release: v0.1.28 photo selection and gallery polish

fix: anchor gallery card actions to bottom left
fix: make photo retention and exclusion mutually exclusive
2026-10-20 19:47:28 +08:00 · 2026-10-20 19:42:33 +08:00 · 2026-10-20 19:19:30 +08:00 · 2026-10-20 19:09:31 +08:00 · 2026-10-20 19:07:18 +08:00 · 2026-10-20 19:01:23 +08:00
50 changed files with 2607 additions and 180 deletions
@@ -7,7 +7,7 @@ on:
  workflow_dispatch:
 jobs:
  verify:
-    # The NAS Docker runner must never execute code from external forks.
+    # The self-hosted Docker runner must never execute code from external forks.
    if: github.server_url != 'https://github.com' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    env:
@@ -15,6 +15,7 @@ jobs:
      DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
      CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
      CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
+      CI_PYTHON_BASE: ${{ vars.CI_PYTHON_BASE }}
      ALPINE_MIRROR: ${{ vars.ALPINE_MIRROR }}
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -41,4 +42,4 @@ jobs:
          fi

 # Production moved to Ubuntu Server. Release manually with scripts/server-release.py;
-# the shared NAS runner performs isolated verification only.
+# the shared Server runner performs isolated verification only.
@@ -43,7 +43,7 @@ WORKDIR /app
 ARG BUILD_COMMIT=development
 ARG BUILD_TIME=unknown
 ENV BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
-LABEL org.opencontainers.image.title="PIGWay Frame Flow" org.opencontainers.image.version="0.1.21" org.opencontainers.image.revision=$BUILD_COMMIT
+LABEL org.opencontainers.image.title="PIGWay Frame Flow" org.opencontainers.image.version="0.1.28" org.opencontainers.image.revision=$BUILD_COMMIT
 USER 10333:10333
 EXPOSE 18787
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
@@ -1,3 +1,5 @@
+<p><img src="docs/brand/pigway-logo.png" alt="PIGWay" width="96" height="96"></p>
+
 # PIGWay Frame Flow

 Development currently supports Python 3.14.x. See [contributing](CONTRIBUTING.md) and [security reporting](SECURITY.md).
@@ -1,3 +1,5 @@
+<p><img src="docs/brand/pigway-logo.png" alt="PIGWay" width="96" height="96"></p>
+
 # PIGWay Frame Flow

 开发环境目前支持 Python 3.14.x。参见[贡献指南](CONTRIBUTING.md)和[安全问题报告](SECURITY.md)。
@@ -26,6 +28,8 @@ docker compose up -d

 打开 `http://127.0.0.1:6005`，使用刚创建的账号登录。网页使用 HttpOnly 会话 Cookie，无需输入 API Token；勾选记住登录后会话有效期为 30 天，可在设置中修改密码或退出。`FRAME_FLOW_TOKEN` 用于外部 API 客户端鉴权，与 KoKonna API Key 分开。

+网页仅支持一个用户，不提供公开注册。密码为 8–256 位，支持密码管理器；使用带随机盐的 scrypt（N=16384、r=8、p=5）保存，旧哈希登录成功后自动升级。连续 5 次失败后按账号和来源 IP 限制登录 5 分钟。修改密码需验证当前密码，成功后撤销全部会话；写入请求校验 CSRF Token，登录拒绝跨来源请求。公网访问应通过 HTTPS，HTTPS 下会话 Cookie 自动启用 Secure。
+
 默认端口只绑定本机回环地址。需要局域网访问时，显式将 `WEB_BIND` 设置为 NAS 的局域网地址，并通过 `WEB_PORT` 选择空闲端口。参见[群晖部署](docs/NAS.md)、[构建镜像源与缓存](docs/BUILDING.md)。不会自动修改防火墙、路由器或反向代理。

 使用 Python 3.14 运行本地 Mock 演示：
@@ -99,3 +103,7 @@ KoKonna 是支持的设备集成。本项目与 KoKonna 无隶属关系，也不
 相关项目：[PIGWay Raspberry Pi Agent](https://tea.pigway.com/way/pigway-raspberry-pi-agent) · [PIGWay Device Console](https://tea.pigway.com/way/pigway-device-console) · [PIGWay Yahboom Cooling HAT](https://tea.pigway.com/way/pigway-yahboom-cooling-hat)

 [文档目录](docs/README.md)
+
+历史记录支持服务端翻页、图片名称/请求 ID/任务 ID/来源搜索，以及状态、操作、设备和日期（上海时区）筛选；可选择当前页记录进行单条或批量删除，操作前需确认。删除仅从历史列表移除，内部执行凭据继续供图库来源、幂等及恢复使用，不会删除图片或取消任务；运行中的任务不能删除。
+
+源图库选用标记：本地图库支持单张和批量“不再选用／恢复选用”，照片源（Synology Photos、WebDAV、网盘等）的浏览列表支持独立星标及选用标记。后续自动选图和自动拼图跳过被标记的图片，星标保留与不再选用互斥，需先取消原标记再切换；图片仍保留，可手动预览、使用或恢复。标记按图库和图片 ID 独立保存，不取消已提交任务，也不修改网盘原文件。
@@ -1,9 +1,11 @@
-# pigway-frame-flow v0.1.21
+# pigway-frame-flow v0.1.28

-基础映像改为固定摘要的官方 Python 3.14 Alpine 3.24，并应用系统安全更新，移除 Debian 基础系统遗留告警。保留原字体路径、中文字体、时区和第三方许可。
+源图库增加自动选图排除标记，并完善图库卡片交互。

-发布脚本统一从完整 Dockerfile 构建，避免复用旧运行映像继续携带漏洞；版本标签读取项目元数据。移除旧 Debian 离线字体缓存和运行映像覆盖构建方式，同步构建参数与文档。
+- 本地图库支持单张、批量“不再选用／恢复选用”；网盘等照片源支持星标及选用标记，按图库与图片 ID 保存。
+- 后续自动选图和自动拼图跳过被排除的图片；图片仍保留，可手动使用或恢复，不取消已提交任务。
+- 星标与不再选用互斥，前端禁用冲突按钮，后端校验单张、批量、照片源及并发提交，拒绝非法布尔值。
+- 卡片分别显示来源、星标／排除标记和时间；按钮按“显示到画框、星标保留、不再选用、下载图片、删除”排列，保持贴底、靠左及同行底边对齐。
+- 修正图库任务筛选控件空引用提示，保留删除确认和批量操作。

-585 项测试、Ruff、格式和 mypy 通过。AMD64 容器启动/重启、只读接口及中文实际字形和 PNG 渲染验证通过。Trivy 0.76.0 扫描系统包和全部 25 项 Python 运行依赖，各严重级别均未检出已知漏洞；结论限于 2026-10-18 漏洞库快照。
-
-生产升级须通过现有挂载身份校验和部署流程完成，发布源码不等同于生产升级。
+源码包保留 LICENSE、NOTICE 和第三方许可材料，不包含私有配置、数据库或会话。
@@ -16,6 +16,6 @@ person's deployment or write to real frames without explicit authorization.

 ## 当前容器映像检查

-v0.1.21 使用官方 Python Alpine 3.24 基础映像并固定摘要，构建时应用 APK 安全更新。2026-10-18 使用 Trivy 0.76.0 扫描构建的 Linux AMD64 映像，涵盖操作系统和 Python 包、全部严重级别，未检出已知漏洞；未配置漏洞忽略规则。该结果是当日漏洞库快照，不是未来无漏洞的保证，也不代表旧运行容器已升级。
+v0.1.23 使用官方 Python Alpine 3.24 基础映像并固定摘要，构建时应用 APK 安全更新。2026-10-18 使用 Trivy 0.76.0 扫描与当前生产运行 ID 一致的 Linux AMD64 映像，涵盖操作系统和 Python 包、全部严重级别，未检出已知漏洞；未配置漏洞忽略规则。该结果是当日漏洞库快照，不是未来无漏洞的保证，也不代表旧运行容器已升级。

 基础映像更新后须重新构建并复扫。默认非 root、只读根目录、清空 capabilities 和 no-new-privileges 的部署限制继续保留。中文字体、第三方许可证和依赖元数据均保留；不以删除包清单掩盖告警。
@@ -2,16 +2,16 @@ c2792b2c75880ff09822804632b1b3b6dd6190b38841b8c3567bb1b7e7b59a8c  .dockerignore
 d20031a8e861a0f3e19b7750ddb53bc84c480c469c44a70ecdf8261ec05431c0  .env.example
 0c7f4585d62a8d35bfc22e0bebdf7a479a179122b2b092bfe434e3038cddd3d5  .gitattributes
 b45d35d737f119a70bf40cb1f9626ff80772ed7913cb35f6e9b870d6ada01a15  .github/workflows/community.yml
-d3ad09bdc5dc60c41a774e1cad43f3e3f8ae5c851303ae6ec2aac030392a2939  .github/workflows/verify.yml
+c8c545718e9b9880555c950a078cac160c82e0cd6e593afcf20bc13727539ec5  .github/workflows/verify.yml
 3931cc314019760a582e0914e2d9c0f3b862a004d0a30d374900edcad5f599e5  .gitignore
 4b4ed4926a350cbeb71436541b4566e4ba7d2494ac95236b88827a9f5dd171c2  CONTRIBUTING.md
-660c76fccccae8643633d052d0d6733ecf278f2a3016de29e6850b312a365413  Dockerfile
+784ddd90ad45e4de196a7459bd3b7cb76daf57c374cd4a503be31a0e95e2b2a1  Dockerfile
 6eb7728e6e73f9568ca6fd5ad6383d13ffc638f2870fefa2d86f72f39685c0fc  LICENSE
 250a2bcec248b074786d90e0329874628d70d5a0fe3b4fba47c8c57d4f84dcce  NOTICE.md
-26ad0d9063c0ee843f0f532604b8fd66e8b39fd72d129595ed078677c0d6d13c  README.md
-ee00cb267b38485f1e574d610f0a57b51d4ae575731a18e57d06a7c43dc0a8b0  README.zh-CN.md
-304bec983ac8242107b1ec4154522f451a5d33b6a77ed26669926cb3e161f863  RELEASE_NOTES.md
-6a0c85c8d52a2d4a3b779dce306a93c4efc4dfe3ab3b23e4a6a3bb7c55079910  SECURITY.md
+b7a41a2c00df1a0dbe3869d059d65c3bcaee8c50e51217c358527c4f1d3d6c98  README.md
+94184f76401192678ec420c2ccd23142d90e07a8ccc882a4a0d4701a0c278afc  README.zh-CN.md
+441c9bf48ed54c32dc21e103a657c3f87b497cb96e358ca2c62f31b2d058ec14  RELEASE_NOTES.md
+3dd364e47fdbd2ce9ce2df83342c523adc21583f093a5439d501b3424878ce2f  SECURITY.md
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  build-cache/wheels/.gitkeep
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  config/.gitkeep
 dff739157875c8a70235c4994df868afc6824e0d3861b2716ac28014bb38144f  deploy/build-cn.env
@@ -21,35 +21,41 @@ fd53125a5359dcae1d81e95b8447aac755270f9aeb354d3e1140d7fccb57c42e  deploy/docker-
 4464545a9d91bbc9fff9cd9941db63f44fa61120caca426687d1ed06635cc3e6  deploy/organized-photos-source.json
 f78d6c3d40e6c5246601bb99c2b46eef91e883a8f83841d85c925394708af0c0  docker-compose.yml
 30d3e705870ebb012ce122bd7d8f95192d86664c4d2bb45a3169c86988fbaf72  docs/AUTOMATIC_COLLAGE.md
-5f727c9588504a18009ea892f3204fce9520b03754a56dbc9f59e3505ce8a1b2  docs/BUILDING.md
+93b6e60570d9ca2ce14a454641a32885ca84d16a82db05db22cd62e488191dff  docs/BUILDING.md
 d9f07164c75c757e85f4ace2b55deaf82b8b904216c5222be6c0e3ab7b28cb36  docs/EXTENSIONS.md
 1d8c5f79eff3115b1cd13d8f63fff1332b80d1fe1bec6b0f2713b5f80b0cbf67  docs/KOKONNA_RECOVERY.md
 0fe1896a53cef4cfd2e380a0b979eceda493733082a9b56c3d7e89e7f62a65b3  docs/NAS.md
 3280bddcbe2d2721bb7efeb0eb2ec03d9d5ef867c69f3e70066b69f1ad5926e2  docs/PHOTO_SOURCES.md
 edf44436fd044561539c48480c481e66c1a38164f51ba5226cde04c756f7bacb  docs/PHOTO_SOURCE_CONNECTIONS.md
-4b00d08eb5a2425b205af13b87f9be04dd6870a734b42463a3e075658039dac9  docs/PUBLICATION.md
+b48f3ab6f28404bb34c188067a832384f4ba290e56912461ef3565528aa157d8  docs/PUBLICATION.md
 5fe4641e75e0746929f71256c6ff11116c777cca8d4288ccc2d7aee91bd7a6ac  docs/README.md
 5eb19e7e4ed1ceddbdf388fd55697e40f1b7ecd9a4fbdf8ab485132cc684dcb2  docs/REAL_DEVICE_TEST.md
 bfc38b889fa966031e195c3131db1d4a713e0dc35c644e3047c7ed94f2354700  docs/RESEARCH.md
 fac36f986e1a7a331d3669aa8e2013e6c0ea7a99c16a61ba3ff573e836aa87e1  docs/SYNOLOGY_PHOTOS_API.md
+f8ef7749c58d4396781bbc21371048f6561e791efbd489570224dc51173bffff  docs/brand/README.md
+f709156217c798f6b6230dae1f341373e0814a67ab90e881401da577f52ec3d3  docs/brand/pigway-avatar.png
+da6734d8a23305f6254c0936dadff4ec34977b4c934f5067186423c8cfce3fc7  docs/brand/pigway-logo.png
+0fa494a3fbd456c754bbea3f7f050be139e32e3b42b09a1ed953094087437210  docs/brand/pigway-logo.svg
 ac0481196e593ff9cca2e5133ff41fb3614268e6a10728a0deca3ad3bfb80b34  docs/integrations/TICKTAR.md
-b191be41aec1dab92ff0d2956d32ec6a325b49786ce9051e5299fe20e2b6b62d  docs/openapi.json
+bd906c2e74d95360880f3c96fd78474458be243f7ac01bd6cbc6e737719bb9ad  docs/openapi.json
 54bf7061e0626900ce35e19e81efc5c32c8fd6a0438bdad68f494e1ce81616d4  docs/research/KOKONNA_ACCOUNT_CAPABILITIES.md
 a07cbe71571c6e2d5a1b94897bd63321c74675c05d15438c4964eef39db0fd76  docs/research/KOKONNA_CONTENT_SUBSCRIPTIONS.md
 ec53d587b855be84283c50f8fb45be62a4c1caba78b28d436a8260fd171943a2  docs/research/KOKONNA_LOCAL_CONTROL.md
 2a68fe95ba4afc24aec6abd3e6ab24a360eb6bc3005ab0fefd696190915d76c1  docs/research/KOKONNA_WIDGET_CATALOG.json
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/__init__.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/api/__init__.py
-06e2e5156383120271ec989b89236bd1baa2d7ba3d6e51b3018de2b23bd39d91  pigway_frame_flow/api/app.py
+a2561122d40be5ed49bff2a4ad6cae628f9180ef28489853dd9bf1812e224ac6  pigway_frame_flow/api/app.py
+1efe9b1fc774a97e5be72d81199b1b65b25c258956fdf166aebff732cc820d7c  pigway_frame_flow/api/history.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/core/__init__.py
-fbadf6beaf25b9670dcbf125ec9d192188cf9e076ee4d4a0b5decdaf3834417c  pigway_frame_flow/core/accounts.py
+0b8402603c2f397f4f42491873b27bf363959194b05a0c67c7b1d49596288b95  pigway_frame_flow/core/accounts.py
 818e8fb29d22c13159a6cb22bcbc6b9e211a8a1301588126eb192ac4ed71441b  pigway_frame_flow/core/auth.py
+2f03a04c1f0f32d95bfd3d27d37ca98f9b79daaa20453999024b16fc8f34cd5d  pigway_frame_flow/core/photo_preferences.py
 8f2220fa90b0dc2e45df2023dc5ac695efe55361644ef266829553c99151949b  pigway_frame_flow/core/registry.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/display/__init__.py
 81effa34d6c452579cfa65781909f7c5a9e8ddad136e4c47ee0704939851879a  pigway_frame_flow/display/cloud_library.py
-558d2e2111e3dea1917eaa4f81d7c2dac3b47af3eda1cdc9426af4bf9bc570dd  pigway_frame_flow/display/recovery.py
+5e7e272e671a6d01d9b677416c77967ca488b4e2aa559f4211cf0de4ba1e88bc  pigway_frame_flow/display/recovery.py
 e1e4ae3ba321ae7282c5a4e061c52f24d2a6a6e3d4637e69e4b1fbd05004f5f6  pigway_frame_flow/display/retention.py
-1ee9ee8745dc497dadcc20e5e238c78f6c228f7f8a4ed310ced32f9be55b512e  pigway_frame_flow/display/service.py
+d974caaa2772b013cc6f080f997d37cd0d2212b29fa9524002f3fb87dd937364  pigway_frame_flow/display/service.py
 0975b24488be19f24e768c4c76d9f3c0348417c1351c4e410897da00f7be6656  pigway_frame_flow/display/upload_reconciliation.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/drivers/__init__.py
 9a8386ef368a6df7fd8cb23bcc442c28e784729a5ce4a78911ad86245d5c5794  pigway_frame_flow/drivers/base.py
@@ -63,7 +69,7 @@ f548a5a2b01d298eb3543cf6a1ac41177357bc8eb81b5578293347a15310b700  pigway_frame_f
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/extensions/__init__.py
 4655fb6cdf9550efd90d33b8de64511d8d6ff5a96d19782fc52d99498fe2a6c0  pigway_frame_flow/extensions/ai_images.py
 394459895a060f43d0ace27a4be0ea06ba1590df5de026b5661b06d42f2b31f9  pigway_frame_flow/extensions/api.py
-cf05d8bf20ad1ddb399ba0fc244fe1f36c895133579660f5ab7fc6716f9e66fc  pigway_frame_flow/extensions/auto_collage.py
+2f10b3644652369a367d3100114dc8b6fe3abaceeeb6d09fc2f55522e1298f9d  pigway_frame_flow/extensions/auto_collage.py
 46dab9596ba605da4d306ea941b7f19c4f3cde1f714fe1889c9f15bd8c087e42  pigway_frame_flow/extensions/device_events.py
 d463465ca3aea449e67386bc84a5f25b58535f74d89d7858c5b9bca0d93189d3  pigway_frame_flow/extensions/layout.py
 13bea510a6b5ae1958b3e095936429516c3e3bee6b06c3676a7eb31f311766e0  pigway_frame_flow/extensions/mqtt.py
@@ -82,7 +88,7 @@ a518965aa4db9abeb60865c315229c3053c8e9edd26d80f24dc0af0528bad9e6  pigway_frame_f
 2a68fe95ba4afc24aec6abd3e6ab24a360eb6bc3005ab0fefd696190915d76c1  pigway_frame_flow/integrations/kokonna_official/widget_catalog.json
 aea594fb4e4c9a6e2094d4d7973eb627ac02fb632811b2d1a558a0ee1cd12e77  pigway_frame_flow/integrations/kokonna_official/widgets.py
 1fe53f4bfb407b8db774fe730131ecf1213e16d752a3506c4c56b46365ea14e8  pigway_frame_flow/main.py
-0a7a96f84c3c1248eadf80ae412df36c71d308771f9f53512f3fc3c9bc6d5976  pigway_frame_flow/models.py
+f16e9ae17da8bddf95622b4d8ef2626342a88cd9da2f97913db5bdaec5c409df  pigway_frame_flow/models.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/providers/__init__.py
 b7a6cb8eb40d8dedfbce18777f8fbd433a174f14bcdadf498bd834132aa568fd  pigway_frame_flow/providers/cloud_drives.py
 58b070f0c814d639a4a912d079479d751d459816d59f2199d0be03e4d573ec3b  pigway_frame_flow/providers/external.py
@@ -90,14 +96,14 @@ e90b6becc3e19baa83fab763cb156eb8882a96594c04040305dcb315f68e85d0  pigway_frame_f
 69e7419e67e8416bf73f37e257a2586d2a1aa4d2706da8f7b42c5cb8ca7f1eb3  pigway_frame_flow/providers/oauth.py
 abff8ee4b4eb1575451bcd5addf54451056af665d7aaa90173b5ed69a75a4d8e  pigway_frame_flow/providers/photo_names.py
 7d6fd8ff3ae99798b26d7a82644353e2c9ce5439e18c64393dc261c395ac6f4c  pigway_frame_flow/providers/photo_orientation.py
-322cf299b1811b61636771b925aacfd57aa1cab0b0d84a245b70a2989eda66c0  pigway_frame_flow/providers/photo_sources.py
+885d1945dacd611143eb6992da4621ce32ae304d80514f150d55318bdcb10e0f  pigway_frame_flow/providers/photo_sources.py
 114adfb3fcd1ab050c1dd2f1fff9d91fdde192b8eced907dee3bc8086037e13d  pigway_frame_flow/providers/photos_cache.py
 119427bc435ec8d4c91114713f37d07f22067eaeec391261d1441a1436baf5e0  pigway_frame_flow/providers/poetry.py
 c44bf2b4a3776bebe3689b251ae3e8c352a43088829ae8c3f6fd379b64dea05e  pigway_frame_flow/providers/synology_photos.py
 7dfc5eab241122c4758d8b0c027369049231451dc8e0e1b49f7da56532a8e87d  pigway_frame_flow/providers/weather.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/renderers/__init__.py
 ce1e3d9dd7d8dc8d76d6206ab9cd05974bd2e81e1bbf28711f4b461332bf9236  pigway_frame_flow/renderers/frame_geometry.py
-34a22709b300e7e36813d37ce449cebe5a5051bf6711c2c28f59a649b5e0bdc7  pigway_frame_flow/renderers/images.py
+e80029d9edc781e54e523570940110c948a0b0e564dcacf64f2fe1425f4509ea  pigway_frame_flow/renderers/images.py
 b70197edc25101b7ee73434b253ae947cddc8a9d3e55545369ac7189e117b2a2  pigway_frame_flow/renderers/photo_caption.py
 241f7d80997a6b6c7d421723d5375d4890f64eea8c70680abefb0fa5d15b9502  pigway_frame_flow/renderers/photo_layout.py
 d36258296d04b6575d78dd9831f8d3f66cf8b1e9182e2e90a589d10fa0067a04  pigway_frame_flow/renderers/templates.py
@@ -106,7 +112,7 @@ ee80352e10eb871293bd8700837fab8d5f2e0da777d22e32811e935cf7572edc  pigway_frame_f
 d54facc006da1345a150780c414830efaa2e0ab75fa0c9673cf5d39e912472b1  pigway_frame_flow/scheduler/upload_retries.py
 77464a08816507a2423f08327c7767a9c019f55ea8f232856fa647e72e1e0246  pigway_frame_flow/settings.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/storage/__init__.py
-36cfc19b9583809f59a2276da3ba0f023a747013b6903d3a11fbb5941931681a  pigway_frame_flow/storage/database.py
+2c306ca452b15588b83f15df46a39d33564954519b941690f3d07a75147f3f1e  pigway_frame_flow/storage/database.py
 44c0c47d852ffd80cb05969965ee216479c1047daffabf9c3bdc8fe2b036db12  pigway_frame_flow/templates/calendar.json
 1b01fcda4b1cba11c3b152dfc2223d4119f1879ddd0b7eaf6a2e2731a6f6bf6d  pigway_frame_flow/templates/collage.json
 7bfe623e0569beae25b44261d949679c95d42c8bd095ef6b5cca25cf1b0d4c40  pigway_frame_flow/templates/daily-dashboard.json
@@ -116,29 +122,33 @@ f9e777980ea5bb3ea8fb2357f23530802811ea2674d25100af9b728cbc9f83a9  pigway_frame_f
 8f37296f52a88c11a000a5a0767310354550da34e1d4c0c7260393ec00cd0d9b  pigway_frame_flow/templates/quote.json
 82c17f4e7eaac95483592add181f549186dea9d7c0375fa9cad3554e3ccd1794  pigway_frame_flow/templates/system-alert.json
 d6f705b9d183b57d50759e283db2161f8493c4e3969459e74da635252014c925  pigway_frame_flow/templates/weather.json
-c43faa235848bec6370d7a3d8a7b3475cbd8eb4a6e494518dfaf160ca8f77bfa  pigway_frame_flow/web/app.js
+26294166cdf50cd41885b5e71d1314b2e885b212e1efe7496d401d424b2beda4  pigway_frame_flow/web/app.js
+f332fac63f611572597812a06ae0cc266a59e5677efda0d6e9b6925acf9f9309  pigway_frame_flow/web/apple-touch-icon.png
 d7d55b06ead173b4c23a277fa39800cadfc18f1163c500e8617cfc1f4ee0dea9  pigway_frame_flow/web/extensions.js
-fe19e508ad60fab0ab4ca61f5d966f8340143e89f1572de00e78b3f1fed8384b  pigway_frame_flow/web/features.js
-3c4e3be6321d40547d45724fc3c54af090ebbbc2a41dec717966596577c72c5d  pigway_frame_flow/web/i18n.js
-d4518595bc39adfd88d908f98c8c14c02ffbc67a4289003e792b2ceade2838dd  pigway_frame_flow/web/index.html
-0609e796b5ca8346405b1bb6e65ac9f88ee163f7a93024d96d54d4e6ab96ba41  pigway_frame_flow/web/style.css
+94558dbf524a1068e83283eb814c1b1501512d4b7e75e092b52e9aabfea720e7  pigway_frame_flow/web/favicon.ico
+0fa494a3fbd456c754bbea3f7f050be139e32e3b42b09a1ed953094087437210  pigway_frame_flow/web/favicon.svg
+4c7a6d81a4397896e5dcca9020e0a162e60116ff05a840f161834afdf6ea54c5  pigway_frame_flow/web/features.js
+4995020f673252abfd745ac8a1a6e9c5081cf9bfa89dd4b7d1ab30a41e0b6eb9  pigway_frame_flow/web/i18n.js
+3f241f7180861aac148f4713e1538178e252b375172759e7d6bfdfa84042236b  pigway_frame_flow/web/index.html
+0fa494a3fbd456c754bbea3f7f050be139e32e3b42b09a1ed953094087437210  pigway_frame_flow/web/logo-symbol.svg
+ff769c592cc616a983fdf6e92114ebe3779cf8f40a2a7bc235687e7cbdfdaed0  pigway_frame_flow/web/style.css
 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  pigway_frame_flow/web/swagger-LICENSE
 050bc415ee7048dcd881682678f720264e7da5e373f7461d7c58c755305255f7  pigway_frame_flow/web/swagger-ui-bundle.js
 1ac324f7dcd27e4b9386b4bd6421271ec147e922a22c05ba24b11515e9aa6321  pigway_frame_flow/web/swagger-ui.css
-da96be4eeb3b57f6805ca766919e3899968179f1e7e6a5cb25dbabfd13bc1569  pyproject.toml
+0d444fe33713346788104b3473c4b413fd261e0abda77dae6cf174442b71812c  pyproject.toml
 d34ac82e4c3feacd38546aa2f0a4491ab17ddbf3ad8f489375783166d78923f0  requirements.lock
-ae264ad19391bb2515def85963f39458cfa75a8611ff54e5329106c35bd8cc6e  scripts/build-verify.sh
+008af5f4adf616c86e805febc016faad60be0008abf5dddad6e955f1d03606cf  scripts/build-verify.sh
 43e8345ac5f29c2a5d1fa751c0e7c963b00b5391817393541e72c52919f0f2b4  scripts/check-compose-remote.py
 8186d4d9c2542d42d786404b096fbbdee22e4c74edae78ddebab5bd3f632764c  scripts/ci-audit.py
 b0ec44fba0adfceca3655628021683030469be77c9e303c3f5cf830e8fd0cee3  scripts/ci-compose-verify.py
 6ebe82488d7eb2f10f69cf8bf4ed4e1ee272a216413fc5be1329f05889ed49a7  scripts/ci-install.py
-a11e660a0343f2631c1a3dd0aa28471db827fb1f43d1af4217f51209aa3afe32  scripts/create-account.py
+eb94843315f0671ca14fac66fc0c6e7380866f28dc822cce14312fa548bb5c82  scripts/create-account.py
 cdabf30144ea089ae8e64228f6762951f53d4fe8c191673fb5676331d249473d  scripts/migrate-photos-api.py
 80813607835c19d321085fac4cabb17d865d98ed62a09b7f45195ac48bec94a8  scripts/package-nas.py
 b0b877cfbb2bdf830e2e41097c2057538bb9d0b61a3c39952fe505d910cd5c29  scripts/persistence-check.py
 b7247c5590fe17ae461311f2fbdbeda0daa8a34c0804cef22a314c7ff8f4c389  scripts/production-deploy.py
 11627ecbd8a3be01aa079bdf6166b4368e670f5ad4a165b5971754b8187bbc2c  scripts/run_local.py
-792dafe1ffb2be6a50aba549e642aa95357469ac1ec94a04bdc93a0f419d5f63  scripts/server-release.py
+5a0f8560d44352f2c5595875455ab1b2397d4eb8158a8160b5587a89a934f712  scripts/server-release.py
 1fc16c43485a60a05012322cb1e4a219309dbd7e11f002f510602beea743ce30  scripts/smoke-test.py
 1236d3b2d27559cbe73a27dcf56248ef3c60404c6fb21453caa7225570d4ac45  scripts/ui-audit-regressions.cjs
 57a79a534a71442f5e3a70ed9ff96f426007d9f6dd0bb9b1f5d79eac773d2254  scripts/ui-auto-collage.cjs
@@ -148,8 +158,8 @@ b7247c5590fe17ae461311f2fbdbeda0daa8a34c0804cef22a314c7ff8f4c389  scripts/produc
 f981da8a8b4a043b4d39686feadd0e107e008c4e9e6804c45b92607777d2dbbc  scripts/ui-gallery-current.cjs
 01991b94630c9b4af9f52d304b3b7e7b121c59e32d5765f778b53d238cbc6c06  scripts/ui-gallery-destinations.cjs
 bc47ba7a196d84a155d9df5f0e2e23e892256979faa435e01b0a63816562fa01  scripts/ui-gallery-stars.cjs
-02bae6aea8e9b6aef99afc690ad6ddf1fe796501fd83667109cedfe67d5c2586  scripts/ui-history-layout.cjs
-cb0ccb04e087e2117f2a2e7ebe7f1a6b116e39e2bfc197ea996675ef628c98ae  scripts/ui-history-localization.cjs
+8260a11478e23f63bc56c119205a89df04efe7c8a9bfb25b80db24aa56fd302b  scripts/ui-history-layout.cjs
+86cf401ffb8b78691b6dca0851925af3b3107acfffd6943d78027ca4e9a54df7  scripts/ui-history-localization.cjs
 1f87c8b0c6d403c96bf91ca62b6679d1ccdfa3d8cca3f13a006d73f669fe7b09  scripts/ui-image-loading.cjs
 742197504264a547bcf5f121ed7fae447d8d31f51672d41278b4b984e94b5129  scripts/ui-integrations.cjs
 66a12251ea36f372072923ee0b8c7bfebac222fe1dbb702b22242a3859512a9a  scripts/ui-interval-schedule.cjs
@@ -169,11 +179,11 @@ d390c1c9a76ddc167a17bfd7afb0bd1a7169809c8a0b30a26a5be4d18c3032de  scripts/ui-pro
 e474740bdb7dbe0617f7c6b170ada918e51f5eed8edbb9c2c47c4590a5dc2359  scripts/verify-photos-api-container.py
 b7816947e33a77997a4dd7d595ce385081fc578b2821aedb859277c3b490bf07  scripts/verify-photos-api.py
 d4f04e4c8f51c56aa21389d60115ecd1dda384da444dfd4d40237314fb51e3ea  tests/conftest.py
-41f128b9bf09fd160b8e99f3c811b73443b765b019c71306ada3dc18b83a31ca  tests/contract.json
-c44080785bb2cca54bb17ac9e25f2e91a36839688bc70e40faecaea42d75e9f8  tests/schema-contract.json
-14a7c56c40ea4b520585c20341b3ec70fa3ba52518144a10ba3494ceceb30758  tests/test_accounts.py
+964a29221c6f7a4185067cb686e1ea003b99ce4609d6fb4ee4bacb70c9fe5ce8  tests/contract.json
+86aba7819e70b6ea9372eecc17ab5dfee3aa433e38417ebe81785d3450b4ad0d  tests/schema-contract.json
+23ffc7413f8388648c9d52d3c8f56e2966b73ca1bdc5e209e6c15469c790edba  tests/test_accounts.py
 e87ce325c8260f96e586b20697ab0bac71058918ba73f7412eb482364f83f73e  tests/test_ai_images.py
-94c01e6d8bdbfffbff72edb91823eaf39a325ad8782aba1d8e2804402e256aec  tests/test_api.py
+a6edb781f4d081b2db45ffe2b02eed52a10f9b87a70e1e201b5d2f7c6813b93b  tests/test_api.py
 24fca799b0f5e33c800c6310764b18f6b39fc210be769684171388cf14b95746  tests/test_audit_regressions.py
 7001a2209473e6f6bf1050d33212985f63f4844defeb5df8e75d9f2a96c0d83c  tests/test_auto_collage.py
 f267ebcdb3cf1fcb01ef9fd9ef7c5c8c4daca11d02543f84bfbe56359f35b78a  tests/test_ci_audit.py
@@ -186,6 +196,8 @@ fc7a3b37e43ae6716c3afeeeddc0631c932175d527bd8adfea6e5e0acb166311  tests/test_con
 f5d737520934371fa8291727458285ccbc6285d8612f286e424c0f0ea6c34666  tests/test_extensions.py
 f695398aabf0ef7a5c86a23bef44421a09eed8b24c655987d87cd793df6a8a32  tests/test_external_photo_sources.py
 2ab265986f89df625b8e9c8e057ffa2e421e1c6e9bb02884b355b1b71cb918f7  tests/test_gallery_thumbnail.py
+5dc4027bcdad63c4a3e02c7735e6b8445c69edb43f2a3c0cd8902ef6aa1c6342  tests/test_history_images.py
+1f548f3ac8023da49c3cfd1e61ed986d949229e67e5b34b5e4947852ce3b5ca4  tests/test_history_management.py
 cbc44ca3bd0eab93b39f0aabfe5c9d923105f4556df7fd7b86593c06daddcae5  tests/test_ical.py
 787bb5ca8a03b8c94496b00e5a21957dea756b9ba1a4daf354b9e27a5f56d7ef  tests/test_images.py
 95892c597f80aed1e5217c81ce187c3eae09a18542093c02c97fd2d950cc76c6  tests/test_interval_schedule.py
@@ -199,6 +211,7 @@ cbc44ca3bd0eab93b39f0aabfe5c9d923105f4556df7fd7b86593c06daddcae5  tests/test_ica
 cad91937e8429647319cd01fd1925132b7afe057d5420be9586c5fe63f79e498  tests/test_photo_failures.py
 2bfc64fe11c882dd7de0ad0d9cc5d73a3f5a3394771adc84e7b010243a452a9c  tests/test_photo_orientation.py
 f14bad45534041ff0b7dead21d2952ec9d6c60e9f718ab5393bdf5a47b2a6d3e  tests/test_photo_paths.py
+3138c696c64d0e67d0cb03b18b79b0d0e1a4217f391231af27941a9e560c8050  tests/test_photo_preferences.py
 64117766bf85dbd2a5fac77a55ba24303c1067d5e7d92571385210816dd3e85c  tests/test_photo_resolution.py
 8226d48f02aadcc60b7d951dc60808d559891d64bf7de7f434731dcf0a90cd44  tests/test_photo_sources.py
 1e5f544dd4abb4e360efa7d7057f9ccafef7c2e15d19d1eb68db059f5bf55a90  tests/test_photo_watermark.py
@@ -207,10 +220,10 @@ f14bad45534041ff0b7dead21d2952ec9d6c60e9f718ab5393bdf5a47b2a6d3e  tests/test_pho
 ab773ca6868ec007786e7142d5425663a5c8da35b9aa90837ac8e46b51e51507  tests/test_production_bootstrap.py
 fee152c5f6eaeda712d38cf88a79213f5e885ba323eb15dfa5a12cf4c88028c3  tests/test_production_deploy.py
 f0601f5ed89e8a14a4584a9683611aa7510a964f50a642348b8ab6c62df72278  tests/test_publication_security.py
-0ed189d3469097aa7538325d418425e0c7a3ccc8a285bcf4c2ac10658af4b0df  tests/test_recovery.py
-072e8ca2fa68ca73fb078b107ced96ea683652410b286017db883c97608d78f6  tests/test_retention.py
+915992a2ef9aeb8ae5c688d5dd50c6acd37ba726eb5aff1a0df991ffe374d94e  tests/test_recovery.py
+e0a426eed6f1b6f59207b4de7d8286b6852550bfa28ad30e20f7e911ad9865ee  tests/test_retention.py
 ab2cd30163453fe571b55c30cb26dc047a104a536ec01d2c64aa2bc91996ba11  tests/test_scheduler.py
-5f25f608f13f96b245d6963c02a98add679c6e7d70d398ebb5c3c49b38fbeda8  tests/test_server_release.py
+0cccc08adf35a06dbf704eb5c35966bc1c3de0ce39d3014efd7ca751253ce79f  tests/test_server_release.py
 a7ae1b4a64bfcbcf2b7ff795b30ba91db24ee2ad7544073dca2bf43d021cd266  tests/test_smoke_dependencies.py
 2624fb6ca01f32d93499d7d771144dcaa2850e5f77b2ac3b7b566891b5e9d283  tests/test_synology_photos.py
 ca98469f6a6b8b49c36a00657ea1a81775c3496e1fbdd5e38eb4d5298b5936b4  tests/test_synology_photos_api.py
@@ -7,6 +7,10 @@ locked Python dependencies, and `font-noto-cjk` for Chinese rendering. APK
 repository signatures and offline wheel SHA256 checks remain enabled.
 Production uses `scripts/build-verify.sh`; CI uses `scripts/ci-compose-verify.py`.
 Both build the same Dockerfile with BuildKit and `docker compose build --pull`.
+For a CI host that cannot reach Docker Hub, the optional `CI_PYTHON_BASE`
+repository variable passes a registry mirror reference through the build script.
+Keep the same official Python image digest; an unset variable preserves the
+Dockerfile default. This setting does not change the shared Docker daemon.

 `ALPINE_MIRROR` accepts a mirror host (without scheme or path), defaulting to
 `dl-cdn.alpinelinux.org`. For mainland-China builds:
@@ -29,6 +33,17 @@ resources and are not runtime mounts or dependencies.

 ### CI with a host Docker socket

+The managed CI runner runs on Ubuntu Server; the NAS no longer executes jobs.
+It retains `ubuntu-latest` compatibility and fixed runner/job image digests,
+accepts one job at a time, and limits each task container to 4 CPUs and 8 GiB.
+The runner's private state resides on the guarded business disk. Its systemd
+service checks the mount identity before starting. Registration credentials are
+supplied through a temporary file and removed after registration; the daemon
+container does not retain the reusable registration token in its environment.
+Keep the current runner and job images even when no task is executing: they are
+active CI dependencies. Only trusted repository events may reach this runner's
+Docker socket; CI does not automatically deploy production or write to frames.
+
 Run `python scripts/ci-compose-verify.py` after loading the build mirror profile.
 The script derives a temporary Compose document from production settings, with
 an absolute client-side build context, a UUID project name, a unique CI image
@@ -40,7 +55,7 @@ owned `/data` and `/config` directories; the service remains UID/GID 10333.

 Build contexts are sent by the Docker client, so the job workspace can remain
 inside the job container. Runtime storage is managed by the daemon; no matching
-NAS host `/workspace` directory is needed. HTTP readiness and the unmodified
+Docker host `/workspace` directory is needed. HTTP readiness and the unmodified
 nine-endpoint smoke script run inside the service with `compose exec -T`.
 Restart is followed by another readiness check and the same smoke test.

@@ -81,3 +96,7 @@ If dependency installation fails, the always() cleanup step still executes.
 It skips the Python/PyYAML cleanup script when no CI Compose manifest exists,
 as no Docker verification resources have been created at that point.

+
+### Verified prebuilt production image
+
+When the production host cannot reach the registry, build the complete Dockerfile in a trusted build environment and transfer it with `docker image save` / `docker image load`. Supply the immutable `sha256:` image ID privately as `FRAME_FLOW_PREBUILT_IMAGE_ID` to `scripts/server-release.py`. The expected version/commit tag must already exist. The script checks the ID, version and revision labels, then verifies runtime source and license hashes in an isolated container without production mounts before switching the service. Existing storage checks, backups, post-deployment verification and rollback remain in effect.
@@ -4,7 +4,7 @@ Runtime keys, passwords, sessions, private photos, databases and local `.env` fi
 must remain outside Git. Examples use documentation-only addresses and identities.
 Personal deployment reports and screenshots are excluded from public history.

-The Gitea NAS Docker runner accepts trusted repository events only. GitHub mirrors
+The Gitea Server Docker runner accepts trusted repository events only. GitHub mirrors
 use the separate community workflow on GitHub-hosted disposable runners, with
 read-only repository permissions and no deployment configuration. External fork PRs
 are not executed on this runner; maintainers must review them before copying changes
@@ -0,0 +1,15 @@
+# PIGWAY 品牌资源 / Brand assets
+
+来源：PIGWAY Brand Production v1.1 正式交付包。图形、颜色与比例保持原文件，不使用重绘、滤镜或替代字标。
+
+- `pigway-logo.svg`：正式 Web 图形标。
+- `pigway-logo.png`：正式 256px 透明图形标，用于项目介绍页。
+- `pigway-avatar.png`：正式 512px 平台图标，用于 Tea 项目头像。
+
+本项目的产品名称保持独立。品牌物料版本不跟随软件版本变化；网页小图标使用同一正式包的 Favicon 和 Apple Touch Icon。
+
+## SHA-256
+
+- `0fa494a3fbd456c754bbea3f7f050be139e32e3b42b09a1ed953094087437210`  `pigway-logo.svg`
+- `da6734d8a23305f6254c0936dadff4ec34977b4c934f5067186423c8cfce3fc7`  `pigway-logo.png`
+- `f709156217c798f6b6230dae1f341373e0814a67ab90e881401da577f52ec3d3`  `pigway-avatar.png`
@@ -2,7 +2,7 @@
  "openapi": "3.1.0",
  "info": {
    "title": "PIGWay Frame Flow API",
-    "version": "0.1.21"
+    "version": "0.1.28"
  },
  "paths": {
    "/api/v1/devices/{device_id}/widgets/selection": {
@@ -14118,6 +14118,732 @@
          }
        }
      }
+    },
+    "/api/v1/operation-history": {
+      "get": {
+        "tags": [
+          "Operations"
+        ],
+        "summary": "List History",
+        "operationId": "list_history_api_v1_operation_history_get",
+        "security": [
+          {
+            "HTTPBearer": []
+          },
+          {
+            "AccountSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "page",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 1,
+              "title": "Page"
+            }
+          },
+          {
+            "name": "page_size",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "maximum": 100,
+              "minimum": 1,
+              "default": 20,
+              "title": "Page Size"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/OperationStatus"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          },
+          {
+            "name": "action",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 80,
+              "default": "",
+              "title": "Action"
+            }
+          },
+          {
+            "name": "device_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 120,
+              "default": "",
+              "title": "Device Id"
+            }
+          },
+          {
+            "name": "q",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 200,
+              "default": "",
+              "title": "Q"
+            }
+          },
+          {
+            "name": "start",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "format": "date"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Start"
+            }
+          },
+          {
+            "name": "end",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "format": "date"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "End"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HistoryPage"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Content Too Large"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unprocessable Content"
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Operations"
+        ],
+        "summary": "Delete History",
+        "operationId": "delete_history_api_v1_operation_history_delete",
+        "security": [
+          {
+            "HTTPBearer": []
+          },
+          {
+            "AccountSession": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/HistoryDelete"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Content Too Large"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unprocessable Content"
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        }
+      }
+    },
+    "/api/v1/assets/{asset_id}/exclusion": {
+      "put": {
+        "tags": [
+          "Images"
+        ],
+        "summary": "Exclude Asset",
+        "operationId": "exclude_asset_api_v1_assets__asset_id__exclusion_put",
+        "security": [
+          {
+            "HTTPBearer": []
+          },
+          {
+            "AccountSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "asset_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "title": "Asset Id"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ImageExclusion"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Asset"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Content Too Large"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unprocessable Content"
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        }
+      }
+    },
+    "/api/v1/photo-sources/{source_id}/preferences": {
+      "put": {
+        "tags": [
+          "Photo sources"
+        ],
+        "summary": "Source Preference",
+        "operationId": "source_preference_api_v1_photo_sources__source_id__preferences_put",
+        "security": [
+          {
+            "HTTPBearer": []
+          },
+          {
+            "AccountSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "title": "Source Id"
+            }
+          },
+          {
+            "name": "device_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Device Id"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PhotoPreference"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Content Too Large"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Unprocessable Content"
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        }
+      }
    }
  },
  "components": {
@@ -14203,6 +14929,11 @@
      },
      "Asset": {
        "properties": {
+          "excluded": {
+            "type": "boolean",
+            "title": "Excluded",
+            "default": false
+          },
          "source_path": {
            "anyOf": [
              {
@@ -14304,7 +15035,9 @@
            "enum": [
              "delete",
              "star",
-              "unstar"
+              "unstar",
+              "exclude",
+              "include"
            ],
            "title": "Action"
          }
@@ -15227,7 +15960,7 @@
          "version": {
            "type": "string",
            "title": "Version",
-            "default": "0.1.21"
+            "default": "0.1.23"
          }
        },
        "type": "object",
@@ -16216,6 +16949,16 @@
      },
      "PhotoItem": {
        "properties": {
+          "starred": {
+            "type": "boolean",
+            "title": "Starred",
+            "default": false
+          },
+          "excluded": {
+            "type": "boolean",
+            "title": "Excluded",
+            "default": false
+          },
          "id": {
            "type": "string",
            "title": "Id"
@@ -17490,7 +18233,7 @@
          "version": {
            "type": "string",
            "title": "Version",
-            "default": "0.1.21"
+            "default": "0.1.23"
          },
          "api_version": {
            "type": "string",
@@ -17733,6 +18476,107 @@
          "catalog"
        ],
        "title": "WidgetState"
+      },
+      "HistoryPage": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/Operation"
+            },
+            "type": "array",
+            "title": "Items"
+          },
+          "total": {
+            "type": "integer",
+            "title": "Total"
+          },
+          "page": {
+            "type": "integer",
+            "title": "Page"
+          },
+          "page_size": {
+            "type": "integer",
+            "title": "Page Size"
+          }
+        },
+        "type": "object",
+        "required": [
+          "items",
+          "total",
+          "page",
+          "page_size"
+        ],
+        "title": "HistoryPage"
+      },
+      "HistoryDelete": {
+        "properties": {
+          "operation_ids": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "maxItems": 200,
+            "minItems": 1,
+            "title": "Operation Ids"
+          }
+        },
+        "type": "object",
+        "required": [
+          "operation_ids"
+        ],
+        "title": "HistoryDelete"
+      },
+      "ImageExclusion": {
+        "properties": {
+          "excluded": {
+            "type": "boolean",
+            "title": "Excluded"
+          }
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "required": [
+          "excluded"
+        ],
+        "title": "ImageExclusion"
+      },
+      "PhotoPreference": {
+        "properties": {
+          "item_id": {
+            "type": "string",
+            "maxLength": 4096,
+            "minLength": 1,
+            "title": "Item Id"
+          },
+          "starred": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Starred"
+          },
+          "excluded": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Excluded"
+          }
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "required": [
+          "item_id"
+        ],
+        "title": "PhotoPreference"
      }
    },
    "securitySchemes": {
@@ -14,8 +14,14 @@ from fastapi.openapi.docs import get_swagger_ui_html
 from fastapi.responses import FileResponse, JSONResponse, Response
 from starlette.exceptions import HTTPException

+from pigway_frame_flow.api.history import install_history
 from pigway_frame_flow.core.accounts import install_accounts, seed_accounts
 from pigway_frame_flow.core.auth import require, seed_client
+from pigway_frame_flow.core.photo_preferences import (
+    annotate,
+    ensure_compatible,
+    set_flags,
+)
 from pigway_frame_flow.core.registry import DeviceRegistry
 from pigway_frame_flow.display.service import DisplayService
 from pigway_frame_flow.errors import ErrorCode as E
@@ -42,12 +48,14 @@ from pigway_frame_flow.models import (
    Health,
    History,
    ImageContent,
+    ImageExclusion,
    ImageStar,
    ImageURLConfig,
    Job,
    JobInput,
    Operation,
    Options,
+    PhotoPreference,
    PhotoSourceContent,
    Playlist,
    PlaylistInput,
@@ -126,12 +134,13 @@ def create_app(settings=None, start_worker=True):
    app = FastAPI(
        title="PIGWay Frame Flow API",
        docs_url=None,
-        version="0.1.21",
+        version="0.1.28",
        lifespan=lifespan,
        responses=error_responses,
    )
    install_extensions(app, service)
    install_accounts(app, db)
+    install_history(app, service)
    app.state.service = service
    app.state.worker_enabled = start_worker
    app.state.scheduler = scheduler
@@ -623,6 +632,10 @@ def create_app(settings=None, start_worker=True):
                409,
            )
        path.unlink(missing_ok=True)
+        db.execute(
+            "DELETE FROM photo_preferences WHERE source_id='@assets' AND item_id=?",
+            (asset_id,),
+        )
        db.execute("DELETE FROM asset_metadata WHERE asset_id=?", (asset_id,))
        db.execute("DELETE FROM asset_sources WHERE asset_id=?", (asset_id,))
        db.execute("DELETE FROM assets WHERE id=?", (asset_id,))
@@ -635,16 +648,30 @@ def create_app(settings=None, start_worker=True):
        dependencies=[Depends(require("images:write"))],
    )
    def star_asset(asset_id: str, payload: ImageStar):
+        with service.lock:
+            with db.transaction() as connection:
+                current = assets.info(asset_id)
+                ensure_compatible(payload.starred, current["excluded"])
+                connection.execute(
+                    "INSERT INTO asset_metadata(asset_id,starred) VALUES(?,?) ON CONFLICT(asset_id) DO UPDATE SET starred=excluded.starred",
+                    (asset_id, int(payload.starred)),
+                )
+                connection.execute(
+                    "UPDATE image_retention SET starred=? WHERE (device_id,image_id) IN (SELECT device_id,image_id FROM image_sources WHERE asset_id=?)",
+                    (int(payload.starred), asset_id),
+                )
+            return assets.info(asset_id)
+
+    @app.put(
+        "/api/v1/assets/{asset_id}/exclusion",
+        response_model=Asset,
+        tags=["Images"],
+        dependencies=[Depends(require("images:write"))],
+    )
+    def exclude_asset(asset_id: str, payload: ImageExclusion):
        with service.lock:
            assets.info(asset_id)
-            db.execute(
-                "INSERT INTO asset_metadata(asset_id,starred) VALUES(?,?) ON CONFLICT(asset_id) DO UPDATE SET starred=excluded.starred",
-                (asset_id, int(payload.starred)),
-            )
-            db.execute(
-                "UPDATE image_retention SET starred=? WHERE (device_id,image_id) IN (SELECT device_id,image_id FROM image_sources WHERE asset_id=?)",
-                (int(payload.starred), asset_id),
-            )
+            set_flags(db, "@assets", asset_id, excluded=payload.excluded)
            return assets.info(asset_id)

    @app.post(
@@ -659,6 +686,10 @@ def create_app(settings=None, start_worker=True):
                try:
                    if payload.action == "delete":
                        delete_asset(id)
+                    elif payload.action in {"exclude", "include"}:
+                        exclude_asset(
+                            id, ImageExclusion(excluded=payload.action == "exclude")
+                        )
                    else:
                        star_asset(id, ImageStar(starred=payload.action == "star"))
                    results.append({"asset_id": id, "status": "completed"})
@@ -780,13 +811,38 @@ def create_app(settings=None, start_worker=True):
            source_id, refresh=refresh, target_size=size
        )
        return {
-            "items": items[offset : offset + limit],
+            "items": annotate(db, source_id, items[offset : offset + limit]),
            "total": len(items),
            "offset": offset,
            "limit": limit,
            "catalog_limit": service.photo_sources.get(source_id).catalog_limit,
        }

+    @app.put(
+        "/api/v1/photo-sources/{source_id}/preferences",
+        tags=["Photo sources"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def source_preference(
+        source_id: str, payload: PhotoPreference, device_id: str | None = None
+    ):
+        source = service.photo_sources.get(source_id)
+        size = (1200, 1600)
+        if source.orientation == "auto":
+            size = frame_canvas(
+                registry.get(device_id or settings.device_id).device().display
+            )
+        items = service.photo_sources.catalog(source_id, target_size=size)
+        if not any(item["id"] == payload.item_id for item in items):
+            raise FlowError(E.NOT_FOUND, "Photo is not in this source", 404)
+        return set_flags(
+            db,
+            source_id,
+            payload.item_id,
+            starred=payload.starred,
+            excluded=payload.excluded,
+        )
+
    @app.delete(
        "/api/v1/devices/{device_id}/images/{image_id}",
        response_model=Accepted,
@@ -842,7 +898,7 @@ def create_app(settings=None, start_worker=True):
        return [
            service.operation(x["id"])
            for x in db.all(
-                "SELECT id FROM operations WHERE (? OR client_id=?) ORDER BY created_at DESC LIMIT ?",
+                "SELECT id FROM operations WHERE (? OR client_id=?) AND NOT EXISTS (SELECT 1 FROM hidden_history h WHERE h.operation_id=operations.id) ORDER BY created_at DESC,rowid DESC LIMIT ?",
                ("admin" in request.state.permissions, request.state.client_id, limit),
            )
        ]
@@ -1001,7 +1057,10 @@ def create_app(settings=None, start_worker=True):
        dependencies=[Depends(require("history:read"))],
    )
    def history(limit: int = Query(default=100, ge=1, le=200)):
-        return db.all("SELECT * FROM history ORDER BY id DESC LIMIT ?", (limit,))
+        return db.all(
+            "SELECT * FROM history WHERE NOT EXISTS (SELECT 1 FROM hidden_history h WHERE h.operation_id=history.operation_id) ORDER BY id DESC LIMIT ?",
+            (limit,),
+        )

    @app.get(
        "/api/v1/settings",
@@ -1040,7 +1099,7 @@ def create_app(settings=None, start_worker=True):
                    supports_upload=True,
                ),
            ],
-            version="0.1.21",
+            version="0.1.28",
            mock=settings.mock,
            write_enabled=settings.write_enabled,
            api_key_configured=bool(settings.api_key)
@@ -1313,6 +1372,10 @@ def create_app(settings=None, start_worker=True):
            "i18n.js",
            "swagger-ui-bundle.js",
            "swagger-ui.css",
+            "favicon.svg",
+            "favicon.ico",
+            "apple-touch-icon.png",
+            "logo-symbol.svg",
        ]:
            raise FlowError(E.NOT_FOUND, "Resource not found", 404)
        return FileResponse(root / filename)
@@ -0,0 +1,121 @@
+"""Paginated history without removing operation receipts used by other services."""
+
+from datetime import UTC, date, datetime, time, timedelta
+from zoneinfo import ZoneInfo
+
+from fastapi import Depends, Query, Request
+from pydantic import BaseModel, Field
+
+from pigway_frame_flow.core.auth import require
+from pigway_frame_flow.errors import ErrorCode as E
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.models import Operation, OperationStatus
+
+
+class HistoryPage(BaseModel):
+    items: list[Operation]
+    total: int
+    page: int
+    page_size: int
+
+
+class HistoryDelete(BaseModel):
+    operation_ids: list[str] = Field(min_length=1, max_length=200)
+
+
+def install_history(app, service):
+    db = service.db
+
+    @app.get(
+        "/api/v1/operation-history",
+        response_model=HistoryPage,
+        tags=["Operations"],
+        dependencies=[Depends(require("history:read"))],
+    )
+    def list_history(
+        request: Request,
+        page: int = Query(1, ge=1),
+        page_size: int = Query(20, ge=1, le=100),
+        status: OperationStatus | None = None,
+        action: str = Query("", max_length=80),
+        device_id: str = Query("", max_length=120),
+        q: str = Query("", max_length=200),
+        start: date | None = None,
+        end: date | None = None,
+    ):
+        if start and end and start > end:
+            raise FlowError(
+                E.INVALID_REQUEST, "Start date must not follow end date", 422
+            )
+        clauses = [
+            "NOT EXISTS (SELECT 1 FROM hidden_history h WHERE h.operation_id=o.id)"
+        ]
+        args: list = []
+        if "admin" not in request.state.permissions:
+            clauses.append("o.client_id=?")
+            args.append(request.state.client_id)
+        for column, value in [
+            ("status", status),
+            ("action", action),
+            ("device_id", device_id),
+        ]:
+            if value:
+                clauses.append(f"o.{column}=?")
+                args.append(value)
+        if q.strip():
+            clauses.append(
+                "instr(lower(o.id||' '||o.request_id||' '||o.client_id||' '||coalesce(o.result,'')),lower(?))>0"
+            )
+            args.append(q.strip())
+        for day, operator, offset in [(start, ">=", 0), (end, "<", 1)]:
+            if day:
+                boundary = datetime.combine(
+                    day, time(), ZoneInfo("Asia/Shanghai")
+                ) + timedelta(days=offset)
+                clauses.append(f"o.created_at{operator}?")
+                args.append(boundary.astimezone(UTC).isoformat())
+        where = " AND ".join(clauses)
+        # Keep count and rows consistent if a worker finishes or a deletion occurs.
+        with db.lock:
+            total = db.one(
+                "SELECT count(*) AS total FROM operations o WHERE " + where, args
+            )["total"]
+            page = min(page, max(1, (total + page_size - 1) // page_size))
+            rows = db.all(
+                "SELECT o.id FROM operations o WHERE "
+                + where
+                + " ORDER BY o.created_at DESC,o.rowid DESC LIMIT ? OFFSET ?",
+                [*args, page_size, (page - 1) * page_size],
+            )
+            return HistoryPage(
+                items=[service.operation(row["id"]) for row in rows],
+                total=total,
+                page=page,
+                page_size=page_size,
+            )
+
+    @app.delete(
+        "/api/v1/operation-history",
+        tags=["Operations"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def delete_history(payload: HistoryDelete):
+        ids = list(dict.fromkeys(payload.operation_ids))
+        placeholders = ",".join("?" for _ in ids)
+        with db.transaction() as connection:
+            rows = connection.execute(
+                f"SELECT id,status FROM operations WHERE id IN ({placeholders})", ids
+            ).fetchall()
+            if len(rows) != len(ids):
+                raise FlowError(E.NOT_FOUND, "History record not found", 404)
+            if any(
+                row["status"] not in {"COMPLETED", "FAILED", "UNKNOWN"} for row in rows
+            ):
+                raise FlowError(E.CONFLICT, "Running operations cannot be deleted", 409)
+            before = connection.total_changes
+            connection.executemany(
+                "INSERT OR IGNORE INTO hidden_history(operation_id) VALUES(?)",
+                [(key,) for key in ids],
+            )
+            deleted = connection.total_changes - before
+        return {"deleted": deleted}
@@ -21,16 +21,22 @@ cookie = APIKeyCookie(name=COOKIE, auto_error=False, scheme_name="AccountSession
 def password_hash(password: str) -> str:
    salt = secrets.token_hex(16)
    digest = hashlib.scrypt(
-        password.encode(), salt=bytes.fromhex(salt), n=16384, r=8, p=1
+        password.encode(), salt=bytes.fromhex(salt), n=16384, r=8, p=5
    ).hex()
-    return f"scrypt${salt}${digest}"
+    return f"scrypt-v2${salt}${digest}"


 def verify_password(password: str, encoded: str) -> bool:
    try:
-        _, salt, expected = encoded.split("$")
+        algorithm, salt, expected = encoded.split("$")
+        if algorithm not in {"scrypt", "scrypt-v2"}:
+            return False
        actual = hashlib.scrypt(
-            password.encode(), salt=bytes.fromhex(salt), n=16384, r=8, p=1
+            password.encode(),
+            salt=bytes.fromhex(salt),
+            n=16384,
+            r=8,
+            p=5 if algorithm == "scrypt-v2" else 1,
        ).hex()
        return hmac.compare_digest(actual, expected)
    except (ValueError, TypeError):
@@ -57,6 +63,7 @@ def seed_accounts(db, config_dir: Path):
    db.execute(
        "CREATE TABLE IF NOT EXISTS users (username TEXT PRIMARY KEY, password_hash TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1)"
    )
+    db.execute("CREATE UNIQUE INDEX IF NOT EXISTS single_browser_account ON users((1))")
    db.execute(
        "CREATE TABLE IF NOT EXISTS sessions (token_hash TEXT PRIMARY KEY, username TEXT NOT NULL, csrf TEXT NOT NULL, expires_at REAL NOT NULL)"
    )
@@ -65,7 +72,13 @@ def seed_accounts(db, config_dir: Path):
    )
    path = config_dir / "accounts.json"
    if path.exists():
-        for user in json.loads(path.read_text()).get("users", []):
+        users = json.loads(path.read_text()).get("users", [])
+        if len(users) > 1:
+            raise ValueError("Only one browser account is supported")
+        for user in users:
+            existing = db.one("SELECT username FROM users LIMIT 1")
+            if existing and existing["username"] != user["username"]:
+                raise ValueError("A browser account already exists")
            db.execute(
                "INSERT OR IGNORE INTO users VALUES(?,?,1)",
                (user["username"], user["password_hash"]),
@@ -83,7 +96,7 @@ def session_user(request: Request):
    )
    if not row or not row["enabled"] or row["expires_at"] <= time.time():
        return None
-    if request.method in {"POST", "PUT", "DELETE"}:
+    if request.method in {"POST", "PUT", "PATCH", "DELETE"}:
        if not hmac.compare_digest(
            request.headers.get("X-CSRF-Token", ""), row["csrf"]
        ):
@@ -94,60 +107,88 @@ def session_user(request: Request):
 def install_accounts(app, db):
    @app.post("/api/v1/auth/login", response_model=AccountView, tags=["Accounts"])
    def login(payload: Login, request: Request, response: Response):
-        identity = hashlib.sha256(
-            (request.client.host if request.client else "unknown").encode()
-        ).hexdigest()
-        attempt = db.one("SELECT * FROM login_attempts WHERE identity=?", (identity,))
-        if attempt and attempt["blocked_until"] > time.time():
-            raise FlowError(
-                E.RATE_LIMITED, "Too many login attempts; try again later", 429
+        with db.lock:
+            # Reject login CSRF before checking credentials. Never trust forwarded hosts.
+            origin = request.headers.get("origin")
+            if request.headers.get("sec-fetch-site") == "cross-site" or (
+                origin and origin != str(request.base_url).rstrip("/")
+            ):
+                raise FlowError(E.FORBIDDEN, "Cross-origin login is not allowed", 403)
+            identity = hashlib.sha256(
+                (request.client.host if request.client else "unknown").encode()
+            ).hexdigest()
+            # Account throttling also applies when an attacker changes source IPs.
+            identities = (
+                identity,
+                "account:" + hashlib.sha256(payload.username.encode()).hexdigest(),
            )
-        row = db.one(
-            "SELECT * FROM users WHERE username=? AND enabled=1", (payload.username,)
-        )
-        # Perform a password calculation even for unknown usernames.
-        fallback = "scrypt$" + "00" * 16 + "$" + "00" * 64
-        valid = verify_password(
-            payload.password, row["password_hash"] if row else fallback
-        )
-        if not row or not valid:
-            failures = (
-                attempt["failures"] if attempt and attempt["blocked_until"] == 0 else 0
-            ) + 1
+            attempts = [
+                db.one("SELECT * FROM login_attempts WHERE identity=?", (key,))
+                for key in identities
+            ]
+            attempt = next(
+                (a for a in attempts if a and a["blocked_until"] > time.time()), None
+            )
+            if attempt and attempt["blocked_until"] > time.time():
+                raise FlowError(
+                    E.RATE_LIMITED, "Too many login attempts; try again later", 429
+                )
+            row = db.one(
+                "SELECT * FROM users WHERE username=? AND enabled=1",
+                (payload.username,),
+            )
+            # Perform a password calculation even for unknown usernames.
+            fallback = "scrypt-v2$" + "00" * 16 + "$" + "00" * 64
+            valid = verify_password(
+                payload.password, row["password_hash"] if row else fallback
+            )
+            if not row or not valid:
+                for key, previous in zip(identities, attempts, strict=True):
+                    failures = (
+                        previous["failures"]
+                        if previous and previous["blocked_until"] == 0
+                        else 0
+                    ) + 1
+                    db.execute(
+                        "INSERT OR REPLACE INTO login_attempts VALUES(?,?,?)",
+                        (key, failures, time.time() + 300 if failures >= 5 else 0),
+                    )
+                raise FlowError(E.UNAUTHORIZED, "Invalid username or password", 401)
+            for key in identities:
+                db.execute("DELETE FROM login_attempts WHERE identity=?", (key,))
+            if row["password_hash"].startswith("scrypt$"):
+                db.execute(
+                    "UPDATE users SET password_hash=? WHERE username=?",
+                    (password_hash(payload.password), row["username"]),
+                )
+            raw, csrf = secrets.token_urlsafe(32), secrets.token_urlsafe(32)
+            lifetime = 30 * 86400 if payload.remember else 12 * 3600
+            db.execute("DELETE FROM sessions WHERE expires_at<=?", (time.time(),))
+            old = request.cookies.get(COOKIE)
+            if old:
+                db.execute(
+                    "DELETE FROM sessions WHERE token_hash=?",
+                    (hashlib.sha256(old.encode()).hexdigest(),),
+                )
            db.execute(
-                "INSERT OR REPLACE INTO login_attempts VALUES(?,?,?)",
-                (identity, failures, time.time() + 300 if failures >= 5 else 0),
+                "INSERT INTO sessions VALUES(?,?,?,?)",
+                (
+                    hashlib.sha256(raw.encode()).hexdigest(),
+                    row["username"],
+                    csrf,
+                    time.time() + lifetime,
+                ),
            )
-            raise FlowError(E.UNAUTHORIZED, "Invalid username or password", 401)
-        db.execute("DELETE FROM login_attempts WHERE identity=?", (identity,))
-        raw, csrf = secrets.token_urlsafe(32), secrets.token_urlsafe(32)
-        lifetime = 30 * 86400 if payload.remember else 12 * 3600
-        db.execute("DELETE FROM sessions WHERE expires_at<=?", (time.time(),))
-        old = request.cookies.get(COOKIE)
-        if old:
-            db.execute(
-                "DELETE FROM sessions WHERE token_hash=?",
-                (hashlib.sha256(old.encode()).hexdigest(),),
+            response.set_cookie(
+                COOKIE,
+                raw,
+                max_age=lifetime if payload.remember else None,
+                httponly=True,
+                samesite="strict",
+                secure=request.url.scheme == "https",
+                path="/",
            )
-        db.execute(
-            "INSERT INTO sessions VALUES(?,?,?,?)",
-            (
-                hashlib.sha256(raw.encode()).hexdigest(),
-                row["username"],
-                csrf,
-                time.time() + lifetime,
-            ),
-        )
-        response.set_cookie(
-            COOKIE,
-            raw,
-            max_age=lifetime if payload.remember else None,
-            httponly=True,
-            samesite="strict",
-            secure=request.url.scheme == "https",
-            path="/",
-        )
-        return AccountView(username=row["username"], csrf_token=csrf)
+            return AccountView(username=row["username"], csrf_token=csrf)

    def current(request):
        row = session_user(request)
@@ -187,9 +228,12 @@ def install_accounts(app, db):
        user = db.one("SELECT * FROM users WHERE username=?", (session["username"],))
        if not verify_password(payload.current_password, user["password_hash"]):
            raise FlowError(E.UNAUTHORIZED, "Current password is incorrect", 401)
-        db.execute(
-            "UPDATE users SET password_hash=? WHERE username=?",
-            (password_hash(payload.new_password), session["username"]),
-        )
-        db.execute("DELETE FROM sessions WHERE username=?", (session["username"],))
+        with db.transaction() as connection:
+            connection.execute(
+                "UPDATE users SET password_hash=? WHERE username=?",
+                (password_hash(payload.new_password), session["username"]),
+            )
+            connection.execute(
+                "DELETE FROM sessions WHERE username=?", (session["username"],)
+            )
        response.delete_cookie(COOKIE, path="/")
@@ -0,0 +1,78 @@
+"""Persistent selection preferences scoped to a library and its stable item ID."""
+
+from pigway_frame_flow.errors import ErrorCode as E
+from pigway_frame_flow.errors import FlowError
+
+
+def ensure_compatible(starred, excluded):
+    if starred and excluded:
+        raise FlowError(
+            E.CONFLICT,
+            "Starred photos cannot be excluded; clear the existing mark first",
+            409,
+        )
+
+
+def flags(db, source_id, item_id):
+    row = db.one(
+        "SELECT starred,excluded FROM photo_preferences WHERE source_id=? AND item_id=?",
+        (source_id, item_id),
+    )
+    return {key: bool(row and row[key]) for key in ("starred", "excluded")}
+
+
+def set_flags(db, source_id, item_id, *, starred=None, excluded=None):
+    with db.transaction() as connection:
+        current = flags(db, source_id, item_id)
+        if source_id == "@assets":
+            meta = db.one(
+                "SELECT starred FROM asset_metadata WHERE asset_id=?", (item_id,)
+            )
+            current["starred"] = bool(meta and meta["starred"])
+        ensure_compatible(
+            current["starred"] if starred is None else starred,
+            current["excluded"] if excluded is None else excluded,
+        )
+        connection.execute(
+            "INSERT INTO photo_preferences(source_id,item_id,starred,excluded) VALUES(?,?,?,?) ON CONFLICT(source_id,item_id) DO UPDATE SET starred=coalesce(?,starred),excluded=coalesce(?,excluded)",
+            (
+                source_id,
+                item_id,
+                int(starred or False),
+                int(excluded or False),
+                None if starred is None else int(starred),
+                None if excluded is None else int(excluded),
+            ),
+        )
+    return flags(db, source_id, item_id)
+
+
+def annotate(db, source_id, items):
+    preferences = {
+        row["item_id"]: row
+        for row in db.all(
+            "SELECT item_id,starred,excluded FROM photo_preferences WHERE source_id=?",
+            (source_id,),
+        )
+    }
+    return [
+        {
+            **item,
+            **{
+                key: bool(preferences.get(item["id"], {}).get(key))
+                for key in ("starred", "excluded")
+            },
+        }
+        for item in items
+    ]
+
+
+def eligible(db, source_id, items):
+    excluded = {
+        row["item_id"]
+        for row in db.all(
+            "SELECT item_id FROM photo_preferences WHERE source_id=? AND excluded=1",
+            (source_id,),
+        )
+    }
+    return [item for item in items if item["id"] not in excluded]
@@ -1,8 +1,10 @@
 """Durable, read-only recovery progress for writes with uncertain outcomes."""

+import json
 from datetime import UTC, datetime
 from uuid import uuid4

+from pigway_frame_flow.errors import ErrorCode
 from pigway_frame_flow.storage.database import encode, now_iso


@@ -71,3 +73,92 @@ class RecoveryMonitor:
        if row:
            row["requires_manual_review"] = row["state"] == "manual_review"
        return row
+
+    def observe_device(self, op, *, device=None, error=None):
+        row = self.db.one("SELECT result FROM operations WHERE id=?", (op["id"],))
+        result = json.loads(row["result"] or "{}")
+        observation = {"checked_at": now_iso()}
+        if device is not None:
+            observation.update(
+                image_id=device.current_content.id,
+                synced=device.current_content.synced,
+                online=device.status == "online",
+                heartbeat=device.last_seen_at,
+            )
+        else:
+            observation["read_error"] = {
+                "code": error.code,
+                **{
+                    k: v
+                    for k, v in error.details.items()
+                    if k
+                    in ("transport_error", "http_status", "attempts", "retry_exhausted")
+                },
+            }
+        samples = result.get("sync_observations", [])
+        if samples:
+            old = samples[-1]
+            changed = {k: v for k, v in old.items() if k != "checked_at"} != {
+                k: v for k, v in observation.items() if k != "checked_at"
+            }
+            if (
+                not changed
+                and (
+                    datetime.now(UTC) - datetime.fromisoformat(old["checked_at"])
+                ).total_seconds()
+                < 60
+            ):
+                return observation
+        samples.append(observation)
+        result["sync_observations"] = (
+            [samples[0], *samples[-11:]] if len(samples) > 12 else samples
+        )
+        # Evidence must not reset updated_at: that is the sync timeout's clock.
+        self.db.execute(
+            "UPDATE operations SET result=? WHERE id=?", (encode(result), op["id"])
+        )
+        return observation
+
+    def close_superseded_displays(self):
+        for op in self.db.all(
+            "SELECT * FROM operations WHERE action='display' AND write_started=1 "
+            "AND status IN ('SYNCING','UNKNOWN')"
+        ):
+            result = json.loads(op["result"] or "{}")
+            if not result.get("image_id") or json.loads(op["payload"]).get(
+                "options", {}
+            ).get("restore_previous"):
+                continue
+            newer = self.db.one(
+                "SELECT id,result FROM operations WHERE device_id=? AND action='display' "
+                "AND status='COMPLETED' AND write_started=1 AND created_at>? "
+                "AND COALESCE(json_extract(payload,'$.options.restore_previous'),0)=0 "
+                "AND json_extract(result,'$.image_id') IS NOT NULL "
+                "ORDER BY created_at DESC LIMIT 1",
+                (op["device_id"], op["created_at"]),
+            )
+            if (
+                not newer
+                or json.loads(newer["result"])["image_id"] == result["image_id"]
+            ):
+                continue
+            # A later confirmed permanent display ends this attempt, but cannot
+            # prove whether the earlier image was ever shown. Never replay it.
+            self.service.update(
+                op["id"],
+                "FAILED",
+                error={
+                    "code": ErrorCode.DISPLAY_NOT_CONFIRMED,
+                    "message": "Superseded by a later confirmed display; earlier display unconfirmed",
+                    "request_id": op["request_id"],
+                    "details": {
+                        "superseded_by_operation_id": newer["id"],
+                        "previous_error": json.loads(op["error"] or "null"),
+                    },
+                },
+            )
+            self.db.history(op, "DISPLAY_NOT_CONFIRMED")
+            self.db.event(
+                "operation.failed",
+                {"operation_id": op["id"], "code": ErrorCode.DISPLAY_NOT_CONFIRMED},
+            )
@@ -5,6 +5,7 @@ import time
 from datetime import UTC, datetime, timedelta
 from uuid import uuid4

+from pigway_frame_flow.core.photo_preferences import eligible
 from pigway_frame_flow.display.cloud_library import CloudLibrary
 from pigway_frame_flow.display.recovery import RecoveryMonitor
 from pigway_frame_flow.display.retention import Retention
@@ -152,6 +153,31 @@ class DisplayService:
                )
        return id

+    def operation_image(self, device_id, result):
+        result = dict(result or {})
+        asset_id = result.get("rendered_asset_id") or result.get("asset_id")
+        if not asset_id and result.get("image_id") is not None:
+            # Cloud cleanup removes image_sources; the original upload receipt survives.
+            row = self.db.one(
+                "SELECT result FROM operations WHERE device_id=? "
+                "AND json_extract(result,'$.image_id')=? "
+                "AND json_extract(result,'$.rendered_asset_id') IS NOT NULL "
+                "ORDER BY created_at DESC LIMIT 1",
+                (device_id, result["image_id"]),
+            )
+            if row:
+                original = json.loads(row["result"])
+                asset_id = original["rendered_asset_id"]
+                result.setdefault("image_name", original.get("image_name"))
+        if asset_id:
+            result.setdefault("asset_id", asset_id)
+            asset = self.db.one("SELECT * FROM assets WHERE id=?", (asset_id,))
+            if asset:
+                result["image_name"] = result.get("image_name") or asset["name"]
+                if self.assets.path(asset_id).is_file():
+                    result["preview_url"] = f"/api/v1/assets/{asset_id}"
+        return result or None
+
    def operation(self, id):
        op = self.db.one("SELECT * FROM operations WHERE id=?", (id,))
        if not op:
@@ -162,7 +188,9 @@ class DisplayService:
            device_id=op["device_id"],
            created_at=op["created_at"],
            updated_at=op["updated_at"],
-            result=json.loads(op["result"]) if op["result"] else None,
+            result=self.operation_image(
+                op["device_id"], json.loads(op["result"]) if op["result"] else None
+            ),
            error=json.loads(op["error"]) if op["error"] else None,
            request_id=op["request_id"],
            client_id=op["client_id"],
@@ -172,9 +200,12 @@ class DisplayService:

    def update(self, id, status, result=None, error=None):
        if result:
+            op = self.db.one("SELECT device_id FROM operations WHERE id=?", (id,))
+            result = self.operation_image(op["device_id"], result)
+            result.pop("preview_url", None)
            row = self.db.one("SELECT result FROM operations WHERE id=?", (id,))
            previous = json.loads(row["result"]) if row and row["result"] else {}
-            for key in ("photo_attempts", "upload_intent"):
+            for key in ("photo_attempts", "upload_intent", "sync_observations"):
                if key in previous:
                    result = {**result, key: previous[key]}
        self.db.execute(
@@ -284,6 +315,8 @@ class DisplayService:
            import random

            items = self.photo_sources.catalog(content.source_id, target_size=size)
+            if not content.item_id:
+                items = eligible(self.db, content.source_id, items)
            candidates = (
                [item for item in items if item["id"] == content.item_id]
                if content.item_id
@@ -518,6 +551,25 @@ class DisplayService:
                ) and self.blocked(op["device_id"]):
                    continue
                payload = json.loads(op["payload"])
+                if (
+                    op["action"] in ("display", "delete", "restore")
+                    and op["client_id"]
+                    in ("scheduler", "scheduler-retry", "cloud-library", "retention")
+                    and self.db.one(
+                        "SELECT id FROM operations WHERE device_id=? AND action='display' "
+                        "AND status='SYNCING' AND write_started=1 AND updated_at>? LIMIT 1",
+                        (
+                            op["device_id"],
+                            (
+                                datetime.now(UTC)
+                                - timedelta(seconds=self.settings.sync_timeout)
+                            ).isoformat(),
+                        ),
+                    )
+                ):
+                    # Both upload and deletion update the cloud frame counter.
+                    # Automatic writes must not invalidate a pending display ack.
+                    continue
                if op["action"] == "display":
                    priority = payload["options"]["priority"]
                    top = self.top(op["device_id"])
@@ -823,6 +875,7 @@ class DisplayService:
            try:
                driver = self.registry.get(op["device_id"])
                device = driver.device(refresh=True)
+                self.recovery.observe_device(op, device=device)
                if intent:
                    expected = self.upload_reconciliation.check(op, driver, device)
                    if (
@@ -850,7 +903,8 @@ class DisplayService:
                        if device.current_content.id == expected
                        else "target_mismatch",
                    )
-            except FlowError:
+            except FlowError as exc:
+                self.recovery.observe_device(op, error=exc)
                self.recovery.observe(op, "read_unavailable")
            except Exception:
                # Bad vendor metadata for one operation must not stop the worker.
@@ -858,6 +912,7 @@ class DisplayService:
        for op in self.db.all("SELECT * FROM operations WHERE status='SYNCING'"):
            try:
                device = self.registry.get(op["device_id"]).device()
+                observation = self.recovery.observe_device(op, device=device)
                target = json.loads(op["result"])["image_id"]
                if (
                    device.current_content.id == target
@@ -878,11 +933,13 @@ class DisplayService:
                            "code": E.WRITE_RESULT_UNKNOWN,
                            "message": "Frame refresh was not confirmed",
                            "request_id": op["request_id"],
-                            "details": {},
+                            "details": {"last_device_observation": observation},
                        },
                    )
-            except FlowError:
-                pass
+            except FlowError as exc:
+                self.recovery.observe_device(op, error=exc)
+
+        self.recovery.close_superseded_displays()

    def expire(self):
        if not self.settings.mock and not self.settings.write_enabled:
@@ -5,6 +5,7 @@ from io import BytesIO

 from PIL import Image, ImageOps

+from pigway_frame_flow.core.photo_preferences import eligible
 from pigway_frame_flow.errors import ErrorCode as E
 from pigway_frame_flow.errors import FlowError
 from pigway_frame_flow.extensions.layout import LayoutInput, LayoutStudio
@@ -19,7 +20,11 @@ def prepare(service, content, device_id=None):
        from pigway_frame_flow.extensions.quality import passes, photo_quality

        source = service.photo_sources.get(content.source_id)
-        items = service.photo_sources.catalog(content.source_id)
+        items = eligible(
+            service.db,
+            content.source_id,
+            service.photo_sources.catalog(content.source_id),
+        )
        candidates = rng.sample(items, min(len(items), content.count * 5))
        for item in candidates:
            try:
@@ -46,7 +51,7 @@ def prepare(service, content, device_id=None):
                break
    else:
        rows = service.db.all(
-            "SELECT id AS asset_id FROM assets WHERE kind='images' ORDER BY created_at DESC LIMIT 10000"
+            "SELECT id AS asset_id FROM assets WHERE kind='images' AND NOT EXISTS (SELECT 1 FROM photo_preferences p WHERE p.source_id='@assets' AND p.item_id=assets.id AND p.excluded=1) ORDER BY created_at DESC LIMIT 10000"
        )
        ids = rng.sample(
            [row["asset_id"] for row in rows], min(content.count, len(rows))
@@ -2,7 +2,7 @@ from datetime import datetime
 from enum import StrEnum
 from typing import Annotated, Any, Literal

-from pydantic import BaseModel, ConfigDict, Field, model_validator
+from pydantic import BaseModel, ConfigDict, Field, StrictBool, model_validator

 from pigway_frame_flow.errors import ErrorCode

@@ -168,6 +168,8 @@ class ErrorResponse(BaseModel):


 class OperationResult(BaseModel):
+    image_name: str | None = None
+    preview_url: str | None = None
    cover_id: int | None = None
    photo_attempts: list[dict[str, str]] = Field(default_factory=list)
    image_id: int | None = None
@@ -366,7 +368,7 @@ class SettingsView(BaseModel):

 class Health(BaseModel):
    status: str
-    version: str = "0.1.21"
+    version: str = "0.1.28"


 class Readiness(BaseModel):
@@ -375,6 +377,7 @@ class Readiness(BaseModel):


 class Asset(BaseModel):
+    excluded: bool = False
    source_path: str | None = None
    starred: bool = False
    origin: Literal["manual", "task", "external", "template", "unknown"] = "unknown"
@@ -397,7 +400,7 @@ class RestoreRequest(StrictModel):

 class Version(BaseModel):
    product: str = "PIGWay Frame Flow"
-    version: str = "0.1.21"
+    version: str = "0.1.28"
    api_version: str = "v1"
    commit: str = "development"
    build_time: str = "unknown"
@@ -500,10 +503,20 @@ class WidgetState(StrictModel):
    writable: Literal[False] = False


+class ImageExclusion(StrictModel):
+    excluded: StrictBool
+
+
+class PhotoPreference(StrictModel):
+    item_id: str = Field(min_length=1, max_length=4096)
+    starred: StrictBool | None = None
+    excluded: StrictBool | None = None
+
+
 class ImageStar(StrictModel):
-    starred: bool
+    starred: StrictBool


 class AssetBatch(StrictModel):
    asset_ids: list[str] = Field(min_length=1, max_length=100)
-    action: Literal["delete", "star", "unstar"]
+    action: Literal["delete", "star", "unstar", "exclude", "include"]
@@ -15,6 +15,7 @@ from xml.etree import ElementTree

 from pydantic import Field

+from pigway_frame_flow.core.photo_preferences import eligible
 from pigway_frame_flow.errors import ErrorCode as E
 from pigway_frame_flow.errors import FlowError
 from pigway_frame_flow.models import StrictModel
@@ -60,6 +61,8 @@ class PhotoSourceView(PhotoSourceInput):


 class PhotoItem(StrictModel):
+    starred: bool = False
+    excluded: bool = False
    id: str
    name: str
    caption: dict[str, str] | None = None
@@ -220,6 +223,7 @@ class PhotoSources:
        self.db.execute(
            "DELETE FROM app_config WHERE key=?", ("photo_source:" + source_id,)
        )
+        self.db.execute("DELETE FROM photo_preferences WHERE source_id=?", (source_id,))
        self.cache.pop(source_id, None)
        self.api_items.pop(source_id, None)

@@ -581,9 +585,11 @@ class PhotoSources:
    def read(self, source_id, item_id=None, *, target_size=(1200, 1600)):
        source = self.get(source_id)
        items = self.catalog(source_id, target_size=target_size)
+        if not item_id:
+            items = eligible(self.db, source_id, items)
        if not items:
            raise FlowError(
-                E.NOT_FOUND, "Photo source contains no supported images", 404
+                E.NOT_FOUND, "Photo source contains no eligible images", 404
            )
        item = (
            next((x for x in items if x["id"] == item_id), None)
@@ -8,6 +8,7 @@ from uuid import uuid4

 from PIL import Image, ImageFilter, ImageOps, ImageStat

+from pigway_frame_flow.core.photo_preferences import flags
 from pigway_frame_flow.errors import ErrorCode as E
 from pigway_frame_flow.errors import FlowError
 from pigway_frame_flow.storage.database import now_iso
@@ -142,6 +143,7 @@ class Assets:
            if provenance
            else None,
            "starred": bool(meta and meta["starred"]),
+            "excluded": flags(self.db, "@assets", asset_id)["excluded"],
            "origin": meta["origin"] if meta else "unknown",
            "job_id": meta["job_id"] if meta else None,
            "job_name": meta["job_name"] if meta else None,
@@ -24,6 +24,7 @@ class Database:
        PRAGMA busy_timeout=5000;
        PRAGMA synchronous=FULL;
        CREATE TABLE IF NOT EXISTS managed_cloud_uploads (device_id TEXT, image_id INTEGER, asset_id TEXT, job_id TEXT, operation_id TEXT, uploaded_at TEXT, confirmed_at TEXT, cleanup_operation TEXT, PRIMARY KEY(device_id,image_id));
+        CREATE TABLE IF NOT EXISTS photo_preferences (source_id TEXT NOT NULL, item_id TEXT NOT NULL, starred INTEGER NOT NULL DEFAULT 0, excluded INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(source_id,item_id));
        CREATE TABLE IF NOT EXISTS asset_metadata (asset_id TEXT PRIMARY KEY, starred INTEGER NOT NULL DEFAULT 0, origin TEXT NOT NULL DEFAULT 'unknown', job_id TEXT, job_name TEXT);
        CREATE TABLE IF NOT EXISTS image_retention (device_id TEXT NOT NULL, image_id INTEGER NOT NULL, starred INTEGER NOT NULL DEFAULT 0, expires_at TEXT, upload_operation TEXT, cleanup_operation TEXT, PRIMARY KEY(device_id,image_id));
        CREATE TABLE IF NOT EXISTS photo_dimensions (path TEXT PRIMARY KEY, mtime INTEGER NOT NULL, bytes INTEGER NOT NULL, width INTEGER NOT NULL, height INTEGER NOT NULL);
@@ -45,6 +46,7 @@ class Database:
            last_run TEXT, last_result TEXT);
        CREATE TABLE IF NOT EXISTS job_runs (job_id TEXT, scheduled_at TEXT,
            operation_id TEXT, PRIMARY KEY(job_id,scheduled_at));
+        CREATE TABLE IF NOT EXISTS hidden_history (operation_id TEXT PRIMARY KEY);
        CREATE TABLE IF NOT EXISTS history (id INTEGER PRIMARY KEY, client_id TEXT,
            request_id TEXT, operation_id TEXT, device_id TEXT, action TEXT,
            result TEXT, timestamp TEXT);
@@ -38,6 +38,14 @@ window.addEventListener('resize',revealCurrentNavigation);
 function deviceNameForId(id){return deviceDisplayName(state.devices.find(d=>d.id===id)||{id,name:id});}
 function operationActionLabel(action){const labels={'render':['生成预览','Generate preview'],'render-ai':['AI 生成图片','Generate AI image'],'official-widget':['更新官方订阅','Update official widget'],'delete':['删除图片','Delete image'],'display':['显示图片','Display image'],'restore':['恢复图片','Restore image'],'local-upload':['保存到图库','Save to gallery'],'reconcile':['核对状态','Reconcile']};return labels[action]?.[state.lang==='zh'?0:1]||t('operation');}
 function operationClientLabel(client){return client==='admin'?tr('管理员','Administrator'):client==='scheduler'?tr('自动调度','Scheduler'):client;}
+function operationResultHTML(o){
+ const r=o.result||{},parts=[];
+ if(r.image_name)parts.push(`<div>${esc(r.image_name)}</div>`);
+ if(r.image_id!=null)parts.push(`<small>${t('cloudImageId')}: ${esc(r.image_id)}</small>`);
+ else if(r.asset_id||r.rendered_asset_id)parts.push(`<small>${t('localAssetId')}: ${esc(r.asset_id||r.rendered_asset_id)}</small>`);
+ if(o.error)parts.push(`<div class="history-status bad">${esc(operationErrorMessage(o.error))}</div>`);
+ return parts.join('')||'—';
+}
 function operationErrorLabel(error){if(!error?.code)return '';const label=t(error.code);return label===error.code?t('error'):label;}
 function deviceDisplayName(device){const name=device.name||device.id;return device.id==='living-room'&&['living-room','Living room'].includes(name)?t('livingRoom'):name;}
 function shell(){document.documentElement.lang=state.lang==='zh'?'zh-CN':'en';$('#lang').textContent=state.lang==='zh'?'EN':'中文';$('#theme').title=t('theme');$('#nav').innerHTML=Object.entries(icons).map(([id,icon])=>`<button data-page="${id}" class="${id===state.page?'active':''}" ${id===state.page?'aria-current="page"':''}><span class="nav-icon">${icon}</span><span>${t(id)}</span></button>`).join('');document.querySelectorAll('[data-page]').forEach(b=>b.onclick=()=>navigate(b.dataset.page));$('#page-title').textContent=t(state.page);$('#device').innerHTML=(state.devices.length?state.devices:[{id:state.device,name:state.device}]).map(d=>`<option value="${esc(d.id)}" ${d.id===state.device?'selected':''}>${esc(deviceDisplayName(d))}</option>`).join('');revealCurrentNavigation();}
@@ -118,7 +126,7 @@ async function templateEditor(selected){
 const reset=document.createElement('button');reset.id='reset-template';reset.textContent=t('resetTemplate');$('#save-template').after(reset);bind('reset-template',()=>confirmDialog(t('resetConfirm'),async()=>{await api('/api/v1/templates/'+selected.id+'/config',{method:'DELETE'});await navigate();}));
 const save=$('#save-template');const oldSave=save.onclick;save.onclick=async e=>{if([...panel.querySelectorAll('textarea'),raw].some(x=>!x.checkValidity())){toast(t('INVALID_REQUEST'));return;}await oldSave(e);};
 }
-function accountSettings(){const section=$('#logout').parentElement;const form=document.createElement('form');form.id='password-form';form.innerHTML=`<h3>${t('changePassword')}</h3><div class="form-grid password-fields"><div class="field"><label for="current-password">${t('currentPassword')}</label><input id="current-password" type="password" required autocomplete="current-password"></div><div class="field"><label for="new-password">${t('newPassword')}</label><input id="new-password" type="password" minlength="8" required autocomplete="new-password"></div></div><button type="submit">${t('changePassword')}</button>`;section.append(form);form.onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/auth/password',{method:'PUT',body:{current_password:$('#current-password').value,new_password:$('#new-password').value}});forgetLogin();shell();login();toast(t('passwordChanged'));});}
+function accountSettings(){const section=$('#logout').parentElement;const form=document.createElement('form');form.id='password-form';form.innerHTML=`<h3>${t('changePassword')}</h3><div class="form-grid password-fields"><div class="field"><label for="current-password">${t('currentPassword')}</label><input id="current-password" type="password" required autocomplete="current-password"></div><div class="field"><label for="new-password">${t('newPassword')}</label><input id="new-password" type="password" minlength="8" required autocomplete="new-password"></div><div class="field"><label for="confirm-password">${t('confirmPassword')}</label><input id="confirm-password" type="password" minlength="8" required autocomplete="new-password"></div></div><button type="submit">${t('changePassword')}</button>`;section.append(form);const confirm=$('#confirm-password');const validate=()=>confirm.setCustomValidity(confirm.value!==$('#new-password').value?t('passwordMismatch'):'');confirm.oninput=validate;$('#new-password').oninput=validate;form.onsubmit=busy(async e=>{e.preventDefault();validate();if(!form.reportValidity())return;await api('/api/v1/auth/password',{method:'PUT',body:{current_password:$('#current-password').value,new_password:$('#new-password').value}});forgetLogin();shell();login();toast(t('passwordChanged'));});}
 const views={
 studio:()=>layoutStudioPage(),
 connections:()=>connectionsPage(),
@@ -143,7 +151,7 @@ const views={
 async upload(){state.preview=null;$('#main').innerHTML=notice()+`<div class="notice">${t('uploadNotice')}</div><div class="columns"><section class="card"><h2>${t('upload')}</h2><div class="dropzone"><strong>${t('selectFile')}</strong><p class="hint">${t('uploadHint')}</p><input id="file" type="file" accept="image/jpeg,image/png,image/webp" aria-label="${t('selectFile')}"></div><div class="form-grid" style="margin-top:24px"><div class="field"><label for="fit">${t('mode')}</label><select id="fit">${['contain','cover','smart'].map(x=>`<option value="${x}">${t(x)}</option>`).join('')}</select></div><div class="field"><label for="profile">${t('profile')}</label><select id="profile">${['color','grayscale'].map(x=>`<option value="${x}">${t(x)}</option>`).join('')}</select></div></div>${buttons('make-preview','preview',true)}<p class="hint">${t('previewHint')}</p></section><section class="card"><h3>${t('preview')}</h3><div id="preview-box" class="empty">${t('previewHint')}</div><div class="actions" style="margin-top:18px"><button id="save-local" disabled>${t('staging')}</button><button id="display-upload" class="primary" disabled>${t('display')}</button></div></section></div>`;bind('make-preview',async()=>{const file=$('#file').files[0];if(!file)throw new Error(t('selectFile'));const form=new FormData();form.append('file',file);form.append('fit',$('#fit').value);form.append('profile',$('#profile').value);state.preview=await api('/api/v1/preview',{method:'POST',body:form});$('#preview-box').className='';$('#preview-box').innerHTML='<img id="upload-preview" class="preview" alt="Preview">';await blobImage($('#upload-preview'),state.preview.url);$('#save-local').disabled=false;$('#display-upload').disabled=!liveWriteAllowed();});for(const id of ['file','fit','profile'])$('#'+id).onchange=()=>{state.preview=null;$('#save-local').disabled=true;$('#display-upload').disabled=true;};bind('save-local',async()=>{const id=await accepted('/api/v1/devices/'+state.device+'/upload',{type:'image',asset_id:state.preview.asset_id});await waitOperation(id);state.tab='local';return navigate('gallery');});bind('display-upload',()=>displayDialog({type:'image',asset_id:state.preview.asset_id}));},
 async templates(){state.templates=await api('/api/v1/templates');const selected=state.templates.find(x=>x.id===state.selectedTemplate)||state.templates[0];state.selectedTemplate=selected.id;if(state.pendingTemplateData?.template===selected.id){selected.defaults=state.pendingTemplateData.data;state.initialProfile=state.pendingTemplateData.profile;state.pendingTemplateData=null;}state.templatePreview=null;$('#main').innerHTML=notice()+`<div class="notice">${t('templateHint')}<p>${t('templateSteps')}</p></div><div class="template-grid">${state.templates.map((x,i)=>`<div class="card template-card ${x.id===selected.id?'selected':''}" role="button" tabindex="0" data-template="${x.id}"><span>${{'daily-poetry':'詩','calendar':'▦','daily-dashboard':'☀','photo-text':'▣','quote':'❝','system-alert':'◒','weather':'☁'}[x.id]||'▦'}</span><div><h3>${esc(x.name.split(' / ')[state.lang==='zh'?1:0]||x.name)}</h3><small>1200 × 1600 · ${esc(x.id)}</small></div></div>`).join('')}</div><div class="columns"><section class="card"><h3>${t('templateData')}</h3><p class="hint">${t('templateGuideTitle')}</p><p class="hint">${t({'photo-text':'guidePhotoText','daily-dashboard':'guideDashboard',weather:'guideWeather',calendar:'guideCalendar',quote:'guideQuote','daily-poetry':'guidePoetry','system-alert':'guideAlert'}[selected.id]||'templateContentHelp')}</p>${['weather','daily-dashboard'].includes(selected.id)?`<p class="hint">${t('templateWeatherHelp')}</p>`:''}<textarea id="template-data" aria-label="${t('templateData')}">${esc(JSON.stringify(selected.defaults,null,2))}</textarea><div class="field" style="margin-top:16px"><label for="template-profile">${t('profile')}</label><select id="template-profile"><option value="color">${t('color')}</option><option value="grayscale">${t('grayscale')}</option></select><p class="hint">${t('helpProfile')}</p></div><p class="hint">${t('templateActionHelp')}</p><p class="hint">${t('templateAutomationHelp')}</p><div class="actions">${buttons('render-template','render',true)}${buttons('save-template','saveTemplate')}</div></section><section class="card"><h3>${t('preview')}</h3><div id="template-preview" class="empty">${t('templatePreviewHint')}</div><button id="display-template" class="primary" style="margin-top:18px" disabled>${t('display')}</button></section></div>`;document.querySelectorAll('[data-template]').forEach(b=>{b.onclick=()=>{state.selectedTemplate=b.dataset.template;navigate(['collage','poster'].includes(b.dataset.template)?'studio':undefined);};b.onkeydown=e=>{if(e.key==='Enter')b.click();};});bind('render-template',async()=>{const content={type:'template',template:selected.id,data:JSON.parse($('#template-data').value),profile:$('#template-profile').value};if([...document.querySelectorAll('#template-fields textarea'),$('#template-data')].some(x=>!x.checkValidity())){toast(t('INVALID_REQUEST'));return;}const id=await accepted('/api/v1/render',content);$('#template-preview').textContent=t('previewLoading');const op=await waitOperation(id);state.templatePreview=op.result.asset_id;$('#template-preview').className='';$('#template-preview').innerHTML='<img id="template-image" class="preview" alt="Template preview">';await blobImage($('#template-image'),op.result.url);$('#display-template').disabled=!liveWriteAllowed();});bind('save-template',async()=>{await api('/api/v1/templates/'+selected.id+'/config',{method:'PUT',body:{data:JSON.parse($('#template-data').value)}});toast(t('done'));});$('#template-data').oninput=()=>$('#display-template').disabled=true;$('#template-profile').onchange=()=>$('#display-template').disabled=true;bind('display-template',()=>displayDialog({type:'image',asset_id:state.templatePreview}));await templateEditor(selected);if(state.initialProfile){$('#template-profile').value=state.initialProfile;state.initialProfile=null;}},
 async playlists(epoch){const playlists=await api('/api/v1/playlists');if(epoch!==state.epoch)return;$('#main').innerHTML=notice()+`<div class="notice">${t('playlistNotice')}</div><div class="section-heading"><h2>${t('playlists')}</h2>${buttons('new-playlist','newPlaylist',true)}</div><div class="gallery">${playlists.map((p,i)=>`<section class="card"><span class="badge">${t(p.enabled?'enabled':'disabled')}</span><h3 style="margin-top:16px">${esc(p.name)}</h3><p class="hint">${p.image_ids.length} ${t('count')} · ${p.interval_minutes} ${t('minutes')} · ${t(p.mode)}</p><p><code>${esc(p.image_ids.join(' → '))}</code></p><small>${t('lastScheduled')}: ${p.position>=0?esc(p.image_ids[p.position]):'—'}</small><div class="actions" style="margin-top:16px"><button data-pl-edit="${i}">${t('edit')}</button><button class="danger" data-pl-delete="${i}">${t('remove')}</button></div></section>`).join('')||`<div class="card empty"><strong>${t('noTasks')}</strong></div>`}</div>`;bind('new-playlist',()=>playlistEditor());document.querySelectorAll('[data-pl-edit]').forEach(b=>b.onclick=()=>playlistEditor(playlists[b.dataset.plEdit]));document.querySelectorAll('[data-pl-delete]').forEach(b=>b.onclick=()=>confirmDialog(t('removeConfirm'),async()=>{await api('/api/v1/playlists/'+playlists[b.dataset.plDelete].id,{method:'DELETE'});await navigate();}));},
- async history(epoch){const ops=await api('/api/v1/operations');if(epoch!==state.epoch)return;$('#main').innerHTML=`<div class="section-heading"><h2>${t('history')}</h2>${buttons('history-refresh','refresh')}</div>${ops.some(x=>x.status==='UNKNOWN')?`<div class="notice warning">${t('unknown')}</div>`:''}<div class="card table-wrap">${ops.length?`<table><thead><tr>${['created','action','status','result','client','requestId'].map(x=>`<th>${t(x)}</th>`).join('')}</tr></thead><tbody>${ops.map((o,i)=>`<tr><td>${fmt(o.created_at)}</td><td>${esc(operationActionLabel(o.action))}<br><small>${esc(deviceNameForId(o.device_id))}</small></td><td><span class="history-status ${['FAILED','UNKNOWN'].includes(o.status)?'bad':''}">${t(o.status)}</span>${o.status==='UNKNOWN'?`<div><button data-reconcile="${i}">${t('reconcile')}</button></div>`:''}</td><td>${esc(o.result?.image_id||o.result?.asset_id||operationErrorLabel(o.error)||'—')}</td><td>${esc(operationClientLabel(o.client_id))}</td><td><code>${esc(o.request_id)}<br>${esc(o.operation_id)}</code></td></tr>`).join('')}</tbody></table>`:`<div class="empty">${t('noHistory')}</div>`}</div>`;bind('history-refresh',()=>navigate());document.querySelectorAll('[data-reconcile]').forEach(b=>b.onclick=busy(async()=>{const o=ops[b.dataset.reconcile];const r=await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:false}});showModal(`<h2>${t('reconcile')}</h2><p>${t('current')}: ${esc(r.current_image_id)}</p><p>${t('result')}: ${esc(r.expected_image_id)}</p><p class="hint">${t('unknown')}</p><div class="modal-actions">${buttons('modal-cancel','cancel')}${r.resolved?'':buttons('acknowledge','acknowledge')}</div>`);bind('acknowledge',async()=>{await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:true}});$('#modal').close();await navigate();});}));},
+ async history(epoch){const data=await api('/api/v1/operation-history?'+historyQuery());if(epoch!==state.epoch)return;state.historyPageData=data;state.historyPage=data.page;const ops=data.items;$('#main').innerHTML=`<div class="section-heading"><h2>${t('history')}</h2>${buttons('history-refresh','refresh')}</div>${ops.some(x=>x.status==='UNKNOWN')?`<div class="notice warning">${t('unknown')}</div>`:''}<div class="card table-wrap">${ops.length?`<table><thead><tr>${['created','action','status','result','client','requestId'].map(x=>`<th>${t(x)}</th>`).join('')}</tr></thead><tbody>${ops.map((o,i)=>`<tr data-operation-id="${esc(o.operation_id)}"><td>${fmt(o.created_at)}</td><td>${esc(operationActionLabel(o.action))}<br><small>${esc(deviceNameForId(o.device_id))}</small></td><td><span class="history-status ${['FAILED','UNKNOWN'].includes(o.status)?'bad':''}">${t(o.status)}</span>${o.status==='UNKNOWN'?`<div><button data-reconcile="${i}">${t('reconcile')}</button></div>`:''}</td><td>${operationResultHTML(o)}</td><td>${esc(operationClientLabel(o.client_id))}</td><td><code>${esc(o.request_id)}<br>${esc(o.operation_id)}</code></td></tr>`).join('')}</tbody></table>`:`<div class="empty">${t('noHistory')}</div>`}</div>`;bind('history-refresh',()=>navigate());document.querySelectorAll('[data-reconcile]').forEach(b=>b.onclick=busy(async()=>{const o=ops[b.dataset.reconcile];const r=await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:false}});showModal(`<h2>${t('reconcile')}</h2><p>${t('current')}: ${esc(r.current_image_id)}</p><p>${t('result')}: ${esc(r.expected_image_id)}</p><p class="hint">${t('unknown')}</p><div class="modal-actions">${buttons('modal-cancel','cancel')}${r.resolved?'':buttons('acknowledge','acknowledge')}</div>`);bind('acknowledge',async()=>{await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:true}});$('#modal').close();await navigate();});}));},
 async settings(){state.settings=await api('/api/v1/settings');const s=state.settings;$('#main').innerHTML=notice()+`<div class="columns settings-columns"><section class="card"><h3>${t('settings')}</h3><div class="form-grid settings-preferences"><div class="field"><label for="theme-select">${t('theme')}</label><select id="theme-select">${['system','light','dark'].map(x=>`<option value="${x}" ${state.theme===x?'selected':''}>${t(x==='system'?'systemTheme':x)}</option>`).join('')}</select></div><div class="field"><label for="language-select">${t('language')}</label><select id="language-select"><option value="zh" ${state.lang==='zh'?'selected':''}>简体中文</option><option value="en" ${state.lang==='en'?'selected':''}>English</option></select></div></div><p class="hint">${t('tokenHint')}</p>${buttons('logout','logout')}</section><section class="card"><h3>${t('auth')}</h3><div class="detail-grid">${detail('version',s.version)}${detail('writeProtection',t(!s.write_enabled?'yes':'no'))}${detail('keyConfigured',t(s.api_key_configured?'yes':'no'))}${detail('timezone',s.timezone)}</div><p class="hint">${t('refreshInterval')}</p><a href="/docs" target="_blank" rel="noopener">${t('apiDocs')} →</a><p class="hint">GET /openapi.json · /api/v1</p></section></div>`;$('#theme-select').onchange=()=>{state.theme=$('#theme-select').value;localStorage.setItem('ff-theme',state.theme);applyTheme();};$('#language-select').onchange=()=>{state.lang=$('#language-select').value;localStorage.setItem('ff-language',state.lang);navigate();};bind('logout',async()=>{await api('/api/v1/auth/logout',{method:'POST'});forgetLogin();shell();login();});accountSettings();}
 };
 function jobPayload(j,changes={}){return {name:j.name,enabled:j.enabled,device_id:j.device_id,schedule:j.schedule,source:j.source,display_duration:j.display_duration,restore_previous:j.restore_previous,priority:j.priority,cleanup_unstarred:j.cleanup_unstarred||false,...changes};}
@@ -34,9 +34,14 @@ function displayDialog(content){
 function enhanceGallery(){
 const grid=$('.gallery');if(!grid)return;
 const controls=document.createElement('div');controls.className='form-grid gallery-filters';controls.innerHTML=`<div class="field"><label for="gallery-search">${t('searchImages')}</label><input id="gallery-search" type="search"></div><div class="field"><label for="gallery-sort">${t('sortOrder')}</label><select id="gallery-sort"><option value="newest">${t('sortNewest')}</option><option value="oldest">${t('sortOldest')}</option><option value="name">${t('sortName')}</option></select></div>`;grid.before(controls);
- if(state.tab==='local'){controls.classList.add('gallery-filters-local');const bar=document.createElement('div');bar.className='actions';bar.innerHTML=`<select id="asset-origin" aria-label="${t('originFilter')}">${['all','manual','task','external','template','unknown'].map(x=>`<option value="${x}">${t('origin_'+x)}</option>`).join('')}</select><select id="asset-job" aria-label="${t('taskOrigin')}"><option value="">${t('allTasks')}</option></select><button id="asset-prev">${t('previousPage')}</button><button id="asset-next">${t('nextPage')}</button><button id="asset-all">${t('selectAll')}</button><button id="asset-invert">${t('invertSelection')}</button><button id="asset-batch-star">${t('star')}</button><button id="asset-batch-unstar">${t('unstar')}</button><button id="asset-batch-delete" class="danger">${t('deleteSelected')}</button>`;grid.before(bar);for(const [id,key] of [['asset-origin','originFilter'],['asset-job','taskOrigin']]){const field=document.createElement('div');field.className='field';const label=document.createElement('label');label.htmlFor=id;label.textContent=t(key);field.append(label,bar.querySelector('#'+id));controls.append(field);}const help=document.createElement('p');help.className='hint';help.id='gallery-selection-help';help.textContent=t('gallerySelectionHelp')+' '+t('starHelp');grid.before(help);bar.setAttribute('aria-describedby',help.id);$('#asset-origin').value=state.assetOrigin||'all';if(state.galleryJobsEpoch!==state.epoch){state.galleryJobsEpoch=state.epoch;state.galleryJobsRequest=api('/api/v1/jobs');}void state.galleryJobsRequest.then(jobs=>{if(!bar.isConnected)return;const picker=bar.querySelector('#asset-job');for(const job of jobs){const option=document.createElement('option');option.value=job.id;option.textContent=job.name;picker.append(option);}picker.value=state.assetJob||'';}).catch(error=>{if(bar.isConnected)toast(error.message);});$('#asset-origin').onchange=()=>{state.assetOffset=0;state.assetOrigin=$('#asset-origin').value;return navigate();};$('#asset-job').onchange=()=>{state.assetOffset=0;state.assetJob=$('#asset-job').value;state.assetOrigin=state.assetJob?'task':state.assetOrigin;return navigate();};$('#asset-prev').disabled=!(state.assetOffset||0);$('#asset-next').disabled=state.gallery.length<200;bind('asset-prev',()=>{state.assetOffset=Math.max(0,(state.assetOffset||0)-200);return navigate();});bind('asset-next',()=>{state.assetOffset=(state.assetOffset||0)+200;return navigate();});const visibleSelection=()=>[...grid.querySelectorAll('.asset-select')].filter(x=>!x.closest('.image-card').hidden);$('#asset-all').onclick=()=>{const boxes=visibleSelection();const checked=boxes.some(x=>!x.checked);boxes.forEach(x=>x.checked=checked);};$('#asset-invert').onclick=()=>visibleSelection().forEach(x=>x.checked=!x.checked);for(const action of ['star','unstar','delete']){bind('asset-batch-'+action,async()=>{const ids=[...document.querySelectorAll('.asset-select:checked')].map(x=>x.dataset.asset);if(!ids.length){toast(t('selectImagesFirst'));return;}if(action==='delete'&&!confirm(t('deleteSelectedConfirm')))return;const results=[];for(let i=0;i<ids.length;i+=100){const r=await api('/api/v1/assets/batch',{method:'POST',body:{asset_ids:ids.slice(i,i+100),action}});results.push(...r.results);}const failed=results.filter(x=>x.status==='failed');if(failed.length)toast(t('batchFailed')+' '+failed.length);await navigate();});}}
+ if(state.tab==='local'){controls.classList.add('gallery-filters-local');const bar=document.createElement('div');bar.className='actions';bar.innerHTML=`<select id="asset-origin" aria-label="${t('originFilter')}">${['all','manual','task','external','template','unknown'].map(x=>`<option value="${x}">${t('origin_'+x)}</option>`).join('')}</select><select id="asset-job" aria-label="${t('taskOrigin')}"><option value="">${t('allTasks')}</option></select><button id="asset-prev">${t('previousPage')}</button><button id="asset-next">${t('nextPage')}</button><button id="asset-all">${t('selectAll')}</button><button id="asset-invert">${t('invertSelection')}</button><button id="asset-batch-star">${t('star')}</button><button id="asset-batch-unstar">${t('unstar')}</button><button id="asset-batch-exclude">${t('excludePhoto')}</button><button id="asset-batch-include">${t('includePhoto')}</button><button id="asset-batch-delete" class="danger">${t('deleteSelected')}</button>`;grid.before(bar);for(const [id,key] of [['asset-origin','originFilter'],['asset-job','taskOrigin']]){const field=document.createElement('div');field.className='field';const label=document.createElement('label');label.htmlFor=id;label.textContent=t(key);field.append(label,bar.querySelector('#'+id));controls.append(field);}const help=document.createElement('p');help.className='hint';help.id='gallery-selection-help';help.textContent=t('gallerySelectionHelp')+' '+t('starHelp')+' '+t('excludePhotoHelp');grid.before(help);bar.setAttribute('aria-describedby',help.id);$('#asset-origin').value=state.assetOrigin||'all';if(state.galleryJobsEpoch!==state.epoch){state.galleryJobsEpoch=state.epoch;state.galleryJobsRequest=api('/api/v1/jobs');}void state.galleryJobsRequest.then(jobs=>{if(!bar.isConnected)return;const picker=controls.querySelector('#asset-job');for(const job of jobs){const option=document.createElement('option');option.value=job.id;option.textContent=job.name;picker.append(option);}picker.value=state.assetJob||'';}).catch(error=>{if(bar.isConnected)toast(error.message);});$('#asset-origin').onchange=()=>{state.assetOffset=0;state.assetOrigin=$('#asset-origin').value;return navigate();};$('#asset-job').onchange=()=>{state.assetOffset=0;state.assetJob=$('#asset-job').value;state.assetOrigin=state.assetJob?'task':state.assetOrigin;return navigate();};$('#asset-prev').disabled=!(state.assetOffset||0);$('#asset-next').disabled=state.gallery.length<200;bind('asset-prev',()=>{state.assetOffset=Math.max(0,(state.assetOffset||0)-200);return navigate();});bind('asset-next',()=>{state.assetOffset=(state.assetOffset||0)+200;return navigate();});const visibleSelection=()=>[...grid.querySelectorAll('.asset-select')].filter(x=>!x.closest('.image-card').hidden);$('#asset-all').onclick=()=>{const boxes=visibleSelection();const checked=boxes.some(x=>!x.checked);boxes.forEach(x=>x.checked=checked);};$('#asset-invert').onclick=()=>visibleSelection().forEach(x=>x.checked=!x.checked);for(const action of ['star','unstar','exclude','include','delete']){bind('asset-batch-'+action,async()=>{const ids=[...document.querySelectorAll('.asset-select:checked')].map(x=>x.dataset.asset);if(!ids.length){toast(t('selectImagesFirst'));return;}if(action==='delete'&&!confirm(t('deleteSelectedConfirm')))return;const results=[];for(let i=0;i<ids.length;i+=100){const r=await api('/api/v1/assets/batch',{method:'POST',body:{asset_ids:ids.slice(i,i+100),action}});results.push(...r.results);}const failed=results.filter(x=>x.status==='failed');if(failed.length)toast(t('batchFailed')+' '+failed.length);await navigate();});}}
 const cards=[...grid.querySelectorAll('.image-card')];$('#gallery-search').oninput=()=>{state.galleryQuery=$('#gallery-search').value;const query=state.galleryQuery.toLowerCase();cards.forEach(card=>card.hidden=!card.textContent.toLowerCase().includes(query));};$('#gallery-sort').onchange=()=>{const order=$('#gallery-sort').value;state.galleryOrder=order;const indexes=cards.map((card,index)=>({card,item:state.gallery[index]}));indexes.sort((a,b)=>order==='name'?a.item.name.localeCompare(b.item.name):order==='oldest'?String(a.item.created_at).localeCompare(String(b.item.created_at)):String(b.item.created_at).localeCompare(String(a.item.created_at)));indexes.forEach(x=>grid.append(x.card));};
- cards.forEach((card,i)=>{const item=state.gallery[i];if(state.tab==='local'){const star=document.createElement('button');star.textContent=t(item.starred?'unstar':'star');star.setAttribute('aria-pressed',String(item.starred));card.querySelector('.actions').append(star);star.onclick=busy(async()=>{await api('/api/v1/assets/'+item.asset_id+'/star',{method:'PUT',body:{starred:!item.starred}});await navigate();});const label=document.createElement('small');label.textContent=item.origin==='task'?t('taskOrigin')+' · '+(item.job_name||item.job_id):t('origin_'+item.origin);card.querySelector('h3').after(label);const select=document.createElement('input');select.type='checkbox';select.className='asset-select';select.dataset.asset=item.asset_id;select.setAttribute('aria-label',t('selectImage'));card.prepend(select);}if(item.width&&item.height){const dimensions=document.createElement('small');dimensions.textContent=item.width+' × '+item.height;card.querySelector('h3').after(dimensions);}const download=document.createElement('button');download.textContent=t('download');card.querySelector('.actions').append(download);download.onclick=busy(()=>downloadImage(item.url,item.name));if(state.tab==='local'){const edit=document.createElement('button');edit.textContent=t('continueEdit');card.querySelector('.actions').append(edit);edit.onclick=busy(async()=>{const meta=await api('/api/v1/assets/'+item.asset_id+'/source');if(meta.source?.type==='template')await editTemplateSource(meta.source);else toast(t('templateSourceUnavailable'));});}});
+ cards.forEach((card,i)=>{const item=state.gallery[i];if(state.tab==='local'){const star=document.createElement('button');star.textContent=t(item.starred?'unstar':'star');star.setAttribute('aria-pressed',String(item.starred));star.disabled=Boolean(item.excluded);star.title=item.excluded?t('clearExclusionFirst'):'';card.querySelector('.actions').append(star);const exclude=document.createElement('button');exclude.textContent=t(item.excluded?'includePhoto':'excludePhoto');exclude.setAttribute('aria-pressed',String(Boolean(item.excluded)));exclude.disabled=Boolean(item.starred);exclude.title=item.starred?t('clearStarFirst'):'';card.querySelector('.actions').append(exclude);exclude.onclick=busy(async()=>{await api('/api/v1/assets/'+item.asset_id+'/exclusion',{method:'PUT',body:{excluded:!item.excluded}});await navigate();});if(item.starred){const kept=document.createElement('small');kept.className='photo-mark';kept.textContent=t('photoStarred');card.querySelector('h3').after(kept);}if(item.excluded){const badge=document.createElement('small');badge.className='excluded-photo';badge.textContent=t('photoExcluded');card.querySelector('h3').after(badge);}star.onclick=busy(async()=>{await api('/api/v1/assets/'+item.asset_id+'/star',{method:'PUT',body:{starred:!item.starred}});await navigate();});const label=document.createElement('small');label.textContent=item.origin==='task'?t('taskOrigin')+' · '+(item.job_name||item.job_id):t('origin_'+item.origin);card.querySelector('h3').after(label);const select=document.createElement('input');select.type='checkbox';select.className='asset-select';select.dataset.asset=item.asset_id;select.setAttribute('aria-label',t('selectImage'));card.prepend(select);}if(item.width&&item.height){const dimensions=document.createElement('small');dimensions.textContent=item.width+' × '+item.height;card.querySelector('h3').after(dimensions);}const download=document.createElement('button');download.textContent=t(state.tab==='local'?'downloadShort':'download');card.querySelector('.actions').append(download);download.onclick=busy(()=>downloadImage(item.url,item.name));if(state.tab==='local')card.querySelector('.actions').append(card.querySelector('[data-delete]'));});
+ if(state.tab==='local'){
+  const updateMarks=()=>{const selected=[...grid.querySelectorAll('.asset-select:checked')].map(box=>state.gallery.find(item=>item.asset_id===box.dataset.asset));const starred=selected.some(item=>item?.starred),excluded=selected.some(item=>item?.excluded);$('#asset-batch-star').disabled=!selected.length||excluded;$('#asset-batch-star').title=excluded?t('clearExclusionFirst'):'';$('#asset-batch-exclude').disabled=!selected.length||starred;$('#asset-batch-exclude').title=starred?t('clearStarFirst'):'';};
+  grid.querySelectorAll('.asset-select').forEach(box=>box.onchange=updateMarks);
+  for(const id of ['asset-all','asset-invert']){const previous=$('#'+id).onclick;$('#'+id).onclick=event=>{previous(event);updateMarks();};}updateMarks();
+ }
 $('#gallery-search').value=state.galleryQuery||'';$('#gallery-sort').value=state.galleryOrder||'newest';$('#gallery-search').oninput();$('#gallery-sort').onchange();
 }
 async function weatherSettings(){
@@ -45,7 +50,8 @@ async function weatherSettings(){
 result(weather);$('#weather-form').onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/settings/weather',{method:'PUT',body:{provider:$('#weather-provider').value,location:$('#weather-location').value,latitude:Number($('#weather-latitude').value),longitude:Number($('#weather-longitude').value)}});result(await api('/api/v1/providers/weather'));toast(t('done'));});
 }
 async function enhanceHistory(){
- const table=document.querySelector('#main table');if(!table)return;table.classList.add('history-table');const heading=document.createElement('th');heading.textContent=t('operation');table.querySelector('thead tr').append(heading);const rows=[...table.querySelectorAll('tbody tr')];const ops=await api('/api/v1/operations');rows.forEach((row,i)=>{const op=ops[i];if(!op)return;const button=document.createElement('button');button.textContent=t('details');const actions=document.createElement('td');actions.className='history-actions';actions.append(button);row.append(actions);button.onclick=busy(async()=>{const current=await api('/api/v1/operations/'+op.operation_id);showModal(`<h2>${t('details')}</h2><p>${t(current.status)} · ${esc(operationActionLabel(current.action))}</p><p>${esc(operationErrorLabel(current.error)||current.error?.message||'')}</p><pre style="white-space:pre-wrap;overflow-wrap:anywhere">${esc(JSON.stringify({action:current.action,device_id:current.device_id,error_code:current.error?.code,operation_id:current.operation_id,request_id:current.request_id,created_at:current.created_at,updated_at:current.updated_at,result:current.result},null,2))}</pre>${current.result?.url?'<img id="operation-preview" class="preview" alt="Preview">':''}<div class="modal-actions">${buttons('modal-cancel','cancel')}</div>`);if(current.result?.url)await blobImage($('#operation-preview'),current.result.url);});});}
+ historyControls();
+ const table=document.querySelector('#main table');if(!table)return;table.classList.add('history-table');const heading=document.createElement('th');heading.textContent=t('operation');table.querySelector('thead tr').append(heading);const rows=[...table.querySelectorAll('tbody tr')];rows.forEach(row=>{const operationId=row.dataset.operationId;if(!operationId)return;const button=document.createElement('button');button.textContent=t('details');const actions=document.createElement('td');actions.className='history-actions';actions.append(button);row.append(actions);const op=state.historyPageData?.items.find(x=>x.operation_id===operationId);if(op&&['COMPLETED','FAILED','UNKNOWN'].includes(op.status)){const remove=document.createElement('button');remove.textContent=t('delete');remove.className='danger';remove.onclick=()=>deleteHistory([operationId]);actions.append(remove);}button.onclick=busy(async()=>{const current=await api('/api/v1/operations/'+operationId);showModal(`<h2>${t('details')}</h2><p>${t(current.status)} · ${esc(operationActionLabel(current.action))}</p>${operationResultHTML(current)}<pre style="white-space:pre-wrap;overflow-wrap:anywhere">${esc(JSON.stringify({action:current.action,device_id:current.device_id,error_code:current.error?.code,operation_id:current.operation_id,request_id:current.request_id,created_at:current.created_at,updated_at:current.updated_at,result:current.result},null,2))}</pre>${(current.result?.preview_url||current.result?.url)?'<img id="operation-preview" class="preview" alt="Preview">':''}<div class="modal-actions">${buttons('modal-cancel','cancel')}</div>`);if(current.result?.preview_url||current.result?.url)await blobImage($('#operation-preview'),current.result.preview_url||current.result.url);});});}
 async function enhanceAutomation(){
 const jobs=await api('/api/v1/jobs');const rows=[...document.querySelectorAll('tbody tr')];rows.forEach((row,i)=>{const job=jobs[i];if(!job)return;const actions=row.querySelector('.row-actions');const run=document.createElement('button');run.textContent=t('runNow');run.disabled=!liveWriteAllowed();run.title=run.disabled?t('readOnlyWarning'):'';actions.append(run);run.onclick=()=>confirmDialog(t('runConfirm'),async()=>{await accepted('/api/v1/jobs/'+job.id+'/run',{});await navigate('history');});if(['template','auto_collage'].includes(job.source.type)){const preview=document.createElement('button');preview.textContent=t('jobPreview');actions.append(preview);preview.onclick=busy(async()=>{const id=await accepted('/api/v1/jobs/'+job.id+'/preview',{});const op=await waitOperation(id);showModal(`<h2>${t('jobPreview')}</h2><img id="job-preview-image" class="preview" alt="Preview"><div class="modal-actions">${buttons('modal-cancel','cancel')}</div>`);await blobImage($('#job-preview-image'),op.result.url);});}});
 }
@@ -156,7 +162,8 @@ async function photoSourceForm(source=null){
 }
 async function browseSource(id,offset=0,refresh=false){
 const result=await api('/api/v1/photo-sources/'+id+'/images?device_id='+encodeURIComponent(state.device)+'&offset='+offset+'&limit=50&refresh='+refresh);const box=$('#source-browser');if(!box)return;
- box.innerHTML=`<h4>${t('sourceImages')} · ${result.total}${result.total>=result.catalog_limit?' (limit)':''}</h4><p class="hint">${t('sourceBrowseHint')}</p><div class="source-items">${result.items.map((x,i)=>`<button data-source-item="${i}">${esc(x.name)}${x.width?`<small>${x.width} × ${x.height}</small>`:''}${x.caption?`<small>${esc([x.caption.date,x.caption.people,x.caption.title,x.caption.place,x.caption.filename].filter(Boolean).join(' · '))}</small>`:''}</button>`).join('')||t('noSourcePhotos')}</div><div class="actions"><button id="source-prev" ${offset?'':'disabled'}>${t('previousPage')}</button><button id="source-next" ${offset+result.items.length<result.total?'':'disabled'}>${t('nextPage')}</button>${buttons('source-refresh','refresh')}</div>`;
+ box.innerHTML=`<h4>${t('sourceImages')} · ${result.total}${result.total>=result.catalog_limit?' (limit)':''}</h4><p class="hint">${t('sourceBrowseHint')} ${t('excludePhotoHelp')}</p><div class="source-items">${result.items.map((x,i)=>`<article class="source-photo"><button data-source-item="${i}">${esc(x.name)}${x.width?`<small>${x.width} × ${x.height}</small>`:''}${x.caption?`<small>${esc([x.caption.date,x.caption.people,x.caption.title,x.caption.place,x.caption.filename].filter(Boolean).join(' · '))}</small>`:''}</button><div class="actions"><button data-source-star="${i}" aria-pressed="${Boolean(x.starred)}" ${x.excluded?'disabled':''} title="${x.excluded?t('clearExclusionFirst'):''}">${t(x.starred?'unstar':'star')}</button><button data-source-exclude="${i}" aria-pressed="${Boolean(x.excluded)}" ${x.starred?'disabled':''} title="${x.starred?t('clearStarFirst'):''}">${t(x.excluded?'includePhoto':'excludePhoto')}</button></div>${x.starred?`<small class="photo-mark">${t('photoStarred')}</small>`:''}${x.excluded?`<small class="excluded-photo">${t('photoExcluded')}</small>`:''}</article>`).join('')||t('noSourcePhotos')}</div><div class="actions"><button id="source-prev" ${offset?'':'disabled'}>${t('previousPage')}</button><button id="source-next" ${offset+result.items.length<result.total?'':'disabled'}>${t('nextPage')}</button>${buttons('source-refresh','refresh')}</div>`;
+ for(const key of ['star','exclude'])box.querySelectorAll('[data-source-'+key+']').forEach(button=>button.onclick=busy(async()=>{const item=result.items[Number(button.dataset[key==='star'?'sourceStar':'sourceExclude'])],field=key==='star'?'starred':'excluded';await api('/api/v1/photo-sources/'+id+'/preferences?device_id='+encodeURIComponent(state.device),{method:'PUT',body:{item_id:item.id,[field]:!item[field]}});await browseSource(id,offset);}));
 box.querySelectorAll('[data-source-item]').forEach(b=>b.onclick=busy(()=>previewSource(id,result.items[Number(b.dataset.sourceItem)].id)));bind('source-prev',()=>browseSource(id,Math.max(0,offset-50)));bind('source-next',()=>browseSource(id,offset+50));bind('source-refresh',()=>browseSource(id,0,true));
 }
 async function previewSource(id,item_id=null){
@@ -166,3 +173,25 @@ async function previewSource(id,item_id=null){
 async function sourceJobForm(id){
 await jobEditor({name:t('randomPhoto'),device_id:state.device,enabled:false,schedule:{type:'interval',interval_minutes:120},source:{type:'photo_source',source_id:id,fit:'contain',profile:'color'},display_duration:0,restore_previous:false,priority:50});
 }
+
+function historyQuery(){return new URLSearchParams({...state.historyFilters,page:state.historyPage||1,page_size:state.historyPageSize||20});}
+function historyControls(){
+ const data=state.historyPageData;if(!data)return;
+ const filters=state.historyFilters||{};
+ const form=document.createElement('form');form.id='history-filters';form.className='card history-filters';
+ const select=(id,label,options)=>`<div class="field"><label for="${id}">${t(label)}</label><select id="${id}">${options}</select></div>`;
+ form.innerHTML=`<div class="field"><label for="history-search">${t('searchHistory')}</label><input id="history-search" type="search" maxlength="200" value="${esc(filters.q||'')}"></div>`+select('history-status','status',`<option value="">${t('allStatuses')}</option>`+['QUEUED','RENDERING','UPLOADING','SYNCING','COMPLETED','FAILED','UNKNOWN'].map(x=>`<option value="${x}">${t(x)}</option>`).join(''))+select('history-action','action',`<option value="">${t('allActions')}</option>`+['display','render','render-ai','local-upload','delete','restore','official-widget','reconcile'].map(x=>`<option value="${x}">${esc(operationActionLabel(x))}</option>`).join(''))+select('history-device','device',`<option value="">${t('allDevices')}</option>`+state.devices.map(d=>`<option value="${esc(d.id)}">${esc(deviceNameForId(d.id))}</option>`).join(''))+`<div class="field"><label for="history-start">${t('startDate')}</label><input id="history-start" type="date" value="${esc(filters.start||'')}"></div><div class="field"><label for="history-end">${t('endDate')}</label><input id="history-end" type="date" value="${esc(filters.end||'')}"></div><div class="actions"><button type="submit" class="primary">${t('filter')}</button><button id="history-reset" type="button">${t('resetFilters')}</button></div>`;
+ const wrap=$('#main .table-wrap');wrap.before(form);
+ for(const key of ['status','action','device'])$('#history-'+key).value=filters[key==='device'?'device_id':key]||'';
+ form.onsubmit=busy(async e=>{e.preventDefault();const start=$('#history-start'),end=$('#history-end');end.setCustomValidity(start.value&&end.value&&start.value>end.value?t('dateRangeInvalid'):'');if(!form.reportValidity())return;state.historyFilters={};for(const [id,key] of [['search','q'],['status','status'],['action','action'],['device','device_id'],['start','start'],['end','end']]){const value=$('#history-'+id).value;if(value)state.historyFilters[key]=value;}state.historyPage=1;await navigate();});
+ $('#history-end').oninput=()=>$('#history-end').setCustomValidity('');$('#history-start').oninput=()=>$('#history-end').setCustomValidity('');
+ bind('history-reset',async()=>{state.historyFilters={};state.historyPage=1;await navigate();});
+ const bar=document.createElement('div');bar.className='actions history-toolbar';bar.innerHTML=`<button id="history-all">${t('selectAll')}</button><button id="history-invert">${t('invertSelection')}</button><button id="history-delete" class="danger" disabled>${t('deleteSelected')}</button><span id="history-selected" class="hint" role="status"></span>`;wrap.before(bar);
+ const pager=document.createElement('div');pager.className='actions history-pagination';const pages=Math.max(1,Math.ceil(data.total/data.page_size));pager.innerHTML=`<span>${t('historyTotal').replace('{count}',data.total)} · ${data.page} / ${pages}</span><button id="history-prev" ${data.page<=1?'disabled':''}>${t('previousPage')}</button><button id="history-next" ${data.page>=pages?'disabled':''}>${t('nextPage')}</button><label for="history-page-size">${t('pageSize')}</label><select id="history-page-size">${[20,50,100].map(n=>`<option value="${n}" ${n===data.page_size?'selected':''}>${n}</option>`).join('')}</select>`;wrap.after(pager);
+ bind('history-prev',async()=>{state.historyPage=data.page-1;await navigate();});bind('history-next',async()=>{state.historyPage=data.page+1;await navigate();});$('#history-page-size').onchange=busy(async()=>{state.historyPageSize=Number($('#history-page-size').value);state.historyPage=1;await navigate();});
+ const checkboxes=()=>[...document.querySelectorAll('.history-select:not(:disabled)')];
+ const update=()=>{const selected=checkboxes().filter(x=>x.checked);$('#history-delete').disabled=!selected.length;$('#history-selected').textContent=t('historySelected').replace('{count}',selected.length);};
+ for(const op of data.items){const row=[...wrap.querySelectorAll('tbody tr')].find(r=>r.dataset.operationId===op.operation_id);if(!row)continue;const box=document.createElement('input');box.type='checkbox';box.className='history-select';box.value=op.operation_id;box.setAttribute('aria-label',t('selectHistory')+' '+op.operation_id);box.disabled=!['COMPLETED','FAILED','UNKNOWN'].includes(op.status);box.onchange=update;row.cells[0].prepend(box);}
+ bind('history-all',()=>{const boxes=checkboxes(),checked=boxes.length>0&&boxes.every(x=>x.checked);boxes.forEach(x=>x.checked=!checked);update();});bind('history-invert',()=>{checkboxes().forEach(x=>x.checked=!x.checked);update();});bind('history-delete',()=>deleteHistory(checkboxes().filter(x=>x.checked).map(x=>x.value)));update();
+}
+async function deleteHistory(ids){await confirmDialog(t('deleteHistoryConfirm').replace('{count}',ids.length),async()=>{await api('/api/v1/operation-history',{method:'DELETE',body:{operation_ids:ids}});await navigate();});}
@@ -1,3 +1,3 @@
 <!doctype html>
-<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><title>PIGWay Frame Flow</title><link rel="stylesheet" href="/ui/style.css"></head>
-<body><aside class="sidebar"><a class="brand" href="/"><span>PIGWay Frame Flow<small>Smart Frame Automation</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.21</small></div></aside><div class="workspace"><header><div><span class="eyebrow">PIGWay Frame Flow</span><h1 id="page-title"></h1></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=0.1.21"></script><script src="/ui/features.js?v=0.1.21"></script><script src="/ui/extensions.js?v=0.1.21"></script><script src="/ui/app.js?v=0.1.21"></script></body></html>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><title>PIGWay Frame Flow</title><link rel="icon" type="image/svg+xml" href="/ui/favicon.svg"><link rel="icon" href="/ui/favicon.ico" sizes="16x16 32x32 48x48"><link rel="apple-touch-icon" sizes="180x180" href="/ui/apple-touch-icon.png"><link rel="stylesheet" href="/ui/style.css"></head>
+<body><aside class="sidebar"><a class="brand" href="/" aria-label="PIGWay Frame Flow"><img class="pigway-logo" src="/ui/logo-symbol.svg" alt="" width="56" height="56"><span>PIGWAY<small>FRAME FLOW</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.28</small></div></aside><div class="workspace"><header><div class="workspace-heading"><img class="mobile-brand-logo pigway-logo" src="/ui/logo-symbol.svg" alt="PIGWay" width="56" height="56"><div><span class="eyebrow">PIGWay Frame Flow</span><h1 id="page-title"></h1></div></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=0.1.28"></script><script src="/ui/features.js?v=0.1.28"></script><script src="/ui/extensions.js?v=0.1.28"></script><script src="/ui/app.js?v=0.1.28"></script></body></html>
@@ -49,7 +49,7 @@ input[type="file"]::file-selector-button{margin-inline-end:12px}

 .official-account-panel{margin:20px 0;padding:20px;border:1px solid var(--border);border-radius:12px}.official-account-panel>p{margin:14px 0}#official-device-picker{margin-top:18px}

-.history-table{min-width:1060px;table-layout:fixed}.history-table th:nth-child(1){width:145px}.history-table th:nth-child(2){width:180px}.history-table th:nth-child(3){width:100px}.history-table th:nth-child(5){width:110px}.history-table th:last-child{width:120px}.history-table td{overflow-wrap:anywhere}.history-table .history-actions{vertical-align:top;white-space:nowrap}.history-actions button{white-space:nowrap}
+.history-table{min-width:1060px;table-layout:fixed}.history-table th:nth-child(1){width:180px}.history-table th:nth-child(2){width:180px}.history-table th:nth-child(3){width:100px}.history-table th:nth-child(5){width:110px}.history-table th:last-child{width:190px}.history-table td{overflow-wrap:anywhere}.history-table .history-actions{white-space:nowrap}.history-actions button{white-space:nowrap}

 .photo-sources-panel{margin-top:24px}.source-list{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,280px),1fr));gap:20px}.source-card{border:1px solid var(--border);border-radius:12px;padding:18px}.source-card h4{margin:0 0 12px}.source-card .actions{margin-top:16px}.source-items{display:flex;flex-wrap:wrap;gap:12px;margin:18px 0}.source-items button{max-width:100%;overflow-wrap:anywhere}#source-browser>h4{margin-top:24px}

@@ -187,7 +187,10 @@ body.login-mode header,body.login-mode footer{flex-shrink:0}
 .history-status{color:var(--accent)}
 .history-status.bad{color:var(--bad)}

-.settings-columns{align-items:stretch}
+.settings-columns{align-items:stretch;grid-template-columns:minmax(0,2fr) minmax(240px,1fr)}
+.password-fields{grid-template-columns:repeat(3,minmax(0,1fr));max-width:780px;align-items:end}
+@media(max-width:1050px){.settings-columns{grid-template-columns:minmax(0,1fr)}}
+@media(max-width:720px){.password-fields{grid-template-columns:minmax(0,1fr)}}
 .settings-preferences .field,.password-fields .field,#weather-form .field{min-width:0;margin-bottom:0}
 #password-form>button{align-self:flex-start}
 form#weather-form{display:grid;grid-template-columns:minmax(160px,1fr) minmax(220px,2fr) repeat(2,minmax(100px,1fr)) auto;gap:18px;align-items:end}
@@ -224,6 +227,35 @@ form#mqtt-config{grid-template-columns:minmax(160px,1fr) 110px minmax(180px,1.5f
 .automation-table{min-width:1200px}
 .automation-table td:is(:nth-child(2),:nth-child(5),:nth-child(6)){white-space:nowrap}
 .automation-table .row-actions{flex-wrap:nowrap}
-.history-table td:is(:nth-child(3),:nth-child(4),:nth-child(5)),.history-table .history-actions{vertical-align:middle}
+.history-table td{vertical-align:middle}

 .image-card h3.source-path{white-space:normal;overflow-wrap:anywhere}
+
+.pigway-logo{display:block;width:56px;height:56px;padding:6px;flex:0 0 56px;object-fit:contain}
+.brand>span{min-width:0}.workspace-heading{display:flex;align-items:center;gap:12px}.workspace-heading>div{min-width:0}.mobile-brand-logo{display:none}
+@media(max-width:720px){.mobile-brand-logo{display:block}}
+
+/* Stacked wordmark keeps the product name readable within the sidebar. */
+.sidebar .brand{font-size:26px;font-weight:800;line-height:1.15;letter-spacing:1px}
+.sidebar .brand small{margin-top:6px;font-size:12px;font-weight:700;letter-spacing:4px;line-height:1.4;white-space:nowrap}
+
+form#history-filters{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:18px}
+#history-filters .field{min-width:0;margin:0}
+#history-filters>.actions{grid-column:1/-1}
+.history-select{margin:0 10px 0 0;vertical-align:middle}
+.history-actions button+button{margin-left:10px}
+.history-pagination select{width:auto}
+@media(max-width:1050px){form#history-filters{grid-template-columns:repeat(2,minmax(0,1fr))}}
+@media(max-width:720px){form#history-filters{grid-template-columns:minmax(0,1fr)}}
+
+.source-photo{min-width:0;display:flex;flex-direction:column;gap:12px;padding:14px;border:1px solid var(--border);border-radius:12px}
+.source-photo>[data-source-item]{width:100%;text-align:left;overflow-wrap:anywhere}
+.source-photo .actions{margin-top:auto}
+.excluded-photo{display:block;color:var(--muted);font-size:12px}
+
+.image-card>small{display:block}
+.photo-mark{display:block;color:var(--accent);font-size:12px}
+
+.image-card{display:flex;flex-direction:column}
+.image-card>.asset-select{align-self:flex-start}
+.image-card>.actions{margin-top:auto;padding-top:12px;justify-content:flex-start}
@@ -1,6 +1,6 @@
 [project]
 name = "pigway-frame-flow"
-version = "0.1.21"
+version = "0.1.28"
 readme = "README.md"
 license = {file = "LICENSE"}
 requires-python = ">=3.14,<3.15"
@@ -6,5 +6,9 @@ cd "$(dirname "$0")/.."
 DOCKER_BIN=${DOCKER_BIN:-docker}
 "$DOCKER_BIN" info >/dev/null
 "$DOCKER_BIN" compose config --quiet
-"$DOCKER_BIN" compose build --pull
+set -- --pull
+if [ -n "${CI_PYTHON_BASE:-}" ]; then
+  set -- "$@" --build-arg "PYTHON_BASE=$CI_PYTHON_BASE"
+fi
+"$DOCKER_BIN" compose build "$@"
 "$DOCKER_BIN" image inspect "${FRAME_FLOW_IMAGE:-pigway-frame-flow:latest}" --format 'image={{.Id}} size_bytes={{.Size}} architecture={{.Architecture}}'
@@ -19,8 +19,8 @@ if len(password) < 8 or password != getpass.getpass("Confirm password: "):
 args.config_dir.mkdir(parents=True, exist_ok=True)
 path = args.config_dir / "accounts.json"
 users = json.loads(path.read_text()).get("users", []) if path.exists() else []
-if any(u["username"] == args.username for u in users):
-    sys.exit("Bootstrap user already exists. Change the password in Settings.")
+if users:
+    sys.exit("Single-user account already exists. Change the password in Settings.")
 users.append({"username": args.username, "password_hash": password_hash(password)})
 path.write_text(json.dumps({"users": users}) + "\n")
 path.chmod(0o600)
@@ -127,6 +127,48 @@ def main():
        release(lock)


+def verify_prebuilt_image(image, commit, version, hashes):
+    expected = os.getenv("FRAME_FLOW_PREBUILT_IMAGE_ID", "")
+    if not expected:
+        return False
+    assert re.fullmatch(r"sha256:[0-9a-f]{64}", expected), "Require immutable image ID"
+    metadata = json.loads(run("docker", "image", "inspect", image))[0]
+    assert metadata["Id"] == expected, "Prebuilt image ID mismatch"
+    labels = metadata["Config"].get("Labels") or {}
+    assert labels.get("org.opencontainers.image.revision") == commit
+    assert labels.get("org.opencontainers.image.version") == version
+    project = {
+        n: h
+        for n, h in hashes.items()
+        if n.startswith(("pigway_frame_flow/", "vendor/"))
+        or n in {"requirements.lock", "LICENSE", "NOTICE.md"}
+    }
+    # Validate the artifact before it can access production config or data.
+    code = "import hashlib,json,pathlib,sys; h=json.load(sys.stdin); assert h and all(hashlib.sha256((pathlib.Path('/app')/n).read_bytes()).hexdigest()==v for n,v in h.items())"
+    subprocess.run(
+        [
+            "docker",
+            "run",
+            "--rm",
+            "-i",
+            "--network=none",
+            "--read-only",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges",
+            "--user=10333:10333",
+            "--entrypoint=python",
+            expected,
+            "-c",
+            code,
+        ],
+        input=json.dumps(project),
+        text=True,
+        check=True,
+        timeout=60,
+    )
+    return True
+
+
 def release(lock):
    ctx = Path(__file__).resolve().parent.parent
    assert ctx.parent == ROOT / "migration-inbox"
@@ -154,28 +196,37 @@ def release(lock):
    version = tomllib.loads((ctx / "pyproject.toml").read_text())["project"]["version"]
    assert re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version)
    image = "pigway-frame-flow:" + version + "-" + commit[:12]
-    # A source-only overlay would retain vulnerable packages from the old image.
-    run(
-        "docker",
-        "build",
-        "--pull",
-        "-f",
-        str(ctx / "Dockerfile"),
-        "--build-arg",
-        "BUILD_COMMIT=" + commit,
-        "--build-arg",
-        "BUILD_TIME=" + stamp,
-        "--build-arg",
-        "ALPINE_MIRROR=" + os.getenv("ALPINE_MIRROR", "dl-cdn.alpinelinux.org"),
-        "-t",
-        image,
-        str(ctx),
-    )
+    if not verify_prebuilt_image(image, commit, version, hashes):
+        # A source-only overlay would retain vulnerable packages from the old image.
+        run(
+            "docker",
+            "build",
+            "--pull",
+            "-f",
+            str(ctx / "Dockerfile"),
+            "--build-arg",
+            "BUILD_COMMIT=" + commit,
+            "--build-arg",
+            "BUILD_TIME=" + stamp,
+            "--build-arg",
+            "ALPINE_MIRROR=" + os.getenv("ALPINE_MIRROR", "dl-cdn.alpinelinux.org"),
+            "-t",
+            image,
+            str(ctx),
+        )
    compose = json.loads((APP / "compose.json").read_text())
    service = compose["services"][CONTAINER]
    service["image"] = image
    service["environment"]["BUILD_COMMIT"] = commit
    service["environment"]["BUILD_TIME"] = stamp
+    labels = service.get("labels") or {}
+    if isinstance(labels, list):
+        labels = {item.partition("=")[0]: item.partition("=")[2] for item in labels}
+    service["labels"] = {
+        **labels,
+        "org.opencontainers.image.version": version,
+        "org.opencontainers.image.revision": commit,
+    }
    changed = False
    try:
        changed = True
@@ -1,3 +1,3 @@
 /* Mock history fixtures only; verifies long identifiers and detail actions. */
 const assert=require('assert'),{chromium}=require('playwright');
-(async()=>{const browser=await chromium.launch({headless:true,executablePath:'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'});const page=await browser.newPage();const op={operation_id:'a'.repeat(64),request_id:'b'.repeat(64),action:'render',device_id:'living-room',client_id:'user:way',created_at:'2026-10-05T00:28:05Z',status:'COMPLETED',result:{asset_id:'c'.repeat(64)}};await page.route('**/api/v1/operations',r=>r.fulfill({json:[op,op]}));await page.route('**/api/v1/operations/'+op.operation_id,r=>r.fulfill({json:op}));await page.goto(process.env.FRAME_FLOW_URL||'http://127.0.0.1:6005');await page.locator('#username').fill(process.env.FRAME_FLOW_TEST_USERNAME);await page.locator('#password').fill(process.env.FRAME_FLOW_TEST_PASSWORD);await page.locator('#login-form button').click();await page.locator('.hero').waitFor();let checks=0;for(const lang of ['zh','en'])for(const width of [1440,768,390])for(const theme of ['dark','light']){await page.setViewportSize({width,height:1000});await page.evaluate(({lang,theme})=>{state.lang=lang;document.documentElement.dataset.theme=theme;shell();},{lang,theme});await page.locator('[data-page="history"]').click();await page.locator('.history-actions button').first().waitFor();assert(await page.evaluate(()=>{const table=document.querySelector('.history-table');return table.querySelectorAll('th').length===7&&[...table.querySelectorAll('tbody tr')].every(row=>row.children.length===7&&row.lastElementChild.classList.contains('history-actions')&&row.lastElementChild.previousElementSibling.querySelector('button')===null)&&document.documentElement.scrollWidth<=innerWidth;}));await page.locator('.history-actions button').first().click();await page.locator('#modal[open]').waitFor();await page.locator('#modal-cancel').click();checks++;}await browser.close();console.log('History layout and detail dialog: '+checks+' passed');})().catch(e=>{console.error(e);process.exit(1)});
+(async()=>{const browser=await chromium.launch({headless:true,executablePath:'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'});const page=await browser.newPage();const op={operation_id:'a'.repeat(64),request_id:'b'.repeat(64),action:'render',device_id:'living-room',client_id:'user:way',created_at:'2026-10-05T00:28:05Z',status:'COMPLETED',result:{asset_id:'c'.repeat(64)}};await page.route('**/api/v1/operation-history?*',r=>r.fulfill({json:{items:[op,{...op,operation_id:'d'.repeat(64)}],total:2,page:1,page_size:20}}));await page.route('**/api/v1/operations/'+op.operation_id,r=>r.fulfill({json:op}));await page.goto(process.env.FRAME_FLOW_URL||'http://127.0.0.1:6005');await page.locator('#username').fill(process.env.FRAME_FLOW_TEST_USERNAME);await page.locator('#password').fill(process.env.FRAME_FLOW_TEST_PASSWORD);await page.locator('#login-form button').click();await page.locator('.hero').waitFor();let checks=0;for(const lang of ['zh','en'])for(const width of [1440,768,390])for(const theme of ['dark','light']){await page.setViewportSize({width,height:1000});await page.evaluate(({lang,theme})=>{state.lang=lang;document.documentElement.dataset.theme=theme;shell();},{lang,theme});await page.locator('[data-page="history"]').click();await page.locator('.history-actions button').first().waitFor();assert(await page.evaluate(()=>{const table=document.querySelector('.history-table');return table.querySelectorAll('th').length===7&&[...table.querySelectorAll('tbody tr')].every(row=>row.children.length===7&&row.lastElementChild.classList.contains('history-actions')&&row.lastElementChild.previousElementSibling.querySelector('button')===null)&&document.documentElement.scrollWidth<=innerWidth;}));await page.locator('.history-actions button').first().click();await page.locator('#modal[open]').waitFor();await page.locator('#modal-cancel').click();checks++;}await browser.close();console.log('History layout and detail dialog: '+checks+' passed');})().catch(e=>{console.error(e);process.exit(1)});
@@ -4,6 +4,7 @@ const root=path.join(__dirname,'../pigway_frame_flow/web');
 const p=await b.newPage({viewport:{width,height:900}});let errors=[];p.on('pageerror',e=>errors.push(e.message));let saved;
 await p.addInitScript(lang=>localStorage.setItem('ff-language',lang),lang);
 await p.route('**/*',async r=>{const u=new URL(r.request().url());if(u.pathname.startsWith('/api/')){
+ if(u.pathname==='/api/v1/assets/fixture')return r.fulfill({body:Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+jBz8AAAAASUVORK5CYII=','base64'),contentType:'image/png'});
 if(['PUT','POST'].includes(r.request().method())){saved=r.request().postDataJSON();return r.fulfill({json:{}})}
 if(['/api/v1/jobs','/api/v1/assets','/api/v1/devices/living-room/images'].includes(u.pathname))return r.fulfill({json:[]});
 if(u.pathname==='/api/v1/photo-sources')return r.fulfill({json:[]});
@@ -12,6 +13,6 @@ const root=path.join(__dirname,'../pigway_frame_flow/web');
 return r.fulfill({status:401,json:{error:{code:'UNAUTHORIZED',message:'Sign in required'}}});}
 const f=u.pathname==='/'?'index.html':u.pathname.replace(/^\/ui\//,'');return r.fulfill({body:fs.readFileSync(path.join(root,f)),contentType:f.endsWith('.js')?'application/javascript':f.endsWith('.css')?'text/css':'text/html'});});
 await p.goto('http://frame.test/');await p.locator('#login-form').waitFor();
- await p.evaluate(async()=>{const previous=api;api=async()=>[{operation_id:'fixture',action:'display',device_id:'living-room',status:'FAILED',client_id:'scheduler',error:{code:'WRITE_DISABLED'},request_id:'fixture'}];state.devices=[{id:'living-room',name:'living-room'}];try{await views.history(state.epoch);}finally{api=previous;}});
- const text=await p.locator('#main').innerText();assert(!text.includes('living-room'));assert(!text.includes('WRITE_DISABLED'));assert(text.includes(lang==='zh'?'客厅':'Living room'));assert(text.includes(lang==='zh'?'显示图片':'Display image'));assert(text.includes(lang==='zh'?'自动调度':'Scheduler'));assert.equal(errors.length,0);console.log('PASS history',width,lang);await p.close();
+ await p.evaluate(async()=>{const op={operation_id:'fixture',action:'display',device_id:'living-room',status:'FAILED',client_id:'scheduler',result:{image_id:999,image_name:'example <photo>.jpg',preview_url:'/api/v1/assets/fixture'},error:{code:'WRITE_DISABLED'},request_id:'fixture'};api=async(path,options)=>options?.binary?(await fetch(path)).blob():path.endsWith('/fixture')?op:{items:[op],total:1,page:1,page_size:20};state.devices=[{id:'living-room',name:'living-room'}];document.body.classList.remove('login-mode');shell();await views.history(state.epoch);await enhanceHistory();});
+ const text=await p.locator('#main').innerText();assert(!text.includes('living-room'));assert(!text.includes('WRITE_DISABLED'));assert(text.includes('example <photo>.jpg'));assert(text.includes('999'));assert(text.includes(lang==='zh'?'云端图片 ID':'Cloud image ID'));assert(await p.locator('td div.bad').count()===1);assert(text.includes(lang==='zh'?'客厅':'Living room'));assert(text.includes(lang==='zh'?'显示图片':'Display image'));assert(text.includes(lang==='zh'?'自动调度':'Scheduler'));await p.locator('.history-actions button').first().click();await p.locator('#operation-preview').waitFor();assert(await p.locator('#operation-preview').evaluate(img=>img.complete&&img.naturalWidth>0));assert(await p.locator('#modal-content').innerText().then(x=>x.includes('example <photo>.jpg')));assert(await p.evaluate(()=>document.documentElement.scrollWidth<=innerWidth));assert.equal(errors.length,0);console.log('PASS history',width,lang);await p.close();
 }}finally{await b.close()}})().catch(e=>{console.error(e);process.exit(1)});
@@ -1448,5 +1448,67 @@
      "502",
      "503"
    ]
+  },
+  "/api/v1/operation-history": {
+    "get": [
+      "200",
+      "400",
+      "401",
+      "403",
+      "404",
+      "409",
+      "413",
+      "422",
+      "429",
+      "500",
+      "502",
+      "503"
+    ],
+    "delete": [
+      "200",
+      "400",
+      "401",
+      "403",
+      "404",
+      "409",
+      "413",
+      "422",
+      "429",
+      "500",
+      "502",
+      "503"
+    ]
+  },
+  "/api/v1/assets/{asset_id}/exclusion": {
+    "put": [
+      "200",
+      "400",
+      "401",
+      "403",
+      "404",
+      "409",
+      "413",
+      "422",
+      "429",
+      "500",
+      "502",
+      "503"
+    ]
+  },
+  "/api/v1/photo-sources/{source_id}/preferences": {
+    "put": [
+      "200",
+      "400",
+      "401",
+      "403",
+      "404",
+      "409",
+      "413",
+      "422",
+      "429",
+      "500",
+      "502",
+      "503"
+    ]
  }
 }
@@ -690,6 +690,28 @@
  },
  "OperationResult": {
    "properties": {
+      "image_name": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Image Name"
+      },
+      "preview_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Preview Url"
+      },
      "cover_id": {
        "anyOf": [
          {
@@ -1224,6 +1246,16 @@
  },
  "PhotoItem": {
    "properties": {
+      "starred": {
+        "type": "boolean",
+        "title": "Starred",
+        "default": false
+      },
+      "excluded": {
+        "type": "boolean",
+        "title": "Excluded",
+        "default": false
+      },
      "id": {
        "type": "string",
        "title": "Id"
@@ -141,3 +141,104 @@ def test_browser_admin_can_read_other_clients_operation(client, app, service):
    assert operation_id in [
        op["operation_id"] for op in client.get("/api/v1/operations").json()
    ]
+
+
+def test_password_minimum_and_https_cookie(client, app):
+    response = login(client, app)
+    client.headers["X-CSRF-Token"] = response.json()["csrf_token"]
+    assert (
+        client.put(
+            "/api/v1/auth/password",
+            json={"current_password": "fixture-password", "new_password": "1234567"},
+        ).status_code
+        == 422
+    )
+    assert (
+        client.put(
+            "/api/v1/auth/password",
+            json={"current_password": "fixture-password", "new_password": "12345678"},
+        ).status_code
+        == 204
+    )
+    response = client.post(
+        "https://testserver/api/v1/auth/login",
+        json={"username": "test-user", "password": "12345678"},
+    )
+    assert response.status_code == 200
+    assert "Secure" in response.headers["set-cookie"]
+    assert response.headers["cache-control"] == "no-store"
+
+
+def test_login_rejects_cross_origin(client, app):
+    account(app)
+    assert (
+        client.post(
+            "/api/v1/auth/login",
+            headers={"Origin": "https://evil.example"},
+            json={"username": "test-user", "password": "fixture-password"},
+        ).status_code
+        == 403
+    )
+
+
+def test_account_throttle_across_source_addresses(client, app):
+    account(app)
+    for _ in range(5):
+        assert (
+            client.post(
+                "/api/v1/auth/login",
+                json={"username": "test-user", "password": "wrong"},
+            ).status_code
+            == 401
+        )
+        app.state.service.db.execute(
+            "DELETE FROM login_attempts WHERE identity NOT LIKE 'account:%'"
+        )
+    assert (
+        client.post(
+            "/api/v1/auth/login",
+            json={"username": "test-user", "password": "fixture-password"},
+        ).status_code
+        == 429
+    )
+
+
+def test_legacy_hash_upgrade(client, app):
+    import hmac
+
+    from pigway_frame_flow.core.accounts import verify_password
+
+    salt = "12" * 16
+    digest = hashlib.scrypt(
+        b"fixture-password", salt=bytes.fromhex(salt), n=16384, r=8, p=1
+    ).hex()
+    legacy = f"scrypt${salt}${digest}"
+    app.state.service.db.execute(
+        "INSERT INTO users VALUES(?,?,1)", ("test-user", legacy)
+    )
+    assert verify_password("fixture-password", legacy)
+    assert (
+        client.post(
+            "/api/v1/auth/login",
+            json={"username": "test-user", "password": "fixture-password"},
+        ).status_code
+        == 200
+    )
+    stored = app.state.service.db.one("SELECT password_hash FROM users")[
+        "password_hash"
+    ]
+    assert stored.startswith("scrypt-v2$") and not hmac.compare_digest(stored, legacy)
+    assert verify_password("fixture-password", stored)
+
+
+def test_only_one_browser_account(app):
+    import sqlite3
+
+    import pytest
+
+    account(app)
+    with pytest.raises(sqlite3.IntegrityError):
+        app.state.service.db.execute(
+            "INSERT INTO users VALUES(?,?,1)",
+            ("other", password_hash("another-password")),
+        )
@@ -291,6 +291,28 @@ def test_core_has_no_client_special_case():
    )


+def test_official_brand_assets(client):
+    html = client.get("/").text
+    assert "/ui/favicon.svg" in html
+    assert "/ui/apple-touch-icon.png" in html
+    assert 'class="mobile-brand-logo pigway-logo"' in html
+    for filename, content_type in [
+        ("logo-symbol.svg", "image/svg+xml"),
+        ("favicon.svg", "image/svg+xml"),
+        ("favicon.ico", "image/vnd.microsoft.icon"),
+        ("apple-touch-icon.png", "image/png"),
+    ]:
+        response = client.get("/ui/" + filename)
+        assert response.status_code == 200
+        assert response.headers["content-type"].split(";")[0] in (
+            content_type,
+            "image/x-icon",
+        )
+        assert (
+            response.content == (Path("pigway_frame_flow/web") / filename).read_bytes()
+        )
+
+
 def test_ui_languages(client):
    assert client.get("/ui/app.js").status_code == 200
    i18n = client.get("/ui/i18n.js").text
@@ -0,0 +1,62 @@
+from io import BytesIO
+
+from PIL import Image
+
+from pigway_frame_flow.models import DisplayRequest
+
+
+def test_history_image_survives_cloud_cleanup(client, service):
+    data = BytesIO()
+    Image.new("RGB", (40, 60), "blue").save(data, "JPEG")
+    asset = service.assets.put(data.getvalue(), "example.jpg", "images")
+    request = DisplayRequest(content={"type": "image", "asset_id": asset["asset_id"]})
+    op = service.submit(
+        "display", request.model_dump(mode="json"), "living-room", "admin", "fixture"
+    )
+    service.process_one()
+    service.sync()
+    result = service.operation(op)["result"]
+    image_id = result["image_id"]
+    # Simulate an older receipt without the new name snapshot, then cloud cleanup.
+    service.db.execute(
+        "UPDATE operations SET result=? WHERE id=?",
+        (
+            '{"image_id":%d,"rendered_asset_id":"%s"}' % (image_id, asset["asset_id"]),
+            op,
+        ),
+    )
+    service.db.execute("DELETE FROM image_sources WHERE device_id=?", ("living-room",))
+    deletion = service.submit(
+        "delete",
+        {"image_id": image_id, "confirm_current": True},
+        "living-room",
+        "admin",
+        "delete-fixture",
+    )
+    service.update(deletion, "COMPLETED", {"image_id": image_id})
+    receipt = client.get("/api/v1/operations/" + deletion).json()["result"]
+    assert receipt["image_name"] == "example.jpg"
+    assert client.get(receipt["preview_url"]).status_code == 200
+    service.assets.path(asset["asset_id"]).unlink()
+    service.db.execute("DELETE FROM assets WHERE id=?", (asset["asset_id"],))
+    receipt = client.get("/api/v1/operations/" + deletion).json()["result"]
+    assert receipt["image_name"] == "example.jpg"
+    assert receipt["preview_url"] is None
+
+
+def test_history_missing_local_image_does_not_break_list(client, service):
+    op = service.submit("delete", {"image_id": 999}, "living-room", "admin", "fixture")
+    service.update(
+        op,
+        "FAILED",
+        {"image_id": 999},
+        {
+            "code": "DEVICE_OFFLINE",
+            "message": "Device offline",
+            "request_id": "fixture",
+        },
+    )
+    receipt = client.get("/api/v1/operations/" + op).json()
+    assert receipt["result"]["image_id"] == 999
+    assert receipt["result"]["preview_url"] is None
+    assert receipt["error"]["code"] == "DEVICE_OFFLINE"
@@ -0,0 +1,151 @@
+import hashlib
+import json
+
+from pigway_frame_flow.core.accounts import password_hash
+
+
+def make_op(service, n, status="COMPLETED", client_id="admin", action="render"):
+    key = service.submit(action, {}, "living-room", client_id, f"request-{n}")
+    service.update(key, status)
+    service.db.execute(
+        "UPDATE operations SET created_at=?,result=? WHERE id=?",
+        (
+            f"2026-10-{n:02d}T10:00:00+00:00",
+            json.dumps({"image_name": f"photo-{n}.jpg"}),
+            key,
+        ),
+    )
+    return key
+
+
+def test_pagination_filters_and_page_clamp(client, service):
+    ids = [make_op(service, n, "FAILED" if n % 2 else "COMPLETED") for n in range(1, 7)]
+    page = client.get("/api/v1/operation-history?page_size=2").json()
+    assert page["total"] == 6
+    assert [x["operation_id"] for x in page["items"]] == ids[-1:-3:-1]
+    assert (
+        client.get("/api/v1/operation-history?page=2&page_size=2").json()["items"][0][
+            "operation_id"
+        ]
+        == ids[3]
+    )
+    assert (
+        client.get("/api/v1/operation-history?page=99&page_size=2").json()["page"] == 3
+    )
+    assert client.get("/api/v1/operation-history?status=FAILED").json()["total"] == 3
+    assert (
+        client.get("/api/v1/operation-history?q=photo-3").json()["items"][0][
+            "operation_id"
+        ]
+        == ids[2]
+    )
+    assert (
+        client.get("/api/v1/operation-history?start=2026-10-03&end=2026-10-04").json()[
+            "total"
+        ]
+        == 2
+    )
+    assert (
+        client.get(
+            "/api/v1/operation-history?start=2026-10-05&end=2026-10-01"
+        ).status_code
+        == 422
+    )
+    assert client.get("/api/v1/operation-history?device_id=other").json()["total"] == 0
+    assert client.get("/api/v1/operation-history?action=display").json()["total"] == 0
+
+
+def test_delete_preserves_receipts_and_protects_running(client, service):
+    done = make_op(service, 1)
+    running = make_op(service, 2, "QUEUED")
+    assert (
+        client.request(
+            "DELETE",
+            "/api/v1/operation-history",
+            json={"operation_ids": [done, running]},
+        ).status_code
+        == 409
+    )
+    assert client.get("/api/v1/operation-history").json()["total"] == 2
+    assert (
+        client.request(
+            "DELETE",
+            "/api/v1/operation-history",
+            json={"operation_ids": [done, "missing"]},
+        ).status_code
+        == 404
+    )
+    assert (
+        client.request(
+            "DELETE", "/api/v1/operation-history", json={"operation_ids": [done, done]}
+        ).json()["deleted"]
+        == 1
+    )
+    assert client.get("/api/v1/operation-history").json()["total"] == 1
+    assert done not in [
+        x["operation_id"] for x in client.get("/api/v1/operations").json()
+    ]
+    assert client.get("/api/v1/operations/" + done).status_code == 200
+    assert service.db.one("SELECT id FROM operations WHERE id=?", (done,))
+    assert (
+        client.request(
+            "DELETE", "/api/v1/operation-history", json={"operation_ids": [done]}
+        ).json()["deleted"]
+        == 0
+    )
+
+
+def test_history_permissions(client, service):
+    mine = make_op(service, 1, client_id="reader")
+    make_op(service, 2)
+    service.db.execute(
+        "INSERT INTO clients VALUES(?,?,?,?,?,?,?)",
+        (
+            "reader",
+            hashlib.sha256(b"reader-token").hexdigest(),
+            "Reader",
+            json.dumps(["history:read"]),
+            "",
+            None,
+            1,
+        ),
+    )
+    client.headers["Authorization"] = "Bearer reader-token"
+    result = client.get("/api/v1/operation-history").json()
+    assert result["total"] == 1 and result["items"][0]["operation_id"] == mine
+    assert (
+        client.request(
+            "DELETE", "/api/v1/operation-history", json={"operation_ids": [mine]}
+        ).status_code
+        == 403
+    )
+    client.headers.pop("Authorization")
+    assert client.get("/api/v1/operation-history").status_code == 401
+
+
+def test_history_delete_requires_browser_csrf(client, service):
+    op = make_op(service, 1)
+    service.db.execute(
+        "INSERT INTO users VALUES(?,?,1)",
+        ("fixture", password_hash("fixture-password")),
+    )
+    client.headers.pop("Authorization")
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"username": "fixture", "password": "fixture-password"},
+    ).json()
+    assert (
+        client.request(
+            "DELETE", "/api/v1/operation-history", json={"operation_ids": [op]}
+        ).status_code
+        == 403
+    )
+    assert (
+        client.request(
+            "DELETE",
+            "/api/v1/operation-history",
+            json={"operation_ids": [op]},
+            headers={"X-CSRF-Token": login["csrf_token"]},
+        ).status_code
+        == 200
+    )
@@ -0,0 +1,237 @@
+import json
+from io import BytesIO
+
+import pytest
+from PIL import Image
+
+from pigway_frame_flow.core.photo_preferences import eligible, flags, set_flags
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.models import AutoCollageContent, PhotoSourceContent
+from pigway_frame_flow.providers.photo_sources import PhotoSourceInput
+
+
+def photo(service, name, color):
+    data = BytesIO()
+    Image.new("RGB", (320, 240), color).save(data, "JPEG")
+    return service.assets.put(data.getvalue(), name)
+
+
+def test_local_exclusion_star_and_restore(client, service):
+    excluded = photo(service, "excluded.jpg", "red")["asset_id"]
+    allowed = photo(service, "allowed.jpg", "blue")["asset_id"]
+    assert (
+        client.put(
+            f"/api/v1/assets/{excluded}/star", json={"starred": True}
+        ).status_code
+        == 200
+    )
+    result = client.put(f"/api/v1/assets/{excluded}/exclusion", json={"excluded": True})
+    assert result.status_code == 409
+    client.put(f"/api/v1/assets/{excluded}/star", json={"starred": False})
+    result = client.put(f"/api/v1/assets/{excluded}/exclusion", json={"excluded": True})
+    assert (
+        result.status_code == 200
+        and result.json()["excluded"]
+        and not result.json()["starred"]
+    )
+    assert (
+        client.put(
+            f"/api/v1/assets/{excluded}/star", json={"starred": True}
+        ).status_code
+        == 409
+    )
+    batch = client.post(
+        "/api/v1/assets/batch", json={"asset_ids": [excluded], "action": "star"}
+    ).json()
+    assert (
+        batch["results"][0]["status"] == "failed"
+        and batch["results"][0]["code"] == "CONFLICT"
+    )
+    assert next(
+        x for x in client.get("/api/v1/assets").json() if x["asset_id"] == excluded
+    )["excluded"]
+    asset = service.content_asset(
+        AutoCollageContent(type="auto_collage", count=1, use_ai=False)
+    )
+    saved = json.loads(
+        service.db.one(
+            "SELECT payload FROM asset_sources WHERE asset_id=?", (asset["asset_id"],)
+        )["payload"]
+    )
+    assert [r["asset_id"] for r in saved["data"]["layout"]["regions"]] == [allowed]
+    assert service.assets.path(excluded).is_file()
+    assert (
+        client.post(
+            "/api/v1/assets/batch", json={"asset_ids": [allowed], "action": "exclude"}
+        ).json()["results"][0]["status"]
+        == "completed"
+    )
+    with pytest.raises(FlowError):
+        service.content_asset(
+            AutoCollageContent(type="auto_collage", count=1, use_ai=False)
+        )
+    restored = client.put(
+        f"/api/v1/assets/{excluded}/exclusion", json={"excluded": False}
+    ).json()
+    assert not restored["excluded"] and not restored["starred"]
+    assert (
+        client.put(
+            f"/api/v1/assets/{excluded}/star", json={"starred": True}
+        ).status_code
+        == 200
+    )
+    assert service.content_asset(
+        AutoCollageContent(type="auto_collage", count=1, use_ai=False)
+    )
+
+
+def test_source_preferences_are_scoped_and_do_not_mutate_cached_catalog(
+    client, service, monkeypatch
+):
+    source = PhotoSourceInput(
+        name="Drive", kind="webdav", location="https://photos.example.test/dav"
+    )
+    items = [{"id": "folder/photo.jpg", "name": "photo.jpg"}]
+    monkeypatch.setattr(service.photo_sources, "get", lambda _: source)
+    monkeypatch.setattr(service.photo_sources, "catalog", lambda *args, **kwargs: items)
+    url = "/api/v1/photo-sources/drive/preferences"
+    assert (
+        client.put(url, json={"item_id": items[0]["id"], "starred": True}).status_code
+        == 200
+    )
+    assert (
+        client.put(url, json={"item_id": items[0]["id"], "excluded": True}).status_code
+        == 409
+    )
+    assert (
+        client.put(
+            url, json={"item_id": items[0]["id"], "starred": True, "excluded": True}
+        ).status_code
+        == 409
+    )
+    assert client.put(
+        url, json={"item_id": items[0]["id"], "starred": False, "excluded": True}
+    ).json() == {"starred": False, "excluded": True}
+    result = client.get("/api/v1/photo-sources/drive/images").json()["items"][0]
+    assert not result["starred"] and result["excluded"]
+    assert "excluded" not in items[0]
+    assert eligible(service.db, "drive", items) == []
+    assert eligible(service.db, "another-drive", items) == items
+    assert (
+        client.put(url, json={"item_id": "missing", "excluded": True}).status_code
+        == 404
+    )
+    with pytest.raises(FlowError):
+        service.content_asset(
+            AutoCollageContent(
+                type="auto_collage", source_id="drive", count=1, use_ai=False
+            )
+        )
+    with pytest.raises(FlowError):
+        service.photo_sources.read("drive")
+    with pytest.raises(FlowError):
+        service.content_asset(
+            PhotoSourceContent(type="photo_source", source_id="drive")
+        )
+    client.put(url, json={"item_id": items[0]["id"], "excluded": False})
+    assert eligible(service.db, "drive", items) == items
+    assert flags(service.db, "drive", items[0]["id"]) == {
+        "starred": False,
+        "excluded": False,
+    }
+
+
+def test_preference_persistence(settings):
+    from pigway_frame_flow.storage.database import Database
+
+    path = settings.data_dir / "preferences.db"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    db = Database(path)
+    set_flags(db, "drive", "item", excluded=True)
+    db.conn.close()
+    reopened = Database(path)
+    assert flags(reopened, "drive", "item")["excluded"]
+    reopened.conn.close()
+
+
+@pytest.mark.parametrize("value", ["true", "false", 1, 0, [], {}])
+def test_marks_reject_non_boolean_payloads(client, service, value):
+    key = photo(service, "fixture.jpg", "red")["asset_id"]
+    assert (
+        client.put(f"/api/v1/assets/{key}/star", json={"starred": value}).status_code
+        == 422
+    )
+    assert (
+        client.put(
+            f"/api/v1/assets/{key}/exclusion", json={"excluded": value}
+        ).status_code
+        == 422
+    )
+    assert (
+        client.put(
+            "/api/v1/photo-sources/drive/preferences",
+            json={"item_id": "fixture", "starred": value},
+        ).status_code
+        == 422
+    )
+
+
+def test_asset_marks_are_mutually_exclusive_under_concurrent_requests(client, service):
+    from concurrent.futures import ThreadPoolExecutor
+
+    key = photo(service, "fixture.jpg", "blue")["asset_id"]
+
+    def request_star():
+        return client.put(
+            f"/api/v1/assets/{key}/star", json={"starred": True}
+        ).status_code
+
+    def request_exclusion():
+        return client.put(
+            f"/api/v1/assets/{key}/exclusion", json={"excluded": True}
+        ).status_code
+
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        first = pool.submit(request_star)
+        second = pool.submit(request_exclusion)
+        assert sorted([first.result(), second.result()]) == [200, 409]
+    final = service.assets.info(key)
+    assert final["starred"] != final["excluded"]
+
+
+def test_source_marks_are_mutually_exclusive_under_concurrent_requests(service):
+    from concurrent.futures import ThreadPoolExecutor
+
+    def change(**mark):
+        try:
+            set_flags(service.db, "drive", "fixture", **mark)
+            return 200
+        except FlowError as error:
+            return error.status
+
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        first = pool.submit(change, starred=True)
+        second = pool.submit(change, excluded=True)
+        assert sorted([first.result(), second.result()]) == [200, 409]
+    final = flags(service.db, "drive", "fixture")
+    assert final["starred"] != final["excluded"]
+
+
+def test_batch_exclusion_rejects_starred_and_unknown_payload_fields(client, service):
+    key = photo(service, "fixture.jpg", "red")["asset_id"]
+    assert (
+        client.put(
+            f"/api/v1/assets/{key}/star", json={"starred": True, "excluded": False}
+        ).status_code
+        == 422
+    )
+    client.put(f"/api/v1/assets/{key}/star", json={"starred": True})
+    result = client.post(
+        "/api/v1/assets/batch", json={"asset_ids": [key], "action": "exclude"}
+    ).json()
+    assert (
+        result["results"][0]["status"] == "failed"
+        and result["results"][0]["code"] == "CONFLICT"
+    )
+    final = service.assets.info(key)
+    assert final["starred"] and not final["excluded"]
@@ -1,5 +1,6 @@
 from datetime import UTC, datetime, timedelta

+import pytest
 from test_display import submit

 from pigway_frame_flow.display.service import DisplayService
@@ -60,7 +61,9 @@ def test_persistent_block_escalates_once_survives_restart_and_preserves_evidence
        == 1
    )
    assert service.operation(operation)["recovery"]["checks"] == 3
-    assert service.operation(operation)["result"] == original["result"]
+    current_result = service.operation(operation)["result"]
+    assert current_result.pop("sync_observations")
+    assert current_result == original["result"]
    service.reconcile(operation, acknowledge=True)
    assert service.operation(operation)["recovery"]["state"] == "resolved"
    assert not service.operation(operation)["recovery"]["requires_manual_review"]
@@ -107,3 +110,184 @@ def test_malformed_reconciliation_does_not_abort_other_background_work(
    assert op["recovery"]["reason"] == "reconciliation_error"
    assert "private" not in str(op["recovery"])
    assert service.blocked("living-room")
+
+
+@pytest.mark.parametrize("status", ["SYNCING", "UNKNOWN"])
+def test_later_confirmed_display_closes_earlier_syncing_attempt_without_replay(
+    service, status
+):
+    first = submit(service)
+    service.process_one()
+    assert service.operation(first)["status"] == "SYNCING"
+    second = submit(service)
+    service.process_one()
+    driver = service.registry.get("living-room")
+    uploads = driver.client.uploads
+    previous_error = {"code": "WRITE_RESULT_UNKNOWN", "message": "Refresh unconfirmed"}
+    if status == "UNKNOWN":
+        service.update(first, status, error=previous_error)
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    old = service.operation(first)
+    assert old["status"] == "FAILED"
+    assert old["error"]["code"] == "DISPLAY_NOT_CONFIRMED"
+    assert old["error"]["details"]["superseded_by_operation_id"] == second
+    if status == "UNKNOWN":
+        assert old["error"]["details"]["previous_error"] == previous_error
+    assert driver.client.uploads == uploads
+    assert not service.blocked("living-room")
+    service.sync()
+    assert (
+        len(
+            service.db.all(
+                "SELECT * FROM history WHERE operation_id=? AND result='DISPLAY_NOT_CONFIRMED'",
+                (first,),
+            )
+        )
+        == 1
+    )
+
+
+def test_unconfirmed_later_display_does_not_close_old_attempt(service):
+    first = submit(service)
+    service.process_one()
+    second = submit(service)
+    service.process_one()
+    service.recovery.close_superseded_displays()
+    assert service.operation(first)["status"] == "SYNCING"
+    assert service.operation(second)["status"] == "SYNCING"
+
+
+def test_confirmed_temporary_override_does_not_close_earlier_display(service):
+    first = submit(service)
+    service.process_one()
+    second = submit(service, 60, True)
+    service.process_one()
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    assert service.operation(first)["status"] == "SYNCING"
+
+
+@pytest.mark.parametrize("client_id", ["scheduler", "scheduler-retry"])
+def test_automatic_upload_waits_for_prior_sync_confirmation(service, client_id):
+    first = submit(service)
+    service.process_one()
+    payload = service.db.one("SELECT payload FROM operations WHERE id=?", (first,))[
+        "payload"
+    ]
+    import json
+
+    second = service.submit(
+        "display", json.loads(payload), "living-room", client_id, "fixture"
+    )
+    uploads = service.registry.get("living-room").client.uploads
+    service.process_one()
+    assert service.operation(second)["status"] == "QUEUED"
+    assert service.registry.get("living-room").client.uploads == uploads
+    service.sync()
+    assert service.operation(first)["status"] == "COMPLETED"
+    service.process_one()
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    assert service.registry.get("living-room").client.uploads == uploads + 1
+
+
+def test_device_evidence_is_bounded_and_does_not_extend_sync_timeout(service):
+    first = submit(service)
+    service.process_one()
+    op = service.db.one("SELECT * FROM operations WHERE id=?", (first,))
+    before = service.operation(first)["updated_at"]
+    device = service.registry.get("living-room").device()
+    for i in range(20):
+        sample = device.model_copy(
+            update={
+                "current_content": device.current_content.model_copy(
+                    update={"id": 1000 + i}
+                )
+            }
+        )
+        service.recovery.observe_device(op, device=sample)
+    result = service.operation(first)
+    samples = result["result"]["sync_observations"]
+    assert len(samples) == 12
+    assert samples[0]["image_id"] == 1000 and samples[-1]["image_id"] == 1019
+    assert result["updated_at"] == before
+    service.update(first, "UNKNOWN", {"image_id": 7})
+    assert service.operation(first)["result"]["sync_observations"] == samples
+
+
+def test_device_read_failure_evidence_never_copies_raw_error_details(service):
+    first = submit(service)
+    service.process_one()
+    op = service.db.one("SELECT * FROM operations WHERE id=?", (first,))
+    service.recovery.observe_device(
+        op,
+        error=FlowError(
+            ErrorCode.CLOUD_UNAVAILABLE,
+            "unavailable",
+            details={
+                "transport_error": "read_timeout",
+                "url": "private-url-must-not-be-stored",
+            },
+        ),
+    )
+    sample = service.operation(first)["result"]["sync_observations"][-1]
+    assert sample["read_error"]["transport_error"] == "read_timeout"
+    assert "private-url" not in str(sample)
+
+
+def test_sync_timeout_includes_observed_device_state(service):
+    first = submit(service)
+    service.process_one()
+    service.registry.get("living-room").client.synced = False
+    service.registry.get("living-room").invalidate()
+    service.settings.sync_timeout = 0
+    service.sync()
+    op = service.operation(first)
+    assert op["status"] == "UNKNOWN"
+    assert op["error"]["details"]["last_device_observation"]["synced"] is False
+
+
+def test_automatic_wait_does_not_extend_past_sync_timeout(service):
+    import json
+
+    first = submit(service)
+    service.process_one()
+    payload = service.db.one("SELECT payload FROM operations WHERE id=?", (first,))[
+        "payload"
+    ]
+    service.db.execute(
+        "UPDATE operations SET updated_at=? WHERE id=?",
+        (
+            (
+                datetime.now(UTC) - timedelta(seconds=service.settings.sync_timeout + 1)
+            ).isoformat(),
+            first,
+        ),
+    )
+    second = service.submit(
+        "display", json.loads(payload), "living-room", "scheduler", "fixture"
+    )
+    service.process_one()
+    assert service.operation(second)["status"] == "SYNCING"
+
+
+def test_automatic_cleanup_waits_for_display_confirmation(service, monkeypatch):
+    first = submit(service)
+    service.process_one()
+    monkeypatch.setattr(service.cloud_library, "eligible", lambda *args: True)
+    cleanup = service.submit(
+        "delete",
+        {"image_id": 1, "cloud_cleanup": True},
+        "living-room",
+        "cloud-library",
+        "fixture-cleanup",
+    )
+    service.process_one()
+    assert service.operation(cleanup)["status"] == "QUEUED"
+    assert 1 in [x.image_id for x in service.registry.get("living-room").images()]
+    service.sync()
+    service.process_one()
+    assert service.operation(first)["status"] == "COMPLETED"
+    assert service.operation(cleanup)["status"] == "COMPLETED"
+    assert 1 not in [x.image_id for x in service.registry.get("living-room").images()]
@@ -37,6 +37,8 @@ def due(service, image_id):
        "UPDATE image_retention SET expires_at=? WHERE image_id=?",
        ((datetime.now(UTC) - timedelta(days=1)).isoformat(), image_id),
    )
+    # Complete the upload before simulating expiry days later and switching away.
+    service.sync()
    # The test driver switches to a different image, not a real device.
    driver = service.registry.get("living-room")
    driver.display(1)
@@ -92,3 +92,53 @@ def test_release_rejects_wrong_storage_uuid(release_tool, monkeypatch):
    monkeypatch.setattr(release_tool, "run", lambda *args: "different-storage-uuid")
    with pytest.raises(AssertionError):
        release_tool.main()
+
+
+@pytest.mark.parametrize("invalid", [None, "id", "commit", "version", "content"])
+def test_prebuilt_image_is_bound_to_source_before_deployment(
+    release_tool, monkeypatch, invalid
+):
+    import json
+    import subprocess
+
+    digest = "sha256:" + "a" * 64
+    monkeypatch.setenv("FRAME_FLOW_PREBUILT_IMAGE_ID", digest)
+    metadata = {
+        "Id": digest,
+        "Config": {
+            "Labels": {
+                "org.opencontainers.image.revision": "fixture-commit",
+                "org.opencontainers.image.version": "0.1.22",
+            }
+        },
+    }
+    if invalid == "id":
+        metadata["Id"] = "sha256:" + "b" * 64
+    if invalid == "commit":
+        metadata["Config"]["Labels"]["org.opencontainers.image.revision"] = "wrong"
+    if invalid == "version":
+        metadata["Config"]["Labels"]["org.opencontainers.image.version"] = "wrong"
+    monkeypatch.setattr(release_tool, "run", lambda *args: json.dumps([metadata]))
+    calls = []
+
+    def isolated(command, **kwargs):
+        calls.append(command)
+        assert "--network=none" in command and "--read-only" in command
+        assert "--cap-drop=ALL" in command and "--user=10333:10333" in command
+        assert "-v" not in command and "--mount" not in command
+        assert json.loads(kwargs["input"]) == {"LICENSE": "fixture-hash"}
+        if invalid == "content":
+            raise subprocess.CalledProcessError(1, command)
+
+    monkeypatch.setattr(release_tool.subprocess, "run", isolated)
+    if invalid:
+        with pytest.raises((AssertionError, subprocess.CalledProcessError)):
+            release_tool.verify_prebuilt_image(
+                "fixture-image", "fixture-commit", "0.1.22", {"LICENSE": "fixture-hash"}
+            )
+    else:
+        assert release_tool.verify_prebuilt_image(
+            "fixture-image", "fixture-commit", "0.1.22", {"LICENSE": "fixture-hash"}
+        )
+    if invalid in ("id", "commit", "version"):
+        assert not calls
Author	SHA1	Message	Date
渡口浪人	71cf2955ce	release: v0.1.28 photo selection and gallery polish Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 7m10s Details	2026-10-20 19:47:28 +08:00
渡口浪人	3b9c3e8c15	fix: anchor gallery card actions to bottom left Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 6m10s Details	2026-10-20 19:42:33 +08:00
渡口浪人	95625c5857	fix: make photo retention and exclusion mutually exclusive Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 6m10s Details	2026-10-20 19:19:30 +08:00
渡口浪人	b770626a66	fix: clarify gallery image download label Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 7m7s Details	2026-10-20 19:09:31 +08:00
渡口浪人	00b754db28	fix: restore delete as last local gallery action Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m55s Details	2026-10-20 19:07:18 +08:00
渡口浪人	b0a833f1ef	fix: simplify local gallery card actions Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m57s Details	2026-10-20 19:01:23 +08:00
渡口浪人	383ed45185	feat: exclude source photos from automatic selection Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m53s Details	2026-10-20 18:50:43 +08:00
渡口浪人	e6a3974d08	release: v0.1.27 history management Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 6m38s Details	2026-10-20 16:58:00 +08:00
渡口浪人	4771db6f2a	feat: paginate filter and delete operation history Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 7m29s Details	2026-10-20 16:53:27 +08:00
渡口浪人	c3bed2edce	release: v0.1.26 account security and settings polish Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m47s Details	2026-10-20 16:33:28 +08:00
渡口浪人	f8fe8e8b14	fix: retain logo beside stacked sidebar wordmark Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m31s Details	2026-10-20 16:26:57 +08:00
渡口浪人	50903564ad	fix: use stacked sidebar brand wordmark Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 9m57s Details	2026-10-20 16:23:16 +08:00
渡口浪人	69ef87e8e9	fix: confirm new password and compact settings layout Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m45s Details	2026-10-20 16:19:50 +08:00
渡口浪人	09c6773d76	feat: harden single-user account authentication Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m47s Details	2026-10-20 16:06:24 +08:00
渡口浪人	ecfa17607f	release: v0.1.25 official PIGWay branding Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m52s Details	2026-10-19 19:22:34 +08:00
渡口浪人	a83591d2c8	feat: integrate official PIGWay v1.1 brand assets Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m18s Details	2026-10-19 19:03:08 +08:00
渡口浪人	beb0bb0eb8	fix: vertically center every history table column Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m25s Details	2026-10-18 23:23:17 +08:00
渡口浪人	cc3fd02eb7	fix: identify history images and keep failure reasons visible Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 7m29s Details	2026-10-18 22:58:48 +08:00
渡口浪人	3a5acaa72a	fix: allow a pinned CI base-image mirror on Server Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m51s Details	2026-10-18 21:58:10 +08:00
渡口浪人	8e66b6d741	docs: move trusted CI runner from NAS to Server Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Failing after 5m55s Details	2026-10-18 21:31:03 +08:00
渡口浪人	acdf267e48	fix: align deployment labels and refresh v0.1.23 audit Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m23s Details	2026-10-18 20:59:32 +08:00
渡口浪人	28e971c0ff	fix: defer background cleanup until pending display is confirmed Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 7m44s Details	2026-10-18 20:32:37 +08:00
渡口浪人	a2e8a204e8	fix: defer automatic uploads while device synchronization is pending Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m30s Details	2026-10-18 20:21:52 +08:00
渡口浪人	50bb41899d	fix: verify full prebuilt images before offline production deployment Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 5m37s Details	2026-10-18 19:45:30 +08:00
渡口浪人	cb8ac32b74	fix: close unconfirmed displays superseded by confirmed updates Community checks / verify (push) Skipped Details Verify Frame Flow / verify (push) Successful in 6m29s Details	2026-10-18 19:27:35 +08:00