: var(--accent-contrast, #fff);
+  }
+  .role-tag[data-role='intermediate'] {
+    background: var(--surface-2);
+    color: var(--text-muted);
+  }
+  .role-tag[data-role='input'] {
+    background: transparent;
+    color: var(--text-muted);
+    border: 1px solid var(--border);
+  }
+</style>
+```
+
+Use the colour tokens `ui/src/app.css` actually defines. Grep it for the
+accent, muted-text, surface and border variable names, and substitute
+them for the ones above.
+
+- [ ] **Step 4: Gallery page tests, then implementation**
+
+Add these tests to the GalleryPage test, mocking `api.gallery` the way
+existing page tests mock api calls:
+
+```ts
+it('opens on finals only and shows each tile role', async () => {
+  // mock gallery() to return one final and one intermediate entry
+  // render GalleryPage; expect the Final chip pressed, Intermediate not
+  // expect only the final tile rendered, carrying a RoleTag "Final"
+})
+
+it('toggling Intermediate shows intermediates too', async () => {
+  // click the Intermediate chip; expect both tiles
+})
+
+it('has no subfolder filter in the top bar', async () => {
+  // expect no element with the subfolder filter's label/test id
+})
+```
+
+Write these out as real assertions against the mock data, following the
+nearest existing page test for its mocking and querying idiom.
+
+Implementation in `GalleryPage.svelte`:
+
+```ts
+let roles = $state<Set<'final' | 'intermediate'>>(new Set(['final']))
+const visible = $derived(
+  files.filter((f) => roles.has((f.role ?? 'final') as 'final' | 'intermediate')),
+)
+function toggleRole(role: 'final' | 'intermediate') {
+  const next = new Set(roles)
+  next.has(role) ? next.delete(role) : next.add(role)
+  roles = next.size ? next : new Set([role === 'final' ? 'intermediate' : 'final'])
+}
+```
+
+The chips are two `<button aria-pressed={roles.has(r)}>` elements in the
+top bar beside the workflow filter. Filter on the client: the listing is
+already fully loaded, so this needs no extra fetch. The `role` parameter
+on `api.gallery` is for MCP parity and future paging. Inside a run, sort
+finals before intermediates and keep the existing mtime order within
+each. Remove the subfolder `<select>`, and its `subfolder` state, from
+the top bar.
+
+- [ ] **Step 5: Detail panel, job page and asset detail**
+
+In `GalleryDetail.svelte`, put `<RoleTag role={meta.role} />` at the top
+of the meta block. Then:
+- a `<details><summary>Settings</summary>` holding the run's arguments
+  and seed, which the existing metadata already carries, so move that
+  block inside;
+- "Made from": `meta.inputs`, each rendered as a link that opens the
+  asset or output detail the way the existing reference links do;
+- a small "Location" line showing the file's folder path.
+
+In `JobPage.svelte`, group the result files by `role`, from the gallery
+entries or the job manifest's step `role`, into three sections:
+- Final first and expanded;
+- Intermediate collapsed, using `<details>` with `open={finals.length === 0}`;
+- Made from, from the job's run inputs. Read them from
+  `galleryMetadata` of any one output, or from the manifest when the job
+  detail carries it.
+
+A test covers the grouping order and the collapsed intermediate section.
+
+In `AssetDetail.svelte`, when the asset metadata carries `job` (the
+`JobRef` that `keep_output` provenance fills in), render
+`kept from {job.workflow} v{job.version}`. Use whichever fields `JobRef`
+has: read `api_models.py:825`.
+
+- [ ] **Step 6: Run the UI checks**
+
+```bash
+cd ui && npx vitest run && npm run lint && npm run check && npm run metrics -- --check ../docs/stabilization/ui/baseline.json
+```
+
+Expected: all pass. If `complex_functions` rises, split the function.
+Don't raise the baseline.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add ui/src/lib/gallery/RoleTag.svelte ui/src/lib/gallery/RoleTag.test.ts ui/src/lib/pages/GalleryPage.svelte ui/src/lib/gallery/GalleryDetail.svelte ui/src/lib/pages/JobPage.svelte ui/src/lib/assets/AssetDetail.svelte ui/src/lib/api.ts ui/src/lib/types.ts
+git commit -m "feat(ui): roles lead the gallery - role chips, tile tags, grouped job results, made-from list
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add the page test files you created or extended, by name.
+
+---
+
+## Stage 2: Notes
+
+### Task 5: `dw/notes.py` stores and bookkeeping
+
+**Files:**
+- Create: `dw/notes.py`
+- Modify: `dw/runs.py`. Extract a `write_json_atomic(path, data)` from
+  `write_manifest` (line 683) so that both use it, with no duplicate
+  block.
+- Modify: `dw/server/routes/gallery.py`:
+  - `RUN_BOOKKEEPING_FILES` at line 54 gains `NOTES_FILE_NAME`;
+  - `RUN_SIDECARS` at line 277 gains it;
+  - single-output delete at line 351 drops that file's note entry.
+- Modify: `dw/server/outputs.py`. If it holds its own bookkeeping set,
+  add `NOTES_FILE_NAME` there too (grep `RUN_BOOKKEEPING`).
+- Modify: `dw/server/exports.py`, lines 235-255. Copy `notes.json` beside
+  the manifest when present.
+- Modify: `dw/workspace.py`. `_foreign_entries` (line 374) tolerates
+  `WORKSPACE_FILE_NAME`.
+- Modify: `docs/superpowers/specs/2026-10-12-roles-and-notes-design.md`.
+  Change the asset row in the Stores table to "the asset directory's
+  `notes.json` (`{"files": {name: note}}`)" and its reason to
+  "`record_kept_shots` deletes its sidecar with the last entry".
+- Modify: `docs/ARCHITECTURE.md`. Add one row for notes.
+- Test: `tests/test_notes.py`
+
+**Interfaces:**
+- Produces, from `dw/notes.py`:
+  - `NOTES_FILE_NAME = "notes.json"`, `WORKSPACE_FILE_NAME = "workspace.json"`,
+    `MAX_NOTE_LENGTH = 4000`
+  - `class NoteTooLong(ValueError)`
+  - `clean_note(note: str | None) -> str | None`. It returns None for
+    None, an empty string or whitespace only. It raises `NoteTooLong`
+    above the limit, and `TypeError` for a non-string.
+  - `read_notes(directory: str) -> dict`, always `{"run": str | None, "files": dict[str, str]}`.
+    A missing or corrupt file gives empties.
+  - `set_run_note(directory: str, note: str | None) -> str | None`. It
+    returns the stored, cleaned value.
+  - `set_file_note(directory: str, name: str, note: str | None) -> str | None`.
+    `name` is relative to `directory` and `/`-separated.
+  - `drop_file_note(directory: str, name: str) -> None`
+  - `effective_note(notes: dict, name: str) -> tuple[str | None, str | None]`
+    returns `(note, "file" | "run" | None)`.
+  - `read_workspace_note(root: str) -> str | None`
+  - `set_workspace_note(root: str, note: str | None) -> str | None`
+
+  A write that leaves no notes removes the file. Writes go through
+  `dw.runs.write_json_atomic`, under a per-directory `threading.Lock`.
+  Callers have already validated `directory` and `root`; this module
+  joins only fixed file names onto them.
+- Produces, from `dw/runs.py`: `write_json_atomic(path: str, data) -> None`.
+  It raises `OSError`. `write_manifest` keeps its never-fatal wrapper
+  around it.
+
+- [ ] **Step 1: Write the failing tests**
+
+```python
+# tests/test_notes.py
+import json, os, threading
+import pytest
+from dw import notes as N
+
+
+def test_clean_note_rules():
+    assert N.clean_note(None) is None
+    assert N.clean_note("   \n") is None
+    assert N.clean_note("shift 5") == "shift 5"
+    assert N.clean_note("x" * N.MAX_NOTE_LENGTH) == "x" * N.MAX_NOTE_LENGTH
+    with pytest.raises(N.NoteTooLong):
+        N.clean_note("x" * (N.MAX_NOTE_LENGTH + 1))
+    with pytest.raises(TypeError):
+        N.clean_note(5)
+
+
+def test_run_and_file_notes_and_effective(tmp_path):
+    d = str(tmp_path)
+    assert N.read_notes(d) == {"run": None, "files": {}}
+    N.set_run_note(d, "testing shift 3 vs 5")
+    N.set_file_note(d, "final/b.png", "the keeper")
+    notes = N.read_notes(d)
+    assert N.effective_note(notes, "final/b.png") == ("the keeper", "file")
+    assert N.effective_note(notes, "a.png") == ("testing shift 3 vs 5", "run")
+    assert N.effective_note({"run": None, "files": {}}, "a.png") == (None, None)
+
+
+def test_clearing_everything_removes_the_file(tmp_path):
+    d = str(tmp_path)
+    N.set_run_note(d, "x")
+    N.set_file_note(d, "a.png", "y")
+    N.set_run_note(d, "")
+    N.drop_file_note(d, "a.png")
+    assert not os.path.exists(os.path.join(d, N.NOTES_FILE_NAME))
+
+
+def test_corrupt_file_reads_empty(tmp_path):
+    (tmp_path / N.NOTES_FILE_NAME).write_text("{not json")
+    assert N.read_notes(str(tmp_path)) == {"run": None, "files": {}}
+
+
+def test_concurrent_file_notes_all_land(tmp_path):
+    d = str(tmp_path)
+    threads = [
+        threading.Thread(target=N.set_file_note, args=(d, f"{i}.png", str(i)))
+        for i in range(20)
+    ]
+    [t.start() for t in threads]
+    [t.join() for t in threads]
+    assert len(N.read_notes(d)["files"]) == 20
+
+
+def test_workspace_note(tmp_path):
+    root = str(tmp_path)
+    assert N.read_workspace_note(root) is None
+    N.set_workspace_note(root, "the anthem project")
+    assert N.read_workspace_note(root) == "the anthem project"
+    assert json.load(open(tmp_path / N.WORKSPACE_FILE_NAME)) == {
+        "notes": "the anthem project"
+    }
+    N.set_workspace_note(root, None)
+    assert not os.path.exists(tmp_path / N.WORKSPACE_FILE_NAME)
+
+
+def test_workspace_with_note_is_deletable(tmp_path):
+    from dw.workspace import create_workspace, delete_workspace
+    # follow tests/test_workspace*.py for how a root and a named workspace are set up,
+    # then: set_workspace_note(ws.root, "x"); delete_workspace(...) succeeds
+```
+
+Complete the last test against the real `create_workspace` and
+`delete_workspace` signatures, copying the setup from the existing
+workspace tests.
+
+Add bookkeeping tests to `tests/test_server.py`, or to a new
+`tests/test_notes_bookkeeping.py`, using that file's fixtures:
+
+```python
+def test_run_with_only_notes_is_pruned_and_orphan(client, output_root):
+    # write a run (manifest + one output + notes.json with a run note);
+    # DELETE /api/gallery/<that output>; assert the run directory is gone.
+    # Then write a run holding only manifest.json + notes.json and assert
+    # it is listed by the orphan listing (grep the route _orphan_entries feeds).
+
+
+def test_single_output_delete_drops_its_note(client, output_root):
+    # run with two outputs, file notes on both; delete one; read_notes keeps only the other
+
+
+def test_export_carries_notes(client, ...):
+    # follow the existing export test; assert notes.json is in the zip
+```
+
+Write these as full tests by copying the nearest existing delete, orphan
+and export test bodies.
+
+- [ ] **Step 2: Run them to verify they fail**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_notes.py -v -n0`
+Expected: FAIL with `No module named 'dw.notes'`.
+
+- [ ] **Step 3: Extract `write_json_atomic` in `dw/runs.py`**
+
+```python
+def write_json_atomic(path, data):
+    """Write `data` as JSON to `path` by a temp file and a rename, so a
+    reader never sees half a file. Raises OSError."""
+    directory = os.path.dirname(path)
+    os.makedirs(directory, exist_ok=True)
+    fd, tmp_path = tempfile.mkstemp(dir=directory, prefix=f".{os.path.basename(path)}-")
+    try:
+        with os.fdopen(fd, "w") as file:
+            json.dump(data, file, indent=2, default=str)
+        os.replace(tmp_path, path)
+    except OSError:
+        os.unlink(tmp_path)
+        raise
+
+
+def write_manifest(run_dir, manifest):
+    """...(docstring unchanged)..."""
+    path = os.path.join(run_dir, MANIFEST_FILE_NAME)
+    try:
+        write_json_atomic(path, manifest)
+    except OSError as e:
+        logger.warning(f"Could not write {path}: {e}")
+        return None
+    return path
+```
+
+- [ ] **Step 4: Write `dw/notes.py`**
+
+```python
+"""Notes: optional plain text a person or an agent leaves on a run, on a
+file, on an asset or on a workspace, saying what it is for.
+
+Two stores, both sidecars the media listings never show (.json is not a
+media kind):
+
+- `notes.json` in a directory - a run directory or an asset-library
+  directory - holding `{"run": ..., "files": {<name relative to the
+  directory>: ...}}`. A file's effective note is its own, else the run's.
+  The engine rewrites manifest.json throughout a run, so notes live apart
+  from it and only the server writes them.
+- `workspace.json` at a workspace root, holding `{"notes": ...}`.
+
+Callers resolve and validate the directory; this module joins only its
+own fixed file names onto it. A write that leaves nothing removes the file.
+"""
+
+import json
+import os
+import threading
+
+from .runs import write_json_atomic
+
+NOTES_FILE_NAME = "notes.json"
+WORKSPACE_FILE_NAME = "workspace.json"
+MAX_NOTE_LENGTH = 4000
+
+_locks = {}
+_locks_guard = threading.Lock()
+
+
+class NoteTooLong(ValueError):
+    pass
+
+
+def clean_note(note):
+    """The note as stored: None for nothing, else the text, length-checked."""
+    if note is None:
+        return None
+    if not isinstance(note, str):
+        raise TypeError(f"a note is text, not {type(note).__name__}")
+    if not note.strip():
+        return None
+    if len(note) > MAX_NOTE_LENGTH:
+        raise NoteTooLong(
+            f"a note is at most {MAX_NOTE_LENGTH} characters, got {len(note)}"
+        )
+    return note
+
+
+def _lock(directory):
+    key = os.path.realpath(directory)
+    with _locks_guard:
+        return _locks.setdefault(key, threading.Lock())
+
+
+def _read_json(path):
+    try:
+        with open(path) as handle:
+            data = json.load(handle)
+    except (OSError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def read_notes(directory):
+    data = _read_json(os.path.join(directory, NOTES_FILE_NAME))
+    run = data.get("run") if isinstance(data.get("run"), str) else None
+    files = data.get("files") if isinstance(data.get("files"), dict) else {}
+    files = {
+        k: v for k, v in files.items() if isinstance(k, str) and isinstance(v, str)
+    }
+    return {"run": run, "files": files}
+
+
+def _store(directory, notes):
+    path = os.path.join(directory, NOTES_FILE_NAME)
+    if notes["run"] is None and not notes["files"]:
+        try:
+            os.remove(path)
+        except FileNotFoundError:
+            pass
+        return
+    write_json_atomic(path, {k: v for k, v in notes.items() if v})
+
+
+def _update(directory, change):
+    with _lock(directory):
+        notes = read_notes(directory)
+        change(notes)
+        _store(directory, notes)
+
+
+def set_run_note(directory, note):
+    note = clean_note(note)
+    _update(directory, lambda notes: notes.__setitem__("run", note))
+    return note
+
+
+def set_file_note(directory, name, note):
+    note = clean_note(note)
+
+    def change(notes):
+        if note is None:
+            notes["files"].pop(name, None)
+        else:
+            notes["files"][name] = note
+
+    _update(directory, change)
+    return note
+
+
+def drop_file_note(directory, name):
+    if os.path.exists(os.path.join(directory, NOTES_FILE_NAME)):
+        set_file_note(directory, name, None)
+
+
+def effective_note(notes, name):
+    own = notes["files"].get(name)
+    if own:
+        return own, "file"
+    if notes["run"]:
+        return notes["run"], "run"
+    return None, None
+
+
+def read_workspace_note(root):
+    note = _read_json(os.path.join(root, WORKSPACE_FILE_NAME)).get("notes")
+    return note if isinstance(note, str) and note.strip() else None
+
+
+def set_workspace_note(root, note):
+    note = clean_note(note)
+    path = os.path.join(root, WORKSPACE_FILE_NAME)
+    with _lock(root):
+        if note is None:
+            try:
+                os.remove(path)
+            except FileNotFoundError:
+                pass
+        else:
+            write_json_atomic(path, {"notes": note})
+    return note
+```
+
+- [ ] **Step 5: Bookkeeping**
+
+1. `gallery.py`: add `from ...notes import NOTES_FILE_NAME, drop_file_note`.
+   Add `NOTES_FILE_NAME` to `RUN_BOOKKEEPING_FILES` and to `RUN_SIDECARS`.
+   In the single-file delete branch, after the file is removed and
+   before `_prune_empty_run_directory`, call
+   `drop_file_note(run_dir, inner_name)`. Here `run_dir` and `inner_name`
+   are the run directory and the file's name relative to it. Derive them
+   as Task 3's `_gallery_entries` change does, and factor a shared
+   `_split_run_name(root, name) -> (run_dir, inner) | None` helper rather
+   than writing the split twice.
+2. `exports.py`: where the manifest is added to the zip, add `notes.json`
+   the same way when it exists.
+3. `workspace.py`: in `_foreign_entries`, add `WORKSPACE_FILE_NAME` to the
+   names it tolerates. Import it from `.notes`, and check that `dw.notes`
+   doesn't import `dw.workspace`, which would make an import cycle.
+4. `docs/ARCHITECTURE.md` row:
+   `| Notes on runs, files, assets, workspaces | dw/notes.py | notes.json beside what it describes (run dir or asset dir; a file's own note else the run's), workspace.json at a workspace root; only the server writes them, never the engine; ≤4000 chars, plain text. | tests/test_notes.py |`
+5. Update the spec's Stores table as described under **Files**.
+
+- [ ] **Step 6: Run the tests, the ratchet and lint**
+
+```bash
+DW_DEVICE=cpu venv/bin/python -m pytest tests/test_notes.py tests/test_notes_bookkeeping.py tests/test_server.py tests/test_workspace*.py -q
+venv/bin/python scripts/arch_metrics.py --check docs/stabilization/baseline.json
+venv/bin/ruff check dw tests && venv/bin/ruff format --check dw tests
+```
+
+Expected: PASS, with modules now at 210.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add dw/notes.py dw/runs.py dw/server/routes/gallery.py dw/server/exports.py dw/workspace.py tests/test_notes.py tests/test_notes_bookkeeping.py docs/ARCHITECTURE.md docs/superpowers/specs/2026-10-12-roles-and-notes-design.md
+git commit -m "feat(notes): notes.json and workspace.json stores, kept in step with prune, delete and export
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add `dw/server/outputs.py` if you changed it.
+
+### Task 6: Server API for notes
+
+**Files:**
+- Modify: `dw/server/api_models.py`:
+  - `GalleryFile` gains `note`;
+  - `GalleryMetadata` gains `note`, `run_note` and `note_source`;
+  - `AssetFile` gains `note`;
+  - `WorkspaceInfo` gains `note`;
+  - `JobSummary` and `JobDetail` gain `note`;
+  - new `NoteRequest` and `NoteSet` models.
+- Modify: `dw/server/admission.py`. `JobRequest` (line 383) gains
+  `note: Optional[str]`. It is validated with `clean_note` at admission,
+  with 400 on `NoteTooLong`, and put into the job spec as `spec["note"]`.
+- Modify: `dw/server/job_record.py`:
+  - `RERUN_SPEC_KEYS` gains `"note"`;
+  - `Job.__init__` sets `self.note = spec.get("note")`.
+- Modify: `dw/server/job_history.py`:
+  - add the column with `ALTER TABLE jobs ADD COLUMN note TEXT`, in the
+    same pattern as `acknowledged`;
+  - write it on save (around line 165);
+  - read it in both row readers (around lines 212 and 255), and map it
+    into the summary and detail dicts.
+- Modify: `dw/server/job_results.py`. In `record_progress`, on
+  `run_start`, when `job.note` is set, write it as the run note.
+- Modify: `dw/server/routes/media.py`:
+  - add `PUT /api/notes`;
+  - the metadata route gains the note fields.
+- Modify: `dw/server/routes/gallery.py`. `_gallery_entries` adds the
+  effective `note`, reading `read_notes(run_dir)` once per run directory
+  per listing.
+- Modify: `dw/server/routes/assets.py`:
+  - `upload_media` gains `note: Optional[str] = None` (a query parameter,
+    like `asset_name`);
+  - `KeepRequest` gains `note`;
+  - keep falls back to the source file's effective note;
+  - asset `summary()` (lines 262-287) adds `note`;
+  - asset delete (line 470) calls `drop_file_note` and
+    `record_kept_shots(directory, name, None, None)`.
+- Modify: `dw/server/routes/library.py`. The workspace list (line 91)
+  adds `note` via `read_workspace_note(ws.root)`.
+- Modify: `ui/src/lib/generated/openapi.json` and `api-schema.ts`,
+  regenerated.
+- Modify: `tests/test_api_contract.py`. Add `PUT /api/notes` to
+  `UI_READ_ROUTES`, or to whichever list covers write routes the UI
+  calls. Read the file to see which list fits.
+- Modify: `docs/SERVER.md`. Document the route and the fields.
+- Test: `tests/test_notes_api.py`
+
+**Interfaces:**
+- Consumes: everything Task 5 produces.
+- Produces:
+  - `PUT /api/notes`, with body `NoteRequest{target: str, note: str | None}`,
+    returning `NoteSet{target: str, note: str | None, note_source: Literal["file","run"] | None}`.
+  - Target forms:
+    - `workspace:<name>` targets `named_workspace(...).root`, or the
+      configured root for `default`;
+    - `asset:<path>` targets the asset directory's `notes.json`, keyed by
+      basename. Resolve it with `validate_asset_reference` plus the
+      library directory, exactly as asset delete does;
+    - `<identity>/<run_id>` is a run directory: a path whose last segment
+      satisfies `is_run_id` and which is a directory under the output
+      root. It sets the run note;
+    - anything else is a gallery file name, resolved with
+      `resolve_output_file`, which is the delete route's resolver. It
+      sets the file note in its run directory. A flat-layout file, with
+      no run directory, answers 409 with "notes need a run directory".
+  - The status codes:
+    - an unknown target gives 404;
+    - traversal or an invalid name gives 400;
+    - a note over 4000 characters gives 400;
+    - a write failure gives 500.
+  - `JobSummary.note` and `JobDetail.note`, as `sometimes()`.
+  - `GalleryMetadata.note`, `run_note` and `note_source`.
+
+- [ ] **Step 1: Write the failing tests**
+
+```python
+# tests/test_notes_api.py - use tests/test_server.py's client/output_root/asset fixtures
+import json, os
+import pytest
+from dw import notes as N
+
+
+def test_put_file_and_run_note_and_read_back(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png", "final/b.png"])  # helper: manifest + files, returns run dir
+    run = os.path.relpath(run_dir, output_root).replace(os.sep, "/")
+    r = client.put("/api/notes", json={"target": run, "note": "shift 3 vs 5"})
+    assert r.status_code == 200 and r.json()["note_source"] == "run"
+    r = client.put("/api/notes", json={"target": f"{run}/final/b.png", "note": "keeper"})
+    assert r.json() == {"target": f"{run}/final/b.png", "note": "keeper", "note_source": "file"}
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["note"] == "shift 3 vs 5"
+    assert files["b.png"]["note"] == "keeper"
+    meta = client.get(f"/api/gallery/{run}/final/b.png/metadata").json()
+    assert (meta["note"], meta["run_note"], meta["note_source"]) == ("keeper", "shift 3 vs 5", "file")
+
+
+def test_clear_note(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png"])
+    run = os.path.relpath(run_dir, output_root).replace(os.sep, "/")
+    client.put("/api/notes", json={"target": run, "note": "x"})
+    r = client.put("/api/notes", json={"target": run, "note": ""})
+    assert r.json()["note"] is None
+    assert not os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+
+
+@pytest.mark.parametrize("target", [
+    "../etc/passwd", "wf/../../x", "/abs/path.png", "asset:../x.png",
+    "workspace:../other", "workspace:nope", "wf/20261012-000000-zzzz/missing.png",
+])
+def test_put_note_refuses_traversal_targets(client, target):
+    r = client.put("/api/notes", json={"target": target, "note": "x"})
+    assert r.status_code in (400, 404)
+
+
+def test_note_too_long(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png"])
+    run = os.path.relpath(run_dir, output_root).replace(os.sep, "/")
+    r = client.put("/api/notes", json={"target": run, "note": "x" * 4001})
+    assert r.status_code == 400
+
+
+def test_workspace_note(client):
+    r = client.put("/api/notes", json={"target": "workspace:default", "note": "anthem"})
+    assert r.status_code == 200
+    ws = {w["name"]: w for w in client.get("/api/workspaces").json()["workspaces"]}
+    assert ws["default"]["note"] == "anthem"
+
+
+def test_asset_note_upload_keep_and_delete(client, output_root, make_run):
+    up = client.post("/api/uploads", params={"filename": "iris.png", "note": "cast: iris"},
+                     content=b"\x89PNG\r\n\x1a\n" + b"0" * 64)
+    ref = up.json()["reference"]
+    assets = {a["name"]: a for a in client.get("/api/assets").json()["files"]}
+    # find the entry for ref; assert its note == "cast: iris"
+
+
+def test_keep_copies_effective_note(client, output_root, make_run):
+    # make_run + run note; POST /api/assets/keep without note; asset note == run note
+
+
+def test_deleted_asset_leaves_no_note_or_provenance(client, output_root, make_run):
+    # keep a file with a note under asset_name 'x.png' (provenance written);
+    # DELETE /api/assets/x.png; upload a new x.png with no note;
+    # assert its asset entry has no note and its metadata has no job/provenance
+
+
+def test_job_note_reaches_history_run_and_rerun(client, ...):
+    # submit a tiny workflow with note="testing"; wait for it the way the
+    # existing job tests do; assert GET /api/jobs/{id} note == "testing",
+    # the run directory's notes.json run note == "testing", and a rerun's
+    # job carries note "testing"
+
+
+def test_note_set_during_run_survives_manifest_rewrite(tmp_path):
+    from dw.runs import write_manifest
+    d = str(tmp_path)
+    write_manifest(d, {"status": "running", "steps": []})
+    N.set_run_note(d, "mid-run")
+    write_manifest(d, {"status": "succeeded", "steps": []})
+    assert N.read_notes(d)["run"] == "mid-run"
+```
+
+Write the placeholder-comment tests in full, using the fixtures and job
+helpers `tests/test_server.py` and the job tests already use (for example
+`grep -n "def test_rerun" tests/*.py`). If `make_run` doesn't exist, add
+it as a fixture in this file, built on Task 3's `_write_run` helper.
+
+- [ ] **Step 2: Run them to verify they fail**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest tests/test_notes_api.py -v -n0`
+Expected: FAIL with 404 or 405 on `/api/notes`.
+
+- [ ] **Step 3: Implement the route**
+
+In `dw/server/routes/media.py`:
+
+```python
+class NoteRequest(
+    BaseModel
+):  # or define in api_models.py next to the response, per file convention
+    target: str
+    note: Optional[str] = None
+
+
+@router.put("/api/notes", response_model=NoteSet, response_model_exclude_unset=True)
+def put_note(
+    request: Request, body: NoteRequest, ws: Workspace = Depends(selected_workspace)
+):
+    """Set or clear the note on a run, a file, an asset or a workspace."""
+    try:
+        note = clean_note(body.note)
+    except (NoteTooLong, TypeError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    directory, name, kind = resolve_note_target(request.app.state, ws, body.target)
+    # resolve_note_target raises HTTPException 400/404/409 as listed above
+    try:
+        if kind == "workspace":
+            stored, source = set_workspace_note(directory, note), None
+        elif kind == "run":
+            stored, source = set_run_note(directory, note), "run"
+        else:
+            set_file_note(directory, name, note)
+            stored, source = effective_note(read_notes(directory), name)
+    except OSError as e:
+        raise HTTPException(status_code=500, detail=f"Could not write the note: {e}")
+    return {
+        "target": body.target,
+        "note": stored,
+        "note_source": source if stored else None,
+    }
+```
+
+Write `resolve_note_target(state, ws, target) -> (directory, name, kind)`
+in the same file. It dispatches on the four target forms, reusing:
+- `ref_name(WORKSPACE?...)`. There is no `workspace:` prefix in
+  `dw/references.py`, and only that module may spell prefixes
+  (`prefix_literals` ratchet). So add
+  `WORKSPACE = "workspace:"` to `dw/references.py`, next to `ASSET`, with
+  a one-line comment that it addresses a note target, and add it to
+  `FALLBACK_REFERENCE_NAMES` in `scripts/arch_metrics.py` only if
+  `tests/test_arch_metrics.py` requires it. Use `is_ref` and `ref_name`
+  everywhere;
+- `named_workspace` from `dw/workspace.py` for named workspaces, and the
+  default workspace's root for `default`;
+- `validate_asset_reference` and `writable_asset_directory` from
+  `routes/assets.py`, as the asset delete route resolves names;
+- `resolve_output_file` from `dw/server/outputs.py` for a file;
+- for a run directory, `validate_path(candidate, output_root)` with a
+  non-None root, then `os.path.isdir` and `is_run_id(basename)`.
+
+Every directory returned has passed a validator against a non-None root.
+For a file, find its run directory with the `_split_run_name` helper from
+Task 5.
+
+- [ ] **Step 4: Note fields on the readers**
+
+- `_gallery_entries`: keep a `notes_by_run = {}` cache per listing, and
+  set `entry["note"] = effective_note(notes, inner)[0]` when there is a
+  run.
+- Metadata route: `note`, `note_source` and `run_note`, from
+  `read_notes(run_dir)`. For an `asset:` name, read its directory's
+  `notes.json` with the basename.
+- Assets `summary()`: `note` from the entry's directory's `notes.json`.
+  Cache it per directory within one listing.
+- Workspace list: `note`.
+- Jobs: the `note` column goes into `JobSummary` and `JobDetail`.
+- `record_progress` on `run_start`:
+
+```python
+        if getattr(job, "note", None) and job.run_dir:
+            try:
+                set_run_note(os.path.join(output_dir, job.run_dir), job.note)
+            except OSError as e:
+                logger.warning(f"Could not write the run note for job {job.id}: {e}")
+```
+
+  `output_dir` is the parameter `record_progress` already receives. Check
+  the `job.id` attribute name in `job_record.py`.
+- Upload: `note` is cleaned (400 on `NoteTooLong`). After the file is
+  written, `set_file_note(os.path.dirname(dest), os.path.basename(dest), note)`.
+- Keep: `body.note` if it is set, else the source's effective note,
+  looked up from the source's run directory. Write it beside the kept
+  file the same way.
+- Asset delete: after `os.remove`, call `drop_file_note(directory, basename)`
+  and `record_kept_shots(directory, basename, None, None)`.
+
+- [ ] **Step 5: Regenerate and run**
+
+```bash
+venv/bin/python scripts/dump_openapi.py && (cd ui && npm run gen:api)
+DW_DEVICE=cpu venv/bin/python -m pytest tests/test_notes_api.py tests/test_server.py tests/test_api_contract.py tests/test_ui_twins.py tests/test_arch_metrics.py -q
+venv/bin/python scripts/arch_metrics.py --check docs/stabilization/baseline.json
+```
+
+Expected: PASS.
+
+- [ ] **Step 6: Docs**
+
+In `docs/SERVER.md`, add a "Notes" subsection covering:
+- the route;
+- the four target forms;
+- the 4,000-character limit;
+- that clearing is `null` or `""`;
+- the effective-note rule;
+- `note` on job submission, upload and keep.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add dw/server/api_models.py dw/server/admission.py dw/server/job_record.py dw/server/job_history.py dw/server/job_results.py dw/server/routes/media.py dw/server/routes/gallery.py dw/server/routes/assets.py dw/server/routes/library.py dw/references.py tests/test_notes_api.py tests/test_api_contract.py ui/src/lib/generated/openapi.json ui/src/lib/generated/api-schema.ts docs/SERVER.md
+git commit -m "feat(notes): PUT /api/notes, note on jobs, uploads and keeps, and on every listing
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add `scripts/arch_metrics.py` if you touched it.
+
+### Task 7: MCP for notes
+
+**Files:**
+- Modify: `dw_mcp/tools_media.py`:
+  - `upload_asset` (line 312) and `keep_output` (line 355) gain `note`;
+  - a new `set_note` tool goes here, beside the other asset and output
+    write tools.
+- Modify: `dw_mcp/assets.py`. Forward `note`, and add a `set_note` helper
+  calling `PUT /api/notes`. Add `note` to `ASSET_SUMMARY_FIELDS` (line
+  134), clipped.
+- Modify: `dw_mcp/tools_jobs.py` and `dw_mcp/diagnose.py`.
+  `run_workflow` gains `note`, which is forwarded in the job body.
+  `get_job` returns `note` in full, and `list_jobs`'s compact entries
+  carry it clipped.
+- Modify: `dw_mcp/workspaces.py`. `WORKSPACE_SUMMARY_FIELDS` (line 21)
+  gains `note`, clipped.
+- Modify: `dw_mcp/catalog.py`. The gallery compact projection gains
+  `note`, clipped. `get_gallery_metadata` returns the full note.
+- Modify: the MCP server instructions string. Find it with
+  `grep -rn "Start from \`list_workflows" dw_mcp`, and add the agent
+  guidance sentence.
+- Modify: `docs/WORKFLOW_GUIDE.md`, *Authoring a workflow from an agent*
+  section, and `docs/MCP.md`.
+- Modify: the surface snapshot, regenerated.
+- Test: extend the existing MCP test files for these tools (find them with
+  `grep -ln "keep_output\|run_workflow" tests/test_mcp*.py`).
+
+**Interfaces:**
+- Consumes: Task 6's routes and fields.
+- Produces:
+  - `set_note(target: str, note: str | None) -> dict`, returning the
+    route's `NoteSet` body;
+  - `clip_note(entry: dict, limit: int = 200) -> dict`, one helper in
+    `dw_mcp/client.py` or wherever the other projection helpers live
+    (`grep -n "def .*project" dw_mcp/*.py`). It replaces a longer `note`
+    with its first 200 characters plus `"…"` and sets
+    `note_truncated: True`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Using the MCP test files' existing pattern for faking HTTP responses:
+
+```python
+def test_set_note_puts_target_and_note(fake_server):
+    result = set_note(target="wf/20261012-000000-aaaa", note="shift 5")
+    assert fake_server.last_request.method == "PUT"
+    assert fake_server.last_request.path == "/api/notes"
+    assert fake_server.last_request.json == {
+        "target": "wf/20261012-000000-aaaa",
+        "note": "shift 5",
+    }
+
+
+def test_run_workflow_forwards_note(fake_server):
+    run_workflow(
+        workflow_path="templates/text-to-image",
+        note="seed sweep 1/4",
+        acknowledged_cost=True,
+    )
+    assert fake_server.last_job_body["note"] == "seed sweep 1/4"
+
+
+def test_compact_projections_clip_long_notes(fake_server):
+    fake_server.gallery = [{"name": "a.png", "note": "x" * 500, "role": "final"}]
+    entry = list_gallery()["files"][0]
+    assert len(entry["note"]) <= 201 and entry["note_truncated"] is True
+
+
+def test_short_note_not_marked_truncated(fake_server):
+    fake_server.gallery = [{"name": "a.png", "note": "short", "role": "final"}]
+    entry = list_gallery()["files"][0]
+    assert entry["note"] == "short" and "note_truncated" not in entry
+```
+
+Rename `fake_server`, `last_request` and the call shapes to match what
+the existing MCP tests use. The assertions stay the same.
+
+- [ ] **Step 2: Run them to verify they fail**
+
+Run: `DW_DEVICE=cpu venv/bin/python -m pytest <the MCP test files> -k note -v -n0`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement it**
+
+`set_note` tool description:
+
+> "Set or clear (note null or '') the note on a run ('<workflow>/<run id>'), one output file (its gallery name), an asset ('asset:<name>') or a workspace ('workspace:<name>'). A note is plain text up to 4000 characters saying what the thing is for - what a run tested, why a file is the keeper. Free: no acknowledged_cost."
+
+`run_workflow`'s `note` parameter description:
+
+> "What this run is for, kept with the run and shown on every file it writes - e.g. 'testing video_shift 5 against 3'. When running a set of variations, give each its own."
+
+`upload_asset` and `keep_output` `note`:
+
+> "A note kept with the asset. keep_output copies the source file's note when this is left out."
+
+The MCP instructions gain one sentence, after the loop paragraph:
+
+> "Pass `note` on `run_workflow` saying what each run tests when exploring variations, and `set_note` to mark the keeper - the note is shown with every file the run made."
+
+In `docs/WORKFLOW_GUIDE.md`, under *Authoring a workflow from an agent*,
+add a short paragraph with the same guidance. Add to it that
+`result.role` (`final`/`intermediate`) overrides the inferred role when
+a step's default is wrong.
+
+`docs/MCP.md` documents `set_note` and the `note` parameters.
+
+- [ ] **Step 4: Check the tool-surface budget**
+
+Run the existing MCP surface tests:
+`DW_DEVICE=cpu venv/bin/python -m pytest tests/ -k "surface or mcp_budget or tool_list" -q`.
+Then regenerate the snapshot with `scripts/surface_snapshot.py`, using
+the flag `--help` shows. If a token-budget test fails, cut the new
+descriptions down. Don't raise the budget.
+
+- [ ] **Step 5: Run and commit**
+
+```bash
+DW_DEVICE=cpu venv/bin/python -m pytest tests/test_mcp*.py -q
+git add dw_mcp/tools_media.py dw_mcp/assets.py dw_mcp/tools_jobs.py dw_mcp/diagnose.py dw_mcp/workspaces.py dw_mcp/catalog.py docs/WORKFLOW_GUIDE.md docs/MCP.md
+git commit -m "feat(mcp): set_note, note on run_workflow, upload_asset and keep_output, notes in every listing
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add the MCP instructions file, `dw_mcp/client.py` if it changed, the
+snapshot, and the test files, each by name.
+
+### Task 8: UI notes
+
+**Files:**
+- Create: `ui/src/lib/ui/NoteEditor.svelte`
+- Create: `ui/src/lib/ui/NoteEditor.test.ts`
+- Modify: `ui/src/lib/api.ts`. Add
+  `setNote(target: string, note: string | null): Promise<NoteSet>`,
+  which PUTs `/api/notes`.
+- Modify: `ui/src/lib/types.ts`. Re-export `NoteSet`.
+- Modify: `ui/src/lib/pages/OverviewPage.svelte`. The note goes under the
+  `<h1>` at line 128, with target `workspace:<name>`.
+- Modify: `ui/src/lib/workspace.svelte.ts`. `loadWorkspaces` (line 72)
+  keeps `note`.
+- Modify: `ui/src/lib/gallery/GalleryDetail.svelte`. The note goes under
+  the `RoleTag`. When `note_source === 'run'` it is labelled "Run note",
+  with two actions: "Edit run note" (target = run directory) and "Note
+  this file" (target = the file).
+- Modify: `ui/src/lib/assets/AssetDetail.svelte`. Note, with target
+  `asset:<name>`.
+- Modify: `ui/src/lib/pages/JobPage.svelte`. The run note goes under the
+  header, with target `<identity>/<run_id>` from the job's `run_dir`.
+- Modify: the gallery tile. Add a small note icon with
+  `title={firstLine(note)}` when `file.note` is set.
+- Test: `NoteEditor.test.ts`, plus a test per page that the note renders.
+
+**Interfaces:**
+- Consumes: `setNote`, and the `note` fields from Task 6.
+- Produces: `NoteEditor` props:
+
+```ts
+{
+  note: string | null | undefined
+  target: string
+  label?: string            // e.g. "Run note"; default "Note"
+  placeholder?: string      // default "Add a note"
+  onsaved?: (note: string | null) => void
+}
+```
+
+- [ ] **Step 1: Write the failing test**
+
+```ts
+// ui/src/lib/ui/NoteEditor.test.ts
+import { fireEvent, render, screen } from '@testing-library/svelte'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as api from '../api'
+import NoteEditor from './NoteEditor.svelte'
+
+describe('NoteEditor', () => {
+  beforeEach(() => vi.restoreAllMocks())
+
+  it('shows the note as text, never markup', () => {
+    render(NoteEditor, { note: '<b>bold</b>', target: 'workspace:default' })
+    expect(screen.getByText('<b>bold</b>')).toBeTruthy()
+    expect(document.querySelector('b')).toBeNull()
+  })
+
+  it('shows the placeholder when empty', () => {
+    render(NoteEditor, { note: null, target: 'workspace:default' })
+    expect(screen.getByText('Add a note')).toBeTruthy()
+  })
+
+  it('saves through setNote and reports the stored note', async () => {
+    const spy = vi.spyOn(api, 'setNote').mockResolvedValue({ target: 't', note: 'new', note_source: 'run' })
+    const onsaved = vi.fn()
+    render(NoteEditor, { note: 'old', target: 't', onsaved })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    const box = screen.getByRole('textbox')
+    await fireEvent.input(box, { target: { value: 'new' } })
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(spy).toHaveBeenCalledWith('t', 'new')
+    expect(onsaved).toHaveBeenCalledWith('new')
+  })
+
+  it('cancel restores the old note without calling the api', async () => {
+    const spy = vi.spyOn(api, 'setNote')
+    render(NoteEditor, { note: 'old', target: 't' })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), { target: { value: 'changed' } })
+    await fireEvent.click(screen.getByRole('button', { name: /cancel/i }))
+    expect(spy).not.toHaveBeenCalled()
+    expect(screen.getByText('old')).toBeTruthy()
+  })
+
+  it('saving an empty box clears the note', async () => {
+    const spy = vi.spyOn(api, 'setNote').mockResolvedValue({ target: 't', note: null, note_source: null })
+    render(NoteEditor, { note: 'old', target: 't' })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), { target: { value: '' } })
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(spy).toHaveBeenCalledWith('t', null)
+  })
+
+  it('shows the server error and stays in edit mode', async () => {
+    vi.spyOn(api, 'setNote').mockRejectedValue(new Error('a note is at most 4000 characters'))
+    render(NoteEditor, { note: 'old', target: 't' })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(await screen.findByText(/at most 4000/)).toBeTruthy()
+    expect(screen.getByRole('textbox')).toBeTruthy()
+  })
+})
+```
+
+The memory note for this repo says: no `vi.resetModules` in Svelte
+component tests. Use `vi.spyOn` as above.
+
+- [ ] **Step 2: Run it to verify it fails**
+
+Run: `cd ui && npx vitest run src/lib/ui/NoteEditor.test.ts`
+Expected: FAIL, because the module is not found.
+
+- [ ] **Step 3: Implement it**
+
+```svelte
+<script lang="ts">
+  import { setNote } from '../api'
+
+  let {
+    note,
+    target,
+    label = 'Note',
+    placeholder = 'Add a note',
+    onsaved,
+  }: {
+    note: string | null | undefined
+    target: string
+    label?: string
+    placeholder?: string
+    onsaved?: (note: string | null) => void
+  } = $props()
+
+  let editing = $state(false)
+  let draft = $state('')
+  let saving = $state(false)
+  let error = $state<string | null>(null)
+  let shown = $state<string | null>(null)
+  $effect(() => {
+    shown = note ?? null
+  })
+
+  function edit() {
+    draft = shown ?? ''
+    error = null
+    editing = true
+  }
+
+  async function save() {
+    saving = true
+    error = null
+    try {
+      const stored = await setNote(target, draft.trim() ? draft : null)
+      shown = stored.note ?? null
+      editing = false
+      onsaved?.(shown)
+    } catch (e) {
+      error = e instanceof Error ? e.message : String(e)
+    } finally {
+      saving = false
+    }
+  }
+</script>
+
+<div class="note">
+  {#if editing}
+    <textarea bind:value={draft} maxlength="4000" rows="4" aria-label={label}></textarea>
+    <div class="actions">
+      <button type="button" onclick={save} disabled={saving}>Save</button>
+      <button type="button" onclick={() => (editing = false)} disabled={saving}>Cancel</button>
+    </div>
+    {#if error}<p class="error" role="alert">{error}</p>{/if}
+  {:else}
+    <div class="shown">
+      <span class="label">{label}</span>
+      {#if shown}
+        <p class="text">{shown}</p>
+      {:else}
+        <p class="text muted">{placeholder}</p>
+      {/if}
+      <button type="button" class="icon" aria-label="Edit note" onclick={edit}>✎</button>
+    </div>
+  {/if}
+</div>
+
+<style>
+  .text {
+    white-space: pre-wrap;
+    margin: 0;
+  }
+  .muted {
+    color: var(--text-muted);
+  }
+  textarea {
+    width: 100%;
+    font: inherit;
+  }
+  .actions {
+    display: flex;
+    gap: 0.5rem;
+    margin-top: 0.25rem;
+  }
+  .error {
+    color: var(--danger);
+  }
+  .label {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+  }
+</style>
+```
+
+Match the button classes and colour tokens to `ui/src/app.css` and the
+existing small-button style, for example by copying from
+`ConfirmDialog`'s buttons. Check how `api.ts` surfaces server error
+detail, and make `setNote` throw an `Error` carrying the server's
+`detail` the way the other `api.ts` write calls do.
+
+- [ ] **Step 4: Place it in the four views and on the tile**
+
+- **Overview:** `<NoteEditor note={ws.note} target={`workspace:${ws.name}`} onsaved={reloadWorkspaces} />`
+  under the `<h1>`.
+- **Gallery detail:** if `meta.note_source === 'run'`, show
+  `<NoteEditor note={meta.run_note} target={runDir} label="Run note" />`
+  plus a "Note this file" button. That button swaps it for
+  `<NoteEditor note={null} target={meta.name} label="File note" />`.
+  Otherwise show `<NoteEditor note={meta.note} target={meta.name} />`.
+  `runDir` is the file name's `<identity>/<run_id>` prefix. Derive it
+  from `folder` and `run_id` on the gallery entry. After a save,
+  refetch the metadata and refresh the listing entry's `note`.
+- **Asset detail:** `<NoteEditor note={asset.note} target={`asset:${asset.name}`} />`
+- **Job page:** `<NoteEditor note={job.note} target={job.run_dir} label="Run note" />`
+  when `job.run_dir` is set.
+- **Tile:** `{#if file.note}<span class="note-mark" title={file.note.split('\n')[0]} aria-label="Has a note">✎</span>{/if}`
+
+Add one assertion per page test that the note text renders, extending
+the page tests Task 4 touched.
+
+- [ ] **Step 5: Run the UI checks**
+
+```bash
+cd ui && npx vitest run && npm run lint && npm run check && npm run metrics -- --check ../docs/stabilization/ui/baseline.json
+```
+
+Expected: all pass. Then run the twins test from the repo root:
+`DW_DEVICE=cpu venv/bin/python -m pytest tests/test_ui_twins.py tests/test_api_contract.py -q`.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add ui/src/lib/ui/NoteEditor.svelte ui/src/lib/ui/NoteEditor.test.ts ui/src/lib/api.ts ui/src/lib/types.ts ui/src/lib/pages/OverviewPage.svelte ui/src/lib/workspace.svelte.ts ui/src/lib/gallery/GalleryDetail.svelte ui/src/lib/assets/AssetDetail.svelte ui/src/lib/pages/JobPage.svelte ui/src/lib/pages/GalleryPage.svelte
+git commit -m "feat(ui): notes on workspaces, runs, files and assets, edited in place
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add the page test files you touched, by name.
+
+### Task 9: Whole-branch verification
+
+**Files:** none new. This task only fixes what the checks turn up.
+
+- [ ] **Step 1: Run the full Python suite, lint and ratchet**
+
+```bash
+DW_DEVICE=cpu venv/bin/python -m pytest tests/ -q
+venv/bin/ruff check . && venv/bin/ruff format --check .
+venv/bin/python scripts/arch_metrics.py --check docs/stabilization/baseline.json
+venv/bin/python scripts/dump_openapi.py --check
+```
+
+Expected: all pass, with `modules` at 210.
+
+- [ ] **Step 2: Run the full UI checks and e2e**
+
+```bash
+cd ui && npx vitest run && npm run lint && npm run check && npm run gen:api && git diff --exit-code src/lib/generated && npm run metrics -- --check ../docs/stabilization/ui/baseline.json
+cd ui && npx playwright test
+```
+
+Expected: all pass. If an e2e gallery spec relied on the subfolder
+filter or on intermediates being visible by default, update the spec to
+click the Intermediate chip. That is the intended behaviour change.
+
+- [ ] **Step 3: Check the app by hand**
+
+Start `python -m dw.serve` against a scratch `DIFFUSERS_HELPER_ROOT`. Run
+`workflows/templates/text-to-image.json` with
+`note="first look"`. Then check:
+- the gallery shows it with a Final tag;
+- the run note appears in the detail panel;
+- editing a file note works;
+- the workspace overview note saves.
+
+Take one screenshot each of the gallery, the detail panel and the
+overview for the release note.
+
+- [ ] **Step 4: Add a release note line**
+
+Following the convention in `docs/RELEASING.md`, add to the
+unreleased-notes section:
+"Gallery files are tagged final or intermediate (inferred when a
+workflow doesn't say) and the gallery opens on finals; runs, files,
+assets and workspaces take an optional note (`note` on `run_workflow`,
+MCP `set_note`)."
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add docs/RELEASING.md
+git commit -m "docs(release): note roles and notes for 0.14.0
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+Also add any e2e specs you updated, by name.
diff --git a/docs/superpowers/plans/2026-10-14-ui-ux-improvements.md b/docs/superpowers/plans/2026-10-14-ui-ux-improvements.md
new file mode 100644
index 00000000..2d633ab1
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-14-ui-ux-improvements.md
@@ -0,0 +1,3192 @@
+# UI/UX Improvements Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Eleven web UI improvements, from a tab title that tracks the running
+job up to a side-by-side compare view, each shipped and tested on its own.
+
+**Architecture:**
+- Most tasks are UI-only (Svelte 5 runes, `ui/src/lib/`). Pure logic goes in a
+  small `.ts` module with its own Vitest file, and the component only wires it
+  up. That is the codebase's existing pattern (`progress.ts`, `picks.svelte.ts`,
+  `outputMeta.ts`).
+- Two tasks change the server:
+  - **Stars:** saved in each run's existing `notes.json` through `dw/notes.py`,
+    with one new route.
+  - **Rerun lineage:** a `rerun_of` field on the job spec, plus one new
+    job-history column.
+- The UI's server response types are generated (`python scripts/dump_openapi.py`
+  then `npm run gen:api`) and are never written by hand.
+
+**Tech Stack:**
+- Svelte 5, Vitest with jsdom, `@testing-library/svelte`, `@lucide/svelte`,
+  svelte-sonner (through `ui/src/lib/toast.ts`);
+- FastAPI with pydantic, pytest (xdist), sqlite job history.
+
+**Spec:** the suggestion list agreed in the 2026-10-14 session, restated here
+because there is no separate design doc. Numbers match the suggestion list.
+
+1. Tab title shows the running job; an alert fires when a job finishes.
+2. Notes are rendered as Markdown.
+3. Side-by-side compare of 2–4 outputs, with synced video playback.
+4. ←/→ and Delete in the gallery detail.
+5. Sidebar: hide workspaces, and group them by name prefix. (Every workspace
+   name already shows in full on hover - `Sidebar.svelte` sets `title={name}`.)
+6. Drag-and-drop uploads (Assets page, media argument inputs).
+7. Star ("keep") an output, and filter the gallery to starred ones.
+8. Measured run time from this server's history (`observed`), shown on the
+   workflow page and the cards.
+9. Placeholder blocks instead of "loading…" on the Overview panels.
+10. ~~Theme toggle~~ - **already exists** (`cycleTheme` in `ui/src/App.svelte`),
+    dropped.
+11. A note you expanded stays expanded (per browser).
+12. Jobs list: time in the queue, and the job each rerun came from.
+
+## Global Constraints
+
+- Colour (`ui/src/app.css` header): `--live` is machine state only, and
+  `--select` is the user's place only. Where they may appear is enforced by
+  `ui/scripts/design-rules.test.ts`. New UI uses ink, `--muted`, `--line` and
+  `--panel-2` only.
+- Type: anything the engine reads literally (names, ids, paths, numbers) is
+  `--font-mono`; text written for a person is `--font-sans`.
+- Every token pair passes WCAG AA in both themes.
+- Persisted UI state goes through `ui/src/lib/storage.ts` (`storageGet` /
+  `storageSet`, keys auto-prefixed `dw-`) and must degrade silently when
+  storage is unavailable.
+- User text is never rendered as HTML: no `{@html}`, no `innerHTML`.
+  `NoteEditor.test.ts` "shows the note as text, never markup" must keep
+  passing.
+- Server: paths go through `dw/security.py` validators. Never use
+  `eval`/`exec`/`shell=True`. Notes and stars are written only by the server.
+- `ui/src/lib/generated/` comes from `python scripts/dump_openapi.py` (repo
+  root) then `npm run gen:api` (in `ui/`), never hand-edited.
+- Checks: from `ui/` run `npm run check`, `npm run lint`, `npm test`. For
+  server tasks also run `pytest tests/ -v`. `dw.serve` needs a restart to pick
+  up server changes.
+- Match the surrounding code: comment density, prose-style comments explaining
+  *why*, and the existing component structure.
+
+## Review Focus
+
+1. **The health poll fails once** (server restart, network blip). A failed
+   poll must not count as "every running job ended": no false "finished"
+   toast or alert. Pinned in Task 1 (`watchJobs` ignores a null health).
+2. **The UI is opened over plain HTTP from another machine** (`http://lem:8765`
+   - the user's real setup). Browser notifications need a secure context, so
+   the alert must fall back to a chime and the button must say so, not fail
+   silently. Pinned in Task 1 (`alertMode` test).
+3. **Arrow or Delete key pressed while typing in a note textarea, or while a
+   focused `<video>` is seeking.** It must not change the selection or delete
+   a file. Pinned in Task 3 (`isEditable` covers media elements, and a test
+   presses ← inside the note box).
+4. **Link markup in a note** (`[x](javascript:alert(1))`). It must render as
+   plain text, never as a link. Pinned in Task 7 (`safeHref` and parse tests).
+5. **A star write and a note write on the same run.** Neither may erase the
+   other in `notes.json`. Pinned in Task 10 (a round-trip test in both
+   directions).
+
+---
+
+## File Map
+
+| File | Task | Responsibility |
+|---|---|---|
+| `ui/src/lib/jobWatch.ts` (+test) | 1 | running ids, ended ids, percent, tab title text |
+| `ui/src/lib/finishAlert.ts` (+test) | 1 | desktop notification or chime fallback |
+| `ui/src/lib/editable.ts` (+test) | 1, 3 | "is this keypress inside something editable" (moved out of App) |
+| `ui/src/App.svelte` | 1, 12 | wire job watching, alert toggle; compare route |
+| `ui/src/lib/format.ts` (+test) | 2 | `formatMinutes` (moved from WorkflowsPage) |
+| `ui/src/lib/observed.ts` (+test) | 2 | text for the server's `observed` block |
+| `ui/src/lib/pages/WorkflowPage.svelte`, `WorkflowsPage.svelte` | 2 | show measured time |
+| `ui/src/lib/neighbor.ts` (+test) | 3 | next/previous in a list |
+| `ui/src/lib/pages/GalleryPage.svelte` | 3, 10, 12 | keys, star filter, compare action |
+| `ui/src/lib/KeyboardHelp.svelte` | 3, 10 | document the new keys |
+| `ui/src/lib/expandedNotes.ts` (+test) | 4 | remembered expanded notes |
+| `ui/src/lib/ui/ClampedText.svelte` (+test) | 4, 7 | remember key; Markdown mode; max-height clamp |
+| `ui/src/lib/ui/Skeleton.svelte` (+test) | 5 | placeholder blocks |
+| `ui/src/lib/jobTimes.ts` (+test) | 6 | queue wait |
+| `ui/src/lib/pages/JobsPage.svelte` | 6, 11 | wait + rerun chip |
+| `ui/src/lib/markdown.ts` (+test) | 7 | safe Markdown subset → node tree |
+| `ui/src/lib/ui/Markdown.svelte` (+test) | 7 | render the tree with Svelte nodes |
+| `ui/src/lib/dropFiles.ts` (+test) | 8 | drag-and-drop Svelte action |
+| `ui/src/lib/pages/AssetsPage.svelte`, `editor/MediaArgumentInput.svelte` | 8 | accept drops |
+| `ui/src/lib/wsGroups.ts` (+test) | 9 | group/hide workspace names |
+| `ui/src/lib/hiddenWorkspaces.svelte.ts` | 9 | persisted hidden list |
+| `ui/src/lib/Sidebar.svelte`, `pages/OverviewPage.svelte` | 9 | groups, hidden toggle |
+| `dw/notes.py`, `dw/server/routes/media.py`, `dw/server/routes/gallery.py`, `dw/server/api_models.py` | 10 | stars |
+| `tests/test_stars.py` | 10 | star store + API |
+| `dw/server/jobs.py`, `job_record.py`, `job_history.py`, `api_models.py` | 11 | `rerun_of` |
+| `tests/test_rerun_lineage.py` | 11 | lineage live + historical + migration |
+| `ui/src/lib/compare.ts` (+test) | 12 | differing arguments |
+| `ui/src/lib/pages/ComparePage.svelte` (+test) | 12 | compare grid |
+| `ui/src/lib/BulkBar.svelte`, `routes.ts` | 12 | compare action + route |
+
+---
+
+## Phase A - small, UI-only
+
+### Task 1: Tab title and job-finished alerts
+
+**Files:**
+- Create: `ui/src/lib/editable.ts`, `ui/src/lib/editable.test.ts`
+- Create: `ui/src/lib/jobWatch.ts`, `ui/src/lib/jobWatch.test.ts`
+- Create: `ui/src/lib/finishAlert.ts`, `ui/src/lib/finishAlert.test.ts`
+- Modify: `ui/src/App.svelte` (the `isEditable` function, the status `$effect`
+  around line 69, and the header `.state` block)
+
+**Interfaces:**
+- Produces: `isEditable(target: EventTarget | null): boolean` (Task 3 uses it)
+- Produces: `runningIds(health: HealthInfo | null): string[]`,
+  `endedSince(before: readonly string[], now: readonly string[]): string[]`,
+  `percentDone(progress: JobDetail['progress']): number | null`,
+  `tabTitle(job: TitleJob | null, othersRunning?: number): string`,
+  `endedTitle(job: TitleJob & { status: string }): string`,
+  `finishedText(job: JobDetail): string`, `BASE_TITLE`
+- Produces: `alertMode(): 'notification' | 'chime'`,
+  `enableAlerts(): Promise<boolean>`, `unlockChime(): void`,
+  `alertFinished(text: string, href: string): void`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/editable.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { isEditable } from './editable'
+
+describe('isEditable', () => {
+  it('is true for text entry and media, false for plain elements', () => {
+    expect(isEditable(document.createElement('input'))).toBe(true)
+    expect(isEditable(document.createElement('textarea'))).toBe(true)
+    expect(isEditable(document.createElement('select'))).toBe(true)
+    // a focused <video> seeks on the arrow keys itself
+    expect(isEditable(document.createElement('video'))).toBe(true)
+    expect(isEditable(document.createElement('div'))).toBe(false)
+    expect(isEditable(null)).toBe(false)
+  })
+})
+```
+
+`ui/src/lib/jobWatch.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import type { HealthInfo, JobDetail } from './types'
+import {
+  BASE_TITLE,
+  endedSince,
+  endedTitle,
+  percentDone,
+  runningIds,
+  tabTitle,
+} from './jobWatch'
+
+const health = (ids: (string | null)[], current: string | null = null) =>
+  ({
+    current_job: current ?? ids.find(Boolean) ?? null,
+    workers: ids.map((id) => ({ current_job: id })),
+  }) as unknown as HealthInfo
+
+const progress = (p: Partial<NonNullable<JobDetail['progress']>>) =>
+  p as JobDetail['progress']
+
+describe('runningIds', () => {
+  it('names every card’s job once', () => {
+    expect(runningIds(health(['a', null, 'b']))).toEqual(['a', 'b'])
+  })
+  it('falls back to current_job when workers is absent', () => {
+    expect(
+      runningIds({ current_job: 'x' } as unknown as HealthInfo),
+    ).toEqual(['x'])
+  })
+  it('is empty for no health', () => {
+    expect(runningIds(null)).toEqual([])
+  })
+})
+
+describe('endedSince', () => {
+  it('is what was running and is not now', () => {
+    expect(endedSince(['a', 'b'], ['b', 'c'])).toEqual(['a'])
+  })
+})
+
+describe('percentDone', () => {
+  it('counts finished steps plus the denoise fraction of the current one', () => {
+    expect(
+      percentDone(
+        progress({
+          step_index: 1,
+          total_steps: 4,
+          denoise_step: 5,
+          denoise_total_steps: 10,
+        }),
+      ),
+    ).toBe(37)
+  })
+  it('never claims 100 while running', () => {
+    expect(
+      percentDone(
+        progress({
+          step_index: 3,
+          total_steps: 4,
+          denoise_step: 10,
+          denoise_total_steps: 10,
+        }),
+      ),
+    ).toBe(99)
+  })
+  it('is null with no step count', () => {
+    expect(percentDone(null)).toBeNull()
+    expect(percentDone(progress({ total_steps: 0 }))).toBeNull()
+  })
+})
+
+describe('tabTitle', () => {
+  it('is the app name when idle', () => {
+    expect(tabTitle(null)).toBe(BASE_TITLE)
+  })
+  it('shows percent, the workflow leaf name and other running jobs', () => {
+    const job = {
+      workflow: 'minimax/ref-to-video',
+      workflow_name: 'templates/minimax/ref-to-video',
+      progress: progress({ step_index: 0, total_steps: 2 }),
+    }
+    expect(tabTitle(job, 1)).toBe(`▶ 0% · ref-to-video +1 — ${BASE_TITLE}`)
+  })
+  it('leaves the percent out when there is none', () => {
+    expect(
+      tabTitle({ workflow: 'wf', workflow_name: null, progress: null }),
+    ).toBe(`▶ wf — ${BASE_TITLE}`)
+  })
+})
+
+describe('endedTitle', () => {
+  it('marks the outcome', () => {
+    const base = { workflow: 'wf', workflow_name: null, progress: null }
+    expect(endedTitle({ ...base, status: 'succeeded' })).toBe(
+      `✓ wf — ${BASE_TITLE}`,
+    )
+    expect(endedTitle({ ...base, status: 'failed' })).toBe(
+      `✗ wf — ${BASE_TITLE}`,
+    )
+    expect(endedTitle({ ...base, status: 'cancelled' })).toBe(
+      `⊘ wf — ${BASE_TITLE}`,
+    )
+  })
+})
+```
+
+`ui/src/lib/finishAlert.test.ts`:
+```ts
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { alertMode } from './finishAlert'
+
+describe('alertMode', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('uses desktop notifications on a secure origin', () => {
+    vi.stubGlobal('isSecureContext', true)
+    vi.stubGlobal('Notification', function () {})
+    expect(alertMode()).toBe('notification')
+  })
+  it('falls back to a chime over plain http from another machine', () => {
+    vi.stubGlobal('isSecureContext', false)
+    vi.stubGlobal('Notification', function () {})
+    expect(alertMode()).toBe('chime')
+  })
+  it('falls back to a chime where the API does not exist', () => {
+    vi.stubGlobal('isSecureContext', true)
+    vi.stubGlobal('Notification', undefined)
+    expect(alertMode()).toBe('chime')
+  })
+})
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/editable.test.ts src/lib/jobWatch.test.ts src/lib/finishAlert.test.ts`
+Expected: FAIL, because the modules do not exist.
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/editable.ts`:
+```ts
+/** Whether a keypress landed somewhere that owns its own keys: text entry,
+ * a select, contenteditable, or a media element (a focused <video> seeks on
+ * the arrow keys). A page-wide shortcut stands aside for all of them. */
+export function isEditable(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false
+  return (
+    target instanceof HTMLInputElement ||
+    target instanceof HTMLTextAreaElement ||
+    target instanceof HTMLSelectElement ||
+    target instanceof HTMLMediaElement ||
+    target.isContentEditable
+  )
+}
+```
+
+`ui/src/lib/jobWatch.ts`:
+```ts
+/** What the tab title and the finish alert read off the 5-second health
+ * poll. A job runs for minutes to half an hour, usually in a tab nobody is
+ * looking at, so the title is where its state has to be. */
+import { formatDuration } from './format'
+import type { HealthInfo, JobDetail } from './types'
+
+export const BASE_TITLE = 'diffusers-workflow'
+
+export type TitleJob = Pick<JobDetail, 'workflow' | 'workflow_name' | 'progress'>
+
+/** Every job a card is running now; `current_job` alone on a server too old
+ * to report `workers`. */
+export function runningIds(health: HealthInfo | null): string[] {
+  if (!health) return []
+  const ids = (health.workers ?? [])
+    .map((w) => w.current_job)
+    .filter((id): id is string => !!id)
+  if (health.current_job && !ids.includes(health.current_job))
+    ids.push(health.current_job)
+  return ids
+}
+
+export function endedSince(
+  before: readonly string[],
+  now: readonly string[],
+): string[] {
+  return before.filter((id) => !now.includes(id))
+}
+
+/** 0-99: steps behind it plus how far the current step's denoise loop is.
+ * Never 100 - a running job is not done. Null with nothing to go on. */
+export function percentDone(progress: JobDetail['progress']): number | null {
+  if (!progress?.total_steps) return null
+  const inner = progress.denoise_total_steps
+    ? Math.min(1, (progress.denoise_step ?? 0) / progress.denoise_total_steps)
+    : 0
+  const done = ((progress.step_index ?? 0) + inner) / progress.total_steps
+  return Math.min(99, Math.max(0, Math.floor(done * 100)))
+}
+
+const leaf = (job: TitleJob) =>
+  (job.workflow ?? job.workflow_name ?? 'job').split('/').pop() || 'job'
+
+export function tabTitle(job: TitleJob | null, othersRunning = 0): string {
+  if (!job) return BASE_TITLE
+  const pct = percentDone(job.progress)
+  const more = othersRunning > 0 ? ` +${othersRunning}` : ''
+  return `▶ ${pct === null ? '' : `${pct}% · `}${leaf(job)}${more} — ${BASE_TITLE}`
+}
+
+const MARKS: Record<string, string> = {
+  succeeded: '✓',
+  failed: '✗',
+  cancelled: '⊘',
+}
+
+export function endedTitle(job: TitleJob & { status: string }): string {
+  return `${MARKS[job.status] ?? '•'} ${leaf(job)} — ${BASE_TITLE}`
+}
+
+/** "ref-to-video succeeded in 12m 54s" - the toast and the alert body. */
+export function finishedText(job: JobDetail): string {
+  const took =
+    job.started_at && job.finished_at
+      ? ` in ${formatDuration(job.finished_at - job.started_at)}`
+      : ''
+  return `${leaf(job)} ${job.status}${took}`
+}
+```
+
+`ui/src/lib/finishAlert.ts`:
+```ts
+/** The alert a finished job raises in a tab nobody is looking at.
+ *
+ * A desktop notification needs a secure context - https, or localhost - and
+ * this UI is routinely opened over plain http from another machine
+ * (http://<gpu-box>:8765), where the Notification API is not offered. There
+ * the alert is a short chime instead. The browser only lets a page make
+ * sound after the person has interacted with it, so the chime is unlocked on
+ * the click that turns alerts on, and again on the first click after a
+ * reload. */
+export type AlertMode = 'notification' | 'chime'
+
+export function alertMode(): AlertMode {
+  return typeof Notification === 'function' && globalThis.isSecureContext
+    ? 'notification'
+    : 'chime'
+}
+
+let audio: AudioContext | null = null
+
+export function unlockChime(): void {
+  try {
+    audio ??= new AudioContext()
+    void audio.resume()
+  } catch {
+    /* no Web Audio - the tab title still carries the news */
+  }
+}
+
+/** Asks for permission where that applies; false when it was refused. */
+export async function enableAlerts(): Promise<boolean> {
+  if (alertMode() === 'notification') {
+    if (Notification.permission === 'granted') return true
+    return (await Notification.requestPermission()) === 'granted'
+  }
+  unlockChime()
+  return true
+}
+
+function chime(): void {
+  if (!audio) return
+  const now = audio.currentTime
+  const tone = audio.createOscillator()
+  const gain = audio.createGain()
+  tone.frequency.value = 880
+  gain.gain.setValueAtTime(0.15, now)
+  gain.gain.exponentialRampToValueAtTime(0.0001, now + 0.6)
+  tone.connect(gain).connect(audio.destination)
+  tone.start(now)
+  tone.stop(now + 0.6)
+}
+
+export function alertFinished(text: string, href: string): void {
+  if (alertMode() === 'notification' && Notification.permission === 'granted') {
+    const note = new Notification('diffusers-workflow', { body: text })
+    note.onclick = () => {
+      window.focus()
+      location.hash = href.replace(/^#/, '')
+      note.close()
+    }
+    return
+  }
+  chime()
+}
+```
+
+- [ ] **Step 4: Run the new tests**
+
+Run: `cd ui && npx vitest run src/lib/editable.test.ts src/lib/jobWatch.test.ts src/lib/finishAlert.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Wire App.svelte**
+
+1. Delete the local `isEditable` function and add
+   `import { isEditable } from './lib/editable'`.
+2. Add these imports: `Bell, BellOff` (to the existing `@lucide/svelte`
+   import), `TERMINAL_STATUSES` (to the existing `./lib/api` import),
+   `import { notify } from './lib/toast'`,
+   `import { wsHref } from './lib/routes'`,
+   `import type { JobDetail } from './lib/types'` (merge it with the existing
+   type import), the `jobWatch` functions, and
+   `import { alertFinished, alertMode, enableAlerts, unlockChime } from './lib/finishAlert'`.
+3. Below the `currentJob` derived value, add:
+
+```ts
+  // The tab title and the finish alert (jobWatch.ts, finishAlert.ts). The
+  // first poll only learns what is running - a job already going when the
+  // page opened has not "just finished" when the next poll misses it
+  let watched: string[] | null = null
+  let runningJob = $state<JobDetail | null>(null)
+  let othersRunning = $state(0)
+  let endedMark = $state<string | null>(null)
+  let alertsOn = $state(storageGet<boolean>('alert-finished', false))
+
+  async function watchJobs(info: HealthInfo | null) {
+    // A failed poll says nothing about the jobs - treating it as "none
+    // running" would announce every running job as finished
+    if (!info) return
+    const now = runningIds(info)
+    const ended = watched === null ? [] : endedSince(watched, now)
+    watched = now
+    othersRunning = Math.max(0, now.length - 1)
+    runningJob = now[0] ? await api.getJob(now[0]).catch(() => null) : null
+    for (const id of ended) {
+      const job = await api.getJob(id).catch(() => null)
+      if (job && TERMINAL_STATUSES.includes(job.status)) announce(job)
+    }
+  }
+
+  function announce(job: JobDetail) {
+    const text = finishedText(job)
+    if (document.hidden) endedMark = endedTitle(job)
+    // The job's own page already shows its outcome
+    const onItsPage =
+      view.kind === 'ws' && view.section === 'jobs' && view.rest[0] === job.id
+    if (!onItsPage) {
+      if (job.status === 'succeeded') notify.success(text)
+      else notify.error(text)
+    }
+    if (alertsOn && document.hidden)
+      alertFinished(text, wsHref(job.workspace, 'jobs', job.id))
+  }
+
+  async function toggleAlerts() {
+    if (alertsOn) {
+      alertsOn = false
+    } else if (await enableAlerts()) {
+      alertsOn = true
+    } else {
+      notify.error(
+        'The browser blocked notifications for this site - allow them in its site settings',
+      )
+      return
+    }
+    storageSet('alert-finished', alertsOn)
+  }
+
+  $effect(() => {
+    document.title = endedMark ?? tabTitle(runningJob, othersRunning)
+  })
+  $effect(() => {
+    const back = () => {
+      if (!document.hidden) endedMark = null
+    }
+    // A chime may only play after a gesture; after a reload the first
+    // click anywhere is that gesture
+    const unlock = () => {
+      if (alertsOn && alertMode() === 'chime') unlockChime()
+    }
+    document.addEventListener('visibilitychange', back)
+    window.addEventListener('pointerdown', unlock, { once: true })
+    return () => {
+      document.removeEventListener('visibilitychange', back)
+      window.removeEventListener('pointerdown', unlock)
+    }
+  })
+```
+
+4. In `refreshStatus`, after `health = ...`, add
+   `void watchJobs(health)`.
+5. `view` is declared further down (`const view = $derived(route.view)`).
+   Move that line above the new block so `announce` can read it.
+6. In the header's `.state` block, put a button next to the theme toggle,
+   copying its classes:
+
+```svelte
+          <button
+            class="bare icon"
+            onclick={toggleAlerts}
+            aria-pressed={alertsOn}
+            aria-label={alertsOn ? 'stop job-finished alerts' : 'alert me when a job finishes'}
+            title={alertsOn
+              ? 'alerts on - click to stop'
+              : alertMode() === 'chime'
+                ? 'chime when a job finishes while this tab is in the background (this page is not a secure origin, so desktop notifications are unavailable)'
+                : 'notify me when a job finishes while this tab is in the background'}
+          >
+            {#if alertsOn}<Bell size={15} />{:else}<BellOff size={15} />{/if}
+          </button>
+```
+
+- [ ] **Step 6: Run the UI checks**
+
+Run: `cd ui && npm run check && npm run lint && npm test`
+Expected: all pass. Then check by hand on `npm run dev` against a running
+`dw.serve`: start a job, switch tabs, and watch the title count up then show
+✓; turn alerts on and confirm the chime plays over a LAN http URL.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add ui/src/lib/editable.ts ui/src/lib/editable.test.ts ui/src/lib/jobWatch.ts ui/src/lib/jobWatch.test.ts ui/src/lib/finishAlert.ts ui/src/lib/finishAlert.test.ts ui/src/App.svelte
+git commit -m "feat(ui): tab title tracks the running job; alert when a job finishes"
+```
+
+---
+
+### Task 2: Show measured run time (`observed`)
+
+The server already computes, for each workflow, how long its finished jobs took
+on this machine (`dw/server/observed_cost.py`). `GET /api/workflows` returns it
+as `details[name].observed`, with `cold_minutes`, `warm_minutes`, `runs` and
+optional `name`/`device`/`since`. The UI never shows it.
+
+**Files:**
+- Modify: `ui/src/lib/format.ts`, `ui/src/lib/format.test.ts` (move `formatMinutes` here)
+- Create: `ui/src/lib/observed.ts`, `ui/src/lib/observed.test.ts`
+- Modify: `ui/src/lib/pages/WorkflowsPage.svelte` (`formatMinutes`, `formatCost`, `cardTitle`, ~line 130-165 and the card around line 297)
+- Modify: `ui/src/lib/pages/WorkflowPage.svelte` (load the detail, show it next to Run)
+
+**Interfaces:**
+- Produces: `formatMinutes(minutes: number): string` in `format.ts`
+- Produces: `observedText(observed: Record<string, unknown> | null | undefined): string | null`,
+  `observedTitle(observed: Record<string, unknown> | null | undefined): string | null`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/observed.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { observedText, observedTitle } from './observed'
+
+describe('observedText', () => {
+  it('prefers the warm figure - what the next run costs with the model resident', () => {
+    expect(
+      observedText({ warm_minutes: 12.9, cold_minutes: 14.5, runs: 3 }),
+    ).toBe('~12.9 min here')
+  })
+  it('falls back to the cold figure', () => {
+    expect(observedText({ cold_minutes: 0.4, runs: 1 })).toBe('<1 min here')
+  })
+  it('is null without a figure', () => {
+    expect(observedText(null)).toBeNull()
+    expect(observedText({ runs: 2 })).toBeNull()
+  })
+})
+
+describe('observedTitle', () => {
+  it('names both figures, the run count and the card', () => {
+    expect(
+      observedTitle({
+        warm_minutes: 12.9,
+        warm_runs: 2,
+        cold_minutes: 14.5,
+        cold_runs: 1,
+        runs: 3,
+        name: 'RTX 4090',
+        since: '2026-10-01T00:00:00Z',
+      }),
+    ).toBe(
+      'measured on this server (RTX 4090): ~12.9 min with the model loaded (2 runs), ~14.5 min from cold (1 run); 3 runs since 2026-10-01',
+    )
+  })
+})
+```
+
+Add to `ui/src/lib/format.test.ts`:
+```ts
+describe('formatMinutes', () => {
+  it('rounds to two places and says <1 below a minute', () => {
+    expect(formatMinutes(12.946)).toBe('~12.95 min')
+    expect(formatMinutes(0.4)).toBe('<1 min')
+  })
+})
+```
+(add `formatMinutes` to that file's import from `./format`).
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/observed.test.ts src/lib/format.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+Move the arrow function `formatMinutes` from `WorkflowsPage.svelte` (around
+line 133) into `format.ts` as an export, keeping its doc comment:
+```ts
+export const formatMinutes = (minutes: number) =>
+  minutes < 1 ? '<1 min' : `~${Number(minutes.toFixed(2))} min`
+```
+Then import it in `WorkflowsPage.svelte`.
+
+`ui/src/lib/observed.ts`:
+```ts
+/** The server's own history for a workflow - `observed` on a catalog
+ * detail (dw/server/observed_cost.py) - said for a person. The curated
+ * `cost` is a maintainer's claim about some other card; this is what this
+ * box actually took, which is the number that predicts the next run. */
+import { formatMinutes } from './format'
+
+type Observed = Record<string, unknown> | null | undefined
+const num = (v: unknown) => (typeof v === 'number' ? v : null)
+const runs = (n: number) => `${n} ${n === 1 ? 'run' : 'runs'}`
+
+export function observedText(observed: Observed): string | null {
+  const minutes = num(observed?.warm_minutes) ?? num(observed?.cold_minutes)
+  return minutes === null ? null : `${formatMinutes(minutes)} here`
+}
+
+export function observedTitle(observed: Observed): string | null {
+  if (!observed) return null
+  const parts: string[] = []
+  const warm = num(observed.warm_minutes)
+  const cold = num(observed.cold_minutes)
+  if (warm !== null)
+    parts.push(
+      `${formatMinutes(warm)} with the model loaded (${runs(num(observed.warm_runs) ?? 0)})`,
+    )
+  if (cold !== null)
+    parts.push(
+      `${formatMinutes(cold)} from cold (${runs(num(observed.cold_runs) ?? 0)})`,
+    )
+  if (!parts.length) return null
+  const card = observed.name ?? observed.device
+  const since =
+    typeof observed.since === 'string' ? ` since ${observed.since.slice(0, 10)}` : ''
+  return `measured on this server${card ? ` (${card})` : ''}: ${parts.join(', ')}; ${runs(num(observed.runs) ?? 0)}${since}`
+}
+```
+
+`WorkflowsPage.svelte`:
+- In the card (around line 297), after the curated-cost `{#if}` block, add:
+  ```svelte
+  {#if !detail?.cost?.length && observedText(detail?.observed)}
+    <span class="cost num muted">{observedText(detail?.observed)}</span>
+  {/if}
+  ```
+- In `cardTitle`, after the `measured on` line, add:
+  ```ts
+  const seen = observedTitle(detail?.observed)
+  if (seen) lines.push(seen)
+  ```
+
+`WorkflowPage.svelte`:
+- Add state `let observed = $state<Record<string, unknown> | null>(null)`.
+- In the effect that runs when `name` changes (the one calling
+  `api.getWorkflow(name)`), also call:
+  ```ts
+  observed = null
+  api
+    .listWorkflows()
+    .then((r) => {
+      observed = (r.details?.[name]?.observed as Record<string, unknown>) ?? null
+    })
+    .catch(() => {})
+  ```
+- Right before the Run `<button>`, add:
+  ```svelte
+  {#if observedText(observed)}
+    <span class="num muted" title={observedTitle(observed) ?? ''}
+      >{observedText(observed)}</span
+    >
+  {/if}
+  ```
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/observed.test.ts src/lib/format.test.ts && npm run check && npm run lint && npm test`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/format.ts ui/src/lib/format.test.ts ui/src/lib/observed.ts ui/src/lib/observed.test.ts ui/src/lib/pages/WorkflowsPage.svelte ui/src/lib/pages/WorkflowPage.svelte
+git commit -m "feat(ui): show this server's measured run time beside Run and on cards"
+```
+
+---
+
+### Task 3: Gallery ←/→ and Delete
+
+**Files:**
+- Create: `ui/src/lib/neighbor.ts`, `ui/src/lib/neighbor.test.ts`
+- Modify: `ui/src/lib/pages/GalleryPage.svelte` (the `<svelte:window onkeydown>` around line 207, and `removeFile` around line 183)
+- Modify: `ui/src/lib/pages/GalleryPage.test.ts`
+- Modify: `ui/src/lib/KeyboardHelp.svelte`
+
+**Interfaces:**
+- Consumes: `isEditable` (Task 1), `overlayOpen` (`ui/layers.svelte.ts`)
+- Produces: `neighbor(items: readonly string[], current: string, step: 1 | -1): string | null`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/neighbor.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { neighbor } from './neighbor'
+
+describe('neighbor', () => {
+  const items = ['a', 'b', 'c']
+  it('steps forward and back', () => {
+    expect(neighbor(items, 'b', 1)).toBe('c')
+    expect(neighbor(items, 'b', -1)).toBe('a')
+  })
+  it('stops at the ends rather than wrapping', () => {
+    expect(neighbor(items, 'c', 1)).toBeNull()
+    expect(neighbor(items, 'a', -1)).toBeNull()
+  })
+  it('is null for a name no longer listed', () => {
+    expect(neighbor(items, 'z', 1)).toBeNull()
+  })
+})
+```
+
+Add to `GalleryPage.test.ts`. Follow that file's existing helpers: it renders
+`GalleryPage` with `listing.files` and opens a file by clicking its tile.
+Reuse whatever helper the "opens details" tests use.
+```ts
+it('the arrow keys step through the files the grid shows', async () => {
+  render(GalleryPage)
+  await openFile('a.png') // the file's existing helper that clicks a tile
+  await fireEvent.keyDown(window, { key: 'ArrowRight' })
+  expect(galleryMetadata).toHaveBeenLastCalledWith('b.png')
+  await fireEvent.keyDown(window, { key: 'ArrowLeft' })
+  expect(galleryMetadata).toHaveBeenLastCalledWith('a.png')
+})
+
+it('an arrow key typed in the note box does not move the selection', async () => {
+  render(GalleryPage)
+  await openFile('a.png')
+  const before = galleryMetadata.mock.calls.length
+  const box = document.createElement('textarea')
+  document.body.append(box)
+  await fireEvent.keyDown(box, { key: 'ArrowRight' })
+  expect(galleryMetadata.mock.calls.length).toBe(before)
+  box.remove()
+})
+```
+If the file has no `openFile` helper, write one at the top of the new tests:
+`const openFile = (label: string) => fireEvent.click(screen.getByTitle(label))`.
+Match how the existing tests find a tile.
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/neighbor.test.ts src/lib/pages/GalleryPage.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/neighbor.ts`:
+```ts
+/** The item `step` places from `current` in `items`, or null at either end
+ * (no wrap: arriving back at the first file reads as "nothing happened") or
+ * when `current` is no longer listed. */
+export function neighbor(
+  items: readonly string[],
+  current: string,
+  step: 1 | -1,
+): string | null {
+  const at = items.indexOf(current)
+  if (at === -1) return null
+  return items[at + step] ?? null
+}
+```
+
+`GalleryPage.svelte`:
+- Import `isEditable` from `'../editable'` and `neighbor` from `'../neighbor'`.
+- Replace the window handler with:
+```svelte
+<svelte:window
+  onkeydown={(e) => {
+    if (overlayOpen()) return
+    // Escape closes the thing on top, and a dialog answers it itself. The
+    // selection is the more recent, more surprising state to be stuck in,
+    // so it clears first and the detail panel on a second press
+    if (e.key === 'Escape') {
+      if (picks.size) picks.clear()
+      else selected = null
+      return
+    }
+    // Culling a run: step through what the grid shows, delete as you go.
+    // A key typed into the note box, or a focused video seeking, is theirs
+    if (!selected || isEditable(e.target)) return
+    if (e.key === 'ArrowRight' || e.key === 'ArrowLeft') {
+      const next = neighbor(
+        visible.map((f) => f.name),
+        selected.name,
+        e.key === 'ArrowRight' ? 1 : -1,
+      )
+      if (next) {
+        e.preventDefault()
+        select(byName.get(next)!)
+      }
+    } else if (e.key === 'Delete' || (e.key === 'Backspace' && e.metaKey)) {
+      e.preventDefault()
+      void removeFile()
+    }
+  }}
+/>
+```
+- In `removeFile`, work out the next file *before* the delete. After a
+  successful delete, open that file instead of closing the panel:
+```ts
+    const name = selected.name
+    const order = visible.map((f) => f.name)
+    const after = neighbor(order, name, 1) ?? neighbor(order, name, -1)
+    try {
+      await api.deleteOutput(name)
+      files = files.filter((f) => f.name !== name)
+      picks.drop(name)
+      // Culling goes on to the next file rather than back to the grid
+      if (after && byName.get(after)) select(byName.get(after)!)
+      else selected = null
+```
+
+`KeyboardHelp.svelte`, after the `Esc` entry:
+```svelte
+    <dt><kbd>←</kbd> / <kbd>→</kbd></dt>
+    <dd>previous / next file (gallery details)</dd>
+    <dt><kbd>Delete</kbd> or <kbd>⌘</kbd> + <kbd>⌫</kbd></dt>
+    <dd>delete the open file and show the next (gallery details)</dd>
+```
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/neighbor.test.ts src/lib/pages/GalleryPage.test.ts && npm run check && npm run lint`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/neighbor.ts ui/src/lib/neighbor.test.ts ui/src/lib/pages/GalleryPage.svelte ui/src/lib/pages/GalleryPage.test.ts ui/src/lib/KeyboardHelp.svelte
+git commit -m "feat(ui): arrow keys and Delete in the gallery details for culling a run"
+```
+
+---
+
+### Task 4: Remember expanded notes
+
+**Files:**
+- Create: `ui/src/lib/expandedNotes.ts`, `ui/src/lib/expandedNotes.test.ts`
+- Modify: `ui/src/lib/ui/ClampedText.svelte`, `ui/src/lib/ui/ClampedText.test.ts`
+- Modify: `ui/src/lib/ui/NoteEditor.svelte`
+
+**Interfaces:**
+- Produces: `isRemembered(key: string): boolean`, `remember(key: string, open: boolean): void`
+- Produces: `ClampedText` prop `rememberKey?: string`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/expandedNotes.test.ts`:
+```ts
+import { beforeEach, describe, expect, it } from 'vitest'
+import { isRemembered, remember } from './expandedNotes'
+
+describe('expandedNotes', () => {
+  beforeEach(() => localStorage.clear())
+
+  it('remembers and forgets', () => {
+    remember('workspace:a', true)
+    expect(isRemembered('workspace:a')).toBe(true)
+    remember('workspace:a', false)
+    expect(isRemembered('workspace:a')).toBe(false)
+  })
+  it('keeps only the newest 200', () => {
+    for (let i = 0; i < 205; i++) remember(`k${i}`, true)
+    expect(isRemembered('k0')).toBe(false)
+    expect(isRemembered('k204')).toBe(true)
+  })
+})
+```
+
+Add to `ClampedText.test.ts`:
+```ts
+  it('opens already expanded when its key was left expanded', () => {
+    localStorage.clear()
+    fakeHeights(400, 80)
+    const first = render(ClampedText, {
+      props: { text: 'long text', rememberKey: 'k' },
+    })
+    return fireEvent
+      .click(screen.getByRole('button', { name: 'Show more' }))
+      .then(() => {
+        first.unmount()
+        render(ClampedText, { props: { text: 'long text', rememberKey: 'k' } })
+        expect(
+          screen.getByText('long text').classList.contains('clamped'),
+        ).toBe(false)
+      })
+  })
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/expandedNotes.test.ts src/lib/ui/ClampedText.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/expandedNotes.ts`:
+```ts
+/** Which long notes this browser left expanded, so a note someone opened
+ * to read stays open when they come back to it. Newest last, capped, so the
+ * list cannot grow without bound across thousands of run notes. */
+import { storageGet, storageSet } from './storage'
+
+const KEY = 'expanded-notes'
+const CAP = 200
+
+export function isRemembered(key: string): boolean {
+  return storageGet<string[]>(KEY, []).includes(key)
+}
+
+export function remember(key: string, open: boolean): void {
+  const list = storageGet<string[]>(KEY, []).filter((k) => k !== key)
+  if (open) list.push(key)
+  storageSet(KEY, list.slice(-CAP))
+}
+```
+
+`ClampedText.svelte`:
+- Props become
+  `let { text, lines = 4, rememberKey }: { text: string; lines?: number; rememberKey?: string } = $props()`.
+- Import `isRemembered, remember` from `'../expandedNotes'`.
+- Make the initial state and the reset depend on the key:
+```ts
+  const recalled = () => (rememberKey ? isRemembered(rememberKey) : false)
+  // svelte-ignore state_referenced_locally
+  let expanded = $state(recalled())
+  ...
+  // svelte-ignore state_referenced_locally
+  let seen = `${rememberKey ?? ''}\u0000${text}`
+  $effect(() => {
+    const now = `${rememberKey ?? ''}\u0000${text}`
+    if (now === seen) return
+    seen = now
+    expanded = recalled()
+  })
+  function toggle() {
+    expanded = !expanded
+    if (rememberKey) remember(rememberKey, expanded)
+  }
+```
+- The button's `onclick` becomes `onclick={toggle}`.
+
+`NoteEditor.svelte`: pass
+`rememberKey={`${workspace ?? ''}|${target}`}` to `<ClampedText>`.
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/expandedNotes.test.ts src/lib/ui && npm run check && npm run lint`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/expandedNotes.ts ui/src/lib/expandedNotes.test.ts ui/src/lib/ui/ClampedText.svelte ui/src/lib/ui/ClampedText.test.ts ui/src/lib/ui/NoteEditor.svelte
+git commit -m "feat(ui): a note left expanded stays expanded"
+```
+
+---
+
+### Task 5: Placeholder blocks on the Overview
+
+**Files:**
+- Create: `ui/src/lib/ui/Skeleton.svelte`, `ui/src/lib/ui/Skeleton.test.ts`
+- Modify: `ui/src/lib/pages/OverviewPage.svelte` (the three `<p class="muted">loading…</p>`)
+- Modify: `ui/src/lib/pages/OverviewPage.test.ts` if any test looks for the "loading…" text
+
+**Interfaces:**
+- Produces: `Skeleton` props `{ lines?: number; tiles?: number; label?: string }`
+
+- [ ] **Step 1: Write the failing test**
+
+`ui/src/lib/ui/Skeleton.test.ts`:
+```ts
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it } from 'vitest'
+import Skeleton from './Skeleton.svelte'
+
+describe('Skeleton', () => {
+  afterEach(cleanup)
+  it('announces loading and draws the requested shape', () => {
+    render(Skeleton, { props: { tiles: 4, label: 'loading outputs' } })
+    const status = screen.getByRole('status', { name: 'loading outputs' })
+    expect(status.querySelectorAll('.tile')).toHaveLength(4)
+  })
+  it('draws lines by default', () => {
+    render(Skeleton)
+    expect(screen.getByRole('status').querySelectorAll('.line')).toHaveLength(3)
+  })
+})
+```
+
+- [ ] **Step 2: Run it to see it fail**
+
+Run: `cd ui && npx vitest run src/lib/ui/Skeleton.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/ui/Skeleton.svelte`:
+```svelte
+<script lang="ts">
+  // The shape of what is coming, in the panel's own grey, so a slow panel
+  // does not jump when it lands. Neutral on purpose: --live is machine
+  // state and a load is not one. Still under reduced motion
+  let {
+    lines = 3,
+    tiles = 0,
+    label = 'loading',
+  }: { lines?: number; tiles?: number; label?: string } = $props()
+</script>
+
+<div class="skeleton" role="status" aria-label={label}>
+  {#if tiles}
+    <div class="tiles">
+      {#each { length: tiles } as _, i (i)}<span class="tile"></span>{/each}
+    </div>
+  {:else}
+    {#each { length: lines } as _, i (i)}
+      <span class="line" style:width="{90 - (i % 3) * 20}%"></span>
+    {/each}
+  {/if}
+</div>
+
+<style>
+  .skeleton {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+  }
+  .tiles {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
+    gap: var(--space-2);
+  }
+  .tile,
+  .line {
+    display: block;
+    background: var(--panel-2);
+    border-radius: var(--radius-2);
+    animation: pulse 1.4s ease-in-out infinite;
+  }
+  .tile {
+    aspect-ratio: 1;
+  }
+  .line {
+    height: 0.9em;
+  }
+  @keyframes pulse {
+    50% {
+      opacity: 0.55;
+    }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .tile,
+    .line {
+      animation: none;
+    }
+  }
+</style>
+```
+
+`OverviewPage.svelte`: import `Skeleton from '../ui/Skeleton.svelte'` and
+replace each `loading…`:
+- Recent outputs: `<Skeleton tiles={RECENT} label="loading recent outputs" />`
+- Jobs: `<Skeleton lines={JOBS} label="loading jobs" />`
+- Workflows: `<Skeleton lines={3} label="loading workflows" />`
+
+If `OverviewPage.test.ts` asserts `getByText('loading…')`, change it to
+`getByRole('status', { name: /loading/ })`.
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/ui/Skeleton.test.ts src/lib/pages/OverviewPage.test.ts && npm run check && npm run lint && npm test`
+Expected: PASS (the design-rules test included)
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/ui/Skeleton.svelte ui/src/lib/ui/Skeleton.test.ts ui/src/lib/pages/OverviewPage.svelte ui/src/lib/pages/OverviewPage.test.ts
+git commit -m "feat(ui): placeholder blocks instead of 'loading…' on the overview"
+```
+
+---
+
+### Task 6: Time in queue on the Jobs list
+
+**Files:**
+- Create: `ui/src/lib/jobTimes.ts`, `ui/src/lib/jobTimes.test.ts`
+- Modify: `ui/src/lib/pages/JobsPage.svelte` (the `.started` span around line 193)
+
+**Interfaces:**
+- Produces: `queueWait(job: Pick<JobSummary, 'created_at' | 'started_at' | 'status'>, now: number): number | null`
+
+- [ ] **Step 1: Write the failing test**
+
+`ui/src/lib/jobTimes.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { queueWait } from './jobTimes'
+
+describe('queueWait', () => {
+  it('is the time from submit to start for a job that started', () => {
+    expect(
+      queueWait({ created_at: 100, started_at: 160, status: 'succeeded' }, 999),
+    ).toBe(60)
+  })
+  it('counts up to now for a job still queued', () => {
+    expect(
+      queueWait({ created_at: 100, started_at: null, status: 'queued' }, 400),
+    ).toBe(300)
+  })
+  it('is null for a job cancelled before it started, or with no clock', () => {
+    expect(
+      queueWait({ created_at: 100, started_at: null, status: 'cancelled' }, 400),
+    ).toBeNull()
+    expect(
+      queueWait({ created_at: null, started_at: null, status: 'queued' }, 400),
+    ).toBeNull()
+  })
+})
+```
+
+- [ ] **Step 2: Run it to see it fail**
+
+Run: `cd ui && npx vitest run src/lib/jobTimes.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/jobTimes.ts`:
+```ts
+import type { JobSummary } from './types'
+
+/** Seconds a job waited for a card: submit to start, or submit to now for
+ * one still waiting. Null when there is no wait to speak of - no clock, or
+ * cancelled before it ever started. */
+export function queueWait(
+  job: Pick<JobSummary, 'created_at' | 'started_at' | 'status'>,
+  now: number,
+): number | null {
+  if (!job.created_at) return null
+  if (job.started_at) return Math.max(0, job.started_at - job.created_at)
+  return job.status === 'queued' ? Math.max(0, now - job.created_at) : null
+}
+```
+
+`JobsPage.svelte`: import `queueWait`. Replace
+`<span class="muted started">{when(job.started_at)}</span>` with:
+```svelte
+        {@const wait = queueWait(job, Date.now() / 1000)}
+        {#if job.status === 'queued'}
+          <span class="muted started" title="time spent waiting for a card"
+            >waiting {wait === null ? '' : formatDuration(wait)}</span
+          >
+        {:else}
+          <span
+            class="muted started"
+            title={wait !== null && wait >= 1
+              ? `waited ${formatDuration(wait)} in the queue`
+              : ''}>{when(job.started_at)}</span
+          >
+        {/if}
+```
+`{@const}` must be the first child of a block. If Svelte rejects it here,
+compute the value in a small function `waitOf(job)` in the script and call
+that instead.
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/jobTimes.test.ts src/lib/pages/JobsPage.test.ts && npm run check && npm run lint`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/jobTimes.ts ui/src/lib/jobTimes.test.ts ui/src/lib/pages/JobsPage.svelte
+git commit -m "feat(ui): jobs list shows how long a job waited for a card"
+```
+
+---
+
+## Phase B - UI, medium
+
+### Task 7: Notes rendered as Markdown (a safe subset)
+
+The renderer is our own small parser, and it outputs **Svelte nodes, never
+HTML**, so no sanitizer or new dependency is needed and the
+"never markup" rule holds. The subset:
+- `#`/`##`/`###` headings;
+- `-`/`*` and `1.` lists;
+- fenced code blocks;
+- paragraphs (single newlines kept as line breaks);
+- inline `**bold**`, `*italic*`, `` `code` ``, and `[text](https://…)`.
+
+Underscore emphasis is left out on purpose: notes are full of `snake_case`
+names (`cold_minutes`, `first_block`).
+
+`-webkit-line-clamp` does not reliably clamp across block children (`<p>`,
+`<ul>`). So `ClampedText` switches to a max-height clamp (`lines × line-height`)
+with a fade, which works for both plain and Markdown text.
+
+**Files:**
+- Create: `ui/src/lib/markdown.ts`, `ui/src/lib/markdown.test.ts`
+- Create: `ui/src/lib/ui/Markdown.svelte`, `ui/src/lib/ui/Markdown.test.ts`
+- Modify: `ui/src/lib/ui/ClampedText.svelte` (prop `markdown`, max-height clamp)
+- Modify: `ui/src/lib/ui/NoteEditor.svelte` (render notes as Markdown; hint under the textarea)
+
+**Interfaces:**
+- Produces: types `Inline`, `Block`; `parseMarkdown(src: string): Block[]`;
+  `parseInline(src: string): Inline[]`; `safeHref(url: string): string | null`
+- Produces: `Markdown` props `{ source: string }`; `ClampedText` prop `markdown?: boolean`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/markdown.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { parseInline, parseMarkdown, safeHref } from './markdown'
+
+describe('safeHref', () => {
+  it('allows http, https and mailto only', () => {
+    expect(safeHref('https://x.dev/a')).toBe('https://x.dev/a')
+    expect(safeHref('mailto:a@b.c')).toBe('mailto:a@b.c')
+    expect(safeHref('javascript:alert(1)')).toBeNull()
+    expect(safeHref('JaVaScRiPt:alert(1)')).toBeNull()
+    expect(safeHref('data:text/html,x')).toBeNull()
+    expect(safeHref('/relative')).toBeNull()
+  })
+})
+
+describe('parseInline', () => {
+  it('reads bold, italic, code and links', () => {
+    expect(parseInline('a **b** *c* `d` [e](https://x.dev)')).toEqual([
+      { kind: 'text', text: 'a ' },
+      { kind: 'strong', children: [{ kind: 'text', text: 'b' }] },
+      { kind: 'text', text: ' ' },
+      { kind: 'em', children: [{ kind: 'text', text: 'c' }] },
+      { kind: 'text', text: ' ' },
+      { kind: 'code', text: 'd' },
+      { kind: 'text', text: ' ' },
+      {
+        kind: 'link',
+        href: 'https://x.dev/',
+        children: [{ kind: 'text', text: 'e' }],
+      },
+    ])
+  })
+  it('leaves an unsafe link as its literal text', () => {
+    expect(parseInline('[x](javascript:alert(1))')).toEqual([
+      { kind: 'text', text: '[x](javascript:alert(1))' },
+    ])
+  })
+  it('leaves snake_case alone', () => {
+    expect(parseInline('cold_minutes and warm_minutes')).toEqual([
+      { kind: 'text', text: 'cold_minutes and warm_minutes' },
+    ])
+  })
+  it('keeps markup-looking text as text', () => {
+    expect(parseInline('<b>x</b>')).toEqual([
+      { kind: 'text', text: '<b>x</b>' },
+    ])
+  })
+})
+
+describe('parseMarkdown', () => {
+  it('reads headings, lists, code and paragraphs', () => {
+    const src = [
+      '## RULE',
+      'Two paths, pick by target.',
+      'Second line.',
+      '',
+      '- TV: L0 -> L7',
+      '- Cinema: B3 -> P1',
+      '',
+      '1. one',
+      '2. two',
+      '',
+      '```',
+      'dw validate x',
+      '```',
+    ].join('\n')
+    expect(parseMarkdown(src)).toEqual([
+      { kind: 'heading', level: 2, children: [{ kind: 'text', text: 'RULE' }] },
+      {
+        kind: 'paragraph',
+        children: [
+          { kind: 'text', text: 'Two paths, pick by target.' },
+          { kind: 'br' },
+          { kind: 'text', text: 'Second line.' },
+        ],
+      },
+      {
+        kind: 'list',
+        ordered: false,
+        items: [
+          [{ kind: 'text', text: 'TV: L0 -> L7' }],
+          [{ kind: 'text', text: 'Cinema: B3 -> P1' }],
+        ],
+      },
+      {
+        kind: 'list',
+        ordered: true,
+        items: [[{ kind: 'text', text: 'one' }], [{ kind: 'text', text: 'two' }]],
+      },
+      { kind: 'code', text: 'dw validate x' },
+    ])
+  })
+  it('a plain note is one paragraph', () => {
+    expect(parseMarkdown('just text')).toEqual([
+      { kind: 'paragraph', children: [{ kind: 'text', text: 'just text' }] },
+    ])
+  })
+  it('an unclosed fence runs to the end', () => {
+    expect(parseMarkdown('```\nx')).toEqual([{ kind: 'code', text: 'x' }])
+  })
+})
+```
+
+`ui/src/lib/ui/Markdown.test.ts`:
+```ts
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it } from 'vitest'
+import Markdown from './Markdown.svelte'
+
+describe('Markdown', () => {
+  afterEach(cleanup)
+  it('renders the subset as elements', () => {
+    render(Markdown, {
+      props: { source: '## Rule\n\n- **one**\n\n[docs](https://x.dev)' },
+    })
+    expect(screen.getByRole('heading', { name: 'Rule' })).toBeTruthy()
+    expect(screen.getByText('one').tagName).toBe('STRONG')
+    const link = screen.getByRole('link', { name: 'docs' })
+    expect(link.getAttribute('href')).toBe('https://x.dev/')
+    expect(link.getAttribute('rel')).toBe('noopener noreferrer')
+  })
+  it('never renders markup in the source', () => {
+    render(Markdown, { props: { source: '<img src=x onerror=alert(1)>' } })
+    expect(document.querySelector('img')).toBeNull()
+    expect(screen.getByText('<img src=x onerror=alert(1)>')).toBeTruthy()
+  })
+  it('never links a javascript: url', () => {
+    render(Markdown, { props: { source: '[x](javascript:alert(1))' } })
+    expect(screen.queryByRole('link')).toBeNull()
+  })
+})
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/markdown.test.ts src/lib/ui/Markdown.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement the parser**
+
+`ui/src/lib/markdown.ts`:
+```ts
+/** A small, safe Markdown subset for notes, parsed to a tree that
+ * Markdown.svelte renders as Svelte nodes. Nothing here produces HTML, so
+ * text that looks like markup stays text, and a link is only ever an
+ * http(s)/mailto URL the browser's own URL parser accepted.
+ *
+ * Underscore emphasis is left out on purpose: notes quote snake_case
+ * names (`cold_minutes`, `first_block`) constantly. */
+
+export type Inline =
+  | { kind: 'text'; text: string }
+  | { kind: 'br' }
+  | { kind: 'code'; text: string }
+  | { kind: 'strong' | 'em'; children: Inline[] }
+  | { kind: 'link'; href: string; children: Inline[] }
+
+export type Block =
+  | { kind: 'heading'; level: 1 | 2 | 3; children: Inline[] }
+  | { kind: 'paragraph'; children: Inline[] }
+  | { kind: 'list'; ordered: boolean; items: Inline[][] }
+  | { kind: 'code'; text: string }
+
+const SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
+
+export function safeHref(url: string): string | null {
+  try {
+    const parsed = new URL(url)
+    return SAFE_PROTOCOLS.has(parsed.protocol) ? parsed.href : null
+  } catch {
+    return null
+  }
+}
+
+// One alternation, tried left to right at each position: code first, so a
+// `**` inside backticks stays literal
+const INLINE =
+  /`([^`]+)`|\*\*(.+?)\*\*|\*([^*\s][^*]*?)\*|\[([^\]]+)\]\(([^)\s]+(?:\([^)\s]*\))?[^)\s]*)\)/g
+
+function pushText(out: Inline[], text: string) {
+  if (!text) return
+  const last = out[out.length - 1]
+  if (last?.kind === 'text') last.text += text
+  else out.push({ kind: 'text', text })
+}
+
+export function parseInline(src: string): Inline[] {
+  const out: Inline[] = []
+  let at = 0
+  for (const m of src.matchAll(INLINE)) {
+    pushText(out, src.slice(at, m.index))
+    at = m.index + m[0].length
+    if (m[1] !== undefined) out.push({ kind: 'code', text: m[1] })
+    else if (m[2] !== undefined)
+      out.push({ kind: 'strong', children: parseInline(m[2]) })
+    else if (m[3] !== undefined)
+      out.push({ kind: 'em', children: parseInline(m[3]) })
+    else {
+      const href = safeHref(m[5])
+      if (href) out.push({ kind: 'link', href, children: parseInline(m[4]) })
+      else pushText(out, m[0])
+    }
+  }
+  pushText(out, src.slice(at))
+  return out
+}
+
+const HEADING = /^(#{1,3})\s+(.*)$/
+const BULLET = /^\s*[-*]\s+(.*)$/
+const NUMBERED = /^\s*\d+[.)]\s+(.*)$/
+const FENCE = /^\s*```/
+
+const startsBlock = (line: string) =>
+  FENCE.test(line) ||
+  HEADING.test(line) ||
+  BULLET.test(line) ||
+  NUMBERED.test(line)
+
+export function parseMarkdown(src: string): Block[] {
+  const lines = src.replace(/\r\n?/g, '\n').split('\n')
+  const blocks: Block[] = []
+  let i = 0
+  while (i < lines.length) {
+    const line = lines[i]
+    if (!line.trim()) {
+      i++
+      continue
+    }
+    if (FENCE.test(line)) {
+      const body: string[] = []
+      i++
+      while (i < lines.length && !FENCE.test(lines[i])) body.push(lines[i++])
+      i++ // the closing fence, or past the end when it never closed
+      blocks.push({ kind: 'code', text: body.join('\n') })
+      continue
+    }
+    const heading = HEADING.exec(line)
+    if (heading) {
+      blocks.push({
+        kind: 'heading',
+        level: heading[1].length as 1 | 2 | 3,
+        children: parseInline(heading[2]),
+      })
+      i++
+      continue
+    }
+    const list = BULLET.test(line) ? BULLET : NUMBERED.test(line) ? NUMBERED : null
+    if (list) {
+      const items: Inline[][] = []
+      while (i < lines.length && list.test(lines[i]))
+        items.push(parseInline(list.exec(lines[i++])![1]))
+      blocks.push({ kind: 'list', ordered: list === NUMBERED, items })
+      continue
+    }
+    // A paragraph runs until a blank line or the start of another block;
+    // its single newlines are kept as line breaks - notes are written as
+    // lines, not reflowed prose
+    const children: Inline[] = []
+    while (i < lines.length && lines[i].trim() && !startsBlock(lines[i])) {
+      if (children.length) children.push({ kind: 'br' })
+      children.push(...parseInline(lines[i++]))
+    }
+    blocks.push({ kind: 'paragraph', children })
+  }
+  return blocks
+}
+```
+
+- [ ] **Step 4: Implement the component, and switch ClampedText and NoteEditor**
+
+`ui/src/lib/ui/Markdown.svelte`:
+```svelte
+<script lang="ts">
+  // Renders parseMarkdown's tree as Svelte nodes - never as HTML - so a note
+  // that contains markup shows that markup as text. Headings are styled
+  // paragraphs with a heading role two levels below the page's own, so a
+  // note's "# RULE" does not compete with the page title in the outline
+  import { parseMarkdown, type Inline } from '../markdown'
+
+  let { source }: { source: string } = $props()
+  const blocks = $derived(parseMarkdown(source))
+</script>
+
+{#snippet inline(nodes: Inline[])}
+  {#each nodes as node, i (i)}
+    {#if node.kind === 'text'}{node.text}{:else if node.kind === 'br'}<br
+      />{:else if node.kind === 'code'}<code>{node.text}</code
+      >{:else if node.kind === 'strong'}<strong>{@render inline(node.children)}</strong
+      >{:else if node.kind === 'em'}<em>{@render inline(node.children)}</em
+      >{:else}<a href={node.href} target="_blank" rel="noopener noreferrer"
+        >{@render inline(node.children)}</a
+      >{/if}
+  {/each}
+{/snippet}
+
+<div class="md">
+  {#each blocks as block, i (i)}
+    {#if block.kind === 'heading'}
+      <p class="h h{block.level}" role="heading" aria-level={block.level + 2}>
+        {@render inline(block.children)}
+      </p>
+    {:else if block.kind === 'paragraph'}
+      <p>{@render inline(block.children)}</p>
+    {:else if block.kind === 'list' && block.ordered}
+      <ol>
+        {#each block.items as item, j (j)}<li>{@render inline(item)}</li>{/each}
+      </ol>
+    {:else if block.kind === 'list'}
+      <ul>
+        {#each block.items as item, j (j)}<li>{@render inline(item)}</li>{/each}
+      </ul>
+    {:else}
+      <pre><code>{block.text}</code></pre>
+    {/if}
+  {/each}
+</div>
+
+<style>
+  .md > :first-child {
+    margin-top: 0;
+  }
+  .md > :last-child {
+    margin-bottom: 0;
+  }
+  p,
+  ul,
+  ol,
+  pre {
+    margin: 0 0 0.5em;
+  }
+  ul,
+  ol {
+    padding-left: 1.4em;
+  }
+  .h {
+    font-weight: 600;
+    margin-top: 0.75em;
+  }
+  .h1 {
+    font-size: 1.1em;
+  }
+  pre {
+    background: var(--panel-2);
+    padding: var(--space-2);
+    border-radius: var(--radius-2);
+    overflow-x: auto;
+    white-space: pre;
+  }
+  code {
+    font-family: var(--font-mono);
+    font-size: 0.92em;
+  }
+</style>
+```
+
+`ClampedText.svelte`:
+- Add the prop `markdown = false` (type `markdown?: boolean`) and
+  `import Markdown from './Markdown.svelte'`.
+- The text element body becomes
+  `{#if markdown}<Markdown source={text} />{:else}{text}{/if}` and gets
+  `class:plain={!markdown}`.
+- Replace the CSS for `.text` / `.clamped`:
+```css
+  .text {
+    line-height: 1.5;
+    overflow-wrap: anywhere;
+  }
+  .plain {
+    white-space: pre-wrap;
+  }
+  /* A height clamp, not -webkit-line-clamp: that one does not reliably
+     clamp across block children, and a Markdown note is paragraphs and
+     lists. The fade says there is more */
+  .clamped {
+    max-height: calc(var(--lines) * 1.5em);
+    overflow: hidden;
+    mask-image: linear-gradient(to bottom, #000 70%, transparent);
+  }
+```
+- Update the comment at the top of the file to describe the height clamp.
+
+`NoteEditor.svelte`:
+- Pass `markdown` to `<ClampedText>`.
+- Under the textarea, before `.actions`, add
+  `<p class="hint muted">Markdown: # heading · - list · **bold** · *italic* · \`code\` · [link](https://…)</p>`
+  with `.hint { font-size: var(--t-sm); margin: 0.25rem 0 0; }`.
+
+- [ ] **Step 5: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/markdown.test.ts src/lib/ui && npm run check && npm run lint && npm test`
+Expected: PASS. `NoteEditor.test.ts` "never markup" passes unchanged.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add ui/src/lib/markdown.ts ui/src/lib/markdown.test.ts ui/src/lib/ui/Markdown.svelte ui/src/lib/ui/Markdown.test.ts ui/src/lib/ui/ClampedText.svelte ui/src/lib/ui/NoteEditor.svelte
+git commit -m "feat(ui): notes render a safe Markdown subset"
+```
+
+---
+
+### Task 8: Drag-and-drop uploads
+
+**Files:**
+- Create: `ui/src/lib/dropFiles.ts`, `ui/src/lib/dropFiles.test.ts`
+- Modify: `ui/src/app.css` (one `.dropping` rule)
+- Modify: `ui/src/lib/pages/AssetsPage.svelte` (`upload` around line 235; wrap the page content from `.pagehead` (line 297) through the `<FolderGroups>`)
+- Modify: `ui/src/lib/editor/MediaArgumentInput.svelte` (`pick` around line 74; the root `<div class="media">`)
+
+**Interfaces:**
+- Produces: `dropFiles: Action<HTMLElement, DropOptions>` with
+  `DropOptions = { ondrop: (files: File[]) => void; accept?: (file: File) => boolean; disabled?: boolean }`
+
+- [ ] **Step 1: Write the failing test**
+
+`ui/src/lib/dropFiles.test.ts`:
+```ts
+import { describe, expect, it, vi } from 'vitest'
+import { dropFiles } from './dropFiles'
+
+function dragEvent(type: string, files: File[]) {
+  const event = new Event(type, { bubbles: true, cancelable: true })
+  Object.defineProperty(event, 'dataTransfer', {
+    value: { types: ['Files'], files, dropEffect: 'none' },
+  })
+  return event
+}
+
+describe('dropFiles', () => {
+  it('hands over the accepted files and marks the target while dragging', () => {
+    const node = document.createElement('div')
+    const ondrop = vi.fn()
+    const png = new File(['x'], 'a.png', { type: 'image/png' })
+    const txt = new File(['x'], 'b.txt', { type: 'text/plain' })
+    const action = dropFiles(node, {
+      ondrop,
+      accept: (f) => f.type.startsWith('image/'),
+    })
+    node.dispatchEvent(dragEvent('dragenter', [png, txt]))
+    expect(node.classList.contains('dropping')).toBe(true)
+    const drop = dragEvent('drop', [png, txt])
+    node.dispatchEvent(drop)
+    expect(drop.defaultPrevented).toBe(true)
+    expect(ondrop).toHaveBeenCalledWith([png])
+    expect(node.classList.contains('dropping')).toBe(false)
+    action?.destroy?.()
+  })
+
+  it('ignores drops while disabled', () => {
+    const node = document.createElement('div')
+    const ondrop = vi.fn()
+    dropFiles(node, { ondrop, disabled: true })
+    node.dispatchEvent(dragEvent('drop', [new File(['x'], 'a.png')]))
+    expect(ondrop).not.toHaveBeenCalled()
+  })
+})
+```
+
+- [ ] **Step 2: Run it to see it fail**
+
+Run: `cd ui && npx vitest run src/lib/dropFiles.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/dropFiles.ts`:
+```ts
+/** Drop files from the desktop onto an element. A drag that carries no
+ * files (text, a link, a tile being dragged inside the page) is left alone
+ * so it keeps its native behaviour. `dropping` marks the element while
+ * files hover; enter/leave are counted because they fire for every child
+ * the pointer crosses. */
+import type { Action } from 'svelte/action'
+
+export interface DropOptions {
+  ondrop: (files: File[]) => void
+  accept?: (file: File) => boolean
+  disabled?: boolean
+}
+
+export const dropFiles: Action<HTMLElement, DropOptions> = (node, initial) => {
+  let options = initial
+  let depth = 0
+  const carriesFiles = (e: DragEvent) =>
+    !options.disabled &&
+    Array.from(e.dataTransfer?.types ?? []).includes('Files')
+  const clear = () => {
+    depth = 0
+    node.classList.remove('dropping')
+  }
+  const enter = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    depth++
+    node.classList.add('dropping')
+  }
+  const over = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'copy'
+  }
+  const leave = () => {
+    if (depth > 0 && --depth === 0) node.classList.remove('dropping')
+  }
+  const drop = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    clear()
+    const files = Array.from(e.dataTransfer?.files ?? []).filter(
+      (f) => options.accept?.(f) ?? true,
+    )
+    if (files.length) options.ondrop(files)
+  }
+  node.addEventListener('dragenter', enter)
+  node.addEventListener('dragover', over)
+  node.addEventListener('dragleave', leave)
+  node.addEventListener('drop', drop)
+  return {
+    update(next) {
+      options = next
+    },
+    destroy() {
+      node.removeEventListener('dragenter', enter)
+      node.removeEventListener('dragover', over)
+      node.removeEventListener('dragleave', leave)
+      node.removeEventListener('drop', drop)
+    },
+  }
+}
+```
+
+`ui/src/app.css`, near the other global utility rules:
+```css
+/* A drop target with files hovering over it (dropFiles.ts). Ink, not
+   --select: it is the pointer's place, not a selection */
+.dropping {
+  outline: 2px dashed var(--ink);
+  outline-offset: 4px;
+}
+```
+
+`AssetsPage.svelte`:
+- Split `upload(event)` into the input handler and `uploadFiles(files: File[])`:
+```ts
+  async function upload(event: Event) {
+    const input = event.target as HTMLInputElement
+    const files = Array.from(input.files ?? [])
+    // Clear it either way, so picking the same file twice still fires
+    input.value = ''
+    await uploadFiles(files)
+  }
+
+  // One file asks for its library name; a dropped batch keeps each file's
+  // own, since a prompt per file would be a dialog storm
+  async function uploadFiles(files: File[]) {
+    if (!files.length) return
+    let names: (string | undefined)[] = files.map(() => undefined)
+    if (files.length === 1) {
+      const assetName = window.prompt(
+        `Upload — name in the ${uploadTarget} asset library:`,
+        files[0].name,
+      )
+      if (assetName === null) return
+      names = [assetName || undefined]
+    }
+    busy = true
+    const failed: string[] = []
+    for (const [i, file] of files.entries()) {
+      try {
+        const result = await api.uploadMedia(
+          file,
+          names[i],
+          uploadTarget === 'shared',
+        )
+        if (files.length === 1)
+          notify.success(`Uploaded as ${result.reference ?? result.url}`)
+      } catch (e) {
+        failed.push(`${file.name}: ${e instanceof Error ? e.message : String(e)}`)
+      }
+    }
+    if (files.length > 1 && failed.length < files.length)
+      notify.success(`Uploaded ${files.length - failed.length} of ${files.length} files`)
+    if (failed.length) notify.error(failed.join('\n'))
+    busy = false
+    await load()
+  }
+```
+- Import `dropFiles`. Wrap the content from `<div class="pagehead">` through
+  the end of `<FolderGroups>…</FolderGroups>` in
+  `<div class="dropzone" use:dropFiles={{ ondrop: uploadFiles, disabled: busy }}>`.
+  Give it `.dropzone { min-height: 60vh; }` so an empty library is still a
+  target. Add `multiple` to the file `<input>` (line 314), since the handler
+  now takes several.
+
+`MediaArgumentInput.svelte`:
+- Split `pick` into the event handler and `uploadFile(file: File)`. The
+  handler reads `e.currentTarget.files?.[0]`, clears the input, and calls
+  `uploadFile(file)` when there is a file. The body after `if (!file) return`
+  moves into `uploadFile`.
+- On the root `<div class="media">` add
+  `use:dropFiles={{ ondrop: (files) => uploadFile(files[0]), accept: (f) => f.type.startsWith(`${kind}/`), disabled: uploading }}`.
+- Add to its title text: "or drop a file here".
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/dropFiles.test.ts src/lib/pages/AssetsPage.test.ts src/lib/editor/MediaArgumentInput.test.ts && npm run check && npm run lint && npm test`
+Expected: PASS. If an existing `AssetsPage.test.ts` upload test fires
+`change` with one file, it still works: one file still prompts.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/dropFiles.ts ui/src/lib/dropFiles.test.ts ui/src/app.css ui/src/lib/pages/AssetsPage.svelte ui/src/lib/editor/MediaArgumentInput.svelte
+git commit -m "feat(ui): drop files onto the assets page and media inputs to upload"
+```
+
+---
+
+### Task 9: Sidebar - hide workspaces, group by prefix
+
+The hidden list is **per browser** (`localStorage`). Workspaces are shared
+server state, and hiding one is a viewing preference, not a change to the
+workspace. The open workspace is always shown even if hidden, so you can't
+lose the page you're on. Workspace names cannot contain `/`
+(`^[a-zA-Z_][a-zA-Z0-9_-]*$`), so groups key on the part before the first
+`-`. A group forms only when at least 3 names share that prefix.
+
+**Files:**
+- Create: `ui/src/lib/wsGroups.ts`, `ui/src/lib/wsGroups.test.ts`
+- Create: `ui/src/lib/hiddenWorkspaces.svelte.ts`
+- Modify: `ui/src/lib/Sidebar.svelte` (the `{#each workspace.names …}` block, lines 144-200)
+- Modify: `ui/src/lib/Sidebar.test.ts`
+- Modify: `ui/src/lib/pages/OverviewPage.svelte` (Manage panel)
+
+**Interfaces:**
+- Produces: `type WsEntry = { kind: 'ws'; name: string } | { kind: 'group'; prefix: string; names: string[] }`;
+  `groupWorkspaces(names: readonly string[], opts: { hidden: readonly string[]; open: string; min?: number }): { entries: WsEntry[]; hidden: string[] }`
+- Produces: `hiddenWorkspaces: { names: string[] }` ($state),
+  `setHidden(name: string, hidden: boolean): void`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/wsGroups.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { groupWorkspaces } from './wsGroups'
+
+const names = [
+  'acorn-wars',
+  'regression-co',
+  'h3-quality',
+  'regression-mod',
+  'regression-smoke',
+  'sci0fi',
+]
+
+describe('groupWorkspaces', () => {
+  it('groups three or more names that share a prefix, where the first one stood', () => {
+    expect(groupWorkspaces(names, { hidden: [], open: 'h3-quality' })).toEqual({
+      entries: [
+        { kind: 'ws', name: 'acorn-wars' },
+        {
+          kind: 'group',
+          prefix: 'regression',
+          names: ['regression-co', 'regression-mod', 'regression-smoke'],
+        },
+        { kind: 'ws', name: 'h3-quality' },
+        { kind: 'ws', name: 'sci0fi' },
+      ],
+      hidden: [],
+    })
+  })
+  it('leaves hidden names out, except the open one', () => {
+    const r = groupWorkspaces(names, {
+      hidden: ['sci0fi', 'h3-quality'],
+      open: 'h3-quality',
+    })
+    expect(r.hidden).toEqual(['sci0fi'])
+    expect(r.entries).toContainEqual({ kind: 'ws', name: 'h3-quality' })
+    expect(r.entries).not.toContainEqual({ kind: 'ws', name: 'sci0fi' })
+  })
+  it('does not group a pair', () => {
+    const r = groupWorkspaces(['a-1', 'a-2', 'b'], { hidden: [], open: 'b' })
+    expect(r.entries.every((e) => e.kind === 'ws')).toBe(true)
+  })
+  it('hiding names can dissolve a group below the minimum', () => {
+    const r = groupWorkspaces(names, {
+      hidden: ['regression-co'],
+      open: 'h3-quality',
+    })
+    expect(r.entries.some((e) => e.kind === 'group')).toBe(false)
+  })
+})
+```
+
+Add to `Sidebar.test.ts`, following that file's existing setup for
+`workspace.names`:
+```ts
+it('folds a run of same-prefix workspaces into one group row', async () => {
+  workspace.names = ['regression-a', 'regression-b', 'regression-c', 'main']
+  workspace.current = 'main'
+  render(Sidebar, { props: { collapsed: false, onToggle: () => {} } })
+  const group = screen.getByRole('button', { name: /regression/ })
+  expect(group.getAttribute('aria-expanded')).toBe('false')
+  expect(screen.queryByText('regression-a')).toBeNull()
+  await fireEvent.click(group)
+  expect(screen.getByText('regression-a')).toBeTruthy()
+})
+```
+Use whatever props and state setup `Sidebar.test.ts` already uses. The names
+above are the only new part.
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/wsGroups.test.ts src/lib/Sidebar.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement**
+
+`ui/src/lib/wsGroups.ts`:
+```ts
+/** The sidebar's workspace list, folded: names that share a prefix (the
+ * part before the first '-') become one group row once there are `min` of
+ * them, at the place the first one stood; names this browser hid are left
+ * out. The open workspace is never hidden - hiding the page you are on
+ * would strand you. */
+export type WsEntry =
+  | { kind: 'ws'; name: string }
+  | { kind: 'group'; prefix: string; names: string[] }
+
+const prefixOf = (name: string) => {
+  const at = name.indexOf('-')
+  return at > 0 ? name.slice(0, at) : null
+}
+
+export function groupWorkspaces(
+  names: readonly string[],
+  {
+    hidden,
+    open,
+    min = 3,
+  }: { hidden: readonly string[]; open: string; min?: number },
+): { entries: WsEntry[]; hidden: string[] } {
+  const shown = names.filter((n) => n === open || !hidden.includes(n))
+  const counts = new Map<string, number>()
+  for (const n of shown) {
+    const p = prefixOf(n)
+    if (p) counts.set(p, (counts.get(p) ?? 0) + 1)
+  }
+  const entries: WsEntry[] = []
+  const groups = new Map<string, { kind: 'group'; prefix: string; names: string[] }>()
+  for (const n of shown) {
+    const p = prefixOf(n)
+    if (p && (counts.get(p) ?? 0) >= min) {
+      let group = groups.get(p)
+      if (!group) {
+        group = { kind: 'group', prefix: p, names: [] }
+        groups.set(p, group)
+        entries.push(group)
+      }
+      group.names.push(n)
+    } else entries.push({ kind: 'ws', name: n })
+  }
+  return {
+    entries,
+    hidden: names.filter((n) => n !== open && hidden.includes(n)),
+  }
+}
+```
+
+`ui/src/lib/hiddenWorkspaces.svelte.ts`:
+```ts
+/** Workspaces this browser keeps out of the sidebar - a viewing choice, so
+ * it is local, not a change to the workspace on the server. */
+import { storageGet, storageSet } from './storage'
+
+export const hiddenWorkspaces = $state({
+  names: storageGet<string[]>('hidden-workspaces', []),
+})
+
+export function setHidden(name: string, hidden: boolean): void {
+  const rest = hiddenWorkspaces.names.filter((n) => n !== name)
+  hiddenWorkspaces.names = hidden ? [...rest, name] : rest
+  storageSet('hidden-workspaces', hiddenWorkspaces.names)
+}
+```
+
+`Sidebar.svelte`:
+1. Pull the body of the existing `{#each … as name (name)}` (the
+   open-workspace `<div class="ws open">` branch and the shut `<a>` branch)
+   into a snippet `{#snippet wsRow(name: string)} … {/snippet}`, unchanged.
+2. Add these imports: `groupWorkspaces` from `./wsGroups`,
+   `hiddenWorkspaces` from `./hiddenWorkspaces.svelte`, `storageGet` and
+   `storageSet` from `./storage`, and `Eye` from `@lucide/svelte`.
+3. Add this state:
+```ts
+  const folded = $derived(
+    groupWorkspaces(workspace.names ?? [workspace.current], {
+      hidden: hiddenWorkspaces.names,
+      open: workspace.current,
+    }),
+  )
+  let openGroups = $state(storageGet<string[]>('open-ws-groups', []))
+  function toggleGroup(prefix: string) {
+    openGroups = openGroups.includes(prefix)
+      ? openGroups.filter((p) => p !== prefix)
+      : [...openGroups, prefix]
+    storageSet('open-ws-groups', openGroups)
+  }
+  let showHidden = $state(false)
+```
+4. Replace the `{#each}` with:
+```svelte
+      {#each folded.entries as entry (entry.kind === 'ws' ? entry.name : `group:${entry.prefix}`)}
+        {#if entry.kind === 'ws'}
+          {@render wsRow(entry.name)}
+        {:else}
+          {@const isOpen =
+            openGroups.includes(entry.prefix) ||
+            entry.names.includes(workspace.current)}
+          {#if collapsed}
+            {#each entry.names as name (name)}{@render wsRow(name)}{/each}
+          {:else}
+            <button
+              class="plain ws shut wsgroup"
+              aria-expanded={isOpen}
+              onclick={() => toggleGroup(entry.prefix)}
+              title="{entry.names.length} workspaces named {entry.prefix}-…"
+            >
+              {#if isOpen}<ChevronDown size={13} class="chev" />{:else}<ChevronRight
+                  size={13}
+                  class="chev"
+                />{/if}
+              <span class="name">{entry.prefix}-…</span>
+              <span class="num muted size">{entry.names.length}</span>
+            </button>
+            {#if isOpen}
+              <div class="groupkids">
+                {#each entry.names as name (name)}{@render wsRow(name)}{/each}
+              </div>
+            {/if}
+          {/if}
+        {/if}
+      {/each}
+      {#if folded.hidden.length && !collapsed}
+        <button
+          class="bare muted hiddentoggle"
+          aria-expanded={showHidden}
+          onclick={() => (showHidden = !showHidden)}
+          ><Eye size={13} />{folded.hidden.length} hidden</button
+        >
+        {#if showHidden}
+          <div class="groupkids dim">
+            {#each folded.hidden as name (name)}{@render wsRow(name)}{/each}
+          </div>
+        {/if}
+      {/if}
+```
+5. Styles:
+   `.groupkids { padding-left: var(--space-3); }`,
+   `.dim { opacity: 0.7; }` (check AA contrast against `--muted` in both
+   themes; if it fails, drop the opacity and rely on the label),
+   `.hiddentoggle { display: inline-flex; gap: 0.35rem; align-items: center; font-size: var(--t-sm); padding: var(--space-1) var(--space-2); }`,
+   and `.wsgroup { width: 100%; text-align: left; }`.
+
+`OverviewPage.svelte`, in the Manage panel, before the delete button:
+```svelte
+    <button
+      class="quiet withicon"
+      onclick={() => setHidden(name, !hiddenWorkspaces.names.includes(name))}
+      disabled={name === DEFAULT_WORKSPACE}
+      title="a choice for this browser only - the workspace itself is unchanged"
+    >
+      {#if hiddenWorkspaces.names.includes(name)}<Eye size={14} />Show in sidebar{:else}<EyeOff
+          size={14}
+        />Hide from sidebar{/if}
+    </button>
+```
+(import `Eye, EyeOff` and `hiddenWorkspaces, setHidden`).
+
+- [ ] **Step 4: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/wsGroups.test.ts src/lib/Sidebar.test.ts && npm run check && npm run lint && npm test`
+Expected: PASS (design-rules included: the group row uses no `--select`)
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add ui/src/lib/wsGroups.ts ui/src/lib/wsGroups.test.ts ui/src/lib/hiddenWorkspaces.svelte.ts ui/src/lib/Sidebar.svelte ui/src/lib/Sidebar.test.ts ui/src/lib/pages/OverviewPage.svelte
+git commit -m "feat(ui): group same-prefix workspaces in the sidebar; hide workspaces per browser"
+```
+
+---
+
+## Phase C - server and UI
+
+### Task 10: Star outputs
+
+Stars are saved in the run's existing `notes.json` as `"starred": [names]`.
+That file is already the server-only sidecar for that run's per-file data,
+and it already travels with the run. `read_notes` keeps its current return
+shape, because existing tests compare it exactly. Stars get their own reader,
+and the shared write path keeps both kinds of data.
+
+**Files:**
+- Modify: `dw/notes.py`
+- Modify: `dw/server/routes/media.py` (a `StarRequest` model and a `put_star` route next to `put_note`)
+- Modify: `dw/server/routes/gallery.py` (listing, lines ~124-131)
+- Modify: `dw/server/api_models.py` (`GalleryFile.starred`, new `StarSet`)
+- Create: `tests/test_stars.py`
+- Modify: `docs/SERVER.md` (notes section, ~line 804)
+- Regenerate: `ui/src/lib/generated/openapi.json`, `api-schema.ts`
+- Modify: `ui/src/lib/types.ts` (`StarSet`), `ui/src/lib/api.ts` (`setStarred`)
+- Modify: `ui/src/lib/gallery/GalleryDetail.svelte`, `ui/src/lib/pages/GalleryPage.svelte` (+ test), `ui/src/lib/KeyboardHelp.svelte`
+
+**Interfaces:**
+- Produces (Python): `read_starred(directory) -> set[str]`,
+  `set_file_starred(directory, name, starred: bool) -> bool`. The
+  `drop_file_note(directory, name)` function now also clears the star.
+- Produces (HTTP): `PUT /api/stars` with body `{name: str, starred: bool}`,
+  returning `{name, starred}`. A run directory or a `workspace:`/`asset:`
+  target gets 400; a flat-layout file gets 409.
+- Produces (TS): `api.setStarred(name: string, starred: boolean): Promise<StarSet>`.
+  `GalleryFile.starred?: boolean`.
+
+- [ ] **Step 1: Write the failing server tests**
+
+`tests/test_stars.py`:
+```python
+"""Stars: the "keep" mark on an output file, in the run's notes.json beside
+its notes (dw/notes.py), set through PUT /api/stars and carried on the
+gallery listing."""
+
+from dw import notes as N
+
+from .test_notes_api import (  # noqa: F401 - fixtures
+    client,
+    make_run,
+    output_root,
+    run_name,
+    studio,
+)
+
+
+def test_star_round_trip_keeps_notes(tmp_path):
+    N.set_file_note(str(tmp_path), "a.png", "keeper")
+    assert N.set_file_starred(str(tmp_path), "a.png", True) is True
+    assert N.read_starred(str(tmp_path)) == {"a.png"}
+    # A note written after the star leaves it, and the other way round
+    N.set_run_note(str(tmp_path), "run note")
+    assert N.read_starred(str(tmp_path)) == {"a.png"}
+    assert N.read_notes(str(tmp_path))["files"] == {"a.png": "keeper"}
+
+
+def test_unstarring_the_last_file_with_no_notes_removes_the_sidecar(tmp_path):
+    N.set_file_starred(str(tmp_path), "a.png", True)
+    N.set_file_starred(str(tmp_path), "a.png", False)
+    assert not (tmp_path / N.NOTES_FILE_NAME).exists()
+
+
+def test_dropping_a_file_drops_its_star(tmp_path):
+    N.set_file_starred(str(tmp_path), "a.png", True)
+    N.drop_file_note(str(tmp_path), "a.png")
+    assert N.read_starred(str(tmp_path)) == set()
+
+
+def test_put_star_and_the_listing_carries_it(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png", "b.png"])
+    run = run_name(run_dir, output_root)
+    r = client.put("/api/stars", json={"name": f"{run}/a.png", "starred": True})
+    assert r.status_code == 200
+    assert r.json() == {"name": f"{run}/a.png", "starred": True}
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["starred"] is True
+    assert "starred" not in files["b.png"]
+    client.put("/api/stars", json={"name": f"{run}/a.png", "starred": False})
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert "starred" not in files["a.png"]
+
+
+def test_only_an_output_file_can_be_starred(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    for name in (run, "workspace:default", "asset:x.png"):
+        r = client.put("/api/stars", json={"name": name, "starred": True})
+        assert r.status_code == 400, name
+
+
+def test_put_star_refuses_traversal(client):
+    r = client.put("/api/stars", json={"name": "../../etc/passwd", "starred": True})
+    assert r.status_code in (400, 404)
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `pytest tests/test_stars.py -v -p no:xdist`
+Expected: FAIL (`set_file_starred` is not defined; the route returns 404/405)
+
+- [ ] **Step 3: Implement the store (`dw/notes.py`)**
+
+Update the module docstring's `notes.json` bullet to:
+`{"run": ..., "files": {...}, "starred": [<name>, ...]}` - starred is the
+"keep" mark on an output file.
+
+Replace `_store` and `_update`, and update the callers:
+```python
+def read_starred(directory):
+    """The names starred in `directory`'s notes.json, as a set."""
+    starred = _read_json(os.path.join(directory, NOTES_FILE_NAME)).get("starred")
+    if not isinstance(starred, list):
+        return set()
+    return {name for name in starred if isinstance(name, str)}
+
+
+def _store(directory, notes, starred):
+    path = os.path.join(directory, NOTES_FILE_NAME)
+    if notes["run"] is None and not notes["files"] and not starred:
+        try:
+            os.remove(path)
+        except FileNotFoundError:
+            pass
+        return
+    data = {k: v for k, v in notes.items() if v}
+    if starred:
+        data["starred"] = sorted(starred)
+    write_json_atomic(path, data)
+
+
+def _update(directory, change):
+    """Read, change and write notes.json under its lock. `change` gets the
+    notes and the starred set and edits them in place - both, so a write of
+    one never drops the other."""
+    with _lock(directory):
+        notes = read_notes(directory)
+        starred = read_starred(directory)
+        change(notes, starred)
+        _store(directory, notes, starred)
+```
+`set_run_note` becomes
+`_update(directory, lambda notes, _starred: notes.__setitem__("run", note))`.
+`set_file_note`'s inner `change` becomes `def change(notes, _starred):`.
+Add:
+```python
+def set_file_starred(directory, name, starred):
+    starred = bool(starred)
+
+    def change(_notes, names):
+        if starred:
+            names.add(name)
+        else:
+            names.discard(name)
+
+    _update(directory, change)
+    return starred
+
+
+def drop_file_note(directory, name):
+    """Forget a deleted file: its note and its star."""
+    if os.path.exists(os.path.join(directory, NOTES_FILE_NAME)):
+
+        def change(notes, names):
+            notes["files"].pop(name, None)
+            names.discard(name)
+
+        _update(directory, change)
+```
+(this replaces the old `drop_file_note`).
+
+- [ ] **Step 4: Implement the route, model and listing**
+
+`dw/server/api_models.py`:
+- In `GalleryFile`, after `note`, add:
+  `starred: bool = sometimes("True when the file is starred; absent otherwise.")`
+- Next to `NoteSet`, add:
+```python
+class StarSet(ApiModel):
+    name: str
+    starred: bool
+```
+
+`dw/server/routes/media.py`, after `put_note`:
+```python
+class StarRequest(BaseModel):
+    name: str = Field(description="A gallery file name")
+    starred: bool
+
+
+@router.put("/api/stars", response_model=StarSet)
+def put_star(
+    request: Request, body: StarRequest, ws: Workspace = Depends(selected_workspace)
+):
+    """Star or unstar one output file - the "keep" mark a person culls a run
+    with. It lives in the run's notes.json beside the notes, so it is
+    resolved exactly as a file note is, and only a file in a run directory
+    can carry one."""
+    if is_ref(WORKSPACE, body.name) or is_asset_reference(body.name):
+        raise HTTPException(status_code=400, detail="Only an output file can be starred")
+    directory, name, kind = resolve_note_target(request.app.state, ws, body.name)
+    if kind != "file":
+        raise HTTPException(status_code=400, detail="Only an output file can be starred")
+    try:
+        starred = set_file_starred(directory, name, body.starred)
+    except OSError:
+        raise internal_error(f"Could not write the star on {body.name!r}")
+    return {"name": body.name, "starred": starred}
+```
+Import `set_file_starred` with the other `..notes` imports and `StarSet` with
+the other `..api_models` imports. These have to be added to existing import
+lists in that file, so check them.
+
+`dw/server/routes/gallery.py`: import `read_starred`. Next to `notes_by_run`,
+add `starred_by_run = {}`. In the `if split:` block:
+```python
+            if split[0] not in starred_by_run:
+                starred_by_run[split[0]] = read_starred(split[0])
+            if split[1] in starred_by_run[split[0]]:
+                entry["starred"] = True
+```
+Find where `notes_by_run = {}` is set and add `starred_by_run = {}` next to it.
+
+`docs/SERVER.md`, after the notes paragraph (~line 807):
+```markdown
+`PUT /api/stars` with `{"name": <gallery file name>, "starred": true|false}`
+stars or unstars one output file - the "keep" mark for culling a run. A star
+is stored in the run's `notes.json` (`"starred": [...]`) beside its notes, and
+the gallery listing carries `"starred": true` on a starred file. Only a file
+in a run directory can be starred; a run, asset or workspace target is a 400.
+```
+
+- [ ] **Step 5: Run the server tests**
+
+Run: `pytest tests/test_stars.py tests/test_notes.py tests/test_notes_api.py tests/test_notes_bookkeeping.py -v -p no:xdist`
+Expected: PASS
+
+- [ ] **Step 6: Regenerate the UI types**
+
+Run: `python scripts/dump_openapi.py && cd ui && npm run gen:api`
+Expected: `openapi.json` and `api-schema.ts` now contain `StarSet` and `GalleryFile.starred`.
+
+- [ ] **Step 7: Write the failing UI test**
+
+In `GalleryPage.test.ts`, add `setStarred` to the mocked `api` object, using
+the file's `vi.hoisted` pattern:
+`const setStarred = vi.hoisted(() => vi.fn((name: string, starred: boolean) => Promise.resolve({ name, starred })))`.
+Then add:
+```ts
+it('stars the open file and can filter to starred files', async () => {
+  render(GalleryPage)
+  await openFile('a.png')
+  await fireEvent.click(screen.getByRole('button', { name: 'star this file' }))
+  expect(setStarred).toHaveBeenCalledWith('a.png', true)
+  await fireEvent.click(screen.getByRole('button', { name: 'Starred' }))
+  expect(screen.queryByTitle('b.png')).toBeNull()
+})
+```
+
+Run: `cd ui && npx vitest run src/lib/pages/GalleryPage.test.ts`
+Expected: FAIL
+
+- [ ] **Step 8: Implement the UI**
+
+`types.ts`: `export type StarSet = Schemas['StarSet']`.
+
+`api.ts`, after `deleteOutput`:
+```ts
+  setStarred: (name: string, starred: boolean) =>
+    request<StarSet>('/api/stars', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name, starred }),
+    }),
+```
+(import the `StarSet` type.)
+
+`GalleryDetail.svelte`:
+- Add the props `starred: boolean` and `onstar: () => void`.
+- Import `Star`.
+- Before the delete button, add:
+```svelte
+    <button
+      class="quiet icon"
+      onclick={onstar}
+      aria-pressed={starred}
+      aria-label={starred ? 'unstar this file' : 'star this file'}
+      title={starred ? 'starred - press S to unstar' : 'star to keep - press S'}
+      ><Star size={14} fill={starred ? 'currentColor' : 'none'} /></button
+    >
+```
+
+`GalleryPage.svelte`:
+- Add state `let starredOnly = $state(false)`.
+- `filterActive` adds `|| starredOnly`.
+- `visible`'s filter adds `&& (!starredOnly || f.starred)`.
+- Add:
+```ts
+  async function toggleStar() {
+    if (!selected) return
+    const name = selected.name
+    const next = !selected.starred
+    try {
+      await api.setStarred(name, next)
+      files = files.map((f) => (f.name === name ? { ...f, starred: next } : f))
+      if (selected?.name === name) selected = { ...selected, starred: next }
+    } catch (e) {
+      notify.error(e instanceof Error ? e.message : String(e))
+    }
+  }
+```
+- In the keydown handler, after the arrow branch, add
+  `else if (e.key === 's' && !e.metaKey && !e.ctrlKey) { e.preventDefault(); void toggleStar() }`.
+- Pass `starred={!!selected.starred}` and `onstar={toggleStar}` to `<GalleryDetail>`.
+- After the role chips, add
+  `<button class="rolechip" class:on={starredOnly} aria-pressed={starredOnly} onclick={() => (starredOnly = !starredOnly)} title="only the files you starred">Starred</button>`.
+- On the tile, next to the note marker (`aria-label="Has a note"`), add
+  `{#if file.starred}<span class="badge" aria-label="Starred"><Star size={11} fill="currentColor" /></span>{/if}`,
+  copying the note marker's classes.
+
+`KeyboardHelp.svelte`: add
+`<dt><kbd>S</kbd></dt><dd>star / unstar the open file (gallery details)</dd>`.
+
+- [ ] **Step 9: Run all checks**
+
+Run: `cd ui && npm run check && npm run lint && npm test && cd .. && pytest tests/ -v`
+Expected: PASS
+
+- [ ] **Step 10: Commit**
+
+```bash
+git add dw/notes.py dw/server/routes/media.py dw/server/routes/gallery.py dw/server/api_models.py tests/test_stars.py docs/SERVER.md ui/src/lib/generated ui/src/lib/types.ts ui/src/lib/api.ts ui/src/lib/gallery/GalleryDetail.svelte ui/src/lib/pages/GalleryPage.svelte ui/src/lib/pages/GalleryPage.test.ts ui/src/lib/KeyboardHelp.svelte
+git commit -m "feat: star output files to keep them; gallery filters to starred"
+```
+
+---
+
+### Task 11: Rerun lineage
+
+**Files:**
+- Modify: `dw/server/jobs.py` (`submit` param plus spec around line 320; `rerun` passes it, ~line 545)
+- Modify: `dw/server/job_record.py` (`__init__` around line 94; `summary()`)
+- Modify: `dw/server/job_history.py` (migration, `record`, `recent_summaries`, `get`, `_to_detail`)
+- Modify: `dw/server/api_models.py` (`JobSummary.rerun_of`)
+- Create: `tests/test_rerun_lineage.py`
+- Regenerate: UI types
+- Modify: `ui/src/lib/pages/JobsPage.svelte`, `ui/src/lib/job/JobHeader.svelte`
+
+**Interfaces:**
+- Produces: `JobSummary.rerun_of?: string`, which `JobDetail` inherits. It is
+  present only on a rerun and is kept in history.
+
+- [ ] **Step 1: Write the failing tests**
+
+`tests/test_rerun_lineage.py`:
+```python
+"""A rerun names the job it reran (`rerun_of`), live and from history."""
+
+import sqlite3
+
+from fastapi.testclient import TestClient
+
+from dw.server.app import create_app
+from dw.server.job_history import JobHistory
+from dw.server.jobs import JobManager
+
+from .test_server import ScriptedWorkerManager, success_script, valid_workflow
+from .test_server import wait_for_status
+
+
+def make_client(tmp_path):
+    (tmp_path / "workflows").mkdir(exist_ok=True)
+    manager = JobManager(
+        str(tmp_path / "outputs"),
+        worker_manager=ScriptedWorkerManager(success_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+    )
+    app = create_app(
+        workflow_dir=str(tmp_path / "workflows"),
+        output_dir=str(tmp_path / "outputs"),
+        job_manager=manager,
+    )
+    return TestClient(app, base_url="http://localhost")
+
+
+def run_and_rerun(client):
+    original = client.post(
+        "/api/jobs", json={"workflow": valid_workflow("lineage"), "arguments": {}}
+    ).json()["id"]
+    wait_for_status(client, original, ["succeeded"])
+    rerun = client.post(f"/api/jobs/{original}/rerun").json()["id"]
+    wait_for_status(client, rerun, ["succeeded"])
+    return original, rerun
+
+
+def test_a_rerun_names_the_job_it_reran(tmp_path):
+    with make_client(tmp_path) as client:
+        original, rerun = run_and_rerun(client)
+        assert client.get(f"/api/jobs/{rerun}").json()["rerun_of"] == original
+        assert "rerun_of" not in client.get(f"/api/jobs/{original}").json()
+        listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+        assert listed[rerun]["rerun_of"] == original
+
+
+def test_the_lineage_survives_a_restart(tmp_path):
+    with make_client(tmp_path) as client:
+        original, rerun = run_and_rerun(client)
+    with make_client(tmp_path) as client:
+        assert client.get(f"/api/jobs/{rerun}").json()["rerun_of"] == original
+        listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+        assert listed[rerun]["rerun_of"] == original
+
+
+def test_an_older_history_database_gains_the_column(tmp_path):
+    path = tmp_path / "old.sqlite"
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE jobs (id TEXT PRIMARY KEY, workflow TEXT, status TEXT,"
+            " created_at REAL, started_at REAL, finished_at REAL, arguments TEXT,"
+            " spec TEXT, manifest TEXT, warnings TEXT, error TEXT)"
+        )
+    JobHistory(path)
+    with sqlite3.connect(path) as connection:
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
+    assert "rerun_of" in columns
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `pytest tests/test_rerun_lineage.py -v -p no:xdist`
+Expected: FAIL (KeyError `rerun_of`, and the column is missing)
+
+- [ ] **Step 3: Implement**
+
+`dw/server/jobs.py`:
+- `submit` gains a keyword parameter `rerun_of=None`. Document it in the
+  docstring: "the job this one reruns, recorded so the list can say so".
+- After `if note: spec["note"] = note`, add
+  `if rerun_of: spec["rerun_of"] = rerun_of`.
+- In `rerun`, pass `rerun_of=job_id` to `self.submit(...)`.
+
+`dw/server/job_record.py`:
+- In `__init__`, after `self.note = spec.get("note")`, add
+  `self.rerun_of = spec.get("rerun_of")`.
+- In `summary()`, after the `note` entry, add
+  `**({"rerun_of": self.rerun_of} if self.rerun_of else {}),`.
+
+`dw/server/job_history.py`:
+- Migration, after the `note` column block:
+```python
+            # The job a rerun reran. NULL for a fresh submit and for every
+            # row before the column
+            if "rerun_of" not in columns:
+                connection.execute("ALTER TABLE jobs ADD COLUMN rerun_of TEXT")
+```
+- `record`: add `rerun_of` to the end of the column list, add one more `?`
+  (25 in total), and add `getattr(job, "rerun_of", None),` as the last tuple
+  value.
+- `recent_summaries`: append `, rerun_of` after the `CASE … END` expression
+  in the SELECT, so it is `row[15]`. In the dict, add
+  `**({"rerun_of": row[15]} if row[15] else {}),`.
+- `get`: append `, rerun_of` after `note` in the SELECT (`row[20]`). In
+  `_to_detail`, add `**({"rerun_of": row[20]} if row[20] else {}),`.
+
+`dw/server/api_models.py`, in `JobSummary` after `note`:
+`rerun_of: str = sometimes("The job this one reran; absent for a job submitted fresh.")`
+
+- [ ] **Step 4: Run the server tests**
+
+Run: `pytest tests/test_rerun_lineage.py tests/test_rerun_new_seed.py tests/test_server_jobs.py tests/test_job_history_device.py -v -p no:xdist`
+Expected: PASS
+
+- [ ] **Step 5: Regenerate the UI types and show the lineage**
+
+Run: `python scripts/dump_openapi.py && cd ui && npm run gen:api`
+
+`JobsPage.svelte`, after the `run_version` chip:
+```svelte
+          {#if job.rerun_of}
+            <span class="wschip muted" title="a rerun of {job.rerun_of}"
+              >rerun</span
+            >
+          {/if}
+```
+(the row is itself an `<a>`, so the chip is not a link.)
+
+`JobHeader.svelte`: next to the job id / `CopyButton` in the title row, add:
+```svelte
+    {#if job?.rerun_of}
+      <span class="muted"
+        >rerun of <a class="plain" href={wsHref(job.workspace, 'jobs', job.rerun_of)}
+          ><code>{job.rerun_of}</code></a
+        ></span
+      >
+    {/if}
+```
+
+Add to `JobsPage.test.ts`, following its existing listing mock:
+```ts
+it('marks a rerun', async () => {
+  // a job in the mocked listing with rerun_of: 'abc'
+  ...render as the other tests do...
+  expect(screen.getByTitle('a rerun of abc')).toBeTruthy()
+})
+```
+Fill in the setup by copying the nearest existing test in that file. The only
+new part is the extra `rerun_of: 'abc'` field on one listed job.
+
+- [ ] **Step 6: Run all checks**
+
+Run: `cd ui && npm run check && npm run lint && npm test && cd .. && pytest tests/ -v`
+Expected: PASS
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add dw/server/jobs.py dw/server/job_record.py dw/server/job_history.py dw/server/api_models.py tests/test_rerun_lineage.py ui/src/lib/generated ui/src/lib/pages/JobsPage.svelte ui/src/lib/pages/JobsPage.test.ts ui/src/lib/job/JobHeader.svelte
+git commit -m "feat: a rerun records and shows the job it reran"
+```
+
+---
+
+### Task 12: Compare view
+
+Pick 2–4 files in the gallery, then click **Compare**. They show side by side,
+each with its version, model, seed, run time and note. Below the grid, a
+"What differs" table lists only the arguments whose values differ between the
+files. Videos play, pause and scrub together from one control.
+
+**Files:**
+- Create: `ui/src/lib/compare.ts`, `ui/src/lib/compare.test.ts`
+- Create: `ui/src/lib/pages/ComparePage.svelte`, `ui/src/lib/pages/ComparePage.test.ts`
+- Modify: `ui/src/lib/routes.ts` (`WS_SECTIONS` adds `'compare'`)
+- Modify: `ui/src/App.svelte` (route branch)
+- Modify: `ui/src/lib/BulkBar.svelte` (optional `oncompare`)
+- Modify: `ui/src/lib/pages/GalleryPage.svelte` (pass `oncompare`)
+
+**Interfaces:**
+- Consumes: `api.gallery()`, `api.galleryMetadata(name)` (which returns
+  `{ metadata, job, ... }`), `api.getJob(id)`, `describeOutputMeta`,
+  `formatDuration`
+- Produces: `differingArguments(metas: (Record<string, unknown> | null)[]): string[]`,
+  `argumentOf(meta: Record<string, unknown> | null, key: string): unknown`,
+  `valueText(value: unknown): string`, `COMPARE_MAX = 4`
+
+- [ ] **Step 1: Write the failing tests**
+
+`ui/src/lib/compare.test.ts`:
+```ts
+import { describe, expect, it } from 'vitest'
+import { argumentOf, differingArguments, valueText } from './compare'
+
+const meta = (args: Record<string, unknown>, extra = {}) => ({
+  arguments: args,
+  ...extra,
+})
+
+describe('differingArguments', () => {
+  it('lists only the keys whose values differ, model and seed first', () => {
+    expect(
+      differingArguments([
+        meta({ prompt: 'a', steps: 12, width: 1344 }, { model_name: 'h3', seed: 1 }),
+        meta({ prompt: 'a', steps: 30, width: 1344 }, { model_name: 'h3', seed: 2 }),
+      ]),
+    ).toEqual(['seed', 'steps'])
+  })
+  it('a key one side lacks is a difference', () => {
+    expect(
+      differingArguments([meta({ lora: 'x' }), meta({})]),
+    ).toEqual(['lora'])
+  })
+  it('compares structured values by content', () => {
+    expect(
+      differingArguments([meta({ q: { a: 1 } }), meta({ q: { a: 1 } })]),
+    ).toEqual([])
+  })
+  it('missing metadata counts as unknown, not as different', () => {
+    expect(differingArguments([meta({ steps: 1 }), null])).toEqual([])
+  })
+})
+
+describe('argumentOf / valueText', () => {
+  it('reads model and seed from the top level, the rest from arguments', () => {
+    const m = meta({ steps: 12 }, { model_name: 'h3', seed: 9 })
+    expect(argumentOf(m, 'model')).toBe('h3')
+    expect(argumentOf(m, 'seed')).toBe(9)
+    expect(argumentOf(m, 'steps')).toBe(12)
+  })
+  it('prints strings bare, the rest as JSON, cut long', () => {
+    expect(valueText('a cat')).toBe('a cat')
+    expect(valueText({ a: 1 })).toBe('{"a":1}')
+    expect(valueText(undefined)).toBe('—')
+    expect(valueText('x'.repeat(300))).toHaveLength(201)
+  })
+})
+```
+
+`ui/src/lib/pages/ComparePage.test.ts`:
+```ts
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const file = (name: string, kind = 'image') => ({
+  name,
+  label: name.split('/').pop(),
+  kind,
+  url: `/outputs/${name}`,
+  folder: 'wf',
+  subfolder: '',
+  run_id: 'r',
+  size: 1,
+  mtime: 1,
+})
+
+vi.mock('../api', () => ({
+  api: {
+    gallery: () =>
+      Promise.resolve({ files: [file('wf/r1/a.png'), file('wf/r2/b.png')] }),
+    galleryMetadata: (name: string) =>
+      Promise.resolve({
+        metadata: {
+          model_name: 'h3',
+          seed: name.includes('a') ? 1 : 2,
+          arguments: { steps: 12 },
+        },
+        job: null,
+      }),
+    galleryThumbnailUrl: (n: string) => `/thumb/${n}`,
+    getJob: () => Promise.reject(new Error('none')),
+  },
+}))
+
+import ComparePage from './ComparePage.svelte'
+
+describe('ComparePage', () => {
+  afterEach(cleanup)
+  it('shows each file and only the argument that differs', async () => {
+    render(ComparePage, { props: { names: ['wf/r1/a.png', 'wf/r2/b.png'] } })
+    expect(await screen.findByAltText('wf/r1/a.png')).toBeTruthy()
+    expect(await screen.findByRole('rowheader', { name: 'seed' })).toBeTruthy()
+    expect(screen.queryByRole('rowheader', { name: 'steps' })).toBeNull()
+  })
+  it('says when a file is gone', async () => {
+    render(ComparePage, { props: { names: ['wf/r1/a.png', 'wf/gone.png'] } })
+    expect(await screen.findByText(/no longer in the gallery/)).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run them to see them fail**
+
+Run: `cd ui && npx vitest run src/lib/compare.test.ts src/lib/pages/ComparePage.test.ts`
+Expected: FAIL
+
+- [ ] **Step 3: Implement the logic**
+
+`ui/src/lib/compare.ts`:
+```ts
+/** What a side-by-side compare reads off each file's metadata: the
+ * arguments that actually differ between the files. The rest are shared and
+ * would only bury the one change the comparison is about. */
+
+export const COMPARE_MAX = 4
+
+type Meta = Record<string, unknown> | null
+
+export function argumentOf(meta: Meta, key: string): unknown {
+  if (!meta) return undefined
+  if (key === 'model') return meta.model_name
+  if (key === 'seed')
+    return meta.seed ?? (meta.arguments as Record<string, unknown>)?.seed
+  return (meta.arguments as Record<string, unknown> | undefined)?.[key]
+}
+
+const same = (a: unknown, b: unknown) => JSON.stringify(a) === JSON.stringify(b)
+
+/** Keys that differ across the files that have metadata - model and seed
+ * first, then the arguments alphabetically. A file whose metadata could
+ * not be read is unknown, not different. */
+export function differingArguments(metas: Meta[]): string[] {
+  const known = metas.filter((m): m is Record<string, unknown> => !!m)
+  if (known.length < 2) return []
+  const keys = new Set<string>()
+  for (const m of known)
+    for (const k of Object.keys((m.arguments as object) ?? {})) keys.add(k)
+  keys.delete('seed')
+  const ordered = ['model', 'seed', ...[...keys].sort()]
+  return ordered.filter((key) => {
+    const first = argumentOf(known[0], key)
+    return known.some((m) => !same(argumentOf(m, key), first))
+  })
+}
+
+export function valueText(value: unknown): string {
+  if (value === undefined || value === null) return '—'
+  const text = typeof value === 'string' ? value : JSON.stringify(value)
+  return text.length > 200 ? `${text.slice(0, 200)}…` : text
+}
+```
+
+- [ ] **Step 4: Implement the page, the route and the action**
+
+`routes.ts`: add `'compare'` to `WS_SECTIONS`, after `'gallery'`.
+`WS_ITEMS` in `Sidebar.svelte` is a separate list, so no nav item appears.
+
+`App.svelte`: import `ComparePage` and add, beside the gallery branch:
+`{:else if view.section === 'compare'}<ComparePage names={view.rest} />`
+
+`BulkBar.svelte`:
+- Add the optional prop `oncompare?: () => void`.
+- Import `Columns2` and `COMPARE_MAX`.
+- Before the download button, add:
+```svelte
+    {#if oncompare}
+      <button
+        class="quiet icon"
+        onclick={oncompare}
+        disabled={busy || picks.size < 2 || picks.size > COMPARE_MAX}
+        title={picks.size > COMPARE_MAX
+          ? `compare up to ${COMPARE_MAX} at a time`
+          : 'compare the selected side by side'}
+        aria-label="compare the selected {noun}s side by side"
+      >
+        <Columns2 size={14} />
+      </button>
+    {/if}
+```
+
+`GalleryPage.svelte`: import `go` from `'../router.svelte'` and `workspace`
+from `'../workspace.svelte'` (check which are already imported). Pass
+`oncompare={() => go('ws', workspace.current, 'compare', ...picks.names)}`
+to `<BulkBar>`.
+
+`ui/src/lib/pages/ComparePage.svelte`:
+```svelte
+<script lang="ts">
+  // Two to four outputs side by side - the seed sweep, the int4 vs int8
+  // pair, the 12 vs 30 steps - with the arguments that differ called out
+  // and every video on one transport, so a difference in motion is seen at
+  // the same frame rather than remembered across two players
+  import { Pause, Play } from '@lucide/svelte'
+  import { api } from '../api'
+  import { differingArguments, argumentOf, valueText } from '../compare'
+  import { formatDuration } from '../format'
+  import { wsHref } from '../routes'
+  import type { GalleryFile } from '../types'
+  import { workspace } from '../workspace.svelte'
+
+  let { names }: { names: string[] } = $props()
+
+  type Cell = {
+    name: string
+    file: GalleryFile | null
+    meta: Record<string, unknown> | null
+    took: number | null
+  }
+  let cells = $state<Cell[]>([])
+  let loaded = $state(false)
+
+  $effect(() => {
+    const wanted = [...names]
+    loaded = false
+    void api
+      .gallery()
+      .then(async ({ files }) => {
+        const byName = new Map(files.map((f) => [f.name, f]))
+        cells = await Promise.all(
+          wanted.map(async (name) => {
+            const file = byName.get(name) ?? null
+            if (!file) return { name, file, meta: null, took: null }
+            const r = await api.galleryMetadata(name).catch(() => null)
+            const job = r?.job ? await api.getJob(r.job).catch(() => null) : null
+            const took =
+              job?.started_at && job.finished_at
+                ? job.finished_at - job.started_at
+                : null
+            return {
+              name,
+              file,
+              meta: (r?.metadata as Record<string, unknown>) ?? null,
+              took,
+            }
+          }),
+        )
+      })
+      .finally(() => (loaded = true))
+  })
+
+  const differing = $derived(differingArguments(cells.map((c) => c.meta)))
+
+  // One transport for every video: the first is the clock the slider reads
+  let videos = $state<HTMLVideoElement[]>([])
+  let playing = $state(false)
+  let time = $state(0)
+  let length = $state(0)
+  const present = () => videos.filter(Boolean)
+  function playPause() {
+    playing = !playing
+    for (const v of present()) void (playing ? v.play() : v.pause())
+  }
+  function seek(to: number) {
+    time = to
+    for (const v of present()) v.currentTime = to
+  }
+</script>
+
+<div class="pagehead baseline">
+  <h1>Compare</h1>
+  <a class="plain muted" href={wsHref(workspace.current, 'gallery')}>back to the gallery</a>
+</div>
+
+{#if !loaded}
+  <p class="muted">loading…</p>
+{:else}
+  {#if cells.some((c) => c.file?.kind === 'video')}
+    <div class="transport">
+      <button class="quiet icon" onclick={playPause} aria-label={playing ? 'pause all' : 'play all'}>
+        {#if playing}<Pause size={14} />{:else}<Play size={14} />{/if}
+      </button>
+      <input
+        type="range"
+        min="0"
+        max={length || 0}
+        step="0.01"
+        value={time}
+        oninput={(e) => seek(Number(e.currentTarget.value))}
+        aria-label="position in every video"
+      />
+      <span class="num muted">{time.toFixed(2)} s</span>
+    </div>
+  {/if}
+
+  <div class="grid" style:--cols={cells.length}>
+    {#each cells as cell, i (cell.name)}
+      <figure class="cell">
+        {#if !cell.file}
+          <p class="muted">{cell.name} is no longer in the gallery.</p>
+        {:else if cell.file.kind === 'video'}
+          <!-- svelte-ignore a11y_media_has_caption -->
+          <video
+            bind:this={videos[i]}
+            src={cell.file.url}
+            loop
+            muted
+            playsinline
+            ontimeupdate={(e) => {
+              if (i === 0) time = e.currentTarget.currentTime
+            }}
+            onloadedmetadata={(e) => {
+              length = Math.max(length, e.currentTarget.duration)
+            }}
+          ></video>
+        {:else if cell.file.kind === 'image'}
+          <img src={cell.file.url} alt={cell.name} />
+        {:else}
+          <p class="muted">{cell.file.label}</p>
+        {/if}
+        {#if cell.file}
+          <figcaption>
+            <span class="mono">{cell.file.label}</span>
+            {#if cell.file.version}<span class="num muted">v{cell.file.version}</span>{/if}
+            <span class="num muted">
+              {valueText(argumentOf(cell.meta, 'model'))} · seed {valueText(
+                argumentOf(cell.meta, 'seed'),
+              )}{cell.took !== null ? ` · ${formatDuration(cell.took)}` : ''}
+            </span>
+            {#if cell.file.note}<span class="note">{cell.file.note}</span>{/if}
+          </figcaption>
+        {/if}
+      </figure>
+    {/each}
+  </div>
+
+  {#if differing.length}
+    <section class="panel">
+      <h2>What differs</h2>
+      <table>
+        <tbody>
+          {#each differing as key (key)}
+            <tr>
+              <th scope="row">{key}</th>
+              {#each cells as cell (cell.name)}
+                <td class="mono">{valueText(argumentOf(cell.meta, key))}</td>
+              {/each}
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+    </section>
+  {:else if cells.filter((c) => c.meta).length > 1}
+    <p class="muted">Same model, seed and arguments - the files differ only in what the run did.</p>
+  {/if}
+{/if}
+
+<style>
+  .grid {
+    display: grid;
+    grid-template-columns: repeat(var(--cols), minmax(0, 1fr));
+    gap: var(--space-3);
+    margin-bottom: var(--space-4);
+  }
+  @media (max-width: 640px) {
+    .grid {
+      grid-template-columns: 1fr;
+    }
+  }
+  .cell {
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+  }
+  .cell img,
+  .cell video {
+    width: 100%;
+    background: var(--panel-2);
+    border: 1px solid var(--line);
+  }
+  figcaption {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--space-2);
+    font-size: var(--t-sm);
+  }
+  .mono {
+    font-family: var(--font-mono);
+  }
+  .note {
+    flex-basis: 100%;
+    white-space: pre-wrap;
+  }
+  .transport {
+    display: flex;
+    align-items: center;
+    gap: var(--space-2);
+    margin-bottom: var(--space-3);
+  }
+  .transport input {
+    flex: 1;
+  }
+  table {
+    border-collapse: collapse;
+    width: 100%;
+    font-size: var(--t-sm);
+  }
+  th {
+    text-align: left;
+    font-family: var(--font-mono);
+    color: var(--muted);
+    padding-right: var(--space-3);
+    white-space: nowrap;
+  }
+  td {
+    padding: var(--space-1) var(--space-2);
+    border-top: 1px solid var(--line);
+    overflow-wrap: anywhere;
+  }
+</style>
+```
+If Task 5 has landed, swap the `loading…` line for
+`<Skeleton tiles={names.length} label="loading the comparison" />`.
+
+- [ ] **Step 5: Run the tests and checks**
+
+Run: `cd ui && npx vitest run src/lib/compare.test.ts src/lib/pages/ComparePage.test.ts src/lib/pages/GalleryPage.test.ts && npm run check && npm run lint && npm test`
+Expected: PASS. Then check by hand on `npm run dev`: tick two videos, click
+Compare, and confirm play, pause and scrub move both together.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add ui/src/lib/compare.ts ui/src/lib/compare.test.ts ui/src/lib/pages/ComparePage.svelte ui/src/lib/pages/ComparePage.test.ts ui/src/lib/routes.ts ui/src/App.svelte ui/src/lib/BulkBar.svelte ui/src/lib/pages/GalleryPage.svelte
+git commit -m "feat(ui): compare 2-4 outputs side by side with synced video and the differing arguments"
+```
+
+---
+
+## Finish
+
+- [ ] From `ui/`: `npm run check && npm run lint && npm test && npx playwright test`.
+  Playwright starts its own server, so stop `dw.serve` on the same port first.
+- [ ] From the repo root: `pytest tests/ -v`
+- [ ] Rebuild the UI (`cd ui && npm run build`) and restart `dw.serve` so Tasks
+  10 and 11 take effect.
+- [ ] Optional follow-up, not in this plan: rewrite the long h3-quality
+  workspace note as Markdown (RULE / TIERS / LESSONS / PERF headings with
+  lists) so Task 7 shows off on real content. The MCP `set_note` tool can do
+  this.
diff --git a/docs/superpowers/specs/2026-10-12-roles-and-notes-design.md b/docs/superpowers/specs/2026-10-12-roles-and-notes-design.md
new file mode 100644
index 00000000..dc6dbe8d
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-12-roles-and-notes-design.md
@@ -0,0 +1,345 @@
+# Roles and notes for runs, outputs, assets and workspaces
+
+Date: 2026-10-12. Status: approved in conversation, awaiting spec review.
+
+## Goal
+
+The gallery is hard to navigate because nothing tells the deliverable from
+the scratch files. The `final` / `intermediate` subfolder convention works
+for the catalog templates (121 and 37 uses across all 65), but the engine
+treats no folder name specially. As a result, a hand-built workflow lands
+its files flat, or in whatever folder the agent picked. And nothing records
+*why* a file exists: an agent asked to "experiment with x, y, z and keep a
+note of the settings with each output" has nowhere to put the note.
+
+This adds two things:
+
+1. **Roles.** Every file in a run is `final` or `intermediate`, and the
+   files a run read are its `input`s. A role is decided by default, with
+   nothing for the agent to do. In the UI roles are the main way to
+   navigate, and folders become a detail.
+2. **Notes.** Optional plain text on a run, on a file in a run, on an asset
+   and on a workspace. It can be set at submission or afterwards, by the UI
+   or by an agent.
+
+Free-form tags are deliberately out of scope. They will be revisited if
+roles turn out not to be enough categorization.
+
+## Build order
+
+1. Roles: engine recording, server inference for older runs, API and MCP
+   fields, gallery and job UI.
+2. Notes: the four stores, submission and edit paths, API and MCP, UI.
+
+Each stage ships on its own and passes the full suite.
+
+## 1. Roles
+
+### Values
+
+- `final`: a file the run produced as a deliverable.
+- `intermediate`: a file the run produced so that a later step could
+  consume it.
+- `input`: an `asset:` or `output:` file the run's arguments resolved to.
+  An input is never copied. It is a reference recorded in the run's
+  manifest.
+
+### Deciding a step's role
+
+The role is decided per step, and every file the step wrote gets it. The
+first rule that holds wins:
+
+1. **Explicit.** The step's `result.role` is `"final"` or
+   `"intermediate"`. This is a new optional property in
+   `dw/workflow_schema.json` under the result block, next to `save` and
+   `subfolder`, and it may be a `variable:` reference like `subfolder`.
+2. **Convention.** The step's resolved `result.subfolder` is `final` or
+   `intermediate`, or its first path segment is one of them
+   (`final/act-1`).
+3. **Inferred.**
+   - A step whose files a later step *that writes media* consumes is
+     `intermediate`. Media means a gallery media kind: image, video or
+     audio.
+   - Every other step is `final`.
+   - Consuming means a `previous_result:<step>` reference anywhere in the
+     later step's arguments, or in its task or pipeline inputs.
+   - A consumer that writes only text or JSON does not demote what it
+     reads. This covers transcripts, `check_script`, `plan_cuts` and
+     assessment probes. It is why `check_script` on a finished video
+     leaves the video `final`.
+
+A flat-layout file with no manifest has no role. It is listed with
+`role: null` and counted as final by the UI filter, so nothing disappears
+from view.
+
+### Sub-workflows and `for_each`
+
+- A composing step's role applies to the files the composed child wrote
+  into the parent's run.
+- A `for_each` step has one role for all its expansions.
+- The child's own manifest, if it has its own run, keeps its own roles.
+
+### Inputs
+
+As a run opens, the engine records every `asset:` and `output:` reference
+the substituted arguments resolved to, as `inputs: [{reference, kind}]` in
+`manifest.json`. Duplicates are removed and the order follows first use.
+
+### Where roles are stored
+
+- **New runs.** `write_run_manifest` (`dw/workflow_run.py:209`) adds
+  `role` to each `steps[]` entry when it writes the terminal manifest,
+  alongside `inputs`.
+- **Older runs.** A manifest whose steps carry no `role` is inferred on the
+  server from the realized `workflow.json` beside it, using the same
+  function. The rules live in one module (`dw/roles.py`) that both the
+  engine and the server import, and that module names no model. The result
+  is cached per run directory, keyed by the manifest's mtime, next to the
+  gallery's existing run metadata lookups.
+
+### API and MCP
+
+- `GalleryFile` (`dw/server/api_models.py:781`) gains `role`.
+- `GalleryMetadata` (`:843`) gains `role` and `inputs`.
+- `GET /api/gallery` gains an optional `role` query parameter, repeatable,
+  taking `final` and `intermediate`. Leaving it out lists every file.
+- MCP `list_gallery` gains the same `role` filter, and its compact
+  projection gains `role`. MCP's default stays every role, because
+  diagnosis needs the intermediates.
+- `get_gallery_metadata` returns `role` and `inputs`.
+- The OpenAPI document is regenerated (`scripts/dump_openapi.py`, then
+  `npm run gen:api`), and `scripts/surface_snapshot.py` is updated.
+
+### UI
+
+**Gallery** (`ui/src/lib/pages/GalleryPage.svelte`):
+
+- **Role chips are the main filter,** in the top bar beside the workflow
+  filter: **Final** and **Intermediate**, multi-select. Final is on by
+  default. The UI's default differs from MCP's on purpose.
+- **Every tile carries its role as a coloured tag,** ahead of the file
+  name and visible at thumbnail size. Final is prominent and intermediate
+  is muted.
+- **The subfolder filter leaves the top bar.** The folder path moves to a
+  small "Location" line at the bottom of the detail panel.
+- Inside a run, finals sort before intermediates.
+
+**Job results** (`ui/src/lib/pages/JobPage.svelte`):
+
+- Grouped into sections: **Final** first and expanded, then
+  **Intermediate**, collapsed when the run has any finals, then **Made
+  from**, the input references tagged `input`.
+
+**Detail panel** (`ui/src/lib/gallery/GalleryDetail.svelte`), top to
+bottom:
+
+1. Role tag.
+2. Note (section 2).
+3. A collapsed **Settings** line with the run's recorded arguments and
+   seed, which the manifest already holds.
+4. **Made from**, the inputs, each one clickable.
+5. Location.
+
+**Assets page:** every asset is an input, so assets get no role tag. A kept
+file shows a "kept from <workflow> v<n>" line from the provenance
+`record_kept_shots` already writes (`dw/runs.py:784`, read by
+`kept_provenance` `:872`).
+
+## 2. Notes
+
+### What a note is
+
+- Optional plain text, at most 4,000 characters. Longer is refused with a
+  400.
+- Rendered as text, never as HTML or markdown.
+- An empty string or null clears the note.
+
+### Stores
+
+| On | Stored in | Shape |
+|---|---|---|
+| Run | `notes.json` in the run directory | `{"run": "..."}` |
+| File in a run | the same `notes.json` | `{"files": {"<path relative to the run dir>": "..."}}` |
+| Asset | the asset directory's `notes.json` (`{"files": {name: note}}`) | a `files` map keyed by file name |
+| Workspace | new `workspace.json` at the workspace root | `{"notes": "..."}` |
+
+Why `notes.json` and not `manifest.json`: the engine rewrites the whole
+manifest on every write while a run is going (`write_run_manifest`), so a
+note written into it by the server could be lost. A separate file keeps the
+engine's manifest single-writer. For assets the same file is used rather than
+the `record_kept_shots` sidecar, because `record_kept_shots` deletes its sidecar
+with the last entry, which would take the notes with it.
+
+Every write is atomic, using a temp file and replace, as `write_manifest`
+does (`dw/runs.py:683`). Concurrent edits to the same `notes.json` are
+serialized by a per-path lock in the server. Only the server writes
+`notes.json`, never the engine.
+
+### The effective note
+
+A file's effective note is its own entry in `files`, or else the run's
+note.
+
+### Bookkeeping
+
+- `notes.json` joins `RUN_SIDECARS` (`dw/server/routes/gallery.py:277`) and
+  `RUN_BOOKKEEPING_FILES` (`dw/server/outputs.py:54`). As a result:
+  - a run left holding only notes is pruned when its last output is
+    deleted;
+  - it is still detected as an orphan;
+  - `notes.json` is never listed as media;
+  - `dw/server/exports.py` copies it into the export zip beside the
+    manifest.
+- Deleting one output removes that file's entry from `notes.json`.
+- `workspace.json` joins the entries `delete_workspace` tolerates
+  (`_foreign_entries`, `dw/workspace.py:374`).
+- Deleting an asset (`dw/server/routes/assets.py:470`) removes that file's
+  entries from its directory sidecar: its notes, provenance and shots. This
+  fixes an existing leak, where a later upload under the same name
+  inherited stale provenance.
+
+### Setting a note
+
+**At submission.** `JobRequest` (`dw/server/admission.py:383`) and MCP
+`run_workflow` gain an optional `note`.
+
+- It is stored in a new `note` column on the sqlite `jobs` table, added by
+  the existing `ALTER TABLE ADD COLUMN` migration path
+  (`dw/server/job_history.py:61-133`).
+- It is kept in the job spec, and the server writes it to the run's
+  `notes.json` when the worker's `run_start` event names the run directory.
+  The engine never writes notes.
+- `note` joins `RERUN_SPEC_KEYS` (`dw/server/job_record.py:31`), so
+  `rerun_job` carries it forward.
+
+**At upload or keep.**
+
+- `POST /api/uploads` and MCP `upload_asset` gain `note`. Upload writes
+  the directory sidecar when a note is given.
+- `KeepRequest` and MCP `keep_output` gain `note`. Without one, keep copies
+  the source file's effective note.
+
+**Afterwards.** One route, `PUT /api/notes`, with body
+`{target, note}`. `target` is one of:
+
+- a gallery file name: sets that file's note;
+- a run directory, `<identity>/<run_id>`: sets the run note;
+- `asset:<name>`;
+- `workspace:<name>`.
+
+The target is resolved by the same validated resolution the delete and
+metadata routes use (`dw/server/routes/gallery.py:346`,
+`dw/server/routes/media.py:69`, `validate_asset_reference`). No path
+handling is new, and every write lands on a path that has been through
+`validate_output_path` against its root.
+
+The route answers with the target's effective note and `note_source`.
+Notes are free metadata, so they need no `acknowledged_cost`.
+
+MCP gains one tool, `set_note(target, note)`, over that route.
+
+### Reading notes
+
+- `GalleryFile` gains `note`, the effective one.
+- `GalleryMetadata` gains `note`, `run_note` and `note_source`, which is
+  `"file"` or `"run"`.
+- `AssetFile` (`api_models.py:864`) and `WorkspaceInfo` (`:627`) gain
+  `note`.
+- `JobSummary` (`:345`) and `JobDetail` (`:419`) gain `note`.
+- In MCP, the compact projections of `list_gallery`, `list_assets`,
+  `list_workspaces` (`WORKSPACE_SUMMARY_FIELDS`, `dw_mcp/workspaces.py:21`)
+  and `list_jobs` / `get_job` include `note`.
+  - In a compact projection the note is clipped to 200 characters with
+    `note_truncated: true`.
+  - The detail tools (`get_gallery_metadata`, `get_job`) return it in full.
+- New response keys are declared with `sometimes(...)` where optional, as
+  strict responses require.
+
+### UI
+
+**Workspace overview** (`ui/src/lib/pages/OverviewPage.svelte:128`):
+
+- The note is shown under the heading. It is edited in place with a
+  pencil, a textarea and Save/Cancel.
+- With no note, the place shows a muted "Add a note".
+- `loadWorkspaces` (`ui/src/lib/workspace.svelte.ts:72`) keeps `note`.
+
+**Gallery and asset detail:**
+
+- The note sits under the role tag, edited the same way.
+- When the note shown is the run's, it is labelled "run note", and the
+  editor offers "edit for this file" or "edit run note".
+
+**Gallery tiles:** a small note icon when the effective note is set,
+showing the first line on hover.
+
+**Job page:** the run note sits under the job header, and can be edited.
+
+**One editor component.** `NoteEditor.svelte` is shared by all four
+places. It renders the note as text, never with `{@html}`.
+
+### Agent guidance
+
+A short paragraph goes in the MCP server instructions
+(`dw_mcp`) and in `docs/WORKFLOW_GUIDE.md`'s *Authoring a workflow from an
+agent* section, saying:
+
+- When running a set of variations, pass `note` on each `run_workflow`
+  saying what that run tests.
+- Use `set_note` to mark a keeper.
+- `result.role` is available when the default inference is wrong for a
+  step.
+
+`docs/SERVER.md` and `docs/MCP.md` document the new route, fields and tool.
+`docs/ARCHITECTURE.md` gains a row for `dw/roles.py`.
+
+## Testing
+
+**Python:**
+
+- Role inference:
+  - each of the three rules and their precedence;
+  - the text and JSON consumer exception;
+  - `for_each`;
+  - sub-workflow composing steps;
+  - a `variable:` role or subfolder;
+  - older-run inference matches what a new run records for the same
+    workflow;
+  - a flat file gives `null`.
+- `inputs` recording for `asset:` and `output:` references, with
+  duplicates removed.
+- Each note store: write, read, clear, the 4,000-character limit, atomic
+  writes, and the effective-note fallback.
+- Bookkeeping:
+  - prune when only notes remain;
+  - orphan detection;
+  - the export includes `notes.json`;
+  - deleting a single output removes its note entry;
+  - deleting an asset clears its sidecar entry;
+  - a workspace holding `workspace.json` deletes.
+- `PUT /api/notes` security:
+  - traversal in each target form is refused;
+  - an unknown target gives a 404;
+  - a non-writable library gives a 409, as keep and delete answer.
+- Submission: `note` reaches the sqlite row and `notes.json`, and survives
+  a rerun.
+- MCP: `set_note`, the `note` parameters, the compact clipping and
+  `note_truncated`.
+
+**UI (Vitest):**
+
+- Role chips, the default Final filter and tile tags.
+- Job grouping.
+- `NoteEditor`: save, cancel, clear, file versus run, and text-only
+  rendering.
+- The note in each of the four places.
+
+**Snapshots:** OpenAPI regenerated, and `scripts/surface_snapshot.py`
+updated for the MCP tool and parameters.
+
+## Out of scope
+
+- Free-form tags.
+- Search over notes.
+- Notes on prompts and saved workflows, which already have `description`.
+- Moving notes with a cross-workspace move (#853).
diff --git a/dw/acceleration_warnings.py b/dw/acceleration_warnings.py
new file mode 100644
index 00000000..738fdd98
--- /dev/null
+++ b/dw/acceleration_warnings.py
@@ -0,0 +1,275 @@
+"""Acceleration settings that validate passes and that cannot pay off (#868).
+
+Each of these cost a render to find out in Don's `h3-quality` matrix:
+
+- `cache_short_schedule`: a threshold cache (`first_block`, `mag`) on a
+  schedule under `CACHE_MIN_USEFUL_STEPS`. Consecutive steps of a short
+  schedule differ too much for the residual threshold, so the cache skips
+  nothing and still perturbs the result - on MiniMax-H3 a `first_block` cache
+  at 0.05 skipped no step at 12 steps and took 22% off at 30. `docs/RECIPES_24GB.md` states the
+  rule and `tests/test_catalog_speed_defaults.py` holds the catalog to it;
+  this is where a hand-written workflow meets it. The interval caches
+  (`taylorseer`, `faster`) skip on a fixed interval and `text_kv` skips no
+  step at all, so none of them is held to it.
+- `taylorseer_state_unestimated`: TaylorSeer keeps per-block state on the
+  device that no VRAM estimate charges - P5 ran out of memory two minutes
+  into a run validate had passed. Always said when TaylorSeer is set. Sizing
+  that state would need the architecture data the engine never holds, and
+  charging it in `vram_estimate` would turn a warning into a refusal and move
+  jobs between cards, so the warning only states the estimate it sits on top
+  of.
+- `cache_unsupported`: a cache on a pipeline whose class declares no
+  transformer (a UNet pipeline such as SD 1.5), or whose transformer class has
+  no `enable_cache()` (Z-Image's, in the diffusers this server runs). Read from
+  the pipeline class's constructor alone, nothing is loaded; the run only says
+  "not applied" and carries on uncached.
+- `compile_fullgraph_with_cache`: `fullgraph` forbids the graph break a
+  cache's skip decision needs (`docs/ACCELERATION.md`).
+- `attention_backend_unavailable`: a CUDA-only attention backend on a device
+  that isn't CUDA passes validate and fails at load.
+
+Every one is a warning and never a refusal. A value that cannot be resolved
+before the run (a null variable, an unknown device) leaves its warning
+silent rather than guessed at.
+"""
+
+import inspect
+import typing
+
+from . import get_device_type
+from .introspection import load_pipeline_class
+from .references import iter_steps, render_path
+from .vram_estimate import required_vram_gb
+
+# The fewest denoise steps a threshold cache is expected to skip any of. A
+# general fact about residual-threshold caching, not a per-model rule: H3
+# skipped nothing at 12 steps and 22% at 30 (RECIPES_24GB.md); nothing
+# between has been measured yet (#875 measures 20)
+CACHE_MIN_USEFUL_STEPS = 20
+
+# The cache types that decide each step's skip on a residual threshold
+THRESHOLD_CACHES = ("first_block", "mag")
+
+# The attention backends diffusers registers that need CUDA: the flash,
+# flash-3, sage and xformers families, Hub kernels included. Matched by name,
+# never by a `_hub` suffix; no `native`-family backend is here. A name
+# missing from this set only means no warning - today's behavior
+CUDA_ONLY_ATTENTION_BACKENDS = frozenset(
+    {
+        "flash",
+        "flash_hub",
+        "flash_varlen",
+        "flash_varlen_hub",
+        "flash_4_hub",
+        "_flash_3",
+        "_flash_varlen_3",
+        "_flash_3_hub",
+        "_flash_3_varlen_hub",
+        "aiter_fa2_hub",
+        "sage",
+        "sage_hub",
+        "sage_blackwell_hub",
+        "sage_varlen",
+        "_sage_qk_int8_pv_fp8_cuda",
+        "_sage_qk_int8_pv_fp8_cuda_sm90",
+        "_sage_qk_int8_pv_fp16_cuda",
+        "_sage_qk_int8_pv_fp16_triton",
+        "xformers",
+    }
+)
+
+SHORT_SCHEDULE = "cache_short_schedule"
+TAYLORSEER_STATE = "taylorseer_state_unestimated"
+FULLGRAPH_WITH_CACHE = "compile_fullgraph_with_cache"
+BACKEND_UNAVAILABLE = "attention_backend_unavailable"
+CACHE_UNSUPPORTED = "cache_unsupported"
+
+# The component names a cache hook attaches to, as in
+# dw.pipeline_processors.components.get_cache_transformer
+_CACHE_COMPONENTS = ("transformer", "transformer_ref")
+
+
+def _steps(pipeline):
+    """The resolved `num_inference_steps` the pipeline is called with, or
+    None when it is not a number known before the run."""
+    arguments = pipeline.get("arguments")
+    value = (arguments if isinstance(arguments, dict) else {}).get(
+        "num_inference_steps"
+    )
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return None
+    return value
+
+
+def _backend(device_type):
+    """The backend `device_type` belongs to ('cuda' for 'cuda:1'), or None
+    when the device is unknown."""
+    if not isinstance(device_type, str) or not device_type:
+        return None
+    try:
+        return get_device_type(device_type)
+    except (RuntimeError, ValueError):
+        return None
+
+
+def _components(configuration):
+    components = configuration.get("components")
+    if not isinstance(components, dict):
+        return []
+    return [
+        (name, component)
+        for name, component in components.items()
+        if isinstance(component, dict)
+    ]
+
+
+def _estimate_clause(context):
+    """'; this job is estimated at X of Y GB' when the workflow declares a
+    VRAM estimate and the device's capacity is known, else ''."""
+    if context.capacity_gb is None:
+        return ""
+    required = required_vram_gb(
+        context.expanded,
+        context.arguments,
+        device_type=context.device_type,
+        base_dir=context.base_dir,
+        probe=context.probe,
+    )
+    if required is None or not required[1]:
+        # Only a declared vram_estimate is an estimate; a measured `cost`
+        # entry records a card, not what this job needs
+        return ""
+    return (
+        f"; this job is estimated at {required[0]:.1f} of "
+        f"{context.capacity_gb:.1f} GB, and that state comes on top"
+    )
+
+
+def _cache_unsupported(component_type):
+    """Why a cache cannot attach to the pipeline class `component_type`
+    names, or None when it can or that cannot be told from the class alone
+    (an unresolvable class, a **kwargs constructor, a component whose type is
+    not a single class)."""
+    if not isinstance(component_type, str):
+        return None
+    try:
+        cls = load_pipeline_class(component_type)
+        parameters = inspect.signature(cls.__init__).parameters
+    except (ValueError, TypeError):
+        return None
+    if any(p.kind == inspect.Parameter.VAR_KEYWORD for p in parameters.values()):
+        return None
+    names = [name for name in _CACHE_COMPONENTS if name in parameters]
+    if not names:
+        return (
+            f"{cls.__name__} has no transformer component to attach a cache to "
+            f"(a UNet pipeline is not supported)"
+        )
+    try:
+        hints = typing.get_type_hints(cls.__init__)
+    except Exception:
+        return None
+    classes = [hints.get(name) for name in names]
+    if all(isinstance(c, type) and not hasattr(c, "enable_cache") for c in classes):
+        return (
+            f"{cls.__name__}'s transformer ({classes[0].__name__}) does not "
+            f"support diffusers' enable_cache()"
+        )
+    return None
+
+
+def _cache_warnings(cache, pipeline, path, where, context, component_type=None):
+    cache_type = cache.get("type")
+    warnings = []
+    steps = _steps(pipeline)
+    if (
+        cache_type in THRESHOLD_CACHES
+        and steps is not None
+        and steps < CACHE_MIN_USEFUL_STEPS
+    ):
+        warnings.append(
+            f"{path}: {SHORT_SCHEDULE}: a '{cache_type}' cache on {steps:g} "
+            f"steps will likely skip nothing (consecutive steps differ too much "
+            f"for its threshold) and still perturbs the result{where}; drop the "
+            f"cache or run >= {CACHE_MIN_USEFUL_STEPS} steps"
+        )
+    reason = _cache_unsupported(component_type)
+    if reason:
+        warnings.append(
+            f"{path}: {CACHE_UNSUPPORTED}: the '{cache_type}' cache will not be "
+            f"applied: {reason}{where}; the step runs uncached, so drop the cache"
+        )
+    if cache_type == "taylorseer":
+        max_order = cache.get("max_order")
+        if isinstance(max_order, bool) or not isinstance(max_order, int):
+            max_order = 1
+        warnings.append(
+            f"{path}: {TAYLORSEER_STATE}: TaylorSeer keeps per-block state on "
+            f"the GPU (more with a higher max_order; this one is {max_order}) "
+            f"that the VRAM estimate doesn't include{_estimate_clause(context)}"
+            f"{where}. A run that fits without the cache can run out of memory "
+            f"with it"
+        )
+    return warnings
+
+
+def acceleration_warnings(context):
+    """Every acceleration setting in the expanded definition that cannot pay
+    off, as `"<path>: <code>: <message>"` strings, each said once."""
+    warnings = []
+    backend = _backend(context.device_type)
+    for _, _, pipeline, source, where in iter_steps(
+        context.expanded.get("steps"), context.source_indices, "pipeline"
+    ):
+        configuration = pipeline.get("configuration")
+        if not isinstance(configuration, dict):
+            continue
+        base = ("steps", source, "pipeline", "configuration")
+        cache = configuration.get("cache")
+        if isinstance(cache, dict):
+            warnings += _cache_warnings(
+                cache,
+                pipeline,
+                render_path(base + ("cache",)),
+                where,
+                context,
+                configuration.get("component_type"),
+            )
+
+        backends = [(base + ("attention_backend",), configuration)]
+        for name, component in _components(configuration):
+            component_path = base + ("components", name)
+            compile_config = component.get("compile")
+            if (
+                isinstance(cache, dict)
+                and isinstance(compile_config, dict)
+                and compile_config.get("fullgraph") is True
+            ):
+                warnings.append(
+                    f"{render_path(component_path + ('compile', 'fullgraph'))}: "
+                    f"{FULLGRAPH_WITH_CACHE}: fullgraph forbids the graph break "
+                    f"the '{cache.get('type')}' cache's skip decision needs"
+                    f"{where}; use partial graph mode (fullgraph false) with a "
+                    f"cache"
+                )
+            backends.append((component_path + ("attention_backend",), component))
+
+        if backend is None or backend == "cuda":
+            continue
+        for path, block in backends:
+            name = block.get("attention_backend")
+            if name not in CUDA_ONLY_ATTENTION_BACKENDS:
+                continue
+            warnings.append(
+                f"{render_path(path)}: {BACKEND_UNAVAILABLE}: attention backend "
+                f"'{name}' needs CUDA; this server is '{context.device_type}', "
+                f"so the job will fail at load{where}; leave it unset or use a "
+                f"'native'-family backend"
+            )
+    # A for_each step's members share their written path: say each code once
+    # there, naming the first member it fired for
+    said = {}
+    for warning in warnings:
+        path, _, rest = warning.partition(": ")
+        said.setdefault((path, rest.partition(": ")[0]), warning)
+    return list(said.values())
diff --git a/dw/adapter_compatibility.py b/dw/adapter_compatibility.py
index b4bf34f8..5349769d 100644
--- a/dw/adapter_compatibility.py
+++ b/dw/adapter_compatibility.py
@@ -25,6 +25,26 @@
 `fl2v` in the file name) that no diffusers symbol declares; the workflow
 names and the partition each one denoises against are diffusers' own, and
 `tests/test_h3_adapters.py` pins them to it.
+
+The LoRA catalog comes first, the file name second (#870). The server hands
+in `catalog_index` over the one catalog every workspace shares
+(`dw/server/deps.py` `lora_index`). An entry whose `workflow` list sits in
+one partition decides the adapter's partition, and its `status` decides how
+much that counts:
+
+- a `proven` entry is used: a step on the other partition is an error
+  naming the entry, and a step on its own one is clean;
+- a `trial` or `rejected` entry only warns when the step is on the other
+  partition, and clears the "names neither" warning when it is not - a
+  file-name error still stands, since only `proven` refuses;
+- a `proven` entry and a file-name token that disagree are a warning naming
+  both, never an error;
+- a file the catalog does not cover, or an entry whose `workflow` is null or
+  spans both partitions, falls to the file-name rule unchanged.
+
+The CLI, the worker's sub-workflow re-validation and `warn_adapters` pass no
+index and keep the file-name rule alone, so the server is stricter than the
+worker, never looser.
 """
 
 import logging
@@ -66,11 +86,52 @@ def _trained_for(weight_name):
     return None
 
 
-def _problem(workflow, weight_name):
-    """(severity, message) for one adapter on one step, or None when the
-    pairing is right."""
-    trained = _trained_for(weight_name)
-    wants = "reference" if workflow in REFERENCE_WORKFLOWS else "keyframe"
+PARTITIONS = {"reference": "transformer_ref", "keyframe": "transformer"}
+# Which of two entries for one file the index keeps: the stronger status
+STATUS_STRENGTH = {"proven": 0, "trial": 1, "rejected": 2}
+
+
+def catalog_index(entries):
+    """`{(model_name, weight_name): (entry name, workflows, status)}` over
+    the catalog entries (`{name: entry}`) that declare a `workflow` and a
+    file. The revision is not part of the key (#870 Q2)."""
+    index = {}
+    for name, entry in sorted(entries.items()):
+        workflows = entry.get(WORKFLOW_KEY)
+        weight_name = entry.get(WEIGHT_NAME_KEY)
+        if not workflows or not isinstance(weight_name, str):
+            continue
+        if isinstance(workflows, str):
+            workflows = [workflows]
+        key = (entry.get(MODEL_NAME_KEY), weight_name)
+        status = entry.get("status")
+        held = index.get(key)
+        weakest = len(STATUS_STRENGTH)
+        if held is not None and STATUS_STRENGTH.get(
+            held[2], weakest
+        ) <= STATUS_STRENGTH.get(status, weakest):
+            continue
+        index[key] = (name, tuple(workflows), status)
+    return index
+
+
+def _catalog_partition(workflows):
+    """The partition a catalog entry's `workflow` list sits in -
+    'reference', 'keyframe' - or None when it spans both."""
+    listed = set(workflows)
+    if listed and listed <= REFERENCE_WORKFLOWS:
+        return "reference"
+    if listed and listed <= KEYFRAME_WORKFLOWS:
+        return "keyframe"
+    return None
+
+
+def _token(partition):
+    return REFERENCE_TOKEN if partition == "reference" else KEYFRAME_TOKEN
+
+
+def _filename_problem(workflow, weight_name, trained, wants):
+    """(severity, message) the file-name rule gives, or None."""
     if trained == wants:
         return None
     if trained is None:
@@ -79,28 +140,90 @@ def _problem(workflow, weight_name):
             f"'{weight_name}' names neither '{REFERENCE_TOKEN}' nor "
             f"'{KEYFRAME_TOKEN}', so it cannot be checked against this "
             f"step's '{workflow}' workflow. A '{workflow}' step denoises "
-            f"against the "
-            f"'{'transformer_ref' if wants == 'reference' else 'transformer'}' "
-            f"partition, and an adapter trained against the other one loads "
-            f"onto it without error and only degrades the result",
+            f"against the '{PARTITIONS[wants]}' partition, and an adapter "
+            f"trained against the other one loads onto it without error and "
+            f"only degrades the result",
         )
     return (
         "error",
-        f"'{weight_name}' is trained against the "
-        f"'{'transformer_ref' if trained == 'reference' else 'transformer'}' "
+        f"'{weight_name}' is trained against the '{PARTITIONS[trained]}' "
         f"partition and this step runs the '{workflow}' workflow, which "
-        f"denoises against "
-        f"'{'transformer_ref' if wants == 'reference' else 'transformer'}'. "
-        f"MiniMax-H3 loads it anyway and the run succeeds - the only symptom "
-        f"is a worse result - so it is refused here. Use an adapter trained "
-        f"for this workflow (its name carries "
-        f"'{REFERENCE_TOKEN if wants == 'reference' else KEYFRAME_TOKEN}')",
+        f"denoises against '{PARTITIONS[wants]}'. MiniMax-H3 loads it anyway "
+        f"and the run succeeds - the only symptom is a worse result - so it "
+        f"is refused here. Use an adapter trained for this workflow (its name "
+        f"carries '{_token(wants)}')",
+    )
+
+
+def _problems(workflow, weight_name, model_name=None, catalog=None):
+    """Every (severity, message) for one adapter on one step; empty when
+    the pairing is right. The catalog first, the file name second (the
+    module docstring)."""
+    trained = _trained_for(weight_name)
+    wants = "reference" if workflow in REFERENCE_WORKFLOWS else "keyframe"
+    found = (catalog or {}).get((model_name, weight_name))
+    decided = _catalog_partition(found[1]) if found else None
+    if decided is None:
+        problem = _filename_problem(workflow, weight_name, trained, wants)
+        return [problem] if problem else []
+    entry_name, workflows, status = found
+    lists_it = (
+        f"'{weight_name}': catalog entry '{entry_name}' ({status}) lists it "
+        f"for '{', '.join(workflows)}', which denoises against "
+        f"'{PARTITIONS[decided]}'"
     )
+    if status == "proven":
+        # The catalog and the file name disagree: say both, refuse neither
+        # (#870 Q1)
+        if trained is not None and trained != decided:
+            return [
+                (
+                    "warning",
+                    f"{lists_it}, but its name carries '{_token(trained)}', "
+                    f"which says '{PARTITIONS[trained]}'. This step runs "
+                    f"'{workflow}', which denoises against "
+                    f"'{PARTITIONS[wants]}'. Check which is right; if it is "
+                    f"the catalog, correct the entry with save_lora",
+                )
+            ]
+        if decided == wants:
+            return []
+        return [
+            (
+                "error",
+                f"{lists_it}, and this step runs the '{workflow}' workflow, "
+                f"which denoises against '{PARTITIONS[wants]}'. MiniMax-H3 "
+                f"loads it anyway and the run succeeds - the only symptom is "
+                f"a worse result - so it is refused here. Use an adapter the "
+                f"catalog lists for '{workflow}' (list_loras), or correct the "
+                f"entry with save_lora if it is wrong",
+            )
+        ]
+    # A trial or rejected entry only warns. It never lifts a file-name
+    # error: only a proven entry may overrule one
+    problems = []
+    if trained is not None and trained != wants:
+        problems.append(_filename_problem(workflow, weight_name, trained, wants))
+    if decided != wants:
+        problems.append(
+            (
+                "warning",
+                f"{lists_it}, and this step runs the '{workflow}' workflow, "
+                f"which denoises against '{PARTITIONS[wants]}'. An adapter "
+                f"trained against the other partition loads without error "
+                f"and only degrades the result. The entry is '{status}', so "
+                f"this is not refused; promoting it to proven would make it "
+                f"refuse",
+            )
+        )
+    return problems
 
 
-def _lora_problems(steps, source_indices, written=None, supplied=()):
+def _lora_problems(steps, source_indices, written=None, supplied=(), catalog=None):
     """Every adapter/workflow mismatch in an expanded step list, as
-    (severity, path, message).
+    (severity, path, message). `catalog` is `catalog_index`'s answer, built
+    once by the caller and looked up here per adapter; None is the file-name
+    rule alone.
 
     `written` is the definition as the author wrote it and `supplied` the
     argument names the caller passed: when the value arrived through a
@@ -133,27 +256,13 @@ def _lora_problems(steps, source_indices, written=None, supplied=()):
                 references.UNRESOLVED, weight_name
             ):
                 continue
-            problem = _problem(workflow, weight_name)
-            if problem is None:
-                continue
-            severity, message = problem
-            found.append(
-                (
-                    severity,
-                    _path_for(written_steps, source, position, supplied)
-                    or render_path(
-                        (
-                            "steps",
-                            source,
-                            "pipeline",
-                            LORAS_KEY,
-                            position,
-                            WEIGHT_NAME_KEY,
-                        )
-                    ),
-                    message + where,
-                )
+            path = _path_for(written_steps, source, position, supplied) or render_path(
+                ("steps", source, "pipeline", LORAS_KEY, position, WEIGHT_NAME_KEY)
             )
+            for severity, message in _problems(
+                workflow, weight_name, lora.get(MODEL_NAME_KEY), catalog
+            ):
+                found.append((severity, path, message + where))
     return found
 
 
@@ -175,14 +284,21 @@ def _path_for(written_steps, source, position, supplied, key=WEIGHT_NAME_KEY):
     return f"arguments.{variable}" if variable in (supplied or ()) else None
 
 
-def adapter_errors(workflow_definition, source_indices=None, written=None, supplied=()):
+def adapter_errors(
+    workflow_definition, source_indices=None, written=None, supplied=(), catalog=None
+):
     """Every adapter loaded onto the wrong checkpoint partition, as
     [{path, message}]. The definition is the expanded, substituted one, so a
-    `for_each` member's own adapter is checked as it will run."""
+    `for_each` member's own adapter is checked as it will run. `catalog` is
+    `catalog_index`'s answer, when the caller has the catalog."""
     return [
         {"path": path, "message": message}
         for severity, path, message in _lora_problems(
-            workflow_definition.get("steps") or [], source_indices, written, supplied
+            workflow_definition.get("steps") or [],
+            source_indices,
+            written,
+            supplied,
+            catalog,
         )
         if severity == "error"
     ]
@@ -221,7 +337,7 @@ def _disabled_loras(steps, source_indices, written=None, supplied=()):
 
 
 def adapter_warnings(
-    workflow_definition, source_indices=None, written=None, supplied=()
+    workflow_definition, source_indices=None, written=None, supplied=(), catalog=None
 ):
     """Every adapter whose name says nothing about what it was trained for,
     and every one switched off, as messages - valid, and said out loud
@@ -230,7 +346,7 @@ def adapter_warnings(
     return [
         f"{path}: {message}"
         for severity, path, message in _lora_problems(
-            steps, source_indices, written, supplied
+            steps, source_indices, written, supplied, catalog
         )
         if severity == "warning"
     ] + [
diff --git a/dw/assessment_rules.py b/dw/assessment_rules.py
index b0b55e08..71ced4ca 100644
--- a/dw/assessment_rules.py
+++ b/dw/assessment_rules.py
@@ -16,8 +16,9 @@
 the threshold, the severity and what a crossing says. `magnitude` compares
 the value's absolute size, for a signed measurement whose direction is not
 the problem. `shot_level_spread` shares its threshold with the run-time
-`LEVEL_SPREAD_WARN_DB`, so the join-time warning and the after-the-fact
-probe cannot disagree about the same cut.
+`LEVEL_SPREAD_WARN_DB`, and `seam_level_step` with `INNER_LEVEL_STEP_WARN_DB`
+(concat_videos' warning for a multi-shot input), so the join-time warning
+and the after-the-fact probe cannot disagree about the same cut.
 
 Three rules carry a guard the table alone cannot express, applied by the
 probe and named here in `unless` so it is written down beside the number:
@@ -32,7 +33,7 @@
 `tests/test_assessment_rules.py` pins those quotes to this table.
 """
 
-from .tasks.joins import LEVEL_SPREAD_WARN_DB
+from .tasks.joins import INNER_LEVEL_STEP_WARN_DB, LEVEL_SPREAD_WARN_DB
 
 SEVERITIES = ("info", "warn")
 
@@ -67,7 +68,7 @@
         "probe": "analyze_seams",
         "field": "level_step_db",
         "comparator": ">",
-        "threshold": 3.0,
+        "threshold": INNER_LEVEL_STEP_WARN_DB,
         "severity": "warn",
         "says": "the shots either side of the seam sit this far apart in level",
     },
diff --git a/dw/cache_blocks.json b/dw/cache_blocks.json
index 09288d55..6f519047 100644
--- a/dw/cache_blocks.json
+++ b/dw/cache_blocks.json
@@ -11,6 +11,11 @@
             "return_encoder_hidden_states_index": 1,
             "hidden_states_argument_name": "hidden_states",
             "encoder_hidden_states_argument_name": "audio_hidden_states"
+        },
+        "diffusers.models.transformers.transformer_qwenimage21.QwenImage21TransformerBlock": {
+            "return_hidden_states_index": 0,
+            "return_encoder_hidden_states_index": null,
+            "hidden_states_argument_name": "hidden_states"
         }
     }
 }
diff --git a/dw/cost_scaling.py b/dw/cost_scaling.py
new file mode 100644
index 00000000..75badf16
--- /dev/null
+++ b/dw/cost_scaling.py
@@ -0,0 +1,300 @@
+"""How far a run's arguments moved it from the defaults a curated `cost`
+figure was measured at, and that figure scaled to match (#267, #593, #866).
+
+A workflow's `cost` entry is measured at its variable defaults. The
+variables its `cost_drivers` names are the ones the author says move that
+figure: a generic diffusers driver (`num_inference_steps`, `width` and
+`height`, `num_frames`, per list entry summed) scales it in proportion
+(`scale_curated`); any other declared driver that moved has no rule to
+scale by, so the figure is kept and flagged. `dw/plan.py` prices the run
+and applies the answer (`_scaled`); `dw/server/deps.py` scales an inherited
+figure with the same `scale_curated`, so an inline copy and its template
+quote one request alike. The basis labels an estimate carries live here
+because the scaled figure is the first place one is chosen.
+
+Nothing here knows a model: the drivers are the workflow's own
+declaration, and the defaults its own `variables`.
+"""
+
+import json
+import math
+
+# The basis an estimate quotes its minutes on
+UNKNOWN = "unknown"
+CATALOG = "catalog"
+PER_ENTRY = "per_entry"
+DERIVED = "derived"
+OTHER_DEVICE = "other_device"
+OBSERVED = "observed"
+INHERITED = "inherited"
+
+COST_DRIVERS_KEY = "cost_drivers"
+
+
+def _declared_drivers(definition):
+    """The variables the author says move this workflow's cost - the same
+    rule `dw/server/observed_cost.py`'s `declared_drivers` applies, kept
+    local so this module does not import the server package (#267)."""
+    drivers = definition.get(COST_DRIVERS_KEY)
+    if not isinstance(drivers, list):
+        return []
+    variables = definition.get("variables") or {}
+    return [name for name in drivers if isinstance(name, str) and name in variables]
+
+
+def _driver_comparable(value):
+    """A driver value as something hashable and stable across JSON round
+    trips, mirroring `dw/server/observed_cost.py`'s `_comparable`."""
+    if isinstance(value, bool) or value is None:
+        return value
+    if isinstance(value, (int, float)):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return value
+    return json.dumps(value, sort_keys=True, default=str)
+
+
+def _numeric_fields(entries):
+    """{field: {values}} over the numeric fields of a list's dict entries. A
+    numeric string ("243") counts as its number, as `_driver_comparable` does
+    for a scalar driver."""
+    fields = {}
+    if not isinstance(entries, list):
+        return fields
+    for entry in entries:
+        if not isinstance(entry, dict):
+            continue
+        for key, value in entry.items():
+            number = _driver_comparable(value)
+            if isinstance(number, float) and math.isfinite(number):
+                fields.setdefault(key, set()).add(number)
+    return fields
+
+
+LIST_ENTRY_COST_FIELDS = ("num_frames",)
+
+
+def _list_entry_field_shifted(default_entries, effective_entries):
+    """Whether a list driver's entries carry a numeric field (a per-shot
+    `num_frames`, say) with a value none of the default entries had. The
+    curated figure was measured over the default entries' values, so a value
+    outside them has no matching bucket - the #267 rule applied inside a
+    list driver (#593)."""
+    measured = _numeric_fields(default_entries)
+    for field, values in _numeric_fields(effective_entries).items():
+        # Only a field that sets how long a shot renders moves its cost; a
+        # start_frame or cut_frames is a position that moves with the count
+        if (
+            field in LIST_ENTRY_COST_FIELDS
+            and field in measured
+            and not values <= measured[field]
+        ):
+            return True
+    return False
+
+
+# The generic diffusers argument names a curated figure scales along when a
+# run moves one off the default it was measured at (#866). Any other declared
+# scalar driver (H3's weights_dtype, a music audio_duration) has no rule to
+# scale by, so moving it keeps the figure and flags it (`_scaled`).
+STEPS_DRIVER = "num_inference_steps"
+FRAMES_DRIVER = "num_frames"
+SCALABLE_DRIVERS = (STEPS_DRIVER, "width", "height", FRAMES_DRIVER)
+
+
+def _positive(value):
+    """A driver value as a positive finite number, or None."""
+    number = _driver_comparable(value)
+    if isinstance(number, float) and math.isfinite(number) and number > 0:
+        return number
+    return None
+
+
+def _shown(number):
+    return f"{round(number, 1):g}"
+
+
+def scale_curated(minutes, defaults, effective):
+    """`minutes` measured at `defaults`, scaled to a run at `effective`, as
+    (minutes, axes), or None when a moved value is not a number (#866).
+
+    Both are {driver: value} over `SCALABLE_DRIVERS`. Plain proportional
+    scaling - steps/steps0 x (w.h)/(w0.h0) x frames/frames0 - with no fixed
+    term for the model load and decode, so it over-quotes a little when a
+    value rises and under-quotes when one falls. `axes` names each axis that
+    moved, for a caller to read ("steps 30 vs 9"); empty when none did.
+    """
+    moved = {
+        name
+        for name in SCALABLE_DRIVERS
+        if name in effective
+        and _driver_comparable(effective[name])
+        != _driver_comparable(defaults.get(name))
+    }
+    if not moved:
+        return minutes, []
+    values = {}
+    for name in SCALABLE_DRIVERS:
+        if name not in effective:
+            continue
+        pair = (_positive(defaults.get(name)), _positive(effective[name]))
+        if None in pair:
+            if name in moved:
+                return None
+            continue
+        values[name] = pair
+    factor = 1.0
+    axes = []
+    if STEPS_DRIVER in moved:
+        was, now = values[STEPS_DRIVER]
+        factor *= now / was
+        axes.append(f"steps {_shown(now)} vs {_shown(was)}")
+    canvas = [name for name in ("width", "height") if name in moved]
+    for name in canvas:
+        was, now = values[name]
+        factor *= now / was
+    if canvas and "width" in values and "height" in values:
+        (w0, w), (h0, h) = values["width"], values["height"]
+        axes.append(f"canvas {_shown(w)}x{_shown(h)} vs {_shown(w0)}x{_shown(h0)}")
+    else:
+        axes.extend(
+            f"{name} {_shown(values[name][1])} vs {_shown(values[name][0])}"
+            for name in canvas
+        )
+    if FRAMES_DRIVER in moved:
+        was, now = values[FRAMES_DRIVER]
+        factor *= now / was
+        axes.append(f"frames {_shown(now)} vs {_shown(was)}")
+    return minutes * factor, axes
+
+
+def _entry_frames(entries):
+    """The per-entry `num_frames` of a list's entries as numbers, or None
+    when an entry carries none (or a non-numeric one)."""
+    if not isinstance(entries, list) or not entries:
+        return None
+    frames = []
+    for entry in entries:
+        number = (
+            _positive(entry.get(FRAMES_DRIVER)) if isinstance(entry, dict) else None
+        )
+        if number is None:
+            return None
+        frames.append(number)
+    return frames
+
+
+def _list_frames_scaling(name, default_entries, effective_entries, list_entries):
+    """A list driver's per-entry frames as (factor, axis) - (1.0, None) when
+    they did not move - or None when they moved in a way that cannot be
+    scaled (#593, #866).
+
+    The frames a list renders are the sum over its entries. When the list's
+    length is already priced (`_repriced`, a `per_entry` rate), only the
+    mean per entry is left to scale, so the two multiply to the summed ratio
+    rather than counting the length twice.
+    """
+    measured = _entry_frames(default_entries)
+    running = _entry_frames(effective_entries)
+    if measured is None or running is None:
+        # Nothing to sum on one side: only a frame count outside the values
+        # the default entries carried leaves no figure, as before (#593)
+        if _list_entry_field_shifted(default_entries, effective_entries):
+            return None
+        return 1.0, None
+    was, now = sum(measured), sum(running)
+    if was == now:
+        return 1.0, None
+    factor = now / was
+    if name in list_entries:
+        factor = (now / len(running)) / (was / len(measured))
+        if math.isclose(factor, 1.0):
+            return 1.0, None
+    return factor, f"frames {_shown(now)} vs {_shown(was)} over {name}"
+
+
+def _driver_scaling(definition, expanded, list_entries):
+    """How far the declared `cost_drivers` moved the run away from the
+    defaults the curated `cost` was measured at, as (factor, axes, unscaled),
+    or None when a scalable one moved to a value that is not a number, or a
+    list's frames moved in a way nothing can scale (#267, #866).
+
+    A list driver's length is `_repriced`'s to price; here only its entries'
+    `num_frames` are. A scalar one in `SCALABLE_DRIVERS` scales in
+    proportion. Any other scalar driver that moved has no rule to scale by,
+    for every template: its name goes in `unscaled`, and the figure is kept
+    but flagged (#866, Q4).
+    """
+    defaults = definition.get("variables") or {}
+    effective = expanded.get("variables") or {}
+    factor = 1.0
+    axes = []
+    at_default = {}
+    running = {}
+    unscaled = []
+    for name in _declared_drivers(definition):
+        default_value = defaults.get(name)
+        if isinstance(default_value, list):
+            frames = _list_frames_scaling(
+                name, default_value, effective.get(name), list_entries
+            )
+            if frames is None:
+                return None
+            factor *= frames[0]
+            if frames[1]:
+                axes.append(frames[1])
+            continue
+        if name in list_entries:
+            continue
+        if name in SCALABLE_DRIVERS:
+            at_default[name] = default_value
+            running[name] = effective.get(name)
+        elif _driver_comparable(effective.get(name)) != _driver_comparable(
+            default_value
+        ):
+            unscaled.append(name)
+    scaled = scale_curated(factor, at_default, running)
+    if scaled is None:
+        return None
+    return scaled[0], scaled[1] + axes, unscaled
+
+
+def _scaled(price, scaling):
+    """`price` scaled by a `_driver_scaling` answer: `derived` once any axis
+    moved (another device's figure stays `other_device`, as `_price` keeps it
+    for a resized list - #589), with `scaled` saying from what. A driver with
+    no rule to scale by that moved leaves the basis alone, and is named in
+    `differs` with `low_confidence` set: the figure was measured at another
+    setting of it (#866)."""
+    if scaling is None:
+        return {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+    factor, axes, unscaled = scaling
+    if price["minutes"] is None:
+        return price
+    if unscaled:
+        price = {**price, "differs": list(unscaled), "low_confidence": True}
+    if not axes:
+        return price
+    basis = OTHER_DEVICE if price["basis"] == OTHER_DEVICE else DERIVED
+    return {
+        **price,
+        "minutes": price["minutes"] * factor,
+        "basis": basis,
+        "scaled": f"scaled from the curated {_shown(price['minutes'])} min: "
+        + ", ".join(axes),
+    }
+
+
+def _entry_cost_field_shifted(definition, expanded):
+    """Whether any declared list driver carries a per-entry cost field outside
+    the values the default entries had."""
+    defaults = definition.get("variables") or {}
+    effective = expanded.get("variables") or {}
+    return any(
+        isinstance(defaults.get(name), list)
+        and _list_entry_field_shifted(defaults[name], effective.get(name))
+        for name in _declared_drivers(definition)
+    )
diff --git a/dw/for_each.py b/dw/for_each.py
index 6ddc6cc4..161aad76 100644
--- a/dw/for_each.py
+++ b/dw/for_each.py
@@ -69,6 +69,14 @@ def is_member_name(name):
     return isinstance(name, str) and MEMBER_SEPARATOR in name
 
 
+def group_of(name):
+    """The authored step a name stands for: a member's group, else the name
+    itself (the inverse of `member_name`; a step name never holds the
+    separator, so the first split is the group)."""
+    name = str(name)
+    return name.split(MEMBER_SEPARATOR)[0] if is_member_name(name) else name
+
+
 def expand_for_each(definition, source_indices=None):
     """The definition with every 'for_each' step replaced by its members.
 
diff --git a/dw/host_memory.py b/dw/host_memory.py
index 20a3c142..6af7701b 100644
--- a/dw/host_memory.py
+++ b/dw/host_memory.py
@@ -139,6 +139,19 @@ def _peak_rss_mb():
     return peak / _MB if sys.platform == "darwin" else peak / 1024.0
 
 
+def read_oom_score_adj(pid):
+    """The kernel's `oom_score_adj` for process `pid`, read now from /proc, or
+    None where it cannot be read (not Linux, or the process is gone). The
+    value in force, not the one the server meant to write (#881)."""
+    if not isinstance(pid, int) or pid <= 0:
+        return None
+    try:
+        with open(f"/proc/{pid}/oom_score_adj", "r") as f:
+            return int(f.read().strip())
+    except (OSError, ValueError):
+        return None
+
+
 def process_rss_mb(pid):
     """Resident set size of another process - a server's worker, read from
     the server - in MB, or None where it cannot be read (the process is
diff --git a/dw/host_memory_projection.py b/dw/host_memory_projection.py
index 6b6681ea..9710ea40 100644
--- a/dw/host_memory_projection.py
+++ b/dw/host_memory_projection.py
@@ -10,7 +10,7 @@
 curated (no author-declared memory figure - `host_memory_job_peak_rss_mb` is
 a worker-reported field, not a schema key); warn, not refuse (host RAM headroom
 is a property of *this machine*, not something a caller chose, so it never
-blocks a run); no cross-machine normalization; and a cold start - no history
+refuses a run; dispatch may delay a start on the figure, #869); no cross-machine normalization; and a cold start - no history
 for this workflow at all - means no check, the same rule `observed_cost.py`
 uses for GPU minutes.
 """
@@ -148,7 +148,9 @@ def _fit_peak_model(medians):
     return base, slope, low, high
 
 
-def _already_survived(rows, list_entries, requested, projected_mb, variables):
+def _already_survived(
+    rows, list_entries, requested, projected_mb, variables, released=False
+):
     """Whether a run at least as large as this request already finished on
     this box at or above the projected peak.
 
@@ -159,67 +161,110 @@ def _already_survived(rows, list_entries, requested, projected_mb, variables):
     completed data point, not a guess: warning about a peak already reached
     without incident tells a caller nothing they don't already know from ten
     minutes ago.
+
+    A `released` shape holds one entry's pipeline at a time, so its peak does
+    not scale with the list: a successful run at that peak survived it
+    whatever length that run had (#901 - dialogue-short's ~125 GB was reached
+    by runs of 5 and fewer shots alike, all of which finished). The
+    `released` projection is the largest peak among successful rows, so this
+    holds by construction; the check stays so the rule is stated in one
+    place.
     """
     for row in rows:
         peak = row.get("host_memory_job_peak_rss_mb")
         if not isinstance(peak, (int, float)) or peak < projected_mb:
             continue
+        if released:
+            return True
         count = _row_count(row, list_entries, variables)
         if count is not None and count >= requested:
             return True
     return False
 
 
-def host_memory_warnings(definition, list_entries, rows, ceiling_mb):
-    """Warnings for a projected host-memory peak this machine cannot hold,
-    or [] when there is nothing to project from or nothing to warn about.
+def _projection(definition, list_entries, rows):
+    """The projected peak and how it was reached, or None when there is no
+    list, no history, or nothing seedable to project for.
 
-    `rows` are this workflow's finished runs as `JobHistory.finished_runs()`
-    groups them - the same history `observed_cost.py` reads, extended with
-    `host_memory_job_peak_rss_mb` per row (#243, repointed from the
-    process-lifetime `host_memory_peak_rss_mb` by #272 - a small job run
-    right after a heavy one no longer inherits the heavy job's peak).
-    `ceiling_mb` is this box's own RAM, scaled by `CEILING_FRACTION`; the
-    caller reads that once per request rather than this module importing
-    `host_memory` for a per-validate syscall.
+    Returns `(projected_mb, shape, requested, released, variables)` - the
+    figure and the words `host_memory_warnings` quotes it in.
     """
     requested = _requested_count(list_entries)
-    if requested is None or not rows or not ceiling_mb:
-        return []
+    if requested is None or not rows:
+        return None
     if not _has_seedable_step(definition):
         # A task-only workflow loads no model to accumulate across entries -
         # the failure mode this module projects for doesn't apply to it
-        return []
+        return None
     variables = definition.get("variables") or {}
-    peaks = [row["host_memory_job_peak_rss_mb"] for row in rows]
+    peaks = [row.get("host_memory_job_peak_rss_mb") for row in rows]
     peaks = [value for value in peaks if isinstance(value, (int, float))]
     if not peaks:
         # Cold start: history exists for this workflow, but no run of it
         # ever reported a host-memory reading - nothing to project from
-        return []
-    if releases_between_iterations(definition):
-        projected_mb = max(peaks)
-        shape = f"~{round(projected_mb)} MB, the largest single iteration observed"
+        return None
+    released = releases_between_iterations(definition)
+    if released:
+        projected = max(peaks)
+        shape = f"~{round(projected)} MB, the largest single iteration observed"
     else:
         medians = _peak_by_count(rows, list_entries, variables)
         if not medians:
-            return []
+            return None
         base, slope, low_count, high_count = _fit_peak_model(medians)
-        projected_mb = base + slope * requested
+        projected = base + slope * requested
         if low_count == high_count:
             shape = (
-                f"~{round(projected_mb)} MB at {requested} entries, based on "
+                f"~{round(projected)} MB at {requested} entries, based on "
                 f"this workflow's own {low_count}-entry runs with no larger "
                 "history yet to project growth from"
             )
         else:
             shape = (
-                f"~{round(projected_mb)} MB at {requested} entries, "
+                f"~{round(projected)} MB at {requested} entries, "
                 f"extrapolated from runs of {low_count} and {high_count} entries"
             )
-    if projected_mb <= ceiling_mb:
+    return projected, shape, requested, released, variables
+
+
+def projected_mb(definition, list_entries, rows):
+    """`{"projected_mb", "runs"}` for a list run's projected host-memory
+    peak, or None - the figure `host_memory_warnings` compares with the
+    ceiling, for a caller that wants the number rather than a warning
+    (`dw/server/host_ram_need.py`, #869). `runs` counts the rows that
+    reported a peak."""
+    projection = _projection(definition, list_entries, rows)
+    if projection is None:
+        return None
+    runs = sum(
+        isinstance(row.get("host_memory_job_peak_rss_mb"), (int, float)) for row in rows
+    )
+    return {"projected_mb": projection[0], "runs": runs}
+
+
+def host_memory_warnings(definition, list_entries, rows, ceiling_mb):
+    """Warnings for a projected host-memory peak this machine cannot hold,
+    or [] when there is nothing to project from or nothing to warn about.
+
+    `rows` are this workflow's finished runs as `JobHistory.finished_runs()`
+    groups them - the same history `observed_cost.py` reads, extended with
+    `host_memory_job_peak_rss_mb` per row (#243, repointed from the
+    process-lifetime `host_memory_peak_rss_mb` by #272 - a small job run
+    right after a heavy one no longer inherits the heavy job's peak).
+    `ceiling_mb` is this box's own RAM, scaled by `CEILING_FRACTION`; the
+    caller reads that once per request rather than this module importing
+    `host_memory` for a per-validate syscall. The projection itself is
+    `_projection`'s, shared with `projected_mb`.
+    """
+    if not ceiling_mb:
+        return []
+    projection = _projection(definition, list_entries, rows)
+    if projection is None:
+        return []
+    projected, shape, requested, released, variables = projection
+    if projected <= ceiling_mb:
         return []
-    if _already_survived(rows, list_entries, requested, projected_mb, variables):
+    if _already_survived(rows, list_entries, requested, projected, variables, released):
         return []
     return [
         f"Projected host memory for this run ({shape}) exceeds this "
diff --git a/dw/hub_cache.py b/dw/hub_cache.py
index d67e7b0a..38e736e0 100644
--- a/dw/hub_cache.py
+++ b/dw/hub_cache.py
@@ -11,7 +11,9 @@
 import json
 import logging
 import os
+import re
 import shutil
+import tempfile
 import threading
 import time
 import uuid
@@ -112,13 +114,25 @@ def _snapshot_dir(repo_dir):
     return snapshot if os.path.isdir(snapshot) else None
 
 
-def _component_incomplete(folder, variant):
+# Component classes that carry no weights: a folder holding only config
+# files is whole for them
+_WEIGHTLESS_CLASS_MARKERS = ("Scheduler", "Tokenizer", "Processor", "Extractor")
+
+
+def _component_incomplete(folder, variant, class_name=None):
     """Whether a diffusers pipeline component's folder is missing files a
-    load would need. A component with no weight files at all (a scheduler
-    or tokenizer config) is complete once its folder exists; one with
-    weight files is checked against the requested `variant` only when that
-    variant is actually in play, since an unvarianted component (most
-    schedulers, safety checkers) never carries a tagged file."""
+    load would need. The rule, by `class_name` (#894):
+
+    - A weightless class (Scheduler, Tokenizer, Processor, Extractor - see
+      `_WEIGHTLESS_CLASS_MARKERS`) is complete once its folder exists and is
+      non-empty.
+    - Any other class is weight-bearing: it is incomplete with no weight
+      files (an earlier pull that stopped after the configs), with a weight
+      file that is a dangling symlink (its blob never arrived), or with a
+      shard named by a `*.index.json` weight_map that is absent.
+    - The `variant` check applies only when a variant is actually
+      requested, since an unvarianted component (most schedulers, safety
+      checkers) never carries a tagged file."""
     if not os.path.isdir(folder):
         return True
     try:
@@ -127,10 +141,30 @@ def _component_incomplete(folder, variant):
         return True
     if not entries:
         return True
-    if not variant:
-        return False
     weight_files = [e for e in entries if e.endswith(_WEIGHT_SUFFIXES)]
+    # A weight-bearing component whose folder holds only configs (an earlier
+    # pull that stopped after the small files) is not whole (#894)
     if not weight_files:
+        return isinstance(class_name, str) and not any(
+            marker in class_name for marker in _WEIGHTLESS_CLASS_MARKERS
+        )
+    # A symlink whose blob is gone is a file that never arrived
+    if any(not os.path.exists(os.path.join(folder, e)) for e in weight_files):
+        return True
+    for name in entries:
+        if name.endswith(".safetensors.index.json") or name.endswith(".bin.index.json"):
+            try:
+                with open(os.path.join(folder, name)) as f:
+                    shards = set(json.load(f).get("weight_map", {}).values())
+            except (OSError, ValueError, AttributeError):
+                continue
+            if any(
+                os.path.basename(shard) != shard
+                or not os.path.exists(os.path.join(folder, shard))
+                for shard in shards
+            ):
+                return True
+    if not variant:
         return False
     return not any(f".{variant}." in name for name in weight_files)
 
@@ -146,8 +180,8 @@ def repo_download_incomplete(repo_id, cache_dir=None, variant=None):
     `*.incomplete` blob (huggingface_hub's own marker for a file mid-transfer)
     anywhere in the repo's `blobs/` makes the repo incomplete outright. Past
     that, a diffusers pipeline repo (one with a `model_index.json` in its
-    current snapshot) is checked component by component, for the requested
-    `variant`; a plain checkpoint/LoRA repo (no `model_index.json`) has
+    current snapshot) is checked component by component, by its class and
+    for the requested `variant` (see `_component_incomplete`); a plain checkpoint/LoRA repo (no `model_index.json`) has
     nothing further to check beyond its blobs.  This is not a full hub
     file-list diff - it does not fetch the repo's file list from the hub, so
     a file that was never attempted at all on an otherwise-untouched repo
@@ -197,7 +231,8 @@ def repo_download_incomplete(repo_id, cache_dir=None, variant=None):
         # downloads_required a yes/no oracle for directories on the box
         if os.path.basename(key) != key or key in (".", ".."):
             continue
-        if _component_incomplete(os.path.join(snapshot, key), variant):
+        class_name = value[1] if len(value) > 1 else None
+        if _component_incomplete(os.path.join(snapshot, key), variant, class_name):
             return True
     return False
 
@@ -233,7 +268,7 @@ class DownloadManager:
 
     One thread per download; progress is fed by a tqdm-compatible tracker
     that snapshot_download instantiates per file, so the counters aggregate
-    across the file pool. Cancellation raises out of the next progress tick;
+    across the file pool. Cancellation raises out of the next progress tick (and aborts the xet session);
     huggingface_hub's partial files remain resumable, so a cancelled or
     failed download picks up where it stopped when retried.
     """
@@ -243,9 +278,9 @@ class DownloadManager:
     def __init__(self, download_fn=None, info_fn=None):
         # Injectable for tests - the defaults reach the network
         if download_fn is None or info_fn is None:
-            from huggingface_hub import HfApi, snapshot_download
+            from huggingface_hub import HfApi
 
-            download_fn = download_fn or snapshot_download
+            download_fn = download_fn or _download_repo
             info_fn = info_fn or (
                 lambda repo_id: HfApi().repo_info(repo_id, files_metadata=True)
             )
@@ -278,6 +313,9 @@ def start(self, repo_id):
                 "error": None,
                 "started_at": time.time(),
                 "finished_at": None,
+                # True from cancel() until the download is terminal, so a
+                # consumer can tell "stopping" from "still pulling" (#899)
+                "cancel_requested": False,
                 # Set before the entry is published: cancel() reaches for this
                 # the moment the id is visible, and assigning it after the
                 # lock left a window where cancelling raised KeyError
@@ -310,13 +348,19 @@ def _run(self, entry, cancel_event):
         except DownloadCancelled:
             self._finish(entry, "cancelled")
         except Exception as e:
-            self._finish(entry, "failed", str(e))
+            # An aborted xet transfer surfaces as whatever the library
+            # raises; a requested cancel is a cancel, not a failure
+            if cancel_event.is_set():
+                self._finish(entry, "cancelled")
+            else:
+                self._finish(entry, "failed", str(e))
 
     def _finish(self, entry, status, error=None):
         with self._lock:
             entry["status"] = status
             entry["error"] = error
             entry["finished_at"] = time.time()
+            entry["cancel_requested"] = False
 
     def _add_progress(self, entry, n):
         with self._lock:
@@ -324,13 +368,25 @@ def _add_progress(self, entry, n):
 
     def cancel(self, download_id):
         """Request cancellation; returns the status dict or None if unknown.
-        Takes effect at the download's next progress tick."""
+        The record shows `cancel_requested` until it is terminal. A plain
+        download stops at its next chunk; an xet transfer, which ticks only
+        as it writes a file, is aborted outright (#899)."""
+        abort_xet = False
         with self._lock:
             entry = self._downloads.get(download_id)
             if entry is None:
                 return None
             if entry["status"] == "downloading":
                 entry["_cancel"].set()
+                entry["cancel_requested"] = True
+                # The xet session is process-wide: abort it only when no
+                # other download shares it
+                abort_xet = all(
+                    other is entry or other["status"] != "downloading"
+                    for other in self._downloads.values()
+                )
+        if abort_xet:
+            _abort_xet_session()
         return self.status(download_id)
 
     def status(self, download_id):
@@ -365,6 +421,91 @@ def _prune(self):
             del self._downloads[entry["id"]]
 
 
+def _download_repo(repo_id, tqdm_class, max_workers=4, cache_dir=None):
+    """Fetch every file of repo_id, stopping promptly on a cancel (#899).
+
+    Stands in for `snapshot_download`, whose file pool runs every queued file
+    to the end after a cancel (its worker threads swallow the tracker's
+    exception, and aborting the xet session only ends the files in flight).
+    Here each file checks the cancel event before it starts, so a cancel
+    leaves at most the aborted in-flight files behind.
+
+    Every file is pinned to the commit `repo_info` resolved for `main`, and
+    hf_hub_download writes no ref for a commit-hash revision, so this writes
+    `refs/main` itself once every file is in and no cancel came - without it
+    `repo_download_incomplete` reads the pull as unfinished and an offline
+    load cannot resolve `main`. A cancelled pull writes no ref."""
+    from concurrent.futures import ThreadPoolExecutor
+
+    from huggingface_hub import HfApi, hf_hub_download
+
+    cancel_event = tqdm_class._cancel_event
+    # repo_info's default revision is `main` - the ref written below
+    info = HfApi().repo_info(repo_id)
+    files = [sibling.rfilename for sibling in info.siblings or []]
+
+    def fetch(filename):
+        if cancel_event.is_set():
+            raise DownloadCancelled()
+        hf_hub_download(
+            repo_id,
+            filename=filename,
+            revision=info.sha,
+            tqdm_class=tqdm_class,
+            cache_dir=cache_dir,
+        )
+
+    pool = ThreadPoolExecutor(max_workers=max_workers)
+    try:
+        for future in [pool.submit(fetch, name) for name in files]:
+            future.result()
+    finally:
+        pool.shutdown(wait=True, cancel_futures=True)
+    if cancel_event.is_set():
+        raise DownloadCancelled()
+    _write_main_ref(repo_id, info.sha, cache_dir)
+
+
+_COMMIT_HASH = re.compile(r"^[0-9a-f]{40}$")
+
+
+def _write_main_ref(repo_id, commit, cache_dir=None):
+    """Point repo_id's `refs/main` at `commit`, atomically: a temp file in
+    the refs folder, then os.replace over the ref."""
+    if not isinstance(commit, str) or not _COMMIT_HASH.match(commit):
+        # The ref names a snapshot folder; anything but a commit hash is
+        # not a value to write into the cache
+        raise ValueError(f"'{repo_id}' resolved to no commit hash: {commit!r}")
+    resolved = _resolved_cache_dir(cache_dir)
+    repo_dir = validate_path(
+        os.path.join(resolved, _repo_folder_name(repo_id)), resolved
+    )
+    refs_dir = validate_path(os.path.join(repo_dir, "refs"), repo_dir)
+    ref_path = validate_path(os.path.join(refs_dir, "main"), refs_dir)
+    os.makedirs(refs_dir, exist_ok=True)
+    fd, tmp_path = tempfile.mkstemp(dir=refs_dir, prefix=".main.", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write(commit)
+        os.replace(tmp_path, ref_path)
+    except BaseException:
+        try:
+            os.unlink(tmp_path)
+        except OSError:
+            pass
+        raise
+
+
+def _abort_xet_session():
+    """Stop in-flight hf_xet transfers (the hub's own KeyboardInterrupt path)."""
+    try:
+        from huggingface_hub.utils._xet import abort_xet_session
+
+        abort_xet_session()
+    except Exception as e:
+        logger.debug(f"Could not abort the xet session: {e}")
+
+
 def _public(entry):
     return {key: value for key, value in entry.items() if not key.startswith("_")}
 
diff --git a/dw/media_compare.py b/dw/media_compare.py
new file mode 100644
index 00000000..c051fcb1
--- /dev/null
+++ b/dw/media_compare.py
@@ -0,0 +1,418 @@
+"""Two to eight outputs side by side at the same moments, with how far each
+is from a baseline - the read-only `compare_outputs` (#871). One grid (a
+row per output, a column per moment) and, per non-baseline output, PSNR,
+SSIM and mean absolute difference against the baseline at source
+resolution.
+
+Metrics always compare the same pixels: one shared crop is the region they
+cover, and anything else - no crop, or one crop per output, which only
+changes what each row *shows* - leaves them on the full frame. Outputs
+whose frames differ in size get no number, and say why: a resize to force
+one would itself be a difference. A moment past an output's end is a
+blank cell, and says so.
+
+The server process runs this per request, like `media_frames`: the
+baseline's frames are held at source size for the whole call, every other
+output's only while its own row is measured and fitted to tiles.
+"""
+
+import math
+import os
+
+import numpy
+from PIL import Image, ImageDraw, ImageFont
+
+from . import media, references
+from .media_frames import compose_grid, evenly_spaced_indices, moment_index, parse_crop
+
+MAX_COMPARE_NAMES = 8
+MAX_COMPARE_MOMENTS = 8
+DEFAULT_MOMENT_COUNT = 4
+
+FULL_FRAME = "full frame"
+PER_OUTPUT_CROPS = "full frame (per-output crops are display only)"
+
+
+class UnreadableMedia(Exception):
+    """A file that resolved but whose frames could not be decoded - the
+    route answers 422, the file's problem rather than the caller's."""
+
+
+def psnr(a, b):
+    """Peak signal-to-noise ratio of two uint8 arrays in dB, `math.inf`
+    when they are identical."""
+    difference = a.astype(numpy.float64) - b.astype(numpy.float64)
+    mse = float(numpy.mean(difference * difference))
+    if mse == 0.0:
+        return math.inf
+    return 10.0 * math.log10(255.0 * 255.0 / mse)
+
+
+def ssim(a, b):
+    """Structural similarity of two uint8 RGB arrays, on their luma, with
+    the usual 11x11 Gaussian window (sigma 1.5) - 1.0 when identical."""
+    import cv2
+
+    x = _luma(a)
+    y = _luma(b)
+    c1 = (0.01 * 255) ** 2
+    c2 = (0.03 * 255) ** 2
+
+    def blur(image):
+        return cv2.GaussianBlur(image, (11, 11), 1.5)
+
+    mu_x = blur(x)
+    mu_y = blur(y)
+    var_x = blur(x * x) - mu_x * mu_x
+    var_y = blur(y * y) - mu_y * mu_y
+    covariance = blur(x * y) - mu_x * mu_y
+    numerator = (2 * mu_x * mu_y + c1) * (2 * covariance + c2)
+    denominator = (mu_x * mu_x + mu_y * mu_y + c1) * (var_x + var_y + c2)
+    return float(numpy.mean(numerator / denominator))
+
+
+def mean_abs_diff(a, b):
+    """Mean absolute difference of two uint8 arrays, on the 0-255 scale."""
+    return float(numpy.mean(numpy.abs(a.astype(numpy.int16) - b.astype(numpy.int16))))
+
+
+def _luma(rgb):
+    # ITU-R 601, the weights Pillow's "L" conversion uses
+    rgb = rgb.astype(numpy.float64)
+    return rgb[..., 0] * 0.299 + rgb[..., 1] * 0.587 + rgb[..., 2] * 0.114
+
+
+def check_request(names, at, crop, baseline):
+    """Refuse a request by its shape before anything is resolved or
+    decoded: name and moment counts, the baseline, the crop's form.
+    Returns (the baseline's row, crop mode: None, "shared" or "each")."""
+    if not isinstance(names, list) or not 2 <= len(names) <= MAX_COMPARE_NAMES:
+        count = len(names) if isinstance(names, list) else 0
+        raise ValueError(
+            f"`names` holds {count} outputs; compare takes 2 to {MAX_COMPARE_NAMES}"
+        )
+    if at is not None and not 1 <= len(at) <= MAX_COMPARE_MOMENTS:
+        raise ValueError(
+            f"`at` names {len(at)} moments; compare takes 1 to {MAX_COMPARE_MOMENTS}"
+        )
+    if baseline is None:
+        row = 0
+    elif baseline in names:
+        row = names.index(baseline)
+    else:
+        raise ValueError(f"baseline {baseline!r} is not one of `names`")
+    if crop is None:
+        return row, None
+    if crop and all(isinstance(box, (list, tuple)) for box in crop):
+        if len(crop) != len(names):
+            raise ValueError(
+                f"`crop` gives {len(crop)} boxes for {len(names)} names - give "
+                "one [x, y, width, height] for every output, or one box for all"
+            )
+        return row, "each"
+    return row, "shared"
+
+
+def crop_box(crop, width, height, name):
+    """`[x, y, w, h]` as Pillow's (left, upper, right, lower), refused unless
+    it lies wholly inside this output's `width` x `height` frame - a box
+    clamped differently per output would measure different regions."""
+    x, y, w, h = parse_crop(crop)
+    if x + w > width or y + h > height:
+        raise ValueError(
+            f"crop {[x, y, w, h]} is out of bounds for {name}, which is "
+            f"{width}x{height}"
+        )
+    return (x, y, x + w, y + h)
+
+
+def resolve_moments(at, reference, shortest):
+    """The frame index each moment names, as [(moment, frame)]. Seconds
+    convert at the reference video's fps (the baseline's, or the first
+    video's), and a negative moment is refused rather than counted back
+    from an end; every output is then read at that same frame number.
+    Without `at`, 4 evenly spaced frames of the shortest video."""
+    if at is None:
+        return [
+            (f"frame:{index}", index)
+            for index in evenly_spaced_indices(shortest, DEFAULT_MOMENT_COUNT)
+        ]
+    resolved = []
+    for moment in at:
+        resolved.append((moment, moment_index(moment, reference, from_end=False)))
+    return resolved
+
+
+def compare(sources, at, crop, baseline_row, crop_mode, max_dimension):
+    """The grid and metrics for `sources`, one dict per output in the
+    caller's order: {name, kind, and for a still `image` (decoded, PIL),
+    for a video `path` and `shape` (`video_shape`)}. Returns the answer's
+    body without the encoded grid, plus the grid itself under "grid"."""
+    for source in sources:
+        source["width"], source["height"] = _size(source)
+        source["box"] = None
+    if crop_mode == "shared":
+        for source in sources:
+            source["box"] = crop_box(
+                crop, source["width"], source["height"], source["name"]
+            )
+    elif crop_mode == "each":
+        for source, box in zip(sources, crop):
+            source["box"] = crop_box(
+                box, source["width"], source["height"], source["name"]
+            )
+
+    videos = [source for source in sources if source["kind"] == "video"]
+    notes = []
+    if videos:
+        reference = (
+            sources[baseline_row]
+            if sources[baseline_row]["kind"] == "video"
+            else videos[0]
+        )
+        shortest = min(video["shape"]["frame_count"] for video in videos)
+        columns = resolve_moments(at, reference["shape"], shortest)
+        if all(
+            frame >= video["shape"]["frame_count"]
+            for _, frame in columns
+            for video in videos
+        ):
+            raise ValueError(
+                f"every moment is past the end of every video (the shortest has "
+                f"{shortest} frames)"
+            )
+    else:
+        columns = [("still", 0)]
+        if at is not None:
+            notes.append("`at` ignored: every output is a still image")
+    frames = [frame for _, frame in columns]
+
+    metrics_region = (
+        PER_OUTPUT_CROPS
+        if crop_mode == "each"
+        else f"crop {_rectangle(sources[0]['box'])}"
+        if crop_mode == "shared"
+        else FULL_FRAME
+    )
+    measure_box = sources[0]["box"] if crop_mode == "shared" else None
+
+    baseline = sources[baseline_row]
+    base_frames = _frames(baseline, frames)
+    base_arrays = [
+        None if frame is None else _measured(frame, measure_box)
+        for frame in base_frames
+    ]
+
+    rows = []
+    metrics = []
+    for row, source in enumerate(sources):
+        source_frames = base_frames if row == baseline_row else _frames(source, frames)
+        if row != baseline_row:
+            metrics.append(
+                _metrics_for(
+                    row, source, source_frames, baseline, base_arrays, measure_box
+                )
+            )
+        rows.append(
+            [
+                None if frame is None else _cell(frame, source["box"], max_dimension)
+                for frame in source_frames
+            ]
+        )
+        del source_frames
+
+    fps_values = {round(video["shape"]["fps"] or 0.0, 3) for video in videos}
+    grid = _grid(rows, sources, baseline_row, frames, bool(videos))
+    return {
+        "grid": grid,
+        "baseline": baseline["name"],
+        "region": metrics_region,
+        "fps_differs": len(fps_values) > 1,
+        "columns": [
+            {"moment": moment, "frame": frame if videos else None}
+            for moment, frame in columns
+        ],
+        "rows": [_row_summary(source) for source in sources],
+        "metrics": metrics,
+        "notes": notes,
+    }
+
+
+def _size(source):
+    if source["kind"] == "video":
+        return source["shape"]["width"], source["shape"]["height"]
+    return source["image"].size
+
+
+def _frames(source, frames):
+    """The source's frames at these indexes as RGB PIL images, None for a
+    moment past its end. A still is the same image at every moment."""
+    if source["kind"] == "image":
+        image = source["image"].convert("RGB")
+        return [image for _ in frames]
+    total = source["shape"]["frame_count"]
+    inside = [frame for frame in frames if frame < total]
+    try:
+        found = media.read_frames(source["path"], inside) if inside else {}
+    except Exception as e:
+        # PyAV's own errors, or read_frames' ValueError for a frame it
+        # could not reach: either way the file, not the request
+        raise UnreadableMedia(f"{source['name']} could not be decoded: {e}")
+    return [found[frame].convert("RGB") if frame < total else None for frame in frames]
+
+
+def _measured(image, box):
+    return numpy.asarray(image.crop(box) if box else image)
+
+
+def _metrics_for(row, source, source_frames, baseline, base_arrays, measure_box):
+    entry = {"name": source["name"], "row": row, "reason": None, "cells": []}
+    same_size = (source["width"], source["height"]) == (
+        baseline["width"],
+        baseline["height"],
+    )
+    if not same_size:
+        entry["reason"] = (
+            f"size differs from baseline: {source['width']}x{source['height']} "
+            f"vs {baseline['width']}x{baseline['height']}"
+        )
+    for frame, base in zip(source_frames, base_arrays):
+        cell = {"psnr_db": None, "ssim": None, "mean_abs_diff": None, "reason": None}
+        if frame is None:
+            cell["reason"] = f"past end ({source['shape']['frame_count']} frames)"
+        elif base is None:
+            cell["reason"] = (
+                f"baseline past end ({baseline['shape']['frame_count']} frames)"
+            )
+        elif not same_size:
+            cell["reason"] = entry["reason"]
+        else:
+            ours = _measured(frame, measure_box)
+            value = psnr(ours, base)
+            cell.update(
+                psnr_db="identical" if math.isinf(value) else round(value, 2),
+                ssim=round(ssim(ours, base), 4),
+                mean_abs_diff=round(mean_abs_diff(ours, base), 3),
+            )
+        entry["cells"].append(cell)
+    measured = [cell for cell in entry["cells"] if cell["ssim"] is not None]
+    for key in ("psnr_db", "ssim", "mean_abs_diff"):
+        entry[key] = _summary([cell[key] for cell in measured])
+    if not measured and entry["reason"] is None:
+        entry["reason"] = "no moment holds a frame of both this output and the baseline"
+    return entry
+
+
+def _summary(values):
+    """mean, min and max of one metric over the measured columns, None when
+    none was measured. PSNR's "identical" columns are left out of the
+    arithmetic (they are infinite) and counted; all identical is
+    "identical" throughout."""
+    if not values:
+        return None
+    finite = [value for value in values if value != "identical"]
+    identical = len(values) - len(finite)
+    if not finite:
+        return {"mean": "identical", "min": "identical", "max": "identical"}
+    summary = {
+        "mean": round(sum(finite) / len(finite), 4),
+        "min": min(finite),
+        "max": "identical" if identical else max(finite),
+    }
+    if identical:
+        summary["identical_columns"] = identical
+    return summary
+
+
+def _rectangle(box):
+    return [box[0], box[1], box[2] - box[0], box[3] - box[1]]
+
+
+def _row_summary(source):
+    summary = {
+        "name": source["name"],
+        "kind": source["kind"],
+        "width": source["width"],
+        "height": source["height"],
+        "crop": _rectangle(source["box"]) if source["box"] else None,
+    }
+    if source["kind"] == "video":
+        summary["frame_count"] = source["shape"]["frame_count"]
+        summary["fps"] = source["shape"]["fps"]
+    return summary
+
+
+def _cell(frame, box, max_dimension):
+    """One grid cell: the frame cut to its row's box at source pixels, then
+    fitted to `max_dimension` on its longest side - never enlarged."""
+    image = frame.crop(box) if box else frame
+    limit = max(1, int(max_dimension))
+    longest = max(image.size)
+    if longest > limit:
+        scale = limit / longest
+        image = image.resize(
+            (max(1, round(image.width * scale)), max(1, round(image.height * scale))),
+            Image.LANCZOS,
+        )
+    return image.convert("RGB")
+
+
+def short_name(name):
+    """A row's label: an asset reference as given, an output as its run id
+    and file (the workflow folder is the same across a comparison)."""
+    if references.is_ref(references.ASSET, name):
+        return name
+    parts = name.replace(os.sep, "/").split("/")
+    return "/".join(parts[-2:])
+
+
+def _grid(rows, sources, baseline_row, frames, stamped):
+    """Rows of cells, every cell letterboxed to the largest cell's size so
+    rows of different aspect still line up in columns; each row under a
+    band naming its output, each cell stamped with its frame number."""
+    cells = [cell for row in rows for cell in row if cell is not None]
+    width = max(cell.width for cell in cells)
+    height = max(cell.height for cell in cells)
+    font_size = max(10, min(width // 16, 20))
+    font = _font(font_size)
+    band = font_size + 8
+    tiles = []
+    for row, source in zip(rows, sources):
+        for cell, frame in zip(row, frames):
+            tile = Image.new("RGB", (width, height), (32, 32, 32))
+            if cell is not None:
+                tile.paste(
+                    cell, ((width - cell.width) // 2, (height - cell.height) // 2)
+                )
+                if stamped:
+                    _stamp(tile, f"frame {frame}", font)
+            else:
+                _stamp(tile, f"frame {frame}: past end", font)
+            tiles.append(tile)
+    body = compose_grid(tiles, len(frames))
+    grid = Image.new("RGB", (body.width, body.height + band * len(rows)), (0, 0, 0))
+    draw = ImageDraw.Draw(grid)
+    for index, source in enumerate(sources):
+        top = index * (height + band)
+        label = f"{index + 1}. {short_name(source['name'])}"
+        if index == baseline_row:
+            label += "  (baseline)"
+        draw.text((4, top + 4), label, font=font, fill="white")
+        grid.paste(
+            body.crop((0, index * height, body.width, (index + 1) * height)),
+            (0, top + band),
+        )
+    return grid
+
+
+def _stamp(tile, text, font):
+    ImageDraw.Draw(tile).text(
+        (4, 4), text, font=font, fill="white", stroke_width=2, stroke_fill="black"
+    )
+
+
+def _font(size):
+    try:
+        return ImageFont.truetype("Arial", size)
+    except (IOError, OSError):
+        return ImageFont.load_default(size=size)
diff --git a/dw/media_frames.py b/dw/media_frames.py
index 7cfef292..c58c6dcd 100644
--- a/dw/media_frames.py
+++ b/dw/media_frames.py
@@ -31,6 +31,19 @@ def resolve_crop_box(crop, width, height):
     across every tile - the same `[x, y, width, height]` convention
     `get_output_image`'s crop uses. Refused when it is not four
     non-negative integers, starts outside the frame, or has nothing in it."""
+    x, y, w, h = parse_crop(crop)
+    if x >= width or y >= height:
+        raise ValueError(
+            f"crop origin ({x}, {y}) lies outside the {width}x{height} frame."
+        )
+    return (x, y, min(x + w, width), min(y + h, height))
+
+
+def parse_crop(crop):
+    """`[x, y, width, height]` as four ints - the crop convention every
+    media route shares. Refused when it is not four integers, or has a
+    negative origin or an empty size. Bounds are the caller's policy:
+    `resolve_crop_box` clamps, `media_compare.crop_box` refuses."""
     try:
         x, y, w, h = (int(v) for v in crop)
     except (TypeError, ValueError):
@@ -39,11 +52,7 @@ def resolve_crop_box(crop, width, height):
         raise ValueError(
             f"crop must have a non-negative origin and a positive size, got {crop!r}."
         )
-    if x >= width or y >= height:
-        raise ValueError(
-            f"crop origin ({x}, {y}) lies outside the {width}x{height} frame."
-        )
-    return (x, y, min(x + w, width), min(y + h, height))
+    return x, y, w, h
 
 
 def first_frame(path):
@@ -195,7 +204,13 @@ def fit(image, _index):
     return tiles
 
 
-def _moment_to_index(moment, shape):
+def moment_index(moment, shape, from_end=True):
+    """The frame index one `at` moment names in a clip of `shape`
+    (`video_shape`): "frame:N", or seconds converted at the clip's fps and
+    rounded. A negative moment counts back from the end, or with
+    `from_end=False` is refused. This is the `at` grammar
+    `get_output_frames` and `compare_outputs` share; the index is not
+    bounds-checked, because past-end is each caller's policy."""
     total = shape["frame_count"]
     if isinstance(moment, str) and moment.startswith("frame:"):
         raw = moment[len("frame:") :]
@@ -203,38 +218,51 @@ def _moment_to_index(moment, shape):
             index = int(raw)
         except ValueError:
             raise ValueError(f'"{moment}" - frame index must be a whole number')
-        if index < 0:
-            index += total
-        if not 0 <= index < total:
-            raise ValueError(
-                f"frame {index} is past the end of a {total}-frame clip "
-                f"(frames 0-{total - 1})"
-            )
-        return index
-    fps = shape["fps"]
-    if fps is None:
-        raise ValueError("this clip has no frame rate, so name a frame: 'frame:N'")
-    seconds = float(moment)
-    if not math.isfinite(seconds):
-        raise ValueError(f"{moment!r} is not a moment in seconds")
-    index = int(round(seconds * fps))
+        negative = index < 0
+    else:
+        try:
+            seconds = float(moment)
+        except (TypeError, ValueError):
+            raise ValueError(f'{moment!r} is not a moment - seconds, or "frame:N"')
+        if not math.isfinite(seconds):
+            raise ValueError(f"{moment!r} is not a moment in seconds")
+        if not shape["fps"]:
+            raise ValueError("this clip has no frame rate, so name a frame: 'frame:N'")
+        negative = seconds < 0
+        index = int(round(seconds * shape["fps"]))
+    if negative and not from_end:
+        raise ValueError(
+            f"{moment!r} is negative - moments count from the start of the clip"
+        )
     if index < 0:
         index += total
-    if not 0 <= index < total:
-        duration = total / fps
-        message = (
-            f"{moment!r} s is past the end of a {duration:.2f} s "
-            f"({total}-frame) clip - bare numbers in 'at' are seconds"
-        )
-        # A fractional value is a seconds overshoot, not a frame index in
-        # disguise - the frame: hint only makes sense for a whole number
-        # that would itself be a valid frame index.
-        if seconds.is_integer() and 0 <= int(seconds) < total:
-            message += f'; use "frame:{_format_moment(moment)}" for a frame index'
-        raise ValueError(message)
     return index
 
 
+def _moment_to_index(moment, shape):
+    total = shape["frame_count"]
+    index = moment_index(moment, shape)
+    if 0 <= index < total:
+        return index
+    if isinstance(moment, str) and moment.startswith("frame:"):
+        raise ValueError(
+            f"frame {index} is past the end of a {total}-frame clip "
+            f"(frames 0-{total - 1})"
+        )
+    seconds = float(moment)
+    duration = total / shape["fps"]
+    message = (
+        f"{moment!r} s is past the end of a {duration:.2f} s "
+        f"({total}-frame) clip - bare numbers in 'at' are seconds"
+    )
+    # A fractional value is a seconds overshoot, not a frame index in
+    # disguise - the frame: hint only makes sense for a whole number
+    # that would itself be a valid frame index.
+    if seconds.is_integer() and 0 <= int(seconds) < total:
+        message += f'; use "frame:{_format_moment(moment)}" for a frame index'
+    raise ValueError(message)
+
+
 def _format_moment(moment):
     if isinstance(moment, float) and moment.is_integer():
         return str(int(moment))
diff --git a/dw/notes.py b/dw/notes.py
new file mode 100644
index 00000000..32aefc48
--- /dev/null
+++ b/dw/notes.py
@@ -0,0 +1,177 @@
+"""Notes: optional plain text a person or an agent leaves on a run, on a
+file, on an asset or on a workspace, saying what it is for.
+
+Two stores, both sidecars the media listings never show (.json is not a
+media kind):
+
+- `notes.json` in a directory - a run directory or an asset-library
+  directory - holding `{"run": ..., "files": {<name relative to the
+  directory>: ...}}`. A file's effective note is its own, else the run's.
+  The engine rewrites manifest.json throughout a run, so notes live apart
+  from it and only the server writes them.
+- `workspace.json` at a workspace root, holding `{"notes": ...}`.
+
+Callers resolve and validate the directory; this module joins only its
+own fixed file names onto it. A write that leaves nothing removes the file.
+"""
+
+import json
+import os
+import threading
+
+from .runs import write_json_atomic
+from .workspace import WORKSPACE_FILE_NAME  # noqa: F401 - re-exported
+
+NOTES_FILE_NAME = "notes.json"
+MAX_NOTE_LENGTH = 4000
+
+_locks = {}
+_locks_guard = threading.Lock()
+
+
+class NoteTooLong(ValueError):
+    pass
+
+
+def clean_note(note):
+    """The note as stored: None for nothing, else the text, length-checked."""
+    if note is None:
+        return None
+    if not isinstance(note, str):
+        raise TypeError(f"a note is text, not {type(note).__name__}")
+    if not note.strip():
+        return None
+    if len(note) > MAX_NOTE_LENGTH:
+        raise NoteTooLong(
+            f"a note is at most {MAX_NOTE_LENGTH} characters, got {len(note)}"
+        )
+    return note
+
+
+def _lock(directory):
+    key = os.path.realpath(directory)
+    with _locks_guard:
+        return _locks.setdefault(key, threading.Lock())
+
+
+def _read_json(path):
+    try:
+        with open(path) as handle:
+            data = json.load(handle)
+    except (OSError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def read_notes(directory):
+    data = _read_json(os.path.join(directory, NOTES_FILE_NAME))
+    run = data.get("run") if isinstance(data.get("run"), str) else None
+    files = data.get("files") if isinstance(data.get("files"), dict) else {}
+    files = {
+        k: v for k, v in files.items() if isinstance(k, str) and isinstance(v, str)
+    }
+    return {"run": run, "files": files}
+
+
+def read_starred(directory):
+    """The names starred in `directory`'s notes.json, as a set."""
+    starred = _read_json(os.path.join(directory, NOTES_FILE_NAME)).get("starred")
+    if not isinstance(starred, list):
+        return set()
+    return {name for name in starred if isinstance(name, str)}
+
+
+def _store(directory, notes, starred):
+    path = os.path.join(directory, NOTES_FILE_NAME)
+    if notes["run"] is None and not notes["files"] and not starred:
+        try:
+            os.remove(path)
+        except FileNotFoundError:
+            pass
+        return
+    data = {k: v for k, v in notes.items() if v}
+    if starred:
+        data["starred"] = sorted(starred)
+    write_json_atomic(path, data)
+
+
+def _update(directory, change):
+    """Read, change and write notes.json under its lock. `change` gets the
+    notes and the starred set and edits them in place - both, so a write of
+    one never drops the other."""
+    with _lock(directory):
+        notes = read_notes(directory)
+        starred = read_starred(directory)
+        change(notes, starred)
+        _store(directory, notes, starred)
+
+
+def set_run_note(directory, note):
+    note = clean_note(note)
+    _update(directory, lambda notes, _starred: notes.__setitem__("run", note))
+    return note
+
+
+def set_file_note(directory, name, note):
+    note = clean_note(note)
+
+    def change(notes, _starred):
+        if note is None:
+            notes["files"].pop(name, None)
+        else:
+            notes["files"][name] = note
+
+    _update(directory, change)
+    return note
+
+
+def set_file_starred(directory, name, starred):
+    starred = bool(starred)
+
+    def change(_notes, names):
+        if starred:
+            names.add(name)
+        else:
+            names.discard(name)
+
+    _update(directory, change)
+    return starred
+
+
+def drop_file_note(directory, name):
+    """Forget a deleted file: its note and its star."""
+    if os.path.exists(os.path.join(directory, NOTES_FILE_NAME)):
+
+        def change(notes, names):
+            notes["files"].pop(name, None)
+            names.discard(name)
+
+        _update(directory, change)
+
+
+def effective_note(notes, name):
+    own = notes["files"].get(name)
+    if own:
+        return own, "file"
+    if notes["run"]:
+        return notes["run"], "run"
+    return None, None
+
+
+def read_workspace_note(root):
+    note = _read_json(os.path.join(root, WORKSPACE_FILE_NAME)).get("notes")
+    return note if isinstance(note, str) and note.strip() else None
+
+
+def set_workspace_note(root, note):
+    note = clean_note(note)
+    path = os.path.join(root, WORKSPACE_FILE_NAME)
+    with _lock(root):
+        if note is None:
+            try:
+                os.remove(path)
+            except FileNotFoundError:
+                pass
+        else:
+            write_json_atomic(path, {"notes": note})
+    return note
diff --git a/dw/pipeline_ownership.py b/dw/pipeline_ownership.py
index 8c2354de..26c4733f 100644
--- a/dw/pipeline_ownership.py
+++ b/dw/pipeline_ownership.py
@@ -27,6 +27,7 @@
 from .events import emit_phase, get_context
 from .host_memory import release_host_caches
 from .pipeline_processors.pipeline import Pipeline
+from .pipeline_processors.timing import mark
 from .step_cache import pipeline_cache_key, step_pipeline_keys
 from .tasks.model_cache import clear_model_cache
 
@@ -305,6 +306,7 @@ def wrap_resident(
     # A cache hit and a cold load look identical from the outside -
     # same step, same dot - and they differ by minutes
     emit_phase("cached", detail=new_pipeline_wrapper.name)
+    mark("load_cached", True)
     return new_pipeline_wrapper
 
 
@@ -334,5 +336,6 @@ def load_fresh(
     # Loading is the longest silence in a run: weights, quantization,
     # adapters and placement all happen inside this call
     emit_phase("loading", detail=pipeline.name)
+    mark("load_cached", False)
     pipeline.load(shared_components)
     return pipeline
diff --git a/dw/pipeline_processors/components.py b/dw/pipeline_processors/components.py
index cc056cd5..47a6aedc 100644
--- a/dw/pipeline_processors/components.py
+++ b/dw/pipeline_processors/components.py
@@ -1,4 +1,5 @@
 import torch
+import ast
 import contextlib
 import logging
 from .config_objects import (
@@ -11,10 +12,11 @@
     require_trusted_from_pretrained_arguments,
 )
 from .. import get_device_type, resolve_device
-from ..events import WorkflowCancelled, emit_phase
+from ..events import WorkflowCancelled, emit_log, emit_phase, emit_warning
 from .. import download_watch
 from .. import quantized_cache
 from huggingface_hub.errors import HfHubHTTPError
+from .timing import counting_forwards, report_cache_stats
 from .h3_guides import insert_guides
 from .h3_hold import insert_audio_hold
 from .placement import (
@@ -126,8 +128,12 @@ def configure_components(pipeline, configuration, default_device, reused_compone
             "attention_backend", None
         )
         if component_attention_backend is not None:
-            logger.info(
-                f"Setting {component_name} attention backend: {component_attention_backend}"
+            message = f"Setting {component_name} attention backend: {component_attention_backend}"
+            logger.info(message)
+            emit_log(
+                message,
+                component=component_name,
+                attention_backend=str(component_attention_backend),
             )
             set_component_attention_backend(component, component_attention_backend)
 
@@ -830,8 +836,130 @@ def get_cache_transformer(pipeline):
     return None
 
 
+_MAG_LOGGER = "diffusers.hooks.mag_cache"
+_MAG_RESULT_PREFIX = "MagCache Calibration Results:"
+
+
+def _active_cache_context_name(transformer):
+    """The name of the cache context a stateful hook under the transformer is
+    running in, or None. Under CFG that is "cond" or "uncond"."""
+    for module in transformer.modules():
+        registry = getattr(module, "_diffusers_hook", None)
+        for hook in getattr(registry, "hooks", {}).values():
+            for attr in vars(hook).values():
+                context = getattr(attr, "_context", None)
+                if context is not None and hasattr(attr, "get_state"):
+                    return context.name
+    return None
+
+
+class _MagCalibrationHandler(logging.Handler):
+    """Turns diffusers' end-of-run calibration log record into job events.
+
+    diffusers prints the ratios, logs them at INFO and clears the list in the
+    same call (`MagCacheHook._advance_step`), so the record is the only moment
+    they can be read, and the worker's stdout reaches no consumer. The record
+    is emitted synchronously from inside the forward, so the state manager's
+    context is still the one the ratios belong to.
+    """
+
+    def __init__(self, transformer):
+        super().__init__(level=logging.INFO)
+        self.transformer = transformer
+
+    def emit(self, record):
+        message = record.getMessage()
+        if not message.startswith(_MAG_RESULT_PREFIX):
+            return
+        try:
+            ratios = ast.literal_eval(message[len(_MAG_RESULT_PREFIX) :].strip())
+            context = _active_cache_context_name(self.transformer)
+        except (ValueError, SyntaxError):
+            return
+        _report_mag_ratios(ratios, context)
+
+
+def _report_mag_ratios(ratios, context):
+    label = f" [{context}]" if context in ("cond", "uncond") else ""
+    text = (
+        f"MagCache calibration ({len(ratios)} steps){label}: "
+        f"{ratios} \u2014 paste into mag_ratios"
+    )
+    if context == "cond":
+        text += " (classifier-free guidance runs two lists; the cond one is the usual choice)"
+    emit_log(text)
+    emit_warning(text)
+
+
+def _report_unfinished_mag_calibration(transformer):
+    """Report the ratios a calibrating call left in its mag state (#927).
+
+    diffusers logs a calibration only when its step counter reaches the
+    config's num_inference_steps, and a scheduler can run fewer forwards than
+    that: MiniMax-H3's turns N sigmas into N - 1 evaluations. Such a call ends
+    with its ratios still in the state, which the call's reset then drops. A
+    call that did finish has nothing left here - diffusers clears the list
+    when it logs - so nothing is reported twice.
+    """
+    if not getattr(getattr(transformer, "_cache_config", None), "calibrate", False):
+        return
+    from diffusers.hooks.mag_cache import MagCacheBlockHook
+
+    for module in transformer.modules():
+        registry = getattr(module, "_diffusers_hook", None)
+        for hook in getattr(registry, "hooks", {}).values():
+            if isinstance(hook, MagCacheBlockHook) and hook.is_tail:
+                for name, state in hook.state_manager._state_cache.items():
+                    if state.calibration_ratios:
+                        _report_mag_ratios(list(state.calibration_ratios), name)
+                return
+
+
+@contextlib.contextmanager
+def captured_mag_calibration(pipeline, arguments=None):
+    """Report a mag cache's calibration ratios as job events (#891).
+
+    A no-op unless the transformer's cache is a MagCacheConfig with calibrate
+    on. Under classifier-free guidance dw's pipelines run "cond" and "uncond"
+    contexts, each with its own state, so two labeled lists are emitted.
+
+    diffusers only finishes (and logs) a calibration once its step counter
+    reaches the config's `num_inference_steps`, which defaults to 28. A run of
+    any other length would end without a record, so for the call the config
+    counts the steps the call actually runs.
+    """
+    transformer = get_cache_transformer(pipeline)
+    config = getattr(transformer, "_cache_config", None)
+    if not getattr(config, "calibrate", False):
+        yield
+        return
+
+    steps = (arguments or {}).get("num_inference_steps")
+    declared_steps = config.num_inference_steps
+    if isinstance(steps, int) and steps != declared_steps:
+        emit_warning(
+            f"MagCache calibration: the cache declares num_inference_steps "
+            f"{declared_steps} but this step runs {steps}; calibrating over {steps}"
+        )
+        config.num_inference_steps = steps
+
+    mag_logger = logging.getLogger(_MAG_LOGGER)
+    handler = _MagCalibrationHandler(transformer)
+    old_level, old_propagate = mag_logger.level, mag_logger.propagate
+    mag_logger.addHandler(handler)
+    mag_logger.setLevel(logging.INFO)
+    mag_logger.propagate = False
+    try:
+        yield
+    finally:
+        config.num_inference_steps = declared_steps
+        mag_logger.removeHandler(handler)
+        mag_logger.setLevel(old_level)
+        mag_logger.propagate = old_propagate
+
+
 @contextlib.contextmanager
-def stateful_cache_context(pipeline):
+def stateful_cache_context(pipeline, segment=None):
     """Provide the context a stateful cache hook reads its state through.
 
     first_block, mag and layer_skip keep per-context state, and their hooks go
@@ -848,6 +976,11 @@ def stateful_cache_context(pipeline):
     to keep their caches apart, which a shared context would defeat - but a modular
     pipeline that needed that would be setting its own contexts already, and this
     is a no-op for pipelines whose cache is not enabled.
+
+    The call's skip counts are taken here too (dw/pipeline_processors/timing.py):
+    a forward hook counts each denoiser forward, and the `cache_stats` event
+    (naming the chain `segment`, when there is one) goes out before the state
+    is reset, the hook removed after it.
     """
     transformer = get_cache_transformer(pipeline)
     if transformer is None or not getattr(transformer, "is_cache_enabled", False):
@@ -855,30 +988,45 @@ def stateful_cache_context(pipeline):
         return
 
     logger.debug(f"Entering cache context for {transformer.__class__.__name__}")
+    counter, stop_counting = counting_forwards(transformer)
     try:
         with transformer.cache_context(_CACHE_CONTEXT_NAME):
             yield
+        # Only a call that completed has ratios worth pasting
+        _report_unfinished_mag_calibration(transformer)
     finally:
+        try:
+            report_cache_stats(counter, segment)
+        finally:
+            stop_counting()
         # Private, but it is what diffusers' own pipelines call and there is no
         # public equivalent. Also clears the context an errored call left set
         transformer._reset_stateful_cache()
 
 
-def enable_cache_on_transformer(pipeline, cache_config):
+def enable_cache_on_transformer(pipeline, cache_config, distilled_explicit=False):
     """Enable cache configuration on the pipeline's transformer.
 
     Args:
         pipeline: The loaded diffusers pipeline
         cache_config: Cache configuration object from get_cache_configuration()
+        distilled_explicit: True when the workflow set is_guidance_distilled, which
+            then wins over what the transformer's config implies
     """
     transformer = get_cache_transformer(pipeline)
     if transformer is None:
-        logger.warning("Pipeline has no transformer, skipping cache configuration")
+        emit_warning(
+            f"{cache_config.__class__.__name__} was not applied: the pipeline has "
+            "no transformer to attach a cache to (a UNet pipeline such as SD 1.5 "
+            "is not supported)"
+        )
         return
 
     if not hasattr(transformer, "enable_cache"):
-        logger.warning(
-            f"{transformer.__class__.__name__} does not support enable_cache(), skipping"
+        emit_warning(
+            f"{cache_config.__class__.__name__} was not applied: "
+            f"{transformer.__class__.__name__} does not support diffusers' "
+            "enable_cache(), so this step runs uncached"
         )
         return
 
@@ -893,6 +1041,21 @@ def enable_cache_on_transformer(pipeline, cache_config):
         logger.debug("Wiring FasterCache current_timestep_callback to the pipeline")
         cache_config.current_timestep_callback = lambda: pipeline._current_timestep
 
+    # FasterCache assumes a cond/uncond batch of 2. A guidance-distilled
+    # transformer embeds guidance instead of batching CFG, so its config says
+    # so (guidance_embeds); infer the flag unless the workflow set it
+    if (
+        cache_config.__class__.__name__ == "FasterCacheConfig"
+        and not distilled_explicit
+        and getattr(getattr(transformer, "config", None), "guidance_embeds", None)
+        is True
+    ):
+        logger.info(
+            "Inferring FasterCache is_guidance_distilled=True from "
+            f"{transformer.__class__.__name__}.config.guidance_embeds"
+        )
+        cache_config.is_guidance_distilled = True
+
     # first_block, mag and layer_skip resolve the transformer's block class
     # through diffusers' registry and raise when it is absent - fill in the
     # blocks diffusers has not registered before handing the config over
diff --git a/dw/pipeline_processors/config_objects.py b/dw/pipeline_processors/config_objects.py
index 85042800..c3966588 100644
--- a/dw/pipeline_processors/config_objects.py
+++ b/dw/pipeline_processors/config_objects.py
@@ -212,6 +212,7 @@ def _resolve_mag_ratios(mag_ratios):
     "calibrate",
 )
 _TAYLORSEER_CACHE_KEYS = ("cache_interval", "max_order")
+_FASTER_CACHE_KEYS = ("is_guidance_distilled",)
 
 
 def get_cache_configuration(configuration):
@@ -248,7 +249,12 @@ def get_cache_configuration(configuration):
                     threshold=cache_config.get("threshold", 0.05),
                 )
             elif cache_type == "faster":
-                config = FasterCacheConfig()
+                kwargs = {
+                    key: cache_config[key]
+                    for key in _FASTER_CACHE_KEYS
+                    if key in cache_config
+                }
+                config = FasterCacheConfig(**kwargs)
             elif cache_type == "text_kv":
                 config = TextKVCacheConfig()
             elif cache_type == "mag":
diff --git a/dw/pipeline_processors/h3_guides.py b/dw/pipeline_processors/h3_guides.py
index 7f7042ab..86ac51f4 100644
--- a/dw/pipeline_processors/h3_guides.py
+++ b/dw/pipeline_processors/h3_guides.py
@@ -20,7 +20,8 @@
 Nothing restores them before decode: `after_denoise` slices the condition prefix
 off, and the target rows at the same times are generated, as with a video guide.
 
-This module puts the guide blocks in; the blocks themselves, and the row and
+This module puts the guide blocks in, and reads each `guides` entry a step
+passes into the arrays they take (`prepared_guide`); the blocks themselves, and the row and
 position arithmetic they run (`splice_guide_rows`, `guide_audio_span`), are
 dw/pipeline_processors/h3_guide_steps.py, imported in `guide_blocks()` only,
 since it imports diffusers when it loads (#790). The hold blocks are
@@ -33,6 +34,8 @@
 
 import torch
 
+from ..events import emit_warning
+from ..tasks.video_utils import load_audio_video
 from .h3_hold import core_denoise_sequences
 from .h3_rules import (
     GUIDE_AUDIO_BLOCK,
@@ -41,6 +44,8 @@
     HOLD_BEFORE,
     HOLD_BLOCK,
     LAYOUT_STEP,
+    guide_frame_problem,
+    snap_guide_length,
 )
 
 logger = logging.getLogger("dw")
@@ -190,6 +195,62 @@ def guide_frames_array(value):
     return np.ascontiguousarray(value)
 
 
+def prepared_guide(where, index, guide, base_dir):
+    """One `guides` entry checked and read: its clip as uint8 frames cut to
+    a whole-latent length, with its soundtrack when it asks for one."""
+    if not isinstance(guide, dict):
+        raise ValueError(
+            f"{where}[{index}] must be {{video, frame}}, got {type(guide).__name__}"
+        )
+    unknown = sorted(set(guide) - {"video", "frame", "audio"})
+    if unknown:
+        raise ValueError(
+            f"{where}[{index}] has unknown key(s) {unknown} - a guide is "
+            f"{{video, frame}}, with an optional 'audio'"
+        )
+    if "video" not in guide or "frame" not in guide:
+        raise ValueError(f"{where}[{index}] needs both 'video' and 'frame'")
+    problem = guide_frame_problem(guide["frame"])
+    if problem:
+        raise ValueError(f"{where}[{index}]: {problem}")
+    with_audio = guide.get("audio", False)
+    if not isinstance(with_audio, bool):
+        raise ValueError(
+            f"{where}[{index}]: 'audio' must be true or false, got "
+            f"{type(with_audio).__name__}"
+        )
+    video = guide["video"]
+    if isinstance(video, str) or (isinstance(video, dict) and with_audio):
+        # argument_media imports diffusers, which this module waits for (#790)
+        from ..argument_media import fetch_video
+
+        # Read with its soundtrack only when the guide holds it
+        video = (
+            load_audio_video(video, base_dir)
+            if with_audio
+            else fetch_video(video, base_dir)
+        )
+    try:
+        frames = guide_frames_array(video)
+        audio, sample_rate = guide_audio_waveform(video) if with_audio else (None, None)
+    except ValueError as error:
+        raise ValueError(f"{where}[{index}]: {error}") from error
+    length = snap_guide_length(frames.shape[0])
+    if length != frames.shape[0]:
+        emit_warning(
+            f"{where}[{index}]: a guide clip encodes to whole latents only at "
+            f"1, 5 or 17m + 5 frames, so its {frames.shape[0]} frames are cut "
+            f"to the first {length}"
+        )
+        frames = frames[:length]
+    return {
+        "video": frames,
+        "frame": guide["frame"],
+        "audio": audio,
+        "sample_rate": sample_rate,
+    }
+
+
 def guide_blocks():
     """(DwH3GuideLayoutStep, the t2va condition step, the t2va latents step,
     DwH3GuideAudioStep) - the classes in
diff --git a/dw/pipeline_processors/pipeline.py b/dw/pipeline_processors/pipeline.py
index 223083d8..9297290e 100644
--- a/dw/pipeline_processors/pipeline.py
+++ b/dw/pipeline_processors/pipeline.py
@@ -5,6 +5,7 @@
 import importlib
 import inspect
 import logging
+import traceback
 from .config_objects import (
     get_quantization_configuration,
     get_cache_configuration,
@@ -23,6 +24,7 @@
     get_component,
     load_and_configure_scheduler,
     load_component,
+    captured_mag_calibration,
     stateful_cache_context,
 )
 from .placement import (
@@ -30,7 +32,7 @@
     attention_slicing_requested,
     place_component,
 )
-from .h3_guides import guide_audio_waveform, guide_frames_array, guides_refusal
+from .h3_guides import guides_refusal, prepared_guide
 from .h3_hold import hold_audio_reference, holds_audio, refines
 from .h3_rules import (
     GUIDES_INPUT,
@@ -39,11 +41,10 @@
     HELD_AUDIO_RATE_OUTPUT,
     HOLD_AUDIO_INPUT,
     REFINE_STRENGTH_INPUT,
-    guide_frame_problem,
     refine_problems,
-    snap_guide_length,
 )
 from .progress import reported_blocks, reported_progress_bars
+from .timing import denoise_start_hook, is_compiled, mark
 from .remote import remote_text_encoder
 from ..type_helpers import has_method
 from ..trust import (
@@ -56,9 +57,7 @@
 # dw.prompt_weighting (transformers) and diffusers.hooks (peft, bitsandbytes) are
 # imported where they are used - at module scope they add seconds to every startup
 
-from ..argument_media import fetch_video
-from ..tasks.video_utils import load_audio_video
-from ..events import WorkflowCancelled, emit_phase, emit_warning, get_context
+from ..events import WorkflowCancelled, emit_log, emit_phase, emit_warning, get_context
 from ..media_types import AudioVideo
 from ..step_cache import component_names, copy_containers
 
@@ -408,7 +407,12 @@ def load(self, shared_components):
             # Enable diffusers built-in cache acceleration on transformer
             cache_config = get_cache_configuration(self.configuration)
             if cache_config is not None:
-                enable_cache_on_transformer(self.pipeline, cache_config)
+                enable_cache_on_transformer(
+                    self.pipeline,
+                    cache_config,
+                    distilled_explicit="is_guidance_distilled"
+                    in self.configuration["cache"],
+                )
 
             # Configure the schedulers if specified - a pipeline that denoises two
             # modalities against two schedules configures each of them separately
@@ -633,13 +637,25 @@ def _call_pipeline(self, arguments, attn_backend):
         # signature has no step callback report nothing else at all, so this
         # is the only thing that distinguishes running from still loading
         emit_phase("generating", detail=self.segment_label or self.name)
+        denoiser = _denoiser(self.pipeline)
+        mark("call_started", compiled=is_compiled(denoiser))
         with contextlib.ExitStack() as stack:
             if attn_backend is not None:
                 logger.info(f"Using attention backend: {attn_backend}")
+                emit_log(
+                    f"Using attention backend: {attn_backend}",
+                    attention_backend=str(attn_backend),
+                )
                 stack.enter_context(attention_backend(attn_backend))
 
-            stack.enter_context(stateful_cache_context(self.pipeline))
-            if not self._takes_step_callback():
+            stack.enter_context(captured_mag_calibration(self.pipeline, arguments))
+            stack.enter_context(
+                stateful_cache_context(self.pipeline, segment=self.segment_label)
+            )
+            if self._takes_step_callback():
+                # Encode ends where the denoiser first runs
+                stack.enter_context(denoise_start_hook(denoiser))
+            else:
                 # A modular pipeline takes no step callback at all, so this
                 # is the only per-step signal it has: the denoise blocks
                 # drive a tqdm bar, and a bar that reports each advance is
@@ -651,7 +667,24 @@ def _call_pipeline(self, arguments, attn_backend):
                     reported_blocks(self.pipeline, self.segment_label or self.name)
                 )
 
-            return self.pipeline(**arguments)
+            try:
+                output = self.pipeline(**arguments)
+            except IndexError as e:
+                cache = self.configuration.get("cache")
+                if (
+                    isinstance(cache, dict)
+                    and cache.get("type") == "faster"
+                    and not cache.get("is_guidance_distilled")
+                    and "faster_cache" in "".join(traceback.format_tb(e.__traceback__))
+                ):
+                    raise ValueError(
+                        f"Step '{self.name}': the faster cache failed ({e}). It "
+                        f"assumes a cond/uncond batch of 2; a guidance-distilled "
+                        f"model (FLUX.1-dev) needs cache.is_guidance_distilled: true"
+                    ) from e
+                raise
+            mark("call_ended")
+            return output
 
     def _with_held_audio(self, arguments):
         """`hold_audio` as the reference the H3 hold block takes, and the
@@ -721,7 +754,7 @@ def _with_guides(self, arguments):
                 f"{where} takes at most {GUIDE_LIMIT} clips, got {len(guides)}"
             )
         prepared = [
-            _prepared_guide(where, index, guide, self.base_dir)
+            prepared_guide(where, index, guide, self.base_dir)
             for index, guide in enumerate(guides)
         ]
         arguments[GUIDES_INPUT] = prepared
@@ -774,6 +807,7 @@ def _with_step_callback(self, arguments):
         num_steps = arguments.get("num_inference_steps", None)
 
         def on_step_end(pipe, step_index, timestep, callback_kwargs):
+            mark("pass_ended")
             total = getattr(pipe, "_num_timesteps", None) or num_steps
             run_context.emit("pipeline_step", step=step_index + 1, total_steps=total)
             # Past the last step the pipeline still has to decode the latents,
@@ -884,57 +918,12 @@ def configure_loaded_components(self):
                     component.to(torch_dtype)
 
 
-def _prepared_guide(where, index, guide, base_dir):
-    """One `guides` entry checked and read: its clip as uint8 frames cut to
-    a whole-latent length, with its soundtrack when it asks for one."""
-    if not isinstance(guide, dict):
-        raise ValueError(
-            f"{where}[{index}] must be {{video, frame}}, got {type(guide).__name__}"
-        )
-    unknown = sorted(set(guide) - {"video", "frame", "audio"})
-    if unknown:
-        raise ValueError(
-            f"{where}[{index}] has unknown key(s) {unknown} - a guide is "
-            f"{{video, frame}}, with an optional 'audio'"
-        )
-    if "video" not in guide or "frame" not in guide:
-        raise ValueError(f"{where}[{index}] needs both 'video' and 'frame'")
-    problem = guide_frame_problem(guide["frame"])
-    if problem:
-        raise ValueError(f"{where}[{index}]: {problem}")
-    with_audio = guide.get("audio", False)
-    if not isinstance(with_audio, bool):
-        raise ValueError(
-            f"{where}[{index}]: 'audio' must be true or false, got "
-            f"{type(with_audio).__name__}"
-        )
-    video = guide["video"]
-    if isinstance(video, str) or (isinstance(video, dict) and with_audio):
-        # Read with its soundtrack only when the guide holds it
-        video = (
-            load_audio_video(video, base_dir)
-            if with_audio
-            else fetch_video(video, base_dir)
-        )
-    try:
-        frames = guide_frames_array(video)
-        audio, sample_rate = guide_audio_waveform(video) if with_audio else (None, None)
-    except ValueError as error:
-        raise ValueError(f"{where}[{index}]: {error}") from error
-    length = snap_guide_length(frames.shape[0])
-    if length != frames.shape[0]:
-        emit_warning(
-            f"{where}[{index}]: a guide clip encodes to whole latents only at "
-            f"1, 5 or 17m + 5 frames, so its {frames.shape[0]} frames are cut "
-            f"to the first {length}"
-        )
-        frames = frames[:length]
-    return {
-        "video": frames,
-        "frame": guide["frame"],
-        "audio": audio,
-        "sample_rate": sample_rate,
-    }
+def _denoiser(pipeline):
+    """The module whose forward is one denoise pass, or None."""
+    from .components import get_cache_transformer
+
+    denoiser = get_cache_transformer(pipeline)
+    return denoiser if denoiser is not None else getattr(pipeline, "unet", None)
 
 
 def warn_if_safety_checker_blanked(output):
diff --git a/dw/pipeline_processors/progress.py b/dw/pipeline_processors/progress.py
index 1c74cc11..4965444b 100644
--- a/dw/pipeline_processors/progress.py
+++ b/dw/pipeline_processors/progress.py
@@ -2,6 +2,7 @@
 import contextlib
 import logging
 from ..events import WorkflowCancelled, emit_phase, get_context
+from .timing import mark
 
 logger = logging.getLogger("dw")
 
@@ -105,6 +106,7 @@ def reported_progress_bars(pipeline):
     run_context = get_context()
 
     def on_advance(done, total):
+        mark("pass_ended")
         run_context.emit("pipeline_step", step=done, total_steps=total)
         # Past the last step there is still the decode, which on video is
         # minutes with the bar sitting at 100%
@@ -123,6 +125,9 @@ def on_advance(done, total):
         patched.append((holder, original, "progress_bar" in vars(holder)))
 
         def reporting(iterable=None, total=None, _original=original):
+            # The denoise bar opening is where a modular pipeline's encode
+            # ends - it has no step callback to hang a forward hook off
+            mark("denoise_started")
             bar = _original(iterable=iterable, total=total)
             if total is None and iterable is not None:
                 # An iterated bar's total is the length of what it iterates,
diff --git a/dw/pipeline_processors/timing.py b/dw/pipeline_processors/timing.py
new file mode 100644
index 00000000..4993c81b
--- /dev/null
+++ b/dw/pipeline_processors/timing.py
@@ -0,0 +1,502 @@
+"""Where a pipeline step's time went, measured in the worker (#867).
+
+A `StepTimer` is opened around one step by the step loop
+(`dw/workflow_run.py`) and fed marks from wherever they happen: the load
+around `create_step_action`, the pipeline call in `Pipeline._call_pipeline`,
+the first denoiser call (a self-removing pre-forward hook, or a wrapper
+around a whole-compiled denoiser's compiled call) or the opening
+of a modular pipeline's denoise bar (`progress.py`), each step callback or bar
+advance, and the result save. Its `timing()` is the dict a step's manifest
+entry carries as `timing`.
+
+The clock is the worker's monotonic one, not the server's event timestamps:
+the job history keeps only the last 200 events, so load and encode marks are
+gone from a long job by the time anyone reads it. A field whose mark never
+happened is null, never guessed.
+
+The timer travels ambiently (a contextvar) like the RunContext does, so the
+marks need no parameter threaded through Step and Pipeline. A composed child's
+steps open their own timer and put the parent's back when they finish. With no
+timer open every mark is a no-op.
+
+A step cache's skip counts (`timing.cache`) are counted here too, in the
+section at the end.
+"""
+
+import contextlib
+import contextvars
+import logging
+import statistics
+import time
+
+import torch
+
+from .. import get_device_type
+from ..events import emit_warning, get_context
+from .config_objects import _MAG_CACHE_KEYS, _TAYLORSEER_CACHE_KEYS
+
+logger = logging.getLogger("dw")
+
+_active_timer = contextvars.ContextVar("dw_step_timer", default=None)
+
+# A first pass this much slower than a steady one, on a loaded pipeline, is
+# worth a warning (#924)
+_SLOW_FIRST_PASS_EXTRA_S = 30.0
+
+
+def _synced_clock():
+    """The monotonic clock, read after the device has finished its queued work.
+
+    CUDA and MPS run kernels asynchronously: without the wait, a pass or the
+    call's end is stamped when the host queued the work, and the denoise time
+    surfaces at the first host read, in decode (#896)."""
+    device_type = get_device_type()
+    if device_type == "cuda":
+        torch.cuda.synchronize()
+    elif device_type == "mps":
+        torch.mps.synchronize()
+    return time.monotonic()
+
+
+def _seconds(value):
+    return None if value is None else round(value, 1)
+
+
+def _sum(values):
+    """The sum of a field over segments, or None when any segment lacks it."""
+    if not values or any(value is None for value in values):
+        return None
+    return sum(values)
+
+
+class _Segment:
+    """The marks of one pipeline call: a chain segment, or one iteration."""
+
+    def __init__(self, started):
+        self.started = started
+        self.denoise_started = None
+        self.pass_ends = []
+        self.ended = None
+
+    def spans(self):
+        """(encode, denoise, first_pass, decode, pass intervals) in seconds."""
+        passes = self.pass_ends
+        denoise_started = self.denoise_started
+        encode = denoise = first_pass = decode = None
+        if denoise_started is not None:
+            encode = denoise_started - self.started
+            if passes:
+                denoise = passes[-1] - denoise_started
+                first_pass = passes[0] - denoise_started
+        elif not passes and self.ended is not None:
+            # Neither a step callback nor a bar: the call is all there is to
+            # time, and none of it can be split into encode or decode
+            denoise = self.ended - self.started
+        if passes and self.ended is not None:
+            decode = self.ended - passes[-1]
+        intervals = [later - earlier for earlier, later in zip(passes, passes[1:])]
+        return encode, denoise, first_pass, decode, intervals
+
+
+class StepTimer:
+    """The marks of one pipeline step, from load start to save end."""
+
+    def __init__(self, clock=_synced_clock, step=None):
+        self._clock = clock
+        self.step = step
+        self._cache = None
+        self._load_started = None
+        self._load_ended = None
+        self._load_cached = None
+        self._save_started = None
+        self._save_ended = None
+        self._segments = []
+        self._compiled = None
+
+    def load_started(self):
+        self._load_started = self._clock()
+
+    def load_ended(self):
+        self._load_ended = self._clock()
+
+    def load_cached(self, cached):
+        """A fresh load anywhere in the step's load makes it uncached; a
+        pipeline served from the worker's cache marks it cached otherwise."""
+        if self._load_cached is not False:
+            self._load_cached = cached
+
+    def call_started(self, compiled=None):
+        self._segments.append(_Segment(self._clock()))
+        if compiled is not None:
+            self._compiled = bool(self._compiled) or compiled
+
+    def denoise_started(self):
+        """The first denoiser forward, or the denoise bar opening. Only the
+        first one in a call counts: a second bar is a second loop of the same
+        denoise, not a new start."""
+        segment = self._current_segment()
+        if segment is not None and segment.denoise_started is None:
+            segment.denoise_started = self._clock()
+
+    def pass_ended(self):
+        segment = self._current_segment()
+        if segment is not None:
+            segment.pass_ends.append(self._clock())
+            self._warn_on_slow_first_pass(segment)
+
+    def _warn_on_slow_first_pass(self, segment):
+        """Say so once when a cached pipeline's first pass dwarfs the steady one.
+
+        The pipeline is loaded, so the minutes are not a load. A later entry
+        that runs the cached pipeline at a larger shape (more frames) pays a
+        one-off warm-up on its first pass - re-allocation, offload buffers,
+        kernels meeting a new shape - and without a word the consumer sees only
+        a `phase_stall` (#924). Judged at the second pass interval, when a
+        steady pass is known."""
+        passes = segment.pass_ends
+        if (
+            len(passes) != 3
+            or self._load_cached is not True
+            or segment.denoise_started is None
+        ):
+            return
+        first = passes[0] - segment.denoise_started
+        steady = passes[2] - passes[1]
+        if first - steady < _SLOW_FIRST_PASS_EXTRA_S or first < steady * 3:
+            return
+        emit_warning(
+            f"First denoise pass took {first:.0f}s against {steady:.0f}s for "
+            "the passes after it, with the pipeline already loaded: a one-off "
+            "warm-up (typically a cached pipeline meeting a larger shape than "
+            "it last ran, such as more frames). Later passes run at the "
+            "steady rate.",
+            kind="first_pass_slow",
+            first_pass_s=round(first, 1),
+            pass_s=round(steady, 1),
+            step=self.step,
+        )
+
+    def call_ended(self):
+        segment = self._current_segment()
+        if segment is not None:
+            segment.ended = self._clock()
+
+    def cache_counted(self, stats):
+        """One call's step-cache counts (report_cache_stats, below). A chain's calls sum
+        into one, null if any call's counts are; the rest is the first's."""
+        if self._cache is None:
+            self._cache = dict(stats)
+            return
+        for key in ("forwards", "computed", "skipped"):
+            self._cache[key] = _sum([self._cache[key], stats.get(key)])
+        forwards = self._cache["forwards"]
+        self._cache["hit_rate"] = (
+            round(self._cache["skipped"] / forwards, 3) if forwards else None
+        )
+
+    def save_started(self):
+        self._save_started = self._clock()
+
+    def save_ended(self):
+        self._save_ended = self._clock()
+
+    def _current_segment(self):
+        if not self._segments or self._segments[-1].ended is not None:
+            return None
+        return self._segments[-1]
+
+    def timing(self):
+        """The step's `timing`: every `_s` in seconds to 0.1, a null for any
+        mark that never happened. A chain (or any step that calls its
+        pipeline more than once) sums its calls into one, with `pass_s` the
+        median over every pass after each call's first."""
+        spans = [segment.spans() for segment in self._segments]
+        intervals = [
+            interval for segment_spans in spans for interval in segment_spans[4]
+        ]
+        pass_counts = [len(segment.pass_ends) or None for segment in self._segments]
+        timing = {
+            "load_s": _seconds(self._span(self._load_started, self._load_ended)),
+            "load_cached": self._load_cached,
+            "encode_s": _seconds(_sum([s[0] for s in spans])),
+            "denoise_s": _seconds(_sum([s[1] for s in spans])),
+            "passes": _sum(pass_counts),
+            "first_pass_s": _seconds(_sum([s[2] for s in spans])),
+            "pass_s": _seconds(statistics.median(intervals)) if intervals else None,
+            "compiled": self._compiled,
+            "decode_s": _seconds(_sum([s[3] for s in spans])),
+            "save_s": _seconds(self._span(self._save_started, self._save_ended)),
+            "segments": len(self._segments),
+        }
+        # Only a step that set a `cache` has one
+        if self._cache is not None:
+            timing["cache"] = self._cache
+        return timing
+
+    @staticmethod
+    def _span(started, ended):
+        if started is None or ended is None:
+            return None
+        return ended - started
+
+
+@contextlib.contextmanager
+def timed_step(timer):
+    """Make `timer` the one marks land on for the duration of a step; None
+    opens nothing, so a step that is not timed hides an outer step's timer
+    rather than feeding it."""
+    token = _active_timer.set(timer)
+    try:
+        yield timer
+    finally:
+        _active_timer.reset(token)
+
+
+@contextlib.contextmanager
+def step_timer(step_data):
+    """Open a StepTimer for a pipeline step, None for any other. Opening None
+    also keeps a composed child's pipeline marks off an outer step's timer."""
+    runs_a_pipeline = "pipeline" in step_data or "pipeline_reference" in step_data
+    timer = StepTimer(step=step_data.get("name")) if runs_a_pipeline else None
+    with timed_step(timer) as timer:
+        yield timer
+
+
+def current_timer():
+    """The open step's timer, or None."""
+    return _active_timer.get()
+
+
+def mark(name, *args, **kwargs):
+    """Call one of the open timer's marks; a no-op with no timer open."""
+    timer = _active_timer.get()
+    if timer is not None:
+        getattr(timer, name)(*args, **kwargs)
+
+
+def is_compiled(module):
+    """Whether a denoiser runs through torch.compile, in whole or by its
+    repeated blocks (`apply_compile` compiles in place, which leaves
+    `_compiled_call_impl` set on each compiled module)."""
+    if module is None or not hasattr(module, "modules"):
+        return None
+    return any(
+        getattr(child, "_compiled_call_impl", None) is not None
+        for child in module.modules()
+    )
+
+
+@contextlib.contextmanager
+def denoise_start_hook(module):
+    """Mark denoise start at the first call of `module`, then stop marking:
+    one clock read, so a compiled denoiser sees it once and never again.
+    Undone on the way out too, for a call that never reached it.
+
+    Where the mark is taken depends on how the denoiser is compiled. Eager, or
+    compiled by its repeated blocks, it is a self-removing forward pre-hook on
+    the denoiser, which runs eagerly. Compiled whole (`compile` without
+    `repeated_blocks`, which `module.compile()` does by setting
+    `_compiled_call_impl`), a pre-hook would run inside the compiled
+    `_call_impl`: Dynamo cannot trace the clock read (`time.monotonic`, the
+    device sync), so `fullgraph: true` fails the first denoise step and a
+    non-fullgraph compile breaks its graph there. So a whole-compiled
+    denoiser has its `_compiled_call_impl` wrapped instead, for this call
+    only: the wrapper marks before handing over to the compiled callable, so
+    the mark is outside the compiled region and is the same instant a
+    pre-hook would have stamped, and `first_pass_s` and the slow-first-pass
+    warning (#924) read the same in both cases."""
+    if module is None or not hasattr(module, "register_forward_pre_hook"):
+        yield
+        return
+
+    compiled_call = getattr(module, "_compiled_call_impl", None)
+    if compiled_call is not None:
+        marked = False
+
+        def first_call(*args, **kwargs):
+            nonlocal marked
+            if not marked:
+                marked = True
+                mark("denoise_started")
+            return compiled_call(*args, **kwargs)
+
+        module._compiled_call_impl = first_call
+        try:
+            yield
+        finally:
+            module._compiled_call_impl = compiled_call
+        return
+
+    handle = None
+
+    def first_forward(_module, _inputs):
+        mark("denoise_started")
+        handle.remove()
+
+    handle = module.register_forward_pre_hook(first_forward)
+    try:
+        yield
+    finally:
+        handle.remove()
+
+
+# ------------------------------------------------------------ step-cache skip counts
+#
+# How many denoiser forwards a step cache skipped.
+#
+# diffusers counts nothing: a first_block or mag cache's leader hook keeps only
+# the latest decision (`should_compute` on its shared state) and overwrites it on
+# the next forward. So dw counts it itself, once per forward of the cache
+# transformer, from a forward hook that `stateful_cache_context` registers for
+# the pipeline call and removes when the call ends.
+#
+# Per forward, not per step: classifier-free guidance runs a "cond" and an
+# "uncond" forward each step, and a diffusers pipeline opens a
+# `cache_context("cond")`/`("uncond")` of its own around each one, inside dw's.
+# Each context keeps its own state, so the decision is read inside the forward
+# hook - still in the context the forward ran in - never after it returns.
+#
+# The state is private diffusers API. A diffusers whose hook names or state
+# attributes moved gives null counts and one `cache_stats_unavailable` warning,
+# never a failed run; `tests/test_cache_stats.py` pins the installed names so
+# an upgrade that moves them fails CI first.
+#
+# taylorseer, faster and text_kv keep no decision state at all: they report
+# their type and config with null counts, and no warning, since nothing is
+# missing.
+
+
+# diffusers' config class -> the workflow's `cache.type`
+_CACHE_TYPES = {
+    "FirstBlockCacheConfig": "first_block",
+    "MagCacheConfig": "mag",
+    "TaylorSeerCacheConfig": "taylorseer",
+    "FasterCacheConfig": "faster",
+    "TextKVCacheConfig": "text_kv",
+}
+
+# The cache types whose leader hook keeps a per-forward decision, and the name
+# diffusers registers that hook under (`_FBC_LEADER_BLOCK_HOOK`,
+# `_MAG_CACHE_LEADER_BLOCK_HOOK`)
+LEADER_HOOKS = {
+    "first_block": "fbc_leader_block_hook",
+    "mag": "mag_cache_leader_block_hook",
+}
+
+# Config keys reported alongside the counts, beyond `threshold`
+_CONFIG_KEYS = {
+    "mag": tuple(key for key in _MAG_CACHE_KEYS if key != "threshold"),
+    "taylorseer": _TAYLORSEER_CACHE_KEYS,
+}
+
+
+def _leader_state_manager(transformer, hook_name):
+    """The StateManager the leader hook decides through, or None."""
+    for module in transformer.modules():
+        registry = getattr(module, "_diffusers_hook", None)
+        get_hook = getattr(registry, "get_hook", None)
+        if get_hook is None:
+            continue
+        hook = get_hook(hook_name)
+        if hook is not None:
+            return getattr(hook, "state_manager", None)
+    return None
+
+
+class CacheCounter:
+    """Counts one pipeline call's computed and skipped forwards."""
+
+    def __init__(self, transformer):
+        config = getattr(transformer, "_cache_config", None)
+        self.cache_type = _CACHE_TYPES.get(type(config).__name__, type(config).__name__)
+        self.config = config
+        self.counted = self.cache_type in LEADER_HOOKS
+        self.forwards = self.computed = self.skipped = 0
+        self.unavailable = None
+        self._state_manager = None
+        if self.counted:
+            self._state_manager = _leader_state_manager(
+                transformer, LEADER_HOOKS[self.cache_type]
+            )
+            if self._state_manager is None or not hasattr(
+                self._state_manager, "get_state"
+            ):
+                self.unavailable = (
+                    f"no '{LEADER_HOOKS[self.cache_type]}' hook with a state manager"
+                )
+
+    def after_forward(self, _module, _args, _output):
+        """A torch forward hook: read the decision the leader made for the
+        forward that just ran, in the cache context it ran in."""
+        if not self.counted or self.unavailable:
+            return
+        try:
+            should_compute = self._state_manager.get_state().should_compute
+        except (AttributeError, ValueError) as error:
+            # ValueError: diffusers' "No cache context is set"
+            self.unavailable = f"{type(error).__name__}: {error}"
+            return
+        if not isinstance(should_compute, bool):
+            self.unavailable = f"should_compute is {type(should_compute).__name__}"
+            return
+        self.forwards += 1
+        if should_compute:
+            self.computed += 1
+        else:
+            self.skipped += 1
+
+    def stats(self):
+        """`timing.cache`: type, threshold, counts and hit rate, plus the
+        type's config keys. Counts are null for a type that keeps no
+        decision, or when the decision could not be read."""
+        threshold = getattr(self.config, "threshold", None)
+        has_counts = self.counted and not self.unavailable
+        forwards = self.forwards if has_counts else None
+        stats = {
+            "type": self.cache_type,
+            "threshold": threshold if self.counted else None,
+            "forwards": forwards,
+            "computed": self.computed if has_counts else None,
+            "skipped": self.skipped if has_counts else None,
+            "hit_rate": round(self.skipped / forwards, 3) if forwards else None,
+        }
+        for key in _CONFIG_KEYS.get(self.cache_type, ()):
+            if hasattr(self.config, key):
+                stats[key] = getattr(self.config, key)
+        return stats
+
+
+def counting_forwards(transformer):
+    """Register a CacheCounter's forward hook on `transformer`.
+
+    Returns:
+        (counter, remove) - call `remove` once the counts are read
+    """
+    counter = CacheCounter(transformer)
+    if not counter.counted or counter.unavailable:
+        return counter, lambda: None
+    handle = transformer.register_forward_hook(counter.after_forward)
+    return counter, handle.remove
+
+
+def report_cache_stats(counter, segment=None):
+    """Emit the call's `cache_stats` event, and its warning when the counts
+    could not be read, and hand the stats to the step's timer. The event
+    names the step the open timer is for, and a chain's `segment`."""
+    stats = counter.stats()
+    timer = current_timer()
+    where = {"step": timer.step if timer is not None else None}
+    if segment is not None:
+        where["segment"] = segment
+    if counter.unavailable:
+        emit_warning(
+            f"Step cache '{counter.cache_type}' ran, but its skip counts are "
+            f"unavailable from this diffusers ({counter.unavailable}); "
+            "timing.cache carries null counts",
+            kind="cache_stats_unavailable",
+            cache_type=counter.cache_type,
+        )
+    logger.info(f"Step cache stats: {stats}")
+    get_context().emit("cache_stats", **where, **stats)
+    mark("cache_counted", stats)
+    return stats
diff --git a/dw/plan.py b/dw/plan.py
index c26c1b55..c01eac7b 100644
--- a/dw/plan.py
+++ b/dw/plan.py
@@ -17,25 +17,55 @@
 import hashlib
 import json
 import logging
-import math
 import os
 
 from huggingface_hub import model_info
 from huggingface_hub import get_hf_file_metadata, hf_hub_url
 from huggingface_hub.utils import GatedRepoError, HFValidationError, validate_repo_id
 
+from .cost_scaling import (
+    CATALOG,
+    DERIVED,
+    INHERITED,
+    OBSERVED,
+    OTHER_DEVICE,
+    PER_ENTRY,
+    UNKNOWN,
+    _driver_scaling,
+    _entry_cost_field_shifted,
+    _scaled,
+)
 from .elision import elide_definition
 from .hub_cache import repo_download_incomplete, scan_models
 from . import references
 from .realize import read_sub_workflow, realize_workflow
 from .security import validate_url
 from .validation import _is_seeded
+from .variables import same_number
 
 logger = logging.getLogger("dw")
 
 FINGERPRINT_PREFIX = "sha256:"
-# Top-level keys that document a workflow rather than shape its work
-DOCUMENTATION_KEYS = ("cost", "description", "summary", "configures")
+# Top-level keys that document, classify or price a workflow rather than
+# shape its output - the fingerprint is keyed only by what can change the
+# generated output, so editing one of these never busts an acknowledgement
+# (#905). Pinned by tests/test_plan.py::TestFingerprintKeys
+DOCUMENTATION_KEYS = (
+    "configures",
+    "cost",
+    "cost_drivers",
+    "description",
+    "shape",
+    "summary",
+    "traits",
+    "vram_estimate",
+)
+# A variable constraint's keys that explain the rule rather than state it
+CONSTRAINT_DOCUMENTATION_KEYS = ("reason",)
+# A step result's keys that name, place or label its files without changing
+# their bytes. The step cache keeps file_base_name and subfolder: a hit
+# republishes the cached files verbatim and writes none (dw/step_cache.py)
+PLACEMENT_RESULT_KEYS = ("file_base_name", "role", "subfolder")
 FOR_EACH_KEY = "for_each"
 SIZE_LOOKUP_TIMEOUT = 5.0
 GIB = 1024**3
@@ -126,7 +156,17 @@ def build_plan(
         pin_outputs=False,
     )
     return {
-        "fingerprint": fingerprint(work, definition, annotations),
+        "fingerprint": fingerprint(
+            work,
+            definition,
+            {
+                **annotations,
+                "sub_workflows": {
+                    path: child_work_digest(path, base_dir, candidate.workflow_dir)
+                    for path in annotations.get("sub_workflows") or {}
+                },
+            },
+        ),
         "steps": step_count,
         "elided_steps": elided,
         "list_entries": entries,
@@ -206,23 +246,75 @@ def cached_steps(definition, realized, arguments, cache_probe):
     return len(answer) if isinstance(answer, list) else None
 
 
+def output_only(doc):
+    """Remove from a workflow definition, in place, every key that cannot
+    change the generated output (#905): the documentation keys, each
+    variable constraint's reason, and each step result's placement keys.
+    Returns `doc`."""
+    for key in DOCUMENTATION_KEYS:
+        doc.pop(key, None)
+    constraints = doc.get("variable_constraints")
+    if isinstance(constraints, dict):
+        for rule in constraints.values():
+            if isinstance(rule, dict):
+                for key in CONSTRAINT_DOCUMENTATION_KEYS:
+                    rule.pop(key, None)
+    for step in doc.get("steps") or []:
+        result = step.get("result") if isinstance(step, dict) else None
+        if isinstance(result, dict):
+            for key in PLACEMENT_RESULT_KEYS:
+                result.pop(key, None)
+    return doc
+
+
+def _canonical_digest(doc):
+    # default=repr: a realized 'constant:' can be any Python value, and the
+    # fingerprint only needs it to be stable, not round-trippable
+    serialized = json.dumps(
+        same_number(doc),
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=False,
+        default=repr,
+    )
+    return hashlib.sha256(serialized.encode("utf-8")).hexdigest()
+
+
+def child_work_digest(path, base_dir, workflow_dir):
+    """The digest of a composed child's work: its file with `output_only`
+    applied, so editing a child's cost or documentation leaves the parent's
+    fingerprint alone. None when the file cannot be read; a file that is not
+    a JSON object is digested as bytes."""
+    raw = read_sub_workflow(path, base_dir, workflow_dir)
+    if raw is None:
+        return None
+    try:
+        child = json.loads(raw)
+    except ValueError:
+        child = None
+    if not isinstance(child, dict):
+        return hashlib.sha256(raw).hexdigest()
+    return _canonical_digest(output_only(child))
+
+
 def fingerprint(expanded, definition, annotations=None):
     """SHA-256 over the expanded definition with everything that is not
-    work removed: the seed wherever it sits, and the documentation keys.
+    work removed: the seed wherever it sits, and whatever `output_only`
+    removes.
 
     `definition` is the workflow as written, consulted for whether the
     top-level seed named a variable - if it did, that variable's folded
     value is the seed too and is blanked at its source. `annotations` is
     what realization recorded beside the copy; its sub-workflow digests go
     into the hash, since a composed child edited between the quote and the
-    call is different work the parent's text cannot show.
+    call is different work the parent's text cannot show - build_plan
+    passes them as `child_work_digest`s.
     """
     doc = copy.deepcopy(expanded)
     if annotations and annotations.get("sub_workflows"):
         doc["__sub_workflows__"] = dict(annotations["sub_workflows"])
     doc.pop("seed", None)
-    for key in DOCUMENTATION_KEYS:
-        doc.pop(key, None)
+    output_only(doc)
     written_seed = definition.get("seed")
     name = references.ref_name(references.VARIABLE, written_seed)
     if name is not None:
@@ -235,21 +327,8 @@ def fingerprint(expanded, definition, annotations=None):
             pipeline = step.get("pipeline")
             if isinstance(pipeline, dict):
                 pipeline.pop("seed", None)
-    # default=repr: a realized 'constant:' can be any Python value, and the
-    # fingerprint only needs it to be stable, not round-trippable
-    serialized = json.dumps(
-        doc, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=repr
-    )
-    return FINGERPRINT_PREFIX + hashlib.sha256(serialized.encode("utf-8")).hexdigest()
-
+    return FINGERPRINT_PREFIX + _canonical_digest(doc)
 
-UNKNOWN = "unknown"
-CATALOG = "catalog"
-PER_ENTRY = "per_entry"
-DERIVED = "derived"
-OTHER_DEVICE = "other_device"
-OBSERVED = "observed"
-INHERITED = "inherited"
 
 # #301: a single run is not the same statistical basis as a dozen. Below
 # this many observed runs, an "observed" figure is tempered rather than
@@ -313,144 +392,16 @@ def _cached_minutes(minutes, cached_steps, total_steps):
     return round(minutes * remaining / total_steps, 1)
 
 
-COST_DRIVERS_KEY = "cost_drivers"
-
-
-def _declared_drivers(definition):
-    """The variables the author says move this workflow's cost - the same
-    rule `dw/server/observed_cost.py`'s `declared_drivers` applies, kept
-    local so this module does not import the server package (#267)."""
-    drivers = definition.get(COST_DRIVERS_KEY)
-    if not isinstance(drivers, list):
-        return []
-    variables = definition.get("variables") or {}
-    return [name for name in drivers if isinstance(name, str) and name in variables]
-
-
-def _driver_comparable(value):
-    """A driver value as something hashable and stable across JSON round
-    trips, mirroring `dw/server/observed_cost.py`'s `_comparable`."""
-    if isinstance(value, bool) or value is None:
-        return value
-    if isinstance(value, (int, float)):
-        return float(value)
-    if isinstance(value, str):
-        try:
-            return float(value)
-        except ValueError:
-            return value
-    return json.dumps(value, sort_keys=True, default=str)
-
-
-def _numeric_fields(entries):
-    """{field: {values}} over the numeric fields of a list's dict entries. A
-    numeric string ("243") counts as its number, as `_driver_comparable` does
-    for a scalar driver."""
-    fields = {}
-    if not isinstance(entries, list):
-        return fields
-    for entry in entries:
-        if not isinstance(entry, dict):
-            continue
-        for key, value in entry.items():
-            number = _driver_comparable(value)
-            if isinstance(number, float) and math.isfinite(number):
-                fields.setdefault(key, set()).add(number)
-    return fields
-
-
-LIST_ENTRY_COST_FIELDS = ("num_frames",)
-
-
-def _list_entry_field_shifted(default_entries, effective_entries):
-    """Whether a list driver's entries carry a numeric field (a per-shot
-    `num_frames`, say) with a value none of the default entries had. The
-    curated figure was measured over the default entries' values, so a value
-    outside them has no matching bucket - the #267 rule applied inside a
-    list driver (#593)."""
-    measured = _numeric_fields(default_entries)
-    for field, values in _numeric_fields(effective_entries).items():
-        # Only a field that sets how long a shot renders moves its cost; a
-        # start_frame or cut_frames is a position that moves with the count
-        if (
-            field in LIST_ENTRY_COST_FIELDS
-            and field in measured
-            and not values <= measured[field]
-        ):
-            return True
-    return False
-
-
-def _per_entry_variable(cost, device):
-    """The list variable the cost entry priced for `device` (else the first,
-    as `_price` chooses) re-prices by a measured per-entry rate, or None."""
-    entries = [entry for entry in (cost or []) if isinstance(entry, dict)]
-    chosen = next((e for e in entries if e.get("device") == device), None)
-    if chosen is None and entries:
-        chosen = entries[0]
-    per = chosen.get("per_entry") if chosen else None
-    return per.get("variable") if isinstance(per, dict) else None
-
-
-def _scalar_driver_shifted(definition, expanded, list_entries, per_entry=None):
-    """Whether a declared, non-list `cost_driver` was overridden away from
-    the default value the curated `cost` was measured against (#267).
-
-    A list driver is `_repriced`'s to catch - it changes the plan's list
-    count, not a bare variable's value. This only asks about a scalar one,
-    which `_repriced` never looks at, so a `catalog` figure measured for one
-    `num_frames` silently priced a run at a different one.
-    """
-    defaults = definition.get("variables") or {}
-    effective = expanded.get("variables") or {}
-    for name in _declared_drivers(definition):
-        default_value = defaults.get(name)
-        if isinstance(default_value, list):
-            # A list the cost prices per entry is already extrapolated in
-            # either direction; its entries' index/name fields are labels,
-            # not cost fields (#772)
-            if name != per_entry and _list_entry_field_shifted(
-                default_value, effective.get(name)
-            ):
-                return True
-            continue
-        if name in list_entries:
-            continue
-        if _driver_comparable(effective.get(name)) != _driver_comparable(default_value):
-            return True
-    return False
-
-
-def _entry_cost_field_shifted(definition, expanded):
-    """Whether any declared list driver carries a per-entry cost field outside
-    the values the default entries had."""
-    defaults = definition.get("variables") or {}
-    effective = expanded.get("variables") or {}
-    return any(
-        isinstance(defaults.get(name), list)
-        and _list_entry_field_shifted(defaults[name], effective.get(name))
-        for name in _declared_drivers(definition)
-    )
-
-
 def _own_price(definition, expanded, list_entries, device, measured_entries):
-    """The workflow's own price, reset to unknown when a scalar driver moved."""
+    """The workflow's own price, scaled along the cost drivers that moved."""
     own = _price(definition.get("cost"), device, list_entries, measured_entries or {})
     # `derived` and `per_entry` are re-priced by entry count alone, so a
-    # per-entry num_frames outside the measured values needs the same check (#796)
-    if own["basis"] in (CATALOG, OTHER_DEVICE, DERIVED, PER_ENTRY) and (
-        _scalar_driver_shifted(
-            definition,
-            expanded,
-            list_entries,
-            _per_entry_variable(definition.get("cost"), device),
-        )
-    ):
-        # A scalar cost_driver (H3's num_frames, say) moved away from the
-        # value the curated cost was measured against, and _repriced only
-        # re-prices a for_each list's length - so the catalog figure would
-        # otherwise be quoted for a run it was never measured for (#267)
-        own = {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+    # per-entry num_frames is scaled as well (#796)
+    if own["basis"] in (CATALOG, OTHER_DEVICE, DERIVED, PER_ENTRY):
+        # _repriced only re-prices a for_each list's length, so a moved scalar
+        # cost_driver (H3's num_inference_steps, say) is scaled here rather
+        # than quoted at the figure measured for the defaults (#267, #866)
+        own = _scaled(own, _driver_scaling(definition, expanded, list_entries))
     return own
 
 
@@ -512,21 +463,17 @@ def _child_catalog_price(child_definition, child_cost, step_arguments, device):
         child_list_entries = _list_entries(child_definition, child_expanded)
     child = _price(child_cost, device, child_list_entries, child_measured_entries)
     if (
-        child["basis"] in (CATALOG, OTHER_DEVICE)
+        child["basis"] in (CATALOG, OTHER_DEVICE, DERIVED, PER_ENTRY)
         and child_definition is not None
-        and _scalar_driver_shifted(
-            child_definition,
-            child_expanded,
-            child_list_entries,
-            _per_entry_variable(child_cost, device),
-        )
     ):
-        # A scalar cost_driver the composing step overrode (H3's
-        # num_frames at 345 against a default of 124, say) is the
-        # same #267 failure one level down - the child's own
-        # catalog figure was never measured for the value this
-        # step actually passes it (#341)
-        child = {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+        # A cost_driver the composing step overrode (H3's num_frames at 345
+        # against a default of 124, say) is the same #267 case one level
+        # down - the child's figure was measured at its defaults, so it is
+        # scaled to the value this step actually passes it (#341, #866)
+        child = _scaled(
+            child,
+            _driver_scaling(child_definition, child_expanded, child_list_entries),
+        )
     return child
 
 
@@ -543,6 +490,8 @@ def __init__(self, minutes, partial, unpriced):
         self.runs = []
         self.measured_on = set()
         self.bases = []
+        self.scaled = []
+        self.differs = []
 
     def add(self, path, child, observed):
         self.had_child = True
@@ -557,12 +506,20 @@ def add(self, path, child, observed):
             self.unpriced_children.append(path)
             return
         self.bases.append((child["basis"], child.get("measured_on")))
+        if child.get("scaled"):
+            self.scaled.append(f"{path}: {child['scaled']}")
+        if not observed:
+            self.differs.extend(child.get("differs") or [])
         if self.minutes is not None:
             self.minutes += child["minutes"]
         else:
             self.minutes = child["minutes"]
 
 
+def _unique(names):
+    return list(dict.fromkeys(names))
+
+
 def _rolled_up_estimate(own, totals, device, cached_steps, total_steps):
     """The final estimate from the parent's own price and its children's."""
     minutes = totals.minutes
@@ -615,6 +572,10 @@ def _rolled_up_estimate(own, totals, device, cached_steps, total_steps):
         devices = {on for _, on in totals.bases}
         if len(devices) == 1:
             top_measured_on = next(iter(devices))
+    if top_basis == CATALOG and any(basis == DERIVED for basis, _ in totals.bases):
+        # A child scaled for the arguments its step passes is an estimate,
+        # so the sum is one too (#866)
+        top_basis = DERIVED
     rounded = round(minutes, 1) if minutes is not None else None
     result = {
         "minutes": rounded,
@@ -626,6 +587,15 @@ def _rolled_up_estimate(own, totals, device, cached_steps, total_steps):
         "runs": top_runs,
         "cached_minutes": _cached_minutes(rounded, cached_steps, total_steps),
     }
+    scaled = ([own["scaled"]] if own.get("scaled") else []) + totals.scaled
+    if scaled and minutes is not None and top_basis != OBSERVED:
+        result["scaled"] = "; ".join(scaled)
+    differs = _unique((own.get("differs") or []) + totals.differs)
+    if differs and minutes is not None and top_basis != OBSERVED:
+        # A figure, own or a child's, measured at another setting of a driver
+        # nothing scales (#866)
+        result["differs"] = differs
+        result["low_confidence"] = True
     if top_basis == OBSERVED:
         # The rolled-up-from-children case (#268): no curated figure of the
         # parent's own exists to blend toward (that is this branch's own
@@ -662,8 +632,10 @@ def estimate(
     ones it was measured with, 'per_entry' that total re-priced from a
     measured per-entry rate, and 'derived' re-priced by extrapolating the
     stored total linearly over a list whose length the caller changed
-    (#85) - an estimate, not a measurement, and the only alternative to
-    quoting a 5-shot figure for a 10-shot run.
+    (#85), or scaled along the steps, canvas or frames moved off the
+    defaults it was measured at (#866, `scale_curated`) - an estimate, not
+    a measurement, and the only alternative to quoting a 5-shot figure for
+    a 10-shot run.
 
     `measured_entries` is what the stored defaults carry, which is the
     list the catalog figure was measured against; without it a catalog
@@ -690,6 +662,19 @@ def estimate(
         measured = None
     if measured is not None:
         measured = _tempered(measured, own["minutes"])
+        if measured.get("tempered") and own.get("scaled"):
+            # What it blended toward was scaled for this run's drivers, and
+            # `curated_minutes` alone does not say so (#866)
+            measured["scaled"] = "; ".join(
+                part for part in (measured.get("scaled"), own["scaled"]) if part
+            )
+        if measured.get("tempered") and own.get("differs"):
+            # It blended toward a figure measured at another setting of a
+            # driver nothing scales (#866)
+            measured["differs"] = _unique(
+                (measured.get("differs") or []) + own["differs"]
+            )
+            measured["low_confidence"] = True
         measured["cached_minutes"] = _cached_minutes(
             measured["minutes"], cached_steps, total_steps
         )
@@ -716,7 +701,14 @@ def estimate(
                 child_definition, child_cost, step_arguments, device
             )
         totals.add(path, child, is_observed)
-    return _rolled_up_estimate(own, totals, device, cached_steps, total_steps)
+    result = _rolled_up_estimate(own, totals, device, cached_steps, total_steps)
+    withheld = observed.get("withheld") if isinstance(observed, dict) else None
+    if withheld and result["basis"] == UNKNOWN and result["minutes"] is None:
+        # History exists but could not be re-priced for this workflow's size:
+        # say which template and why, so it reads differently from no history
+        result["inherited_from"] = observed.get("inherited_from")
+        result["withheld"] = withheld
+    return result
 
 
 def _observed(observed, device):
@@ -753,6 +745,15 @@ def _observed(observed, device):
         estimate["basis"] = INHERITED
         estimate["inherited_from"] = inherited_from
         estimate["differs"] = list(observed.get("differs") or [])
+        if estimate["differs"]:
+            # Measured at another attention backend, cache, LoRA, offload or
+            # quantization than this run's: kept, but flagged (#866)
+            estimate["low_confidence"] = True
+        if observed.get("scaled"):
+            # Re-priced linearly from the template's size (#851): an
+            # approximation, not a measurement
+            estimate["scaled"] = observed["scaled"]
+            estimate["low_confidence"] = True
     return estimate
 
 
diff --git a/dw/realize.py b/dw/realize.py
index e191e963..17d44ba1 100644
--- a/dw/realize.py
+++ b/dw/realize.py
@@ -202,6 +202,11 @@ def _pin_output(reference, output_root):
     return references.make_ref(references.OUTPUT, relative)
 
 
+def pin_output_reference(reference, output_root):
+    """`_pin_output` for a caller outside this module (a run's Made from)."""
+    return _pin_output(reference, output_root)
+
+
 def _record_sub_workflows(steps, annotations, base_dir, workflow_dir):
     """Digest every sub-workflow a step names by local path.
 
diff --git a/dw/references.py b/dw/references.py
index 8eebcf15..7e647c94 100644
--- a/dw/references.py
+++ b/dw/references.py
@@ -28,6 +28,8 @@
 GATHER = "gather:"
 BUILTIN = "builtin:"
 CONSTRAINT = "constraint:"
+# Not a workflow reference: names a workspace as a note target (PUT /api/notes)
+WORKSPACE = "workspace:"
 
 # The key naming the file an argument object is constructed from
 FROM_FILE_KEY = "from_file"
@@ -102,6 +104,32 @@ def author_index(source_indices, index):
 # A for_each member is named `<group>@<entry>`
 MEMBER_SEPARATOR = "@"
 
+# The characters a variable name may hold after its first.
+# `security.validate_variable_name` builds its pattern from this, and a
+# for_each entry's name is checked by that validator, so `member_keys` reads
+# the same set to find where a member key ends - one owner for both
+VARIABLE_NAME_CHARACTERS = (
+    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-"
+)
+
+
+def member_keys(name):
+    """The for_each member keys a name carries: `cold_open` for
+    `shot@cold_open` and for a file named `...-shot@cold_open.0-0.0.mp4`.
+    A key is an entry's name (a variable name) or its index, so it ends at
+    the first character outside `VARIABLE_NAME_CHARACTERS`. Empty for a name
+    with no separator."""
+    if not isinstance(name, str):
+        return []
+    keys = []
+    for part in name.split(MEMBER_SEPARATOR)[1:]:
+        end = 0
+        while end < len(part) and part[end] in VARIABLE_NAME_CHARACTERS:
+            end += 1
+        if end:
+            keys.append(part[:end])
+    return keys
+
 
 def member_suffix(name):
     """The `" in member '<name>'"` a message ends with when its step is a
diff --git a/dw/roles.py b/dw/roles.py
new file mode 100644
index 00000000..abf8d346
--- /dev/null
+++ b/dw/roles.py
@@ -0,0 +1,320 @@
+"""The role of each file a run wrote - final or intermediate - and the
+inputs it read.
+
+The gallery mixes a run's deliverable with the scratch files that went
+into it. The 'final'/'intermediate' result subfolder convention separates
+them for the catalog templates, but the engine treats no folder name
+specially and a hand-built workflow rarely sets one. A role is decided per
+step, first rule wins:
+
+1. the step's `result.role` ('final' or 'intermediate');
+2. its `result.subfolder`, when that is or starts with one of those names;
+3. the data flow: a step a later step consumes (a previous_result
+   reference) is intermediate when that consumer writes media or saves
+   nothing at all, and final otherwise - a consumer that writes only text
+   or JSON (a transcript, check_script, plan_cuts) reads a deliverable, it
+   does not make one out of it.
+
+A composed child's rolled-up manifest entries carry `parent_step` and take
+that step's role. The engine records roles when a run ends, from the
+`role_basis` it took as the run opened; the server reads only what was
+recorded, so a run that predates roles has none - unknown, not guessed. Inputs
+are the asset: and output: references the expanded steps carry - a run's
+'made from' list.
+
+Those rules see one run. A project built from separate workflows - shots,
+narration, a score, then an assembly that cuts them together - leaves every
+run's deliverable recorded final, though for the project they are
+ingredients. So a listing applies one more rule when it reads, without
+rewriting a manifest (`consumed_outputs`, `listed_role`):
+
+4. a file a later run in the same output root read is intermediate - through
+   an output: reference (a run id, 'v<N>' or 'latest', resolved to the file
+   that run read: its inputs are pinned as it opened, and an unpinned
+   'latest' is the newest run that started before it), or through an asset:
+   reference to an asset keep_output kept from that file. A role rule 1
+   declared is recorded as such (`role_declared`) and never demoted; an entry
+   from before that flag is demotable, and a file with no recorded role
+   stays unknown.
+
+This module names no model.
+"""
+
+import json
+import os
+
+from .references import (
+    ASSET,
+    OUTPUT,
+    is_ref,
+    iter_previous_result_references,
+    make_ref,
+    ref_name,
+)
+from .runs import (
+    MANIFEST_FILE_NAME,
+    REALIZED_FILE_NAME,
+    _read_manifest,
+    iter_run_directories,
+    kept_provenance,
+    resolve_output_reference,
+)
+from .security import (
+    ALLOWED_AUDIO_EXTENSIONS,
+    ALLOWED_IMAGE_EXTENSIONS,
+    ALLOWED_VIDEO_EXTENSIONS,
+    SecurityError,
+)
+from .step_cache import reference_resolves_to
+
+FINAL = "final"
+INTERMEDIATE = "intermediate"
+INPUT = "input"
+ROLES = (FINAL, INTERMEDIATE)
+ROLE_KEY = "role"
+# On a manifest entry whose role the step's `result.role` declared (rule 1),
+# the one role a later run's reading it does not demote
+ROLE_DECLARED_KEY = "role_declared"
+
+_MEDIA_EXTENSIONS = frozenset(
+    ALLOWED_IMAGE_EXTENSIONS | ALLOWED_VIDEO_EXTENSIONS | ALLOWED_AUDIO_EXTENSIONS
+)
+
+
+def _subfolder_role(subfolder):
+    """Rule 2: the role a subfolder's head names, or None."""
+    if isinstance(subfolder, str):
+        head = subfolder.split("/", 1)[0]
+        if head in ROLES:
+            return head
+    return None
+
+
+def _stated_role(step):
+    """Rule 1: the role a step's `result.role` names, or None."""
+    result = step.get("result")
+    role = result.get(ROLE_KEY) if isinstance(result, dict) else None
+    return role if role in ROLES else None
+
+
+def _declared_role(step):
+    """Rules 1 and 2: the role a step's result block states, or None."""
+    result = step.get("result")
+    if not isinstance(result, dict):
+        return None
+    return _stated_role(step) or _subfolder_role(result.get("subfolder"))
+
+
+def _writes_only_text(files):
+    """Whether a consumer saved files and none of them is media."""
+    if not files:
+        return False
+    return not any(
+        str(name).lower().endswith(tuple(_MEDIA_EXTENSIONS)) for name in files
+    )
+
+
+def _files_by_step(manifest_steps):
+    files = {}
+    for entry in manifest_steps or []:
+        if not isinstance(entry, dict):
+            continue
+        # A child's entry is its composing step's output in the parent
+        name = entry.get("parent_step") or entry.get("step")
+        files.setdefault(name, []).extend(entry.get("files") or [])
+    return files
+
+
+def role_basis(steps):
+    """What the rules read from expanded steps: each step's name, its
+    declared role (rules 1 and 2), whether rule 1 declared it, and the
+    previous_result references it carries. A run rewrites its steps' references in place as they resolve,
+    so the engine takes this as the run opens, before any step runs."""
+    basis = []
+    for step in steps or []:
+        if not isinstance(step, dict) or "name" not in step:
+            continue
+        consumes = [
+            reference
+            for _path, reference, _via in iter_previous_result_references(
+                step, descend_into_from=True
+            )
+            if isinstance(reference, str)
+        ]
+        basis.append(
+            {
+                "name": step["name"],
+                "declared": _declared_role(step),
+                "stated": _stated_role(step) is not None,
+                "consumes": consumes,
+            }
+        )
+    return basis
+
+
+def step_roles(steps, manifest_steps, basis=None):
+    """Each step's role, by name - see the module docstring for the rules.
+    `basis` is `role_basis(steps)` taken earlier, in place of `steps`."""
+    basis = role_basis(steps) if basis is None else basis
+    files = _files_by_step(manifest_steps)
+    names = [b["name"] for b in basis]
+    roles = {b["name"]: b["declared"] for b in basis if b["declared"]}
+    for consumer in basis:
+        if _writes_only_text(files.get(consumer["name"])):
+            continue
+        for reference in consumer["consumes"]:
+            target = max(
+                (n for n in names if reference_resolves_to(reference, n)),
+                key=len,
+                default=None,
+            )
+            if target is not None and target not in roles:
+                roles[target] = INTERMEDIATE
+    for name in list(names) + list(files):
+        roles.setdefault(name, FINAL)
+    return roles
+
+
+def annotate_roles(steps, manifest_steps, basis=None):
+    """Copies of `manifest_steps`, each with its step's `role`, and
+    `role_declared` where rule 1 decided it."""
+    basis = role_basis(steps) if basis is None else basis
+    roles = step_roles(None, manifest_steps, basis)
+    stated = {b["name"] for b in basis if b.get("stated")}
+    annotated = []
+    for entry in manifest_steps or []:
+        if not isinstance(entry, dict):
+            annotated.append(entry)
+            continue
+        name = entry.get("parent_step") or entry.get("step")
+        entry = {**entry, ROLE_KEY: roles.get(name, FINAL)}
+        if name in stated:
+            entry[ROLE_DECLARED_KEY] = True
+        annotated.append(entry)
+    return annotated
+
+
+def entry_role(entry):
+    """A manifest entry's recorded role, or None when it predates roles."""
+    role = entry.get(ROLE_KEY) if isinstance(entry, dict) else None
+    return role if role in ROLES else None
+
+
+def _walk_strings(value):
+    if isinstance(value, str):
+        yield value
+    elif isinstance(value, dict):
+        for item in value.values():
+            yield from _walk_strings(item)
+    elif isinstance(value, list):
+        for item in value:
+            yield from _walk_strings(item)
+
+
+def run_inputs(steps):
+    """The asset: and output: references the steps read, in first-use order."""
+    kinds = ((ASSET, "asset"), (OUTPUT, "output"))
+    seen = []
+    for step in steps or []:
+        if not isinstance(step, dict):
+            continue
+        for value in _walk_strings(step):
+            for prefix, kind in kinds:
+                if is_ref(prefix, value) and value not in (
+                    s["reference"] for s in seen
+                ):
+                    seen.append({"reference": value, "kind": kind})
+    return seen
+
+
+def listed_role(role, declared, consumed):
+    """Rule 4: the role a listing shows for a file whose run recorded
+    `role` - intermediate once a later run `consumed` it, unless rule 1
+    `declared` the role. An unknown role stays unknown."""
+    if role is None or declared or not consumed:
+        return role
+    return INTERMEDIATE
+
+
+# What each run read, by manifest path, keyed on the manifest's stat: a
+# listing asks of every run on every call, and a manifest rarely changes
+_READS = {}
+_KINDS = {"asset": ASSET, "output": OUTPUT}
+
+
+def _recorded_reads(run_dir):
+    """The (kind, reference) pairs a run read: its manifest's pinned
+    `inputs`, or for a run from before them the references its realized
+    workflow carries."""
+    path = os.path.join(run_dir, MANIFEST_FILE_NAME)
+    try:
+        stat = os.stat(path)
+    except OSError:
+        return ()
+    signature = (stat.st_mtime_ns, stat.st_size, stat.st_ino)
+    cached = _READS.get(path)
+    if cached is not None and cached[0] == signature:
+        return cached[1]
+    inputs = (_read_manifest(run_dir) or {}).get("inputs")
+    if not isinstance(inputs, list):
+        try:
+            with open(os.path.join(run_dir, REALIZED_FILE_NAME)) as handle:
+                inputs = run_inputs([json.load(handle)])
+        except (OSError, ValueError):
+            inputs = []
+    reads = tuple(
+        (entry["kind"], entry["reference"])
+        for entry in inputs
+        if isinstance(entry, dict)
+        and isinstance(entry.get("reference"), str)
+        and is_ref(_KINDS.get(entry.get("kind"), ""), entry["reference"])
+    )
+    _READS[path] = (signature, reads)
+    return reads
+
+
+def _relative(path, root):
+    return os.path.relpath(os.path.realpath(path), root).replace(os.sep, "/")
+
+
+def consumed_outputs(output_root, find_asset=None, workspace=None):
+    """Rule 4's evidence: the files under `output_root` (relative, '/'
+    separated) that a run under it read. `find_asset` maps an asset name to
+    its file, or None; an asset counts when keep_output recorded it was kept
+    from a file of `workspace`. One call answers a whole listing."""
+    root = os.path.realpath(output_root)
+    consumed = set()
+    kept = {}
+    for run_dir in iter_run_directories(output_root):
+        run_id = os.path.basename(run_dir)
+        for kind, reference in _recorded_reads(run_dir):
+            try:
+                if kind == "output":
+                    path = resolve_output_reference(reference, root, before=run_id)
+                elif find_asset is None:
+                    continue
+                else:
+                    if reference not in kept:
+                        kept[reference] = _kept_source(
+                            reference, find_asset, workspace, root
+                        )
+                    path = kept[reference]
+                if path and not _relative(path, root).startswith(".."):
+                    consumed.add(_relative(path, root))
+            except (OSError, ValueError, SecurityError):
+                # a reference that no longer names a file consumes nothing
+                continue
+    return consumed
+
+
+def _kept_source(reference, find_asset, workspace, root):
+    """The output file an asset was kept from, when it was kept from
+    `workspace`, else None."""
+    path = find_asset(ref_name(ASSET, reference).strip())
+    provenance = kept_provenance(path) if path else None
+    if not isinstance(provenance, dict):
+        return None
+    source = provenance.get("source")
+    if provenance.get("workspace") != workspace or not isinstance(source, str):
+        return None
+    return resolve_output_reference(make_ref(OUTPUT, source), root)
diff --git a/dw/runs.py b/dw/runs.py
index 5a2d9e76..75a1ed61 100644
--- a/dw/runs.py
+++ b/dw/runs.py
@@ -136,7 +136,13 @@ def _runs_newest_first(directory):
         return []
 
 
-def _resolve_segments(directory, parts, reference, root):
+def _started_before(run, before):
+    """Whether `run` started no later than the run id `before` - the second
+    a run id opens with - and is not that run itself."""
+    return run != before and run[:_RUN_ID_STAMP_LENGTH] <= before[:_RUN_ID_STAMP_LENGTH]
+
+
+def _resolve_segments(directory, parts, reference, root, before=None):
     """Build the path a name stands for, expanding 'latest' or 'v<N>' where
     it names a run.
 
@@ -156,6 +162,9 @@ def _resolve_segments(directory, parts, reference, root):
     'latest' or 'v4' segment in a directory that holds no runs is a name
     like any other, so a workflow or a file called either stays reachable.
 
+    `before`, a run id, narrows 'latest' to the runs that started before
+    it - what 'latest' named when that run read it.
+
     Returns the path, or None when runs were found and none of them holds
     the file.
     """
@@ -166,6 +175,8 @@ def _resolve_segments(directory, parts, reference, root):
         runs = _runs_newest_first(directory)
         if runs:
             for run in runs:
+                if before and not _started_before(run, before):
+                    continue
                 candidate = _resolve_segments(
                     os.path.join(directory, run), rest, reference, root
                 )
@@ -199,10 +210,12 @@ def _resolve_segments(directory, parts, reference, root):
             if candidate and os.path.isfile(candidate):
                 return candidate
         return None
-    return _resolve_segments(os.path.join(directory, part), rest, reference, root)
+    return _resolve_segments(
+        os.path.join(directory, part), rest, reference, root, before
+    )
 
 
-def resolve_output_reference(reference, root=None):
+def resolve_output_reference(reference, root=None, before=None):
     """Resolve an 'output:' reference to the file it names.
 
     The name is a path under the output directory - '<workflow>/<run
@@ -217,6 +230,8 @@ def resolve_output_reference(reference, root=None):
         reference: The 'output:...' string
         root: The output directory to resolve against; defaults to the run
             in progress, else the workspace's outputs
+        before: A run id: 'latest' then names the newest run that started
+            before it, as it did when that run read the reference
 
     Returns:
         The validated absolute path of the file
@@ -236,7 +251,7 @@ def resolve_output_reference(reference, root=None):
     name = validate_output_reference(name.strip())
     root = root or output_root()
 
-    resolved = _resolve_segments(root, name.split("/"), reference, root)
+    resolved = _resolve_segments(root, name.split("/"), reference, root, before)
     if resolved is None:
         raise ValueError(
             f"Output '{name}' not found under {root} - no run of that workflow "
@@ -352,6 +367,15 @@ def is_run_id(segment):
     return bool(RUN_ID_PATTERN.match(segment or ""))
 
 
+def iter_run_directories(root):
+    """Every run directory under an output root. A run directory holds no
+    run directories of its own, so the walk stops at each."""
+    for current, dirs, _names in os.walk(root):
+        if is_run_id(os.path.basename(current)):
+            dirs[:] = []
+            yield current
+
+
 def split_run_path(relative_path):
     """The three parts of a run-relative path: (identity, run id, subfolder).
 
@@ -399,6 +423,8 @@ def strip_run_id(relative_path):
 
 # The length of a run id before any '-N' counter a same-second rerun takes
 _RUN_ID_BASE_LENGTH = len("20260101-000000-00000000")
+# And of the UTC second it opens with
+_RUN_ID_STAMP_LENGTH = len("20260101-000000")
 
 # Recorded ordinals by manifest path, keyed on the manifest's stat so an
 # edited or replaced manifest is read again. A recorded number never changes,
@@ -680,6 +706,80 @@ def open_run(output_dir, file_spec, workflow_id, run_id):
     return candidate, version
 
 
+def copy_runs_in(source_identity_dir, identity_dir, run_ids, place):
+    """Bring runs of one identity in from another workspace and settle their
+    numbers - the copy's counterpart of `open_run` (dw/workspace_copy.py).
+
+    `place(run_id)` puts one run folder at `<identity_dir>/<run_id>`. It is
+    called under the identity's run lock, oldest run first, so no run can
+    open between a copy landing and its number being written down.
+
+    A copied run keeps the version it had in the source unless the
+    destination already holds that number; then every run of this call is
+    numbered after the destination's highest, in run-id order. The
+    destination's unrecorded runs are pinned first (`record_run_versions`):
+    a copied run sorting among them would otherwise move their ranked
+    numbers. The number is written into the copied manifest - a copy, never
+    a link - so the source's stays as it was.
+
+    Returns:
+        {run id: {"from": old, "to": new}} for each run whose number changed
+    """
+    source_versions = run_versions(source_identity_dir)
+    run_ids = sorted(run_ids, key=run_id_sort_key)
+    renumbered = {}
+    with FileLock(run_lock_path(identity_dir)):
+        os.makedirs(identity_dir, exist_ok=True)
+        held = set(record_run_versions(identity_dir).values())
+        wanted = [source_versions.get(run_id) for run_id in run_ids]
+        collides = any(v is not None and v in held for v in wanted)
+        next_number = max(held, default=0) + 1
+        for run_id, version in zip(run_ids, wanted):
+            place(run_id)
+            if version is None:
+                continue
+            new = version
+            if collides:
+                new, next_number = next_number, next_number + 1
+            # Pinned even when unchanged: a source run that recorded no
+            # number was ranked, and its rank in the destination is not
+            # the one it had
+            _pin_version(os.path.join(identity_dir, run_id), new)
+            if new != version:
+                renumbered[run_id] = {"from": version, "to": new}
+    return renumbered
+
+
+def _pin_version(run_dir, version):
+    """Record a run's ordinal in its manifest. A run with no readable
+    manifest is left alone, and stays ranked."""
+    manifest = _read_manifest(run_dir)
+    if manifest is None or manifest.get(RUN_VERSION_KEY) == version:
+        return
+    manifest[RUN_VERSION_KEY] = version
+    write_json_atomic(os.path.join(run_dir, MANIFEST_FILE_NAME), manifest)
+
+
+def identity_run_ids(identity_dir):
+    """Every run id under one workflow identity, oldest first."""
+    return _run_ids(identity_dir)
+
+
+def write_json_atomic(path, data):
+    """Write `data` as JSON to `path` by a temp file and a rename, so a
+    reader never sees half a file. Raises OSError."""
+    directory = os.path.dirname(path)
+    os.makedirs(directory, exist_ok=True)
+    fd, tmp_path = tempfile.mkstemp(dir=directory, prefix=f".{os.path.basename(path)}-")
+    try:
+        with os.fdopen(fd, "w") as file:
+            json.dump(data, file, indent=2, default=str)
+        os.replace(tmp_path, path)
+    except OSError:
+        os.unlink(tmp_path)
+        raise
+
+
 def write_manifest(run_dir, manifest):
     """Record what a run did, beside what it made.
 
@@ -690,15 +790,7 @@ def write_manifest(run_dir, manifest):
     """
     path = os.path.join(run_dir, MANIFEST_FILE_NAME)
     try:
-        os.makedirs(run_dir, exist_ok=True)
-        fd, tmp_path = tempfile.mkstemp(dir=run_dir, prefix=f".{MANIFEST_FILE_NAME}-")
-        try:
-            with os.fdopen(fd, "w") as file:
-                json.dump(manifest, file, indent=2, default=str)
-            os.replace(tmp_path, path)
-        except OSError:
-            os.unlink(tmp_path)
-            raise
+        write_json_atomic(path, manifest)
     except OSError as e:
         logger.warning(f"Could not write {path}: {e}")
         return None
diff --git a/dw/script_lines.py b/dw/script_lines.py
index 5542f842..9354b570 100644
--- a/dw/script_lines.py
+++ b/dw/script_lines.py
@@ -15,6 +15,7 @@
 
 import re
 
+from .references import member_keys
 from .shots import duplicate_shot_names
 
 COMMAND = "check_script"
@@ -127,9 +128,11 @@ def parse_lines(lines):
     """The expected lines as [{text, tokens, shot}], or ValueError naming
     `lines`.
 
-    Each entry is a string or {text, shot}; markup is stripped
+    Each entry is a string or {text, shot, start_frame}; markup is stripped
     (strip_markup) and `shot`, the name of the shot the line is spoken in,
-    is None when not given. `[]` means no speech is expected.
+    is None when not given. `start_frame` picks one occurrence of a shot
+    name the take's map holds more than once (#919); None when not given.
+    `[]` means no speech is expected.
     """
     if isinstance(lines, str) or not isinstance(lines, (list, tuple)):
         raise ValueError(
@@ -138,16 +141,29 @@ def parse_lines(lines):
         )
     parsed = []
     for index, entry in enumerate(lines):
-        shot = None
+        shot = start_frame = None
         if isinstance(entry, dict):
-            extra = sorted(set(entry) - {"text", "shot"})
+            extra = sorted(set(entry) - {"text", "shot", "start_frame"})
             if extra:
                 raise ValueError(
                     f"{COMMAND} 'lines'[{index}] has unknown keys {extra};"
-                    " a line object takes only 'text' and 'shot'"
+                    " a line object takes only 'text', 'shot' and 'start_frame'"
                 )
             text = entry.get("text")
             shot = entry.get("shot")
+            start_frame = entry.get("start_frame")
+            if start_frame is not None and (
+                isinstance(start_frame, bool) or not isinstance(start_frame, int)
+            ):
+                raise ValueError(
+                    f"{COMMAND} 'lines'[{index}] 'start_frame' must be an"
+                    f" integer frame number, got {start_frame!r}"
+                )
+            if start_frame is not None and shot is None:
+                raise ValueError(
+                    f"{COMMAND} 'lines'[{index}] gives 'start_frame' without"
+                    " the 'shot' it picks an occurrence of"
+                )
             if shot is not None and (not isinstance(shot, str) or not shot.strip()):
                 raise ValueError(
                     f"{COMMAND} 'lines'[{index}] 'shot' must be a shot's name"
@@ -161,7 +177,14 @@ def parse_lines(lines):
                 " {text, shot}"
             )
         stripped, tokens = strip_markup(text)
-        parsed.append({"text": stripped, "tokens": tokens, "shot": shot})
+        parsed.append(
+            {
+                "text": stripped,
+                "tokens": tokens,
+                "shot": shot,
+                "start_frame": start_frame,
+            }
+        )
     return parsed
 
 
@@ -187,28 +210,121 @@ def parse_shots(shots):
     return list(shots) or None
 
 
+def matching_shot_names(shot, names):
+    """The names in `names` a line's `shot` addresses: `shot` itself when
+    the map holds it, else every name carrying it as a `@<member>` key
+    (`cold_open` for `shot@cold_open` or `...-shot@cold_open.0-0.0.mp4`)."""
+    if shot in names:
+        return [shot]
+    return list(dict.fromkeys(name for name in names if shot in member_keys(name)))
+
+
+def _repeated(records):
+    """The (file, name) pairs `records` holds more than once."""
+    return {
+        (file, name)
+        for file, dups in (duplicate_shot_names(records) or {}).items()
+        for name in dups
+    }
+
+
+def occurrence_name(record):
+    """A repeated shot's name made unique by where it sits: `shot@bus#1248`."""
+    return f"{record['name']}#{record.get('start_frame')}"
+
+
+def disambiguated(records):
+    """`records` with each name the map holds more than once (within a file)
+    renamed by `occurrence_name`, so a span or finding can tell the
+    occurrences apart (#919). The same list when nothing repeats."""
+    repeated = _repeated(records)
+    if not repeated:
+        return records
+    return [
+        dict(record, name=occurrence_name(record))
+        if (record.get("file"), record.get("name")) in repeated
+        else record
+        for record in records
+    ]
+
+
 def shot_names_error(parsed_lines, records, source="argument"):
-    """The refusal for a line naming a shot `records` does not hold once -
-    unknown, or a name `shots.duplicate_shot_names` finds repeated - or
-    None. The message lists the shots it does hold."""
+    """The refusal for a line naming a shot `records` does not hold - unknown,
+    a short `@<member>` name more than one shot carries, or a name the map
+    holds more than once and the line gives no `start_frame` for - or None.
+    The message lists the shots it does hold."""
     names = [record.get("name") for record in records]
-    known = ", ".join(repr(name) for name in names)
-    duplicated = {
-        name for dups in (duplicate_shot_names(records) or {}).values() for name in dups
-    }
+    repeated = {name for _, name in _repeated(records)}
+    known = ", ".join(repr(name) for name in dict.fromkeys(names))
+    nameable = ", ".join(
+        repr(name) for name in dict.fromkeys(names) if name not in repeated
+    )
     for index, line in enumerate(parsed_lines):
         shot = line["shot"]
         if shot is None:
             continue
-        if shot not in names:
+        matches = matching_shot_names(shot, names)
+        if not matches:
             return (
                 f"{COMMAND} 'lines'[{index}] names shot {shot!r}, which the take"
                 f" does not have - its shots ({source}) are {known}"
             )
-        if shot in duplicated:
+        if len(matches) > 1:
             return (
-                f"{COMMAND} 'lines'[{index}] names shot {shot!r}, which the"
-                f" take's shot map ({source}) holds more than once - a line can"
-                f" only name a shot the map holds once: {known}"
+                f"{COMMAND} 'lines'[{index}] names shot {shot!r}, which more"
+                f" than one of the take's shots ({source}) carries - name one"
+                f" in full: {', '.join(repr(name) for name in matches)}"
+            )
+        if matches[0] in repeated:
+            frames = [
+                record.get("start_frame")
+                for record in records
+                if record.get("name") == matches[0]
+            ]
+            start_frame = line.get("start_frame")
+            if start_frame is None:
+                return (
+                    f"{COMMAND} 'lines'[{index}] names shot {shot!r}, which the"
+                    f" take's shot map ({source}) holds more than once - add"
+                    f" 'start_frame' to say which occurrence: one of {frames}."
+                    f" Shots named without it: {nameable or 'none'}"
+                )
+            if start_frame not in frames:
+                return (
+                    f"{COMMAND} 'lines'[{index}] 'start_frame' {start_frame}"
+                    f" matches no occurrence of shot {shot!r} ({source}) - its"
+                    f" start_frames are {frames}"
+                )
+        elif line.get("start_frame") is not None:
+            frame = next(
+                record.get("start_frame")
+                for record in records
+                if record.get("name") == matches[0]
             )
+            if frame != line["start_frame"]:
+                return (
+                    f"{COMMAND} 'lines'[{index}] 'start_frame'"
+                    f" {line['start_frame']} does not match shot {shot!r}"
+                    f" ({source}), which starts at frame {frame}"
+                )
     return None
+
+
+def with_full_shot_names(parsed_lines, records):
+    """`parsed_lines` with each line's short shot name replaced by the name
+    `disambiguated(records)` holds: the full name, or for a repeated shot
+    `occurrence_name`. Call after `shot_names_error` found nothing."""
+    names = [record.get("name") for record in records]
+    repeated = {name for _, name in _repeated(records)}
+    resolved = []
+    for line in parsed_lines:
+        shot = line["shot"]
+        matches = matching_shot_names(shot, names) if shot is not None else []
+        if not matches:
+            resolved.append(line)
+            continue
+        full = matches[0]
+        if full in repeated:
+            full = f"{full}#{line.get('start_frame')}"
+        resolved.append(dict(line, shot=full))
+    return resolved
diff --git a/dw/security.py b/dw/security.py
index df01c4f0..5bbb2523 100644
--- a/dw/security.py
+++ b/dw/security.py
@@ -9,6 +9,8 @@
 from urllib.parse import urlparse
 from typing import Union, List, Optional
 
+from .references import VARIABLE_NAME_CHARACTERS
+
 logger = logging.getLogger("dw")
 
 # Security constants
@@ -307,7 +309,7 @@ def validate_variable_name(name: str) -> str:
         raise InvalidInputError("Variable name cannot be empty")
 
     # Allow only alphanumeric characters, underscores, and hyphens
-    if not re.match(r"^[a-zA-Z_][a-zA-Z0-9_-]*\Z", name):
+    if not re.match(rf"^[a-zA-Z_][{re.escape(VARIABLE_NAME_CHARACTERS)}]*\Z", name):
         raise InvalidInputError(f"Invalid variable name: {name}")
 
     if len(name) > MAX_VARIABLE_NAME_LENGTH:
@@ -492,8 +494,12 @@ def validate_asset_reference(name: str) -> str:
 # checked by the validate_path that joins the name onto the output root -
 # and a name still may not *start* with it.
 OUTPUT_REFERENCE_CHARACTERS = r"[\w.@-]"
-OUTPUT_REFERENCE_PATTERN = r"^[\w][\w.@-]*(/[\w][\w.@-]*){1,6}\Z"
+_OUTPUT_SEGMENT = r"[\w][\w.@-]*"
+OUTPUT_REFERENCE_PATTERN = rf"^{_OUTPUT_SEGMENT}(/{_OUTPUT_SEGMENT}){{1,6}}\Z"
 MAX_OUTPUT_REFERENCE_LENGTH = 500
+# A run, or every run of one workflow: an output name cut short of its
+# file, so whatever a copy between workspaces takes can be named after it
+OUTPUT_PREFIX_PATTERN = rf"^{_OUTPUT_SEGMENT}(/{_OUTPUT_SEGMENT}){{0,6}}\Z"
 
 
 def validate_output_reference(name: str) -> str:
@@ -525,6 +531,27 @@ def validate_output_reference(name: str) -> str:
     )
 
 
+def validate_output_prefix(name: str) -> str:
+    """
+    Validate the leading segments of an output name: `<workflow>/<run id>`
+    or a bare `<workflow>`, as a copy between workspaces names runs. The
+    segment rule is validate_output_reference's; containment is checked by
+    the validate_path that joins the name.
+
+    Raises:
+        InvalidInputError: If name is invalid
+    """
+    return _validate_name(
+        name,
+        OUTPUT_PREFIX_PATTERN,
+        MAX_OUTPUT_REFERENCE_LENGTH,
+        "Run name",
+        "name a run as '<workflow>/<run id>', as the gallery lists it, or a "
+        "bare '<workflow>' for all its runs",
+        allowed=OUTPUT_REFERENCE_CHARACTERS,
+    )
+
+
 # A step's result 'subfolder': a relative path under the run directory. The
 # segment rule is OUTPUT_REFERENCE_PATTERN's, so every subfolder the engine
 # writes is one a later workflow can name with 'output:'. It also refuses a
diff --git a/dw/server/admission.py b/dw/server/admission.py
index cef9da0e..a8b1279a 100644
--- a/dw/server/admission.py
+++ b/dw/server/admission.py
@@ -26,7 +26,8 @@
     resolve_asset_reference,
 )
 from .. import get_device_type, references, validation
-from ..plan import build_plan
+from ..notes import MAX_NOTE_LENGTH, NoteTooLong, clean_note
+from ..plan import build_plan, list_entries
 from ..prompts import resolve_prompt_reference
 from ..runs import (
     activate_output_root,
@@ -38,7 +39,8 @@
 from ..variables import argument_errors
 from ..vram_estimate import required_vram_gb
 from ..workflow import Workflow, workflow_from_definition, workflow_from_file
-from .deps import ceiling_index, server_prompt_library
+from .host_ram_need import projected_peak
+from .deps import ceiling_index, lora_index, server_prompt_library
 from .job_record import ACK_BOOLEAN, ACK_BOUND, ACK_NONE
 from .outputs import resolution_library
 
@@ -82,6 +84,10 @@ class Admission:
     # What a card must hold to run it, (gb, hard) or None - the worker pool
     # dispatches on it (dw/vram_estimate.py required_vram_gb, #462)
     vram_need: Optional[tuple] = None
+    # The host RAM it is projected to hold at its peak, (mb, basis, runs) or
+    # None for no figure (dw/server/host_ram_need.py, #869). Set by
+    # admit_for, which has the server's history; nothing dispatches on it yet
+    host_ram_need: Optional[tuple] = None
 
     @property
     def ok(self):
@@ -113,6 +119,7 @@ def admit(
     plan_for=None,
     capacity_gb=None,
     capacity_label=None,
+    lora_index=None,
 ):
     """Load the request's workflow once and check it once, with the
     workspace's asset library active for every check (the validate route
@@ -124,7 +131,8 @@ def admit(
 
     `asset_library` and `prompt_library` are the `LibraryPath`s the workspace's
     'asset:' and 'prompt:' references resolve over; `ceiling_index` is the
-    catalog's VRAM ceilings for inherited_vram_warnings.
+    catalog's VRAM ceilings for inherited_vram_warnings; `lora_index` the
+    LoRA catalog's partitions for the adapter checks (`deps.lora_index`).
 
     One ValidationContext serves the whole request: the error pass and the
     warning pass (`validation.WARNING_CHECKS`) read one expansion and one
@@ -176,6 +184,7 @@ def admit(
                 candidate,
                 checked,
                 ceiling_index=ceiling_index,
+                lora_index=lora_index,
                 capacity_gb=capacity_gb,
                 capacity_label=capacity_label,
             )
@@ -399,6 +408,20 @@ class JobRequest(BaseModel):
         description="Which workspace to run or resolve in; the default when omitted",
     )
     acknowledged_cost: Optional[Union[bool, AcknowledgedCost]] = ACKNOWLEDGED_COST_FIELD
+    note: Optional[str] = Field(
+        default=None,
+        description=f"A note on the run, at most {MAX_NOTE_LENGTH} characters: "
+        "kept with the job and written as the run note when the run opens",
+    )
+
+
+def admitted_note(note):
+    """The job's note as it will be stored, or a 400 - checked before
+    admission so an over-long note queues nothing."""
+    try:
+        return clean_note(note)
+    except (NoteTooLong, TypeError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
 
 
 def pool_capacity(state):
@@ -413,20 +436,63 @@ def pool_capacity(state):
     return manager.largest_ceiling()
 
 
-def admit_for(state, workspace, **request):
+def admit_for(
+    state, workspace, *, catalog_name=None, history_workspace=None, **request
+):
     """`admit()` with this server's view of `workspace` - the asset and
     prompt search paths and the catalog's VRAM ceilings, which live on the
-    app's state rather than in the request."""
+    app's state rather than in the request - and, for an admitted request,
+    its projected host-RAM peak from this server's history.
+
+    `catalog_name` and `history_workspace` say whose runs the fit reads, as
+    `ObservedCosts.rows_for` takes them; None for an inline definition."""
     capacity_gb, capacity_label = pool_capacity(state)
-    return admit(
+    admission = admit(
         workspace=workspace,
         ceiling_index=ceiling_index(state, workspace),
+        lora_index=lora_index(state),
         capacity_gb=capacity_gb,
         capacity_label=capacity_label,
         asset_library=resolution_library(state, workspace),
         prompt_library=server_prompt_library(state),
         **request,
     )
+    if admission.ok:
+        admission.host_ram_need = _host_ram_need(
+            state, admission, catalog_name, history_workspace
+        )
+    return admission
+
+
+def _host_ram_need(state, admission, catalog_name, history_workspace):
+    """projected_peak for an admitted request - best effort: a projection
+    that fails leaves no figure rather than refusing a request admission
+    took."""
+    try:
+        manager = getattr(state, "job_manager", None)
+        history = getattr(manager, "history", None)
+        costs = getattr(state, "observed_costs", None)
+        rows = (
+            costs.rows_for(catalog_name, workspace=history_workspace)
+            if costs is not None and catalog_name
+            else []
+        )
+        candidate = admission.workflow
+        definition = candidate.workflow_definition
+        entries = list_entries(
+            definition,
+            {"variables": candidate.folded_variables(admission.arguments)},
+        )
+        return projected_peak(
+            definition,
+            admission.arguments,
+            history,
+            rows=rows,
+            list_entries=entries,
+        )
+    except Exception:
+        logger.debug("Could not project the job's host-RAM peak", exc_info=True)
+        return None
 
 
 def acknowledgement_form(value):
diff --git a/dw/server/api_models.py b/dw/server/api_models.py
index ceaf9087..17572e26 100644
--- a/dw/server/api_models.py
+++ b/dw/server/api_models.py
@@ -13,57 +13,69 @@
 not emit stays absent rather than arriving as null.
 """
 
-import logging
-import os
-
 from typing import Any, Literal
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import ConfigDict, Field
 
 from .admission import AcknowledgedCost
-from .catalog_shape import SHAPES, TRAITS
-
-STRICT = os.environ.get("DW_STRICT_RESPONSES") == "1"
-
-logger = logging.getLogger(__name__)
-
-
-class ApiModel(BaseModel):
-    model_config = ConfigDict(extra="forbid" if STRICT else "allow")
-
-
-def send_rejected_responses(app) -> None:
-    """Make runtime leniency cover a declared field of the wrong type too,
-    not just an undeclared key: the response is logged and sent as the
-    handler built it, with the route's own status. Some routes have acted
-    by then - POST /api/jobs has queued the job - and a 500 would invite a
-    retry that does it twice. Installed by create_app outside strict mode."""
-    from fastapi.encoders import jsonable_encoder
-    from fastapi.exceptions import ResponseValidationError
-    from fastapi.responses import JSONResponse
-
-    async def send_as_built(request, exc: ResponseValidationError):
-        route = request.scope.get("route")
-        logger.error(
-            "Response for %s %s does not match its model: %s",
-            request.method,
-            request.url.path,
-            exc.errors(),
-        )
-        return JSONResponse(
-            jsonable_encoder(exc.body),
-            status_code=getattr(route, "status_code", None) or 200,
-        )
-
-    app.add_exception_handler(ResponseValidationError, send_as_built)
-
-
-def sometimes(description: str | None = None) -> Any:
-    """A key the handler emits only in some states, and never as null when
-    it does: typed as its value, defaulting to an unvalidated None that
-    `response_model_exclude_unset` keeps out of the payload. The generated
-    type is then `key?: T`, not `key?: T | null`."""
-    return Field(default=None, description=description)
+from .api_models_base import STRICT, ApiModel, send_rejected_responses, sometimes
+from .api_models_library import (
+    Origin,
+    Shape,
+    Trait,
+    LibraryRoot,
+    ShadowedEntry,
+    DiskUsage,
+    WorkspaceInfo,
+    WorkspaceList,
+    WorkspaceDeleted,
+    CopiedItems,
+    WorkspaceCopied,
+    WorkflowCost,
+    WorkflowCard,
+    BuiltinWorkflows,
+    WorkflowList,
+    WorkflowSaved,
+    WorkflowDeleted,
+    PromptCard,
+    PromptList,
+    PromptSaved,
+    Deleted,
+    EnhancerPreset,
+    EnhancerPresets,
+)
+
+# The library's models live in api_models_library, and the base in
+# api_models_base; every route and test imports them from here
+__all__ = [
+    "STRICT",
+    "ApiModel",
+    "send_rejected_responses",
+    "sometimes",
+    "Origin",
+    "Shape",
+    "Trait",
+    "LibraryRoot",
+    "ShadowedEntry",
+    "DiskUsage",
+    "WorkspaceInfo",
+    "WorkspaceList",
+    "WorkspaceDeleted",
+    "CopiedItems",
+    "WorkspaceCopied",
+    "WorkflowCost",
+    "WorkflowCard",
+    "BuiltinWorkflows",
+    "WorkflowList",
+    "WorkflowSaved",
+    "WorkflowDeleted",
+    "PromptCard",
+    "PromptList",
+    "PromptSaved",
+    "Deleted",
+    "EnhancerPreset",
+    "EnhancerPresets",
+]
 
 
 # ----------------------------------------------------------------- system
@@ -80,6 +92,12 @@ class WorkerInfo(ApiModel):
     host_memory_rss_mb: float = sometimes(
         "The worker process's resident host memory; absent while it is not running."
     )
+    pid: int = sometimes("The worker process's pid; absent while it is not running.")
+    oom_score_adj: int = sometimes(
+        "The worker's kernel oom_score_adj, read from /proc at call time (1000 for "
+        "the latest dispatch's worker in a pool, else the value it was spawned "
+        "with); absent where unreadable."
+    )
 
 
 class HealthInfo(ApiModel):
@@ -243,6 +261,11 @@ class ModelDownload(ApiModel):
     error: str | None
     started_at: int | float
     finished_at: int | float | None
+    cancel_requested: bool = Field(
+        default=False,
+        description="A cancel was requested and the download has not yet "
+        "stopped: it is stopping, not still pulling.",
+    )
 
 
 class ModelDownloads(ApiModel):
@@ -375,6 +398,62 @@ class JobSummary(ApiModel):
     )
     historical: bool = sometimes("Read from job history rather than a live job.")
     queue_position: int = sometimes("Index in the waiting queue; only while queued.")
+    waiting_for: str = sometimes(
+        "Why dispatch is holding this queued job though a card is free - "
+        "'waiting for host RAM: needs ~N GB, ~M GB free'; only while queued and "
+        "held. It starts when a running job frees the RAM."
+    )
+    note: str = sometimes("The note it was submitted with; also its run's note.")
+    rerun_of: str = sometimes(
+        "The job this one reran; absent for a job submitted fresh."
+    )
+
+
+class StepTiming(ApiModel):
+    """Where one pipeline step's time went, on the worker's monotonic clock
+    (dw/pipeline_processors/timing.py). Every `_s` is seconds to 0.1; a field
+    whose mark never happened is null, never guessed. Open, like the entry."""
+
+    model_config = ConfigDict(extra="allow")
+
+    load_s: float | None = Field(
+        description="Loading or fetching the step's pipeline, cached or not."
+    )
+    load_cached: bool | None = Field(
+        description="The pipeline came from the worker's cache; false if any "
+        "part was loaded fresh, null when the step loaded nothing."
+    )
+    encode_s: float | None = Field(
+        description="Call start to the first denoiser forward: prompt "
+        "encoding and preparation."
+    )
+    denoise_s: float | None = Field(
+        description="First denoiser forward to the last pass's end; the whole "
+        "call when the pipeline reports no passes."
+    )
+    passes: int | None = Field(
+        description="Denoise passes the pipeline ran, one per scheduler timestep; can differ from num_inference_steps."
+    )
+    first_pass_s: float | None = Field(
+        description="The first pass, which carries any compile warm-up."
+    )
+    pass_s: float | None = Field(
+        description="Median of passes 2..n, wall time at step boundaries; "
+        "null with fewer than two passes."
+    )
+    compiled: bool | None = Field(
+        description="The denoiser runs through torch.compile; null when unknown."
+    )
+    decode_s: float | None = Field(
+        description="Last pass's end to the call's return: VAE decode and "
+        "post-processing."
+    )
+    save_s: float | None = Field(description="Writing the step's files.")
+    segments: int = Field(
+        description="Pipeline calls summed into this timing: chain segments "
+        "or iterations; 1 for a plain step."
+    )
+    cache: dict[str, Any] = sometimes("Skip counts, on a step that set a `cache`.")
 
 
 class ManifestEntry(ApiModel):
@@ -395,6 +474,14 @@ class ManifestEntry(ApiModel):
         "earlier run's, republished, and nothing was generated for them this time."
     )
     parent_step: str = sometimes("The composing step a rolled-up entry came from.")
+    role: Literal["final", "intermediate"] = sometimes(
+        "The step's role in its run, as the run's manifest.json records it. "
+        "Absent while the run is going, or for a run from before roles."
+    )
+    timing: StepTiming = sometimes(
+        "Where the step's time went. Only on a pipeline step that ran: a "
+        "reused step, a task or a composed step has none."
+    )
 
 
 class JobProgress(ApiModel):
@@ -557,7 +644,22 @@ class PlanEstimate(ApiModel):
     differs: list[str] = sometimes(
         "With basis `inherited`: what this workflow sets differently from "
         "`inherited_from` among offload, quantization and frame count; empty "
-        "when nothing does."
+        "when nothing does. Otherwise: the cost drivers with no rule to scale "
+        "by that moved off the default the figure was measured at, with "
+        "`low_confidence` true."
+    )
+    scaled: str = sometimes(
+        "With basis `derived` (or `other_device`, or a tempered `observed`): "
+        "what the curated figure was scaled along - steps, canvas or frames "
+        "moved off the variable defaults it was measured at (#866). With basis "
+        "`inherited`: why the template's minutes were re-priced "
+        "linearly (more pipeline steps or frames than the template run measured) "
+        "- an approximation, with `low_confidence` true."
+    )
+    withheld: str = sometimes(
+        "With basis `unknown` and `inherited_from` set: why the template's runs "
+        "could not be re-priced for this workflow (its size cannot be compared "
+        "to the template's)."
     )
     priced_for: str = sometimes(
         "The card the run would be dispatched to, whose history the figure is - "
@@ -565,6 +667,18 @@ class PlanEstimate(ApiModel):
     )
 
 
+class PlanHostMemory(ApiModel):
+    projected_mb: int = Field(
+        description="The host RAM, in MB, this run is projected to hold at its peak."
+    )
+    basis: Literal["observed", "fit"] = Field(
+        description="`observed`: the largest job peak of this machine's successful "
+        "runs with the same pipelines, quantization and offload; `fit`: projected "
+        "from this workflow's own runs for the requested list length."
+    )
+    runs: int = Field(description="How many runs the figure is read from.")
+
+
 class Plan(ApiModel):
     fingerprint: str
     steps: int
@@ -580,6 +694,10 @@ class Plan(ApiModel):
     downloads_required: list[RequiredDownload]
     estimate: PlanEstimate
     workspace: str
+    host_memory: PlanHostMemory = sometimes(
+        "The host RAM this run is projected to hold at its peak, from this "
+        "machine's own history (#869); absent when there is no figure."
+    )
 
 
 class ValidationResult(ApiModel):
@@ -598,184 +716,10 @@ class ValidationResult(ApiModel):
     )
 
 
-# ---------------------------------------------------------------- library
+# --------------------------------------------------------- gallery, assets
 
-Origin = Literal["workspace", "common", "examples", "builtin"]
 # Assets have no packaged (builtin) library
 AssetOrigin = Literal["workspace", "common", "examples"]
-Shape = Literal[SHAPES]
-Trait = Literal[TRAITS]
-
-
-class LibraryRoot(ApiModel):
-    root: str
-    origin: Origin
-    writable: bool
-
-
-class ShadowedEntry(ApiModel):
-    name: str
-    origin: Origin
-    shadowed_by: Origin
-
-
-class DiskUsage(ApiModel):
-    files: int
-    bytes: int
-
-
-class WorkspaceInfo(ApiModel):
-    name: str
-    default: bool
-    root: str | None
-    workflows: str
-    assets: str | None
-    outputs: str
-    prompts: str | None
-    common_assets: str | None
-    usage: DiskUsage = sometimes("Roughly how much disk it holds; listings only.")
-
-
-class WorkspaceList(ApiModel):
-    workspace_root: str | None
-    default: str
-    workspaces: list[WorkspaceInfo]
-
-
-class WorkspaceDeleted(ApiModel):
-    name: str
-    deleted: bool
-    contents: dict[str, DiskUsage] = Field(description="What it held, per folder.")
-
-
-class WorkflowCost(ApiModel):
-    """A measured run, as the workflow's own `cost` block declares it."""
-
-    model_config = ConfigDict(extra="allow")
-
-    device: str
-    name: str = sometimes()
-    vram_gb: int | float
-    minutes: int | float
-
-
-class WorkflowCard(ApiModel):
-    """One workflow's entry in the full listing (the agent's
-    `view=compact` answer is a different, smaller shape outside this
-    model)."""
-
-    kinds: list[str]
-    steps: int
-    variables: int
-    variable_names: list[str]
-    description: str
-    configures: str = sometimes(
-        "For a model config: the template it is a tuned instance of; '' for a "
-        "template. Absent when the file could not be read."
-    )
-    configures_missing: str = sometimes("A `configures` that names no workflow.")
-    prompt_refs: list[str]
-    shape: Shape = Field(description="What the workflow makes, derived by the server.")
-    traits: list[Trait] = Field(
-        description="Sorted, independent facts about how the output is made or what "
-        "it needs."
-    )
-    summary: str = Field(
-        description="The description's first sentence, clipped - what a card shows."
-    )
-    lists: dict[str, Any]
-    constraints: dict[str, Any]
-    cost_drivers: dict[str, Any]
-    cost: list[WorkflowCost] | None = Field(
-        description="Measured runs, one per device the maintainer measured on. Null "
-        "means unknown - never derived."
-    )
-    observed: dict[str, Any] = sometimes("This box's own history for it.")
-    origin: Origin
-    writable: bool = Field(
-        description="False for a read-only source: offer save-a-copy, not delete."
-    )
-
-
-class BuiltinWorkflows(ApiModel):
-    workflows: list[str] = Field(
-        description="The packaged fragments a sub-workflow step names as "
-        "`builtin:<name>.json`, each as what follows the prefix."
-    )
-
-
-class WorkflowList(ApiModel):
-    workspace: str
-    libraries: list[LibraryRoot] = Field(
-        description="The search path in order; the writable workspace root is where "
-        "a save lands, whatever library a workflow was read from."
-    )
-    workflows: list[str]
-    details: dict[str, WorkflowCard]
-    shadowed: list[ShadowedEntry]
-    cost_basis: str
-
-
-class WorkflowSaved(ApiModel):
-    name: str
-    workspace: str
-    origin: Origin
-    warnings: list[str]
-    shape: Shape
-    traits: list[Trait]
-    summary: str
-
-
-class WorkflowDeleted(ApiModel):
-    name: str
-    workspace: str
-    origin: Origin
-    deleted: bool
-
-
-class PromptCard(ApiModel):
-    description: str
-    intended_model: str
-    tags: list[str]
-    text: str = sometimes("Absent when the listing was asked for without text.")
-    text_chars: int = sometimes("The text's length, in place of `text`.")
-    origin: Origin = Field(
-        description="Which library the prompt came from, and whether a save can "
-        "reach it."
-    )
-    writable: bool
-
-
-class PromptList(ApiModel):
-    libraries: list[LibraryRoot]
-    prompts: list[str]
-    details: dict[str, PromptCard]
-    shadowed: list[ShadowedEntry]
-
-
-class PromptSaved(ApiModel):
-    name: str
-
-
-class Deleted(ApiModel):
-    name: str
-    deleted: bool
-
-
-class EnhancerPreset(ApiModel):
-    key: str
-    label: str
-    default_model: str
-    models: list[str]
-    intended_models: list[str]
-    placeholder: str
-
-
-class EnhancerPresets(ApiModel):
-    presets: list[EnhancerPreset]
-
-
-# --------------------------------------------------------- gallery, assets
 
 
 class GalleryFile(ApiModel):
@@ -802,6 +746,12 @@ class GalleryFile(ApiModel):
     duration_seconds: int | float | None = sometimes(
         "An audio or video file's length, with `media=true`."
     )
+    role: Literal["final", "intermediate"] | None = sometimes(
+        "`final` for a deliverable, `intermediate` for a file a later step or "
+        "run consumed; null under the flat layout or when no manifest lists the file."
+    )
+    note: str = sometimes("The effective note: the file's own, else its run's.")
+    starred: bool = sometimes("True when the file is starred; absent otherwise.")
 
 
 class GalleryList(ApiModel):
@@ -840,6 +790,11 @@ class LevelFinding(ApiModel):
     says: str
 
 
+class GalleryInput(ApiModel):
+    reference: str
+    kind: Literal["asset", "output"]
+
+
 class GalleryMetadata(ApiModel):
     name: str
     source: Literal["output", "asset"]
@@ -850,9 +805,20 @@ class GalleryMetadata(ApiModel):
     run_id: str
     version: int | None
     media: dict[str, Any] | None = Field(
-        description="The probe of an audio or video file; null for an image."
+        description="The probe of an audio or video file, or an image's kind, width, height "
+        "and mode; null for another file."
     )
     findings: list[LevelFinding]
+    role: Literal["final", "intermediate"] | None = sometimes(
+        "The file's role in its run; null when the run does not say."
+    )
+    inputs: list[GalleryInput] | None = sometimes(
+        "The `asset:` and `output:` references the run read; null for a run "
+        "that recorded none."
+    )
+    note: str = sometimes("The effective note: the file's own, else its run's.")
+    run_note: str = sometimes("The note of the run that wrote the file.")
+    note_source: Literal["file", "run"] = sometimes("Whose note `note` is.")
 
 
 class AssetLibraryRoot(ApiModel):
@@ -880,6 +846,7 @@ class AssetFile(ApiModel):
         "This workspace's own workflows that name it in an `asset:` reference, "
         "when any do"
     )
+    note: str = sometimes("The asset's note, when it has one.")
 
 
 class ShadowedAsset(ApiModel):
@@ -920,6 +887,19 @@ class Kept(ApiModel):
     shared: bool
 
 
+class StarSet(ApiModel):
+    name: str
+    starred: bool
+
+
+class NoteSet(ApiModel):
+    target: str
+    note: str | None = Field(description="The effective note after the write.")
+    note_source: Literal["file", "run"] | None = Field(
+        description="Whose note `note` is; null for a workspace or no note."
+    )
+
+
 class AssetDeleted(ApiModel):
     name: str
     workspace: str
diff --git a/dw/server/api_models_base.py b/dw/server/api_models_base.py
new file mode 100644
index 00000000..97553bb6
--- /dev/null
+++ b/dw/server/api_models_base.py
@@ -0,0 +1,55 @@
+"""The base every response model derives from, and its strictness.
+
+`dw/server/api_models.py` holds the contract this enforces and re-exports
+every name here; import from it, not from this module.
+"""
+
+import logging
+import os
+
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+STRICT = os.environ.get("DW_STRICT_RESPONSES") == "1"
+
+logger = logging.getLogger("dw.server.api_models")
+
+
+class ApiModel(BaseModel):
+    model_config = ConfigDict(extra="forbid" if STRICT else "allow")
+
+
+def send_rejected_responses(app) -> None:
+    """Make runtime leniency cover a declared field of the wrong type too,
+    not just an undeclared key: the response is logged and sent as the
+    handler built it, with the route's own status. Some routes have acted
+    by then - POST /api/jobs has queued the job - and a 500 would invite a
+    retry that does it twice. Installed by create_app outside strict mode."""
+    from fastapi.encoders import jsonable_encoder
+    from fastapi.exceptions import ResponseValidationError
+    from fastapi.responses import JSONResponse
+
+    async def send_as_built(request, exc: ResponseValidationError):
+        route = request.scope.get("route")
+        logger.error(
+            "Response for %s %s does not match its model: %s",
+            request.method,
+            request.url.path,
+            exc.errors(),
+        )
+        return JSONResponse(
+            jsonable_encoder(exc.body),
+            status_code=getattr(route, "status_code", None) or 200,
+        )
+
+    app.add_exception_handler(ResponseValidationError, send_as_built)
+
+
+def sometimes(description: str | None = None) -> Any:
+    """A key the handler emits only in some states, and never as null when
+    it does: typed as its value, defaulting to an unvalidated None that
+    `response_model_exclude_unset` keeps out of the payload. The generated
+    type is then `key?: T`, not `key?: T | null`."""
+    return Field(default=None, description=description)
diff --git a/dw/server/api_models_library.py b/dw/server/api_models_library.py
new file mode 100644
index 00000000..777c197e
--- /dev/null
+++ b/dw/server/api_models_library.py
@@ -0,0 +1,214 @@
+"""Response models for the library routes - workspaces, workflows, prompts
+and enhancer presets. Part of the UI's response contract that
+`dw/server/api_models.py` describes; it re-exports every name here.
+"""
+
+from typing import Any, Literal
+
+from pydantic import ConfigDict, Field
+
+from .api_models_base import ApiModel, sometimes
+from .catalog_shape import SHAPES, TRAITS
+
+Origin = Literal["workspace", "common", "examples", "builtin"]
+Shape = Literal[SHAPES]
+Trait = Literal[TRAITS]
+
+
+class LibraryRoot(ApiModel):
+    root: str
+    origin: Origin
+    writable: bool
+
+
+class ShadowedEntry(ApiModel):
+    name: str
+    origin: Origin
+    shadowed_by: Origin
+
+
+class DiskUsage(ApiModel):
+    files: int
+    bytes: int
+
+
+class WorkspaceInfo(ApiModel):
+    name: str
+    default: bool
+    root: str | None
+    workflows: str
+    assets: str | None
+    outputs: str
+    prompts: str | None
+    common_assets: str | None
+    usage: DiskUsage = sometimes("Roughly how much disk it holds; listings only.")
+    note: str = sometimes("The workspace's note, when it has one; listings only.")
+
+
+class WorkspaceList(ApiModel):
+    workspace_root: str | None
+    default: str
+    workspaces: list[WorkspaceInfo]
+
+
+class WorkspaceDeleted(ApiModel):
+    name: str
+    deleted: bool
+    contents: dict[str, DiskUsage] = Field(description="What it held, per folder.")
+
+
+class CopiedItems(ApiModel):
+    runs: list[str] = Field(description="`<workflow>/<run id>` of each run copied.")
+    assets: list[str] = Field(
+        description="Library-relative path of each asset file copied."
+    )
+
+
+class WorkspaceCopied(ApiModel):
+    """What a copy between workspaces did (`POST /api/workspaces/{name}/copy`)."""
+
+    source: str
+    destination: str
+    copied: CopiedItems
+    already_present: list[str] = Field(
+        description="Runs the destination already held (`<workflow>/<run id>`) "
+        "and assets it held with identical bytes (library-relative path) - "
+        "skipped."
+    )
+    renumbered: dict[str, dict[str, int]] = Field(
+        description="Copied runs whose `vN` changed, keyed `<workflow>/<run id>`: "
+        "`{from, to}`."
+    )
+    warnings: dict[str, Any] = Field(
+        description="`unresolved_output_refs`, `absolute_paths` and `no_jobs`, "
+        "each only when it applies."
+    )
+    bytes_linked: int
+    bytes_copied: int
+
+
+class WorkflowCost(ApiModel):
+    """A measured run, as the workflow's own `cost` block declares it."""
+
+    model_config = ConfigDict(extra="allow")
+
+    device: str
+    name: str = sometimes()
+    vram_gb: int | float
+    minutes: int | float
+
+
+class WorkflowCard(ApiModel):
+    """One workflow's entry in the full listing (the agent's
+    `view=compact` answer is a different, smaller shape outside this
+    model)."""
+
+    kinds: list[str]
+    steps: int
+    variables: int
+    variable_names: list[str]
+    description: str
+    configures: str = sometimes(
+        "For a model config: the template it is a tuned instance of; '' for a "
+        "template. Absent when the file could not be read."
+    )
+    configures_missing: str = sometimes("A `configures` that names no workflow.")
+    prompt_refs: list[str]
+    shape: Shape = Field(description="What the workflow makes, derived by the server.")
+    traits: list[Trait] = Field(
+        description="Sorted, independent facts about how the output is made or what "
+        "it needs."
+    )
+    summary: str = Field(
+        description="The description's first sentence, clipped - what a card shows."
+    )
+    lists: dict[str, Any]
+    constraints: dict[str, Any]
+    cost_drivers: dict[str, Any]
+    cost: list[WorkflowCost] | None = Field(
+        description="Measured runs, one per device the maintainer measured on. Null "
+        "means unknown - never derived."
+    )
+    observed: dict[str, Any] = sometimes("This box's own history for it.")
+    origin: Origin
+    writable: bool = Field(
+        description="False for a read-only source: offer save-a-copy, not delete."
+    )
+
+
+class BuiltinWorkflows(ApiModel):
+    workflows: list[str] = Field(
+        description="The packaged fragments a sub-workflow step names as "
+        "`builtin:<name>.json`, each as what follows the prefix."
+    )
+
+
+class WorkflowList(ApiModel):
+    workspace: str
+    libraries: list[LibraryRoot] = Field(
+        description="The search path in order; the writable workspace root is where "
+        "a save lands, whatever library a workflow was read from."
+    )
+    workflows: list[str]
+    details: dict[str, WorkflowCard]
+    shadowed: list[ShadowedEntry]
+    cost_basis: str
+
+
+class WorkflowSaved(ApiModel):
+    name: str
+    workspace: str
+    origin: Origin
+    warnings: list[str]
+    shape: Shape
+    traits: list[Trait]
+    summary: str
+
+
+class WorkflowDeleted(ApiModel):
+    name: str
+    workspace: str
+    origin: Origin
+    deleted: bool
+
+
+class PromptCard(ApiModel):
+    description: str
+    intended_model: str
+    tags: list[str]
+    text: str = sometimes("Absent when the listing was asked for without text.")
+    text_chars: int = sometimes("The text's length, in place of `text`.")
+    origin: Origin = Field(
+        description="Which library the prompt came from, and whether a save can "
+        "reach it."
+    )
+    writable: bool
+
+
+class PromptList(ApiModel):
+    libraries: list[LibraryRoot]
+    prompts: list[str]
+    details: dict[str, PromptCard]
+    shadowed: list[ShadowedEntry]
+
+
+class PromptSaved(ApiModel):
+    name: str
+
+
+class Deleted(ApiModel):
+    name: str
+    deleted: bool
+
+
+class EnhancerPreset(ApiModel):
+    key: str
+    label: str
+    default_model: str
+    models: list[str]
+    intended_models: list[str]
+    placeholder: str
+
+
+class EnhancerPresets(ApiModel):
+    presets: list[EnhancerPreset]
diff --git a/dw/server/app.py b/dw/server/app.py
index 56b40a1e..3de14119 100644
--- a/dw/server/app.py
+++ b/dw/server/app.py
@@ -154,6 +154,8 @@ def _store_serving(
     state.updater = diffusers_updater or DiffusersUpdater()
     # One index per distinct listing, per app (see deps.ceiling_index)
     state.ceiling_indexes = {}
+    # The LoRA catalog's partitions, one per listing (see deps.lora_index)
+    state.lora_indexes = None
     state.catalog_listings = {}
     # Which workspace workflows name each asset (see deps.asset_users)
     state.asset_users = {}
diff --git a/dw/server/deps.py b/dw/server/deps.py
index ef9a6efb..b25a2fbf 100644
--- a/dw/server/deps.py
+++ b/dw/server/deps.py
@@ -13,9 +13,20 @@
 from fastapi import HTTPException, Request
 
 from .. import references
+from ..adapter_compatibility import catalog_index
+from ..lora_catalog import entry_errors
 from ..realize import strings_with_prefix
 from ..security import SecurityError, validate_asset_reference
-from ..vram_inheritance import build_index, inherited_differences, template_identity
+from ..vram_inheritance import (
+    build_index,
+    inherited_differences,
+    pipeline_frames,
+    pipeline_steps,
+    pipeline_values,
+    sets_differently,
+    template_identity,
+)
+from ..cost_scaling import FRAMES_DRIVER, STEPS_DRIVER, scale_curated
 from .observed_cost import declared_drivers
 from ..library import ASSETS_KIND, LORAS_KIND, PROMPTS_KIND, library_path
 from ..workspace import (
@@ -173,6 +184,60 @@ def ceiling_index(state, ws):
     return index
 
 
+def catalog_entries(state):
+    """(entries, roots, library): every valid entry on the search path by
+    name, the root each came from, and the path. An unreadable or invalid
+    file is logged and skipped - one bad file must not hide the catalog."""
+    library = server_lora_library(state).existing()
+    winners, _hidden = library.entries()
+    entries, roots = {}, {}
+    for name, root in winners.items():
+        path = library.path_in(root, name)
+        if path is None:
+            continue
+        try:
+            with open(path, "r") as file:
+                entry = json.load(file)
+        except (OSError, ValueError) as error:
+            logger.warning(f"Skipping unreadable LoRA entry {name}: {error}")
+            continue
+        problem = entry_errors(entry) if isinstance(entry, dict) else "not an object"
+        if problem:
+            logger.warning(f"Skipping invalid LoRA entry {name}: {problem}")
+            continue
+        entries[name] = entry
+        roots[name] = root
+    return entries, roots, library
+
+
+def lora_index(state):
+    """The LoRA catalog's partitions by file (`adapter_compatibility.
+    catalog_index`), for the adapter checks: one catalog every workspace
+    shares, so one index (#870).
+
+    Built once per distinct listing and kept on the app
+    (`state.lora_indexes`), as `ceiling_index` is: an edited, added or
+    removed entry rebuilds it and nothing else does."""
+    library = server_lora_library(state).existing()
+    listing = []
+    for name, root in library.entries()[0].items():
+        path = library.path_in(root, name)
+        if path is None:
+            continue
+        try:
+            listing.append((name, path, os.path.getmtime(path)))
+        except OSError:
+            continue
+    signature = tuple(listing)
+    cached = getattr(state, "lora_indexes", None)
+    if cached and cached[0] == signature:
+        return cached[1]
+    entries, _roots, _library = catalog_entries(state)
+    index = catalog_index(entries)
+    state.lora_indexes = (signature, index)
+    return index
+
+
 def asset_users(state, ws):
     """Which of this workspace's own workflows name each asset: `{asset name:
     [workflow name, ...]}`, over the writable libraries of its search path -
@@ -203,22 +268,89 @@ def asset_users(state, ws):
     return users
 
 
-def _pipeline_steps(definition):
-    return sum(
-        1
-        for step in definition.get("steps") or []
-        if isinstance(step, dict) and isinstance(step.get("pipeline"), dict)
-    )
+def _canvases(definition, arguments=None):
+    """Each pipeline step's `(width, height)`, as `pipeline_values` reads
+    them, None for a step that does not set both as numbers."""
+    widths = pipeline_values(definition, "width", arguments)
+    heights = pipeline_values(definition, "height", arguments)
+    return [(w, h) if w and h else None for w, h in zip(widths, heights)]
 
 
-def _scales_past_template(definition, template, drivers, arguments):
-    """Whether `definition` runs the template's pipeline more times, or for
-    more frames, than the template run the bucket was measured on (#821)."""
-    if _pipeline_steps(definition) != _pipeline_steps(template):
-        return True
+def _means(keys, values):
+    """{key: the mean over `values`}: one key per value, or a canvas's
+    `("width", "height")` over its `(width, height)` pairs."""
+    if len(keys) == 1:
+        values = [(value,) for value in values]
+    return {
+        key: sum(value[index] for value in values) / len(values)
+        for index, key in enumerate(keys)
+    }
+
+
+def _scale_past_template(definition, template, drivers, arguments):
+    """How the workflow's size compares to the template run the bucket was
+    measured on (#821, #851, #866): (factor, reason). The factor is the
+    ratio of pipeline steps times what `scale_curated` makes of the mean
+    frames, inference steps and canvas per pipeline step - one rule, so the
+    catalog figure and this one quote a request alike - and the reason names
+    each axis that moved. (1, None) when the workflow is the template's
+    size; (None, reason) when its size cannot be compared."""
     # The template as the bucket's drivers set it
     bucket = {**template, "variables": {**(template.get("variables") or {}), **drivers}}
-    return "frame count" in inherited_differences(definition, bucket, arguments)
+    # Counted with for_each expanded, so a list longer than the one the
+    # bucket ran (a fallback to the template's default bucket) re-prices by
+    # its member count
+    steps = len(pipeline_steps(definition, arguments))
+    template_steps = len(pipeline_steps(bucket))
+    if not steps or not template_steps:
+        return None, "its pipeline step count cannot be compared"
+    factor, reasons = 1.0, []
+    if steps != template_steps:
+        factor *= steps / template_steps
+        reasons.append(
+            f"runs the pipeline in {steps} steps, template measured {template_steps}"
+        )
+    # Each axis read per pipeline step, the template's variables as the
+    # bucket sets them, and averaged for `scale_curated`; a step that does
+    # not set it as a number is left out
+    measured, effective = {}, {}
+    for label, keys, mine, theirs in (
+        (
+            "frame count",
+            (FRAMES_DRIVER,),
+            pipeline_frames(definition, arguments),
+            pipeline_frames(bucket),
+        ),
+        (
+            "inference steps",
+            (STEPS_DRIVER,),
+            pipeline_values(definition, STEPS_DRIVER, arguments),
+            pipeline_values(bucket, STEPS_DRIVER),
+        ),
+        (
+            "canvas",
+            ("width", "height"),
+            _canvases(definition, arguments),
+            _canvases(bucket),
+        ),
+    ):
+        mine = [value for value in mine if value]
+        theirs = [value for value in theirs if value]
+        if mine and theirs:
+            effective.update(_means(keys, mine))
+            measured.update(_means(keys, theirs))
+        elif any(sets_differently(definition, bucket, key, arguments) for key in keys):
+            return None, f"{label} differs and cannot be compared"
+    scaled = scale_curated(factor, measured, effective)
+    if scaled is None:
+        return None, "its size is not a positive number"
+    factor, axes = scaled
+    reasons.extend(axes)
+    return factor, "; ".join(reasons) or None
+
+
+def _number(value):
+    return int(value) if float(value).is_integer() else round(value, 1)
 
 
 def inherited_observed(state, ws, definition, arguments=None, *, card=None):
@@ -240,6 +372,7 @@ def inherited_observed(state, ws, definition, arguments=None, *, card=None):
     variables = definition.get("variables")
     variables = variables if isinstance(variables, dict) else {}
     best = None
+    withheld = None
     for name, template, writable in _catalog_listing(state, ws):
         if not isinstance(template, dict) or template_identity(template) != identity:
             continue
@@ -259,19 +392,46 @@ def inherited_observed(state, ws, definition, arguments=None, *, card=None):
             workspace=ws.name if writable else None,
             card=card,
         )
+        if not (block and block.get("cold_runs")) and drivers:
+            # No run in that bucket (a frame count the template never ran at):
+            # price from the template's own default bucket and scale from it
+            drivers = {}
+            block = observed_for_name(
+                state,
+                name,
+                template,
+                drivers,
+                workspace=ws.name if writable else None,
+                card=card,
+            )
         if not block or not block.get("cold_runs"):
             continue
-        # A figure is quoted only for a run of the template's own size: the
-        # bucket above prices the drivers the inline workflow shares by
-        # name, and anything else that moves the frame count or repeats the
-        # pipeline in more steps (#821) is a multiple the template's
-        # minutes do not carry - withheld rather than quoted unchanged
-        if _scales_past_template(definition, template, drivers, arguments):
+        # The bucket above prices the drivers the inline workflow shares by
+        # name; more pipeline steps or frames than that (#821) are a
+        # multiple the template's minutes do not carry, so they re-price it
+        # linearly (#851). A size that cannot be compared is withheld, with
+        # the template and the reason named
+        factor, reason = _scale_past_template(definition, template, drivers, arguments)
+        if factor is None:
+            withheld = withheld or (name, reason)
             continue
+        if reason:
+            block = {
+                **block,
+                "cold_minutes": block["cold_minutes"] * factor,
+                "scaled": f"scaled from {name}: {reason}",
+            }
         key = (-block["cold_runs"], name)
         if best is None or key < best[0]:
             best = (key, name, template, block)
     if best is None:
+        if withheld:
+            # Not priced, but the plan says which template had history and why
+            # it was not used
+            return {
+                "inherited_from": withheld[0],
+                "withheld": f"not priced from {withheld[0]}: {withheld[1]}",
+            }
         return None
     _, name, template, block = best
     return {
diff --git a/dw/server/dispatch.py b/dw/server/dispatch.py
new file mode 100644
index 00000000..17633f3a
--- /dev/null
+++ b/dw/server/dispatch.py
@@ -0,0 +1,136 @@
+"""The dispatcher's pick: which queued job starts next, on which card.
+
+`Dispatcher` is a mixin of `JobManager` (`dw/server/jobs.py`) - its methods
+read the manager's queue and dispatch tables (`_pending`, `_needs`,
+`_host_needs`, `_preferred`) and are called holding the manager's `_lock`.
+Queue order, except that a job too big for every free card keeps its place
+while a smaller one behind it takes the card (backfill), and a job that fits
+a free card is also held while the host's RAM can't hold it beside the
+running jobs (#869; the figure is `dw/server/host_ram_need.py`'s, the
+comparison `pool.host_ram_wait`).
+"""
+
+from ..host_memory import host_memory_stats, process_rss_mb
+from . import pool
+from .job_record import QUEUED
+
+# How often a job held for host RAM is looked at again while nothing else
+# wakes the dispatcher - memory can be freed outside dw (#869)
+HOST_RAM_RECHECK_SECONDS = 10.0
+
+
+class _HostReading:
+    """The host's MemAvailable for one dispatch pass, read on first ask."""
+
+    def __init__(self):
+        self._read = False
+        self._available = None
+
+    def available_mb(self):
+        if not self._read:
+            self._read = True
+            # None where the platform can't say (macOS without psutil): no gate
+            self._available = (host_memory_stats() or {}).get("available_mb")
+        return self._available
+
+
+def _worker_rss_mb(slot):
+    """What `slot`'s worker holds in host RAM now, or None (not running, or
+    unreadable)."""
+    pid = slot.manager.pid() if hasattr(slot.manager, "pid") else None
+    return process_rss_mb(pid) if pid is not None else None
+
+
+class Dispatcher:
+    """The queue scan `JobManager._run_loop` asks for its next job."""
+
+    def _next_dispatch(self):
+        """(slot, job) for the first queued job, in queue order, that fits
+        a free card - the one it has an affinity for (`_choose_slot`) - or
+        None. A job too big for every free card keeps its place, and the
+        scan goes on past it: a smaller job behind it takes the card
+        meanwhile (backfill). A job the host's RAM can't hold beside the
+        running ones keeps its place the same way (`_host_ram_wait`).
+        Called holding _lock."""
+        if self._dispatch_holds:
+            return None
+        free = [slot for slot in self.slots if slot.current_job_id is None]
+        if not free:
+            return None
+        host = _HostReading()
+        for job_id in list(self._pending):
+            job = self.jobs.get(job_id)
+            if job is None or job.status != QUEUED:
+                self._pending.remove(job_id)  # cancelled while waiting
+                self._forget_dispatch(job, job_id)
+                continue
+            need = self._needs.get(job_id)
+            fitting = [slot for slot in free if slot.fits(need)]
+            if not fitting:
+                # Waiting for a card, not for host RAM
+                job.waiting_for = None
+                continue
+            slot = pool.choose_slot(
+                fitting, self._job_identity(job), self._preferred.get(job_id)
+            )
+            reason = self._host_ram_wait(job_id, slot, host)
+            if reason is not None:
+                if job.waiting_for is None:
+                    # Once per hold, not once per pass: a wait is a moment,
+                    # so an event and a live field, never a warning (#869)
+                    job.add_event(
+                        {"event": "queue_wait", "reason": "host_ram", "message": reason}
+                    )
+                job.waiting_for = reason
+                continue
+            self._pending.remove(job_id)
+            self._forget_dispatch(job)
+            return slot, job
+        return None
+
+    def _forget_dispatch(self, job, job_id=None):
+        """Drop what dispatch keeps for a job leaving the queue - started or
+        cancelled. `job` may be None for one already gone."""
+        job_id = job.id if job is not None else job_id
+        self._needs.pop(job_id, None)
+        self._host_needs.pop(job_id, None)
+        self._preferred.pop(job_id, None)
+        if job is not None:
+            job.waiting_for = None
+
+    def _held_for_host_ram(self):
+        """The queued jobs held for host RAM now. Called holding _lock."""
+        for job_id in self._pending:
+            job = self.jobs.get(job_id)
+            if job is not None and job.waiting_for is not None:
+                yield job
+
+    def _host_ram_wait(self, job_id, slot, host):
+        """Why the queued `job_id` must not start on `slot` yet for host RAM,
+        or None (pool.host_ram_wait, #869). `host` is this pass's reading,
+        taken once and only when a job with a figure asks."""
+        need = self._host_needs.get(job_id)
+        if need is None:
+            return None
+        running = [
+            (other, self.jobs.get(other.current_job_id))
+            for other in self.slots
+            if other.current_job_id is not None
+        ]
+        if not running:
+            return None
+        available = host.available_mb()
+        if available is None:
+            return None
+        return pool.host_ram_wait(
+            need,
+            available,
+            [
+                (
+                    job.host_ram_need[0] if job and job.host_ram_need else None,
+                    _worker_rss_mb(other),
+                )
+                for other, job in running
+            ],
+            _worker_rss_mb(slot),
+        )
diff --git a/dw/server/exports.py b/dw/server/exports.py
index 2808014d..17c2b1db 100644
--- a/dw/server/exports.py
+++ b/dw/server/exports.py
@@ -27,6 +27,7 @@
 from dataclasses import dataclass, field
 
 from .. import references
+from ..notes import NOTES_FILE_NAME
 from ..realize import strings_with_prefix
 from ..runs import (
     MANIFEST_FILE_NAME,
@@ -243,6 +244,7 @@ def export_job(manager, job_id, workspace_root, asset_library, overwrite=False):
             "steps": detail.get("manifest") or [],
         }
     _write_json(summary, target, MANIFEST_FILE_NAME, manifest)
+    _copy_notes(summary, target, output_root, run_dir)
 
     record = {key: detail.get(key) for key in JOB_RECORD_KEYS}
     record["realized"] = realized is not None
@@ -275,6 +277,20 @@ def _run_manifest(output_root, run_dir):
         return None
 
 
+def _copy_notes(summary, target, output_root, run_dir):
+    """The run's notes.json beside the manifest, when it has one."""
+    if not run_dir:
+        return
+    try:
+        source = validate_path(
+            os.path.join(output_root, run_dir, NOTES_FILE_NAME), output_root
+        )
+    except SecurityError:
+        return
+    if os.path.isfile(source):
+        _copy(summary, source, target, NOTES_FILE_NAME, NOTES_FILE_NAME)
+
+
 def _copy_assets(summary, workflow, target, asset_library):
     """Every 'asset:' the workflow names, under its own name in assets/."""
     for reference in strings_with_prefix(workflow, references.ASSET):
diff --git a/dw/server/guides.py b/dw/server/guides.py
index ddbbebee..c20c668e 100644
--- a/dw/server/guides.py
+++ b/dw/server/guides.py
@@ -240,7 +240,7 @@ def get_guide(name, section=None):
     Without a `section` the answer is the *index*: the guide's preamble,
     its first section, and the headings of the rest - not the whole file.
     A full WORKFLOW_GUIDE.md is ~19.6k tokens and TASKS.md ~16k, which is
-    more in one call than the entire 62-tool MCP surface costs to connect,
+    more in one call than the entire 65-tool MCP surface costs to connect,
     and an agent can make that call twice before noticing (#101). Every
     withheld section is named in `sections` and fetched by name, so
     nothing is unreachable - only unspent by accident.
diff --git a/dw/server/host_ram_need.py b/dw/server/host_ram_need.py
new file mode 100644
index 00000000..6aef2709
--- /dev/null
+++ b/dw/server/host_ram_need.py
@@ -0,0 +1,117 @@
+"""How much host RAM a run is projected to hold at its peak (#869).
+
+Two jobs on two cards share one host, and a pair of heavy ones can run it
+out of memory together. This module is the figure a dispatcher compares
+with the host's free RAM; it projects and never refuses.
+
+A run's *memory key* is what decides its host-RAM footprint, read from the
+definition with the caller's arguments resolved:
+  - the sorted pipeline identity (component_type, model_name, workflow) of
+    every pipeline step (`dw/vram_estimate.py` pipeline_identity);
+  - every `quantization_config`, `offload` and `group_offload` value, found
+    the way `vram_inheritance._found` finds them.
+The workflow's name is not in it, so a renamed copy and an inline copy of a
+template share the template's history, and a different `weights_dtype` (fed
+into a quantization config) or offload is a different key. Frame count,
+resolution and reference count are not in it either (#869's D3).
+
+`projected_peak` answers, in order:
+  - `observed`: the largest `host_memory_job_peak_rss_mb` of this machine's
+    successful runs with the same key (the max, not a median: under-
+    projecting is the failure this exists for);
+  - `fit`: `host_memory_projection`'s projection for a list run, from this
+    workflow's own history - also ahead of `observed` when it is the larger
+    for a shape that holds its pipeline across the list, since the key
+    leaves list length out and a longer list outgrows the observed max
+    (#910);
+  - otherwise None - no figure.
+"""
+
+import hashlib
+import json
+import logging
+
+from ..host_memory_projection import projected_mb, releases_between_iterations
+from ..variables import VariableNotFoundError, replace_variables
+from ..vram_estimate import pipeline_identity
+from ..vram_inheritance import _found
+
+logger = logging.getLogger("dw")
+
+# Where a run's host-RAM footprint changes without its pipeline changing.
+# group_offload is offload by another name: it streams weights from host RAM
+_SETTINGS = ("quantization_config", "offload", "group_offload")
+
+
+def _pipeline_steps(node):
+    """Every dict under `node` that loads a pipeline, a for_each step's too."""
+    if isinstance(node, dict):
+        if isinstance(node.get("pipeline"), dict):
+            yield node
+        for value in node.values():
+            yield from _pipeline_steps(value)
+    elif isinstance(node, list):
+        for item in node:
+            yield from _pipeline_steps(item)
+
+
+def memory_key(definition, arguments=None):
+    """The run's memory key as a short hex digest, or None for a definition
+    that loads no pipeline it can name (a task-only workflow) or that
+    references a variable it doesn't declare."""
+    if not isinstance(definition, dict):
+        return None
+    variables = definition.get("variables")
+    variables = dict(variables) if isinstance(variables, dict) else {}
+    variables.update(arguments or {})
+    # Deep substitution, not `_found`'s: `weights_dtype` sits inside a
+    # quantization config rather than being one
+    try:
+        steps = replace_variables(definition.get("steps"), variables)
+    except VariableNotFoundError:
+        return None
+    identities = {pipeline_identity(step) for step in _pipeline_steps(steps)}
+    identities.discard(None)
+    if not identities:
+        return None
+    parts = {"pipelines": sorted(json.dumps(identity) for identity in identities)}
+    for key in _SETTINGS:
+        parts[key] = sorted(_found(steps, key, {}))
+    text = json.dumps(parts, sort_keys=True, default=str)
+    return hashlib.sha256(text.encode()).hexdigest()[:32]
+
+
+def projected_peak(definition, arguments, history, *, rows=None, list_entries=None):
+    """(mb, basis, runs) for this run's projected host-RAM peak, or None.
+
+    `history` is the server's `JobHistory` (this machine's runs); `rows` are
+    this workflow's own finished runs as `ObservedCosts.rows_for` answers
+    them, and `list_entries` the request's list lengths - the fit's inputs,
+    absent for an inline definition, which has no history by name.
+    """
+    fit = projected_mb(definition, list_entries, rows or [])
+    key = memory_key(definition, arguments)
+    if key is not None and history is not None:
+        peaks = history.peaks_for_key(key)
+        if peaks:
+            # The key leaves list length out, so a resident list longer than
+            # any observed one outgrows the observed max: the fit's growth is
+            # taken when it is the larger, as validate's warning quotes (#910)
+            if (
+                fit is not None
+                and fit["projected_mb"] > max(peaks)
+                and not releases_between_iterations(definition)
+            ):
+                return fit["projected_mb"], "fit", fit["runs"]
+            return max(peaks), "observed", len(peaks)
+    if fit is not None:
+        return fit["projected_mb"], "fit", fit["runs"]
+    return None
+
+
+def host_memory_block(need):
+    """`need` as validate's `plan.host_memory`, or None for no figure."""
+    if not need:
+        return None
+    mb, basis, runs = need
+    return {"projected_mb": round(mb), "basis": basis, "runs": runs}
diff --git a/dw/server/job_history.py b/dw/server/job_history.py
index 1babc7f8..6d9d9243 100644
--- a/dw/server/job_history.py
+++ b/dw/server/job_history.py
@@ -12,6 +12,7 @@
 `device` in SQL when it is first opened, so no reader parses the label.
 """
 
+import contextlib
 import json
 import logging
 import os
@@ -19,6 +20,7 @@
 import threading
 
 from ..workspace import DEFAULT_WORKSPACE_NAME
+from .host_ram_need import memory_key
 from .observed_cost import EVENT_CAP, LOADING_MARKER
 from .job_record import (
     ACK_NONE,
@@ -30,6 +32,107 @@
 logger = logging.getLogger("dw")
 
 
+def _memory_key_of(job):
+    """The memory key of the definition the job was admitted with, or None -
+    history is never refused a row over a key it could not compute."""
+    try:
+        return memory_key(job.spec.get("definition"), job.spec.get("arguments"))
+    except Exception:
+        logger.debug("No memory key for job %s", job.id, exc_info=True)
+        return None
+
+
+# The columns added since the table was first written, in the order they
+# were added: a database missing one gets it by ALTER, and its rows keep the
+# column's default (NULL unless the DDL says otherwise)
+_ADDED_COLUMNS = (
+    # Databases written before events were persisted
+    ("events", "TEXT"),
+    # The workspace the job ran in; rows before it are backfilled to
+    # 'default' (`JobHistory.__init__`)
+    ("workspace", "TEXT DEFAULT 'default'"),
+    # The catalog name the job was run from, beside `workflow` (the
+    # definition's id). Ids are not unique across a catalog forever; names
+    # are, and a later runtime-by-workflow join wants the exact one. Rows
+    # before this column stay NULL: old history is unjoinable, new history
+    # is exact
+    ("workflow_name", "TEXT"),
+    # Which run of the workflow this job was - the directory under the
+    # output root that holds its manifest and its realized workflow. NULL
+    # for every row predating run tracking, and the manager refuses to
+    # guess one from file paths
+    ("run_id", "TEXT"),
+    ("run_dir", "TEXT"),
+    # That run's ordinal among the workflow's runs - the 'v4' the gallery
+    # shows. NULL before the column, and for a job that never opened a run
+    ("run_version", "INTEGER"),
+    # Which form of cost acknowledgement queued the job. Rows before the
+    # column are 'none' - nothing recorded is nothing recorded
+    ("acknowledged", "TEXT DEFAULT 'none'"),
+    # The worker's own high-water mark for this run (#243) - NULL for a row
+    # predating the column and for any run that never reported one
+    # (cancelled/errored before the worker's final memory_info)
+    ("host_memory_peak_rss_mb", "REAL"),
+    # This job's own contribution to that process-lifetime figure - growth
+    # since the job's first phase-boundary reading, or its current rss when
+    # it caused no growth (#272). NULL for a row predating the column and
+    # for any run that never got a memory_info message at all
+    ("host_memory_job_peak_rss_mb", "REAL"),
+    # The card the job ran on - "cuda:1 NVIDIA GeForce RTX 3090" (#462).
+    # NULL for a row predating the column: which card that was is not
+    # known, and guessing would mislabel a box whose card has been swapped
+    ("device", "TEXT"),
+    # The same card as two fields - its ordinal ("cuda:1") and its name
+    # ("NVIDIA GeForce RTX 3090") - so rerun affinity and observed cost read
+    # them rather than parse `device` (#693). `device` stays the label
+    # every reader returns. Rows before the columns are backfilled from it
+    # once (`_BACKFILL_DEVICE_FIELDS`)
+    ("device_ordinal", "TEXT"),
+    ("device_card", "TEXT"),
+    # The note the job was submitted with. NULL for a row before the column
+    # and for a job submitted without one
+    ("note", "TEXT"),
+    # What decides the run's host-RAM footprint - its pipelines,
+    # quantization and offload, arguments resolved
+    # (`host_ram_need.memory_key`, #869). NULL for a row predating the
+    # column, which counts as no data rather than a guess, and for a run
+    # that loads no pipeline
+    ("memory_key", "TEXT"),
+    # The job a rerun reran. NULL for a fresh submit and for every row
+    # before the column
+    ("rerun_of", "TEXT"),
+    # 1 once a kept asset's provenance names the job (#917), so a workspace
+    # delete leaves the row for get_job_workflow to read
+    ("kept", "INTEGER DEFAULT 0"),
+)
+
+# `device_ordinal`/`device_card` from `device`, in SQL: an ordinal never
+# holds a space, so the label splits at its first one, and a label with none
+# (`cpu`, `mps`) is all ordinal with no card
+_BACKFILL_DEVICE_FIELDS = (
+    "UPDATE jobs SET"
+    " device_ordinal = CASE WHEN INSTR(device, ' ') > 0"
+    " THEN SUBSTR(device, 1, INSTR(device, ' ') - 1)"
+    " ELSE device END,"
+    " device_card = CASE WHEN INSTR(device, ' ') > 0"
+    " THEN SUBSTR(device, INSTR(device, ' ') + 1) END"
+    " WHERE device IS NOT NULL"
+)
+
+
+def _add_missing_columns(connection):
+    """ALTER in each `_ADDED_COLUMNS` column the jobs table lacks; the names
+    added. ALTER is the whole migration - the column and its DDL are this
+    module's constants, never input."""
+    present = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
+    added = set()
+    for column, ddl in _ADDED_COLUMNS:
+        if column not in present:
+            connection.execute(f"ALTER TABLE jobs ADD COLUMN {column} {ddl}")
+            added.add(column)
+    return added
+
+
 class JobHistory:
     """Finished jobs, persisted so the Jobs view survives server restarts.
 
@@ -57,91 +160,18 @@ def __init__(self, db_path):
                     error TEXT,
                     events TEXT
                 )""")
-            # Databases written before events were persisted are missing the
-            # column; ALTER is the whole migration, and rows keep NULL
-            columns = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
-            if "events" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN events TEXT")
+            added = _add_missing_columns(connection)
             # Every row predating workspaces belongs to the default one -
             # history that cannot say which workspace a job ran in stops
             # making sense the moment there are two
-            if "workspace" not in columns:
-                connection.execute(
-                    "ALTER TABLE jobs ADD COLUMN workspace TEXT DEFAULT 'default'"
-                )
+            if "workspace" in added:
                 connection.execute(
                     "UPDATE jobs SET workspace = 'default' WHERE workspace IS NULL"
                 )
-            # The catalog name the job was run from, beside `workflow` (the
-            # definition's id). Ids are not unique across a catalog forever;
-            # names are, and a later runtime-by-workflow join wants the exact
-            # one. Rows before this column stay NULL: old history is
-            # unjoinable, new history is exact
-            if "workflow_name" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN workflow_name TEXT")
-            # Which run of the workflow this job was - the directory under the
-            # output root that holds its manifest and its realized workflow.
-            # NULL for every row predating run tracking, and the manager
-            # refuses to guess one from file paths
-            if "run_id" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN run_id TEXT")
-            if "run_dir" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN run_dir TEXT")
-            # That run's ordinal among the workflow's runs - the 'v4' the
-            # gallery shows. NULL before the column, and for a job that
-            # never opened a run
-            if "run_version" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN run_version INTEGER")
-            # Which form of cost acknowledgement queued the job. Rows before
-            # the column are 'none' - nothing recorded is nothing recorded
-            if "acknowledged" not in columns:
-                connection.execute(
-                    "ALTER TABLE jobs ADD COLUMN acknowledged TEXT DEFAULT 'none'"
-                )
-            # The worker's own high-water mark for this run (#243) - NULL for
-            # a row predating the column and for any run that never reported
-            # one (cancelled/errored before the worker's final memory_info)
-            if "host_memory_peak_rss_mb" not in columns:
-                connection.execute(
-                    "ALTER TABLE jobs ADD COLUMN host_memory_peak_rss_mb REAL"
-                )
-            # This job's own contribution to that process-lifetime figure -
-            # growth since the job's first phase-boundary reading, or its
-            # current rss when it caused no growth (#272). NULL for a row
-            # predating the column and for any run that never got a
-            # memory_info message at all
-            if "host_memory_job_peak_rss_mb" not in columns:
-                connection.execute(
-                    "ALTER TABLE jobs ADD COLUMN host_memory_job_peak_rss_mb REAL"
-                )
-            # The card the job ran on - "cuda:1 NVIDIA GeForce RTX 3090"
-            # (#462). NULL for a row predating the column: which card that
-            # was is not known, and guessing would mislabel a box whose
-            # card has been swapped
-            if "device" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN device TEXT")
-            # The same card as two fields - its ordinal ("cuda:1") and its
-            # name ("NVIDIA GeForce RTX 3090") - so rerun affinity and
-            # observed cost read them rather than parse `device` (#693).
-            # `device` stays the label every reader returns. Rows before the
-            # columns are backfilled from it once, in SQL: an ordinal never
-            # holds a space, so the label splits at its first one, and a
-            # label with none (`cpu`, `mps`) is all ordinal with no card
-            if "device_ordinal" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN device_ordinal TEXT")
-            if "device_card" not in columns:
-                connection.execute("ALTER TABLE jobs ADD COLUMN device_card TEXT")
-            if "device_ordinal" not in columns or "device_card" not in columns:
-                connection.execute(
-                    "UPDATE jobs SET"
-                    " device_ordinal = CASE WHEN INSTR(device, ' ') > 0"
-                    " THEN SUBSTR(device, 1, INSTR(device, ' ') - 1)"
-                    " ELSE device END,"
-                    " device_card = CASE WHEN INSTR(device, ' ') > 0"
-                    " THEN SUBSTR(device, INSTR(device, ' ') + 1) END"
-                    " WHERE device IS NOT NULL"
-                )
+            if "device_ordinal" in added or "device_card" in added:
+                connection.execute(_BACKFILL_DEVICE_FIELDS)
 
+    @contextlib.contextmanager
     def _connect(self):
         # WAL mode lets a reader (the web UI polling job status, an MCP
         # get_job call) proceed without blocking behind whatever write the
@@ -150,9 +180,15 @@ def _connect(self):
         # duration of a write. journal_mode is a property of the database
         # file, not the connection, but PRAGMA is cheap and idempotent, so
         # it is set on every connect rather than assumed to have stuck.
-        connection = sqlite3.connect(self.db_path, timeout=5)
-        connection.execute("PRAGMA journal_mode=WAL")
-        return connection
+        #
+        # The block commits on success and rolls back on an exception (what
+        # sqlite3's own context manager does), then closes the connection:
+        # one left to GC checkpoints the WAL whenever it is collected,
+        # rewriting jobs.sqlite at an arbitrary later moment.
+        with contextlib.closing(sqlite3.connect(self.db_path, timeout=5)) as connection:
+            connection.execute("PRAGMA journal_mode=WAL")
+            with connection:
+                yield connection
 
     def record(self, job):
         # The spec's workflow_name/warnings are derived; keep what rerun needs
@@ -164,8 +200,8 @@ def record(self, job):
                 " error, events, workspace, workflow_name, run_id, run_dir,"
                 " acknowledged, host_memory_peak_rss_mb,"
                 " host_memory_job_peak_rss_mb, run_version, device,"
-                " device_ordinal, device_card) VALUES"
-                " (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                " device_ordinal, device_card, note, memory_key, rerun_of) VALUES"
+                " (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
                 (
                     job.id,
                     job.workflow_name,
@@ -194,9 +230,24 @@ def record(self, job):
                     getattr(job, "device", None),
                     getattr(job, "device_ordinal", None),
                     getattr(job, "device_card", None),
+                    getattr(job, "note", None),
+                    _memory_key_of(job),
+                    getattr(job, "rerun_of", None),
                 ),
             )
 
+    def peaks_for_key(self, key):
+        """This machine's job peak RSS, in MB, for every successful run with
+        this memory key - inline and renamed runs too, since the key is not
+        the workflow's name (#869). Empty for a key no run has reported."""
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT host_memory_job_peak_rss_mb FROM jobs WHERE status = ?"
+                " AND memory_key = ? AND host_memory_job_peak_rss_mb IS NOT NULL",
+                (SUCCEEDED, key),
+            ).fetchall()
+        return [row[0] for row in rows]
+
     def recent_summaries(self, limit=200, workspace=None, statuses=None):
         """Summary rows only - the jobs list is polled, and parsing four JSON
         blobs per row just to show six scalars was pure waste.
@@ -210,7 +261,10 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
         query = (
             "SELECT id, workflow, status, created_at, started_at, finished_at,"
             " workspace, workflow_name, run_id, acknowledged, run_version,"
-            " device FROM jobs"
+            " device, note, run_dir,"
+            " CASE WHEN json_valid(spec) THEN json_extract(spec, '$.output_dir') END,"
+            " rerun_of"
+            " FROM jobs"
         )
         params = []
         clauses = []
@@ -243,6 +297,13 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
                 "run_version": row[10],
                 "device": row[11],
                 "historical": True,
+                # Only when set: JobSummary.note is absent, never null
+                **({"note": row[12]} if row[12] else {}),
+                # Where the run is, for the list to read its current note
+                # from; JobManager.list takes these off before serving
+                "_run_dir": row[13],
+                "_output_dir": row[14],
+                **({"rerun_of": row[15]} if row[15] else {}),
             }
             for row in rows
         ]
@@ -253,7 +314,7 @@ def get(self, job_id):
                 "SELECT id, workflow, status, created_at, started_at, finished_at,"
                 " arguments, spec, manifest, warnings, error, workspace,"
                 " workflow_name, run_id, run_dir, acknowledged, events,"
-                " run_version, device FROM jobs WHERE id = ?",
+                " run_version, device, note, rerun_of FROM jobs WHERE id = ?",
                 (job_id,),
             ).fetchone()
         return self._to_detail(row) if row else None
@@ -370,6 +431,31 @@ def orphan_workflow_history(self, workspace, workflow_name):
                 (workspace, workflow_name),
             )
 
+    def mark_kept(self, job_id):
+        """Record that a kept asset's provenance names this job (#917), so
+        `forget_workspace` leaves its row."""
+        with self._lock, self._connect() as connection:
+            connection.execute("UPDATE jobs SET kept = 1 WHERE id = ?", (job_id,))
+
+    def forget_workspace(self, workspace):
+        """Delete the rows recorded in this workspace (#913). A deleted
+        workspace takes its history with it, so a new workspace reusing the
+        name starts with none. A job a kept asset names (#917) survives, its
+        workspace renamed to one no workspace can be called, so
+        `get_job_workflow` still resolves the asset's provenance. Returns
+        the number of rows removed."""
+        with self._lock, self._connect() as connection:
+            cursor = connection.execute(
+                "DELETE FROM jobs WHERE workspace = ? AND COALESCE(kept, 0) = 0",
+                (workspace,),
+            )
+            removed = cursor.rowcount
+            connection.execute(
+                "UPDATE jobs SET workspace = ? WHERE workspace = ?",
+                (f"{workspace} (deleted)", workspace),
+            )
+            return removed
+
     def events_for(self, job_id):
         """A finished job's persisted event tail. [] for a job recorded
         before events were kept, None for a job history has never seen -
@@ -494,4 +580,6 @@ def parse(text, fallback):
             "traceback": None,
             "event_count": len(events) if isinstance(events, list) else 0,
             "historical": True,
+            **({"note": row[19]} if row[19] else {}),
+            **({"rerun_of": row[20]} if row[20] else {}),
         }
diff --git a/dw/server/job_record.py b/dw/server/job_record.py
index e0254dc8..e178f1f0 100644
--- a/dw/server/job_record.py
+++ b/dw/server/job_record.py
@@ -44,6 +44,8 @@
     # what the original run was consented to, kept for the record - a
     # rerun's own request decides its form
     "acknowledged_cost",
+    # the note it was submitted with, carried to the rerun's own run
+    "note",
 )
 
 # A long run emits thousands of progress events; the tail is what explains
@@ -88,6 +90,9 @@ def __init__(self, spec):
         self.device_card = None
         # Which form of cost acknowledgement queued this job (#85)
         self.acknowledged = spec.get("acknowledged") or ACK_NONE
+        # The note it was submitted with; written as the run note at run_start
+        self.note = spec.get("note")
+        self.rerun_of = spec.get("rerun_of")
         # The worker's own high-water mark for this run, from its final
         # memory_info message - None for a run that never got that far (#243)
         self.host_memory_peak_rss_mb = None
@@ -96,6 +101,12 @@ def __init__(self, spec):
         # rss when it caused no growth (#272). None for a run that never got
         # a memory_info message at all
         self.host_memory_job_peak_rss_mb = None
+        # The host RAM it was projected to hold at its peak when admitted,
+        # (mb, basis, runs) or None (dw/server/host_ram_need.py, #869)
+        self.host_ram_need = None
+        # Why dispatch is holding it while it is queued - "waiting for host
+        # RAM: ..." - or None; a live state, never a warning (#869)
+        self.waiting_for = None
         self.events = []
         # The running summary a poll reads - see _note_progress. Kept as the
         # events arrive rather than derived from the log on request, because
@@ -295,6 +306,21 @@ def summary(self):
             "run_version": self.run_version,
             "device": self.device,
             "acknowledged": self.acknowledged,
+            # A cancel asked of a running job that has not stopped yet: a
+            # model load or a task has no checkpoint, so the job stays
+            # `running` for a while after the request (#892)
+            **(
+                {"cancel_requested": True}
+                if self.cancel_requested and self.status == RUNNING
+                else {}
+            ),
+            **(
+                {"waiting_for": self.waiting_for}
+                if self.waiting_for and self.status == QUEUED
+                else {}
+            ),
+            **({"note": self.note} if self.note else {}),
+            **({"rerun_of": self.rerun_of} if self.rerun_of else {}),
         }
 
     def detail(self):
diff --git a/dw/server/job_results.py b/dw/server/job_results.py
index 630fc5ae..7a778706 100644
--- a/dw/server/job_results.py
+++ b/dw/server/job_results.py
@@ -26,6 +26,8 @@
     WorkflowLoaded,
     parse_reply,
 )
+from ..notes import set_run_note
+from ..security import SecurityError, validate_path
 from .job_record import CANCELLED, FAILED, SUCCEEDED
 from .outputs import output_kinds
 
@@ -98,9 +100,25 @@ def record_progress(job, event, output_dir):
         job.run_id = event.get("run_id")
         job.run_dir = event.get("run_dir")
         job.run_version = event.get("version")
+        if getattr(job, "note", None) and job.run_dir:
+            write_run_note(job, output_dir)
     job.add_event(event)
 
 
+def write_run_note(job, output_dir):
+    """The note the job was submitted with, as its run's note. The server
+    writes notes.json, never the engine, so this happens here, when the
+    worker reports the run directory. Never fatal: the note is worth less
+    than the run."""
+    try:
+        run_dir = validate_path(
+            os.path.join(output_dir, job.run_dir), output_dir, allow_create=False
+        )
+        set_run_note(run_dir, job.note)
+    except (SecurityError, OSError) as e:
+        logger.warning(f"Could not write the run note for job {job.id}: {e}")
+
+
 def record_run_memory(job, info, slot, record_memory):
     """A memory reading the run reported. One per phase boundary now,
     not just once post-run (#273) - each folds into the cached reading
@@ -147,6 +165,11 @@ def consume_results(job, manager, slot, output_dir, record_memory):
             # against a queue nobody is reading
             detail = manager.crash_details()
             manager.mark_crashed()
+            if job.cancel_requested:
+                # Terminated by JobManager's cancel escalation (#892), or
+                # died on its own with the job already asked to stop: the
+                # outcome the caller wanted either way
+                return (CANCELLED, None, None)
             reason = f"Worker process died: {detail or e}"
             logger.error(f"Job {job.id}: {reason}")
             return (FAILED, reason, None)
diff --git a/dw/server/jobs.py b/dw/server/jobs.py
index 3fd0b6e0..25015174 100644
--- a/dw/server/jobs.py
+++ b/dw/server/jobs.py
@@ -20,6 +20,8 @@
 rest lives beside it, and JobManager keeps a thin delegator for every name a
 route or test calls:
 - `dw/server/pool.py`: WorkerSlot and the lock-free fit and affinity policy;
+- `dw/server/dispatch.py`: the queue scan picking the next job and card,
+  with the host-RAM hold (`Dispatcher`, a mixin of JobManager);
 - `dw/server/job_results.py`: folding a run's worker messages into its Job;
 - `dw/server/worker_memory.py`: a card's memory reading, cache probe and
   memory clear.
@@ -40,9 +42,10 @@
 import threading
 from contextlib import contextmanager
 
+from ..events import NON_INTERRUPTIBLE_PHASES
 from ..worker_protocol import Execute, workflow_identity
 from ..devices import device_ordinal
-from ..host_memory import process_rss_mb
+from ..host_memory import process_rss_mb, read_oom_score_adj
 from ..worker_manager import WorkerManager
 from ..workflow_run import SEED_BITS
 from ..security import (
@@ -56,8 +59,10 @@
 from ..runs import REALIZED_FILE_NAME
 from ..settings import resolve_path
 from ..workspace import DEFAULT_WORKSPACE_NAME
-from . import job_results, pool, worker_memory
+from . import dispatch, job_results, pool, worker_memory
+from .dispatch import Dispatcher
 from .job_history import JobHistory
+from .outputs import job_run_directory, with_run_note
 from .job_record import (
     ACK_NONE,
     CANCELLED,
@@ -79,12 +84,16 @@
 # history only, so a long-running server's memory stays bounded
 TERMINAL_JOBS_KEPT = 20
 
+# How long a cancel waits for a worker in a phase with no checkpoint (a model
+# load, a task) before the worker is terminated (#892)
+CANCEL_GRACE_SECONDS = 30.0
+
 
 class JobsActive(Exception):
     """A job is running or queued."""
 
 
-class JobManager:
+class JobManager(Dispatcher):
     """Queues jobs and dispatches them onto one worker process per card."""
 
     def __init__(
@@ -129,6 +138,9 @@ def __init__(
         self._wake = threading.Condition(self._lock)
         # The VRAM each job needs to start, by job id (dispatch reads it)
         self._needs = {}
+        # The host RAM (MB) each job is projected to peak at, by job id - only
+        # jobs with a figure; dispatch holds one the host can't fit (#869)
+        self._host_needs = {}
         # The card a rerun prefers - the original's ordinal - by job id
         self._preferred = {}
         # Callers holding dispatch (hold_dispatch): while any does, no queued
@@ -222,7 +234,10 @@ def submit(
         acknowledged_cost=None,
         warnings=None,
         vram_need=None,
+        host_ram_need=None,
         preferred_device=None,
+        note=None,
+        rerun_of=None,
     ):
         """Record a job request and queue it.
 
@@ -259,9 +274,19 @@ def submit(
         starts only on a card with that much VRAM (`check_fits` has already
         refused one no card here holds).
 
+        `host_ram_need` is the admission's (`Admission.host_ram_need`): the
+        host RAM the run is projected to hold at its peak, kept on the job
+        as `job.host_ram_need` (#869). The job waits to start while the
+        host cannot hold it beside the running jobs (`_host_ram_wait`).
+
         `preferred_device` is the card ('cuda:1') the job goes to when that
         card is free and fits it - a rerun's original card (`rerun`).
 
+        `note` is the run's note, already cleaned (`admitted_note`): kept on
+        the job and written into the run directory when the run opens.
+
+        `rerun_of` is the job this one reruns, recorded so the list can say so.
+
         `workflow_path`, `workflow` and `base_dir` are the request as the
         caller made it, kept for a rerun (which admits afresh) and for
         `definition()`; the snapshot is not persisted.
@@ -308,11 +333,18 @@ def submit(
         if asset_dir:
             spec["asset_dir"] = asset_dir
         spec["warnings"] = list(warnings or [])
+        if note:
+            spec["note"] = note
+        if rerun_of:
+            spec["rerun_of"] = rerun_of
 
         job = Job(spec)
+        job.host_ram_need = host_ram_need
         with self._lock:
             self.jobs[job.id] = job
             self._needs[job.id] = pool.dispatch_need(self.slots, vram_need)
+            if host_ram_need:
+                self._host_needs[job.id] = host_ram_need[0]
             if preferred_device:
                 self._preferred[job.id] = preferred_device
         job.add_event({"event": "job_status", "status": QUEUED})
@@ -497,6 +529,7 @@ def rerun(
         warnings=None,
         arguments=None,
         vram_need=None,
+        host_ram_need=None,
     ):
         """Queue a fresh job from a previous job's spec.
 
@@ -550,7 +583,10 @@ def rerun(
             ),
             warnings=warnings,
             vram_need=vram_need,
+            host_ram_need=host_ram_need,
             preferred_device=self._original_device(job_id),
+            note=spec.get("note"),
+            rerun_of=job_id,
         )
 
     def _original_device(self, job_id):
@@ -581,6 +617,13 @@ def list(self, workspace=None, statuses=None):
         workspaces existed. `statuses` filters to a set of job states
         ('queued', 'running', 'succeeded', 'failed', 'cancelled'); omitted,
         every state is listed."""
+        return self.list_page(workspace, statuses)[0]
+
+    def list_page(self, workspace=None, statuses=None, limit=None):
+        """`list`'s jobs cut to the newest `limit` (every one when None),
+        and how many matched before the cut. Each run's current note is
+        read after the cut, so a small page does not read the notes of
+        the whole history."""
         statuses = set(statuses) if statuses else None
         with self._lock:
             live = sorted(self.jobs.values(), key=lambda j: j.created_at)
@@ -595,14 +638,31 @@ def list(self, workspace=None, statuses=None):
                 continue
             if job.id in positions:
                 summary["queue_position"] = positions[job.id]
-            summaries.append(summary)
+            output_dir = job.spec.get("output_dir")
+            summaries.append((summary, output_dir, job.run_dir))
         for historical in self.history.recent_summaries(
             workspace=workspace, statuses=statuses
         ):
+            run_dir = historical.pop("_run_dir", None)
+            output_dir = historical.pop("_output_dir", None)
             if historical["id"] not in live_ids:
-                summaries.append(historical)
-        summaries.sort(key=lambda summary: summary["created_at"] or 0)
-        return summaries
+                summaries.append((historical, output_dir, run_dir))
+        summaries.sort(key=lambda entry: entry[0]["created_at"] or 0)
+        total = len(summaries)
+        if limit is not None:
+            # the newest are the interesting ones and the list is oldest
+            # first, so the cut comes off the front; max(0, ...) because a
+            # bare negative start would be read from the end instead
+            summaries = summaries[max(0, total - limit) :] if limit else []
+        return [self._current_note(*entry) for entry in summaries], total
+
+    def _current_note(self, summary, output_dir, run_dir):
+        """The summary with its run's current note (outputs.with_run_note),
+        when the run directory is still there."""
+        if not run_dir:
+            return summary
+        root = validate_output_path(output_dir or self.output_dir, None)
+        return with_run_note(summary, job_run_directory(root, run_dir))
 
     # ------------------------------------------------------------ cancel/stop
 
@@ -619,8 +679,7 @@ def cancel(self, job_id):
             if job.status == QUEUED:
                 if job.id in self._pending:
                     self._pending.remove(job.id)
-                self._needs.pop(job.id, None)
-                self._preferred.pop(job.id, None)
+                self._forget_dispatch(job)
                 self._finish(job, CANCELLED)
                 return job.status
             slot = self._slot_running(job.id)
@@ -633,8 +692,42 @@ def cancel(self, job_id):
                     slot.manager.cancel()
                 except Exception as e:
                     logger.warning(f"Could not send cancel for job {job_id}: {e}")
+                self._escalate_cancel(slot, job)
         return job.status
 
+    def _escalate_cancel(self, slot, job):
+        """A model load or a task step never reaches the checkpoint that
+        honors a cancel, and a cold download can last hours. Once the grace
+        period has passed and the job is still in such a phase, the worker
+        is terminated and the job ends cancelled (#892); it respawns for the
+        next job."""
+        timer = threading.Timer(
+            CANCEL_GRACE_SECONDS, self._terminate_if_stuck, args=(slot, job)
+        )
+        timer.daemon = True
+        timer.start()
+
+    def _terminate_if_stuck(self, slot, job):
+        with self._lock:
+            stuck = (
+                job.status == RUNNING
+                and slot.current_job_id == job.id
+                and job.phase in NON_INTERRUPTIBLE_PHASES
+            )
+        if not stuck:
+            return
+        job.add_event(
+            {
+                "event": "log",
+                "message": f"Cancel still pending in phase '{job.phase}' after "
+                f"{CANCEL_GRACE_SECONDS:g}s: terminating the worker",
+            }
+        )
+        try:
+            slot.manager.terminate_worker()
+        except Exception as e:
+            logger.warning(f"Could not terminate the worker for job {job.id}: {e}")
+
     def move(self, job_id, direction):
         """Reorder a queued job: 'up'/'down' swap with a neighbour,
         'front'/'back' go to the ends. The order is the order to start: with
@@ -657,6 +750,9 @@ def move(self, job_id, direction):
             else:
                 index = min(len(self._pending), index + 1)
             self._pending.insert(index, job_id)
+            # The order decides which job the next pass tries first, a held
+            # one included (#869)
+            self._wake.notify()
             return list(self._pending)
 
     def shutdown(self):
@@ -687,7 +783,10 @@ def _run_loop(self):
                     picked = self._next_dispatch()
                     if picked is not None:
                         break
-                    self._wake.wait()
+                    # Host RAM frees outside dw too, so a job held for it is
+                    # looked at again on a timer, not only on a wake (#869)
+                    held = any(self._held_for_host_ram())
+                    self._wake.wait(dispatch.HOST_RAM_RECHECK_SECONDS if held else None)
                 slot, job = picked
                 job.status = RUNNING
                 job.started_at = time.time()
@@ -707,36 +806,6 @@ def _run_loop(self):
                 self._job_threads.add(thread)
             thread.start()
 
-    def _next_dispatch(self):
-        """(slot, job) for the first queued job, in queue order, that fits
-        a free card - the one it has an affinity for (`_choose_slot`) - or
-        None. A job too big for every free card keeps its place, and the
-        scan goes on past it: a smaller job behind it takes the card
-        meanwhile (backfill). Called holding _lock."""
-        if self._dispatch_holds:
-            return None
-        free = [slot for slot in self.slots if slot.current_job_id is None]
-        if not free:
-            return None
-        for job_id in list(self._pending):
-            job = self.jobs.get(job_id)
-            if job is None or job.status != QUEUED:
-                self._pending.remove(job_id)  # cancelled while waiting
-                self._needs.pop(job_id, None)
-                self._preferred.pop(job_id, None)
-                continue
-            need = self._needs.get(job_id)
-            fitting = [slot for slot in free if slot.fits(need)]
-            if fitting:
-                slot = pool.choose_slot(
-                    fitting, self._job_identity(job), self._preferred.get(job_id)
-                )
-                self._pending.remove(job_id)
-                self._needs.pop(job_id, None)
-                self._preferred.pop(job_id, None)
-                return slot, job
-        return None
-
     def _slot_running(self, job_id):
         """The slot whose worker is running `job_id`, or None."""
         with self._lock:
@@ -753,6 +822,19 @@ def _finish(self, job, status, error=None, traceback_text=None):
             logger.warning(f"Could not persist job {job.id}: {e}")
         self._trim_terminal_jobs()
 
+    def forget_workspace(self, workspace):
+        """Drop a deleted workspace's finished jobs, in memory and in history
+        (#913), so a workspace later created under the same name lists none
+        of them. Queued or running jobs are the caller's to refuse first."""
+        with self._lock:
+            for job in [
+                j
+                for j in self.jobs.values()
+                if j.status in TERMINAL_STATES and j.spec.get("workspace") == workspace
+            ]:
+                del self.jobs[job.id]
+        return self.history.forget_workspace(workspace)
+
     def _trim_terminal_jobs(self):
         """Drop the oldest finished jobs from memory - history has them, and
         get()/list() fall through to it. Recent ones stay for event replay."""
@@ -786,7 +868,7 @@ def _run_on(self, slot, job):
                     outcome = (CANCELLED, None, None)
                 else:
                     manager.ensure_worker(self.log_level)
-                    self._rank_for_oom(slot)
+                    self._rank_for_oom(slot, job)
                     command = Execute(
                         # The snapshot admission checked, which the worker runs
                         # as it is rather than reading the file again
@@ -828,24 +910,41 @@ def _run_on(self, slot, job):
             status, error, traceback_text = outcome
             self._finish(job, status, error=error, traceback_text=traceback_text)
 
-    def _rank_for_oom(self, slot):
-        """A worker this call just started is scored for the kernel's OOM
-        killer above every other live worker, so a host-RAM squeeze kills
-        the later-started worker - one job - rather than whichever is
-        largest. Nothing is written while it is the only worker, so one card
-        runs exactly as before."""
+    def _rank_for_oom(self, slot, job=None):
+        """Score the dispatching worker 1000 for the kernel's OOM killer and
+        put every other live worker back to its spawn-time floor, on every
+        dispatch, so a host-RAM squeeze kills the newest job whatever the
+        workers' sizes (#881). The floor rather than 0: an unprivileged write
+        below it is refused (WorkerManager.reset_oom_score_adj). Nothing is
+        written while it is the only worker, so one card runs exactly as
+        before. A write the kernel refuses is a warning on the job, since a
+        tie at 1000 is the failure this exists to prevent."""
         manager = slot.manager
-        pid = manager.pid() if hasattr(manager, "pid") else None
-        if pid is None or pid == slot.ranked_pid:
+        if not hasattr(manager, "set_oom_score_adj"):
             return
-        slot.ranked_pid = pid
         others = [
             other.manager for other in self.slots if other is not slot and other.alive()
         ]
-        if not others or not hasattr(manager, "set_oom_score_adj"):
+        if not others:
             return
-        highest = max((other.oom_score_adj or 0) for other in others)
-        manager.set_oom_score_adj(min(1000, highest + 100))
+        refused = []
+        if manager.set_oom_score_adj(1000) is False:
+            refused.append((manager, 1000))
+        for other in others:
+            if (
+                hasattr(other, "reset_oom_score_adj")
+                and other.reset_oom_score_adj() is False
+            ):
+                refused.append((other, other.oom_score_floor or 0))
+        for worker, value in refused:
+            message = (
+                f"Could not set oom_score_adj to {value} on the {worker.device} "
+                f"worker (pid {worker.pid()}): a host-RAM squeeze may not kill "
+                "the newest job first"
+            )
+            logger.warning(message)
+            if job is not None:
+                job.add_event({"event": "warning", "message": message})
 
     def is_busy(self):
         """True while a job is running on any card or queued - the window in
@@ -917,6 +1016,11 @@ def workers(self):
             rss = process_rss_mb(pid) if pid is not None else None
             if rss is not None:
                 entry["host_memory_rss_mb"] = rss
+            if pid is not None and slot.alive():
+                entry["pid"] = pid
+                adj = read_oom_score_adj(pid)
+                if adj is not None:
+                    entry["oom_score_adj"] = adj
             described.append(entry)
         return described
 
diff --git a/dw/server/observed_cost.py b/dw/server/observed_cost.py
index 11ff5f46..cd399206 100644
--- a/dw/server/observed_cost.py
+++ b/dw/server/observed_cost.py
@@ -78,7 +78,8 @@ def _bucket_key(definition, arguments):
     With declared drivers: the effective value of each, which is what the run
     passed or else the stored default. Without: only a run that overrode
     nothing that matters is comparable, and since nothing is declared to
-    matter, that means a run that overrode nothing at all.
+    matter, that means a run that overrode nothing at all - except a
+    task-only workflow, whose runs are all comparable (#921).
     """
     variables = definition.get("variables") or {}
     drivers = declared_drivers(definition)
@@ -87,6 +88,11 @@ def _bucket_key(definition, arguments):
             (name, _comparable(arguments.get(name, variables.get(name))))
             for name in sorted(drivers)
         )
+    if _is_task_only(definition):
+        # No pipeline loads, so a task's inputs (an audio file, a list of
+        # lines) are data rather than a size; with nothing declared to
+        # scale the cost, every run is comparable (#921)
+        return ()
     if any(key in variables for key in arguments):
         return None
     return ()
diff --git a/dw/server/outputs.py b/dw/server/outputs.py
index 6d2835a7..908879f7 100644
--- a/dw/server/outputs.py
+++ b/dw/server/outputs.py
@@ -10,7 +10,9 @@
 import os
 import shutil
 import tempfile
+import threading
 import zipfile
+from collections import OrderedDict
 from datetime import datetime
 from urllib.parse import quote
 
@@ -30,8 +32,13 @@
     LibraryRoot,
     library_path,
 )
+from ..notes import read_notes
+from ..roles import ROLE_DECLARED_KEY, consumed_outputs, entry_role, listed_role
 from ..runs import (
+    MANIFEST_FILE_NAME,
+    _read_manifest,
     is_output_reference,
+    is_run_id,
     record_run_versions,
     run_lock_path,
     run_versions,
@@ -463,3 +470,208 @@ def delete_run_directory(run_dir, root):
     logger.info(f"Deleted run directory {os.path.relpath(run_dir, root)}")
     forget_workspace_usage()
     return os.path.basename(run_dir)
+
+
+def split_run_name(root, relative_name):
+    """A gallery file name's run directory and its path inside that run:
+    'wf/20261012-000003-dddddddd/final/b.png' -> (<root>/wf/<run id>,
+    'final/b.png'). None for a flat-layout file, which has no run."""
+    parts = [part for part in (relative_name or "").split("/") if part]
+    for position, segment in enumerate(parts[:-1]):
+        if is_run_id(segment):
+            run_dir = os.path.join(root, *parts[: position + 1])
+            return run_dir, "/".join(parts[position + 1 :])
+    return None
+
+
+def validated_run_split(root, path):
+    """`split_run_name` for a file already resolved under `root` (a
+    validator's return value): (run directory, name inside it), the
+    directory itself validated against `root`, or None for a flat-layout
+    file. Measured from root's real path, since `path` is a real path and a
+    root under a symlink would otherwise relativise to '../..'."""
+    relative = os.path.relpath(path, os.path.realpath(root)).replace(os.sep, "/")
+    split = split_run_name(root, relative)
+    if split is None:
+        return None
+    try:
+        return validate_path(split[0], root, allow_create=False), split[1]
+    except SecurityError:
+        return None
+
+
+def run_directory(name, root):
+    """The run directory `<identity>/<run id>` names, validated against
+    `root`, or None when `name` is not one.
+
+    A run that failed before it wrote anything still has a directory and a
+    manifest, and no gallery name addresses it - so the name of the
+    directory itself is the only handle there can be (#134).
+    """
+    parts = [part for part in (name or "").split("/") if part]
+    if not parts or not is_run_id(parts[-1]):
+        return None
+    try:
+        path = validate_path(
+            os.path.join(root, "/".join(parts)), root, allow_create=False
+        )
+    except SecurityError:
+        return None
+    return path if os.path.isdir(path) else None
+
+
+# Roles by (run directory, manifest mtime): a listing asks for every file
+# of a run, and the manifest it came from has not changed since the last ask.
+# Least recently used goes first; an entry is a small dict, so the limit
+# sits well above the runs one workspace holds. Listings run on the
+# threadpool, so every touch holds the lock
+_ROLE_CACHE = OrderedDict()
+_ROLE_CACHE_LIMIT = 8192
+_ROLE_CACHE_LOCK = threading.Lock()
+_INPUT_KINDS = ("asset", "output")
+
+
+def run_roles(run_dir):
+    """Each file of a run, by path relative to the run directory ('/'
+    separated), mapped to the role its manifest entry records. An entry
+    without one (a run that predates roles) is left out - unknown, not
+    guessed. {} when the manifest is unreadable."""
+    return _run_role_record(run_dir)[0]
+
+
+def declared_files(run_dir):
+    """The files of a run whose role the step declared (`role_declared`,
+    dw/roles.py rule 1), by the same names `run_roles` uses."""
+    return _run_role_record(run_dir)[1]
+
+
+def listed_file_role(run_dir, name, consumed):
+    """The role a listing shows for file `name` of a run: its recorded role,
+    demoted when `consumed` (dw/roles.py rule 4)."""
+    return listed_role(
+        run_roles(run_dir).get(name), name in declared_files(run_dir), consumed
+    )
+
+
+def consumed_in(state, ws):
+    """`consumed_outputs` over a workspace's outputs, its assets found down
+    the search path a run resolves 'asset:' in. Once per listing."""
+    library = resolution_library(state, ws)
+
+    def find_asset(name):
+        try:
+            validate_asset_reference(name)
+        except SecurityError:
+            return None
+        found = library.find(name)
+        return found[0] if found else None
+
+    return consumed_outputs(ws.outputs, find_asset, ws.name)
+
+
+def _run_role_record(run_dir):
+    """(roles, declared names) a run's manifest records, cached on its stat."""
+    try:
+        key = (
+            run_dir,
+            os.stat(os.path.join(run_dir, MANIFEST_FILE_NAME)).st_mtime_ns,
+        )
+    except OSError:
+        return {}, frozenset()
+    with _ROLE_CACHE_LOCK:
+        if key in _ROLE_CACHE:
+            _ROLE_CACHE.move_to_end(key)
+            return _ROLE_CACHE[key]
+    manifest = _read_manifest(run_dir) or {}
+    roles, declared = {}, set()
+    for entry in manifest.get("steps") or []:
+        role = entry_role(entry)
+        if role:
+            for name in entry.get("files") or []:
+                roles[str(name).replace(os.sep, "/")] = role
+                if entry.get(ROLE_DECLARED_KEY) is True:
+                    declared.add(str(name).replace(os.sep, "/"))
+    record = (roles, frozenset(declared))
+    with _ROLE_CACHE_LOCK:
+        _ROLE_CACHE[key] = record
+        _ROLE_CACHE.move_to_end(key)
+        while len(_ROLE_CACHE) > _ROLE_CACHE_LIMIT:
+            _ROLE_CACHE.popitem(last=False)
+    return record
+
+
+def run_inputs(run_dir):
+    """The inputs a run's manifest recorded, or None when it has none. Only
+    well-formed entries: a str reference of a kind the engine records."""
+    inputs = (_read_manifest(run_dir) or {}).get("inputs")
+    if not isinstance(inputs, list):
+        return None
+    return [
+        {"reference": entry["reference"], "kind": entry["kind"]}
+        for entry in inputs
+        if isinstance(entry, dict)
+        and isinstance(entry.get("reference"), str)
+        and entry.get("kind") in _INPUT_KINDS
+    ]
+
+
+def job_run_directory(root, run_dir):
+    """A job's run directory under its validated output root, or None when
+    the job never opened one or the directory is gone."""
+    if not run_dir:
+        return None
+    try:
+        path = validate_path(os.path.join(root, run_dir), root, allow_create=False)
+    except SecurityError:
+        return None
+    return path if os.path.isdir(path) else None
+
+
+def with_run_note(summary, path):
+    """`summary` with the run's current note from its notes.json - a note
+    edited after submission replaces the one the job was submitted with,
+    and a cleared one removes it. Unchanged when `path` is None."""
+    if path is None:
+        return summary
+    summary = {key: value for key, value in summary.items() if key != "note"}
+    note = read_notes(path)["run"]
+    return {**summary, "note": note} if note else summary
+
+
+def with_run_state(detail, root, run_dir, roles=True):
+    """A job's detail with what its run directory says now: the run note,
+    and each manifest entry's role. The worker reports the manifest it held
+    in memory, which carries no roles - so each entry takes the role
+    `run_roles` gives its files; a run from before roles stays without. `roles` false leaves the manifest alone."""
+    path = job_run_directory(root, run_dir)
+    if path is None:
+        return detail
+    detail = with_run_note(detail, path)
+    roles = run_roles(path) if roles else None
+    manifest = detail.get("manifest")
+    if not roles or not isinstance(manifest, list):
+        return detail
+    entries = []
+    for entry in manifest:
+        if isinstance(entry, dict) and entry_role(entry) is None:
+            role = next(
+                (
+                    roles[name]
+                    for name in (
+                        _run_relative(root, path, f) for f in entry.get("files") or []
+                    )
+                    if name in roles
+                ),
+                None,
+            )
+            if role:
+                entry = {**entry, "role": role}
+        entries.append(entry)
+    return {**detail, "manifest": entries}
+
+
+def _run_relative(root, run_path, name):
+    """A job manifest's file name (relative to the output root) as the run
+    directory's manifest names it, '/' separated."""
+    full = os.path.normpath(os.path.join(root, str(name)))
+    return os.path.relpath(full, run_path).replace(os.sep, "/")
diff --git a/dw/server/pool.py b/dw/server/pool.py
index 063fe6aa..ff9a432c 100644
--- a/dw/server/pool.py
+++ b/dw/server/pool.py
@@ -3,9 +3,11 @@
 A WorkerSlot is one `--devices` card: its worker, the job it runs and the
 lock that serializes talking to it. The functions here read only the slots
 they are given and take no lock - fit (`check_fits`, `dispatch_need`), the
-largest card (`largest_ceiling_gb`) and affinity (`choose_slot`). The
+largest card (`largest_ceiling_gb`), affinity (`choose_slot`) and the
+host-RAM wait (`host_ram_wait`): the cards share one host's RAM, so a job
+that fits a free card may still wait for a running one to finish. The
 JobManager (`dw/server/jobs.py`) calls them under its own lock where the
-answer must agree with dispatch (`JobManager.route`, `_next_dispatch`).
+answer must agree with dispatch (`JobManager.route`, `dispatch.Dispatcher._next_dispatch`).
 """
 
 import logging
@@ -32,8 +34,6 @@ def __init__(self, manager):
         # This card's last memory reading and when it was taken
         self.last_memory = None
         self.last_memory_at = None
-        # The worker process _rank_for_oom last looked at
-        self.ranked_pid = None
 
     @property
     def device(self):
@@ -228,3 +228,36 @@ def dispatch_need(slots, need):
     if hard or any(capacity >= gb for _, capacity in capacities(slots)):
         return (gb, hard)
     return None
+
+
+# ---------------------------------------------------------------- host RAM
+
+
+def host_ram_wait(need_mb, available_mb, running, idle_rss_mb=None):
+    """Why a job projected to peak at `need_mb` of host RAM must wait to
+    start now, or None when it may start (#869).
+
+    `available_mb` is the host's MemAvailable; `running` holds one
+    (projected peak MB or None, worker RSS MB now or None) per running job;
+    `idle_rss_mb` is what the idle worker the job would reuse holds, which
+    the job takes over. Each running job is charged the growth it has still
+    to make, `max(0, peak - rss)`: one still loading has not reached its
+    peak, and MemAvailable already reflects what it holds. A running job
+    with no figure is charged nothing more, and an unread RSS is a worker
+    holding nothing yet.
+
+    Never a wait with no other job running, so a job waits only for jobs
+    that will finish; never without a figure for the job or a reading of
+    the host."""
+    if need_mb is None or available_mb is None or not running:
+        return None
+    growth = sum(
+        max(0.0, peak - (rss or 0.0)) for peak, rss in running if peak is not None
+    )
+    free = max(0.0, available_mb - growth + (idle_rss_mb or 0.0))
+    if need_mb <= free:
+        return None
+    return (
+        f"waiting for host RAM: needs ~{need_mb / 1024:.0f} GB, "
+        f"~{free / 1024:.0f} GB free"
+    )
diff --git a/dw/server/routes/assets.py b/dw/server/routes/assets.py
index 09181210..3de01c7e 100644
--- a/dw/server/routes/assets.py
+++ b/dw/server/routes/assets.py
@@ -22,6 +22,15 @@
     Kept,
     Uploaded,
 )
+from ...notes import (
+    MAX_NOTE_LENGTH,
+    NoteTooLong,
+    clean_note,
+    drop_file_note,
+    effective_note,
+    read_notes,
+    set_file_note,
+)
 from ...references import ASSET, make_ref
 from ...runs import record_kept_shots, recorded_shots
 from ...security import (
@@ -54,6 +63,8 @@
     resolve_output_file,
     served_url,
     strip_output_prefix,
+    run_inputs,
+    validated_run_split,
 )
 
 logger = logging.getLogger("dw")
@@ -62,8 +73,49 @@
 
 
 def _write_bytes(path, data):
-    with open(path, "wb") as f:
-        f.write(data)
+    """Write a file whole, then rename it into place. An upload over an
+    existing name replaces that file rather than writing into it: the old
+    one may be a hard link - of a run's file (keep_output) or of another
+    workspace's asset (copy_to_workspace) - and an in-place write would
+    change those bytes too."""
+    partial = f"{path}.{uuid.uuid4().hex}.part"
+    try:
+        with open(partial, "wb") as f:
+            f.write(data)
+        os.replace(partial, path)
+    except BaseException:
+        try:
+            os.remove(partial)
+        except OSError:
+            pass
+        raise
+
+
+def _note_or_400(note):
+    try:
+        return clean_note(note)
+    except (NoteTooLong, TypeError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+def _note_entry(path, notes_by_directory):
+    """{"note": ...} for the asset at `path` when it has one, else {} -
+    reading each directory's notes.json once into `notes_by_directory`."""
+    directory = os.path.dirname(path)
+    if directory not in notes_by_directory:
+        notes_by_directory[directory] = read_notes(directory)["files"]
+    note = notes_by_directory[directory].get(os.path.basename(path))
+    return {"note": note} if note else {}
+
+
+def _describe_new_asset(path, note):
+    """What the library records beside a file just written at `path` (a
+    validated path): its note, or none - which drops a note an earlier file
+    of that name left. Best effort: the file is already in place."""
+    try:
+        set_file_note(os.path.dirname(path), os.path.basename(path), note)
+    except OSError as e:
+        logger.warning(f"Could not write the note beside {path}: {e}")
 
 
 UPLOADS_SUBDIR = "uploads"
@@ -94,6 +146,10 @@ async def upload_media(
     filename: str,
     asset_name: Optional[str] = None,
     shared: bool = False,
+    note: Optional[str] = Query(
+        default=None,
+        description=f"A note on the asset, at most {MAX_NOTE_LENGTH} characters",
+    ),
     ws: Workspace = Depends(selected_workspace),
 ):
     """Save a browser-picked image, video or audio file into the asset library's
@@ -111,7 +167,8 @@ async def upload_media(
     'cast/priya-voice.wav' rather than the random one a browser upload
     gets - which is what makes a recurring cast's references readable
     in every workflow that carries them. It may name a folder, is
-    confined to the library the way `keep_output`'s is, and takes the
+    confined the way `keep_output`'s is but placed under `uploads/`
+    (not at the library root, as `keep_output`'s is), and takes the
     uploaded file's extension when it has none of its own. Without it
     the name stays random, so two uploads of the same file never
     collide.
@@ -119,7 +176,12 @@ async def upload_media(
     `shared` puts it in the library every workspace under this root
     shares rather than in this workspace's own - a recurring cast that
     episode four, in a workspace of its own, still has to reach.
+
+    `note` is kept beside it (the directory's notes.json). An upload over an
+    existing name takes its own note, or none: not the old file's, and not
+    the old file's kept provenance either.
     """
+    note = _note_or_400(note)
     extension = os.path.splitext(os.path.basename(filename))[1].lower()
     if extension not in ALLOWED_UPLOAD_EXTENSIONS:
         raise HTTPException(
@@ -175,11 +237,21 @@ async def upload_media(
     except SecurityError as e:
         raise HTTPException(status_code=400, detail=str(e))
     os.makedirs(os.path.dirname(dest), exist_ok=True)
+    # Taken before the write: only a file this one replaces can have left a
+    # kept record behind, and a fresh name leaves the directory's alone
+    replaced = os.path.exists(dest)
 
     # Off the event loop: a 200 MB write would otherwise stall every SSE
     # stream and poll for its duration
     await run_in_threadpool(_write_bytes, dest, body)
     logger.info(f"Saved upload {filename!r} -> {dest}")
+    _describe_new_asset(dest, note)
+    if replaced:
+        try:
+            # A kept file this one replaced left its provenance and shots
+            record_kept_shots(os.path.dirname(dest), os.path.basename(dest), None, None)
+        except OSError as e:
+            logger.warning(f"Could not clear the kept record beside {dest}: {e}")
     path = f"/inputs/{UPLOADS_SUBDIR}/{quote(name)}"
     result = {
         "reference": make_ref(ASSET, f"{UPLOADS_SUBDIR}/{name}"),
@@ -253,14 +325,14 @@ def media_names(root):
                 stat = os.stat(path)
             except OSError:
                 continue
-            found[(root, relative)] = (folder, kind, stat)
+            found[(root, relative)] = (folder, kind, stat, path)
             names.append(relative)
         return names
 
     winners, hidden = library.entries(media_names)
 
     def summary(name, root):
-        folder, kind, stat = found[(root.root, name)]
+        folder, kind, stat, _path = found[(root.root, name)]
         return {
             "name": name,
             "reference": make_ref(ASSET, name),
@@ -272,13 +344,19 @@ def summary(name, root):
             "writable": root.writable,
         }
 
+    # One read of each directory's notes.json per listing
+    notes_by_directory = {}
     users = asset_users(request.app.state, ws)
     assets = []
     for name, root in winners.items():
         asset_path = f"/inputs/{quote(name)}"
         # `url` is for the editor's own preview - fetchable the same way
         # an upload's URL is
-        asset_entry = {**summary(name, root), "url": served_url(asset_path, ws)}
+        asset_entry = {
+            **summary(name, root),
+            "url": served_url(asset_path, ws),
+            **_note_entry(found[(root.root, name)][3], notes_by_directory),
+        }
         absolute_url = absolute_served_url(asset_path, ws)
         if absolute_url is not None:
             asset_entry["absolute_url"] = absolute_url
@@ -327,6 +405,12 @@ class KeepRequest(BaseModel):
         description="Keep it in the library every workspace under this "
         "root shares, rather than in this workspace's own",
     )
+    note: Optional[str] = Field(
+        default=None,
+        description=f"A note on the kept asset, at most {MAX_NOTE_LENGTH} "
+        "characters; the source file's effective note when omitted, and "
+        "none when empty",
+    )
 
 
 @router.post(
@@ -352,10 +436,17 @@ def keep_output_as_asset(
     multi-gigabyte video to reuse one frame would be paying for the
     round trip twice.
     """
+    note = _note_or_400(body.note)
     library = writable_asset_directory(request.app.state, ws, body.shared)
 
     kept_name = strip_output_prefix(body.name)
     source = resolve_output_file(request.app.state, kept_name, ws.outputs)
+    if body.note is None:
+        # The note the file carried where it was made: its own, else its
+        # run's. Only when no note was given - an empty one keeps none
+        split = validated_run_split(ws.outputs, source)
+        if split:
+            note = effective_note(read_notes(split[0]), split[1])[0]
     asset_name = body.asset_name or os.path.basename(kept_name)
     # The kept file's own extension when the name carries none, and a
     # refusal when it carries a contradicting one - exactly what the
@@ -407,6 +498,10 @@ def keep_output_as_asset(
     job, source_run_id, source_version = job_provenance(
         request.app.state, kept_name, ws
     )
+    # The assets and outputs the source run was built from, so the lineage
+    # outlives the run and its workspace (#902)
+    run_split = validated_run_split(ws.outputs, source)
+    source_inputs = run_inputs(run_split[0]) if run_split else None
     provenance = (
         {
             "job": job,
@@ -414,10 +509,18 @@ def keep_output_as_asset(
             "version": source_version,
             "workspace": ws.name,
             "source": kept_name,
+            **({"inputs": source_inputs} if source_inputs else {}),
         }
         if job
         else None
     )
+    if job:
+        # The asset now names this job, so deleting the workspace must not
+        # take its row (#917)
+        try:
+            request.app.state.job_manager.history.mark_kept(job["id"])
+        except Exception as e:
+            logger.warning(f"Could not mark job {job['id']} kept: {e}")
     record_kept_shots(
         os.path.dirname(destination),
         os.path.basename(destination),
@@ -425,6 +528,8 @@ def keep_output_as_asset(
         provenance,
     )
 
+    _describe_new_asset(destination, note)
+
     logger.info(f"Kept output {body.name} as {make_ref(ASSET, asset_name)}")
     return {
         "reference": make_ref(ASSET, asset_name),
@@ -500,6 +605,14 @@ def delete_asset(
             raise HTTPException(status_code=403, detail=str(refusal))
         os.remove(path)
         logger.info(f"Deleted {make_ref(ASSET, relative)} ({path})")
+        # Its note, provenance and shots go with it, or a later file of the
+        # same name inherits them. Best effort: the file is already gone
+        directory, file_name = os.path.dirname(path), os.path.basename(path)
+        try:
+            drop_file_note(directory, file_name)
+            record_kept_shots(directory, file_name, None, None)
+        except OSError as e:
+            logger.warning(f"Could not clear what {path} left beside it: {e}")
         forget_workspace_usage()
         return {
             "name": relative,
diff --git a/dw/server/routes/gallery.py b/dw/server/routes/gallery.py
index eb7778f4..947e4366 100644
--- a/dw/server/routes/gallery.py
+++ b/dw/server/routes/gallery.py
@@ -12,7 +12,7 @@
 from typing import Optional
 from urllib.parse import quote
 
-from fastapi import APIRouter, Depends, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import JSONResponse
 
 from ..api_models import (
@@ -20,6 +20,14 @@
     OutputDeleted,
 )
 from ...media import probe_media
+from ...notes import (
+    NOTES_FILE_NAME,
+    drop_file_note,
+    effective_note,
+    read_notes,
+    read_starred,
+)
+from ...roles import ROLES
 from ...runs import (
     MANIFEST_FILE_NAME,
     REALIZED_FILE_NAME,
@@ -39,7 +47,11 @@
     archive_selection,
     iter_gallery_files,
     resolve_output_file,
+    run_directory,
+    consumed_in,
+    listed_file_role,
     served_url,
+    split_run_name,
     strip_output_prefix,
 )
 
@@ -51,10 +63,12 @@
 # about itself. A run whose directory holds nothing else is an orphan
 # (see _iter_orphan_runs, #170) whatever shape its output would have had.
 # job.json is what an export bundle writes, listed defensively.
-RUN_BOOKKEEPING_FILES = frozenset({MANIFEST_FILE_NAME, REALIZED_FILE_NAME, "job.json"})
+RUN_BOOKKEEPING_FILES = frozenset(
+    {MANIFEST_FILE_NAME, REALIZED_FILE_NAME, "job.json", NOTES_FILE_NAME}
+)
 
 
-def _gallery_entries(root, ws):
+def _gallery_entries(root, ws, consumed=frozenset()):
     entries = []
     try:
         files = list(iter_gallery_files(root))
@@ -64,6 +78,9 @@ def _gallery_entries(root, ws):
     # a run of fifty files would otherwise re-read the same manifests
     # fifty times
     versions_by_folder = {}
+    # And one read of each run's notes.json, for the same reason
+    notes_by_run = {}
+    starred_by_run = {}
 
     def _version(folder, run_id):
         if not run_id:
@@ -111,6 +128,23 @@ def _version(folder, run_id):
             "mtime": stat.st_mtime,
             "label": label,
         }
+        # None under the flat layout, and for a file no manifest lists
+        split = split_run_name(root, relative_name) if run_id else None
+        entry["role"] = (
+            listed_file_role(split[0], split[1], relative_name in consumed)
+            if split
+            else None
+        )
+        if split:
+            if split[0] not in notes_by_run:
+                notes_by_run[split[0]] = read_notes(split[0])
+            note = effective_note(notes_by_run[split[0]], split[1])[0]
+            if note:
+                entry["note"] = note
+            if split[0] not in starred_by_run:
+                starred_by_run[split[0]] = read_starred(split[0])
+            if split[1] in starred_by_run[split[0]]:
+                entry["starred"] = True
         absolute_url = absolute_served_url(output_path, ws, int(stat.st_mtime))
         if absolute_url is not None:
             entry["absolute_url"] = absolute_url
@@ -164,6 +198,7 @@ def _orphan_entries(root):
     "/api/gallery", response_model=GalleryList, response_model_exclude_unset=True
 )
 def gallery(
+    request: Request,
     limit: int = 200,
     offset: int = 0,
     folder: Optional[str] = None,
@@ -171,6 +206,7 @@ def gallery(
     only_orphans: bool = False,
     version: Optional[int] = None,
     media: bool = False,
+    role: Optional[list[str]] = Query(None),
     ws: Workspace = Depends(selected_workspace),
 ):
     """A page of media files in the output directory, newest first.
@@ -205,7 +241,20 @@ def gallery(
     by, since size and mtime are misleading proxies for length (#356).
     Off by default and bounded by `limit`: only the page actually
     returned is probed, not the whole listing, so the cost of asking
-    stays proportional to the page size rather than the library size."""
+    stays proportional to the page size rather than the library size.
+
+    Each entry carries `role`, `final` or `intermediate` (null for a
+    flat-layout file or one no manifest lists); a file a later run read
+    lists as intermediate unless its step declared it final
+    (dw/roles.py rule 4). `role` is a repeatable
+    filter; a null role counts as final. Omitted, every file is listed."""
+    if role:
+        unknown = sorted(set(role) - set(ROLES))
+        if unknown:
+            raise HTTPException(
+                status_code=400,
+                detail=f"unknown role {unknown}; roles are {list(ROLES)}",
+            )
     if only_orphans:
         entries = _orphan_entries(ws.outputs)
         offset = max(0, offset)
@@ -222,7 +271,8 @@ def gallery(
                 "workspace": ws.name,
             }
         )
-    entries = _gallery_entries(ws.outputs, ws)
+    # Read once for the listing: which files a later run read (#928)
+    entries = _gallery_entries(ws.outputs, ws, consumed_in(request.app.state, ws))
     folders = sorted({e["folder"] for e in entries} | {""})
     subfolders = sorted({e["subfolder"] for e in entries} | {""})
     if folder is not None:
@@ -231,6 +281,9 @@ def gallery(
         entries = [e for e in entries if e["subfolder"] == subfolder]
     if version is not None:
         entries = [e for e in entries if e["version"] == version]
+    if role:
+        wanted = set(role)
+        entries = [e for e in entries if (e.get("role") or "final") in wanted]
     offset = max(0, offset)
     limit = max(0, limit)
     page = entries[offset : offset + limit]
@@ -274,7 +327,7 @@ def archive_outputs(
 
 # What a run directory holds besides its media: the engine writes them to
 # describe the run, and the gallery - which lists media - never shows them
-RUN_SIDECARS = (MANIFEST_FILE_NAME, REALIZED_FILE_NAME)
+RUN_SIDECARS = (MANIFEST_FILE_NAME, REALIZED_FILE_NAME, NOTES_FILE_NAME)
 
 
 def _prune_empty_run_directory(name, root):
@@ -324,25 +377,6 @@ def _prune_empty_run_directory(name, root):
     return run_id
 
 
-def _run_directory(name, root):
-    """The run directory `<identity>/<run id>` names, or None.
-
-    A run that failed before it wrote anything still has a directory and a
-    manifest, and no gallery name addresses it - so the name of the
-    directory itself is the only handle there can be (#134).
-    """
-    parts = [part for part in (name or "").split("/") if part]
-    if not parts or not is_run_id(parts[-1]):
-        return None
-    try:
-        path = validate_path(
-            os.path.join(root, "/".join(parts)), root, allow_create=False
-        )
-    except SecurityError:
-        return None
-    return path if os.path.isdir(path) else None
-
-
 @router.delete(
     "/api/gallery/{name:path}",
     response_model=OutputDeleted,
@@ -359,7 +393,7 @@ def delete_output(
     on a run that failed before it wrote any media (#134).
     """
     name = strip_output_prefix(name)
-    run_dir = _run_directory(name, ws.outputs)
+    run_dir = run_directory(name, ws.outputs)
     if run_dir is not None:
         return {
             "name": name,
@@ -370,6 +404,17 @@ def delete_output(
     path = resolve_output_file(request.app.state, name, ws.outputs)
     os.remove(path)
     logger.info(f"Deleted output file {name}")
+    split = split_run_name(ws.outputs, name)
+    if split is not None:
+        # The note describes the file; it goes with it. Best effort: the file
+        # is already gone, so a note that cannot be rewritten is not a failure
+        try:
+            note_dir = validate_path(split[0], ws.outputs, allow_create=False)
+            drop_file_note(note_dir, split[1])
+        except SecurityError:
+            pass
+        except OSError as e:
+            logger.warning(f"Could not drop the note for {name}: {e}")
     swept = _prune_empty_run_directory(name, ws.outputs)
     forget_workspace_usage()
     return {"name": name, "deleted": True, "run_swept": swept}
diff --git a/dw/server/routes/jobs.py b/dw/server/routes/jobs.py
index 9cf4a37a..cfb4c277 100644
--- a/dw/server/routes/jobs.py
+++ b/dw/server/routes/jobs.py
@@ -42,6 +42,7 @@
     JobRequest,
     ValidatorFailure,
     acknowledgement_form,
+    admitted_note,
     admit_for,
     bound_plan_for,
     check_bound_acknowledgement,
@@ -60,6 +61,7 @@
     workspace_for,
 )
 from ..exports import export_job
+from ..host_ram_need import host_memory_block
 from ..http_security import query_token_ok
 from ..job_record import (
     ACK_BOUND,
@@ -74,6 +76,7 @@
     delete_run_directory,
     output_kinds,
     served_url,
+    with_run_state,
 )
 
 logger = logging.getLogger("dw")
@@ -120,6 +123,7 @@ def submit_job(
     the body wins when both are given."""
     state = http_request.app.state
     manager = http_request.app.state.job_manager
+    note = admitted_note(request.note)
     try:
         workspace = workspace_for(state, request.workspace or ws.name)
         resolved, source = resolve_workflow_reference(
@@ -148,6 +152,9 @@ def submit_job(
                 if form == ACK_BOUND
                 else None
             ),
+            # Whose runs project its host-RAM peak (#869)
+            catalog_name=catalog_name_for(resolved, source),
+            history_workspace=(workspace.name if source and source.writable else None),
         )
         # Refuses what admission refused, and a job too big for every card
         manager.check_fits(admission)
@@ -192,6 +199,8 @@ def submit_job(
             warnings=admission.warnings,
             # What a card must hold to run it: the pool dispatches on it
             vram_need=admission.vram_need,
+            host_ram_need=admission.host_ram_need,
+            note=note,
         )
         return manager.describe(job)
     except HTTPException:
@@ -231,17 +240,9 @@ def list_jobs(
                 detail=f"Unknown job status {', '.join(unknown)} - one of "
                 f"{', '.join((QUEUED, RUNNING, *TERMINAL_STATES))}",
             )
-    jobs = manager.list(workspace=workspace, statuses=statuses)
-    total = len(jobs)
-    if limit is not None:
-        if limit < 0:
-            raise HTTPException(status_code=400, detail="limit must not be negative")
-        # the newest are the interesting ones, and the list is oldest
-        # first - so the cut comes off the front, not the back. max(0, ...)
-        # because a limit above what matched is no cut at all: a bare
-        # negative start would be read from the end instead, and answer a
-        # limit of 12 against 9 matching jobs with the last 3 of them
-        jobs = jobs[max(0, len(jobs) - limit) :] if limit else []
+    if limit is not None and limit < 0:
+        raise HTTPException(status_code=400, detail="limit must not be negative")
+    jobs, total = manager.list_page(workspace=workspace, statuses=statuses, limit=limit)
     return {"jobs": jobs, "total": total}
 
 
@@ -260,6 +261,13 @@ def get_job(request: Request, job_id: str):
     # field of its own, or get_job_workflow's, so it is not served
     detail = job if isinstance(job, dict) else manager.describe(job)
     detail = {key: value for key, value in detail.items() if key != "spec"}
+    # The run as it stands now: its current note, and once it has ended
+    # each entry's role - the engine records none on a running manifest
+    location = manager.run_location(job_id)
+    if location is not None:
+        detail = with_run_state(
+            detail, *location, roles=detail.get("status") in TERMINAL_STATES
+        )
     return {**detail, "output_kinds": output_kinds(detail.get("manifest"))}
 
 
@@ -427,6 +435,7 @@ def rerun_job(request: Request, job_id: str, body: RerunRequest = RerunRequest()
             plan_for=(
                 bound_plan_for(arguments, workspace) if form == ACK_BOUND else None
             ),
+            catalog_name=spec.get("catalog_name"),
         )
         # Refuses what admission refused, and a job too big for every card
         manager.check_fits(admission)
@@ -451,6 +460,7 @@ def rerun_job(request: Request, job_id: str, body: RerunRequest = RerunRequest()
             arguments=arguments,
             admitted=admission.workflow,
             vram_need=admission.vram_need,
+            host_ram_need=admission.host_ram_need,
         )
         if job is None:
             raise HTTPException(status_code=404, detail="Unknown job")
@@ -837,6 +847,8 @@ def validate_workflow(
             # "check the document", explicit is "check a run with these
             # arguments" (#364)
             supplied="arguments" in request.model_fields_set,
+            catalog_name=catalog_name,
+            history_workspace=(workspace.name if source and source.writable else None),
             plan_for=lambda candidate, vram_need: _validation_plan(
                 state,
                 candidate,
@@ -907,6 +919,11 @@ def validate_workflow(
         answer["checked_arguments"] = sorted(request.arguments)
     answer["plan"] = admission.plan
     if answer["plan"]:
+        # What host RAM this run is projected to hold at its peak, and
+        # from what (#869); no key when there is no figure
+        host_memory = host_memory_block(admission.host_ram_need)
+        if host_memory:
+            answer["plan"]["host_memory"] = host_memory
         # cached_steps is 0 both when nothing hit and when the probe ran
         # against the wrong workspace's output root (#184) - echoing
         # what it was actually probed against turns the second case
@@ -931,14 +948,18 @@ def _inherited_cost_warnings(estimate):
     """A price inherited from a catalog template's runs (#797) is an
     approximation; say so, and name what this workflow sets differently
     from the template. Warns and never refuses."""
+    if isinstance(estimate, dict) and estimate.get("withheld"):
+        return [f"cost estimate withheld: {estimate['withheld']}"]
     if not isinstance(estimate, dict) or estimate.get("basis") != "inherited":
         return []
     differs = estimate.get("differs") or []
     return [
         f"cost estimate is inherited from this box's runs of {estimate.get('inherited_from')} "
         "(same pipeline), not of this workflow"
+        + (f"; {estimate['scaled']}" if estimate.get("scaled") else "")
         + (
-            f"; its {', '.join(differs)} differ from that template, so the real cost may too"
+            f"; its {', '.join(differs)} {'differs' if len(differs) == 1 else 'differ'}"
+            " from that template, so the real cost may too"
             if differs
             else ""
         )
diff --git a/dw/server/routes/library.py b/dw/server/routes/library.py
index b17c70ba..62777d31 100644
--- a/dw/server/routes/library.py
+++ b/dw/server/routes/library.py
@@ -27,6 +27,7 @@
     WorkflowDeleted,
     WorkflowList,
     WorkflowSaved,
+    WorkspaceCopied,
     WorkspaceDeleted,
     WorkspaceInfo,
     WorkspaceList,
@@ -36,6 +37,8 @@
 from ... import references, validation
 from ...security import InvalidInputError, SecurityError, validate_prompt_reference
 from ...workflow import Workflow
+from ...workspace_copy import CopyRefused, copy_between
+from ...notes import read_workspace_note
 from ...library import (
     builtin_root,
     ReadOnlyLibraryError,
@@ -68,6 +71,7 @@
 from ..catalog_shape import derive_catalog_metadata, project_listing
 from ..deps import (
     internal_error,
+    lora_index,
     observed_for_name,
     server_prompt_library,
     writable_prompt_directory,
@@ -114,6 +118,9 @@ def list_workspaces(request: Request):
         # workspace_usage - a listing is a glance, and a job writing
         # into outputs moves the number continuously anyway
         entry["usage"] = workspace_usage(space)
+        note = read_workspace_note(space.root) if space.root else None
+        if note:
+            entry["note"] = note
         described.append(entry)
     return {
         "workspace_root": root.root if root else None,
@@ -144,6 +151,95 @@ def add_workspace(http_request: Request, request: WorkspaceRequest):
     return created.describe()
 
 
+class WorkspaceCopyRequest(BaseModel):
+    source: Optional[str] = Field(
+        default=None, description="Workspace to copy from; the default when omitted"
+    )
+    runs: list[str] = Field(
+        default_factory=list,
+        description="`<workflow>/<run id>` entries, or a bare `<workflow>` for "
+        "all its runs",
+    )
+    assets: list[str] = Field(
+        default_factory=list,
+        description="Asset-library files or folders, as written after `asset:` "
+        "(`proj/clip.mp4`, `proj/`); each keeps its library-relative path",
+    )
+
+
+def _copy_side(state, root, name):
+    """A workspace a copy names, by name: the default when None."""
+    if name is None or name == DEFAULT_WORKSPACE_NAME:
+        return named_workspace(
+            root, DEFAULT_WORKSPACE_NAME, prompts_root=state.prompt_dir
+        )
+    try:
+        known = name in workspace_names(root)
+    except SecurityError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    if not known:
+        raise HTTPException(status_code=404, detail=f"No such workspace: {name}")
+    try:
+        return named_workspace(root, name, prompts_root=state.prompt_dir)
+    except SecurityError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.post(
+    "/api/workspaces/{destination:path}/copy",
+    response_model=WorkspaceCopied,
+    response_model_exclude_unset=True,
+)
+def copy_into_workspace(
+    http_request: Request, destination: str, request: WorkspaceCopyRequest
+):
+    """Copy runs and asset-library entries from another workspace into this one.
+
+    Media is hard-linked where the filesystem allows, so a copy costs
+    little disk; sidecars are copied, and an asset's note and kept shots are
+    merged into the destination folder's. All or nothing: a run already
+    here, or an asset with identical bytes, is skipped as `already_present`;
+    a run whose job is still running, or a different file at an asset's
+    path, refuses the whole request (409, naming each) with nothing written.
+    A move is a copy, then `DELETE` of the source runs and assets.
+    """
+    state = http_request.app.state
+    manager = state.job_manager
+    root = workspace_root(state)
+    if not request.runs and not request.assets:
+        raise HTTPException(
+            status_code=400, detail="Name at least one run or asset to copy"
+        )
+    source_name = request.source or DEFAULT_WORKSPACE_NAME
+    if source_name == destination:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Source and destination are both '{destination}' - name "
+            f"another workspace to copy into",
+        )
+    target = _copy_side(state, root, destination)
+    source = _copy_side(state, root, source_name)
+    with manager._lock:
+        active = [
+            job.run_dir
+            for job in manager.jobs.values()
+            if job.status not in TERMINAL_STATES
+            and (job.spec.get("workspace") or DEFAULT_WORKSPACE_NAME) == source_name
+            and getattr(job, "run_dir", None)
+        ]
+    try:
+        return copy_between(
+            source, target, request.runs, request.assets, active_runs=active
+        )
+    except CopyRefused as e:
+        detail = (
+            {"message": str(e), "conflicts": e.conflicts} if e.conflicts else str(e)
+        )
+        raise HTTPException(status_code=e.status, detail=detail)
+    except (SecurityError, InvalidInputError, ValueError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
 @router.delete(
     "/api/workspaces/{name}",
     response_model=WorkspaceDeleted,
@@ -206,6 +302,7 @@ def remove_workspace(request: Request, name: str, acknowledged: bool = False):
     except (ValueError, FileNotFoundError) as e:
         raise HTTPException(status_code=400, detail=str(e))
     forget_workspace_usage()
+    manager.forget_workspace(name)
     logger.info(f"Deleted workspace {name}")
     return {"name": name, "deleted": True, "contents": contents}
 
@@ -310,7 +407,11 @@ def _write_validated(state, ws, name, definition):
     # itself failing is the server's (500), and its message may carry
     # internals the log keeps
     try:
-        errors = candidate.validation_errors()
+        # With the LoRA catalog, as the validate route checks it - a save
+        # the server would refuse to run is refused here too (#870)
+        errors = candidate.validation_errors(
+            context=validation.workflow_context(candidate, lora_index=lora_index(state))
+        )
     except Exception:
         raise internal_error("Workflow validation failed outright on save")
     if errors:
@@ -329,6 +430,9 @@ def _write_validated(state, ws, name, definition):
     warnings += validation.run_warning_check(
         candidate, "null_variable_argument_warnings", None
     )
+    # An acceleration setting that can't pay off is said where the
+    # workflow is kept, too, not only at validate and submit (#887)
+    warnings += validation.run_warning_check(candidate, "acceleration_warnings", None)
     if not metadata["summary"]:
         warnings.append(
             "No summary: add a 'description' (its first sentence becomes "
@@ -810,6 +914,7 @@ def enhance(
             workspace=ws.name,
             warnings=admission.warnings,
             vram_need=admission.vram_need,
+            host_ram_need=admission.host_ram_need,
         )
         return manager.describe(job)
     except Exception:
diff --git a/dw/server/routes/loras.py b/dw/server/routes/loras.py
index 5a97c527..ae937103 100644
--- a/dw/server/routes/loras.py
+++ b/dw/server/routes/loras.py
@@ -36,6 +36,7 @@
 )
 from ...workspace import Workspace, forget_workspace_usage
 from ..deps import (
+    catalog_entries,
     lora_library_missing,
     selected_workspace,
     server_lora_library,
@@ -59,32 +60,6 @@ def _named(name):
         raise HTTPException(status_code=404, detail=str(error))
 
 
-def catalog_entries(state):
-    """(entries, roots, library): every valid entry on the search path by
-    name, the root each came from, and the path. An unreadable or invalid
-    file is logged and skipped - one bad file must not hide the catalog."""
-    library = server_lora_library(state).existing()
-    winners, _hidden = library.entries()
-    entries, roots = {}, {}
-    for name, root in winners.items():
-        path = library.path_in(root, name)
-        if path is None:
-            continue
-        try:
-            with open(path, "r") as file:
-                entry = json.load(file)
-        except (OSError, ValueError) as error:
-            logger.warning(f"Skipping unreadable LoRA entry {name}: {error}")
-            continue
-        problem = entry_errors(entry) if isinstance(entry, dict) else "not an object"
-        if problem:
-            logger.warning(f"Skipping invalid LoRA entry {name}: {problem}")
-            continue
-        entries[name] = entry
-        roots[name] = root
-    return entries, roots, library
-
-
 def resolve_model(state, ws, model, partition=None):
     """`model` as `(repo, partition)` pairs: a catalog workflow's bases, or
     a Hub repo id taken as given. A workflow is tried first - a workflow
diff --git a/dw/server/routes/media.py b/dw/server/routes/media.py
index b42b68d8..e6bd3f4b 100644
--- a/dw/server/routes/media.py
+++ b/dw/server/routes/media.py
@@ -1,5 +1,7 @@
 """The media routes under `/api/gallery/{name:path}`: metadata, assessment,
-audio, frames, thumbnail and download of one output or asset.
+audio, frames, thumbnail and download of one output or asset - and
+`PUT /api/notes`, which sets the note on an output, a run, an asset or a
+workspace (dw/notes.py holds the stores).
 
 Registered before the gallery router, so these GETs sit ahead of the greedy
 `DELETE /api/gallery/{name:path}`, as they always have. `video_shape` is looked
@@ -10,17 +12,33 @@
 import io
 import mimetypes
 import os
-from typing import Literal, Optional
+from typing import Literal, Optional, Union
 
 import av
 from PIL import Image
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import FileResponse, Response
+from pydantic import BaseModel, Field
 
 from ..api_models import (
     GalleryMetadata,
+    NoteSet,
+    StarSet,
 )
 from ...assets import is_asset_reference
+from ...library import ReadOnlyLibraryError
+from ...notes import (
+    MAX_NOTE_LENGTH,
+    NoteTooLong,
+    clean_note,
+    effective_note,
+    read_notes,
+    set_file_note,
+    set_file_starred,
+    set_run_note,
+    set_workspace_note,
+)
+from ...references import ASSET, WORKSPACE, is_ref, ref_name
 from ...media import (
     MAX_INLINE_AUDIO_BYTES,
     NoSoundtrack,
@@ -31,6 +49,7 @@
     projected_wav_base64_size,
     video_shape,
 )
+from ... import media_compare
 from ...media_frames import (
     contact_sheet,
     first_frame,
@@ -40,10 +59,21 @@
 )
 from ...writers import read_embedded_metadata
 from ...runs import kept_provenance, recorded_shots, shots_beside
-from ...security import MAX_DECODE_PIXELS
-from ...workspace import Workspace
+from ...security import (
+    MAX_DECODE_PIXELS,
+    SecurityError,
+    validate_asset_reference,
+    validate_path,
+)
+from ...workspace import DEFAULT_WORKSPACE_NAME, Workspace
 from ..assess import assess, level_findings, unknown_probe
-from ..deps import selected_workspace
+from ..deps import (
+    asset_library_missing,
+    internal_error,
+    selected_workspace,
+    workspace_for,
+    workspace_root,
+)
 from ..http_security import query_token_ok
 from ..inline_media import (
     encode_within_budget,
@@ -57,7 +87,13 @@
     asset_file,
     job_provenance,
     resolve_output_file,
+    run_directory,
+    consumed_in,
+    listed_file_role,
+    run_inputs,
     strip_output_prefix,
+    validated_run_split,
+    workspace_asset_library,
 )
 
 router = APIRouter()
@@ -76,6 +112,7 @@ def gallery_metadata(
     name: str,
     envelope: bool = False,
     interval_seconds: float = 1.0,
+    include_workflow: bool = True,
     ws: Workspace = Depends(selected_workspace),
 ):
     """Generation metadata embedded in a saved image ('workflow' inside
@@ -98,6 +135,12 @@ def gallery_metadata(
     refused (422) with the interval that fits; the default width is
     never refused for length (#823).
 
+    An image's `media` is its measured `{kind, width, height, mode}`,
+    read from the file header (#922) - not the width/height arguments
+    the pipeline was asked for. `include_workflow=false` drops the
+    embedded `metadata.workflow` (the whole definition, often 20 KB) and
+    leaves the rest of `metadata` with `workflow_omitted: true`.
+
     `name` may also be an 'asset:' reference, and then it is the input
     asset of that name that is described rather than an output (#127).
     The numbers here - duration, frame count, fps, sample rate - are
@@ -114,17 +157,34 @@ def gallery_metadata(
     back the same way it reads a kept file's shots (#556). `run_id`/
     `version` are that source run's own - `job.id` is still the one to
     pass `get_job_workflow`, since a pruned run leaves no `workflow.json`
-    of its own to reopen."""
+    of its own to reopen. `inputs` is the source run's too (#902)."""
     run_id, version = "", None
+    role, inputs = None, None
+    notes = {}
     name = strip_output_prefix(name)
     if is_asset_reference(name):
         path = asset_file(request.app.state, name, ws)
         source, job = "asset", None
+        # An asset's note is its own entry in its directory's notes.json;
+        # an asset library has no runs, so no run note
+        own = read_notes(os.path.dirname(path))["files"].get(os.path.basename(path))
+        if own:
+            notes = {"note": own, "note_source": "file"}
         kept = kept_provenance(path)
         if kept:
             job = kept.get("job")
+            if (
+                job
+                and job.get("id")
+                and (request.app.state.job_manager.get(job["id"]) is None)
+            ):
+                # Pruned from history (the cap, or a deleted workspace):
+                # the id is a record, not something get_job_workflow can
+                # open, so the stale status is not reported as current (#918)
+                job = {**job, "status": "forgotten"}
             run_id = kept.get("run_id") or ""
             version = kept.get("version")
+            inputs = kept.get("inputs") or None
     else:
         path = resolve_output_file(request.app.state, name, ws.outputs)
         source = "output"
@@ -133,17 +193,41 @@ def gallery_metadata(
         # call, so it confirms the right file was reached rather than
         # sending the caller back to the listing
         job, run_id, version = job_provenance(request.app.state, name, ws)
+        # Split the validated path, not the raw route parameter, so the
+        # run directory the manifest is read from is a validator's output
+        split = validated_run_split(ws.outputs, path)
+        if split:
+            # The role the listing shows: demoted once a later run read
+            # the file (#928)
+            relative = os.path.relpath(path, os.path.realpath(ws.outputs))
+            consumed = relative.replace(os.sep, "/") in consumed_in(
+                request.app.state, ws
+            )
+            role = listed_file_role(split[0], split[1], consumed)
+            inputs = run_inputs(split[0])
+            notes = _note_fields(read_notes(split[0]), split[1])
     metadata = read_embedded_metadata(path)
+    if metadata is not None and not include_workflow and "workflow" in metadata:
+        metadata = {
+            **{k: v for k, v in metadata.items() if k != "workflow"},
+            "workflow_omitted": True,
+        }
     extension = os.path.splitext(path)[1].lower()
+    kind = MEDIA_KINDS.get(extension)
     try:
-        media = (
-            probe_media(path, envelope=envelope, interval_seconds=interval_seconds)
-            if MEDIA_KINDS.get(extension) in ("audio", "video")
-            else None
-        )
+        if kind in ("audio", "video"):
+            media = probe_media(
+                path, envelope=envelope, interval_seconds=interval_seconds
+            )
+        elif kind == "image":
+            media = _image_media(path)
+        else:
+            media = None
     except ValueError as error:
         raise HTTPException(status_code=422, detail=str(error)) from error
-    if media is not None and source == "output":
+    if kind == "image":
+        pass  # no shots in a still
+    elif media is not None and source == "output":
         # Where each shot of a joined video sits, as the run that wrote
         # it recorded (dw/shots.py) - null for a file not joined from shots
         media["shots"] = recorded_shots(ws.outputs, name)
@@ -161,9 +245,38 @@ def gallery_metadata(
         "version": version,
         "media": media,
         "findings": level_findings(media),
+        "role": role,
+        "inputs": inputs,
+        **notes,
     }
 
 
+def _image_media(path):
+    """An image's `media` block - kind, pixel size and mode - read from
+    the header alone, so no pixel is decoded; None for a file Pillow cannot
+    read (#922)."""
+    from PIL import Image
+
+    try:
+        with Image.open(path) as image:
+            return {
+                "kind": "image",
+                "width": image.width,
+                "height": image.height,
+                "mode": image.mode,
+            }
+    except (OSError, ValueError, SyntaxError):
+        return None
+
+
+def _note_fields(notes, name):
+    """The metadata route's note keys for file `name` of a run, each only
+    when set."""
+    note, source = effective_note(notes, name)
+    fields = {"note": note, "note_source": source, "run_note": notes["run"]}
+    return {key: value for key, value in fields.items() if value}
+
+
 @router.get("/api/gallery/{name:path}/assess")
 def gallery_assess(
     request: Request,
@@ -529,6 +642,123 @@ def _encoded_tile(tile, image):
     return encoded
 
 
+class CompareRequest(BaseModel):
+    names: list[str] = Field(
+        description="2 to 8 outputs (or `asset:` references), one row each"
+    )
+    at: Optional[list[Union[float, str]]] = Field(
+        None,
+        description='1 to 8 moments - seconds, or "frame:N" - read at the same '
+        "frame number in every output; default 4 evenly spaced frames",
+    )
+    crop: Optional[Union[list[int], list[list[int]]]] = Field(
+        None,
+        description="[x, y, width, height] in source pixels, the region shown "
+        "and measured; or one box per name, shown only",
+    )
+    baseline: Optional[str] = Field(
+        None,
+        description="The output the others are measured against; default the first",
+    )
+    max_dimension: int = Field(384, description="Longest side of each grid cell")
+    max_total_bytes: Optional[int] = Field(
+        None, description="A budget on the grid's base64 size"
+    )
+
+
+def _compare_source(state, ws, name):
+    """One output of a comparison, resolved and opened: a still decoded
+    (413/422 as `open_bounded` refuses), a video's shape read."""
+    name = strip_output_prefix(name)
+    if is_asset_reference(name):
+        path = asset_file(state, name, ws)
+    else:
+        path = resolve_output_file(state, name, ws.outputs)
+    kind = MEDIA_KINDS.get(os.path.splitext(path)[1].lower())
+    if kind == "image":
+        return {"name": name, "kind": kind, "image": open_bounded(path, name)}
+    if kind != "video":
+        raise HTTPException(
+            status_code=400, detail=f"{name} is not an image or a video"
+        )
+    try:
+        shape = video_shape(path)
+    except (av.FFmpegError, ValueError) as e:
+        raise HTTPException(
+            status_code=422, detail=f"{name} could not be decoded as a video: {e}"
+        )
+    if shape["width"] * shape["height"] > MAX_DECODE_PIXELS:
+        raise HTTPException(
+            status_code=413,
+            detail=f"{name} is {shape['width']}x{shape['height']}, more than the "
+            f"{MAX_DECODE_PIXELS:,} pixels a frame is decoded from",
+        )
+    return {"name": name, "kind": kind, "path": path, "shape": shape}
+
+
+@router.post("/api/gallery/compare")
+def gallery_compare(
+    request: Request, body: CompareRequest, ws: Workspace = Depends(selected_workspace)
+):
+    """Two to eight outputs side by side at the same moments, and how far
+    each is from a baseline (#871): one grid, a row per output and a
+    column per moment, plus PSNR, SSIM and mean absolute difference per
+    non-baseline output at source resolution. Moments resolve to one
+    frame index against the baseline (or the first video) and every
+    output is read at that frame; one past an output's end is a blank
+    cell. A single `crop` is the region shown and measured; one box per
+    name is shown only, and the metrics stay on the full frame. Outputs
+    of different sizes get no metrics, and say why. Stills join a video
+    comparison as the same image in every column. `max_total_bytes`
+    shrinks the whole grid, and `downscaled_to` says to what."""
+    try:
+        baseline_row, crop_mode = media_compare.check_request(
+            body.names, body.at, body.crop, body.baseline
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    state = request.app.state
+    sources = [_compare_source(state, ws, name) for name in body.names]
+    limit = max(1, int(body.max_dimension))
+    try:
+        answer = media_compare.compare(
+            sources, body.at, body.crop, baseline_row, crop_mode, limit
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    except media_compare.UnreadableMedia as e:
+        raise HTTPException(status_code=422, detail=str(e))
+
+    grid = answer.pop("grid")
+    downscaled_to = None
+    if body.max_total_bytes is not None:
+        # Each cell kept at least FRAME_MIN_DIMENSION on its longest side
+        # however far the budget shrinks the grid
+        cells = max(len(sources), len(answer["columns"]))
+        longest = max(grid.size)
+        (grid,), downscaled_to = fit_tiles_within_budget(
+            [grid], longest, body.max_total_bytes, floor=FRAME_MIN_DIMENSION * cells
+        )
+        if downscaled_to is not None and max(grid.size) >= longest:
+            # Already at the floor: shrinking further would not leave a
+            # cell legible, so the grid goes over budget and says so
+            downscaled_to = None
+            answer["notes"].append(
+                "over `max_total_bytes`: the grid is already as small as it "
+                "can be and stay legible"
+            )
+    return {
+        "image": {
+            "data": base64.b64encode(png_bytes(grid)).decode("ascii"),
+            "mime_type": "image/png",
+            "width": grid.width,
+            "height": grid.height,
+        },
+        "downscaled_to": downscaled_to,
+        **answer,
+    }
+
+
 @router.get("/api/gallery/{name:path}/image")
 @query_token_ok
 def gallery_image(
@@ -673,3 +903,150 @@ def download_output(
     """Serve one output file as a forced download rather than an inline view."""
     path = resolve_output_file(request.app.state, name, ws.outputs)
     return FileResponse(path, filename=os.path.basename(name))
+
+
+class NoteRequest(BaseModel):
+    target: str = Field(
+        description="What the note is on: a gallery file name, a run directory "
+        "`<identity>/<run id>`, `asset:<name>` or `workspace:<name>`"
+    )
+    note: Optional[str] = Field(
+        default=None,
+        description=f"At most {MAX_NOTE_LENGTH} characters; null or '' clears it",
+    )
+
+
+def _workspace_note_target(state, name):
+    """The root a `workspace:<name>` target writes workspace.json into."""
+    if not name:
+        raise HTTPException(
+            status_code=400, detail="Name a workspace: workspace:<name>"
+        )
+    if name == DEFAULT_WORKSPACE_NAME:
+        root = state.default_workspace.root
+        if not root:
+            raise HTTPException(
+                status_code=409,
+                detail="This server has no workspace root, so the default "
+                "workspace has nowhere to keep a note",
+            )
+        return root
+    # 400 for a name a workspace cannot take, 404 for one that is not there
+    selected = workspace_for(state, name)
+    try:
+        return validate_path(
+            selected.root, workspace_root(state).root, allow_create=False
+        )
+    except SecurityError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+def _asset_note_target(state, ws, name):
+    """(directory, file name) of the asset an `asset:<name>` target names -
+    resolved the way the asset delete resolves it, read-only roots refused."""
+    library = workspace_asset_library(state, ws)
+    if not library.roots():
+        raise asset_library_missing()
+    try:
+        relative = validate_asset_reference(name)
+    except SecurityError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    found = library.find(relative)
+    if not found:
+        raise HTTPException(status_code=404, detail=f"No such asset: {relative}")
+    path, root = found
+    try:
+        library.require_writable(root, relative)
+    except ReadOnlyLibraryError as refusal:
+        raise HTTPException(status_code=403, detail=str(refusal))
+    return os.path.dirname(path), os.path.basename(path)
+
+
+def resolve_note_target(state, ws, target):
+    """(directory, name, kind) for a note target, kind one of "workspace",
+    "run" and "file" (an asset is a file in its library directory). Every
+    directory is a validator's return value against a non-None root, or the
+    server's own configured default root. Raises the route's 400/403/404/409.
+    """
+    if is_ref(WORKSPACE, target):
+        name = ref_name(WORKSPACE, target).strip()
+        return _workspace_note_target(state, name), None, "workspace"
+    if is_asset_reference(target):
+        name = ref_name(ASSET, target).strip()
+        directory, file_name = _asset_note_target(state, ws, name)
+        return directory, file_name, "file"
+    name = strip_output_prefix(target)
+    run_dir = run_directory(name, ws.outputs)
+    if run_dir is not None:
+        return run_dir, None, "run"
+    path = resolve_output_file(state, name, ws.outputs)
+    split = validated_run_split(ws.outputs, path)
+    if split is None:
+        raise HTTPException(
+            status_code=409,
+            detail=f"{name} is not in a run directory, and notes need a run directory",
+        )
+    return split[0], split[1], "file"
+
+
+@router.put("/api/notes", response_model=NoteSet, response_model_exclude_unset=True)
+def put_note(
+    request: Request, body: NoteRequest, ws: Workspace = Depends(selected_workspace)
+):
+    """Set or clear the note on a run, a file, an asset or a workspace.
+
+    `target` is a gallery file name (that file's own note), a run directory
+    `<identity>/<run id>` (the run note every file of the run falls back to),
+    `asset:<name>` or `workspace:<name>` ('default' for the root's own). The
+    answer is the target's effective note after the write: a file with no
+    note of its own answers with its run's, and `note_source` says which.
+    """
+    try:
+        note = clean_note(body.note)
+    except (NoteTooLong, TypeError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    directory, name, kind = resolve_note_target(request.app.state, ws, body.target)
+    try:
+        if kind == "workspace":
+            stored, source = set_workspace_note(directory, note), None
+        elif kind == "run":
+            stored, source = set_run_note(directory, note), "run"
+        else:
+            set_file_note(directory, name, note)
+            stored, source = effective_note(read_notes(directory), name)
+    except OSError:
+        raise internal_error(f"Could not write the note on {body.target!r}")
+    return {
+        "target": body.target,
+        "note": stored,
+        "note_source": source if stored else None,
+    }
+
+
+class StarRequest(BaseModel):
+    name: str = Field(description="A gallery file name")
+    starred: bool
+
+
+@router.put("/api/stars", response_model=StarSet)
+def put_star(
+    request: Request, body: StarRequest, ws: Workspace = Depends(selected_workspace)
+):
+    """Star or unstar one output file - the "keep" mark a person culls a run
+    with. It lives in the run's notes.json beside the notes, so it is
+    resolved exactly as a file note is, and only a file in a run directory
+    can carry one."""
+    if is_ref(WORKSPACE, body.name) or is_asset_reference(body.name):
+        raise HTTPException(
+            status_code=400, detail="Only an output file can be starred"
+        )
+    directory, name, kind = resolve_note_target(request.app.state, ws, body.name)
+    if kind != "file":
+        raise HTTPException(
+            status_code=400, detail="Only an output file can be starred"
+        )
+    try:
+        starred = set_file_starred(directory, name, body.starred)
+    except OSError:
+        raise internal_error(f"Could not write the star on {body.name!r}")
+    return {"name": body.name, "starred": starred}
diff --git a/dw/server/routes/system.py b/dw/server/routes/system.py
index 98470864..3a263d17 100644
--- a/dw/server/routes/system.py
+++ b/dw/server/routes/system.py
@@ -221,7 +221,7 @@ def list_downloads(request: Request):
     response_model_exclude_unset=True,
 )
 def cancel_download(request: Request, download_id: str):
-    """Request cancellation; takes effect at the next progress tick.
+    """Request cancellation; `cancel_requested` shows until it is terminal.
     Partial files stay in the cache and resume on a retry."""
     state = request.app.state
     status = state.downloads.cancel(download_id)
diff --git a/dw/shot_span_preflight.py b/dw/shot_span_preflight.py
index 659d3acc..f8956fbe 100644
--- a/dw/shot_span_preflight.py
+++ b/dw/shot_span_preflight.py
@@ -24,6 +24,8 @@
 from .media import probe_metadata
 from .probe_paths import resolve_probe_path
 from .references import iter_steps
+from .script_lines import parse_lines, shot_names_error
+from .runs import shots_beside
 
 PROBE_COMMANDS = ("analyze_shots", "analyze_seams", "analyze_sync_drift")
 
@@ -103,4 +105,45 @@ def shot_span_warnings(
     return warnings
 
 
-__all__ = ["shot_span_warnings"]
+def script_shot_name_errors(workflow_definition, source_indices=None, base_dir=None):
+    """Every `check_script` step with a literal `lines` entry naming a shot
+    that the shot map recorded beside its statically-resolvable `audio`
+    (a manifest, via `shots_beside`) does not hold, as [{path, message}]
+    (#873). The run refuses the same line with the same message, but only
+    after queueing and loading Whisper. A `shots` argument, a
+    `previous_result:` audio or an unreadable manifest is left to the run."""
+    errors = []
+    for _, _, task, source, where in iter_steps(
+        workflow_definition.get("steps"), source_indices, "task"
+    ):
+        if task.get("command") != "check_script":
+            continue
+        task_args = task.get("arguments")
+        if not isinstance(task_args, dict) or task_args.get("shots"):
+            continue
+        try:
+            parsed_lines = parse_lines(task_args.get("lines"))
+        except ValueError:
+            continue  # task_argument_errors reports a malformed `lines`
+        if not any(line["shot"] for line in parsed_lines):
+            continue
+        path = resolve_probe_path(task_args.get("audio"), base_dir, "an audio argument")
+        if path is None:
+            continue
+        records = shots_beside(path)
+        if not records:
+            continue
+        refusal = shot_names_error(parsed_lines, records, "manifest")
+        if refusal:
+            errors.append(
+                {
+                    "path": render_path(
+                        ("steps", source, "task", "arguments", "lines")
+                    ),
+                    "message": f"{refusal}{where}",
+                }
+            )
+    return errors
+
+
+__all__ = ["script_shot_name_errors", "shot_span_warnings"]
diff --git a/dw/shots.py b/dw/shots.py
index bfa0e31c..a0a44986 100644
--- a/dw/shots.py
+++ b/dw/shots.py
@@ -62,6 +62,7 @@
 
 import copy
 
+from .events import emit_warning
 from .for_each import is_member_name
 from .references import PREVIOUS_RESULT, ref_name
 
@@ -468,6 +469,33 @@ def duplicate_shot_names(shots):
     return duplicates or None
 
 
+def warn_shot_collisions(step_data, step_name, shots):
+    """Joined shots that share a name, said where the join made them."""
+    # Only the step that joined made the collision; a step
+    # that carries an input's shots over (pair_audio,
+    # interpolate_frames) repeats what the caller can only
+    # act on at the join (#568)
+    command = step_data.get("task", {}).get("command")
+    duplicates = None if carries_shots(command) else duplicate_shot_names(shots)
+    if not duplicates:
+        return
+    # Frames and samples stay exact either way - only a
+    # name-based lookup (a `shots=` argument, a finding)
+    # can no longer tell the collided shots apart (#508)
+    for file, names in duplicates.items():
+        extra = {"file": file} if file is not None else {}
+        emit_warning(
+            "joined shots share a name ("
+            + ", ".join(names)
+            + ") and can no longer be told apart by "
+            "name - start_frame still disambiguates.",
+            kind="shot_name_collision",
+            command=step_name,
+            names=names,
+            **extra,
+        )
+
+
 def shots_for_file(shots, path, step_files):
     """The shots of one file out of a manifest entry's `shots`, or None.
 
diff --git a/dw/step_cache.py b/dw/step_cache.py
index ca726338..da873d65 100644
--- a/dw/step_cache.py
+++ b/dw/step_cache.py
@@ -32,6 +32,15 @@
   6. the entry retained the step's Result if this run needs one - an entry
      stored for a step nothing downstream read holds only its saved_files
 
+The cache is keyed only by what can change the output (#905). A workflow's
+top-level keys never reach a key - an entry is the step alone, under the
+workflow id - so its cost, cost_drivers, vram_estimate and documentation
+move nothing here. Inside a step, `output_identity` drops the result keys
+that only label a file (NON_OUTPUT_RESULT_KEYS). A result's subfolder and
+file_base_name stay: a hit writes nothing and republishes the cached paths,
+so a run that moved either would be handed files where it did not ask for
+them.
+
 Entries are keyed by (workflow_id, step_name), not by step name alone:
 saved files are named "{workflow_id}-{step_name}.{index}", so a bare-name
 key would let a different workflow (or the same one after an id rename, or
@@ -76,6 +85,24 @@
 _generations = itertools.count(1)
 
 
+# A step result's keys that label its files without changing them or where
+# they are written: the run records a step's role from its own definition as
+# it opens (dw/roles.py role_basis), never from a cached entry. Pinned by
+# tests/test_workflow_step_cache.py::TestOutputKeys
+NON_OUTPUT_RESULT_KEYS = ("role",)
+
+
+def output_identity(step_data):
+    """`step_data` with NON_OUTPUT_RESULT_KEYS removed from its result
+    block, in place - what a step cache entry is keyed and compared on.
+    Returns `step_data`."""
+    result = step_data.get("result")
+    if isinstance(result, dict):
+        for key in NON_OUTPUT_RESULT_KEYS:
+            result.pop(key, None)
+    return step_data
+
+
 def reference_resolves_to(reference, name):
     """Whether a previous_result reference resolves to the result `name`.
 
diff --git a/dw/step_value_checks.py b/dw/step_value_checks.py
index 364befad..bedc81b9 100644
--- a/dw/step_value_checks.py
+++ b/dw/step_value_checks.py
@@ -1,4 +1,5 @@
-"""Four step-value checkers: `fps_errors` (a result's `fps`),
+"""Five step-value checkers: `fps_errors` (a result's `fps`),
+`cache_errors` (a pipeline's `cache` once a variable has substituted it),
 `null_media_errors` (a bare object description whose media resolved null),
 `select_errors` (a `select` step's arguments) and `chain_prompts_errors` (a
 chain's `prompts` that is not a list).
@@ -10,9 +11,13 @@
 in validation.py. Their only caller is the error registry there.
 """
 
+import copy
+from functools import lru_cache
+
 from . import references
 from .arguments import names_no_media
 from .for_each import render_path
+from .schema import load_schema, validate_data_all
 from .references import (
     FROM_ARGUMENTS_KEY,
     FROM_FILE_KEY,
@@ -87,6 +92,78 @@ def fps_errors(workflow_definition, source_indices=None):
     return errors
 
 
+# --- A pipeline's 'cache' once substituted (#865) ------------------------------
+#
+# The schema lets the raw document hold `cache: "variable:cache"` so a template
+# can expose the whole cache object as one argument. The raw check then never
+# sees the object the run will build, so `{"type": "bogus"}` or a bare
+# "first_block" would pass validate and fail at load. This checks the
+# substituted value against the schema's own cache object shape; a variable
+# that resolved to null has already dropped the key (dw/variables.py), which
+# is no cache.
+
+CACHE_EXAMPLE = '{"type": "first_block", "threshold": 0.05}'
+
+
+@lru_cache(maxsize=1)
+def _cache_object_schema():
+    """The schema's `cache` shape with the `variable:` string form taken out."""
+    schema = copy.deepcopy(
+        load_schema("workflow")["$defs"]["pipeline_configuration"]["properties"][
+            "cache"
+        ]
+    )
+    schema["type"] = "object"
+    schema.pop("pattern", None)
+    # A field that also takes a 'variable:' string (threshold) has been
+    # substituted by now, so only its number form is a value the run can use
+    for field in schema.get("properties", {}).values():
+        kinds = field.get("type")
+        if isinstance(kinds, list) and "string" in kinds:
+            numeric = [k for k in kinds if k in ("number", "integer")]
+            if numeric:
+                field["type"] = numeric[0] if len(numeric) == 1 else numeric
+    return schema
+
+
+def cache_errors(workflow_definition, source_indices=None):
+    """Every substituted pipeline 'cache' the run could not build, as
+    [{path, message}], each at the field it names. A for_each step's members
+    share one written path and, nearly always, one cache value: each problem
+    is said once there, naming the first member it was found in."""
+    errors = []
+    said = set()
+
+    def add(path, message, where):
+        if (path, message) not in said:
+            said.add((path, message))
+            errors.append({"path": path, "message": f"Invalid cache: {message}{where}"})
+
+    for _, _, pipeline, source, where in iter_steps(
+        workflow_definition.get("steps"), source_indices, "pipeline"
+    ):
+        configuration = pipeline.get("configuration")
+        if not isinstance(configuration, dict) or "cache" not in configuration:
+            continue
+        value = configuration["cache"]
+        if references.is_ref(references.SUBSTITUTED, value):
+            continue
+        base = ("steps", source, "pipeline", "configuration", "cache")
+        if not isinstance(value, dict):
+            add(
+                render_path(base),
+                f"{value!r} - cache is an object such as {CACHE_EXAMPLE}, "
+                f"or null for no cache",
+                where,
+            )
+            continue
+        for error in validate_data_all(value, _cache_object_schema()):
+            inner = error["path"]
+            path = render_path(base) + (f".{inner}" if inner else "")
+            add(path, error["message"], where)
+    return errors
+
+
 # --- An object description whose media resolved null (was dw/null_media.py) --
 #
 # `realize_args` builds a pipeline argument that names a type and where its
diff --git a/dw/tasks/concat_videos.py b/dw/tasks/concat_videos.py
index 133627ef..64963827 100644
--- a/dw/tasks/concat_videos.py
+++ b/dw/tasks/concat_videos.py
@@ -12,12 +12,14 @@
 
 import numpy
 
-from ..dsp import as_channels_samples
-from ..events import emit_log, emit_warning
+from ..dsp import as_channels_samples, level_dbfs
+from ..events import emit_log, emit_warning, get_context
 from ..media_types import AudioVideo
 from ..shots import measured_num_samples, nested_shots, shot_record, trimmed_shots
 from ..task_domains import frames_to_samples
+from .assess import sample_span
 from .joins import (
+    INNER_LEVEL_STEP_WARN_DB,
     bleed_join,
     equal_power_crossfade_join,
     fit_audio_to_frames,
@@ -97,7 +99,10 @@ def concat_videos(
             land 10 dB apart routinely, and that jump is the one seam
             artifact none of the fade controls can hide, because it is not
             at the seam but either side of it. Left off, a spread wide
-            enough to hear is logged as a warning
+            enough to hear is logged as a warning. Each input is levelled
+            as one unit: an input that is itself a join (it carries
+            media.shots) keeps the level steps between its own shots, and
+            one wider than 3 dB is reported as an inner_level_step warning
         match_levels_dbfs: The level match_levels moves every shot to -
             defaults to -1 dBFS for "peak" and -20 dBFS for "rms". A shot
             that would clip at the target is held at -0.5 dBFS peak instead,
@@ -122,6 +127,43 @@ def concat_videos(
         videos, match_levels, match_levels_dbfs, sample_rate
     )
 
+    frames, audio, shots = _joined_tracks(
+        videos,
+        names,
+        clips,
+        waveforms,
+        sample_rate,
+        trim_frames,
+        fps,
+        crossfade_ms,
+        audio_bleed_ms,
+        audio_bleed_gain_db,
+        seam_fade_ms,
+    )
+
+    _warn_fps_override(videos, names, fps)
+    audio, written_fps = _fitted_audio(frames, audio, sample_rate, fps, videos, shots)
+    logger.debug(f"Concatenated {len(videos)} videos into {len(frames)} frames")
+    return AudioVideo(frames, audio, sample_rate, fps=written_fps, shots=shots)
+
+
+def _joined_tracks(
+    videos,
+    names,
+    clips,
+    waveforms,
+    sample_rate,
+    trim_frames,
+    fps,
+    crossfade_ms,
+    audio_bleed_ms,
+    audio_bleed_gain_db,
+    seam_fade_ms,
+):
+    """The prepared inputs joined end to end, as (frames, audio, shots):
+    each video's frames after its head trim, its soundtrack joined at the
+    seam, and a shot record for where it landed. `audio` is None when no
+    input carries any."""
     frames, audio, audio_native_rate = [], None, None
     # Where each video landed, measured on the joined picture and track as
     # they grow - never derived from the frame count, so a track that runs
@@ -176,11 +218,7 @@ def concat_videos(
             )
             _record_seam_fade(shots[first_shot[index]], applied)
         audio_native_rate = getattr(video, "sample_rate", None)
-
-    _warn_fps_override(videos, names, fps)
-    audio, written_fps = _fitted_audio(frames, audio, sample_rate, fps, videos, shots)
-    logger.debug(f"Concatenated {len(videos)} videos into {len(frames)} frames")
-    return AudioVideo(frames, audio, sample_rate, fps=written_fps, shots=shots)
+    return frames, audio, shots
 
 
 def _record_seam_fade(shot, applied):
@@ -223,8 +261,11 @@ def _prepare_inputs(videos, match_levels, match_levels_dbfs, sample_rate):
     names, videos = load_named_inputs(videos)
     clips = [frames_as_pil_list(v) for v in videos]
     check_same_frame_size(clips, "concat_videos")
+    native = _input_waveforms(videos)
+    if match_levels:
+        _warn_inner_level_steps(videos, names, native, match_levels)
     waveforms, sample_rate = reconcile_sample_rates(
-        "concat_videos", videos, names, _input_waveforms(videos), sample_rate
+        "concat_videos", videos, names, native, sample_rate
     )
     waveforms = level_waveforms(
         "concat_videos", waveforms, match_levels, match_levels_dbfs, names
@@ -232,6 +273,44 @@ def _prepare_inputs(videos, match_levels, match_levels_dbfs, sample_rate):
     return names, videos, clips, waveforms, sample_rate
 
 
+def _warn_inner_level_steps(videos, names, waveforms, measure):
+    """Say so when match_levels levels a multi-shot input as one unit and its
+    own shots differ by more than assess_output's seam_level_step threshold (shared with it), placing
+    shots with assess.sample_span:
+    the step between them survives the join (#876)."""
+    # A later pair_audio replaces the track, so the step is never heard (#800)
+    if get_context().audio_replaced_downstream:
+        return
+    for video, name, waveform in zip(videos, names, waveforms):
+        shots = getattr(video, "shots", None)
+        if waveform is None or not shots or len(shots) < 2:
+            continue
+        levels = []
+        for shot in shots:
+            start, count, _ = sample_span(shot, video)
+            if start is None or not count:
+                continue
+            level = level_dbfs(waveform[:, start : start + count], measure)
+            if level is not None:
+                levels.append(level)
+        if len(levels) < 2:
+            continue
+        spread = max(levels) - min(levels)
+        if spread > INNER_LEVEL_STEP_WARN_DB:
+            emit_warning(
+                f"concat_videos: {name} is itself a join of {len(shots)} shots "
+                f"whose {measure} levels span {spread:.1f} dB - match_levels "
+                "levels an input as one unit, so that step survives the join. "
+                "Trim it into its shots (trim_video per media.shots entry) and "
+                "join those to level them",
+                kind="inner_level_step",
+                command="concat_videos",
+                video=name,
+                spread_db=round(spread, 1),
+                measure=measure,
+            )
+
+
 def _fitted_audio(frames, audio, sample_rate, fps, videos, shots):
     """The joined track fitted to the frame grid, with the rate the file is
     written at: (audio, written_fps). Every shot is measured against it."""
diff --git a/dw/tasks/joins.py b/dw/tasks/joins.py
index 488962c4..041ae571 100644
--- a/dw/tasks/joins.py
+++ b/dw/tasks/joins.py
@@ -507,6 +507,10 @@ def crossfade_concat(waveforms, sample_rate, crossfade_ms, starts=None):
 
 LEVEL_SPREAD_WARN_DB = 6.0
 
+# The level step between a multi-shot input's own shots that match_levels cannot
+# level (#876); assessment_rules' seam_level_step reads the same number
+INNER_LEVEL_STEP_WARN_DB = 3.0
+
 # Mirrors audio_qc.py's NEAR_SILENT_WARN_DBFS: the same mean/rms level a job's
 # own near-silent check treats as having no real content. Gaining an input
 # already this quiet up to the target raises a noise floor rather than
diff --git a/dw/tasks/loop_bed.py b/dw/tasks/loop_bed.py
index 117225b1..cd436d83 100644
--- a/dw/tasks/loop_bed.py
+++ b/dw/tasks/loop_bed.py
@@ -356,10 +356,16 @@ def _looped(segment, sample_rate, crossfade_ms, loop_seconds):
     }
 
 
-def _empty_finding(rejected, criteria):
+def _empty_finding(rejected, criteria, closest_tonal=None):
     """The one finding for a search that found nothing, naming the rule that
     threw the most out and the argument that relaxes it.
 
+    Rules tally in order, so `too_loud` counts every window above the level
+    limits, however many quiet windows then failed a later rule. Once any
+    window passed the level test, raising the level limits cannot help and
+    the dominant of the later rules is named instead. `closest_tonal` is the
+    nearest any tonal-rejected window came to the thresholds.
+
     A window that crosses a shot boundary is counted under `shot_boundary`
     alone, so the other rules tally in-shot windows only. When any in-shot
     window existed the dominant of those is named: crossing windows
@@ -369,7 +375,9 @@ def _empty_finding(rejected, criteria):
         rule = None
     else:
         in_shot = {n: c for n, c in rejected.items() if n != "shot_boundary"}
-        pool = in_shot if any(in_shot.values()) else rejected
+        quiet = {n: c for n, c in in_shot.items() if n != "too_loud"}
+        pool = quiet if any(quiet.values()) else in_shot
+        pool = pool if any(pool.values()) else rejected
         rule = max(pool, key=lambda name: pool[name])
         message = {
             "too_loud": (
@@ -396,10 +404,25 @@ def _empty_finding(rejected, criteria):
             "tonal": (
                 "every quiet window is tonal or speech-like - faint "
                 "programme that would be audible once it repeats; widen "
-                "the range"
+                "the range" + _closest_note(closest_tonal, criteria)
             ),
         }[rule]
-    return {"rule": "no_loop_bed", "rejected_by": rule, "message": message}
+    finding = {"rule": "no_loop_bed", "rejected_by": rule, "message": message}
+    if closest_tonal is not None:
+        finding["closest_tonal"] = closest_tonal
+    return finding
+
+
+def _closest_note(closest, criteria):
+    """How near the tonal-rejected windows came to the thresholds, in words."""
+    if closest is None:
+        return ""
+    return (
+        f" (nearest misses: flatness {closest['flatness']:.3f} against the "
+        f"{criteria['tonal_flatness']:g} floor, harmonicity "
+        f"{closest['harmonicity']:.3f} against the {criteria['harmonicity']:g} "
+        "ceiling, each on a different window)"
+    )
 
 
 def _coerce_arguments(shots, **raw):
@@ -523,7 +546,10 @@ def _scan_windows(
     lengths,
     args,
 ):
-    """Judge every (start, length) window; returns (survivors, rejected).
+    """Judge every (start, length) window; returns (survivors, rejected, closest).
+
+    `closest` holds the highest flatness and lowest harmonicity any
+    tonal-rejected window reached (empty with none).
 
     Vectorised per window length: every pair is judged at once and counted
     under the first rule it fails - loudness, silence, ticks, tonality - so
@@ -539,6 +565,7 @@ def _scan_windows(
     if bin_shot is not None:
         rejected["shot_boundary"] = 0
     survivors = []  # (source ripple, start bin, length in bins, readings)
+    closest = {}
     for length in range(shortest, longest + 1):
         windows = _sliding(power, length)  # (starts, length)
         loudest = windows.max(axis=1)
@@ -571,6 +598,17 @@ def _scan_windows(
             inside = _sliding(block_tonal, length - block_bins + 1)
             any_tonal |= inside[: windows.shape[0]].any(axis=1)
         tonal = ~crossing & ~loud & ~silent & ~ticked & any_tonal
+        if tonal.any():
+            rows = numpy.flatnonzero(tonal)
+            for bins, flat, harm, _ in scales:
+                flat_in = _sliding(flat, length - bins + 1)[rows]
+                harm_in = _sliding(harm, length - bins + 1)[rows]
+                closest["flatness"] = max(
+                    closest.get("flatness", 0.0), float(flat_in.min(axis=1).max())
+                )
+                closest["harmonicity"] = min(
+                    closest.get("harmonicity", 1.0), float(harm_in.max(axis=1).min())
+                )
         rejected["too_loud"] += int(loud.sum())
         rejected["silent"] += int(silent.sum())
         rejected["spike"] += int(ticked.sum())
@@ -607,7 +645,7 @@ def _scan_windows(
                     },
                 )
             )
-    return survivors, rejected
+    return survivors, rejected, closest
 
 
 def _rank_and_loop(
@@ -683,6 +721,7 @@ def _answer(
     last,
     shots_source,
     spans,
+    closest=None,
 ):
     """The command's JSON answer, with the finding when nothing was found."""
     criteria = {
@@ -697,7 +736,9 @@ def _answer(
         "max_seconds": args.max_seconds,
         "target_bed_dbfs": args.target_bed_dbfs,
     }
-    findings = [] if candidates else [_empty_finding(rejected, criteria)]
+    findings = (
+        [] if candidates else [_empty_finding(rejected, criteria, closest or None)]
+    )
     logger.info(
         f"{COMMAND}: {survivor_count} windows passed level and tick tests, "
         f"{kept_count} looped, {len(candidates)} returned; rejected {rejected}"
@@ -843,7 +884,7 @@ def find_loop_bed(
         searched, bin_length, sample_rate, bin_seconds, count, shortest, usable
     )
     edges = _edge_ticks(power, peaks, bin_threshold)
-    survivors, rejected = _scan_windows(
+    survivors, rejected, closest = _scan_windows(
         power, peaks, bin_shot, scales, edges, (shortest, longest), args
     )
     kept, candidates = _rank_and_loop(
@@ -861,4 +902,5 @@ def find_loop_bed(
         last,
         shots_source,
         spans,
+        closest,
     )
diff --git a/dw/tasks/script_check.py b/dw/tasks/script_check.py
index 1832b78f..c3c12dfd 100644
--- a/dw/tasks/script_check.py
+++ b/dw/tasks/script_check.py
@@ -42,21 +42,25 @@
 
 import difflib
 import logging
+import math
 from types import SimpleNamespace
 
 from .. import dsp
 from ..assessment_rules import DEAD_AIR_FLOOR_DBFS, finding
 from ..task_domains import check_arguments
+from ..events import emit_log
 from ..locations import is_http_url
 from ..script_lines import (
     COMMAND,
     REPEAT_MAX_PERIOD,
     REPEAT_RUN_MIN,
+    disambiguated,
     looped_texts,
     normalize_words,
     parse_lines,
     parse_shots,
     shot_names_error,
+    with_full_shot_names,
 )
 from .assess import DEAD_AIR_WINDOW, resolve_shots, sample_span
 from .audio_transcription import WHISPER_DEFAULT_MODEL
@@ -81,6 +85,17 @@
 # GUARD_FLOOR_DBFS - still voiced when the file stops, not a word that
 # finished into a quiet tail
 CLIP_TAIL_SECONDS = 0.25
+# Audible speech the transcript has no words for (#923): Whisper can drop a
+# passage from its text on a longer input (the ad-lib heard in a short file
+# is gone), and the word alignment hands that time to a neighbouring word,
+# which stretches. A gap between a line's words,
+# or a word, lasting UNHEARD_MIN_SECONDS or more, whose interior - trimmed by
+# UNHEARD_MARGIN_SECONDS each side - holds a window above UNHEARD_FLOOR_DBFS,
+# is speech the words do not account for. The floor is far above the
+# dead-air floor so room tone and a pause's tail do not trip it
+UNHEARD_MIN_SECONDS = 1.0
+UNHEARD_MARGIN_SECONDS = 0.25
+UNHEARD_FLOOR_DBFS = -40.0
 # REPEAT_RUN_MIN and REPEAT_MAX_PERIOD, the repetition-loop guard, live in
 # dw/script_lines.py beside the detector, which transcribe_audio shares
 
@@ -89,13 +104,21 @@
     "guard_floor_dbfs": GUARD_FLOOR_DBFS,
     "guard_window_seconds": GUARD_WINDOW_SECONDS,
     "clip_tail_seconds": CLIP_TAIL_SECONDS,
+    "unheard_min_seconds": UNHEARD_MIN_SECONDS,
+    "unheard_margin_seconds": UNHEARD_MARGIN_SECONDS,
+    "unheard_floor_dbfs": UNHEARD_FLOOR_DBFS,
     "repeat_run_min": REPEAT_RUN_MIN,
     "repeat_max_period": REPEAT_MAX_PERIOD,
 }
 
-LINE_RULES = ("line_mismatch", "tag_spoken", "line_clipped_at_end")
+LINE_RULES = (
+    "line_mismatch",
+    "tag_spoken",
+    "line_clipped_at_end",
+    "speech_not_transcribed",
+)
 SILENT_RULES = ("speech_where_silent",)
-SHOT_RULES = ("speech_in_silent_shot",)
+SHOT_RULES = ("speech_in_silent_shot", "unscripted_speech")
 
 
 def _rule(name, threshold, says):
@@ -118,6 +141,13 @@ def mismatch_rule(similarity):
     "a markup word from this line was heard spoken aloud - the model read the"
     " tag as dialogue",
 )
+SPEECH_NOT_TRANSCRIBED = _rule(
+    "speech_not_transcribed",
+    UNHEARD_FLOOR_DBFS,
+    "audible sound lasting this many seconds sits between the line's words, or"
+    " inside one stretched word, with no word for it - the transcript left speech"
+    " out and the line's timing absorbed it; listen",
+)
 SPEECH_WHERE_SILENT = _rule(
     "speech_where_silent",
     0,
@@ -137,6 +167,34 @@ def mismatch_rule(similarity):
     "no line names this shot, and this many words were heard in it above the"
     " dead-air floor and outside a repetition loop",
 )
+UNSCRIPTED_SPEECH = _rule(
+    "unscripted_speech",
+    0,
+    "this many words were heard inside a shot that has a scripted line, matched to"
+    " no line - a line spoken twice (see 'repeats_line'), or an ad-lib; listen",
+)
+
+
+# Whisper drops soft speech from a quiet input, so the same shot got different
+# verdicts by level (#925). The transcriber hears the take scaled so its loud
+# end sits near full scale - a take only 2 dB under that still lost a soft
+# "Uh," that +6 dB brought back; the level checks keep reading the original
+# waveform.
+TRANSCRIBE_PEAK = 0.9
+TRANSCRIBE_MAX_GAIN = 100.0  # 40 dB: a near-silent take is not boosted to noise
+
+
+def level_for_transcription(waveform):
+    """(waveform, gain) with the 99.9th-percentile magnitude scaled to
+    TRANSCRIBE_PEAK (spikes past full scale clipped); gain is 1.0 for silence."""
+    import numpy
+
+    loud = float(numpy.percentile(numpy.abs(waveform), 99.9)) if waveform.size else 0.0
+    if loud <= 0.0:
+        return waveform, 1.0
+    gain = min(TRANSCRIBE_PEAK / loud, TRANSCRIBE_MAX_GAIN)
+    leveled = numpy.clip(waveform * gain, -1.0, 1.0).astype(numpy.float32)
+    return leveled, gain
 
 
 def shot_spans(records, sample_rate, fps, duration):
@@ -460,6 +518,9 @@ def check(
             findings.extend(
                 _clipped_findings(mono, sample_rate, tails, index, own, shot)
             )
+            findings.extend(
+                _untranscribed_findings(mono, sample_rate, index, own, shot)
+            )
             previous_end = end
 
     findings.extend(_unassigned_tags(heard, unassigned, parsed_lines, expected, spans))
@@ -473,6 +534,9 @@ def check(
     if no_shot is None:
         rules_applied.extend(SHOT_RULES)
         findings.extend(_silent_shot_findings(spans, parsed_lines, heard, claimed))
+        findings.extend(
+            _unscripted_findings(spans, parsed_lines, expected, heard, unassigned)
+        )
     else:
         rules_skipped.extend({"rule": rule, "reason": no_shot} for rule in SHOT_RULES)
 
@@ -523,6 +587,40 @@ def _silent_take(heard, discarded, spans, shots_source):
     }
 
 
+def _untranscribed_findings(mono, sample_rate, index, own, shot):
+    """speech_not_transcribed: audible sound in a gap the line's words leave
+    - between two of them - or inside one word stretched over
+    UNHEARD_MIN_SECONDS (#923). Not the gap before a line's first word: a pause
+    between shots may hold music or ambience above the floor."""
+    intervals = [(a["end"], b["start"]) for a, b in zip(own, own[1:])]
+    findings = []
+    for start, end in intervals:
+        if end - start >= UNHEARD_MIN_SECONDS:
+            findings.append(_untranscribed(mono, sample_rate, index, start, end, shot))
+    for word in own:
+        # A word is sound itself: only its interior past the margins is a gap
+        if (
+            word["end"] - word["start"]
+            >= UNHEARD_MIN_SECONDS + 2 * UNHEARD_MARGIN_SECONDS
+        ):
+            findings.append(
+                _untranscribed(
+                    mono, sample_rate, index, word["start"], word["end"], shot
+                )
+            )
+    return [found for found in findings if found is not None]
+
+
+def _untranscribed(mono, sample_rate, index, start, end, shot):
+    lo, hi = start + UNHEARD_MARGIN_SECONDS, end - UNHEARD_MARGIN_SECONDS
+    level = word_level(mono, sample_rate, lo, hi)
+    if level is None or level <= UNHEARD_FLOOR_DBFS:
+        return None
+    at = _at(index, seconds=start, shot=shot)
+    at["end"] = _round(end)
+    return finding(SPEECH_NOT_TRANSCRIBED, _round(end - start, 2), at)
+
+
 def _clipped_findings(mono, sample_rate, tails, index, own, shot):
     """line_clipped_at_end for one heard line, as a list of zero or one
     finding: its last word ends in a voiced tail of its shot or the file."""
@@ -579,6 +677,42 @@ def _silent_shot_findings(spans, parsed_lines, heard, claimed):
     return findings
 
 
+def _unscripted_findings(spans, parsed_lines, expected, heard, unassigned):
+    """unscripted_speech: heard words align left to no line that sit inside a
+    shot a line names. `repeats_line` is set when the shot's words, in order,
+    contain one of its lines' words again."""
+    findings = []
+    for span in spans:
+        lines = [
+            expected[i]
+            for i, line in enumerate(parsed_lines)
+            if line["shot"] == span["name"]
+        ]
+        if not lines:
+            continue
+        inside = [
+            heard[j]
+            for j, _ in unassigned
+            if _heard_shot(spans, heard[j]) == span["name"]
+        ]
+        if not inside:
+            continue
+        at = _at(None, inside[0], shot=span["name"])
+        words = [word["word"] for word in inside]
+        at["end"] = _round(inside[-1]["end"])
+        at["repeats_line"] = any(
+            line and _contains(words, line) for line in lines
+        ) or any(line and _contains(line, words) for line in lines)
+        findings.append(finding(UNSCRIPTED_SPEECH, len(inside), at))
+    return findings
+
+
+def _contains(words, part):
+    """Whether `part` occurs in `words` as a contiguous run."""
+    size = len(part)
+    return any(words[i : i + size] == part for i in range(len(words) - size + 1))
+
+
 def _heard_entry(word):
     return {
         "text": word["text"],
@@ -620,7 +754,13 @@ def check_script(
         audio: The take - a path, 'asset:'/'output:' reference, or an
             earlier step's audio or video (its soundtrack is taken).
         lines: The expected lines in order - a list of strings or
-            {text, shot}, 'shot' naming the take's shot the line belongs in.
+            {text, shot}, 'shot' naming the take's shot the line belongs in -
+            its full recorded name, or the short '@name' of exactly one shot
+            ('cold_open' for 'shot@cold_open'). A name the shot map holds
+            more than once (a cut joined from episodes sharing shot names)
+            needs 'start_frame' on the line to pick the occurrence:
+            {text, shot, start_frame}; findings and 'shots' then call it
+            'name#start_frame'.
             H3 markup (<d>[English] ...</d>, <scenetrans>, <cutoff>,
             [unclear], (S1)) is stripped, and a markup word heard spoken is
             'tag_spoken'. [] means no speech is expected.
@@ -637,7 +777,8 @@ def check_script(
 
     Returns:
         A JSON document: 'findings' (line_mismatch, tag_spoken,
-        line_clipped_at_end, speech_where_silent, speech_in_silent_shot),
+        line_clipped_at_end, speech_not_transcribed, speech_where_silent, speech_in_silent_shot,
+        unscripted_speech),
         'lines' (expected, heard, similarity, start, end, shot), 'shots'
         (name, start, end in seconds, or null), 'shots_source', 'discarded' (guarded words with their
         level and reason), 'unmatched' (heard words aligned to no line), 'transcript',
@@ -655,12 +796,19 @@ def check_script(
         refusal = shot_names_error(parsed_lines, records, shots_source)
         if refusal:
             raise ValueError(refusal)
+        parsed_lines = with_full_shot_names(parsed_lines, records)
+        records = disambiguated(records)
     waveform, rate = waveform_and_rate(audio, sample_rate, COMMAND)
 
     from .audio_transcription import transcribe_audio
 
+    leveled, gain = level_for_transcription(waveform)
+    emit_log(
+        f"check_script: transcribing at {20 * math.log10(gain):+.1f} dB gain",
+        transcription_gain_db=round(20 * math.log10(gain), 2),
+    )
     transcript = transcribe_audio(
-        waveform,
+        leveled,
         device=device,
         sample_rate=rate,
         model_name=model_name,
diff --git a/dw/type_references.py b/dw/type_references.py
index 337f2e62..f5502574 100644
--- a/dw/type_references.py
+++ b/dw/type_references.py
@@ -83,12 +83,18 @@ def _is_type_key(key):
     )
 
 
-def _loose_type_reference_error(key, value, path):
+def _loose_type_reference_error(key, value, path, warnings=None):
     """Any other '*_type' / '*_dtype' / 'dtype' value the run loads as a type
     (a pipeline's torch_dtype, say), put to the same untrusted gate. Only the
-    gate's refusal is reported: a name that merely fails to resolve is left
+    gate's refusal is an error: a name that merely fails to resolve is left
     to the run, since realize_args reads some of these keys as something
-    other than a type."""
+    other than a type.
+
+    That rule stops short of a bare, undotted name (#926): a type or
+    quantization name written without braces (`weights_dtype: "int8"`) loads
+    as a diffusers attribute and dies after the model has loaded, so one that
+    fails to resolve is reported to `warnings` (when given) with its braced
+    spelling - a warning, since the key may still be read as something else."""
     if not isinstance(value, str) or not _DOTTED_NAME_PATTERN.match(value):
         return None
 
@@ -97,7 +103,17 @@ def _loose_type_reference_error(key, value, path):
     except UntrustedWorkflowError as e:
         return {"path": path, "message": str(e)}
     except (ImportError, AttributeError, ValueError):
-        pass
+        if warnings is not None and "." not in value:
+            warnings.append(
+                {
+                    "path": path,
+                    "message": (
+                        f"{key} {value!r} is not a diffusers type, and a "
+                        f"'{key}' value loads as one; a type or quantization "
+                        f'name that is only a name needs braces: "{{{value}}}"'
+                    ),
+                }
+            )
     return None
 
 
@@ -116,7 +132,7 @@ def _constant_reference_error(value, path):
     return None
 
 
-def _walk_type_references(node, path, errors):
+def _walk_type_references(node, path, errors, warnings=None):
     # A {media_type, location} dict is loaded as media, and its media_type
     # names a kind rather than a type - realize_args never reads it as one
     if isinstance(node, dict) and not is_media_reference(node):
@@ -124,20 +140,20 @@ def _walk_type_references(node, path, errors):
             if k in _TYPE_REFERENCE_KEYS:
                 error = _type_reference_error(k, v, path + (k,))
             elif _is_type_key(k):
-                error = _loose_type_reference_error(k, v, path + (k,))
+                error = _loose_type_reference_error(k, v, path + (k,), warnings)
             else:
                 error = _constant_reference_error(v, path + (k,))
             if error is not None:
                 errors.append(error)
             else:
-                _walk_type_references(v, path + (k,), errors)
+                _walk_type_references(v, path + (k,), errors, warnings)
     elif isinstance(node, list):
         for i, item in enumerate(node):
             error = _constant_reference_error(item, path + (i,))
             if error is not None:
                 errors.append(error)
             else:
-                _walk_type_references(item, path + (i,), errors)
+                _walk_type_references(item, path + (i,), errors, warnings)
 
 
 def component_type_errors(workflow_definition, source_indices=None):
@@ -180,6 +196,24 @@ def component_type_errors(workflow_definition, source_indices=None):
     return errors
 
 
+def unbraced_type_warnings(workflow_definition, source_indices=None):
+    """Every bare name handed to a `*_type`/`*_dtype`/`dtype` key that is not
+    a diffusers type, as warning strings (#926) - found by the same walk and
+    resolver `component_type_errors` uses, on the substituted definition, so a
+    value a `variable:` supplied is covered."""
+    found = []
+    for _, step, _, source, where in references.iter_steps(
+        workflow_definition.get("steps"), source_indices
+    ):
+        entries = []
+        _walk_type_references(step, (), [], entries)
+        found.extend(
+            f"{render_path(('steps', source) + e['path'])}: {e['message']}{where}"
+            for e in entries
+        )
+    return found
+
+
 def component_name_errors(workflow_definition, source_indices=None):
     """Every name under a step's `pipeline.configuration.components` that
     the named component_type's constructor does not register, as
diff --git a/dw/validation.py b/dw/validation.py
index 19f55ae6..06d69260 100644
--- a/dw/validation.py
+++ b/dw/validation.py
@@ -21,8 +21,8 @@
 (`workflow_errors`, `workflow_context`, `run_warning_check`,
 `undeclared_variable_errors`, `sub_workflow_errors`,
 `sub_workflow_argument_warnings`); only `Workflow.validation_errors` and
-`Workflow.validate` remain as methods. The three step-value checkers the error
-registry runs (`fps_errors`, `null_media_errors`, `select_errors`) are in
+`Workflow.validate` remain as methods. The step-value checkers the error
+registry runs (`fps_errors`, `cache_errors`, `null_media_errors`, `select_errors`) are in
 dw/step_value_checks.py.
 """
 
@@ -33,6 +33,7 @@
 from typing import Callable
 
 from . import references
+from .acceleration_warnings import acceleration_warnings
 from . import get_device_type, device_capacity_gb
 from .adapter_compatibility import adapter_errors, adapter_warnings
 from .argument_warnings import workflow_argument_warnings
@@ -52,17 +53,22 @@
 from .scalar_result_validation import scalar_result_errors
 from .schema import load_schema, validate_data_all
 from .security import InvalidInputError, SecurityError
-from .shot_span_preflight import shot_span_warnings
+from .shot_span_preflight import script_shot_name_errors, shot_span_warnings
 from .slice_preflight import slice_past_end_warnings
 from .subfolders import subfolder_errors
 from .step_value_checks import (
+    cache_errors,
     chain_prompts_errors,
     fps_errors,
     null_media_errors,
     select_errors,
 )
 from .task_domains import task_argument_errors
-from .type_references import component_name_errors, component_type_errors
+from .type_references import (
+    component_name_errors,
+    component_type_errors,
+    unbraced_type_warnings,
+)
 from .variable_constraints import (
     ConstraintReferenceError,
     constraint_errors,
@@ -135,6 +141,9 @@ def __init__(
         capacity_label=None,
         # The catalog's VRAM ceilings, for inherited_vram_warnings
         ceiling_index=None,
+        # The LoRA catalog's partitions, for the adapter checks
+        # (adapter_compatibility.catalog_index)
+        lora_index=None,
         expand=None,
     ):
         self.workflow = workflow
@@ -145,6 +154,7 @@ def __init__(
         self.capacity_gb = capacity_gb
         self.capacity_label = capacity_label
         self.ceiling_index = ceiling_index
+        self.lora_index = lora_index
         self._expand = expand
         self._expanded = expanded
         self._source_indices = source_indices
@@ -302,6 +312,9 @@ def _task_errors(context):
     ),
     Check("subfolders", lambda c: subfolder_errors(c.expanded, c.source_indices)),
     Check("fps", lambda c: fps_errors(c.expanded, c.source_indices)),
+    # A `cache: "variable:cache"` the raw schema let through, holding an
+    # object the run could not build (dw/step_value_checks.py, #865)
+    Check("cache", lambda c: cache_errors(c.expanded, c.source_indices)),
     # A reference name no workspace could ever resolve - the '@' a for_each
     # member's own file carries, rejected after the queue by a message that
     # named a valid form and not the objection (dw/reference_names.py, #162)
@@ -380,8 +393,9 @@ def _task_errors(context):
     # refuses this at run time, a few seconds into the job (#478)
     Check("null_media", lambda c: null_media_errors(c.expanded, c.source_indices)),
     # An adapter trained for the other checkpoint partition, which the
-    # pipeline loads without complaint and answers worse for
-    # (dw/adapter_compatibility.py, #155)
+    # pipeline loads without complaint and answers worse for - by the
+    # adapter's file name, or a proven LoRA catalog entry when the server
+    # has the catalog (dw/adapter_compatibility.py, #155, #870)
     Check(
         "adapters",
         lambda c: adapter_errors(
@@ -389,6 +403,7 @@ def _task_errors(context):
             c.source_indices,
             written=c.definition,
             supplied=c.supplied,
+            catalog=c.lora_index,
         ),
     ),
     # A number outside a task argument's declared domain, and a command's
@@ -406,6 +421,12 @@ def _task_errors(context):
             c.expanded, c.source_indices, c.base_dir, probe=c.probe
         ),
     ),
+    # A check_script line naming a shot the take's recorded shot map lacks
+    # (dw/shot_span_preflight.py, #873)
+    Check(
+        "script_shot_names",
+        lambda c: script_shot_name_errors(c.expanded, c.source_indices, c.base_dir),
+    ),
     # A join_windows list not the length its statically-resolvable source
     # needs (dw/window_count_errors.py, #601)
     Check(
@@ -569,6 +590,12 @@ def _null_variable_argument_warnings(context):
         "workflow_argument_warnings",
         lambda c: workflow_argument_warnings(c.definition, c.arguments),
     ),
+    # A type or quantization name written without braces, which the run loads
+    # as a diffusers attribute and fails on (dw/type_references.py, #926)
+    Check(
+        "unbraced_type_warnings",
+        lambda c: unbraced_type_warnings(c.expanded, c.source_indices),
+    ),
     # A value a declared constraint will round up - the silent half of #96:
     # the run changed the caller's frame count and only the server's log
     # said so
@@ -588,11 +615,16 @@ def _null_variable_argument_warnings(context):
     # An adapter whose file name says nothing about which checkpoint
     # partition it was trained for: valid, since the name of a future
     # checkpoint cannot be predicted, but nothing at run time would say it
-    # loaded onto the wrong one (#155)
+    # loaded onto the wrong one (#155); and a trial catalog entry that lists
+    # it for the other partition, which only warns (#870)
     Check(
         "adapter_warnings",
         lambda c: adapter_warnings(
-            c.expanded, c.source_indices, written=c.definition, supplied=c.supplied
+            c.expanded,
+            c.source_indices,
+            written=c.definition,
+            supplied=c.supplied,
+            catalog=c.lora_index,
         ),
     ),
     Check("null_variable_argument_warnings", _null_variable_argument_warnings),
@@ -646,6 +678,11 @@ def _null_variable_argument_warnings(context):
             )
         ),
     ),
+    # An acceleration setting that cannot pay off - a threshold cache on a
+    # short schedule, TaylorSeer state no estimate charges, fullgraph with a
+    # cache, a CUDA-only attention backend off CUDA - each of which cost a
+    # render to find out (#868)
+    Check("acceleration_warnings", acceleration_warnings),
 ]
 
 
@@ -671,6 +708,7 @@ def workflow_context(
     ceiling_index=None,
     capacity_gb=None,
     capacity_label=None,
+    lora_index=None,
 ):
     """One validation request's ValidationContext: the expansion over
     `arguments` (lazy and memoized, so the error pass and the warning
@@ -678,7 +716,8 @@ def workflow_context(
     request is checked against (its own capacity, or `capacity_gb` when
     the caller knows a larger card the job may land on - the server's
     worker pool, which `capacity_label` names in a refusal) and the catalog's VRAM ceilings
-    (`ceiling_index`, for inherited_vram_warnings). Built per request
+    (`ceiling_index`, for inherited_vram_warnings) and the LoRA catalog's
+    partitions (`lora_index`, for the adapter checks). Built per request
     and never stored on the Workflow, so its probe cache cannot serve a
     replaced file stale.
 
@@ -706,6 +745,7 @@ def expand():
         capacity_gb=device_capacity_gb() if capacity_gb is None else capacity_gb,
         capacity_label=capacity_label,
         ceiling_index=ceiling_index,
+        lora_index=lora_index,
         expand=expand,
     )
 
diff --git a/dw/variables.py b/dw/variables.py
index 573c92ba..4d2f9a67 100644
--- a/dw/variables.py
+++ b/dw/variables.py
@@ -39,6 +39,20 @@ class VariableCycleError(ValueError):
     or through others, inside `resolve_variable_values`."""
 
 
+def same_number(value):
+    """`value` with every integral float spelled as an int, so 12.0 and 12
+    compare and digest alike - the same value to the run (and to the step
+    cache's equality), but a JSON round trip through a client can respell one
+    as the other (#905, #908). A bool is left alone: True is not 1.0 here."""
+    if isinstance(value, float) and value.is_integer():
+        return int(value)
+    if isinstance(value, dict):
+        return {key: same_number(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [same_number(item) for item in value]
+    return value
+
+
 def _resolve_variable_reference(value, variables):
     """
     If value is a "variable:name" reference, look it up and return (True, resolved).
diff --git a/dw/vram_estimate.py b/dw/vram_estimate.py
index bcdf3e2d..b2945db9 100644
--- a/dw/vram_estimate.py
+++ b/dw/vram_estimate.py
@@ -55,6 +55,7 @@
 is an estimate of an estimate.
 """
 
+import math
 import numbers
 
 from .references import FROM_FILE_KEY, FROM_PREVIOUS_RESULT_KEY, VARIABLE, ref_name
@@ -215,6 +216,27 @@ def _entries_for(cost, device_type, capacity_gb, capacity_label=None):
         if str(entry.get("device", "")).split(":")[0] == device_type
     ]
     if matching:
+        # The catalog writes a card's GiB rounded up (a 3090 is "24"), but
+        # the queue gate holds a projection to what the card reports (23.6),
+        # so a projection between the two must be reported here as well
+        # (#900)
+        known = [
+            entry["vram_gb"]
+            for entry in matching
+            if _as_number(entry.get("vram_gb")) is not None
+        ]
+        if (
+            capacity_gb is not None
+            and known
+            and round(capacity_gb, 1) < min(known) <= math.ceil(capacity_gb)
+        ):
+            return matching + [
+                {
+                    "name": capacity_label
+                    or f"this {device_type} device (recommended maximum)",
+                    "vram_gb": round(capacity_gb, 1),
+                }
+            ]
         return matching
     if capacity_gb is not None:
         return [
diff --git a/dw/vram_inheritance.py b/dw/vram_inheritance.py
index 7d62ed1a..c6d37482 100644
--- a/dw/vram_inheritance.py
+++ b/dw/vram_inheritance.py
@@ -29,8 +29,16 @@
 
 import json
 
+from .for_each import ForEachError, expand_for_each
 from .vram_estimate import KEY as ESTIMATE_KEY
-from .vram_estimate import _resolved, pipeline_identity, vram_estimate_errors
+from .vram_estimate import reference_count
+from .variables import (
+    VariableNotFoundError,
+    replace_variables,
+    same_number,
+    undeclared_variable_references,
+)
+from .vram_estimate import pipeline_identity, vram_estimate_errors
 
 KIND = "vram_projection_inherited"
 
@@ -52,45 +60,190 @@ def template_identity(definition):
 
 
 def _found(node, key, variables):
-    """Every value `key` carries anywhere under `node`, a `variable:`
-    reference resolved against `variables`, as sorted JSON text."""
+    """Every value `key` carries anywhere under `node`, as sorted JSON text,
+    after `node`'s `variable:` references are substituted the way a run
+    substitutes them (`replace_variables`: at any depth, and a key whose
+    reference resolves to null dropped). A `loras` list carries its repo as
+    a reference inside each entry (#866)."""
+    return _carried(_substituted(node, variables), key)
+
+
+def _substituted(node, variables):
+    """`replace_variables(node, variables)`, except that a reference to a
+    variable `variables` doesn't declare stays as written instead of failing
+    the whole node, so the rest of it is still compared."""
+    try:
+        return replace_variables(node, variables)
+    except VariableNotFoundError:
+        pass
+    if isinstance(node, dict):
+        result = {}
+        for name, value in node.items():
+            try:
+                result.update(replace_variables({name: value}, variables))
+            except VariableNotFoundError:
+                result[name] = _substituted(value, variables)
+        return result
+    if isinstance(node, list):
+        result = []
+        for item in node:
+            try:
+                result.extend(replace_variables([item], variables))
+            except VariableNotFoundError:
+                result.append(_substituted(item, variables))
+        return result
+    return node
+
+
+def _carried(node, key):
     values = set()
     if isinstance(node, dict):
         for name, value in node.items():
             if name == key:
-                values.add(json.dumps(_resolved(value, variables), sort_keys=True))
-            values |= _found(value, key, variables)
+                # By value, not spelling: a client's JSON round trip turns
+                # the template's `lora_scale` 1.0 into 1 (#908)
+                values.add(json.dumps(same_number(value), sort_keys=True))
+            values |= _carried(value, key)
     elif isinstance(node, list):
         for item in node:
-            values |= _found(item, key, variables)
+            values |= _carried(item, key)
     return values
 
 
 # What changes a pipeline's cost without changing its identity (#797):
-# (label, key) pairs read wherever a step sets them
+# (label, key) pairs read wherever a step sets them. The last three are the
+# keys a pipeline step sets its attention backend, step cache and LoRAs
+# under (#866)
 _COST_SETTINGS = (
     ("offload", "offload"),
     ("quantization", "quantization_config"),
     ("frame count", "num_frames"),
+    ("attention backend", "attention_backend"),
+    ("cache", "cache"),
+    ("LoRA", "loras"),
 )
 
 
 def inherited_differences(definition, template, arguments=None):
     """What `definition` sets differently from `template` among the things
     that move a pipeline's cost without changing which pipeline it is -
-    offload, quantization, frame count - as short phrases (#797). A figure
-    inherited from `template` is an approximation to the extent these
-    differ. `arguments` (the caller's) override `definition`'s variables."""
+    offload, quantization, frame count, attention backend, cache, LoRA - as
+    short phrases (#797, #866). A figure inherited from `template` is an
+    approximation to the extent these differ. `arguments` (the caller's)
+    override `definition`'s variables."""
+    differs = [
+        label
+        for label, key in _COST_SETTINGS
+        if sets_differently(definition, template, key, arguments)
+    ]
+    # A reference is encoded and attended on every pass, so a count other
+    # than the template's moves the cost (#915); it is named, not scaled
+    if reference_counts(definition, arguments) != reference_counts(template):
+        differs.append("reference count")
+    return differs
+
+
+def reference_counts(definition, arguments=None):
+    """The set of reference counts the pipeline steps of `definition` pass,
+    `variable:` references resolved and `for_each` expanded, so each member
+    step counts its own entry's `references` (#915). A step's count is
+    `vram_estimate.reference_count`'s, the one the VRAM projection uses."""
     variables = dict(definition.get("variables") or {})
     variables.update(arguments or {})
-    template_variables = template.get("variables") or {}
-    differs = []
-    for label, key in _COST_SETTINGS:
-        mine = _found(definition.get("steps"), key, variables)
-        theirs = _found(template.get("steps"), key, template_variables)
-        if mine != theirs:
-            differs.append(label)
-    return differs
+    expanded = _expanded_steps(definition, variables)
+    if expanded is None:
+        return set()
+    return {
+        reference_count(step["pipeline"].get("arguments"))
+        for step in expanded
+        if isinstance(step, dict) and isinstance(step.get("pipeline"), dict)
+    }
+
+
+def _expanded_steps(definition, variables):
+    """`definition`'s steps with `variables` substituted and `for_each`
+    expanded as the run does, so `item:` references carry each entry's own
+    value; None when the expansion fails."""
+    steps = _substituted(definition.get("steps"), variables)
+    try:
+        return expand_for_each({"steps": steps}).get("steps") or []
+    except ForEachError:
+        return None
+
+
+def sets_differently(definition, template, key, arguments=None):
+    """Whether `definition`'s steps set `key` to other values than
+    `template`'s, `variable:` references resolved (`arguments` override
+    `definition`'s variables)."""
+    return _found_expanded(
+        definition, key, _compared_variables(definition, arguments)
+    ) != _found_expanded(template, key, _compared_variables(template))
+
+
+def _compared_variables(definition, arguments=None):
+    """`definition`'s variables, `arguments` over them, with every name its
+    references use but it doesn't declare set to null. A copy that leaves out
+    a variable whose default is null (`lora_alpha`) then drops that key as
+    the template it was copied from does, instead of comparing the reference
+    text against nothing (#866)."""
+    variables = dict(definition.get("variables") or {})
+    variables.update(arguments or {})
+    for _, name in undeclared_variable_references(definition):
+        variables.setdefault(name, None)
+    return variables
+
+
+def _found_expanded(definition, key, variables):
+    # A for_each step's `item:` references resolve per entry, so the value an
+    # entry sets is compared, not the reference text (#916)
+    expanded = _expanded_steps(definition, variables)
+    if expanded is None:
+        return _found(definition.get("steps"), key, variables)
+    return _carried(expanded, key)
+
+
+def pipeline_steps(definition, arguments=None):
+    """The pipeline steps `definition` runs, `variable:` references resolved
+    (`arguments` override the variables) and `for_each` expanded, so a
+    six-entry list is six steps, each with its entry's `item:` values - the
+    count and values an inherited price is scaled by (#851). The authored
+    steps when the expansion fails."""
+    variables = dict(definition.get("variables") or {})
+    variables.update(arguments or {})
+    steps = _expanded_steps(definition, variables)
+    if steps is None:
+        steps = definition.get("steps") or []
+    return [
+        step
+        for step in steps
+        if isinstance(step, dict) and isinstance(step.get("pipeline"), dict)
+    ]
+
+
+def pipeline_values(definition, key, arguments=None):
+    """The number each pipeline step sets `key` to (a `variable:` reference
+    resolved; `arguments` override the variables; the largest where a step
+    sets it twice), None for a step that sets none or a non-numeric one -
+    for scaling an inherited price along it (#851, #866). A `for_each`
+    step is read per member, as `pipeline_steps` expands it."""
+    variables = dict(definition.get("variables") or {})
+    variables.update(arguments or {})
+    found = []
+    for step in pipeline_steps(definition, arguments):
+        numbers = [
+            value
+            for value in map(json.loads, _found(step, key, variables))
+            if isinstance(value, (int, float)) and not isinstance(value, bool)
+        ]
+        found.append(max(numbers) if numbers else None)
+    return found
+
+
+def pipeline_frames(definition, arguments=None):
+    """The frame count each pipeline step sets (`num_frames`), as
+    `pipeline_values` reads it - for scaling an inherited price by frame
+    count (#851)."""
+    return pipeline_values(definition, "num_frames", arguments)
 
 
 def declarations(catalog):
diff --git a/dw/worker.py b/dw/worker.py
index 0759cf5c..a4139791 100644
--- a/dw/worker.py
+++ b/dw/worker.py
@@ -552,7 +552,16 @@ def _handle_probe_cache(self, command: Dict[str, Any]):
         """
         request_id = command.get("request_id")
         try:
-            workflow, _ = self._load_workflow(command, command["output_dir"])
+            workflow, identity = self._load_workflow(command, command["output_dir"])
+            # The run's identity switch (_prepare_workflow) clears the step
+            # cache before the job starts, so a different warm identity
+            # means nothing would be served (#911)
+            if (
+                self.workflow_identity is not None
+                and identity != self.workflow_identity
+            ):
+                self._reply(ProbeCacheReply(request_id=request_id, cached=[]))
+                return
             asset_token = (
                 activate_asset_dir(command["asset_dir"])
                 if command.get("asset_dir")
diff --git a/dw/worker_manager.py b/dw/worker_manager.py
index b0ef73b9..09e48922 100644
--- a/dw/worker_manager.py
+++ b/dw/worker_manager.py
@@ -21,6 +21,7 @@
     pinned_environment,
     worker_environment,
 )
+from .host_memory import read_oom_score_adj
 from .worker import worker_main
 from .worker_protocol import Cancel, Shutdown, WorkerCrashed, parse_reply
 
@@ -54,6 +55,9 @@ def __init__(self, device: Optional[str] = None):
         self._ceiling_gb = None
         # What set_oom_score_adj last wrote for the running process
         self.oom_score_adj = None
+        # The running process's oom_score_adj as spawned - the lowest value
+        # reset_oom_score_adj may write back without privilege (#881)
+        self.oom_score_floor = None
         self.worker_process: Optional[multiprocessing.Process] = None
         self.command_queue: Optional[multiprocessing.Queue] = None
         self.result_queue: Optional[multiprocessing.Queue] = None
@@ -81,6 +85,7 @@ def ensure_worker(self, log_level: str = "INFO"):
                 self.worker_process.start()
             self.worker_active = True
             self.oom_score_adj = None
+            self.oom_score_floor = read_oom_score_adj(self.worker_process.pid)
             logger.info("Worker process started")
 
     def device_fields(self):
@@ -203,6 +208,19 @@ def cancel(self):
         """Ask the worker to cancel the workflow it is running."""
         self.send_command(Cancel().to_wire())
 
+    def terminate_worker(self):
+        """Kill the worker process outright, for a cancel that a model load
+        cannot honor (#892). The job's thread, blocked reading results, sees
+        the process gone; the next job respawns it, with a cold model cache."""
+        process = self.worker_process
+        if process is None or not process.is_alive():
+            return
+        logger.warning("Terminating the worker: a cancel found it still loading")
+        process.terminate()
+        process.join(timeout=WORKER_TERMINATE_TIMEOUT_SECONDS)
+        if process.is_alive():
+            process.kill()
+
     def crash_details(self):
         """Why the worker process is gone, as far as the OS will say.
 
@@ -274,13 +292,16 @@ def ceiling_gb(self):
 
     def set_oom_score_adj(self, value):
         """Ask the kernel's OOM killer to pick this worker ahead of anything
-        scored lower (Linux only; best effort). In a pool the worker started
-        later is scored higher, so a host-RAM squeeze kills the newer job
-        rather than whichever worker happens to be larger (#462). Raising a
-        process's own score needs no privilege. Returns whether it took."""
+        scored lower (Linux only; best effort). In a pool the worker of the
+        latest dispatch is scored 1000 and the others are put back to their
+        floor (reset_oom_score_adj), so a host-RAM squeeze kills the newest
+        job rather than whichever worker happens to be larger (#462, #881).
+
+        Returns True when the kernel took the value, False when it refused
+        it, and None where nothing was attempted (no worker, not Linux)."""
         pid = self.pid()
         if pid is None or not sys.platform.startswith("linux"):
-            return False
+            return None
         value = max(-1000, min(1000, int(value)))
         try:
             with open(f"/proc/{int(pid)}/oom_score_adj", "w") as file:
@@ -290,3 +311,15 @@ def set_oom_score_adj(self, value):
             return False
         self.oom_score_adj = value
         return True
+
+    def reset_oom_score_adj(self):
+        """Put this worker back to the oom_score_adj it was spawned with, not
+        a literal 0. Without CAP_SYS_RESOURCE the kernel refuses a write below
+        the process's `oom_score_adj_min`, which a privileged write sets and
+        a child inherits: on lem, PID 1 starts the systemd user manager at 100
+        and the manager starts the server's unit at 200, so a worker raised to
+        1000 can come back to 200 and never to 0 (#881). The spawn-time value
+        is always at or above that minimum. Returns as
+        set_oom_score_adj does."""
+        floor = self.oom_score_floor
+        return self.set_oom_score_adj(0 if floor is None else floor)
diff --git a/dw/worker_protocol.py b/dw/worker_protocol.py
index ec88e405..535bb377 100644
--- a/dw/worker_protocol.py
+++ b/dw/worker_protocol.py
@@ -117,14 +117,25 @@ class Progress(_Message):
     """A run event, whose keys sit beside "type" on the wire."""
 
     TYPE: ClassVar[str] = "progress"
+    # An event's own "type" key - `cache_stats` carries the cache's (#886) -
+    # would overwrite the message's and the parent would drop the event as an
+    # UnknownReply, so it crosses the wire under this name instead
+    EVENT_TYPE_KEY: ClassVar[str] = "event_type"
     event: Dict[str, Any]
 
     def to_wire(self) -> Dict[str, Any]:
-        return {"type": self.TYPE, **self.event}
+        wire = {k: v for k, v in self.event.items() if k != "type"}
+        if "type" in self.event:
+            wire[self.EVENT_TYPE_KEY] = self.event["type"]
+        wire["type"] = self.TYPE
+        return wire
 
     @classmethod
     def from_wire(cls, wire: Dict[str, Any]):
-        return cls(event={k: v for k, v in wire.items() if k != "type"})
+        event = {k: v for k, v in wire.items() if k not in ("type", cls.EVENT_TYPE_KEY)}
+        if cls.EVENT_TYPE_KEY in wire:
+            event["type"] = wire[cls.EVENT_TYPE_KEY]
+        return cls(event=event)
 
 
 @dataclass(frozen=True)
diff --git a/dw/workflow.py b/dw/workflow.py
index 2e7e6cfe..e23980d1 100644
--- a/dw/workflow.py
+++ b/dw/workflow.py
@@ -550,6 +550,9 @@ def run(
         # What elision dropped this run, filled by prepare_definition and
         # read by the warning pass and the manifest (#122)
         self._elided_steps = []
+        # The variables the surviving steps referenced, filled by
+        # prepare_definition for the run's Made from (#857)
+        self._used_variables = []
         # A reused Workflow (the persistent worker's) still holds the last
         # run's directory: a run that fails before open_run would otherwise
         # rewrite that run's manifest. A composed child's values were set by
diff --git a/dw/workflow_run.py b/dw/workflow_run.py
index ca913a05..316787f1 100644
--- a/dw/workflow_run.py
+++ b/dw/workflow_run.py
@@ -9,7 +9,7 @@
 with the run, so the probe answers for the run that would happen.
 
 Every phase takes the Workflow and writes what others read back onto it:
-`manifest`, `_run_dir`, `_run_version`, `_elided_steps` and
+`manifest`, `_run_dir`, `_run_version`, `_elided_steps`, `_used_variables` and
 `_cache_enabled_this_run`. A composed child is recognized as an instance of
 the running workflow's own type.
 
@@ -28,11 +28,13 @@
 from .adapter_compatibility import warn_adapters
 from .arguments import realize_args
 from .elision import elide_definition, warn_elided
-from .events import emit_warning
+from .for_each import group_of
 from .media import probe_metadata
 from .pipeline_ownership import allocated_mb, finish_release
+from .pipeline_processors.timing import mark, step_timer
 from .previous_results import StepResults
-from .realize import realize_workflow
+from .realize import pin_output_reference, realize_workflow
+from .roles import annotate_roles, role_basis, run_inputs
 from .runs import (
     FLAT_LAYOUT,
     REALIZED_FILE_NAME,
@@ -47,11 +49,10 @@
     write_realized_workflow,
 )
 from .shots import (
-    carries_shots,
-    duplicate_shot_names,
     name_unsaved_shots,
     shot_references,
     step_shots,
+    warn_shot_collisions,
 )
 from .step import Step
 from .step_cache import (
@@ -59,6 +60,7 @@
     borrowed_pipeline_keys,
     copy_containers,
     normalized_downstream,
+    output_identity,
     reference_resolves_to,
     referenced_result_names,
     step_cache,
@@ -104,6 +106,11 @@ class RunRecord:
     seed: object = None
     realized_name: object = None
     annotations: dict = field(default_factory=_empty_annotations)
+    # Taken from the expanded steps as the run opens, before realization
+    # rewrites their references in place: what roles are decided from
+    # (dw/roles.py role_basis) and the asset:/output: inputs it read
+    role_basis: list = field(default_factory=list)
+    inputs: list = field(default_factory=list)
 
 
 @dataclass
@@ -116,6 +123,7 @@ class PreparedRun:
     default_seed: int
     recorded_variables: object
     cache_enabled: bool
+    used_variables: list = field(default_factory=list)
 
 
 @dataclass
@@ -220,6 +228,18 @@ def write_run_manifest(workflow, record, status=None):
     """
     status = status or record.status
     annotations = record.annotations
+    steps = [
+        {
+            **entry,
+            "files": manifest_relative_files(entry.get("files"), workflow._run_dir),
+            **_relative_shots(entry, workflow._run_dir),
+        }
+        for entry in workflow.manifest
+    ]
+    # Roles once the run has ended - a running manifest would show the
+    # newest step as final until its consumer runs (dw/roles.py)
+    if status != "running":
+        steps = annotate_roles(None, steps, record.role_basis)
     write_manifest(
         workflow._run_dir,
         {
@@ -252,16 +272,8 @@ def write_run_manifest(workflow, record, status=None):
             # What did not run, and why - a run says what it did not do
             # as well as what it did (#122)
             "elided_steps": workflow._elided_steps,
-            "steps": [
-                {
-                    **entry,
-                    "files": manifest_relative_files(
-                        entry.get("files"), workflow._run_dir
-                    ),
-                    **_relative_shots(entry, workflow._run_dir),
-                }
-                for entry in workflow.manifest
-            ],
+            "inputs": record.inputs,
+            "steps": steps,
         },
     )
 
@@ -312,6 +324,7 @@ def prepare_definition(workflow, workflow_def, arguments, base_dir):
         realize_args(variables, base_dir, apply_key_conventions=False)
     ## then replace any variable references in the workflow definition
     # with the actual values, and expand
+    authored_steps = workflow_def.get("steps")
     workflow_def = workflow._expand(workflow_def, variables)
 
     # A step a declared vram_estimate projects past the card 'cost' was
@@ -341,6 +354,9 @@ def prepare_definition(workflow, workflow_def, arguments, base_dir):
     workflow._elided_steps = elide_definition(
         workflow_def, workflow.workflow_definition
     )
+    workflow._used_variables = _surviving_variables(
+        authored_steps, workflow_def.get("steps")
+    )
 
     # Set up random seed for reproducibility. Resolved lazily - as a
     # dict.get default, torch.seed() would run on every call and reseed
@@ -362,6 +378,53 @@ def prepare_definition(workflow, workflow_def, arguments, base_dir):
     return workflow_def, default_seed, recorded_variables
 
 
+def _variable_names(value):
+    """Every 'variable:' name a nested value references, in first-use order."""
+    names = []
+    if isinstance(value, str):
+        name = references.ref_name(references.VARIABLE, value)
+        if name is not None:
+            names.append(name)
+    elif isinstance(value, dict):
+        for item in value.values():
+            names.extend(_variable_names(item))
+    elif isinstance(value, list):
+        for item in value:
+            names.extend(_variable_names(item))
+    return names
+
+
+def _surviving_variables(authored_steps, expanded_steps):
+    """The variable names the steps that survived expansion and elision
+    referenced before substitution (#857). A for_each member
+    ('<group>@<entry>') stands for the step it was expanded from."""
+    groups = {
+        group_of(step.get("name"))
+        for step in expanded_steps or []
+        if isinstance(step, dict)
+    }
+    used = []
+    for step in authored_steps or []:
+        if isinstance(step, dict) and step.get("name") in groups:
+            for name in _variable_names(step):
+                if name not in used:
+                    used.append(name)
+    return used
+
+
+def _pin_inputs(inputs, output_root):
+    """`inputs` with each output: reference pinned as the realized workflow
+    pins it, duplicates merged."""
+    pinned = []
+    for entry in inputs:
+        reference = entry["reference"]
+        if entry["kind"] == "output":
+            reference = pin_output_reference(reference, output_root)
+        if not any(p["reference"] == reference for p in pinned):
+            pinned.append({**entry, "reference": reference})
+    return pinned
+
+
 def cache_lookup(
     workflow,
     workflow_id,
@@ -407,7 +470,7 @@ def cache_lookup(
     step_data_snapshot = None
     if is_cacheable:
         try:
-            step_data_snapshot = copy.deepcopy(step_data)
+            step_data_snapshot = output_identity(copy.deepcopy(step_data))
             if parent_saves_this:
                 # Keyed apart from the same step run standalone: this
                 # entry's result was never saved here, so a standalone
@@ -586,6 +649,7 @@ def prepare_run(workflow, record):
         default_seed,
         recorded_variables,
         cache_enabled,
+        list(workflow._used_variables),
     )
 
 
@@ -620,6 +684,19 @@ def open_run(workflow, prepared, record, run_context):
     inherits the parent's and never opens its own."""
     record.started_at = _now()
     record.run_id = None
+    expanded = prepared.workflow_def.get("steps") or []
+    record.role_basis = role_basis(expanded)
+    # The variables as folded, before their assets loaded: a template's
+    # input image is usually a variable, gone from the steps by now
+    # Only the variables a surviving step referenced: a default nothing
+    # read is not something the run was made from (#857)
+    recorded = prepared.recorded_variables
+    read = (
+        {k: v for k, v in recorded.items() if k in prepared.used_variables}
+        if isinstance(recorded, dict)
+        else None
+    )
+    record.inputs = run_inputs([*expanded, read])
     if not workflow._run_dir_inherited:
         _claim_run_dir(workflow, prepared, record)
 
@@ -640,6 +717,9 @@ def open_run(workflow, prepared, record, run_context):
         )
         if write_realized_workflow(workflow._run_dir, realized):
             record.realized_name = REALIZED_FILE_NAME
+        # Made from names the run realize_workflow pinned, not 'latest'
+        # as read when the page is viewed (#858)
+        record.inputs = _pin_inputs(record.inputs, workflow.output_dir)
     except Exception as e:
         # Never fatal: the record is worth less than the run
         logger.warning(f"Could not realize workflow {prepared.workflow_id}: {e}")
@@ -776,37 +856,11 @@ def save_step(workflow, loop, index, step_data, step, result, cache_entry):
     return saved_files
 
 
-def _warn_shot_collisions(step_data, step_name, shots):
-    """Joined shots that share a name, said where the join made them."""
-    # Only the step that joined made the collision; a step
-    # that carries an input's shots over (pair_audio,
-    # interpolate_frames) repeats what the caller can only
-    # act on at the join (#568)
-    command = step_data.get("task", {}).get("command")
-    duplicates = None if carries_shots(command) else duplicate_shot_names(shots)
-    if not duplicates:
-        return
-    # Frames and samples stay exact either way - only a
-    # name-based lookup (a `shots=` argument, a finding)
-    # can no longer tell the collided shots apart (#508)
-    for file, names in duplicates.items():
-        extra = {"file": file} if file is not None else {}
-        emit_warning(
-            "joined shots share a name ("
-            + ", ".join(names)
-            + ") and can no longer be told apart by "
-            "name - start_frame still disambiguates.",
-            kind="shot_name_collision",
-            command=step_name,
-            names=names,
-            **extra,
-        )
-
-
-def record_step(workflow, loop, index, step_data, outcome, sub_manifest):
+def record_step(workflow, loop, index, step_data, outcome, sub_manifest, timing=None):
     """Phase E7: the step's manifest entry, the child's rolled-up entries,
     and `step_end`. `outcome` is (result, saved_files, reused,
-    parent_saves_this)."""
+    parent_saves_this). `timing` is the step's StepTimer reading
+    (dw/pipeline_processors/timing.py), None for a step nothing timed."""
     result, saved_files, reused, parent_saves_this = outcome
     step_name = step_data["name"]
     # 'reused' marks files an earlier run wrote and this one only
@@ -819,6 +873,9 @@ def record_step(workflow, loop, index, step_data, outcome, sub_manifest):
         details["reused"] = True
     if selected is not None:
         details["selected"] = selected
+    # A reused step ran nothing, so it has nothing to time
+    if timing is not None and not reused:
+        details["timing"] = timing
     # Where each joined shot sits in the file, named by the
     # step's own input references (dw/shots.py)
     references = shot_references(step_data.get("task", {}).get("arguments", {}))
@@ -826,7 +883,7 @@ def record_step(workflow, loop, index, step_data, outcome, sub_manifest):
     shots = step_shots(getattr(result, "saved_shots", None), saved_files, references)
     if shots:
         details["shots"] = shots
-        _warn_shot_collisions(step_data, step_name, shots)
+        warn_shot_collisions(step_data, step_name, shots)
     # No entry at all for a step the parent saves for: the
     # parent's own entry names the same files, under the step
     # name the caller wrote (#92)
@@ -894,12 +951,21 @@ def run_step(workflow, loop, index, step_data, record):
     """Phase E: one step, start to `step_end`. Returns the names later
     steps still reference; the result is the loop's (`last_result`,
     `results`), so the caller holds no reference of its own to it.
+    """
+    step, step_seed = _start_step(workflow, loop, index, step_data)
+    with step_timer(step_data) as timer:
+        return _run_started_step(
+            workflow, loop, index, step_data, step, step_seed, record, timer
+        )
+
+
+def _run_started_step(workflow, loop, index, step_data, step, step_seed, record, timer):
+    """run_step past `step_start`, with the step's timer open.
 
     Holds the step's action in this frame and nowhere else, so the release
     a step asks for can drop it here before memory is reclaimed.
     """
     steps = loop.steps
-    step, step_seed = _start_step(workflow, loop, index, step_data)
     cached_result, step_data_snapshot, result_needed, remaining_refs = cache_lookup(
         workflow,
         loop.workflow_id,
@@ -926,6 +992,7 @@ def run_step(workflow, loop, index, step_data, record):
     # it, and it loads only when a step that actually runs
     # borrows it - whether a later step will be a hit too is not
     # known until that step's own lookup
+    mark("load_started")
     if cached_result is None:
         workflow._load_deferred_borrows(
             loop.workflow_id, steps, index, loop.shared_components, loop.pipelines
@@ -938,6 +1005,7 @@ def run_step(workflow, loop, index, step_data, record):
         get_device(),
         cache_hit=cached_result is not None,
     )
+    mark("load_ended")
     is_child = isinstance(step_action, type(workflow))
     if is_child:
         wire_child(workflow, step_action, step_data, index, len(steps))
@@ -980,6 +1048,7 @@ def run_step(workflow, loop, index, step_data, record):
         finish_release(loop.workflow_id, step.name, index, before)
 
     if not reused:
+        mark("save_started")
         saved_files = save_step(
             workflow,
             loop,
@@ -989,6 +1058,7 @@ def run_step(workflow, loop, index, step_data, record):
             result,
             (step_data_snapshot, step_seed, result_needed, parent_saves_this),
         )
+        mark("save_ended")
 
     loop.last_result = result
     loop.results[step.name] = result
@@ -999,6 +1069,7 @@ def run_step(workflow, loop, index, step_data, record):
         step_data,
         (result, saved_files, reused, parent_saves_this),
         sub_manifest,
+        timing=timer.timing() if timer is not None else None,
     )
 
     # Rewritten after every step, not only at the end (#480): a
diff --git a/dw/workflow_schema.json b/dw/workflow_schema.json
index 837d44c4..a1c843b3 100644
--- a/dw/workflow_schema.json
+++ b/dw/workflow_schema.json
@@ -35,7 +35,7 @@
         },
         "cost": {
             "type": "array",
-            "description": "Measured runs, one per device the maintainer measured on. Never derived; absent means unknown. 'minutes' is the whole run's wall clock on a worker that has to load the models - what a consumer actually waits through, not the denoise loop alone; on a video template the two differ by minutes.",
+            "description": "Measured runs, one per device the maintainer measured on, each measured at the workflow's variable defaults: a run that moves num_inference_steps, width/height or num_frames off them is quoted scaled in proportion (plan basis 'derived'), so a figure measured anywhere else must be re-priced to the defaults before it is written. Never invented without a run; absent means unknown. 'minutes' is the whole run's wall clock on a worker that has to load the models - what a consumer actually waits through, not the denoise loop alone; on a video template the two differ by minutes.",
             "items": {
                 "type": "object",
                 "required": ["device", "vram_gb", "minutes"],
@@ -757,8 +757,12 @@
                     }
                 },
                 "cache": {
-                    "description": "Enable diffusers built-in cache acceleration on the transformer. Hooks auto-reset between inference runs.",
-                    "type": "object",
+                    "description": "Enable diffusers built-in cache acceleration on the transformer. Hooks auto-reset between inference runs. Accepts a 'variable:' reference to a whole cache object; a variable that resolves to null means no cache, and the object it resolves to is checked against this shape at validate.",
+                    "type": [
+                        "object",
+                        "string"
+                    ],
+                    "pattern": "^variable:",
                     "properties": {
                         "type": {
                             "description": "Cache algorithm: first_block (simplest, broadest support), faster (video-oriented, experimental), mag (magnitude-based, needs num_inference_steps), taylorseer (Taylor series approximation), text_kv (text key-value cache).",
@@ -779,7 +783,7 @@
                             ]
                         },
                         "num_inference_steps": {
-                            "description": "Required for mag cache type. Must match the pipeline's num_inference_steps.",
+                            "description": "Required for mag cache type. The transformer forwards the call runs: the pipeline's num_inference_steps, except where the scheduler runs fewer (MiniMax-H3 runs one fewer, so a calibration reports one ratio fewer than the call's steps; set this to the count reported).",
                             "type": "integer"
                         },
                         "max_skip_steps": {
@@ -805,7 +809,7 @@
                             ]
                         },
                         "calibrate": {
-                            "description": "Run mag cache in calibration mode: skip nothing, and log the magnitude ratios for this model at the end of the run so they can be pasted into mag_ratios. Default: false.",
+                            "description": "Run mag cache in calibration mode: skip nothing, and report the magnitude ratios for this model at the end of the run as a job warning and log event, so they can be pasted into mag_ratios. Under classifier-free guidance run as separate cond and uncond passes two lists are reported, labeled [cond] and [uncond]; use the cond one. A pipeline whose transformer does not support enable_cache() (a UNet such as SD 1.5, Z-Image) runs uncached with a job warning and reports nothing. Default: false.",
                             "type": "boolean"
                         },
                         "cache_interval": {
@@ -815,6 +819,10 @@
                         "max_order": {
                             "description": "Taylor series order for taylorseer cache. Higher = better approximation, more memory. Default: 1.",
                             "type": "integer"
+                        },
+                        "is_guidance_distilled": {
+                            "description": "For faster cache: set true when the model is guidance-distilled (FLUX.1-dev, FLUX.1-Krea-dev), where guidance_scale is an embedding and the transformer sees a batch of 1, not a cond/uncond pair. Without it faster fails at the first step with 'tuple index out of range'. Default: false.",
+                            "type": "boolean"
                         }
                     },
                     "required": [
@@ -1240,6 +1248,13 @@
                     "description": "A subfolder of the run directory this step's files are written into, as a relative path like 'final' or 'shots/act-1'. Optional: without it the files land at the root of the run directory as they always have. By convention a step whose output the user will be shown is 'final' and everything else is 'intermediate', which is how a consumer tells the deliverable from the scratch files without knowing the workflow; the engine treats no name specially. May be a 'variable:' or, inside a for_each step, an 'item:' reference. Each segment must start with a letter, digit or underscore; '..' and '\\' are refused.",
                     "type": "string"
                 },
+                "role": {
+                    "description": "What this step's files are to whoever looks at the run: 'final' (a deliverable) or 'intermediate' (made for a later step). Optional: without it a subfolder named 'final' or 'intermediate' decides, else a step a later media-writing step consumes is intermediate and every other step is final. May be a 'variable:' reference.",
+                    "anyOf": [
+                        {"enum": ["final", "intermediate"]},
+                        {"type": "string", "pattern": "^variable:"}
+                    ]
+                },
                 "fps": {
                     "description": "Frames per second - only used when output is video. Defaults to the rate the frames themselves carry (a chain's 'fps', a join's own rate, the rate of the file a task read) and to 8 only when nothing knows better. Set it to write at a rate other than the source's - a deliberate slow motion - which the run then warns about. May be a 'variable:' or, inside a for_each step, an 'item:' reference, resolved the same way 'subfolder' is - the resolved value must be a positive whole number; a fractional rate is refused, since the video writer would silently truncate rather than honor it.",
                     "type": ["integer", "number", "string"],
diff --git a/dw/workspace.py b/dw/workspace.py
index 43b7dff6..30ec5658 100644
--- a/dw/workspace.py
+++ b/dw/workspace.py
@@ -371,10 +371,15 @@ def _holds_a_workspace(path):
     return _has_subdirs(path, NAMED_SUBDIRS, all_of=True)
 
 
+# The note a workspace carries at its root (dw/notes.py reads and writes it);
+# defined here so notes can import the name without a cycle through runs
+WORKSPACE_FILE_NAME = "workspace.json"
+
+
 def _foreign_entries(path):
     """What a directory holds besides a workspace's own three folders and
-    the exports it may have gathered."""
-    ignored = NAMED_SUBDIRS + (EXPORTS_SUBDIR,)
+    the exports it may have gathered, and its workspace.json note."""
+    ignored = NAMED_SUBDIRS + (EXPORTS_SUBDIR, WORKSPACE_FILE_NAME)
     try:
         return sorted(entry for entry in os.listdir(path) if entry not in ignored)
     except OSError:
diff --git a/dw/workspace_copy.py b/dw/workspace_copy.py
new file mode 100644
index 00000000..a45351e5
--- /dev/null
+++ b/dw/workspace_copy.py
@@ -0,0 +1,573 @@
+"""Copying runs and asset-library entries from one workspace to another
+under the same root (#853).
+
+A run is self-contained on disk - `latest`, `vN`, `output:` resolution and
+the gallery all read the run folder and its manifests, never the jobs
+database - so copying the folder into the destination's outputs is the whole
+of making it resolvable there. What this module adds is the care around that:
+
+- Confinement. Both ends are workspaces under one root, named and validated
+  (`named_workspace`); every path is checked with `validate_path` against
+  its own side's outputs folder; a source that is, passes through or holds a
+  symlink is refused, and nothing here ever creates one - output references
+  refuse linked run folders (tests/test_security_symlinks.py).
+- All or nothing. Every entry is checked before anything is written. A run
+  folder already in the destination is the same run (same run id), so it is
+  `already_present` and skipped, which makes a repeated copy idempotent; a
+  run whose job is still running is a conflict and refuses the request.
+- Files. Media is hard-linked, falling back to `copy2` across devices, as
+  `keep_output` does - dw never edits media in place. JSON sidecars
+  (manifest, workflow.json, notes.json, job.json, any `.json`) are always
+  copied: they *are* edited in place (`record_kept_shots`,
+  `write_realized_workflow`, the notes), and a link would carry an edit in
+  one workspace into the other.
+- Versions. A copied run keeps its `vN` unless the destination's identity
+  already uses that number; then every run this request copies into that
+  identity is renumbered after the destination's highest, in run-id order,
+  under the identity's run lock so it cannot race `open_run`. dw/runs.py
+  owns the numbering (`copy_runs_in`); this module only places the folders.
+  The version is the only manifest field a copy edits; pinned `output:` refs
+  name run ids, so renumbering breaks none of them.
+- Warnings, never refusals: `output:` inputs that do not resolve in the
+  destination, manifest paths that still point into the source workspace
+  (reported relative to its root - no reply carries an absolute server
+  path), and that a copied run has no job row (it appears in the gallery,
+  not in the jobs list).
+
+Assets are named as after `asset:` - a file, or a folder for everything
+under it - and keep their library-relative path, so `uploads/x` stays
+`uploads/x`. A path the destination already holds with identical bytes is
+`already_present`; with different bytes it is a conflict, and a conflict
+refuses the whole request - runs included - before anything is written.
+An asset's sidecars are not copied as files: its `notes.json` entry and its
+kept-shots entry (`record_kept_shots`) are merged into the destination
+folder's own, written fresh, so the shot map and the note travel while
+`provenance.workspace` keeps naming the workspace the file was made in.
+Media is linked here too: no asset path writes a file in place - an upload
+over a name replaces it (`os.replace`), keep and delete unlink first.
+"""
+
+import filecmp
+import logging
+import os
+import shutil
+
+from .notes import NOTES_FILE_NAME, read_notes, set_file_note
+from .references import ASSET, OUTPUT, ref_name
+from .runs import (
+    MANIFEST_FILE_NAME,
+    _read_manifest,
+    copy_runs_in,
+    identity_run_ids,
+    is_run_id,
+    record_kept_shots,
+    resolve_output_reference,
+)
+from .security import (
+    InvalidInputError,
+    PathTraversalError,
+    validate_asset_reference,
+    validate_output_prefix,
+    validate_path,
+)
+from .workspace import ConfiguredWorkspace, forget_workspace_usage
+
+logger = logging.getLogger("dw")
+
+# The sidecars a copy writes fresh rather than links: every JSON file
+SIDECAR_SUFFIX = ".json"
+
+# An asset folder's own sidecars: merged per file, never copied as files
+ASSET_SIDECARS = (NOTES_FILE_NAME, MANIFEST_FILE_NAME)
+
+NO_JOBS_NOTE = (
+    "Copied runs appear in list_gallery and resolve through output: "
+    "references, but not in list_jobs - a copy carries no job record."
+)
+
+
+class CopyRefused(Exception):
+    """The request cannot be carried out as asked; nothing was written.
+
+    `status` is the HTTP status the route answers with: 404 for something
+    that is not there, 409 for a conflict with what is."""
+
+    def __init__(self, message, status=409, conflicts=None):
+        super().__init__(message)
+        self.status = status
+        self.conflicts = conflicts or []
+
+
+def _run_entry(entry):
+    """A `runs` entry as its segments: `<identity>/<run id>` or a bare
+    `<identity>`. An `output:` prefix is accepted, as the gallery quotes it.
+
+    Raises:
+        PathTraversalError: For an absolute path or a `..`
+        InvalidInputError: For anything else that is not a run name
+    """
+    if not isinstance(entry, str) or not entry.strip():
+        raise InvalidInputError("A runs entry must be a non-empty string")
+    name = entry.strip()
+    name = ref_name(OUTPUT, name) or name
+    if name.startswith(("/", "\\")) or os.path.isabs(name):
+        raise PathTraversalError(f"'{entry}' is an absolute path - name a run")
+    parts = name.split("/")
+    if any(part in ("..", ".") for part in parts):
+        raise PathTraversalError(f"'{entry}' leaves the outputs folder")
+    validate_output_prefix(name)
+    return parts
+
+
+def _symlink_on_the_way(base, path):
+    """The first symlink between `base` (exclusive) and `path` (inclusive),
+    or None. validate_path resolves links, so a link that stays inside the
+    base passes it; this refuses those too."""
+    relative = os.path.relpath(path, base)
+    current = base
+    for part in relative.split(os.sep):
+        current = os.path.join(current, part)
+        if os.path.islink(current):
+            return current
+    return None
+
+
+def _symlink_inside(directory):
+    """The first symlink anywhere under a run folder, or None."""
+    for current, dirs, files in os.walk(directory):
+        for name in dirs + files:
+            path = os.path.join(current, name)
+            if os.path.islink(path):
+                return path
+    return None
+
+
+def _source_runs(source, entry):
+    """[(identity, run id)] that one entry names in the source.
+
+    Raises:
+        PathTraversalError: When the entry escapes, or reaches a symlink
+        CopyRefused (404): When there is no such run or workflow
+    """
+    parts = _run_entry(entry)
+    outputs = os.path.realpath(source.outputs)
+    if is_run_id(parts[-1]) and len(parts) > 1:
+        identity, run_ids = "/".join(parts[:-1]), [parts[-1]]
+    else:
+        identity, run_ids = "/".join(parts), None
+    identity_dir = validate_path(os.path.join(outputs, *identity.split("/")), outputs)
+    if run_ids is None:
+        run_ids = identity_run_ids(identity_dir)
+        if not run_ids:
+            raise CopyRefused(
+                f"No runs of '{identity}' in workspace '{source.name}'", status=404
+            )
+    found = []
+    for run_id in run_ids:
+        run_dir = os.path.join(outputs, *identity.split("/"), run_id)
+        link = _symlink_on_the_way(outputs, run_dir)
+        if link:
+            raise PathTraversalError(
+                f"'{entry}' passes through a symlink - a copy never follows one"
+            )
+        run_dir = validate_path(run_dir, outputs)
+        if not os.path.isdir(run_dir):
+            raise CopyRefused(
+                f"No run '{identity}/{run_id}' in workspace '{source.name}'",
+                status=404,
+            )
+        if _symlink_inside(run_dir):
+            raise PathTraversalError(
+                f"Run '{identity}/{run_id}' holds a symlink - a copy never "
+                f"follows or creates one"
+            )
+        found.append((identity, run_id))
+    return found
+
+
+def _copy_file(source, target, totals):
+    """Hard-link a media file, falling back to a copy; copy a sidecar."""
+    size = os.path.getsize(source)
+    if not source.endswith(SIDECAR_SUFFIX):
+        try:
+            os.link(source, target)
+            totals["bytes_linked"] += size
+            return
+        except OSError:
+            pass  # another device, or a filesystem without hard links
+    shutil.copy2(source, target)
+    totals["bytes_copied"] += size
+
+
+def _copy_tree(source_dir, target_dir, totals):
+    """Recreate a run folder file by file - no symlinks, ever."""
+    os.makedirs(target_dir)
+    for current, dirs, files in os.walk(source_dir):
+        relative = os.path.relpath(current, source_dir)
+        here = (
+            target_dir if relative == os.curdir else os.path.join(target_dir, relative)
+        )
+        for name in dirs:
+            os.makedirs(os.path.join(here, name), exist_ok=True)
+        for name in files:
+            _copy_file(os.path.join(current, name), os.path.join(here, name), totals)
+
+
+def _place_run(source_dir, identity_dir, run_id, totals):
+    """Copy one run folder in under a name no listing reads, then rename it
+    into place - a reader never sees half a run."""
+    staging = os.path.join(identity_dir, f".copy-{run_id}")
+    if os.path.exists(staging):
+        shutil.rmtree(staging)
+    try:
+        _copy_tree(source_dir, staging, totals)
+        os.rename(staging, os.path.join(identity_dir, run_id))
+    except BaseException:
+        shutil.rmtree(staging, ignore_errors=True)
+        raise
+
+
+def _copy_identity(source, destination, identity, run_ids, totals):
+    """Copy one identity's runs; dw/runs.py settles their versions under
+    the identity's run lock. Returns {"<identity>/<run>": {"from", "to"}}
+    for each run whose number changed."""
+    source_identity = os.path.join(
+        os.path.realpath(source.outputs), *identity.split("/")
+    )
+    outputs = os.path.realpath(destination.outputs)
+    identity_dir = validate_path(os.path.join(outputs, *identity.split("/")), outputs)
+
+    def place(run_id):
+        _place_run(os.path.join(source_identity, run_id), identity_dir, run_id, totals)
+
+    renumbered = copy_runs_in(source_identity, identity_dir, run_ids, place)
+    return {f"{identity}/{run_id}": change for run_id, change in renumbered.items()}
+
+
+def _absolute_paths(manifest, source_root):
+    """Paths in a manifest that still point into the source workspace,
+    relative to its root: a file a step cache hit republished from an
+    earlier run, and the workflow file the run was started from."""
+    found = []
+
+    def visit(value):
+        if isinstance(value, dict):
+            for item in value.values():
+                visit(item)
+        elif isinstance(value, list):
+            for item in value:
+                visit(item)
+        elif isinstance(value, str) and os.path.isabs(value):
+            try:
+                inside = (
+                    os.path.commonpath([os.path.realpath(value), source_root])
+                    == source_root
+                )
+            except ValueError:
+                inside = False
+            if inside:
+                relative = os.path.relpath(os.path.realpath(value), source_root)
+                found.append(relative.replace(os.sep, "/"))
+
+    visit({key: manifest.get(key) for key in ("workflow", "steps")})
+    return sorted(set(found))
+
+
+def _unresolved_inputs(manifest, outputs):
+    """The `output:` inputs a copied run's manifest records that name
+    nothing in the destination."""
+    unresolved = []
+    for entry in manifest.get("inputs") or []:
+        if not isinstance(entry, dict) or entry.get("kind") != "output":
+            continue
+        reference = entry.get("reference")
+        if not isinstance(reference, str):
+            continue
+        try:
+            resolve_output_reference(reference, outputs)
+        except (ValueError, OSError, InvalidInputError, PathTraversalError):
+            unresolved.append(reference)
+    return unresolved
+
+
+def _asset_entry(entry):
+    """An `assets` entry as a library-relative name, and whether it names a
+    folder. An `asset:` prefix is accepted; a trailing `/` marks a folder,
+    but a folder is a folder without one too.
+
+    Raises:
+        PathTraversalError: For an absolute path or a `..`
+        InvalidInputError: For anything else that is not an asset name
+    """
+    if not isinstance(entry, str) or not entry.strip():
+        raise InvalidInputError("An assets entry must be a non-empty string")
+    name = entry.strip()
+    name = ref_name(ASSET, name) or name
+    if name.startswith(("/", "\\")) or os.path.isabs(name):
+        raise PathTraversalError(f"'{entry}' is an absolute path - name an asset")
+    if any(part in ("..", ".") for part in name.split("/")):
+        raise PathTraversalError(f"'{entry}' leaves the asset library")
+    folder = name.endswith("/")
+    return validate_asset_reference(name[:-1] if folder else name), folder
+
+
+def _source_assets(source, entry):
+    """[library-relative name] of each file one entry names in the source's
+    asset library - the file itself, or every file under a folder but the
+    folder sidecars, which travel per file instead.
+
+    Raises:
+        PathTraversalError: When the entry escapes, or reaches a symlink
+        InvalidInputError: When it names a sidecar rather than an asset
+        CopyRefused (404): When there is no such asset
+    """
+    name, _folder = _asset_entry(entry)
+    library = os.path.realpath(source.assets)
+    joined = os.path.join(library, *name.split("/"))
+    if os.path.isdir(library) and _symlink_on_the_way(library, joined):
+        raise PathTraversalError(
+            f"'{entry}' passes through a symlink - a copy never follows one"
+        )
+    path = validate_path(joined, library)
+    if os.path.isfile(path):
+        if os.path.basename(path) in ASSET_SIDECARS:
+            raise InvalidInputError(
+                f"'{entry}' is a sidecar, not an asset - copy the file it "
+                f"describes and its entry comes with it"
+            )
+        return [name]
+    if not os.path.isdir(path):
+        raise CopyRefused(f"No asset '{name}' in workspace '{source.name}'", status=404)
+    if _symlink_inside(path):
+        raise PathTraversalError(
+            f"Asset folder '{name}' holds a symlink - a copy never follows or "
+            f"creates one"
+        )
+    found = []
+    for current, dirs, files in os.walk(path):
+        dirs.sort()
+        for file_name in sorted(files):
+            if file_name in ASSET_SIDECARS:
+                continue
+            relative = os.path.relpath(os.path.join(current, file_name), library)
+            found.append(relative.replace(os.sep, "/"))
+    if not found:
+        raise CopyRefused(
+            f"Asset folder '{name}' in workspace '{source.name}' holds no files",
+            status=404,
+        )
+    return found
+
+
+def _same_bytes(a, b):
+    """Whether two files hold the same bytes - a hard link of one another
+    trivially does."""
+    if os.path.samefile(a, b):
+        return True
+    return filecmp.cmp(a, b, shallow=False)
+
+
+def _plan_assets(source, destination, assets):
+    """([name] to copy, [already present], [conflicting]) for the assets
+    named - every path checked against the destination, nothing written."""
+    named = []
+    for entry in assets:
+        for name in _source_assets(source, entry):
+            if name not in named:
+                named.append(name)
+    source_library = os.path.realpath(source.assets)
+    library = os.path.realpath(destination.assets)
+    to_copy, already_present, conflicts = [], [], []
+    for name in named:
+        joined = os.path.join(library, *name.split("/"))
+        if os.path.isdir(library) and _symlink_on_the_way(library, joined):
+            raise PathTraversalError(
+                f"'{name}' passes through a symlink in workspace "
+                f"'{destination.name}' - a copy never writes through one"
+            )
+        target = validate_path(joined, library)
+        if not os.path.lexists(target):
+            to_copy.append(name)
+        elif os.path.isfile(target) and _same_bytes(
+            os.path.join(source_library, *name.split("/")), target
+        ):
+            already_present.append(name)
+        else:
+            conflicts.append(name)
+    return to_copy, already_present, conflicts
+
+
+def _kept_entry(directory, file_name):
+    """The kept-shots entry a folder's manifest holds for one file, or None."""
+    for entry in (_read_manifest(directory) or {}).get("steps") or []:
+        if isinstance(entry, dict) and entry.get("files") == [file_name]:
+            return entry
+    return None
+
+
+def _copy_asset(source, destination, name, totals):
+    """Link (or copy) one asset into place, then merge its note and its
+    kept-shots entry into the destination folder's sidecars - written
+    fresh, so an edit on either side stays on that side."""
+    parts = name.split("/")
+    source_path = os.path.join(os.path.realpath(source.assets), *parts)
+    library = os.path.realpath(destination.assets)
+    target = validate_path(os.path.join(library, *parts), library)
+    os.makedirs(os.path.dirname(target), exist_ok=True)
+    _copy_file(source_path, target, totals)
+
+    source_dir, target_dir = os.path.dirname(source_path), os.path.dirname(target)
+    file_name = parts[-1]
+    set_file_note(target_dir, file_name, read_notes(source_dir)["files"].get(file_name))
+    kept = _kept_entry(source_dir, file_name) or {}
+    record_kept_shots(target_dir, file_name, kept.get("shots"), kept.get("provenance"))
+
+
+def _refuse_unless_copyable(source, destination, runs, assets):
+    """The checks on the request as a whole, before any entry is read."""
+    for side in (source, destination):
+        if isinstance(side, ConfiguredWorkspace):
+            raise CopyRefused(
+                "This server has no workspace root - it was started with "
+                "individual directory overrides, so there is no other "
+                "workspace to copy to or from"
+            )
+    if os.path.realpath(source.root) == os.path.realpath(destination.root):
+        raise InvalidInputError(
+            f"Source and destination are both '{source.name}' - name another "
+            f"workspace to copy into"
+        )
+    if not runs and not assets:
+        raise InvalidInputError("Name at least one run or asset to copy")
+    for folder, named in ((destination.outputs, runs), (destination.assets, assets)):
+        if not named:
+            continue
+        os.makedirs(folder, exist_ok=True)
+        if not os.access(folder, os.W_OK):
+            raise CopyRefused(f"Workspace '{destination.name}' is not writable")
+
+
+def _plan_runs(source, outputs, runs, active_runs):
+    """({identity: [run id]} to copy, [already present], [active]) - every
+    entry checked before anything is written."""
+    named = []
+    for entry in runs:
+        for found in _source_runs(source, entry):
+            if found not in named:
+                named.append(found)
+    active = set(active_runs)
+    conflicts = []
+    already_present = []
+    to_copy = {}
+    for identity, run_id in named:
+        name = f"{identity}/{run_id}"
+        if name in active:
+            conflicts.append(name)
+            continue
+        target = validate_path(
+            os.path.join(outputs, *identity.split("/"), run_id), outputs
+        )
+        if os.path.lexists(target):
+            already_present.append(name)
+        else:
+            to_copy.setdefault(identity, []).append(run_id)
+    return to_copy, already_present, conflicts
+
+
+def _refuse_conflicts(active, differing):
+    """One refusal naming every conflict the plan found, or nothing."""
+    if not active and not differing:
+        return
+    reasons = []
+    if active:
+        reasons.append(
+            "these runs' jobs are still queued or running, so their manifests "
+            "are not final - wait for them, then copy: " + ", ".join(active)
+        )
+    if differing:
+        reasons.append(
+            "the destination already holds a different file at: "
+            + ", ".join(differing)
+            + " - a copy never replaces one; delete or rename it first"
+        )
+    raise CopyRefused(
+        "Nothing was copied: " + "; and ".join(reasons),
+        conflicts=active + differing,
+    )
+
+
+def _copy_warnings(copied, outputs, source_root):
+    """What the caller should know about the copied runs - never a refusal."""
+    warnings = {}
+    unresolved = {}
+    absolute = {}
+    for name in copied:
+        manifest = _read_manifest(os.path.join(outputs, *name.split("/"))) or {}
+        refs = _unresolved_inputs(manifest, outputs)
+        if refs:
+            unresolved[name] = refs
+        paths = _absolute_paths(manifest, source_root)
+        if paths:
+            absolute[name] = paths
+    if unresolved:
+        warnings["unresolved_output_refs"] = unresolved
+    if absolute:
+        warnings["absolute_paths"] = absolute
+    if copied:
+        warnings["no_jobs"] = NO_JOBS_NOTE
+    return warnings
+
+
+def copy_between(source, destination, runs=(), assets=(), active_runs=()):
+    """Copy runs and assets from one workspace into another.
+
+    Args:
+        source, destination: Workspaces under one root, already resolved
+            and known to exist
+        runs: `<identity>/<run id>` or bare `<identity>` entries
+        assets: Library-relative files or folders, as after `asset:`
+        active_runs: `<identity>/<run id>` of the source's runs whose job
+            is still queued or running - their manifest is not final
+
+    Returns:
+        {copied: {runs, assets}, already_present, renumbered, warnings,
+        bytes_linked, bytes_copied}
+
+    Raises:
+        InvalidInputError, PathTraversalError: A malformed or escaping entry
+        CopyRefused: Anything else that stops the copy; nothing was written
+    """
+    runs, assets = list(runs or []), list(assets or [])
+    _refuse_unless_copyable(source, destination, runs, assets)
+    outputs = os.path.realpath(destination.outputs)
+    to_copy, runs_present, active = _plan_runs(source, outputs, runs, active_runs)
+    assets_to_copy, assets_present, differing = (
+        _plan_assets(source, destination, assets) if assets else ([], [], [])
+    )
+    _refuse_conflicts(active, differing)
+
+    totals = {"bytes_linked": 0, "bytes_copied": 0}
+    renumbered = {}
+    copied = []
+    for identity, run_ids in to_copy.items():
+        renumbered.update(
+            _copy_identity(source, destination, identity, run_ids, totals)
+        )
+        copied.extend(f"{identity}/{run_id}" for run_id in run_ids)
+    for name in assets_to_copy:
+        _copy_asset(source, destination, name, totals)
+    forget_workspace_usage()
+    logger.info(
+        f"Copied {len(copied)} run(s) and {len(assets_to_copy)} asset(s) from "
+        f"workspace {source.name} to {destination.name}"
+    )
+
+    return {
+        "source": source.name,
+        "destination": destination.name,
+        "copied": {"runs": copied, "assets": assets_to_copy},
+        "already_present": runs_present + assets_present,
+        "renumbered": renumbered,
+        "warnings": _copy_warnings(copied, outputs, os.path.realpath(source.root)),
+        **totals,
+    }
diff --git a/dw_mcp/assets.py b/dw_mcp/assets.py
index c9cafbea..f018859a 100644
--- a/dw_mcp/assets.py
+++ b/dw_mcp/assets.py
@@ -14,7 +14,7 @@
 from urllib.parse import urlsplit
 
 from dw_mcp import confine
-from dw_mcp.client import UNSHAREABLE_HOSTS, DwApiError, api_path, project
+from dw_mcp.client import UNSHAREABLE_HOSTS, DwApiError, api_path, clip_note, project
 
 # Twin of the server's own limit (dw/server/routes/assets.py). Checked here as well so
 # a 200MB file fails before it is read and pushed, not after
@@ -131,12 +131,12 @@ def _confine_source(path, roots, named, client, workspace=None):
 
 # What a compact asset entry keeps: enough to name and choose one, nothing
 # that only opening or previewing it needs
-ASSET_SUMMARY_FIELDS = ("name", "reference", "kind", "size", "origin")
+ASSET_SUMMARY_FIELDS = ("name", "reference", "kind", "size", "origin", "note")
 
 
 def _summarised_asset_entries(entries):
     return [
-        project(entry, ASSET_SUMMARY_FIELDS)
+        clip_note(project(entry, ASSET_SUMMARY_FIELDS))
         for entry in entries
         if isinstance(entry, dict)
     ]
@@ -228,8 +228,24 @@ def delete_asset(client, name, workspace=None):
     return client.delete_json(api_path("api", "assets", name), workspace=workspace)
 
 
+def set_note(client, target, note, workspace=None):
+    """Set (or clear, with None or '') the note on a run, an output file, an
+    asset ('asset:<name>') or a workspace ('workspace:<name>'). `workspace`
+    pins this one call, as `delete_asset`'s does: a run or file name is read
+    in that workspace rather than the session's."""
+    return client.put_json(
+        "/api/notes", {"target": target, "note": note}, workspace=workspace
+    )
+
+
 def keep_output(
-    client, name, asset_name=None, overwrite=False, shared=False, workspace=None
+    client,
+    name,
+    asset_name=None,
+    overwrite=False,
+    shared=False,
+    workspace=None,
+    note=None,
 ):
     """Keep a generated file as an input asset, under a stable name.
 
@@ -253,6 +269,7 @@ def keep_output(
             "asset_name": asset_name,
             "overwrite": overwrite,
             "shared": shared,
+            "note": note,
         },
         workspace=workspace,
     )
@@ -265,6 +282,7 @@ def upload_asset(
     asset_name=None,
     shared=False,
     workspace=None,
+    note=None,
 ):
     """Put an image, video or audio file into the server's asset library and
     get back the reference a workflow can use.
@@ -291,7 +309,9 @@ def upload_asset(
     required so the upload has a name and extension to be validated against.
 
     `asset_name` is the name it is stored under - 'cast/priya-voice.wav'
-    rather than the random one an upload gets by default. A recurring cast
+    rather than the random one an upload gets by default. It lands under
+    `uploads/` ('asset:uploads/cast/priya-voice.wav'), not at the library
+    root as `keep_output`'s `asset_name` does. A recurring cast
     referenced as 'asset:uploads/084eaecc....wav' in every workflow cannot
     be told apart without opening each file, which is the whole reason to
     name one (2026-09-11). With `file_path`, the extension comes from the
@@ -312,7 +332,12 @@ def upload_asset(
 
     if content is not None:
         return _upload_inline(
-            client, content, asset_name=asset_name, shared=shared, workspace=workspace
+            client,
+            content,
+            asset_name=asset_name,
+            shared=shared,
+            workspace=workspace,
+            note=note,
         )
 
     path = os.path.abspath(os.path.expanduser(str(file_path)))
@@ -353,6 +378,8 @@ def upload_asset(
         params["asset_name"] = asset_name
     if shared:
         params["shared"] = "true"
+    if note:
+        params["note"] = note
     result = client.post_bytes("/api/uploads", body, params=params, workspace=workspace)
     # A server with no asset library refuses the upload (409) - there is
     # nothing an `asset:` argument could name. One with a library gives the
@@ -366,7 +393,9 @@ def upload_asset(
     }
 
 
-def _upload_inline(client, content, asset_name=None, shared=False, workspace=None):
+def _upload_inline(
+    client, content, asset_name=None, shared=False, workspace=None, note=None
+):
     """The `content=` path of upload_asset - bytes with no path behind
     them, so nothing here is confined or read off any disk (#203)."""
     if not asset_name:
@@ -400,6 +429,8 @@ def _upload_inline(client, content, asset_name=None, shared=False, workspace=Non
     params = {"filename": asset_name, "asset_name": asset_name}
     if shared:
         params["shared"] = "true"
+    if note:
+        params["note"] = note
     result = client.post_bytes("/api/uploads", body, params=params, workspace=workspace)
     return {
         "reference": result.get("reference"),
diff --git a/dw_mcp/catalog.py b/dw_mcp/catalog.py
index c6a2d184..d2551fc5 100644
--- a/dw_mcp/catalog.py
+++ b/dw_mcp/catalog.py
@@ -3,7 +3,7 @@
 web UI consumes, and reshaping them here would only add a second thing to
 keep in sync."""
 
-from dw_mcp.client import DwApiError, api_path, project
+from dw_mcp.client import DwApiError, api_path, clip_note, project
 
 
 def list_workflows(
@@ -214,7 +214,7 @@ def list_jobs(client, limit=20, status=None, workspace=None):
     body = client.get_json("/api/jobs", params=params or None)
     # The API answers oldest first - the order the web UI's list renders in.
     # An agent reads the top of a tool result, so the newest job belongs there
-    jobs = list(reversed(body.get("jobs") or []))
+    jobs = [clip_note(job) for job in reversed(body.get("jobs") or [])]
     total = body.get("total", len(jobs))
     answer = {"jobs": jobs, "returned": len(jobs), "total": total}
     if total > len(jobs):
@@ -235,6 +235,7 @@ def list_gallery(
     folder=None,
     version=None,
     media=False,
+    role=None,
 ):
     """Generated media in the output directory, newest first. `subfolder`
     narrows to one in-run subfolder ('final', 'intermediate', '' for files
@@ -267,8 +268,13 @@ def list_gallery(
     `media=True` adds `duration_seconds` to each audio/video entry in the
     page returned, probed the way `get_gallery_metadata` measures a file -
     enough to pick between two takes without one metadata call per
-    candidate. Off by default; a plain call carries no `duration_seconds`."""
+    candidate. Off by default; a plain call carries no `duration_seconds`.
+
+    Each file carries `role` (`final`, `intermediate`, or null with no run);
+    `role=[...]` keeps only those, null counting as final."""
     params = {"limit": limit}
+    if role:
+        params["role"] = list(role)
     if subfolder is not None:
         params["subfolder"] = subfolder
     if folder is not None:
@@ -279,11 +285,23 @@ def list_gallery(
         params["only_orphans"] = "true"
     if media:
         params["media"] = "true"
-    return client.get_json("/api/gallery", params=params, workspace=workspace)
+    result = client.get_json("/api/gallery", params=params, workspace=workspace)
+    files = result.get("files") if isinstance(result, dict) else None
+    if isinstance(files, list):
+        result = {
+            **result,
+            "files": [clip_note(f) if isinstance(f, dict) else f for f in files],
+        }
+    return result
 
 
 def get_gallery_metadata(
-    client, name, envelope=False, workspace=None, interval_seconds=None
+    client,
+    name,
+    envelope=False,
+    workspace=None,
+    interval_seconds=None,
+    include_workflow=True,
 ):
     """Metadata embedded in a saved file: the full workflow that made it -
     the exact workflow, arguments and seed, so a result can be reproduced
@@ -313,9 +331,12 @@ def get_gallery_metadata(
     measure, and the default answer has to stay small. `interval_seconds`
     (0.05 to 3600, default 1.0) narrows the bins; a finer-than-default width
     that would need over 2400 of them is refused with the interval that fits."""
-    params = {"envelope": "true"} if envelope else None
+    params = {"envelope": "true"} if envelope else {}
     if envelope and interval_seconds is not None:
         params["interval_seconds"] = interval_seconds
+    if not include_workflow:
+        params["include_workflow"] = "false"
+    params = params or None
     body = client.get_json(
         api_path("api", "gallery", name, "metadata"),
         params=params,
@@ -325,10 +346,21 @@ def get_gallery_metadata(
     job = body.get("job")
     hints = []
     if body.get("metadata") is None:
-        if job and job.get("id"):
+        if job and job.get("status") == "forgotten":
+            hints.append(
+                "metadata is null because this file has none embedded, and "
+                f"its job {job.get('id')} is no longer in the server's "
+                "history (status 'forgotten'), so get_job_workflow would "
+                "answer 'Unknown job'. What remains is this file's own "
+                "`note` and `inputs` when present, or get_job_workflow of "
+                "an older job that is still listed."
+            )
+        elif job and job.get("id"):
             hints.append(
-                "metadata is null because only an image (PNG/JPEG/WebP) "
-                "carries it embedded - this file's job is known, and "
+                "metadata is null because this file has none embedded - a "
+                "pipeline's image carries it, but video, audio and an image "
+                "a task step wrote (get_last_frame, a crop) do not. "
+                "This file's job is known, and "
                 f'get_job_workflow(job_id="{job["id"]}") returns the exact '
                 "workflow, arguments and seed that produced it."
             )
diff --git a/dw_mcp/client.py b/dw_mcp/client.py
index 5637ee13..3463533f 100644
--- a/dw_mcp/client.py
+++ b/dw_mcp/client.py
@@ -35,6 +35,20 @@ def project(entry, fields):
     return {key: entry.get(key) for key in fields if key in entry}
 
 
+NOTE_CLIP = 200
+
+
+def clip_note(entry, limit=NOTE_CLIP):
+    """`entry` with a `note` over `limit` characters cut to its first `limit`
+    plus an ellipsis, and `note_truncated` set - so a listing of many notes
+    stays small and says which ones to read in full (get_job,
+    get_gallery_metadata)."""
+    note = entry.get("note")
+    if isinstance(note, str) and len(note) > limit:
+        return {**entry, "note": note[:limit] + "\u2026", "note_truncated": True}
+    return entry
+
+
 def is_loopback_url(url):
     """True when `url` names this machine's loopback interface - the case
     where an unauthenticated dw.serve is only reachable by this user."""
@@ -99,8 +113,11 @@ def path_segment(name):
     and the server's own path-traversal check never runs on it. Quoting
     keeps the literal bytes intact on the wire, so it is the server's own
     validation - not this client - that decides what a name is allowed to
-    contain.
+    contain. A segment that is only dots ('.', '..') is not touched by
+    `quote`, so its dots are encoded too: unencoded, httpx would drop it.
     """
+    if name and name.strip(".") == "":
+        return "%2E" * len(name)
     return quote(name, safe="")
 
 
diff --git a/dw_mcp/diagnose.py b/dw_mcp/diagnose.py
index ea961999..305d8dfb 100644
--- a/dw_mcp/diagnose.py
+++ b/dw_mcp/diagnose.py
@@ -12,7 +12,7 @@
 import os
 import time
 
-from dw_mcp.client import DwApiError, api_path, workflow_source
+from dw_mcp.client import DwApiError, api_path, clip_note, workflow_source
 
 logger = logging.getLogger(__name__)
 
@@ -96,6 +96,7 @@ def run_workflow(
     acknowledged_cost=False,
     workspace=None,
     wait_seconds=0,
+    note=None,
 ):
     """Queue a workflow. `workflow_path` (or `name` - the same thing
     `validate_workflow` calls it) is either a catalog name from
@@ -132,6 +133,8 @@ def run_workflow(
         )
     payload = {"arguments": arguments or {}}
     payload.update(_acknowledgement_body(acknowledged_cost))
+    if note:
+        payload["note"] = note
     if path is not None:
         payload["workflow_path"] = path
     else:
@@ -228,6 +231,8 @@ def get_job_events(client, job_id, after=-1, limit=200, kinds=None):
     # can be told apart from a run on the slower card
     "device",
     "queue_position",
+    # Why a queued job is held though a card is free (#869)
+    "waiting_for",
     "warnings",
     "error",
     "event_count",
@@ -237,6 +242,8 @@ def get_job_events(client, job_id, after=-1, limit=200, kinds=None):
     # is what separates a slow job from a hung one on a poll that would
     # otherwise come back byte-identical
     "progress",
+    # Clipped in slim_job: a poll repeats it
+    "note",
 )
 
 
@@ -249,7 +256,7 @@ def slim_job(job):
     running job's carries the steps finished so far (#799), under
     `finished_steps` so it is not read as the final list.
     """
-    slim = {key: job.get(key) for key in _SLIM_KEYS if key in job}
+    slim = clip_note({key: job.get(key) for key in _SLIM_KEYS if key in job})
     if job.get("status") in TERMINAL_STATUSES:
         slim["manifest"] = job.get("manifest")
     elif job.get("manifest"):
diff --git a/dw_mcp/media.py b/dw_mcp/media.py
index 7ba67ee5..6e509a7c 100644
--- a/dw_mcp/media.py
+++ b/dw_mcp/media.py
@@ -334,6 +334,64 @@ def assess_output(client, name, probe=None, detail=False, workspace=None):
     )
 
 
+def compare_outputs(
+    client, names, at=None, crop=None, baseline=None, max_dimension=384, workspace=None
+):
+    """Two to eight outputs side by side at the same moments, with PSNR,
+    SSIM and mean absolute difference against a baseline (#871). The
+    server builds the grid and measures at source resolution; the grid is
+    held to MAX_RETURNED_BYTES, shrunk whole when over it."""
+    payload = {
+        "names": names,
+        "max_dimension": max_dimension,
+        "max_total_bytes": MAX_RETURNED_BYTES,
+    }
+    for key, value in (("at", at), ("crop", crop), ("baseline", baseline)):
+        if value is not None:
+            payload[key] = value
+    return client.post_json(
+        api_path("api", "gallery", "compare"), payload=payload, workspace=workspace
+    )
+
+
+def compare_summary(result):
+    """The comparison's numbers as the lines a tool reply carries beside
+    the grid: the region measured, then one line per compared output."""
+    lines = [
+        f"baseline: {result['baseline']}",
+        f"region: {result['region']}",
+        "columns: "
+        + ", ".join(
+            str(column["moment"])
+            + (f" (frame {column['frame']})" if column.get("frame") is not None else "")
+            for column in result["columns"]
+        ),
+    ]
+    for entry in result["metrics"]:
+        line = f"- row {entry['row'] + 1} {entry['name']}:"
+        if entry["ssim"] is None:
+            lines.append(f"{line} no metrics - {entry['reason']}")
+            continue
+        for key in ("psnr_db", "ssim", "mean_abs_diff"):
+            summary = entry[key]
+            line += (
+                f"  {key} mean {summary['mean']} min {summary['min']}"
+                f" max {summary['max']}"
+            )
+        if entry["psnr_db"].get("identical_columns"):
+            line += f"  ({entry['psnr_db']['identical_columns']} identical columns)"
+        skipped = {cell["reason"] for cell in entry["cells"] if cell["reason"]}
+        if skipped:
+            line += "  skipped: " + "; ".join(sorted(skipped))
+        lines.append(line)
+    if result["fps_differs"]:
+        lines.append("fps_differs: the videos' frame rates differ")
+    if result["downscaled_to"]:
+        lines.append(f"downscaled_to: {result['downscaled_to']} (to fit the budget)")
+    lines.extend(f"note: {note}" for note in result["notes"])
+    return "\n".join(lines)
+
+
 def delete_output(client, name=None, workspace=None, job_id=None):
     """Remove one file from the output directory. The gallery is the output
     directory read back, so this is where a delete belongs.
diff --git a/dw_mcp/server.py b/dw_mcp/server.py
index a91fc06b..60e0c193 100644
--- a/dw_mcp/server.py
+++ b/dw_mcp/server.py
@@ -71,15 +71,13 @@ def wrapper(*args, **kwargs):
     "Shapes: image, image-set, image-edit, shot, sequence, audio, "
     "text, utility. Traits: has-audio, chained, image-conditioned, "
     "identity-referenced, needs-input-media, composes-workflows. An "
-    "open-ended request names a subject, not a shape - decide the "
-    "deliverable's shape first. `list_guides` indexes the docs by "
-    "section and `list_tasks` is what a shape is composed from; "
-    "author new JSON only when neither the catalog nor a "
-    "composition covers the request.\n"
+    "open-ended request names a subject: decide the shape first. `list_guides` indexes the docs and "
+    "`list_tasks` is what a shape is composed from; author new JSON "
+    "only when neither covers the request.\n"
     "\n"
     "`get_server_info` reports the accelerator and this "
-    "session's workspace (`use_workspace` picks it); a CUDA-only "
-    "choice is unavailable on mps or cpu. The engine runs one job per GPU; "
+    "session's workspace (`use_workspace` picks it); CUDA-only "
+    "choices fail on mps or cpu. The engine runs one job per GPU; "
     "`get_health`'s `workers` lists each card's.\n"
     "\n"
     'The loop: `get_guide("workflows", section="Authoring a '
@@ -88,14 +86,13 @@ def wrapper(*args, **kwargs):
     "`plan.estimate` and get the user's go-ahead -> `run_workflow` "
     "-> `wait_for_job` -> `get_job` -> `get_output_image`, "
     "`get_output_frames`, `get_output_audio` to judge the result "
-    "against the ask. Tools that spend GPU time or disk, or "
-    "delete, refuse until "
-    "`acknowledged_cost` is set. A workflow you wrote has no "
+    "against the ask. Give each variation a `run_workflow` `note` "
+    "saying what it tests; `set_note` marks the keeper. Tools "
+    "that spend GPU time or disk, or delete, need `acknowledged_cost`. A workflow you wrote has no "
     "cost: quote the `models/` entry for its pipeline "
     "(`list_workflows(include_models=true)`) times the number of "
     "images. Validate warns (never refuses) past the VRAM ceiling "
-    "of the catalog template with the same pipeline; "
-    "your offload or quantization may differ.\n"
+    "of the catalog template with the same pipeline; your offload or quantization may differ.\n"
     "\n"
     "Arguments carry references: `variable:`, "
     "`previous_result:`, `prompt:` (the stored prompt library), "
@@ -161,6 +158,7 @@ def tool(fn, annotations):
         med.get_output_frames,
         med.get_output_text,
         med.assess_output,
+        med.compare_outputs,
     ):
         tool(fn, READ_ONLY)
     tool(med.download_output, OVERWRITES)
@@ -169,11 +167,13 @@ def tool(fn, annotations):
     tool(asset.list_assets, READ_ONLY)
     tool(asset.upload_asset, WRITES)
     tool(asset.keep_output, WRITES)
+    tool(asset.set_note, WRITES)
     tool(asset.delete_asset, DELETES)
 
     tool(wks.list_workspaces, READ_ONLY)
     tool(wks.use_workspace, WRITES)
     tool(wks.create_workspace, WRITES)
+    tool(wks.copy_to_workspace, WRITES)
     tool(wks.delete_workspace, DELETES)
 
     tool(aut.validate_workflow, READ_ONLY)
diff --git a/dw_mcp/tools_authoring.py b/dw_mcp/tools_authoring.py
index e5c4318f..8150ed33 100644
--- a/dw_mcp/tools_authoring.py
+++ b/dw_mcp/tools_authoring.py
@@ -38,6 +38,27 @@ def create_workspace(self, name: str, use: bool = False) -> dict:
         the result says so."""
         return workspaces.create_workspace(self.client, name, use=use)
 
+    def copy_to_workspace(
+        self,
+        destination: str,
+        runs: list[str] | None = None,
+        assets: list[str] | None = None,
+        source: str | None = None,
+    ) -> dict:
+        """Copy runs and assets from one workspace into another. runs:
+        '<workflow>/<run id>' as list_gallery names it, or a bare
+        '<workflow>' for all its runs. assets: paths as after asset:, a
+        folder ('proj/') for all under it; each keeps its path, note and
+        shots. source defaults to this session's workspace. Media is
+        hard-linked, so a copy costs little disk. What the destination
+        already has is skipped; a different file at an asset's path refuses
+        the whole request; a vN it already uses is renumbered and reported.
+        Copied runs get no job record: they show in list_gallery and resolve
+        as output: refs, not in list_jobs. To move, copy then delete."""
+        return workspaces.copy_to_workspace(
+            self.client, destination, runs, assets, source=source
+        )
+
     def delete_workspace(self, name: str, acknowledged_cost: bool = False) -> dict:
         """Permanently delete a workspace and every workflow, asset and
         generated file in it. Refuses without acknowledged_cost=True, and
diff --git a/dw_mcp/tools_catalog.py b/dw_mcp/tools_catalog.py
index eceedfdf..09a01e7d 100644
--- a/dw_mcp/tools_catalog.py
+++ b/dw_mcp/tools_catalog.py
@@ -261,6 +261,7 @@ def list_gallery(
         folder: str | None = None,
         version: int | None = None,
         media: bool = False,
+        role: list[Literal["final", "intermediate"]] | None = None,
     ) -> dict:
         """List generated output files, newest first. A name is
         <workflow>/<run id>/<file>, where <file> may itself sit in a
@@ -268,38 +269,26 @@ def list_gallery(
         `get_output_image`, `get_output_text`, `download_output`,
         `keep_output` and `delete_output` all take, and the form an
         `output:` reference in a later workflow is built from. Each entry
-        carries `folder` (the workflow) and `subfolder` (the part of the run:
-        by convention `final` is the deliverable and `intermediate` the
-        scratch work, '' when the step chose none); `subfolder=` filters on
-        the latter, so `subfolder="final"` is "what did these runs
-        deliver". Each entry's `url` is already scoped to its workspace;
-        use it as given rather than composing one from the name.
-
-        Entries also carry `run_id` and `version`, the run's stable ordinal
-        (the web UI shows `v5`) - quote the version to a person. `folder=`
-        plus `version=` lists that run; "output:<folder>/v5/<file>" names
-        it. Other tools take `name`.
-
-        `only_orphans=True` inverts the call: instead of files, it returns
-        run directories holding nothing but their own bookkeeping
-        (manifest.json, workflow.json, job.json) as `runs`, each
-        `{name, mtime}` - a run whose output was deleted before
-        `delete_output` could remove it by name, or one that failed before
-        writing anything. `subfolder` does not apply in this mode. `name` is
-        exactly what `delete_output` accepts, so clearing the backlog is
-        list, then delete each name. A run that wrote any file at
-        all - a text-shape prompt, a utility's side output - is not listed;
-        this call only lists, so deciding whether a listed entry is actually
-        junk before calling `delete_output` on it is still yours to make.
-
-        `workspace` names the workspace for this one call without
-        switching the session to it - the same pin `run_workflow`
-        takes, so a job run into another workspace is reachable from
-        here without leaving this one.
-
-        `media=True` adds `duration_seconds` to audio/video entries - two
-        takes sharing a basename are told apart by length, not size or
-        mtime."""
+        carries `folder` (the workflow), `subfolder` (the step's chosen
+        subfolder, '' for none; `subfolder=` filters on it) and `role`:
+        `final` is a deliverable, `intermediate` a file a later step
+        or run consumed, null with no run. `role=` filters. Each entry's `url` is workspace-scoped; use it as given.
+
+        Entries carry `run_id` and `version`, the run's stable ordinal
+        (the web UI's `v5`) - quote it to a person. `folder=` plus
+        `version=` lists that run; "output:<folder>/v5/<file>" names it.
+
+        `only_orphans=True` returns instead the run directories holding
+        only bookkeeping (manifest.json, workflow.json, job.json) as
+        `runs`, each `{name, mtime}` - output deleted, or a run that failed
+        before writing anything; `name` is what `delete_output` accepts.
+        A run that wrote a file is not listed. `subfolder` is
+        ignored. Whether an entry is junk is yours to decide.
+
+        `workspace` scopes one call without switching the session.
+
+        `media=True` adds `duration_seconds` to audio/video entries, to
+        tell takes apart."""
         return catalog.list_gallery(
             self.client,
             limit=limit,
@@ -309,6 +298,7 @@ def list_gallery(
             folder=folder,
             version=version,
             media=media,
+            role=role,
         )
 
     def get_gallery_metadata(
@@ -317,6 +307,7 @@ def get_gallery_metadata(
         envelope: bool = False,
         workspace: str | None = None,
         interval_seconds: float | None = None,
+        include_workflow: bool = True,
     ) -> dict:
         """Get the metadata embedded in a generated file: the exact
         workflow, arguments and seed that produced it, so a result can be
@@ -324,8 +315,9 @@ def get_gallery_metadata(
         and video `metadata` is null and `next` names
         `get_job_workflow(job_id)` when known. `media` carries duration,
         sample rate, channels, fps, size and level - how an agent that
-        cannot listen checks a deliverable; `media.shots` places a joined
-        video's shots.
+        cannot listen checks a deliverable, or an image's measured
+        `width`/`height`; `media.shots` places a joined video's shots.
+        `include_workflow=false` omits the large embedded workflow.
         `envelope=true` adds that level second by second
         (`media.envelope.rms_dbfs` / `peak_dbfs`), which says *where* in a
         track something is: a shot's last frame, a seam's hole, where a
@@ -349,6 +341,7 @@ def get_gallery_metadata(
             envelope=envelope,
             workspace=workspace,
             interval_seconds=interval_seconds,
+            include_workflow=include_workflow,
         )
 
     def list_guides(
diff --git a/dw_mcp/tools_jobs.py b/dw_mcp/tools_jobs.py
index c6ed5f43..7ab0c843 100644
--- a/dw_mcp/tools_jobs.py
+++ b/dw_mcp/tools_jobs.py
@@ -21,6 +21,7 @@ def run_workflow(
         acknowledged_cost: bool | dict = False,
         workspace: str | None = None,
         wait_seconds: int = 0,
+        note: str | None = None,
     ) -> dict:
         """Queue a workflow for generation. This costs GPU time: a run
         occupies a GPU for minutes and the engine runs one job per GPU.
@@ -49,7 +50,10 @@ def run_workflow(
         "downloads": [...the non-null repos in plan.downloads_required]} from
         the validate plan; the server refuses with 409, naming the new
         plan, if the run's shape changed since. Bare true is for a plan
-        that was null."""
+        that was null.
+
+        `note`: what this run is for, shown on every file it writes
+        ('testing video_shift 5 against 3'). Give each variation its own."""
         return diagnose.run_workflow(
             self.client,
             workflow_path=workflow_path,
@@ -60,6 +64,7 @@ def run_workflow(
             acknowledged_cost=acknowledged_cost,
             workspace=workspace,
             wait_seconds=wait_seconds,
+            note=note,
         )
 
     # The cap is a number a caller paces against, so the description
@@ -80,7 +85,9 @@ def get_job(self, job_id: str) -> dict:
         declared - by convention `final` is the deliverable, `intermediate`
         the scratch work, and '' a step that said nothing. A step served
         from the step cache is marked `reused`, with the earlier run's
-        files. On failure, read the error and traceback before changing
+        files. A pipeline step's entry carries `timing`, where its time
+        went (`get_guide("workspaces", section="Step timing")`). On failure,
+        read the error and traceback before changing
         anything. `device` is the card the job ran or is running on, e.g.
         `cuda:1 NVIDIA GeForce RTX 3090`; null for jobs from before
         multi-GPU. `acknowledged` says which form of cost acknowledgement
@@ -113,7 +120,8 @@ def get_job_events(
         difference between two events. For 'is it still moving?' the
         `progress` block on get_job/wait_for_job is cheaper than a page of
         events. `kinds` (e.g. `["log", "warning"]`, or a warning's `kind`)
-        filters the page - `memory` events otherwise dominate it.
+        filters the page - `memory` events otherwise dominate it;
+        `cache_stats` is a step cache's skip counts, once per call.
 
         A `kind: "phase_stall"` entry is a watchdog notice, not progress - it
         fires every ~30s a phase goes quiet, not evidence of a hang by
@@ -165,9 +173,9 @@ def wait_for_job(self, job_id: str, timeout_seconds: int = 20) -> dict:
         )
 
     def cancel_job(self, job_id: str) -> dict:
-        """Ask a queued or running job to stop. Cooperative: a running job
-        stops at the next step or denoise-step boundary, not instantly.
-        Deliberately not gated - it ends a cost rather than starting one."""
+        """Stop a queued or running job at its next step or denoise-step
+        boundary; a load is killed after 30 s (`cancel_requested` till then).
+        Not gated - it ends a cost rather than starting one."""
         return diagnose.cancel_job(self.client, job_id)
 
     def rerun_job(
diff --git a/dw_mcp/tools_media.py b/dw_mcp/tools_media.py
index 163b7f5d..b525ba43 100644
--- a/dw_mcp/tools_media.py
+++ b/dw_mcp/tools_media.py
@@ -209,6 +209,36 @@ def assess_output(
             self.client, name, probe=probe, detail=detail, workspace=workspace
         )
 
+    def compare_outputs(
+        self,
+        names: list[str],
+        at: list[str | float] | None = None,
+        crop: list[int] | list[list[int]] | None = None,
+        baseline: str | None = None,
+        max_dimension: int = 384,
+        workspace: str | None = None,
+    ) -> list[ImageContent | TextContent]:
+        """2-8 outputs as one grid (a row each, a column per `at` moment,
+        the same frame number in all) with PSNR, SSIM and mean abs diff
+        against `baseline` (default the first). One `crop` box is shown
+        and measured; one box per name is shown only. Takes `asset:`."""
+        result = media.compare_outputs(
+            self.client,
+            names,
+            at=at,
+            crop=crop,
+            baseline=baseline,
+            max_dimension=max_dimension,
+            workspace=workspace,
+        )
+        image = result["image"]
+        return [
+            ImageContent(
+                type="image", data=image["data"], mime_type=image["mime_type"]
+            ),
+            TextContent(type="text", text=media.compare_summary(result)),
+        ]
+
     def delete_output(
         self,
         name: str | None = None,
@@ -316,6 +346,7 @@ def upload_asset(
         asset_name: str | None = None,
         shared: bool = False,
         workspace: str | None = None,
+        note: str | None = None,
     ) -> dict:
         """Put an image, video or audio file into the server's asset
         library and get back the `asset:` reference to use in a workflow.
@@ -337,12 +368,13 @@ def upload_asset(
 
         Accepts the usual image, video and audio extensions; reference the
         result, not a path. Pass `asset_name` for a readable stored name
-        ("cast/priya-voice.wav", folders allowed) - otherwise (with
-        `file_path`) the name is random. Pass `shared=true` to put it in
+        ("cast/priya-voice.wav", folders allowed; under `uploads/`) -
+        otherwise (with `file_path`) it is random. Pass `shared=true` to put it in
         the library every workspace shares - where a recurring cast
         belongs, since a workspace's own assets are invisible from the next.
 
-        `workspace` scopes this one call without changing the session pin."""
+        `workspace` scopes this one call without changing the session pin.
+        `note` is kept with the asset."""
         return assets.upload_asset(
             self.client,
             file_path=file_path,
@@ -350,6 +382,7 @@ def upload_asset(
             asset_name=asset_name,
             shared=shared,
             workspace=workspace,
+            note=note,
         )
 
     def keep_output(
@@ -359,6 +392,7 @@ def keep_output(
         overwrite: bool = False,
         shared: bool = False,
         workspace: str | None = None,
+        note: str | None = None,
     ) -> dict:
         """Keep a generated file as an input asset under a stable `asset:`
         name, so later workflows can rely on it - a run's own name moves
@@ -368,7 +402,8 @@ def keep_output(
         re-uploaded. Pass `shared=true` to keep it in the library every
         workspace shares instead.
 
-        `workspace` scopes this one call without changing the session pin."""
+        `workspace` scopes this one call without changing the session pin.
+        `note` is kept with the asset; left out, the source's is copied."""
         return assets.keep_output(
             self.client,
             name,
@@ -376,8 +411,19 @@ def keep_output(
             overwrite=overwrite,
             shared=shared,
             workspace=workspace,
+            note=note,
         )
 
+    def set_note(
+        self, target: str, note: str | None = None, workspace: str | None = None
+    ) -> dict:
+        """Set or clear (note null or '') the note on a run
+        ('<workflow>/<run id>'), an output file (gallery name), 'asset:<name>'
+        or 'workspace:<name>'. Plain text, 4000 chars max: what it is for -
+        what a run tested, why a file is the keeper. Free. `workspace` scopes
+        one call."""
+        return assets.set_note(self.client, target, note, workspace=workspace)
+
     def delete_asset(self, name: str, workspace: str | None = None) -> dict:
         """Permanently remove one file from the asset library, by the name
         `list_assets` reports (without the `asset:` prefix). Not
diff --git a/dw_mcp/workspaces.py b/dw_mcp/workspaces.py
index 7cf69cee..b327a2be 100644
--- a/dw_mcp/workspaces.py
+++ b/dw_mcp/workspaces.py
@@ -10,7 +10,7 @@
 
 import logging
 
-from dw_mcp.client import DEFAULT_WORKSPACE, DwApiError, api_path, project
+from dw_mcp.client import DEFAULT_WORKSPACE, DwApiError, api_path, clip_note, project
 from dw_mcp import catalog
 
 logger = logging.getLogger(__name__)
@@ -18,7 +18,7 @@
 
 # What a compact workspace entry keeps: enough to choose one or judge its
 # size, nothing that only naming its folders needs
-WORKSPACE_SUMMARY_FIELDS = ("name", "default", "usage")
+WORKSPACE_SUMMARY_FIELDS = ("name", "default", "usage", "note")
 
 # What create_workspace answers with: the name to address it by, never the
 # folders the server made for it - no MCP response carries an absolute
@@ -79,7 +79,7 @@ def list_workspaces(client, detail=False):
             result = {
                 **result,
                 "workspaces": [
-                    project(entry, WORKSPACE_SUMMARY_FIELDS)
+                    clip_note(project(entry, WORKSPACE_SUMMARY_FIELDS))
                     for entry in entries
                     if isinstance(entry, dict)
                 ],
@@ -151,6 +151,19 @@ def create_workspace(client, name, use=False):
     return result
 
 
+def copy_to_workspace(client, destination, runs=None, assets=None, source=None):
+    """Copy runs and assets into another workspace under the same root.
+    `source` defaults to this session's workspace. The server hard-links
+    media and copies sidecars, skips what the destination already holds
+    (`already_present`), refuses a differing asset at the same path, and
+    reports renumbered `vN` and warnings."""
+    source = source or client.workspace
+    return client.post_json(
+        api_path("api", "workspaces", destination, "copy"),
+        {"source": source, "runs": list(runs or []), "assets": list(assets or [])},
+    )
+
+
 def delete_workspace(client, name, acknowledged_cost=False):
     """Delete a workspace and every workflow, asset and generated file in it.
 
diff --git a/loras/minimax-h3/realism-people.json b/loras/minimax-h3/realism-people.json
index 484cba4d..e1aeddd0 100644
--- a/loras/minimax-h3/realism-people.json
+++ b/loras/minimax-h3/realism-people.json
@@ -5,9 +5,12 @@
   "base_models": [
     "MiniMaxAI/MiniMax-H3"
   ],
-  "workflow": "t2va",
+  "workflow": [
+    "t2va",
+    "fl2va"
+  ],
   "description": "Realistic people and faces; stacks as a second adapter on the 8-step turbo",
-  "use_when": "People, crowds or faces should look photoreal; tried on T2VA only. It tightens framing against a prompt's wide shot",
+  "use_when": "People, crowds or faces should look photoreal on T2VA or FL2VA, not reference-to-video (inert there). It tightens framing against a prompt's wide shot",
   "scale": {
     "default": 0.7,
     "range": [
@@ -23,6 +26,10 @@
     {
       "note": "Best arm of the 2026-10-03 eval, about 6 s over the 9.5 min 768p baseline; 1.0 and a second prompt untested",
       "issue": 585
+    },
+    {
+      "note": "h3-quality matrix R3: 4/5 faces better on FL2VA/I2VA; the ref2va run was inert, as its header's base_model minimax-h3-fl2va says",
+      "issue": 870
     }
   ],
   "license": "other",
diff --git a/plugins/dw/.claude-plugin/plugin.json b/plugins/dw/.claude-plugin/plugin.json
index 9e4b6aa5..18c809cd 100644
--- a/plugins/dw/.claude-plugin/plugin.json
+++ b/plugins/dw/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
     "name": "dw",
     "description": "Compose MiniMax H3 video, MiniMax Music 3, LTX-2.5 and Kandinsky 6.0 workflows over a dw MCP server, and cut a multi-episode series from them: which template fits which shape, the hard rules, cost, and how to judge the output. Prompt format comes from the vendors' own guides.",
-    "version": "0.13.0",
+    "version": "0.14.0-alpha.1",
     "author": {
         "name": "Don Kackman"
     },
diff --git a/plugins/dw/skills/minimax-h3/SKILL.md b/plugins/dw/skills/minimax-h3/SKILL.md
index b824432e..58869d10 100644
--- a/plugins/dw/skills/minimax-h3/SKILL.md
+++ b/plugins/dw/skills/minimax-h3/SKILL.md
@@ -28,6 +28,10 @@ arguments; prompt format is MiniMax's, from its text not here.
   first and last `templates/minimax/first-and-last-frame`; last only
   `templates/minimax/last-frame-only`; a one-line idea plus a picture
   `templates/minimax/enhance-prompt-with-image`.
+- **A locked frame that lip-syncs to a song** (FL2VA takes no audio): Ref2VA
+  `[keyframe completion + audio reuse]`, `<Picture 1>` the first frame,
+  `<Audio 1>` the song, held with `hold_audio` (#852). It keeps the framing,
+  not the pixels; a last frame costs 45% more and does not land.
 - **Pinned to a clip** (hold earlier footage): a `guides` argument on
   `t2va`/`fl2va` - up to 4 clips, 3 on a guide chain, each at a
   `frame` that is a multiple of 17; the VRAM ceiling charges each
@@ -43,18 +47,16 @@ arguments; prompt format is MiniMax's, from its text not here.
   Z-Image, references it in the same workflow;
   `templates/minimax/voice-timbre-reference` fixes a voice from a Bark line.
 - **Several boards, one generation, unbroken score**:
-  `templates/minimax/storyboard` - H3 cuts between boards in one
-  generation, which no concat matches. One beat only; past that use the
-  cuts pattern below.
+  `templates/minimax/storyboard`, cuts no concat matches. One beat only;
+  past that use the cuts pattern below.
 - **Longer than 14.4 seconds**: chain when one action or line of speech
   crosses the seam, cut when the scene changes.
 - **As one take (a chain)**: `templates/minimax/chained-segments`
   (default `continuity: "last_frame"`; `continuity: "guide"`, `guide_frames`
   22 or 39 - default 22 - holds the last frames and voice as a guide instead.
-  The guide prefix is trimmed off again, so the deliverable carries no
-  repeated frames. `carry_audio` (default true, a chain-block setting the
-  template does not expose as a variable) is what brings the voice with the
-  guide. Not on the ref2va chains, as guides stay off ref2va), `templates/minimax/chain-video-continuity`
+  `carry_audio` (default true, a chain-block setting, not a variable)
+  brings the voice. Not on the ref2va chains, as guides stay off ref2va),
+  `templates/minimax/chain-video-continuity`
   (previous segment's tail rides as a video reference - motion, camera,
   voice carry the seam), `templates/minimax/chain-matched-to-audio` (a track
   sets the length, muxed back seamless), `templates/minimax/chain-matched-and-aligned`
@@ -70,22 +72,21 @@ arguments; prompt format is MiniMax's, from its text not here.
   `max(124, next 17n+5 ≥ lead + cut)`, the smallest `17n + 5` at or above
   `lead_frames + cut_frames`, at least 124; past 345, split the span.
   Before composing one, read `references/cuts.md`: the `shots` list (a music
-  video's six fields, plan then render), cost per entry, scoring and one voice across cuts.
+  video's six fields), cost per entry, scoring and one voice across cuts.
 - **Dialogue into a song**, not a concat: `slice_audio`, `join_into_song`,
   `pair_audio`, in that reference's last section.
 - **Unrelated shots, no cut**: `templates/minimax/shots-batch` - one H3
-  step per `shots` entry, no shared cast, no concat. `keep_output` each
-  clip, then `templates/assemble-and-score` cuts and scores.
+  step per `shots` entry, no concat. `keep_output` each clip, then `templates/assemble-and-score` cuts and scores.
 - **Music alone**: `templates/minimax/music` (Music3); the `minimax-music3`
   skill - its `audio_duration` is a ceiling, not a length.
 
-If none fits, compose from `list_tasks` before writing a new workflow and
-read the `workflows` guide's authoring section.
+If none fits, compose from `list_tasks` (the `workflows` guide's authoring
+section).
 
 ## Hard rules
 
 - `num_frames` is `17n + 5`, from 124 to 345, at a fixed 24 fps: 5.17 to 14.4
-  seconds in one clip. Most default to 124 for fast iteration (storyboard 192);
+  seconds in one clip. Most default to 124 (storyboard 192);
   `num_frames=345` is the full length, and fits 24 GB at 544p only (#271).
   The 5-second floor is diffusers'; the model card says 4.
 - Canvas: 768-pixel short edge, at most 768x1344, in multiples of 32, aspect
@@ -97,6 +98,8 @@ read the `workflows` guide's authoring section.
   Never put an FL2VA LoRA on a reference template: `ref2va` holds
   `transformer_ref` alone, so anything handed there degrades output.
   `validate_workflow` refuses it and warns on a `weight_name` naming neither.
+- Smeary faces (int8 base) or draft -> final tiers: `references/quality-and-speed.md`.
+- CUDA: `attention_backend=sage_hub` (null elsewhere; mps fails at run).
 - Fit a crowd's action to what it holds: candle-holders asked to clap
   rendered three-handed people.
 - A directed crowd move needs its landmark in frame: "marches up to the
@@ -109,19 +112,17 @@ read the `workflows` guide's authoring section.
   for ~1.5s (about 1 in 25): check a shot's first frames and say in
   `subject_definitions` that the portrait's backdrop, pose and framing are
   not reused.
-- Ref2VA reaches 1344x768 too, not only the FL2VA 768p template - see the
-  `recipes` guide's MiniMax-H3 section for the trade-off. At that canvas the
-  24 GB ceiling on the `17n+5` grid drops with each reference: 243 frames at
-  one, 209 at two, 175 at three, 141 at four. `validate_workflow` refuses
+- Ref2VA reaches 1344x768 too (trade-off: the `recipes` guide's MiniMax-H3
+  section). There the 24 GB ceiling on the `17n+5` grid drops with each
+  reference: 243 frames at one, 209 at two, 175 at three, 141 at four. `validate_workflow` refuses
   the largest `for_each` shot over budget.
 - Steps are the LoRA's passes plus one (5 for the 4-step default, 9 for
   8-step): the scheduler counts the terminal zero, so `denoise_total_steps`
   reports 4. A null `lora_model_name` drops the LoRA; raise steps and shifts too.
 - Nothing carries between generations except a passed reference, a
-  held track or a `guides` clip: there is no latent memory (a diffusers
-  limit, not the model's). Identity rides on a picture, voice
-  timbre on an audio clip, motion/camera on a video tail, score across
-  cuts under concat.
+  held track or a `guides` clip: there is no latent memory. Identity rides
+  on a picture, voice timbre on an audio clip, motion/camera on a video
+  tail, score across cuts under concat.
 - Lip sync to supplied audio: an audio reference alone, as the
   `match_audio` chains pass it, can sing shifted beats off the track; `music-video`
   holds each slice as well by default, and the chains' `hold_audio` variable adds a
@@ -190,7 +191,7 @@ Before writing lines, read `references/dialogue.md`: how long a line fits a clip
 5. After a run worth keeping, `get_job_workflow` and `save_workflow` it;
    `export_job` bundles it on the server. `auth_required: false` - fetch
    `open_url` into `exports/` (never a temp dir). `true` - hand `open_url`
-   to the person and keep using `get_output_image`/`_audio`/`_frames`.
+   to the person.
 
 ## Sources
 
diff --git a/plugins/dw/skills/minimax-h3/references/checkpoints-and-loras.md b/plugins/dw/skills/minimax-h3/references/checkpoints-and-loras.md
index dc510fe4..8c9a8c32 100644
--- a/plugins/dw/skills/minimax-h3/references/checkpoints-and-loras.md
+++ b/plugins/dw/skills/minimax-h3/references/checkpoints-and-loras.md
@@ -6,7 +6,7 @@ A checkpoint comes with a canvas, a sigma shift and an alpha and they move
 together - change one, change all. `video_shift`, `audio_shift` and
 `lora_alpha` are variables everywhere, so a swap is arguments, not a file.
 
-Four combinations are tested, plus one addition below, nothing else:
+Four combinations are tested, plus the base model and one addition below, nothing else:
 **default** - 4-step FL2VA v1.2 (`minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors`),
 shift **6**/3, `num_inference_steps=5`, alpha unset, on every T2VA/FL2VA
 template at 960x544 and 1344x768 (since 2026-10-10; trained at 768p,
@@ -19,11 +19,18 @@ Swap file, shift and steps together. The
 544p 4-step v0.1 file renders noise. v1.2 records alpha 8; v1.0/v1.1 record
 128 - never state an alpha the header doesn't.
 
+**Base, no LoRA**: `lora_model_name: null`, int8, 12-30 steps (floor 12), shift
+12/3 - the quality path for faces (4/5 against 2-3/5 on turbo or int4); on a
+24 GB CUDA card 1344x768 takes ~13 min at 12 steps and ~23 min at 30 with
+`first_block` 0.05. Numbers, caveats and prompting rules in
+`references/quality-and-speed.md`.
+
 **Realism People** (#585) as a second `loras` entry on a t2va
 step (`fal/MiniMax-H3-Realism-People-LoRA`,
 `h3-realism-people-t2v-i2v-r2v.safetensors`, scale 0.7, own `adapter_name`;
-a saved copy): validate warns the name fits neither partition, so never on
-a `ref2va` template.
+a saved copy): validate refuses it on `ref2va`, so never on
+a `ref2va` template: its header says `base_model: minimax-h3-fl2va`, and
+it is inert on `reference-to-video` whatever `r2v` the filename says.
 
 Acc PDD, HyperFlow and drozbay FastH3 need their own loaders, not `loras`:
 don't try them. Any other LoRA (a style, a motion fix): `list_loras` first -
diff --git a/plugins/dw/skills/minimax-h3/references/quality-and-speed.md b/plugins/dw/skills/minimax-h3/references/quality-and-speed.md
new file mode 100644
index 00000000..8399a87b
--- /dev/null
+++ b/plugins/dw/skills/minimax-h3/references/quality-and-speed.md
@@ -0,0 +1,198 @@
+# MiniMax H3: the base-model quality path and measured speed levers
+
+Part of the `minimax-h3` skill; its *Hard rules* say when to read this.
+
+Measured on a CUDA box (RTX 3090 24 GB, `sage_hub`), 1344x768, 4 references
+(2 portraits, 2 voice clips), 124 frames, seed 42, #863. **These are CUDA
+numbers**: MPS has no sage backend and runs several times slower, so take the
+ordering, not the minutes. Face score is realism at native-resolution crops,
+judged from frames by a model (5 = cinema-grade photographic).
+
+## Quality ladder
+
+Base model = `lora_model_name: null`, shift video 12 / audio 3. Turbo = the
+shift the LoRA names.
+
+| Rung | Canvas | Weights | LoRA | Steps | Attn | Min | Face /5 |
+|---|---|---|---|---|---|---|---|
+| L0 | 960x544 | int4 | ref2v 4-step v0.1 | 5 | sage_hub | 3.5 | 2 |
+| L1 | 1344x768 | int4 | ref2v 4-step v0.1 | 5 | sage_hub | 5.4 | 2.5 |
+| L7 | 1344x768 | int8 | ref2v 4-step v0.1 | 5 | sage_hub | 7.2 | 3 |
+| L3 | 1344x768 | int8 | ref2v 8-step v1.0 768p | 9 | sage_hub | 11.2 | 3 |
+| L4 | 1344x768 | int8 | ref2v 8-step v1.0 768p | 9 | native | 14.5 | 3 |
+| B4 | 960x544 | int4 | none | 12 | sage_hub | 6.6 | 3 |
+| B1 | 960x544 | int4 | none | 30 | sage_hub | 15.1 | 3 |
+| B5 | 1344x768 | int4 | none | 12 | sage_hub | 11.8 | 3.5 |
+| B6 | 1344x768 | int4 | none | 8 | sage_hub | 8.5 | 1.5 (duplicated a character) |
+| B3 | 1344x768 | int8 | none | 12 | sage_hub | 12.9 | 3.5 |
+| L5 | 1344x768 | int8 | none | 30 | sage_hub | 29.5 | 4 |
+| L6 | 1344x768 | int8 | none | 30 | native | 44.2 | 4 |
+| P1 | 1344x768 | int8 | none | 30 | sage_hub + `first_block` 0.05 | 23.1 | 4 |
+| C1 / C2 (close-up) | 1344x768 | int8 | none | 12 / 30 | sage_hub | 13.9 / 22.8 | 4 / 4 |
+
+- **Faces**: turbo LoRAs plus int4 cause the smeary faces, not resolution. The
+  base model at int8 fixes it: `lora_model_name: null`, 12-30 steps, shift
+  12/3. A close-up is already 4/5 at 12 steps.
+- **Composition** (who stands where): attention never moves it; quantization
+  doesn't on a turbo LoRA (L1 = L7) but does on the base model (int4 vs
+  int8); a different LoRA family re-stages; base step count doesn't.
+- **Steps**: the base floor is 12. 8 steps duplicated a character (B6).
+- **Two-character shots at 960x544 smear** (~60 px faces): render them at
+  1344x768 from the start, not at 544 and upscaled.
+- **Draft then final**: pick the path by target and render a cheap draft
+  before the final. See *Ramp* below.
+- **Submit freely**: the server holds a second heavy job, queued with
+  `waiting_for`, until host RAM frees.
+- **Frame ceiling** at 1344x768 with 4 references is 124; 141 was refused
+  (23.9 GB > 23.6). Write to 124 or drop a reference.
+
+## Ramp
+
+Spend GPU time on quality in two tiers: a draft to approve the shot, then a
+final of the same shot. Pick the path by the target **before the first
+render**, because a draft only carries to a final on its own path.
+
+### 1. Pick the path
+
+Both tiers use the same template (`templates/minimax/reference-to-video`, or
+`templates/minimax/dialogue-short` for a cut). `attention_backend=sage_hub`
+is an argument on every H3 template, `dialogue-short` included. Set it at
+both tiers on CUDA: it never moves composition.
+
+**`dialogue-short` at 1344x768** (every rung below is that canvas): a shot
+with 4 references must be 124 frames (*Frame ceiling* above). The default
+`shots` list's `tag` (`shots[4]`) is 141 frames with 4 references, so
+`validate_workflow` refuses it at `variables.shots[4]`. Pass your own
+`shots` argument at both tiers: `get_workflow` the template, copy
+`variables.shots`, set `shots[4].num_frames` to 124 (or drop a reference
+from it), and pass the list unchanged at draft and final. A cut you write
+follows the same rule: every 4-reference shot at 124. Check the trimmed
+shot's line still fits 5.17 s.
+
+| Target | Draft | Final | Only these change |
+|---|---|---|---|
+| **TV** (sitcom, social, previs) | **L1**, ~5.4 min | **L7**, ~7.2 min | `weights_dtype` `{int4}` to `{int8}` |
+| **Cinema** (realistic faces) | **B3**, ~12.9 min | **L5**, ~29.5 min, or **P1**, ~23.1 min | `num_inference_steps` 12 to 30; P1 adds `cache` |
+| **Close-up** | **C1**, ~13.9 min | ship the draft | nothing |
+
+- **TV.** Both rungs are 1344x768 on the 4-step Ref2VA v0.1 LoRA:
+  `lora_model_name` `lightx2v/Minimax-h3-Turbo`, `lora_weight_name`
+  `minimax_h3_ref2v_turbo_4step_v0.1_bf16.safetensors`,
+  `num_inference_steps` 5, `video_shift` 12, `audio_shift` 3. L1 is
+  `weights_dtype` `{int4}`, L7 is `{int8}`. **L0** (the same at 960x544,
+  ~3.5 min) is a throwaway sketch only. Its staging did carry to L7 (below),
+  but it smeared a face at both new seeds, so a face can't be approved on it,
+  and two-character shots at 960x544 smear. Render those at 1344x768 from
+  the start. The L7 final (3/5) is **not confirmed by ear or in playback**.
+- **Cinema.** The base model: `lora_model_name` `null`, `weights_dtype`
+  `{int8}`, 1344x768, `video_shift` 12, `audio_shift` 3. B3 is 12 steps, L5 is
+  30. On `dialogue-short`, add the 124-frame `shots` above at both tiers. **P1** is L5 plus the template's `cache` argument
+  `{"type": "first_block", "threshold": 0.05}` (-22%, the same staging and
+  faces). Both tiers warn `lora_disabled`. That is expected: the warning asks
+  for the base schedule, and these values are it. Never draft at B4 (960x544
+  int4 base) for a 1344x768 final: its staging held on only 2 of 4 seeds.
+- **Close-ups**: C1 is B3's arguments on a close-up shot. It scores 4/5 at
+  12 steps (C1 = C2), so the draft is the deliverable.
+
+### 2. What carries from draft to final
+
+The composition rules under *Quality ladder* hold: attention never moves
+staging, and neither does base step count; a different LoRA family
+re-stages; so does int4 against int8 on the base model. On top of those:
+
+- keep the seed, canvas, prompt and references identical between the tiers;
+- blocking carries, but props and set dressing sometimes don't (a jacket on
+  a chair in C1 only).
+
+Measured (#861) on seeds 42, 7 and 1234, judged by Don: B3 -> P1, C1 -> C2
+and L0 -> L7 each held staging on **3 of 3** seeds. L1 = L7 (the TV pair
+itself) is measured on **1 seed** (42). B4 -> B5 held on only 2 of 4 seeds
+(42, 7, 1234, 99). At seed 1234, B5 (int4) staged like B3 (int8): on the
+base model the canvas moved staging more than the weights did. That is one
+seed against the int4/int8 rule, which stands until it's measured further.
+
+### 3. What to approve at each tier
+
+- **Draft:** blocking, line delivery, timing and head count. Re-roll the
+  seed or the prompt here, and only here.
+- **Final:** faces, skin and hair. On these paths a final that re-stages
+  usually has an argument the table doesn't allow: diff its arguments
+  against the draft's before suspecting the seed.
+
+### 4. How to judge
+
+- Face crops at native resolution, at fixed frames
+  (`get_output_frames`), the same frames at both tiers.
+- A contact sheet (`get_output_frames(count=12)`) for staging.
+- `check-script` for the lines.
+- A 1-5 face score, recorded on the run with `set_note`.
+
+Claude can't judge audio by ear (voice timbre, lip-sync feel, room sound)
+or motion (smear, flicker) in playback. Say so in the note, and ask a
+human for those.
+
+### 5. Cost
+
+Quote `validate_workflow`'s `plan.estimate` for each tier, draft plus
+final. It scales by steps, canvas and frames (#866), but not by
+`weights_dtype`, `attention_backend`, `cache` or a null LoRA. When one of
+those moves it sets `low_confidence` and names the variable in `differs`.
+With `sage_hub` set, every rung above moves one. Quote that rung's minutes
+from the ladder instead (they were measured with `sage_hub`), and say which
+figure you are quoting.
+
+## Prompting the base model
+
+- It invents an extra person unless every subject is placed explicitly
+  ("Howie at frame left, Pat at the right end of the desk"). A head-count
+  sentence ("exactly two people") alone failed three times.
+- Name the set dressing (chair, desk items) in every shot of a sequence, or
+  each shot draws its own set: a chair changed between two close-ups.
+
+## What does not help
+
+- **Realism People LoRA**: its header says `base_model: minimax-h3-fl2va`,
+  `training: text_to_video`, rank 32. It is inert on `reference-to-video`
+  (Ref2VA) despite `r2v` in the filename. It works on FL2VA/I2VA (4/5) but
+  those lose the voice and identity references.
+- **LTX-2.5 refine-in-place on an H3 shot** is not a face fix: cleaner edges,
+  waxy skin, identity drift (2.5/5, 2/5).
+
+## Speed levers
+
+Per phase, from the job event log (minutes unless noted):
+
+| Rung | Change | Denoise | s/pass | Total | vs baseline |
+|---|---|---|---|---|---|
+| B3 | 12 steps | 10.24 | 55.8 | 12.89 | |
+| P2 | + `first_block` 0.05 | 10.31 | 56.3 | 12.79 | 0% |
+| P4 | + `text_kv` | 10.24 | 55.9 | 12.69 | ~0% |
+| P3 | + compile `repeated_blocks` | 14.02 | 288.6 first, 55.2 rest | 16.58 | +29% |
+| L5 | 30 steps | 26.97 | 55.8 | 29.49 | |
+| P1 | + `first_block` 0.05 | 20.61 | 42.2 avg | 23.06 | **-22%** |
+| P5 | + `taylorseer` interval 3 order 1 | | | OOM at 2 min | |
+
+Denoise is 80-91% of a job, ~56 s/pass with int8 weights streamed by
+block-level group offload: compute-bound, not PCIe-bound.
+
+- **`sage_hub`**: -23% at turbo 8-step, -33% at base 30, visually lossless.
+  Advise it first where the box has it: `attention_backend=sage_hub`, an
+  argument on every H3 template (default `null`, the H3 step only). It needs
+  CUDA, the `kernels` package and `DIFFUSERS_TRUST_REMOTE_KERNELS=true`; leave
+  it `null` on mps or cpu, where it passes validate and fails at run time.
+- **`first_block` 0.05**: -22% at 30 base steps with identical staging and
+  faces (PSNR 27.5 dB against L5). It skips nothing at 12 steps or on a
+  turbo schedule, yet still perturbs the result: use it at ~20 or more base
+  steps only, never with the turbo LoRAs. It is the `cache` argument on every H3
+  template, `{"type": "first_block", "threshold": 0.05}`; `null` (the default)
+  is off.
+- **`torch.compile`**: +289 s on the first pass, ~1% per pass after. A net
+  loss for one job; it breaks even only across ~16 shots at one shape in one
+  warm worker.
+- **`text_kv`**: no measurable effect on Ref2VA.
+- **`taylorseer`**: OOM at this canvas with 4 references.
+- **Did a speed setting change the output?** Run it with and without the setting (same seed) and pass both to `compare_outputs`; read the PSNR against the bands in the workflow guide's *Assessing a run's output* (about 44 dB is rerun noise, 23-27 dB is changed numerics with the same shot, about 19 dB is a re-staged shot).
+
+Open: `first_block` 0.08-0.10 at 30 steps (speed against face cost);
+`first_block` at 20 steps against plain 30; whether P1 holds on a close-up and
+a second seed; MagCache needs a calibration run (no H3 preset).
diff --git a/plugins/dw/skills/script-to-video/SKILL.md b/plugins/dw/skills/script-to-video/SKILL.md
index dfe20694..f5229911 100644
--- a/plugins/dw/skills/script-to-video/SKILL.md
+++ b/plugins/dw/skills/script-to-video/SKILL.md
@@ -78,6 +78,7 @@ live there, not here.
 
 Render two to four representative shots first (a dialogue shot, an action
 shot, the hardest cut) and judge them before the full batch.
+For H3 shots, `dw:minimax-h3`'s quality-and-speed reference (*Ramp*) has the draft and final tiers and what to approve at each.
 
 `validate_workflow` against the chosen template with the assembled `shots`
 argument, read `plan.estimate` and `plan.downloads_required`, and state the
@@ -86,6 +87,9 @@ human (or an explicit pre-authorization) has signed off - this is a real
 gate, not a formality, and skipping it here is the one thing this skill
 must not do even when running unattended.
 
+Pass `note` on each `run_workflow` naming the shot and what the run tests,
+and `set_note` the take you keep: the note shows on every file it made.
+
 ## Run and judge
 
 Wait with `wait_for_job`, asking for the plan's estimate plus a margin as
@@ -112,6 +116,14 @@ Once every shot exists, hand off to `templates/assemble-and-score` (or the
 a series) for the recut/bed/match_levels/normalize/pair pass. That skill
 already owns this step - do not re-derive it here.
 
+The shots, narration, score or cues, stills and references are ingredients
+the assembly consumes: a workflow you write or copy for one sets
+`"role": "intermediate"` in its saving step's `result`, so it reads as
+intermediate in the gallery (which opens on finals) before the assembly
+runs. Only the assembly's cut is final. Once a later run reads a file
+through `output:` or an `asset:` kept from it, the gallery lists that file
+as intermediate on its own.
+
 A sung multi-shot piece is reviewed by its lip-sync target: run
 `get_guide("tasks", section="Checking the lip-sync target")` on the cut
 before delivering it.
diff --git a/plugins/dw/skills/series-episodes/SKILL.md b/plugins/dw/skills/series-episodes/SKILL.md
index cac9696f..ac97f197 100644
--- a/plugins/dw/skills/series-episodes/SKILL.md
+++ b/plugins/dw/skills/series-episodes/SKILL.md
@@ -60,9 +60,8 @@ guard, so it has to be a deliberate, first step rather than an implicit one.
 
 Save each portrait prompt with `save_prompt` under one folder for the series
 and reference it as `prompt:<series>/<character>` from every episode.
-`list_prompts(tag="<series>")` is then the cast list, and a character
-described the same way in episode 6 as in episode 1 is a reference rather
-than a paragraph retyped - which is the drift this skill exists to stop.
+`list_prompts(tag="<series>")` is then the cast list, and a character is
+referenced, never retyped - retyping is the drift this skill exists to stop.
 
 The same goes for a long shot list: a `run_workflow` call carrying 26 prompts
 is ~50 KB. `save_prompt(name, {"text": ...})` each shot under a series-prefixed name (the library
@@ -76,9 +75,13 @@ voice clip, and the shot list's cast entry (`script-to-video` step 2) points at
 ## 1-5. Per episode: generate, then recut, bed, match_levels, normalize, pair
 
 Generate the episode's shots with `templates/minimax/dialogue-short` (or
-`music-video`), `shots` referencing the fixed cast from step 0. Each shot
-is its own H3 generation, so cast drift *within* one episode does not
-happen - only *across* episodes does, which is what step 0 closes.
+`music-video`), `shots` referencing the fixed cast from step 0. Drift
+happens across episodes, not within one; step 0 closes it.
+
+A workflow you write for an ingredient - a shot, narration, a score or cue,
+a still, a reference - sets `"role": "intermediate"` in its saving step's
+`result`, so it reads as intermediate before the recut runs; only the
+episode's cut is final. (A file a later run reads drops to intermediate.)
 
 **Optional look, before the recut.** Not a beat and skippable: to give
 every episode one look, grade each shot with `apply_lut` and one shared
@@ -88,6 +91,7 @@ every episode; the same palette gives the same look. An uploaded `.cube` as
 `lut` works too. The graded clips are then the recut's `shots`. The recipe
 and its workflow are in `references/look.md`.
 
+Give each `run_workflow` a `note` (episode, shot); `set_note` the keeper.
 Once every shot for the episode exists (freshly generated, or promoted from
 a run with `keep_output`), cut and score them with
 `templates/assemble-and-score` - it is the five-beat pipeline this skill
@@ -124,8 +128,7 @@ composes into, not something to re-derive:
   episode lower still. Match episodes **downward** anyway: pick one series `target_lufs`
   that every episode can reach - in practice, about the quietest episode
   the ceiling holds back - and pass that same value on every episode's
-  `assemble-and-score` run. Don't pick the loudest episode's loudness and
-  ask the others to climb to it. A `target_lufs_capped` warning on an
+  `assemble-and-score` run. A `target_lufs_capped` warning on an
   episode means that episode's own peak sets the series' ceiling; lower the
   series `target_lufs` rather than accepting the mismatch. Only when the
   series should sit louder than its most dynamic episode allows (e.g. -16
@@ -137,8 +140,8 @@ composes into, not something to re-derive:
 - **pair**: the normalized track is muxed onto the cut - the episode's
   deliverable.
 
-One `assemble-and-score` run per episode; each episode's `total_frames` and
-`shots` list are its own.
+For smeary two-shot faces, read `references/cinema-path.md` (1344x768 base
+model); choose the path once, at episode 1.
 
 ## Run and judge
 
@@ -176,10 +179,8 @@ as a whole; `integrated_lufs` (BS.1770, whole-track) is the field that
 answers that, and is what to compare across episodes. A peak-normalized
 episode with one loud outlier (a studio-audience laugh, a sting) can sit
 1-2 LU quieter than its neighbors even at the same -3 dBFS peak ceiling -
-that gap is `target_lufs`'s to close, matched downward to a series-wide
-value every episode's ceiling allows (see the **normalize** bullet above);
-`target_lufs` alone cannot raise a capped episode to meet a louder one -
-`limit: true` can, for a series that must sit louder (same bullet). To confirm every
+that gap is `target_lufs`'s to close, matched downward (the **normalize**
+bullet; `limit: true` for a series that must sit louder). To confirm every
 line rendered rather than judging it by ear, run `templates/check-script`
 against the episode's script: `validate_workflow(name="templates/check-script",
 arguments={"input_audio": "output:<name>", "lines": [...]})` first (free; it
diff --git a/plugins/dw/skills/series-episodes/references/cinema-path.md b/plugins/dw/skills/series-episodes/references/cinema-path.md
new file mode 100644
index 00000000..b5126d55
--- /dev/null
+++ b/plugins/dw/skills/series-episodes/references/cinema-path.md
@@ -0,0 +1,23 @@
+# Series episodes: the cinema path
+
+The default `dialogue-short` shots are the TV path (960x544, turbo), whose
+two-character faces smear (~60 px). The cinema path renders every shot at
+1344x768 on the base model at int8, no LoRA; the `minimax-h3` skill's
+quality-and-speed reference owns the settings, timings (CUDA
+measurements), the `first_block` lever and the base-model prompt rules - read
+it, not restated here. What a multi-shot episode adds:
+
+- Wides as a 12-step draft, then a 30-step final; close-ups at 12 steps.
+  Submit the shots freely: the server holds a second int8 job for host RAM
+  (`waiting_for`). A five-shot episode ran ~156 GPU-min with three rejected
+  drafts.
+- Place every subject explicitly in every shot and name the set dressing, or
+  the base model adds a person and each shot draws its own chair.
+- Four references at 1344x768 cap a shot at 124 frames: write tags to 124 or
+  drop a reference.
+- Assemble at full size, no `fit`: `concat_videos` with `trim_frames: 0`,
+  `audio_bleed_ms: 0`, `match_levels: "rms"`, a looped room-tone bed, then
+  `normalize_audio` peak -1 (one episode: -16.7 LUFS).
+- TV-path and cinema-path episodes look like different shows back to back:
+  choose the path once, at episode 1, and keep it unless the user says
+  otherwise.
diff --git a/pyproject.toml b/pyproject.toml
index 223607f3..62bb4ed0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,7 @@ name = "diffusers-workflow"
 # runtime (static in TOML because importing dw at build time would drag
 # torch into the build environment). Release tags must match it - see
 # docs/RELEASING.md
-version = "0.13.0"
+version = "0.14.0-alpha.1"
 description = "Declarative workflow engine and web UI for Hugging Face Diffusers"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -173,6 +173,7 @@ ignore = ["E501"]
 "tests/test_server_downloads.py" = ["F811"]
 "tests/test_server_exports.py" = ["F811"]
 "tests/test_server_jobs.py" = ["F811"]
+"tests/test_stars.py" = ["F811"]
 
 [tool.setuptools.packages.find]
 # tasks/, pipeline_processors/ and community_pipelines/ are namespace
diff --git a/scripts/dw-serve.service b/scripts/dw-serve.service
index aac43af6..0f7b2a30 100644
--- a/scripts/dw-serve.service
+++ b/scripts/dw-serve.service
@@ -21,6 +21,11 @@ Environment=DW_MCP_MAX_WAIT_SECONDS=1800
 ExecStart=%h/diffusers-workflow/venv/bin/python -m dw.serve --host 0.0.0.0 --port 8765 --mcp --token xyz --workspace %h/diffusers-workspace --examples-dir %h/diffusers-workflow/workflows
 KillSignal=SIGTERM
 TimeoutStopSec=30
+# A worker the kernel OOM-kills fails only its own job (the pool ranks the
+# newest dispatch first, #881). systemd's default OOMPolicy=stop would instead
+# SIGTERM the whole unit, the server and every other worker's job with it -
+# what killed the second job in #869
+OOMPolicy=continue
 Restart=on-failure
 RestartSec=5
 
diff --git a/tests/conftest.py b/tests/conftest.py
index 8fcb8dfc..07150124 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -5,6 +5,7 @@
 _os.environ.setdefault("DW_STRICT_RESPONSES", "1")
 
 import gc
+import json
 import pytest
 import os
 import tempfile
@@ -190,3 +191,69 @@ def __call__(self, **kwargs):
             return type("MockOutput", (), {"images": ["mock_image"]})()
 
     return MockPipeline()
+
+
+@pytest.fixture
+def write_run():
+    """Build a fake run directory: `write_run(root, identity, run_id, steps,
+    realized=None, files=(), inputs=None)` writes the media `files` (paths
+    relative to the run), a manifest.json carrying `steps` and, when given,
+    `inputs`, and a workflow.json from `realized`. Returns the run directory."""
+
+    def build(root, identity, run_id, steps, realized=None, files=(), inputs=None):
+        run_dir = os.path.join(root, identity, run_id)
+        os.makedirs(run_dir, exist_ok=True)
+        for name in files:
+            path = os.path.join(run_dir, name)
+            os.makedirs(os.path.dirname(path), exist_ok=True)
+            with open(path, "wb") as handle:
+                handle.write(b"\x89PNG\r\n\x1a\n")
+        manifest = {
+            "run_id": run_id,
+            "version": 1,
+            "status": "succeeded",
+            "steps": steps,
+        }
+        if inputs is not None:
+            manifest["inputs"] = inputs
+        with open(os.path.join(run_dir, "manifest.json"), "w") as handle:
+            json.dump(manifest, handle)
+        if realized is not None:
+            with open(os.path.join(run_dir, "workflow.json"), "w") as handle:
+                json.dump(realized, handle)
+        return run_dir
+
+    return build
+
+
+@pytest.fixture
+def output_root(tmp_path):
+    """The output directory `gallery_client` serves."""
+    return str(tmp_path / "outputs")
+
+
+@pytest.fixture
+def gallery_client(tmp_path, output_root):
+    """A TestClient on an app with no jobs, over `output_root`."""
+    from fastapi.testclient import TestClient
+
+    from dw.server.app import create_app
+    from dw.server.jobs import JobManager
+
+    from .test_server import ScriptedWorkerManager, success_script
+
+    os.makedirs(output_root, exist_ok=True)
+    for sub in ("workflows", "prompts"):
+        os.makedirs(tmp_path / sub, exist_ok=True)
+    manager = JobManager(
+        output_root,
+        worker_manager=ScriptedWorkerManager(success_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+    )
+    app = create_app(
+        workflow_dir=str(tmp_path / "workflows"),
+        output_dir=output_root,
+        job_manager=manager,
+        prompt_dir=str(tmp_path / "prompts"),
+    )
+    return TestClient(app, base_url="http://localhost")
diff --git a/tests/test_admission_capacity.py b/tests/test_admission_capacity.py
index 0ec7a394..67d364e3 100644
--- a/tests/test_admission_capacity.py
+++ b/tests/test_admission_capacity.py
@@ -26,8 +26,11 @@ def test_the_context_takes_a_pool_ceiling_instead(tmp_path, monkeypatch):
 
 def _patched_admit_for(monkeypatch, state):
     seen = {}
-    monkeypatch.setattr(admission, "admit", lambda **kw: seen.update(kw))
+    monkeypatch.setattr(
+        admission, "admit", lambda **kw: seen.update(kw) or SimpleNamespace(ok=False)
+    )
     monkeypatch.setattr(admission, "ceiling_index", lambda state, workspace: None)
+    monkeypatch.setattr(admission, "lora_index", lambda state: None)
     monkeypatch.setattr(admission, "resolution_library", lambda state, workspace: None)
     monkeypatch.setattr(admission, "server_prompt_library", lambda state: None)
     admission.admit_for(state, "workspace")
diff --git a/tests/test_api_contract.py b/tests/test_api_contract.py
index 8cd912c3..c4c4824a 100644
--- a/tests/test_api_contract.py
+++ b/tests/test_api_contract.py
@@ -183,6 +183,8 @@ def test_the_committed_document_is_current():
     ("get", "/api/gallery"),
     ("delete", "/api/gallery/{name}"),
     ("get", "/api/gallery/{name}/metadata"),
+    ("put", "/api/notes"),
+    ("put", "/api/stars"),
     ("get", "/api/assets"),
     ("post", "/api/uploads"),
     ("post", "/api/assets/keep"),
@@ -533,6 +535,8 @@ def test_gallery_and_asset_answers_keep_their_keys(server, tmp_path):
         "version",
         "media",
         "findings",
+        "role",
+        "inputs",
     }
     assert metadata["job"] is None and metadata["findings"] == []
     assert set(assets) == {"workspace", "libraries", "assets", "folders", "shadowed"}
diff --git a/tests/test_attention_backend_trace.py b/tests/test_attention_backend_trace.py
new file mode 100644
index 00000000..f421faa7
--- /dev/null
+++ b/tests/test_attention_backend_trace.py
@@ -0,0 +1,29 @@
+"""The attention backend applied to a component is visible to the consumer."""
+
+from types import SimpleNamespace
+
+from dw.pipeline_processors import components
+
+
+def test_component_backend_emits_log(monkeypatch):
+    logged = []
+    monkeypatch.setattr(
+        components, "emit_log", lambda msg, **kw: logged.append((msg, kw))
+    )
+    applied = []
+    monkeypatch.setattr(
+        components,
+        "set_component_attention_backend",
+        lambda component, backend: applied.append(backend),
+    )
+    transformer = SimpleNamespace()
+    pipeline = SimpleNamespace(transformer=transformer)
+    configuration = {"components": {"transformer": {"attention_backend": "sage_hub"}}}
+
+    components.configure_components(pipeline, configuration, "cpu")
+
+    assert applied == ["sage_hub"]
+    assert len(logged) == 1
+    message, data = logged[0]
+    assert "transformer" in message and "sage_hub" in message
+    assert data == {"component": "transformer", "attention_backend": "sage_hub"}
diff --git a/tests/test_cache_blocks.py b/tests/test_cache_blocks.py
index b5026d8f..4485a889 100644
--- a/tests/test_cache_blocks.py
+++ b/tests/test_cache_blocks.py
@@ -438,3 +438,198 @@ def test_without_the_remap_the_text_stream_leaks_into_the_audio_slot(monkeypatch
 
     # The text conditioning's sequence length, carried into the audio stream
     assert audio_hidden_states.shape == (1, 3, 4)
+
+
+def _mag_model(num_inference_steps):
+    from diffusers import MagCacheConfig
+    from diffusers.models.transformers.transformer_minimax_h3 import (
+        MiniMaxH3Transformer3DModel,
+    )
+
+    register_cache_blocks()
+    model = MiniMaxH3Transformer3DModel(
+        num_attention_heads=2,
+        attention_head_dim=8,
+        hidden_size=16,
+        num_layers=2,
+        num_refiner_layers=1,
+        ffn_dim=32,
+        text_dim=16,
+        time_embed_hidden_dim=16,
+        time_embed_dim=8,
+        freq_dim=16,
+        rope_freq_dim=4,
+    )
+    model.enable_cache(
+        MagCacheConfig(calibrate=True, num_inference_steps=num_inference_steps)
+    )
+    return model
+
+
+def _run_calibration_steps(model, context, steps):
+    """Drive the real mag hooks' tail path the way a forward does."""
+    from diffusers.hooks import HookRegistry
+    from diffusers.hooks.mag_cache import MagCacheBlockHook
+
+    tail = next(
+        hook
+        for block in model.transformer_blocks
+        for hook in HookRegistry.check_if_exists_or_initialize(block).hooks.values()
+        if isinstance(hook, MagCacheBlockHook) and hook.is_tail
+    )
+    with model.cache_context(context):
+        state = tail.state_manager.get_state()
+        for i in range(steps):
+            tail._perform_calibration_step(state, torch.full((1, 3, 4), 1.0 + i))
+            state.previous_residual = torch.full((1, 3, 4), 1.0 + i)
+            tail._advance_step(state)
+
+
+def test_mag_calibration_ratios_reach_job_events_for_both_cfg_contexts(monkeypatch):
+    """#891: diffusers logs the ratios and clears them; both CFG lists must be emitted."""
+    from dw.pipeline_processors import components
+
+    logs, warnings = [], []
+    monkeypatch.setattr(components, "emit_log", logs.append)
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+
+    model = _mag_model(4)
+    with components.captured_mag_calibration(_FakePipeline(model)):
+        _run_calibration_steps(model, "cond", 4)
+        _run_calibration_steps(model, "uncond", 4)
+
+    assert logs == warnings
+    assert len(warnings) == 2
+    assert "[cond]" in warnings[0] and "[uncond]" in warnings[1]
+    for message in warnings:
+        assert "MagCache calibration (4 steps)" in message
+        assert "paste into mag_ratios" in message
+
+
+def test_mag_calibration_silent_without_calibrate(monkeypatch):
+    from diffusers import MagCacheConfig
+
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    model = _mag_model(3)
+    model.disable_cache()
+    model.enable_cache(
+        MagCacheConfig(mag_ratios=[1.0, 0.9, 0.8], num_inference_steps=3)
+    )
+
+    with components.captured_mag_calibration(_FakePipeline(model)):
+        pass
+    assert warnings == []
+
+
+def test_mag_calibration_counts_the_steps_the_call_runs(monkeypatch):
+    """#891: a config left at 28 steps never finishes a 4-step run; the call's count is used."""
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+
+    model = _mag_model(28)
+    with components.captured_mag_calibration(
+        _FakePipeline(model), {"num_inference_steps": 4}
+    ):
+        _run_calibration_steps(model, "cond", 4)
+
+    assert model._cache_config.num_inference_steps == 28
+    assert any("declares num_inference_steps 28" in w for w in warnings)
+    assert any("MagCache calibration (4 steps)" in w for w in warnings)
+
+
+def test_cache_on_pipeline_without_transformer_warns(monkeypatch):
+    from diffusers import MagCacheConfig
+
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    components.enable_cache_on_transformer(object(), MagCacheConfig(calibrate=True))
+    assert len(warnings) == 1 and "not applied" in warnings[0]
+
+
+def test_cache_on_transformer_without_enable_cache_warns(monkeypatch):
+    """#891: Z-Image's transformer has no enable_cache(); the caller must hear
+    the cache was dropped, not only the server log."""
+    import torch
+    from diffusers import MagCacheConfig
+
+    from dw.pipeline_processors import components
+
+    class _Pipe:
+        transformer = torch.nn.Linear(2, 2)
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    components.enable_cache_on_transformer(_Pipe(), MagCacheConfig(calibrate=True))
+    assert len(warnings) == 1
+    assert "was not applied" in warnings[0] and "enable_cache()" in warnings[0]
+
+
+def _calibrate_call(components, model, steps_run, contexts=("cond", "uncond")):
+    """Nest the two contexts the way Pipeline.__call__ does around a 4-step call."""
+    with components.captured_mag_calibration(
+        _FakePipeline(model), {"num_inference_steps": 4}
+    ):
+        with components.stateful_cache_context(_FakePipeline(model)):
+            for context in contexts:
+                _run_calibration_steps(model, context, steps_run)
+
+
+def test_mag_calibration_reports_a_call_that_ends_one_forward_short(monkeypatch):
+    """#927: H3's scheduler runs num_inference_steps - 1 forwards, so diffusers
+    never reaches its end-of-run log; the ratios left in the state are reported
+    before the call's reset drops them."""
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+
+    _calibrate_call(components, _mag_model(4), steps_run=3)
+
+    reported = [w for w in warnings if w.startswith("MagCache calibration (")]
+    assert len(reported) == 2
+    assert "[cond]" in reported[0] and "[uncond]" in reported[1]
+    assert all("MagCache calibration (3 steps)" in w for w in reported)
+
+
+def test_mag_calibration_a_finished_call_is_reported_once(monkeypatch):
+    """#927: diffusers clears the list when it logs, so the end-of-call read
+    finds nothing left and does not repeat the lists."""
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+
+    _calibrate_call(components, _mag_model(4), steps_run=4)
+
+    reported = [w for w in warnings if w.startswith("MagCache calibration (")]
+    assert len(reported) == 2
+    assert all("MagCache calibration (4 steps)" in w for w in reported)
+
+
+def test_mag_calibration_an_errored_call_reports_no_partial_lists(monkeypatch):
+    from dw.pipeline_processors import components
+
+    warnings = []
+    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(components, "emit_warning", warnings.append)
+
+    model = _mag_model(4)
+    with pytest.raises(RuntimeError):
+        with components.captured_mag_calibration(
+            _FakePipeline(model), {"num_inference_steps": 4}
+        ):
+            with components.stateful_cache_context(_FakePipeline(model)):
+                _run_calibration_steps(model, "cond", 2)
+                raise RuntimeError("out of memory")
+
+    assert not [w for w in warnings if w.startswith("MagCache calibration (")]
diff --git a/tests/test_cache_stats.py b/tests/test_cache_stats.py
new file mode 100644
index 00000000..482a7528
--- /dev/null
+++ b/tests/test_cache_stats.py
@@ -0,0 +1,413 @@
+#!/usr/bin/env python3
+"""Tests for a step cache's skip counts (the step-cache section of dw/pipeline_processors/timing.py).
+
+The counts read diffusers' private leader-hook state, so the pin tests below
+fail first when an upgrade moves it. The pipeline tests run a tiny real
+FluxPipeline with true CFG, so each step is a cond and an uncond forward, each
+in a cache context diffusers opens inside dw's.
+"""
+
+import os
+import sys
+from types import SimpleNamespace
+
+import pytest
+import torch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from dw.pipeline_processors import components
+from dw.pipeline_processors import timing as cache_stats
+from dw.pipeline_processors.timing import StepTimer, timed_step
+
+STEPS = 6
+
+
+class _Recorder:
+    """Stands in for the event context and emit_warning."""
+
+    def __init__(self):
+        self.events = []
+        self.warnings = []
+
+    def emit(self, event_type, **data):
+        self.events.append((event_type, data))
+
+    def warn(self, message, **data):
+        self.warnings.append((message, data))
+
+
+@pytest.fixture
+def recorder(monkeypatch):
+    recorder = _Recorder()
+    monkeypatch.setattr(cache_stats, "get_context", lambda: recorder)
+    monkeypatch.setattr(cache_stats, "emit_warning", recorder.warn)
+    return recorder
+
+
+def _flux_pipeline(cache_config):
+    from diffusers import (
+        FlowMatchEulerDiscreteScheduler,
+        FluxPipeline,
+        FluxTransformer2DModel,
+    )
+
+    torch.manual_seed(0)
+    transformer = FluxTransformer2DModel(
+        patch_size=1,
+        in_channels=4,
+        num_layers=2,
+        num_single_layers=2,
+        attention_head_dim=8,
+        num_attention_heads=2,
+        joint_attention_dim=16,
+        pooled_projection_dim=8,
+        axes_dims_rope=[2, 2, 4],
+    )
+    pipeline = FluxPipeline(
+        scheduler=FlowMatchEulerDiscreteScheduler(),
+        vae=None,
+        text_encoder=None,
+        tokenizer=None,
+        text_encoder_2=None,
+        tokenizer_2=None,
+        transformer=transformer,
+    )
+    if cache_config is not None:
+        components.enable_cache_on_transformer(pipeline, cache_config)
+    return pipeline
+
+
+def _call(pipeline, timer, segment=None):
+    """One CFG pipeline call the way Pipeline._call_pipeline wraps it."""
+    with timed_step(timer):
+        with components.stateful_cache_context(pipeline, segment=segment):
+            pipeline(
+                prompt_embeds=torch.randn(1, 8, 16),
+                pooled_prompt_embeds=torch.randn(1, 8),
+                negative_prompt_embeds=torch.randn(1, 8, 16),
+                negative_pooled_prompt_embeds=torch.randn(1, 8),
+                true_cfg_scale=2.0,
+                num_inference_steps=STEPS,
+                height=16,
+                width=16,
+                output_type="latent",
+            )
+
+
+def _first_block(threshold):
+    from diffusers import FirstBlockCacheConfig
+
+    return FirstBlockCacheConfig(threshold=threshold)
+
+
+# ------------------------------------------------------------ pins
+
+
+def test_the_private_diffusers_names_are_where_the_counter_reads_them():
+    """An upgrade that moves any of these nulls the counts in production;
+    this fails CI first."""
+    from diffusers.hooks import first_block_cache, mag_cache
+    from diffusers.hooks.hooks import HookRegistry, StateManager
+
+    assert (
+        first_block_cache._FBC_LEADER_BLOCK_HOOK
+        == cache_stats.LEADER_HOOKS["first_block"]
+    )
+    assert mag_cache._MAG_CACHE_LEADER_BLOCK_HOOK == cache_stats.LEADER_HOOKS["mag"]
+    assert hasattr(first_block_cache.FBCSharedBlockState(), "should_compute")
+    assert hasattr(mag_cache.MagCacheState(), "should_compute")
+    assert callable(StateManager.get_state)
+    assert callable(HookRegistry.get_hook)
+
+
+def test_the_config_classes_map_to_workflow_types():
+    import diffusers
+
+    for class_name in cache_stats._CACHE_TYPES:
+        assert hasattr(diffusers, class_name), class_name
+
+
+# ------------------------------------------------------------ real pipeline
+
+
+def test_cfg_counts_two_forwards_per_step_and_they_add_up(recorder):
+    pipeline = _flux_pipeline(_first_block(0.5))
+    timer = StepTimer(step="render")
+    _call(pipeline, timer)
+
+    cache = timer.timing()["cache"]
+    assert cache["type"] == "first_block"
+    assert cache["threshold"] == 0.5
+    assert cache["forwards"] == 2 * STEPS
+    assert cache["computed"] + cache["skipped"] == cache["forwards"]
+    assert cache["skipped"] > 0, "a loose threshold on a tiny model skips"
+    assert cache["hit_rate"] == round(cache["skipped"] / cache["forwards"], 3)
+    assert recorder.warnings == []
+
+
+def test_a_tight_threshold_skips_nothing(recorder):
+    pipeline = _flux_pipeline(_first_block(1e-6))
+    timer = StepTimer(step="render")
+    _call(pipeline, timer)
+
+    cache = timer.timing()["cache"]
+    assert (cache["forwards"], cache["computed"], cache["skipped"]) == (
+        2 * STEPS,
+        2 * STEPS,
+        0,
+    )
+    assert cache["hit_rate"] == 0.0
+
+
+def test_the_event_names_the_step_and_segment_and_goes_out_before_the_reset(
+    recorder, monkeypatch
+):
+    pipeline = _flux_pipeline(_first_block(0.5))
+    order = []
+    reset = pipeline.transformer._reset_stateful_cache
+
+    def recording_reset(*args, **kwargs):
+        order.append("reset")
+        return reset(*args, **kwargs)
+
+    monkeypatch.setattr(pipeline.transformer, "_reset_stateful_cache", recording_reset)
+    real_emit = recorder.emit
+    monkeypatch.setattr(
+        recorder,
+        "emit",
+        lambda event_type, **data: (
+            order.append(event_type),
+            real_emit(event_type, **data),
+        ),
+    )
+
+    _call(pipeline, StepTimer(step="render"), segment="segment 1/2")
+
+    # A DiffusionPipeline resets its own state as its call ends; the counts
+    # were read per forward, so only dw's reset - the last - has to follow
+    assert order[-2:] == ["cache_stats", "reset"]
+    assert order.count("cache_stats") == 1
+    event_type, data = recorder.events[0]
+    assert data["step"] == "render" and data["segment"] == "segment 1/2"
+    assert data["forwards"] == 2 * STEPS
+
+
+def test_the_event_crosses_the_worker_wire_with_its_cache_type():
+    """The real path to the server: the run context's sink, the worker's
+    Progress wire dict, the parent's parse_reply. The cache's `type` key used
+    to overwrite the wire's own "type" and the event was dropped (#886)."""
+    from dw.events import RunContext, activate_context, deactivate_context
+    from dw.worker_protocol import Progress, parse_reply
+
+    wire = []
+    token = activate_context(
+        RunContext(on_event=lambda event: wire.append(Progress(event=event).to_wire()))
+    )
+    try:
+        _call(_flux_pipeline(_first_block(0.5)), StepTimer(step="render"))
+    finally:
+        deactivate_context(token)
+
+    replies = [parse_reply(message) for message in wire]
+    assert all(isinstance(reply, Progress) for reply in replies)
+    stats = [r.event for r in replies if r.event.get("event") == "cache_stats"]
+    assert len(stats) == 1
+    assert stats[0]["type"] == "first_block"
+    assert stats[0]["step"] == "render"
+    assert stats[0]["forwards"] == 2 * STEPS
+
+
+def test_counts_restart_each_call_and_a_chain_sums_them(recorder):
+    pipeline = _flux_pipeline(_first_block(0.5))
+    timer = StepTimer(step="chain")
+    _call(pipeline, timer, segment="segment 1/2")
+    _call(pipeline, timer, segment="segment 2/2")
+
+    per_call = [
+        data for event_type, data in recorder.events if event_type == "cache_stats"
+    ]
+    assert [data["forwards"] for data in per_call] == [2 * STEPS, 2 * STEPS]
+    cache = timer.timing()["cache"]
+    assert cache["forwards"] == 4 * STEPS
+    assert cache["skipped"] == sum(data["skipped"] for data in per_call)
+    assert cache["hit_rate"] == round(cache["skipped"] / cache["forwards"], 3)
+
+
+def test_the_forward_hook_is_removed_after_the_call(recorder):
+    pipeline = _flux_pipeline(_first_block(0.5))
+    _call(pipeline, StepTimer(step="render"))
+    assert not pipeline.transformer._forward_hooks
+
+
+def test_no_cache_no_event_no_timing_key(recorder):
+    pipeline = _flux_pipeline(None)
+    timer = StepTimer(step="render")
+    _call(pipeline, timer)
+
+    assert recorder.events == [] and recorder.warnings == []
+    assert "cache" not in timer.timing()
+
+
+def test_moved_hook_state_nulls_the_counts_warns_once_and_the_run_finishes(
+    recorder, monkeypatch
+):
+    monkeypatch.setitem(cache_stats.LEADER_HOOKS, "first_block", "no_such_hook")
+    pipeline = _flux_pipeline(_first_block(0.5))
+    timer = StepTimer(step="render")
+    _call(pipeline, timer)
+
+    cache = timer.timing()["cache"]
+    assert cache["type"] == "first_block"
+    assert all(
+        cache[key] is None for key in ("forwards", "computed", "skipped", "hit_rate")
+    )
+    assert len(recorder.warnings) == 1
+    assert recorder.warnings[0][1] == {
+        "kind": "cache_stats_unavailable",
+        "cache_type": "first_block",
+    }
+    assert [event_type for event_type, _ in recorder.events] == ["cache_stats"]
+
+
+# ------------------------------------------------------------ the counter alone
+
+
+class _State:
+    def __init__(self, decisions):
+        self._decisions = iter(decisions)
+
+    def get_state(self):
+        return SimpleNamespace(should_compute=next(self._decisions))
+
+
+def _counter(config, state_manager=None, hook_name=None):
+    """A CacheCounter over a fake transformer whose leader hook holds `state_manager`."""
+
+    class Registry:
+        def get_hook(self, name):
+            if state_manager is not None and name == hook_name:
+                return SimpleNamespace(state_manager=state_manager)
+            return None
+
+    module = SimpleNamespace(_diffusers_hook=Registry())
+    transformer = SimpleNamespace(_cache_config=config, modules=lambda: [module])
+    return cache_stats.CacheCounter(transformer)
+
+
+def test_each_forward_is_read_once():
+    counter = _counter(
+        _first_block(0.1), _State([True, False, False, True]), "fbc_leader_block_hook"
+    )
+    for _ in range(4):
+        counter.after_forward(None, (), None)
+    stats = counter.stats()
+    assert (stats["forwards"], stats["computed"], stats["skipped"]) == (4, 2, 2)
+    assert stats["hit_rate"] == 0.5
+
+
+def test_a_state_without_should_compute_is_unavailable_not_an_error():
+    class NoDecision:
+        def get_state(self):
+            return SimpleNamespace()
+
+    counter = _counter(_first_block(0.1), NoDecision(), "fbc_leader_block_hook")
+    counter.after_forward(None, (), None)
+    assert counter.unavailable and "AttributeError" in counter.unavailable
+    assert counter.stats()["forwards"] is None
+
+
+def test_no_context_is_unavailable_not_an_error():
+    class NoContext:
+        def get_state(self):
+            raise ValueError("No context is set")
+
+    counter = _counter(_first_block(0.1), NoContext(), "fbc_leader_block_hook")
+    counter.after_forward(None, (), None)
+    assert counter.unavailable and counter.stats()["computed"] is None
+
+
+def test_mag_reports_its_config_keys():
+    from diffusers import MagCacheConfig
+
+    counter = _counter(
+        MagCacheConfig(threshold=0.1, num_inference_steps=8, mag_ratios=[1.0] * 8),
+        _State([True, False]),
+        "mag_cache_leader_block_hook",
+    )
+    counter.after_forward(None, (), None)
+    counter.after_forward(None, (), None)
+    stats = counter.stats()
+    assert stats["type"] == "mag" and stats["threshold"] == 0.1
+    assert stats["num_inference_steps"] == 8
+    assert {"max_skip_steps", "retention_ratio", "calibrate"} <= set(stats)
+    assert (stats["forwards"], stats["skipped"]) == (2, 1)
+
+
+@pytest.mark.parametrize(
+    "class_name,cache_type",
+    [
+        ("TaylorSeerCacheConfig", "taylorseer"),
+        ("FasterCacheConfig", "faster"),
+        ("TextKVCacheConfig", "text_kv"),
+    ],
+)
+def test_types_without_a_decision_report_type_only_and_no_warning(
+    recorder, class_name, cache_type
+):
+    config = type(class_name, (), {})()
+    counter = _counter(config)
+    assert not counter.unavailable
+    stats = cache_stats.report_cache_stats(counter)
+    assert stats["type"] == cache_type
+    assert all(
+        stats[key] is None
+        for key in ("threshold", "forwards", "computed", "skipped", "hit_rate")
+    )
+    assert recorder.warnings == []
+
+
+# ------------------------------------------------------------ timer
+
+
+def test_the_timer_sums_counts_and_nulls_on_any_null():
+    timer = StepTimer()
+    timer.cache_counted(
+        {
+            "type": "mag",
+            "threshold": 0.1,
+            "forwards": 4,
+            "computed": 3,
+            "skipped": 1,
+            "hit_rate": 0.25,
+        }
+    )
+    timer.cache_counted(
+        {
+            "type": "mag",
+            "threshold": 0.1,
+            "forwards": 4,
+            "computed": 1,
+            "skipped": 3,
+            "hit_rate": 0.75,
+        }
+    )
+    assert timer.timing()["cache"]["forwards"] == 8
+    assert timer.timing()["cache"]["hit_rate"] == 0.5
+
+    timer.cache_counted(
+        {
+            "type": "mag",
+            "threshold": 0.1,
+            "forwards": None,
+            "computed": None,
+            "skipped": None,
+            "hit_rate": None,
+        }
+    )
+    cache = timer.timing()["cache"]
+    assert cache["forwards"] is None and cache["hit_rate"] is None
+
+
+def test_a_timer_without_a_cache_has_no_cache_key():
+    assert "cache" not in StepTimer().timing()
diff --git a/tests/test_catalog_speed_defaults.py b/tests/test_catalog_speed_defaults.py
index fd142326..dfc9430f 100644
--- a/tests/test_catalog_speed_defaults.py
+++ b/tests/test_catalog_speed_defaults.py
@@ -43,7 +43,12 @@ def test_turbo_schedules_carry_no_block_cache(path):
         pytest.skip("not a turbo schedule")
     for step in _pipeline_steps(definition):
         configuration = step["pipeline"].get("configuration", {})
-        assert "cache" not in configuration, (
+        # A `variable:cache` defaulting to null is no cache: the effective
+        # default is what counts, not whether the key is written (#865)
+        cache = configuration.get("cache")
+        if isinstance(cache, str) and cache.startswith("variable:"):
+            cache = _default(definition, cache[len("variable:") :])
+        assert cache is None, (
             f"{os.path.basename(path)} step '{step['name']}' carries a cache block on a "
             f"{steps}-step turbo schedule; RECIPES_24GB.md says it never skips there"
         )
diff --git a/tests/test_catalog_structure.py b/tests/test_catalog_structure.py
index c9ff3ef9..d040038a 100644
--- a/tests/test_catalog_structure.py
+++ b/tests/test_catalog_structure.py
@@ -305,6 +305,9 @@ def test_per_entry_problems_reports_a_mismatched_entries_count():
     "workflows/templates/minimax/music-video.json": {"fit", "num_frames"},
     # fields of the plan's entries, which music-video's shots then take
     "workflows/templates/minimax/music-video-cuts.json": {"num_frames", "prompt"},
+    # the pipeline's 'cache' block it writes inline, not the H3 templates'
+    # variable of that name
+    "workflows/templates/step-caching.json": {"cache"},
 }
 
 
@@ -474,7 +477,14 @@ def test_no_stale_entry_in_the_allowlist():
 # Then to 10_700 for the `attention_backend` variable on the four MiniMax-H3
 # family baselines (2026-10-10), measured at 10_676 with six: the knob behind the
 # measured 28-33% per-step gain from sage_hub, null by default.
-COMPACT_BUDGET = 10_700
+# Then to 10_800 for the same variable on every other MiniMax-H3 template (#865,
+# stage #883, 2026-10-13), measured at 10_758: about 79 tokens across fifteen
+# templates, so the cinema path's sage_hub is an argument on the shots, chains
+# and episodes rather than a JSON edit.
+# Then to 10_850 for the whole-object `cache` variable on the same nineteen H3
+# templates (#865, stage #884, 2026-10-13), measured at 10_800: about 42
+# tokens, so first_block on a long base-model schedule is an argument too.
+COMPACT_BUDGET = 10_850
 FILTERED_BUDGET = 1_500
 
 
@@ -573,6 +583,146 @@ def test_the_remote_code_check_sees_nested_keys():
     ]
 
 
+H3_MODEL = "MiniMaxAI/MiniMax-H3"
+
+
+def _h3_steps(definition):
+    return [
+        step
+        for step in definition.get("steps", [])
+        if (step.get("pipeline") or {})
+        .get("from_pretrained_arguments", {})
+        .get("model_name")
+        == H3_MODEL
+    ]
+
+
+def _transformers(step):
+    components = step["pipeline"]["configuration"].get("components", {})
+    # t2va/fl2va load `transformer`, ref2va loads `transformer_ref`
+    return {
+        k: v for k, v in components.items() if k in ("transformer", "transformer_ref")
+    }
+
+
+H3_TEMPLATES = [path for path in TEMPLATES if _h3_steps(load(path))]
+
+
+def test_there_are_h3_templates():
+    assert len(H3_TEMPLATES) >= 19
+
+
+@pytest.mark.parametrize("path", H3_TEMPLATES)
+def test_every_h3_transformer_step_wires_attention_backend(path):
+    """sage_hub is 23-33% faster per step and lossless on CUDA, and the only way
+    to reach it from `arguments` is a template variable wired to the
+    transformer (#865). Every H3 template exposes it, null by default so mps
+    and cpu keep the process default; one that doesn't makes the cinema path
+    a JSON edit again."""
+    definition = load(path)
+
+    assert definition["variables"].get("attention_backend", "missing") is None, (
+        f"{path} declares no attention_backend variable defaulting to null"
+    )
+    for step in _h3_steps(definition):
+        transformers = _transformers(step)
+        assert transformers, f"{path} step '{step['name']}' configures no transformer"
+        for name, component in transformers.items():
+            assert component.get("attention_backend") == "variable:attention_backend", (
+                f"{path} step '{step['name']}' does not wire {name}.attention_backend"
+            )
+
+
+def test_only_h3_steps_wire_attention_backend():
+    """The Z-Image stills and the Music3 song beside an H3 shot keep the process
+    default: the variable reaches the H3 transformer and nothing else."""
+    for path in H3_TEMPLATES:
+        definition = load(path)
+        h3 = {step["name"] for step in _h3_steps(definition)}
+        for step in definition["steps"]:
+            if step["name"] in h3:
+                continue
+            assert "attention_backend" not in json.dumps(step), (
+                f"{path} step '{step['name']}' is not H3 but sets attention_backend"
+            )
+
+
+@pytest.mark.parametrize("path", H3_TEMPLATES)
+def test_every_h3_transformer_step_wires_cache(path):
+    """first_block 0.05 is -22% at 30 base steps, and the only way to reach it
+    from `arguments` is a whole-object `cache` variable on the H3 step (#865).
+    Null by default: an installed hook changes the output even when it skips
+    nothing, so null is the only off."""
+    definition = load(path)
+
+    assert definition["variables"].get("cache", "missing") is None, (
+        f"{path} declares no cache variable defaulting to null"
+    )
+    for step in _h3_steps(definition):
+        assert step["pipeline"]["configuration"].get("cache") == "variable:cache", (
+            f"{path} step '{step['name']}' does not wire configuration.cache"
+        )
+
+
+def test_only_h3_steps_wire_cache():
+    for path in H3_TEMPLATES:
+        definition = load(path)
+        h3 = {step["name"] for step in _h3_steps(definition)}
+        for step in definition["steps"]:
+            if step["name"] in h3:
+                continue
+            assert "variable:cache" not in json.dumps(step), (
+                f"{path} step '{step['name']}' is not H3 but wires cache"
+            )
+
+
+def _dialogue_short_after_substitution(**overrides):
+    from dw.variables import replace_variables
+
+    definition = load(
+        os.path.join(
+            REPO_ROOT, "workflows", "templates", "minimax", "dialogue-short.json"
+        )
+    )
+    variables = {**definition["variables"], **overrides}
+    return {
+        step["name"]: replace_variables(step, variables) for step in definition["steps"]
+    }
+
+
+def test_attention_backend_reaches_only_the_h3_shot():
+    steps = _dialogue_short_after_substitution(attention_backend="sage_hub")
+
+    shot = steps["shot"]["pipeline"]["configuration"]["components"]["transformer_ref"]
+    assert shot["attention_backend"] == "sage_hub"
+    for name, step in steps.items():
+        if name != "shot":
+            assert "sage_hub" not in json.dumps(step), name
+
+
+def test_cache_reaches_only_the_h3_shot():
+    cache = {"type": "first_block", "threshold": 0.05}
+    steps = _dialogue_short_after_substitution(cache=cache)
+
+    assert steps["shot"]["pipeline"]["configuration"]["cache"] == cache
+    for name, step in steps.items():
+        if name != "shot":
+            assert "first_block" not in json.dumps(step), name
+
+
+def test_a_default_cache_drops_the_key():
+    steps = _dialogue_short_after_substitution()
+
+    assert "cache" not in steps["shot"]["pipeline"]["configuration"]
+
+
+def test_a_default_attention_backend_drops_the_key():
+    steps = _dialogue_short_after_substitution()
+
+    shot = steps["shot"]["pipeline"]["configuration"]["components"]["transformer_ref"]
+    assert "attention_backend" not in shot
+
+
 def _step(definition, name):
     return next(step for step in definition["steps"] if step["name"] == name)
 
@@ -816,7 +966,7 @@ def test_every_readme_link_resolves(path):
 
 COSTED = {
     "workflows/templates/minimax/music-video.json": 35,
-    "workflows/templates/minimax/dialogue-short.json": 42,
+    "workflows/templates/minimax/dialogue-short.json": 21.2,
     "workflows/templates/assemble-and-score.json": 0.2,
     "workflows/templates/dissolve-between-shots.json": 0.2,
 }
@@ -832,7 +982,11 @@ def test_the_cut_templates_quote_a_measured_cost(path, minutes):
     LoRA on those templates at 9 - so their figures went with the schedule
     they described rather than being scaled, `cost` being measured and never
     derived. The three here kept their step count and their canvas; only
-    which adapter loads changed, at the same rank and file size."""
+    which adapter loads changed, at the same rank and file size.
+
+    dialogue-short's 42 was measured at 1344x768, not its 960x544 defaults;
+    a cost entry is measured at the variable defaults, so #866 re-priced it
+    to 42 x 960*544 / (1344*768) = 21.2."""
     definition = json.load(open(os.path.join(REPO_ROOT, path), encoding="utf-8"))
     entry = definition["cost"][0]
     assert entry["name"] == "RTX 3090"
diff --git a/tests/test_compare_route.py b/tests/test_compare_route.py
new file mode 100644
index 00000000..5908b112
--- /dev/null
+++ b/tests/test_compare_route.py
@@ -0,0 +1,325 @@
+"""POST /api/gallery/compare (#871): outputs side by side with PSNR/SSIM
+against a baseline, through the real route."""
+# ruff: noqa: F811
+
+import base64
+import io
+
+import numpy
+import pytest
+from PIL import Image
+
+from tests.test_media_frames import write_ramp_mp4
+from tests.test_server import asset_server, server, success_script  # noqa: F401
+
+
+def decode(image):
+    return Image.open(io.BytesIO(base64.b64decode(image["data"])))
+
+
+def write_noise_png(path, width=32, height=16, seed=0):
+    pixels = numpy.random.default_rng(seed).integers(
+        0, 256, (height, width, 3), dtype=numpy.uint8
+    )
+    Image.fromarray(pixels).save(path)
+
+
+@pytest.fixture
+def outputs(tmp_path):
+    folder = tmp_path / "outputs"
+    folder.mkdir(exist_ok=True)
+    return folder
+
+
+def post(client, **body):
+    return client.post("/api/gallery/compare", json=body)
+
+
+def test_two_identical_videos_compare_as_identical(server, outputs):
+    """The happy path: a grid PNG, the region, four default columns and a
+    single metrics entry that reads identical."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_ramp_mp4(outputs / "b.mp4")
+
+    with server(success_script) as client:
+        response = post(client, names=["a.mp4", "b.mp4"])
+
+        assert response.status_code == 200
+        body = response.json()
+        assert body["image"]["mime_type"] == "image/png"
+        assert decode(body["image"]).size == (
+            body["image"]["width"],
+            body["image"]["height"],
+        )
+        assert len(body["metrics"]) == 1
+        entry = body["metrics"][0]
+        assert entry["name"] == "b.mp4" and entry["row"] == 1
+        assert entry["psnr_db"]["mean"] == "identical"
+        assert entry["ssim"]["mean"] == 1.0
+        assert body["region"] == "full frame"
+        assert [c["frame"] for c in body["columns"]] == [0, 8, 15, 23]
+        assert [row["name"] for row in body["rows"]] == ["a.mp4", "b.mp4"]
+        assert body["baseline"] == "a.mp4"
+        assert body["downscaled_to"] is None
+
+
+def test_a_moment_past_the_shorter_clip_is_a_blank_cell(server, outputs):
+    """Only the shorter clip's missing frames go unmeasured."""
+    write_ramp_mp4(outputs / "long.mp4", frames=24)
+    write_ramp_mp4(outputs / "short.mp4", frames=12)
+
+    with server(success_script) as client:
+        body = post(
+            client, names=["long.mp4", "short.mp4"], at=["frame:0", "frame:20"]
+        ).json()
+
+        cells = body["metrics"][0]["cells"]
+        assert cells[0]["ssim"] == 1.0
+        assert cells[1]["reason"].startswith("past end (12 frames)")
+        assert cells[1]["psnr_db"] is None and cells[1]["ssim"] is None
+
+
+def test_every_moment_past_every_video_is_refused(server, outputs):
+    """With nothing to show at any column the request is the caller's error."""
+    write_ramp_mp4(outputs / "a.mp4", frames=12)
+    write_ramp_mp4(outputs / "b.mp4", frames=12)
+
+    with server(success_script) as client:
+        response = post(client, names=["a.mp4", "b.mp4"], at=["frame:20"])
+
+        assert response.status_code == 400
+        assert "past the end" in response.json()["detail"]
+
+
+@pytest.mark.parametrize("moment", ["frame:-1", -1.0])
+def test_a_negative_moment_is_refused_not_taken_from_the_end(server, outputs, moment):
+    """Python negative indexing would silently pick a frame near the end."""
+    write_ramp_mp4(outputs / "a.mp4", frames=12)
+    write_ramp_mp4(outputs / "b.mp4", frames=12)
+
+    with server(success_script) as client:
+        response = post(client, names=["a.mp4", "b.mp4"], at=[moment])
+
+        assert response.status_code == 400
+        assert repr(moment) in response.json()["detail"]
+        assert "is negative" in response.json()["detail"]
+
+
+def test_a_size_mismatch_gets_no_numbers_and_says_why(server, outputs):
+    """Resizing to force a comparison would itself be a difference."""
+    write_ramp_mp4(outputs / "big.mp4", width=64, height=32)
+    write_ramp_mp4(outputs / "small.mp4", width=32, height=16)
+
+    with server(success_script) as client:
+        response = post(client, names=["big.mp4", "small.mp4"])
+
+        assert response.status_code == 200
+        entry = response.json()["metrics"][0]
+        assert entry["reason"] == "size differs from baseline: 32x16 vs 64x32"
+        assert entry["psnr_db"] is None and entry["ssim"] is None
+        assert entry["mean_abs_diff"] is None
+
+
+def test_a_shared_crop_is_the_region_measured(server, outputs):
+    """One box is shown and measured, and the answer names it."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_ramp_mp4(outputs / "b.mp4")
+
+    with server(success_script) as client:
+        body = post(client, names=["a.mp4", "b.mp4"], crop=[0, 0, 32, 16]).json()
+
+        assert body["region"] == "crop [0, 0, 32, 16]"
+        assert [row["crop"] for row in body["rows"]] == [[0, 0, 32, 16]] * 2
+
+
+def test_per_output_crops_are_display_only(server, outputs):
+    """One box per name changes what each row shows; the numbers stay those
+    of the full frame."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_noise_png(outputs / "b.png")
+
+    with server(success_script) as client:
+        plain = post(client, names=["a.mp4", "b.png"]).json()
+        cropped = post(
+            client,
+            names=["a.mp4", "b.png"],
+            crop=[[0, 0, 16, 8], [8, 4, 16, 8]],
+        ).json()
+
+        assert plain["metrics"][0]["ssim"]["mean"] < 1.0
+        assert cropped["region"] == "full frame (per-output crops are display only)"
+        assert cropped["metrics"] == plain["metrics"]
+        assert cropped["rows"][1]["crop"] == [8, 4, 16, 8]
+        assert cropped["image"]["width"] < plain["image"]["width"]
+
+
+def test_a_crop_out_of_bounds_for_one_output_is_refused(server, outputs):
+    """The refusal names the output the box does not fit."""
+    write_ramp_mp4(outputs / "a.mp4", width=32, height=16)
+    write_ramp_mp4(outputs / "b.mp4", width=16, height=16)
+
+    with server(success_script) as client:
+        response = post(
+            client, names=["a.mp4", "b.mp4"], crop=[[0, 0, 32, 16], [0, 0, 32, 16]]
+        )
+
+        assert response.status_code == 400
+        assert "out of bounds for b.mp4" in response.json()["detail"]
+
+
+def test_a_crop_list_of_the_wrong_length_is_refused(server, outputs):
+    """One box for every output, or one for all."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_ramp_mp4(outputs / "b.mp4")
+
+    with server(success_script) as client:
+        response = post(client, names=["a.mp4", "b.mp4"], crop=[[0, 0, 4, 4]] * 3)
+
+        assert response.status_code == 400
+        assert "3 boxes for 2 names" in response.json()["detail"]
+
+
+def test_one_name_is_refused(server, outputs):
+    """A comparison needs at least two outputs."""
+    write_ramp_mp4(outputs / "a.mp4")
+
+    with server(success_script) as client:
+        assert post(client, names=["a.mp4"]).status_code == 400
+
+
+def test_an_unknown_name_is_not_found(server, outputs):
+    """An output that is not there is a 404."""
+    write_ramp_mp4(outputs / "a.mp4")
+
+    with server(success_script) as client:
+        assert post(client, names=["a.mp4", "missing.mp4"]).status_code == 404
+
+
+@pytest.mark.parametrize("filename", ["tone.wav", "notes.txt"])
+def test_audio_and_text_are_not_comparable(server, outputs, filename):
+    """Only stills and videos compare."""
+    write_ramp_mp4(outputs / "a.mp4")
+    (outputs / filename).write_bytes(b"RIFF....WAVE")
+
+    with server(success_script) as client:
+        response = post(client, names=["a.mp4", filename])
+
+        assert response.status_code == 400
+        assert "not an image or a video" in response.json()["detail"]
+
+
+@pytest.mark.parametrize("filename", ["broken.png", "broken.mp4"])
+def test_an_undecodable_file_is_unprocessable(server, outputs, filename):
+    """A file that resolved but will not decode is the file's problem."""
+    write_ramp_mp4(outputs / "a.mp4")
+    (outputs / filename).write_bytes(b"garbage" * 50)
+
+    with server(success_script) as client:
+        assert post(client, names=["a.mp4", filename]).status_code == 422
+
+
+def test_an_oversized_video_is_refused(server, outputs, monkeypatch):
+    """A frame past the decode ceiling is a 413 before any decoding."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_ramp_mp4(outputs / "b.mp4")
+    monkeypatch.setattr("dw.server.routes.media.MAX_DECODE_PIXELS", 100)
+
+    with server(success_script) as client:
+        assert post(client, names=["a.mp4", "b.mp4"]).status_code == 413
+
+
+def test_an_oversized_image_is_refused(server, outputs, monkeypatch):
+    """A still's header past the ceiling is a 413 as well."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_noise_png(outputs / "b.png")
+    monkeypatch.setattr("dw.server.inline_media.MAX_DECODE_PIXELS", 100)
+
+    with server(success_script) as client:
+        assert post(client, names=["a.mp4", "b.png"]).status_code == 413
+
+
+def test_a_byte_budget_shrinks_the_whole_grid(server, outputs):
+    """`downscaled_to` says what the budget shrank the grid to; with no
+    budget it is None."""
+    write_ramp_mp4(outputs / "a.mp4", width=512, height=256)
+    write_noise_png(outputs / "b.png", width=512, height=256)
+    names = ["a.mp4", "b.png"]
+
+    with server(success_script) as client:
+        full = post(client, names=names, max_dimension=512).json()
+        small = post(
+            client,
+            names=names,
+            max_dimension=512,
+            max_total_bytes=len(full["image"]["data"]) // 4,
+        ).json()
+
+        assert full["downscaled_to"] is None
+        assert small["downscaled_to"] is not None
+        assert small["downscaled_to"] < max(
+            full["image"]["width"], full["image"]["height"]
+        )
+        assert small["image"]["width"] < full["image"]["width"]
+        assert len(small["image"]["data"]) < len(full["image"]["data"])
+        assert decode(small["image"]).size == (
+            small["image"]["width"],
+            small["image"]["height"],
+        )
+
+
+def test_a_still_joins_a_video_comparison_in_every_column(server, outputs):
+    """The still is the same image at each moment, measured per column."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_noise_png(outputs / "b.png")
+
+    with server(success_script) as client:
+        body = post(client, names=["a.mp4", "b.png"]).json()
+
+        assert len(body["columns"]) == 4
+        assert body["rows"][1]["kind"] == "image"
+        entry = body["metrics"][0]
+        assert len(entry["cells"]) == 4
+        assert all(cell["ssim"] is not None for cell in entry["cells"])
+        assert len({cell["psnr_db"] for cell in entry["cells"]}) > 1
+
+
+def test_all_stills_make_one_column_and_ignore_at(server, outputs):
+    """With no video there is no moment to name."""
+    write_noise_png(outputs / "a.png", seed=1)
+    write_noise_png(outputs / "b.png", seed=2)
+
+    with server(success_script) as client:
+        body = post(client, names=["a.png", "b.png"], at=[0, 1]).json()
+
+        assert len(body["columns"]) == 1
+        assert body["columns"][0]["frame"] is None
+        assert any("`at` ignored" in note for note in body["notes"])
+
+
+def test_the_baseline_can_be_the_second_name(server, outputs):
+    """The baseline row is excluded from the metrics."""
+    write_ramp_mp4(outputs / "a.mp4")
+    write_ramp_mp4(outputs / "b.mp4")
+
+    with server(success_script) as client:
+        body = post(client, names=["a.mp4", "b.mp4"], baseline="b.mp4").json()
+
+        assert body["baseline"] == "b.mp4"
+        assert [entry["name"] for entry in body["metrics"]] == ["a.mp4"]
+        assert body["metrics"][0]["row"] == 0
+
+
+def test_an_asset_reference_compares_with_an_output(asset_server, tmp_path, outputs):
+    """`asset:` names resolve through the asset library."""
+    uploads = tmp_path / "assets" / "uploads"
+    uploads.mkdir()
+    write_noise_png(uploads / "ref.png")
+    write_noise_png(outputs / "b.png")
+
+    with asset_server(success_script) as client:
+        response = post(client, names=["asset:uploads/ref.png", "b.png"])
+
+        assert response.status_code == 200
+        body = response.json()
+        assert body["baseline"] == "asset:uploads/ref.png"
+        assert body["metrics"][0]["ssim"]["mean"] == 1.0
diff --git a/tests/test_concat_videos.py b/tests/test_concat_videos.py
index 29e72826..f76c0d1c 100644
--- a/tests/test_concat_videos.py
+++ b/tests/test_concat_videos.py
@@ -582,6 +582,68 @@ def test_gaining_a_near_silent_shot_up_to_target_warns(self, caplog):
         assert "near-silent" in caplog.text
 
 
+class TestInnerLevelStep:
+    """#876: match_levels levels a multi-shot input as one unit."""
+
+    def _events(self, call):
+        from dw.events import RunContext, activate_context, deactivate_context
+
+        events = []
+        token = activate_context(RunContext(on_event=events.append))
+        try:
+            call()
+        finally:
+            deactivate_context(token)
+        return [e for e in events if "inner_level_step" in str(e)]
+
+    def test_a_joined_input_with_a_step_between_its_shots_warns(self):
+        inner = concat_videos([audio_video(4, 0.5), audio_video(4, 0.1)])
+        assert len(inner.shots) == 2
+
+        found = self._events(
+            lambda: concat_videos([inner, audio_video(4, 0.3)], match_levels="rms")
+        )
+
+        assert found
+
+    def test_an_even_joined_input_draws_no_warning(self):
+        inner = concat_videos([audio_video(4, 0.3), audio_video(4, 0.3)])
+
+        found = self._events(
+            lambda: concat_videos([inner, audio_video(4, 0.3)], match_levels="rms")
+        )
+
+        assert not found
+
+    def test_a_trimmed_joined_input_still_warns(self):
+        inner = concat_videos([audio_video(4, 0.5), audio_video(4, 0.1)])
+        inner.fps = 4
+        for shot in inner.shots:
+            shot.pop("start_sample", None)
+            shot.pop("num_samples", None)
+
+        found = self._events(
+            lambda: concat_videos([inner, audio_video(4, 0.3)], match_levels="rms")
+        )
+
+        assert found
+
+    def test_a_track_replaced_downstream_draws_no_warning(self):
+        from dw.events import RunContext, activate_context, deactivate_context
+
+        inner = concat_videos([audio_video(4, 0.5), audio_video(4, 0.1)])
+        events = []
+        context = RunContext(on_event=events.append)
+        context.audio_replaced_downstream = True
+        token = activate_context(context)
+        try:
+            concat_videos([inner, audio_video(4, 0.3)], match_levels="rms")
+        finally:
+            deactivate_context(token)
+
+        assert not [e for e in events if "inner_level_step" in str(e)]
+
+
 class TestWarningsReachTheCaller:
     """A warning that only reaches the server's log does not exist from
     outside it - see issue #82, where match_levels verified but the spread
diff --git a/tests/test_config_objects.py b/tests/test_config_objects.py
index 159bf0b8..56b5e497 100644
--- a/tests/test_config_objects.py
+++ b/tests/test_config_objects.py
@@ -343,6 +343,15 @@ def test_taylorseer_omitted_arguments_keep_the_diffusers_defaults(self):
         assert explicit.max_order == 3
         assert bare.cache_interval == explicit.cache_interval
 
+    def test_faster_forwards_is_guidance_distilled(self):
+        config = get_cache_configuration(
+            {"cache": {"type": "faster", "is_guidance_distilled": True}}
+        )
+
+        assert config.is_guidance_distilled is True
+        bare = get_cache_configuration({"cache": {"type": "faster"}})
+        assert bare.is_guidance_distilled is False
+
     def test_an_unknown_cache_type_raises(self):
         with pytest.raises(ValueError, match="Unknown cache type: nope"):
             get_cache_configuration({"cache": {"type": "nope"}})
@@ -479,6 +488,18 @@ def test_every_forwarded_taylorseer_argument_is_declared_in_the_schema(self):
 
         assert set(_TAYLORSEER_CACHE_KEYS) <= declared
 
+    def test_every_forwarded_faster_argument_is_declared_in_the_schema(self):
+        import dataclasses
+
+        from diffusers import FasterCacheConfig
+        from dw.pipeline_processors.config_objects import _FASTER_CACHE_KEYS
+
+        declared = set(cache_schema()["properties"])
+        fields = {f.name for f in dataclasses.fields(FasterCacheConfig)}
+
+        assert set(_FASTER_CACHE_KEYS) <= declared
+        assert set(_FASTER_CACHE_KEYS) <= fields
+
     def test_forwarded_arguments_are_real_diffusers_config_fields(self):
         """A key the schema and the builder agree on but diffusers does not have
         raises TypeError at construction - the other half of the same drift."""
diff --git a/tests/test_find_loop_bed.py b/tests/test_find_loop_bed.py
index 88ca7508..ced15c45 100644
--- a/tests/test_find_loop_bed.py
+++ b/tests/test_find_loop_bed.py
@@ -216,6 +216,25 @@ def test_no_candidate_covers_the_tone(self):
         assert result["rejected"]["tonal"] >= 1
 
 
+class TestTonalFinding:
+    def test_names_tonal_when_loud_windows_outnumber_it(self):
+        rng = numpy.random.default_rng(3)
+        waveform = noise(rng, 20 * SR, -20.0)
+        t = numpy.arange(2 * SR) / SR
+        amplitude = rms_amplitude(-78.0) * math.sqrt(2)
+        waveform[8 * SR : 10 * SR] = amplitude * numpy.sin(2 * math.pi * 220.0 * t)
+
+        result = find_loop_bed(track(waveform), min_seconds=0.5, max_seconds=1.0)
+
+        assert result["candidates"] == []
+        assert result["rejected"]["too_loud"] > result["rejected"]["tonal"] > 0
+        finding = result["findings"][0]
+        assert finding["rejected_by"] == "tonal"
+        assert finding["closest_tonal"]["flatness"] < 0.3
+        assert finding["closest_tonal"]["harmonicity"] >= 0.45
+        assert "nearest misses" in finding["message"]
+
+
 class TestIntermittentVoice:
     """Speech under a bed comes and goes: 250 ms harmonic syllables every
     400 ms, at the bed's own level. Measured over a whole 0.5-2 s window the
diff --git a/tests/test_for_each.py b/tests/test_for_each.py
index a8f030fa..d0b0b354 100644
--- a/tests/test_for_each.py
+++ b/tests/test_for_each.py
@@ -46,6 +46,12 @@ class TestNaming:
     def test_member_name_joins_with_at(self):
         assert member_name("shot", "wide_open") == "shot@wide_open"
 
+    def test_group_of_inverts_member_name(self):
+        from dw.for_each import group_of
+
+        assert group_of(member_name("shot", "wide_open")) == "shot"
+        assert group_of("plain") == "plain"
+
     def test_is_member_name_round_trips_member_name(self):
         assert is_member_name(member_name("shot", "wide_open"))
         assert not is_member_name("shot")
diff --git a/tests/test_forget_workspace_history.py b/tests/test_forget_workspace_history.py
new file mode 100644
index 00000000..2708e1cc
--- /dev/null
+++ b/tests/test_forget_workspace_history.py
@@ -0,0 +1,46 @@
+"""A deleted workspace takes its job history with it (#913)."""
+
+from dw.server.job_history import JobHistory
+from dw.server.job_record import Job
+
+
+def _job(job_id, workspace):
+    job = Job(
+        {
+            "workflow_name": "w",
+            "catalog_name": "w",
+            "arguments": {},
+            "workspace": workspace,
+        }
+    )
+    job.id = job_id
+    job.status = "succeeded"
+    job.started_at = 10.0
+    job.finished_at = 70.0
+    return job
+
+
+def test_forgetting_a_workspace_leaves_a_same_named_one_empty(tmp_path):
+    history = JobHistory(str(tmp_path / "jobs.sqlite"))
+    history.record(_job("a", "sweep"))
+    history.record(_job("b", "sweep"))
+    history.record(_job("c", "other"))
+
+    assert history.forget_workspace("sweep") == 2
+
+    assert history.recent_summaries(workspace="sweep") == []
+    assert [r["id"] for r in history.recent_summaries(workspace="other")] == ["c"]
+    assert history.get("a") is None
+
+
+def test_a_job_a_kept_asset_names_survives_its_workspace(tmp_path):
+    history = JobHistory(str(tmp_path / "jobs.sqlite"))
+    history.record(_job("a", "sweep"))
+    history.record(_job("b", "sweep"))
+    history.mark_kept("a")
+
+    assert history.forget_workspace("sweep") == 1
+
+    assert history.recent_summaries(workspace="sweep") == []
+    assert history.get("b") is None
+    assert history.get("a")["status"] == "succeeded"
diff --git a/tests/test_gallery_roles.py b/tests/test_gallery_roles.py
new file mode 100644
index 00000000..70da0182
--- /dev/null
+++ b/tests/test_gallery_roles.py
@@ -0,0 +1,411 @@
+"""The gallery says which files of a run are its deliverable and which are
+scratch: each entry's `role`, the listing's `role` filter, and the metadata's
+`role` and `inputs` (dw/roles.py decides the roles)."""
+
+import json
+import os
+
+from dw.server.outputs import run_roles, split_run_name
+
+
+def test_recorded_roles_reach_the_listing(gallery_client, output_root, write_run):
+    write_run(
+        output_root,
+        "wf",
+        "20261012-000000-aaaaaaaa",
+        [
+            {"step": "a", "files": ["a.png"], "role": "intermediate"},
+            {"step": "b", "files": ["b.png"], "role": "final"},
+        ],
+        files=["a.png", "b.png"],
+    )
+    files = {f["label"]: f for f in gallery_client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["role"] == "intermediate"
+    assert files["b.png"]["role"] == "final"
+
+
+def test_older_run_has_no_role(gallery_client, output_root, write_run):
+    # A manifest from before roles: b reads a, but nothing is guessed
+    realized = {
+        "id": "wf",
+        "steps": [
+            {"name": "a", "task": {"command": "noop", "arguments": {}}},
+            {
+                "name": "b",
+                "task": {
+                    "command": "noop",
+                    "arguments": {"image": "previous_result:a"},
+                },
+            },
+        ],
+    }
+    write_run(
+        output_root,
+        "wf",
+        "20261012-000001-bbbbbbbb",
+        [
+            {"step": "a", "files": ["intermediate/a.png"], "subfolder": "intermediate"},
+            {"step": "b", "files": ["b.png"]},
+        ],
+        realized=realized,
+        files=["intermediate/a.png", "b.png"],
+    )
+    files = {f["label"]: f for f in gallery_client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["role"] is None
+    assert files["b.png"]["role"] is None
+
+
+def test_role_filter(gallery_client, output_root, write_run):
+    write_run(
+        output_root,
+        "wf",
+        "20261012-000002-cccccccc",
+        [
+            {"step": "a", "files": ["a.png"], "role": "intermediate"},
+            {"step": "b", "files": ["final/b.png"], "role": "final"},
+        ],
+        files=["a.png", "final/b.png"],
+    )
+    finals = gallery_client.get("/api/gallery", params={"role": "final"}).json()[
+        "files"
+    ]
+    assert [f["label"] for f in finals] == ["b.png"]
+    both = gallery_client.get(
+        "/api/gallery", params={"role": ["final", "intermediate"]}
+    ).json()["files"]
+    assert len(both) == 2
+    assert (
+        gallery_client.get("/api/gallery", params={"role": "bogus"}).status_code == 400
+    )
+
+
+def test_flat_file_has_null_role_and_passes_final_filter(gallery_client, output_root):
+    os.makedirs(os.path.join(output_root, "loose"), exist_ok=True)
+    with open(os.path.join(output_root, "loose", "x.png"), "wb") as handle:
+        handle.write(b"\x89PNG\r\n\x1a\n")
+    entries = gallery_client.get("/api/gallery", params={"role": "final"}).json()[
+        "files"
+    ]
+    loose = [f for f in entries if f["label"] == "x.png"]
+    assert loose and loose[0].get("role") is None
+
+
+def test_metadata_carries_role_and_inputs(gallery_client, output_root, write_run):
+    write_run(
+        output_root,
+        "wf",
+        "20261012-000003-dddddddd",
+        [{"step": "b", "files": ["b.png"], "role": "final"}],
+        files=["b.png"],
+        inputs=[{"reference": "asset:iris.png", "kind": "asset"}],
+    )
+    meta = gallery_client.get(
+        "/api/gallery/wf/20261012-000003-dddddddd/b.png/metadata"
+    ).json()
+    assert meta["role"] == "final"
+    assert meta["inputs"] == [{"reference": "asset:iris.png", "kind": "asset"}]
+
+
+def test_split_run_name(tmp_path):
+    root = str(tmp_path)
+    assert split_run_name(root, "wf/20261012-000003-dddddddd/final/b.png") == (
+        os.path.join(root, "wf", "20261012-000003-dddddddd"),
+        "final/b.png",
+    )
+    assert split_run_name(root, "loose/x.png") is None
+    assert run_roles(os.path.join(root, "missing")) == {}
+
+
+def test_metadata_for_a_subfolder_file_of_a_nested_identity_run(
+    gallery_client, output_root, write_run
+):
+    write_run(
+        output_root,
+        "series/ep1",
+        "20261012-000004-eeeeeeee",
+        [{"step": "b", "files": ["final/b.png"], "role": "final"}],
+        files=["final/b.png"],
+        inputs=[{"reference": "output:wf/v1/a.png", "kind": "output"}],
+    )
+    meta = gallery_client.get(
+        "/api/gallery/series/ep1/20261012-000004-eeeeeeee/final/b.png/metadata"
+    ).json()
+    assert meta["role"] == "final"
+    assert meta["inputs"] == [{"reference": "output:wf/v1/a.png", "kind": "output"}]
+
+
+def _role_less_run_script(output_dir):
+    """A worker that writes a two-step run - b reads a's result - whose
+    manifest.json records roles, and reports the manifest it held in
+    memory, which never carries them."""
+    from dw.runs import new_run_id
+
+    def script(command):
+        run_id = new_run_id({"command": 1})
+        relative = f"wf/{run_id}"
+        run_dir = os.path.join(output_dir, "wf", run_id)
+        os.makedirs(run_dir, exist_ok=True)
+        realized = {
+            "id": "wf",
+            "steps": [
+                {"name": "a", "task": {"command": "noop", "arguments": {}}},
+                {
+                    "name": "b",
+                    "task": {
+                        "command": "noop",
+                        "arguments": {"image": "previous_result:a"},
+                    },
+                },
+            ],
+        }
+        steps = [
+            {"step": "a", "files": ["a.png"], "role": "intermediate"},
+            {"step": "b", "files": ["b.png"], "role": "final"},
+        ]
+        for name in ("a.png", "b.png"):
+            with open(os.path.join(run_dir, name), "wb") as handle:
+                handle.write(b"\x89PNG\r\n\x1a\n")
+        with open(os.path.join(run_dir, "manifest.json"), "w") as handle:
+            json.dump({"run_id": run_id, "status": "succeeded", "steps": steps}, handle)
+        with open(os.path.join(run_dir, "workflow.json"), "w") as handle:
+            json.dump(realized, handle)
+        yield {
+            "type": "progress",
+            "event": "run_start",
+            "run_id": run_id,
+            "identity": "wf",
+            "run_dir": relative,
+            "version": 1,
+        }
+        manifest = [
+            {"step": e["step"], "files": [os.path.join(run_dir, e["files"][0])]}
+            for e in steps
+        ]
+        yield {"type": "success", "message": "ok", "run_count": 1, "manifest": manifest}
+
+    return script
+
+
+def test_job_detail_entries_carry_the_run_roles(tmp_path):
+    """The worker reports a role-less manifest; the job detail fills each
+    entry's role from the run directory, live and from history."""
+    from fastapi.testclient import TestClient
+
+    from dw.server.app import create_app
+    from dw.server.jobs import JobManager
+    from dw.workspace import Workspace
+
+    from .test_server import ScriptedWorkerManager, valid_workflow, wait_for_status
+
+    studio = Workspace(tmp_path / "studio", "flag").ensure()
+    manager = JobManager(
+        studio.outputs,
+        worker_manager=ScriptedWorkerManager(_role_less_run_script(studio.outputs)),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=studio.workflows,
+    )
+    app = create_app(
+        workflow_dir=studio.workflows,
+        output_dir=studio.outputs,
+        job_manager=manager,
+        prompt_dir=studio.prompts,
+        asset_dir=studio.assets,
+        workspace=studio.root,
+    )
+    with TestClient(app, base_url="http://localhost") as client:
+        job = client.post("/api/jobs", json={"workflow": valid_workflow()}).json()
+        detail = wait_for_status(client, job["id"], ["succeeded"])
+        assert all("role" not in e for e in manager.jobs[job["id"]].manifest)
+        assert {e["step"]: e["role"] for e in detail["manifest"]} == {
+            "a": "intermediate",
+            "b": "final",
+        }
+        manager.jobs.pop(job["id"])
+        again = client.get(f"/api/jobs/{job['id']}").json()
+        assert {e["step"]: e["role"] for e in again["manifest"]} == {
+            "a": "intermediate",
+            "b": "final",
+        }
+
+
+def test_a_mixed_manifest_reports_only_recorded_roles(tmp_path, write_run):
+    run_dir = write_run(
+        str(tmp_path),
+        "wf",
+        "20261012-000010-aaaaaaaa",
+        [
+            {"step": "a", "files": ["a.png"], "role": "final"},
+            {"step": "b", "files": ["b.png"]},
+            {"step": "c", "files": ["c.png"], "role": "bogus"},
+        ],
+    )
+    assert run_roles(run_dir) == {"a.png": "final"}
+
+
+def test_run_inputs_keeps_only_well_formed_entries(tmp_path, write_run):
+    from dw.server.outputs import run_inputs
+
+    run_dir = write_run(
+        str(tmp_path),
+        "wf",
+        "20261012-000013-aaaaaaaa",
+        [],
+        inputs=[
+            {"reference": "asset:a.png", "kind": "asset"},
+            {"reference": 3, "kind": "asset"},
+            {"reference": "x", "kind": "variable"},
+            "asset:b.png",
+            {"reference": "output:wf/v1/a.png", "kind": "output", "extra": 1},
+        ],
+    )
+    assert run_inputs(run_dir) == [
+        {"reference": "asset:a.png", "kind": "asset"},
+        {"reference": "output:wf/v1/a.png", "kind": "output"},
+    ]
+
+
+def test_role_cache_is_lru_and_safe_under_threads(tmp_path, write_run, monkeypatch):
+    from concurrent.futures import ThreadPoolExecutor
+
+    from dw.server import outputs
+
+    monkeypatch.setattr(outputs, "_ROLE_CACHE", outputs.OrderedDict())
+    monkeypatch.setattr(outputs, "_ROLE_CACHE_LIMIT", 4)
+    runs = [
+        write_run(
+            str(tmp_path),
+            "wf",
+            f"20261012-0001{i:02d}-aaaaaaaa",
+            [{"step": "a", "files": ["a.png"], "role": "final"}],
+        )
+        for i in range(12)
+    ]
+    with ThreadPoolExecutor(8) as pool:
+        results = list(pool.map(run_roles, runs * 20))
+    assert all(r == {"a.png": "final"} for r in results)
+    assert len(outputs._ROLE_CACHE) == 4
+
+    # the most recently used survives a newcomer; the oldest goes
+    outputs._ROLE_CACHE.clear()
+    for run in runs[:4]:
+        run_roles(run)
+    run_roles(runs[0])
+    run_roles(runs[4])
+    kept = {key[0] for key in outputs._ROLE_CACHE}
+    assert runs[0] in kept and runs[1] not in kept
+
+
+# A file a later run consumed reads as intermediate (#928)
+
+SHOT_RUN = "20261015-000000-aaaaaaaa"
+CUT_RUN = "20261015-010000-bbbbbbbb"
+
+
+def _shot_and_cut(output_root, write_run, reference, **shot_entry):
+    write_run(
+        output_root,
+        "shots",
+        SHOT_RUN,
+        [{"step": "shot", "files": ["final/shot.png"], "role": "final", **shot_entry}],
+        files=["final/shot.png"],
+    )
+    write_run(
+        output_root,
+        "assembly",
+        CUT_RUN,
+        [{"step": "cut", "files": ["final/cut.png"], "role": "final"}],
+        files=["final/cut.png"],
+        inputs=[{"reference": reference, "kind": reference.split(":", 1)[0]}],
+    )
+
+
+def _roles(client, **params):
+    listing = client.get("/api/gallery", params=params).json()["files"]
+    return {f["label"]: f.get("role") for f in listing}
+
+
+def test_a_file_a_later_run_read_lists_as_intermediate(
+    gallery_client, output_root, write_run
+):
+    _shot_and_cut(output_root, write_run, "output:shots/latest/final/shot.png")
+    assert _roles(gallery_client) == {"shot.png": "intermediate", "cut.png": "final"}
+    assert _roles(gallery_client, role="final") == {"cut.png": "final"}
+    assert _roles(gallery_client, role="intermediate") == {"shot.png": "intermediate"}
+    meta = gallery_client.get(
+        f"/api/gallery/shots/{SHOT_RUN}/final/shot.png/metadata"
+    ).json()
+    assert meta["role"] == "intermediate"
+
+
+def test_a_declared_final_stays_final(gallery_client, output_root, write_run):
+    _shot_and_cut(
+        output_root,
+        write_run,
+        "output:shots/v1/final/shot.png",
+        role_declared=True,
+    )
+    assert _roles(gallery_client, role="final") == {
+        "shot.png": "final",
+        "cut.png": "final",
+    }
+
+
+def test_a_pre_roles_file_a_later_run_read_stays_unknown(
+    gallery_client, output_root, write_run
+):
+    write_run(
+        output_root,
+        "shots",
+        SHOT_RUN,
+        [{"step": "shot", "files": ["shot.png"]}],
+        files=["shot.png"],
+    )
+    write_run(
+        output_root,
+        "assembly",
+        CUT_RUN,
+        [{"step": "cut", "files": ["cut.png"], "role": "final"}],
+        files=["cut.png"],
+        inputs=[{"reference": f"output:shots/{SHOT_RUN}/shot.png", "kind": "output"}],
+    )
+    assert _roles(gallery_client)["shot.png"] is None
+
+
+def test_an_asset_kept_from_a_file_demotes_it(tmp_path, write_run):
+    from fastapi.testclient import TestClient
+
+    from dw.runs import record_kept_shots
+    from dw.server.app import create_app
+    from dw.server.jobs import JobManager
+    from dw.workspace import Workspace
+
+    from .test_server import ScriptedWorkerManager, success_script
+
+    studio = Workspace(tmp_path / "studio", "studio").ensure()
+    manager = JobManager(
+        studio.outputs,
+        worker_manager=ScriptedWorkerManager(success_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=studio.workflows,
+    )
+    app = create_app(
+        workflow_dir=studio.workflows,
+        output_dir=studio.outputs,
+        job_manager=manager,
+        prompt_dir=studio.prompts,
+        asset_dir=studio.assets,
+        workspace=studio.root,
+    )
+    with TestClient(app, base_url="http://localhost") as client:
+        name = client.get("/api/gallery").json()["workspace"]
+        os.makedirs(studio.assets, exist_ok=True)
+        with open(os.path.join(studio.assets, "hero.png"), "wb") as handle:
+            handle.write(b"\x89PNG\r\n\x1a\n")
+        record_kept_shots(
+            studio.assets,
+            "hero.png",
+            None,
+            {"workspace": name, "source": f"shots/{SHOT_RUN}/final/shot.png"},
+        )
+        _shot_and_cut(studio.outputs, write_run, "asset:hero.png")
+        assert _roles(client)["shot.png"] == "intermediate"
diff --git a/tests/test_h3_adapters.py b/tests/test_h3_adapters.py
index 8cad1583..403f2d0e 100644
--- a/tests/test_h3_adapters.py
+++ b/tests/test_h3_adapters.py
@@ -27,7 +27,9 @@
     REFERENCE_WORKFLOWS,
     adapter_errors,
     adapter_warnings,
+    catalog_index,
 )
+from dw.lora_catalog import entry_errors
 from tests.test_examples import REPO_ROOT
 
 TEMPLATES = sorted(
@@ -40,7 +42,7 @@ def load(path):
         return json.load(handle)
 
 
-def h3_step(workflow, weight_name, name="shot"):
+def h3_step(workflow, weight_name, name="shot", model_name="MiniMaxAI/MiniMax-H3"):
     return {
         "name": name,
         "pipeline": {
@@ -48,9 +50,7 @@ def h3_step(workflow, weight_name, name="shot"):
                 "model_name": "MiniMaxAI/MiniMax-H3",
                 "workflow": workflow,
             },
-            "loras": [
-                {"model_name": "MiniMaxAI/MiniMax-H3", "weight_name": weight_name}
-            ],
+            "loras": [{"model_name": model_name, "weight_name": weight_name}],
         },
     }
 
@@ -193,3 +193,177 @@ def test_the_sweep_found_the_family(self):
             )
         ]
         assert len(paired) >= 15, "the H3 family moved - this sweep found almost none"
+
+
+REALISM = "fal/MiniMax-H3-Realism-People-LoRA"
+NO_TOKEN = "h3-realism-people-t2v-i2v-r2v.safetensors"
+
+
+def catalogued(workflow, status="proven", weight_name=NO_TOKEN, name="h3/realism"):
+    """A one-entry index for `weight_name` under `REALISM`."""
+    entry = {
+        "model_name": REALISM,
+        "weight_name": weight_name,
+        "workflow": workflow,
+        "status": status,
+    }
+    return catalog_index({name: entry})
+
+
+def realism_step(workflow, weight_name=NO_TOKEN):
+    return h3_step(workflow, weight_name, model_name=REALISM)
+
+
+class TestTheCatalogDecidesFirst:
+    """#870: a catalog entry's `workflow` places a file its name cannot."""
+
+    def test_a_proven_entry_refuses_the_other_partition(self):
+        catalog = catalogued(["t2va", "fl2va"])
+        spec = definition(realism_step("ref2va"))
+        errors = adapter_errors(spec, catalog=catalog)
+        assert len(errors) == 1
+        assert "h3/realism" in errors[0]["message"]
+        assert "proven" in errors[0]["message"]
+        assert errors[0]["path"] == "steps[0].pipeline.loras[0].weight_name"
+
+    def test_a_proven_entry_agrees_cleanly(self):
+        catalog = catalogued(["t2va", "fl2va"])
+        for workflow in sorted(KEYFRAME_WORKFLOWS):
+            spec = definition(realism_step(workflow))
+            assert adapter_errors(spec, catalog=catalog) == [], workflow
+            # No "names neither" warning: the catalog placed it
+            assert adapter_warnings(spec, catalog=catalog) == [], workflow
+
+    def test_a_single_workflow_string_is_one_partition(self):
+        catalog = catalogued("t2va")
+        assert adapter_errors(definition(realism_step("ref2va")), catalog=catalog)
+        assert adapter_errors(definition(realism_step("fl2va")), catalog=catalog) == []
+
+    @pytest.mark.parametrize("status", ["trial", "rejected"])
+    def test_a_weaker_entry_only_warns(self, status):
+        catalog = catalogued(["t2va", "fl2va"], status=status)
+        spec = definition(realism_step("ref2va"))
+        assert adapter_errors(spec, catalog=catalog) == []
+        warnings = adapter_warnings(spec, catalog=catalog)
+        assert len(warnings) == 1
+        assert "h3/realism" in warnings[0] and status in warnings[0]
+        assert "names neither" not in warnings[0]
+
+    @pytest.mark.parametrize("status", ["trial", "rejected"])
+    def test_a_weaker_entry_that_agrees_clears_names_neither(self, status):
+        catalog = catalogued(["t2va", "fl2va"], status=status)
+        spec = definition(realism_step("fl2va"))
+        assert adapter_errors(spec, catalog=catalog) == []
+        assert adapter_warnings(spec, catalog=catalog) == []
+
+    def test_no_index_is_todays_rule(self):
+        spec = definition(realism_step("ref2va"))
+        assert adapter_errors(spec) == []
+        warnings = adapter_warnings(spec)
+        assert len(warnings) == 1
+        assert "names neither" in warnings[0]
+
+    def test_an_uncovered_file_is_todays_rule(self):
+        catalog = catalogued(["t2va", "fl2va"], weight_name="other.safetensors")
+        spec = definition(realism_step("ref2va"))
+        assert adapter_errors(spec, catalog=catalog) == []
+        assert "names neither" in adapter_warnings(spec, catalog=catalog)[0]
+
+    def test_another_repo_with_the_same_file_is_not_covered(self):
+        catalog = catalogued(["t2va", "fl2va"])
+        spec = definition(h3_step("ref2va", NO_TOKEN, model_name="someone/else"))
+        assert adapter_errors(spec, catalog=catalog) == []
+        assert "names neither" in adapter_warnings(spec, catalog=catalog)[0]
+
+    @pytest.mark.parametrize("workflow", [None, ["t2va", "ref2va"]])
+    def test_a_null_or_mixed_workflow_falls_back_to_the_name(self, workflow):
+        catalog = catalogued(workflow)
+        spec = definition(realism_step("ref2va"))
+        assert adapter_errors(spec, catalog=catalog) == []
+        assert "names neither" in adapter_warnings(spec, catalog=catalog)[0]
+        token = definition(
+            realism_step("ref2va", "minimax_h3_fl2v_turbo_8step_v1.0_bf16.safetensors")
+        )
+        assert (
+            len(
+                adapter_errors(
+                    token,
+                    catalog=catalogued(
+                        workflow,
+                        weight_name="minimax_h3_fl2v_turbo_8step_v1.0_bf16.safetensors",
+                    ),
+                )
+            )
+            == 1
+        )
+
+    def test_a_proven_entry_against_a_name_token_warns_naming_both(self):
+        """Q1: the catalog and the file name disagree - say both, refuse
+        neither, whichever partition the step runs."""
+        weight_name = "minimax_h3_fl2v_turbo_8step_v1.0_bf16.safetensors"
+        catalog = catalogued("ref2va", weight_name=weight_name)
+        for workflow in sorted(H3_WORKFLOWS):
+            spec = definition(realism_step(workflow, weight_name))
+            assert adapter_errors(spec, catalog=catalog) == [], workflow
+            warnings = adapter_warnings(spec, catalog=catalog)
+            assert len(warnings) == 1, workflow
+            assert "h3/realism" in warnings[0] and KEYFRAME_TOKEN in warnings[0]
+
+    @pytest.mark.parametrize("status", ["trial", "rejected"])
+    def test_a_weaker_entry_never_lifts_a_name_error(self, status):
+        weight_name = "minimax_h3_fl2v_turbo_8step_v1.0_bf16.safetensors"
+        catalog = catalogued("ref2va", status=status, weight_name=weight_name)
+        spec = definition(realism_step("ref2va", weight_name))
+        errors = adapter_errors(spec, catalog=catalog)
+        assert len(errors) == 1 and "transformer_ref" in errors[0]["message"]
+
+    def test_the_caller_is_told_where_they_wrote_it(self):
+        catalog = catalogued(["t2va", "fl2va"])
+        written = definition(
+            h3_step("ref2va", "variable:lora_weight_name", model_name=REALISM)
+        )
+        expanded = definition(realism_step("ref2va"))
+        errors = adapter_errors(
+            expanded,
+            None,
+            written=written,
+            supplied={"lora_weight_name"},
+            catalog=catalog,
+        )
+        assert errors[0]["path"] == "arguments.lora_weight_name"
+
+    def test_a_stronger_entry_wins_a_shared_file(self):
+        entry = {"model_name": REALISM, "weight_name": NO_TOKEN}
+        index = catalog_index(
+            {
+                "a/trial": {**entry, "workflow": "ref2va", "status": "trial"},
+                "b/proven": {**entry, "workflow": "t2va", "status": "proven"},
+            }
+        )
+        assert index[(REALISM, NO_TOKEN)] == ("b/proven", ("t2va",), "proven")
+
+
+def packaged_catalog():
+    entries = {}
+    root = os.path.join(REPO_ROOT, "loras")
+    for path in glob.glob(os.path.join(root, "**", "*.json"), recursive=True):
+        entry = load(path)
+        assert not entry_errors(entry), path
+        entries[os.path.relpath(path, root)[: -len(".json")]] = entry
+    return catalog_index(entries)
+
+
+PACKAGED = packaged_catalog()
+
+
+class TestThePackagedCatalogAgrees:
+    """The template sweep again, as the server validates it: with the
+    packaged catalog's index (#870)."""
+
+    def test_the_index_covers_realism_people(self):
+        assert PACKAGED[(REALISM, NO_TOKEN)][1:] == (("t2va", "fl2va"), "proven")
+
+    @pytest.mark.parametrize("path", TEMPLATES)
+    def test_no_stored_workflow_mispairs_an_adapter(self, path):
+        spec = load(path)
+        assert adapter_errors(spec, catalog=PACKAGED) == [], path
diff --git a/tests/test_h3_guides.py b/tests/test_h3_guides.py
index cac60ce4..fc8fac52 100644
--- a/tests/test_h3_guides.py
+++ b/tests/test_h3_guides.py
@@ -11,7 +11,6 @@
 
 from dw.media_types import AudioVideo
 from dw.pipeline_processors import h3_guides, h3_hold, h3_rules
-from dw.pipeline_processors import pipeline as pipeline_module
 from dw.pipeline_processors.h3_guides import (
     LAYOUT_ANCHORS,
     default_num_frames,
@@ -848,7 +847,7 @@ def guided():
 def warnings_seen(monkeypatch):
     seen = []
     monkeypatch.setattr(
-        pipeline_module, "emit_warning", lambda message, **data: seen.append(message)
+        h3_guides, "emit_warning", lambda message, **data: seen.append(message)
     )
     return seen
 
@@ -978,7 +977,7 @@ def load(location, base_dir=None):
             read.append(location)
             return AudioVideo(clip(5), np.ones((2, 10), np.float32), 16000)
 
-        monkeypatch.setattr(pipeline_module, "load_audio_video", load)
+        monkeypatch.setattr(h3_guides, "load_audio_video", load)
         result = Pipeline._with_guides(
             ns(guided), {"guides": [{"video": "clip.mp4", "frame": 0, "audio": True}]}
         )
diff --git a/tests/test_host_memory.py b/tests/test_host_memory.py
index 61cd89f4..dd9a9c92 100644
--- a/tests/test_host_memory.py
+++ b/tests/test_host_memory.py
@@ -215,3 +215,16 @@ def test_rss_split_absent_without_the_split(tmp_path):
     status.write_text("VmRSS:\t300 kB\n")
     assert host_memory.rss_split_mb(str(status)) == {}
     assert host_memory.rss_split_mb(str(tmp_path / "missing")) == {}
+
+
+def test_read_oom_score_adj_reads_proc_or_none():
+    from dw.host_memory import read_oom_score_adj
+
+    assert read_oom_score_adj(0) is None
+    assert read_oom_score_adj(None) is None
+    if sys.platform.startswith("linux"):
+        assert read_oom_score_adj(os.getpid()) == int(
+            open("/proc/self/oom_score_adj").read()
+        )
+    else:
+        assert read_oom_score_adj(os.getpid()) is None
diff --git a/tests/test_host_memory_projection.py b/tests/test_host_memory_projection.py
index f7906d86..a0abdb8c 100644
--- a/tests/test_host_memory_projection.py
+++ b/tests/test_host_memory_projection.py
@@ -119,11 +119,14 @@ def test_released_pipeline_projects_the_largest_single_iteration(self):
         warnings = host_memory_warnings(definition, {"shots": 12}, rows, 8_000 * MB)
         assert warnings == []
 
-    def test_released_pipeline_over_the_ceiling_still_warns(self):
+    def test_released_peak_that_already_succeeded_warns_nothing_at_any_length(self):
+        # #901: a released shape's peak does not scale with the list, so a
+        # completed run at ~125 GB proves a longer request survives it too,
+        # even when the peak row ran fewer entries than this request
         definition = for_each_workflow(release=True)
         rows = [row(9000 * MB, {"shots": [1, 2, 3]})]
-        warnings = host_memory_warnings(definition, {"shots": 12}, rows, 8_000 * MB)
-        assert len(warnings) == 1
+        warnings = host_memory_warnings(definition, {"shots": 5}, rows, 8_000 * MB)
+        assert warnings == []
 
     def test_no_list_in_this_request_warns_nothing(self):
         definition = for_each_workflow(release=False)
diff --git a/tests/test_host_ram_need.py b/tests/test_host_ram_need.py
new file mode 100644
index 00000000..fff27332
--- /dev/null
+++ b/tests/test_host_ram_need.py
@@ -0,0 +1,392 @@
+"""The host-RAM need a run is projected to hold (#869, #909).
+
+`memory_key` names what decides a run's footprint (pipelines, quantization,
+offload, arguments resolved); `JobHistory` stores it per run; `projected_peak`
+prefers the observed peak of this machine's successful runs with that key over
+the fit from the workflow's own history; validate reports it as
+`plan.host_memory`.
+"""
+
+import copy
+import json
+import os
+import sqlite3
+
+import pytest
+from fastapi.testclient import TestClient
+
+from dw.host_memory_projection import host_memory_warnings, projected_mb
+from dw.server.app import create_app
+from dw.server.host_ram_need import host_memory_block, memory_key, projected_peak
+from dw.server.job_history import JobHistory
+from dw.server.job_record import SUCCEEDED, Job
+from dw.server.jobs import JobManager
+from dw.workspace import Workspace
+
+from .test_server import ScriptedWorkerManager, success_script, valid_workflow
+
+TEMPLATE = "workflows/templates/minimax/reference-to-video.json"
+
+
+def template():
+    with open(TEMPLATE) as file:
+        return json.load(file)
+
+
+def pipeline_step(definition):
+    return next(step for step in definition["steps"] if "pipeline" in step)
+
+
+def recorded_job(job_id, definition, peak, status=SUCCEEDED, arguments=None):
+    job = Job(
+        {
+            "workflow_name": "w",
+            "catalog_name": "w",
+            "arguments": arguments or {},
+            "definition": definition,
+        }
+    )
+    job.id = job_id
+    job.status = status
+    job.started_at = 10.0
+    job.finished_at = 70.0
+    job.host_memory_job_peak_rss_mb = peak
+    return job
+
+
+def fit_rows(*peaks):
+    return [{"host_memory_job_peak_rss_mb": peak, "arguments": "{}"} for peak in peaks]
+
+
+class TestMemoryKey:
+    def test_the_template_has_a_key(self):
+        assert memory_key(template()) is not None
+
+    def test_a_renamed_copy_has_the_same_key(self):
+        definition = template()
+        renamed = copy.deepcopy(definition)
+        renamed["id"] = "SomethingElse"
+        renamed["name"] = "something-else"
+
+        assert memory_key(renamed) == memory_key(definition)
+
+    def test_an_inline_copy_without_its_metadata_has_the_same_key(self):
+        definition = template()
+        inline = copy.deepcopy(definition)
+        for field in ("id", "name", "description", "summary", "cost", "cost_drivers"):
+            inline.pop(field, None)
+
+        assert memory_key(inline) == memory_key(definition)
+
+    def test_a_different_weights_dtype_is_a_different_key(self):
+        definition = template()
+        assert "weights_dtype" in definition["variables"]
+
+        int4 = memory_key(definition, {"weights_dtype": "{int4}"})
+        int8 = memory_key(definition, {"weights_dtype": "{int8}"})
+
+        assert int4 is not None and int8 is not None
+        assert int4 != int8
+
+    def test_a_different_offload_is_a_different_key(self):
+        definition = valid_workflow("offload")
+        offloaded = copy.deepcopy(definition)
+        pipeline_step(offloaded)["pipeline"]["configuration"]["offload"] = "model"
+
+        assert memory_key(offloaded) != memory_key(definition)
+
+    def test_a_different_group_offload_setting_changes_the_template_key(self):
+        definition = template()
+        changed = copy.deepcopy(definition)
+        text = json.dumps(changed).replace("block_level", "leaf_level")
+        assert text != json.dumps(changed)
+
+        assert memory_key(json.loads(text)) != memory_key(definition)
+
+    def test_a_task_only_definition_has_no_key(self):
+        definition = {
+            "id": "tasks",
+            "steps": [
+                {
+                    "name": "n",
+                    "task": {"command": "normalize_audio", "arguments": {}},
+                }
+            ],
+        }
+
+        assert memory_key(definition) is None
+
+    def test_an_undeclared_variable_has_no_key(self):
+        definition = template()
+        definition["variables"].pop("weights_dtype")
+
+        assert memory_key(definition) is None
+
+
+class TestProjectedPeak:
+    def test_an_observed_peak_beats_the_fit(self, tmp_path):
+        definition = template()
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        history.record(recorded_job("a", definition, 50000))
+        history.record(recorded_job("b", definition, 60000))
+        rows = fit_rows(1000, 2000)
+        entries = {"references": 2}
+        assert projected_mb(definition, entries, rows) is not None
+
+        need = projected_peak(definition, {}, history, rows=rows, list_entries=entries)
+
+        assert need == (60000, "observed", 2)
+
+    def test_a_renamed_run_shares_the_templates_observed_history(self, tmp_path):
+        definition = template()
+        renamed = copy.deepcopy(definition)
+        renamed["id"] = "Renamed"
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        history.record(recorded_job("a", renamed, 42000))
+
+        assert projected_peak(definition, {}, history) == (42000, "observed", 1)
+
+    def test_the_fit_answers_when_nothing_was_observed(self, tmp_path):
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        rows = fit_rows(30000, 40000) + [
+            {"host_memory_job_peak_rss_mb": None, "arguments": "{}"}
+        ]
+
+        need = projected_peak(
+            template(), {}, history, rows=rows, list_entries={"references": 3}
+        )
+
+        assert need == (40000, "fit", 2)
+
+    def test_no_figure_without_history_or_rows(self, tmp_path):
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+
+        assert projected_peak(template(), {}, history) is None
+        assert projected_peak(template(), {}, None) is None
+
+    def test_a_failed_run_is_not_observed(self, tmp_path):
+        definition = template()
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        history.record(recorded_job("a", definition, 99000, status="failed"))
+
+        assert history.peaks_for_key(memory_key(definition)) == []
+        assert projected_peak(definition, {}, history) is None
+
+    def test_a_run_without_a_peak_is_not_observed(self, tmp_path):
+        definition = template()
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        history.record(recorded_job("a", definition, None))
+
+        assert history.peaks_for_key(memory_key(definition)) == []
+
+    def test_another_key_is_not_observed(self, tmp_path):
+        definition = template()
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        history.record(recorded_job("a", definition, 50000))
+
+        other = projected_peak(definition, {"weights_dtype": "{int8}"}, history)
+
+        assert other is None
+
+
+def shots_definition(released=False):
+    """A for_each over a shot list, holding its pipeline resident across the
+    list (the accumulating shape) unless `released`."""
+    step = {
+        "name": "shot",
+        "for_each": "variable:shots",
+        "pipeline": {
+            "configuration": {"component_type": "ModularPipeline"},
+            "from_pretrained_arguments": {"model_name": "acme/video"},
+        },
+        "run": {"prompt": "item:prompt"},
+    }
+    if released:
+        step["release_pipeline"] = True
+    return {
+        "id": "shots",
+        "variables": {"shots": [{"prompt": "a"}]},
+        "steps": [step],
+    }
+
+
+def shot_rows(*runs):
+    """Fit rows of (shot count, peak MB)."""
+    return [
+        {
+            "host_memory_job_peak_rss_mb": peak,
+            "arguments": json.dumps({"shots": [{"prompt": "p"}] * count}),
+        }
+        for count, peak in runs
+    ]
+
+
+class TestALongerListThanObserved:
+    """#910: the memory key leaves list length out, so for an accumulating
+    shape the observed max (from shorter lists) under-projects a longer one;
+    the fit's growth is taken when it is the larger, so dispatch, the plan's
+    host_memory and validate's warning agree."""
+
+    def _history(self, tmp_path, definition):
+        history = JobHistory(str(tmp_path / "jobs.sqlite"))
+        for job_id, count, peak in (("a", 2, 20000), ("b", 4, 30000)):
+            history.record(
+                recorded_job(
+                    job_id,
+                    definition,
+                    peak,
+                    arguments={"shots": [{"prompt": "p"}] * count},
+                )
+            )
+        return history
+
+    def test_an_accumulating_list_takes_the_larger_fit(self, tmp_path):
+        definition = shots_definition()
+        history = self._history(tmp_path, definition)
+        rows = shot_rows((2, 20000), (4, 30000))
+
+        need = projected_peak(
+            definition,
+            {"shots": [{"prompt": "p"}] * 8},
+            history,
+            rows=rows,
+            list_entries={"shots": 8},
+        )
+
+        assert need == (50000, "fit", 2)
+        warnings = host_memory_warnings(definition, {"shots": 8}, rows, 40000)
+        assert warnings and "~50000 MB" in warnings[0]
+
+    def test_a_list_inside_the_observed_range_keeps_the_observed_max(self, tmp_path):
+        definition = shots_definition()
+        history = self._history(tmp_path, definition)
+
+        need = projected_peak(
+            definition,
+            {"shots": [{"prompt": "p"}] * 3},
+            history,
+            rows=shot_rows((2, 20000), (4, 30000)),
+            list_entries={"shots": 3},
+        )
+
+        assert need == (30000, "observed", 2)
+
+    def test_a_released_list_keeps_the_observed_max(self, tmp_path):
+        definition = shots_definition(released=True)
+        history = self._history(tmp_path, definition)
+
+        need = projected_peak(
+            definition,
+            {"shots": [{"prompt": "p"}] * 8},
+            history,
+            rows=shot_rows((2, 20000), (4, 30000)),
+            list_entries={"shots": 8},
+        )
+
+        assert need == (30000, "observed", 2)
+
+
+def old_shape_database(path):
+    """A jobs.sqlite from before the memory_key column, holding one successful
+    run with a peak."""
+    with sqlite3.connect(path) as connection:
+        connection.execute("""CREATE TABLE jobs (
+                id TEXT PRIMARY KEY, workflow TEXT, status TEXT,
+                created_at REAL, started_at REAL, finished_at REAL,
+                arguments TEXT, spec TEXT, manifest TEXT, warnings TEXT,
+                error TEXT, events TEXT, host_memory_job_peak_rss_mb REAL
+            )""")
+        connection.execute(
+            "INSERT INTO jobs (id, workflow, status, arguments, spec, manifest,"
+            " events, host_memory_job_peak_rss_mb) VALUES (?,?,?,?,?,?,?,?)",
+            ("old", "w", SUCCEEDED, "{}", "{}", "[]", "[]", 77000.0),
+        )
+
+
+class TestMigration:
+    def test_a_row_from_before_the_column_counts_as_no_data(self, tmp_path):
+        path = str(tmp_path / "jobs.sqlite")
+        old_shape_database(path)
+
+        history = JobHistory(path)
+
+        with sqlite3.connect(path) as connection:
+            columns = [row[1] for row in connection.execute("PRAGMA table_info(jobs)")]
+            (key,) = connection.execute("SELECT memory_key FROM jobs").fetchone()
+        assert "memory_key" in columns
+        assert key is None
+        assert history.peaks_for_key(memory_key(template())) == []
+        assert projected_peak(template(), {}, history) is None
+
+    def test_opening_a_migrated_database_again_is_harmless(self, tmp_path):
+        path = str(tmp_path / "jobs.sqlite")
+        old_shape_database(path)
+        JobHistory(path)
+
+        JobHistory(path)
+
+        with sqlite3.connect(path) as connection:
+            columns = [row[1] for row in connection.execute("PRAGMA table_info(jobs)")]
+        assert columns.count("memory_key") == 1
+
+
+class TestHostMemoryBlock:
+    def test_no_need_is_no_block(self):
+        assert host_memory_block(None) is None
+
+    def test_the_figure_is_rounded(self):
+        assert host_memory_block((61234.6, "observed", 2)) == {
+            "projected_mb": 61235,
+            "basis": "observed",
+            "runs": 2,
+        }
+
+
+@pytest.fixture
+def server(tmp_path):
+    root = Workspace(tmp_path / "studio", "flag").ensure()
+    with open(os.path.join(root.workflows, "Heavy.json"), "w") as file:
+        json.dump(valid_workflow("heavy"), file)
+    manager = JobManager(
+        root.outputs,
+        worker_manager=ScriptedWorkerManager(success_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=root.workflows,
+    )
+    app = create_app(
+        workflow_dir=root.workflows,
+        output_dir=root.outputs,
+        job_manager=manager,
+        prompt_dir=root.prompts,
+        asset_dir=root.assets,
+        workspace=root.root,
+    )
+    return manager, TestClient(app, base_url="http://localhost")
+
+
+def validate(client):
+    response = client.post("/api/validate", json={"workflow_path": "Heavy"})
+    assert response.status_code == 200
+    return response.json()
+
+
+class TestValidateRoute:
+    def test_no_history_has_no_host_memory_in_the_plan(self, server):
+        manager, client = server
+        with client:
+            result = validate(client)
+
+        assert result["valid"] is True
+        assert "host_memory" not in result["plan"]
+
+    def test_an_observed_run_is_the_plans_host_memory(self, server):
+        manager, client = server
+        manager.history.record(recorded_job("a", valid_workflow("heavy"), 51234.4))
+        with client:
+            result = validate(client)
+
+        assert result["plan"]["host_memory"] == {
+            "projected_mb": 51234,
+            "basis": "observed",
+            "runs": 1,
+        }
diff --git a/tests/test_hub_cache.py b/tests/test_hub_cache.py
index 9a174163..99949b57 100644
--- a/tests/test_hub_cache.py
+++ b/tests/test_hub_cache.py
@@ -2,6 +2,7 @@
 deleting it through huggingface_hub's own strategy."""
 
 import json
+import os
 
 import pytest
 
@@ -68,7 +69,11 @@ def make_pipeline_repo(
     (repo / "refs" / "main").write_text(commit)
     index = {"_class_name": "SomePipeline"}
     for component in components or {}:
-        index[component] = ["diffusers", "SomeComponent"]
+        weightless = component in ("scheduler", "tokenizer")
+        index[component] = [
+            "diffusers",
+            "SomeScheduler" if weightless else "SomeComponent",
+        ]
     (snapshot / "model_index.json").write_text(json.dumps(index))
     for component, files in (components or {}).items():
         folder = snapshot / component
@@ -181,6 +186,69 @@ def test_a_component_with_the_requested_variant_present_is_complete(self, tmp_pa
         )
 
 
+class TestConfigOnlyComponents:
+    """#894: FLUX.1-dev with every component folder holding only its small
+    config files read as fully cached, and the run then pulled ~33 GB."""
+
+    def _repo(self, tmp_path, classes, files):
+        repo = make_pipeline_repo(tmp_path, components=files)
+        snapshot = next((repo / "snapshots").iterdir())
+        index = json.loads((snapshot / "model_index.json").read_text())
+        for name, cls in classes.items():
+            index[name] = ["diffusers", cls]
+        (snapshot / "model_index.json").write_text(json.dumps(index))
+        return snapshot
+
+    def test_a_weight_bearing_component_with_only_a_config_is_incomplete(
+        self, tmp_path
+    ):
+        self._repo(
+            tmp_path,
+            {
+                "transformer": "FluxTransformer2DModel",
+                "scheduler": "FlowMatchEulerDiscreteScheduler",
+            },
+            {"transformer": ["config.json"], "scheduler": ["scheduler_config.json"]},
+        )
+        assert repo_download_incomplete("acme/pipe", cache_dir=tmp_path) is True
+
+    def test_weightless_components_alone_are_complete(self, tmp_path):
+        self._repo(
+            tmp_path,
+            {
+                "scheduler": "FlowMatchEulerDiscreteScheduler",
+                "tokenizer": "CLIPTokenizer",
+            },
+            {"scheduler": ["scheduler_config.json"], "tokenizer": ["vocab.json"]},
+        )
+        assert repo_download_incomplete("acme/pipe", cache_dir=tmp_path) is False
+
+    def test_a_shard_named_by_the_index_but_absent_is_incomplete(self, tmp_path):
+        snapshot = self._repo(
+            tmp_path,
+            {"transformer": "FluxTransformer2DModel"},
+            {"transformer": ["m-00001-of-00002.safetensors"]},
+        )
+        (snapshot / "transformer" / "m.safetensors.index.json").write_text(
+            json.dumps(
+                {
+                    "weight_map": {
+                        "a": "m-00001-of-00002.safetensors",
+                        "b": "m-00002-of-00002.safetensors",
+                    }
+                }
+            )
+        )
+        assert repo_download_incomplete("acme/pipe", cache_dir=tmp_path) is True
+
+    def test_a_dangling_weight_symlink_is_incomplete(self, tmp_path):
+        snapshot = self._repo(
+            tmp_path, {"transformer": "FluxTransformer2DModel"}, {"transformer": []}
+        )
+        os.symlink(tmp_path / "gone", snapshot / "transformer" / "model.safetensors")
+        assert repo_download_incomplete("acme/pipe", cache_dir=tmp_path) is True
+
+
 class FakeSibling:
     def __init__(self, size):
         self.size = size
@@ -247,6 +315,36 @@ def test_cancel_stops_the_download_mid_flight(self):
         status = self.wait_status(manager, started["id"], ["cancelled"])
         assert status["downloaded"] < 100
 
+    def test_cancel_shows_pending_then_aborts_xet_and_ends_cancelled(self):
+        """#899: the record says the cancel is pending, the xet session is
+        aborted, and the library's own error from the abort is a cancel."""
+        import threading
+        from unittest import mock
+
+        from dw.hub_cache import DownloadManager
+
+        release = threading.Event()
+
+        def stuck_download(repo_id, tqdm_class=None):
+            release.wait(5)
+            raise RuntimeError("xet session aborted")
+
+        manager = DownloadManager(
+            download_fn=stuck_download,
+            info_fn=lambda repo_id: FakeInfo([10]),
+        )
+        started = manager.start("acme/tiny")
+        assert started["cancel_requested"] is False
+        with mock.patch("dw.hub_cache._abort_xet_session") as abort:
+            pending = manager.cancel(started["id"])
+        abort.assert_called_once()
+        assert pending["status"] == "downloading"
+        assert pending["cancel_requested"] is True
+        release.set()
+        status = self.wait_status(manager, started["id"], ["cancelled"])
+        assert status["cancel_requested"] is False
+        assert status["error"] is None
+
     def test_xet_aggregate_bars_count_file_bytes_once(self):
         """huggingface_hub's xet path builds two aggregate bars from the
         tracker class - reconstruction (file bytes) and transfer (network
@@ -328,3 +426,119 @@ def test_invalid_and_duplicate_repos_are_refused(self):
         manager.cancel(started["id"])
         gate.set()
         self.wait_status(manager, started["id"], ["cancelled"])
+
+
+class TestDownloadRepoCancel:
+    def test_cancel_skips_files_not_yet_started(self):
+        """#899: after a cancel no queued file starts (snapshot_download's
+        pool ran them all). Runs the real _download_repo loop."""
+        import threading
+        from types import SimpleNamespace
+        from unittest import mock
+
+        from dw.hub_cache import DownloadCancelled, _download_repo
+
+        cancel = threading.Event()
+        fetched = []
+
+        def fake_hub_download(repo_id, filename, revision, tqdm_class, **kwargs):
+            fetched.append(filename)
+            cancel.set()
+
+        info = SimpleNamespace(
+            sha="abc",
+            siblings=[SimpleNamespace(rfilename=f"f{i}") for i in range(20)],
+        )
+        tracker = SimpleNamespace(_cancel_event=cancel)
+        with (
+            mock.patch("huggingface_hub.HfApi") as api,
+            mock.patch("huggingface_hub.hf_hub_download", fake_hub_download),
+        ):
+            api.return_value.repo_info.return_value = info
+            try:
+                _download_repo("acme/tiny", tracker, max_workers=1)
+            except DownloadCancelled:
+                pass
+            else:
+                raise AssertionError("expected DownloadCancelled")
+        assert len(fetched) == 1
+
+
+class TestDownloadRepoMainRef:
+    """#899 regression: per-file hf_hub_download pinned to a commit hash never
+    writes refs/main, so a pulled repo read as incomplete and offline loads
+    could not resolve 'main'. _download_repo writes it once every file is in."""
+
+    SHA = "0123456789abcdef0123456789abcdef01234567"
+
+    def run(self, tmp_path, fake_hub_download, cancel=None):
+        import threading
+        from types import SimpleNamespace
+        from unittest import mock
+
+        from dw.hub_cache import _download_repo
+
+        cancel = cancel or threading.Event()
+        info = SimpleNamespace(
+            sha=self.SHA,
+            siblings=[SimpleNamespace(rfilename=name) for name in ("a.bin", "b.bin")],
+        )
+        tracker = SimpleNamespace(_cancel_event=cancel)
+        with (
+            mock.patch("huggingface_hub.HfApi") as api,
+            mock.patch("huggingface_hub.hf_hub_download", fake_hub_download),
+        ):
+            api.return_value.repo_info.return_value = info
+            _download_repo("acme/tiny", tracker, max_workers=1, cache_dir=tmp_path)
+
+    def fake_writer(self, tmp_path, on_fetch=None):
+        def fake_hub_download(repo_id, filename, revision, tqdm_class, cache_dir):
+            assert revision == self.SHA
+            snapshot = (
+                tmp_path / "models--acme--tiny" / "snapshots" / revision / filename
+            )
+            snapshot.parent.mkdir(parents=True, exist_ok=True)
+            snapshot.write_bytes(b"x")
+            if on_fetch:
+                on_fetch(filename)
+
+        return fake_hub_download
+
+    def test_a_completed_download_writes_refs_main_at_the_sha(self, tmp_path):
+        self.run(tmp_path, self.fake_writer(tmp_path))
+        ref = tmp_path / "models--acme--tiny" / "refs" / "main"
+        assert ref.read_text() == self.SHA
+        assert repo_download_incomplete("acme/tiny", cache_dir=tmp_path) is False
+        # The temp file the ref was written through is gone
+        assert os.listdir(ref.parent) == ["main"]
+
+    def test_a_cancelled_download_writes_no_ref(self, tmp_path):
+        import threading
+
+        from dw.hub_cache import DownloadCancelled
+
+        cancel = threading.Event()
+        with pytest.raises(DownloadCancelled):
+            self.run(
+                tmp_path,
+                self.fake_writer(tmp_path, on_fetch=lambda _: cancel.set()),
+                cancel=cancel,
+            )
+        assert not (tmp_path / "models--acme--tiny" / "refs" / "main").exists()
+
+    def test_a_cancel_after_the_last_file_writes_no_ref(self, tmp_path):
+        import threading
+
+        cancel = threading.Event()
+        names = []
+
+        def on_fetch(name):
+            names.append(name)
+            if len(names) == 2:
+                cancel.set()
+
+        from dw.hub_cache import DownloadCancelled
+
+        with pytest.raises(DownloadCancelled):
+            self.run(tmp_path, self.fake_writer(tmp_path, on_fetch), cancel=cancel)
+        assert not (tmp_path / "models--acme--tiny" / "refs" / "main").exists()
diff --git a/tests/test_inherited_cost.py b/tests/test_inherited_cost.py
index 249f37af..882cd0d2 100644
--- a/tests/test_inherited_cost.py
+++ b/tests/test_inherited_cost.py
@@ -4,12 +4,15 @@
 template had none. `inherited_observed` finds the catalog template with the
 same pipeline identity (the key `dw/vram_inheritance.py` matches on) and
 quotes its runs under `basis: "inherited"`, warning where the inline
-workflow's offload, quantization or frame count differ.
+workflow's offload, quantization, frame count, attention backend, cache or
+LoRA differ, and scaling its minutes by its size (#851, #866).
 """
 
 from types import SimpleNamespace
 from unittest.mock import patch
 
+import pytest
+
 import dw.plan
 from dw.plan import build_plan
 from dw.server.observed_cost import observed_for
@@ -161,6 +164,66 @@ def test_a_frame_count_the_caller_changed(self):
         )
         assert differs == ["frame count"]
 
+    def test_a_reference_count_other_than_the_templates_is_named(self):
+        def refs(n):
+            return [{"from_file": f"r{i}"} for i in range(n)]
+
+        def with_refs(value, **top):
+            d = definition("inline")
+            step = d["steps"][0]
+            step["pipeline"] = {
+                **step["pipeline"],
+                "arguments": {"references": value},
+            }
+            d.update(top)
+            return d
+
+        template = with_refs(refs(2))
+        assert inherited_differences(with_refs(refs(2)), template) == []
+        assert inherited_differences(with_refs(refs(3)), template) == [
+            "reference count"
+        ]
+        # per-entry references, read off the step's for_each list
+        entries = [{"references": refs(2)}, {"references": refs(3)}]
+        each = with_refs("item:references", variables={"shots": entries})
+        each["steps"][0]["for_each"] = "variable:shots"
+        assert "reference count" in inherited_differences(each, template)
+        # the optional form with a default, and a null source, count as the
+        # run counts them
+        optional = [
+            {"references": refs(2) + [{"from_file": None}]},
+            {"label": "no references of its own"},
+        ]
+        each = with_refs(
+            {"item": "references", "default": refs(2)},
+            variables={"shots": optional, "num_frames": 124},
+        )
+        each["steps"][0]["for_each"] = "variable:shots"
+        assert "reference count" not in inherited_differences(each, template)
+        each["variables"]["shots"][1]["references"] = refs(3)
+        assert "reference count" in inherited_differences(each, template)
+
+    def test_a_for_each_whose_entries_match_the_templates_frames_is_not_named(self):
+        def with_frames(value, **top):
+            d = definition("inline")
+            step = d["steps"][0]
+            step["pipeline"] = {
+                **step["pipeline"],
+                "arguments": {"num_frames": value},
+            }
+            d.update(top)
+            return d
+
+        template = with_frames(124)
+        shots = [{"num_frames": 124}, {"num_frames": 124}]
+        each = with_frames(
+            "item:num_frames", variables={"shots": shots, "num_frames": 124}
+        )
+        each["steps"][0]["for_each"] = "variable:shots"
+        assert inherited_differences(each, template) == []
+        each["variables"]["shots"][1]["num_frames"] = 209
+        assert inherited_differences(each, template) == ["frame count"]
+
 
 class TestThePlanReportsIt:
     def test_the_estimate_is_inherited_and_the_validate_answer_warns(self, tmp_path):
@@ -195,25 +258,69 @@ def test_an_observed_estimate_does_not_warn(self):
         assert _inherited_cost_warnings({"basis": "observed"}) == []
 
 
-class TestNotQuotedUnchangedWhenItScales:
-    """#821: the template's minutes are for one template-sized run."""
+class TestScaledWhenItScales:
+    """#821/#851: the template's minutes are for one template-sized run, so a
+    bigger workflow is re-priced linearly and says why."""
 
     HISTORY = {"templates/t": [run(8 * MINUTE, {"num_frames": 124})]}
+    CATALOG = [("templates/t", definition("t"))]
 
-    def test_several_steps_of_one_pipeline_are_not_priced_as_one_run(self):
+    def test_several_steps_scale_by_step_count(self):
         inline = definition("inline")
         inline["steps"] = [{**inline["steps"][0], "id": f"shot{n}"} for n in range(3)]
-        assert (
-            inherited(inline, [("templates/t", definition("t"))], self.HISTORY) is None
-        )
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 24.0
+        assert block["inherited_from"] == "templates/t"
+        assert "3 steps, template measured 1" in block["scaled"]
 
-    def test_a_literal_longer_frame_count_is_not_priced_as_the_templates(self):
+    def test_a_longer_frame_count_scales_by_frames(self):
         inline = definition("inline")
         inline["variables"] = {}
-        inline["steps"][0]["run"] = {"num_frames": 899}
-        assert (
-            inherited(inline, [("templates/t", definition("t"))], self.HISTORY) is None
+        inline["steps"][0]["run"] = {"num_frames": 248}
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 16.0
+        assert "frames 248 vs 124" in block["scaled"]
+        assert "frame count" in block["differs"]
+
+    def test_steps_and_frames_multiply(self):
+        inline = definition("inline")
+        inline["variables"] = {}
+        inline["steps"] = [
+            {**inline["steps"][0], "id": f"shot{n}", "run": {"num_frames": 62}}
+            for n in range(4)
+        ]
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 16.0  # 4 steps x half the frames
+        assert "4 steps" in block["scaled"] and "62 vs 124" in block["scaled"]
+
+    def test_a_template_sized_workflow_is_not_scaled(self):
+        block = inherited(definition("inline"), self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 8.0
+        assert "scaled" not in block
+
+    def test_the_plan_reports_the_reason_and_low_confidence(self, tmp_path):
+        inline = definition("inline")
+        inline["steps"] = [{**inline["steps"][0], "id": f"shot{n}"} for n in range(3)]
+        block = inherited(
+            inline, self.CATALOG, {"templates/t": self.HISTORY["templates/t"] * 3}
+        )
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            plan = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: block,
+            )
+        estimate = plan["estimate"]
+        assert estimate["basis"] == "inherited"
+        assert estimate["minutes"] == 24.0
+        assert estimate["low_confidence"] is True
+        assert "3 steps, template measured 1" in estimate["scaled"]
+        assert "3 steps" in _inherited_cost_warnings(estimate)[0]
 
     def test_a_shared_driver_name_still_prices_its_bucket(self):
         block = inherited(
@@ -223,3 +330,443 @@ def test_a_shared_driver_name_still_prices_its_bucket(self):
             {"num_frames": 124},
         )
         assert block["cold_minutes"] == 8.0
+
+
+def shot_list(count, num_frames=124):
+    return [{"prompt": f"p{n}", "num_frames": num_frames} for n in range(count)]
+
+
+def shots_definition(name, shots):
+    return {
+        "id": name,
+        "variables": {"shots": shots},
+        "cost_drivers": ["shots"],
+        "steps": [
+            {
+                "name": "shot",
+                "for_each": "variable:shots",
+                "pipeline": PIPELINE,
+                "run": {"num_frames": "item:num_frames", "prompt": "item:prompt"},
+            }
+        ],
+    }
+
+
+class TestAListLongerThanTheFallbackBucket:
+    """A for_each step is one pipeline step per entry: an inline copy with
+    more entries than the default bucket the template ran is priced from
+    that bucket only once it is scaled by the expanded member count (#851
+    regression - 6 x 124 frames was quoted as 3 x 124's minutes)."""
+
+    CATALOG = [("templates/t", shots_definition("t", shot_list(3)))]
+    HISTORY = {"templates/t": [run(30 * MINUTE, {"shots": shot_list(3)})]}
+
+    def test_the_template_sized_list_is_not_scaled(self):
+        block = inherited(
+            shots_definition("inline", shot_list(3)), self.CATALOG, self.HISTORY
+        )
+        assert block["cold_minutes"] == 30.0
+        assert "scaled" not in block
+
+    def test_an_inline_six_shot_copy_scales_by_members(self):
+        block = inherited(
+            shots_definition("inline", shot_list(6)), self.CATALOG, self.HISTORY
+        )
+        assert block["cold_minutes"] == 60.0
+        assert "6 steps, template measured 3" in block["scaled"]
+
+    def test_a_six_shot_argument_scales_by_members(self):
+        block = inherited(
+            shots_definition("inline", shot_list(3)),
+            self.CATALOG,
+            self.HISTORY,
+            {"shots": shot_list(6)},
+        )
+        assert block["cold_minutes"] == 60.0
+        assert "6 steps, template measured 3" in block["scaled"]
+
+    def test_shorter_shots_scale_by_members_and_frames(self):
+        block = inherited(
+            shots_definition("inline", shot_list(6, num_frames=62)),
+            self.CATALOG,
+            self.HISTORY,
+        )
+        assert block["cold_minutes"] == 30.0
+        assert "6 steps" in block["scaled"] and "62 vs 124" in block["scaled"]
+
+    def test_the_plan_quotes_it_low_confidence(self, tmp_path):
+        inline = shots_definition("inline", shot_list(6))
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            plan = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: block,
+            )
+        estimate = plan["estimate"]
+        assert estimate["basis"] == "inherited"
+        assert estimate["minutes"] == 60.0
+        assert estimate["low_confidence"] is True
+
+
+class TestVariableFrameCountAndWithheldReason:
+    """#851 bounce: a frame count written as `variable:num_frames` that the
+    template never ran at still prices from the template's default bucket, and
+    a figure still withheld names the template and why."""
+
+    HISTORY = {"templates/t": [run(8 * MINUTE, {"num_frames": 124})]}
+    CATALOG = [("templates/t", definition("t"))]
+
+    def test_a_variable_frame_count_scales_from_the_default_bucket(self):
+        inline = definition("inline", num_frames=248)
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 16.0
+        assert "frames 248 vs 124" in block["scaled"]
+
+    def test_variable_frames_and_steps_multiply(self):
+        inline = definition("inline", num_frames=248)
+        inline["steps"] = [{**inline["steps"][0], "id": f"s{n}"} for n in range(2)]
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 32.0
+
+    def test_a_withheld_figure_names_template_and_reason(self):
+        inline = definition("inline")
+        inline["variables"] = {}
+        inline["steps"][0]["run"] = {"num_frames": "variable:missing"}
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert block["inherited_from"] == "templates/t"
+        assert "cannot be compared" in block["withheld"]
+        assert "cold_minutes" not in block
+
+    def test_the_plan_carries_the_withheld_reason(self, tmp_path):
+        inline = definition("inline")
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        withheld = {"inherited_from": "templates/t", "withheld": "not priced: why"}
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            plan = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: withheld,
+            )
+        estimate = plan["estimate"]
+        assert estimate["basis"] == "unknown" and estimate["minutes"] is None
+        assert estimate["inherited_from"] == "templates/t"
+        assert estimate["withheld"] == "not priced: why"
+        assert "withheld" in _inherited_cost_warnings(estimate)[0]
+
+
+def sized(name, steps=9, width=960, height=544, **extra):
+    """`definition` whose step also sets inference steps and a canvas."""
+    workflow = definition(name, **extra)
+    workflow["variables"].update(
+        {"num_inference_steps": steps, "width": width, "height": height}
+    )
+    workflow["cost_drivers"] += ["num_inference_steps", "width", "height"]
+    workflow["steps"][0]["run"].update(
+        {
+            "num_inference_steps": "variable:num_inference_steps",
+            "width": "variable:width",
+            "height": "variable:height",
+        }
+    )
+    return workflow
+
+
+class TestScaledByStepsAndCanvas:
+    """#866 stage C: the inherited figure scales by the inference-step and
+    canvas ratios too, as the catalog figure does (`scale_curated`)."""
+
+    HISTORY = {"templates/t": [run(8 * MINUTE, {})]}
+    CATALOG = [("templates/t", sized("t"))]
+
+    def test_thirty_steps_scale_by_the_step_ratio(self):
+        block = inherited(sized("inline", steps=30), self.CATALOG, self.HISTORY)
+        assert block["cold_minutes"] == 8.0 * 30 / 9
+        assert "steps 30 vs 9" in block["scaled"]
+
+    def test_a_larger_canvas_scales_by_the_pixel_ratio(self):
+        block = inherited(
+            sized("inline", width=1344, height=768), self.CATALOG, self.HISTORY
+        )
+        assert block["cold_minutes"] == 8.0 * (1344 * 768) / (960 * 544)
+        assert "canvas 1344x768 vs 960x544" in block["scaled"]
+
+    def test_the_callers_arguments_scale_it_and_the_axes_multiply(self):
+        block = inherited(
+            sized("inline"),
+            self.CATALOG,
+            self.HISTORY,
+            {"num_inference_steps": 30, "width": 1344, "height": 768},
+        )
+        assert block["cold_minutes"] == pytest.approx(
+            8.0 * 30 / 9 * (1344 * 768) / (960 * 544)
+        )
+        assert "steps" in block["scaled"] and "canvas" in block["scaled"]
+
+    def test_a_bucket_at_those_values_is_not_scaled_again(self):
+        history = {
+            "templates/t": [
+                run(8 * MINUTE, {}),
+                run(20 * MINUTE, {"num_inference_steps": 30}),
+            ]
+        }
+        block = inherited(sized("inline", steps=30), self.CATALOG, history)
+        assert block["cold_minutes"] == 20.0
+        assert "scaled" not in block
+
+    def test_a_canvas_that_cannot_be_compared_is_withheld(self):
+        inline = sized("inline")
+        inline["steps"][0]["run"]["width"] = "variable:missing"
+        block = inherited(inline, self.CATALOG, self.HISTORY)
+        assert "canvas differs and cannot be compared" in block["withheld"]
+
+    def test_the_plan_quotes_it_inherited_and_scaled(self, tmp_path):
+        inline = sized("inline", steps=30, width=1344, height=768)
+        block = inherited(inline, self.CATALOG, {"templates/t": [run(8 * MINUTE)] * 3})
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            estimate = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: block,
+            )["estimate"]
+        assert estimate["basis"] == "inherited"
+        assert estimate["minutes"] == round(8.0 * 30 / 9 * 1.9765, 1)
+        assert "steps 30 vs 9" in estimate["scaled"]
+        assert "canvas 1344x768 vs 960x544" in estimate["scaled"]
+
+
+class TestAttentionCacheAndLoraDiffer:
+    """#866 stage C: the attention backend, cache and LoRA a step sets are
+    named in `differs`, and a figure measured at others is low confidence."""
+
+    def with_settings(self, name, attention=None, cache=None, lora="acme/turbo"):
+        workflow = definition(name)
+        pipeline = {
+            **PIPELINE,
+            "configuration": {
+                **PIPELINE["configuration"],
+                "components": {"transformer": {"attention_backend": attention}},
+                "cache": cache,
+            },
+            "loras": [{"model_name": lora}] if lora else [],
+        }
+        workflow["steps"][0]["pipeline"] = pipeline
+        return workflow
+
+    def test_each_is_named(self):
+        template = self.with_settings("t")
+        assert inherited_differences(self.with_settings("i"), template) == []
+        assert inherited_differences(
+            self.with_settings("i", attention="native"), template
+        ) == ["attention backend"]
+        assert inherited_differences(
+            self.with_settings("i", cache={"type": "fbc"}), template
+        ) == ["cache"]
+        assert inherited_differences(self.with_settings("i", lora=None), template) == [
+            "LoRA"
+        ]
+
+    def test_the_plan_flags_it_low_confidence(self, tmp_path):
+        inline = self.with_settings("inline", attention="native")
+        block = inherited(
+            inline,
+            [("templates/t", self.with_settings("t"))],
+            {"templates/t": [run(8 * MINUTE, {"num_frames": 124})] * 3},
+        )
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            estimate = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: block,
+            )["estimate"]
+        assert estimate["basis"] == "inherited"
+        assert estimate["minutes"] == 8.0
+        assert estimate["differs"] == ["attention backend"]
+        assert estimate["low_confidence"] is True
+
+
+class TestTheTemplateAndAnInlineCopyAgree:
+    """#866 stage C: the catalog path (`scale_curated`) and the inherited path
+    quote the same request alike - an inline copy of the shipped H3
+    reference-to-video and the template itself, at the same arguments."""
+
+    ARGUMENTS = {"num_inference_steps": 30, "width": 1344, "height": 768}
+
+    def test_the_same_minutes_within_rounding(self, tmp_path):
+        import copy
+        import json
+        from pathlib import Path
+
+        path = (
+            Path(__file__).resolve().parents[1]
+            / "workflows/templates/minimax/reference-to-video.json"
+        )
+        template = json.loads(path.read_text())
+        curated = template["cost"][0]["minutes"]
+        inline = copy.deepcopy(template)
+        del inline["cost"], inline["cost_drivers"]
+
+        def planned(definition, observed):
+            candidate = workflow_from_definition(
+                definition, str(tmp_path), str(tmp_path), str(tmp_path)
+            )
+            with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+                return build_plan(
+                    candidate,
+                    self.ARGUMENTS,
+                    device="cuda",
+                    lookup_sizes=False,
+                    observed=observed,
+                )["estimate"]
+
+        # The template has no run at these arguments: its curated figure,
+        # scaled
+        catalog = planned(template, lambda arguments: None)
+        assert catalog["basis"] == "derived"
+
+        # Its runs at the defaults took the curated minutes; the inline copy
+        # inherits them, scaled from the default bucket
+        block = inherited(
+            inline,
+            [("templates/minimax/reference-to-video", template)],
+            {"templates/minimax/reference-to-video": [run(curated * MINUTE)] * 3},
+            self.ARGUMENTS,
+        )
+        block["device"] = None
+        copied = planned(inline, lambda arguments: block)
+        assert copied["basis"] == "inherited"
+        assert "steps 30 vs 9" in copied["scaled"]
+        assert "canvas 1344x768 vs 960x544" in copied["scaled"]
+        assert abs(copied["minutes"] - catalog["minutes"]) <= 0.1
+
+
+class TestTheShippedTemplatesLoraIsCompared:
+    """#866 stage C (bounce): H3's `loras` entry carries its repo as a
+    `variable:` reference inside the list, so the comparison resolves
+    references at any depth - dropping or swapping the turbo LoRA is named."""
+
+    def template(self):
+        import json
+        from pathlib import Path
+
+        path = (
+            Path(__file__).resolve().parents[1]
+            / "workflows/templates/minimax/reference-to-video.json"
+        )
+        return json.loads(path.read_text())
+
+    def test_the_defaults_differ_in_nothing(self):
+        template = self.template()
+        assert inherited_differences(template, template) == []
+
+    def test_dropping_the_lora_is_named(self):
+        template = self.template()
+        arguments = {"lora_model_name": None, "lora_weight_name": None}
+        assert inherited_differences(template, template, arguments) == ["LoRA"]
+
+    def test_swapping_the_lora_is_named(self):
+        template = self.template()
+        arguments = {"lora_model_name": "lightx2v/Some-Other-Lora"}
+        assert inherited_differences(template, template, arguments) == ["LoRA"]
+
+    def test_a_copy_without_its_null_variables_differs_in_nothing(self):
+        """#866 stage C (C-F485 bounce): an inline copy that leaves out the
+        variables whose default is null (`lora_alpha`) compares as if they
+        resolved to null, the way the template's own declarations do."""
+        template = self.template()
+        copy = dict(template)
+        copy["variables"] = {
+            name: value
+            for name, value in template["variables"].items()
+            if value is not None
+        }
+        assert "lora_alpha" not in copy["variables"]
+        assert inherited_differences(copy, template) == []
+        arguments = {"lora_model_name": "lightx2v/Some-Other-Lora"}
+        assert inherited_differences(copy, template, arguments) == ["LoRA"]
+
+    def test_a_client_round_trip_differs_in_nothing(self, tmp_path):
+        """#866 stage C (second C-F485 bounce): an MCP client's JSON round
+        trip respells the template's `lora_scale` 1.0 as 1. The copy, sent
+        the way the tester's was (seed set, prompt replaced, catalog keys
+        dropped), is quoted from the template's runs with nothing named and
+        no low confidence: a number compares by value, not spelling."""
+        from dw.variables import same_number
+
+        template = self.template()
+        copy = same_number(template)
+        assert copy["variables"]["lora_scale"] == 1
+        assert isinstance(copy["variables"]["lora_scale"], int)
+        for key in ("cost", "cost_drivers", "summary", "vram_estimate"):
+            copy.pop(key, None)
+        copy.pop("variable_constraints", None)
+        copy["variables"]["seed"] = 42
+        copy["variables"]["prompt"] = "a lighthouse at dusk"
+
+        assert inherited_differences(copy, template) == []
+        block = inherited(
+            copy,
+            [("templates/minimax/reference-to-video", template)],
+            {"templates/minimax/reference-to-video": [run(8 * MINUTE)] * 3},
+        )
+        assert block["differs"] == []
+        candidate = workflow_from_definition(
+            copy, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            estimate = build_plan(
+                candidate,
+                {},
+                device="cpu",
+                lookup_sizes=False,
+                observed=lambda arguments: {**block, "device": None},
+            )["estimate"]
+        assert estimate["basis"] == "inherited"
+        assert not estimate.get("differs")
+        assert not estimate.get("low_confidence")
+        # A scale that really differs is still named
+        assert inherited_differences(copy, template, {"lora_scale": 0.5}) == ["LoRA"]
+
+
+def test_the_warning_agrees_in_number():
+    def warned(differs):
+        return _inherited_cost_warnings(
+            {"basis": "inherited", "inherited_from": "templates/t", "differs": differs}
+        )[0]
+
+    assert "its LoRA differs from that template" in warned(["LoRA"])
+    assert "its cache, LoRA differ from that template" in warned(["cache", "LoRA"])
+
+
+def test_the_comparison_substitutes_as_the_run_does():
+    """#866 stage C (arch review): `_found` reads a step through
+    `replace_variables`, so a `variable:` resolving to null drops its key as
+    the run does, rather than comparing a value the run never sees."""
+    from dw.vram_inheritance import _found
+
+    steps = [{"pipeline": {"loras": [{"model_name": "variable:lora"}]}}]
+    assert _found(steps, "loras", {"lora": None}) == {"[{}]"}
+    assert _found(steps, "loras", {"lora": "a/b"}) == {'[{"model_name": "a/b"}]'}
+    # An undeclared name stays as written; the rest of the step still resolves
+    mixed = [{"run": {"width": "variable:missing", "num_frames": "variable:n"}}]
+    assert _found(mixed, "num_frames", {"n": 124}) == {"124"}
+    assert _found(mixed, "width", {"n": 124}) == {'"variable:missing"'}
diff --git a/tests/test_job_history_wal.py b/tests/test_job_history_wal.py
index b6ccab67..e1c5354f 100644
--- a/tests/test_job_history_wal.py
+++ b/tests/test_job_history_wal.py
@@ -12,3 +12,47 @@ def test_the_jobs_database_uses_wal_mode(tmp_path):
         (mode,) = connection.execute("PRAGMA journal_mode").fetchone()
 
     assert mode.lower() == "wal"
+
+
+def test_every_connection_is_closed_when_its_block_ends(tmp_path, monkeypatch):
+    """A connection left to GC checkpoints the WAL whenever it is collected,
+    rewriting jobs.sqlite under whatever is watching it; each one closes at
+    the end of its `with` block instead."""
+    import sqlite3
+
+    import pytest
+
+    import dw.server.job_history as job_history
+
+    opened = []
+    real_connect = sqlite3.connect
+
+    def tracking_connect(*args, **kwargs):
+        connection = real_connect(*args, **kwargs)
+        opened.append(connection)
+        return connection
+
+    monkeypatch.setattr(job_history.sqlite3, "connect", tracking_connect)
+    history = JobHistory(str(tmp_path / "jobs.sqlite"))
+    history.get("missing")
+    history.watermark()
+
+    assert len(opened) == 3
+    for connection in opened:
+        with pytest.raises(sqlite3.ProgrammingError):
+            connection.execute("SELECT 1")
+
+
+def test_a_failed_block_rolls_back_and_still_closes(tmp_path):
+    import sqlite3
+
+    import pytest
+
+    history = JobHistory(str(tmp_path / "jobs.sqlite"))
+    with pytest.raises(RuntimeError):
+        with history._connect() as connection:
+            connection.execute("INSERT INTO jobs (id, status) VALUES ('x', 'failed')")
+            raise RuntimeError("boom")
+    with pytest.raises(sqlite3.ProgrammingError):
+        connection.execute("SELECT 1")
+    assert history.get("x") is None
diff --git a/tests/test_jobs_listing.py b/tests/test_jobs_listing.py
index bd3b7f83..36ff5f5c 100644
--- a/tests/test_jobs_listing.py
+++ b/tests/test_jobs_listing.py
@@ -200,3 +200,39 @@ def test_limit_larger_than_the_match_under_a_status_filter(server):
 
         assert body["total"] == 2
         assert [entry["id"] for entry in body["jobs"]] == ids
+
+
+def test_history_summaries_survive_a_malformed_spec_row(history):
+    stored_job(history, "good", "succeeded", 1)
+    stored_job(history, "bad", "succeeded", 2)
+    with history._connect() as conn:
+        conn.execute("UPDATE jobs SET spec = '{not json' WHERE id = 'bad'")
+
+    rows = history.recent_summaries()
+
+    assert {row["id"] for row in rows} == {"good", "bad"}
+    assert next(row for row in rows if row["id"] == "bad")["_output_dir"] is None
+
+
+def test_list_page_reads_notes_only_for_the_page(tmp_path):
+    from dw.server.jobs import JobManager
+
+    manager = JobManager.__new__(JobManager)
+    import threading
+
+    manager._lock = threading.RLock()
+    manager.jobs = {}
+    manager._pending = []
+    manager.history = JobHistory(str(tmp_path / "jobs.sqlite"))
+    for index in range(6):
+        stored_job(manager.history, f"j{index}", "succeeded", index)
+    seen = []
+    manager._current_note = lambda summary, out, run: (
+        seen.append(summary["id"]) or summary
+    )
+
+    jobs, total = manager.list_page(limit=2)
+
+    assert total == 6
+    assert [j["id"] for j in jobs] == ["j4", "j5"]
+    assert sorted(seen) == ["j4", "j5"]
diff --git a/tests/test_mcp_assets.py b/tests/test_mcp_assets.py
index a68daf82..a909f0db 100644
--- a/tests/test_mcp_assets.py
+++ b/tests/test_mcp_assets.py
@@ -703,3 +703,41 @@ def test_the_inline_limit_refusal_carries_the_same_command(self):
         assert '&workspace=qa-series"' in text
         assert "201 with 'reference', the 'asset:' reference" in text
         assert "no size cap" not in text
+
+
+class TestNotes:
+    def test_upload_and_keep_forward_a_note(self):
+        client, seen = recording()
+        upload_asset(
+            client,
+            content=base64.b64encode(b"x").decode(),
+            asset_name="a.png",
+            note="hero",
+        )
+        assert "note=hero" in seen["url"]
+
+        client, seen = recording()
+        keep_output(client, "wf/run/a.png", note="keeper")
+        assert json.loads(seen["body"])["note"] == "keeper"
+
+    def test_no_note_sends_none(self):
+        client, seen = recording()
+        keep_output(client, "wf/run/a.png")
+        assert json.loads(seen["body"]).get("note") is None
+        client, seen = recording()
+        upload_asset(
+            client, content=base64.b64encode(b"x").decode(), asset_name="a.png"
+        )
+        assert "note=" not in seen["url"]
+
+    def test_asset_listing_clips_notes(self):
+        body = {
+            "assets": [{"name": "a.png", "kind": "image", "note": "x" * 500}],
+            "total": 1,
+        }
+
+        def handler(request):
+            return httpx.Response(200, json=body)
+
+        entry = list_assets(client_over(handler))["assets"][0]
+        assert len(entry["note"]) == 201 and entry["note_truncated"] is True
diff --git a/tests/test_mcp_catalog.py b/tests/test_mcp_catalog.py
index c84fab86..1b70f77f 100644
--- a/tests/test_mcp_catalog.py
+++ b/tests/test_mcp_catalog.py
@@ -322,6 +322,26 @@ def test_gallery_metadata_points_at_get_job_workflow_when_embedded_is_null():
     assert "c68bc29607ec" in result["next"]
 
 
+def test_gallery_metadata_null_hint_does_not_claim_a_png_carries_it():
+    """#903: a task step's PNG has null metadata; the hint must not say
+    images carry it."""
+    body = {
+        "name": "ws/20261014-104901-39d691b0/ws-frame.0-0.0.png",
+        "source": "output",
+        "metadata": None,
+        "job": {"id": "6cee0715fc6f", "status": "succeeded"},
+    }
+    client, _ = scripted(
+        {("GET", "/api/gallery/" + body["name"] + "/metadata"): (200, body)}
+    )
+
+    result = catalog.get_gallery_metadata(client, body["name"])
+
+    assert "only an image" not in result["next"]
+    assert "task step" in result["next"]
+    assert "6cee0715fc6f" in result["next"]
+
+
 def test_gallery_metadata_says_a_kept_asset_has_no_recorded_job():
     """#556: a kept asset with no recorded job (kept before provenance
     tracking, or from a file with no job history) still answers 'job: null',
@@ -412,3 +432,55 @@ def test_full_get_workflow_without_history_has_no_observed_key():
     )
 
     assert "observed" not in catalog.get_workflow(client, "w")
+
+
+def test_list_gallery_forwards_role_as_a_repeated_parameter():
+    seen = {}
+
+    def handler(request):
+        seen["roles"] = request.url.params.get_list("role")
+        return httpx.Response(200, json={"files": []})
+
+    client = DwClient(transport=httpx.MockTransport(handler))
+    catalog.list_gallery(client)
+    assert seen["roles"] == []
+
+    catalog.list_gallery(client, role=["final"])
+    assert seen["roles"] == ["final"]
+
+    catalog.list_gallery(client, role=["final", "intermediate"])
+    assert seen["roles"] == ["final", "intermediate"]
+
+
+def test_gallery_metadata_does_not_promise_a_forgotten_job():
+    """#918: a kept asset's job pruned from history reports 'forgotten', and
+    the hint must not point at get_job_workflow, which would say Unknown job."""
+    body = {
+        "name": "asset:qa-cast/ep182-episode.mp4",
+        "source": "asset",
+        "metadata": None,
+        "job": {"id": "ad1adcb65d6d", "status": "forgotten"},
+    }
+    client, _ = scripted(
+        {("GET", "/api/gallery/asset:qa-cast/ep182-episode.mp4/metadata"): (200, body)}
+    )
+
+    result = catalog.get_gallery_metadata(client, "asset:qa-cast/ep182-episode.mp4")
+
+    assert "no longer in the server" in result["next"]
+    assert 'get_job_workflow(job_id="ad1adcb65d6d")' not in result["next"]
+
+
+def test_gallery_metadata_asks_the_server_to_leave_out_the_workflow():
+    seen = []
+
+    def handler(request):
+        seen.append(dict(request.url.params))
+        return httpx.Response(200, json={"name": "a.png", "metadata": None})
+
+    client = DwClient(transport=httpx.MockTransport(handler))
+
+    catalog.get_gallery_metadata(client, "a.png", include_workflow=False)
+    catalog.get_gallery_metadata(client, "a.png")
+
+    assert seen == [{"include_workflow": "false"}, {}]
diff --git a/tests/test_mcp_client.py b/tests/test_mcp_client.py
index 10a1bcd8..a8264e32 100644
--- a/tests/test_mcp_client.py
+++ b/tests/test_mcp_client.py
@@ -263,6 +263,18 @@ def test_api_path_quotes_dot_segments_so_they_cannot_traverse():
     assert api_path("api", "workflows", "../escape") == "/api/workflows/..%2Fescape"
 
 
+@pytest.mark.parametrize("name,encoded", [(".", "%2E"), ("..", "%2E%2E")])
+def test_api_path_encodes_a_segment_that_is_only_dots(name, encoded):
+    # quote() leaves '.' alone, and httpx drops a bare '.' or '..' segment
+    assert api_path("api", "workspaces", name, "copy") == (
+        f"/api/workspaces/{encoded}/copy"
+    )
+
+
+def test_api_path_keeps_dots_inside_a_name():
+    assert api_path("api", "workflows", "v1.2") == "/api/workflows/v1.2"
+
+
 # Every dw_mcp handler module that talks to the API must build request paths
 # through `api_path`, not by hand - `path_segment` alone is easy to forget on
 # one call site among many, and a bare f-string skips quoting entirely. This
diff --git a/tests/test_mcp_diagnose.py b/tests/test_mcp_diagnose.py
index f65b66f8..ad8721b3 100644
--- a/tests/test_mcp_diagnose.py
+++ b/tests/test_mcp_diagnose.py
@@ -1,12 +1,13 @@
 """Running and diagnosing jobs. The gate on run_workflow is the point: a
 run costs GPU time on an engine that runs one job at a time."""
 
+import json
 import time
 
 import httpx
 import pytest
 
-from dw_mcp import diagnose
+from dw_mcp import catalog, diagnose
 from dw_mcp.client import DwApiError, DwClient
 
 WORKFLOW = {"id": "w", "steps": []}
@@ -806,3 +807,81 @@ def test_a_bad_wait_cap_keeps_the_default(raw, caplog):
 def test_a_wait_cap_is_read_from_the_environment():
     assert diagnose._max_wait_seconds(None) == diagnose.DEFAULT_MAX_WAIT_SECONDS
     assert diagnose._max_wait_seconds("120") == 120.0
+
+
+def test_run_forwards_a_note_only_when_given():
+    client, seen = submitting()
+    diagnose.run_workflow(
+        client, workflow_path="w.json", acknowledged_cost=True, note="seed sweep 1/4"
+    )
+    assert json.loads(seen[0]["body"])["note"] == "seed sweep 1/4"
+
+    client, seen = submitting()
+    diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=True)
+    assert "note" not in json.loads(seen[0]["body"])
+
+
+def test_set_note_puts_target_and_note():
+    from dw_mcp import assets
+
+    client, seen = scripted(
+        {
+            ("PUT", "/api/notes"): (
+                200,
+                {"target": "wf/run", "note": "shift 5", "note_source": "run"},
+            )
+        }
+    )
+    result = assets.set_note(client, "wf/run", "shift 5")
+    assert seen[0]["key"] == ("PUT", "/api/notes")
+    assert json.loads(seen[0]["body"]) == {"target": "wf/run", "note": "shift 5"}
+    assert result["note_source"] == "run"
+
+
+def test_set_note_none_clears():
+    from dw_mcp import assets
+
+    client, seen = scripted({("PUT", "/api/notes"): (200, {})})
+    assets.set_note(client, "asset:a.png", None)
+    assert json.loads(seen[0]["body"]) == {"target": "asset:a.png", "note": None}
+
+
+def test_set_note_workspace_pins_the_call():
+    from dw_mcp import assets
+
+    client, seen = scripted({("PUT", "/api/notes"): (200, {})})
+    assets.set_note(client, "wf/run", "n", workspace="music-video")
+    assert seen[0]["params"]["workspace"] == "music-video"
+    assets.set_note(client, "wf/run", "n")
+    assert "workspace" not in seen[1]["params"]
+
+
+def test_list_jobs_clips_long_notes():
+    body = {"jobs": [{"id": "j", "note": "x" * 500}, {"id": "k", "note": "hi"}]}
+    client, _ = scripted({("GET", "/api/jobs"): (200, body)})
+    jobs = {j["id"]: j for j in catalog.list_jobs(client)["jobs"]}
+    assert len(jobs["j"]["note"]) == 201 and jobs["j"]["note_truncated"] is True
+    assert jobs["k"]["note"] == "hi" and "note_truncated" not in jobs["k"]
+
+
+def test_clip_note_leaves_other_entries_alone():
+    from dw_mcp.client import clip_note
+
+    assert clip_note({"name": "a"}) == {"name": "a"}
+    assert clip_note({"note": None}) == {"note": None}
+
+
+def test_gallery_clips_long_notes_but_metadata_does_not():
+    gallery = {"files": [{"name": "a.png", "note": "x" * 500, "role": "final"}]}
+    client, _ = scripted({("GET", "/api/gallery"): (200, gallery)})
+    entry = catalog.list_gallery(client)["files"][0]
+    assert len(entry["note"]) <= 201 and entry["note_truncated"] is True
+
+    gallery = {"files": [{"name": "a.png", "note": "short"}]}
+    client, _ = scripted({("GET", "/api/gallery"): (200, gallery)})
+    entry = catalog.list_gallery(client)["files"][0]
+    assert entry["note"] == "short" and "note_truncated" not in entry
+
+    meta = {"note": "y" * 500}
+    client, _ = scripted({("GET", "/api/gallery/a.png/metadata"): (200, meta)})
+    assert len(catalog.get_gallery_metadata(client, "a.png")["note"]) == 500
diff --git a/tests/test_mcp_server.py b/tests/test_mcp_server.py
index 9f16d234..a609dd8e 100644
--- a/tests/test_mcp_server.py
+++ b/tests/test_mcp_server.py
@@ -68,14 +68,17 @@
     "enhance_prompt",
     "get_output_text",
     "assess_output",
+    "compare_outputs",
     "download_output",
     "delete_output",
     "list_assets",
     "upload_asset",
     "keep_output",
+    "set_note",
     "delete_asset",
     "list_workspaces",
     "use_workspace",
+    "copy_to_workspace",
     "create_workspace",
     "delete_workspace",
 }
@@ -101,8 +104,10 @@
     "delete_output",
     "upload_asset",
     "keep_output",
+    "set_note",
     "delete_asset",
     "use_workspace",
+    "copy_to_workspace",
     "create_workspace",
     "delete_workspace",
 }
@@ -540,6 +545,37 @@ def _a_file_to_upload():
     return path
 
 
+# What POST /api/gallery/compare answers for two outputs, one measured
+COMPARE_BODY = {
+    "image": {
+        "data": base64.b64encode(PNG_1X1).decode("ascii"),
+        "mime_type": "image/png",
+        "width": 1,
+        "height": 1,
+    },
+    "downscaled_to": None,
+    "baseline": "a.mp4",
+    "region": "full frame",
+    "fps_differs": False,
+    "columns": [{"moment": "frame:0", "frame": 0}],
+    "rows": [],
+    "metrics": [
+        {
+            "name": "b.mp4",
+            "row": 1,
+            "reason": None,
+            "cells": [
+                {"psnr_db": 31.2, "ssim": 0.91, "mean_abs_diff": 2.5, "reason": None}
+            ],
+            "psnr_db": {"mean": 31.2, "min": 31.2, "max": 31.2},
+            "ssim": {"mean": 0.91, "min": 0.91, "max": 0.91},
+            "mean_abs_diff": {"mean": 2.5, "min": 2.5, "max": 2.5},
+        }
+    ],
+    "notes": [],
+}
+
+
 TOOL_WIRING = [
     ("list_guides", {}, "GET", "/api/guides"),
     (
@@ -683,6 +719,12 @@ def _a_file_to_upload():
     ),
     ("get_output_text", {"name": "enhanced.txt"}, "GET", "/outputs/enhanced.txt"),
     ("assess_output", {"name": "cut.mp4"}, "GET", "/api/gallery/cut.mp4/assess"),
+    (
+        "compare_outputs",
+        {"names": ["a.mp4", "b.mp4"]},
+        "POST",
+        "/api/gallery/compare",
+    ),
     (
         "download_output",
         {
@@ -700,10 +742,17 @@ def _a_file_to_upload():
         "POST",
         "/api/assets/keep",
     ),
+    ("set_note", {"target": "wf/run", "note": "keeper"}, "PUT", "/api/notes"),
     ("delete_asset", {"name": "hero.png"}, "DELETE", "/api/assets/hero.png"),
     ("list_workspaces", {}, "GET", "/api/workspaces"),
     ("use_workspace", {"name": "default"}, "GET", "/api/workspaces"),
     ("create_workspace", {"name": "shots"}, "POST", "/api/workspaces"),
+    (
+        "copy_to_workspace",
+        {"destination": "shots", "runs": ["wf/20261013-120000-0123abcd"]},
+        "POST",
+        "/api/workspaces/shots/copy",
+    ),
     (
         "delete_workspace",
         {"name": "shots", "acknowledged_cost": True},
@@ -760,6 +809,8 @@ def handler(request):
                     ],
                 },
             )
+        if request.url.path.endswith("/compare"):
+            return httpx.Response(200, json=COMPARE_BODY)
         if request.url.path.startswith("/outputs/"):
             return httpx.Response(
                 200, content=PNG_1X1, headers={"content-type": "image/png"}
@@ -778,6 +829,64 @@ def handler(request):
     assert result.content
 
 
+def test_compare_summary_names_the_region_and_the_row_means():
+    """The reply beside the grid carries the region measured and each
+    output's mean PSNR and SSIM."""
+    text = media.compare_summary(COMPARE_BODY)
+
+    assert "region: full frame" in text
+    assert "- row 2 b.mp4:" in text
+    assert "psnr_db mean 31.2" in text and "ssim mean 0.91" in text
+
+
+def test_compare_summary_says_why_an_output_has_no_metrics():
+    """An output the baseline could not be measured against says why."""
+    body = {
+        **COMPARE_BODY,
+        "metrics": [
+            {
+                "name": "b.mp4",
+                "row": 1,
+                "reason": "size differs from baseline: 32x16 vs 64x32",
+                "cells": [],
+                "psnr_db": None,
+                "ssim": None,
+                "mean_abs_diff": None,
+            }
+        ],
+    }
+
+    assert (
+        "- row 2 b.mp4: no metrics - size differs from baseline: 32x16 vs 64x32"
+        in media.compare_summary(body)
+    )
+
+
+def test_compare_outputs_posts_the_budget_and_omits_what_is_unset():
+    """The handler holds the grid to MAX_RETURNED_BYTES and sends only the
+    optional fields the caller set."""
+    sent = []
+
+    def handler(request):
+        sent.append(json.loads(request.content))
+        return httpx.Response(200, json=COMPARE_BODY)
+
+    client = DwClient(transport=httpx.MockTransport(handler))
+
+    media.compare_outputs(client, ["a.mp4", "b.mp4"])
+    media.compare_outputs(
+        client, ["a.mp4", "b.mp4"], at=[0, "frame:3"], baseline="b.mp4"
+    )
+
+    assert sent[0] == {
+        "names": ["a.mp4", "b.mp4"],
+        "max_dimension": 384,
+        "max_total_bytes": media.MAX_RETURNED_BYTES,
+    }
+    assert sent[1]["at"] == [0, "frame:3"] and sent[1]["baseline"] == "b.mp4"
+    assert "crop" not in sent[1]
+
+
 class RecordingServer:
     def __init__(self):
         self.transport = None
@@ -1200,6 +1309,7 @@ def refusing(request):
     "rerun_job": (diagnose, "rerun_job"),
     "get_output_text": (media, "get_output_text"),
     "assess_output": (media, "assess_output"),
+    "compare_outputs": (media, "compare_outputs"),
     "enhance_prompt": (prompts, "enhance_prompt"),
     "download_output": (media, "download_output"),
     "get_gallery_metadata": (catalog, "get_gallery_metadata"),
@@ -1569,7 +1679,31 @@ def test_the_stated_tool_count_is_the_registered_one():
 # tokens) - measured 14_246.25 before and 14_262.25 after (9_281.75 /
 # 4_470.25 / 510.25). Text trimmed since 10-07 left room, so the ceiling
 # stays, 2.75 of headroom.
-SURFACE_BUDGET = 14_265
+# 2026-10-13 (#859, #853 stage A): copy_to_workspace (121.25 description +
+# 84.75 schema) - measured at 14_470.25 (9_276.25 / 4_683.75 / 510.25); the
+# ceiling moves to 14_471 with 0.75 of headroom.
+# 2026-10-13 (#859 bounce): set_note, documented since the notes feature but
+# never registered, is registered (66.75 description + 83.25 schema) -
+# measured at 14_620.25 (9_343 / 4_767 / 510.25); the ceiling moves to
+# 14_621 with 0.75 of headroom.
+# 2026-10-13 (#860, #853 stage B): copy_to_workspace takes assets (its
+# description names them; the schema gains the parameter, runs optional) -
+# measured at 14_699.5 (9_381 / 4_808 / 510.5); the ceiling moves to 14_700
+# with 0.5 of headroom.
+# 2026-10-13 (#885, #867 stage 1): get_job's description names a manifest
+# entry's `timing` and the guide section for it (+28.5 description) - measured
+# at 14_728 (9_409.5 / 4_808.25 / 510.25); the ceiling moves to 14_728 with
+# none to spare.
+# 2026-10-14 (#889, #871 stage A): compare_outputs (60.75 description +
+# 200.75 schema - `crop` is one box or one per name) - measured at 14_989.25
+# (9_470 / 5_009 / 510.25); the ceiling moves to 14_990 with 0.75 of headroom.
+# 2026-10-14 (#886, #867 stage 2): get_job_events' description names the
+# `cache_stats` kind (+15 description) - measured at 15_004.25 (9_485 /
+# 5_009 / 510.25); the ceiling moves to 15_005 with 0.75 of headroom.
+# 2026-10-15 (#922): get_gallery_metadata gains `include_workflow` and says an
+# image's `media` is its measured size (+46) - measured at 15_051.25; the
+# ceiling moves to 15_052 with 0.75 of headroom.
+SURFACE_BUDGET = 15_052
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_mcp_workspaces.py b/tests/test_mcp_workspaces.py
index ceb3635b..4d8892b8 100644
--- a/tests/test_mcp_workspaces.py
+++ b/tests/test_mcp_workspaces.py
@@ -487,3 +487,14 @@ def test_create_without_use_never_warns(self):
         client.workspace = "shots"
         result = create_workspace(client, "qa")
         assert "warning" not in result
+
+
+def test_workspace_listing_clips_notes():
+    body = {
+        "workspaces": [{"name": "w", "default": True, "usage": {}, "note": "x" * 500}]
+    }
+    client = DwClient(
+        transport=httpx.MockTransport(lambda request: httpx.Response(200, json=body))
+    )
+    entry = list_workspaces(client)["workspaces"][0]
+    assert len(entry["note"]) == 201 and entry["note_truncated"] is True
diff --git a/tests/test_media_compare.py b/tests/test_media_compare.py
new file mode 100644
index 00000000..6bfedc49
--- /dev/null
+++ b/tests/test_media_compare.py
@@ -0,0 +1,187 @@
+"""The comparison engine behind compare_outputs (#871): the metrics on
+synthetic pixels, and the checks that refuse a request by its shape."""
+
+import math
+
+import numpy
+import pytest
+
+from dw.media_compare import (
+    check_request,
+    crop_box,
+    mean_abs_diff,
+    psnr,
+    resolve_moments,
+    short_name,
+    ssim,
+)
+
+
+def noise(seed=0, shape=(48, 48, 3)):
+    return numpy.random.default_rng(seed).integers(0, 256, shape, dtype=numpy.uint8)
+
+
+def test_identical_arrays_are_identical_on_every_metric():
+    """No difference is an infinite PSNR, a perfect SSIM and a zero error."""
+    a = noise()
+
+    assert psnr(a, a.copy()) == math.inf
+    assert ssim(a, a.copy()) == pytest.approx(1.0, abs=1e-9)
+    assert mean_abs_diff(a, a.copy()) == 0
+
+
+def test_a_constant_offset_gives_the_psnr_its_mse_implies():
+    """An offset of 5 is an MSE of 25, so 10*log10(255^2/25) dB."""
+    a = numpy.full((16, 16, 3), 100, numpy.uint8)
+    b = a + 5
+
+    assert psnr(a, b) == pytest.approx(10 * math.log10(255**2 / 25))
+    assert psnr(a, b) == pytest.approx(34.15, abs=0.01)
+    assert mean_abs_diff(a, b) == pytest.approx(5.0)
+
+
+def test_psnr_does_not_wrap_at_the_uint8_edge():
+    """255 against 0 is the largest error, not a wrapped small one."""
+    a = numpy.zeros((4, 4, 3), numpy.uint8)
+    b = numpy.full((4, 4, 3), 255, numpy.uint8)
+
+    assert psnr(a, b) == pytest.approx(0.0)
+    assert mean_abs_diff(a, b) == 255
+
+
+def test_a_shift_lowers_ssim_far_more_than_a_brightness_change():
+    """SSIM reads structure: a rolled texture is a different picture, a
+    slight brightening of it is the same one."""
+    a = noise(1)
+    shifted = numpy.roll(a, 3, axis=1)
+    brighter = numpy.clip(a.astype(int) + 4, 0, 255).astype(numpy.uint8)
+
+    assert ssim(a, shifted) < 0.5
+    assert ssim(a, brighter) > 0.95
+
+
+def test_a_shifted_checkerboard_scores_low():
+    """A checkerboard moved by one square inverts, so it shares no structure."""
+    board = (numpy.indices((32, 32)).sum(axis=0) // 4 % 2 * 255).astype(numpy.uint8)
+    a = numpy.stack([board] * 3, axis=-1)
+
+    assert ssim(a, numpy.roll(a, 4, axis=1)) < 0.2
+
+
+NAMES = ["a.mp4", "b.mp4"]
+
+
+@pytest.mark.parametrize("names", [["a.mp4"], [f"{i}.mp4" for i in range(9)]])
+def test_check_request_refuses_a_name_count_outside_2_to_8(names):
+    """Compare takes two to eight outputs."""
+    with pytest.raises(ValueError, match="compare takes 2 to 8"):
+        check_request(names, None, None, None)
+
+
+@pytest.mark.parametrize("at", [[], list(range(9))])
+def test_check_request_refuses_a_moment_count_outside_1_to_8(at):
+    """Compare takes one to eight moments."""
+    with pytest.raises(ValueError, match="compare takes 1 to 8"):
+        check_request(NAMES, at, None, None)
+
+
+def test_check_request_refuses_a_baseline_that_is_not_a_name():
+    """The baseline is one of the outputs compared."""
+    with pytest.raises(ValueError, match="not one of `names`"):
+        check_request(NAMES, None, None, "c.mp4")
+
+
+def test_check_request_refuses_a_crop_list_of_the_wrong_length():
+    """One box per output, or one box for all."""
+    with pytest.raises(ValueError, match="3 boxes for 2 names"):
+        check_request(NAMES, None, [[0, 0, 4, 4]] * 3, None)
+
+
+def test_check_request_reports_the_baseline_row_and_crop_mode():
+    """The baseline defaults to the first row; the crop form picks a mode."""
+    assert check_request(NAMES, None, None, None) == (0, None)
+    assert check_request(NAMES, [0, 1], [0, 0, 4, 4], "b.mp4") == (1, "shared")
+    assert check_request(NAMES, None, [[0, 0, 4, 4], [1, 1, 2, 2]], None) == (
+        0,
+        "each",
+    )
+
+
+def test_crop_box_returns_a_pillow_box():
+    """[x, y, w, h] becomes (left, upper, right, lower)."""
+    assert crop_box([2, 3, 10, 5], 32, 16, "a.mp4") == (2, 3, 12, 8)
+
+
+def test_crop_box_refuses_a_box_outside_the_frame_naming_the_output():
+    """A clamped box would measure a different region per output."""
+    with pytest.raises(ValueError, match="out of bounds for a.mp4"):
+        crop_box([30, 0, 10, 4], 32, 16, "a.mp4")
+
+
+@pytest.mark.parametrize("box", [[-1, 0, 4, 4], [0, -1, 4, 4], [0, 0, 0, 4]])
+def test_crop_box_refuses_a_negative_origin_or_empty_size(box):
+    """The origin is non-negative and the size positive."""
+    with pytest.raises(ValueError, match="non-negative origin"):
+        crop_box(box, 32, 16, "a.mp4")
+
+
+REFERENCE = {"fps": 6.0, "frame_count": 24}
+
+
+def test_resolve_moments_defaults_to_four_evenly_spaced_frames():
+    """Without `at`, four frames spread over the shortest video."""
+    assert resolve_moments(None, REFERENCE, 24) == [
+        ("frame:0", 0),
+        ("frame:8", 8),
+        ("frame:15", 15),
+        ("frame:23", 23),
+    ]
+
+
+@pytest.mark.parametrize("moment", ["frame:-1", -1.0, "-0.01"])
+def test_resolve_moments_refuses_a_negative_moment(moment):
+    """A negative moment is refused, never wrapped to the clip's end."""
+    with pytest.raises(ValueError, match="is negative"):
+        resolve_moments([moment], REFERENCE, 24)
+
+
+def test_resolve_moments_converts_seconds_at_the_reference_fps():
+    """1.5 s at 6 fps is frame 9."""
+    assert resolve_moments([1.5, "0"], REFERENCE, 24) == [(1.5, 9), ("0", 0)]
+
+
+def test_get_output_frames_still_counts_a_negative_frame_from_the_end():
+    """frames keeps Python-style negatives; only compare refuses them."""
+    from dw.media_frames import moment_index
+
+    assert moment_index("frame:-1", REFERENCE) == 23
+
+
+def test_short_name_keeps_an_asset_reference_and_trims_an_output_path():
+    """An asset reads as given; an output as its run id and file."""
+    assert short_name("asset:uploads/a.png") == "asset:uploads/a.png"
+    assert short_name("wf/run1/out.png") == "run1/out.png"
+
+
+@pytest.mark.parametrize("moment", ["50%", "frame:x", "nan"])
+def test_resolve_moments_refuses_what_get_output_frames_refuses(moment):
+    # One `at` grammar (media_frames.moment_index): compare and frames
+    # refuse the same malformed moment with the same words.
+    from dw.media_frames import frames_at
+
+    with pytest.raises(ValueError) as frames_error:
+        frames_at("unused.mp4", [moment], shape=REFERENCE)
+    with pytest.raises(ValueError) as compare_error:
+        resolve_moments([moment], REFERENCE, 24)
+    assert str(compare_error.value) == str(frames_error.value)
+
+
+def test_crop_box_refuses_a_malformed_box_as_resolve_crop_box_does():
+    # One crop parse (media_frames.parse_crop); only the bounds policy differs.
+    from dw.media_frames import resolve_crop_box
+
+    with pytest.raises(ValueError) as frames_error:
+        resolve_crop_box([1, 2, 3], 32, 16)
+    with pytest.raises(ValueError) as compare_error:
+        crop_box([1, 2, 3], 32, 16, "a.mp4")
+    assert str(compare_error.value) == str(frames_error.value)
diff --git a/tests/test_notes.py b/tests/test_notes.py
new file mode 100644
index 00000000..db8608eb
--- /dev/null
+++ b/tests/test_notes.py
@@ -0,0 +1,79 @@
+import json
+import os
+import threading
+
+import pytest
+
+from dw import notes as N
+
+
+def test_clean_note_rules():
+    assert N.clean_note(None) is None
+    assert N.clean_note("   \n") is None
+    assert N.clean_note("shift 5") == "shift 5"
+    assert N.clean_note("x" * N.MAX_NOTE_LENGTH) == "x" * N.MAX_NOTE_LENGTH
+    with pytest.raises(N.NoteTooLong):
+        N.clean_note("x" * (N.MAX_NOTE_LENGTH + 1))
+    with pytest.raises(TypeError):
+        N.clean_note(5)
+
+
+def test_run_and_file_notes_and_effective(tmp_path):
+    d = str(tmp_path)
+    assert N.read_notes(d) == {"run": None, "files": {}}
+    N.set_run_note(d, "testing shift 3 vs 5")
+    N.set_file_note(d, "final/b.png", "the keeper")
+    notes = N.read_notes(d)
+    assert N.effective_note(notes, "final/b.png") == ("the keeper", "file")
+    assert N.effective_note(notes, "a.png") == ("testing shift 3 vs 5", "run")
+    assert N.effective_note({"run": None, "files": {}}, "a.png") == (None, None)
+
+
+def test_clearing_everything_removes_the_file(tmp_path):
+    d = str(tmp_path)
+    N.set_run_note(d, "x")
+    N.set_file_note(d, "a.png", "y")
+    assert os.path.exists(os.path.join(d, N.NOTES_FILE_NAME))
+    N.set_run_note(d, "")
+    N.drop_file_note(d, "a.png")
+    assert not os.path.exists(os.path.join(d, N.NOTES_FILE_NAME))
+
+
+def test_corrupt_file_reads_empty(tmp_path):
+    (tmp_path / N.NOTES_FILE_NAME).write_text("{not json")
+    assert N.read_notes(str(tmp_path)) == {"run": None, "files": {}}
+
+
+def test_concurrent_file_notes_all_land(tmp_path):
+    d = str(tmp_path)
+    threads = [
+        threading.Thread(target=N.set_file_note, args=(d, f"{i}.png", str(i)))
+        for i in range(20)
+    ]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    assert len(N.read_notes(d)["files"]) == 20
+
+
+def test_workspace_note(tmp_path):
+    root = str(tmp_path)
+    assert N.read_workspace_note(root) is None
+    N.set_workspace_note(root, "the anthem project")
+    assert N.read_workspace_note(root) == "the anthem project"
+    with open(tmp_path / N.WORKSPACE_FILE_NAME) as handle:
+        assert json.load(handle) == {"notes": "the anthem project"}
+    N.set_workspace_note(root, None)
+    assert not os.path.exists(tmp_path / N.WORKSPACE_FILE_NAME)
+
+
+def test_workspace_with_note_is_deletable(tmp_path):
+    from dw.workspace import Workspace, create_workspace, delete_workspace
+
+    root = Workspace(tmp_path / "studio", "flag").ensure()
+    created = create_workspace(root, "shots")
+    N.set_workspace_note(created.root, "x")
+    assert os.path.exists(os.path.join(created.root, N.WORKSPACE_FILE_NAME))
+    delete_workspace(root, "shots")
+    assert not os.path.exists(created.root)
diff --git a/tests/test_notes_api.py b/tests/test_notes_api.py
new file mode 100644
index 00000000..703903fe
--- /dev/null
+++ b/tests/test_notes_api.py
@@ -0,0 +1,617 @@
+"""The notes API: PUT /api/notes over its four target forms, `note` on job
+submission, upload and keep, and the note fields every listing and detail
+route carries (dw/notes.py holds the stores)."""
+
+import json
+import os
+
+import pytest
+from fastapi.testclient import TestClient
+
+from dw import notes as N
+from dw.runs import new_run_id
+from dw.server.app import create_app
+from dw.server.jobs import JobManager
+from dw.workspace import Workspace
+
+from .test_server import ScriptedWorkerManager, valid_workflow, wait_for_status
+
+RUN_ID = "20261012-120000-aabbccdd"
+PNG = b"\x89PNG\r\n\x1a\n" + b"0" * 64
+
+
+@pytest.fixture
+def studio(tmp_path):
+    """A workspace root: its default workspace has an asset library."""
+    return Workspace(tmp_path / "studio", "flag").ensure()
+
+
+@pytest.fixture
+def output_root(studio):
+    return studio.outputs
+
+
+def run_script(output_dir):
+    """A worker that opens a fresh run directory under `output_dir` and
+    reports it with run_start, the way Workflow.run does."""
+
+    def script(command):
+        run_id = new_run_id({"command": len(os.listdir(output_dir))})
+        relative = f"server_test/{run_id}"
+        run_dir = os.path.join(output_dir, "server_test", run_id)
+        os.makedirs(run_dir, exist_ok=True)
+        with open(os.path.join(run_dir, "a.png"), "wb") as handle:
+            handle.write(PNG)
+        yield {
+            "type": "progress",
+            "event": "run_start",
+            "run_id": run_id,
+            "identity": "server_test",
+            "run_dir": relative,
+            "version": 1,
+        }
+        yield {"type": "success", "message": "ok", "run_count": 1, "manifest": []}
+
+    return script
+
+
+@pytest.fixture
+def client(studio, tmp_path):
+    manager = JobManager(
+        studio.outputs,
+        worker_manager=ScriptedWorkerManager(run_script(studio.outputs)),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=studio.workflows,
+    )
+    app = create_app(
+        workflow_dir=studio.workflows,
+        output_dir=studio.outputs,
+        job_manager=manager,
+        prompt_dir=studio.prompts,
+        asset_dir=studio.assets,
+        workspace=studio.root,
+    )
+    with TestClient(app, base_url="http://localhost") as test_client:
+        yield test_client
+
+
+@pytest.fixture
+def make_run(write_run, output_root):
+    """A run of workflow `identity` holding `files`, each listed by a
+    manifest step. Returns the run directory."""
+
+    def build(identity, files, run_id=RUN_ID):
+        steps = [{"step": "gen", "files": list(files)}]
+        return write_run(output_root, identity, run_id, steps, files=files)
+
+    return build
+
+
+def run_name(run_dir, output_root):
+    return os.path.relpath(run_dir, output_root).replace(os.sep, "/")
+
+
+def asset_entry(client, name):
+    assets = {a["name"]: a for a in client.get("/api/assets").json()["assets"]}
+    return assets[name]
+
+
+def snapshot(root):
+    """Every file under root with its bytes - what a refused write must not
+    change. The job history's SQLite file and its -wal/-shm sidecars are left
+    out: the client fixture keeps them beside the studio, and a WAL
+    checkpoint rewrites their bytes on the connection's schedule, not the
+    request's."""
+    found = {}
+    for current, _dirs, names in os.walk(root):
+        for name in names:
+            if name.startswith("jobs.sqlite"):
+                continue
+            path = os.path.join(current, name)
+            with open(path, "rb") as handle:
+                found[path] = handle.read()
+    return found
+
+
+# ------------------------------------------------------------- PUT /api/notes
+
+
+def test_put_file_and_run_note_and_read_back(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png", "final/b.png"])
+    run = run_name(run_dir, output_root)
+    r = client.put("/api/notes", json={"target": run, "note": "shift 3 vs 5"})
+    assert r.status_code == 200
+    assert r.json() == {"target": run, "note": "shift 3 vs 5", "note_source": "run"}
+    r = client.put(
+        "/api/notes", json={"target": f"{run}/final/b.png", "note": "keeper"}
+    )
+    assert r.status_code == 200
+    assert r.json() == {
+        "target": f"{run}/final/b.png",
+        "note": "keeper",
+        "note_source": "file",
+    }
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["note"] == "shift 3 vs 5"
+    assert files["b.png"]["note"] == "keeper"
+    meta = client.get(f"/api/gallery/{run}/final/b.png/metadata").json()
+    assert (meta["note"], meta["run_note"], meta["note_source"]) == (
+        "keeper",
+        "shift 3 vs 5",
+        "file",
+    )
+    meta = client.get(f"/api/gallery/{run}/a.png/metadata").json()
+    assert (meta["note"], meta["run_note"], meta["note_source"]) == (
+        "shift 3 vs 5",
+        "shift 3 vs 5",
+        "run",
+    )
+    assert N.read_notes(run_dir) == {
+        "run": "shift 3 vs 5",
+        "files": {"final/b.png": "keeper"},
+    }
+
+
+def test_a_file_without_its_own_note_answers_with_the_run_note(
+    client, output_root, make_run
+):
+    run_dir = make_run("wf", ["a.png"])
+    run = run_name(run_dir, output_root)
+    client.put("/api/notes", json={"target": run, "note": "the run"})
+    r = client.put("/api/notes", json={"target": f"{run}/a.png", "note": None})
+    assert r.json() == {
+        "target": f"{run}/a.png",
+        "note": "the run",
+        "note_source": "run",
+    }
+
+
+def test_an_output_reference_names_the_same_file(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    r = client.put("/api/notes", json={"target": f"output:{run}/a.png", "note": "o"})
+    assert r.status_code == 200
+    assert r.json()["note_source"] == "file"
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["note"] == "o"
+
+
+def test_a_listing_without_notes_carries_no_note_key(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    (entry,) = client.get("/api/gallery").json()["files"]
+    assert "note" not in entry
+    meta = client.get(f"/api/gallery/{run}/a.png/metadata").json()
+    assert not {"note", "run_note", "note_source"} & set(meta)
+
+
+def test_clear_note(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png"])
+    run = run_name(run_dir, output_root)
+    client.put("/api/notes", json={"target": run, "note": "x"})
+    assert os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+    r = client.put("/api/notes", json={"target": run, "note": ""})
+    assert r.status_code == 200
+    assert r.json() == {"target": run, "note": None, "note_source": None}
+    assert not os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+    client.put("/api/notes", json={"target": run, "note": "y"})
+    r = client.put("/api/notes", json={"target": run, "note": None})
+    assert r.json()["note"] is None
+    assert not os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+
+
+@pytest.mark.parametrize(
+    "target",
+    [
+        # a gallery file name
+        "../etc/passwd",
+        "wf/../../x",
+        "/abs/path.png",
+        f"wf/{RUN_ID}/../../../outside.png",
+        "wf/20261012-000000-zzzz/missing.png",
+        f"wf/{RUN_ID}/missing.png",
+        # a run directory
+        f"../{RUN_ID}",
+        f"wf/../../{RUN_ID}",
+        f"/tmp/{RUN_ID}",
+        f"nope/{RUN_ID}",
+        # an asset
+        "asset:../x.png",
+        "asset:../../studio/outputs/wf/a.png",
+        "asset:/etc/passwd",
+        "asset:missing.png",
+        # a workspace
+        "workspace:../other",
+        "workspace:/abs",
+        "workspace:nope",
+        "workspace:",
+    ],
+)
+def test_put_note_refuses_traversal_targets(client, studio, make_run, target):
+    make_run("wf", ["a.png"])
+    before = snapshot(os.path.dirname(studio.root))
+    r = client.put("/api/notes", json={"target": target, "note": "x"})
+    assert r.status_code in (400, 404), r.json()
+    assert snapshot(os.path.dirname(studio.root)) == before
+
+
+def test_a_flat_layout_file_cannot_hold_a_note(client, output_root):
+    with open(os.path.join(output_root, "flat.png"), "wb") as handle:
+        handle.write(PNG)
+    r = client.put("/api/notes", json={"target": "flat.png", "note": "x"})
+    assert r.status_code == 409
+    assert "notes need a run directory" in r.json()["detail"]
+    assert not os.path.exists(os.path.join(output_root, N.NOTES_FILE_NAME))
+
+
+def test_note_too_long(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png"])
+    run = run_name(run_dir, output_root)
+    r = client.put("/api/notes", json={"target": run, "note": "x" * 4001})
+    assert r.status_code == 400
+    assert not os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+    r = client.put("/api/notes", json={"target": run, "note": "x" * 4000})
+    assert r.status_code == 200
+
+
+def test_a_write_failure_is_a_500(client, output_root, make_run, monkeypatch):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+
+    def refuse(*args, **kwargs):
+        raise OSError("disk full")
+
+    monkeypatch.setattr("dw.server.routes.media.set_run_note", refuse)
+    r = client.put("/api/notes", json={"target": run, "note": "x"})
+    assert r.status_code == 500
+
+
+def test_workspace_note(client, studio):
+    r = client.put("/api/notes", json={"target": "workspace:default", "note": "anthem"})
+    assert r.status_code == 200
+    assert r.json() == {
+        "target": "workspace:default",
+        "note": "anthem",
+        "note_source": None,
+    }
+    ws = {w["name"]: w for w in client.get("/api/workspaces").json()["workspaces"]}
+    assert ws["default"]["note"] == "anthem"
+    assert N.read_workspace_note(studio.root) == "anthem"
+
+
+def test_a_named_workspace_note(client, studio):
+    assert client.post("/api/workspaces", json={"name": "ep4"}).status_code == 201
+    r = client.put("/api/notes", json={"target": "workspace:ep4", "note": "pilot"})
+    assert r.status_code == 200
+    ws = {w["name"]: w for w in client.get("/api/workspaces").json()["workspaces"]}
+    assert ws["ep4"]["note"] == "pilot"
+    assert "note" not in ws["default"]
+    assert N.read_workspace_note(os.path.join(studio.root, "ep4")) == "pilot"
+    client.put("/api/notes", json={"target": "workspace:ep4", "note": ""})
+    ws = {w["name"]: w for w in client.get("/api/workspaces").json()["workspaces"]}
+    assert "note" not in ws["ep4"]
+
+
+def test_an_asset_note_by_reference(client, studio):
+    up = client.post(
+        "/api/uploads",
+        params={"filename": "iris.png", "asset_name": "iris"},
+        content=PNG,
+    )
+    assert up.status_code == 201
+    r = client.put(
+        "/api/notes", json={"target": "asset:uploads/iris.png", "note": "lead"}
+    )
+    assert r.status_code == 200
+    assert r.json() == {
+        "target": "asset:uploads/iris.png",
+        "note": "lead",
+        "note_source": "file",
+    }
+    assert asset_entry(client, "uploads/iris.png")["note"] == "lead"
+    meta = client.get("/api/gallery/asset:uploads/iris.png/metadata").json()
+    assert (meta["note"], meta["note_source"]) == ("lead", "file")
+    assert "run_note" not in meta
+    uploads = os.path.join(studio.assets, "uploads")
+    assert N.read_notes(uploads)["files"] == {"iris.png": "lead"}
+
+
+# ------------------------------------------------------- upload, keep, delete
+
+
+def test_asset_note_upload_keep_and_delete(client, studio):
+    up = client.post(
+        "/api/uploads",
+        params={"filename": "iris.png", "note": "cast: iris"},
+        content=PNG,
+    )
+    assert up.status_code == 201
+    ref = up.json()["reference"]
+    name = ref.split(":", 1)[1]
+    assert asset_entry(client, name)["note"] == "cast: iris"
+
+    too_long = client.post(
+        "/api/uploads",
+        params={"filename": "long.png", "note": "x" * 4001},
+        content=PNG,
+    )
+    assert too_long.status_code == 400
+    # refused before a byte was written
+    assert sorted(os.listdir(os.path.join(studio.assets, "uploads"))) == sorted(
+        [os.path.basename(name), N.NOTES_FILE_NAME]
+    )
+
+    assert client.delete(f"/api/assets/{name}").status_code == 200
+    assert not os.path.exists(os.path.join(studio.assets, "uploads", N.NOTES_FILE_NAME))
+
+
+def test_keep_copies_effective_note(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png", "b.png"]), output_root)
+    client.put("/api/notes", json={"target": run, "note": "the run note"})
+    client.put("/api/notes", json={"target": f"{run}/b.png", "note": "b's own"})
+
+    kept = client.post("/api/assets/keep", json={"name": f"{run}/a.png"})
+    assert kept.status_code == 201
+    assert asset_entry(client, "a.png")["note"] == "the run note"
+
+    kept = client.post("/api/assets/keep", json={"name": f"{run}/b.png"})
+    assert asset_entry(client, "b.png")["note"] == "b's own"
+
+    kept = client.post(
+        "/api/assets/keep",
+        json={"name": f"{run}/a.png", "asset_name": "c.png", "note": "given"},
+    )
+    assert kept.status_code == 201
+    assert asset_entry(client, "c.png")["note"] == "given"
+
+    refused = client.post(
+        "/api/assets/keep",
+        json={"name": f"{run}/a.png", "asset_name": "d.png", "note": "x" * 4001},
+    )
+    assert refused.status_code == 400
+    assert "d.png" not in {
+        a["name"] for a in client.get("/api/assets").json()["assets"]
+    }
+
+
+def test_keep_without_any_note_leaves_none(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    assert client.post("/api/assets/keep", json={"name": f"{run}/a.png"}).status_code
+    assert "note" not in asset_entry(client, "a.png")
+
+
+def test_deleted_asset_leaves_no_note_or_provenance(
+    client, studio, output_root, make_run
+):
+    run = run_name(make_run("wf", ["x.png"]), output_root)
+    history = client.app.state.job_manager.history
+    history.job_for_file = lambda name, workspace=None: {
+        "id": "abc",
+        "status": "succeeded",
+    }
+    kept = client.post(
+        "/api/assets/keep",
+        json={"name": f"{run}/x.png", "asset_name": "uploads/x.png", "note": "old"},
+    )
+    assert kept.status_code == 201
+    meta = client.get("/api/gallery/asset:uploads/x.png/metadata").json()
+    assert meta["job"]["id"] == "abc"
+    assert meta["note"] == "old"
+
+    assert client.delete("/api/assets/uploads/x.png").status_code == 200
+    uploads = os.path.join(studio.assets, "uploads")
+    assert not os.path.exists(os.path.join(uploads, N.NOTES_FILE_NAME))
+    assert not os.path.exists(os.path.join(uploads, "manifest.json"))
+
+    up = client.post(
+        "/api/uploads",
+        params={"filename": "x.png", "asset_name": "x.png"},
+        content=PNG,
+    )
+    assert up.status_code == 201
+    assert up.json()["reference"] == "asset:uploads/x.png"
+    assert "note" not in asset_entry(client, "uploads/x.png")
+    meta = client.get("/api/gallery/asset:uploads/x.png/metadata").json()
+    assert meta["job"] is None
+    assert meta["run_id"] == ""
+    assert "note" not in meta
+
+
+def test_an_upload_over_an_existing_name_drops_the_old_note(client):
+    params = {"filename": "y.png", "asset_name": "y.png", "note": "first"}
+    assert client.post("/api/uploads", params=params, content=PNG).status_code == 201
+    assert asset_entry(client, "uploads/y.png")["note"] == "first"
+    params = {"filename": "y.png", "asset_name": "y.png"}
+    assert client.post("/api/uploads", params=params, content=PNG).status_code == 201
+    assert "note" not in asset_entry(client, "uploads/y.png")
+
+
+# --------------------------------------------------------------------- jobs
+
+
+def test_job_note_reaches_history_run_and_rerun(client, output_root):
+    submitted = client.post(
+        "/api/jobs", json={"workflow": valid_workflow(), "note": "testing"}
+    )
+    assert submitted.status_code == 201
+    job = submitted.json()
+    assert job["note"] == "testing"
+    detail = wait_for_status(client, job["id"], ["succeeded"])
+    assert detail["note"] == "testing"
+
+    # the run directory the worker reported holds it as the run note
+    run_dir = os.path.join(output_root, *detail["run_dir"].split("/"))
+    assert N.read_notes(run_dir)["run"] == "testing"
+    files = {f["name"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files[f"{detail['run_dir']}/a.png"]["note"] == "testing"
+
+    # the polled list carries it, live and from history
+    listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+    assert listed[job["id"]]["note"] == "testing"
+    manager = client.app.state.job_manager
+    assert manager.history.get(job["id"])["note"] == "testing"
+    (summary,) = [s for s in manager.history.recent_summaries() if s["id"] == job["id"]]
+    assert summary["note"] == "testing"
+
+    # read back from sqlite once the live job is gone
+    manager.jobs.pop(job["id"])
+    assert client.get(f"/api/jobs/{job['id']}").json()["note"] == "testing"
+    listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+    assert listed[job["id"]]["note"] == "testing"
+
+    # a rerun carries it forward, and writes it into its own run
+    rerun = client.post(f"/api/jobs/{job['id']}/rerun")
+    assert rerun.status_code == 201
+    assert rerun.json()["note"] == "testing"
+    again = wait_for_status(client, rerun.json()["id"], ["succeeded"])
+    assert again["note"] == "testing"
+    assert again["run_dir"] != detail["run_dir"]
+    rerun_dir = os.path.join(output_root, *again["run_dir"].split("/"))
+    assert N.read_notes(rerun_dir)["run"] == "testing"
+
+
+def test_a_job_without_a_note_has_no_note(client, output_root):
+    job = client.post("/api/jobs", json={"workflow": valid_workflow()}).json()
+    detail = wait_for_status(client, job["id"], ["succeeded"])
+    assert "note" not in detail
+    run_dir = os.path.join(output_root, *detail["run_dir"].split("/"))
+    assert not os.path.exists(os.path.join(run_dir, N.NOTES_FILE_NAME))
+    manager = client.app.state.job_manager
+    assert "note" not in manager.history.get(job["id"])
+
+
+def test_a_job_note_too_long_is_refused_before_queuing(client):
+    r = client.post(
+        "/api/jobs", json={"workflow": valid_workflow(), "note": "x" * 4001}
+    )
+    assert r.status_code == 400
+    assert client.app.state.job_manager.worker_manager.commands == []
+
+
+def test_a_run_dir_escaping_the_output_root_gets_no_note(tmp_path, studio):
+    """The run_start event is the worker's word: a run_dir that leaves the
+    output root writes nothing outside it."""
+    from dw.server.job_record import Job
+    from dw.server.job_results import record_progress
+
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    job = Job({"workflow_name": "w", "note": "n"})
+    record_progress(
+        job,
+        {"event": "run_start", "run_id": RUN_ID, "run_dir": "../../outside"},
+        studio.outputs,
+    )
+    assert not (outside / N.NOTES_FILE_NAME).exists()
+
+
+def test_note_set_during_run_survives_manifest_rewrite(tmp_path):
+    from dw.runs import write_manifest
+
+    d = str(tmp_path)
+    write_manifest(d, {"status": "running", "steps": []})
+    N.set_run_note(d, "mid-run")
+    write_manifest(d, {"status": "succeeded", "steps": []})
+    assert N.read_notes(d)["run"] == "mid-run"
+    with open(os.path.join(d, "manifest.json")) as handle:
+        assert "mid-run" not in json.dumps(json.load(handle))
+
+
+def test_job_detail_and_list_show_the_current_run_note(client, output_root):
+    """A run note edited after submission replaces the submitted one on
+    the job, live and from history, and a cleared one removes it."""
+    job = client.post(
+        "/api/jobs", json={"workflow": valid_workflow(), "note": "A"}
+    ).json()
+    detail = wait_for_status(client, job["id"], ["succeeded"])
+    r = client.put("/api/notes", json={"target": detail["run_dir"], "note": "B"})
+    assert r.status_code == 200
+
+    def shown():
+        listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+        return (
+            client.get(f"/api/jobs/{job['id']}").json().get("note"),
+            listed[job["id"]].get("note"),
+        )
+
+    assert shown() == ("B", "B")
+    client.app.state.job_manager.jobs.pop(job["id"])  # from sqlite now
+    assert shown() == ("B", "B")
+    client.put("/api/notes", json={"target": detail["run_dir"], "note": None})
+    assert shown() == (None, None)
+
+
+def test_a_job_whose_run_is_gone_keeps_its_submitted_note(client, output_root):
+    import shutil
+
+    job = client.post(
+        "/api/jobs", json={"workflow": valid_workflow(), "note": "A"}
+    ).json()
+    detail = wait_for_status(client, job["id"], ["succeeded"])
+    shutil.rmtree(os.path.join(output_root, *detail["run_dir"].split("/")))
+    assert client.get(f"/api/jobs/{job['id']}").json()["note"] == "A"
+
+
+def test_keep_with_an_empty_note_keeps_none(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    client.put("/api/notes", json={"target": run, "note": "the run note"})
+    kept = client.post("/api/assets/keep", json={"name": f"{run}/a.png", "note": ""})
+    assert kept.status_code == 201
+    assert "note" not in asset_entry(client, "a.png")
+
+
+def _keep_with_provenance(client, run, asset_name):
+    history = client.app.state.job_manager.history
+    history.job_for_file = lambda name, workspace=None: {
+        "id": "abc",
+        "status": "succeeded",
+    }
+    kept = client.post(
+        "/api/assets/keep", json={"name": f"{run}/x.png", "asset_name": asset_name}
+    )
+    assert kept.status_code == 201
+    meta = client.get(f"/api/gallery/asset:{asset_name}/metadata").json()
+    assert meta["job"]["id"] == "abc"
+
+
+def test_an_upload_over_a_kept_name_clears_its_provenance(
+    client, output_root, make_run
+):
+    run = run_name(make_run("wf", ["x.png"]), output_root)
+    _keep_with_provenance(client, run, "uploads/x.png")
+    up = client.post(
+        "/api/uploads", params={"filename": "x.png", "asset_name": "x.png"}, content=PNG
+    )
+    assert up.status_code == 201
+    assert client.get("/api/gallery/asset:uploads/x.png/metadata").json()["job"] is None
+
+
+def test_an_upload_under_a_fresh_name_leaves_other_provenance(
+    client, studio, output_root, make_run
+):
+    run = run_name(make_run("wf", ["x.png"]), output_root)
+    _keep_with_provenance(client, run, "uploads/x.png")
+    up = client.post(
+        "/api/uploads", params={"filename": "y.png", "asset_name": "y.png"}, content=PNG
+    )
+    assert up.status_code == 201
+    meta = client.get("/api/gallery/asset:uploads/x.png/metadata").json()
+    assert meta["job"]["id"] == "abc"
+
+    # a kept record caught mid-write is not the upload's to rewrite
+    manifest = os.path.join(studio.assets, "uploads", "manifest.json")
+    with open(manifest, "w") as handle:
+        handle.write('{"steps": [')
+    up = client.post(
+        "/api/uploads", params={"filename": "z.png", "asset_name": "z.png"}, content=PNG
+    )
+    assert up.status_code == 201
+    with open(manifest) as handle:
+        assert handle.read() == '{"steps": ['
+
+
+def test_a_kept_asset_whose_job_left_history_reports_it_forgotten(
+    client, output_root, make_run
+):
+    """#918: the id stays, but the stale status is not reported as current."""
+    run = run_name(make_run("wf", ["x.png"]), output_root)
+    _keep_with_provenance(client, run, "uploads/x.png")
+    meta = client.get("/api/gallery/asset:uploads/x.png/metadata").json()
+    assert meta["job"] == {"id": "abc", "status": "forgotten"}
diff --git a/tests/test_notes_bookkeeping.py b/tests/test_notes_bookkeeping.py
new file mode 100644
index 00000000..3991dd45
--- /dev/null
+++ b/tests/test_notes_bookkeeping.py
@@ -0,0 +1,83 @@
+"""Run-directory bookkeeping stays correct when notes.json is present."""
+
+import io
+import os
+import zipfile
+
+from dw.notes import NOTES_FILE_NAME, read_notes, set_file_note, set_run_note
+from dw.runs import new_run_id
+
+from .test_server_exports import RUN_DIR, exporting_script, finished
+from .test_server_exports import server as export_server  # noqa: F401
+from .test_server_exports import workspace_root  # noqa: F401
+
+IDENTITY = "wf"
+
+
+def _run(write_run, output_root, files, seed=1):
+    run_id = new_run_id({"id": IDENTITY, "seed": seed})
+    run_dir = write_run(
+        output_root,
+        IDENTITY,
+        run_id,
+        [{"step": "gen", "files": list(files)}],
+        files=files,
+    )
+    return run_id, run_dir
+
+
+def test_run_with_only_notes_is_pruned_and_orphan(
+    gallery_client, output_root, write_run
+):
+    run_id, run_dir = _run(write_run, output_root, ["a.png"])
+    set_run_note(run_dir, "testing shift")
+    assert (
+        gallery_client.delete(f"/api/gallery/{IDENTITY}/{run_id}/a.png").status_code
+        == 200
+    )
+    assert not os.path.exists(run_dir)
+
+    orphan_id, orphan_dir = _run(write_run, output_root, [], seed=2)
+    set_run_note(orphan_dir, "left behind")
+    assert os.path.isfile(os.path.join(orphan_dir, NOTES_FILE_NAME))
+    listed = gallery_client.get("/api/gallery?only_orphans=true").json()
+    assert {r["name"] for r in listed["runs"]} == {f"{IDENTITY}/{orphan_id}"}
+
+
+def test_single_output_delete_drops_its_note(gallery_client, output_root, write_run):
+    run_id, run_dir = _run(write_run, output_root, ["a.png", "final/b.png"])
+    set_file_note(run_dir, "a.png", "first")
+    set_file_note(run_dir, "final/b.png", "second")
+    response = gallery_client.delete(f"/api/gallery/{IDENTITY}/{run_id}/final/b.png")
+    assert response.status_code == 200
+    assert os.path.isfile(os.path.join(run_dir, "a.png"))
+    assert read_notes(run_dir)["files"] == {"a.png": "first"}
+
+
+def test_export_carries_notes(export_server):  # noqa: F811
+    with export_server(exporting_script) as client:
+        # the run's directory is made by the script, so note it once finished
+        job_id = finished(client)
+        output_root = client.app.state.job_manager.output_dir
+        set_run_note(os.path.join(output_root, RUN_DIR), "keep this one")
+        body = client.post(f"/api/jobs/{job_id}/export").json()
+        assert os.path.isfile(os.path.join(body["directory"], NOTES_FILE_NAME))
+        zipped = client.get(body["zip_url"])
+    names = zipfile.ZipFile(io.BytesIO(zipped.content)).namelist()
+    assert f"{job_id}/{NOTES_FILE_NAME}" in names
+
+
+def test_a_failing_note_drop_does_not_fail_the_delete(
+    gallery_client, output_root, write_run, monkeypatch
+):
+    run_id, run_dir = _run(write_run, output_root, ["a.png"])
+    set_file_note(run_dir, "a.png", "first")
+
+    def broken(*_args):
+        raise OSError("disk full")
+
+    monkeypatch.setattr("dw.server.routes.gallery.drop_file_note", broken)
+    response = gallery_client.delete(f"/api/gallery/{IDENTITY}/{run_id}/a.png")
+    assert response.status_code == 200
+    assert response.json()["run_swept"] == run_id
+    assert not os.path.exists(run_dir)
diff --git a/tests/test_observed_cost.py b/tests/test_observed_cost.py
index 6bf3ebad..9aac5e31 100644
--- a/tests/test_observed_cost.py
+++ b/tests/test_observed_cost.py
@@ -239,6 +239,21 @@ def test_a_task_only_workflow_reports_cold_even_though_had_load_is_false(self):
         assert observed["cold_minutes"] == 12.0 and observed["cold_runs"] == 24
         assert "warm_minutes" not in observed
 
+    def test_a_task_only_workflow_without_drivers_counts_runs_with_overrides(self):
+        """#921: templates/check-script is called with its own audio and
+        lines every time; none of that makes runs incomparable."""
+        definition = workflow(None, input_audio="asset:take.wav", lines=None)
+        definition["steps"] = [{"name": "check", "task": "check_script"}]
+        args = {"input_audio": "asset:other.mp4", "lines": ["a", "b"]}
+
+        observed = observed_for(
+            definition,
+            [run(5, args), run(6, {"lines": ["x"]}), run(5, {})],
+            arguments=args,
+        )
+
+        assert observed["runs"] == 3 and observed["cold_runs"] == 3
+
     def test_a_pipeline_step_keeps_the_ordinary_had_load_split(self):
         """A workflow that does load a model is unaffected - the split still
         comes from what the run actually logged."""
@@ -662,8 +677,13 @@ def test_a_driver_is_a_size_not_a_piece_of_text(self):
         """A prompt, a seed or a URL moves the output, not the wall clock,
         and bucketing on one gives every run its own bucket and so a
         permanent `runs: 1`. `num_images_per_prompt` is a count and is
-        fine - the rule is the value's *type*, not the name's spelling."""
+        fine - the rule is the value's *type*, not the name's spelling.
+
+        The exception is a configuration choice drawn from a short list:
+        H3's weights dtype and LoRA move the wall clock and are text, and
+        bucket by exact value (#866, Q5)."""
         never = {"seed", "prompt", "negative_prompt"}
+        choices = {"weights_dtype", "lora_model_name"}
         for path in sorted(
             glob.glob(
                 os.path.join(REPO_ROOT, "workflows", "**", "*.json"), recursive=True
@@ -675,7 +695,7 @@ def test_a_driver_is_a_size_not_a_piece_of_text(self):
             where = os.path.relpath(path, REPO_ROOT)
             for name in definition.get("cost_drivers") or []:
                 assert name not in never, f"{where} buckets on '{name}'"
-                assert not isinstance(variables.get(name), str), (
+                assert name in choices or not isinstance(variables.get(name), str), (
                     f"{where} buckets on '{name}', whose default is text"
                 )
 
@@ -752,6 +772,54 @@ def test_the_minimax_templates_declare_drivers(self):
             assert definition.get("cost_drivers"), os.path.relpath(path, REPO_ROOT)
 
 
+class TestH3KnobsSplitTheBucket:
+    """#866 stage B: a run that overrode a knob with no rule to scale by no
+    longer pools with the runs at the default."""
+
+    @staticmethod
+    def h3():
+        return workflow(
+            ["num_frames", "weights_dtype", "lora_model_name", "attention_backend"],
+            num_frames=124,
+            weights_dtype="{int4}",
+            lora_model_name="lightx2v/Minimax-h3-Turbo",
+            attention_backend=None,
+        )
+
+    def test_an_int8_run_does_not_pool_with_int4_runs(self):
+        rows = [
+            run(8 * MINUTE, {}),
+            run(8 * MINUTE, {"weights_dtype": "{int4}"}),
+            run(20 * MINUTE, {"weights_dtype": "{int8}"}),
+        ]
+        default = observed_for(self.h3(), rows)
+        assert (default["runs"], default["cold_minutes"]) == (2, 8.0)
+        int8 = observed_for(self.h3(), rows, arguments={"weights_dtype": "{int8}"})
+        assert (int8["runs"], int8["cold_minutes"]) == (1, 20.0)
+
+    def test_a_lora_buckets_by_its_exact_name(self):
+        rows = [
+            run(8 * MINUTE, {}),
+            run(12 * MINUTE, {"lora_model_name": None}),
+            run(9 * MINUTE, {"lora_model_name": "someone/other-lora"}),
+        ]
+        assert observed_for(self.h3(), rows)["runs"] == 1
+        none = observed_for(self.h3(), rows, arguments={"lora_model_name": None})
+        assert none["cold_minutes"] == 12.0
+        other = observed_for(
+            self.h3(), rows, arguments={"lora_model_name": "someone/other-lora"}
+        )
+        assert other["cold_minutes"] == 9.0
+
+    def test_a_native_attention_run_leaves_the_default_bucket(self):
+        rows = [run(8 * MINUTE, {}), run(11 * MINUTE, {"attention_backend": "native"})]
+        assert observed_for(self.h3(), rows)["runs"] == 1
+        native = observed_for(
+            self.h3(), rows, arguments={"attention_backend": "native"}
+        )
+        assert native["cold_minutes"] == 11.0
+
+
 @pytest.mark.parametrize("value", [None, "", "[]", "not json"])
 def test_a_manifest_that_will_not_parse_is_not_a_cached_run(value):
     from dw.server.observed_cost import _every_step_was_reused
diff --git a/tests/test_pipeline_components.py b/tests/test_pipeline_components.py
index 81706f38..1cb2d1a4 100644
--- a/tests/test_pipeline_components.py
+++ b/tests/test_pipeline_components.py
@@ -101,6 +101,33 @@ def callback():
 
         assert config.current_timestep_callback is callback
 
+    def test_guidance_embeds_infers_distilled(self):
+        from diffusers import FasterCacheConfig
+
+        config = FasterCacheConfig()
+        pipeline = MagicMock()
+        pipeline.transformer.config.guidance_embeds = True
+        enable_cache_on_transformer(pipeline, config)
+        assert config.is_guidance_distilled is True
+
+    def test_no_guidance_embeds_stays_false(self):
+        from diffusers import FasterCacheConfig
+
+        config = FasterCacheConfig()
+        pipeline = MagicMock()
+        pipeline.transformer.config.guidance_embeds = False
+        enable_cache_on_transformer(pipeline, config)
+        assert config.is_guidance_distilled is False
+
+    def test_explicit_value_wins(self):
+        from diffusers import FasterCacheConfig
+
+        config = FasterCacheConfig(is_guidance_distilled=False)
+        pipeline = MagicMock()
+        pipeline.transformer.config.guidance_embeds = True
+        enable_cache_on_transformer(pipeline, config, distilled_explicit=True)
+        assert config.is_guidance_distilled is False
+
 
 class ModularLike:
     """Stands in for a ModularPipeline - built from its own component index, and
diff --git a/tests/test_plan.py b/tests/test_plan.py
index fd01f3f8..9c1c6dc1 100644
--- a/tests/test_plan.py
+++ b/tests/test_plan.py
@@ -6,7 +6,14 @@
 
 import pytest
 
-from dw.plan import build_plan, gate_warnings
+from dw.plan import (
+    CONSTRAINT_DOCUMENTATION_KEYS,
+    DOCUMENTATION_KEYS,
+    PLACEMENT_RESULT_KEYS,
+    build_plan,
+    gate_warnings,
+)
+from dw.cost_scaling import scale_curated
 from dw.validation import unseeded_cache_warnings
 from dw.runs import new_run_id
 from dw.workflow import workflow_from_definition
@@ -224,6 +231,300 @@ def test_a_step_added_removed_or_renamed(self, plan):
         assert len(prints) == 4
 
 
+# Every top-level schema key and every step `result` key, sorted into what
+# the fingerprint leaves out and what it keeps (#905). A key added to the
+# schema fails TestFingerprintKeys until it is sorted here, so a metadata key
+# can neither bust acknowledgements nor slip into the work unreviewed
+KEPT_TOP_LEVEL_KEYS = {
+    "id",  # names every file the run saves, and the step cache keys on it
+    "variables",  # the folded values are the work
+    "variable_constraints",  # a rule rounds or refuses a value
+    "argument_template",  # read as arguments when not run as a child
+    "seed",  # removed separately: a seed is not the work, but it is the output
+    "steps",
+}
+KEPT_RESULT_KEYS = {
+    "content_type",
+    "save",
+    "fps",
+    "sample_rate",
+    "audio_sample_rate",
+    "subtype",
+    "compression_level",
+    "bitrate_mode",
+    "embed_metadata",
+    "format",
+}
+
+
+def schema():
+    from importlib import resources
+
+    return json.loads(
+        resources.files("dw").joinpath("workflow_schema.json").read_text()
+    )
+
+
+class TestFingerprintKeys:
+    def test_the_exclusion_lists_are_pinned(self):
+        assert DOCUMENTATION_KEYS == (
+            "configures",
+            "cost",
+            "cost_drivers",
+            "description",
+            "shape",
+            "summary",
+            "traits",
+            "vram_estimate",
+        )
+        assert CONSTRAINT_DOCUMENTATION_KEYS == ("reason",)
+        assert PLACEMENT_RESULT_KEYS == ("file_base_name", "role", "subfolder")
+
+    def test_every_top_level_schema_key_is_sorted(self):
+        keys = set(schema()["properties"])
+        assert set(DOCUMENTATION_KEYS) | KEPT_TOP_LEVEL_KEYS == keys
+        assert not set(DOCUMENTATION_KEYS) & KEPT_TOP_LEVEL_KEYS
+
+    def test_every_result_schema_key_is_sorted(self):
+        keys = set(schema()["$defs"]["result"]["properties"])
+        assert set(PLACEMENT_RESULT_KEYS) | KEPT_RESULT_KEYS == keys
+        assert not set(PLACEMENT_RESULT_KEYS) & KEPT_RESULT_KEYS
+
+    def test_every_constraint_schema_key_but_the_reason_is_a_rule(self):
+        keys = set(schema()["$defs"]["variable_constraint"]["properties"])
+        assert set(CONSTRAINT_DOCUMENTATION_KEYS) <= keys
+
+
+def with_pipeline_settings(spec):
+    """The fixture's pipeline step with an attention backend, a cache
+    config, a dtype and a LoRA set, so a test can move each one."""
+    spec = copy.deepcopy(spec)
+    pipeline = spec["steps"][0]["pipeline"]
+    pipeline["configuration"]["attention_backend"] = "flash"
+    pipeline["configuration"]["cache"] = {"type": "mag", "threshold": 0.1}
+    pipeline["from_pretrained_arguments"]["torch_dtype"] = "torch.bfloat16"
+    pipeline["loras"] = [{"model_name": "org/lora-a", "scale": 1.0}]
+    return spec
+
+
+class TestFingerprintIgnoresWhatCannotChangeTheOutput:
+    """#905: the fingerprint is keyed only by what can change the output."""
+
+    def test_cost_drivers(self, plan):
+        spec = definition()
+        spec["cost_drivers"] = ["frames"]
+        other = copy.deepcopy(spec)
+        other["cost_drivers"] = ["frames", "shots"]
+        assert plan(spec)["fingerprint"] == plan(other)["fingerprint"]
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_vram_estimate(self, plan):
+        spec = definition()
+        spec["vram_estimate"] = {
+            "base_gb": 4,
+            "bytes_per_voxel": 1.0,
+            "voxel_variables": ["frames"],
+            "reason": "measured",
+        }
+        other = copy.deepcopy(spec)
+        other["vram_estimate"]["base_gb"] = 9
+        other["vram_estimate"]["reason"] = "re-measured"
+        assert plan(spec)["fingerprint"] == plan(other)["fingerprint"]
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_an_integral_float_spelled_as_an_int(self, plan):
+        # A client's JSON round trip can turn 12.0 into 12 (#905)
+        spec = definition()
+        spec["variables"]["frames"] = 25.0
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_shape_and_traits(self, plan):
+        spec = definition()
+        spec["shape"] = "shot"
+        spec["traits"] = ["has-audio"]
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_a_constraints_reason(self, plan):
+        spec = definition()
+        spec["variable_constraints"] = {
+            "frames": {"modulus": 8, "remainder": 1, "reason": "the VAE packs 8"}
+        }
+        other = copy.deepcopy(spec)
+        other["variable_constraints"]["frames"]["reason"] = "reworded"
+        assert plan(spec)["fingerprint"] == plan(other)["fingerprint"]
+
+    def test_a_results_role_subfolder_and_file_name(self, plan):
+        spec = definition()
+        result = spec["steps"][0]["result"]
+        result.update(role="final", subfolder="final", file_base_name="still")
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_a_composed_childs_cost_and_documentation(self, plan, tmp_path):
+        step = {"name": "x", "task": {"command": "x", "arguments": {}}}
+        child = {"id": "child", "variables": {"n": 1}, "steps": [step]}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        spec = composing("child.json")
+        before = plan(spec)["fingerprint"]
+        child.update(
+            cost=[cost("cuda", 5)],
+            cost_drivers=["n"],
+            description="documented",
+            vram_estimate={"base_gb": 1, "voxel_variables": ["n"]},
+        )
+        (tmp_path / "child.json").write_text(json.dumps(child, indent=2))
+        assert plan(spec)["fingerprint"] == before
+
+
+class TestFingerprintStillChangesWithWhatChangesTheOutput:
+    @pytest.mark.parametrize(
+        "move",
+        [
+            lambda p: p["configuration"].update(attention_backend="native"),
+            lambda p: p["configuration"].update(cache={"type": "first_block"}),
+            lambda p: p["configuration"]["cache"].update(threshold=0.2),
+            lambda p: p["from_pretrained_arguments"].update(
+                torch_dtype="torch.float16"
+            ),
+            lambda p: p["loras"][0].update(model_name="org/lora-b"),
+            lambda p: p["loras"][0].update(scale=0.5),
+            lambda p: p.pop("loras"),
+        ],
+        ids=[
+            "attention_backend",
+            "cache_type",
+            "cache_threshold",
+            "dtype",
+            "lora",
+            "lora_scale",
+            "no_lora",
+        ],
+    )
+    def test_a_pipeline_setting(self, plan, move):
+        spec = with_pipeline_settings(definition())
+        other = copy.deepcopy(spec)
+        move(other["steps"][0]["pipeline"])
+        assert plan(spec)["fingerprint"] != plan(other)["fingerprint"]
+
+    def test_a_results_format(self, plan):
+        spec = definition()
+        spec["steps"][0]["result"]["format"] = "webp"
+        assert plan(spec)["fingerprint"] != plan()["fingerprint"]
+
+
+CATALOG_H3 = "workflows/templates/minimax/reference-to-video.json"
+CATALOG_MUSIC = "workflows/templates/minimax/music.json"
+# The knobs stage B of #866 made cost drivers of every H3 template
+H3_UNSCALABLE = ("weights_dtype", "lora_model_name", "attention_backend", "cache")
+
+
+def _repo_json(path):
+    import pathlib
+
+    root = pathlib.Path(__file__).resolve().parent.parent
+    return json.loads((root / path).read_text())
+
+
+def _minimax_with_h3_drivers():
+    import glob
+    import pathlib
+
+    root = pathlib.Path(__file__).resolve().parent.parent
+    found = []
+    for path in sorted(glob.glob(str(root / "workflows/templates/minimax/*.json"))):
+        drivers = json.loads(pathlib.Path(path).read_text()).get("cost_drivers") or []
+        if "weights_dtype" in drivers:
+            found.append(str(pathlib.Path(path).relative_to(root)))
+    return found
+
+
+@pytest.mark.parametrize("path", _minimax_with_h3_drivers())
+def test_h3_unscalable_drivers_leave_every_fingerprint(plan, path):
+    """Stage 0's pin, held for stage B (#866): declaring H3's unscalable
+    knobs as cost drivers changes no template's plan fingerprint."""
+    template = _repo_json(path)
+    before = copy.deepcopy(template)
+    before["cost_drivers"] = [
+        name for name in template["cost_drivers"] if name not in H3_UNSCALABLE
+    ]
+    assert plan(template)["fingerprint"] == plan(before)["fingerprint"]
+
+
+def test_every_h3_template_with_drivers_declares_its_unscalable_knobs():
+    """#866 stage B: a minimax H3 template that buckets on its size also
+    buckets on the knobs that move its wall clock with no rule to scale by."""
+    import glob
+    import pathlib
+
+    root = pathlib.Path(__file__).resolve().parent.parent
+    missing = []
+    for path in sorted(glob.glob(str(root / "workflows/templates/minimax/*.json"))):
+        definition = json.loads(pathlib.Path(path).read_text())
+        variables = definition.get("variables") or {}
+        if not definition.get("cost_drivers") or "weights_dtype" not in variables:
+            continue
+        absent = [n for n in H3_UNSCALABLE if n not in definition["cost_drivers"]]
+        if absent:
+            missing.append((pathlib.Path(path).name, absent))
+    assert _minimax_with_h3_drivers()
+    assert missing == []
+
+
+class TestTheCatalogH3Template:
+    """The stage's repro on the real template: a copy differing only in
+    cost_drivers plans the same work, one differing in attention backend
+    or weights dtype does not."""
+
+    @pytest.fixture
+    def template(self):
+        import pathlib
+
+        root = pathlib.Path(__file__).resolve().parent.parent
+        return json.loads((root / CATALOG_H3).read_text())
+
+    def test_cost_drivers_leave_the_fingerprint(self, plan, template):
+        other = copy.deepcopy(template)
+        other["cost_drivers"] = [
+            name for name in other["cost_drivers"] if name not in H3_UNSCALABLE
+        ]
+        del other["vram_estimate"]
+        assert plan(template)["fingerprint"] == plan(other)["fingerprint"]
+
+    def test_a_client_round_trip_keeps_it(self, plan, template):
+        # The inline get_workflow JSON comes back with video_shift 12.0 as
+        # 12 (and its kin); the by-name form keeps the float (#905)
+        def respell(value):
+            if isinstance(value, float) and value.is_integer():
+                return int(value)
+            if isinstance(value, dict):
+                return {key: respell(item) for key, item in value.items()}
+            if isinstance(value, list):
+                return [respell(item) for item in value]
+            return value
+
+        inline = respell(template)
+        # The template does hold one, or this checks nothing
+        assert json.dumps(inline) != json.dumps(template)
+        assert plan(template)["fingerprint"] == plan(inline)["fingerprint"]
+
+    def test_the_seed_stays_out(self, plan, template):
+        # The #85 contract: an acknowledgement buys the cost, not the seed
+        assert (
+            plan(template, arguments={"seed": 42})["fingerprint"]
+            == plan(template, arguments={"seed": 43})["fingerprint"]
+        )
+
+    @pytest.mark.parametrize(
+        "arguments",
+        [{"attention_backend": "native"}, {"weights_dtype": "{int8}"}],
+        ids=["attention_backend", "weights_dtype"],
+    )
+    def test_an_output_setting_moves_it(self, plan, template, arguments):
+        assert (
+            plan(template)["fingerprint"]
+            != plan(template, arguments=arguments)["fingerprint"]
+        )
+
+
 def cost(device="cuda", minutes=10, per_entry=None, name="card"):
     entry = {"device": device, "name": name, "vram_gb": 8, "minutes": minutes}
     if per_entry:
@@ -407,24 +708,29 @@ def test_minutes_is_rounded_to_one_decimal(self, plan):
         spec["cost"] = [cost("cuda", 10.04)]
         assert plan(spec)["estimate"]["minutes"] == 10.0
 
-    def test_a_shifted_scalar_cost_driver_falls_back_to_unknown(self, plan):
+    def test_a_shifted_unscalable_cost_driver_is_flagged(self, plan):
         """The catalog figure was measured at frames=25; a caller who
         overrides a declared cost_driver away from that value is not
-        describing the run the figure was measured for, and `_repriced`
-        only re-prices a for_each list's length, not a bare variable (#267)."""
+        describing the run the figure was measured for (#267). `frames` is
+        not one of the drivers a figure scales along, so the figure is kept
+        and flagged rather than withheld (#866, Q4)."""
         spec = definition()
         spec["cost_drivers"] = ["frames"]
         answer = plan(spec, arguments={"frames": 9})["estimate"]
-        assert (answer["minutes"], answer["basis"]) == (None, "unknown")
+        assert (answer["minutes"], answer["basis"]) == (10.0, "catalog")
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["frames"]
 
-    def test_a_shifted_scalar_driver_is_unknown_on_another_device_too(self, plan):
+    def test_a_shifted_unscalable_driver_is_flagged_on_another_device_too(self, plan):
         """#589: the other_device branch skipped the #267 check, so a 241-frame
-        run was quoted the 121-frame clip's figure."""
+        run was quoted the 121-frame clip's figure with nothing to say so."""
         spec = definition()
         spec["cost"] = [cost("mps", 40, name="M2")]
         spec["cost_drivers"] = ["frames"]
         answer = plan(spec, arguments={"frames": 9})["estimate"]
-        assert (answer["minutes"], answer["basis"]) == (None, "unknown")
+        assert (answer["minutes"], answer["basis"]) == (40.0, "other_device")
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["frames"]
 
     def test_an_unshifted_scalar_cost_driver_still_quotes_the_catalog_figure(
         self, plan
@@ -444,9 +750,10 @@ def test_a_list_driver_still_reprices_instead_of_going_unknown(self, plan):
         answer = plan(spec, arguments={"shots": shots})["estimate"]
         assert (answer["minutes"], answer["basis"]) == (50.0, "derived")
 
-    def test_a_shifted_per_entry_field_in_a_list_driver_is_unknown(self, plan):
+    def test_a_shifted_per_entry_field_in_a_list_driver_is_scaled(self, plan):
         """#593: a per-shot num_frames outside the values the default entries
-        were measured with has no matching bucket, same as a scalar (#267)."""
+        were measured with has no matching bucket, same as a scalar (#267) -
+        so the figure is scaled by the frames summed over the list (#866)."""
         spec = definition()
         spec["cost"] = [cost("mps", 40, name="M2")]
         spec["cost_drivers"] = ["shots"]
@@ -462,20 +769,26 @@ def test_a_shifted_per_entry_field_in_a_list_driver_is_unknown(self, plan):
             {"name": "x", "prompt": "p", "num_frames": 243},
             {"name": "y", "prompt": "p", "num_frames": 243},
         ]
+        # Another device's figure stays other_device, scaled (#589)
         kept = plan(spec, arguments={"shots": same})["estimate"]
-        assert (kept["minutes"], kept["basis"]) == (40.0, "other_device")
+        assert (kept["minutes"], kept["basis"]) == (37.4, "other_device")
+        assert kept["scaled"].endswith("frames 248 vs 265 over shots")
         moved = plan(spec, arguments={"shots": long})["estimate"]
-        assert (moved["minutes"], moved["basis"]) == (None, "unknown")
+        assert (moved["minutes"], moved["basis"]) == (73.4, "other_device")
         as_text = [dict(entry, num_frames=str(entry["num_frames"])) for entry in long]
         moved = plan(spec, arguments={"shots": as_text})["estimate"]
-        assert (moved["minutes"], moved["basis"]) == (None, "unknown")
+        assert (moved["minutes"], moved["basis"]) == (73.4, "other_device")
         same_text = [dict(entry, num_frames="124") for entry in same]
         kept = plan(spec, arguments={"shots": same_text})["estimate"]
-        assert (kept["minutes"], kept["basis"]) == (40.0, "other_device")
+        assert (kept["minutes"], kept["basis"]) == (37.4, "other_device")
+        default = plan(spec)["estimate"]
+        assert (default["minutes"], default["basis"]) == (40.0, "other_device")
+        assert "scaled" not in default
 
-    def test_a_lengthened_list_with_a_shifted_field_is_unknown_not_derived(self, plan):
+    def test_a_lengthened_list_with_a_shifted_field_scales_both(self, plan):
         """#796: the derived basis scaled by entry count and skipped the #593
-        field check, so 6 shots with one at 345 frames was quoted confidently."""
+        field check, so 6 shots with one at 345 frames was quoted confidently.
+        The count and the mean frames per entry now both scale (#866)."""
         spec = definition()
         spec["cost_drivers"] = ["shots"]
         spec["variables"]["shots"] = [
@@ -484,9 +797,14 @@ def test_a_lengthened_list_with_a_shifted_field_is_unknown_not_derived(self, pla
         same = [{"name": f"s{n}", "prompt": "p", "num_frames": 124} for n in range(10)]
         kept = plan(spec, arguments={"shots": same})["estimate"]
         assert (kept["minutes"], kept["basis"]) == (20.0, "derived")
+        assert "scaled" not in kept
         long = same[:9] + [{"name": "z", "prompt": "p", "num_frames": 345}]
         moved = plan(spec, arguments={"shots": long})["estimate"]
-        assert (moved["minutes"], moved["basis"]) == (None, "unknown")
+        # 4 min x 10/5 shots x (1461/10)/(620/5) frames per shot
+        assert (moved["minutes"], moved["basis"]) == (23.6, "derived")
+        assert moved["scaled"] == (
+            "scaled from the curated 20 min: frames 1461 vs 620 over shots"
+        )
 
     def test_position_fields_do_not_block_a_derived_figure(self, plan):
         """#796: start_frame/cut_frames grow with the count; only num_frames
@@ -512,7 +830,8 @@ def test_a_shifted_field_withholds_an_observed_figure(self, plan):
         long = [dict(e) for e in spec["variables"]["shots"]]
         long[3]["num_frames"] = 345
         answer = plan(spec, arguments={"shots": long}, observed=observed())["estimate"]
-        assert (answer["minutes"], answer["basis"]) == (None, "unknown")
+        # The observed 8.04 is withheld; the curated 10 is scaled instead
+        assert (answer["minutes"], answer["basis"]) == (14.5, "derived")
 
     def test_a_per_entry_list_driver_prices_past_its_measured_count(self, plan):
         """#772: a windows list whose entries carry an `index` label priced
@@ -686,6 +1005,345 @@ def observed_for_child(path, child_definition, arguments=None):
         assert answer["low_confidence"] is True
 
 
+def scalable(minutes=10):
+    """The fixture with steps and a canvas as declared cost drivers, its
+    curated figure measured at their defaults (#866)."""
+    spec = definition()
+    spec["cost"] = [cost("cuda", minutes)]
+    spec["variables"].update({"num_inference_steps": 9, "width": 960, "height": 544})
+    spec["cost_drivers"] = ["num_inference_steps", "width", "height", "shots"]
+    return spec
+
+
+class TestDriverScaling:
+    """#866: a curated figure is measured at the workflow's variable
+    defaults; a run that moves steps, the canvas or the frames is quoted
+    scaled along them rather than as no figure at all."""
+
+    def test_the_defaults_quote_the_curated_figure(self, plan):
+        answer = plan(scalable())["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "catalog")
+        assert "scaled" not in answer
+
+    def test_steps_scale_in_proportion(self, plan):
+        answer = plan(scalable(), arguments={"num_inference_steps": 30})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (33.3, "derived")
+        assert answer["scaled"] == "scaled from the curated 10 min: steps 30 vs 9"
+
+    def test_the_canvas_scales_by_its_area(self, plan):
+        arguments = {"width": 1344, "height": 768}
+        answer = plan(scalable(), arguments=arguments)["estimate"]
+        # 10 x 1344.768 / 960.544
+        assert (answer["minutes"], answer["basis"]) == (19.8, "derived")
+        assert answer["scaled"] == (
+            "scaled from the curated 10 min: canvas 1344x768 vs 960x544"
+        )
+
+    def test_one_side_of_the_canvas_scales_too(self, plan):
+        answer = plan(scalable(), arguments={"width": 1920})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (20.0, "derived")
+        assert "canvas 1920x544 vs 960x544" in answer["scaled"]
+
+    def test_per_entry_frames_scale_by_their_sum(self, plan):
+        spec = scalable()
+        spec["variables"]["shots"] = [
+            {"name": "a", "prompt": "one", "num_frames": 124},
+            {"name": "b", "prompt": "two", "num_frames": 141},
+        ]
+        shots = [
+            {"name": "a", "prompt": "one", "num_frames": 124},
+            {"name": "b", "prompt": "two", "num_frames": 345},
+        ]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        # 10 x 469/265: the same two shots, one of them longer
+        assert (answer["minutes"], answer["basis"]) == (17.7, "derived")
+        assert answer["scaled"].endswith("frames 469 vs 265 over shots")
+
+    def test_a_list_not_priced_by_length_scales_by_the_sum_alone(self, plan):
+        """No for_each runs over `takes`, so its length prices nothing - the
+        summed frames carry the whole ratio, length and all."""
+        spec = scalable()
+        spec["variables"]["takes"] = [{"num_frames": 100}]
+        spec["cost_drivers"] = spec["cost_drivers"] + ["takes"]
+        takes = [{"num_frames": 100}, {"num_frames": 150}]
+        answer = plan(spec, arguments={"takes": takes})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (25.0, "derived")
+        assert answer["scaled"].endswith("frames 250 vs 100 over takes")
+
+    def test_steps_canvas_and_frames_multiply(self, plan):
+        spec = scalable()
+        spec["variables"]["frames"] = 124
+        spec["variables"]["num_frames"] = 124
+        spec["steps"][0]["pipeline"]["arguments"]["num_frames"] = "variable:num_frames"
+        spec["cost_drivers"] = spec["cost_drivers"] + ["num_frames"]
+        arguments = {
+            "num_inference_steps": 30,
+            "width": 1344,
+            "height": 768,
+            "num_frames": 248,
+        }
+        answer = plan(spec, arguments=arguments)["estimate"]
+        # 10 x 30/9 x 1344.768/960.544 x 248/124
+        assert (answer["minutes"], answer["basis"]) == (131.8, "derived")
+        assert answer["scaled"] == (
+            "scaled from the curated 10 min: steps 30 vs 9, "
+            "canvas 1344x768 vs 960x544, frames 248 vs 124"
+        )
+
+    def test_it_multiplies_with_the_list_length(self, plan):
+        shots = [{"name": f"s{n}", "prompt": "x"} for n in range(4)]
+        arguments = {"shots": shots, "num_inference_steps": 18}
+        answer = plan(scalable(), arguments=arguments)["estimate"]
+        # 10 x 4/2 shots x 18/9 steps
+        assert (answer["minutes"], answer["basis"]) == (40.0, "derived")
+        assert answer["scaled"] == "scaled from the curated 20 min: steps 18 vs 9"
+
+    def test_a_non_numeric_value_stays_unknown(self, plan):
+        # A text default keeps a text argument as text; an int one would
+        # have cast "wide" away to the default before the plan saw it
+        spec = scalable()
+        spec["variables"]["width"] = "960"
+        answer = plan(spec, arguments={"width": "wide"})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (None, "unknown")
+        assert "scaled" not in answer
+
+    def test_a_number_spelled_as_text_scales(self, plan):
+        answer = plan(scalable(), arguments={"num_inference_steps": "18"})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (20.0, "derived")
+
+    def test_another_devices_figure_stays_other_device(self, plan):
+        spec = scalable()
+        spec["cost"] = [cost("mps", 40)]
+        answer = plan(spec, arguments={"num_inference_steps": 18})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (80.0, "other_device")
+        assert answer["scaled"] == "scaled from the curated 40 min: steps 18 vs 9"
+
+    def test_a_thin_observed_figure_tempers_toward_the_scaled_one(self, plan):
+        arguments = {"num_inference_steps": 18}
+        thin = observed(minutes=24, runs=1)
+        answer = plan(scalable(), arguments=arguments, observed=thin)["estimate"]
+        assert answer["basis"] == "observed"
+        assert answer["tempered"] is True
+        assert answer["curated_minutes"] == 20.0
+        assert 20.0 < answer["minutes"] < 24.0
+        assert answer["scaled"] == "scaled from the curated 10 min: steps 18 vs 9"
+
+    def test_a_settled_observed_figure_is_not_scaled(self, plan):
+        arguments = {"num_inference_steps": 18}
+        answer = plan(scalable(), arguments=arguments, observed=observed(minutes=24))[
+            "estimate"
+        ]
+        assert (answer["minutes"], answer["basis"]) == (24.0, "observed")
+        assert "scaled" not in answer
+
+
+class TestScalingAccuracy:
+    """#866's bar: each measured pair on the RTX 3090 (#851's B and L runs)
+    is predicted within 30% by scaling the other."""
+
+    @pytest.mark.parametrize(
+        "measured, defaults, effective, actual",
+        [
+            # B4 -> B1: steps 12 -> 30 at 960x544
+            (
+                6.6,
+                {"num_inference_steps": 12, "width": 960, "height": 544},
+                {"num_inference_steps": 30, "width": 960, "height": 544},
+                15.1,
+            ),
+            # B4 -> B5: canvas 960x544 -> 1344x768 at 12 steps
+            (
+                6.6,
+                {"num_inference_steps": 12, "width": 960, "height": 544},
+                {"num_inference_steps": 12, "width": 1344, "height": 768},
+                11.8,
+            ),
+            # B3 -> L5: steps 12 -> 30 at 1344x768
+            (
+                12.9,
+                {"num_inference_steps": 12, "width": 1344, "height": 768},
+                {"num_inference_steps": 30, "width": 1344, "height": 768},
+                29.5,
+            ),
+        ],
+    )
+    def test_within_thirty_percent(self, measured, defaults, effective, actual):
+        minutes, axes = scale_curated(measured, defaults, effective)
+        assert axes
+        assert abs(minutes - actual) / actual < 0.30
+
+    def test_nothing_moved_is_the_figure_itself(self):
+        defaults = {"num_inference_steps": 9, "width": 960, "height": 544}
+        assert scale_curated(7.88, defaults, dict(defaults)) == (7.88, [])
+
+    def test_a_moved_non_number_is_none(self):
+        defaults = {"num_inference_steps": 9}
+        assert scale_curated(7.88, defaults, {"num_inference_steps": None}) is None
+
+
+CATALOG_DIALOGUE = "workflows/templates/minimax/dialogue-short.json"
+
+
+class TestTheCatalogTemplatesScale:
+    """#866 on the real templates: H3's reference-to-video and the
+    dialogue-short sequence, measured at their defaults."""
+
+    @staticmethod
+    def load(path):
+        import pathlib
+
+        root = pathlib.Path(__file__).resolve().parent.parent
+        return json.loads((root / path).read_text())
+
+    def test_reference_to_video_at_its_defaults(self, plan):
+        answer = plan(self.load(CATALOG_H3))["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (7.9, "catalog")
+        assert "scaled" not in answer
+
+    def test_reference_to_video_at_thirty_steps(self, plan):
+        template = self.load(CATALOG_H3)
+        answer = plan(template, arguments={"num_inference_steps": 30})["estimate"]
+        # 7.88 x 30/9
+        assert (answer["minutes"], answer["basis"]) == (26.3, "derived")
+        assert "steps 30 vs 9" in answer["scaled"]
+
+    def test_reference_to_video_at_the_larger_canvas(self, plan):
+        template = self.load(CATALOG_H3)
+        arguments = {"width": 1344, "height": 768}
+        answer = plan(template, arguments=arguments)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (15.6, "derived")
+        assert "canvas 1344x768 vs 960x544" in answer["scaled"]
+
+    def test_dialogue_short_at_its_defaults(self, plan):
+        answer = plan(self.load(CATALOG_DIALOGUE))["estimate"]
+        assert answer["basis"] == "catalog"
+        assert answer["minutes"] == pytest.approx(21, abs=0.5)
+
+    def test_dialogue_short_with_one_shot_longer(self, plan):
+        template = self.load(CATALOG_DIALOGUE)
+        shots = copy.deepcopy(template["variables"]["shots"])
+        assert [shot["num_frames"] for shot in shots] == [124, 124, 124, 124, 141]
+        shots[0]["num_frames"] = 192
+        answer = plan(template, arguments={"shots": shots})["estimate"]
+        # 21.2 x 705/637 frames
+        assert (answer["minutes"], answer["basis"]) == (23.5, "derived")
+        assert answer["scaled"] == (
+            "scaled from the curated 21.2 min: frames 705 vs 637 over shots"
+        )
+
+
+class TestUnscalableDrivers:
+    """#866 stage B: a declared scalar driver with no rule to scale by keeps
+    the (scaled) figure, sets `low_confidence` and names itself in
+    `differs`, for every template (Q4)."""
+
+    def test_reference_to_video_in_int8(self, plan):
+        template = _repo_json(CATALOG_H3)
+        answer = plan(template, arguments={"weights_dtype": "{int8}"})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (7.9, "catalog")
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["weights_dtype"]
+
+    def test_reference_to_video_without_its_lora_at_thirty_steps(self, plan):
+        template = _repo_json(CATALOG_H3)
+        arguments = {"lora_model_name": None, "num_inference_steps": 30}
+        answer = plan(template, arguments=arguments)["estimate"]
+        # 7.88 x 30/9, scaled and flagged
+        assert (answer["minutes"], answer["basis"]) == (26.3, "derived")
+        assert "steps 30 vs 9" in answer["scaled"]
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["lora_model_name"]
+
+    def test_every_moved_knob_is_named(self, plan):
+        template = _repo_json(CATALOG_H3)
+        arguments = {
+            "weights_dtype": "{int8}",
+            "attention_backend": "native",
+            "cache": {"type": "first_block"},
+        }
+        answer = plan(template, arguments=arguments)["estimate"]
+        assert answer["minutes"] == 7.9
+        assert sorted(answer["differs"]) == [
+            "attention_backend",
+            "cache",
+            "weights_dtype",
+        ]
+
+    def test_reference_to_video_at_its_defaults_is_not_flagged(self, plan):
+        template = _repo_json(CATALOG_H3)
+        answer = plan(template)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (7.9, "catalog")
+        assert "low_confidence" not in answer
+        assert "differs" not in answer
+
+    def test_the_defaults_passed_explicitly_are_not_flagged(self, plan):
+        template = _repo_json(CATALOG_H3)
+        variables = template["variables"]
+        arguments = {name: variables[name] for name in H3_UNSCALABLE}
+        answer = plan(template, arguments=arguments)["estimate"]
+        assert "low_confidence" not in answer
+
+    def test_music_at_another_duration(self, plan):
+        """#440's case, now a flagged figure rather than `unknown`."""
+        template = _repo_json(CATALOG_MUSIC)
+        answer = plan(template, arguments={"audio_duration": 240})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (3.6, "catalog")
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["audio_duration"]
+
+    def test_a_thin_bucket_blends_toward_a_flagged_figure(self, plan):
+        """One int8 run, blended toward the int4 catalog figure: the blend
+        leans on a figure measured at another setting, so it says so."""
+        spec = definition()
+        spec["cost_drivers"] = ["frames"]
+        answer = plan(
+            spec, arguments={"frames": 9}, observed=observed(minutes=6, runs=1)
+        )["estimate"]
+        assert answer["basis"] == "observed"
+        assert answer["tempered"] is True
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["frames"]
+
+    def test_a_full_bucket_is_not_flagged(self, plan):
+        """Three runs at the moved setting are a measurement of it."""
+        spec = definition()
+        spec["cost_drivers"] = ["frames"]
+        answer = plan(
+            spec, arguments={"frames": 9}, observed=observed(minutes=6, runs=3)
+        )["estimate"]
+        assert answer["minutes"] == 6.0
+        assert "low_confidence" not in answer
+        assert "differs" not in answer
+
+    def test_a_composed_child_at_another_setting_flags_the_total(self, plan, tmp_path):
+        child = {
+            "id": "child",
+            "cost": [cost("cuda", 5)],
+            "variables": {"weights_dtype": "{int4}"},
+            "cost_drivers": ["weights_dtype"],
+            "steps": [],
+        }
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        parent = {
+            "id": "parent",
+            "cost": [cost("cuda", 2)],
+            "steps": [
+                {"name": "own", "task": {"command": "x", "arguments": {}}},
+                {
+                    "name": "child",
+                    "workflow": {
+                        "path": "child.json",
+                        "arguments": {"weights_dtype": "{int8}"},
+                    },
+                },
+            ],
+        }
+        answer = plan(parent)["estimate"]
+        assert answer["minutes"] == 7.0
+        assert answer["low_confidence"] is True
+        assert answer["differs"] == ["weights_dtype"]
+
+
 def composing(child_path):
     return {
         "id": "parent",
@@ -767,11 +1425,11 @@ def test_a_child_measured_on_another_device_is_still_added(self, plan, tmp_path)
         # the parent's own basis is what is reported
         assert answer["basis"] == "catalog"
 
-    def test_a_composed_childs_shifted_scalar_driver_is_unpriced(self, plan, tmp_path):
+    def test_a_composed_childs_shifted_scalar_driver_is_scaled(self, plan, tmp_path):
         """The composing step's own `arguments` are what the child actually
         runs with, not its declared defaults - a scalar cost_driver moved
         away from the value the child's catalog cost was measured against
-        is the same #267 failure one level down (#341)."""
+        is the same #267 case one level down (#341), scaled (#866)."""
         child = {
             "id": "child",
             "cost": [cost("cuda", 5)],
@@ -783,8 +1441,12 @@ def test_a_composed_childs_shifted_scalar_driver_is_unpriced(self, plan, tmp_pat
         parent = composing("child.json")
         parent["steps"][1]["workflow"]["arguments"] = {"num_frames": 345}
         answer = plan(parent)["estimate"]
-        assert (answer["minutes"], answer["partial"]) == (2.0, True)
-        assert answer["unpriced"] == ["child.json"]
+        # 2 of its own + 5 x 345/124
+        assert (answer["minutes"], answer["partial"]) == (15.9, False)
+        assert (answer["basis"], answer["unpriced"]) == ("derived", [])
+        assert answer["scaled"] == (
+            "child.json: scaled from the curated 5 min: frames 345 vs 124"
+        )
 
     def test_a_composed_child_at_its_default_is_still_priced(self, plan, tmp_path):
         """The companion case: a composing step that passes the child's own
@@ -918,16 +1580,16 @@ def test_an_unpriced_childs_history_leaves_the_estimate_partial(
         assert answer["basis"] == "unknown"
         assert answer["partial"] is False
 
-    def test_a_composed_childs_shifted_scalar_driver_stays_unpriced_despite_default_bucket_history(
+    def test_a_composed_childs_shifted_scalar_driver_is_scaled_despite_default_bucket_history(
         self, plan, tmp_path
     ):
         """The observed-history rollup must not paper over a shifted scalar
         driver by quoting the *default* bucket's figure just because it
         exists - `observed_for_child` is called with the composing step's
         own arguments, and answering None for the shifted bucket falls
-        through to the catalog path's `_scalar_driver_shifted` unpriced
-        check rather than silently reusing the default bucket's history
-        (#341)."""
+        through to the catalog path's driver check rather than silently
+        reusing the default bucket's history (#341), which now scales the
+        child's figure (#866)."""
         child = {
             "id": "child",
             "cost": [cost("cuda", 5)],
@@ -959,8 +1621,8 @@ def observed_for_child(path, child_definition, arguments=None):
 
         answer = plan(parent, observed_for_child=observed_for_child)["estimate"]
         assert calls == [{"num_frames": 345}]
-        assert answer["basis"] == "unknown"
-        assert (answer["minutes"], answer["partial"]) == (None, False)
+        assert answer["basis"] == "derived"
+        assert (answer["minutes"], answer["partial"]) == (13.9, False)
 
     def test_a_composed_childs_observed_history_is_bucketed_by_the_composing_steps_arguments(
         self, plan, tmp_path
diff --git a/tests/test_plugin_skills.py b/tests/test_plugin_skills.py
index 5dffba10..42fcb78e 100644
--- a/tests/test_plugin_skills.py
+++ b/tests/test_plugin_skills.py
@@ -469,6 +469,35 @@ def test_the_dialogue_into_a_song_recipe_is_the_task_s_and_the_guide_s(self):
         workflow = Workflow(definition, REPO_ROOT, os.path.join(REPO_ROOT, "n.json"))
         assert workflow.validation_errors() == []
 
+    def test_the_locked_frame_lip_sync_recipe_names_real_task_types(self):
+        """#852: a locked frame that lip-syncs is Ref2VA with a first-frame
+        keyframe and the song held. The task types are MiniMax's, which the
+        built-in Context-IR enhancer teaches, and `hold_audio` is the argument
+        music-video's ref2va step takes, so a rename of either fails here."""
+        body = skill_body(H3_SKILL)
+        task = "[keyframe completion + audio reuse]"
+        assert f"`{task}`" in body
+        assert "FL2VA takes no audio" in body
+        assert "`hold_audio`" in body
+
+        enhancer = os.path.join(REPO_ROOT, "dw", "workflows", "h3_context_ir.json")
+        system_prompt = open(enhancer, encoding="utf-8").read()
+        for name in ("keyframe completion", "audio reuse"):
+            assert name in system_prompt
+
+        path = os.path.join(
+            REPO_ROOT, "workflows", "templates", "minimax", "music-video.json"
+        )
+        steps = json.load(open(path, encoding="utf-8"))["steps"]
+        assert any(
+            step.get("pipeline", {})
+            .get("from_pretrained_arguments", {})
+            .get("workflow")
+            == "ref2va"
+            and "hold_audio" in step["pipeline"].get("arguments", {})
+            for step in steps
+        )
+
     def test_the_1344x768_reference_ceilings_are_the_templates_vram_estimate(self):
         """#479: `gb_per_reference` and the per-step projection moved the
         Ref2VA ceiling from one number (175 frames, unstated reference count)
diff --git a/tests/test_rerun_lineage.py b/tests/test_rerun_lineage.py
new file mode 100644
index 00000000..5a82eee7
--- /dev/null
+++ b/tests/test_rerun_lineage.py
@@ -0,0 +1,69 @@
+"""A rerun names the job it reran (`rerun_of`), live and from history."""
+
+import sqlite3
+
+from fastapi.testclient import TestClient
+
+from dw.server.app import create_app
+from dw.server.job_history import JobHistory
+from dw.server.jobs import JobManager
+
+from .test_server import ScriptedWorkerManager, success_script, valid_workflow
+from .test_server import wait_for_status
+
+
+def make_client(tmp_path):
+    (tmp_path / "workflows").mkdir(exist_ok=True)
+    manager = JobManager(
+        str(tmp_path / "outputs"),
+        worker_manager=ScriptedWorkerManager(success_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+    )
+    app = create_app(
+        workflow_dir=str(tmp_path / "workflows"),
+        output_dir=str(tmp_path / "outputs"),
+        job_manager=manager,
+    )
+    return TestClient(app, base_url="http://localhost")
+
+
+def run_and_rerun(client):
+    original = client.post(
+        "/api/jobs", json={"workflow": valid_workflow("lineage"), "arguments": {}}
+    ).json()["id"]
+    wait_for_status(client, original, ["succeeded"])
+    rerun = client.post(f"/api/jobs/{original}/rerun").json()["id"]
+    wait_for_status(client, rerun, ["succeeded"])
+    return original, rerun
+
+
+def test_a_rerun_names_the_job_it_reran(tmp_path):
+    with make_client(tmp_path) as client:
+        original, rerun = run_and_rerun(client)
+        assert client.get(f"/api/jobs/{rerun}").json()["rerun_of"] == original
+        assert "rerun_of" not in client.get(f"/api/jobs/{original}").json()
+        listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+        assert listed[rerun]["rerun_of"] == original
+
+
+def test_the_lineage_survives_a_restart(tmp_path):
+    with make_client(tmp_path) as client:
+        original, rerun = run_and_rerun(client)
+    with make_client(tmp_path) as client:
+        assert client.get(f"/api/jobs/{rerun}").json()["rerun_of"] == original
+        listed = {j["id"]: j for j in client.get("/api/jobs").json()["jobs"]}
+        assert listed[rerun]["rerun_of"] == original
+
+
+def test_an_older_history_database_gains_the_column(tmp_path):
+    path = tmp_path / "old.sqlite"
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE jobs (id TEXT PRIMARY KEY, workflow TEXT, status TEXT,"
+            " created_at REAL, started_at REAL, finished_at REAL, arguments TEXT,"
+            " spec TEXT, manifest TEXT, warnings TEXT, error TEXT)"
+        )
+    JobHistory(path)
+    with sqlite3.connect(path) as connection:
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
+    assert "rerun_of" in columns
diff --git a/tests/test_roles.py b/tests/test_roles.py
new file mode 100644
index 00000000..b85f7a9b
--- /dev/null
+++ b/tests/test_roles.py
@@ -0,0 +1,366 @@
+import json
+
+import pytest
+
+from dw.roles import (
+    FINAL,
+    INTERMEDIATE,
+    ROLE_DECLARED_KEY,
+    annotate_roles,
+    consumed_outputs,
+    listed_role,
+    run_inputs,
+    step_roles,
+)
+from dw.schema import load_schema, validate_data_all
+
+
+def _step(name, result=None, args=None):
+    step = {"name": name, "task": {"command": "noop", "arguments": args or {}}}
+    if result is not None:
+        step["result"] = result
+    return step
+
+
+def _entry(step, *files, **extra):
+    return {"step": step, "files": list(files), **extra}
+
+
+def test_leaf_media_step_is_final_and_consumed_one_intermediate():
+    steps = [
+        _step("image"),
+        _step("video", args={"image": "previous_result:image"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "b.mp4")]
+    assert step_roles(steps, manifest) == {"image": INTERMEDIATE, "video": FINAL}
+
+
+def test_property_reference_counts_as_consumption():
+    steps = [
+        _step("stems"),
+        _step("mix", args={"audio": "previous_result:stems.vocals"}),
+    ]
+    manifest = [_entry("stems", "v.wav"), _entry("mix", "m.wav")]
+    assert step_roles(steps, manifest)["stems"] == INTERMEDIATE
+
+
+def test_text_only_consumer_does_not_demote():
+    steps = [
+        _step("video"),
+        _step("check", args={"video": "previous_result:video"}),
+    ]
+    manifest = [_entry("video", "v.mp4"), _entry("check", "report.json")]
+    roles = step_roles(steps, manifest)
+    assert roles == {"video": FINAL, "check": FINAL}
+
+
+def test_unsaved_consumer_still_demotes():
+    steps = [
+        _step("image"),
+        _step("latent", args={"image": "previous_result:image"}),
+        _step("video", args={"latent": "previous_result:latent"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "v.mp4")]
+    roles = step_roles(steps, manifest)
+    assert roles["image"] == INTERMEDIATE
+    assert roles["latent"] == INTERMEDIATE
+    assert roles["video"] == FINAL
+
+
+def test_explicit_role_wins_over_inference_and_subfolder():
+    steps = [
+        _step("image", result={"role": "final", "subfolder": "intermediate"}),
+        _step("video", args={"image": "previous_result:image"}),
+    ]
+    manifest = [_entry("image", "a.png"), _entry("video", "v.mp4")]
+    assert step_roles(steps, manifest)["image"] == FINAL
+
+
+def test_subfolder_convention_including_nested():
+    steps = [
+        _step("a", result={"subfolder": "intermediate/shots"}),
+        _step("b", result={"subfolder": "final/act-1"}),
+    ]
+    manifest = [_entry("a", "x.png"), _entry("b", "y.png")]
+    assert step_roles(steps, manifest) == {"a": INTERMEDIATE, "b": FINAL}
+
+
+def test_other_subfolder_name_falls_through_to_inference():
+    steps = [_step("a", result={"subfolder": "shots"})]
+    assert step_roles(steps, [_entry("a", "x.png")]) == {"a": FINAL}
+
+
+def test_from_previous_result_key_counts():
+    steps = [
+        _step("seg"),
+        _step("inpaint", args={"mask": {"from_previous_result": "seg"}}),
+    ]
+    manifest = [_entry("seg", "m.png"), _entry("inpaint", "o.png")]
+    assert step_roles(steps, manifest)["seg"] == INTERMEDIATE
+
+
+def test_dotted_step_name_resolves_by_longest_match():
+    steps = [
+        _step("v1.0"),
+        _step("up", args={"image": "previous_result:v1.0"}),
+    ]
+    manifest = [_entry("v1.0", "a.png"), _entry("up", "b.png")]
+    assert step_roles(steps, manifest)["v1.0"] == INTERMEDIATE
+
+
+def test_for_each_members_are_steps_of_their_own():
+    steps = [
+        _step("shot@0"),
+        _step("shot@1"),
+        _step(
+            "join",
+            args={"videos": ["previous_result:shot@0", "previous_result:shot@1"]},
+        ),
+    ]
+    manifest = [
+        _entry("shot@0", "0.mp4"),
+        _entry("shot@1", "1.mp4"),
+        _entry("join", "j.mp4"),
+    ]
+    roles = step_roles(steps, manifest)
+    assert roles["shot@0"] == roles["shot@1"] == INTERMEDIATE
+    assert roles["join"] == FINAL
+
+
+def test_child_entries_take_parent_step_role():
+    steps = [
+        _step("child", args={}),
+        _step("score", args={"video": "previous_result:child"}),
+    ]
+    manifest = [
+        _entry("render", "r.mp4", parent_step="child"),
+        _entry("score", "s.mp4"),
+    ]
+    annotated = annotate_roles(steps, manifest)
+    assert annotated[0]["role"] == INTERMEDIATE
+    assert annotated[1]["role"] == FINAL
+
+
+def test_annotate_roles_copies_and_defaults_unknown_to_final():
+    manifest = [_entry("ghost", "g.png")]
+    annotated = annotate_roles([], manifest)
+    assert annotated[0]["role"] == FINAL
+    assert "role" not in manifest[0]
+
+
+def test_run_inputs_dedups_in_first_use_order():
+    steps = [
+        _step("a", args={"image": "asset:cast/iris.png", "mask": "output:w/r/m.png"}),
+        _step("b", args={"images": ["asset:cast/iris.png", "asset:bg.png"]}),
+    ]
+    assert run_inputs(steps) == [
+        {"reference": "asset:cast/iris.png", "kind": "asset"},
+        {"reference": "output:w/r/m.png", "kind": "output"},
+        {"reference": "asset:bg.png", "kind": "asset"},
+    ]
+
+
+@pytest.mark.parametrize(
+    "role,ok",
+    [
+        ("final", True),
+        ("intermediate", True),
+        ("variable:r", True),
+        ("input", False),
+        ("keeper", False),
+    ],
+)
+def test_schema_role_values(role, ok):
+    workflow = {
+        "id": "t",
+        "steps": [
+            {
+                "name": "s",
+                "task": {"command": "noop", "arguments": {}},
+                "result": {"role": role},
+            }
+        ],
+    }
+    errors = validate_data_all(workflow, load_schema("workflow"))
+    role_errors = [e for e in errors if "role" in (e["path"] or "")]
+    assert (not role_errors) == ok
+
+
+def test_role_basis_survives_realization_of_the_steps():
+    from dw.roles import role_basis
+
+    steps = [
+        {"name": "image", "result": {"subfolder": "x"}},
+        {"name": "video", "arguments": {"image": "previous_result:image"}},
+    ]
+    basis = role_basis(steps)
+    steps[1]["arguments"]["image"] = object()  # what a run does in place
+    manifest = [_entry("image", "a.png"), _entry("video", "b.mp4")]
+    assert step_roles(None, manifest, basis) == {"image": INTERMEDIATE, "video": FINAL}
+
+
+# A file a later run consumed (#928): read-time, across the runs of one
+# output root, never rewriting a manifest
+
+PRODUCER = "20261015-000000-aaaaaaaa"
+OLDER = "20261014-000000-aaaaaaaa"
+CONSUMER = "20261015-010000-bbbbbbbb"
+
+
+def _producer(write_run, root, run_id=PRODUCER, version=1, **entry):
+    run_dir = write_run(
+        root,
+        "shots",
+        run_id,
+        [{"step": "shot", "files": ["final/shot.png"], "role": "final", **entry}],
+        files=["final/shot.png"],
+    )
+    if version != 1:
+        manifest_path = f"{run_dir}/manifest.json"
+        with open(manifest_path) as handle:
+            manifest = json.load(handle)
+        manifest["version"] = version
+        with open(manifest_path, "w") as handle:
+            json.dump(manifest, handle)
+    return run_dir
+
+
+def _consumer(write_run, root, reference, run_id=CONSUMER, kind="output", **kw):
+    return write_run(
+        root,
+        "assembly",
+        run_id,
+        [{"step": "cut", "files": ["final/cut.mp4"], "role": "final"}],
+        files=["final/cut.mp4"],
+        inputs=[{"reference": reference, "kind": kind}],
+        **kw,
+    )
+
+
+def test_annotate_roles_flags_a_role_declared_by_rule_1():
+    steps = [
+        _step("a", result={"role": "final"}),
+        _step("b", result={"subfolder": "final"}),
+        _step("c"),
+    ]
+    manifest = [_entry("a", "a.png"), _entry("b", "b.png"), _entry("c", "c.png")]
+    annotated = {e["step"]: e for e in annotate_roles(steps, manifest)}
+    assert annotated["a"][ROLE_DECLARED_KEY] is True
+    assert ROLE_DECLARED_KEY not in annotated["b"]
+    assert ROLE_DECLARED_KEY not in annotated["c"]
+
+
+@pytest.mark.parametrize(
+    "reference",
+    [
+        f"output:shots/{PRODUCER}/final/shot.png",
+        "output:shots/v1/final/shot.png",
+        "output:shots/latest/final/shot.png",
+    ],
+)
+def test_a_file_a_later_run_read_is_consumed(tmp_path, write_run, reference):
+    root = str(tmp_path)
+    _producer(write_run, root)
+    _consumer(write_run, root, reference)
+    assert consumed_outputs(root) == {f"shots/{PRODUCER}/final/shot.png"}
+
+
+def test_an_unpinned_latest_is_the_newest_run_before_the_consumer(tmp_path, write_run):
+    root = str(tmp_path)
+    _producer(write_run, root, OLDER)
+    _consumer(write_run, root, "output:shots/latest/final/shot.png")
+    # A run of the producer after the consumer is not what it read
+    _producer(write_run, root, "20261015-020000-cccccccc", version=2)
+    assert consumed_outputs(root) == {f"shots/{OLDER}/final/shot.png"}
+
+
+def test_a_manifest_without_inputs_falls_back_to_the_realized_workflow(
+    tmp_path, write_run
+):
+    root = str(tmp_path)
+    _producer(write_run, root)
+    write_run(
+        root,
+        "assembly",
+        CONSUMER,
+        [{"step": "cut", "files": ["cut.mp4"], "role": "final"}],
+        realized={
+            "steps": [
+                {
+                    "name": "cut",
+                    "x": f"output:shots/{PRODUCER}/final/shot.png",
+                }
+            ]
+        },
+    )
+    assert consumed_outputs(root) == {f"shots/{PRODUCER}/final/shot.png"}
+
+
+def test_an_asset_kept_from_an_output_is_consumed(tmp_path, write_run):
+    from dw.runs import record_kept_shots
+
+    root = str(tmp_path / "outputs")
+    assets = tmp_path / "assets"
+    assets.mkdir()
+    (assets / "hero.png").write_bytes(b"\x89PNG\r\n\x1a\n")
+    (assets / "plain.png").write_bytes(b"\x89PNG\r\n\x1a\n")
+    record_kept_shots(
+        str(assets),
+        "hero.png",
+        None,
+        {"workspace": "studio", "source": f"shots/{PRODUCER}/final/shot.png"},
+    )
+    _producer(write_run, root)
+    _consumer(write_run, root, "asset:hero.png", kind="asset")
+    write_run(
+        root,
+        "other",
+        "20261015-030000-dddddddd",
+        [],
+        inputs=[{"reference": "asset:plain.png", "kind": "asset"}],
+    )
+
+    def find(name):
+        path = assets / name
+        return str(path) if path.is_file() else None
+
+    assert consumed_outputs(root, find, "studio") == {
+        f"shots/{PRODUCER}/final/shot.png"
+    }
+    # Kept from another workspace's output: not this root's file
+    assert consumed_outputs(root, find, "elsewhere") == set()
+
+
+def test_a_consumer_under_another_root_consumes_nothing_here(tmp_path, write_run):
+    here, there = str(tmp_path / "here"), str(tmp_path / "there")
+    _producer(write_run, here)
+    _producer(write_run, there)
+    _consumer(write_run, there, f"output:shots/{PRODUCER}/final/shot.png")
+    assert consumed_outputs(here) == set()
+
+
+def test_an_unresolvable_reference_consumes_nothing(tmp_path, write_run):
+    root = str(tmp_path)
+    _producer(write_run, root)
+    _consumer(write_run, root, "output:shots/v9/final/shot.png")
+    _consumer(
+        write_run,
+        root,
+        "output:../escape.png",
+        run_id="20261015-040000-eeeeeeee",
+    )
+    assert consumed_outputs(root) == set()
+
+
+@pytest.mark.parametrize(
+    "role, declared, consumed, listed",
+    [
+        (FINAL, False, True, INTERMEDIATE),
+        (FINAL, True, True, FINAL),
+        (FINAL, False, False, FINAL),
+        (INTERMEDIATE, False, True, INTERMEDIATE),
+        (None, False, True, None),
+    ],
+)
+def test_listed_role(role, declared, consumed, listed):
+    assert listed_role(role, declared, consumed) == listed
diff --git a/tests/test_run_manifest_roles.py b/tests/test_run_manifest_roles.py
new file mode 100644
index 00000000..8f97bc03
--- /dev/null
+++ b/tests/test_run_manifest_roles.py
@@ -0,0 +1,159 @@
+"""The engine records each step's role and the run's inputs in manifest.json."""
+
+import copy
+import json
+from types import SimpleNamespace
+
+from dw.roles import role_basis, run_inputs
+from dw.workflow_run import RunRecord, write_run_manifest
+
+from .test_runs import _workflow_definition, fake_pipeline  # noqa: F401
+
+
+def _two_step_definition():
+    definition = _workflow_definition()
+    second = copy.deepcopy(definition["steps"][0])
+    second["name"] = "second"
+    second["pipeline"]["arguments"]["image"] = "previous_result:gen0"
+    definition["steps"].append(second)
+    return definition
+
+
+def _stand_in(tmp_path, manifest):
+    return SimpleNamespace(
+        manifest=manifest,
+        _run_dir=str(tmp_path),
+        _run_version=1,
+        _elided_steps=[],
+        name="roles-test",
+        file_spec=None,
+    )
+
+
+def test_terminal_manifest_records_roles_and_inputs(tmp_path, fake_pipeline):  # noqa: F811
+    from dw.workflow import Workflow
+
+    definition = _two_step_definition()
+    Workflow(definition, str(tmp_path), "/w/workflows/Roles.json").run({})
+
+    run_dir = next((tmp_path / "Roles").iterdir())
+    manifest = json.loads((run_dir / "manifest.json").read_text())
+    assert {e["step"]: e["role"] for e in manifest["steps"]} == {
+        "gen0": "intermediate",
+        "second": "final",
+    }
+    assert manifest["inputs"] == []
+
+
+def test_a_terminal_manifest_lists_the_assets_the_steps_read(tmp_path):
+    steps = [{"name": "a", "x": "asset:cat.png"}, {"name": "b"}]
+    record = RunRecord(
+        status="completed", role_basis=role_basis(steps), inputs=run_inputs(steps)
+    )
+    workflow = _stand_in(tmp_path, [{"step": "a", "files": []}])
+    write_run_manifest(workflow, record)
+
+    manifest = json.loads((tmp_path / "manifest.json").read_text())
+    assert manifest["inputs"] == [{"reference": "asset:cat.png", "kind": "asset"}]
+    assert manifest["steps"][0]["role"] == "final"
+
+
+def test_a_running_manifest_carries_inputs_but_no_roles(tmp_path):
+    steps = [{"name": "a", "x": "asset:cat.png"}, {"name": "b"}]
+    record = RunRecord(
+        status="running", role_basis=role_basis(steps), inputs=run_inputs(steps)
+    )
+    workflow = _stand_in(tmp_path, [{"step": "a", "files": []}])
+    write_run_manifest(workflow, record)
+
+    manifest = json.loads((tmp_path / "manifest.json").read_text())
+    assert manifest["inputs"] == [{"reference": "asset:cat.png", "kind": "asset"}]
+    assert all("role" not in e for e in manifest["steps"])
+
+
+def _source_run(tmp_path):
+    """A finished run of the one-step workflow, and the output: reference
+    naming the image it wrote."""
+    from dw.workflow import Workflow
+
+    Workflow(_workflow_definition(), str(tmp_path), "/w/workflows/Src.json").run({})
+    run_dir = next((tmp_path / "Src").iterdir())
+    image = next(p.name for p in run_dir.iterdir() if p.suffix == ".png")
+    return f"output:Src/{run_dir.name}/{image}"
+
+
+def _terminal_manifest(tmp_path, identity):
+    run_dir = next((tmp_path / identity).iterdir())
+    return json.loads((run_dir / "manifest.json").read_text())
+
+
+def test_a_real_run_records_the_output_a_step_read(tmp_path, fake_pipeline):  # noqa: F811
+    # The step's output: string is realized in place as the step runs; the
+    # terminal manifest must still name it (it was always [] before)
+    from dw.workflow import Workflow
+
+    reference = _source_run(tmp_path)
+    definition = _two_step_definition()
+    definition["id"] = "Dst"
+    definition["steps"][0]["pipeline"]["arguments"]["image"] = reference
+    Workflow(definition, str(tmp_path), "/w/workflows/Dst.json").run({})
+
+    manifest = _terminal_manifest(tmp_path, "Dst")
+    assert manifest["status"] == "completed"
+    assert manifest["inputs"] == [{"reference": reference, "kind": "output"}]
+    # and roles still see the previous_result reference realization replaced
+    assert {e["step"]: e["role"] for e in manifest["steps"]} == {
+        "gen0": "intermediate",
+        "second": "final",
+    }
+
+
+def test_a_real_run_records_an_output_carried_by_a_variable(tmp_path, fake_pipeline):  # noqa: F811
+    from dw.workflow import Workflow
+
+    reference = _source_run(tmp_path)
+    definition = _workflow_definition()
+    definition["id"] = "Var"
+    definition["variables"] = {"image": reference}
+    definition["steps"][0]["pipeline"]["arguments"]["image"] = "variable:image"
+    Workflow(definition, str(tmp_path), "/w/workflows/Var.json").run({})
+
+    manifest = _terminal_manifest(tmp_path, "Var")
+    assert manifest["inputs"] == [{"reference": reference, "kind": "output"}]
+
+
+def test_a_real_run_omits_a_variable_default_no_step_read(tmp_path, fake_pipeline):  # noqa: F811
+    # #857: an unused variable's asset:/output: default is not an input
+    from dw.workflow import Workflow
+
+    reference = _source_run(tmp_path)
+    definition = _workflow_definition()
+    definition["id"] = "Unused"
+    definition["variables"] = {
+        "image": reference,
+        "spare": "output:Src/latest/" + reference.rsplit("/", 1)[1],
+        "prompt": "a cat",
+    }
+    definition["steps"][0]["pipeline"]["arguments"]["prompt"] = "variable:prompt"
+    definition["steps"][0]["pipeline"]["arguments"]["image"] = "variable:image"
+    Workflow(definition, str(tmp_path), "/w/workflows/Unused.json").run({})
+
+    manifest = _terminal_manifest(tmp_path, "Unused")
+    assert manifest["inputs"] == [{"reference": reference, "kind": "output"}]
+
+
+def test_a_real_run_pins_a_latest_output_reference(tmp_path, fake_pipeline):  # noqa: F811
+    # #858: Made from names the run 'latest' resolved to, not 'latest'
+    from dw.workflow import Workflow
+
+    pinned = _source_run(tmp_path)
+    _, run_id, image = pinned.removeprefix("output:").split("/")
+    definition = _workflow_definition()
+    definition["id"] = "Pin"
+    definition["steps"][0]["pipeline"]["arguments"]["image"] = (
+        f"output:Src/latest/{image}"
+    )
+    Workflow(definition, str(tmp_path), "/w/workflows/Pin.json").run({})
+
+    manifest = _terminal_manifest(tmp_path, "Pin")
+    assert manifest["inputs"] == [{"reference": pinned, "kind": "output"}]
diff --git a/tests/test_script_check.py b/tests/test_script_check.py
index 5728204c..f653f0a6 100644
--- a/tests/test_script_check.py
+++ b/tests/test_script_check.py
@@ -15,9 +15,11 @@
 from dw.task_problems import script_lines_errors
 from dw.script_lines import (
     normalize_words,
+    disambiguated,
     parse_lines,
     parse_shots,
     shot_names_error,
+    with_full_shot_names,
     strip_markup,
 )
 from dw.tasks import script_check
@@ -117,8 +119,13 @@ def test_accepts_strings_and_text_objects(self):
         self.assertEqual(
             parsed,
             [
-                {"text": "Hello", "tokens": ["cutoff"], "shot": None},
-                {"text": "World", "tokens": ["s1"], "shot": None},
+                {
+                    "text": "Hello",
+                    "tokens": ["cutoff"],
+                    "shot": None,
+                    "start_frame": None,
+                },
+                {"text": "World", "tokens": ["s1"], "shot": None, "start_frame": None},
             ],
         )
 
@@ -372,7 +379,7 @@ def test_exact_lines_have_no_findings(self):
         self.assertEqual(answer["rules_applied"], list(script_check.LINE_RULES))
         self.assertEqual(
             [s["rule"] for s in answer["rules_skipped"]],
-            ["speech_where_silent", "speech_in_silent_shot"],
+            ["speech_where_silent", "speech_in_silent_shot", "unscripted_speech"],
         )
         self.assertTrue(all(s["reason"] for s in answer["rules_skipped"]))
 
@@ -628,6 +635,62 @@ def test_dropped_line_in_a_known_shot_is_at_the_shots_start(self):
         self.assertEqual(found[0]["at"]["shot"], "B")
 
 
+class TestUnscriptedSpeech(unittest.TestCase):
+    def test_a_line_spoken_twice_in_its_shot_is_a_finding(self):
+        chunks = words("alpha bravo charlie", 0.0) + words("alpha bravo charlie", 1.0)
+        answer = shot_run([{"text": "alpha bravo charlie", "shot": "A"}], chunks)
+        (found,) = rules(answer, "unscripted_speech")
+        self.assertEqual(found["value"], 3)
+        self.assertEqual(found["at"]["shot"], "A")
+        self.assertTrue(found["at"]["repeats_line"])
+
+    def test_an_ad_lib_in_a_scripted_shot_is_not_a_repeat(self):
+        chunks = words("alpha bravo", 0.0) + words("zulu yankee", 1.0)
+        answer = shot_run([{"text": "alpha bravo", "shot": "A"}], chunks)
+        (found,) = rules(answer, "unscripted_speech")
+        self.assertFalse(found["at"]["repeats_line"])
+
+    def test_clean_take_has_none(self):
+        answer = shot_run([{"text": "alpha bravo", "shot": "A"}], words("alpha bravo"))
+        self.assertEqual(rules(answer, "unscripted_speech"), [])
+
+
+class TestSpeechNotTranscribed(unittest.TestCase):
+    LINES = [{"text": "alpha bravo charlie delta", "shot": "A"}]
+
+    def test_sound_in_a_gap_between_a_lines_words_is_a_finding(self):
+        # The ASR dropped an ad-lib between "bravo" and "charlie"
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
+        answer = shot_run(self.LINES, chunks, mono=voiced(6.0))
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertEqual(found["at"]["line"], 0)
+        self.assertEqual(found["at"]["shot"], "A")
+        self.assertAlmostEqual(found["at"]["seconds"], 0.9, places=2)
+        self.assertAlmostEqual(found["at"]["end"], 4.0, places=2)
+
+    def test_a_stretched_word_over_sound_is_a_finding(self):
+        chunks = [
+            {"start": 0.0, "end": 0.4, "text": " alpha"},
+            {"start": 0.5, "end": 3.0, "text": " bravo"},
+            {"start": 3.0, "end": 3.4, "text": " charlie"},
+            {"start": 3.5, "end": 3.9, "text": " delta"},
+        ]
+        answer = shot_run(self.LINES, chunks, mono=voiced(6.0))
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertEqual(found["at"]["seconds"], 0.5)
+
+    def test_a_quiet_gap_is_not(self):
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
+        mono = numpy.concatenate([voiced(0.9), silent(3.1), voiced(2.0)])
+        answer = shot_run(self.LINES, chunks, mono=mono)
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+    def test_a_short_gap_is_not(self):
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 1.5)
+        answer = shot_run(self.LINES, chunks, mono=voiced(3.0))
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+
 class TestSpeechInSilentShot(unittest.TestCase):
     LINES = [{"text": "alpha bravo", "shot": "A"}]
 
@@ -830,6 +893,38 @@ def test_duplicate_names_a_line_names_are_refused(self):
         records = [{"name": "A"}, {"name": "A"}]
         message = shot_names_error(parse_lines([{"text": "x", "shot": "A"}]), records)
         self.assertIn("more than once", message)
+        self.assertIn("start_frame", message)
+
+    def test_start_frame_picks_one_occurrence_of_a_repeated_shot(self):
+        records = [
+            {"name": "A", "start_frame": 0},
+            {"name": "B", "start_frame": 10},
+            {"name": "A", "start_frame": 20},
+        ]
+        lines = parse_lines(
+            [{"text": "x", "shot": "A", "start_frame": 20}, {"text": "y", "shot": "B"}]
+        )
+        self.assertIsNone(shot_names_error(lines, records))
+        resolved = with_full_shot_names(lines, records)
+        self.assertEqual([line["shot"] for line in resolved], ["A#20", "B"])
+        self.assertEqual(
+            [record["name"] for record in disambiguated(records)], ["A#0", "B", "A#20"]
+        )
+
+    def test_a_start_frame_no_occurrence_has_is_refused(self):
+        records = [{"name": "A", "start_frame": 0}, {"name": "A", "start_frame": 20}]
+        lines = parse_lines([{"text": "x", "shot": "A", "start_frame": 5}])
+        self.assertIn("matches no occurrence", shot_names_error(lines, records))
+
+    def test_the_refusal_lists_only_the_nameable_shots(self):
+        records = [
+            {"name": "A", "start_frame": 0},
+            {"name": "A", "start_frame": 20},
+            {"name": "B", "start_frame": 40},
+        ]
+        message = shot_names_error(parse_lines([{"text": "x", "shot": "A"}]), records)
+        self.assertIn("Shots named without it: 'B'", message)
+        self.assertNotIn("'A', 'B'", message)
 
     def test_a_name_repeated_only_across_files_is_not_a_duplicate(self):
         # shots.duplicate_shot_names groups by file (#644 arch review).
@@ -841,6 +936,50 @@ def test_known_names_and_untagged_lines_pass(self):
         lines = parse_lines([{"text": "x", "shot": "B"}, "y"])
         self.assertIsNone(shot_names_error(lines, self.RECORDS))
 
+    def test_a_short_member_name_matches_the_one_shot_carrying_it(self):
+        records = [
+            {"name": "x-shot@cold_open.0-0.0.mp4"},
+            {"name": "x-shot@cold_open_two.0-0.0.mp4"},
+        ]
+        lines = parse_lines([{"text": "x", "shot": "cold_open"}])
+        self.assertIsNone(shot_names_error(lines, records))
+        resolved = with_full_shot_names(lines, records)
+        self.assertEqual(resolved[0]["shot"], "x-shot@cold_open.0-0.0.mp4")
+
+    def test_member_keys_come_from_the_for_each_separator(self):
+        from dw.references import member_keys
+
+        self.assertEqual(member_keys("shot@cold_open"), ["cold_open"])
+        self.assertEqual(member_keys("x-shot@cold_open.0-0.0.mp4"), ["cold_open"])
+        self.assertEqual(member_keys("plain.mp4"), [])
+
+    def test_a_valid_variable_name_comes_back_whole_as_a_member_key(self):
+        # A for_each entry's name is checked by validate_variable_name; the
+        # key member_keys reads back must end exactly where that rule does,
+        # for every character either could meet
+        import string
+
+        from dw.for_each import member_name
+        from dw.references import member_keys
+        from dw.security import InvalidInputError, validate_variable_name
+
+        for char in string.printable:
+            key = f"a{char}b"
+            filename = member_name("shot", key) + ".0-0.0.mp4"
+            try:
+                validate_variable_name(key)
+            except InvalidInputError:
+                self.assertNotEqual(member_keys(filename)[:1], [key], repr(char))
+            else:
+                self.assertEqual(member_keys(filename), [key], repr(char))
+
+    def test_a_short_name_two_shots_carry_is_refused(self):
+        records = [{"name": "a-shot@open.mp4"}, {"name": "b-shot@open.mp4"}]
+        message = shot_names_error(
+            parse_lines([{"text": "x", "shot": "open"}]), records
+        )
+        self.assertIn("more than one", message)
+
     def test_parse_shots(self):
         self.assertIsNone(parse_shots(None))
         self.assertIsNone(parse_shots([]))
@@ -988,3 +1127,22 @@ def test_check_script_defaults_to_the_one_whisper_model():
 
     default = inspect.signature(script_check.check_script).parameters["model_name"]
     assert default.default is audio_transcription.WHISPER_DEFAULT_MODEL
+
+
+def test_transcription_input_is_level_independent():
+    import numpy
+
+    from dw.tasks.script_check import level_for_transcription
+
+    rng = numpy.random.default_rng(0)
+    loud = rng.uniform(-0.5, 0.5, (1, 48000)).astype(numpy.float32)
+    quiet = loud * 0.1
+    (a, gain_a), (b, gain_b) = (
+        level_for_transcription(loud),
+        level_for_transcription(quiet),
+    )
+    assert gain_b > gain_a
+    assert numpy.allclose(a, b, atol=1e-4)
+    assert float(numpy.abs(a).max()) <= 1.0
+    silent = numpy.zeros((1, 100), dtype=numpy.float32)
+    assert level_for_transcription(silent) == (silent, 1.0)
diff --git a/tests/test_server.py b/tests/test_server.py
index 0bd653ee..ba71e331 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -1616,6 +1616,41 @@ def test_gallery_lists_media_and_reads_metadata(server, tmp_path):
         assert read_embedded_metadata(str(outputs / "meta.jpg"))["step_name"] == "gen"
 
 
+def test_gallery_metadata_measures_an_image_and_can_omit_the_workflow(server, tmp_path):
+    """#922: an image's `media` was null, so its size was only in the
+    arguments the pipeline was asked for; `include_workflow=false` drops
+    the embedded definition."""
+    from PIL import Image
+    from dw.writers import embed_image_metadata
+
+    with server(success_script) as client:
+        outputs = tmp_path / "outputs"
+        metadata = {"step_name": "gen", "workflow": valid_workflow("from_image")}
+        embed_image_metadata(
+            Image.new("RGB", (6, 4)),
+            str(outputs / "m.0-0.0.jpg"),
+            "image/jpeg",
+            metadata,
+        )
+        full = client.get("/api/gallery/m.0-0.0.jpg/metadata").json()
+        assert full["media"] == {
+            "kind": "image",
+            "width": 6,
+            "height": 4,
+            "mode": "RGB",
+        }
+        assert full["findings"] == []
+        assert full["metadata"]["workflow"]["id"] == "from_image"
+
+        lean = client.get(
+            "/api/gallery/m.0-0.0.jpg/metadata?include_workflow=false"
+        ).json()
+        assert "workflow" not in lean["metadata"]
+        assert lean["metadata"]["workflow_omitted"] is True
+        assert lean["metadata"]["step_name"] == "gen"
+        assert lean["media"]["width"] == 6
+
+
 def test_gallery_metadata_describes_audio_and_video(server, tmp_path):
     """A generated mp3 answered metadata: null and nothing else, so every
     duration and level check was ffprobe by hand. The route now says what
@@ -1640,7 +1675,12 @@ def test_gallery_metadata_describes_audio_and_video(server, tmp_path):
         assert shot["media"]["frame_count"] == 12
 
         still = client.get("/api/gallery/still-gen.0-0.0.png/metadata").json()
-        assert still["media"] is None
+        assert still["media"] == {
+            "kind": "image",
+            "width": 4,
+            "height": 4,
+            "mode": "RGB",
+        }
 
 
 def test_gallery_metadata_accepts_an_output_reference(server, tmp_path):
@@ -6068,7 +6108,12 @@ def test_gallery_metadata_reads_an_asset_reference(asset_server, tmp_path):
         # an image asset carries no media block, the same as an image output
         still = client.get("/api/gallery/asset:still.png/metadata").json()
         assert still["source"] == "asset"
-        assert still["media"] is None
+        assert still["media"] == {
+            "kind": "image",
+            "width": 4,
+            "height": 4,
+            "mode": "RGB",
+        }
 
         # and an output is unchanged - it still says where it came from
         write_wav(tmp_path / "outputs" / "score-gen.0-0.0.wav", seconds=1.0)
diff --git a/tests/test_server_guides.py b/tests/test_server_guides.py
index f5495438..45ba1d45 100644
--- a/tests/test_server_guides.py
+++ b/tests/test_server_guides.py
@@ -316,6 +316,51 @@ def test_the_authoring_section_states_the_cartesian_rule_and_the_loop(self):
         ):
             assert f"`{shape}`" in content, shape
 
+    def test_the_sweep_section_names_the_loop_and_only_real_tools(self):
+        """#890: a sweep is the existing tools called once per variant, so
+        the section has to name each one, and every tool-shaped name it
+        tells an agent to call has to exist on the MCP server."""
+        import asyncio
+        import re
+
+        from dw_mcp.client import DwClient
+        from dw_mcp.server import build_server
+
+        guide = guides.get_guide("workspaces", section="Running a sweep")
+        content = guide["content"]
+
+        assert guide["section"] == "Running a sweep"
+        loop = (
+            "create_workspace",
+            "use_workspace",
+            "set_note",
+            "get_workflow",
+            "save_workflow",
+            "validate_workflow",
+            "run_workflow",
+            "wait_for_job",
+            "list_jobs",
+            "get_job",
+            "get_gallery_metadata",
+            "list_gallery",
+            "keep_output",
+        )
+        for tool in loop:
+            assert f"`{tool}" in content, tool
+        for convention in (
+            "plan.estimate",
+            "reused",
+            "latest run",
+            "score ",
+            "judged_by",
+        ):
+            assert convention in content, convention
+
+        tools = {t.name for t in asyncio.run(build_server(DwClient()).list_tools())}
+        named = set(re.findall(r"`([a-z]+(?:_[a-z]+)+)\b", content))
+        not_tools = {"num_inference_steps", "judged_by"}
+        assert named - not_tools <= tools, sorted(named - not_tools - tools)
+
     def test_the_tasks_guide_carries_the_catalog_path_note(self):
         """TASKS.md links 49 example workflows by repo path - the most of any
         served guide."""
diff --git a/tests/test_server_jobs.py b/tests/test_server_jobs.py
index f26e60ed..1f8449aa 100644
--- a/tests/test_server_jobs.py
+++ b/tests/test_server_jobs.py
@@ -144,6 +144,43 @@ def test_a_database_without_the_columns_is_migrated(tmp_path):
     assert row["run_id"] is None and row["run_dir"] is None
 
 
+def test_a_v0_13_0_database_gains_the_columns_added_since(tmp_path):
+    """A jobs.sqlite as v0.13.0 wrote it - every column through
+    device_card, none of note/memory_key/rerun_of/kept - opens, gains the
+    four, and keeps its card fields as they were."""
+    import sqlite3
+
+    path = str(tmp_path / "v0.13.0.sqlite")
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE jobs (id TEXT PRIMARY KEY, workflow TEXT, status TEXT,"
+            " created_at REAL, started_at REAL, finished_at REAL, arguments TEXT,"
+            " spec TEXT, manifest TEXT, warnings TEXT, error TEXT, events TEXT,"
+            " workspace TEXT DEFAULT 'default', workflow_name TEXT, run_id TEXT,"
+            " run_dir TEXT, run_version INTEGER, acknowledged TEXT DEFAULT 'none',"
+            " host_memory_peak_rss_mb REAL, host_memory_job_peak_rss_mb REAL,"
+            " device TEXT, device_ordinal TEXT, device_card TEXT)"
+        )
+        connection.execute(
+            "INSERT INTO jobs (id, status, workspace, device, device_ordinal,"
+            " device_card) VALUES ('old-1', 'succeeded', 'w', 'cuda:1 Card',"
+            " 'cuda:1', 'Card')"
+        )
+
+    history = JobHistory(path)
+    with history._connect() as connection:
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
+        kept = connection.execute("SELECT kept FROM jobs").fetchone()[0]
+    assert {"note", "memory_key", "rerun_of", "kept"} <= columns
+    assert kept == 0
+    row = history.get("old-1")
+    assert row["workspace"] == "w" and "note" not in row and "rerun_of" not in row
+    assert history.device_ordinal("old-1") == "cuda:1"
+    assert history.peaks_for_key("any") == []
+    # Opening it again finds nothing left to add
+    JobHistory(path)
+
+
 def _for_each_workflow(**overrides):
     """Copied from tests/test_workflow.py's helper of the same name (Task 5) -
     not imported across test modules, per that task's convention."""
diff --git a/tests/test_server_loras.py b/tests/test_server_loras.py
index 9705902f..7a2aa0bb 100644
--- a/tests/test_server_loras.py
+++ b/tests/test_server_loras.py
@@ -7,6 +7,7 @@
 import pytest
 from fastapi.testclient import TestClient
 
+from dw.server import deps
 from dw.server.app import create_app
 from dw.server.jobs import JobManager
 from dw.server.routes import loras as lora_routes
@@ -232,6 +233,112 @@ def test_a_workflow_that_is_not_an_object_is_a_400(self, server):
         assert "models/listy" in response.json()["detail"]
 
 
+PEOPLE = "fal/MiniMax-H3-Realism-People-LoRA"
+PEOPLE_FILE = "h3-realism-people-t2v-i2v-r2v.safetensors"
+H3_TEMPLATE = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "workflows",
+    "templates",
+    "minimax",
+    "reference-to-video.json",
+)
+
+
+def people_entry(status, **overrides):
+    return entry(
+        model_name=PEOPLE,
+        weight_name=PEOPLE_FILE,
+        base_models=["MiniMaxAI/MiniMax-H3"],
+        workflow=["t2va", "fl2va"],
+        status=status,
+        **({"evidence": [{"note": "R3"}]} if status == "proven" else {}),
+        **overrides,
+    )
+
+
+def h3_people(workflow, for_each=None):
+    """The shipped reference-to-video template, its adapters swapped for
+    the realism file and its workflow for `workflow`."""
+    with open(H3_TEMPLATE, encoding="utf-8") as file:
+        definition = json.load(file)
+    # The ceiling is the host's business, not this check's
+    definition.pop("vram_estimate", None)
+    for step in definition["steps"]:
+        pipeline = step.get("pipeline") or {}
+        if pipeline.get("loras"):
+            pipeline["from_pretrained_arguments"]["workflow"] = workflow
+            pipeline["loras"] = [{"model_name": PEOPLE, "weight_name": PEOPLE_FILE}]
+            if for_each:
+                step["for_each"] = for_each
+    return definition
+
+
+def validated(server, workflow):
+    return server.post(
+        "/api/validate", json={"workflow": workflow}, params={"sizes": False}
+    ).json()
+
+
+class TestTheCatalogPlacesAnAdapter:
+    """#870: the server's validate reads the catalog before the file name."""
+
+    def test_a_trial_entry_warns_and_promoting_it_refuses(self, server):
+        assert (
+            server.put(
+                "/api/loras/minimax-h3/people", json={"entry": people_entry("trial")}
+            ).status_code
+            == 200
+        )
+        trial = validated(server, h3_people("ref2va"))
+        assert trial["valid"] is True, trial
+        assert any(
+            "minimax-h3/people" in warning and "trial" in warning
+            for warning in trial["warnings"]
+        ), trial["warnings"]
+        # The proven copy wins the shared file, and the listing changed
+        assert (
+            server.put(
+                "/api/loras/minimax-h3/people-proven",
+                json={"entry": people_entry("proven")},
+            ).status_code
+            == 200
+        )
+        proven = validated(server, h3_people("ref2va"))
+        assert proven["valid"] is False
+        assert "minimax-h3/people-proven" in proven["errors"][0]["message"]
+        clean = validated(server, h3_people("fl2va"))
+        assert clean["valid"] is True
+        assert not any(PEOPLE_FILE in warning for warning in clean["warnings"])
+
+    def test_one_build_per_listing_for_every_member(self, server, monkeypatch):
+        server.put(
+            "/api/loras/minimax-h3/people", json={"entry": people_entry("proven")}
+        )
+        builds = []
+        real = deps.catalog_index
+
+        def counted(entries):
+            builds.append(len(entries))
+            return real(entries)
+
+        monkeypatch.setattr(deps, "catalog_index", counted)
+        server.app.state.lora_indexes = None
+        workflow = h3_people(
+            "ref2va", for_each=[{"name": "wide"}, {"name": "closeup"}, {"name": "cu"}]
+        )
+        first = validated(server, workflow)
+        second = validated(server, workflow)
+        assert len(builds) == 1, builds
+        for answer in (first, second):
+            assert answer["valid"] is False
+            adapters = [
+                error
+                for error in answer["errors"]
+                if "minimax-h3/people" in error["message"]
+            ]
+            assert len(adapters) == 3, answer["errors"]
+
+
 @pytest.fixture
 def hub(monkeypatch):
     calls = {}
diff --git a/tests/test_server_workspaces.py b/tests/test_server_workspaces.py
index 2c8f8628..77a3b036 100644
--- a/tests/test_server_workspaces.py
+++ b/tests/test_server_workspaces.py
@@ -609,6 +609,9 @@ class FinishedJob:
         os.makedirs(run_dir, exist_ok=True)
         with open(os.path.join(run_dir, "still.png"), "wb") as handle:
             handle.write(b"png-bytes")
+        inputs = [{"reference": "asset:qa-cast/a.mp4", "kind": "asset"}]
+        with open(os.path.join(run_dir, "manifest.json"), "w") as handle:
+            json.dump({"steps": [], "inputs": inputs}, handle)
 
         with server() as client:
             manager = client.app.state.job_manager
@@ -629,6 +632,8 @@ class FinishedJob:
         assert metadata["job"] == {"id": "9bd7d90745c3", "status": "complete"}
         assert metadata["run_id"] == "20260905-101500-bbbbbbbb"
         assert metadata["version"] == 1
+        # #902: the lineage the source run recorded outlives the run
+        assert metadata["inputs"] == inputs
 
         sidecar = os.path.join(workspace_root.assets, "qa-cast", "manifest.json")
         with open(sidecar) as handle:
diff --git a/tests/test_shot_span_preflight.py b/tests/test_shot_span_preflight.py
index 85b04d48..a49b3300 100644
--- a/tests/test_shot_span_preflight.py
+++ b/tests/test_shot_span_preflight.py
@@ -11,7 +11,7 @@
 from dw import validation
 from dw.media import probe_metadata
 from dw.runs import activate_output_root, deactivate_output_root
-from dw.shot_span_preflight import shot_span_warnings
+from dw.shot_span_preflight import script_shot_name_errors, shot_span_warnings
 from dw.workflow import workflow_from_definition
 
 from tests.test_assess import write_mp4
@@ -174,3 +174,64 @@ def test_reachable_from_the_workflow_method(self, monkeypatch, tmp_path):
 
         assert len(warnings) == 1
         assert "'b'" in warnings[0]
+
+
+class TestScriptShotNames:
+    def _take(self, tmp_path):
+        import json
+
+        from dw.runs import MANIFEST_FILE_NAME
+        from dw.shots import shot_record
+
+        output_root = tmp_path / "out"
+        run_dir = output_root / "ep" / "20260101-000000-abc"
+        (run_dir / "final").mkdir(parents=True)
+        write_mp4(str(run_dir / "final" / "cut.mp4"), frames=48, fps=24)
+        records = [
+            shot_record("clip-shot@cold_open.0-0.0.mp4", 0, 24),
+            shot_record("clip-shot@reveal.0-0.0.mp4", 24, 24),
+        ]
+        manifest = {
+            "steps": [{"step": "join", "files": ["final/cut.mp4"], "shots": records}]
+        }
+        (run_dir / MANIFEST_FILE_NAME).write_text(json.dumps(manifest))
+        return str(output_root)
+
+    def _definition(self, shot):
+        return {
+            "id": "check",
+            "steps": [
+                {
+                    "name": "check",
+                    "task": {
+                        "command": "check_script",
+                        "arguments": {
+                            "audio": "output:ep/20260101-000000-abc/final/cut.mp4",
+                            "lines": [{"text": "hello", "shot": shot}],
+                        },
+                    },
+                    "result": {"content_type": "application/json"},
+                }
+            ],
+        }
+
+    def _errors(self, tmp_path, shot):
+        token = activate_output_root(self._take(tmp_path))
+        try:
+            return script_shot_name_errors(self._definition(shot))
+        finally:
+            deactivate_output_root(token)
+
+    def test_a_wrong_shot_name_is_an_error_at_validate_time(self, tmp_path):
+        errors = self._errors(tmp_path, "nope")
+        assert len(errors) == 1
+        assert "does not have" in errors[0]["message"]
+        assert "cold_open" in errors[0]["message"]
+
+    def test_the_short_name_and_the_full_name_pass(self, tmp_path):
+        token = activate_output_root(self._take(tmp_path))
+        try:
+            for shot in ("cold_open", "clip-shot@reveal.0-0.0.mp4"):
+                assert script_shot_name_errors(self._definition(shot)) == []
+        finally:
+            deactivate_output_root(token)
diff --git a/tests/test_stars.py b/tests/test_stars.py
new file mode 100644
index 00000000..4347a619
--- /dev/null
+++ b/tests/test_stars.py
@@ -0,0 +1,61 @@
+"""Stars: the "keep" mark on an output file, in the run's notes.json beside
+its notes (dw/notes.py), set through PUT /api/stars and carried on the
+gallery listing."""
+
+from dw import notes as N
+
+from .test_notes_api import (  # noqa: F401 - fixtures
+    client,
+    make_run,
+    output_root,
+    run_name,
+    studio,
+)
+
+
+def test_star_round_trip_keeps_notes(tmp_path):
+    N.set_file_note(str(tmp_path), "a.png", "keeper")
+    assert N.set_file_starred(str(tmp_path), "a.png", True) is True
+    assert N.read_starred(str(tmp_path)) == {"a.png"}
+    # A note written after the star leaves it, and the other way round
+    N.set_run_note(str(tmp_path), "run note")
+    assert N.read_starred(str(tmp_path)) == {"a.png"}
+    assert N.read_notes(str(tmp_path))["files"] == {"a.png": "keeper"}
+
+
+def test_unstarring_the_last_file_with_no_notes_removes_the_sidecar(tmp_path):
+    N.set_file_starred(str(tmp_path), "a.png", True)
+    N.set_file_starred(str(tmp_path), "a.png", False)
+    assert not (tmp_path / N.NOTES_FILE_NAME).exists()
+
+
+def test_dropping_a_file_drops_its_star(tmp_path):
+    N.set_file_starred(str(tmp_path), "a.png", True)
+    N.drop_file_note(str(tmp_path), "a.png")
+    assert N.read_starred(str(tmp_path)) == set()
+
+
+def test_put_star_and_the_listing_carries_it(client, output_root, make_run):
+    run_dir = make_run("wf", ["a.png", "b.png"])
+    run = run_name(run_dir, output_root)
+    r = client.put("/api/stars", json={"name": f"{run}/a.png", "starred": True})
+    assert r.status_code == 200
+    assert r.json() == {"name": f"{run}/a.png", "starred": True}
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert files["a.png"]["starred"] is True
+    assert "starred" not in files["b.png"]
+    client.put("/api/stars", json={"name": f"{run}/a.png", "starred": False})
+    files = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert "starred" not in files["a.png"]
+
+
+def test_only_an_output_file_can_be_starred(client, output_root, make_run):
+    run = run_name(make_run("wf", ["a.png"]), output_root)
+    for name in (run, "workspace:default", "asset:x.png"):
+        r = client.put("/api/stars", json={"name": name, "starred": True})
+        assert r.status_code == 400, name
+
+
+def test_put_star_refuses_traversal(client):
+    r = client.put("/api/stars", json={"name": "../../etc/passwd", "starred": True})
+    assert r.status_code in (400, 404)
diff --git a/tests/test_step_timing.py b/tests/test_step_timing.py
new file mode 100644
index 00000000..3884ca3c
--- /dev/null
+++ b/tests/test_step_timing.py
@@ -0,0 +1,637 @@
+"""Per-step timing (#867): the StepTimer's arithmetic on a fake clock, its
+ambient marks, and what a step's manifest entry and `step_end` carry."""
+
+import pytest
+import torch
+from PIL import Image
+from unittest.mock import patch
+
+from dw.pipeline_processors import timing as timing_module
+from dw.pipeline_processors.pipeline import Pipeline
+from dw.pipeline_processors.timing import (
+    StepTimer,
+    denoise_start_hook,
+    is_compiled,
+    mark,
+    timed_step,
+)
+from dw.server.api_models import ManifestEntry
+from dw.step_cache import step_cache
+from dw.workflow import Workflow
+from dw import workflow_run as workflow_run_module
+
+PLAN_KEYS = {
+    "load_s",
+    "load_cached",
+    "encode_s",
+    "denoise_s",
+    "passes",
+    "first_pass_s",
+    "pass_s",
+    "compiled",
+    "decode_s",
+    "save_s",
+    "segments",
+}
+
+
+class FakeClock:
+    """A monotonic clock the test advances by hand."""
+
+    def __init__(self):
+        self.now = 0.0
+
+    def at(self, seconds):
+        self.now = seconds
+        return self.now
+
+    def __call__(self):
+        return self.now
+
+
+def marked(clock, timer, *events):
+    """Apply (time, mark name[, args]) events to the timer in order."""
+    for time_, name, *args in events:
+        clock.at(time_)
+        getattr(timer, name)(*args)
+
+
+def new_timer():
+    clock = FakeClock()
+    return clock, StepTimer(clock=clock)
+
+
+def test_a_full_step_reports_every_span():
+    clock, timer = new_timer()
+    marked(
+        clock,
+        timer,
+        (1.0, "load_started"),
+        (1.0, "load_cached", True),
+        (3.04, "load_ended"),
+        (3.04, "call_started", False),
+        (5.0, "denoise_started"),
+        (6.0, "pass_ended"),
+        (7.0, "pass_ended"),
+        (8.0, "pass_ended"),
+        (9.5, "call_ended"),
+        (9.5, "save_started"),
+        (10.0, "save_ended"),
+    )
+
+    assert timer.timing() == {
+        "load_s": 2.0,
+        "load_cached": True,
+        "encode_s": 2.0,
+        "denoise_s": 3.0,
+        "passes": 3,
+        "first_pass_s": 1.0,
+        "pass_s": 1.0,
+        "compiled": False,
+        "decode_s": 1.5,
+        "save_s": 0.5,
+        "segments": 1,
+    }
+
+
+def test_every_seconds_field_is_rounded_to_a_tenth():
+    clock, timer = new_timer()
+    marked(
+        clock,
+        timer,
+        (0.0, "load_started"),
+        (0.26, "load_ended"),
+        (0.26, "call_started"),
+        (0.57, "denoise_started"),
+        (1.0, "pass_ended"),
+        (1.5, "pass_ended"),
+        (1.84, "call_ended"),
+        (1.84, "save_started"),
+        (1.9, "save_ended"),
+    )
+
+    result = timer.timing()
+
+    assert result["load_s"] == 0.3
+    assert result["encode_s"] == 0.3
+    assert result["first_pass_s"] == 0.4
+    assert result["pass_s"] == 0.5
+    assert result["decode_s"] == 0.3
+    assert result["save_s"] == 0.1
+
+
+def test_a_missing_denoise_start_nulls_encode_and_first_pass():
+    clock, timer = new_timer()
+    marked(
+        clock,
+        timer,
+        (0.0, "call_started"),
+        (2.0, "pass_ended"),
+        (3.0, "pass_ended"),
+        (4.0, "call_ended"),
+    )
+
+    result = timer.timing()
+
+    assert result["encode_s"] is None
+    assert result["first_pass_s"] is None
+    assert result["denoise_s"] is None
+    assert result["passes"] == 2
+    assert result["decode_s"] == 1.0
+
+
+def test_missing_load_and_save_marks_are_null_not_guessed():
+    clock, timer = new_timer()
+    marked(clock, timer, (0.0, "call_started"), (1.0, "call_ended"))
+    result = timer.timing()
+
+    assert result["load_s"] is None
+    assert result["load_cached"] is None
+    assert result["save_s"] is None
+    assert result["compiled"] is None
+
+    marked(clock, timer, (2.0, "save_started"))
+    assert timer.timing()["save_s"] is None
+
+
+def test_a_timer_with_no_call_has_no_segments_and_no_spans():
+    _, timer = new_timer()
+
+    result = timer.timing()
+
+    assert result["segments"] == 0
+    assert result["passes"] is None
+    assert result["encode_s"] is None
+    assert result["denoise_s"] is None
+    assert result["pass_s"] is None
+
+
+def test_pass_s_is_the_median_of_the_intervals_not_the_mean():
+    clock, timer = new_timer()
+    # Pass ends at 1, 2, 3, 13: intervals 1, 1, 10 - median 1, mean 4
+    marked(
+        clock,
+        timer,
+        (0.0, "call_started"),
+        (0.0, "denoise_started"),
+        (1.0, "pass_ended"),
+        (2.0, "pass_ended"),
+        (3.0, "pass_ended"),
+        (13.0, "pass_ended"),
+        (14.0, "call_ended"),
+    )
+
+    assert timer.timing()["pass_s"] == 1.0
+
+
+def test_pass_s_is_null_with_fewer_than_two_passes():
+    clock, timer = new_timer()
+    marked(
+        clock,
+        timer,
+        (0.0, "call_started"),
+        (0.0, "denoise_started"),
+        (1.0, "pass_ended"),
+        (2.0, "call_ended"),
+    )
+
+    result = timer.timing()
+
+    assert result["passes"] == 1
+    assert result["pass_s"] is None
+    assert result["first_pass_s"] == 1.0
+
+
+def test_a_chain_sums_its_segments_and_takes_one_median_over_both():
+    clock, timer = new_timer()
+    marked(
+        clock,
+        timer,
+        # Segment 1: encode 1, passes end 3 and 4 and 9 (intervals 1, 5), decode 1
+        (0.0, "call_started"),
+        (1.0, "denoise_started"),
+        (3.0, "pass_ended"),
+        (4.0, "pass_ended"),
+        (9.0, "pass_ended"),
+        (10.0, "call_ended"),
+        # Segment 2: encode 2, passes end 14 and 15 (interval 1), decode 3
+        (20.0, "call_started"),
+        (22.0, "denoise_started"),
+        (24.0, "pass_ended"),
+        (25.0, "pass_ended"),
+        (28.0, "call_ended"),
+    )
+
+    result = timer.timing()
+
+    assert result["segments"] == 2
+    assert result["encode_s"] == 3.0
+    assert result["denoise_s"] == 8.0 + 3.0
+    assert result["decode_s"] == 4.0
+    assert result["first_pass_s"] == 2.0 + 2.0
+    assert result["passes"] == 5
+    # Intervals 1, 5 and 1; the gap between the segments is no interval
+    assert result["pass_s"] == 1.0
+
+
+def test_a_segment_with_no_denoise_start_and_no_passes_is_all_denoise():
+    clock, timer = new_timer()
+    marked(clock, timer, (2.0, "call_started"), (7.0, "call_ended"))
+
+    result = timer.timing()
+
+    assert result["denoise_s"] == 5.0
+    assert result["encode_s"] is None
+    assert result["decode_s"] is None
+    assert result["passes"] is None
+
+
+def test_load_cached_stays_false_once_any_load_was_fresh():
+    _, timer = new_timer()
+
+    timer.load_cached(False)
+    timer.load_cached(True)
+
+    assert timer.timing()["load_cached"] is False
+
+
+def test_load_cached_true_holds_when_every_load_was_cached():
+    _, timer = new_timer()
+
+    timer.load_cached(True)
+    timer.load_cached(True)
+
+    assert timer.timing()["load_cached"] is True
+
+
+def test_mark_with_no_timer_open_does_nothing():
+    mark("call_started")
+    mark("pass_ended")
+
+
+def test_mark_reaches_the_open_timer():
+    clock, timer = new_timer()
+
+    with timed_step(timer):
+        mark("call_started", compiled=True)
+
+    assert timer.timing()["segments"] == 1
+    assert timer.timing()["compiled"] is True
+
+
+def test_a_step_with_no_timer_hides_the_outer_one_and_restores_it():
+    clock, outer = new_timer()
+
+    with timed_step(outer):
+        with timed_step(None):
+            mark("call_started")
+            assert timing_module.current_timer() is None
+        assert timing_module.current_timer() is outer
+        mark("call_started")
+
+    assert outer.timing()["segments"] == 1
+    assert timing_module.current_timer() is None
+
+
+def test_the_denoise_hook_marks_the_first_forward_once_and_removes_itself():
+    module = torch.nn.Linear(2, 2)
+    timer = StepTimer()
+
+    with timed_step(timer):
+        timer.call_started()
+        with denoise_start_hook(module):
+            module(torch.zeros(1, 2))
+            assert not module._forward_pre_hooks
+            segment = timer._segments[0]
+            first = segment.denoise_started
+            module(torch.zeros(1, 2))
+
+    assert first is not None
+    assert segment.denoise_started == first
+
+
+def test_the_denoise_hook_is_removed_when_forward_never_ran():
+    module = torch.nn.Linear(2, 2)
+
+    with denoise_start_hook(module):
+        assert len(module._forward_pre_hooks) == 1
+
+    assert not module._forward_pre_hooks
+
+
+def _compiled_linear(**options):
+    """A tiny Linear compiled in place the way `apply_compile` does it, or a
+    skip where torch.compile cannot run on this platform."""
+    module = torch.nn.Linear(2, 2)
+    try:
+        module.compile(**options)
+        module(torch.zeros(1, 2))
+    except Exception as error:  # pragma: no cover - platform dependent
+        pytest.skip(f"torch.compile is unavailable here: {error}")
+    return module
+
+
+def test_a_fullgraph_compiled_denoiser_runs_and_still_gets_the_start_mark():
+    # A forward pre-hook runs inside the compiled `_call_impl`, where its
+    # clock read is untraceable and fullgraph=True fails the first step
+    module = _compiled_linear(fullgraph=True)
+    original = module._compiled_call_impl
+    timer = StepTimer()
+
+    with timed_step(timer):
+        timer.call_started()
+        with denoise_start_hook(module):
+            module(torch.zeros(1, 2))
+            first = timer._segments[0].denoise_started
+            module(torch.zeros(1, 2))
+
+    assert first is not None
+    assert timer._segments[0].denoise_started == first
+    assert module._compiled_call_impl is original
+
+
+def test_a_compiled_denoiser_is_restored_when_forward_never_ran():
+    module = torch.nn.Linear(2, 2)
+    original = lambda *args, **kwargs: None  # noqa: E731
+    module._compiled_call_impl = original
+
+    with denoise_start_hook(module):
+        assert module._compiled_call_impl is not original
+
+    assert module._compiled_call_impl is original
+
+
+def test_repeated_blocks_compiled_keeps_the_pre_hook_on_the_eager_parent():
+    child = _compiled_linear(fullgraph=True)
+    parent = torch.nn.Sequential(child)
+    timer = StepTimer()
+
+    with timed_step(timer):
+        timer.call_started()
+        with denoise_start_hook(parent):
+            assert len(parent._forward_pre_hooks) == 1
+            parent(torch.zeros(1, 2))
+            assert not parent._forward_pre_hooks
+
+    assert timer._segments[0].denoise_started is not None
+
+
+def test_a_plain_module_is_not_compiled():
+    assert is_compiled(torch.nn.Sequential(torch.nn.Linear(2, 2))) is False
+
+
+def test_a_module_with_a_compiled_child_is_compiled():
+    child = torch.nn.Linear(2, 2)
+    child._compiled_call_impl = lambda *args, **kwargs: None
+    parent = torch.nn.Sequential(child)
+
+    assert is_compiled(parent) is True
+
+
+def test_no_module_means_compiled_is_unknown():
+    assert is_compiled(None) is None
+
+
+# --- the manifest entry and step_end -------------------------------------
+
+
+class RecordingContext:
+    def __init__(self):
+        self.events = []
+
+    def emit(self, event, **fields):
+        self.events.append((event, fields))
+
+
+class FakeLoop:
+    def __init__(self):
+        self.steps = [None]
+        self.workflow_id = "wf"
+        self.run_context = RecordingContext()
+
+
+class FakeStepResult:
+    selected = None
+    saved_shots = None
+
+
+class FakeWorkflow:
+    def __init__(self):
+        self.manifest = []
+
+    def _parent_progress_fields(self):
+        return {}
+
+
+def record(timing, reused):
+    workflow, loop = FakeWorkflow(), FakeLoop()
+    workflow_run_module.record_step(
+        workflow,
+        loop,
+        0,
+        {"name": "generate"},
+        (FakeStepResult(), ["generate.png"], reused, False),
+        [],
+        timing=timing,
+    )
+    end = [fields for event, fields in loop.run_context.events if event == "step_end"]
+    return workflow.manifest[0], end[0]
+
+
+def full_timing(**overrides):
+    return dict.fromkeys(PLAN_KEYS) | {"segments": 1} | overrides
+
+
+def test_a_step_that_ran_carries_its_timing_in_entry_and_step_end():
+    timing = full_timing(load_s=1.5)
+
+    entry, step_end = record(timing, reused=False)
+
+    assert entry["timing"] == timing
+    assert step_end["timing"] == timing
+
+
+def test_a_reused_step_carries_no_timing_even_when_one_is_passed():
+    entry, step_end = record(full_timing(), reused=True)
+
+    assert entry["reused"] is True
+    assert "timing" not in entry
+    assert "timing" not in step_end
+
+
+def test_a_step_nothing_timed_carries_no_timing():
+    entry, step_end = record(None, reused=False)
+
+    assert "timing" not in entry
+    assert "timing" not in step_end
+
+
+class FakeDiffusionPipeline:
+    """Called like a diffusers pipeline: no step callback, so the call is all
+    there is to time."""
+
+    def __call__(self, **kwargs):
+        return type("Output", (), {"images": [Image.new("RGB", (8, 8))]})()
+
+
+def _load_fake_pipeline(self, shared_components):
+    self.pipeline = FakeDiffusionPipeline()
+
+
+def run_workflow(tmp_path, step):
+    step_cache.clear()
+    workflow = Workflow(
+        {"id": "timing_test", "seed": 1, "steps": [step]}, str(tmp_path), "test.json"
+    )
+    with patch.object(Pipeline, "load", _load_fake_pipeline):
+        workflow.run({})
+    return workflow
+
+
+def test_a_pipeline_step_run_through_the_step_loop_records_its_timing(tmp_path):
+    workflow = run_workflow(
+        tmp_path,
+        {
+            "name": "generate",
+            "pipeline": {
+                "configuration": {"component_type": "{MockPipeline}"},
+                "from_pretrained_arguments": {"model_name": "model-generate"},
+                "arguments": {"prompt": "a cat"},
+            },
+        },
+    )
+
+    timing = workflow.manifest[0]["timing"]
+
+    assert set(timing) == PLAN_KEYS
+    assert timing["segments"] >= 1
+    assert timing["save_s"] is not None
+    assert timing["load_s"] is not None
+    ManifestEntry.model_validate(workflow.manifest[0])
+
+
+def test_a_task_step_run_through_the_step_loop_has_no_timing(tmp_path):
+    source = tmp_path / "source.png"
+    Image.new("RGB", (8, 8)).save(source)
+
+    workflow = run_workflow(
+        tmp_path / "out",
+        {
+            "name": "grade",
+            "task": {
+                "command": "grade",
+                "arguments": {"media": str(source), "contrast": 0.1},
+            },
+            "result": {"content_type": "image/png"},
+        },
+    )
+
+    assert workflow.manifest[0]["step"] == "grade"
+    assert "timing" not in workflow.manifest[0]
+
+
+# --- the response model ---------------------------------------------------
+
+
+def test_a_manifest_entry_without_timing_serializes_without_the_key():
+    entry = ManifestEntry.model_validate(
+        {"step": "generate", "files": ["a.png"], "subfolder": ""}
+    )
+
+    assert "timing" not in entry.model_dump(exclude_unset=True)
+    assert "timing" not in entry.model_dump(exclude_none=True)
+
+
+def test_a_manifest_entry_with_timing_validates_and_round_trips():
+    timing = full_timing(
+        load_s=1.2,
+        load_cached=False,
+        encode_s=0.5,
+        denoise_s=10.0,
+        passes=20,
+        first_pass_s=1.0,
+        pass_s=0.4,
+        compiled=True,
+        decode_s=0.7,
+        save_s=0.1,
+    )
+    payload = {
+        "step": "generate",
+        "files": ["a.png"],
+        "subfolder": "",
+        "timing": timing,
+    }
+
+    entry = ManifestEntry.model_validate(payload)
+
+    assert entry.model_dump(exclude_unset=True) == payload
+    assert ManifestEntry.model_validate(entry.model_dump(exclude_unset=True)) == entry
+
+
+def test_a_timing_with_a_mistyped_field_is_refused():
+    with pytest.raises(ValueError):
+        ManifestEntry.model_validate(
+            {"step": "s", "files": [], "subfolder": "", "timing": {"segments": "x"}}
+        )
+
+
+def test_default_clock_syncs_the_device_before_reading(monkeypatch):
+    """#896: on an async backend a mark must wait for queued work."""
+    calls = []
+    monkeypatch.setattr(timing_module, "get_device_type", lambda: "mps")
+    monkeypatch.setattr(torch.mps, "synchronize", lambda: calls.append("sync"))
+    timer = StepTimer()
+    timer.call_started()
+    timer.pass_ended()
+    timer.call_ended()
+    assert calls == ["sync"] * 3
+
+
+def test_default_clock_does_not_sync_on_cpu(monkeypatch):
+    monkeypatch.setattr(timing_module, "get_device_type", lambda: "cpu")
+    monkeypatch.setattr(torch.mps, "synchronize", lambda: pytest.fail("synced on cpu"))
+    StepTimer().load_started()
+
+
+def _passes(clock, timer, cached, first, steady):
+    timer.load_cached(cached)
+    marked(
+        clock,
+        timer,
+        (0.0, "call_started"),
+        (1.0, "denoise_started"),
+        (1.0 + first, "pass_ended"),
+        (1.0 + first + steady, "pass_ended"),
+        (1.0 + first + 2 * steady, "pass_ended"),
+        (2.0 + first + 2 * steady, "call_ended"),
+    )
+
+
+def test_a_cached_pipeline_whose_first_pass_dwarfs_the_rest_warns_once(monkeypatch):
+    """#924: 202 s then 37 s/pass on a loaded pipeline is said, not silent."""
+    warnings = []
+    monkeypatch.setattr(
+        timing_module, "emit_warning", lambda message, **data: warnings.append(data)
+    )
+    clock, timer = new_timer()
+    _passes(clock, timer, True, 202.0, 37.0)
+    assert len(warnings) == 1
+    assert warnings[0]["kind"] == "first_pass_slow"
+    assert warnings[0]["first_pass_s"] == 202.0
+    assert warnings[0]["pass_s"] == 37.0
+
+
+@pytest.mark.parametrize(
+    "cached, first, steady",
+    [(True, 29.0, 28.4), (True, 60.0, 37.0), (False, 202.0, 37.0)],
+)
+def test_no_warning_for_a_normal_first_pass_or_a_fresh_load(
+    monkeypatch, cached, first, steady
+):
+    warnings = []
+    monkeypatch.setattr(
+        timing_module, "emit_warning", lambda message, **data: warnings.append(data)
+    )
+    clock, timer = new_timer()
+    _passes(clock, timer, cached, first, steady)
+    assert warnings == []
diff --git a/tests/test_unbraced_type_warning.py b/tests/test_unbraced_type_warning.py
new file mode 100644
index 00000000..005651bc
--- /dev/null
+++ b/tests/test_unbraced_type_warning.py
@@ -0,0 +1,45 @@
+"""#926: an unbraced type name handed to a `*_dtype` key warns at validate."""
+
+from dw.type_references import unbraced_type_warnings
+from dw.validation import WARNING_CHECKS
+
+
+def _definition(value, extra=None):
+    return {
+        "steps": [
+            {
+                "name": "s",
+                "pipeline": {
+                    "configuration": {"component_type": "{x}"},
+                    "arguments": {"weights_dtype": value, **(extra or {})},
+                },
+            }
+        ],
+    }
+
+
+def test_unbraced_name_warns_with_the_braced_spelling():
+    warnings = unbraced_type_warnings(_definition("int8"))
+    assert len(warnings) == 1
+    assert "{int8}" in warnings[0] and "weights_dtype" in warnings[0]
+
+
+def test_braced_name_is_quiet():
+    assert unbraced_type_warnings(_definition("{int8}")) == []
+
+
+def test_a_real_diffusers_type_is_quiet():
+    assert unbraced_type_warnings(_definition("DiffusionPipeline")) == []
+
+
+def test_dotted_name_is_left_to_the_trust_gate():
+    assert unbraced_type_warnings(_definition("os.path")) == []
+
+
+def test_media_reference_media_type_is_quiet():
+    media = {"media_type": "image", "location": "x.png"}
+    assert unbraced_type_warnings(_definition("{int8}", {"image": media})) == []
+
+
+def test_registered_as_a_warning_check():
+    assert "unbraced_type_warnings" in [c.name for c in WARNING_CHECKS]
diff --git a/tests/test_validate_arguments.py b/tests/test_validate_arguments.py
index e154ed62..730d56e0 100644
--- a/tests/test_validate_arguments.py
+++ b/tests/test_validate_arguments.py
@@ -537,6 +537,27 @@ def test_save_workflow_accepts_the_document_with_a_warning(self, server):
         assert any("audio" in warning for warning in response.json()["warnings"])
 
 
+def test_save_workflow_carries_the_acceleration_warnings(server):
+    """#887: a save answers the acceleration warnings validate gives, and
+    still saves - they never refuse."""
+    from .test_validation import TestAccelerationWarnings
+
+    definition = TestAccelerationWarnings.definition(
+        cache={"type": "first_block"},
+        steps=12,
+        components={"transformer": {"compile": {"fullgraph": True}}},
+    )
+    with server() as client:
+        response = client.put(
+            "/api/workflows/AccelerationSaved", json={"workflow": definition}
+        )
+
+    assert response.status_code == 200
+    warnings = response.json()["warnings"]
+    assert any("cache_short_schedule" in warning for warning in warnings)
+    assert any("compile_fullgraph_with_cache" in warning for warning in warnings)
+
+
 def test_an_entry_key_no_step_reads_is_a_warning_not_an_error(server):
     workflow = {
         "id": "cut",
diff --git a/tests/test_validation.py b/tests/test_validation.py
index a19f7224..b55ddb58 100644
--- a/tests/test_validation.py
+++ b/tests/test_validation.py
@@ -178,6 +178,7 @@ def test_validation_does_not_import_the_workflow_module():
     "previous_result_references",
     "subfolders",
     "fps",
+    "cache",
     "reference_names",
     "video_extensions",
     "hold_audio",
@@ -192,6 +193,7 @@ def test_validation_does_not_import_the_workflow_module():
     "adapters",
     "task_argument_domains",
     "dissolve_frames",
+    "script_shot_names",
     "window_count",
     "video_sizes",
     "select",
@@ -298,6 +300,7 @@ def test_a_childs_pathless_finding_is_placed_at_the_sub_workflow_step(
 
 WARNING_ORDER = [
     "workflow_argument_warnings",
+    "unbraced_type_warnings",
     "constraint_warnings",
     "entry_field_warnings",
     "unseeded_cache_warnings",
@@ -307,6 +310,7 @@ def test_a_childs_pathless_finding_is_placed_at_the_sub_workflow_step(
     "slice_past_end_warnings",
     "shot_span_warnings",
     "inherited_vram_warnings",
+    "acceleration_warnings",
 ]
 
 
@@ -397,6 +401,9 @@ def test_a_warning_method_on_an_unexpandable_definition_says_it_failed(tmp_path)
                 ceiling_index={"identity": {}},
             )
         ),
+        "acceleration_warnings": lambda: validation.run_warning_check(
+            workflow, "acceleration_warnings", None
+        ),
     }
     for name, call in calls.items():
         assert call() == [
@@ -433,3 +440,591 @@ def test_a_pipeline_configuration_naming_teacache_is_refused():
     errors = Workflow(definition, ".", "teacache-removed.json").validation_errors()
 
     assert any("teacache" in str(error["message"]) for error in errors), errors
+
+
+class TestAccelerationWarnings:
+    """dw/acceleration_warnings.py through the real path: a Workflow, its
+    expansion, the registry check. Every code is a warning, never a refusal,
+    and a value unknown before the run leaves its warning silent."""
+
+    CODES = (
+        "cache_short_schedule",
+        "taylorseer_state_unestimated",
+        "compile_fullgraph_with_cache",
+        "attention_backend_unavailable",
+        "cache_unsupported",
+    )
+
+    @staticmethod
+    def definition(
+        cache=None,
+        steps=20,
+        components=None,
+        attention_backend=None,
+        variables=None,
+        extra=None,
+    ):
+        configuration = {"component_type": "FluxPipeline"}
+        if cache is not None:
+            configuration["cache"] = cache
+        if components is not None:
+            configuration["components"] = components
+        if attention_backend is not None:
+            configuration["attention_backend"] = attention_backend
+        arguments = {"prompt": "a cat"}
+        if steps is not None:
+            arguments["num_inference_steps"] = steps
+        definition = {
+            "id": "accel",
+            "steps": [
+                {
+                    "name": "gen",
+                    "pipeline": {
+                        "configuration": configuration,
+                        "from_pretrained_arguments": {
+                            "model_name": "black-forest-labs/FLUX.1-dev"
+                        },
+                        "arguments": arguments,
+                    },
+                }
+            ],
+        }
+        if variables is not None:
+            definition["variables"] = variables
+        definition.update(extra or {})
+        return definition
+
+    @staticmethod
+    def workflow(definition):
+        from dw.workflow import Workflow
+
+        return Workflow(definition, None, "")
+
+    def run(self, monkeypatch, definition, arguments=None, device="cuda", **fields):
+        monkeypatch.setattr(validation, "get_device_type", lambda: device)
+        return validation.run_warning_check(
+            self.workflow(definition), "acceleration_warnings", arguments, **fields
+        )
+
+    def direct(self, definition, **fields):
+        """A hand-built context, for the fields run_warning_check cannot
+        leave None (capacity_gb) or the device it cannot name."""
+        workflow = self.workflow(definition)
+        source_indices = []
+        expanded = workflow.expanded_definition(None, source_indices)
+        from dw.acceleration_warnings import acceleration_warnings
+
+        values = {
+            "workflow": workflow,
+            "expanded": expanded,
+            "source_indices": source_indices,
+            "device_type": "cuda",
+        }
+        values.update(fields)
+        return acceleration_warnings(context(**values))
+
+    @staticmethod
+    def coded(warnings, code):
+        return [w for w in warnings if f": {code}:" in w]
+
+    # cache_unsupported (#904): the real pipeline classes, nothing mocked
+
+    @pytest.mark.parametrize(
+        "component_type, names",
+        [
+            ("StableDiffusionPipeline", "no transformer"),
+            ("ZImagePipeline", "ZImageTransformer2DModel"),
+        ],
+    )
+    def test_a_cache_with_nothing_to_attach_to_warns(
+        self, monkeypatch, component_type, names
+    ):
+        definition = self.definition({"type": "first_block"}, steps=30)
+        pipeline = definition["steps"][0]["pipeline"]
+        pipeline["configuration"]["component_type"] = component_type
+
+        found = self.coded(self.run(monkeypatch, definition), "cache_unsupported")
+
+        assert len(found) == 1
+        assert "first_block" in found[0]
+        assert names in found[0] or "transformer component" in found[0]
+
+    def test_a_cache_on_a_transformer_that_supports_it_is_silent(self, monkeypatch):
+        warnings = self.run(monkeypatch, self.definition({"type": "first_block"}, 30))
+
+        assert self.coded(warnings, "cache_unsupported") == []
+
+    def test_no_cache_means_no_cache_unsupported(self, monkeypatch):
+        definition = self.definition(None)
+        definition["steps"][0]["pipeline"]["configuration"]["component_type"] = (
+            "StableDiffusionPipeline"
+        )
+
+        assert self.coded(self.run(monkeypatch, definition), "cache_unsupported") == []
+
+    # cache_short_schedule
+
+    def test_a_threshold_cache_fires_below_twenty_steps_and_not_at_twenty(
+        self, monkeypatch
+    ):
+        cache = {"type": "first_block"}
+        short = self.run(monkeypatch, self.definition(cache, steps=19))
+        enough = self.run(monkeypatch, self.definition(cache, steps=20))
+
+        found = self.coded(short, "cache_short_schedule")
+        assert len(found) == 1
+        assert "19 steps" in found[0]
+        assert "first_block" in found[0]
+        assert self.coded(enough, "cache_short_schedule") == []
+
+    @pytest.mark.parametrize("cache_type", ["first_block", "mag"])
+    def test_both_threshold_caches_fire_at_twelve_steps(self, monkeypatch, cache_type):
+        warnings = self.run(
+            monkeypatch, self.definition({"type": cache_type}, steps=12)
+        )
+
+        assert len(self.coded(warnings, "cache_short_schedule")) == 1
+
+    @pytest.mark.parametrize("cache_type", ["taylorseer", "faster", "text_kv"])
+    def test_the_other_caches_are_not_held_to_the_schedule_rule(
+        self, monkeypatch, cache_type
+    ):
+        warnings = self.run(monkeypatch, self.definition({"type": cache_type}, steps=9))
+
+        assert self.coded(warnings, "cache_short_schedule") == []
+
+    def test_steps_come_from_a_variable_default(self, monkeypatch):
+        definition = self.definition(
+            {"type": "first_block"},
+            steps="variable:steps",
+            variables={"steps": 12},
+        )
+
+        warnings = self.run(monkeypatch, definition)
+
+        found = self.coded(warnings, "cache_short_schedule")
+        assert len(found) == 1 and "12 steps" in found[0]
+
+    def test_steps_come_from_an_argument_over_the_default(self, monkeypatch):
+        definition = self.definition(
+            {"type": "first_block"},
+            steps="variable:steps",
+            variables={"steps": 30},
+        )
+
+        short = self.run(monkeypatch, definition, {"steps": 9})
+        default = self.run(monkeypatch, definition)
+
+        assert len(self.coded(short, "cache_short_schedule")) == 1
+        assert self.coded(default, "cache_short_schedule") == []
+
+    def test_steps_that_resolve_to_nothing_are_silent(self, monkeypatch):
+        definition = self.definition(
+            {"type": "first_block"},
+            steps="variable:steps",
+            variables={"steps": None},
+        )
+
+        assert (
+            self.coded(self.run(monkeypatch, definition), "cache_short_schedule") == []
+        )
+
+    def test_no_num_inference_steps_is_silent(self, monkeypatch):
+        definition = self.definition({"type": "first_block"}, steps=None)
+
+        assert (
+            self.coded(self.run(monkeypatch, definition), "cache_short_schedule") == []
+        )
+
+    # taylorseer_state_unestimated
+
+    def test_taylorseer_always_says_its_state_is_unestimated(self, monkeypatch):
+        default = self.run(monkeypatch, self.definition({"type": "taylorseer"}))
+        second = self.run(
+            monkeypatch, self.definition({"type": "taylorseer", "max_order": 2})
+        )
+
+        first = self.coded(default, "taylorseer_state_unestimated")
+        higher = self.coded(second, "taylorseer_state_unestimated")
+        assert len(first) == 1 and "this one is 1" in first[0]
+        assert len(higher) == 1 and "this one is 2" in higher[0]
+
+    def test_taylorseer_names_the_declared_estimate_against_the_capacity(
+        self, monkeypatch
+    ):
+        definition = self.definition(
+            {"type": "taylorseer"},
+            extra={
+                "vram_estimate": {
+                    "base_gb": 10,
+                    "gb_per_voxel": 0,
+                    "voxel_variables": [],
+                }
+            },
+        )
+
+        warnings = self.run(monkeypatch, definition, capacity_gb=24)
+
+        found = self.coded(warnings, "taylorseer_state_unestimated")
+        assert len(found) == 1
+        assert "10.0 of 24.0 GB" in found[0]
+
+    def test_taylorseer_without_capacity_carries_no_gb_clause(self):
+        definition = self.definition(
+            {"type": "taylorseer"},
+            extra={
+                "vram_estimate": {
+                    "base_gb": 10,
+                    "gb_per_voxel": 0,
+                    "voxel_variables": [],
+                }
+            },
+        )
+
+        warnings = self.direct(definition, capacity_gb=None)
+
+        found = self.coded(warnings, "taylorseer_state_unestimated")
+        assert len(found) == 1 and "GB" not in found[0]
+
+    def test_taylorseer_without_a_declared_estimate_carries_no_gb_clause(
+        self, monkeypatch
+    ):
+        warnings = self.run(
+            monkeypatch, self.definition({"type": "taylorseer"}), capacity_gb=24
+        )
+
+        found = self.coded(warnings, "taylorseer_state_unestimated")
+        assert len(found) == 1 and "GB" not in found[0]
+
+    # compile_fullgraph_with_cache
+
+    def test_fullgraph_with_a_cache_fires_at_the_component(self, monkeypatch):
+        definition = self.definition(
+            {"type": "faster"},
+            components={"transformer": {"compile": {"fullgraph": True}}},
+        )
+
+        warnings = self.run(monkeypatch, definition)
+
+        found = self.coded(warnings, "compile_fullgraph_with_cache")
+        assert len(found) == 1
+        assert (
+            found[0].split(": ")[0].endswith("components.transformer.compile.fullgraph")
+        )
+
+    def test_partial_graph_with_a_cache_is_silent(self, monkeypatch):
+        definition = self.definition(
+            {"type": "faster"},
+            components={"transformer": {"compile": {"fullgraph": False}}},
+        )
+
+        warnings = self.run(monkeypatch, definition)
+
+        assert self.coded(warnings, "compile_fullgraph_with_cache") == []
+
+    def test_fullgraph_without_a_cache_is_silent(self, monkeypatch):
+        definition = self.definition(
+            components={"transformer": {"compile": {"fullgraph": True}}}
+        )
+
+        warnings = self.run(monkeypatch, definition)
+
+        assert self.coded(warnings, "compile_fullgraph_with_cache") == []
+
+    # attention_backend_unavailable
+
+    @staticmethod
+    def with_backend(level, backend):
+        if level == "pipeline":
+            return {"attention_backend": backend}
+        return {"components": {"transformer": {"attention_backend": backend}}}
+
+    @pytest.mark.parametrize("level", ["pipeline", "component"])
+    @pytest.mark.parametrize("device", ["mps", "cpu"])
+    def test_a_cuda_only_backend_fires_off_cuda(self, monkeypatch, level, device):
+        definition = self.definition(**self.with_backend(level, "sage_hub"))
+
+        warnings = self.run(monkeypatch, definition, device=device)
+
+        found = self.coded(warnings, "attention_backend_unavailable")
+        assert len(found) == 1
+        assert "'sage_hub'" in found[0] and f"'{device}'" in found[0]
+        if level == "component":
+            assert "components.transformer.attention_backend" in found[0]
+
+    @pytest.mark.parametrize("level", ["pipeline", "component"])
+    @pytest.mark.parametrize("device", ["cuda", "cuda:1"])
+    def test_a_cuda_only_backend_is_silent_on_cuda(self, monkeypatch, level, device):
+        definition = self.definition(**self.with_backend(level, "sage_hub"))
+
+        warnings = self.run(monkeypatch, definition, device=device)
+
+        assert self.coded(warnings, "attention_backend_unavailable") == []
+
+    @pytest.mark.parametrize("level", ["pipeline", "component"])
+    def test_an_unknown_device_is_silent(self, level):
+        definition = self.definition(**self.with_backend(level, "sage_hub"))
+
+        warnings = self.direct(definition, device_type=None)
+
+        assert self.coded(warnings, "attention_backend_unavailable") == []
+
+    @pytest.mark.parametrize("backend", ["native", "_native_cudnn", "flex"])
+    def test_a_native_family_backend_is_silent_on_mps(self, monkeypatch, backend):
+        definition = self.definition(attention_backend=backend)
+
+        warnings = self.run(monkeypatch, definition, device="mps")
+
+        assert self.coded(warnings, "attention_backend_unavailable") == []
+
+    def test_an_unresolvable_backend_is_silent_on_mps(self, monkeypatch):
+        definition = self.definition(
+            attention_backend="variable:backend", variables={"backend": None}
+        )
+
+        warnings = self.run(monkeypatch, definition, device="mps")
+
+        assert self.coded(warnings, "attention_backend_unavailable") == []
+
+    # shape of the answer
+
+    def test_a_for_each_step_says_each_warning_once(self, monkeypatch):
+        """Members share their written path, and each one's message names
+        its member - the warning is said once there, not once a member"""
+        definition = self.definition(
+            {"type": "taylorseer"},
+            variables={"shots": [{"name": "a"}, {"name": "b"}, {"name": "c"}]},
+        )
+        definition["steps"][0]["for_each"] = "variable:shots"
+        definition["steps"][0]["name"] = "gen"
+
+        warnings = self.run(monkeypatch, definition)
+
+        assert len(self.coded(warnings, "taylorseer_state_unestimated")) == 1
+
+    def test_warnings_never_refuse(self, monkeypatch):
+        definition = self.definition(
+            {"type": "first_block"},
+            steps=9,
+            components={
+                "transformer": {
+                    "compile": {"fullgraph": True},
+                    "attention_backend": "sage_hub",
+                }
+            },
+        )
+        monkeypatch.setattr(validation, "get_device_type", lambda: "mps")
+
+        warnings = self.run(monkeypatch, definition, device="mps")
+
+        assert len(self.coded(warnings, "cache_short_schedule")) == 1
+        assert len(self.coded(warnings, "compile_fullgraph_with_cache")) == 1
+        assert len(self.coded(warnings, "attention_backend_unavailable")) == 1
+        assert self.workflow(definition).validation_errors() == []
+
+    # the catalog
+
+    def test_no_catalog_workflow_trips_a_device_independent_acceleration_warning(
+        self, monkeypatch
+    ):
+        """The catalog defaults are held to the same rules a hand-written
+        workflow meets. attention_backend_unavailable is left out on purpose:
+        a CUDA-only backend is a legitimate catalog choice."""
+        import glob
+
+        from dw.workflow import Workflow
+
+        root = pathlib.Path(__file__).resolve().parent.parent
+        paths = sorted(
+            glob.glob(str(root / "workflows" / "**" / "*.json"), recursive=True)
+            + glob.glob(
+                str(root / "dw" / "workflows" / "**" / "*.json"), recursive=True
+            )
+        )
+        monkeypatch.setattr(validation, "get_device_type", lambda: "cuda")
+        checked = 0
+        offenders = []
+        for path in paths:
+            try:
+                with open(path, encoding="utf-8") as handle:
+                    definition = json.load(handle)
+            except (OSError, ValueError):
+                continue
+            if not isinstance(definition, dict) or "steps" not in definition:
+                continue
+            workflow = Workflow(definition, None, path)
+            warnings = validation.run_warning_check(
+                workflow, "acceleration_warnings", None
+            )
+            checked += 1
+            for code in self.CODES[:3]:
+                offenders += [
+                    f"{os.path.relpath(path, root)}: {w}"
+                    for w in self.coded(warnings, code)
+                ]
+
+        assert checked
+        assert offenders == []
+
+
+class TestCacheVariable:
+    """A `cache: "variable:cache"` is checked as the object it substitutes to
+    (#865): the raw schema only sees the reference string, so this is what
+    stops a bad cache object from passing validate and failing at load."""
+
+    @staticmethod
+    def definition(default=None):
+        return {
+            "id": "cache-variable",
+            "variables": {"cache": default},
+            "steps": [
+                {
+                    "name": "gen",
+                    "pipeline": {
+                        "configuration": {
+                            "component_type": "FluxPipeline",
+                            "cache": "variable:cache",
+                        },
+                        "from_pretrained_arguments": {
+                            "model_name": "black-forest-labs/FLUX.1-dev"
+                        },
+                        "arguments": {"prompt": "a cat", "num_inference_steps": 30},
+                    },
+                }
+            ],
+        }
+
+    @staticmethod
+    def errors(definition, arguments=None):
+        from dw.workflow import Workflow
+
+        return Workflow(definition, None, "").validation_errors(arguments)
+
+    @staticmethod
+    def expanded_configuration(definition, arguments=None):
+        from dw.workflow import Workflow
+
+        expanded = Workflow(definition, None, "").expanded_definition(arguments)
+        return expanded["steps"][0]["pipeline"]["configuration"]
+
+    def test_a_valid_object_validates_and_reaches_the_step(self):
+        cache = {"type": "first_block", "threshold": 0.05}
+
+        assert self.errors(self.definition(), {"cache": cache}) == []
+        assert (
+            self.expanded_configuration(self.definition(), {"cache": cache})["cache"]
+            == cache
+        )
+
+    def test_null_drops_the_key(self):
+        assert self.errors(self.definition()) == []
+        assert "cache" not in self.expanded_configuration(self.definition())
+
+    def test_an_unknown_type_is_refused_at_the_field(self):
+        errors = self.errors(self.definition(), {"cache": {"type": "bogus"}})
+
+        assert [e["path"] for e in errors] == [
+            "steps[0].pipeline.configuration.cache.type"
+        ]
+        assert "bogus" in errors[0]["message"]
+
+    def test_a_bare_string_is_refused(self):
+        errors = self.errors(self.definition(), {"cache": "first_block"})
+
+        assert [e["path"] for e in errors] == ["steps[0].pipeline.configuration.cache"]
+        assert "object" in errors[0]["message"]
+
+    def test_a_missing_type_is_refused(self):
+        errors = self.errors(self.definition(), {"cache": {"threshold": 0.05}})
+
+        assert [e["path"] for e in errors] == ["steps[0].pipeline.configuration.cache"]
+        assert "'type'" in errors[0]["message"]
+
+    def test_a_string_threshold_is_refused_at_the_field(self):
+        for threshold in ("0.05", "abc"):
+            errors = self.errors(
+                self.definition(),
+                {"cache": {"type": "first_block", "threshold": threshold}},
+            )
+
+            assert [e["path"] for e in errors] == [
+                "steps[0].pipeline.configuration.cache.threshold"
+            ], threshold
+
+    def test_a_threshold_variable_in_a_literal_object_still_validates(self):
+        definition = self.definition()
+        definition["variables"]["threshold"] = 0.05
+        definition["steps"][0]["pipeline"]["configuration"]["cache"] = {
+            "type": "first_block",
+            "threshold": "variable:threshold",
+        }
+
+        assert self.errors(definition) == []
+
+    def test_an_invalid_default_is_refused_with_no_arguments(self):
+        errors = self.errors(self.definition(default={"type": "bogus"}))
+
+        assert [e["path"] for e in errors] == [
+            "steps[0].pipeline.configuration.cache.type"
+        ]
+
+    def test_a_literal_string_other_than_a_variable_fails_the_schema(self):
+        definition = self.definition()
+        definition["steps"][0]["pipeline"]["configuration"]["cache"] = "first_block"
+
+        errors = self.errors(definition)
+
+        assert [e["path"] for e in errors] == ["steps[0].pipeline.configuration.cache"]
+
+    def test_a_literal_object_still_validates(self):
+        definition = self.definition()
+        definition["steps"][0]["pipeline"]["configuration"]["cache"] = {
+            "type": "first_block",
+            "threshold": 0.05,
+        }
+
+        assert self.errors(definition) == []
+
+
+class TestCacheVariableOnAForEachTemplate:
+    """The same check through a real for_each template: every member's
+    substituted cache is checked, and one bad value is said once."""
+
+    PATH = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+        "workflows",
+        "templates",
+        "minimax",
+        "dialogue-short.json",
+    )
+
+    def errors(self, arguments):
+
+        from dw.workflow import Workflow
+
+        with open(self.PATH, encoding="utf-8") as handle:
+            definition = json.load(handle)
+        errors = Workflow(definition, None, self.PATH).validation_errors(arguments)
+        return [e for e in errors if ".cache" in e["path"]]
+
+    def test_a_valid_object_is_clean(self):
+        assert self.errors({"cache": {"type": "first_block", "threshold": 0.05}}) == []
+
+    def test_an_unknown_type_is_refused_once(self):
+        errors = self.errors({"cache": {"type": "bogus"}})
+
+        assert len(errors) == 1, errors
+        assert errors[0]["path"].endswith("pipeline.configuration.cache.type")
+        assert "member 'shot@" in errors[0]["message"]
+
+    def test_a_bare_string_is_refused(self):
+        errors = self.errors({"cache": "first_block"})
+
+        assert len(errors) == 1, errors
+        assert errors[0]["path"].endswith("pipeline.configuration.cache")
+
+    def test_a_string_threshold_is_refused_once(self):
+        errors = self.errors({"cache": {"type": "first_block", "threshold": "0.05"}})
+
+        assert len(errors) == 1, errors
+        assert errors[0]["path"].endswith("pipeline.configuration.cache.threshold")
diff --git a/tests/test_vram_estimate.py b/tests/test_vram_estimate.py
index 3c3f0fb0..b0e35196 100644
--- a/tests/test_vram_estimate.py
+++ b/tests/test_vram_estimate.py
@@ -418,3 +418,23 @@ def test_apply_vram_estimate_raises_with_no_variables_block_at_all():
     assert "variables" not in d
     with pytest.raises(ValueError):
         apply_vram_estimate(d, variables=None, device_type="cuda", capacity_gb=24.0)
+
+
+def test_a_projection_between_the_real_card_and_its_rounded_catalog_entry_is_refused():
+    # 768*512*121 voxels * 1 byte/voxel = 0.04 GiB; a base of 23.9 projects to
+    # 23.94 GB: under the catalog's "24" but over a 3090's 23.6 (#900)
+    d = definition()
+    d["vram_estimate"] = {
+        "voxel_variables": ["width", "height", "num_frames"],
+        "base_gb": 23.9,
+        "bytes_per_voxel": 1,
+    }
+    errors = vram_estimate_errors(
+        d, device_type="cuda", capacity_gb=23.6, capacity_label="cuda:0 RTX 3090"
+    )
+    assert len(errors) == 1
+    assert "cuda:0 RTX 3090" in errors[0]["message"]
+    assert "above the 23.6 GB" in errors[0]["message"]
+    assert vram_estimate_errors(d, device_type="cuda", capacity_gb=24) == []
+    with pytest.raises(ValueError):
+        apply_vram_estimate(d, d["variables"], device_type="cuda", capacity_gb=23.6)
diff --git a/tests/test_worker_execute.py b/tests/test_worker_execute.py
index e3966634..2786dc43 100644
--- a/tests/test_worker_execute.py
+++ b/tests/test_worker_execute.py
@@ -669,3 +669,33 @@ def run(
     assert log["message"] == "wrote output:id/a.wav"
     step_end = next(e for e in events if e["event"] == "step_end")
     assert step_end["files"] == [written]
+
+
+class TestProbeCacheWarmIdentity:
+    """#911: the probe answers for the run's identity switch, which clears
+    the step cache before the job starts."""
+
+    def _probe(self, worker, warm, requested):
+        worker.workflow_identity = warm
+        command = snapshot_command(file_spec=requested, request_id="r1", arguments={})
+        with (
+            patch.object(workflow_run, "cache_hits", return_value=["gen"]) as hits,
+            patch.object(
+                worker, "_load_workflow", return_value=(StubWorkflow(), requested)
+            ),
+        ):
+            worker._handle_probe_cache(command)
+        return _drain(worker.result_queue), hits
+
+    def test_different_warm_identity_reports_nothing_cached(self):
+        messages, hits = self._probe(_make_worker(), "/w/b.json", "/w/a.json")
+        assert messages[0]["cached"] == []
+        hits.assert_not_called()
+
+    def test_same_warm_identity_probes_the_cache(self):
+        messages, hits = self._probe(_make_worker(), "/w/a.json", "/w/a.json")
+        assert messages[0]["cached"] == ["gen"]
+
+    def test_cold_card_probes_the_cache(self):
+        messages, _ = self._probe(_make_worker(), None, "/w/a.json")
+        assert messages[0]["cached"] == ["gen"]
diff --git a/tests/test_worker_manager.py b/tests/test_worker_manager.py
index fe3388fc..d8022c1c 100644
--- a/tests/test_worker_manager.py
+++ b/tests/test_worker_manager.py
@@ -216,6 +216,7 @@ class _RecordingProcess:
     variables in os.environ at that moment instead of spawning."""
 
     environment_at_start = None
+    pid = None  # nothing spawned, so no /proc entry to read
 
     def __init__(self, target=None, args=()):
         self.target = target
@@ -241,6 +242,31 @@ def recorded_start(monkeypatch):
     return _RecordingProcess
 
 
+class TestOomScoreFloor:
+    def test_the_spawn_time_adj_is_recorded_as_the_floor(
+        self, recorded_start, monkeypatch
+    ):
+        # #881: the value a reset may go back to without privilege
+        monkeypatch.setattr(recorded_start, "pid", 4242, raising=False)
+        read = []
+        monkeypatch.setattr(
+            worker_manager,
+            "read_oom_score_adj",
+            lambda pid: read.append(pid) or 200,
+        )
+        manager = WorkerManager(device="cuda:1")
+        manager.ensure_worker()
+        assert read == [4242] and manager.oom_score_floor == 200
+
+    def test_reset_writes_the_floor_not_zero(self, monkeypatch):
+        manager = WorkerManager(device="cuda:1")
+        manager.oom_score_floor = 200
+        written = []
+        monkeypatch.setattr(manager, "set_oom_score_adj", written.append)
+        manager.reset_oom_score_adj()
+        assert written == [200]
+
+
 class TestWorkerPinning:
     def test_a_cuda_index_pins_the_worker_through_the_environment(self, recorded_start):
         WorkerManager(device="cuda:1").ensure_worker()
diff --git a/tests/test_worker_messages.py b/tests/test_worker_messages.py
index 988a5cdd..7d5bbe6c 100644
--- a/tests/test_worker_messages.py
+++ b/tests/test_worker_messages.py
@@ -116,6 +116,15 @@
         Progress(event={"event": "step_start", "step": "gen", "index": 0}),
         {"type": "progress", "event": "step_start", "step": "gen", "index": 0},
     ),
+    (
+        Progress(event={"event": "cache_stats", "step": "gen", "type": "mag"}),
+        {
+            "type": "progress",
+            "event": "cache_stats",
+            "step": "gen",
+            "event_type": "mag",
+        },
+    ),
     (
         MemoryInfo(info={"run_count": 1}),
         {"type": "memory_info", "info": {"run_count": 1}},
diff --git a/tests/test_worker_pool.py b/tests/test_worker_pool.py
index 2a0c37e5..3e9b3df5 100644
--- a/tests/test_worker_pool.py
+++ b/tests/test_worker_pool.py
@@ -2,6 +2,8 @@
 isolation, cancel routing, VRAM-aware dispatch with backfill, the fit check at
 submit, the OOM ranking, and what /api/health reports."""
 
+import subprocess
+import sys
 import threading
 import time
 
@@ -408,31 +410,160 @@ def is_alive(self):
         return True
 
 
+class FakeKernelAdj:
+    """A worker's /proc/<pid>/oom_score_adj as an unprivileged writer meets
+    it: a write below `minimum` (the oom_score_adj_min a privileged parent
+    left - 100 under lem's systemd user manager) is refused."""
+
+    def __init__(self, minimum):
+        self.minimum = minimum
+        self.value = minimum
+
+    def write(self, value):
+        if value < self.minimum:
+            return False
+        self.value = value
+        return True
+
+
 class TestOomRanking:
-    def test_the_later_started_worker_is_ranked_first(self, pool):
+    def _pair(self, pool, minimum=0):
         a = card(success_script, "cuda:0", 24)
         b = card(success_script, "cuda:1", 24)
         written = []
         for worker, pid in ((a, 101), (b, 102)):
+            kernel = FakeKernelAdj(minimum)
+            worker.kernel = kernel
+            worker.oom_score_floor = minimum
             worker.pid = lambda pid=pid: pid
-            worker.set_oom_score_adj = lambda value, worker=worker: written.append(
-                (worker.device, value)
-            )
-        manager = pool(a, b)
+            worker.worker_active = True
+            worker.worker_process = FakeProcess(pid)
+
+            def set_adj(value, worker=worker, kernel=kernel):
+                took = kernel.write(value)
+                if took:
+                    written.append((worker.device, value))
+                return took
+
+            worker.set_oom_score_adj = set_adj
+        return pool(a, b), written
+
+    def test_health_reports_pid_and_kernel_oom_score_adj(self, pool, monkeypatch):
+        manager, _ = self._pair(pool)
+        values = {101: 1000, 102: 0}
+        monkeypatch.setattr(
+            "dw.server.jobs.read_oom_score_adj", lambda pid: values.get(pid)
+        )
+
+        workers = manager.workers()
+
+        assert [w["pid"] for w in workers] == [101, 102]
+        assert [w["oom_score_adj"] for w in workers] == [1000, 0]
+
+    def test_health_omits_oom_fields_for_a_stopped_worker(self, pool):
+        manager, _ = self._pair(pool)
+        manager.slots[1].manager.worker_active = False
+        manager.slots[1].manager.worker_process = None
+        manager.slots[1].manager.pid = lambda: None
+
+        second = manager.workers()[1]
+
+        assert "pid" not in second and "oom_score_adj" not in second
+
+    def test_each_dispatch_scores_its_worker_highest(self, pool):
+        manager, written = self._pair(pool)
         first, second = manager.slots
 
-        # The only worker alive: nothing is written
-        a.worker_active = True
-        a.worker_process = FakeProcess(101)
+        manager._rank_for_oom(first)
+        assert written == [("cuda:0", 1000), ("cuda:1", 0)]
+
+        written.clear()
+        manager._rank_for_oom(second)
+        assert written == [("cuda:1", 1000), ("cuda:0", 0)]
+
+    def test_a_dispatch_back_onto_an_unchanged_worker_flips_the_scores(self, pool):
+        manager, written = self._pair(pool)
+        first, second = manager.slots
+        manager._rank_for_oom(first)
+        manager._rank_for_oom(second)
+
+        written.clear()
+        manager._rank_for_oom(first)  # same pid as the first dispatch
+        assert written == [("cuda:0", 1000), ("cuda:1", 0)]
+
+    def test_the_only_live_worker_is_left_alone(self, pool):
+        manager, written = self._pair(pool)
+        first, second = manager.slots
+        second.manager.worker_active = False
+        second.manager.worker_process = None
+
         manager._rank_for_oom(first)
         assert written == []
 
-        # A second starts beside it, with the first still at no adjustment
-        b.worker_active = True
-        b.worker_process = FakeProcess(102)
-        assert a.oom_score_adj is None
+    def test_a_privileged_floor_is_where_the_others_go_back_to(self, pool):
+        # Under lem's systemd user manager writing 0 is refused, so a worker
+        # raised to 1000 stayed there and tied with the next (#881 verify)
+        manager, written = self._pair(pool, minimum=200)
+        first, second = manager.slots
+        manager._rank_for_oom(first)
         manager._rank_for_oom(second)
-        assert written == [("cuda:1", 100)]
+        assert written[-2:] == [("cuda:1", 1000), ("cuda:0", 200)]
+
+        manager._rank_for_oom(first)
+        assert [w.manager.kernel.value for w in manager.slots] == [1000, 200]
+
+    def test_a_refused_write_is_a_warning_on_the_job(self, pool):
+        manager, _ = self._pair(pool, minimum=200)
+        first, second = manager.slots
+        second.manager.oom_score_floor = 0  # a floor the kernel won't take
+        events = []
+
+        class Job:
+            def add_event(self, event):
+                events.append(event)
+
+        manager._rank_for_oom(first, Job())
+
+        assert [e["event"] for e in events] == ["warning"]
+        assert "cuda:1" in events[0]["message"] and "0" in events[0]["message"]
+
+    def test_a_clean_ranking_warns_nothing(self, pool):
+        manager, _ = self._pair(pool, minimum=200)
+        events = []
+
+        class Job:
+            def add_event(self, event):
+                events.append(event)
+
+        manager._rank_for_oom(manager.slots[0], Job())
+        assert events == []
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux"), reason="Linux /proc")
+class TestOomScoreAdjOnLinux:
+    """The real write through /proc, against a real child process. Run under
+    `systemd-run --user --pipe` on lem the child starts at 200 with a
+    minimum of 100 (user@.service's), so a reset to 0 would be refused and
+    this shows the reset to the spawn value lands."""
+
+    def test_raise_then_reset_returns_to_the_spawn_value(self):
+        from dw.host_memory import read_oom_score_adj
+        from dw.worker_manager import WorkerManager
+
+        child = subprocess.Popen(["sleep", "30"])
+        try:
+            manager = WorkerManager("cuda:0")
+            manager.worker_process = FakeProcess(child.pid)
+            manager.oom_score_floor = read_oom_score_adj(child.pid)
+            floor = manager.oom_score_floor
+
+            assert manager.set_oom_score_adj(1000) is True
+            assert read_oom_score_adj(child.pid) == 1000
+            assert manager.reset_oom_score_adj() is True
+            assert read_oom_score_adj(child.pid) == floor
+        finally:
+            child.kill()
+            child.wait()
 
 
 class TestHealth:
@@ -1054,3 +1185,248 @@ def test_the_server_routes_by_the_identity_the_worker_caches_by(self):
             "x",
         )
         assert JobManager.identity_of("inline", None, None) == ("inline", None)
+
+
+class TestCancelDuringLoading:
+    def test_a_cancel_in_a_load_terminates_the_worker_and_cancels(
+        self, pool, monkeypatch
+    ):
+        from dw.server import jobs as jobs_module
+
+        monkeypatch.setattr(jobs_module, "CANCEL_GRACE_SECONDS", 0.1)
+        gate = Gate()
+        worker = card(gate, "cuda:0", 24)
+        terminated = []
+        worker.terminate_worker = lambda: (terminated.append(1), gate.release.set())
+        manager = pool(worker)
+        job = submit(manager, "loading")
+        gate.wait_started()
+        job.add_event({"event": "phase", "phase": "loading", "detail": "pipeline"})
+        manager.cancel(job.id)
+        assert job.summary()["cancel_requested"] is True
+        wait_for(job, {"cancelled"})
+        assert terminated
+
+    def test_a_cancel_in_an_interruptible_phase_is_not_escalated(
+        self, pool, monkeypatch
+    ):
+        from dw.server import jobs as jobs_module
+
+        monkeypatch.setattr(jobs_module, "CANCEL_GRACE_SECONDS", 0.1)
+        gate = Gate()
+        worker = card(gate, "cuda:0", 24)
+        terminated = []
+        worker.terminate_worker = lambda: terminated.append(1)
+        manager = pool(worker)
+        job = submit(manager, "denoising")
+        gate.wait_started()
+        job.add_event({"event": "phase", "phase": "generating"})
+        manager.cancel(job.id)
+        time.sleep(0.4)
+        assert not terminated
+        gate.release.set()
+        wait_for(job, {"cancelled"})
+
+
+def test_a_worker_that_dies_under_a_requested_cancel_reads_as_cancelled(tmp_path):
+    from dw.server import job_results
+    from dw.server.job_record import Job
+
+    class Dead:
+        def get_result(self):
+            raise RuntimeError("Worker process died while waiting for results")
+
+        def crash_details(self):
+            return "terminated"
+
+        def mark_crashed(self):
+            pass
+
+    job = Job({"workflow_name": "w"})
+    job.cancel_requested = True
+    outcome = job_results.consume_results(job, Dead(), None, str(tmp_path), None)
+    assert outcome == ("cancelled", None, None)
+
+
+# ---------------------------------------------------------------- host RAM
+
+
+GB = 1024
+
+
+class TestHostRamGate:
+    """#869: a job that fits a free card waits while the host's RAM can't hold
+    it beside the running jobs, with the readings faked."""
+
+    @pytest.fixture
+    def host(self, monkeypatch):
+        """The host's MemAvailable and each worker's RSS, as a test sets them."""
+        readings = {"available_mb": 64 * GB, "rss": {}}
+        monkeypatch.setattr(
+            "dw.server.dispatch.host_memory_stats",
+            lambda: (
+                None
+                if readings["available_mb"] is None
+                else {"available_mb": readings["available_mb"]}
+            ),
+        )
+        monkeypatch.setattr(
+            "dw.server.dispatch._worker_rss_mb",
+            lambda slot: readings["rss"].get(slot.device),
+        )
+        return readings
+
+    @staticmethod
+    def submit(manager, name, host_gb=None, vram_need=None):
+        return manager.submit(
+            admitted=admitted_for(manager, valid_workflow(name)),
+            workflow=valid_workflow(name),
+            vram_need=vram_need,
+            host_ram_need=None if host_gb is None else (host_gb * GB, "observed", 1),
+        )
+
+    def _two_cards(self, pool):
+        first, second = Gate(), Gate()
+        manager = pool(card(first, "cuda:0", 24), card(second, "cuda:1", 24))
+        return manager, first, second
+
+    @staticmethod
+    def queue_waits(job):
+        return [e for e in job.events if e.get("event") == "queue_wait"]
+
+    def test_a_job_the_host_cannot_hold_beside_the_running_one_is_held(
+        self, pool, host
+    ):
+        manager, first_gate, second_gate = self._two_cards(pool)
+        host["available_mb"] = 40 * GB
+        running = self.submit(manager, "running", host_gb=30)
+        first_gate.wait_started()
+        host["rss"]["cuda:0"] = 30 * GB
+        host["available_mb"] = 10 * GB
+
+        held = self.submit(manager, "held", host_gb=30)
+        assert wait_until(lambda: held.waiting_for is not None)
+        assert held.status == "queued"
+        assert held.waiting_for == "waiting for host RAM: needs ~30 GB, ~10 GB free"
+        assert not second_gate.started.is_set()
+        assert manager.get(held.id).summary()["waiting_for"] == held.waiting_for
+
+        # The running job finishing is what frees the RAM and wakes dispatch
+        host["available_mb"] = 40 * GB
+        first_gate.release.set()
+        wait_for(running, {"succeeded"})
+        wait_for(held, {"running", "succeeded"})
+        assert held.waiting_for is None
+        assert "waiting_for" not in held.summary()
+        second_gate.release.set()
+        wait_for(held, {"succeeded"})
+
+    def test_memory_freed_outside_dw_starts_the_held_job_on_the_recheck(
+        self, pool, host, monkeypatch
+    ):
+        monkeypatch.setattr("dw.server.dispatch.HOST_RAM_RECHECK_SECONDS", 0.05)
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=10)
+        first_gate.wait_started()
+        host["rss"]["cuda:0"] = 10 * GB
+        host["available_mb"] = 5 * GB
+        held = self.submit(manager, "held", host_gb=20)
+        assert wait_until(lambda: held.waiting_for is not None)
+
+        # Nothing in dw wakes the dispatcher: only the timer sees this
+        host["available_mb"] = 40 * GB
+        second_gate.wait_started()
+        wait_for(held, {"running"})
+
+    def test_a_smaller_job_starts_past_a_held_one(self, pool, host):
+        gates = [Gate(), Gate(), Gate()]
+        manager = pool(*(card(g, f"cuda:{i}", 24) for i, g in enumerate(gates)))
+        self.submit(manager, "running", host_gb=10)
+        gates[0].wait_started()
+        host["rss"]["cuda:0"] = 10 * GB
+        host["available_mb"] = 12 * GB
+
+        big = self.submit(manager, "big", host_gb=30)
+        small = self.submit(manager, "small", host_gb=4)
+        wait_for(small, {"running"})
+        assert big.status == "queued"
+        assert big.waiting_for is not None
+        assert small.waiting_for is None
+
+    def test_a_job_alone_is_never_held(self, pool, host):
+        host["available_mb"] = 1 * GB
+        manager = pool(card(success_script, "cuda:0", 24))
+        job = self.submit(manager, "alone", host_gb=200)
+        wait_for(job, {"succeeded"})
+        assert not self.queue_waits(job)
+
+    def test_a_job_with_no_figure_is_never_held(self, pool, host):
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=30)
+        first_gate.wait_started()
+        host["available_mb"] = 0
+        unknown = self.submit(manager, "unknown")
+        second_gate.wait_started()
+        wait_for(unknown, {"running"})
+        assert not self.queue_waits(unknown)
+
+    def test_no_host_reading_means_no_gate(self, pool, host):
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=30)
+        first_gate.wait_started()
+        host["available_mb"] = None
+        job = self.submit(manager, "unread", host_gb=30)
+        second_gate.wait_started()
+        wait_for(job, {"running"})
+        assert not self.queue_waits(job)
+
+    def test_the_growth_a_still_loading_job_has_left_is_charged(self, pool, host):
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "loading", host_gb=30)
+        first_gate.wait_started()
+        # 40 GB free now, but the loading job will take 25 GB more of it
+        host["rss"]["cuda:0"] = 5 * GB
+        host["available_mb"] = 40 * GB
+        held = self.submit(manager, "next", host_gb=20)
+        assert wait_until(lambda: held.waiting_for is not None)
+        assert held.waiting_for == "waiting for host RAM: needs ~20 GB, ~15 GB free"
+        assert not second_gate.started.is_set()
+
+    def test_the_idle_worker_it_would_reuse_counts_as_free(self, pool, host):
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=10)
+        first_gate.wait_started()
+        host["rss"] = {"cuda:0": 10 * GB, "cuda:1": 15 * GB}
+        host["available_mb"] = 10 * GB
+        job = self.submit(manager, "reuses", host_gb=20)
+        second_gate.wait_started()
+        wait_for(job, {"running"})
+
+    def test_the_event_fires_once_per_hold(self, pool, host, monkeypatch):
+        monkeypatch.setattr("dw.server.dispatch.HOST_RAM_RECHECK_SECONDS", 0.02)
+        manager, first_gate, second_gate = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=10)
+        first_gate.wait_started()
+        host["rss"]["cuda:0"] = 10 * GB
+        host["available_mb"] = 5 * GB
+        held = self.submit(manager, "held", host_gb=20)
+        assert wait_until(lambda: held.waiting_for is not None)
+        time.sleep(0.2)  # several rechecks, each still held
+        waits = self.queue_waits(held)
+        assert len(waits) == 1
+        assert waits[0]["reason"] == "host_ram"
+        assert waits[0]["message"] == held.waiting_for
+        assert not held.warnings
+
+    def test_cancel_clears_waiting_for_and_the_bookkeeping(self, pool, host):
+        manager, first_gate, _ = self._two_cards(pool)
+        self.submit(manager, "running", host_gb=10)
+        first_gate.wait_started()
+        host["rss"]["cuda:0"] = 10 * GB
+        host["available_mb"] = 5 * GB
+        held = self.submit(manager, "held", host_gb=20)
+        assert wait_until(lambda: held.waiting_for is not None)
+        assert manager.cancel(held.id) == "cancelled"
+        assert held.waiting_for is None
+        assert "waiting_for" not in held.summary()
+        assert held.id not in manager._host_needs
diff --git a/tests/test_workflow_step_cache.py b/tests/test_workflow_step_cache.py
index fb493437..aeff9466 100644
--- a/tests/test_workflow_step_cache.py
+++ b/tests/test_workflow_step_cache.py
@@ -1272,3 +1272,112 @@ def fake_step_run(self, previous_results, previous_pipelines, step_action):
     adapters, shift = seen["C"]
     assert adapters.args == (["0"], [1.0])
     assert shift.args == (6.0,)
+
+
+def _runs_of(tmp_path, first, second):
+    """How many times the step body ran across one run of each definition,
+    two separate Workflows sharing an id and an output dir - the rerun of an
+    edited copy of the same workflow."""
+    step_cache.clear()
+    calls = {"n": 0}
+
+    def fake_step_run(self, previous_results, previous_pipelines, step_action):
+        calls["n"] += 1
+        return FakeResult()
+
+    with (
+        patch.object(Step, "run", fake_step_run),
+        patch.object(Pipeline, "load", _mock_pipeline_load),
+    ):
+        Workflow(first, str(tmp_path), "test.json").run({})
+        Workflow(second, str(tmp_path), "test.json").run({})
+    return calls["n"]
+
+
+def _with_output_settings():
+    """The fixture's step with an attention backend, a cache config, a
+    dtype and a LoRA set, so a test can move each one."""
+    spec = _workflow_def()
+    pipeline = spec["steps"][0]["pipeline"]
+    pipeline["configuration"]["attention_backend"] = "flash"
+    pipeline["configuration"]["cache"] = {"type": "mag", "threshold": 0.1}
+    pipeline["from_pretrained_arguments"]["torch_dtype"] = "torch.bfloat16"
+    pipeline["loras"] = [{"model_name": "org/lora-a", "scale": 1.0}]
+    spec["steps"][0]["result"] = {"content_type": "image"}
+    return spec
+
+
+class TestOutputKeys:
+    """#905: a step's cache key is what can change its output. Workflow
+    metadata never reaches it; a result's role is a label. Its subfolder and
+    file_base_name stay: a hit republishes the cached files' paths."""
+
+    def test_the_exclusion_list_is_pinned(self):
+        from dw.step_cache import NON_OUTPUT_RESULT_KEYS
+
+        assert NON_OUTPUT_RESULT_KEYS == ("role",)
+
+    @pytest.mark.parametrize(
+        "edit",
+        [
+            lambda d: d.update(cost_drivers=["prompt"]),
+            lambda d: d.update(
+                vram_estimate={"base_gb": 4, "voxel_variables": ["prompt"]}
+            ),
+            lambda d: d.update(description="reworded", summary="reworded"),
+            lambda d: d.update(shape="image", traits=["chained"]),
+            lambda d: d["steps"][0]["result"].update(role="final"),
+        ],
+        ids=["cost_drivers", "vram_estimate", "description", "catalog", "role"],
+    )
+    def test_metadata_alone_is_a_hit(self, tmp_path, edit):
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        edit(other)
+        assert _runs_of(tmp_path, spec, other) == 1
+
+    def test_cost_drivers_alone_name_the_step_in_cache_hits(self, tmp_path):
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        other["cost_drivers"] = ["prompt"]
+        assert _runs_of(tmp_path, spec, spec) == 1
+        workflow = Workflow(other, str(tmp_path), "test.json")
+        assert "generate" in workflow_run_module.cache_hits(workflow, {})
+
+    @pytest.mark.parametrize(
+        "move",
+        [
+            lambda p: p["configuration"].update(attention_backend="native"),
+            lambda p: p["configuration"]["cache"].update(threshold=0.2),
+            lambda p: p["from_pretrained_arguments"].update(
+                torch_dtype="torch.float16"
+            ),
+            lambda p: p["loras"][0].update(model_name="org/lora-b"),
+            lambda p: p["loras"][0].update(scale=0.5),
+        ],
+        ids=["attention_backend", "cache", "dtype", "lora", "lora_scale"],
+    )
+    def test_an_output_setting_is_a_miss(self, tmp_path, move):
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        move(other["steps"][0]["pipeline"])
+        assert _runs_of(tmp_path, spec, other) == 2
+
+    def test_a_subfolder_is_a_miss(self, tmp_path):
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        other["steps"][0]["result"]["subfolder"] = "elsewhere"
+        assert _runs_of(tmp_path, spec, other) == 2
+
+    def test_a_file_base_name_is_a_miss(self, tmp_path):
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        other["steps"][0]["result"]["file_base_name"] = "renamed"
+        assert _runs_of(tmp_path, spec, other) == 2
+
+    def test_a_seed_is_a_miss(self, tmp_path):
+        # The fingerprint leaves the seed out (#85); the cache never does
+        spec = _with_output_settings()
+        other = copy.deepcopy(spec)
+        other["seed"] = 43
+        assert _runs_of(tmp_path, spec, other) == 2
diff --git a/tests/test_workspace_copy.py b/tests/test_workspace_copy.py
new file mode 100644
index 00000000..e64e7fd8
--- /dev/null
+++ b/tests/test_workspace_copy.py
@@ -0,0 +1,903 @@
+"""Copying runs and assets between workspaces (#853): the engine, the route and the MCP tool."""
+
+import json
+import os
+import re
+from types import SimpleNamespace
+
+import httpx
+import pytest
+from fastapi.testclient import TestClient
+
+from dw.notes import read_notes, set_file_note
+from dw.runs import (
+    RUN_ID_PATTERN,
+    record_kept_shots,
+    resolve_output_reference,
+    run_versions,
+)
+from dw.security import InvalidInputError, PathTraversalError, SecurityError
+from dw.server.app import create_app
+from dw.server.jobs import JobManager
+from dw.workspace import (
+    ConfiguredWorkspace,
+    Workspace,
+    create_workspace,
+)
+from dw.workspace_copy import CopyRefused, copy_between
+from dw_mcp.client import DwClient, api_path
+from dw_mcp.workspaces import copy_to_workspace
+
+from .test_server import ScriptedWorkerManager, success_script
+
+R1 = "20260101-000000-aaaaaaaa"
+R2 = "20260102-000000-bbbbbbbb"
+R3 = "20260103-000000-cccccccc"
+
+
+def test_run_ids_match_the_pattern():
+    for run_id in (R1, R2, R3):
+        assert RUN_ID_PATTERN.match(run_id)
+        assert re.match(r"\d{8}-\d{6}-[0-9a-f]{8}$", run_id)
+
+
+@pytest.fixture
+def root(tmp_path):
+    return Workspace(tmp_path / "studio", "flag").ensure()
+
+
+@pytest.fixture
+def src(root):
+    return create_workspace(root, "src")
+
+
+@pytest.fixture
+def dst(root):
+    return create_workspace(root, "dst")
+
+
+def make_run(
+    ws,
+    identity,
+    run_id,
+    version=1,
+    inputs=(),
+    workflow_file=None,
+    steps=None,
+    notes=None,
+    content=b"png-bytes",
+):
+    run_dir = os.path.join(ws.outputs, *identity.split("/"), run_id)
+    os.makedirs(run_dir)
+    with open(os.path.join(run_dir, "img.png"), "wb") as f:
+        f.write(content)
+    manifest = {
+        "run_id": run_id,
+        "version": version,
+        "inputs": [{"reference": r, "kind": "output"} for r in inputs],
+        "workflow": {"file": workflow_file or "relative.json"},
+    }
+    if steps is not None:
+        manifest["steps"] = steps
+    with open(os.path.join(run_dir, "manifest.json"), "w") as f:
+        json.dump(manifest, f)
+    if notes is not None:
+        with open(os.path.join(run_dir, "notes.json"), "w") as f:
+            json.dump(notes, f)
+    return run_dir
+
+
+def read_json(path):
+    with open(path) as f:
+        return json.load(f)
+
+
+def nothing_written(ws):
+    return not os.path.exists(ws.outputs) or not any(os.scandir(ws.outputs))
+
+
+class TestHappyPath:
+    def test_one_run_is_copied(self, src, dst):
+        make_run(src, "wf", R1)
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        assert set(reply) == {
+            "source",
+            "destination",
+            "copied",
+            "already_present",
+            "renumbered",
+            "warnings",
+            "bytes_linked",
+            "bytes_copied",
+        }
+        assert reply["source"] == "src"
+        assert reply["destination"] == "dst"
+        assert reply["copied"] == {"runs": [f"wf/{R1}"], "assets": []}
+        assert reply["already_present"] == []
+        assert reply["renumbered"] == {}
+        for name in ("img.png", "manifest.json"):
+            assert os.path.isfile(os.path.join(dst.outputs, "wf", R1, name))
+
+    def test_a_bare_workflow_copies_all_its_runs(self, src, dst):
+        make_run(src, "wf", R1, 1)
+        make_run(src, "wf", R2, 2)
+        reply = copy_between(src, dst, ["wf"])
+        assert reply["copied"]["runs"] == [f"wf/{R1}", f"wf/{R2}"]
+
+    def test_a_multi_segment_identity(self, src, dst):
+        make_run(src, "ltx2/Gyre", R1)
+        reply = copy_between(src, dst, [f"ltx2/Gyre/{R1}"])
+        assert reply["copied"]["runs"] == [f"ltx2/Gyre/{R1}"]
+        assert os.path.isfile(os.path.join(dst.outputs, "ltx2", "Gyre", R1, "img.png"))
+
+    def test_a_bare_multi_segment_identity(self, src, dst):
+        make_run(src, "ltx2/Gyre", R1)
+        reply = copy_between(src, dst, ["ltx2/Gyre"])
+        assert reply["copied"]["runs"] == [f"ltx2/Gyre/{R1}"]
+
+    def test_an_output_prefix_is_accepted(self, src, dst):
+        make_run(src, "wf", R1)
+        reply = copy_between(src, dst, [f"output:wf/{R1}"])
+        assert reply["copied"]["runs"] == [f"wf/{R1}"]
+
+    def test_repeating_a_copy_is_idempotent(self, src, dst):
+        make_run(src, "wf", R1)
+        copy_between(src, dst, [f"wf/{R1}"])
+        again = copy_between(src, dst, [f"wf/{R1}"])
+        assert again["already_present"] == [f"wf/{R1}"]
+        assert again["copied"]["runs"] == []
+        assert "no_jobs" not in again["warnings"]
+
+
+class TestRenumbering:
+    def test_a_collision_renumbers_in_run_id_order(self, src, dst):
+        make_run(dst, "wf", "20251231-000000-dddddddd", 1)
+        make_run(src, "wf", R2, 2)
+        make_run(src, "wf", R1, 1)
+        make_run(src, "wf", R3, 3)
+        # v1 collides, so every copied run of the identity is renumbered
+        reply = copy_between(src, dst, ["wf"])
+        assert reply["renumbered"] == {
+            f"wf/{R1}": {"from": 1, "to": 2},
+            f"wf/{R2}": {"from": 2, "to": 3},
+            f"wf/{R3}": {"from": 3, "to": 4},
+        }
+        copied = read_json(os.path.join(dst.outputs, "wf", R1, "manifest.json"))
+        assert copied["version"] == 2
+        versions = run_versions(os.path.join(dst.outputs, "wf"))
+        assert versions[R1] == 2 and versions[R2] == 3 and versions[R3] == 4
+
+    def test_two_runs_renumber_after_one(self, src, dst):
+        make_run(dst, "wf", "20251231-000000-dddddddd", 1)
+        make_run(src, "wf", R1, 1)
+        make_run(src, "wf", R2, 2)
+        reply = copy_between(src, dst, ["wf"])
+        assert reply["renumbered"] == {
+            f"wf/{R1}": {"from": 1, "to": 2},
+            f"wf/{R2}": {"from": 2, "to": 3},
+        }
+
+    def test_no_collision_keeps_numbers(self, src, dst):
+        make_run(dst, "wf", "20251231-000000-dddddddd", 1)
+        make_run(src, "wf", R2, 2)
+        reply = copy_between(src, dst, [f"wf/{R2}"])
+        assert reply["renumbered"] == {}
+        copied = read_json(os.path.join(dst.outputs, "wf", R2, "manifest.json"))
+        assert copied["version"] == 2
+
+
+class TestWarnings:
+    def test_unresolved_output_refs(self, src, dst):
+        make_run(dst, "other", R1)
+        make_run(
+            src,
+            "wf",
+            R2,
+            inputs=["output:other/latest/img.png", "output:gone/latest/img.png"],
+        )
+        reply = copy_between(src, dst, [f"wf/{R2}"])
+        unresolved = reply["warnings"]["unresolved_output_refs"]
+        assert unresolved == {f"wf/{R2}": ["output:gone/latest/img.png"]}
+
+    def test_all_refs_resolving_gives_no_warning(self, src, dst):
+        make_run(dst, "other", R1)
+        make_run(src, "wf", R2, inputs=["output:other/latest/img.png"])
+        reply = copy_between(src, dst, [f"wf/{R2}"])
+        assert "unresolved_output_refs" not in reply["warnings"]
+
+    def test_absolute_paths_are_relative_to_the_source_root(self, src, dst, tmp_path):
+        inside = os.path.join(src.outputs, "wf", "earlier", "img.png")
+        workflow = os.path.join(src.workflows, "wf.json")
+        make_run(
+            src,
+            "wf",
+            R1,
+            workflow_file=workflow,
+            steps=[{"step": "s", "files": [inside, "relative/img.png"]}],
+        )
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        paths = reply["warnings"]["absolute_paths"][f"wf/{R1}"]
+        assert paths == sorted(["outputs/wf/earlier/img.png", "workflows/wf.json"])
+        assert str(tmp_path) not in json.dumps(reply)
+
+    def test_a_path_outside_the_source_root_is_not_reported(self, src, dst):
+        make_run(src, "wf", R1, workflow_file="/somewhere/else/wf.json")
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        assert "absolute_paths" not in reply["warnings"]
+
+    def test_no_jobs_note_after_a_copy(self, src, dst):
+        make_run(src, "wf", R1)
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        assert "no_jobs" in reply["warnings"]
+
+
+class TestRefusals:
+    @pytest.mark.parametrize("entry", ["../x", "/abs", "wf/../../x", "wf/.."])
+    def test_traversal(self, src, dst, entry):
+        make_run(src, "wf", R1)
+        with pytest.raises(SecurityError):
+            copy_between(src, dst, [entry])
+        assert nothing_written(dst)
+
+    @pytest.mark.parametrize("entry", ["wf/", f"wf/{R1}/", f"wf//{R1}", "output:wf/"])
+    def test_an_empty_segment(self, src, dst, entry):
+        make_run(src, "wf", R1)
+        with pytest.raises(InvalidInputError):
+            copy_between(src, dst, [entry])
+        assert nothing_written(dst)
+
+    def test_a_symlinked_run_folder(self, src, dst, tmp_path):
+        make_run(src, "elsewhere", R1)
+        os.makedirs(os.path.join(src.outputs, "wf"))
+        os.symlink(
+            os.path.join(src.outputs, "elsewhere", R1),
+            os.path.join(src.outputs, "wf", R1),
+        )
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, [f"wf/{R1}"])
+        assert nothing_written(dst)
+
+    def test_a_symlinked_identity_folder(self, src, dst):
+        make_run(src, "real", R1)
+        os.symlink(
+            os.path.join(src.outputs, "real"), os.path.join(src.outputs, "linked")
+        )
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, [f"linked/{R1}"])
+        assert nothing_written(dst)
+
+    def test_a_symlink_inside_a_run(self, src, dst, tmp_path):
+        run_dir = make_run(src, "wf", R1)
+        os.symlink(os.path.join(run_dir, "img.png"), os.path.join(run_dir, "link.png"))
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, [f"wf/{R1}"])
+        assert nothing_written(dst)
+
+    def test_a_missing_run(self, src, dst):
+        make_run(src, "wf", R1)
+        with pytest.raises(CopyRefused) as raised:
+            copy_between(src, dst, [f"wf/{R2}"])
+        assert raised.value.status == 404
+        assert nothing_written(dst)
+
+    def test_a_missing_workflow(self, src, dst):
+        with pytest.raises(CopyRefused) as raised:
+            copy_between(src, dst, ["nope"])
+        assert raised.value.status == 404
+
+    def test_same_workspace(self, src):
+        make_run(src, "wf", R1)
+        with pytest.raises(InvalidInputError):
+            copy_between(src, src, [f"wf/{R1}"])
+
+    def test_empty_runs(self, src, dst):
+        with pytest.raises(InvalidInputError):
+            copy_between(src, dst, [])
+
+    def configured(self, ws):
+        return ConfiguredWorkspace(ws.workflows, ws.assets, ws.outputs, ws.prompts)
+
+    def test_configured_source(self, src, dst):
+        make_run(src, "wf", R1)
+        with pytest.raises(CopyRefused) as raised:
+            copy_between(self.configured(src), dst, [f"wf/{R1}"])
+        assert raised.value.status == 409
+        assert nothing_written(dst)
+
+    def test_configured_destination(self, src, dst):
+        make_run(src, "wf", R1)
+        with pytest.raises(CopyRefused) as raised:
+            copy_between(src, self.configured(dst), [f"wf/{R1}"])
+        assert raised.value.status == 409
+        assert nothing_written(dst)
+
+    def test_an_active_run_refuses_all_or_nothing(self, src, dst):
+        make_run(src, "wf", R1, 1)
+        make_run(src, "wf", R2, 2)
+        with pytest.raises(CopyRefused) as raised:
+            copy_between(src, dst, ["wf"], active_runs=[f"wf/{R2}"])
+        assert raised.value.status == 409
+        assert raised.value.conflicts == [f"wf/{R2}"]
+        assert nothing_written(dst)
+        assert not os.path.exists(os.path.join(dst.outputs, "wf", R1))
+
+
+class TestResolution:
+    def test_output_references_resolve_in_the_destination(self, src, dst):
+        make_run(src, "wf", R1)
+        copy_between(src, dst, ["wf"])
+        latest = resolve_output_reference("output:wf/latest/img.png", dst.outputs)
+        pinned = resolve_output_reference(f"output:wf/{R1}/img.png", dst.outputs)
+        expected = os.path.join(os.path.realpath(dst.outputs), "wf", R1, "img.png")
+        assert latest == expected
+        assert pinned == expected
+        assert os.path.isfile(pinned)
+
+
+class TestIndependence:
+    def test_notes_are_not_shared(self, src, dst):
+        source_run = make_run(src, "wf", R1, notes={"note": "original"})
+        copy_between(src, dst, [f"wf/{R1}"])
+        copied = os.path.join(dst.outputs, "wf", R1, "notes.json")
+        original = os.path.join(source_run, "notes.json")
+        assert os.stat(copied).st_ino != os.stat(original).st_ino
+        with open(copied, "w") as f:
+            json.dump({"note": "edited"}, f)
+        assert read_json(original) == {"note": "original"}
+
+    def test_a_renumbered_manifest_leaves_the_source_alone(self, src, dst):
+        make_run(dst, "wf", "20251231-000000-dddddddd", 1)
+        source_run = make_run(src, "wf", R1, 1)
+        copy_between(src, dst, [f"wf/{R1}"])
+        copied = os.path.join(dst.outputs, "wf", R1, "manifest.json")
+        original = os.path.join(source_run, "manifest.json")
+        assert read_json(copied)["version"] == 2
+        assert read_json(original)["version"] == 1
+        assert os.stat(copied).st_ino != os.stat(original).st_ino
+
+
+class TestMediaLinking:
+    def test_media_is_hard_linked(self, src, dst):
+        source_run = make_run(src, "wf", R1, content=b"x" * 100)
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        a = os.stat(os.path.join(source_run, "img.png"))
+        b = os.stat(os.path.join(dst.outputs, "wf", R1, "img.png"))
+        assert a.st_ino == b.st_ino
+        assert reply["bytes_linked"] >= 100
+
+    def test_a_failed_link_falls_back_to_a_copy(self, src, dst, monkeypatch):
+        source_run = make_run(src, "wf", R1, content=b"x" * 100)
+
+        def refuse(*args, **kwargs):
+            raise OSError("cross-device")
+
+        monkeypatch.setattr("dw.workspace_copy.os.link", refuse)
+        reply = copy_between(src, dst, [f"wf/{R1}"])
+        target = os.path.join(dst.outputs, "wf", R1, "img.png")
+        source_file = os.path.join(source_run, "img.png")
+        assert os.stat(target).st_ino != os.stat(source_file).st_ino
+        with open(target, "rb") as a, open(source_file, "rb") as b:
+            assert a.read() == b.read()
+        assert reply["bytes_linked"] == 0
+        assert reply["bytes_copied"] >= 100
+
+
+def make_asset(
+    ws, name, content=b"asset-bytes", note=None, shots=None, provenance=None
+):
+    path = os.path.join(ws.assets, *name.split("/"))
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "wb") as f:
+        f.write(content)
+    if note is not None:
+        set_file_note(os.path.dirname(path), os.path.basename(path), note)
+    if shots is not None or provenance is not None:
+        record_kept_shots(
+            os.path.dirname(path), os.path.basename(path), shots, provenance
+        )
+    return path
+
+
+def no_assets(ws):
+    return not os.path.exists(ws.assets) or not any(os.scandir(ws.assets))
+
+
+SHOTS = [{"start": 0.0, "end": 1.5}]
+PROVENANCE = {"job_id": "j1", "workspace": "src", "run": f"wf/{R1}"}
+
+
+class TestAssets:
+    def test_a_file_keeps_its_path(self, src, dst):
+        source_file = make_asset(src, "cast/iris.png")
+        reply = copy_between(src, dst, assets=["cast/iris.png"])
+        target = os.path.join(dst.assets, "cast", "iris.png")
+        assert reply["copied"] == {"runs": [], "assets": ["cast/iris.png"]}
+        assert os.stat(target).st_ino == os.stat(source_file).st_ino
+        assert reply["bytes_linked"] == len(b"asset-bytes")
+
+    def test_an_asset_prefix_is_accepted(self, src, dst):
+        make_asset(src, "iris.png")
+        reply = copy_between(src, dst, assets=["asset:iris.png"])
+        assert reply["copied"]["assets"] == ["iris.png"]
+
+    def test_a_folder_copies_every_file_under_it(self, src, dst):
+        make_asset(src, "proj/a.png", note="first")
+        make_asset(src, "proj/deep/b.wav")
+        make_asset(src, "other.png")
+        reply = copy_between(src, dst, assets=["proj/"])
+        assert reply["copied"]["assets"] == ["proj/a.png", "proj/deep/b.wav"]
+        assert not os.path.exists(os.path.join(dst.assets, "other.png"))
+        # The folder's sidecar travels per file, not as a file of its own
+        assert read_json(os.path.join(dst.assets, "proj", "notes.json"))["files"] == {
+            "a.png": "first"
+        }
+
+    def test_a_folder_without_a_slash_is_a_folder(self, src, dst):
+        make_asset(src, "proj/a.png")
+        reply = copy_between(src, dst, assets=["proj"])
+        assert reply["copied"]["assets"] == ["proj/a.png"]
+
+    def test_an_upload_stays_under_uploads(self, src, dst):
+        make_asset(src, "uploads/abc.png")
+        reply = copy_between(src, dst, assets=["uploads/abc.png"])
+        assert reply["copied"]["assets"] == ["uploads/abc.png"]
+        assert os.path.isfile(os.path.join(dst.assets, "uploads", "abc.png"))
+
+    def test_json_is_copied_not_linked(self, src, dst):
+        source_file = make_asset(src, "data/cues.json", content=b"{}")
+        copy_between(src, dst, assets=["data/cues.json"])
+        target = os.path.join(dst.assets, "data", "cues.json")
+        assert os.stat(target).st_ino != os.stat(source_file).st_ino
+
+    def test_an_identical_file_is_already_present(self, src, dst):
+        make_asset(src, "iris.png")
+        make_asset(dst, "iris.png")
+        reply = copy_between(src, dst, assets=["iris.png"])
+        assert reply["copied"]["assets"] == []
+        assert reply["already_present"] == ["iris.png"]
+
+    def test_repeating_a_copy_is_idempotent(self, src, dst):
+        make_asset(src, "proj/a.png", note="n")
+        copy_between(src, dst, assets=["proj/"])
+        reply = copy_between(src, dst, assets=["proj/"])
+        assert reply["copied"]["assets"] == []
+        assert reply["already_present"] == ["proj/a.png"]
+
+    def test_a_different_file_refuses_everything(self, src, dst):
+        make_run(src, "wf", R1)
+        make_asset(src, "proj/a.png")
+        make_asset(src, "proj/b.png", content=b"mine")
+        make_asset(dst, "proj/b.png", content=b"theirs")
+        with pytest.raises(CopyRefused) as refused:
+            copy_between(src, dst, [f"wf/{R1}"], ["proj/"])
+        assert refused.value.status == 409
+        assert refused.value.conflicts == ["proj/b.png"]
+        assert "proj/b.png" in str(refused.value)
+        assert nothing_written(dst)
+        assert not os.path.exists(os.path.join(dst.assets, "proj", "a.png"))
+        with open(os.path.join(dst.assets, "proj", "b.png"), "rb") as f:
+            assert f.read() == b"theirs"
+
+    def test_an_active_run_and_a_different_file_are_named_together(self, src, dst):
+        make_run(src, "wf", R1)
+        make_asset(src, "a.png", content=b"mine")
+        make_asset(dst, "a.png", content=b"theirs")
+        with pytest.raises(CopyRefused) as refused:
+            copy_between(src, dst, [f"wf/{R1}"], ["a.png"], active_runs=[f"wf/{R1}"])
+        assert refused.value.conflicts == [f"wf/{R1}", "a.png"]
+
+    def test_runs_and_assets_together(self, src, dst):
+        make_run(src, "wf", R1)
+        make_asset(src, "a.png")
+        reply = copy_between(src, dst, [f"wf/{R1}"], ["a.png"])
+        assert reply["copied"] == {"runs": [f"wf/{R1}"], "assets": ["a.png"]}
+
+    def test_notes_and_kept_shots_travel(self, src, dst):
+        make_asset(
+            src, "proj/a.mp4", note="the keeper", shots=SHOTS, provenance=PROVENANCE
+        )
+        copy_between(src, dst, assets=["proj/a.mp4"])
+        target_dir = os.path.join(dst.assets, "proj")
+        assert read_notes(target_dir)["files"] == {"a.mp4": "the keeper"}
+        manifest = read_json(os.path.join(target_dir, "manifest.json"))
+        [entry] = manifest["steps"]
+        assert entry["files"] == ["a.mp4"]
+        assert entry["shots"] == SHOTS
+        # Where it was kept from is history: it does not become the destination
+        assert entry["provenance"] == PROVENANCE
+        assert entry["provenance"]["workspace"] == "src"
+
+    def test_a_destinations_own_entries_are_kept(self, src, dst):
+        make_asset(src, "proj/a.png", note="from src")
+        make_asset(dst, "proj/z.png", note="already here", shots=SHOTS)
+        copy_between(src, dst, assets=["proj/a.png"])
+        target_dir = os.path.join(dst.assets, "proj")
+        assert read_notes(target_dir)["files"] == {
+            "a.png": "from src",
+            "z.png": "already here",
+        }
+        steps = read_json(os.path.join(target_dir, "manifest.json"))["steps"]
+        assert [s["files"] for s in steps] == [["z.png"]]
+
+    def test_sidecars_are_not_shared(self, src, dst):
+        make_asset(src, "proj/a.mp4", note="original", shots=SHOTS)
+        source_dir = os.path.join(src.assets, "proj")
+        notes_before = read_json(os.path.join(source_dir, "notes.json"))
+        manifest_before = read_json(os.path.join(source_dir, "manifest.json"))
+        copy_between(src, dst, assets=["proj/"])
+        target_dir = os.path.join(dst.assets, "proj")
+        for sidecar in ("notes.json", "manifest.json"):
+            assert (
+                os.stat(os.path.join(target_dir, sidecar)).st_ino
+                != os.stat(os.path.join(source_dir, sidecar)).st_ino
+            )
+        set_file_note(target_dir, "a.mp4", "edited")
+        record_kept_shots(target_dir, "a.mp4", [{"start": 0.0, "end": 9.0}])
+        assert read_json(os.path.join(source_dir, "notes.json")) == notes_before
+        assert read_json(os.path.join(source_dir, "manifest.json")) == manifest_before
+
+    @pytest.mark.parametrize("entry", ["../x.png", "/abs/x.png", "a/../b.png", "./a"])
+    def test_traversal(self, src, dst, entry):
+        make_asset(src, "a/b.png")
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, assets=[entry])
+        assert no_assets(dst)
+
+    def test_a_sidecar_named_directly(self, src, dst):
+        make_asset(src, "proj/a.png", note="n")
+        with pytest.raises(InvalidInputError):
+            copy_between(src, dst, assets=["proj/notes.json"])
+
+    def test_a_missing_asset(self, src, dst):
+        with pytest.raises(CopyRefused) as refused:
+            copy_between(src, dst, assets=["nope.png"])
+        assert refused.value.status == 404
+
+    def test_a_symlink_on_the_way_in_the_source(self, src, dst, tmp_path):
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "a.png").write_bytes(b"x")
+        os.makedirs(src.assets, exist_ok=True)
+        os.symlink(outside, os.path.join(src.assets, "linked"))
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, assets=["linked/a.png"])
+        assert no_assets(dst)
+
+    def test_a_symlink_inside_a_folder(self, src, dst, tmp_path):
+        make_asset(src, "proj/a.png")
+        outside = tmp_path / "secret.png"
+        outside.write_bytes(b"x")
+        os.symlink(outside, os.path.join(src.assets, "proj", "b.png"))
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, assets=["proj/"])
+        assert no_assets(dst)
+
+    def test_a_symlink_on_the_way_in_the_destination(self, src, dst, tmp_path):
+        make_asset(src, "proj/a.png")
+        elsewhere = tmp_path / "elsewhere"
+        elsewhere.mkdir()
+        os.makedirs(dst.assets, exist_ok=True)
+        os.symlink(elsewhere, os.path.join(dst.assets, "proj"))
+        with pytest.raises(PathTraversalError):
+            copy_between(src, dst, assets=["proj/a.png"])
+        assert list(elsewhere.iterdir()) == []
+
+    def test_nothing_named(self, src, dst):
+        with pytest.raises(InvalidInputError):
+            copy_between(src, dst)
+
+
+@pytest.fixture
+def server(root, tmp_path):
+    def make(with_root=True):
+        manager = JobManager(
+            root.outputs,
+            worker_manager=ScriptedWorkerManager(success_script),
+            history_path=str(tmp_path / "jobs.sqlite"),
+            workflow_dir=root.workflows,
+        )
+        kwargs = {"workspace": root.root} if with_root else {}
+        app = create_app(
+            workflow_dir=root.workflows,
+            output_dir=root.outputs,
+            job_manager=manager,
+            prompt_dir=root.prompts,
+            asset_dir=root.assets,
+            **kwargs,
+        )
+        return TestClient(app, base_url="http://localhost")
+
+    return make
+
+
+class TestRoute:
+    def test_happy_path(self, server, root, src, dst):
+        make_run(src, "wf", R1)
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 200, response.text
+        body = response.json()
+        assert body["copied"]["runs"] == [f"wf/{R1}"]
+        assert os.path.isfile(os.path.join(dst.outputs, "wf", R1, "img.png"))
+
+    def test_assets(self, server, src, dst):
+        make_asset(src, "proj/a.png", note="n")
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "assets": ["proj/"]},
+            )
+        assert response.status_code == 200, response.text
+        assert response.json()["copied"] == {"runs": [], "assets": ["proj/a.png"]}
+        assert os.path.isfile(os.path.join(dst.assets, "proj", "a.png"))
+
+    def test_runs_and_assets(self, server, src, dst):
+        make_run(src, "wf", R1)
+        make_asset(src, "a.png")
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"], "assets": ["a.png"]},
+            )
+        assert response.status_code == 200, response.text
+        assert response.json()["copied"] == {
+            "runs": [f"wf/{R1}"],
+            "assets": ["a.png"],
+        }
+
+    def test_a_different_asset_is_409_and_writes_nothing(self, server, src, dst):
+        make_run(src, "wf", R1)
+        make_asset(src, "a.png", content=b"mine")
+        make_asset(dst, "a.png", content=b"theirs")
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"], "assets": ["a.png"]},
+            )
+        assert response.status_code == 409
+        assert response.json()["detail"]["conflicts"] == ["a.png"]
+        assert nothing_written(dst)
+
+    def test_a_missing_asset_is_404(self, server, src, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "assets": ["nope.png"]},
+            )
+        assert response.status_code == 404
+
+    def test_asset_traversal_is_400(self, server, src, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "assets": ["../x.png"]},
+            )
+        assert response.status_code == 400
+
+    def test_an_upload_over_a_copied_asset_leaves_the_source_alone(
+        self, server, src, dst
+    ):
+        source_file = make_asset(src, "uploads/cast.png", content=b"original")
+        copy_between(src, dst, assets=["uploads/cast.png"])
+        with server() as client:
+            response = client.post(
+                "/api/uploads",
+                params={
+                    "filename": "cast.png",
+                    "asset_name": "cast.png",
+                    "workspace": "dst",
+                },
+                content=b"replaced",
+            )
+        assert response.status_code == 201, response.text
+        with open(os.path.join(dst.assets, "uploads", "cast.png"), "rb") as f:
+            assert f.read() == b"replaced"
+        with open(source_file, "rb") as f:
+            assert f.read() == b"original"
+
+    def test_empty_runs(self, server, src, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy", json={"source": "src", "runs": []}
+            )
+        assert response.status_code == 400
+
+    def test_same_workspace(self, server, src):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/src/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 400
+
+    def test_unknown_destination(self, server, src):
+        make_run(src, "wf", R1)
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/nope/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 404
+
+    def test_unknown_source(self, server, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "nope", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 404
+
+    def test_a_missing_run_is_404(self, server, src, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 404
+
+    def test_traversal_is_400(self, server, src, dst):
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": ["../x"]},
+            )
+        assert response.status_code == 400
+
+    @pytest.mark.parametrize(
+        "destination",
+        ["../dst", "/tmp/dst", "dst/../x", ".", "..", "", "dst/"],
+    )
+    def test_a_bad_destination_name_is_refused_by_name(
+        self, server, root, src, dst, destination
+    ):
+        # Built as the MCP client builds it: each name reaches the route
+        # rather than being normalized into another URL on the way
+        make_run(src, "wf", R1)
+        before = sorted(os.listdir(root.root))
+        with server() as client:
+            response = client.post(
+                api_path("api", "workspaces", destination, "copy"),
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 404, response.text
+        assert response.json()["detail"] == f"No such workspace: {destination}"
+        assert sorted(os.listdir(root.root)) == before
+        assert nothing_written(dst)
+
+    def test_an_active_job_conflicts(self, server, src, dst):
+        make_run(src, "wf", R1)
+        with server() as client:
+            job = SimpleNamespace(
+                status="running",
+                run_dir=f"wf/{R1}",
+                spec={"workspace": "src"},
+            )
+            client.app.state.job_manager.jobs["j1"] = job
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 409
+        assert response.json()["detail"]["conflicts"] == [f"wf/{R1}"]
+        assert nothing_written(dst)
+
+    def test_a_finished_job_does_not_conflict(self, server, src, dst):
+        make_run(src, "wf", R1)
+        with server() as client:
+            client.app.state.job_manager.jobs["j1"] = SimpleNamespace(
+                status="succeeded", run_dir=f"wf/{R1}", spec={"workspace": "src"}
+            )
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 200
+
+    def test_no_workspace_root(self, server):
+        with server(with_root=False) as client:
+            response = client.post(
+                "/api/workspaces/dst/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 409
+
+    def test_the_default_is_the_source_when_omitted(self, server, root, dst):
+        make_run(root, "wf", R1)
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/dst/copy", json={"runs": [f"wf/{R1}"]}
+            )
+        assert response.status_code == 200, response.text
+        assert response.json()["source"] == "default"
+        assert os.path.isfile(os.path.join(dst.outputs, "wf", R1, "img.png"))
+
+    def test_the_default_can_be_the_destination(self, server, root, src):
+        make_run(src, "wf", R1)
+        with server() as client:
+            response = client.post(
+                "/api/workspaces/default/copy",
+                json={"source": "src", "runs": [f"wf/{R1}"]},
+            )
+        assert response.status_code == 200, response.text
+        assert os.path.isfile(os.path.join(root.outputs, "wf", R1, "img.png"))
+
+
+class TestMcp:
+    def recording(self, workspace=None):
+        seen = []
+
+        def handler(request):
+            seen.append(request)
+            return httpx.Response(200, json={"ok": True})
+
+        client = DwClient(
+            transport=httpx.MockTransport(handler),
+            **({"workspace": workspace} if workspace else {}),
+        )
+        return client, seen
+
+    def test_source_defaults_to_the_session_workspace(self):
+        client, seen = self.recording("shots")
+        copy_to_workspace(client, "final", ["wf/x"])
+        assert seen[0].method == "POST"
+        assert seen[0].url.path == "/api/workspaces/final/copy"
+        body = json.loads(seen[0].content)
+        assert body == {"source": "shots", "runs": ["wf/x"], "assets": []}
+
+    def test_assets_pass_through(self):
+        client, seen = self.recording("shots")
+        copy_to_workspace(client, "final", assets=["proj/"])
+        body = json.loads(seen[0].content)
+        assert body == {"source": "shots", "runs": [], "assets": ["proj/"]}
+
+    def test_an_explicit_source_passes_through(self):
+        client, seen = self.recording("shots")
+        copy_to_workspace(client, "final", ["wf/x"], source="other")
+        assert json.loads(seen[0].content)["source"] == "other"
+
+
+class TestTheOwners:
+    """The rules a copy relies on live with their owners (#859 arch review):
+    the entry shape in dw/security.py, the numbering in dw/runs.py."""
+
+    def test_an_entry_follows_the_output_reference_segment_rule(self):
+        from dw.security import validate_output_prefix, validate_output_reference
+
+        assert validate_output_prefix("wf") == "wf"
+        assert validate_output_prefix(f"ltx2/Gyre/{R1}") == f"ltx2/Gyre/{R1}"
+        for name in ("wf@a", "w.f-1/x"):
+            validate_output_prefix(name)
+            validate_output_reference(f"{name}/latest/img.png")
+        for bad in ("@wf", "wf/.hidden", "a/b/c/d/e/f/g/h", "wf/x y"):
+            with pytest.raises(InvalidInputError):
+                validate_output_prefix(bad)
+
+    def test_copy_runs_in_pins_the_destinations_unrecorded_runs_first(self, tmp_path):
+        from dw.runs import copy_runs_in
+
+        source = tmp_path / "src" / "wf"
+        dest = tmp_path / "dst" / "wf"
+        for base, run_id, version in ((source, R2, 1), (dest, R1, None)):
+            run_dir = base / run_id
+            run_dir.mkdir(parents=True)
+            manifest = {"run_id": run_id}
+            if version is not None:
+                manifest["version"] = version
+            (run_dir / "manifest.json").write_text(json.dumps(manifest))
+
+        def place(run_id):
+            os.makedirs(dest / run_id)
+            (dest / run_id / "manifest.json").write_text(
+                (source / run_id / "manifest.json").read_text()
+            )
+
+        renumbered = copy_runs_in(str(source), str(dest), [R2], place)
+
+        assert renumbered == {R2: {"from": 1, "to": 2}}
+        recorded = json.loads((dest / R1 / "manifest.json").read_text())
+        assert recorded["version"] == 1
+        assert run_versions(str(dest)) == {R1: 1, R2: 2}
+        assert json.loads((source / R2 / "manifest.json").read_text())["version"] == 1
diff --git a/ui/src/App.svelte b/ui/src/App.svelte
index 04709092..adb04525 100644
--- a/ui/src/App.svelte
+++ b/ui/src/App.svelte
@@ -4,6 +4,7 @@
   import {
     BookOpen,
     Braces,
+    ChevronDown,
     KeyRound,
     Menu,
     Moon,
@@ -12,14 +13,27 @@
   } from '@lucide/svelte'
   import { Toaster } from 'svelte-sonner'
   import { route } from './lib/router.svelte'
-  import { api } from './lib/api'
+  import { api, TERMINAL_STATUSES } from './lib/api'
+  import { isEditable } from './lib/editable'
+  import { notify } from './lib/toast'
+  import { wsHref } from './lib/routes'
+  import {
+    endedTitle,
+    finishedText,
+    nextWatch,
+    runningIds,
+    tabTitle,
+  } from './lib/jobWatch'
+  import { alertFinished, alertMode, unlockChime } from './lib/finishAlert'
+  import { alerts } from './lib/alerts.svelte'
   import { storageGet, storageSet } from './lib/storage'
-  import type { HealthInfo, MemoryInfo } from './lib/types'
+  import type { HealthInfo, JobDetail, MemoryInfo } from './lib/types'
   import Sidebar from './lib/Sidebar.svelte'
   import Breadcrumb from './lib/Breadcrumb.svelte'
   import KeyboardHelp from './lib/KeyboardHelp.svelte'
   import StatusPopover from './lib/StatusPopover.svelte'
   import TokenPopover from './lib/TokenPopover.svelte'
+  import AlertToggle from './lib/AlertToggle.svelte'
   import ConfirmDialog from './lib/ui/ConfirmDialog.svelte'
   import WorkflowsPage from './lib/pages/WorkflowsPage.svelte'
   import WorkflowPage from './lib/pages/WorkflowPage.svelte'
@@ -29,6 +43,7 @@
   import PromptsPage from './lib/pages/PromptsPage.svelte'
   import PromptEditorPage from './lib/pages/PromptEditorPage.svelte'
   import GalleryPage from './lib/pages/GalleryPage.svelte'
+  import ComparePage from './lib/pages/ComparePage.svelte'
   import OverviewPage from './lib/pages/OverviewPage.svelte'
   import AssetsPage from './lib/pages/AssetsPage.svelte'
   import ModelsPage from './lib/pages/ModelsPage.svelte'
@@ -45,17 +60,72 @@
   let statusTrigger = $state<HTMLElement | null>(null)
   let tokenTrigger = $state<HTMLElement | null>(null)
   const currentJob = $derived(health?.current_job ?? null)
+  // One job per card: with more than one running, the chip cannot link to
+  // them all, so it joins the status trigger and the popover lists each
+  const running = $derived(health ? runningIds(health) : [])
+  const statusLabel = $derived(
+    running.length > 1
+      ? `${running.length} jobs running - server & worker status`
+      : 'server & worker status',
+  )
+  const view = $derived(route.view)
 
-  function isEditable(target: EventTarget | null): boolean {
-    if (!(target instanceof HTMLElement)) return false
-    return (
-      target instanceof HTMLInputElement ||
-      target instanceof HTMLTextAreaElement ||
-      target instanceof HTMLSelectElement ||
-      target.isContentEditable
-    )
+  // The tab title and the finish alert (jobWatch.ts, finishAlert.ts); what
+  // a poll means for the watched jobs is nextWatch's to decide
+  let watched: string[] | null = null
+  let runningJob = $state<JobDetail | null>(null)
+  let othersRunning = $state(0)
+  let endedMark = $state<string | null>(null)
+
+  async function watchJobs(info: HealthInfo | null) {
+    const next = nextWatch(watched, info)
+    watched = next.watched
+    // A failed poll leaves the title showing what it last knew
+    if (info) {
+      const now = next.running
+      othersRunning = Math.max(0, now.length - 1)
+      runningJob = now[0] ? await api.getJob(now[0]).catch(() => null) : null
+    }
+    for (const id of next.ended) {
+      const job = await api.getJob(id).catch(() => null)
+      if (job && TERMINAL_STATUSES.includes(job.status)) announce(job)
+    }
+  }
+
+  function announce(job: JobDetail) {
+    const text = finishedText(job)
+    if (document.hidden) endedMark = endedTitle(job)
+    // The job's own page already shows its outcome
+    const onItsPage =
+      view.kind === 'ws' && view.section === 'jobs' && view.rest[0] === job.id
+    if (!onItsPage) {
+      if (job.status === 'succeeded') notify.success(text)
+      else notify.error(text)
+    }
+    if (alerts.on && document.hidden)
+      alertFinished(text, wsHref(job.workspace, 'jobs', job.id))
   }
 
+  $effect(() => {
+    document.title = endedMark ?? tabTitle(runningJob, othersRunning)
+  })
+  $effect(() => {
+    const back = () => {
+      if (!document.hidden) endedMark = null
+    }
+    // A chime may only play after a gesture; after a reload the first
+    // click anywhere is that gesture
+    const unlock = () => {
+      if (alerts.on && alertMode() === 'chime') unlockChime()
+    }
+    document.addEventListener('visibilitychange', back)
+    window.addEventListener('pointerdown', unlock, { once: true })
+    return () => {
+      document.removeEventListener('visibilitychange', back)
+      window.removeEventListener('pointerdown', unlock)
+    }
+  })
+
   function onKeydown(event: KeyboardEvent) {
     if (event.key === '?' && !isEditable(event.target)) {
       event.preventDefault()
@@ -76,6 +146,7 @@
       ])
       memory = memoryInfo.status === 'fulfilled' ? memoryInfo.value : null
       health = healthInfo.status === 'fulfilled' ? healthInfo.value : null
+      void watchJobs(health)
     }
     return poll(refreshStatus, 5000)
   })
@@ -133,7 +204,6 @@
     drawerOpen = false
     window.scrollTo(0, 0)
   })
-  const view = $derived(route.view)
   const wide = $derived(
     (view.kind === 'ws' && view.section === 'edit') ||
       (view.kind === 'shared' && view.section === 'prompt-edit'),
@@ -171,29 +241,38 @@
         <Breadcrumb />
         <span class="flex"></span>
         <div class="state">
-          {#if currentJob}
+          {#if running.length === 1}
             <!-- The one thing worth pinning to every page: what the GPU is
              doing, and a way straight to it. The legacy '#/jobs/<id>' form is
-             deliberate: health.current_job carries no workspace, so the legacy
+             deliberate: health carries no workspace for the job, so the legacy
              redirect plus JobPage's correction is how it lands under the job's
              own workspace -->
             <a
               class="plain live"
-              href="#/jobs/{currentJob}"
+              href="#/jobs/{running[0]}"
               title="go to the job"
             >
               <span class="pulse-dot"></span>running
             </a>
           {/if}
+          {#snippet busy()}
+            <!-- Inside the trigger rather than beside it: a second button
+             opening the same popover would read as a press outside it -->
+            <span class="live">
+              <span class="pulse-dot"></span>{running.length} running
+              <ChevronDown size={13} />
+            </span>
+          {/snippet}
           {#if metered.length}
             <button
               class="bare vram"
               bind:this={statusTrigger}
               onclick={() => (statusOpen = !statusOpen)}
               title={meterTitle(metered) || 'VRAM allocated'}
-              aria-label="server & worker status"
+              aria-label={statusLabel}
               aria-expanded={statusOpen}
             >
+              {#if running.length > 1}{@render busy()}{/if}
               <span class="meters">
                 {#each metered as card, i (card.device ?? i)}
                   <span class="meter">
@@ -215,10 +294,11 @@
               bind:this={statusTrigger}
               onclick={() => (statusOpen = !statusOpen)}
               title="server & worker status"
-              aria-label="server & worker status"
+              aria-label={statusLabel}
               aria-expanded={statusOpen}
             >
-              {currentJob ? 'status' : 'idle'}
+              {#if running.length > 1}{@render busy()}
+              {:else}{currentJob ? 'status' : 'idle'}{/if}
             </button>
           {/if}
           <StatusPopover
@@ -238,6 +318,7 @@
             <KeyRound size={15} />
           </button>
           <TokenPopover bind:open={tokenOpen} anchor={tokenTrigger} />
+          <AlertToggle />
           <button
             class="bare icon"
             onclick={cycleTheme}
@@ -289,6 +370,7 @@
         {:else}<WorkflowsPage examples />{/if}
       {:else if view.section === 'overview'}<OverviewPage />
       {:else if view.section === 'gallery'}<GalleryPage />
+      {:else if view.section === 'compare'}<ComparePage names={view.rest} />
       {:else if view.section === 'assets'}<AssetsPage />
       {:else if view.section === 'edit'}<EditorPage
           name={view.rest.join('/')}
diff --git a/ui/src/app.css b/ui/src/app.css
index e78f5506..33f80513 100644
--- a/ui/src/app.css
+++ b/ui/src/app.css
@@ -571,6 +571,13 @@ button.frame:hover {
   display: flex;
   flex-direction: column;
 }
+
+/* A drop target with files hovering over it (dropFiles.ts). Ink, not
+   --select: it is the pointer's place, not a selection */
+.dropping {
+  outline: 2px dashed var(--ink);
+  outline-offset: 4px;
+}
 .ui-message {
   margin: 0 0 var(--space-4);
   white-space: pre-line;
diff --git a/ui/src/lib/AlertToggle.svelte b/ui/src/lib/AlertToggle.svelte
new file mode 100644
index 00000000..33120abd
--- /dev/null
+++ b/ui/src/lib/AlertToggle.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+  import { Bell, BellOff } from '@lucide/svelte'
+  import { alertMode } from './finishAlert'
+  import { alerts, toggleAlerts } from './alerts.svelte'
+</script>
+
+<button
+  class="bare icon"
+  onclick={toggleAlerts}
+  aria-pressed={alerts.on}
+  aria-label={alerts.on
+    ? 'stop job-finished alerts'
+    : 'alert me when a job finishes'}
+  title={alerts.on
+    ? 'alerts on - click to stop'
+    : alertMode() === 'chime'
+      ? 'chime when a job finishes while this tab is in the background (this page is not a secure origin, so desktop notifications are unavailable)'
+      : 'notify me when a job finishes while this tab is in the background'}
+>
+  {#if alerts.on}<Bell size={15} />{:else}<BellOff size={15} />{/if}
+</button>
diff --git a/ui/src/lib/AlertToggle.test.ts b/ui/src/lib/AlertToggle.test.ts
new file mode 100644
index 00000000..2fb317df
--- /dev/null
+++ b/ui/src/lib/AlertToggle.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render, waitFor } from '@testing-library/svelte'
+
+const enableAlerts = vi.fn<() => Promise<boolean>>()
+const error = vi.fn()
+vi.mock('./finishAlert', () => ({
+  alertMode: () => 'chime',
+  enableAlerts: () => enableAlerts(),
+}))
+vi.mock('./toast', () => ({ notify: { error: (m: string) => error(m) } }))
+
+import AlertToggle from './AlertToggle.svelte'
+import { alerts } from './alerts.svelte'
+import { storageGet } from './storage'
+
+afterEach(() => {
+  cleanup()
+  alerts.on = false
+  enableAlerts.mockReset()
+  error.mockReset()
+  localStorage.clear()
+})
+
+const button = () => document.querySelector('button')!
+
+it('turns alerts on once the browser allows them, and remembers it', async () => {
+  enableAlerts.mockResolvedValue(true)
+  render(AlertToggle)
+  expect(button().getAttribute('aria-pressed')).toBe('false')
+  await fireEvent.click(button())
+  await waitFor(() => expect(alerts.on).toBe(true))
+  expect(button().getAttribute('aria-pressed')).toBe('true')
+  expect(button().getAttribute('aria-label')).toBe('stop job-finished alerts')
+  expect(storageGet('alert-finished', null)).toBe(true)
+})
+
+it('stays off and says why when the browser refuses', async () => {
+  enableAlerts.mockResolvedValue(false)
+  render(AlertToggle)
+  await fireEvent.click(button())
+  await waitFor(() => expect(error).toHaveBeenCalledOnce())
+  expect(alerts.on).toBe(false)
+  expect(button().getAttribute('title')).toMatch(/^chime when a job finishes/)
+})
+
+it('turns off without asking', async () => {
+  alerts.on = true
+  render(AlertToggle)
+  await fireEvent.click(button())
+  await waitFor(() => expect(alerts.on).toBe(false))
+  expect(enableAlerts).not.toHaveBeenCalled()
+  expect(storageGet('alert-finished', null)).toBe(false)
+})
diff --git a/ui/src/lib/BulkBar.svelte b/ui/src/lib/BulkBar.svelte
index a939f1d3..d42ba786 100644
--- a/ui/src/lib/BulkBar.svelte
+++ b/ui/src/lib/BulkBar.svelte
@@ -3,7 +3,8 @@
   // bar while anything is ticked, and the select-all button above the grid.
   // Shared by the gallery and the assets page, which run the same selection
   // (see picks.svelte.ts) and had two copies of this markup and its CSS.
-  import { Download, Trash2 } from '@lucide/svelte'
+  import { Columns2, Download, Trash2 } from '@lucide/svelte'
+  import { COMPARE_MAX } from './compare'
   import type { Picks } from './picks.svelte'
 
   let {
@@ -14,6 +15,7 @@
     noun,
     ondownload,
     ondelete,
+    oncompare,
   }: {
     picks: Picks
     /** How many the grid is showing - what "select all" would take. */
@@ -24,6 +26,8 @@
     noun: string
     ondownload: () => void
     ondelete: () => void
+    /** Only the gallery compares; without it no button shows. */
+    oncompare?: () => void
   } = $props()
 </script>
 
@@ -31,6 +35,19 @@
   <div class="picks panel" role="region" aria-label="selected {noun}s">
     <strong>{picks.size} selected</strong>
     <span class="flex"></span>
+    {#if oncompare}
+      <button
+        class="quiet icon"
+        onclick={oncompare}
+        disabled={busy || picks.size < 2 || picks.size > COMPARE_MAX}
+        title={picks.size > COMPARE_MAX
+          ? `compare up to ${COMPARE_MAX} at a time`
+          : 'compare the selected side by side'}
+        aria-label="compare the selected {noun}s side by side"
+      >
+        <Columns2 size={14} />
+      </button>
+    {/if}
     <button
       class="quiet icon"
       onclick={ondownload}
diff --git a/ui/src/lib/KeyboardHelp.svelte b/ui/src/lib/KeyboardHelp.svelte
index f5e49288..6f974357 100644
--- a/ui/src/lib/KeyboardHelp.svelte
+++ b/ui/src/lib/KeyboardHelp.svelte
@@ -13,6 +13,12 @@
     <dd>validate &amp; run (workflow editor)</dd>
     <dt><kbd>Esc</kbd></dt>
     <dd>close this help, the gallery drawer, and other panels</dd>
+    <dt><kbd>←</kbd> / <kbd>→</kbd></dt>
+    <dd>previous / next file (gallery details)</dd>
+    <dt><kbd>Delete</kbd> or <kbd>⌘</kbd> + <kbd>⌫</kbd></dt>
+    <dd>delete the open file and show the next (gallery details)</dd>
+    <dt><kbd>S</kbd></dt>
+    <dd>star / unstar the open file (gallery details)</dd>
     <dt><kbd>?</kbd></dt>
     <dd>show this help</dd>
   </dl>
diff --git a/ui/src/lib/Sidebar.svelte b/ui/src/lib/Sidebar.svelte
index dc544d64..805da98d 100644
--- a/ui/src/lib/Sidebar.svelte
+++ b/ui/src/lib/Sidebar.svelte
@@ -5,6 +5,7 @@
     ChevronDown,
     ChevronRight,
     Database,
+    Eye,
     FolderOpen,
     Images,
     LayoutDashboard,
@@ -33,6 +34,9 @@
   import { createWorkspaceAndGo } from './workspaceActions'
   import { formatBytes } from './format'
   import { wsColor } from './wsColor'
+  import { groupWorkspaces } from './wsGroups'
+  import { hiddenWorkspaces } from './hiddenWorkspaces.svelte'
+  import { storageGet, storageSet } from './storage'
 
   let {
     collapsed,
@@ -104,6 +108,21 @@
   const sharedActive = (s: SharedSection) =>
     sharedSection === s || (s === 'prompts' && sharedSection === 'prompt-edit')
 
+  const folded = $derived(
+    groupWorkspaces(workspace.names ?? [workspace.current], {
+      hidden: hiddenWorkspaces.names,
+      open: workspace.current,
+    }),
+  )
+  let openGroups = $state(storageGet<string[]>('open-ws-groups', []))
+  function toggleGroup(prefix: string) {
+    openGroups = openGroups.includes(prefix)
+      ? openGroups.filter((p) => p !== prefix)
+      : [...openGroups, prefix]
+    storageSet('open-ws-groups', openGroups)
+  }
+  let showHidden = $state(false)
+
   let adding = $state(false)
   let newName = $state('')
   let addError = $state('')
@@ -123,6 +142,62 @@
   }
 </script>
 
+{#snippet wsRow(name: string)}
+  {#if name === expanded}
+    <!-- The open workspace is one block: a --select rail and tint
+               behind its name and sections, a guide line down its children,
+               so siblings read as outside it -->
+    <div class="ws open" class:flash={switched} style:--ws-dot={wsColor(name)}>
+      {#if collapsed}
+        <span class="dot solo" title={name}></span>
+      {:else}
+        <span class="wsname" title={name}>
+          <ChevronDown size={13} class="chev" />
+          <span class="dot"></span>
+          <span class="name">{name}</span>
+          {#if workspace.usage[name]}
+            <span
+              class="num muted size"
+              title="{workspace.usage[name].files} files"
+              >{formatBytes(workspace.usage[name].bytes)}</span
+            >
+          {/if}
+        </span>
+      {/if}
+      <div class="sections" transition:slide={motion}>
+        {#each WS_ITEMS as item (item.section)}
+          <a
+            class="plain item"
+            href={wsHref(name, item.section)}
+            aria-current={wsSection === item.section ? 'page' : undefined}
+            title={item.label}
+          >
+            <item.icon size={15} />{#if !collapsed}<span class="label"
+                >{item.label}</span
+              >{/if}
+          </a>
+        {/each}
+      </div>
+    </div>
+  {:else if !collapsed}
+    <a
+      class="plain ws shut"
+      href={wsHref(name, 'overview')}
+      title={name}
+      style:--ws-dot={wsColor(name)}
+    >
+      <ChevronRight size={13} class="chev" />
+      <span class="dot"></span>
+      <span class="name">{name}</span>
+      {#if workspace.usage[name]}
+        <span class="num muted size"
+          >{formatBytes(workspace.usage[name].bytes)}</span
+        >
+      {/if}
+    </a>
+  {/if}
+{/snippet}
+
 <aside class:collapsed {inert} aria-label="navigation">
   <div class="top">
     <a class="brand plain" href={wsHref(workspace.current, 'overview')}>dw</a>
@@ -141,65 +216,50 @@
   <nav>
     <div class="group" role="group" aria-label="workspaces">
       {#if !collapsed}<span class="grouplabel muted">Workspaces</span>{/if}
-      {#each workspace.names ?? [workspace.current] as name (name)}
-        {#if name === expanded}
-          <!-- The open workspace is one block: a --select rail and tint
-               behind its name and sections, a guide line down its children,
-               so siblings read as outside it -->
-          <div
-            class="ws open"
-            class:flash={switched}
-            style:--ws-dot={wsColor(name)}
-          >
-            {#if collapsed}
-              <span class="dot solo" title={name}></span>
-            {:else}
-              <span class="wsname" title={name}>
-                <ChevronDown size={13} class="chev" />
-                <span class="dot"></span>
-                <span class="name">{name}</span>
-                {#if workspace.usage[name]}
-                  <span
-                    class="num muted size"
-                    title="{workspace.usage[name].files} files"
-                    >{formatBytes(workspace.usage[name].bytes)}</span
-                  >
-                {/if}
-              </span>
-            {/if}
-            <div class="sections" transition:slide={motion}>
-              {#each WS_ITEMS as item (item.section)}
-                <a
-                  class="plain item"
-                  href={wsHref(name, item.section)}
-                  aria-current={wsSection === item.section ? 'page' : undefined}
-                  title={item.label}
-                >
-                  <item.icon size={15} />{#if !collapsed}<span class="label"
-                      >{item.label}</span
-                    >{/if}
-                </a>
-              {/each}
-            </div>
-          </div>
-        {:else if !collapsed}
-          <a
-            class="plain ws shut"
-            href={wsHref(name, 'overview')}
-            title={name}
-            style:--ws-dot={wsColor(name)}
-          >
-            <ChevronRight size={13} class="chev" />
-            <span class="dot"></span>
-            <span class="name">{name}</span>
-            {#if workspace.usage[name]}
-              <span class="num muted size"
-                >{formatBytes(workspace.usage[name].bytes)}</span
-              >
+      {#each folded.entries as entry (entry.kind === 'ws' ? entry.name : `group:${entry.prefix}`)}
+        {#if entry.kind === 'ws'}
+          {@render wsRow(entry.name)}
+        {:else}
+          {@const isOpen =
+            openGroups.includes(entry.prefix) ||
+            entry.names.includes(workspace.current)}
+          {#if collapsed}
+            {#each entry.names as name (name)}{@render wsRow(name)}{/each}
+          {:else}
+            <button
+              class="plain ws shut wsgroup"
+              aria-expanded={isOpen}
+              onclick={() => toggleGroup(entry.prefix)}
+              title="{entry.names.length} workspaces named {entry.prefix}-…"
+            >
+              {#if isOpen}<ChevronDown
+                  size={13}
+                  class="chev"
+                />{:else}<ChevronRight size={13} class="chev" />{/if}
+              <span class="name">{entry.prefix}-…</span>
+              <span class="num muted size">{entry.names.length}</span>
+            </button>
+            {#if isOpen}
+              <div class="groupkids">
+                {#each entry.names as name (name)}{@render wsRow(name)}{/each}
+              </div>
             {/if}
-          </a>
+          {/if}
         {/if}
       {/each}
+      {#if folded.hidden.length && !collapsed}
+        <button
+          class="bare muted hiddentoggle"
+          aria-expanded={showHidden}
+          onclick={() => (showHidden = !showHidden)}
+          ><Eye size={13} />{folded.hidden.length} hidden</button
+        >
+        {#if showHidden}
+          <div class="groupkids">
+            {#each folded.hidden as name (name)}{@render wsRow(name)}{/each}
+          </div>
+        {/if}
+      {/if}
       {#if !collapsed && workspace.root}
         {#if adding}
           <form
@@ -444,6 +504,22 @@
     background: color-mix(in srgb, var(--select) 16%, transparent);
     font-weight: 600;
   }
+  .groupkids {
+    padding-left: var(--space-3);
+  }
+  /* hidden rows carry the "hidden" toggle's label, not a faded colour: an
+     opacity on --muted text falls below AA in both themes */
+  .hiddentoggle {
+    display: inline-flex;
+    gap: 0.35rem;
+    align-items: center;
+    font-size: var(--t-sm);
+    padding: var(--space-1) var(--space-2);
+  }
+  .wsgroup {
+    width: 100%;
+    text-align: left;
+  }
   .newws {
     display: flex;
     flex-direction: column;
diff --git a/ui/src/lib/Sidebar.test.ts b/ui/src/lib/Sidebar.test.ts
index da44221b..5166546a 100644
--- a/ui/src/lib/Sidebar.test.ts
+++ b/ui/src/lib/Sidebar.test.ts
@@ -163,3 +163,21 @@ it('marks the open workspace apart from its siblings', async () => {
   expect(hue(open)).toMatch(/^oklch/)
   expect(hue(container.querySelector('.ws.shut'))).not.toBe(hue(open))
 })
+
+it('folds a run of same-prefix workspaces into one group row', async () => {
+  listWorkspaces.mockResolvedValueOnce({
+    workspace_root: '/ws',
+    default: 'main',
+    workspaces: ['regression-a', 'regression-b', 'regression-c', 'main'].map(
+      (name) => ({ name, default: name === 'main' }),
+    ),
+  })
+  location.hash = '#/ws/main/overview'
+  window.dispatchEvent(new HashChangeEvent('hashchange'))
+  render(Sidebar, { collapsed: false, onToggle: () => {} })
+  const group = await screen.findByRole('button', { name: /regression/ })
+  expect(group.getAttribute('aria-expanded')).toBe('false')
+  expect(screen.queryByText('regression-a')).toBeNull()
+  await fireEvent.click(group)
+  expect(screen.getByText('regression-a')).toBeTruthy()
+})
diff --git a/ui/src/lib/alerts.svelte.ts b/ui/src/lib/alerts.svelte.ts
new file mode 100644
index 00000000..584b42fd
--- /dev/null
+++ b/ui/src/lib/alerts.svelte.ts
@@ -0,0 +1,25 @@
+/** Whether a job finishing in a background tab raises an alert
+ * (finishAlert.ts) - a per-browser choice, so it is kept locally. Shared
+ * state: the toggle in the header sets it, and App's announce and its
+ * chime-unlock listener read it. */
+import { enableAlerts } from './finishAlert'
+import { notify } from './toast'
+import { storageGet, storageSet } from './storage'
+
+export const alerts = $state({
+  on: storageGet<boolean>('alert-finished', false),
+})
+
+export async function toggleAlerts(): Promise<void> {
+  if (alerts.on) {
+    alerts.on = false
+  } else if (await enableAlerts()) {
+    alerts.on = true
+  } else {
+    notify.error(
+      'The browser blocked notifications for this site - allow them in its site settings',
+    )
+    return
+  }
+  storageSet('alert-finished', alerts.on)
+}
diff --git a/ui/src/lib/api.test.ts b/ui/src/lib/api.test.ts
index 447ba5eb..ec070afb 100644
--- a/ui/src/lib/api.test.ts
+++ b/ui/src/lib/api.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { api, fetchOutputText } from './api'
+import { api, fetchOutputText, setNote } from './api'
 
 type Stub = {
   ok: boolean
@@ -289,3 +289,22 @@ describe('job export', () => {
     expect(api.exportZipUrl('/exports/j1.zip')).toBe('/exports/j1.zip')
   })
 })
+
+describe('setNote', () => {
+  it('scopes to a named workspace, not the picker', async () => {
+    const calls = stubFetch({ ok: true, body: {} })
+    await setNote('wf/run-1', 'n', 'studio')
+    expect(calls[0][0]).toBe('/api/notes?workspace=studio')
+    expect(calls[0][1]?.method).toBe('PUT')
+    expect(JSON.parse(String(calls[0][1]?.body))).toEqual({
+      target: 'wf/run-1',
+      note: 'n',
+    })
+  })
+
+  it("uses the picker's workspace when none is named", async () => {
+    const calls = stubFetch({ ok: true, body: {} })
+    await setNote('wf/run-1', null)
+    expect(calls[0][0]).toBe('/api/notes')
+  })
+})
diff --git a/ui/src/lib/api.ts b/ui/src/lib/api.ts
index bdc551e2..fd26bac6 100644
--- a/ui/src/lib/api.ts
+++ b/ui/src/lib/api.ts
@@ -1,5 +1,7 @@
 import type {
   AssetDeleted,
+  NoteSet,
+  StarSet,
   AssetList,
   ClassList,
   Deleted,
@@ -276,7 +278,14 @@ export const api = {
     ),
   // Loads the whole gallery in one request, like listWorkflows/listPrompts -
   // the limit just needs to exceed any real output directory's file count
-  gallery: () => request<GalleryList>('/api/gallery?limit=100000'),
+  // `roles` narrows to those roles server-side (repeated `role` parameters;
+  // a null role counts as final there). The page filters on the client, so
+  // it asks for none
+  gallery: (roles?: string[]) => {
+    const params = new URLSearchParams({ limit: '100000' })
+    for (const role of roles ?? []) params.append('role', role)
+    return request<GalleryList>(`/api/gallery?${params}`)
+  },
   // `workspace`, when given, names the file's own workspace and wins over
   // whatever is currently selected in the picker - mirrors `outputUrl`, since
   // a job page must read its own files from where they were written
@@ -293,6 +302,12 @@ export const api = {
     request<OutputDeleted>(`/api/gallery/${encodePath(name)}`, {
       method: 'DELETE',
     }),
+  setStarred: (name: string, starred: boolean) =>
+    request<StarSet>('/api/stars', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name, starred }),
+    }),
   outputDownloadUrl: (name: string, workspace?: string) =>
     withToken(`/api/gallery/${encodePath(name)}/download`, workspace),
   /** Download a multi-file gallery selection as one zip. The browser
@@ -433,6 +448,27 @@ export async function fetchOutputText(
   return response.text()
 }
 
+/** Set (or, with null, clear) the note on a workspace, asset, run or file.
+ * A file name or run directory is read in the picked workspace, unless
+ * `workspace` names another - a job page edits the run of the job's own
+ * workspace, wherever the picker has since moved. */
+export function setNote(
+  target: string,
+  note: string | null,
+  workspace?: string,
+): Promise<NoteSet> {
+  const path = '/api/notes'
+  return request<NoteSet>(
+    workspace === undefined ? path : scopeTo(path, workspace),
+    {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ target, note }),
+    },
+    { scope: workspace === undefined },
+  )
+}
+
 export const TERMINAL_STATUSES = ['succeeded', 'failed', 'cancelled']
 
 /** Stream a job's events; returns a stop function. The stream closes itself
diff --git a/ui/src/lib/assets/AssetDetail.svelte b/ui/src/lib/assets/AssetDetail.svelte
index 49d5cc68..8dc824dd 100644
--- a/ui/src/lib/assets/AssetDetail.svelte
+++ b/ui/src/lib/assets/AssetDetail.svelte
@@ -1,6 +1,9 @@
 <script lang="ts">
   import { Trash2, X } from '@lucide/svelte'
   import CopyButton from '../CopyButton.svelte'
+  import { api } from '../api'
+  import NoteEditor from '../ui/NoteEditor.svelte'
+  import { ASSET } from '../references'
   import type { AssetFile } from '../types'
   import { formatBytes, formatMtime } from '../format'
   import { wsHref } from '../routes'
@@ -13,12 +16,36 @@
     busy,
     onremove,
     onclose,
+    onnotesaved,
   }: {
     asset: AssetFile
     busy: boolean
     onremove: (asset: AssetFile) => void
     onclose: () => void
+    /** The note the server stored, so the page can carry it on the asset */
+    onnotesaved?: (note: string | null) => void
   } = $props()
+
+  // Where a kept asset came from, when keep_output recorded it: the
+  // workflow and run version of the job that wrote the file
+  let keptFrom = $state('')
+  $effect(() => {
+    const reference = asset.reference
+    keptFrom = ''
+    let stale = false
+    api
+      .galleryMetadata(reference)
+      .then((r) => {
+        if (stale || !r.job) return
+        const workflow =
+          typeof r.job.workflow === 'string' ? r.job.workflow : r.job.id
+        keptFrom = `kept from ${workflow}${r.version ? ` v${r.version}` : ''}`
+      })
+      .catch(() => {})
+    return () => {
+      stale = true
+    }
+  })
 </script>
 
 <div class="detail panel">
@@ -63,6 +90,9 @@
       aria-label="close details"><X size={14} /></button
     >
   </div>
+  {#if keptFrom}
+    <p class="usedby muted">{keptFrom}</p>
+  {/if}
   {#if asset.used_by?.length}
     <p class="usedby muted">
       used by
@@ -72,6 +102,11 @@
         >{/each}
     </p>
   {/if}
+  <NoteEditor
+    note={asset.note}
+    target={`${ASSET}${asset.name}`}
+    onsaved={(note) => onnotesaved?.(note)}
+  />
   <div class="body">
     {#if asset.kind === 'image'}
       <img src={asset.url} alt={asset.name} />
diff --git a/ui/src/lib/assets/AssetDetail.test.ts b/ui/src/lib/assets/AssetDetail.test.ts
new file mode 100644
index 00000000..7fea2d70
--- /dev/null
+++ b/ui/src/lib/assets/AssetDetail.test.ts
@@ -0,0 +1,61 @@
+import { cleanup, render, screen, waitFor } from '@testing-library/svelte'
+import { afterEach, expect, it, vi } from 'vitest'
+import AssetDetail from './AssetDetail.svelte'
+import type { AssetFile } from '../types'
+
+const provenance = vi.hoisted(() => ({
+  response: null as Record<string, unknown> | null,
+}))
+const galleryMetadata = vi.hoisted(() =>
+  vi.fn<(name: string) => Promise<Record<string, unknown> | null>>(() =>
+    Promise.resolve(provenance.response),
+  ),
+)
+vi.mock('../api', () => ({
+  api: { galleryMetadata: (name: string) => galleryMetadata(name) },
+}))
+
+afterEach(() => {
+  cleanup()
+  galleryMetadata.mockClear()
+})
+
+const asset: AssetFile = {
+  name: 'face.png',
+  folder: '',
+  reference: 'asset:face.png',
+  kind: 'image',
+  size: 10,
+  mtime: 1,
+  url: '/assets/face.png',
+  origin: 'workspace',
+  writable: true,
+}
+
+const props = { asset, busy: false, onremove: () => {}, onclose: () => {} }
+
+it('says which workflow and version a kept asset came from', async () => {
+  provenance.response = {
+    job: { id: 'j1', status: 'succeeded', workflow: 'portrait' },
+    version: 3,
+  }
+  render(AssetDetail, props)
+  await waitFor(() => expect(screen.getByText(/kept from/)).toBeTruthy())
+  expect(screen.getByText(/kept from/).textContent?.trim()).toBe(
+    'kept from portrait v3',
+  )
+  expect(galleryMetadata).toHaveBeenCalledWith('asset:face.png')
+})
+
+it('says nothing for an asset with no recorded provenance', async () => {
+  provenance.response = { job: null, version: null }
+  render(AssetDetail, props)
+  await waitFor(() => expect(galleryMetadata).toHaveBeenCalled())
+  await new Promise((r) => setTimeout(r, 0))
+  expect(screen.queryByText(/kept from/)).toBeNull()
+})
+
+it('shows the asset note', () => {
+  render(AssetDetail, { ...props, asset: { ...asset, note: 'the hero face' } })
+  expect(screen.getByText('the hero face')).toBeTruthy()
+})
diff --git a/ui/src/lib/compare.test.ts b/ui/src/lib/compare.test.ts
new file mode 100644
index 00000000..995a28c2
--- /dev/null
+++ b/ui/src/lib/compare.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import { argumentOf, differingArguments, valueText } from './compare'
+
+const meta = (args: Record<string, unknown>, extra = {}) => ({
+  arguments: args,
+  ...extra,
+})
+
+describe('differingArguments', () => {
+  it('lists only the keys whose values differ, model and seed first', () => {
+    expect(
+      differingArguments([
+        meta(
+          { prompt: 'a', steps: 12, width: 1344 },
+          { model_name: 'h3', seed: 1 },
+        ),
+        meta(
+          { prompt: 'a', steps: 30, width: 1344 },
+          { model_name: 'h3', seed: 2 },
+        ),
+      ]),
+    ).toEqual(['seed', 'steps'])
+  })
+  it('a key one side lacks is a difference', () => {
+    expect(differingArguments([meta({ lora: 'x' }), meta({})])).toEqual([
+      'lora',
+    ])
+  })
+  it('compares structured values by content', () => {
+    expect(
+      differingArguments([meta({ q: { a: 1 } }), meta({ q: { a: 1 } })]),
+    ).toEqual([])
+  })
+  it('missing metadata counts as unknown, not as different', () => {
+    expect(differingArguments([meta({ steps: 1 }), null])).toEqual([])
+  })
+})
+
+describe('argumentOf / valueText', () => {
+  it('reads model and seed from the top level, the rest from arguments', () => {
+    const m = meta({ steps: 12 }, { model_name: 'h3', seed: 9 })
+    expect(argumentOf(m, 'model')).toBe('h3')
+    expect(argumentOf(m, 'seed')).toBe(9)
+    expect(argumentOf(m, 'steps')).toBe(12)
+  })
+  it('prints strings bare, the rest as JSON, cut long', () => {
+    expect(valueText('a cat')).toBe('a cat')
+    expect(valueText({ a: 1 })).toBe('{"a":1}')
+    expect(valueText(undefined)).toBe('—')
+    expect(valueText('x'.repeat(300))).toHaveLength(201)
+  })
+})
diff --git a/ui/src/lib/compare.ts b/ui/src/lib/compare.ts
new file mode 100644
index 00000000..731bb5b2
--- /dev/null
+++ b/ui/src/lib/compare.ts
@@ -0,0 +1,40 @@
+/** What a side-by-side compare reads off each file's metadata: the
+ * arguments that actually differ between the files. The rest are shared and
+ * would only bury the one change the comparison is about. */
+
+export const COMPARE_MAX = 4
+
+type Meta = Record<string, unknown> | null
+
+export function argumentOf(meta: Meta, key: string): unknown {
+  if (!meta) return undefined
+  if (key === 'model') return meta.model_name
+  if (key === 'seed')
+    return meta.seed ?? (meta.arguments as Record<string, unknown>)?.seed
+  return (meta.arguments as Record<string, unknown> | undefined)?.[key]
+}
+
+const same = (a: unknown, b: unknown) => JSON.stringify(a) === JSON.stringify(b)
+
+/** Keys that differ across the files that have metadata - model and seed
+ * first, then the arguments alphabetically. A file whose metadata could
+ * not be read is unknown, not different. */
+export function differingArguments(metas: Meta[]): string[] {
+  const known = metas.filter((m): m is Record<string, unknown> => !!m)
+  if (known.length < 2) return []
+  const keys = new Set<string>()
+  for (const m of known)
+    for (const k of Object.keys((m.arguments as object) ?? {})) keys.add(k)
+  keys.delete('seed')
+  const ordered = ['model', 'seed', ...[...keys].sort()]
+  return ordered.filter((key) => {
+    const first = argumentOf(known[0], key)
+    return known.some((m) => !same(argumentOf(m, key), first))
+  })
+}
+
+export function valueText(value: unknown): string {
+  if (value === undefined || value === null) return '—'
+  const text = typeof value === 'string' ? value : JSON.stringify(value)
+  return text.length > 200 ? `${text.slice(0, 200)}…` : text
+}
diff --git a/ui/src/lib/dropFiles.test.ts b/ui/src/lib/dropFiles.test.ts
new file mode 100644
index 00000000..c5eae1c4
--- /dev/null
+++ b/ui/src/lib/dropFiles.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it, vi } from 'vitest'
+import { dropFiles } from './dropFiles'
+
+function dragEvent(type: string, files: File[]) {
+  const event = new Event(type, { bubbles: true, cancelable: true })
+  Object.defineProperty(event, 'dataTransfer', {
+    value: { types: ['Files'], files, dropEffect: 'none' },
+  })
+  return event
+}
+
+describe('dropFiles', () => {
+  it('hands over the accepted files and marks the target while dragging', () => {
+    const node = document.createElement('div')
+    const ondrop = vi.fn()
+    const png = new File(['x'], 'a.png', { type: 'image/png' })
+    const txt = new File(['x'], 'b.txt', { type: 'text/plain' })
+    const action = dropFiles(node, {
+      ondrop,
+      accept: (f) => f.type.startsWith('image/'),
+    })
+    node.dispatchEvent(dragEvent('dragenter', [png, txt]))
+    expect(node.classList.contains('dropping')).toBe(true)
+    const drop = dragEvent('drop', [png, txt])
+    node.dispatchEvent(drop)
+    expect(drop.defaultPrevented).toBe(true)
+    expect(ondrop).toHaveBeenCalledWith([png])
+    expect(node.classList.contains('dropping')).toBe(false)
+    action?.destroy?.()
+  })
+
+  it('claims but ignores drops while disabled', () => {
+    const node = document.createElement('div')
+    const ondrop = vi.fn()
+    dropFiles(node, { ondrop, disabled: true })
+    const drop = dragEvent('drop', [new File(['x'], 'a.png')])
+    node.dispatchEvent(drop)
+    expect(drop.defaultPrevented).toBe(true)
+    expect(ondrop).not.toHaveBeenCalled()
+  })
+
+  it('keeps the mark until the last leave', () => {
+    const node = document.createElement('div')
+    const child = document.createElement('span')
+    node.append(child)
+    dropFiles(node, { ondrop: vi.fn() })
+    const f = [new File(['x'], 'a.png')]
+    node.dispatchEvent(dragEvent('dragenter', f))
+    child.dispatchEvent(dragEvent('dragenter', f))
+    node.dispatchEvent(dragEvent('dragleave', f))
+    expect(node.classList.contains('dropping')).toBe(true)
+    child.dispatchEvent(dragEvent('dragleave', f))
+    expect(node.classList.contains('dropping')).toBe(false)
+  })
+
+  it('clears the mark when disabled flips on mid-drag', () => {
+    const node = document.createElement('div')
+    const ondrop = vi.fn()
+    const action = dropFiles(node, { ondrop })
+    const f = [new File(['x'], 'a.png')]
+    node.dispatchEvent(dragEvent('dragenter', f))
+    action?.update?.({ ondrop, disabled: true })
+    node.dispatchEvent(dragEvent('drop', f))
+    expect(node.classList.contains('dropping')).toBe(false)
+    expect(ondrop).not.toHaveBeenCalled()
+  })
+})
diff --git a/ui/src/lib/dropFiles.ts b/ui/src/lib/dropFiles.ts
new file mode 100644
index 00000000..dfbeedf2
--- /dev/null
+++ b/ui/src/lib/dropFiles.ts
@@ -0,0 +1,66 @@
+/** Drop files from the desktop onto an element. A drag that carries no
+ * files (text, a link, a tile being dragged inside the page) is left alone
+ * so it keeps its native behaviour. `dropping` marks the element while
+ * files hover; enter/leave are counted because they fire for every child
+ * the pointer crosses. */
+import type { Action } from 'svelte/action'
+
+export interface DropOptions {
+  ondrop: (files: File[]) => void
+  accept?: (file: File) => boolean
+  disabled?: boolean
+}
+
+export const dropFiles: Action<HTMLElement, DropOptions> = (node, initial) => {
+  let options = initial
+  let depth = 0
+  // A file drag is always claimed, even while disabled: left alone, the
+  // browser would navigate to the dropped file and lose the page (and any
+  // upload in flight). Only the highlight and the hand-over are gated
+  const carriesFiles = (e: DragEvent) =>
+    Array.from(e.dataTransfer?.types ?? []).includes('Files')
+  const clear = () => {
+    depth = 0
+    node.classList.remove('dropping')
+  }
+  const enter = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    depth++
+    if (!options.disabled) node.classList.add('dropping')
+  }
+  const over = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    if (e.dataTransfer)
+      e.dataTransfer.dropEffect = options.disabled ? 'none' : 'copy'
+  }
+  const leave = () => {
+    if (depth > 0 && --depth === 0) node.classList.remove('dropping')
+  }
+  const drop = (e: DragEvent) => {
+    if (!carriesFiles(e)) return
+    e.preventDefault()
+    clear()
+    if (options.disabled) return
+    const files = Array.from(e.dataTransfer?.files ?? []).filter(
+      (f) => options.accept?.(f) ?? true,
+    )
+    if (files.length) options.ondrop(files)
+  }
+  node.addEventListener('dragenter', enter)
+  node.addEventListener('dragover', over)
+  node.addEventListener('dragleave', leave)
+  node.addEventListener('drop', drop)
+  return {
+    update(next) {
+      options = next
+    },
+    destroy() {
+      node.removeEventListener('dragenter', enter)
+      node.removeEventListener('dragover', over)
+      node.removeEventListener('dragleave', leave)
+      node.removeEventListener('drop', drop)
+    },
+  }
+}
diff --git a/ui/src/lib/editable.test.ts b/ui/src/lib/editable.test.ts
new file mode 100644
index 00000000..26d25aa4
--- /dev/null
+++ b/ui/src/lib/editable.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest'
+import { isEditable } from './editable'
+
+describe('isEditable', () => {
+  it('is true for text entry and media, false for plain elements', () => {
+    expect(isEditable(document.createElement('input'))).toBe(true)
+    expect(isEditable(document.createElement('textarea'))).toBe(true)
+    expect(isEditable(document.createElement('select'))).toBe(true)
+    // a focused <video> seeks on the arrow keys itself
+    expect(isEditable(document.createElement('video'))).toBe(true)
+    expect(isEditable(document.createElement('div'))).toBe(false)
+    expect(isEditable(null)).toBe(false)
+  })
+})
diff --git a/ui/src/lib/editable.ts b/ui/src/lib/editable.ts
new file mode 100644
index 00000000..7986952b
--- /dev/null
+++ b/ui/src/lib/editable.ts
@@ -0,0 +1,13 @@
+/** Whether a keypress landed somewhere that owns its own keys: text entry,
+ * a select, contenteditable, or a media element (a focused <video> seeks on
+ * the arrow keys). A page-wide shortcut stands aside for all of them. */
+export function isEditable(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false
+  return (
+    target instanceof HTMLInputElement ||
+    target instanceof HTMLTextAreaElement ||
+    target instanceof HTMLSelectElement ||
+    target instanceof HTMLMediaElement ||
+    target.isContentEditable === true
+  )
+}
diff --git a/ui/src/lib/editor/ArgumentsEditor.svelte b/ui/src/lib/editor/ArgumentsEditor.svelte
index 916b7d7f..9220295f 100644
--- a/ui/src/lib/editor/ArgumentsEditor.svelte
+++ b/ui/src/lib/editor/ArgumentsEditor.svelte
@@ -18,6 +18,7 @@
   import { promptTooltip } from '../prompts'
   import { referenceCompletions } from '../refcomplete.svelte'
   import BrowseButton from '../assets/BrowseButton.svelte'
+  import ClampedText from '../ui/ClampedText.svelte'
   import type { PipelineDescription } from '../types'
 
   let {
@@ -159,7 +160,9 @@
           </div>
         {/if}
         {#if parameter?.description}
-          <div class="hint muted">{parameter.description}</div>
+          <div class="hint muted">
+            <ClampedText text={parameter.description} lines={3} />
+          </div>
         {/if}
       </div>
       <button
@@ -199,7 +202,9 @@
               >{parameter.name}{parameter.required ? ' *' : ''}</span
             >
             {#if parameter.description}
-              <span class="muted availdesc">{parameter.description}</span>
+              <div class="muted availdesc">
+                <ClampedText text={parameter.description} lines={2} />
+              </div>
             {/if}
           </div>
         {/each}
diff --git a/ui/src/lib/editor/MediaArgumentInput.svelte b/ui/src/lib/editor/MediaArgumentInput.svelte
index 8a27f7cb..c4e2dfd5 100644
--- a/ui/src/lib/editor/MediaArgumentInput.svelte
+++ b/ui/src/lib/editor/MediaArgumentInput.svelte
@@ -13,6 +13,7 @@
   import { ASSET, OUTPUT, referenceName } from '../references'
   import { ensureOutputLibrary, outputNamed } from '../outputlib.svelte'
   import type { MediaKind } from '../editor'
+  import { dropFiles } from '../dropFiles'
 
   let {
     id,
@@ -74,8 +75,10 @@
   async function pick(e: Event & { currentTarget: HTMLInputElement }) {
     const file = e.currentTarget.files?.[0]
     e.currentTarget.value = ''
-    if (!file) return
+    if (file) await uploadFile(file)
+  }
 
+  async function uploadFile(file: File) {
     error = ''
     setLocalPreview(URL.createObjectURL(file))
     uploading = true
@@ -103,7 +106,14 @@
   }}
 />
 
-<div class="media">
+<div
+  class="media"
+  use:dropFiles={{
+    ondrop: (files) => uploadFile(files[0]),
+    accept: (f) => f.type.startsWith(`${kind}/`),
+    disabled: uploading,
+  }}
+>
   <div class="row1">
     <Suggest
       {id}
@@ -128,7 +138,7 @@
     <button
       type="button"
       class="quiet icon"
-      title={`browse for a local ${kind} file`}
+      title={`browse for a local ${kind} file, or drop a file here`}
       aria-label={`browse for a local ${kind} file`}
       disabled={uploading}
       onclick={() => fileInput?.click()}
diff --git a/ui/src/lib/expandedNotes.test.ts b/ui/src/lib/expandedNotes.test.ts
new file mode 100644
index 00000000..74934769
--- /dev/null
+++ b/ui/src/lib/expandedNotes.test.ts
@@ -0,0 +1,18 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { isRemembered, remember } from './expandedNotes'
+
+describe('expandedNotes', () => {
+  beforeEach(() => localStorage.clear())
+
+  it('remembers and forgets', () => {
+    remember('workspace:a', true)
+    expect(isRemembered('workspace:a')).toBe(true)
+    remember('workspace:a', false)
+    expect(isRemembered('workspace:a')).toBe(false)
+  })
+  it('keeps only the newest 200', () => {
+    for (let i = 0; i < 205; i++) remember(`k${i}`, true)
+    expect(isRemembered('k0')).toBe(false)
+    expect(isRemembered('k204')).toBe(true)
+  })
+})
diff --git a/ui/src/lib/expandedNotes.ts b/ui/src/lib/expandedNotes.ts
new file mode 100644
index 00000000..46713630
--- /dev/null
+++ b/ui/src/lib/expandedNotes.ts
@@ -0,0 +1,17 @@
+/** Which long notes this browser left expanded, so a note someone opened
+ * to read stays open when they come back to it. Newest last, capped, so the
+ * list cannot grow without bound across thousands of run notes. */
+import { storageGet, storageSet } from './storage'
+
+const KEY = 'expanded-notes'
+const CAP = 200
+
+export function isRemembered(key: string): boolean {
+  return storageGet<string[]>(KEY, []).includes(key)
+}
+
+export function remember(key: string, open: boolean): void {
+  const list = storageGet<string[]>(KEY, []).filter((k) => k !== key)
+  if (open) list.push(key)
+  storageSet(KEY, list.slice(-CAP))
+}
diff --git a/ui/src/lib/finishAlert.test.ts b/ui/src/lib/finishAlert.test.ts
new file mode 100644
index 00000000..c20aae05
--- /dev/null
+++ b/ui/src/lib/finishAlert.test.ts
@@ -0,0 +1,22 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { alertMode } from './finishAlert'
+
+describe('alertMode', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('uses desktop notifications on a secure origin', () => {
+    vi.stubGlobal('isSecureContext', true)
+    vi.stubGlobal('Notification', function () {})
+    expect(alertMode()).toBe('notification')
+  })
+  it('falls back to a chime over plain http from another machine', () => {
+    vi.stubGlobal('isSecureContext', false)
+    vi.stubGlobal('Notification', function () {})
+    expect(alertMode()).toBe('chime')
+  })
+  it('falls back to a chime where the API does not exist', () => {
+    vi.stubGlobal('isSecureContext', true)
+    vi.stubGlobal('Notification', undefined)
+    expect(alertMode()).toBe('chime')
+  })
+})
diff --git a/ui/src/lib/finishAlert.ts b/ui/src/lib/finishAlert.ts
new file mode 100644
index 00000000..bff8f29a
--- /dev/null
+++ b/ui/src/lib/finishAlert.ts
@@ -0,0 +1,63 @@
+/** The alert a finished job raises in a tab nobody is looking at.
+ *
+ * A desktop notification needs a secure context - https, or localhost - and
+ * this UI is routinely opened over plain http from another machine
+ * (http://<gpu-box>:8765), where the Notification API is not offered. There
+ * the alert is a short chime instead. The browser only lets a page make
+ * sound after the person has interacted with it, so the chime is unlocked on
+ * the click that turns alerts on, and again on the first click after a
+ * reload. */
+export type AlertMode = 'notification' | 'chime'
+
+export function alertMode(): AlertMode {
+  return typeof Notification === 'function' && globalThis.isSecureContext
+    ? 'notification'
+    : 'chime'
+}
+
+let audio: AudioContext | null = null
+
+export function unlockChime(): void {
+  try {
+    audio ??= new AudioContext()
+    void audio.resume()
+  } catch {
+    /* no Web Audio - the tab title still carries the news */
+  }
+}
+
+/** Asks for permission where that applies; false when it was refused. */
+export async function enableAlerts(): Promise<boolean> {
+  if (alertMode() === 'notification') {
+    if (Notification.permission === 'granted') return true
+    return (await Notification.requestPermission()) === 'granted'
+  }
+  unlockChime()
+  return true
+}
+
+function chime(): void {
+  if (!audio) return
+  const now = audio.currentTime
+  const tone = audio.createOscillator()
+  const gain = audio.createGain()
+  tone.frequency.value = 880
+  gain.gain.setValueAtTime(0.15, now)
+  gain.gain.exponentialRampToValueAtTime(0.0001, now + 0.6)
+  tone.connect(gain).connect(audio.destination)
+  tone.start(now)
+  tone.stop(now + 0.6)
+}
+
+export function alertFinished(text: string, href: string): void {
+  if (alertMode() === 'notification' && Notification.permission === 'granted') {
+    const note = new Notification('diffusers-workflow', { body: text })
+    note.onclick = () => {
+      window.focus()
+      location.hash = href.replace(/^#/, '')
+      note.close()
+    }
+    return
+  }
+  chime()
+}
diff --git a/ui/src/lib/format.test.ts b/ui/src/lib/format.test.ts
index f9d9fd98..149ad2ef 100644
--- a/ui/src/lib/format.test.ts
+++ b/ui/src/lib/format.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   formatBytes,
   formatDuration,
+  formatMinutes,
   formatMtime,
   gbFromBytes,
   gbFromMb,
@@ -46,3 +47,10 @@ describe('formatDuration', () => {
     expect(formatDuration(3725)).toBe('1h 02m')
   })
 })
+
+describe('formatMinutes', () => {
+  it('rounds to two places and says <1 below a minute', () => {
+    expect(formatMinutes(12.946)).toBe('~12.95 min')
+    expect(formatMinutes(0.4)).toBe('<1 min')
+  })
+})
diff --git a/ui/src/lib/format.ts b/ui/src/lib/format.ts
index ae3b79e5..5df3f728 100644
--- a/ui/src/lib/format.ts
+++ b/ui/src/lib/format.ts
@@ -36,3 +36,8 @@ export function formatDuration(seconds: number): string {
   if (whole < 3600) return `${Math.floor(whole / 60)}m ${pad(whole % 60)}s`
   return `${Math.floor(whole / 3600)}h ${pad(Math.floor((whole % 3600) / 60))}m`
 }
+
+/** Minutes for a person: under one is '<1 min', anything else keeps the
+ * measured value ('~3 min', '~1.5 min') rather than rounding it away. */
+export const formatMinutes = (minutes: number) =>
+  minutes < 1 ? '<1 min' : `~${Number(minutes.toFixed(2))} min`
diff --git a/ui/src/lib/gallery/GalleryDetail.svelte b/ui/src/lib/gallery/GalleryDetail.svelte
index f170f9b8..416d2513 100644
--- a/ui/src/lib/gallery/GalleryDetail.svelte
+++ b/ui/src/lib/gallery/GalleryDetail.svelte
@@ -1,12 +1,18 @@
 <script lang="ts">
-  import { Bookmark, FolderOpen, Trash2, X } from '@lucide/svelte'
+  import { Bookmark, FolderOpen, Star, Trash2, X } from '@lucide/svelte'
   import DownloadLink from '../DownloadLink.svelte'
   import { api } from '../api'
   import { goWs } from '../router.svelte'
   import { notify } from '../toast'
   import { confirmDialog } from '../confirm.svelte'
   import { describeOutputMeta } from '../outputMeta'
-  import type { GalleryFile } from '../types'
+  import type { GalleryFile, GalleryInput, OutputRole } from '../types'
+  import RoleTag from './RoleTag.svelte'
+  import NoteEditor from '../ui/NoteEditor.svelte'
+  import { ASSET, OUTPUT, referenceName } from '../references'
+  import { outputUrl } from '../apiUrls'
+  import { wsHref } from '../routes'
+  import { workspace } from '../workspace.svelte'
   import { formatBytes, formatMtime } from '../format'
 
   // The detail panel under the grid for the one file picked. The page owns
@@ -17,6 +23,14 @@
     metadata,
     metadataLoading,
     sourceJob,
+    role = null,
+    inputs = [],
+    note = null,
+    runNote = null,
+    noteSource = null,
+    onnotesaved,
+    starred = false,
+    onstar,
     onremove,
     onclose,
   }: {
@@ -24,6 +38,19 @@
     metadata: Record<string, unknown> | null
     metadataLoading: boolean
     sourceJob: { id: string; status: string } | null
+    /** The file's role in its run; null when the run does not say */
+    role?: OutputRole | null
+    /** The assets and outputs the run read */
+    inputs?: GalleryInput[]
+    /** The file's effective note, its run's note, and whose the effective one is */
+    note?: string | null
+    runNote?: string | null
+    noteSource?: 'file' | 'run' | null
+    /** A note changed, so the page can refetch what it shows */
+    onnotesaved?: (kind: 'run' | 'file') => void | Promise<void>
+    /** Whether the file is starred, and the toggle */
+    starred?: boolean
+    onstar?: () => void
     onremove: () => void
     onclose: () => void
   } = $props()
@@ -93,6 +120,39 @@
   const negativePrompt = $derived(described.negativePrompt)
   const seed = $derived(described.seed)
 
+  // Where a run input leads: an output opens its file, an asset the library
+  const inputName = (input: GalleryInput) =>
+    referenceName(input.reference, input.kind === 'asset' ? ASSET : OUTPUT) ??
+    input.reference
+  const inputHref = (input: GalleryInput) =>
+    input.kind === 'asset'
+      ? wsHref(workspace.current, 'assets')
+      : outputUrl(inputName(input))
+  // The folder the file sits in, as the engine wrote it
+  const location = $derived(
+    file.name.includes('/')
+      ? file.name.slice(0, file.name.lastIndexOf('/'))
+      : '',
+  )
+
+  // The run the file belongs to, as a note target; empty under the flat layout
+  const runDir = $derived(file.run_id ? `${file.folder}/${file.run_id}` : '')
+  // A file inheriting its run's note shows that one; "Note this file" swaps
+  // in a box for the file's own, which then overrides it
+  let ownNote = $state(false)
+  $effect(() => {
+    void file.name
+    ownNote = false
+  })
+  const inherited = $derived(noteSource === 'run' && !ownNote && !!runDir)
+
+  // Back to what the server says once it has answered: a cleared file note
+  // returns the run's, a saved one is the file's own
+  async function saveFileNote() {
+    await onnotesaved?.('file')
+    ownNote = false
+  }
+
   function openAsWorkflow() {
     if (!embeddedWorkflow) return
     // Pin the run's seed into the definition so reopening reproduces this
@@ -143,6 +203,14 @@
       >{formatBytes(file.size)} · {formatMtime(file.mtime)}</span
     >
     <DownloadLink href={api.outputDownloadUrl(file.name)} />
+    <button
+      class="quiet icon"
+      onclick={onstar}
+      aria-pressed={starred}
+      aria-label={starred ? 'unstar this file' : 'star this file'}
+      title={starred ? 'starred - press S to unstar' : 'star to keep - press S'}
+      ><Star size={14} fill={starred ? 'currentColor' : 'none'} /></button
+    >
     <button
       class="quiet icon danger"
       onclick={onremove}
@@ -170,49 +238,103 @@
     {:else if file.kind === 'text'}
       <pre class="text">{textBody ?? 'loading…'}</pre>
     {/if}
-    {#if metadata}
+    {#if metadata || role || inputs.length}
       <div class="meta">
-        {#if metadata.step_name}<div>
-            <span class="muted">step</span>
-            {metadata.step_name}
-          </div>{/if}
-        {#if metadata.model_name}<div>
-            <span class="muted">model</span>
-            <code>{metadata.model_name}</code>
-          </div>{/if}
-        {#if seed !== undefined}
-          <div>
-            <span class="muted">seed</span> <code>{seed}</code>
-          </div>
+        <div><RoleTag {role} /></div>
+        {#if inherited}
+          <NoteEditor
+            note={runNote}
+            target={runDir}
+            label="Run note"
+            onsaved={() => onnotesaved?.('run')}
+          />
+          <button type="button" class="bare" onclick={() => (ownNote = true)}
+            >Note this file</button
+          >
+        {:else}
+          <NoteEditor
+            note={ownNote ? null : note}
+            target={file.name}
+            label={ownNote || noteSource === 'file' ? 'File note' : 'Note'}
+            onsaved={saveFileNote}
+          />
         {/if}
-        {#if prompt}
-          <div class="prompt">
-            <span class="muted">prompt</span>
-            <p>{prompt}</p>
-          </div>
+        {#if metadata}
+          <details class="settings">
+            <summary>Settings</summary>
+            {#if metadata.step_name}<div>
+                <span class="muted">step</span>
+                {metadata.step_name}
+              </div>{/if}
+            {#if metadata.model_name}<div>
+                <span class="muted">model</span>
+                <code>{metadata.model_name}</code>
+              </div>{/if}
+            {#if seed !== undefined}
+              <div>
+                <span class="muted">seed</span> <code>{seed}</code>
+              </div>
+            {/if}
+            {#if prompt}
+              <div class="prompt">
+                <span class="muted">prompt</span>
+                <p>{prompt}</p>
+              </div>
+            {/if}
+            {#if negativePrompt}
+              <div class="prompt">
+                <span class="muted">negative prompt</span>
+                <p>{negativePrompt}</p>
+              </div>
+            {/if}
+            {#if sourceJob}
+              <div>
+                <span class="muted">job</span>
+                <a
+                  href={'#/jobs/' + sourceJob.id}
+                  title="open the job that produced this file"
+                >
+                  {sourceJob.id}
+                </a>
+              </div>
+            {/if}
+            {#if embeddedWorkflow}
+              <div>
+                <span class="muted">workflow</span>
+                {embeddedWorkflow.id}
+              </div>
+            {:else}
+              <div class="muted">
+                no embedded workflow - enable embed_metadata in the step's
+                result
+              </div>
+            {/if}
+          </details>
         {/if}
-        {#if negativePrompt}
-          <div class="prompt">
-            <span class="muted">negative prompt</span>
-            <p>{negativePrompt}</p>
+        {#if inputs.length}
+          <div class="madefrom">
+            <span class="muted">Made from</span>
+            <ul>
+              {#each inputs as input (input.kind + input.reference)}
+                <li>
+                  <a
+                    href={inputHref(input)}
+                    target={input.kind === 'output' ? '_blank' : undefined}
+                    title={input.kind === 'asset'
+                      ? 'open the asset library'
+                      : 'open this earlier output'}>{inputName(input)}</a
+                  >
+                  <RoleTag role="input" />
+                  <span class="muted">{input.kind}</span>
+                </li>
+              {/each}
+            </ul>
           </div>
         {/if}
-        {#if sourceJob}
-          <div>
-            <span class="muted">job</span>
-            <a
-              href={'#/jobs/' + sourceJob.id}
-              title="open the job that produced this file"
-            >
-              {sourceJob.id}
-            </a>
-          </div>
-        {/if}
-        {#if embeddedWorkflow}
-          <div><span class="muted">workflow</span> {embeddedWorkflow.id}</div>
-        {:else}
-          <div class="muted">
-            no embedded workflow - enable embed_metadata in the step's result
+        {#if location}
+          <div class="location">
+            <span class="muted">Location</span>
+            <code>{location}/</code>
           </div>
         {/if}
       </div>
@@ -276,6 +398,17 @@
   .meta .muted {
     margin-right: 0.4rem;
   }
+  .settings summary {
+    cursor: pointer;
+    color: var(--muted);
+  }
+  .madefrom ul {
+    margin: 0.15rem 0 0;
+    padding-left: 1.1rem;
+  }
+  .location code {
+    overflow-wrap: anywhere;
+  }
   .prompt p {
     margin: 0.15rem 0 0;
     white-space: pre-wrap;
diff --git a/ui/src/lib/gallery/GalleryDetail.test.ts b/ui/src/lib/gallery/GalleryDetail.test.ts
new file mode 100644
index 00000000..4346325d
--- /dev/null
+++ b/ui/src/lib/gallery/GalleryDetail.test.ts
@@ -0,0 +1,150 @@
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from '@testing-library/svelte'
+import { afterEach, expect, it, vi } from 'vitest'
+import GalleryDetail from './GalleryDetail.svelte'
+import type { GalleryFile } from '../types'
+
+const setNote = vi.hoisted(() => vi.fn())
+vi.mock('../api', () => ({
+  setNote: (t: string, n: string | null) => setNote(t, n),
+  api: { outputDownloadUrl: (name: string) => `/download/${name}` },
+}))
+
+afterEach(cleanup)
+
+const file: GalleryFile = {
+  name: 'wf/run-1/final/a.png',
+  folder: 'wf',
+  subfolder: 'final',
+  run_id: 'run-1',
+  version: 1,
+  url: '/outputs/wf/run-1/final/a.png',
+  kind: 'image',
+  size: 10,
+  mtime: 1,
+  label: 'a.png',
+  role: 'final',
+}
+
+const props = {
+  file,
+  metadata: { model_name: 'org/model', seed: 7 },
+  metadataLoading: false,
+  sourceJob: null,
+  role: 'final' as const,
+  inputs: [
+    { reference: 'asset:face.png', kind: 'asset' as const },
+    { reference: 'output:wf/run-0/b.png', kind: 'output' as const },
+  ],
+  onremove: () => {},
+  onclose: () => {},
+}
+
+it('orders the panel role, Settings, Made from, Location', () => {
+  const { container } = render(GalleryDetail, props)
+  const meta = container.querySelector('.meta') as HTMLElement
+  const order = [...meta.children].map(
+    (el) =>
+      (el.classList.contains('madefrom') && 'Made from') ||
+      (el.querySelector('.role-tag') && 'role') ||
+      (el.matches('details') && el.querySelector('summary')?.textContent) ||
+      el.querySelector('.muted')?.textContent,
+  )
+  expect(order).toEqual(['role', 'Note', 'Settings', 'Made from', 'Location'])
+  // Settings starts collapsed
+  expect((meta.querySelector('details') as HTMLDetailsElement).open).toBe(false)
+  expect(meta.querySelector('.location code')?.textContent).toBe(
+    'wf/run-1/final/',
+  )
+})
+
+it('lists each run input as a link', () => {
+  const { container } = render(GalleryDetail, props)
+  const links = [...container.querySelectorAll('.madefrom a')]
+  expect(links.map((a) => a.textContent)).toEqual([
+    'face.png',
+    'wf/run-0/b.png',
+  ])
+  expect(
+    [...container.querySelectorAll('.madefrom .role-tag')].map(
+      (t) => (t as HTMLElement).dataset.role,
+    ),
+  ).toEqual(['input', 'input'])
+  expect(links[1].getAttribute('href')).toContain('wf/run-0/b.png')
+})
+
+it('omits Made from when the run read nothing', () => {
+  const { container } = render(GalleryDetail, { ...props, inputs: [] })
+  expect(container.querySelector('.madefrom')).toBeNull()
+})
+
+it('shows an inherited run note as the run note and offers to note the file', async () => {
+  render(GalleryDetail, {
+    ...props,
+    note: 'for the client',
+    runNote: 'for the client',
+    noteSource: 'run' as const,
+  })
+  expect(screen.getByText('Run note')).toBeTruthy()
+  expect(screen.getByText('for the client')).toBeTruthy()
+  await fireEvent.click(screen.getByRole('button', { name: 'Note this file' }))
+  expect(screen.getByText('File note')).toBeTruthy()
+  expect(screen.queryByText('for the client')).toBeNull()
+})
+
+it("shows the file's own note", () => {
+  render(GalleryDetail, {
+    ...props,
+    note: 'keeper',
+    noteSource: 'file' as const,
+  })
+  expect(screen.getByText('keeper')).toBeTruthy()
+  expect(screen.queryByRole('button', { name: 'Note this file' })).toBeNull()
+})
+
+it("labels a saved file note as the file's own, and a cleared one returns the run note", async () => {
+  const run = {
+    ...props,
+    note: 'for the client',
+    runNote: 'for the client',
+    noteSource: 'run' as const,
+  }
+  const spy = setNote
+  const onnotesaved = vi.fn(async () => {})
+  const { rerender } = render(GalleryDetail, { ...run, onnotesaved })
+  await fireEvent.click(screen.getByRole('button', { name: 'Note this file' }))
+  spy.mockResolvedValue({
+    target: file.name,
+    note: 'mine',
+    note_source: 'file',
+  })
+  onnotesaved.mockImplementation(async () => {
+    await rerender({ ...run, note: 'mine', noteSource: 'file', onnotesaved })
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+  await fireEvent.input(screen.getByRole('textbox'), {
+    target: { value: 'mine' },
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+  await waitFor(() => expect(screen.getByText('File note')).toBeTruthy())
+  expect(screen.getByText('mine')).toBeTruthy()
+
+  spy.mockResolvedValue({
+    target: file.name,
+    note: 'for the client',
+    note_source: 'run',
+  })
+  onnotesaved.mockImplementation(async () => {
+    await rerender({ ...run, onnotesaved })
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+  await fireEvent.input(screen.getByRole('textbox'), { target: { value: '' } })
+  await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+  await waitFor(() => expect(screen.getByText('Run note')).toBeTruthy())
+  expect(screen.getByText('for the client')).toBeTruthy()
+})
diff --git a/ui/src/lib/gallery/RoleTag.svelte b/ui/src/lib/gallery/RoleTag.svelte
new file mode 100644
index 00000000..c7ff1b02
--- /dev/null
+++ b/ui/src/lib/gallery/RoleTag.svelte
@@ -0,0 +1,38 @@
+<script lang="ts">
+  // A file's role in its run, as a small tag - the gallery's main axis.
+  // Nothing for a file whose run does not say
+  let {
+    role,
+  }: { role: 'final' | 'intermediate' | 'input' | null | undefined } = $props()
+  const text = { final: 'Final', intermediate: 'Intermediate', input: 'Input' }
+</script>
+
+{#if role}
+  <span class="role-tag" data-role={role}>{text[role]}</span>
+{/if}
+
+<style>
+  .role-tag {
+    display: inline-block;
+    padding: 0.05rem 0.4rem;
+    border-radius: 999px;
+    font-family: var(--font-sans);
+    font-size: var(--t-xs);
+    font-weight: 600;
+    line-height: 1.4;
+    white-space: nowrap;
+  }
+  .role-tag[data-role='final'] {
+    background: var(--accent);
+    color: var(--accent-ink);
+  }
+  .role-tag[data-role='intermediate'] {
+    background: var(--panel-2);
+    color: var(--muted);
+  }
+  .role-tag[data-role='input'] {
+    background: transparent;
+    color: var(--muted);
+    border: 1px solid var(--line);
+  }
+</style>
diff --git a/ui/src/lib/gallery/RoleTag.test.ts b/ui/src/lib/gallery/RoleTag.test.ts
new file mode 100644
index 00000000..df5eb882
--- /dev/null
+++ b/ui/src/lib/gallery/RoleTag.test.ts
@@ -0,0 +1,22 @@
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it } from 'vitest'
+import RoleTag from './RoleTag.svelte'
+
+afterEach(cleanup)
+
+describe('RoleTag', () => {
+  it.each([
+    ['final', 'Final'],
+    ['intermediate', 'Intermediate'],
+    ['input', 'Input'],
+  ] as const)('renders %s', (role, text) => {
+    render(RoleTag, { role })
+    const tag = screen.getByText(text)
+    expect(tag.dataset.role).toBe(role)
+  })
+
+  it('renders nothing for a null role', () => {
+    const { container } = render(RoleTag, { role: null })
+    expect(container.textContent?.trim()).toBe('')
+  })
+})
diff --git a/ui/src/lib/generated/api-schema.ts b/ui/src/lib/generated/api-schema.ts
index 835f49c5..bd0bd948 100644
--- a/ui/src/lib/generated/api-schema.ts
+++ b/ui/src/lib/generated/api-schema.ts
@@ -339,6 +339,12 @@ export interface paths {
          *     Off by default and bounded by `limit`: only the page actually
          *     returned is probed, not the whole listing, so the cost of asking
          *     stays proportional to the page size rather than the library size.
+         *
+         *     Each entry carries `role`, `final` or `intermediate` (null for a
+         *     flat-layout file or one no manifest lists); a file a later run read
+         *     lists as intermediate unless its step declared it final
+         *     (dw/roles.py rule 4). `role` is a repeatable
+         *     filter; a null role counts as final. Omitted, every file is listed.
          */
         get: operations["gallery_api_gallery_get"];
         put?: never;
@@ -373,6 +379,36 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/gallery/compare": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Gallery Compare
+         * @description Two to eight outputs side by side at the same moments, and how far
+         *     each is from a baseline (#871): one grid, a row per output and a
+         *     column per moment, plus PSNR, SSIM and mean absolute difference per
+         *     non-baseline output at source resolution. Moments resolve to one
+         *     frame index against the baseline (or the first video) and every
+         *     output is read at that frame; one past an output's end is a blank
+         *     cell. A single `crop` is the region shown and measured; one box per
+         *     name is shown only, and the metrics stay on the full frame. Outputs
+         *     of different sizes get no metrics, and say why. Stills join a video
+         *     comparison as the same image in every column. `max_total_bytes`
+         *     shrinks the whole grid, and `downscaled_to` says to what.
+         */
+        post: operations["gallery_compare_api_gallery_compare_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/gallery/{name}": {
         parameters: {
             query?: never;
@@ -581,6 +617,12 @@ export interface paths {
          *     refused (422) with the interval that fits; the default width is
          *     never refused for length (#823).
          *
+         *     An image's `media` is its measured `{kind, width, height, mode}`,
+         *     read from the file header (#922) - not the width/height arguments
+         *     the pipeline was asked for. `include_workflow=false` drops the
+         *     embedded `metadata.workflow` (the whole definition, often 20 KB) and
+         *     leaves the rest of `metadata` with `workflow_omitted: true`.
+         *
          *     `name` may also be an 'asset:' reference, and then it is the input
          *     asset of that name that is described rather than an output (#127).
          *     The numbers here - duration, frame count, fps, sample rate - are
@@ -597,7 +639,7 @@ export interface paths {
          *     back the same way it reads a kept file's shots (#556). `run_id`/
          *     `version` are that source run's own - `job.id` is still the one to
          *     pass `get_job_workflow`, since a pruned run leaves no `workflow.json`
-         *     of its own to reopen.
+         *     of its own to reopen. `inputs` is the source run's too (#902).
          */
         get: operations["gallery_metadata_api_gallery__name__metadata_get"];
         put?: never;
@@ -1150,7 +1192,7 @@ export interface paths {
         put?: never;
         /**
          * Cancel Download
-         * @description Request cancellation; takes effect at the next progress tick.
+         * @description Request cancellation; `cancel_requested` shows until it is terminal.
          *     Partial files stay in the cache and resume on a retry.
          */
         post: operations["cancel_download_api_models_downloads__download_id__cancel_post"];
@@ -1160,6 +1202,32 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/notes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Put Note
+         * @description Set or clear the note on a run, a file, an asset or a workspace.
+         *
+         *     `target` is a gallery file name (that file's own note), a run directory
+         *     `<identity>/<run id>` (the run note every file of the run falls back to),
+         *     `asset:<name>` or `workspace:<name>` ('default' for the root's own). The
+         *     answer is the target's effective note after the write: a file with no
+         *     note of its own answers with its run's, and `note_source` says which.
+         */
+        put: operations["put_note_api_notes_put"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/pipelines": {
         parameters: {
             query?: never;
@@ -1346,6 +1414,29 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/stars": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Put Star
+         * @description Star or unstar one output file - the "keep" mark a person culls a run
+         *     with. It lives in the run's notes.json beside the notes, so it is
+         *     resolved exactly as a file note is, and only a file in a run directory
+         *     can carry one.
+         */
+        put: operations["put_star_api_stars_put"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/system/diffusers": {
         parameters: {
             query?: never;
@@ -1461,7 +1552,8 @@ export interface paths {
          *     'cast/priya-voice.wav' rather than the random one a browser upload
          *     gets - which is what makes a recurring cast's references readable
          *     in every workflow that carries them. It may name a folder, is
-         *     confined to the library the way `keep_output`'s is, and takes the
+         *     confined the way `keep_output`'s is but placed under `uploads/`
+         *     (not at the library root, as `keep_output`'s is), and takes the
          *     uploaded file's extension when it has none of its own. Without it
          *     the name stays random, so two uploads of the same file never
          *     collide.
@@ -1469,6 +1561,10 @@ export interface paths {
          *     `shared` puts it in the library every workspace under this root
          *     shares rather than in this workspace's own - a recurring cast that
          *     episode four, in a workspace of its own, still has to reach.
+         *
+         *     `note` is kept beside it (the directory's notes.json). An upload over an
+         *     existing name takes its own note, or none: not the old file's, and not
+         *     the old file's kept provenance either.
          */
         post: operations["upload_media_api_uploads_post"];
         delete?: never;
@@ -1658,6 +1754,34 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/workspaces/{destination}/copy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Copy Into Workspace
+         * @description Copy runs and asset-library entries from another workspace into this one.
+         *
+         *     Media is hard-linked where the filesystem allows, so a copy costs
+         *     little disk; sidecars are copied, and an asset's note and kept shots are
+         *     merged into the destination folder's. All or nothing: a run already
+         *     here, or an asset with identical bytes, is skipped as `already_present`;
+         *     a run whose job is still running, or a different file at an asset's
+         *     path, refuses the whole request (409, naming each) with nothing written.
+         *     A move is a copy, then `DELETE` of the source runs and assets.
+         */
+        post: operations["copy_into_workspace_api_workspaces__destination__copy_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/workspaces/{name}": {
         parameters: {
             query?: never;
@@ -1818,6 +1942,11 @@ export interface components {
             mtime: number;
             /** Name */
             name: string;
+            /**
+             * Note
+             * @description The asset's note, when it has one.
+             */
+            note?: string;
             /**
              * Origin
              * @description Which library it came from: this workspace's own, the `common` one every workspace shares, or a read-only examples tree - why a delete can answer 403.
@@ -1935,6 +2064,53 @@ export interface components {
             /** Kind */
             kind: string;
         };
+        /** CompareRequest */
+        CompareRequest: {
+            /**
+             * At
+             * @description 1 to 8 moments - seconds, or "frame:N" - read at the same frame number in every output; default 4 evenly spaced frames
+             */
+            at?: (number | string)[] | null;
+            /**
+             * Baseline
+             * @description The output the others are measured against; default the first
+             */
+            baseline?: string | null;
+            /**
+             * Crop
+             * @description [x, y, width, height] in source pixels, the region shown and measured; or one box per name, shown only
+             */
+            crop?: number[] | number[][] | null;
+            /**
+             * Max Dimension
+             * @description Longest side of each grid cell
+             * @default 384
+             */
+            max_dimension: number;
+            /**
+             * Max Total Bytes
+             * @description A budget on the grid's base64 size
+             */
+            max_total_bytes?: number | null;
+            /**
+             * Names
+             * @description 2 to 8 outputs (or `asset:` references), one row each
+             */
+            names: string[];
+        };
+        /** CopiedItems */
+        CopiedItems: {
+            /**
+             * Assets
+             * @description Library-relative path of each asset file copied.
+             */
+            assets: string[];
+            /**
+             * Runs
+             * @description `<workflow>/<run id>` of each run copied.
+             */
+            runs: string[];
+        };
         /** Deleted */
         Deleted: {
             /** Deleted */
@@ -2182,6 +2358,16 @@ export interface components {
             mtime: number;
             /** Name */
             name: string;
+            /**
+             * Note
+             * @description The effective note: the file's own, else its run's.
+             */
+            note?: string;
+            /**
+             * Role
+             * @description `final` for a deliverable, `intermediate` for a file a later step or run consumed; null under the flat layout or when no manifest lists the file.
+             */
+            role?: ("final" | "intermediate") | null;
             /**
              * Run Id
              * @description The run that wrote the file, `''` under the flat layout.
@@ -2189,6 +2375,11 @@ export interface components {
             run_id: string;
             /** Size */
             size: number;
+            /**
+             * Starred
+             * @description True when the file is starred; absent otherwise.
+             */
+            starred?: boolean;
             /**
              * Subfolder
              * @description What followed the run id in the file's path - the `final` / `intermediate` a step's `result.subfolder` chose, `''` for none.
@@ -2202,6 +2393,16 @@ export interface components {
              */
             version: number | null;
         };
+        /** GalleryInput */
+        GalleryInput: {
+            /**
+             * Kind
+             * @enum {string}
+             */
+            kind: "asset" | "output";
+            /** Reference */
+            reference: string;
+        };
         /** GalleryList */
         GalleryList: {
             /**
@@ -2226,10 +2427,15 @@ export interface components {
         GalleryMetadata: {
             /** Findings */
             findings: components["schemas"]["LevelFinding"][];
+            /**
+             * Inputs
+             * @description The `asset:` and `output:` references the run read; null for a run that recorded none.
+             */
+            inputs?: components["schemas"]["GalleryInput"][] | null;
             job: components["schemas"]["JobRef"] | null;
             /**
              * Media
-             * @description The probe of an audio or video file; null for an image.
+             * @description The probe of an audio or video file, or an image's kind, width, height and mode; null for another file.
              */
             media: {
                 [key: string]: unknown;
@@ -2243,8 +2449,29 @@ export interface components {
             } | null;
             /** Name */
             name: string;
+            /**
+             * Note
+             * @description The effective note: the file's own, else its run's.
+             */
+            note?: string;
+            /**
+             * Note Source
+             * @description Whose note `note` is.
+             * @enum {string}
+             */
+            note_source?: "file" | "run";
+            /**
+             * Role
+             * @description The file's role in its run; null when the run does not say.
+             */
+            role?: ("final" | "intermediate") | null;
             /** Run Id */
             run_id: string;
+            /**
+             * Run Note
+             * @description The note of the run that wrote the file.
+             */
+            run_note?: string;
             /**
              * Source
              * @enum {string}
@@ -2340,6 +2567,11 @@ export interface components {
              * @description Null on a history row recorded before manifests, or by a run that wrote none.
              */
             manifest: components["schemas"]["ManifestEntry"][] | null;
+            /**
+             * Note
+             * @description The note it was submitted with; also its run's note.
+             */
+            note?: string;
             /**
              * Output Kinds
              * @description Each output file's kind; null for a kind the gallery does not show. On GET /api/jobs/{id} only.
@@ -2354,6 +2586,11 @@ export interface components {
              * @description Index in the waiting queue; only while queued.
              */
             queue_position?: number;
+            /**
+             * Rerun Of
+             * @description The job this one reran; absent for a job submitted fresh.
+             */
+            rerun_of?: string;
             /** Run Dir */
             run_dir: string | null;
             /**
@@ -2375,6 +2612,11 @@ export interface components {
             status: "queued" | "running" | "succeeded" | "failed" | "cancelled";
             /** Traceback */
             traceback: string | null;
+            /**
+             * Waiting For
+             * @description Why dispatch is holding this queued job though a card is free - 'waiting for host RAM: needs ~N GB, ~M GB free'; only while queued and held. It starts when a running job frees the RAM.
+             */
+            waiting_for?: string;
             /** Warnings */
             warnings: string[];
             /**
@@ -2504,6 +2746,11 @@ export interface components {
              * @description Directory relative paths in an inline workflow resolve against
              */
             base_dir?: string | null;
+            /**
+             * Note
+             * @description A note on the run, at most 4000 characters: kept with the job and written as the run note when the run opens
+             */
+            note?: string | null;
             /**
              * Workflow
              * @description Inline workflow definition
@@ -2546,11 +2793,21 @@ export interface components {
             historical?: boolean;
             /** Id */
             id: string;
+            /**
+             * Note
+             * @description The note it was submitted with; also its run's note.
+             */
+            note?: string;
             /**
              * Queue Position
              * @description Index in the waiting queue; only while queued.
              */
             queue_position?: number;
+            /**
+             * Rerun Of
+             * @description The job this one reran; absent for a job submitted fresh.
+             */
+            rerun_of?: string;
             /**
              * Run Id
              * @description The run this job opened - null until it opens one, and for a job recorded before runs were tracked.
@@ -2568,6 +2825,11 @@ export interface components {
              * @enum {string}
              */
             status: "queued" | "running" | "succeeded" | "failed" | "cancelled";
+            /**
+             * Waiting For
+             * @description Why dispatch is holding this queued job though a card is free - 'waiting for host RAM: needs ~N GB, ~M GB free'; only while queued and held. It starts when a running job frees the RAM.
+             */
+            waiting_for?: string;
             /**
              * Workflow
              * @description Null only on a row recorded before the workflow was stored.
@@ -2620,6 +2882,11 @@ export interface components {
              * @description The generated file to keep, as the gallery names it
              */
             name: string;
+            /**
+             * Note
+             * @description A note on the kept asset, at most 4000 characters; the source file's effective note when omitted, and none when empty
+             */
+            note?: string | null;
             /**
              * Overwrite
              * @description Replace an asset already under that name
@@ -2704,6 +2971,12 @@ export interface components {
              * @description The step was served from the step cache: these files are an earlier run's, republished, and nothing was generated for them this time.
              */
             reused?: boolean;
+            /**
+             * Role
+             * @description The step's role in its run, as the run's manifest.json records it. Absent while the run is going, or for a run from before roles.
+             * @enum {string}
+             */
+            role?: "final" | "intermediate";
             /** Step */
             step: string;
             /**
@@ -2711,6 +2984,8 @@ export interface components {
              * @description The in-run subfolder the step's `result.subfolder` chose - `final`, `intermediate`, any relative path - `''` when it chose none. Absent only on a job recorded before the field existed.
              */
             subfolder?: string;
+            /** @description Where the step's time went. Only on a pipeline step that ran: a reused step, a task or a composed step has none. */
+            timing?: components["schemas"]["StepTiming"];
         } & {
             [key: string]: unknown;
         };
@@ -2820,6 +3095,12 @@ export interface components {
         };
         /** ModelDownload */
         ModelDownload: {
+            /**
+             * Cancel Requested
+             * @description A cancel was requested and the download has not yet stopped: it is stopping, not still pulling.
+             * @default false
+             */
+            cancel_requested: boolean;
             /** Downloaded */
             downloaded: number;
             /** Error */
@@ -2884,6 +3165,34 @@ export interface components {
              */
             direction: string;
         };
+        /** NoteRequest */
+        NoteRequest: {
+            /**
+             * Note
+             * @description At most 4000 characters; null or '' clears it
+             */
+            note?: string | null;
+            /**
+             * Target
+             * @description What the note is on: a gallery file name, a run directory `<identity>/<run id>`, `asset:<name>` or `workspace:<name>`
+             */
+            target: string;
+        };
+        /** NoteSet */
+        NoteSet: {
+            /**
+             * Note
+             * @description The effective note after the write.
+             */
+            note: string | null;
+            /**
+             * Note Source
+             * @description Whose note `note` is; null for a workspace or no note.
+             */
+            note_source: ("file" | "run") | null;
+            /** Target */
+            target: string;
+        };
         /** OutputDeleted */
         OutputDeleted: {
             /** Deleted */
@@ -2970,6 +3279,8 @@ export interface components {
             estimate: components["schemas"]["PlanEstimate"];
             /** Fingerprint */
             fingerprint: string;
+            /** @description The host RAM this run is projected to hold at its peak, from this machine's own history (#869); absent when there is no figure. */
+            host_memory?: components["schemas"]["PlanHostMemory"];
             /** List Entries */
             list_entries: {
                 [key: string]: number;
@@ -2994,7 +3305,7 @@ export interface components {
             device: string;
             /**
              * Differs
-             * @description With basis `inherited`: what this workflow sets differently from `inherited_from` among offload, quantization and frame count; empty when nothing does.
+             * @description With basis `inherited`: what this workflow sets differently from `inherited_from` among offload, quantization and frame count; empty when nothing does. Otherwise: the cost drivers with no rule to scale by that moved off the default the figure was measured at, with `low_confidence` true.
              */
             differs?: string[];
             /**
@@ -3019,6 +3330,11 @@ export interface components {
             priced_for?: string;
             /** Runs */
             runs: number | null;
+            /**
+             * Scaled
+             * @description With basis `derived` (or `other_device`, or a tempered `observed`): what the curated figure was scaled along - steps, canvas or frames moved off the variable defaults it was measured at (#866). With basis `inherited`: why the template's minutes were re-priced linearly (more pipeline steps or frames than the template run measured) - an approximation, with `low_confidence` true.
+             */
+            scaled?: string;
             /** Tempered */
             tempered?: boolean;
             /**
@@ -3026,6 +3342,30 @@ export interface components {
              * @description What contributed nothing to `minutes` when `partial` is true - the workflow's own id when its own steps went unpriced, else the path of each composed child with no cost block or observed history. When `minutes` is null it still names the composed children that left it unpriced (`partial` is then false); empty when nothing composed went unpriced.
              */
             unpriced: string[];
+            /**
+             * Withheld
+             * @description With basis `unknown` and `inherited_from` set: why the template's runs could not be re-priced for this workflow (its size cannot be compared to the template's).
+             */
+            withheld?: string;
+        };
+        /** PlanHostMemory */
+        PlanHostMemory: {
+            /**
+             * Basis
+             * @description `observed`: the largest job peak of this machine's successful runs with the same pipelines, quantization and offload; `fit`: projected from this workflow's own runs for the requested list length.
+             * @enum {string}
+             */
+            basis: "observed" | "fit";
+            /**
+             * Projected Mb
+             * @description The host RAM, in MB, this run is projected to hold at its peak.
+             */
+            projected_mb: number;
+            /**
+             * Runs
+             * @description How many runs the figure is read from.
+             */
+            runs: number;
         };
         /** PromptCard */
         PromptCard: {
@@ -3244,6 +3584,95 @@ export interface components {
              */
             shadowed_by: "workspace" | "common" | "examples" | "builtin";
         };
+        /** StarRequest */
+        StarRequest: {
+            /**
+             * Name
+             * @description A gallery file name
+             */
+            name: string;
+            /** Starred */
+            starred: boolean;
+        };
+        /** StarSet */
+        StarSet: {
+            /** Name */
+            name: string;
+            /** Starred */
+            starred: boolean;
+        };
+        /**
+         * StepTiming
+         * @description Where one pipeline step's time went, on the worker's monotonic clock
+         *     (dw/pipeline_processors/timing.py). Every `_s` is seconds to 0.1; a field
+         *     whose mark never happened is null, never guessed. Open, like the entry.
+         */
+        StepTiming: {
+            /**
+             * Cache
+             * @description Skip counts, on a step that set a `cache`.
+             */
+            cache?: {
+                [key: string]: unknown;
+            };
+            /**
+             * Compiled
+             * @description The denoiser runs through torch.compile; null when unknown.
+             */
+            compiled: boolean | null;
+            /**
+             * Decode S
+             * @description Last pass's end to the call's return: VAE decode and post-processing.
+             */
+            decode_s: number | null;
+            /**
+             * Denoise S
+             * @description First denoiser forward to the last pass's end; the whole call when the pipeline reports no passes.
+             */
+            denoise_s: number | null;
+            /**
+             * Encode S
+             * @description Call start to the first denoiser forward: prompt encoding and preparation.
+             */
+            encode_s: number | null;
+            /**
+             * First Pass S
+             * @description The first pass, which carries any compile warm-up.
+             */
+            first_pass_s: number | null;
+            /**
+             * Load Cached
+             * @description The pipeline came from the worker's cache; false if any part was loaded fresh, null when the step loaded nothing.
+             */
+            load_cached: boolean | null;
+            /**
+             * Load S
+             * @description Loading or fetching the step's pipeline, cached or not.
+             */
+            load_s: number | null;
+            /**
+             * Pass S
+             * @description Median of passes 2..n, wall time at step boundaries; null with fewer than two passes.
+             */
+            pass_s: number | null;
+            /**
+             * Passes
+             * @description Denoise passes the pipeline ran, one per scheduler timestep; can differ from num_inference_steps.
+             */
+            passes: number | null;
+            /**
+             * Save S
+             * @description Writing the step's files.
+             */
+            save_s: number | null;
+            /**
+             * Segments
+             * @description Pipeline calls summed into this timing: chain segments or iterations; 1 for a plain step.
+             */
+            segments: number;
+        } & {
+            [key: string]: unknown;
+        };
         /** TaskList */
         TaskList: {
             /** Assessment */
@@ -3347,6 +3776,16 @@ export interface components {
              * @description The card as a job record's device names it.
              */
             name: string | null;
+            /**
+             * Oom Score Adj
+             * @description The worker's kernel oom_score_adj, read from /proc at call time (1000 for the latest dispatch's worker in a pool, else the value it was spawned with); absent where unreadable.
+             */
+            oom_score_adj?: number;
+            /**
+             * Pid
+             * @description The worker process's pid; absent while it is not running.
+             */
+            pid?: number;
             /**
              * Vram Gb
              * @description What the card holds, in the GB a catalog cost entry is written in.
@@ -3506,6 +3945,60 @@ export interface components {
             /** Workspace */
             workspace: string;
         };
+        /**
+         * WorkspaceCopied
+         * @description What a copy between workspaces did (`POST /api/workspaces/{name}/copy`).
+         */
+        WorkspaceCopied: {
+            /**
+             * Already Present
+             * @description Runs the destination already held (`<workflow>/<run id>`) and assets it held with identical bytes (library-relative path) - skipped.
+             */
+            already_present: string[];
+            /** Bytes Copied */
+            bytes_copied: number;
+            /** Bytes Linked */
+            bytes_linked: number;
+            copied: components["schemas"]["CopiedItems"];
+            /** Destination */
+            destination: string;
+            /**
+             * Renumbered
+             * @description Copied runs whose `vN` changed, keyed `<workflow>/<run id>`: `{from, to}`.
+             */
+            renumbered: {
+                [key: string]: {
+                    [key: string]: number;
+                };
+            };
+            /** Source */
+            source: string;
+            /**
+             * Warnings
+             * @description `unresolved_output_refs`, `absolute_paths` and `no_jobs`, each only when it applies.
+             */
+            warnings: {
+                [key: string]: unknown;
+            };
+        };
+        /** WorkspaceCopyRequest */
+        WorkspaceCopyRequest: {
+            /**
+             * Assets
+             * @description Asset-library files or folders, as written after `asset:` (`proj/clip.mp4`, `proj/`); each keeps its library-relative path
+             */
+            assets?: string[];
+            /**
+             * Runs
+             * @description `<workflow>/<run id>` entries, or a bare `<workflow>` for all its runs
+             */
+            runs?: string[];
+            /**
+             * Source
+             * @description Workspace to copy from; the default when omitted
+             */
+            source?: string | null;
+        };
         /** WorkspaceDeleted */
         WorkspaceDeleted: {
             /**
@@ -3530,6 +4023,11 @@ export interface components {
             default: boolean;
             /** Name */
             name: string;
+            /**
+             * Note
+             * @description The workspace's note, when it has one; listings only.
+             */
+            note?: string;
             /** Outputs */
             outputs: string;
             /** Prompts */
@@ -3937,6 +4435,7 @@ export interface operations {
                 only_orphans?: boolean;
                 version?: number | null;
                 media?: boolean;
+                role?: string[] | null;
                 workspace?: string | null;
             };
             header?: never;
@@ -4000,6 +4499,41 @@ export interface operations {
             };
         };
     };
+    gallery_compare_api_gallery_compare_post: {
+        parameters: {
+            query?: {
+                workspace?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CompareRequest"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": unknown;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     delete_output_api_gallery__name__delete: {
         parameters: {
             query?: {
@@ -4219,6 +4753,7 @@ export interface operations {
             query?: {
                 envelope?: boolean;
                 interval_seconds?: number;
+                include_workflow?: boolean;
                 workspace?: string | null;
             };
             header?: never;
@@ -5104,6 +5639,41 @@ export interface operations {
             };
         };
     };
+    put_note_api_notes_put: {
+        parameters: {
+            query?: {
+                workspace?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["NoteRequest"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["NoteSet"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     pipelines_api_pipelines_get: {
         parameters: {
             query?: never;
@@ -5398,6 +5968,41 @@ export interface operations {
             };
         };
     };
+    put_star_api_stars_put: {
+        parameters: {
+            query?: {
+                workspace?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StarRequest"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StarSet"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     diffusers_state_api_system_diffusers_get: {
         parameters: {
             query?: never;
@@ -5508,6 +6113,8 @@ export interface operations {
                 filename: string;
                 asset_name?: string | null;
                 shared?: boolean;
+                /** @description A note on the asset, at most 4000 characters */
+                note?: string | null;
                 workspace?: string | null;
             };
             header?: never;
@@ -5871,6 +6478,41 @@ export interface operations {
             };
         };
     };
+    copy_into_workspace_api_workspaces__destination__copy_post: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                destination: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WorkspaceCopyRequest"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceCopied"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     remove_workspace_api_workspaces__name__delete: {
         parameters: {
             query?: {
diff --git a/ui/src/lib/generated/openapi.json b/ui/src/lib/generated/openapi.json
index 95b66e1e..949dd149 100644
--- a/ui/src/lib/generated/openapi.json
+++ b/ui/src/lib/generated/openapi.json
@@ -137,6 +137,11 @@
             "title": "Name",
             "type": "string"
           },
+          "note": {
+            "description": "The asset's note, when it has one.",
+            "title": "Note",
+            "type": "string"
+          },
           "origin": {
             "description": "Which library it came from: this workspace's own, the `common` one every workspace shares, or a read-only examples tree - why a delete can answer 403.",
             "enum": [
@@ -417,6 +422,126 @@
         "title": "ClassList",
         "type": "object"
       },
+      "CompareRequest": {
+        "properties": {
+          "at": {
+            "anyOf": [
+              {
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "number"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ]
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "1 to 8 moments - seconds, or \"frame:N\" - read at the same frame number in every output; default 4 evenly spaced frames",
+            "title": "At"
+          },
+          "baseline": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The output the others are measured against; default the first",
+            "title": "Baseline"
+          },
+          "crop": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "integer"
+                },
+                "type": "array"
+              },
+              {
+                "items": {
+                  "items": {
+                    "type": "integer"
+                  },
+                  "type": "array"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "[x, y, width, height] in source pixels, the region shown and measured; or one box per name, shown only",
+            "title": "Crop"
+          },
+          "max_dimension": {
+            "default": 384,
+            "description": "Longest side of each grid cell",
+            "title": "Max Dimension",
+            "type": "integer"
+          },
+          "max_total_bytes": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "A budget on the grid's base64 size",
+            "title": "Max Total Bytes"
+          },
+          "names": {
+            "description": "2 to 8 outputs (or `asset:` references), one row each",
+            "items": {
+              "type": "string"
+            },
+            "title": "Names",
+            "type": "array"
+          }
+        },
+        "required": [
+          "names"
+        ],
+        "title": "CompareRequest",
+        "type": "object"
+      },
+      "CopiedItems": {
+        "additionalProperties": false,
+        "properties": {
+          "assets": {
+            "description": "Library-relative path of each asset file copied.",
+            "items": {
+              "type": "string"
+            },
+            "title": "Assets",
+            "type": "array"
+          },
+          "runs": {
+            "description": "`<workflow>/<run id>` of each run copied.",
+            "items": {
+              "type": "string"
+            },
+            "title": "Runs",
+            "type": "array"
+          }
+        },
+        "required": [
+          "runs",
+          "assets"
+        ],
+        "title": "CopiedItems",
+        "type": "object"
+      },
       "Deleted": {
         "additionalProperties": false,
         "properties": {
@@ -1130,6 +1255,27 @@
             "title": "Name",
             "type": "string"
           },
+          "note": {
+            "description": "The effective note: the file's own, else its run's.",
+            "title": "Note",
+            "type": "string"
+          },
+          "role": {
+            "anyOf": [
+              {
+                "enum": [
+                  "final",
+                  "intermediate"
+                ],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "`final` for a deliverable, `intermediate` for a file a later step or run consumed; null under the flat layout or when no manifest lists the file.",
+            "title": "Role"
+          },
           "run_id": {
             "description": "The run that wrote the file, `''` under the flat layout.",
             "title": "Run Id",
@@ -1139,6 +1285,11 @@
             "title": "Size",
             "type": "integer"
           },
+          "starred": {
+            "description": "True when the file is starred; absent otherwise.",
+            "title": "Starred",
+            "type": "boolean"
+          },
           "subfolder": {
             "description": "What followed the run id in the file's path - the `final` / `intermediate` a step's `result.subfolder` chose, `''` for none.",
             "title": "Subfolder",
@@ -1176,6 +1327,29 @@
         "title": "GalleryFile",
         "type": "object"
       },
+      "GalleryInput": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "enum": [
+              "asset",
+              "output"
+            ],
+            "title": "Kind",
+            "type": "string"
+          },
+          "reference": {
+            "title": "Reference",
+            "type": "string"
+          }
+        },
+        "required": [
+          "reference",
+          "kind"
+        ],
+        "title": "GalleryInput",
+        "type": "object"
+      },
       "GalleryList": {
         "additionalProperties": false,
         "properties": {
@@ -1240,6 +1414,21 @@
             "title": "Findings",
             "type": "array"
           },
+          "inputs": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/GalleryInput"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The `asset:` and `output:` references the run read; null for a run that recorded none.",
+            "title": "Inputs"
+          },
           "job": {
             "anyOf": [
               {
@@ -1260,7 +1449,7 @@
                 "type": "null"
               }
             ],
-            "description": "The probe of an audio or video file; null for an image.",
+            "description": "The probe of an audio or video file, or an image's kind, width, height and mode; null for another file.",
             "title": "Media"
           },
           "metadata": {
@@ -1280,10 +1469,45 @@
             "title": "Name",
             "type": "string"
           },
+          "note": {
+            "description": "The effective note: the file's own, else its run's.",
+            "title": "Note",
+            "type": "string"
+          },
+          "note_source": {
+            "description": "Whose note `note` is.",
+            "enum": [
+              "file",
+              "run"
+            ],
+            "title": "Note Source",
+            "type": "string"
+          },
+          "role": {
+            "anyOf": [
+              {
+                "enum": [
+                  "final",
+                  "intermediate"
+                ],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The file's role in its run; null when the run does not say.",
+            "title": "Role"
+          },
           "run_id": {
             "title": "Run Id",
             "type": "string"
           },
+          "run_note": {
+            "description": "The note of the run that wrote the file.",
+            "title": "Run Note",
+            "type": "string"
+          },
           "source": {
             "enum": [
               "output",
@@ -1532,6 +1756,11 @@
             "description": "Null on a history row recorded before manifests, or by a run that wrote none.",
             "title": "Manifest"
           },
+          "note": {
+            "description": "The note it was submitted with; also its run's note.",
+            "title": "Note",
+            "type": "string"
+          },
           "output_kinds": {
             "additionalProperties": {
               "anyOf": [
@@ -1569,6 +1798,11 @@
             "title": "Queue Position",
             "type": "integer"
           },
+          "rerun_of": {
+            "description": "The job this one reran; absent for a job submitted fresh.",
+            "title": "Rerun Of",
+            "type": "string"
+          },
           "run_dir": {
             "anyOf": [
               {
@@ -1640,6 +1874,11 @@
             ],
             "title": "Traceback"
           },
+          "waiting_for": {
+            "description": "Why dispatch is holding this queued job though a card is free - 'waiting for host RAM: needs ~N GB, ~M GB free'; only while queued and held. It starts when a running job frees the RAM.",
+            "title": "Waiting For",
+            "type": "string"
+          },
           "warnings": {
             "items": {
               "type": "string"
@@ -1996,6 +2235,18 @@
             "description": "Directory relative paths in an inline workflow resolve against",
             "title": "Base Dir"
           },
+          "note": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "A note on the run, at most 4000 characters: kept with the job and written as the run note when the run opens",
+            "title": "Note"
+          },
           "workflow": {
             "anyOf": [
               {
@@ -2099,11 +2350,21 @@
             "title": "Id",
             "type": "string"
           },
+          "note": {
+            "description": "The note it was submitted with; also its run's note.",
+            "title": "Note",
+            "type": "string"
+          },
           "queue_position": {
             "description": "Index in the waiting queue; only while queued.",
             "title": "Queue Position",
             "type": "integer"
           },
+          "rerun_of": {
+            "description": "The job this one reran; absent for a job submitted fresh.",
+            "title": "Rerun Of",
+            "type": "string"
+          },
           "run_id": {
             "anyOf": [
               {
@@ -2153,6 +2414,11 @@
             "title": "Status",
             "type": "string"
           },
+          "waiting_for": {
+            "description": "Why dispatch is holding this queued job though a card is free - 'waiting for host RAM: needs ~N GB, ~M GB free'; only while queued and held. It starts when a running job frees the RAM.",
+            "title": "Waiting For",
+            "type": "string"
+          },
           "workflow": {
             "anyOf": [
               {
@@ -2262,6 +2528,18 @@
             "title": "Name",
             "type": "string"
           },
+          "note": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "A note on the kept asset, at most 4000 characters; the source file's effective note when omitted, and none when empty",
+            "title": "Note"
+          },
           "overwrite": {
             "default": false,
             "description": "Replace an asset already under that name",
@@ -2418,6 +2696,15 @@
             "title": "Reused",
             "type": "boolean"
           },
+          "role": {
+            "description": "The step's role in its run, as the run's manifest.json records it. Absent while the run is going, or for a run from before roles.",
+            "enum": [
+              "final",
+              "intermediate"
+            ],
+            "title": "Role",
+            "type": "string"
+          },
           "step": {
             "title": "Step",
             "type": "string"
@@ -2426,6 +2713,10 @@
             "description": "The in-run subfolder the step's `result.subfolder` chose - `final`, `intermediate`, any relative path - `''` when it chose none. Absent only on a job recorded before the field existed.",
             "title": "Subfolder",
             "type": "string"
+          },
+          "timing": {
+            "$ref": "#/components/schemas/StepTiming",
+            "description": "Where the step's time went. Only on a pipeline step that ran: a reused step, a task or a composed step has none."
           }
         },
         "required": [
@@ -2723,6 +3014,12 @@
       "ModelDownload": {
         "additionalProperties": false,
         "properties": {
+          "cancel_requested": {
+            "default": false,
+            "description": "A cancel was requested and the download has not yet stopped: it is stopping, not still pulling.",
+            "title": "Cancel Requested",
+            "type": "boolean"
+          },
           "downloaded": {
             "title": "Downloaded",
             "type": "integer"
@@ -2947,6 +3244,76 @@
         "title": "MoveRequest",
         "type": "object"
       },
+      "NoteRequest": {
+        "properties": {
+          "note": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "At most 4000 characters; null or '' clears it",
+            "title": "Note"
+          },
+          "target": {
+            "description": "What the note is on: a gallery file name, a run directory `<identity>/<run id>`, `asset:<name>` or `workspace:<name>`",
+            "title": "Target",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "title": "NoteRequest",
+        "type": "object"
+      },
+      "NoteSet": {
+        "additionalProperties": false,
+        "properties": {
+          "note": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The effective note after the write.",
+            "title": "Note"
+          },
+          "note_source": {
+            "anyOf": [
+              {
+                "enum": [
+                  "file",
+                  "run"
+                ],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Whose note `note` is; null for a workspace or no note.",
+            "title": "Note Source"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target",
+          "note",
+          "note_source"
+        ],
+        "title": "NoteSet",
+        "type": "object"
+      },
       "OutputDeleted": {
         "additionalProperties": false,
         "properties": {
@@ -3142,6 +3509,10 @@
             "title": "Fingerprint",
             "type": "string"
           },
+          "host_memory": {
+            "$ref": "#/components/schemas/PlanHostMemory",
+            "description": "The host RAM this run is projected to hold at its peak, from this machine's own history (#869); absent when there is no figure."
+          },
           "list_entries": {
             "additionalProperties": {
               "type": "integer"
@@ -3217,7 +3588,7 @@
             "type": "string"
           },
           "differs": {
-            "description": "With basis `inherited`: what this workflow sets differently from `inherited_from` among offload, quantization and frame count; empty when nothing does.",
+            "description": "With basis `inherited`: what this workflow sets differently from `inherited_from` among offload, quantization and frame count; empty when nothing does. Otherwise: the cost drivers with no rule to scale by that moved off the default the figure was measured at, with `low_confidence` true.",
             "items": {
               "type": "string"
             },
@@ -3289,6 +3660,11 @@
             ],
             "title": "Runs"
           },
+          "scaled": {
+            "description": "With basis `derived` (or `other_device`, or a tempered `observed`): what the curated figure was scaled along - steps, canvas or frames moved off the variable defaults it was measured at (#866). With basis `inherited`: why the template's minutes were re-priced linearly (more pipeline steps or frames than the template run measured) - an approximation, with `low_confidence` true.",
+            "title": "Scaled",
+            "type": "string"
+          },
           "tempered": {
             "title": "Tempered",
             "type": "boolean"
@@ -3300,6 +3676,11 @@
             },
             "title": "Unpriced",
             "type": "array"
+          },
+          "withheld": {
+            "description": "With basis `unknown` and `inherited_from` set: why the template's runs could not be re-priced for this workflow (its size cannot be compared to the template's).",
+            "title": "Withheld",
+            "type": "string"
           }
         },
         "required": [
@@ -3315,6 +3696,37 @@
         "title": "PlanEstimate",
         "type": "object"
       },
+      "PlanHostMemory": {
+        "additionalProperties": false,
+        "properties": {
+          "basis": {
+            "description": "`observed`: the largest job peak of this machine's successful runs with the same pipelines, quantization and offload; `fit`: projected from this workflow's own runs for the requested list length.",
+            "enum": [
+              "observed",
+              "fit"
+            ],
+            "title": "Basis",
+            "type": "string"
+          },
+          "projected_mb": {
+            "description": "The host RAM, in MB, this run is projected to hold at its peak.",
+            "title": "Projected Mb",
+            "type": "integer"
+          },
+          "runs": {
+            "description": "How many runs the figure is read from.",
+            "title": "Runs",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "projected_mb",
+          "basis",
+          "runs"
+        ],
+        "title": "PlanHostMemory",
+        "type": "object"
+      },
       "PromptCard": {
         "additionalProperties": false,
         "properties": {
@@ -3906,6 +4318,196 @@
         "title": "ShadowedEntry",
         "type": "object"
       },
+      "StarRequest": {
+        "properties": {
+          "name": {
+            "description": "A gallery file name",
+            "title": "Name",
+            "type": "string"
+          },
+          "starred": {
+            "title": "Starred",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "name",
+          "starred"
+        ],
+        "title": "StarRequest",
+        "type": "object"
+      },
+      "StarSet": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "starred": {
+            "title": "Starred",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "name",
+          "starred"
+        ],
+        "title": "StarSet",
+        "type": "object"
+      },
+      "StepTiming": {
+        "additionalProperties": true,
+        "description": "Where one pipeline step's time went, on the worker's monotonic clock\n(dw/pipeline_processors/timing.py). Every `_s` is seconds to 0.1; a field\nwhose mark never happened is null, never guessed. Open, like the entry.",
+        "properties": {
+          "cache": {
+            "additionalProperties": true,
+            "description": "Skip counts, on a step that set a `cache`.",
+            "title": "Cache",
+            "type": "object"
+          },
+          "compiled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The denoiser runs through torch.compile; null when unknown.",
+            "title": "Compiled"
+          },
+          "decode_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Last pass's end to the call's return: VAE decode and post-processing.",
+            "title": "Decode S"
+          },
+          "denoise_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "First denoiser forward to the last pass's end; the whole call when the pipeline reports no passes.",
+            "title": "Denoise S"
+          },
+          "encode_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Call start to the first denoiser forward: prompt encoding and preparation.",
+            "title": "Encode S"
+          },
+          "first_pass_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The first pass, which carries any compile warm-up.",
+            "title": "First Pass S"
+          },
+          "load_cached": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The pipeline came from the worker's cache; false if any part was loaded fresh, null when the step loaded nothing.",
+            "title": "Load Cached"
+          },
+          "load_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Loading or fetching the step's pipeline, cached or not.",
+            "title": "Load S"
+          },
+          "pass_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Median of passes 2..n, wall time at step boundaries; null with fewer than two passes.",
+            "title": "Pass S"
+          },
+          "passes": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Denoise passes the pipeline ran, one per scheduler timestep; can differ from num_inference_steps.",
+            "title": "Passes"
+          },
+          "save_s": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Writing the step's files.",
+            "title": "Save S"
+          },
+          "segments": {
+            "description": "Pipeline calls summed into this timing: chain segments or iterations; 1 for a plain step.",
+            "title": "Segments",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "load_s",
+          "load_cached",
+          "encode_s",
+          "denoise_s",
+          "passes",
+          "first_pass_s",
+          "pass_s",
+          "compiled",
+          "decode_s",
+          "save_s",
+          "segments"
+        ],
+        "title": "StepTiming",
+        "type": "object"
+      },
       "TaskList": {
         "additionalProperties": false,
         "properties": {
@@ -4172,6 +4774,16 @@
             "description": "The card as a job record's device names it.",
             "title": "Name"
           },
+          "oom_score_adj": {
+            "description": "The worker's kernel oom_score_adj, read from /proc at call time (1000 for the latest dispatch's worker in a pool, else the value it was spawned with); absent where unreadable.",
+            "title": "Oom Score Adj",
+            "type": "integer"
+          },
+          "pid": {
+            "description": "The worker process's pid; absent while it is not running.",
+            "title": "Pid",
+            "type": "integer"
+          },
           "vram_gb": {
             "anyOf": [
               {
@@ -4542,16 +5154,112 @@
             "type": "string"
           }
         },
-        "required": [
-          "name",
-          "workspace",
-          "origin",
-          "warnings",
-          "shape",
-          "traits",
-          "summary"
-        ],
-        "title": "WorkflowSaved",
+        "required": [
+          "name",
+          "workspace",
+          "origin",
+          "warnings",
+          "shape",
+          "traits",
+          "summary"
+        ],
+        "title": "WorkflowSaved",
+        "type": "object"
+      },
+      "WorkspaceCopied": {
+        "additionalProperties": false,
+        "description": "What a copy between workspaces did (`POST /api/workspaces/{name}/copy`).",
+        "properties": {
+          "already_present": {
+            "description": "Runs the destination already held (`<workflow>/<run id>`) and assets it held with identical bytes (library-relative path) - skipped.",
+            "items": {
+              "type": "string"
+            },
+            "title": "Already Present",
+            "type": "array"
+          },
+          "bytes_copied": {
+            "title": "Bytes Copied",
+            "type": "integer"
+          },
+          "bytes_linked": {
+            "title": "Bytes Linked",
+            "type": "integer"
+          },
+          "copied": {
+            "$ref": "#/components/schemas/CopiedItems"
+          },
+          "destination": {
+            "title": "Destination",
+            "type": "string"
+          },
+          "renumbered": {
+            "additionalProperties": {
+              "additionalProperties": {
+                "type": "integer"
+              },
+              "type": "object"
+            },
+            "description": "Copied runs whose `vN` changed, keyed `<workflow>/<run id>`: `{from, to}`.",
+            "title": "Renumbered",
+            "type": "object"
+          },
+          "source": {
+            "title": "Source",
+            "type": "string"
+          },
+          "warnings": {
+            "additionalProperties": true,
+            "description": "`unresolved_output_refs`, `absolute_paths` and `no_jobs`, each only when it applies.",
+            "title": "Warnings",
+            "type": "object"
+          }
+        },
+        "required": [
+          "source",
+          "destination",
+          "copied",
+          "already_present",
+          "renumbered",
+          "warnings",
+          "bytes_linked",
+          "bytes_copied"
+        ],
+        "title": "WorkspaceCopied",
+        "type": "object"
+      },
+      "WorkspaceCopyRequest": {
+        "properties": {
+          "assets": {
+            "description": "Asset-library files or folders, as written after `asset:` (`proj/clip.mp4`, `proj/`); each keeps its library-relative path",
+            "items": {
+              "type": "string"
+            },
+            "title": "Assets",
+            "type": "array"
+          },
+          "runs": {
+            "description": "`<workflow>/<run id>` entries, or a bare `<workflow>` for all its runs",
+            "items": {
+              "type": "string"
+            },
+            "title": "Runs",
+            "type": "array"
+          },
+          "source": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Workspace to copy from; the default when omitted",
+            "title": "Source"
+          }
+        },
+        "title": "WorkspaceCopyRequest",
         "type": "object"
       },
       "WorkspaceDeleted": {
@@ -4615,6 +5323,11 @@
             "title": "Name",
             "type": "string"
           },
+          "note": {
+            "description": "The workspace's note, when it has one; listings only.",
+            "title": "Note",
+            "type": "string"
+          },
           "outputs": {
             "title": "Outputs",
             "type": "string"
@@ -5266,7 +5979,7 @@
     },
     "/api/gallery": {
       "get": {
-        "description": "A page of media files in the output directory, newest first.\nStateless by design - the gallery survives server restarts because\nit reads the directory tree, not job history. 'folders' lists every\ndistinct workflow folder present (over the whole directory, not just\nthis page), for the UI's folder filter - a run id is not a folder of\nits own, so a workflow's runs group together; '' stands for files\nsaved directly at the output root, and is itself always a member so\nthat folder-less outputs stay selectable once anything is nested.\n'subfolders' is the other axis, over the whole directory the same\nway: the in-run subfolders steps wrote into ('final',\n'intermediate'), '' for files at a run's root. `folder` and\n`subfolder` filter independently and intersect when both are given.\n`version` narrows to the runs holding that ordinal - with `folder`,\nthe one run \"v4\" names; without it, that run of every workflow.\n\n`only_orphans=true` inverts the whole call: instead of media files,\nit returns run directories holding nothing but their own\nbookkeeping (manifest.json, workflow.json, job.json) as `runs`,\neach `{name, mtime}` - a run that wrote any file at all, a\ntext-shape prompt or a utility's side output included, is not\nlisted. `folder`/`subfolder` and the `folders`/`subfolders` facets\ndo not apply in this mode, since an orphan run has no file to\ncarry either. `name` is exactly what `DELETE /api/gallery/{name}`\naccepts, so listing and deleting an orphan is a two-call round\ntrip (#170).\n\n`media=true` adds `duration_seconds` to each audio/video entry,\nprobed the same way `get_gallery_metadata` reports it - which two\ntakes of the same workflow otherwise have no way to be told apart\nby, since size and mtime are misleading proxies for length (#356).\nOff by default and bounded by `limit`: only the page actually\nreturned is probed, not the whole listing, so the cost of asking\nstays proportional to the page size rather than the library size.",
+        "description": "A page of media files in the output directory, newest first.\nStateless by design - the gallery survives server restarts because\nit reads the directory tree, not job history. 'folders' lists every\ndistinct workflow folder present (over the whole directory, not just\nthis page), for the UI's folder filter - a run id is not a folder of\nits own, so a workflow's runs group together; '' stands for files\nsaved directly at the output root, and is itself always a member so\nthat folder-less outputs stay selectable once anything is nested.\n'subfolders' is the other axis, over the whole directory the same\nway: the in-run subfolders steps wrote into ('final',\n'intermediate'), '' for files at a run's root. `folder` and\n`subfolder` filter independently and intersect when both are given.\n`version` narrows to the runs holding that ordinal - with `folder`,\nthe one run \"v4\" names; without it, that run of every workflow.\n\n`only_orphans=true` inverts the whole call: instead of media files,\nit returns run directories holding nothing but their own\nbookkeeping (manifest.json, workflow.json, job.json) as `runs`,\neach `{name, mtime}` - a run that wrote any file at all, a\ntext-shape prompt or a utility's side output included, is not\nlisted. `folder`/`subfolder` and the `folders`/`subfolders` facets\ndo not apply in this mode, since an orphan run has no file to\ncarry either. `name` is exactly what `DELETE /api/gallery/{name}`\naccepts, so listing and deleting an orphan is a two-call round\ntrip (#170).\n\n`media=true` adds `duration_seconds` to each audio/video entry,\nprobed the same way `get_gallery_metadata` reports it - which two\ntakes of the same workflow otherwise have no way to be told apart\nby, since size and mtime are misleading proxies for length (#356).\nOff by default and bounded by `limit`: only the page actually\nreturned is probed, not the whole listing, so the cost of asking\nstays proportional to the page size rather than the library size.\n\nEach entry carries `role`, `final` or `intermediate` (null for a\nflat-layout file or one no manifest lists); a file a later run read\nlists as intermediate unless its step declared it final\n(dw/roles.py rule 4). `role` is a repeatable\nfilter; a null role counts as final. Omitted, every file is listed.",
         "operationId": "gallery_api_gallery_get",
         "parameters": [
           {
@@ -5357,6 +6070,25 @@
               "type": "boolean"
             }
           },
+          {
+            "in": "query",
+            "name": "role",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Role"
+            }
+          },
           {
             "in": "query",
             "name": "workspace",
@@ -5454,6 +6186,61 @@
         "summary": "Archive Outputs"
       }
     },
+    "/api/gallery/compare": {
+      "post": {
+        "description": "Two to eight outputs side by side at the same moments, and how far\neach is from a baseline (#871): one grid, a row per output and a\ncolumn per moment, plus PSNR, SSIM and mean absolute difference per\nnon-baseline output at source resolution. Moments resolve to one\nframe index against the baseline (or the first video) and every\noutput is read at that frame; one past an output's end is a blank\ncell. A single `crop` is the region shown and measured; one box per\nname is shown only, and the metrics stay on the full frame. Outputs\nof different sizes get no metrics, and say why. Stills join a video\ncomparison as the same image in every column. `max_total_bytes`\nshrinks the whole grid, and `downscaled_to` says to what.",
+        "operationId": "gallery_compare_api_gallery_compare_post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "workspace",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Workspace"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CompareRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Gallery Compare"
+      }
+    },
     "/api/gallery/{name}": {
       "delete": {
         "description": "Remove one file from the output directory.\n\nWhen that was the last media file of its run, the run directory goes\nwith it, sidecars included. `name` may also be a run directory\n(`<identity>/<run id>`), which removes the whole run - the only handle\non a run that failed before it wrote any media (#134).",
@@ -6019,7 +6806,7 @@
     },
     "/api/gallery/{name}/metadata": {
       "get": {
-        "description": "Generation metadata embedded in a saved image ('workflow' inside\nit is the full definition the editor can reopen), plus the job that\nproduced the file when history remembers one, plus - for audio and\nvideo - what the file itself holds: duration, format and level,\nwhich is how an agent that cannot listen checks a track. Only an\nimage embeds 'metadata' this way - it is always null for audio and\nvideo, since neither format has a slot this writer uses; recover\nthe recipe from 'job' (GET /api/jobs/{id}/workflow) when one is\nknown, or from nothing when it isn't (a kept asset has no job).\n\n`envelope=true` adds the soundtrack's level second by second, which\nis what says *where* in a track something is - whether a shot is\nstill voiced at its last frame, how deep the hole at a seam goes.\nOpt-in: a ten-minute track is 600 numbers, and the default call has\nto stay small. `interval_seconds` (default 1.0, 0.05 to 3600) is\nthe bin width: 0.1 places a cut on a vocal onset. A track that\nwould need more than 2400 bins at a finer-than-default width is\nrefused (422) with the interval that fits; the default width is\nnever refused for length (#823).\n\n`name` may also be an 'asset:' reference, and then it is the input\nasset of that name that is described rather than an output (#127).\nThe numbers here - duration, frame count, fps, sample rate - are\nwhat decide whether a call will work at all, and for a file the\ncaller is about to *consume* they were previously unobtainable:\nthe only way to read a wav's length was to run a job that copied it\ninto the output directory. `job` is null for an asset with no\nrecorded provenance, and `source` says which of the two roots\nanswered.\n\nA kept asset (`keep_output`) is not always provenance-blind: when\nthe file it was kept from still had a job in history, `keep_output`\nrecorded `{job, run_id, version}` beside it, and this route reads it\nback the same way it reads a kept file's shots (#556). `run_id`/\n`version` are that source run's own - `job.id` is still the one to\npass `get_job_workflow`, since a pruned run leaves no `workflow.json`\nof its own to reopen.",
+        "description": "Generation metadata embedded in a saved image ('workflow' inside\nit is the full definition the editor can reopen), plus the job that\nproduced the file when history remembers one, plus - for audio and\nvideo - what the file itself holds: duration, format and level,\nwhich is how an agent that cannot listen checks a track. Only an\nimage embeds 'metadata' this way - it is always null for audio and\nvideo, since neither format has a slot this writer uses; recover\nthe recipe from 'job' (GET /api/jobs/{id}/workflow) when one is\nknown, or from nothing when it isn't (a kept asset has no job).\n\n`envelope=true` adds the soundtrack's level second by second, which\nis what says *where* in a track something is - whether a shot is\nstill voiced at its last frame, how deep the hole at a seam goes.\nOpt-in: a ten-minute track is 600 numbers, and the default call has\nto stay small. `interval_seconds` (default 1.0, 0.05 to 3600) is\nthe bin width: 0.1 places a cut on a vocal onset. A track that\nwould need more than 2400 bins at a finer-than-default width is\nrefused (422) with the interval that fits; the default width is\nnever refused for length (#823).\n\nAn image's `media` is its measured `{kind, width, height, mode}`,\nread from the file header (#922) - not the width/height arguments\nthe pipeline was asked for. `include_workflow=false` drops the\nembedded `metadata.workflow` (the whole definition, often 20 KB) and\nleaves the rest of `metadata` with `workflow_omitted: true`.\n\n`name` may also be an 'asset:' reference, and then it is the input\nasset of that name that is described rather than an output (#127).\nThe numbers here - duration, frame count, fps, sample rate - are\nwhat decide whether a call will work at all, and for a file the\ncaller is about to *consume* they were previously unobtainable:\nthe only way to read a wav's length was to run a job that copied it\ninto the output directory. `job` is null for an asset with no\nrecorded provenance, and `source` says which of the two roots\nanswered.\n\nA kept asset (`keep_output`) is not always provenance-blind: when\nthe file it was kept from still had a job in history, `keep_output`\nrecorded `{job, run_id, version}` beside it, and this route reads it\nback the same way it reads a kept file's shots (#556). `run_id`/\n`version` are that source run's own - `job.id` is still the one to\npass `get_job_workflow`, since a pruned run leaves no `workflow.json`\nof its own to reopen. `inputs` is the source run's too (#902).",
         "operationId": "gallery_metadata_api_gallery__name__metadata_get",
         "parameters": [
           {
@@ -6051,6 +6838,16 @@
               "type": "number"
             }
           },
+          {
+            "in": "query",
+            "name": "include_workflow",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Include Workflow",
+              "type": "boolean"
+            }
+          },
           {
             "in": "query",
             "name": "workspace",
@@ -7358,7 +8155,7 @@
     },
     "/api/models/downloads/{download_id}/cancel": {
       "post": {
-        "description": "Request cancellation; takes effect at the next progress tick.\nPartial files stay in the cache and resume on a retry.",
+        "description": "Request cancellation; `cancel_requested` shows until it is terminal.\nPartial files stay in the cache and resume on a retry.",
         "operationId": "cancel_download_api_models_downloads__download_id__cancel_post",
         "parameters": [
           {
@@ -7396,6 +8193,63 @@
         "summary": "Cancel Download"
       }
     },
+    "/api/notes": {
+      "put": {
+        "description": "Set or clear the note on a run, a file, an asset or a workspace.\n\n`target` is a gallery file name (that file's own note), a run directory\n`<identity>/<run id>` (the run note every file of the run falls back to),\n`asset:<name>` or `workspace:<name>` ('default' for the root's own). The\nanswer is the target's effective note after the write: a file with no\nnote of its own answers with its run's, and `note_source` says which.",
+        "operationId": "put_note_api_notes_put",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "workspace",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Workspace"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NoteRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NoteSet"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Put Note"
+      }
+    },
     "/api/pipelines": {
       "get": {
         "description": "Every pipeline class the installed diffusers exports.",
@@ -7797,6 +8651,63 @@
         "summary": "Server Info"
       }
     },
+    "/api/stars": {
+      "put": {
+        "description": "Star or unstar one output file - the \"keep\" mark a person culls a run\nwith. It lives in the run's notes.json beside the notes, so it is\nresolved exactly as a file note is, and only a file in a run directory\ncan carry one.",
+        "operationId": "put_star_api_stars_put",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "workspace",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Workspace"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/StarRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/StarSet"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Put Star"
+      }
+    },
     "/api/system/diffusers": {
       "get": {
         "description": "Installed diffusers version (with its git commit when installed\nfrom git) and the state of any update.",
@@ -7918,7 +8829,7 @@
     },
     "/api/uploads": {
       "post": {
-        "description": "Save a browser-picked image, video or audio file into the asset library's\nuploads/ subfolder and hand back the reference a workflow argument\ncan carry.\n\nAn upload is input, so it belongs in the asset library rather than\namong generated output, and the reference handed back is\n'asset:uploads/<name>' - portable, and meaningful in a workflow that\nis saved and rerun later. A server with no asset library configured\nanswers 409. The body is the raw file bytes: no multipart parser\ndependency needed for a single-file upload.\n\n`asset_name` stores it under a name of the caller's choosing -\n'cast/priya-voice.wav' rather than the random one a browser upload\ngets - which is what makes a recurring cast's references readable\nin every workflow that carries them. It may name a folder, is\nconfined to the library the way `keep_output`'s is, and takes the\nuploaded file's extension when it has none of its own. Without it\nthe name stays random, so two uploads of the same file never\ncollide.\n\n`shared` puts it in the library every workspace under this root\nshares rather than in this workspace's own - a recurring cast that\nepisode four, in a workspace of its own, still has to reach.",
+        "description": "Save a browser-picked image, video or audio file into the asset library's\nuploads/ subfolder and hand back the reference a workflow argument\ncan carry.\n\nAn upload is input, so it belongs in the asset library rather than\namong generated output, and the reference handed back is\n'asset:uploads/<name>' - portable, and meaningful in a workflow that\nis saved and rerun later. A server with no asset library configured\nanswers 409. The body is the raw file bytes: no multipart parser\ndependency needed for a single-file upload.\n\n`asset_name` stores it under a name of the caller's choosing -\n'cast/priya-voice.wav' rather than the random one a browser upload\ngets - which is what makes a recurring cast's references readable\nin every workflow that carries them. It may name a folder, is\nconfined the way `keep_output`'s is but placed under `uploads/`\n(not at the library root, as `keep_output`'s is), and takes the\nuploaded file's extension when it has none of its own. Without it\nthe name stays random, so two uploads of the same file never\ncollide.\n\n`shared` puts it in the library every workspace under this root\nshares rather than in this workspace's own - a recurring cast that\nepisode four, in a workspace of its own, still has to reach.\n\n`note` is kept beside it (the directory's notes.json). An upload over an\nexisting name takes its own note, or none: not the old file's, and not\nthe old file's kept provenance either.",
         "operationId": "upload_media_api_uploads_post",
         "parameters": [
           {
@@ -7956,6 +8867,24 @@
               "type": "boolean"
             }
           },
+          {
+            "description": "A note on the asset, at most 4000 characters",
+            "in": "query",
+            "name": "note",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "A note on the asset, at most 4000 characters",
+              "title": "Note"
+            }
+          },
           {
             "in": "query",
             "name": "workspace",
@@ -8599,6 +9528,56 @@
         "summary": "Add Workspace"
       }
     },
+    "/api/workspaces/{destination}/copy": {
+      "post": {
+        "description": "Copy runs and asset-library entries from another workspace into this one.\n\nMedia is hard-linked where the filesystem allows, so a copy costs\nlittle disk; sidecars are copied, and an asset's note and kept shots are\nmerged into the destination folder's. All or nothing: a run already\nhere, or an asset with identical bytes, is skipped as `already_present`;\na run whose job is still running, or a different file at an asset's\npath, refuses the whole request (409, naming each) with nothing written.\nA move is a copy, then `DELETE` of the source runs and assets.",
+        "operationId": "copy_into_workspace_api_workspaces__destination__copy_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "destination",
+            "required": true,
+            "schema": {
+              "title": "Destination",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/WorkspaceCopyRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WorkspaceCopied"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Copy Into Workspace"
+      }
+    },
     "/api/workspaces/{name}": {
       "delete": {
         "description": "Delete a workspace and everything in it.\n\nAnswers what it would remove and refuses until `acknowledged=true`:\nthis deletes generated work, and a count is what makes it an\ninformed choice rather than a surprise. The unacknowledged message\nnames only what would be removed - how to proceed is left to the\ncaller, since the MCP surface tells its own callers to acknowledge\nthrough a differently-named parameter (`acknowledged_cost`).",
diff --git a/ui/src/lib/hiddenWorkspaces.svelte.ts b/ui/src/lib/hiddenWorkspaces.svelte.ts
new file mode 100644
index 00000000..424475ec
--- /dev/null
+++ b/ui/src/lib/hiddenWorkspaces.svelte.ts
@@ -0,0 +1,13 @@
+/** Workspaces this browser keeps out of the sidebar - a viewing choice, so
+ * it is local, not a change to the workspace on the server. */
+import { storageGet, storageSet } from './storage'
+
+export const hiddenWorkspaces = $state({
+  names: storageGet<string[]>('hidden-workspaces', []),
+})
+
+export function setHidden(name: string, hidden: boolean): void {
+  const rest = hiddenWorkspaces.names.filter((n) => n !== name)
+  hiddenWorkspaces.names = hidden ? [...rest, name] : rest
+  storageSet('hidden-workspaces', hiddenWorkspaces.names)
+}
diff --git a/ui/src/lib/job/JobHeader.svelte b/ui/src/lib/job/JobHeader.svelte
index 185ae04c..25cd1519 100644
--- a/ui/src/lib/job/JobHeader.svelte
+++ b/ui/src/lib/job/JobHeader.svelte
@@ -109,6 +109,15 @@
     <span class="chip {job.status}">{job.status}</span>
     <code class="muted seed" title="this job's id">{job.id}</code>
     <CopyButton text={job.id} title="copy job id" />
+    {#if job?.rerun_of}
+      <span class="muted"
+        >rerun of <a
+          class="plain"
+          href={wsHref(job.workspace, 'jobs', job.rerun_of)}
+          ><code>{job.rerun_of}</code></a
+        ></span
+      >
+    {/if}
     {#if cancelPending}
       <span
         class="muted"
@@ -121,6 +130,13 @@
         >#{job.queue_position + 1} in line</span
       >
     {/if}
+    {#if job.waiting_for}
+      <span
+        class="muted"
+        title="a card is free, but the host can't hold this job beside the running ones yet - it starts when one finishes"
+        >{job.waiting_for}</span
+      >
+    {/if}
     {#if seed !== undefined}
       <code
         class="muted seed"
diff --git a/ui/src/lib/job/JobResults.svelte b/ui/src/lib/job/JobResults.svelte
index b1ed62ee..ba3c8ff3 100644
--- a/ui/src/lib/job/JobResults.svelte
+++ b/ui/src/lib/job/JobResults.svelte
@@ -3,12 +3,16 @@
   import { api, outputUrl } from '../api'
   import { describeOutputMeta } from '../outputMeta'
   import {
+    sectionByRole,
     sectionBySubfolder,
     type StepGroup,
     type UnsavedStep,
   } from '../results'
   import DownloadLink from '../DownloadLink.svelte'
-  import type { JobDetail } from '../types'
+  import type { GalleryInput, JobDetail } from '../types'
+  import RoleTag from '../gallery/RoleTag.svelte'
+  import { ASSET, OUTPUT, referenceName } from '../references'
+  import { wsHref } from '../routes'
 
   // The Results panel's body: each output beside what made it, sectioned by
   // subfolder and grouped by step, then the steps that wrote nothing. The
@@ -34,6 +38,7 @@
   // seed. Images only: the metadata route decodes an audio or video file
   // whole to probe it, and nothing it would report is shown here. A key
   // present with null is a lookup already in flight or failed
+  let runInputs = $state<GalleryInput[]>([])
   let fileMeta = $state<Record<string, Record<string, unknown> | null>>({})
   $effect(() => {
     const workspace = job.workspace
@@ -51,12 +56,34 @@
           .galleryMetadata(file, workspace)
           .then((r) => {
             fileMeta[file] = r.metadata
+            // The run's inputs are the same whichever output asks
+            if (r.inputs?.length && !runInputs.length) runInputs = r.inputs
           })
           .catch(() => {})
       }
     })
   })
 
+  // A run that wrote no image (video and audio only, as H3 and LTX do) has
+  // no lookup above to read its inputs from, so the first output of any kind
+  // is asked once - never one probe per file
+  let probedFirst = false
+  $effect(() => {
+    const files = fileGroups.flatMap((group) => group.files)
+    if (!files.length || probedFirst) return
+    if (files.some((file) => kindOf(file) === 'image')) return
+    probedFirst = true
+    api
+      .galleryMetadata(
+        files[0],
+        untrack(() => job.workspace),
+      )
+      .then((r) => {
+        if (r.inputs?.length && !runInputs.length) runInputs = r.inputs
+      })
+      .catch(() => {})
+  })
+
   // Nothing at all was generated: every step the manifest lists was served
   // from the step cache. Worth saying outright - the page otherwise shows a
   // succeeded job full of images that are not this run's
@@ -66,6 +93,12 @@
   // Sections by result.subfolder - one root section, no heading, when no
   // step chose one, so an older run renders as it always did
   const sections = $derived(sectionBySubfolder(fileGroups))
+  // By role when the manifest states one: Final, Intermediate, Made from.
+  // Null for a run that predates roles, which keeps the subfolder layout
+  const byRole = $derived(sectionByRole(fileGroups))
+  const inputName = (input: GalleryInput) =>
+    referenceName(input.reference, input.kind === 'asset' ? ASSET : OUTPUT) ??
+    input.reference
   const sectioned = $derived(
     sections.length > 1 || sections[0].subfolder !== '',
   )
@@ -83,15 +116,49 @@
       Use <strong>New seed</strong> for a different image.{/if}
   </p>
 {/if}
-{#each sections as section (section.subfolder)}
-  {#if sectioned}
-    <h3 class="subhead">
-      {section.subfolder === '' ? '(run root)' : `${section.subfolder}/`}
-    </h3>
-  {/if}
-  {#each section.groups as group (group.step)}
+{#if byRole}
+  <div class="roles">
+    <h3 class="subhead">Final</h3>
+    {@render stepGroups(byRole.final, true)}
+    {#if byRole.intermediate.length}
+      <details open={byRole.final.length === 0}>
+        <summary>Intermediate</summary>
+        {@render stepGroups(byRole.intermediate, true)}
+      </details>
+    {/if}
+    {#if runInputs.length}
+      <h3 class="subhead">Made from</h3>
+      <ul class="madefrom">
+        {#each runInputs as input (input.kind + input.reference)}
+          <li>
+            <a
+              href={input.kind === 'asset'
+                ? wsHref(job.workspace, 'assets')
+                : fileUrl(inputName(input))}
+              target={input.kind === 'output' ? '_blank' : undefined}
+              >{inputName(input)}</a
+            >
+            <RoleTag role="input" />
+            <span class="muted">{input.kind}</span>
+          </li>
+        {/each}
+      </ul>
+    {/if}
+  </div>
+{:else}
+  {#each sections as section (section.subfolder)}
+    {#if sectioned}
+      <h3 class="subhead">
+        {section.subfolder === '' ? '(run root)' : `${section.subfolder}/`}
+      </h3>
+    {/if}
+    {@render stepGroups(section.groups, sectioned)}
+  {/each}
+{/if}
+{#snippet stepGroups(groups: StepGroup[], nested: boolean)}
+  {#each groups as group (group.step)}
     {#if fileGroups.length > 1}
-      <svelte:element this={sectioned ? 'h4' : 'h3'} class="stephead muted">
+      <svelte:element this={nested ? 'h4' : 'h3'} class="stephead muted">
         {group.step}
         {#if group.reused && !allReused}
           <span
@@ -162,7 +229,7 @@
       </div>
     {/each}
   {/each}
-{/each}
+{/snippet}
 {#if unsaved.length}
   <h3 class="subhead">Steps that wrote nothing</h3>
   <ul class="unsaved">
@@ -186,6 +253,24 @@
 {/if}
 
 <style>
+  .roles details {
+    margin-top: var(--space-3);
+  }
+  .roles summary {
+    cursor: pointer;
+    font-size: var(--t-sm);
+    font-weight: 600;
+    margin-bottom: var(--space-2);
+  }
+  .madefrom {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    font-size: var(--t-sm);
+  }
+  .madefrom li {
+    padding: 0.15rem 0;
+  }
   .reusednote {
     margin: 0 0 0.6rem;
   }
diff --git a/ui/src/lib/jobTimes.test.ts b/ui/src/lib/jobTimes.test.ts
new file mode 100644
index 00000000..7f891ba5
--- /dev/null
+++ b/ui/src/lib/jobTimes.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { queueWait } from './jobTimes'
+
+describe('queueWait', () => {
+  it('is the time from submit to start for a job that started', () => {
+    expect(
+      queueWait({ created_at: 100, started_at: 160, status: 'succeeded' }, 999),
+    ).toBe(60)
+  })
+  it('counts up to now for a job still queued', () => {
+    expect(
+      queueWait({ created_at: 100, started_at: null, status: 'queued' }, 400),
+    ).toBe(300)
+  })
+  it('is null for a job cancelled before it started, or with no clock', () => {
+    expect(
+      queueWait(
+        { created_at: 100, started_at: null, status: 'cancelled' },
+        400,
+      ),
+    ).toBeNull()
+    expect(
+      queueWait({ created_at: null, started_at: null, status: 'queued' }, 400),
+    ).toBeNull()
+  })
+})
diff --git a/ui/src/lib/jobTimes.ts b/ui/src/lib/jobTimes.ts
new file mode 100644
index 00000000..1127d55d
--- /dev/null
+++ b/ui/src/lib/jobTimes.ts
@@ -0,0 +1,13 @@
+import type { JobSummary } from './types'
+
+/** Seconds a job waited for a card: submit to start, or submit to now for
+ * one still waiting. Null when there is no wait to speak of - no clock, or
+ * cancelled before it ever started. */
+export function queueWait(
+  job: Pick<JobSummary, 'created_at' | 'started_at' | 'status'>,
+  now: number,
+): number | null {
+  if (!job.created_at) return null
+  if (job.started_at) return Math.max(0, job.started_at - job.created_at)
+  return job.status === 'queued' ? Math.max(0, now - job.created_at) : null
+}
diff --git a/ui/src/lib/jobWatch.test.ts b/ui/src/lib/jobWatch.test.ts
new file mode 100644
index 00000000..ac279a84
--- /dev/null
+++ b/ui/src/lib/jobWatch.test.ts
@@ -0,0 +1,132 @@
+import { describe, expect, it } from 'vitest'
+import type { HealthInfo, JobDetail } from './types'
+import {
+  BASE_TITLE,
+  endedSince,
+  endedTitle,
+  nextWatch,
+  percentDone,
+  runningIds,
+  tabTitle,
+} from './jobWatch'
+
+const health = (ids: (string | null)[], current: string | null = null) =>
+  ({
+    current_job: current ?? ids.find(Boolean) ?? null,
+    workers: ids.map((id) => ({ current_job: id })),
+  }) as unknown as HealthInfo
+
+const progress = (p: Partial<NonNullable<JobDetail['progress']>>) =>
+  p as JobDetail['progress']
+
+describe('runningIds', () => {
+  it('names every card’s job once', () => {
+    expect(runningIds(health(['a', null, 'b']))).toEqual(['a', 'b'])
+  })
+  it('falls back to current_job when workers is absent', () => {
+    expect(runningIds({ current_job: 'x' } as unknown as HealthInfo)).toEqual([
+      'x',
+    ])
+  })
+  it('is empty for no health', () => {
+    expect(runningIds(null)).toEqual([])
+  })
+})
+
+describe('endedSince', () => {
+  it('is what was running and is not now', () => {
+    expect(endedSince(['a', 'b'], ['b', 'c'])).toEqual(['a'])
+  })
+})
+
+describe('nextWatch', () => {
+  it('first poll learns what is running and ends nothing', () => {
+    expect(nextWatch(null, health(['a', 'b']))).toEqual({
+      watched: ['a', 'b'],
+      ended: [],
+      running: ['a', 'b'],
+    })
+  })
+  it('a failed poll ends nothing and keeps what was watched', () => {
+    expect(nextWatch(['a', 'b'], null)).toEqual({
+      watched: ['a', 'b'],
+      ended: [],
+      running: ['a', 'b'],
+    })
+    expect(nextWatch(null, null).watched).toBeNull()
+  })
+  it('a later real poll ends only the job that vanished', () => {
+    const next = nextWatch(['a', 'b'], health(['b', 'c']))
+    expect(next.ended).toEqual(['a'])
+    expect(next.watched).toEqual(['b', 'c'])
+  })
+  it('a real poll after a failed one still ends a vanished job', () => {
+    const kept = nextWatch(['a'], null).watched
+    expect(nextWatch(kept, health([])).ended).toEqual(['a'])
+  })
+})
+
+describe('percentDone', () => {
+  it('counts finished steps plus the denoise fraction of the current one', () => {
+    expect(
+      percentDone(
+        progress({
+          step_index: 1,
+          total_steps: 4,
+          denoise_step: 5,
+          denoise_total_steps: 10,
+        }),
+      ),
+    ).toBe(37)
+  })
+  it('never claims 100 while running', () => {
+    expect(
+      percentDone(
+        progress({
+          step_index: 3,
+          total_steps: 4,
+          denoise_step: 10,
+          denoise_total_steps: 10,
+        }),
+      ),
+    ).toBe(99)
+  })
+  it('is null with no step count', () => {
+    expect(percentDone(null)).toBeNull()
+    expect(percentDone(progress({ total_steps: 0 }))).toBeNull()
+  })
+})
+
+describe('tabTitle', () => {
+  it('is the app name when idle', () => {
+    expect(tabTitle(null)).toBe(BASE_TITLE)
+  })
+  it('shows percent, the workflow leaf name and other running jobs', () => {
+    const job = {
+      workflow: 'minimax/ref-to-video',
+      workflow_name: 'templates/minimax/ref-to-video',
+      progress: progress({ step_index: 0, total_steps: 2 }),
+    }
+    expect(tabTitle(job, 1)).toBe(`▶ 0% · ref-to-video +1 — ${BASE_TITLE}`)
+  })
+  it('leaves the percent out when there is none', () => {
+    expect(
+      tabTitle({ workflow: 'wf', workflow_name: null, progress: null }),
+    ).toBe(`▶ wf — ${BASE_TITLE}`)
+  })
+})
+
+describe('endedTitle', () => {
+  it('marks the outcome', () => {
+    const base = { workflow: 'wf', workflow_name: null, progress: null }
+    expect(endedTitle({ ...base, status: 'succeeded' })).toBe(
+      `✓ wf — ${BASE_TITLE}`,
+    )
+    expect(endedTitle({ ...base, status: 'failed' })).toBe(
+      `✗ wf — ${BASE_TITLE}`,
+    )
+    expect(endedTitle({ ...base, status: 'cancelled' })).toBe(
+      `⊘ wf — ${BASE_TITLE}`,
+    )
+  })
+})
diff --git a/ui/src/lib/jobWatch.ts b/ui/src/lib/jobWatch.ts
new file mode 100644
index 00000000..6570c38b
--- /dev/null
+++ b/ui/src/lib/jobWatch.ts
@@ -0,0 +1,93 @@
+/** What the tab title and the finish alert read off the 5-second health
+ * poll. A job runs for minutes to half an hour, usually in a tab nobody is
+ * looking at, so the title is where its state has to be. */
+import { formatDuration } from './format'
+import type { HealthInfo, JobDetail } from './types'
+
+export const BASE_TITLE = 'diffusers-workflow'
+
+export type TitleJob = Pick<
+  JobDetail,
+  'workflow' | 'workflow_name' | 'progress'
+>
+
+/** Every job a card is running now; `current_job` alone on a server too old
+ * to report `workers`. */
+export function runningIds(health: HealthInfo | null): string[] {
+  if (!health) return []
+  const ids = (health.workers ?? [])
+    .map((w) => w.current_job)
+    .filter((id): id is string => !!id)
+  if (health.current_job && !ids.includes(health.current_job))
+    ids.push(health.current_job)
+  return ids
+}
+
+export function endedSince(
+  before: readonly string[],
+  now: readonly string[],
+): string[] {
+  return before.filter((id) => !now.includes(id))
+}
+
+export type Watch = {
+  watched: string[] | null
+  ended: string[]
+  running: string[]
+}
+
+/** One health poll's step: what is running now and which watched jobs ended.
+ * The first poll (`watched` null) only learns what is running - a job
+ * already going when the page opened has not "just finished" when the next
+ * poll misses it. A failed poll (`info` null) says nothing about the jobs:
+ * reading it as "none running" would announce every running job as
+ * finished, so it leaves the state as it was. */
+export function nextWatch(
+  watched: string[] | null,
+  info: HealthInfo | null,
+): Watch {
+  if (!info) return { watched, ended: [], running: watched ?? [] }
+  const running = runningIds(info)
+  const ended = watched === null ? [] : endedSince(watched, running)
+  return { watched: running, ended, running }
+}
+
+/** 0-99: steps behind it plus how far the current step's denoise loop is.
+ * Never 100 - a running job is not done. Null with nothing to go on. */
+export function percentDone(progress: JobDetail['progress']): number | null {
+  if (!progress?.total_steps) return null
+  const inner = progress.denoise_total_steps
+    ? Math.min(1, (progress.denoise_step ?? 0) / progress.denoise_total_steps)
+    : 0
+  const done = ((progress.step_index ?? 0) + inner) / progress.total_steps
+  return Math.min(99, Math.max(0, Math.floor(done * 100)))
+}
+
+const leaf = (job: TitleJob) =>
+  (job.workflow ?? job.workflow_name ?? 'job').split('/').pop() || 'job'
+
+export function tabTitle(job: TitleJob | null, othersRunning = 0): string {
+  if (!job) return BASE_TITLE
+  const pct = percentDone(job.progress)
+  const more = othersRunning > 0 ? ` +${othersRunning}` : ''
+  return `▶ ${pct === null ? '' : `${pct}% · `}${leaf(job)}${more} — ${BASE_TITLE}`
+}
+
+const MARKS: Record<string, string> = {
+  succeeded: '✓',
+  failed: '✗',
+  cancelled: '⊘',
+}
+
+export function endedTitle(job: TitleJob & { status: string }): string {
+  return `${MARKS[job.status] ?? '•'} ${leaf(job)} — ${BASE_TITLE}`
+}
+
+/** "ref-to-video succeeded in 12m 54s" - the toast and the alert body. */
+export function finishedText(job: JobDetail): string {
+  const took =
+    job.started_at && job.finished_at
+      ? ` in ${formatDuration(job.finished_at - job.started_at)}`
+      : ''
+  return `${leaf(job)} ${job.status}${took}`
+}
diff --git a/ui/src/lib/markdown.test.ts b/ui/src/lib/markdown.test.ts
new file mode 100644
index 00000000..1ba74e1e
--- /dev/null
+++ b/ui/src/lib/markdown.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'vitest'
+import { parseInline, parseMarkdown, safeHref } from './markdown'
+
+describe('safeHref', () => {
+  it('allows http, https and mailto only', () => {
+    expect(safeHref('https://x.dev/a')).toBe('https://x.dev/a')
+    expect(safeHref('mailto:a@b.c')).toBe('mailto:a@b.c')
+    expect(safeHref('javascript:alert(1)')).toBeNull()
+    expect(safeHref('JaVaScRiPt:alert(1)')).toBeNull()
+    expect(safeHref('data:text/html,x')).toBeNull()
+    expect(safeHref('/relative')).toBeNull()
+  })
+})
+
+describe('parseInline', () => {
+  it('reads bold, italic, code and links', () => {
+    expect(parseInline('a **b** *c* `d` [e](https://x.dev)')).toEqual([
+      { kind: 'text', text: 'a ' },
+      { kind: 'strong', children: [{ kind: 'text', text: 'b' }] },
+      { kind: 'text', text: ' ' },
+      { kind: 'em', children: [{ kind: 'text', text: 'c' }] },
+      { kind: 'text', text: ' ' },
+      { kind: 'code', text: 'd' },
+      { kind: 'text', text: ' ' },
+      {
+        kind: 'link',
+        href: 'https://x.dev/',
+        children: [{ kind: 'text', text: 'e' }],
+      },
+    ])
+  })
+  it('leaves an unsafe link as its literal text', () => {
+    expect(parseInline('[x](javascript:alert(1))')).toEqual([
+      { kind: 'text', text: '[x](javascript:alert(1))' },
+    ])
+  })
+  it('does not backtrack on unclosed links', () => {
+    for (const src of ['[a]('.repeat(1000), '[a](b'.repeat(800)]) {
+      const t = performance.now()
+      expect(parseInline(src)).toEqual([{ kind: 'text', text: src }])
+      expect(performance.now() - t).toBeLessThan(100)
+    }
+  })
+  it('links a url with balanced parentheses', () => {
+    expect(parseInline('[w](https://en.wikipedia.org/wiki/Foo_(bar))')).toEqual(
+      [
+        {
+          kind: 'link',
+          href: 'https://en.wikipedia.org/wiki/Foo_(bar)',
+          children: [{ kind: 'text', text: 'w' }],
+        },
+      ],
+    )
+  })
+  it('leaves snake_case alone', () => {
+    expect(parseInline('cold_minutes and warm_minutes')).toEqual([
+      { kind: 'text', text: 'cold_minutes and warm_minutes' },
+    ])
+  })
+  it('keeps markup-looking text as text', () => {
+    expect(parseInline('<b>x</b>')).toEqual([
+      { kind: 'text', text: '<b>x</b>' },
+    ])
+  })
+})
+
+describe('parseMarkdown', () => {
+  it('reads headings, lists, code and paragraphs', () => {
+    const src = [
+      '## RULE',
+      'Two paths, pick by target.',
+      'Second line.',
+      '',
+      '- TV: L0 -> L7',
+      '- Cinema: B3 -> P1',
+      '',
+      '1. one',
+      '2. two',
+      '',
+      '```',
+      'dw validate x',
+      '```',
+    ].join('\n')
+    expect(parseMarkdown(src)).toEqual([
+      { kind: 'heading', level: 2, children: [{ kind: 'text', text: 'RULE' }] },
+      {
+        kind: 'paragraph',
+        children: [
+          { kind: 'text', text: 'Two paths, pick by target.' },
+          { kind: 'br' },
+          { kind: 'text', text: 'Second line.' },
+        ],
+      },
+      {
+        kind: 'list',
+        ordered: false,
+        items: [
+          [{ kind: 'text', text: 'TV: L0 -> L7' }],
+          [{ kind: 'text', text: 'Cinema: B3 -> P1' }],
+        ],
+      },
+      {
+        kind: 'list',
+        ordered: true,
+        items: [
+          [{ kind: 'text', text: 'one' }],
+          [{ kind: 'text', text: 'two' }],
+        ],
+      },
+      { kind: 'code', text: 'dw validate x' },
+    ])
+  })
+  it('a plain note is one paragraph', () => {
+    expect(parseMarkdown('just text')).toEqual([
+      { kind: 'paragraph', children: [{ kind: 'text', text: 'just text' }] },
+    ])
+  })
+  it('an unclosed fence runs to the end', () => {
+    expect(parseMarkdown('```\nx')).toEqual([{ kind: 'code', text: 'x' }])
+  })
+})
diff --git a/ui/src/lib/markdown.ts b/ui/src/lib/markdown.ts
new file mode 100644
index 00000000..5dcbcc57
--- /dev/null
+++ b/ui/src/lib/markdown.ts
@@ -0,0 +1,144 @@
+/** A small, safe Markdown subset for notes, parsed to a tree that
+ * Markdown.svelte renders as Svelte nodes. Nothing here produces HTML, so
+ * text that looks like markup stays text, and a link is only ever an
+ * http(s)/mailto URL the browser's own URL parser accepted.
+ *
+ * Underscore emphasis is left out on purpose: notes quote snake_case
+ * names (`cold_minutes`, `first_block`) constantly. */
+
+export type Inline =
+  | { kind: 'text'; text: string }
+  | { kind: 'br' }
+  | { kind: 'code'; text: string }
+  | { kind: 'strong'; children: Inline[] }
+  | { kind: 'em'; children: Inline[] }
+  | { kind: 'link'; href: string; children: Inline[] }
+
+export type Block =
+  | { kind: 'heading'; level: 1 | 2 | 3; children: Inline[] }
+  | { kind: 'paragraph'; children: Inline[] }
+  | { kind: 'list'; ordered: boolean; items: Inline[][] }
+  | { kind: 'code'; text: string }
+
+const SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
+
+export function safeHref(url: string): string | null {
+  try {
+    const parsed = new URL(url)
+    return SAFE_PROTOCOLS.has(parsed.protocol) ? parsed.href : null
+  } catch {
+    return null
+  }
+}
+
+// One alternation, tried left to right at each position: code first, so a
+// `**` inside backticks stays literal
+const INLINE =
+  /`([^`]+)`|\*\*(.+?)\*\*|\*([^*\s][^*]*?)\*|\[([^\]]+)\]\(([^()\s]+(?:\([^()\s]*\)[^()\s]*)?)\)/g
+
+function pushText(out: Inline[], text: string) {
+  if (!text) return
+  const last = out[out.length - 1]
+  if (last?.kind === 'text') last.text += text
+  else out.push({ kind: 'text', text })
+}
+
+export function parseInline(src: string): Inline[] {
+  const out: Inline[] = []
+  let at = 0
+  for (const m of src.matchAll(INLINE)) {
+    pushText(out, src.slice(at, m.index))
+    at = m.index + m[0].length
+    if (m[1] !== undefined) out.push({ kind: 'code', text: m[1] })
+    else if (m[2] !== undefined)
+      out.push({ kind: 'strong', children: parseInline(m[2]) })
+    else if (m[3] !== undefined)
+      out.push({ kind: 'em', children: parseInline(m[3]) })
+    else {
+      const href = safeHref(m[5])
+      if (href) out.push({ kind: 'link', href, children: parseInline(m[4]) })
+      else pushText(out, m[0])
+    }
+  }
+  pushText(out, src.slice(at))
+  return out
+}
+
+const HEADING = /^(#{1,3})\s+(.*)$/
+const BULLET = /^\s*[-*]\s+(.*)$/
+const NUMBERED = /^\s*\d+[.)]\s+(.*)$/
+const FENCE = /^\s*```/
+
+const startsBlock = (line: string) =>
+  FENCE.test(line) ||
+  HEADING.test(line) ||
+  BULLET.test(line) ||
+  NUMBERED.test(line)
+
+// Each reader takes the block starting at lines[i] and returns it with the
+// index just past it, or null when the line does not start that kind
+
+type Read = { block: Block; next: number } | null
+
+function readFence(lines: string[], i: number): Read {
+  if (!FENCE.test(lines[i])) return null
+  const body: string[] = []
+  i++
+  while (i < lines.length && !FENCE.test(lines[i])) body.push(lines[i++])
+  // Past the closing fence, or past the end when it never closed
+  return { block: { kind: 'code', text: body.join('\n') }, next: i + 1 }
+}
+
+function readHeading(lines: string[], i: number): Read {
+  const heading = HEADING.exec(lines[i])
+  if (!heading) return null
+  return {
+    block: {
+      kind: 'heading',
+      level: heading[1].length as 1 | 2 | 3,
+      children: parseInline(heading[2]),
+    },
+    next: i + 1,
+  }
+}
+
+function readList(lines: string[], i: number): Read {
+  const list = [BULLET, NUMBERED].find((re) => re.test(lines[i]))
+  if (!list) return null
+  const items: Inline[][] = []
+  while (i < lines.length && list.test(lines[i]))
+    items.push(parseInline(list.exec(lines[i++])![1]))
+  return { block: { kind: 'list', ordered: list === NUMBERED, items }, next: i }
+}
+
+// A paragraph runs until a blank line or the start of another block; its
+// single newlines are kept as line breaks - notes are written as lines, not
+// reflowed prose
+function readParagraph(lines: string[], i: number): Read {
+  const children: Inline[] = []
+  while (i < lines.length && lines[i].trim() && !startsBlock(lines[i])) {
+    if (children.length) children.push({ kind: 'br' })
+    children.push(...parseInline(lines[i++]))
+  }
+  return { block: { kind: 'paragraph', children }, next: i }
+}
+
+export function parseMarkdown(src: string): Block[] {
+  const lines = src.replace(/\r\n?/g, '\n').split('\n')
+  const blocks: Block[] = []
+  let i = 0
+  while (i < lines.length) {
+    if (!lines[i].trim()) {
+      i++
+      continue
+    }
+    const read =
+      readFence(lines, i) ??
+      readHeading(lines, i) ??
+      readList(lines, i) ??
+      readParagraph(lines, i)!
+    blocks.push(read.block)
+    i = read.next
+  }
+  return blocks
+}
diff --git a/ui/src/lib/neighbor.test.ts b/ui/src/lib/neighbor.test.ts
new file mode 100644
index 00000000..a363a3d5
--- /dev/null
+++ b/ui/src/lib/neighbor.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import { neighbor } from './neighbor'
+
+describe('neighbor', () => {
+  const items = ['a', 'b', 'c']
+  it('steps forward and back', () => {
+    expect(neighbor(items, 'b', 1)).toBe('c')
+    expect(neighbor(items, 'b', -1)).toBe('a')
+  })
+  it('stops at the ends rather than wrapping', () => {
+    expect(neighbor(items, 'c', 1)).toBeNull()
+    expect(neighbor(items, 'a', -1)).toBeNull()
+  })
+  it('is null for a name no longer listed', () => {
+    expect(neighbor(items, 'z', 1)).toBeNull()
+  })
+  it('goes on from where an unlisted name last stood', () => {
+    // 'x' stood at 1, between 'a' and 'b'; 'b' has taken its place
+    expect(neighbor(items, 'x', 1, 1)).toBe('b')
+    expect(neighbor(items, 'x', -1, 1)).toBe('a')
+    expect(neighbor(items, 'x', -1, 0)).toBeNull()
+    expect(neighbor(items, 'x', 1, 3)).toBeNull()
+  })
+})
diff --git a/ui/src/lib/neighbor.ts b/ui/src/lib/neighbor.ts
new file mode 100644
index 00000000..be9fd18e
--- /dev/null
+++ b/ui/src/lib/neighbor.ts
@@ -0,0 +1,17 @@
+/** The item `step` places from `current` in `items`, or null at either end
+ * (no wrap: arriving back at the first file reads as "nothing happened").
+ * When `current` is no longer listed - a filter hid it, or it was unstarred
+ * with Starred on - `lastAt`, where it last stood, says where to go on
+ * from: forward is whatever now fills its place, back the one before it.
+ * Without one an unlisted `current` has no neighbor. */
+export function neighbor(
+  items: readonly string[],
+  current: string,
+  step: 1 | -1,
+  lastAt = -1,
+): string | null {
+  const at = items.indexOf(current)
+  if (at !== -1) return items[at + step] ?? null
+  if (lastAt < 0) return null
+  return items[step === 1 ? lastAt : lastAt - 1] ?? null
+}
diff --git a/ui/src/lib/observed.test.ts b/ui/src/lib/observed.test.ts
new file mode 100644
index 00000000..8bb78a68
--- /dev/null
+++ b/ui/src/lib/observed.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { observedText, observedTitle } from './observed'
+
+describe('observedText', () => {
+  it('prefers the warm figure - what the next run costs with the model resident', () => {
+    expect(
+      observedText({ warm_minutes: 12.9, cold_minutes: 14.5, runs: 3 }),
+    ).toBe('~12.9 min here')
+  })
+  it('falls back to the cold figure', () => {
+    expect(observedText({ cold_minutes: 0.4, runs: 1 })).toBe('<1 min here')
+  })
+  it('is null without a figure', () => {
+    expect(observedText(null)).toBeNull()
+    expect(observedText({ runs: 2 })).toBeNull()
+  })
+})
+
+describe('observedTitle', () => {
+  it('names both figures, the run count and the card', () => {
+    expect(
+      observedTitle({
+        warm_minutes: 12.9,
+        warm_runs: 2,
+        cold_minutes: 14.5,
+        cold_runs: 1,
+        runs: 3,
+        name: 'RTX 4090',
+        since: '2026-10-01T00:00:00Z',
+      }),
+    ).toBe(
+      'measured on this server (RTX 4090): ~12.9 min with the model loaded (2 runs), ~14.5 min from cold (1 run); 3 runs since 2026-10-01',
+    )
+  })
+  it('is null without input or a figure', () => {
+    expect(observedTitle(null)).toBeNull()
+    expect(observedTitle({ runs: 2 })).toBeNull()
+  })
+})
diff --git a/ui/src/lib/observed.ts b/ui/src/lib/observed.ts
new file mode 100644
index 00000000..7e81951b
--- /dev/null
+++ b/ui/src/lib/observed.ts
@@ -0,0 +1,46 @@
+/** The server's own history for a workflow - `observed` on a catalog
+ * detail (dw/server/observed_cost.py) - said for a person. The curated
+ * `cost` is a maintainer's claim about some other card; this is what this
+ * box actually took, which is the number that predicts the next run. */
+import { formatMinutes } from './format'
+
+type Observed = Record<string, unknown> | null | undefined
+const num = (v: unknown) => (typeof v === 'number' ? v : null)
+const runs = (n: number) => `${n} ${n === 1 ? 'run' : 'runs'}`
+
+export function observedText(observed: Observed): string | null {
+  const minutes = num(observed?.warm_minutes) ?? num(observed?.cold_minutes)
+  return minutes === null ? null : `${formatMinutes(minutes)} here`
+}
+
+// One clause per measured state, or nothing when that state has no runs
+function timing(minutes: number | null, label: string, n: unknown) {
+  return minutes === null
+    ? []
+    : [`${formatMinutes(minutes)} ${label} (${runs(num(n) ?? 0)})`]
+}
+
+// Where and since when: the card's name in parentheses, the date it began
+function provenance(observed: Record<string, unknown>) {
+  const card = observed.name ?? observed.device
+  const since =
+    typeof observed.since === 'string'
+      ? ` since ${observed.since.slice(0, 10)}`
+      : ''
+  return { card: card ? ` (${card})` : '', since }
+}
+
+export function observedTitle(observed: Observed): string | null {
+  if (!observed) return null
+  const parts = [
+    ...timing(
+      num(observed.warm_minutes),
+      'with the model loaded',
+      observed.warm_runs,
+    ),
+    ...timing(num(observed.cold_minutes), 'from cold', observed.cold_runs),
+  ]
+  if (!parts.length) return null
+  const { card, since } = provenance(observed)
+  return `measured on this server${card}: ${parts.join(', ')}; ${runs(num(observed.runs) ?? 0)}${since}`
+}
diff --git a/ui/src/lib/pages/AssetsPage.svelte b/ui/src/lib/pages/AssetsPage.svelte
index d745ba84..4f43ce93 100644
--- a/ui/src/lib/pages/AssetsPage.svelte
+++ b/ui/src/lib/pages/AssetsPage.svelte
@@ -9,6 +9,7 @@
   import { api } from '../api'
   import Empty from '../Empty.svelte'
   import FolderGroups from '../FolderGroups.svelte'
+  import { dropFiles } from '../dropFiles'
   import HintBar from '../HintBar.svelte'
   import { confirmDialog } from '../confirm.svelte'
   import BulkBar from '../BulkBar.svelte'
@@ -62,6 +63,17 @@
     storageGet(COLLAPSE_KEY, {} as Record<string, boolean>),
   )
 
+  // Carry a saved note onto the listing and the pick, so selecting the asset
+  // again shows it rather than what was fetched before the edit
+  function saveNote(note: string | null) {
+    if (!selected) return
+    const name = selected.name
+    const patch = (a: AssetFile) =>
+      a.name === name ? { ...a, note: note ?? undefined } : a
+    assets = assets.map(patch)
+    selected = patch(selected)
+  }
+
   function load() {
     return api
       .listAssets()
@@ -223,30 +235,65 @@
 
   async function upload(event: Event) {
     const input = event.target as HTMLInputElement
-    const file = input.files?.[0]
+    const files = Array.from(input.files ?? [])
     // Clear it either way, so picking the same file twice still fires
     input.value = ''
-    if (!file) return
-    const suggestion = file.name
+    await uploadFiles(files, uploadTarget)
+  }
+
+  // One file asks for its library name; a dropped batch keeps each file's
+  // own, since a prompt per file would be a dialog storm. Null is a cancel
+  function askNames(
+    files: File[],
+    target: 'workspace' | 'shared',
+  ): (string | undefined)[] | null {
+    if (files.length !== 1) return files.map(() => undefined)
     const assetName = window.prompt(
-      `Upload — name in the ${uploadTarget} asset library:`,
-      suggestion,
+      `Upload — name in the ${target} asset library:`,
+      files[0].name,
     )
-    if (assetName === null) return
+    return assetName === null ? null : [assetName || undefined]
+  }
+
+  // Each file in turn, so one failing does not stop the rest; what failed
+  // comes back as "name: reason" lines
+  async function sendAll(
+    files: File[],
+    names: (string | undefined)[],
+    target: 'workspace' | 'shared',
+  ): Promise<string[]> {
+    const failed: string[] = []
+    for (const [i, file] of files.entries()) {
+      try {
+        const result = await api.uploadMedia(
+          file,
+          names[i],
+          target === 'shared',
+        )
+        if (files.length === 1)
+          notify.success(`Uploaded as ${result.reference ?? result.url}`)
+      } catch (e) {
+        failed.push(
+          `${file.name}: ${e instanceof Error ? e.message : String(e)}`,
+        )
+      }
+    }
+    return failed
+  }
+
+  async function uploadFiles(files: File[], target: 'workspace' | 'shared') {
+    if (!files.length) return
+    const names = askNames(files, target)
+    if (!names) return
     busy = true
-    try {
-      const result = await api.uploadMedia(
-        file,
-        assetName || undefined,
-        uploadTarget === 'shared',
+    const failed = await sendAll(files, names, target)
+    if (files.length > 1 && failed.length < files.length)
+      notify.success(
+        `Uploaded ${files.length - failed.length} of ${files.length} files`,
       )
-      notify.success(`Uploaded as ${result.reference ?? result.url}`)
-      await load()
-    } catch (e) {
-      notify.error(e instanceof Error ? e.message : String(e))
-    } finally {
-      busy = false
-    }
+    if (failed.length) notify.error(failed.join('\n'))
+    busy = false
+    await load()
   }
 
   async function remove(asset: AssetFile) {
@@ -283,130 +330,141 @@
   }}
 />
 
-<div class="pagehead">
-  <h1>{shared ? 'Shared assets' : 'Assets'}</h1>
-  <span class="num muted">{shownCount} files</span>
-  <span class="flex"></span>
-  {#if !shared && elsewhereCount}
-    <a
-      class="sharedlink plain muted"
-      href={sharedHref('assets')}
-      title="the shared library every workspace under this root can use"
-      >shared <span class="num">{elsewhereCount}</span></a
-    >
-  {/if}
-  <input class="filter" placeholder="filter…" bind:value={filter} />
-  <!-- One input for every section: which library the file lands in is
+<div
+  class="dropzone"
+  use:dropFiles={{
+    ondrop: (files) => uploadFiles(files, shared ? 'shared' : 'workspace'),
+    disabled: busy,
+  }}
+>
+  <div class="pagehead">
+    <h1>{shared ? 'Shared assets' : 'Assets'}</h1>
+    <span class="num muted">{shownCount} files</span>
+    <span class="flex"></span>
+    {#if !shared && elsewhereCount}
+      <a
+        class="sharedlink plain muted"
+        href={sharedHref('assets')}
+        title="the shared library every workspace under this root can use"
+        >shared <span class="num">{elsewhereCount}</span></a
+      >
+    {/if}
+    <input class="filter" placeholder="filter…" bind:value={filter} />
+    <!-- One input for every section: which library the file lands in is
        uploadTarget, set by whichever button opened it -->
-  <input
-    class="hiddenfile"
-    type="file"
-    accept="image/*,video/*,audio/*"
-    bind:this={fileInput}
-    onchange={upload}
-  />
-</div>
-
-{#if error}<p class="muted">Could not read the asset library: {error}</p>{/if}
+    <input
+      class="hiddenfile"
+      type="file"
+      multiple
+      accept="image/*,video/*,audio/*"
+      bind:this={fileInput}
+      onchange={upload}
+    />
+  </div>
 
-<HintBar storageKey="assets-hint-dismissed">
-  An asset is input a workflow names by reference: an argument set to asset:name
-  loads this file at run time, whatever run produced it.
-  {#if shared}
-    The shared library follows you between workspaces; an examples library is
-    read-only.
-  {:else}
-    This workspace's own assets come first, and a name here hides the same name
-    in the shared library. Shared assets are listed here only when one of this
-    workspace's workflows names them; the rest are on the Shared assets page.
-  {/if}
-</HintBar>
+  {#if error}<p class="muted">Could not read the asset library: {error}</p>{/if}
 
-{#if loaded && !error && shownCount === 0}
-  <Empty>
-    {#snippet icon()}<FolderOpen size={36} strokeWidth={1.5} />{/snippet}
-    Nothing in the asset library yet — upload a file, or keep one from the gallery.
-    {#if !shared && elsewhereCount}
-      The <a href={sharedHref('assets')}>shared library</a> has {elsewhereCount}
-      more.
+  <HintBar storageKey="assets-hint-dismissed">
+    An asset is input a workflow names by reference: an argument set to
+    asset:name loads this file at run time, whatever run produced it. Drop files
+    anywhere on the page to upload them here.
+    {#if shared}
+      The shared library follows you between workspaces; an examples library is
+      read-only.
+    {:else}
+      This workspace's own assets come first, and a name here hides the same
+      name in the shared library. Shared assets are listed here only when one of
+      this workspace's workflows names them; the rest are on the Shared assets
+      page.
     {/if}
-  </Empty>
-{/if}
+  </HintBar>
 
-<BulkBar
-  {picks}
-  visible={ordered.length}
-  {filterActive}
-  {busy}
-  noun="asset"
-  ondownload={downloadPicked}
-  ondelete={removePicked}
-/>
+  {#if loaded && !error && shownCount === 0}
+    <Empty>
+      {#snippet icon()}<FolderOpen size={36} strokeWidth={1.5} />{/snippet}
+      Nothing in the asset library yet — upload a file, or keep one from the gallery.
+      {#if !shared && elsewhereCount}
+        The <a href={sharedHref('assets')}>shared library</a> has {elsewhereCount}
+        more.
+      {/if}
+    </Empty>
+  {/if}
 
-{#each sections as section (section.origin)}
-  <LibraryRow
-    {section}
-    open={isOpen(section.origin)}
-    {shared}
+  <BulkBar
+    {picks}
+    visible={ordered.length}
+    {filterActive}
     {busy}
-    ontoggle={() => toggleLibrary(section.origin)}
-    onupload={startUpload}
+    noun="asset"
+    ondownload={downloadPicked}
+    ondelete={removePicked}
   />
 
-  {#if isOpen(section.origin)}
-    <FolderGroups
-      names={section.assets.map((a) => a.name)}
-      groupOf={(name) => folderByName.get(name) ?? ''}
-      collapseKey="collapsed-asset-folders-{section.origin}"
-      {filterActive}
-      minColumn="150px"
-    >
-      {#snippet card(name)}
-        {@const asset = byName.get(name)!}
-        <div class="cellwrap" class:picked={picks.has(name)}>
-          <!-- A sibling of the cell rather than a child: a checkbox nested in
+  {#each sections as section (section.origin)}
+    <LibraryRow
+      {section}
+      open={isOpen(section.origin)}
+      {shared}
+      {busy}
+      ontoggle={() => toggleLibrary(section.origin)}
+      onupload={startUpload}
+    />
+
+    {#if isOpen(section.origin)}
+      <FolderGroups
+        names={section.assets.map((a) => a.name)}
+        groupOf={(name) => folderByName.get(name) ?? ''}
+        collapseKey="collapsed-asset-folders-{section.origin}"
+        {filterActive}
+        minColumn="150px"
+      >
+        {#snippet card(name)}
+          {@const asset = byName.get(name)!}
+          <div class="cellwrap" class:picked={picks.has(name)}>
+            <!-- A sibling of the cell rather than a child: a checkbox nested in
                a button is invalid, and keeping them apart is what lets a plain
                click still open the details it always has -->
-          {#if section.writable}
-            <input
-              class="pick"
-              type="checkbox"
-              checked={picks.has(name)}
-              aria-label="select {asset.name}"
-              title="select this asset for a bulk action"
-              onclick={(e) => picks.toggle(name, e.shiftKey)}
-            />
-          {/if}
-          <button
-            class="cell"
-            class:active={selected?.name === name}
-            onclick={() => (selected = asset)}
-            aria-label="show details for {asset.name}"
-            title="show details"
-          >
-            {#if asset.kind === 'image'}
-              <img src={asset.url} alt={asset.name} loading="lazy" />
-            {:else if asset.kind === 'video'}
-              <video src={asset.url} preload="metadata" muted></video>
-            {:else}
-              <span class="audio"
-                >{asset.kind === 'audio' ? '♪' : '¶'}
-                {leafName(asset.name)}</span
-              >
+            {#if section.writable}
+              <input
+                class="pick"
+                type="checkbox"
+                checked={picks.has(name)}
+                aria-label="select {asset.name}"
+                title="select this asset for a bulk action"
+                onclick={(e) => picks.toggle(name, e.shiftKey)}
+              />
             {/if}
-            <span class="caption" title={asset.reference}
-              >{leafName(asset.name)}</span
+            <button
+              class="cell"
+              class:active={selected?.name === name}
+              onclick={() => (selected = asset)}
+              aria-label="show details for {asset.name}"
+              title="show details"
             >
-          </button>
-        </div>
-      {/snippet}
-    </FolderGroups>
+              {#if asset.kind === 'image'}
+                <img src={asset.url} alt={asset.name} loading="lazy" />
+              {:else if asset.kind === 'video'}
+                <video src={asset.url} preload="metadata" muted></video>
+              {:else}
+                <span class="audio"
+                  >{asset.kind === 'audio' ? '♪' : '¶'}
+                  {leafName(asset.name)}</span
+                >
+              {/if}
+              <span class="caption" title={asset.reference}
+                >{leafName(asset.name)}</span
+              >
+            </button>
+          </div>
+        {/snippet}
+      </FolderGroups>
 
-    {#if section.shadowed.length}
-      <ShadowedAssets entries={section.shadowed} />
+      {#if section.shadowed.length}
+        <ShadowedAssets entries={section.shadowed} />
+      {/if}
     {/if}
-  {/if}
-{/each}
+  {/each}
+</div>
 
 {#if loaded && assets.length > 0 && ordered.length === 0}
   <p class="muted">Nothing matches "{filter}".</p>
@@ -418,10 +476,14 @@
     {busy}
     onremove={remove}
     onclose={() => (selected = null)}
+    onnotesaved={saveNote}
   />
 {/if}
 
 <style>
+  .dropzone {
+    min-height: 60vh;
+  }
   .pagehead .filter {
     max-width: 220px;
   }
diff --git a/ui/src/lib/pages/AssetsPage.test.ts b/ui/src/lib/pages/AssetsPage.test.ts
index 1b1b2683..9fb3d445 100644
--- a/ui/src/lib/pages/AssetsPage.test.ts
+++ b/ui/src/lib/pages/AssetsPage.test.ts
@@ -1,5 +1,6 @@
 import {
   cleanup,
+  fireEvent,
   render,
   screen,
   waitFor,
@@ -87,9 +88,12 @@ const uploadMedia = vi.hoisted(() =>
     () => Promise.resolve({ reference: 'asset:uploads/x.png' }),
   ),
 )
+const setNote = vi.hoisted(() => vi.fn())
 vi.mock('../api', () => ({
+  setNote: (t: string, n: string | null) => setNote(t, n),
   api: {
     listAssets: () => listAssets(),
+    galleryMetadata: () => new Promise(() => {}),
     deleteAsset: (name: string) => deleteAsset(name),
     archiveAssets: (names: string[]) => archiveAssets(names),
     uploadMedia: (file: File, assetName?: string, shared?: boolean) =>
@@ -632,3 +636,45 @@ it('names the workflows that use an asset in its details', async () => {
   const link = await waitFor(() => screen.getByRole('link', { name: 'ep/two' }))
   expect(link.getAttribute('href')).toContain('workflows/ep/two')
 })
+
+it('keeps a saved note on the asset when it is selected again', async () => {
+  setNote.mockResolvedValue({
+    target: 'asset:iris.png',
+    note: 'hero shot',
+    note_source: null,
+  })
+  await renderAssets()
+  screen.getByLabelText('show details for iris.png').click()
+  await fireEvent.click(
+    await screen.findByRole('button', { name: /edit note/i }),
+  )
+  await fireEvent.input(screen.getByLabelText('Note'), {
+    target: { value: 'hero shot' },
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+  await waitFor(() => expect(screen.getByText('hero shot')).toBeTruthy())
+  screen.getByLabelText('show details for cast/priya.jpg').click()
+  await waitFor(() => expect(screen.queryByText('hero shot')).toBeNull())
+  screen.getByLabelText('show details for iris.png').click()
+  await waitFor(() => expect(screen.getByText('hero shot')).toBeTruthy())
+})
+
+it('a drop on the shared page uploads to the shared library without a button click', async () => {
+  listing.libraries = [WORKSPACE_LIBRARY, SHARED_LIBRARY]
+  listing.assets = [asset('shared/logo.png', 'common')]
+  await renderAssets('logo.png', true)
+
+  vi.stubGlobal(
+    'prompt',
+    vi.fn(() => 'dropped.png'),
+  )
+  const file = new File(['x'], 'dropped.png', { type: 'image/png' })
+  const drop = new Event('drop', { bubbles: true, cancelable: true })
+  Object.defineProperty(drop, 'dataTransfer', {
+    value: { types: ['Files'], files: [file] },
+  })
+  document.querySelector('.dropzone')!.dispatchEvent(drop)
+
+  await waitFor(() => expect(uploadMedia).toHaveBeenCalledTimes(1))
+  expect(uploadMedia).toHaveBeenCalledWith(file, 'dropped.png', true)
+})
diff --git a/ui/src/lib/pages/ComparePage.svelte b/ui/src/lib/pages/ComparePage.svelte
new file mode 100644
index 00000000..0a261eed
--- /dev/null
+++ b/ui/src/lib/pages/ComparePage.svelte
@@ -0,0 +1,254 @@
+<script lang="ts">
+  // Two to four outputs side by side - the seed sweep, the int4 vs int8
+  // pair, the 12 vs 30 steps - with the arguments that differ called out
+  // and every video on one transport, so a difference in motion is seen at
+  // the same frame rather than remembered across two players
+  import { Pause, Play } from '@lucide/svelte'
+  import { api } from '../api'
+  import { differingArguments, argumentOf, valueText } from '../compare'
+  import { formatDuration } from '../format'
+  import { wsHref } from '../routes'
+  import type { GalleryFile } from '../types'
+  import { workspace } from '../workspace.svelte'
+  import Markdown from '../ui/Markdown.svelte'
+  import Skeleton from '../ui/Skeleton.svelte'
+
+  let { names }: { names: string[] } = $props()
+
+  type Cell = {
+    name: string
+    file: GalleryFile | null
+    meta: Record<string, unknown> | null
+    took: number | null
+  }
+  let cells = $state<Cell[]>([])
+  let loaded = $state(false)
+
+  // How long the run took, from the job that made the file - unknown when
+  // the job is gone or never finished
+  async function runTime(jobId: string | null | undefined) {
+    const job = jobId ? await api.getJob(jobId).catch(() => null) : null
+    return job?.started_at && job.finished_at
+      ? job.finished_at - job.started_at
+      : null
+  }
+
+  async function cellFor(
+    name: string,
+    file: GalleryFile | null,
+  ): Promise<Cell> {
+    if (!file) return { name, file, meta: null, took: null }
+    const r = await api.galleryMetadata(name).catch(() => null)
+    return {
+      name,
+      file,
+      meta: (r?.metadata as Record<string, unknown> | undefined) ?? null,
+      took: await runTime(r?.job?.id),
+    }
+  }
+
+  async function load(wanted: string[]) {
+    length = 0
+    time = 0
+    playing = false
+    const { files } = await api.gallery()
+    const byName = new Map(files.map((f) => [f.name, f]))
+    cells = await Promise.all(
+      wanted.map((name) => cellFor(name, byName.get(name) ?? null)),
+    )
+  }
+
+  $effect(() => {
+    const wanted = [...names]
+    loaded = false
+    void load(wanted)
+      .catch(() => (cells = []))
+      .finally(() => (loaded = true))
+  })
+
+  const differing = $derived(differingArguments(cells.map((c) => c.meta)))
+
+  // One transport for every video
+  let videos = $state<HTMLVideoElement[]>([])
+  let playing = $state(false)
+  let time = $state(0)
+  let length = $state(0)
+  // The first video is the clock the slider reads, whatever cells precede it
+  const clock = $derived(cells.findIndex((c) => c.file?.kind === 'video'))
+  const present = () => videos.filter(Boolean)
+  function playPause() {
+    playing = !playing
+    for (const v of present()) {
+      if (!playing) v.pause()
+      else void Promise.resolve(v.play()).catch(() => (playing = false))
+    }
+  }
+  function seek(to: number) {
+    time = to
+    for (const v of present()) v.currentTime = to
+  }
+</script>
+
+<div class="pagehead baseline">
+  <h1>Compare</h1>
+  <a class="plain muted" href={wsHref(workspace.current, 'gallery')}
+    >back to the gallery</a
+  >
+</div>
+
+{#if !loaded}
+  <Skeleton tiles={names.length} label="loading the comparison" />
+{:else}
+  {#if cells.some((c) => c.file?.kind === 'video')}
+    <div class="transport">
+      <button
+        class="quiet icon"
+        onclick={playPause}
+        aria-label={playing ? 'pause all' : 'play all'}
+      >
+        {#if playing}<Pause size={14} />{:else}<Play size={14} />{/if}
+      </button>
+      <input
+        type="range"
+        min="0"
+        max={length || 0}
+        step="0.01"
+        value={time}
+        oninput={(e) => seek(Number(e.currentTarget.value))}
+        aria-label="position in every video"
+      />
+      <span class="num muted">{time.toFixed(2)} s</span>
+    </div>
+  {/if}
+
+  <div class="grid" style:--cols={cells.length}>
+    {#each cells as cell, i (cell.name)}
+      <figure class="cell">
+        {#if !cell.file}
+          <p class="muted">{cell.name} is no longer in the gallery.</p>
+        {:else if cell.file.kind === 'video'}
+          <video
+            bind:this={videos[i]}
+            src={cell.file.url}
+            loop
+            muted
+            playsinline
+            ontimeupdate={(e) => {
+              if (i === clock) time = e.currentTarget.currentTime
+            }}
+            onloadedmetadata={(e) => {
+              length = Math.max(length, e.currentTarget.duration)
+            }}
+          ></video>
+        {:else if cell.file.kind === 'image'}
+          <img src={cell.file.url} alt={cell.name} />
+        {:else}
+          <p class="muted">{cell.file.label}</p>
+        {/if}
+        {#if cell.file}
+          <figcaption>
+            <span class="mono">{cell.file.label}</span>
+            {#if cell.file.version}<span class="num muted"
+                >v{cell.file.version}</span
+              >{/if}
+            <span class="num muted">
+              {valueText(argumentOf(cell.meta, 'model'))} · seed {valueText(
+                argumentOf(cell.meta, 'seed'),
+              )}{cell.took !== null ? ` · ${formatDuration(cell.took)}` : ''}
+            </span>
+            {#if cell.file.note}<div class="note">
+                <Markdown source={cell.file.note} />
+              </div>{/if}
+          </figcaption>
+        {/if}
+      </figure>
+    {/each}
+  </div>
+
+  {#if differing.length}
+    <section class="panel">
+      <h2>What differs</h2>
+      <table>
+        <tbody>
+          {#each differing as key (key)}
+            <tr>
+              <th scope="row">{key}</th>
+              {#each cells as cell (cell.name)}
+                <td class="mono">{valueText(argumentOf(cell.meta, key))}</td>
+              {/each}
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+    </section>
+  {:else if cells.filter((c) => c.meta).length > 1}
+    <p class="muted">
+      Same model, seed and arguments - the files differ only in what the run
+      did.
+    </p>
+  {/if}
+{/if}
+
+<style>
+  .grid {
+    display: grid;
+    grid-template-columns: repeat(var(--cols), minmax(0, 1fr));
+    gap: var(--space-3);
+    margin-bottom: var(--space-4);
+  }
+  @media (max-width: 640px) {
+    .grid {
+      grid-template-columns: 1fr;
+    }
+  }
+  .cell {
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+  }
+  .cell img,
+  .cell video {
+    width: 100%;
+    background: var(--panel-2);
+    border: 1px solid var(--line);
+  }
+  figcaption {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--space-2);
+    font-size: var(--t-sm);
+  }
+  .mono {
+    font-family: var(--font-mono);
+  }
+  .note {
+    flex-basis: 100%;
+  }
+  .transport {
+    display: flex;
+    align-items: center;
+    gap: var(--space-2);
+    margin-bottom: var(--space-3);
+  }
+  .transport input {
+    flex: 1;
+  }
+  table {
+    border-collapse: collapse;
+    width: 100%;
+    font-size: var(--t-sm);
+  }
+  th {
+    text-align: left;
+    font-family: var(--font-mono);
+    color: var(--muted);
+    padding-right: var(--space-3);
+    white-space: nowrap;
+  }
+  td {
+    padding: var(--space-1) var(--space-2);
+    border-top: 1px solid var(--line);
+    overflow-wrap: anywhere;
+  }
+</style>
diff --git a/ui/src/lib/pages/ComparePage.test.ts b/ui/src/lib/pages/ComparePage.test.ts
new file mode 100644
index 00000000..b74c8779
--- /dev/null
+++ b/ui/src/lib/pages/ComparePage.test.ts
@@ -0,0 +1,71 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const file = (name: string, kind = 'image') => ({
+  name,
+  label: name.split('/').pop(),
+  kind,
+  url: `/outputs/${name}`,
+  folder: 'wf',
+  subfolder: '',
+  run_id: 'r',
+  size: 1,
+  mtime: 1,
+})
+
+vi.mock('../api', () => ({
+  api: {
+    gallery: () =>
+      Promise.resolve({
+        files: [
+          file('wf/r1/a.png'),
+          file('wf/r2/b.png'),
+          file('wf/v1.mp4', 'video'),
+          file('wf/v2.mp4', 'video'),
+        ],
+      }),
+    galleryMetadata: (name: string) =>
+      Promise.resolve({
+        metadata: {
+          model_name: 'h3',
+          seed: name.includes('a') ? 1 : 2,
+          arguments: { steps: 12 },
+        },
+        job: null,
+      }),
+    galleryThumbnailUrl: (n: string) => `/thumb/${n}`,
+    getJob: () => Promise.reject(new Error('none')),
+  },
+}))
+
+import ComparePage from './ComparePage.svelte'
+
+describe('ComparePage', () => {
+  afterEach(cleanup)
+  it('shows each file and only the argument that differs', async () => {
+    render(ComparePage, { props: { names: ['wf/r1/a.png', 'wf/r2/b.png'] } })
+    expect(await screen.findByAltText('wf/r1/a.png')).toBeTruthy()
+    expect(await screen.findByRole('rowheader', { name: 'seed' })).toBeTruthy()
+    expect(screen.queryByRole('rowheader', { name: 'steps' })).toBeNull()
+  })
+  it('says when a file is gone', async () => {
+    render(ComparePage, { props: { names: ['wf/r1/a.png', 'wf/gone.png'] } })
+    expect(await screen.findByText(/no longer in the gallery/)).toBeTruthy()
+  })
+  it('reads the clock from the first video, not the first cell', async () => {
+    const { container } = render(ComparePage, {
+      props: { names: ['wf/r1/a.png', 'wf/v1.mp4', 'wf/v2.mp4'] },
+    })
+    await screen.findByLabelText('position in every video')
+    const [first, second] = container.querySelectorAll('video')
+    const slider = screen.getByLabelText(
+      'position in every video',
+    ) as HTMLInputElement
+    second.currentTime = 7
+    await fireEvent(second, new Event('timeupdate'))
+    expect(slider.value).toBe('0')
+    first.currentTime = 3
+    await fireEvent(first, new Event('timeupdate'))
+    expect(screen.getByText('3.00 s')).toBeTruthy()
+  })
+})
diff --git a/ui/src/lib/pages/GalleryPage.svelte b/ui/src/lib/pages/GalleryPage.svelte
index 4604e098..f0d0f965 100644
--- a/ui/src/lib/pages/GalleryPage.svelte
+++ b/ui/src/lib/pages/GalleryPage.svelte
@@ -1,25 +1,28 @@
 <script lang="ts">
-  import { ImageOff, Play } from '@lucide/svelte'
+  import { ImageOff, Pencil, Play, Star } from '@lucide/svelte'
   import { outputLibrary } from '../outputlib.svelte'
   import { api } from '../api'
   import Empty from '../Empty.svelte'
   import FolderGroups from '../FolderGroups.svelte'
   import BulkBar from '../BulkBar.svelte'
   import { Picks, actOnEach } from '../picks.svelte'
+  import { isEditable } from '../editable'
+  import { neighbor } from '../neighbor'
   import { overlayOpen } from '../ui/layers.svelte'
   import { notify } from '../toast'
   import { confirmDialog } from '../confirm.svelte'
-  import type { GalleryFile } from '../types'
+  import type { GalleryFile, GalleryInput, OutputRole } from '../types'
   import { workspace } from '../workspace.svelte'
+  import { go } from '../router.svelte'
   import GalleryDetail from '../gallery/GalleryDetail.svelte'
+  import RoleTag from '../gallery/RoleTag.svelte'
 
   let files = $state<GalleryFile[]>([])
   let loaded = $state(false)
   let filter = $state('')
-  // The in-run subfolder to show - null is every one. Only offered when
-  // some output landed in one; a workspace of unfoldered runs never sees
-  // the control
-  let subfolder = $state<string | null>(null)
+  // The roles to show. Finals are what a run was for, so the gallery opens
+  // on them; Intermediate adds the steps' working files
+  let roles = $state<OutputRole[]>(['final'])
   let error = $state('')
   let selected = $state<GalleryFile | null>(null)
   // Names ticked in the grid, for the bulk actions. The grid order it is
@@ -28,12 +31,17 @@
   let busy = $state(false)
   let metadata = $state<Record<string, unknown> | null>(null)
   let metadataLoading = $state(false)
+  let noteInfo = $state<{
+    note: string | null
+    runNote: string | null
+    source: 'file' | 'run' | null
+  }>({ note: null, runNote: null, source: null })
   let sourceJob = $state<{ id: string; status: string } | null>(null)
+  let role = $state<OutputRole | null>(null)
+  let inputs = $state<GalleryInput[]>([])
 
-  $effect(() => {
-    // Read inside the effect so switching workspaces refetches the gallery
-    void workspace.current
-    api
+  function loadListing() {
+    return api
       .gallery()
       .then((result) => {
         files = result.files
@@ -45,39 +53,58 @@
       })
       .catch((e) => (error = e.message))
       .finally(() => (loaded = true))
+  }
+
+  $effect(() => {
+    // Read inside the effect so switching workspaces refetches the gallery
+    void workspace.current
+    void loadListing()
   })
 
-  // Every distinct subfolder in the listing - read off the entries so a
-  // delete updates it without a refetch. '' (the run root) appears only
-  // when some file sits there, so the pick never offers an empty option
-  const subfolders = $derived(
-    [...new Set(files.map((f) => f.subfolder))].sort((a, b) =>
-      a.localeCompare(b),
-    ),
+  // A file whose run does not say its role counts as final
+  const roleOf = (f: GalleryFile): OutputRole => f.role ?? 'final'
+  let starredOnly = $state(false)
+  const filterActive = $derived(
+    filter !== '' || roles.length < 2 || starredOnly,
   )
-  const subfolderOffered = $derived(subfolders.some((s) => s !== ''))
-  const filterActive = $derived(filter !== '' || subfolder !== null)
-  const visible = $derived(
-    files.filter(
+  // Finals lead inside a run only: the server's order (newest first) holds
+  // between runs, so runs sit where their newest file put them. The sort is
+  // stable, so it holds inside each role too
+  const runKey = (f: GalleryFile) => `${f.folder}\u0000${f.run_id}`
+  const visible = $derived.by(() => {
+    const shown = files.filter(
       (f) =>
         f.name.toLowerCase().includes(filter.toLowerCase()) &&
-        (subfolder === null || f.subfolder === subfolder),
-    ),
-  )
-  // A pick that no longer exists (its last file deleted) means everything,
-  // not an empty grid pinned to a vanished value - and the control itself
-  // is reset, since a <select> whose value matches no option shows blank.
-  // A pick of '' (the run root) never appears in `subfolders` on its own,
-  // so it is only cleared once the control itself stops being offered -
-  // otherwise it would survive the control unmounting and leave
-  // `filterActive` stuck true with nothing to reset it
-  $effect(() => {
-    if (
-      subfolder !== null &&
-      (!subfolderOffered || !subfolders.includes(subfolder))
+        roles.includes(roleOf(f)) &&
+        (!starredOnly || f.starred),
     )
-      subfolder = null
+    // Each run's place is the index of its first (newest) file. Built
+    // back to front so the first file's index is the one that sticks; a
+    // Map keeps this linear at thousands of files
+    const runs = new Map(shown.map((f, i) => [runKey(f), i] as const).reverse())
+    const place = (f: GalleryFile) => runs.get(runKey(f))!
+    const rank = (f: GalleryFile) => Number(roleOf(f) === 'intermediate')
+    return shown.sort((a, b) => place(a) - place(b) || rank(a) - rank(b))
   })
+  async function toggleStar() {
+    if (!selected) return
+    const name = selected.name
+    const next = !selected.starred
+    try {
+      await api.setStarred(name, next)
+      files = files.map((f) => (f.name === name ? { ...f, starred: next } : f))
+      if (selected?.name === name) selected = { ...selected, starred: next }
+    } catch (e) {
+      notify.error(e instanceof Error ? e.message : String(e))
+    }
+  }
+  // Never both off: an empty grid is not a state worth offering
+  function toggleRole(which: OutputRole) {
+    const next = roles.includes(which)
+      ? roles.filter((r) => r !== which)
+      : [...roles, which]
+    roles = next.length ? next : [which === 'final' ? 'intermediate' : 'final']
+  }
   const byName = $derived(new Map(visible.map((f) => [f.name, f])))
   // The server folds each run id into `folder`; group by that, since the
   // name alone reads the run directory as one more folder
@@ -120,17 +147,39 @@
     busy = false
   }
 
+  // Where the open file stood in the grid when last seen there, so stepping
+  // goes on from that place once a filter or an unstar has hidden it
+  let selectedAt = -1
+  // The grid's order, noting the open file's place while it is still listed
+  function gridOrder() {
+    const order = visible.map((f) => f.name)
+    const at = selected ? order.indexOf(selected.name) : -1
+    if (at !== -1) selectedAt = at
+    return order
+  }
+
   function select(file: GalleryFile) {
     selected = file
+    selectedAt = visible.findIndex((f) => f.name === file.name)
     metadata = null
     metadataLoading = true
     sourceJob = null
+    role = null
+    inputs = []
+    noteInfo = { note: null, runNote: null, source: null }
     api
       .galleryMetadata(file.name)
       .then((r) => {
         if (selected?.name === file.name) {
           metadata = r.metadata
           sourceJob = r.job
+          role = r.role ?? file.role ?? null
+          inputs = r.inputs ?? []
+          noteInfo = {
+            note: r.note ?? null,
+            runNote: r.run_note ?? null,
+            source: r.note_source ?? null,
+          }
         }
       })
       .catch(() => {})
@@ -139,6 +188,29 @@
       })
   }
 
+  // A note changed: refetch what the panel shows and carry the file's
+  // effective note to its tile, which is what the grid marks
+  async function refreshNote(kind: 'run' | 'file') {
+    const name = selected?.name
+    if (!name) return
+    // A run's note shows on every tile of the run that inherits it
+    if (kind === 'run') await loadListing()
+    try {
+      const r = await api.galleryMetadata(name)
+      if (selected?.name !== name) return
+      noteInfo = {
+        note: r.note ?? null,
+        runNote: r.run_note ?? null,
+        source: r.note_source ?? null,
+      }
+      files = files.map((f) =>
+        f.name === name ? { ...f, note: r.note ?? undefined } : f,
+      )
+    } catch {
+      /* the editor already shows what was saved */
+    }
+  }
+
   async function removeFile() {
     if (!selected) return
     if (
@@ -149,48 +221,95 @@
     )
       return
     const name = selected.name
+    const order = gridOrder()
+    const after =
+      neighbor(order, name, 1, selectedAt) ??
+      neighbor(order, name, -1, selectedAt)
     try {
       await api.deleteOutput(name)
       files = files.filter((f) => f.name !== name)
       // A file deleted from here may also be ticked in the grid; leaving it
       // there would make the next bulk action fail on a file that is gone
       picks.drop(name)
-      selected = null
+      // Culling goes on to the next file rather than back to the grid
+      if (after && byName.get(after)) select(byName.get(after)!)
+      else selected = null
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
       notify.error(msg)
     }
   }
-</script>
 
-<svelte:window
-  onkeydown={(e) => {
-    // Escape closes the thing on top, and a dialog answers it itself. The
-    // selection is the more recent, more surprising state to be stuck in,
-    // so it clears first and the detail panel on a second press
-    if (e.key !== 'Escape' || overlayOpen()) return
+  // Escape closes the thing on top, and a dialog answers it itself. The
+  // selection is the more recent, more surprising state to be stuck in,
+  // so it clears first and the detail panel on a second press
+  function escape() {
     if (picks.size) picks.clear()
     else selected = null
-  }}
-/>
+  }
+
+  function step(e: KeyboardEvent, by: 1 | -1) {
+    if (!selected) return
+    const next = neighbor(gridOrder(), selected.name, by, selectedAt)
+    const file = next ? byName.get(next) : undefined
+    if (!file) return
+    e.preventDefault()
+    select(file)
+  }
+
+  // A bare S: with Shift, Alt or a command modifier it is someone else's
+  const isStarKey = (e: KeyboardEvent) =>
+    e.key.toLowerCase() === 's' &&
+    !(e.metaKey || e.ctrlKey || e.altKey || e.shiftKey)
+
+  // Culling a run: step through what the grid shows, delete as you go
+  function cullKey(e: KeyboardEvent) {
+    if (e.key === 'ArrowRight') step(e, 1)
+    else if (e.key === 'ArrowLeft') step(e, -1)
+    else if (e.key === 'Delete' || (e.key === 'Backspace' && e.metaKey)) {
+      e.preventDefault()
+      void removeFile()
+    } else if (isStarKey(e)) {
+      e.preventDefault()
+      void toggleStar()
+    }
+  }
+
+  function onKeydown(e: KeyboardEvent) {
+    if (overlayOpen()) return
+    if (e.key === 'Escape') return escape()
+    // A key typed into the note box, or a focused video seeking, is theirs
+    if (selected && !isEditable(e.target)) cullKey(e)
+  }
+</script>
+
+<svelte:window onkeydown={onKeydown} />
 
 <div class="pagehead baseline">
   <h1>Gallery</h1>
   <span class="num muted">{files.length} files</span>
   <input class="filter" placeholder="filter…" bind:value={filter} />
-  {#if subfolderOffered}
-    <select
-      class="subfolderpick"
-      aria-label="subfolder"
-      title="show only files a step saved to this subfolder of its run"
-      bind:value={subfolder}
+  <div class="rolechips" role="group" aria-label="filter by role">
+    {#each ['final', 'intermediate'] as const as which (which)}
+      <button
+        class="rolechip"
+        class:on={roles.includes(which)}
+        aria-pressed={roles.includes(which)}
+        onclick={() => toggleRole(which)}
+        title={which === 'final'
+          ? 'what the runs were for'
+          : "the steps' working files, kept along the way"}
+        >{which === 'final' ? 'Final' : 'Intermediate'}</button
+      >
+    {/each}
+    <button
+      class="rolechip"
+      class:on={starredOnly}
+      aria-pressed={starredOnly}
+      onclick={() => (starredOnly = !starredOnly)}
+      title="only the files you starred">Starred</button
     >
-      <option value={null}>all subfolders</option>
-      {#each subfolders as s (s)}
-        <option value={s}>{s === '' ? '(run root)' : `${s}/`}</option>
-      {/each}
-    </select>
-  {/if}
+  </div>
 </div>
 
 {#if error}<p class="muted">Could not read the gallery: {error}</p>{/if}
@@ -209,6 +328,7 @@
   noun="file"
   ondownload={downloadPicked}
   ondelete={removePicked}
+  oncompare={() => go('ws', workspace.current, 'compare', ...picks.names)}
 />
 
 <FolderGroups
@@ -264,6 +384,11 @@
           >
         {/if}
         <span class="caption" title={file.name}>
+          {#if file.role}
+            <RoleTag role={file.role} />
+            <!-- eslint-disable-next-line svelte/no-useless-mustaches -->
+            {' '}
+          {/if}
           {#if file.version}
             <span
               class="version"
@@ -275,7 +400,17 @@
                  whitespace at the edge of an if block is trimmed -->
             <!-- eslint-disable-next-line svelte/no-useless-mustaches -->
             {' '}
-          {/if}{file.label}</span
+          {/if}{file.label}{#if file.note}
+            <!-- eslint-disable-next-line svelte/no-useless-mustaches -->
+            {' '}<span
+              class="note-mark"
+              title={file.note.split('\n')[0]}
+              aria-label="Has a note"><Pencil size={11} /></span
+            >{/if}{#if file.starred}
+            <!-- eslint-disable-next-line svelte/no-useless-mustaches -->
+            {' '}<span class="note-mark" aria-label="Starred"
+              ><Star size={11} fill="currentColor" /></span
+            >{/if}</span
         >
       </button>
     </div>
@@ -288,6 +423,14 @@
     {metadata}
     {metadataLoading}
     {sourceJob}
+    {role}
+    {inputs}
+    note={noteInfo.note}
+    runNote={noteInfo.runNote}
+    noteSource={noteInfo.source}
+    onnotesaved={refreshNote}
+    starred={!!selected.starred}
+    onstar={toggleStar}
     onremove={removeFile}
     onclose={() => (selected = null)}
   />
@@ -298,12 +441,33 @@
     max-width: 220px;
     margin-left: auto;
   }
-  .subfolderpick {
-    /* The global select rule is width: 100% - here it must share the row */
-    width: auto;
-    max-width: 200px;
-    font-family: var(--font-mono);
-    font-size: var(--t-sm);
+  .rolechips {
+    display: flex;
+    gap: 0.3rem;
+  }
+  .rolechip {
+    background: none;
+    border: 1px solid var(--line);
+    border-radius: 999px;
+    color: var(--muted);
+    font-size: var(--t-xs);
+    font-weight: 500;
+    padding: 0.05rem 0.6rem;
+    cursor: pointer;
+  }
+  .rolechip:hover {
+    color: var(--ink);
+    border-color: var(--muted);
+    filter: none;
+  }
+  .rolechip.on {
+    background: var(--ink);
+    border-color: var(--ink);
+    color: var(--panel);
+  }
+  .note-mark {
+    color: var(--muted);
+    vertical-align: -1px;
   }
   .cellwrap {
     display: flex;
diff --git a/ui/src/lib/pages/GalleryPage.test.ts b/ui/src/lib/pages/GalleryPage.test.ts
index b29f2870..a0ebb630 100644
--- a/ui/src/lib/pages/GalleryPage.test.ts
+++ b/ui/src/lib/pages/GalleryPage.test.ts
@@ -15,8 +15,13 @@ import ConfirmDialog from '../ui/ConfirmDialog.svelte'
 import type { GalleryFile } from '../types'
 import { DEFAULT_WORKSPACE, workspace } from '../workspace.svelte'
 
-const file = (name: string, subfolder = ''): GalleryFile => ({
+const file = (
+  name: string,
+  subfolder = '',
+  role?: GalleryFile['role'],
+): GalleryFile => ({
   name,
+  role,
   folder: name.includes('/') ? name.split('/')[0] : '',
   subfolder,
   run_id: '',
@@ -46,15 +51,24 @@ const deleteOutput = vi.hoisted(() =>
 const archiveOutputs = vi.hoisted(() =>
   vi.fn<(names: string[]) => Promise<void>>(() => Promise.resolve()),
 )
+const setNote = vi.hoisted(() => vi.fn())
+const setStarred = vi.hoisted(() =>
+  vi.fn((name: string, starred: boolean) => Promise.resolve({ name, starred })),
+)
+const galleryMetadata = vi.hoisted(() =>
+  vi.fn<(name: string) => Promise<unknown>>(() => new Promise(() => {})),
+)
 vi.mock('../api', () => ({
+  setNote: (t: string, n: string | null) => setNote(t, n),
   api: {
     gallery: () => gallery(),
     galleryThumbnailUrl: (name: string) => `/thumb/${name}`,
     galleryUrl: (name: string) => `/outputs/${name}`,
     outputDownloadUrl: (name: string) => `/download/${name}`,
     deleteOutput: (name: string) => deleteOutput(name),
+    setStarred: (name: string, starred: boolean) => setStarred(name, starred),
     archiveOutputs: (names: string[]) => archiveOutputs(names),
-    galleryMetadata: vi.fn(() => new Promise(() => {})),
+    galleryMetadata: (name: string) => galleryMetadata(name),
   },
 }))
 
@@ -70,8 +84,11 @@ afterEach(() => {
   cleanup()
   gallery.mockClear()
   deleteOutput.mockClear()
+  setStarred.mockClear()
   archiveOutputs.mockClear()
   notifyError.mockClear()
+  galleryMetadata.mockReset()
+  galleryMetadata.mockImplementation(() => new Promise(() => {}))
   vi.unstubAllGlobals()
   workspace.current = DEFAULT_WORKSPACE
 })
@@ -102,6 +119,14 @@ function pressEscape() {
   )
 }
 
+/** Opens a file's detail panel by clicking its tile. */
+const openFile = (name: string) =>
+  fireEvent.click(
+    screen.getByRole('button', {
+      name: new RegExp(`^${name.replace('.', '\\.')}`),
+    }),
+  )
+
 async function answerConfirm(accept: boolean) {
   const dialog = await waitFor(() => screen.getByRole('alertdialog'))
   within(dialog)
@@ -238,141 +263,123 @@ it('drops a file deleted from the detail panel out of the selection', async () =
   expect(screen.getByLabelText('select b.png')).toBeTruthy()
 })
 
-it('offers no subfolder control when nothing was written to one', async () => {
-  await renderGallery()
-  expect(screen.queryByRole('combobox', { name: 'subfolder' })).toBeNull()
-})
+const roleFiles = () => [
+  file('wf/run-1/deliverable.png', 'final', 'final'),
+  file('wf/run-1/scratch.png', 'intermediate', 'intermediate'),
+]
 
-it('lists the subfolders the outputs landed in and filters the grid by one', async () => {
-  listing.files = [
-    file('wf/run-1/final/deliverable.png', 'final'),
-    file('wf/run-1/intermediate/scratch.png', 'intermediate'),
-    file('wf/run-1/root.png', ''),
-  ]
-  await renderGallery('wf/run-1/final/deliverable.png')
-
-  const pick = screen.getByRole('combobox', {
-    name: 'subfolder',
-  }) as HTMLSelectElement
-  expect([...pick.options].map((o) => o.textContent?.trim())).toEqual([
-    'all subfolders',
-    '(run root)',
-    'final/',
-    'intermediate/',
-  ])
+it('opens on finals only and shows each tile its role', async () => {
+  listing.files = roleFiles()
+  await renderGallery('wf/run-1/deliverable.png')
 
-  pick.value = 'final'
-  pick.dispatchEvent(new Event('change', { bubbles: true }))
-  await waitFor(() =>
-    expect(
-      screen.queryByLabelText('select wf/run-1/intermediate/scratch.png'),
-    ).toBeNull(),
-  )
   expect(
-    screen.getByLabelText('select wf/run-1/final/deliverable.png'),
-  ).toBeTruthy()
-  expect(screen.queryByLabelText('select wf/run-1/root.png')).toBeNull()
-  // Select all takes what the subfolder filter leaves showing
-  screen.getByRole('button', { name: /select all matching \(1\)/i }).click()
-  await waitFor(() => expect(screen.getByText('1 selected')).toBeTruthy())
+    screen.getByRole('button', { name: 'Final' }).getAttribute('aria-pressed'),
+  ).toBe('true')
+  expect(
+    screen
+      .getByRole('button', { name: 'Intermediate' })
+      .getAttribute('aria-pressed'),
+  ).toBe('false')
+  expect(screen.queryByLabelText('select wf/run-1/scratch.png')).toBeNull()
+  const tag = document.querySelector('.cell .role-tag') as HTMLElement
+  expect(tag.textContent).toBe('Final')
+  expect(tag.dataset.role).toBe('final')
 })
 
-it('intersects the subfolder pick with the text filter', async () => {
-  listing.files = [
-    file('wf/run-1/final/a.png', 'final'),
-    file('wf/run-1/final/b.png', 'final'),
-    file('wf/run-1/intermediate/a.png', 'intermediate'),
-  ]
-  await renderGallery('wf/run-1/final/a.png')
+it('counts a file with no role as final', async () => {
+  listing.files = [file('flat.png')]
+  await renderGallery('flat.png')
+  expect(screen.getByLabelText('select flat.png')).toBeTruthy()
+})
 
-  const pick = screen.getByRole('combobox', {
-    name: 'subfolder',
-  }) as HTMLSelectElement
-  pick.value = 'final'
-  pick.dispatchEvent(new Event('change', { bubbles: true }))
-  const filter = screen.getByPlaceholderText('filter…') as HTMLInputElement
-  filter.value = '/a.'
-  filter.dispatchEvent(new Event('input', { bubbles: true }))
+it('toggling Intermediate shows intermediates too, finals first', async () => {
+  listing.files = [...roleFiles()].reverse()
+  await renderGallery('wf/run-1/deliverable.png')
+
+  screen.getByRole('button', { name: 'Intermediate' }).click()
 
   await waitFor(() =>
-    expect(screen.queryByLabelText('select wf/run-1/final/b.png')).toBeNull(),
+    expect(screen.getByLabelText('select wf/run-1/scratch.png')).toBeTruthy(),
   )
-  expect(screen.getByLabelText('select wf/run-1/final/a.png')).toBeTruthy()
-  expect(
-    screen.queryByLabelText('select wf/run-1/intermediate/a.png'),
-  ).toBeNull()
+  const order = screen
+    .getAllByRole('checkbox')
+    .map((c) => c.getAttribute('aria-label'))
+  expect(order).toEqual([
+    'select wf/run-1/deliverable.png',
+    'select wf/run-1/scratch.png',
+  ])
 })
 
-it('falls back to every subfolder when the picked one empties out', async () => {
+it('keeps newest-first between runs and puts finals first only inside a run', async () => {
+  const inRun = (
+    run: string,
+    name: string,
+    role: 'final' | 'intermediate',
+  ) => ({
+    ...file(`wf/${run}/${name}.png`, role, role),
+    folder: 'wf',
+    run_id: run,
+  })
+  // The server lists newest first: the newer run's intermediate leads
   listing.files = [
-    file('wf/run-1/final/only.png', 'final'),
-    file('wf/run-1/root.png', ''),
+    inRun('new', 'scratch', 'intermediate'),
+    inRun('old', 'scratch', 'intermediate'),
+    inRun('new', 'deliverable', 'final'),
+    inRun('old', 'deliverable', 'final'),
   ]
-  await renderGallery('wf/run-1/final/only.png')
-  const pick = screen.getByRole('combobox', {
-    name: 'subfolder',
-  }) as HTMLSelectElement
-  pick.value = 'final'
-  pick.dispatchEvent(new Event('change', { bubbles: true }))
+  await renderGallery('wf/new/deliverable.png')
+  screen.getByRole('button', { name: 'Intermediate' }).click()
   await waitFor(() =>
-    expect(screen.queryByLabelText('select wf/run-1/root.png')).toBeNull(),
+    expect(screen.getByLabelText('select wf/new/scratch.png')).toBeTruthy(),
   )
+  expect(
+    screen.getAllByRole('checkbox').map((c) => c.getAttribute('aria-label')),
+  ).toEqual([
+    'select wf/new/deliverable.png',
+    'select wf/new/scratch.png',
+    'select wf/old/deliverable.png',
+    'select wf/old/scratch.png',
+  ])
+})
 
-  checkbox('wf/run-1/final/only.png').click()
-  await waitFor(() => expect(screen.getByText('1 selected')).toBeTruthy())
-  screen.getByRole('button', { name: /^delete/i }).click()
-  await answerConfirm(true)
+it('never lets both chips be off', async () => {
+  listing.files = roleFiles()
+  await renderGallery('wf/run-1/deliverable.png')
+
+  screen.getByRole('button', { name: 'Final' }).click()
 
-  // The last final/ file is gone: the control goes with it and the grid
-  // shows everything again rather than an empty page pinned to a value
-  // that no longer exists
   await waitFor(() =>
-    expect(screen.getByLabelText('select wf/run-1/root.png')).toBeTruthy(),
+    expect(
+      screen
+        .getByRole('button', { name: 'Intermediate' })
+        .getAttribute('aria-pressed'),
+    ).toBe('true'),
   )
+  expect(
+    screen.getByRole('button', { name: 'Final' }).getAttribute('aria-pressed'),
+  ).toBe('false')
+  expect(screen.getByLabelText('select wf/run-1/scratch.png')).toBeTruthy()
+})
+
+it('has no subfolder filter in the top bar', async () => {
+  listing.files = roleFiles()
+  await renderGallery('wf/run-1/deliverable.png')
   expect(screen.queryByRole('combobox', { name: 'subfolder' })).toBeNull()
 })
 
-it('resets a run-root pick when the control it depends on disappears', async () => {
+it('intersects the role chips with the text filter', async () => {
   listing.files = [
-    file('wf/run-1/final/only.png', 'final'),
-    file('wf/run-1/root.png', ''),
+    file('wf/run-1/a.png', 'final', 'final'),
+    file('wf/run-1/b.png', 'final', 'final'),
   ]
-  await renderGallery('wf/run-1/final/only.png')
-  const pick = screen.getByRole('combobox', {
-    name: 'subfolder',
-  }) as HTMLSelectElement
-  // "all subfolders" and "(run root)" both carry the native value "" -
-  // Svelte tells them apart by each option's bound __value - so picking by
-  // index is what actually lands on "(run root)" rather than falling back
-  // to "all subfolders"
-  pick.selectedIndex = 1
-  pick.dispatchEvent(new Event('change', { bubbles: true }))
+  await renderGallery('wf/run-1/a.png')
+  const filter = screen.getByPlaceholderText('filter…') as HTMLInputElement
+  filter.value = '/a.'
+  filter.dispatchEvent(new Event('input', { bubbles: true }))
   await waitFor(() =>
-    expect(
-      screen.queryByLabelText('select wf/run-1/final/only.png'),
-    ).toBeNull(),
+    expect(screen.queryByLabelText('select wf/run-1/b.png')).toBeNull(),
   )
-  expect(screen.getByLabelText('select wf/run-1/root.png')).toBeTruthy()
-
-  // The run-root pick has just hidden the only other file, so nothing in
-  // this grid's own checkboxes can reach it to delete it - a workspace
-  // switch stands in for that (or the same file being deleted from
-  // elsewhere): the listing comes back with no subfolder at all, the same
-  // shape the last foldered file's own deletion would leave behind
-  listing.files = [file('wf/run-1/root.png', '')]
-  workspace.current = 'other'
-  await waitFor(() => expect(gallery).toHaveBeenCalledTimes(2))
-
-  // The control goes with the pick it can no longer offer, and "Select
-  // all" reads as unfiltered again rather than sticking on a filter
-  // nothing can now clear. The call count only says the listing was asked
-  // for: its reply and the reset it drives land after, so wait on them
-  await waitFor(() => {
-    expect(screen.queryByRole('combobox', { name: 'subfolder' })).toBeNull()
-    expect(
-      screen.getByRole('button', { name: /^select all \(1\)$/i }),
-    ).toBeTruthy()
-  })
+  expect(screen.getByLabelText('select wf/run-1/a.png')).toBeTruthy()
 })
 
 // The confirm dialog answers Escape itself, so the page must not also take
@@ -475,3 +482,126 @@ it('shows a video as a lazy thumbnail, never a <video>', async () => {
   expect(container.querySelector('video')).toBeNull()
   expect(container.querySelector('.videobadge')).not.toBeNull()
 })
+
+it('marks a tile that carries a note, titled with its first line', async () => {
+  listing.files = [
+    { ...file('a.png'), note: 'first line\nsecond' },
+    file('b.png'),
+  ]
+  await renderGallery()
+  const marks = document.querySelectorAll('.note-mark')
+  expect(marks).toHaveLength(1)
+  expect(marks[0].getAttribute('title')).toBe('first line')
+})
+
+it('marks every tile of a run after its run note is saved', async () => {
+  const inRun = (name: string, note?: string): GalleryFile => ({
+    ...file(`wf/r1/${name}`),
+    folder: 'wf',
+    run_id: 'r1',
+    note,
+  })
+  listing.files = [inRun('a.png'), inRun('b.png')]
+  galleryMetadata.mockResolvedValue({
+    metadata: {},
+    job: null,
+    inputs: [],
+    role: null,
+    note: 'old',
+    run_note: 'old',
+    note_source: 'run',
+  })
+  await renderGallery('wf/r1/a.png')
+  screen
+    .getByLabelText('select wf/r1/a.png')
+    .closest('.cellwrap')!
+    .querySelector<HTMLButtonElement>('button.cell')!
+    .click()
+  await fireEvent.click(
+    await screen.findByRole('button', { name: /edit note/i }),
+  )
+  setNote.mockImplementation(async () => {
+    listing.files = [inRun('a.png', 'fresh'), inRun('b.png', 'fresh')]
+    return { target: 'wf/r1', note: 'fresh', note_source: 'run' }
+  })
+  await fireEvent.input(screen.getByLabelText('Run note'), {
+    target: { value: 'fresh' },
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+  await waitFor(() =>
+    expect(document.querySelectorAll('.note-mark')).toHaveLength(2),
+  )
+  expect(setNote).toHaveBeenCalledWith('wf/r1', 'fresh')
+})
+
+it('the arrow keys step through the files the grid shows', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await waitFor(() => expect(galleryMetadata).toHaveBeenLastCalledWith('a.png'))
+  await fireEvent.keyDown(window, { key: 'ArrowRight' })
+  expect(galleryMetadata).toHaveBeenLastCalledWith('b.png')
+  await fireEvent.keyDown(window, { key: 'ArrowLeft' })
+  expect(galleryMetadata).toHaveBeenLastCalledWith('a.png')
+})
+
+it('an arrow key typed in the note box does not move the selection', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await waitFor(() => expect(galleryMetadata).toHaveBeenLastCalledWith('a.png'))
+  const before = galleryMetadata.mock.calls.length
+  const box = document.createElement('textarea')
+  document.body.append(box)
+  await fireEvent.keyDown(box, { key: 'ArrowRight' })
+  expect(galleryMetadata.mock.calls.length).toBe(before)
+  box.remove()
+})
+
+it('Delete removes the open file and opens the next', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await fireEvent.keyDown(window, { key: 'Delete' })
+  await answerConfirm(true)
+  await waitFor(() => expect(deleteOutput).toHaveBeenCalledWith('a.png'))
+  await waitFor(() => expect(galleryMetadata).toHaveBeenLastCalledWith('b.png'))
+})
+
+it('stars the open file and can filter to starred files', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await fireEvent.click(screen.getByRole('button', { name: 'star this file' }))
+  expect(setStarred).toHaveBeenCalledWith('a.png', true)
+  await fireEvent.click(screen.getByRole('button', { name: 'Starred' }))
+  expect(screen.queryByTitle('b.png')).toBeNull()
+  expect(screen.getByTitle('a.png')).toBeTruthy()
+})
+
+it('the S key stars the open file', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await fireEvent.keyDown(window, { key: 's' })
+  await waitFor(() => expect(setStarred).toHaveBeenCalledWith('a.png', true))
+})
+
+it('the S key leaves a bare s to the page: Shift-S does nothing', async () => {
+  await renderGallery()
+  await openFile('a.png')
+  await fireEvent.keyDown(window, { key: 'S', shiftKey: true })
+  expect(setStarred).not.toHaveBeenCalled()
+})
+
+it('unstarring the open file under Starred steps on from its place', async () => {
+  listing.files = [
+    { ...file('a.png'), starred: true },
+    { ...file('b.png'), starred: true },
+    file('c.png'),
+  ]
+  await renderGallery()
+  await fireEvent.click(screen.getByRole('button', { name: 'Starred' }))
+  await openFile('a.png')
+  await waitFor(() => expect(galleryMetadata).toHaveBeenLastCalledWith('a.png'))
+  await fireEvent.keyDown(window, { key: 's' })
+  await waitFor(() => expect(setStarred).toHaveBeenCalledWith('a.png', false))
+  await waitFor(() => expect(screen.queryByTitle('a.png')).toBeNull())
+  await fireEvent.keyDown(window, { key: 'ArrowRight' })
+  expect(galleryMetadata).toHaveBeenLastCalledWith('b.png')
+})
diff --git a/ui/src/lib/pages/JobPage.svelte b/ui/src/lib/pages/JobPage.svelte
index beb80eb9..c17f6e6e 100644
--- a/ui/src/lib/pages/JobPage.svelte
+++ b/ui/src/lib/pages/JobPage.svelte
@@ -18,6 +18,7 @@
   import JsonEditor from '../editor/JsonEditor.svelte'
   import JobHeader from '../job/JobHeader.svelte'
   import JobProgress from '../job/JobProgress.svelte'
+  import NoteEditor from '../ui/NoteEditor.svelte'
   import JobResults from '../job/JobResults.svelte'
   import type { JobDetail, JobEvent } from '../types'
 
@@ -230,6 +231,15 @@
     </div>
   {/if}
 
+  {#if job.run_dir}
+    <NoteEditor
+      note={job.note}
+      target={job.run_dir}
+      workspace={job.workspace}
+      label="Run note"
+    />
+  {/if}
+
   {#if definition}
     <section class="flowsection">
       <div class="flowhead">
diff --git a/ui/src/lib/pages/JobPage.test.ts b/ui/src/lib/pages/JobPage.test.ts
index 39ec0290..8297889e 100644
--- a/ui/src/lib/pages/JobPage.test.ts
+++ b/ui/src/lib/pages/JobPage.test.ts
@@ -8,7 +8,7 @@ import {
 import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import JobPage from './JobPage.svelte'
 import '../router.svelte'
-import { api } from '../api'
+import { api, setNote } from '../api'
 import type { JobDetail, JobEvent } from '../types'
 
 const detail = vi.hoisted(() => ({ job: null as JobDetail | null }))
@@ -19,6 +19,8 @@ const stream = vi.hoisted(() => ({
 // What the metadata route answers for each file, by name
 const metadata = vi.hoisted(() => ({
   byFile: {} as Record<string, Record<string, unknown>>,
+  // The run inputs the route reports beside a file's metadata
+  inputs: [] as Array<{ reference: string; kind: 'asset' | 'output' }>,
 }))
 // The definition the job ran, for the flow view and the unsaved reasons,
 // and whether it is the realized copy or the definition as submitted
@@ -49,12 +51,16 @@ vi.mock('../api', () => ({
       Promise.resolve({
         name,
         metadata: metadata.byFile[name] ?? null,
+        inputs: metadata.inputs,
         job: null,
       }),
     ),
     outputDownloadUrl: (name: string) => `/api/gallery/${name}/download`,
   },
   outputUrl: (path: string) => `/outputs/${path}`,
+  setNote: vi.fn((target: string, note: string | null) =>
+    Promise.resolve({ target, note, note_source: note ? 'run' : null }),
+  ),
   streamJobEvents: (
     _jobId: string,
     _after: number,
@@ -100,6 +106,7 @@ afterEach(() => {
   cleanup()
   stream.onEvent = null
   metadata.byFile = {}
+  metadata.inputs = []
   ran.definition = null
   ran.realized = true
   vi.mocked(api.galleryMetadata).mockClear()
@@ -508,3 +515,98 @@ it('shows no card for a job without a device', async () => {
   await waitFor(() => expect(screen.getByText('j1')).toBeTruthy())
   expect(screen.queryByText(/Card:/)).toBeNull()
 })
+
+const roleJob = (): JobDetail => ({
+  ...job([
+    { step: 'draft', files: ['draft.png'], role: 'intermediate' },
+    { step: 'film', files: ['film.mp4'], role: 'final' },
+  ]),
+  output_kinds: { 'draft.png': 'image', 'film.mp4': 'video' },
+})
+
+it('groups results Final, then a collapsed Intermediate, then Made from', async () => {
+  metadata.inputs = [{ reference: 'asset:face.png', kind: 'asset' }]
+  detail.job = roleJob()
+  const { container } = render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('face.png')).toBeTruthy())
+
+  const order = [
+    ...container.querySelectorAll('.roles > h3, .roles > details > summary'),
+  ].map((el) => el.textContent?.trim())
+  expect(order).toEqual(['Final', 'Intermediate', 'Made from'])
+  expect(container.querySelector('.madefrom .role-tag')?.textContent).toBe(
+    'Input',
+  )
+  // Final's file is on show; the intermediate's sits in a closed <details>
+  const intermediate = container.querySelector(
+    '.roles > details',
+  ) as HTMLDetailsElement
+  expect(intermediate.open).toBe(false)
+  expect(intermediate.textContent).toContain('draft.png')
+  expect(intermediate.textContent).not.toContain('film.mp4')
+})
+
+it('opens Intermediate when the run has no finals', async () => {
+  detail.job = {
+    ...job([{ step: 'draft', files: ['draft.png'], role: 'intermediate' }]),
+    output_kinds: { 'draft.png': 'image' },
+  }
+  const { container } = render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(container.querySelector('.roles')).toBeTruthy())
+  expect(
+    (container.querySelector('.roles > details') as HTMLDetailsElement).open,
+  ).toBe(true)
+})
+
+it('leaves the subfolder layout alone when no step has a role', async () => {
+  detail.job = job([
+    { step: 'film', files: ['final/f.mp4'], subfolder: 'final' },
+  ])
+  const { container } = render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('final/')).toBeTruthy())
+  expect(container.querySelector('.roles')).toBeNull()
+})
+
+it('reads Made from off the first output of a video-only run, probing once', async () => {
+  metadata.inputs = [{ reference: 'asset:face.png', kind: 'asset' }]
+  detail.job = {
+    ...job([{ step: 'film', files: ['a.mp4', 'b.mp4'], role: 'final' }]),
+    output_kinds: { 'a.mp4': 'video', 'b.mp4': 'video' },
+  }
+  const { container } = render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('face.png')).toBeTruthy())
+  expect(container.querySelector('.madefrom .role-tag')?.textContent).toBe(
+    'Input',
+  )
+  expect(vi.mocked(api.galleryMetadata).mock.calls.map((c) => c[0])).toEqual([
+    'a.mp4',
+  ])
+})
+
+it('shows the run note when the job has a run', async () => {
+  detail.job = { ...job([]), run_dir: 'wf/run-1', note: 'second pass' }
+  render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('second pass')).toBeTruthy())
+  expect(screen.getByText('Run note')).toBeTruthy()
+})
+
+it("saves the run note in the job's own workspace", async () => {
+  detail.job = {
+    ...job([]),
+    workspace: 'studio',
+    run_dir: 'wf/run-1',
+    note: 'second pass',
+  }
+  render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('second pass')).toBeTruthy())
+  await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+  await fireEvent.input(screen.getByRole('textbox'), {
+    target: { value: 'third pass' },
+  })
+  await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+  expect(vi.mocked(setNote)).toHaveBeenCalledWith(
+    'wf/run-1',
+    'third pass',
+    'studio',
+  )
+})
diff --git a/ui/src/lib/pages/JobsPage.svelte b/ui/src/lib/pages/JobsPage.svelte
index 50e0fc14..2180ae4d 100644
--- a/ui/src/lib/pages/JobsPage.svelte
+++ b/ui/src/lib/pages/JobsPage.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { formatDuration } from '../format'
+  import { queueWait } from '../jobTimes'
   import { poll } from '../poll'
   import { onMount } from 'svelte'
   import { ChevronDown, ChevronUp, ChevronsUp, Inbox } from '@lucide/svelte'
@@ -74,6 +75,7 @@
 
   const when = (t: number | null) =>
     t ? new Date(t * 1000).toLocaleTimeString() : '—'
+  const waitOf = (job: JobSummary) => queueWait(job, Date.now() / 1000)
   const duration = (job: JobSummary) => {
     if (!job.started_at) return ''
     const end = job.finished_at ?? Date.now() / 1000
@@ -137,6 +139,11 @@
               >v{job.run_version}</span
             >
           {/if}
+          {#if job.rerun_of}
+            <span class="wschip muted" title="a rerun of {job.rerun_of}"
+              >rerun</span
+            >
+          {/if}
           {#if scope === 'all' && (workspace.names?.length ?? 0) > 1}
             <span class="wschip muted" title="workspace">{job.workspace}</span>
           {/if}
@@ -190,7 +197,20 @@
             {/if}
           {/if}
         </span>
-        <span class="muted started">{when(job.started_at)}</span>
+        {#if job.status === 'queued'}
+          {@const wait = waitOf(job)}
+          <span class="muted started" title="time spent waiting for a card"
+            >waiting {wait === null ? '' : formatDuration(wait)}</span
+          >
+        {:else}
+          {@const wait = waitOf(job)}
+          <span
+            class="muted started"
+            title={wait !== null && wait >= 1
+              ? `waited ${formatDuration(wait)} in the queue`
+              : ''}>{when(job.started_at)}</span
+          >
+        {/if}
         <span class="muted dur">{duration(job)}</span>
         <code class="muted jobid">{job.id}</code>
       </a>
diff --git a/ui/src/lib/pages/JobsPage.test.ts b/ui/src/lib/pages/JobsPage.test.ts
index 0a18ec6c..21187a7c 100644
--- a/ui/src/lib/pages/JobsPage.test.ts
+++ b/ui/src/lib/pages/JobsPage.test.ts
@@ -60,3 +60,27 @@ it('shows the card a job ran on, and nothing for one with no device', async () =
     container.querySelectorAll('[title="the card this job ran on"]'),
   ).toHaveLength(1)
 })
+
+it('marks a rerun', async () => {
+  data.jobs = [
+    summary({ id: 'r1', workflow: 'a-rerun', rerun_of: 'abc' }),
+    summary({ id: 'r2', workflow: 'fresh' }),
+  ]
+  const { container } = render(JobsPage)
+  await waitFor(() => expect(screen.getByText('fresh')).toBeTruthy())
+  expect(screen.getByTitle('a rerun of abc')).toBeTruthy()
+  expect(container.querySelectorAll('[title^="a rerun of"]')).toHaveLength(1)
+})
+
+it('shows a queued job as waiting and a started one with its wait', async () => {
+  data.jobs = [
+    summary({ id: 'q1', workflow: 'wq', status: 'queued', started_at: null }),
+    summary({ id: 's1', workflow: 'ws', created_at: 100, started_at: 160 }),
+  ]
+  const { container } = render(JobsPage)
+  await waitFor(() => expect(screen.getByText('ws')).toBeTruthy())
+  expect(container.textContent).toContain('waiting')
+  expect(
+    container.querySelector('[title="waited 1m 00s in the queue"]'),
+  ).toBeTruthy()
+})
diff --git a/ui/src/lib/pages/OverviewPage.svelte b/ui/src/lib/pages/OverviewPage.svelte
index 8d97ee44..b44f1575 100644
--- a/ui/src/lib/pages/OverviewPage.svelte
+++ b/ui/src/lib/pages/OverviewPage.svelte
@@ -1,13 +1,27 @@
 <script lang="ts">
-  import { Images, Inbox, Layers, Play, Plus, Trash2 } from '@lucide/svelte'
+  import {
+    Eye,
+    EyeOff,
+    Images,
+    Inbox,
+    Layers,
+    Play,
+    Plus,
+    Trash2,
+  } from '@lucide/svelte'
   import { api } from '../api'
   import Empty from '../Empty.svelte'
+  import NoteEditor from '../ui/NoteEditor.svelte'
+  import Skeleton from '../ui/Skeleton.svelte'
+  import { WORKSPACE } from '../references'
   import { formatBytes } from '../format'
+  import { hiddenWorkspaces, setHidden } from '../hiddenWorkspaces.svelte'
   import { latestProofs } from '../proofs'
   import { wsHref } from '../routes'
   import type { GalleryFile, JobSummary } from '../types'
   import {
     DEFAULT_WORKSPACE,
+    invalidateWorkspaces,
     loadWorkspaces,
     workspace,
   } from '../workspace.svelte'
@@ -122,6 +136,10 @@
       : null,
   )
   const usage = $derived(workspace.usage[name])
+  function reloadWorkspaces() {
+    invalidateWorkspaces()
+    void loadWorkspaces()
+  }
   const leaf = (n: string) => n.split('/').pop() ?? n
 </script>
 
@@ -129,6 +147,11 @@
   <h1>{name}</h1>
   {#if directory}<code class="muted dir">{directory}</code>{/if}
 </div>
+<NoteEditor
+  note={workspace.notes[name]}
+  target={`${WORKSPACE}${name}`}
+  onsaved={reloadWorkspaces}
+/>
 
 <section class="panel">
   <h2>
@@ -139,7 +162,7 @@
   {#if recentError}
     <p class="muted">Could not load recent outputs: {recentError}</p>
   {:else if recent === null}
-    <p class="muted">loading…</p>
+    <Skeleton tiles={RECENT} label="loading recent outputs" />
   {:else if recent.length === 0}
     <Empty
       >{#snippet icon()}<Images size={36} strokeWidth={1.5} />{/snippet}Nothing
@@ -178,7 +201,7 @@
     {#if jobsError}
       <p class="muted">Could not load jobs: {jobsError}</p>
     {:else if recentJobs === null}
-      <p class="muted">loading…</p>
+      <Skeleton lines={JOBS} label="loading jobs" />
     {:else if recentJobs.length === 0 && !running}
       <Empty
         >{#snippet icon()}<Inbox size={36} strokeWidth={1.5} />{/snippet}No jobs
@@ -223,7 +246,7 @@
     {#if workflowsError}
       <p class="muted">Could not load workflows: {workflowsError}</p>
     {:else if workflows === null}
-      <p class="muted">loading…</p>
+      <Skeleton lines={3} label="loading workflows" />
     {:else if workflows.length === 0}
       <Empty
         >{#snippet icon()}<Layers size={36} strokeWidth={1.5} />{/snippet}No
@@ -286,6 +309,15 @@
       Deleting removes the workspace's workflows, assets and outputs on the
       server. The prompt library and the shared asset library are untouched.
     </p>
+    <button
+      class="quiet withicon"
+      onclick={() => setHidden(name, !hiddenWorkspaces.names.includes(name))}
+      disabled={name === DEFAULT_WORKSPACE}
+      title="a choice for this browser only - the workspace itself is unchanged"
+    >
+      {#if hiddenWorkspaces.names.includes(name)}<Eye size={14} />Show in
+        sidebar{:else}<EyeOff size={14} />Hide from sidebar{/if}
+    </button>
     <button
       class="quiet icon danger"
       onclick={() => deleteWorkspaceWithConfirm(name)}
diff --git a/ui/src/lib/pages/OverviewPage.test.ts b/ui/src/lib/pages/OverviewPage.test.ts
index 51a17d74..088b0b20 100644
--- a/ui/src/lib/pages/OverviewPage.test.ts
+++ b/ui/src/lib/pages/OverviewPage.test.ts
@@ -57,7 +57,12 @@ vi.mock('../api', () => ({
         default: 'default',
         workspaces: [
           { name: 'default', default: true },
-          { name: 'studio', default: false, usage: { files: 4, bytes: 4096 } },
+          {
+            name: 'studio',
+            default: false,
+            usage: { files: 4, bytes: 4096 },
+            note: 'client moodboards',
+          },
         ],
       }),
     deleteWorkspace: (n: string, a?: boolean) => deleteWorkspace(n, a),
@@ -95,6 +100,13 @@ it('an empty workspace shows empty states, not empty frames', async () => {
   expect(screen.getByText(/no workflows yet/i)).toBeTruthy()
 })
 
+it('shows the workspace note', async () => {
+  render(OverviewPage)
+  await waitFor(() =>
+    expect(screen.getByText('client moodboards')).toBeTruthy(),
+  )
+})
+
 it('a failed panel shows its own error, and the rest still load', async () => {
   data.galleryError = new Error('boom')
   data.jobs = [
diff --git a/ui/src/lib/pages/WorkflowPage.svelte b/ui/src/lib/pages/WorkflowPage.svelte
index 97dbe4fc..c43bbb13 100644
--- a/ui/src/lib/pages/WorkflowPage.svelte
+++ b/ui/src/lib/pages/WorkflowPage.svelte
@@ -10,8 +10,10 @@
   import { workspace } from '../workspace.svelte'
   import { loadPromptLibrary } from '../promptlib.svelte'
   import { notify } from '../toast'
+  import { observedText, observedTitle } from '../observed'
   import { confirmDialog } from '../confirm.svelte'
   import type { GalleryFile, WorkflowDefinition } from '../types'
+  import ClampedText from '../ui/ClampedText.svelte'
 
   let { name }: { name: string } = $props()
 
@@ -34,6 +36,8 @@
    * catalog card shows, in the place where you decide whether to run it
    * again. */
   let proofs = $state<GalleryFile[]>([])
+  /** This server's own measured run time for the workflow, if it has one. */
+  let observed = $state<Record<string, unknown> | null>(null)
 
   $effect(() => {
     overrides = {}
@@ -49,6 +53,16 @@
         writable = fetched.writable
       })
       .catch((e) => (error = e.message))
+    observed = null
+    const wanted = name
+    api
+      .listWorkflows()
+      .then((r) => {
+        if (wanted !== name) return
+        observed =
+          (r.details?.[name]?.observed as Record<string, unknown>) ?? null
+      })
+      .catch(() => {})
   })
 
   $effect(() => {
@@ -161,6 +175,11 @@
   >
     <Copy size={14} />Duplicate
   </button>
+  {#if observedText(observed)}
+    <span class="num muted" title={observedTitle(observed) ?? ''}
+      >{observedText(observed)}</span
+    >
+  {/if}
   <button
     class="withicon run"
     onclick={run}
@@ -175,7 +194,9 @@
 
 {#if workflow}
   {#if workflow.description}
-    <p class="muted desc prose">{workflow.description}</p>
+    <div class="muted desc prose">
+      <ClampedText text={String(workflow.description)} />
+    </div>
   {/if}
 
   <!-- What it made last time, before you decide to make another -->
diff --git a/ui/src/lib/pages/WorkflowsPage.svelte b/ui/src/lib/pages/WorkflowsPage.svelte
index 668ae247..2f1dd055 100644
--- a/ui/src/lib/pages/WorkflowsPage.svelte
+++ b/ui/src/lib/pages/WorkflowsPage.svelte
@@ -6,6 +6,8 @@
   import FolderGroups from '../FolderGroups.svelte'
   import { leafOf } from '../grouping'
   import HintBar from '../HintBar.svelte'
+  import { formatMinutes } from '../format'
+  import { observedText, observedTitle } from '../observed'
   import { latestProofs } from '../proofs'
   import { sharedHref, wsHref } from '../routes'
   import { workspace } from '../workspace.svelte'
@@ -129,11 +131,6 @@
     filter !== '' || shape !== '' || traits.length > 0,
   )
 
-  /** Minutes for a person: under one is '<1 min', anything else keeps the
-   * measured value ('~3 min', '~1.5 min') rather than rounding it away. */
-  const formatMinutes = (minutes: number) =>
-    minutes < 1 ? '<1 min' : `~${Number(minutes.toFixed(2))} min`
-
   /** The one measurement a card shows: the first the maintainer recorded.
    * '~3 min · 22 GB', with the accelerator moved to the tooltip - the card
    * has room for the numbers, not for the hardware they came from. */
@@ -156,6 +153,8 @@
       const where = measured.name ?? measured.device
       lines.push(`measured on ${where}`)
     }
+    const seen = observedTitle(detail?.observed)
+    if (seen) lines.push(seen)
     if (detail?.writable === false)
       lines.push(`read-only, from the ${detail.origin} directory`)
     return lines.join('\n')
@@ -297,6 +296,9 @@
         {#if detail?.cost?.length}
           <span class="cost num muted">{formatCost(detail.cost)}</span>
         {/if}
+        {#if !detail?.cost?.length && observedText(detail?.observed)}
+          <span class="cost num muted">{observedText(detail?.observed)}</span>
+        {/if}
         {#if detail?.summary || detail?.description}
           <span class="carddesc muted"
             >{detail.summary || detail.description}</span
diff --git a/ui/src/lib/plan.test.ts b/ui/src/lib/plan.test.ts
index fbf15824..7e2edaf8 100644
--- a/ui/src/lib/plan.test.ts
+++ b/ui/src/lib/plan.test.ts
@@ -62,6 +62,56 @@ describe('describePlan', () => {
     expect(figure.tone).toBe('warn')
   })
 
+  it('a figure scaled along moved drivers says what moved', () => {
+    const [, figure] = describePlan({
+      ...base,
+      list_entries: {},
+      estimate: {
+        ...base.estimate,
+        minutes: 26.3,
+        basis: 'derived',
+        scaled: 'scaled from the curated 7.9 min: steps 30 vs 9',
+      },
+    })
+    expect(figure.text).toBe(
+      '~26.3 min on cuda - estimated (scaled from the curated 7.9 min: steps 30 vs 9), from a figure measured on RTX 3090',
+    )
+    expect(figure.tone).toBe('warn')
+  })
+
+  it('a scaled figure from another accelerator says what moved too', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: {
+        ...base.estimate,
+        minutes: 80,
+        basis: 'other_device',
+        device: 'mps',
+        scaled: 'scaled from the curated 40 min: steps 18 vs 9',
+      },
+    })
+    expect(figure.text).toBe(
+      'no figure for mps - 80 min was measured on RTX 3090 (scaled from the curated 40 min: steps 18 vs 9)',
+    )
+  })
+
+  it('a re-priced figure scaled along a child says what moved', () => {
+    // dw/plan.py names `scaled` for every basis but observed, so the
+    // plain branch must carry it as the warn branches do
+    const [, figure] = describePlan({
+      ...base,
+      estimate: {
+        ...base.estimate,
+        basis: 'per_entry',
+        scaled: 'scaled from the curated 7.9 min: steps 30 vs 9',
+      },
+    })
+    expect(figure.text).toBe(
+      '~42 min on cuda - re-priced for 5 shots, measured on RTX 3090 (scaled from the curated 7.9 min: steps 30 vs 9)',
+    )
+    expect(figure.tone).toBe('plain')
+  })
+
   it('a figure from another accelerator is a warning, not a quote', () => {
     const [, figure] = describePlan({
       ...base,
diff --git a/ui/src/lib/plan.ts b/ui/src/lib/plan.ts
index b4e4b45d..10529d3b 100644
--- a/ui/src/lib/plan.ts
+++ b/ui/src/lib/plan.ts
@@ -61,19 +61,27 @@ export function describePlan(plan: Plan): PlanLine[] {
   return lines
 }
 
+/** The qualifiers every priced figure carries: the card it was measured
+ * on, what it was scaled along (#866: steps, canvas or frames moved off the
+ * defaults it was measured at), and the steps it leaves unpriced. */
+function qualifiers(estimate: Plan['estimate']) {
+  const { measured_on, partial, unpriced, scaled } = estimate
+  return {
+    card: measured_on ? `measured on ${measured_on}` : 'measured',
+    along: scaled ? ` (${scaled})` : '',
+    missing: partial ? `, plus unpriced: ${(unpriced ?? []).join(', ')}` : '',
+  }
+}
+
 function figure(plan: Plan): PlanLine {
-  const { minutes, basis, device, measured_on, partial, unpriced } =
-    plan.estimate
-  const card = measured_on ? `measured on ${measured_on}` : 'measured'
-  const missing = partial
-    ? `, plus unpriced: ${(unpriced ?? []).join(', ')}`
-    : ''
+  const { minutes, basis, device } = plan.estimate
   if (basis === 'unknown' || minutes === null) {
     return { text: 'no measured cost', tone: 'warn' }
   }
+  const { card, along, missing } = qualifiers(plan.estimate)
   if (basis === 'other_device') {
     return {
-      text: `no figure for ${device} - ${minutes} min was ${card}${missing}`,
+      text: `no figure for ${device} - ${minutes} min was ${card}${along}${missing}`,
       tone: 'warn',
     }
   }
@@ -81,16 +89,18 @@ function figure(plan: Plan): PlanLine {
     .map(([name, count]) => `${count} ${name}`)
     .join(', ')
   // `derived` is the stored total stretched over a list the caller
-  // resized - an estimate, so it is said to be one rather than quoted
+  // resized, or scaled along the drivers they moved - an estimate, so it is
+  // said to be one rather than quoted
   if (basis === 'derived') {
+    const target = forList ? ` for ${forList}` : ''
     return {
-      text: `~${minutes} min on ${device} - estimated for ${forList}, from a figure ${card}${missing}`,
+      text: `~${minutes} min on ${device} - estimated${target}${along}, from a figure ${card}${missing}`,
       tone: 'warn',
     }
   }
-  const scaled = basis === 'per_entry' ? `re-priced for ${forList}, ` : ''
+  const repriced = basis === 'per_entry' ? `re-priced for ${forList}, ` : ''
   return {
-    text: `~${minutes} min on ${device} - ${scaled}${card}${missing}`,
+    text: `~${minutes} min on ${device} - ${repriced}${card}${along}${missing}`,
     tone: 'plain',
   }
 }
diff --git a/ui/src/lib/references.ts b/ui/src/lib/references.ts
index f99c80d4..bca68d79 100644
--- a/ui/src/lib/references.ts
+++ b/ui/src/lib/references.ts
@@ -13,6 +13,9 @@ export const ITEM = 'item:'
 export const GATHER = 'gather:'
 export const BUILTIN = 'builtin:'
 export const CONSTRAINT = 'constraint:'
+// Not a workflow reference, so not in PREFIXES: names a workspace as a note
+// target (PUT /api/notes)
+export const WORKSPACE = 'workspace:'
 
 export const PREFIXES = [
   ASSET,
diff --git a/ui/src/lib/results.test.ts b/ui/src/lib/results.test.ts
index 4681dbe4..87e3cb61 100644
--- a/ui/src/lib/results.test.ts
+++ b/ui/src/lib/results.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   groupResultFiles,
+  sectionByRole,
   sectionBySubfolder,
   unsavedReason,
   unsavedSteps,
@@ -34,8 +35,15 @@ describe('groupResultFiles', () => {
         files: ['a.png', 'b.png'],
         reused: false,
         subfolder: '',
+        role: null,
+      },
+      {
+        step: 'upscale',
+        files: ['a_big.png'],
+        reused: false,
+        subfolder: '',
+        role: null,
       },
-      { step: 'upscale', files: ['a_big.png'], reused: false, subfolder: '' },
     ])
   })
 
@@ -50,6 +58,7 @@ describe('groupResultFiles', () => {
         files: ['a.png', 'c.png'],
         reused: false,
         subfolder: '',
+        role: null,
       },
     ])
   })
@@ -63,7 +72,13 @@ describe('groupResultFiles', () => {
       [],
     )
     expect(groups).toEqual([
-      { step: 'generate', files: ['a.png'], reused: false, subfolder: '' },
+      {
+        step: 'generate',
+        files: ['a.png'],
+        reused: false,
+        subfolder: '',
+        role: null,
+      },
     ])
   })
 
@@ -98,6 +113,7 @@ describe('groupResultFiles subfolder', () => {
         files: ['final/e.mp4'],
         reused: false,
         subfolder: 'final',
+        role: null,
       },
     ])
   })
@@ -129,6 +145,7 @@ describe('sectionBySubfolder', () => {
     files: [`${subfolder ? subfolder + '/' : ''}${step}.png`],
     reused: false,
     subfolder,
+    role: null,
   })
 
   it('returns one root section when no group has a subfolder', () => {
@@ -278,3 +295,35 @@ describe('unsavedSteps', () => {
     expect(unsavedSteps([{ step: 'base', files: [] }], [], null)).toEqual([])
   })
 })
+
+describe('sectionByRole', () => {
+  const group = (step: string, role: 'final' | 'intermediate' | null) => ({
+    step,
+    files: [`${step}.png`],
+    reused: false,
+    subfolder: '',
+    role,
+  })
+
+  it('reads a step role off the manifest', () => {
+    const groups = groupResultFiles(
+      [{ step: 'draft', files: ['d.png'], role: 'intermediate' }],
+      [],
+    )
+    expect(groups[0].role).toBe('intermediate')
+  })
+
+  it('is null when no step has a role', () => {
+    expect(sectionByRole([group('a', null)])).toBeNull()
+  })
+
+  it('splits by role and counts a roleless step among them as final', () => {
+    const sections = sectionByRole([
+      group('a', 'intermediate'),
+      group('b', 'final'),
+      group('c', null),
+    ])!
+    expect(sections.final.map((g) => g.step)).toEqual(['b', 'c'])
+    expect(sections.intermediate.map((g) => g.step)).toEqual(['a'])
+  })
+})
diff --git a/ui/src/lib/results.ts b/ui/src/lib/results.ts
index a3c962f3..977c994b 100644
--- a/ui/src/lib/results.ts
+++ b/ui/src/lib/results.ts
@@ -8,6 +8,9 @@ export interface StepGroup {
   reused: boolean
   /** The step's `result.subfolder` - `''` for the run root. */
   subfolder: string
+  /** The step's role in its run, as the manifest records it - null for a
+   * step the manifest does not say (a live step_end, an older run). */
+  role: 'final' | 'intermediate' | null
 }
 
 /** A run's output files, grouped by the step that produced them. The
@@ -42,8 +45,11 @@ export function groupResultFiles(
       if (end.reused) reused.add(end.step || '(unnamed)')
     }
   }
+  const role = new Map<string, StepGroup['role']>()
   for (const entry of manifest ?? []) {
     add(entry.step, entry.files, entry.subfolder ?? '')
+    if (entry.role === 'final' || entry.role === 'intermediate')
+      role.set(entry.step, entry.role)
     if (entry.reused) reused.add(entry.step)
   }
   return order
@@ -52,10 +58,29 @@ export function groupResultFiles(
       files: [...byStep.get(step)!],
       reused: reused.has(step),
       subfolder: subfolder.get(step) ?? '',
+      role: role.get(step) ?? null,
     }))
     .filter((group) => group.files.length > 0)
 }
 
+/** A run's step groups split by role. */
+export interface RoleSections {
+  final: StepGroup[]
+  intermediate: StepGroup[]
+}
+
+/** Step groups by the role the manifest gave them, or null when it gave
+ * none to any - a run from before roles, or one still streaming, which the
+ * page then lays out by subfolder as it always did. A group with no role
+ * among ones that have it counts as final, as it does in the gallery. */
+export function sectionByRole(groups: StepGroup[]): RoleSections | null {
+  if (!groups.some((g) => g.role !== null)) return null
+  return {
+    final: groups.filter((g) => g.role !== 'intermediate'),
+    intermediate: groups.filter((g) => g.role === 'intermediate'),
+  }
+}
+
 /** The step groups of one subfolder, under one heading on the job page. */
 export interface SubfolderSection {
   subfolder: string
diff --git a/ui/src/lib/routes.ts b/ui/src/lib/routes.ts
index c88e5e99..a2727231 100644
--- a/ui/src/lib/routes.ts
+++ b/ui/src/lib/routes.ts
@@ -8,6 +8,7 @@ export const WS_SECTIONS = [
   'workflows',
   'jobs',
   'gallery',
+  'compare',
   'assets',
   'edit',
 ] as const
diff --git a/ui/src/lib/schema/SchemaNode.svelte b/ui/src/lib/schema/SchemaNode.svelte
index 6c09d997..a7c6658f 100644
--- a/ui/src/lib/schema/SchemaNode.svelte
+++ b/ui/src/lib/schema/SchemaNode.svelte
@@ -28,6 +28,7 @@
 <script lang="ts">
   import { ChevronDown, ChevronRight } from '@lucide/svelte'
   import Self from './SchemaNode.svelte'
+  import ClampedText from '../ui/ClampedText.svelte'
 
   let {
     name,
@@ -160,7 +161,7 @@
     {#each facts as fact (fact)}<span class="fact">{fact}</span>{/each}
   </button>
   {#if description}
-    <div class="desc muted">{description}</div>
+    <div class="desc muted"><ClampedText text={description} lines={3} /></div>
   {/if}
   {#if node.enum ?? effective.enum}
     <div class="enums">
diff --git a/ui/src/lib/types.ts b/ui/src/lib/types.ts
index 8a6dc24e..bcc3e2c7 100644
--- a/ui/src/lib/types.ts
+++ b/ui/src/lib/types.ts
@@ -50,6 +50,8 @@ export type PromptList = Schemas['PromptList']
 export type WorkspaceInfo = Schemas['WorkspaceInfo']
 export type WorkspaceList = Schemas['WorkspaceList']
 export type WorkspaceDeleted = Schemas['WorkspaceDeleted']
+export type NoteSet = Schemas['NoteSet']
+export type StarSet = Schemas['StarSet']
 export type Deleted = Schemas['Deleted']
 export type WorkflowDeleted = Schemas['WorkflowDeleted']
 export type PromptSaved = Schemas['PromptSaved']
@@ -57,6 +59,9 @@ export type EnhancerPresets = Schemas['EnhancerPresets']
 export type GalleryFile = Schemas['GalleryFile']
 export type GalleryList = Schemas['GalleryList']
 export type GalleryMetadata = Schemas['GalleryMetadata']
+export type GalleryInput = Schemas['GalleryInput']
+/** A file's role in its run, as the server states it. */
+export type OutputRole = NonNullable<GalleryFile['role']>
 export type OutputDeleted = Schemas['OutputDeleted']
 export type AssetFile = Schemas['AssetFile']
 export type AssetLibrary = Schemas['AssetLibraryRoot']
diff --git a/ui/src/lib/ui/ClampedText.svelte b/ui/src/lib/ui/ClampedText.svelte
new file mode 100644
index 00000000..e12b953f
--- /dev/null
+++ b/ui/src/lib/ui/ClampedText.svelte
@@ -0,0 +1,104 @@
+<script lang="ts">
+  import { isRemembered, remember } from '../expandedNotes'
+  import Markdown from './Markdown.svelte'
+
+  // Text that may run long - a note, a description, a docstring - shown at
+  // most `lines` lines tall until the reader expands it, so one long entry
+  // does not push the rest of the page out of view. The clamp is a max-height
+  // with a fade, not -webkit-line-clamp, so it also holds for Markdown's block
+  // children. The toggle shows only when the clamp actually hides text,
+  // measured while collapsed and again on a resize. Text starts as the state
+  // remembered for its rememberKey (expanded or not), else collapsed
+  let {
+    text,
+    lines = 4,
+    rememberKey,
+    markdown = false,
+  }: {
+    text: string
+    lines?: number
+    rememberKey?: string
+    markdown?: boolean
+  } = $props()
+
+  const recalled = () => (rememberKey ? isRemembered(rememberKey) : false)
+  let expanded = $state(recalled())
+  let overflows = $state(false)
+  let el = $state<HTMLElement>()
+
+  // svelte-ignore state_referenced_locally
+  let seen = `${rememberKey ?? ''}\u0000${text}`
+  $effect(() => {
+    const now = `${rememberKey ?? ''}\u0000${text}`
+    if (now === seen) return
+    seen = now
+    expanded = recalled()
+  })
+
+  function toggle() {
+    expanded = !expanded
+    if (rememberKey) remember(rememberKey, expanded)
+  }
+
+  $effect(() => {
+    void text
+    const node = el
+    if (!node || expanded) return
+    const measure = () =>
+      (overflows = node.scrollHeight > node.clientHeight + 1)
+    measure()
+    // jsdom has no ResizeObserver; the first measurement still stands
+    if (typeof ResizeObserver === 'undefined') return
+    const observer = new ResizeObserver(measure)
+    observer.observe(node)
+    return () => observer.disconnect()
+  })
+</script>
+
+<div class="clamp">
+  <div
+    class="text"
+    class:clamped={!expanded}
+    class:faded={overflows && !expanded}
+    class:plain={!markdown}
+    style:--lines={lines}
+    bind:this={el}
+  >
+    {#if markdown}<Markdown source={text} />{:else}{text}{/if}
+  </div>
+  {#if overflows || expanded}
+    <button
+      type="button"
+      class="bare more"
+      aria-expanded={expanded}
+      onclick={toggle}>{expanded ? 'Show less' : 'Show more'}</button
+    >
+  {/if}
+</div>
+
+<style>
+  .clamp {
+    min-width: 0;
+  }
+  .text {
+    line-height: 1.5;
+    overflow-wrap: anywhere;
+  }
+  .plain {
+    white-space: pre-wrap;
+  }
+  /* A height clamp, not -webkit-line-clamp: that one does not reliably
+     clamp across block children, and a Markdown note is paragraphs and
+     lists. The fade says there is more */
+  .clamped {
+    max-height: calc(var(--lines) * 1.5em);
+    overflow: hidden;
+  }
+  .faded {
+    mask-image: linear-gradient(to bottom, #000 70%, transparent);
+  }
+  .more {
+    font-size: var(--t-sm);
+    padding: 0;
+  }
+</style>
diff --git a/ui/src/lib/ui/ClampedText.test.ts b/ui/src/lib/ui/ClampedText.test.ts
new file mode 100644
index 00000000..fb6317ba
--- /dev/null
+++ b/ui/src/lib/ui/ClampedText.test.ts
@@ -0,0 +1,66 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import ClampedText from './ClampedText.svelte'
+
+// jsdom lays nothing out, so overflow is faked on the element's heights
+function fakeHeights(scroll: number, client: number) {
+  vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockReturnValue(scroll)
+  vi.spyOn(HTMLElement.prototype, 'clientHeight', 'get').mockReturnValue(client)
+}
+
+describe('ClampedText', () => {
+  afterEach(() => {
+    cleanup()
+    vi.restoreAllMocks()
+  })
+
+  it('offers no toggle when the text fits', () => {
+    fakeHeights(40, 40)
+    render(ClampedText, { props: { text: 'short' } })
+    expect(screen.getByText('short')).toBeTruthy()
+    expect(screen.queryByRole('button')).toBeNull()
+  })
+
+  it('folds long text and expands and collapses it', async () => {
+    fakeHeights(400, 80)
+    render(ClampedText, { props: { text: 'long text', lines: 3 } })
+    const text = screen.getByText('long text')
+    expect(text.classList.contains('clamped')).toBe(true)
+    const toggle = screen.getByRole('button', { name: 'Show more' })
+    expect(toggle.getAttribute('aria-expanded')).toBe('false')
+    await fireEvent.click(toggle)
+    expect(text.classList.contains('clamped')).toBe(false)
+    await fireEvent.click(screen.getByRole('button', { name: 'Show less' }))
+    expect(text.classList.contains('clamped')).toBe(true)
+  })
+
+  it('opens already expanded when its key was left expanded', async () => {
+    localStorage.clear()
+    fakeHeights(400, 80)
+    const first = render(ClampedText, {
+      props: { text: 'long text', rememberKey: 'k' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: 'Show more' }))
+    first.unmount()
+    render(ClampedText, { props: { text: 'long text', rememberKey: 'k' } })
+    expect(screen.getByText('long text').classList.contains('clamped')).toBe(
+      false,
+    )
+  })
+
+  it('renders markdown as elements when asked', () => {
+    fakeHeights(40, 40)
+    render(ClampedText, { props: { text: '- **one**', markdown: true } })
+    expect(screen.getByText('one').tagName).toBe('STRONG')
+  })
+
+  it('fades only text the clamp actually hides', () => {
+    fakeHeights(40, 40)
+    const fits = render(ClampedText, { props: { text: 'short' } })
+    expect(screen.getByText('short').classList.contains('faded')).toBe(false)
+    fits.unmount()
+    fakeHeights(400, 80)
+    render(ClampedText, { props: { text: 'long text' } })
+    expect(screen.getByText('long text').classList.contains('faded')).toBe(true)
+  })
+})
diff --git a/ui/src/lib/ui/Markdown.svelte b/ui/src/lib/ui/Markdown.svelte
new file mode 100644
index 00000000..31dffab6
--- /dev/null
+++ b/ui/src/lib/ui/Markdown.svelte
@@ -0,0 +1,82 @@
+<script lang="ts">
+  // Renders parseMarkdown's tree as Svelte nodes - never as HTML - so a note
+  // that contains markup shows that markup as text. Headings are styled
+  // paragraphs with a heading role two levels below the page's own, so a
+  // note's "# RULE" does not compete with the page title in the outline
+  import { parseMarkdown, type Inline } from '../markdown'
+
+  let { source }: { source: string } = $props()
+  const blocks = $derived(parseMarkdown(source))
+</script>
+
+{#snippet inline(nodes: Inline[])}
+  {#each nodes as node, i (i)}
+    {#if node.kind === 'text'}{node.text}{:else if node.kind === 'br'}<br
+      />{:else if node.kind === 'code'}<code>{node.text}</code
+      >{:else if node.kind === 'strong'}<strong
+        >{@render inline(node.children)}</strong
+      >{:else if node.kind === 'em'}<em>{@render inline(node.children)}</em
+      >{:else}<a href={node.href} target="_blank" rel="noopener noreferrer"
+        >{@render inline(node.children)}</a
+      >{/if}
+  {/each}
+{/snippet}
+
+<div class="md">
+  {#each blocks as block, i (i)}
+    {#if block.kind === 'heading'}
+      <p class="h h{block.level}" role="heading" aria-level={block.level + 2}>
+        {@render inline(block.children)}
+      </p>
+    {:else if block.kind === 'paragraph'}
+      <p>{@render inline(block.children)}</p>
+    {:else if block.kind === 'list' && block.ordered}
+      <ol>
+        {#each block.items as item, j (j)}<li>{@render inline(item)}</li>{/each}
+      </ol>
+    {:else if block.kind === 'list'}
+      <ul>
+        {#each block.items as item, j (j)}<li>{@render inline(item)}</li>{/each}
+      </ul>
+    {:else}
+      <pre><code>{block.text}</code></pre>
+    {/if}
+  {/each}
+</div>
+
+<style>
+  .md > :first-child {
+    margin-top: 0;
+  }
+  .md > :last-child {
+    margin-bottom: 0;
+  }
+  p,
+  ul,
+  ol,
+  pre {
+    margin: 0 0 0.5em;
+  }
+  ul,
+  ol {
+    padding-left: 1.4em;
+  }
+  .h {
+    font-weight: 600;
+    margin-top: 0.75em;
+  }
+  .h1 {
+    font-size: 1.1em;
+  }
+  pre {
+    background: var(--panel-2);
+    padding: var(--space-2);
+    border-radius: var(--radius-2);
+    overflow-x: auto;
+    white-space: pre;
+  }
+  code {
+    font-family: var(--font-mono);
+    font-size: 0.92em;
+  }
+</style>
diff --git a/ui/src/lib/ui/Markdown.test.ts b/ui/src/lib/ui/Markdown.test.ts
new file mode 100644
index 00000000..4c3adf2a
--- /dev/null
+++ b/ui/src/lib/ui/Markdown.test.ts
@@ -0,0 +1,26 @@
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it } from 'vitest'
+import Markdown from './Markdown.svelte'
+
+describe('Markdown', () => {
+  afterEach(cleanup)
+  it('renders the subset as elements', () => {
+    render(Markdown, {
+      props: { source: '## Rule\n\n- **one**\n\n[docs](https://x.dev)' },
+    })
+    expect(screen.getByRole('heading', { name: 'Rule' })).toBeTruthy()
+    expect(screen.getByText('one').tagName).toBe('STRONG')
+    const link = screen.getByRole('link', { name: 'docs' })
+    expect(link.getAttribute('href')).toBe('https://x.dev/')
+    expect(link.getAttribute('rel')).toBe('noopener noreferrer')
+  })
+  it('never renders markup in the source', () => {
+    render(Markdown, { props: { source: '<img src=x onerror=alert(1)>' } })
+    expect(document.querySelector('img')).toBeNull()
+    expect(screen.getByText('<img src=x onerror=alert(1)>')).toBeTruthy()
+  })
+  it('never links a javascript: url', () => {
+    render(Markdown, { props: { source: '[x](javascript:alert(1))' } })
+    expect(screen.queryByRole('link')).toBeNull()
+  })
+})
diff --git a/ui/src/lib/ui/NoteEditor.svelte b/ui/src/lib/ui/NoteEditor.svelte
new file mode 100644
index 00000000..206f16eb
--- /dev/null
+++ b/ui/src/lib/ui/NoteEditor.svelte
@@ -0,0 +1,158 @@
+<script lang="ts">
+  import { Pencil } from '@lucide/svelte'
+  import { setNote } from '../api'
+  import ClampedText from './ClampedText.svelte'
+
+  // A note on a workspace, asset, run or file: shown as a safe Markdown
+  // subset (never HTML), edited in place. The server owns the 4000-character
+  // limit and says so in its error, which stays on screen beside the box
+  let {
+    note,
+    target,
+    label = 'Note',
+    placeholder = 'Add a note',
+    workspace,
+    lines = 4,
+    onsaved,
+  }: {
+    note: string | null | undefined
+    target: string
+    /** The workspace a run or file target is read in; the picker's when
+     * omitted */
+    workspace?: string
+    label?: string
+    placeholder?: string
+    /** Lines shown before the note folds behind "Show more" */
+    lines?: number
+    onsaved?: (note: string | null) => void
+  } = $props()
+
+  let editing = $state(false)
+  let draft = $state('')
+  let saving = $state(false)
+  let error = $state<string | null>(null)
+  // What the box last stored, until the parent hands down a newer note
+  let shown = $derived(note ?? null)
+  // Another target is another note, even when the text is the same. Only a
+  // changed target ends an edit: a refetch landing mid-edit keeps the draft
+  // svelte-ignore state_referenced_locally
+  let editedTarget = target
+  $effect(() => {
+    if (target === editedTarget) return
+    editedTarget = target
+    editing = false
+  })
+
+  function edit() {
+    draft = shown ?? ''
+    error = null
+    editing = true
+  }
+
+  async function save() {
+    saving = true
+    error = null
+    try {
+      const stored = await setNote(
+        target,
+        draft.trim() ? draft : null,
+        workspace,
+      )
+      shown = stored.note ?? null
+      editing = false
+      onsaved?.(shown)
+    } catch (e) {
+      error = e instanceof Error ? e.message : String(e)
+    } finally {
+      saving = false
+    }
+  }
+</script>
+
+<div class="note">
+  {#if editing}
+    <textarea
+      bind:value={draft}
+      maxlength="4000"
+      rows="4"
+      aria-label={label}
+      {placeholder}></textarea>
+    <p class="hint muted">
+      Markdown: # heading · - list · **bold** · *italic* · `code` ·
+      [link](https://…)
+    </p>
+    <div class="actions">
+      <button type="button" class="quiet" onclick={save} disabled={saving}
+        >Save</button
+      >
+      <button
+        type="button"
+        class="bare"
+        onclick={() => (editing = false)}
+        disabled={saving}>Cancel</button
+      >
+    </div>
+    {#if error}<p class="error" role="alert">{error}</p>{/if}
+  {:else}
+    <div class="shown">
+      <span class="label muted">{label}</span>
+      {#if shown}
+        <div class="text">
+          <ClampedText
+            text={shown}
+            {lines}
+            markdown
+            rememberKey={`${workspace ?? ''}|${target}`}
+          />
+        </div>
+      {:else}
+        <p class="text muted">{placeholder}</p>
+      {/if}
+      <button
+        type="button"
+        class="quiet icon"
+        aria-label="Edit note"
+        title="edit this note"
+        onclick={edit}><Pencil size={13} /></button
+      >
+    </div>
+  {/if}
+</div>
+
+<style>
+  .shown {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: baseline;
+    gap: 0.5rem;
+  }
+  .label {
+    font-size: var(--t-sm);
+  }
+  .text {
+    min-width: 0;
+    margin: 0;
+  }
+  .muted {
+    color: var(--muted);
+  }
+  textarea {
+    width: 100%;
+    font: inherit;
+    background: var(--panel-2);
+    color: var(--ink);
+  }
+  .hint {
+    font-size: var(--t-sm);
+    margin: 0.25rem 0 0;
+  }
+  .actions {
+    display: flex;
+    gap: 0.5rem;
+    margin-top: 0.25rem;
+  }
+  .error {
+    color: var(--bad);
+    margin: 0.25rem 0 0;
+  }
+</style>
diff --git a/ui/src/lib/ui/NoteEditor.test.ts b/ui/src/lib/ui/NoteEditor.test.ts
new file mode 100644
index 00000000..8f0686c5
--- /dev/null
+++ b/ui/src/lib/ui/NoteEditor.test.ts
@@ -0,0 +1,102 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/svelte'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as api from '../api'
+import NoteEditor from './NoteEditor.svelte'
+
+describe('NoteEditor', () => {
+  beforeEach(() => vi.restoreAllMocks())
+  afterEach(cleanup)
+
+  it('shows the note as text, never markup', () => {
+    render(NoteEditor, {
+      props: { note: '<b>bold</b>', target: 'workspace:default' },
+    })
+    expect(screen.getByText('<b>bold</b>')).toBeTruthy()
+    expect(document.querySelector('b')).toBeNull()
+  })
+
+  it('shows the placeholder when empty', () => {
+    render(NoteEditor, { props: { note: null, target: 'workspace:default' } })
+    expect(screen.getByText('Add a note')).toBeTruthy()
+  })
+
+  it('saves through setNote and reports the stored note', async () => {
+    const spy = vi
+      .spyOn(api, 'setNote')
+      .mockResolvedValue({ target: 't', note: 'new', note_source: 'run' })
+    const onsaved = vi.fn()
+    render(NoteEditor, { props: { note: 'old', target: 't', onsaved } })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), {
+      target: { value: 'new' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(spy).toHaveBeenCalledWith('t', 'new', undefined)
+    expect(onsaved).toHaveBeenCalledWith('new')
+  })
+
+  it('cancel restores the old note without calling the api', async () => {
+    const spy = vi.spyOn(api, 'setNote')
+    render(NoteEditor, { props: { note: 'old', target: 't' } })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), {
+      target: { value: 'changed' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /cancel/i }))
+    expect(spy).not.toHaveBeenCalled()
+    expect(screen.getByText('old')).toBeTruthy()
+  })
+
+  it('saving an empty box clears the note', async () => {
+    const spy = vi
+      .spyOn(api, 'setNote')
+      .mockResolvedValue({ target: 't', note: null, note_source: null })
+    render(NoteEditor, { props: { note: 'old', target: 't' } })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), {
+      target: { value: '' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(spy).toHaveBeenCalledWith('t', null, undefined)
+  })
+
+  it('shows the server error and stays in edit mode', async () => {
+    vi.spyOn(api, 'setNote').mockRejectedValue(
+      new Error('a note is at most 4000 characters'),
+    )
+    render(NoteEditor, { props: { note: 'old', target: 't' } })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(await screen.findByText(/at most 4000/)).toBeTruthy()
+    expect(screen.getByRole('textbox')).toBeTruthy()
+  })
+
+  it('saves in the workspace it was given', async () => {
+    const spy = vi
+      .spyOn(api, 'setNote')
+      .mockResolvedValue({ target: 't', note: 'new', note_source: 'run' })
+    render(NoteEditor, {
+      props: { note: 'old', target: 't', workspace: 'ws2' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), {
+      target: { value: 'new' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(spy).toHaveBeenCalledWith('t', 'new', 'ws2')
+  })
+
+  it('keeps the draft when the note prop changes mid-edit', async () => {
+    const { rerender } = render(NoteEditor, {
+      props: { note: 'old', target: 't' },
+    })
+    await fireEvent.click(screen.getByRole('button', { name: /edit note/i }))
+    await fireEvent.input(screen.getByRole('textbox'), {
+      target: { value: 'half typed' },
+    })
+    await rerender({ note: 'refetched', target: 't' })
+    expect((screen.getByRole('textbox') as HTMLTextAreaElement).value).toBe(
+      'half typed',
+    )
+  })
+})
diff --git a/ui/src/lib/ui/Skeleton.svelte b/ui/src/lib/ui/Skeleton.svelte
new file mode 100644
index 00000000..7c1e2e61
--- /dev/null
+++ b/ui/src/lib/ui/Skeleton.svelte
@@ -0,0 +1,59 @@
+<script lang="ts">
+  // The shape of what is coming, in the panel's own grey, so a slow panel
+  // does not jump when it lands. Neutral on purpose: --live is machine
+  // state and a load is not one. Still under reduced motion
+  let {
+    lines = 3,
+    tiles = 0,
+    label = 'loading',
+  }: { lines?: number; tiles?: number; label?: string } = $props()
+</script>
+
+<div class="skeleton" role="status" aria-label={label}>
+  {#if tiles}
+    <div class="tiles">
+      {#each [...Array(tiles).keys()] as i (i)}<span class="tile"></span>{/each}
+    </div>
+  {:else}
+    {#each [...Array(lines).keys()] as i (i)}
+      <span class="line" style:width="{90 - (i % 3) * 20}%"></span>
+    {/each}
+  {/if}
+</div>
+
+<style>
+  .skeleton {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+  }
+  .tiles {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
+    gap: var(--space-2);
+  }
+  .tile,
+  .line {
+    display: block;
+    background: var(--panel-2);
+    border-radius: var(--radius-2);
+    animation: pulse 1.4s ease-in-out infinite;
+  }
+  .tile {
+    aspect-ratio: 1;
+  }
+  .line {
+    height: 0.9em;
+  }
+  @keyframes pulse {
+    50% {
+      opacity: 0.55;
+    }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .tile,
+    .line {
+      animation: none;
+    }
+  }
+</style>
diff --git a/ui/src/lib/ui/Skeleton.test.ts b/ui/src/lib/ui/Skeleton.test.ts
new file mode 100644
index 00000000..127061ed
--- /dev/null
+++ b/ui/src/lib/ui/Skeleton.test.ts
@@ -0,0 +1,16 @@
+import { cleanup, render, screen } from '@testing-library/svelte'
+import { afterEach, describe, expect, it } from 'vitest'
+import Skeleton from './Skeleton.svelte'
+
+describe('Skeleton', () => {
+  afterEach(cleanup)
+  it('announces loading and draws the requested shape', () => {
+    render(Skeleton, { props: { tiles: 4, label: 'loading outputs' } })
+    const status = screen.getByRole('status', { name: 'loading outputs' })
+    expect(status.querySelectorAll('.tile')).toHaveLength(4)
+  })
+  it('draws lines by default', () => {
+    render(Skeleton)
+    expect(screen.getByRole('status').querySelectorAll('.line')).toHaveLength(3)
+  })
+})
diff --git a/ui/src/lib/workspace.svelte.ts b/ui/src/lib/workspace.svelte.ts
index 040c94e9..f21aa1a2 100644
--- a/ui/src/lib/workspace.svelte.ts
+++ b/ui/src/lib/workspace.svelte.ts
@@ -86,6 +86,11 @@ export function loadWorkspaces(): Promise<void> {
             .filter((entry) => entry.usage)
             .map((entry) => [entry.name, entry.usage!]),
         )
+        workspace.notes = Object.fromEntries(
+          result.workspaces
+            .filter((entry) => entry.note)
+            .map((entry) => [entry.name, entry.note!]),
+        )
         // A route naming a workspace that has gone away (deleted elsewhere,
         // or a stale bookmark) is caught here for the route the app opened
         // on; `applyRouteWorkspace` catches every one after
diff --git a/ui/src/lib/workspaceState.svelte.ts b/ui/src/lib/workspaceState.svelte.ts
index 14a51872..4ccf89b2 100644
--- a/ui/src/lib/workspaceState.svelte.ts
+++ b/ui/src/lib/workspaceState.svelte.ts
@@ -18,4 +18,12 @@ export const workspace = $state<{
    * computes it per listing and caches it briefly, so it is a glance
    * rather than a live figure. Absent for a server that does not send it. */
   usage: Record<string, { files: number; bytes: number }>
-}>({ current: DEFAULT_WORKSPACE, names: undefined, root: null, usage: {} })
+  /** The note each workspace carries, by name; a workspace without one is absent */
+  notes: Record<string, string>
+}>({
+  current: DEFAULT_WORKSPACE,
+  names: undefined,
+  root: null,
+  usage: {},
+  notes: {},
+})
diff --git a/ui/src/lib/wsGroups.test.ts b/ui/src/lib/wsGroups.test.ts
new file mode 100644
index 00000000..5170129f
--- /dev/null
+++ b/ui/src/lib/wsGroups.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+import { groupWorkspaces } from './wsGroups'
+
+const names = [
+  'acorn-wars',
+  'regression-co',
+  'h3-quality',
+  'regression-mod',
+  'regression-smoke',
+  'sci0fi',
+]
+
+describe('groupWorkspaces', () => {
+  it('groups three or more names that share a prefix, where the first one stood', () => {
+    expect(groupWorkspaces(names, { hidden: [], open: 'h3-quality' })).toEqual({
+      entries: [
+        { kind: 'ws', name: 'acorn-wars' },
+        {
+          kind: 'group',
+          prefix: 'regression',
+          names: ['regression-co', 'regression-mod', 'regression-smoke'],
+        },
+        { kind: 'ws', name: 'h3-quality' },
+        { kind: 'ws', name: 'sci0fi' },
+      ],
+      hidden: [],
+    })
+  })
+  it('leaves hidden names out, except the open one', () => {
+    const r = groupWorkspaces(names, {
+      hidden: ['sci0fi', 'h3-quality'],
+      open: 'h3-quality',
+    })
+    expect(r.hidden).toEqual(['sci0fi'])
+    expect(r.entries).toContainEqual({ kind: 'ws', name: 'h3-quality' })
+    expect(r.entries).not.toContainEqual({ kind: 'ws', name: 'sci0fi' })
+  })
+  it('does not group a pair', () => {
+    const r = groupWorkspaces(['a-1', 'a-2', 'b'], { hidden: [], open: 'b' })
+    expect(r.entries.every((e) => e.kind === 'ws')).toBe(true)
+  })
+  it('hiding names can dissolve a group below the minimum', () => {
+    const r = groupWorkspaces(names, {
+      hidden: ['regression-co'],
+      open: 'h3-quality',
+    })
+    expect(r.entries.some((e) => e.kind === 'group')).toBe(false)
+  })
+})
diff --git a/ui/src/lib/wsGroups.ts b/ui/src/lib/wsGroups.ts
new file mode 100644
index 00000000..c359e69c
--- /dev/null
+++ b/ui/src/lib/wsGroups.ts
@@ -0,0 +1,50 @@
+/** The sidebar's workspace list, folded: names that share a prefix (the
+ * part before the first '-') become one group row once there are `min` of
+ * them, at the place the first one stood; names this browser hid are left
+ * out. The open workspace is never hidden - hiding the page you are on
+ * would strand you. */
+export type WsEntry =
+  | { kind: 'ws'; name: string }
+  | { kind: 'group'; prefix: string; names: string[] }
+
+const prefixOf = (name: string) => {
+  const at = name.indexOf('-')
+  return at > 0 ? name.slice(0, at) : null
+}
+
+export function groupWorkspaces(
+  names: readonly string[],
+  {
+    hidden,
+    open,
+    min = 3,
+  }: { hidden: readonly string[]; open: string; min?: number },
+): { entries: WsEntry[]; hidden: string[] } {
+  const shown = names.filter((n) => n === open || !hidden.includes(n))
+  const counts = new Map<string, number>()
+  for (const n of shown) {
+    const p = prefixOf(n)
+    if (p) counts.set(p, (counts.get(p) ?? 0) + 1)
+  }
+  const entries: WsEntry[] = []
+  const groups = new Map<
+    string,
+    { kind: 'group'; prefix: string; names: string[] }
+  >()
+  for (const n of shown) {
+    const p = prefixOf(n)
+    if (p && (counts.get(p) ?? 0) >= min) {
+      let group = groups.get(p)
+      if (!group) {
+        group = { kind: 'group', prefix: p, names: [] }
+        groups.set(p, group)
+        entries.push(group)
+      }
+      group.names.push(n)
+    } else entries.push({ kind: 'ws', name: n })
+  }
+  return {
+    entries,
+    hidden: names.filter((n) => n !== open && hidden.includes(n)),
+  }
+}
diff --git a/workflows/templates/check-script.json b/workflows/templates/check-script.json
index fe8aa891..e577b9fd 100644
--- a/workflows/templates/check-script.json
+++ b/workflows/templates/check-script.json
@@ -1,6 +1,6 @@
 {
   "id": "CheckScript",
-  "description": "Checks that a take speaks its script, line by line, and saves the answer as JSON for get_output_text. It runs 'check_script' on 'input_audio' (an audio file, or a video's muxed soundtrack) against 'lines', the expected lines in order: strings, or {text, shot} objects naming the shot a line belongs in. H3 markup in a line is stripped, and a markup word heard spoken is 'tag_spoken'; [] means no speech is expected. 'shots' is optional: by default the take's own recorded shots are used, from its run manifest or keep_output sidecar. Findings are line_mismatch, tag_spoken, line_clipped_at_end, speech_where_silent and speech_in_silent_shot, each a place to listen before re-rolling. The defaults come from a two-model measurement (#609, job af5de241ca83): whisper-large-v3-turbo scored correct lines 0.71 to 1.00 and wrong or missing ones 0.00, so 'similarity' 0.6 separates them. Write numbers as words, as turbo hears them.",
+  "description": "Checks that a take speaks its script, line by line, and saves the answer as JSON for get_output_text. It runs 'check_script' on 'input_audio' (an audio file, or a video's muxed soundtrack) against 'lines', the expected lines in order: strings, or {text, shot} objects naming the shot a line belongs in. H3 markup in a line is stripped, and a markup word heard spoken is 'tag_spoken'; [] means no speech is expected. 'shots' is optional: by default the take's own recorded shots are used, from its run manifest or keep_output sidecar. Findings are line_mismatch, tag_spoken, line_clipped_at_end, speech_not_transcribed, speech_where_silent and speech_in_silent_shot, each a place to listen before re-rolling. The defaults come from a two-model measurement (#609, job af5de241ca83): whisper-large-v3-turbo scored correct lines 0.71 to 1.00 and wrong or missing ones 0.00, so 'similarity' 0.6 separates them. Write numbers as words, as turbo hears them.",
   "variables": {
     "input_audio": "asset:take.wav",
     "lines": null,
diff --git a/workflows/templates/minimax/README.md b/workflows/templates/minimax/README.md
index fcae9da2..dc492033 100644
--- a/workflows/templates/minimax/README.md
+++ b/workflows/templates/minimax/README.md
@@ -64,7 +64,14 @@ checkpoint comes with the canvas it was trained at, the sigma shift it was
 distilled against and the alpha it is meant to run at, and changing one means
 changing all of them. That is why `video_shift`, `audio_shift` and `lora_alpha`
 are variables on every template here - a checkpoint swap is arguments rather
-than a new file. Four combinations are known good:
+than a new file. So is `attention_backend`, `null` by default and wired to the
+H3 step's transformer only (never a Z-Image or Music3 step beside it):
+`attention_backend=sage_hub` is the measured 23-33% per-step win on a CUDA box
+with the `kernels` package and `DIFFUSERS_TRUST_REMOTE_KERNELS=true`; leave it
+null on mps, where it fails at run time ([ACCELERATION.md](../../../docs/ACCELERATION.md)).
+So is `cache`, `null` (off) by default on the same H3 step: pass
+`{"type": "first_block", "threshold": 0.05}` only at ~20 or more base steps, never
+with the turbo LoRAs. Four combinations are known good:
 
 | Checkpoint | Canvas | Shift (video/audio) | Alpha | Steps | Where |
 | --- | --- | --- | --- | --- | --- |
diff --git a/workflows/templates/minimax/chain-matched-and-aligned.json b/workflows/templates/minimax/chain-matched-and-aligned.json
index fcdd3bc4..1e209abf 100644
--- a/workflows/templates/minimax/chain-matched-and-aligned.json
+++ b/workflows/templates/minimax/chain-matched-and-aligned.json
@@ -7,7 +7,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -40,7 +44,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": 12345
+        "seed": 12345,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -129,6 +135,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -158,7 +165,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/chain-matched-to-audio.json b/workflows/templates/minimax/chain-matched-to-audio.json
index a38fb395..990b4f13 100644
--- a/workflows/templates/minimax/chain-matched-to-audio.json
+++ b/workflows/templates/minimax/chain-matched-to-audio.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -36,7 +40,9 @@
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
         "hold_audio": null,
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -126,6 +132,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -155,7 +162,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/chain-video-continuity.json b/workflows/templates/minimax/chain-video-continuity.json
index 05f8cfd5..31cbf738 100644
--- a/workflows/templates/minimax/chain-video-continuity.json
+++ b/workflows/templates/minimax/chain-video-continuity.json
@@ -8,7 +8,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -40,7 +44,9 @@
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
-        "seed": 12345
+        "seed": 12345,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -129,6 +135,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -158,7 +165,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/chained-segments.json b/workflows/templates/minimax/chained-segments.json
index 3bf9855e..9f171f61 100644
--- a/workflows/templates/minimax/chained-segments.json
+++ b/workflows/templates/minimax/chained-segments.json
@@ -26,7 +26,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "variables": {
         "prompts": null,
@@ -49,7 +53,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -139,6 +145,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -168,7 +175,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/composable-references.json b/workflows/templates/minimax/composable-references.json
index 0a8c9b9b..c39c1559 100644
--- a/workflows/templates/minimax/composable-references.json
+++ b/workflows/templates/minimax/composable-references.json
@@ -7,7 +7,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -36,7 +40,9 @@
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
-        "seed": 12345
+        "seed": 12345,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -125,6 +131,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -154,7 +161,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/dialogue-short.json b/workflows/templates/minimax/dialogue-short.json
index 996b7581..2038241c 100644
--- a/workflows/templates/minimax/dialogue-short.json
+++ b/workflows/templates/minimax/dialogue-short.json
@@ -7,14 +7,18 @@
             "device": "cuda",
             "name": "RTX 3090",
             "vram_gb": 24,
-            "minutes": 42
+            "minutes": 21.2
         }
     ],
     "cost_drivers": [
         "shots",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -25,7 +29,7 @@
             "height",
             "num_frames"
         ],
-        "reason": "Ref2VA holds every reference's encoding resident beside the video latents, so the ceiling is a fixed base, a per-voxel term for the VAE decode's conv3d activation (width * height * num_frames), and a per-reference term. Classified against the 24 GB entry from the #479 field report (lem, RTX 3090 24 GB, int4 + 768p turbo LoRA, 9 steps, 2026-09-25/26) at 1344x768: 175 frames x 2 refs, 209 x 2 and 175 x 3 ran (projected 22.83, 23.77 and 23.83 GB); 209 x 3 OOM'd in reference encode needing a further 5.1 GB and 260 x 1 OOM'd at denoise step 1 needing a further 4.8 GB (projected 24.77 and 24.18 GB). The refused allocations are lower bounds, not peaks, so this is a classification with about 0.2 GB of margin either side, not a fitted curve. bytes_per_voxel is unchanged from #324's calibration (job 282172105da1); base_gb drops 0.3 GB now the references are counted separately"
+        "reason": "Ref2VA holds every reference's encoding resident beside the video latents, so the ceiling is a fixed base, a per-voxel term for the VAE decode's conv3d activation (width * height * num_frames), and a per-reference term. Classified against the 24 GB entry from the #479 field report (lem, RTX 3090 24 GB, int4 + 768p turbo LoRA, 9 steps, 2026-09-25/26) at 1344x768: 175 frames x 2 refs, 209 x 2 and 175 x 3 ran (projected 22.83, 23.77 and 23.83 GB); 209 x 3 OOM'd in reference encode needing a further 5.1 GB and 260 x 1 OOM'd at denoise step 1 needing a further 4.8 GB (projected 24.77 and 24.18 GB). The refused allocations are lower bounds, not peaks, so this is a classification with about 0.2 GB of margin either side, not a fitted curve. bytes_per_voxel is unchanged from #324's calibration (job 282172105da1); base_gb drops 0.3 GB now the references are counted separately. The cost entry's 42 min was that field run at 1344x768; re-priced to these 960x544 defaults it is 42 x 960*544 / (1344*768) = 21.2 (#866)"
     },
     "variables": {
         "character_a_portrait_prompt": "a 3/4-length studio portrait of a wiry man in his early 30s with short curly dark hair and expressive eyebrows, wearing a mustard-yellow sweater vest over a white button-down shirt, standing in a 1990s multi-camera sitcom apartment set with a sagging olive-green couch and a brick wall behind him, warm even studio lighting, sharp focus, photographic",
@@ -143,7 +147,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": 42
+        "seed": 42,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -290,6 +296,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -319,7 +326,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/enhance-prompt-with-image.json b/workflows/templates/minimax/enhance-prompt-with-image.json
index 6e389c98..3abfa59b 100644
--- a/workflows/templates/minimax/enhance-prompt-with-image.json
+++ b/workflows/templates/minimax/enhance-prompt-with-image.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "variables": {
         "idea": "Task: I2VA. Duration: 5.17 seconds. Idea: a blown glass figure's tentacles writhe as it speaks in a deep, echoing voice, calling forth ancient ancestors.",
@@ -27,7 +31,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -134,6 +140,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -163,7 +170,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/enhance-prompt.json b/workflows/templates/minimax/enhance-prompt.json
index e04b6c1a..e645985f 100644
--- a/workflows/templates/minimax/enhance-prompt.json
+++ b/workflows/templates/minimax/enhance-prompt.json
@@ -14,7 +14,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.3,
@@ -43,7 +47,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": 42
+        "seed": 42,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -149,6 +155,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -178,7 +185,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/first-and-last-frame.json b/workflows/templates/minimax/first-and-last-frame.json
index 58dc4bc7..05afbc10 100644
--- a/workflows/templates/minimax/first-and-last-frame.json
+++ b/workflows/templates/minimax/first-and-last-frame.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "variables": {
         "prompt": "How the reference pictures align with the target video - Picture 1 (from Shot 1) aligns with the 0.00-second mark of the target video; Picture 2 (from Shot 1) aligns with the 5.17-second mark of the target video.\n\nintegrated_multimodal_description: [Shot 1] Cinematic, live-action macro photography with a shallow depth of field, one continuous shot from the first frame to the last. The video opens on <Picture 1>: a translucent blown glass figure centred against a dark, softly graded background, its tentacles curled in close to the body, cool rim light running along every curve and small caustics pooling on the surface beneath it. The tentacles unfurl outward and upward through the first half of the clip, reaching their widest span near the midpoint with the glass flexing as though molten while staying perfectly clear, and the caustics below spreading with them. The figure (S1), a deep cavernous male voice with a long tail of reverb, unhurried and very low in pitch, says <d>[English] Rise now. The old ones are listening.</d> Through the second half the tentacles draw steadily back in along the same paths, the span narrowing and the caustics contracting, until the figure settles into exactly the pose, position and lighting of <Picture 2> as the video ends. The camera holds a static shot throughout so the opening and closing frames match.\n\noverall_soundscape: A dark, near-silent room tone under a faint low-frequency hum. The tentacle movement carries a fine, dry glass-on-glass squeak that rises as the limbs spread and falls as they close, with an occasional soft chime as two limbs touch.\n\nnon_diegetic_music: A sustained low drone of bowed double bass and detuned synthesiser, almost subsonic, swelling as the tentacles reach their widest span and returning to its opening level as they close, with no discernible melody or pulse.",
@@ -28,7 +32,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -118,6 +124,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -147,7 +154,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/generated-subject-reference.json b/workflows/templates/minimax/generated-subject-reference.json
index 97e0226c..709f3baa 100644
--- a/workflows/templates/minimax/generated-subject-reference.json
+++ b/workflows/templates/minimax/generated-subject-reference.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -34,7 +38,9 @@
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -151,6 +157,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -180,7 +187,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/image-to-video.json b/workflows/templates/minimax/image-to-video.json
index 6f219b23..be5a19c2 100644
--- a/workflows/templates/minimax/image-to-video.json
+++ b/workflows/templates/minimax/image-to-video.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "variables": {
         "prompt": "For the target video, at 0.00 seconds into the target video, <Picture 1> (from [Shot 1]) is fully referenced.\n\nintegrated_multimodal_description: [Shot 1] Cinematic, live-action macro photography with a shallow depth of field. The shot opens exactly on <Picture 1>: a translucent blown glass figure fills the frame against a dark, softly graded background, its surface catching cool rim light along every curve and throwing small caustics onto the surface beneath it. Its tentacles, until now still, begin to writhe, curling and uncurling in slow deliberate coils, the glass flexing as though molten while staying perfectly clear. The figure (S1), a deep cavernous male voice with a long tail of reverb, unhurried and very low in pitch, says <d>[English] Rise now. The old ones are listening.</d> As the words land its central mass swells and contracts once, and the caustics on the surface below ripple with it. The camera pushes in with small amplitude at slow speed toward the figure's core through the final seconds, holding the writhing tentacles at the edges of frame.\n\noverall_soundscape: A dark, near-silent room tone under a faint low-frequency hum. The tentacle movement carries a fine, dry glass-on-glass squeak and an occasional soft chime as two limbs touch. A distant, slow swell of moving air rises beneath the voice and falls away after it.\n\nnon_diegetic_music: A sustained low drone of bowed double bass and detuned synthesiser, almost subsonic, rising very slowly in intensity across the clip with no discernible melody or pulse.",
@@ -26,7 +30,8 @@
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "seed": null,
-        "attention_backend": null
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -146,7 +151,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/last-frame-only.json b/workflows/templates/minimax/last-frame-only.json
index 66000755..602986d0 100644
--- a/workflows/templates/minimax/last-frame-only.json
+++ b/workflows/templates/minimax/last-frame-only.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "variables": {
         "prompt": "How the reference pictures align with the target video - <Picture 1> (from [Shot 1]) aligns with the 5.17-second mark of the target video.\n\nintegrated_multimodal_description: [Shot 1] Cinematic, live-action macro photography with a shallow depth of field, one continuous shot from the first frame to the last. The video opens on a translucent blown glass figure held far back in a dark, softly graded field, small in frame and turned away from the lens, its tentacles trailing loosely behind it and only a thin cool rim light picking out their edges. The figure drifts steadily toward the lens through the whole clip, growing in the frame as it comes, and turns as it travels until it faces camera straight on. The tentacles gather in from their trailing spread and curl close to the body along the way, the rim light strengthening along every curve as the figure nears, and caustics begin to pool on the surface beneath it. The camera pushes in slowly to meet it. The clip ends on exactly the framing, pose and lighting of <Picture 1>, the figure centred and still.\n\noverall_soundscape: A dark, near-silent room tone under a faint low-frequency hum, the hum rising very slightly in level as the figure closes on the lens. The tentacle movement carries a fine, dry glass-on-glass squeak that grows more present as the figure nears, with an occasional soft chime as two limbs touch, and the last second settles into near silence.\n\nnon_diegetic_music: A sustained low drone of bowed double bass and detuned synthesiser, almost subsonic, swelling steadily as the figure approaches and cutting to nothing on the final frame, with no discernible melody or pulse.",
@@ -25,7 +29,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -115,6 +121,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -144,7 +151,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/music-video.json b/workflows/templates/minimax/music-video.json
index 1d966cb6..dd5123ca 100644
--- a/workflows/templates/minimax/music-video.json
+++ b/workflows/templates/minimax/music-video.json
@@ -14,7 +14,11 @@
         "audio_duration",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -92,7 +96,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": 42
+        "seed": 42,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -256,6 +262,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -285,7 +292,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/reference-to-video.json b/workflows/templates/minimax/reference-to-video.json
index 9a4dbf84..ed8760c1 100644
--- a/workflows/templates/minimax/reference-to-video.json
+++ b/workflows/templates/minimax/reference-to-video.json
@@ -14,7 +14,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -44,7 +48,8 @@
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
         "seed": null,
-        "attention_backend": null
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -164,7 +169,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/shots-batch.json b/workflows/templates/minimax/shots-batch.json
index 80b986c9..619d624a 100644
--- a/workflows/templates/minimax/shots-batch.json
+++ b/workflows/templates/minimax/shots-batch.json
@@ -18,7 +18,11 @@
         "shots",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.3,
@@ -70,7 +74,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -161,6 +167,7 @@
                     },
                     "components": {
                         "transformer": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 2,
@@ -190,7 +197,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/storyboard.json b/workflows/templates/minimax/storyboard.json
index 7888e7bd..7532d214 100644
--- a/workflows/templates/minimax/storyboard.json
+++ b/workflows/templates/minimax/storyboard.json
@@ -13,7 +13,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -45,7 +49,9 @@
         "lora_model_name": "lightx2v/Minimax-h3-Turbo",
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
-        "seed": 42
+        "seed": 42,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -214,6 +220,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -246,7 +253,8 @@
                     },
                     "configs": {
                         "reference_image_short_edge": "variable:reference_image_short_edge"
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/video-with-audio-768p.json b/workflows/templates/minimax/video-with-audio-768p.json
index 77f83b3c..6fd9d36c 100644
--- a/workflows/templates/minimax/video-with-audio-768p.json
+++ b/workflows/templates/minimax/video-with-audio-768p.json
@@ -14,7 +14,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.3,
@@ -42,7 +46,8 @@
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "seed": 42,
-        "attention_backend": null
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -162,7 +167,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/video-with-audio.json b/workflows/templates/minimax/video-with-audio.json
index a0dd1d9a..5887652c 100644
--- a/workflows/templates/minimax/video-with-audio.json
+++ b/workflows/templates/minimax/video-with-audio.json
@@ -14,7 +14,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.3,
@@ -42,7 +46,8 @@
         "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "seed": 42,
-        "attention_backend": null
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -162,7 +167,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",
diff --git a/workflows/templates/minimax/voice-timbre-reference.json b/workflows/templates/minimax/voice-timbre-reference.json
index 2e81b91b..052a2655 100644
--- a/workflows/templates/minimax/voice-timbre-reference.json
+++ b/workflows/templates/minimax/voice-timbre-reference.json
@@ -6,7 +6,11 @@
         "num_frames",
         "num_inference_steps",
         "width",
-        "height"
+        "height",
+        "weights_dtype",
+        "lora_model_name",
+        "attention_backend",
+        "cache"
     ],
     "vram_estimate": {
         "base_gb": 16.0,
@@ -36,7 +40,9 @@
         "lora_weight_name": "minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors",
         "lora_adapter_name": "turbo",
         "weights_dtype": "{int4}",
-        "seed": null
+        "seed": null,
+        "attention_backend": null,
+        "cache": null
     },
     "variable_constraints": {
         "num_frames": {
@@ -141,6 +147,7 @@
                     },
                     "components": {
                         "transformer_ref": {
+                            "attention_backend": "variable:attention_backend",
                             "group_offload": {
                                 "offload_type": "block_level",
                                 "num_blocks_per_group": 1,
@@ -170,7 +177,8 @@
                             "device": "cuda",
                             "residency": "on_demand"
                         }
-                    }
+                    },
+                    "cache": "variable:cache"
                 },
                 "from_pretrained_arguments": {
                     "model_name": "MiniMaxAI/MiniMax-H3",