diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 920f76cb3..ab1063ff5 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -32,7 +32,7 @@ one to open.
 | LoRAs | `dw/pipeline_processors/adapters.py`: `active_loras`, `load_loras` | A `loras` entry whose `model_name` is null is switched off. | `tests/test_lora_disable.py::TestLoadLoras::test_an_all_null_entry_loads_nothing` |
 | Step progress | `dw/pipeline_processors/progress.py`: `reported_progress_bars` | A pipeline with no step callback reports its denoise steps through its progress bars. | `tests/test_modular_progress.py::test_every_advance_of_the_bar_is_reported` |
 | Step timing | `dw/pipeline_processors/timing.py`: `StepTimer`, `step_timer`, `timed_step`, `mark` | Only a pipeline step that ran is timed, on the worker's monotonic clock: `step_timer` opens a `StepTimer` for a step with a `pipeline` or `pipeline_reference` and None for any other, which also hides an outer step's timer from a composed child. Load, call, denoise start, each pass and save reach the open timer through `mark`, and nowhere else. Denoise start is never taken inside a compiled region: a whole-compiled denoiser (`_compiled_call_impl` set) has that callable wrapped for the call instead of a forward pre-hook, which `fullgraph: true` cannot trace. A span with a missing mark is null, never guessed. `record_step` puts the reading on the step's manifest entry and `step_end`, and a reused step gets no `timing`. A chain sums its pipeline calls into one `timing` with `segments: N`. `ManifestEntry.timing` declares the shape (`docs/WORKSPACES.md` *Step timing*). | `tests/test_step_timing.py::test_a_missing_denoise_start_nulls_encode_and_first_pass`, `tests/test_step_timing.py::test_a_reused_step_carries_no_timing_even_when_one_is_passed`, `tests/test_step_timing.py::test_a_chain_sums_its_segments_and_takes_one_median_over_both`, `tests/test_step_timing.py::test_a_task_step_run_through_the_step_loop_has_no_timing`, `tests/test_step_timing.py::test_the_denoise_hook_marks_the_first_forward_once_and_removes_itself`, `tests/test_step_timing.py::test_a_fullgraph_compiled_denoiser_runs_and_still_gets_the_start_mark` |
-| Step-cache skip counts | `dw/pipeline_processors/timing.py`: `CacheCounter`, `counting_forwards`, `report_cache_stats`, `StepTimer.cache_counted`; `dw/pipeline_processors/components.py`: `stateful_cache_context`, `get_cache_transformer` | For `first_block` and `mag`, a forward hook on the cache transformer counts computed or skipped once per forward, reading the leader hook's `should_compute` inside the cond/uncond `cache_context` the pipeline opened, so classifier-free guidance counts both forwards. `stateful_cache_context` registers the hook for one pipeline call; its `finally` emits `cache_stats` before `_reset_stateful_cache()` and removes the hook after the event. Private diffusers state that has moved gives null counts and one `cache_stats_unavailable` warning, and never fails the run; `taylorseer`, `faster` and `text_kv` report type and config only, with no warning. The counts reach the step's `timing.cache` only through `StepTimer.cache_counted`; a chain sums its calls' counts, and a null in any call nulls the sum. A step with no `cache` has no `cache` key and no event (`docs/ACCELERATION.md` *Reading the skip counts*). | `tests/test_cache_stats.py::test_cfg_counts_two_forwards_per_step_and_they_add_up`, `tests/test_cache_stats.py::test_the_event_names_the_step_and_segment_and_goes_out_before_the_reset`, `tests/test_cache_stats.py::test_moved_hook_state_nulls_the_counts_warns_once_and_the_run_finishes`, `tests/test_cache_stats.py::test_the_private_diffusers_names_are_where_the_counter_reads_them`, `tests/test_cache_stats.py::test_the_timer_sums_counts_and_nulls_on_any_null`, `tests/test_cache_stats.py::test_types_without_a_decision_report_type_only_and_no_warning` |
+| Step-cache skip counts | `dw/pipeline_processors/timing.py`: `CacheCounter`, `counting_forwards`, `report_cache_stats`, `StepTimer.cache_counted`; `dw/pipeline_processors/components.py`: `stateful_cache_context`; `dw/pipeline_processors/mag_calibration.py`: `get_cache_transformer`, `captured_mag_calibration` | For `first_block` and `mag`, a forward hook on the cache transformer counts computed or skipped once per forward, reading the leader hook's `should_compute` inside the cond/uncond `cache_context` the pipeline opened, so classifier-free guidance counts both forwards. `stateful_cache_context` registers the hook for one pipeline call; its `finally` emits `cache_stats` before `_reset_stateful_cache()` and removes the hook after the event. Private diffusers state that has moved gives null counts and one `cache_stats_unavailable` warning, and never fails the run; `taylorseer`, `faster` and `text_kv` report type and config only, with no warning. The denoiser a cache attaches to (`get_cache_transformer`) and the MagCache calibration capture (`captured_mag_calibration`, the end-of-run log record turned into `cache_stats`-side job events, #891/#927) live in `mag_calibration.py`, which `components.py` imports and re-exports for `pipeline.py`, never the reverse. The counts reach the step's `timing.cache` only through `StepTimer.cache_counted`; a chain sums its calls' counts, and a null in any call nulls the sum. A step with no `cache` has no `cache` key and no event (`docs/ACCELERATION.md` *Reading the skip counts*). | `tests/test_cache_stats.py::test_cfg_counts_two_forwards_per_step_and_they_add_up`, `tests/test_cache_stats.py::test_the_event_names_the_step_and_segment_and_goes_out_before_the_reset`, `tests/test_cache_stats.py::test_moved_hook_state_nulls_the_counts_warns_once_and_the_run_finishes`, `tests/test_cache_stats.py::test_the_private_diffusers_names_are_where_the_counter_reads_them`, `tests/test_cache_stats.py::test_the_timer_sums_counts_and_nulls_on_any_null`, `tests/test_cache_stats.py::test_types_without_a_decision_report_type_only_and_no_warning` |
 | Community pipelines | `dw/community_pipelines/` (e.g. `pipeline_ltx2_refine.py`: `LTX2RefinePipeline`), `dw/introspection.py`: `community_pipelines`, `load_allowed_class` | A pipeline dw ships is named by its dotted path (`dw.community_pipelines.<module>.<Class>`), loads untrusted because it is under `dw`, and is listed by `list_pipelines` and resolved by `get_pipeline_signature` - only the modules in that directory, never a caller-chosen import. `LTX2RefinePipeline` VAE-encodes `video` at `width` x `height` and passes it unnormalized as `latents`, because `LTX2Pipeline.prepare_latents` normalizes 5-D latents itself. | `tests/test_ltx2_refine_pipeline.py::TestIntrospection::test_only_the_shipped_modules_resolve`, `tests/test_ltx2_refine_pipeline.py::TestEncode::test_the_latents_are_left_unnormalized_for_the_parent` |
 | Adding a task | `dw/tasks/registry.py`: `register_command`, `RegistryTable` | A task is a function registered with `@register_command`, and the signature of its implementation is its argument schema. Its validate-time rules are declared on the same decorator - `domains`, `choices`, `static_check`, `whole_numbers` and `media_arguments` - and `TASK_ARGUMENT_DOMAINS`, `TASK_ARGUMENT_CHOICES`, `TASK_STATIC_CHECKS`, `TASK_WHOLE_NUMBER_ARGUMENTS` and `TASK_MEDIA_ARGUMENTS` are read-only views derived from them, so there is no second table to forget (#692). The registry lives in `dw/tasks/registry.py`; `dw/tasks/task.py` re-exports it, and a task module may register its own handler, as `dw/tasks/beats.py` does, provided `dw/tasks/task.py` imports it (`docs/TASKS.md` *Adding a task*). The built-in handlers are grouped by family the same way - `dw/tasks/audio_handlers.py`, `dw/tasks/video_handlers.py`, `dw/tasks/finish_handlers.py` and `dw/tasks/model_handlers.py` (#790) - and `dw/tasks/task.py` keeps the general-purpose commands, the processor dispatch and `Task`. | `tests/test_task_discovery.py::TestDescribeTask::test_signature_becomes_the_schema`, `tests/test_task_registry_rules.py::test_every_derived_table_is_the_registrys_view`, `tests/test_task_registry_rules.py::test_every_static_check_is_registered_to_exactly_one_command`, `tests/test_task_registry_rules.py::test_every_media_argument_is_a_parameter_of_its_command` |
 | Task argument domains | `dw/task_domains.py`: `check_arguments`, `task_argument_errors`; `dw/task_problems.py`: `face_track_errors`, `beats_errors`, `cuts_errors`, `lut_errors` | A numeric domain that a signature cannot express is declared on the command's `@register_command(domains=...)`, and it is checked at validation and again at run time. A numeric argument is read by `whole_number` or `real_number`, the only numeric coercion in `dw/tasks/`, and validation applies the same rule (`number_problem`), so a value is refused at both or at neither: `"3.0"` is a whole number, `"3.5"` for one of `whole_numbers` is not, and `true` is no number (#774). `Task.run` coerces every declared argument through `coerce_arguments` before dispatch, so a handler sees a number, and an argument that has no range besides being a number declares `finite`. A command's cross-argument rules are its registered `static_check`, which `task_argument_errors` runs at validation (`attribute_voices`' `voices_argument_errors`, kept in `dw/tasks/voice_attribution.py`, among them). A literal enum choice (`choice_errors`) is refused at validation by the same module. The per-family rules past a single domain live in `dw/task_problems.py`, which reads `task_domains`' helpers and is never imported by it (`task_argument_errors` reaches them only through the registered `static_check`, so `import_cycles` stays 0; #790): the `ingredients_grid` image count against `max_images` (`ingredients_grid_errors`), and `crop_face_track`'s cross-argument rules (`face_track_problems`, `face_track_errors`: crop size a multiple of the step's `multiple` (32 by default), `remainder` below `modulus`, `gate_zero` above `gate_full`, padding and confidence limits), which the task checks again at run time, as `analyze_beats`' are too (`beats_problems`, `beats_errors`: `min_bpm` below `max_bpm`, and anchors that are one kind per list, ascending, with whole beat indexes; `tests/test_analyze_beats.py`), and `plan_cuts`' (`cuts_problems`, `cuts_errors`: a bare-string transcript (`transcript_problem`, which `plan_cuts` also calls at run time), `min_scene_s` above `max_scene_s`, `segment_by: "beat"` without beats), and `apply_lut`'s (`lut_source_problem`, `palette_problem`, `lut_errors`: exactly one of `lut` or `palette`, and a palette of 2..16 `#rrggbb` colours, re-checked at run time by `check_lut_source`), and `check_face_detector_source` vets its Hub repo and `.onnx` file before any download. `select`'s index stays in `task_domains` with the other media-timing rules (`select_index_problem`, `select_rule_problems`: a whole number, at least 0, and below the candidate count when the count is known, i.e. at run time or when `candidates` is a written list). | `tests/test_task_domains.py::TestTheStaticPass::test_a_negative_frame_count_is_refused_at_its_path`, `tests/test_numeric_coercion.py::TestGradeExposure::test_a_string_number_grades_like_the_number`, `tests/test_task_domains.py::TestAtRunTime::test_slice_audio_refuses_a_negative_count`, `tests/test_ingredients_grid.py::TestStaticValidation::test_bad_layout_and_fit`, `tests/test_face_track.py::TestStaticValidation::test_bad_literal_is_an_error_at_its_argument`, `tests/test_face_track.py::TestCropFaceTrack::test_bad_arguments_are_refused_at_run_time`, `tests/test_face_track.py::TestStaticValidation::test_a_declared_grid_is_accepted`, `tests/test_face_track.py::TestDetectorSource::test_traversing_repo_is_refused`, `tests/test_select_validation.py::TestSelectErrors::test_an_out_of_range_literal_index_names_both_ends`, `tests/test_lut.py::TestPaletteAtValidate::test_both_refuse_naming_the_two`, `tests/test_lut.py::TestPalette::test_a_bad_palette_refuses_naming_the_entry` |
@@ -67,12 +67,14 @@ one to open.
 | Concept | Owner | Rule | Enforced by |
 | --- | --- | --- | --- |
 | Run directories | `dw/runs.py`: `open_run`, `workflow_identity`, `new_run_id` | Each execution writes into `<output_dir>/<identity>/<run id>/` with a `manifest.json`, unless the flat layout is chosen (the test pins the flat-layout exception). | `tests/test_runs.py::TestRunDirectories::test_the_flat_layout_writes_where_it_always_did` |
-| A file's role (final / intermediate / input) | `dw/roles.py` | Decided per step: result.role, then a final/intermediate subfolder, then data flow (a step a media-writing or unsaved consumer reads is intermediate). Engine records it at run end, with `role_declared` where result.role stated it; the server reports only recorded roles, so an older run has none. At read time the gallery (`GET /api/gallery`, its `role=` filter, the metadata route) also demotes a file a later run of the same workspace read - an `output:` input (an unpinned `latest` is the newest run started before the reader) or an `asset:` keep_output kept from it - unless its role was declared (`consumed_outputs`, `listed_role`, once per listing; no manifest is rewritten). | `tests/test_roles.py`, `tests/test_roles.py::test_a_file_a_later_run_read_is_consumed`, `tests/test_roles.py::test_listed_role`, `tests/test_gallery_roles.py::test_a_file_a_later_run_read_lists_as_intermediate`, `tests/test_gallery_roles.py::test_a_declared_final_stays_final` |
+| A file's role (final / intermediate / input) | `dw/roles.py` | Decided per step: result.role, then a final/intermediate subfolder, then data flow (a step a media-writing or unsaved consumer reads is intermediate). Engine records it at run end, with `role_declared` where result.role stated it; a run that predates roles recorded none, so the listing falls back on the file's own `final`/`intermediate` subfolder, then the demotion below, and a file neither places has none. At read time the gallery (`GET /api/gallery`, its `role=` filter, the metadata route) also demotes a file a later run of the same workspace read - an `output:` input (an unpinned `latest` is the newest run started before the reader) or an `asset:` keep_output kept from it - unless its role was declared (`consumed_outputs`, `listed_role`, once per listing; no manifest is rewritten). | `tests/test_roles.py`, `tests/test_roles.py::test_a_file_a_later_run_read_is_consumed`, `tests/test_roles.py::test_listed_role`, `tests/test_roles.py::test_listed_role_of_a_run_that_recorded_none`, `tests/test_gallery_roles.py::test_older_run_reads_its_intermediate_subfolder_as_intermediate`, `tests/test_gallery_roles.py::test_a_pre_roles_file_a_later_run_read_lists_as_intermediate`, `tests/test_gallery_roles.py::test_metadata_agrees_with_the_listing_for_an_older_run`, `tests/test_gallery_roles.py::test_a_file_a_later_run_read_lists_as_intermediate`, `tests/test_gallery_roles.py::test_a_declared_final_stays_final` |
 | Notes on runs, files, assets, workspaces | dw/notes.py | notes.json beside what it describes (run dir or asset dir; a file's own note else the run's), workspace.json at a workspace root; only the server writes them, never the engine; ≤4000 chars, plain text. | tests/test_notes.py |
 | Run versions | `dw/runs.py`: `open_run`, `run_versions`, `record_run_versions`, `copy_runs_in` | A run takes its number once, when it opens (or, copied in from another workspace, when `copy_runs_in` places it), so deleting a middle run leaves a gap rather than renumbering. | `tests/test_runs.py::TestRunVersions::test_a_deleted_middle_run_leaves_a_gap_rather_than_renumbering`, `tests/test_runs.py::TestRunVersions::test_runs_started_in_the_same_second_still_number_upward` |
 | Run-version surfaces | `dw/runs.py`: `run_versions`, `dw/server/routes/gallery.py`, `dw/server/outputs.py`, `dw_mcp/tools_catalog.py`: `list_gallery`, `ui/src/lib/pages/GalleryPage.svelte` | Only `dw/runs.py` computes the number, and every other module reads it back. | `tests/test_runs.py::TestRunVersions::test_an_output_reference_can_name_a_run_by_its_version` |
+| What the server says about an output file | `dw/server/outputs.py`: `output_annotations` | The gallery listing (`dw/server/routes/gallery.py`) and the metadata route (`dw/server/routes/media.py`) describe an output file's `role`, `note`, `note_source`, `run_note`, `starred` and `version` through `output_annotations`, and neither builds those fields on its own. | `tests/test_gallery_roles.py::test_metadata_agrees_with_the_listing_on_a_starred_noted_demoted_file` |
 | Result subfolders | `dw/subfolders.py`: `subfolder_errors`, `dw/security.py`: `SUBFOLDER_PATTERN` | A step's `result.subfolder` is checked for shape at validation. | `tests/test_subfolders.py::TestValidationErrorsIntegration::test_validation_errors_reports_a_bad_subfolder` |
 | Template subfolder roles | `workflows/templates/`, `dw/workflows/` | Every saving step of a template is marked `final` or `intermediate`, with at least one `final`, and packaged builtins stay unmarked. | `tests/test_template_subfolders.py::test_every_saving_step_of_a_template_names_its_role`, `tests/test_template_subfolders.py::test_the_packaged_builtins_stay_unmarked` |
+| Frames carrying their rate | `dw/media_types.py`: `FrameList` (re-exported by `dw/tasks/video_utils.py`), `rated_videos` | The one list of frames (or of videos) that carries `.fps` and `.shots`: a video loaded from a file (`dw/argument_media.py`) and a step that knows its rate but would return bare frame lists both answer it - `h3_tiles`' tiled refine `videos`, and every pipeline step whose pipeline reports its own `fps` (MiniMax-H3's property; `dw/output_extraction.py`: `attach_video_frame_rate`, called by `pipeline.py`'s `_run_once` beside `attach_audio_sample_rate`, #1056) - through `rated_videos`, the batch and each video in it, so `pair_audio` and the result writer read `getattr(video, "fps", None)` instead of fitting and playing at the default 8 fps. A pipeline that reports no rate leaves its lists bare. No second class of that name. | `tests/test_h3_tiles.py::TestTileLoopReporting::test_the_videos_are_dws_one_frame_list`, `tests/test_pipeline_components.py::TestVideoFrameRate::test_a_dict_outputs_videos_carry_the_pipelines_rate`, `tests/test_pipeline_components.py::TestVideoFrameRate::test_a_pipeline_with_no_rate_leaves_the_lists_bare`, `tests/test_modular_output_properties.py::TestTheBasesOwnTakeSavesBesideIt::test_the_base_take_pairs_at_its_own_rate_with_no_padding`, `tests/test_video_utils.py` (the `FrameList` cases) |
 | JSON records beside media | `dw/media_types.py`: `JsonRecord`, `dw/result.py`: `Result.save_artifact` | A dict marked `JsonRecord` is saved whole as one `.json`, whatever content type the step declares, and is never split into one file per key. | `tests/test_face_track.py::test_json_record_is_saved_whole_under_a_video_content_type`, `tests/test_face_track.py::test_the_task_result_saves_crops_as_video_and_track_as_one_json` |
 | Reading a JSON record back | `dw/locations.py`: `load_json_record` | A task reads a saved JSON record (`fit_to_model`'s, `crop_face_track`'s) only through `load_json_record`: the path is confined like any media path, then the extension must be `.json`, then the size is checked against `MAX_JSON_SIZE`, and only then is it parsed. `fit._read_fit` and `face_track._read_track` call it, never `open`. | `tests/test_locations.py::TestLoadJsonRecord::test_traversal_out_of_the_roots_is_refused`, `tests/test_locations.py::TestLoadJsonRecord::test_a_non_json_extension_is_refused`, `tests/test_locations.py::TestLoadJsonRecord::test_an_oversized_file_is_refused_before_it_is_read`, `tests/test_fit_to_model.py::TestRestore::test_fit_path_with_traversal_is_refused` |
 | Shots in a joined video | `dw/shots.py` | Every `AudioVideo` constructor decides what to do with `shots`, and the sample spans are measured from the joined waveform. | `tests/test_shots.py::test_every_audio_video_constructor_site_is_decided`, `tests/test_shots.py::TestConcatVideosShots::test_an_overrun_track_is_measured_not_derived` |
@@ -95,20 +97,22 @@ one to open.
 | Admission | `dw/server/admission.py`: `admit` | Validate, submit, rerun and enhance load and check a request once, and `JobManager.submit` does not check it again. | `tests/test_admission.py::test_a_submit_expands_once` |
 | Variable constraints | `dw/variable_constraints.py`: `apply_constraints`; the grid arithmetic `aligned` / `aligned_down` | A model's rule about a value is declared in the workflow's `variable_constraints`, and it is checked at validation and again before anything loads. `plan_cuts` (and its static check) rounds render lengths through `aligned` / `aligned_down`, never its own copy, so a planned `num_frames` is one the template's constraint accepts; `crop_face_track` pads its crops to the step's `modulus`/`remainder` grid through `aligned` too (`padding_to_grid`). | `tests/test_variable_constraints.py::TestTheGrid::test_without_snap_an_off_grid_value_is_refused_not_rounded`, `tests/test_variable_constraints.py::TestTheGrid::test_plan_cuts_rounds_through_the_constraint_owner`, `tests/test_face_track.py::TestPadding::test_padding_to_grid_rounds_through_the_constraint_owner`, `tests/test_variable_constraints.py::TestTheRunTimePass::test_an_illegal_value_is_refused_before_anything_loads` |
 | Bound acknowledgement | `dw/plan.py`: `fingerprint`, `dw/server/admission.py`: `check_bound_acknowledgement` | A bound `acknowledged_cost` is refused with 409 when the plan's fingerprint or its required downloads changed. The fingerprint is keyed only by what can change the output: `DOCUMENTATION_KEYS` (`cost`, `cost_drivers`, `vram_estimate`, descriptions, catalog shape/traits), a constraint's `reason` and a result's role, subfolder and file name are left out, of the workflow and of each composed child; every schema key is sorted into left out or kept. A number digests by value, not spelling (`12.0` as `12`), and the seed stays out (#85). | `tests/test_plan.py::TestFingerprintKeys::test_the_exclusion_lists_are_pinned`, `tests/test_plan.py::TestTheCatalogH3Template::test_a_client_round_trip_keeps_it`, `tests/test_plan.py::TestFingerprintKeys::test_every_top_level_schema_key_is_sorted`, `tests/test_server.py::TestBoundRerun::test_a_rerun_bound_to_a_stale_plan_is_refused`, `tests/test_server.py::TestBoundAcknowledgement::test_a_matching_fingerprint_queues` |
-| Per-repo gating | `dw/plan.py`: `build_plan` | Each gated repo, including a `loras` entry's repo, is probed and reported on its own. | `tests/test_plan.py::TestDownloadsRequired::test_a_gated_repo_this_token_lacks_access_to_is_blocked` |
+| Per-repo gating | `dw/plan_downloads.py`: `_model_info`, `_probe_gate_blocked`, assembled by `dw/plan.py`: `build_plan` | Each gated repo, including a `loras` entry's repo, is probed and reported on its own. | `tests/test_plan.py::TestDownloadsRequired::test_a_gated_repo_this_token_lacks_access_to_is_blocked` |
+| Download sources | `dw/plan_downloads.py`: `downloads_required`, `_collect_sources`, `_collect_component_overrides`, `_sub_workflow_paths` (which `plan.estimate` walks children by too; the module never imports `dw/plan.py` back, and `plan.py` re-exports `downloads_required` and `gate_warnings`) | `downloads_required` lists every `model_name`, `loras` repo, single-file URL and `load_components.pretrained_model_name_or_path` override (string, per-component dict, `default`), once each. The base repo stays listed whole: an override's replaced subfolder is not subtracted, so the list is a floor. | `tests/test_plan.py::TestDownloadsRequired::test_a_load_components_repo_override_is_listed` |
+| Task weights | each fetching task's `*_source(arguments)` (e.g. `dw/tasks/remove_object.py`: `remover_source`); `dw/tasks/weights.py`: `argument_or_default`, `file_entries`, `package_dir`; `dw/tasks/registry.py`: `required_weights_hook`, `register_weights_fallback`; `dw/tasks/image_utils.py`: `processor_weights_hook`; `dw/security.py`: `validate_weight_name`; `dw/plan_downloads.py`: `_collect_task_weights`, `_file_info` | A model-backed task declares `required_weights(arguments)` on its `register_command`, and `downloads_required` lists those repos beside the pipeline `model_name`s (a shared repo once; a reference or local-path argument none). A single-file task lists `{repo, filename, revision}` entries, checked per file against the cache; `restore_faces` also lists facexlib's weights as URL entries. A task's declaration and its loader read the same resolution of which argument wins (a single-file task's `*_source(arguments)`, an overridable whole-repo task's `argument_or_default` call, a fixed repo's module constant), so they cannot differ; `argument_or_default` is the shared helper only where `None` means the default (`remover_source` and `upscaler_source` treat any falsy value as absent; `spandrel_source` has no default). `file_entries` builds a file entry (its name checked by `validate_weight_name`), `package_dir` finds facexlib's weights dir without importing it, and `_file_info` sizes one file. The lookup path is acyclic: `dw/locations.py` reads the registry's tables and the task modules import the location policy and `weights.py`, so the registry imports no task module (an image processor's hook reaches it through `register_weights_fallback`, which `image_utils` calls at import) and `weights.py` imports only `dw/security.py`, where `validate_weight_name` lives for that reason. A task module the hook lookup imports keeps `transformers` out of its module top (`hf_pipeline` is a lazy wrapper, patched by name in the tests), so a validate never pays for it. | `tests/test_task_weights.py`, `tests/test_task_weights.py::TestTheHookPathStaysAcyclic::test_weights_imports_only_the_security_leaf_from_dw`, `tests/test_task_weights.py::TestTheHookPathStaysAcyclic::test_the_registry_imports_nothing_from_dw` |
 | Observed cost | `dw/server/observed_cost.py`: `declared_drivers`, `ObservedCosts._on_this_card`, `ObservedCosts.card` | `observed` comes only from this box's finished jobs on the named card (the one `route` names, for `plan.estimate`), else the server's own card; `ObservedCosts.card` owns a card's (kind, name, default). Rows are matched by card name whatever index they ran on (a job from before jobs carried a `device` counts only while the server is on the default card), and never writes `cost`. Cold and warm runs are reported separately. | `tests/test_observed_cost.py::TestColdIsNotWarm::test_the_two_are_reported_separately_each_with_its_runs`, `tests/test_observed_cost.py::TestByCard::test_only_rows_from_this_card_count_whichever_index_they_had`, `tests/test_observed_cost.py::TestByCard::test_rows_from_before_jobs_carried_a_device_do_not_count_off_the_default_card` |
 | The estimate | `dw/plan.py`: `estimate`, `_tempered`; the driver scaling is `dw/cost_scaling.py`: `scale_curated`, `_driver_scaling` | `plan.estimate` quotes the observed figure ahead of the curated one, and blends it toward the curated figure below three runs. A `cost` entry is measured at the workflow's variable defaults; a run moving `num_inference_steps`, `width`/`height` or `num_frames` (per list entry, summed) scales it in proportion (`scale_curated`, which `dw/server/deps.py` reuses for an inherited figure), basis `derived` with `scaled` naming each axis, times the list-length re-price, and that scaled figure is what a thin observed one blends toward (#866). | `tests/test_plan.py::TestObservedEstimate::test_history_beats_a_curated_figure`, `tests/test_plan.py::TestLowConfidenceObservedEstimate::test_a_single_run_blends_toward_the_curated_figure`, `tests/test_plan.py::TestDriverScaling::test_steps_canvas_and_frames_multiply`, `tests/test_plan.py::TestScalingAccuracy::test_within_thirty_percent` |
 | Cost drivers | `dw/server/observed_cost.py`: `declared_drivers` | A cost driver that names no declared variable is dropped. | `tests/test_observed_cost.py::TestComparability::test_a_driver_naming_no_variable_is_dropped`, `tests/test_observed_cost.py::TestTheCatalogsDriversAreReal::test_every_declared_driver_is_a_variable_of_its_workflow` |
 | Raw workflow GET | `dw/server/routes/library.py`: `get_workflow` | The raw workflow GET is served verbatim, with no `observed`, because the editor saves what it reads. | — |
 | VRAM projection | `dw/vram_estimate.py`, `dw/guides.py`: `guide_lengths` | A template's `vram_estimate` is projected per step after `for_each` expansion, and only the largest step over the ceiling is reported. With `bytes_per_guide_voxel` declared, each guide the step lays in (its own non-null `guides` plus a guide chain's) adds its snapped frames times the canvas; an unprobeable clip is charged at `num_frames`, and validate, admission and run project the same number. | `tests/test_vram_estimate.py::test_only_the_largest_over_ceiling_step_is_reported_once_per_cost_entry`, `tests/test_vram_guides.py::test_validate_apply_and_required_agree_on_a_guided_definition` |
 | H3 Ref2VA VRAM numbers | `workflows/templates/minimax/` | Every Ref2VA template declares `base_gb` 16.0, `bytes_per_voxel` 28.71 and `gb_per_reference` 1.0. | `tests/test_h3_vram_ceiling.py::test_every_ref2va_minimax_template_declares_gb_per_reference` |
-| Inherited VRAM ceiling | `dw/vram_inheritance.py`, `dw/server/deps.py`: `ceiling_index` (the catalog parse is `_catalog_listing`, shared with the cost lookup below) | A workflow with no `vram_estimate` is matched against the catalog by pipeline identity, and is warned, never refused. | `tests/test_vram_inheritance.py::test_every_template_declaring_one_identity_declares_the_same_numbers` |
+| Inherited VRAM ceiling | `dw/vram_inheritance.py`, `dw/server/deps.py`: `ceiling_index` (the catalog parse is `_catalog_listing`, shared with the cost lookup below) | A workflow with no `vram_estimate` is matched against the catalog by pipeline identity, and is warned, never refused. Under the ceiling it still gets a `vram_config_differs` warning when its offload or quantization differs from the template's, which the estimate was calibrated on (#954). | `tests/test_vram_inheritance.py::test_every_template_declaring_one_identity_declares_the_same_numbers`, `tests/test_vram_inheritance.py::TestConfigDiffers::test_missing_offload_under_the_ceiling_notes_it` |
 | Inherited cost | `dw/server/deps.py`: `inherited_observed`, `dw/vram_inheritance.py`: `inherited_differences`, `dw/plan.py`: `_observed` (basis `inherited`), `dw/server/routes/jobs.py`: `_inherited_cost_warnings` | An inline workflow (no catalog name) is priced from the observed runs of the catalog template with the same `component_type` + `model_name` + `workflow` key as `vram_inheritance`; the template with the most cold runs wins, then name. `differs` lists offload, quantization, frame count, attention backend, cache, LoRA and reference count (the `references` list lengths, per-entry `item:` ones read off the `for_each` list; named, not scaled, #915) set differently from the template, and sets `low_confidence` when it lists any (#866). More pipeline steps than the template run (a `for_each` counted per member, against the list the bucket ran, so a fallback to the default bucket re-prices a longer list) re-price its minutes linearly, and the mean frames, inference steps, width and height per pipeline step are scaled by `scale_curated` itself - the one rule the catalog figure uses, so an inline copy and its template quote one request alike - with `scaled` naming why and `low_confidence` set (#851, #866). It is warned, never refused. | `tests/test_inherited_cost.py::TestPricedByPipelineIdentity::test_an_inline_copy_inherits_the_templates_runs`, `tests/test_inherited_cost.py::TestDifferences::test_offload_quantization_and_frames_are_named`, `tests/test_inherited_cost.py::TestDifferences::test_a_reference_count_other_than_the_templates_is_named`, `tests/test_inherited_cost.py::TestThePlanReportsIt::test_the_estimate_is_inherited_and_the_validate_answer_warns`, `tests/test_inherited_cost.py::TestTheTemplateAndAnInlineCopyAgree::test_the_same_minutes_within_rounding`, `tests/test_inherited_cost.py::TestAListLongerThanTheFallbackBucket::test_an_inline_six_shot_copy_scales_by_members` |
 | Projected host-RAM peak | `dw/server/host_ram_need.py`: `memory_key`, `projected_peak`, `host_memory_block`; the fit is `dw/host_memory_projection.py`: `projected_mb`; history by key is `dw/server/job_history.py`: `peaks_for_key` | A run's memory key is the sorted pipeline identity of its pipeline steps plus every `quantization_config` / `offload` / `group_offload` value, with arguments substituted through `replace_variables`; never the workflow's name, so a renamed or inline copy shares the template's history. `observed` is the max peak over this machine's successful same-key runs and comes ahead of the list-run fit, unless the shape holds its pipeline across the list and the fit is the larger (the key leaves list length out, #910); with neither there is no figure. It never refuses; dispatch may delay a start on it (`dw/server/dispatch.py`: `Dispatcher._next_dispatch`, #869) (`Admission.host_ram_need`, validate's `plan.host_memory`). | `tests/test_host_ram_need.py::TestMemoryKey::test_an_inline_copy_without_its_metadata_has_the_same_key`, `tests/test_host_ram_need.py::TestMemoryKey::test_a_different_weights_dtype_is_a_different_key`, `tests/test_host_ram_need.py::TestProjectedPeak::test_an_observed_peak_beats_the_fit`, `tests/test_host_ram_need.py::TestALongerListThanObserved::test_an_accumulating_list_takes_the_larger_fit`, `tests/test_host_ram_need.py::TestProjectedPeak::test_a_failed_run_is_not_observed`, `tests/test_host_ram_need.py::TestValidateRoute::test_an_observed_run_is_the_plans_host_memory` |
 | Acceleration warnings | `dw/acceleration_warnings.py`: `acceleration_warnings`, `CACHE_MIN_USEFUL_STEPS`, `CUDA_ONLY_ATTENTION_BACKENDS` (the last entry of `WARNING_CHECKS`) | An acceleration setting that can't pay off (a `first_block`/`mag` cache under `CACHE_MIN_USEFUL_STEPS`, any `taylorseer` cache, `compile.fullgraph` with a cache, a cache on a pipeline class with no transformer or whose transformer lacks `enable_cache()`, a CUDA-only `attention_backend` on a non-CUDA device) is a warning and never a refusal, and an unresolvable value (steps, backend, device) leaves it silent. | `tests/test_validation.py::TestAccelerationWarnings::test_warnings_never_refuse`, `tests/test_validation.py::TestAccelerationWarnings::test_steps_that_resolve_to_nothing_are_silent`, `tests/test_validation.py::TestAccelerationWarnings::test_an_unknown_device_is_silent`, `tests/test_validation.py::TestAccelerationWarnings::test_an_unresolvable_backend_is_silent_on_mps` |
 | H3 sparse attention | `dw/sparse_attention.py`: `sparse_call`, `install_sparse`, `install_sparse_for_call`, `apply_sparse_settings`, `SparseH3AttnProcessor`; wired from `dw/pipeline_processors/components.py`: `configure_components` and `dw/pipeline_processors/pipeline.py`: `apply_runtime_settings` | Whether a pipeline call runs sparse is decided once per call, all or nothing (the call's first kernel invocation included); it never changes diffusers' process-wide backend and never reaches `AttentionBackendName`; it installs by a processor swap plus forward hooks, never a `forward` wrapper; and `sparse_tau` is a runtime setting, not part of the weights identity (#931). | `tests/test_sparse_attention_processor.py`, `tests/test_sparse_attention_wiring.py`, `tests/test_sparse_attention_tiles.py`, `tests/test_sparse_attention_backends.py` |
 | H3 adapter partition | `dw/adapter_compatibility.py`; the server's index is `dw/server/deps.py` `lora_index` | The LoRA catalog decides first, on the server only: a `proven` entry's `workflow` refuses a step in the other partition, a `trial`/`rejected` entry's only warns. A file no entry places falls to its name: an FL2VA LoRA on a reference step is refused, and one whose name says neither `ref2v` nor `fl2v` is warned. | `tests/test_h3_adapters.py::TestWhatIsRefused::test_a_keyframe_adapter_on_the_reference_path`, `tests/test_h3_adapters.py::TestWhatIsRefused::test_an_unrecognised_name_is_a_warning_not_a_refusal`, `tests/test_h3_adapters.py::TestTheCatalogDecidesFirst::test_a_proven_entry_refuses_the_other_partition`, `tests/test_h3_adapters.py::TestTheCatalogDecidesFirst::test_a_weaker_entry_only_warns`, `tests/test_server_loras.py::TestTheCatalogPlacesAnAdapter::test_a_trial_entry_warns_and_promoting_it_refuses` |
-| H3 audio hold, refine and guide layout | Five modules, imported one way: `dw/pipeline_processors/h3_rules.py` holds the names and rules, torch- and diffusers-free (`refine_problems`, the per-argument refine rules asked before validation and before the call; `not_h3`, the step rule; `snap_guide_length`, `guide_frame_problem`, `guide_chain_problems`, `guide_end_problem`; `CHAIN_CONTINUITY_MODES`; the chunk constants), `dw/pipeline_processors/h3_hold.py` puts the hold and refine blocks in (`insert_audio_hold`, `core_denoise_sequences`, `refines`), and `dw/pipeline_processors/h3_guides.py` the guide layout (`LAYOUT_ANCHORS`, `insert_guides`), which imports `h3_hold` and never the reverse; the blocks themselves, and the arithmetic they run, are `dw/pipeline_processors/h3_hold_steps.py` (`encode_audio_span`, `refine_sigmas`) and `dw/pipeline_processors/h3_guide_steps.py` (`splice_guide_rows`), which import diffusers when they load, so the two owners import them only inside `blocks()` and `guide_blocks()` (#790), and `h3_guide_steps` imports `h3_hold_steps` and never the reverse (`_with_guides` in `dw/pipeline_processors/pipeline.py` adds its blocks for a `guides` call), `dw/guides.py`: the `guides` validation check and the chain `continuity: "guide"` check, `guide_chain_errors`, which asks the `guides` check's own step rule (`_takes_guides_problem`, built on `h3_rules.not_h3` and `REFERENCE_WORKFLOWS`) and reads the mode names from `h3_rules.CHAIN_CONTINUITY_MODES`, the names `chain.py`'s `CONTINUITY_MODES` is zipped against (both registered in `dw/validation.py`; a `previous_result:` guide is checked at run time), `dw/hold_audio.py`: `hold_audio_errors`, `refine_strength_errors` | The one place dw modifies a diffusers modular pipeline's block graph: three blocks go in, before `set_timesteps`, `denoise` and `after_denoise`, in every H3 core-denoise sequence (the whole graph and the `workflow=`-pruned flat graph), and they are no-ops without `hold_audio` / `refine_strength`. A `hold_audio` path is opened only after `locations.validate_media_path` against the step's workflow directory. `dw/introspection.py` builds the same graph without weights, hold included, so `get_pipeline_signature` lists a modular pipeline's block inputs. The copies of diffusers behaviour are pinned to the installed diffusers: `shifted_sigma_grid` (the spacing `refine_sigmas` rests on) to stock `set_timesteps`, `GUIDE_FRAMES_PER_CHUNK`/`GUIDE_LATENTS_PER_CHUNK` to the H3 video VAE's `clip_length` and latents per clip, and every name in `LAYOUT_ANCHORS` (`_fill_audio_positions` among them) to `before_denoise`. | `tests/test_h3_hold_audio.py::TestAnchors::test_inserted_next_to_the_anchors_in_every_shape`, `tests/test_h3_hold_audio.py::TestHoldAudioLocation::test_a_path_outside_the_roots_is_refused_at_the_call`, `tests/test_h3_hold_audio.py::TestRefusals::test_a_non_h3_step_is_refused`, `tests/test_h3_hold_audio.py::TestSignature::test_the_h3_signature_shows_hold_audio`, `tests/test_h3_refine.py::TestAnchors::test_inserted_before_denoise_in_every_shape`, `tests/test_h3_refine.py::TestSigmaGridDrift::test_the_full_grid_is_stock_set_timesteps`, `tests/test_h3_guides.py::TestChunkDrift::test_frames_per_chunk_is_the_vae_clip_length`, `tests/test_h3_guides.py::TestChunkDrift::test_latents_per_chunk_is_the_vae_tokens_per_clip`, `tests/test_h3_guides.py::TestAnchors::test_installed_diffusers_has_every_anchor`, `tests/test_guide_chain_validation.py::TestRefused::test_the_step_rule_is_the_guides_rule`, `tests/test_guide_chain_validation.py::TestRefused::test_every_run_mode_is_known_to_validate`, `tests/test_h3_rules.py::test_h3_rules_imports_neither_torch_nor_diffusers`, `tests/test_h3_rules.py::test_the_block_owners_import_no_diffusers` |
+| H3 audio hold, refine, tiled refine and guide layout | Six modules, imported one way: `dw/pipeline_processors/h3_rules.py` holds the names and rules, torch- and diffusers-free (`refine_problems`, the per-argument refine rules, `refine_tiles` among them, asked before validation and before the call; `tile_plan`, the tile layout on the 32 px grid, shared by validate and the run; `not_h3`, the step rule; `snap_guide_length`, `guide_frame_problem`, `guide_chain_problems`, `guide_end_problem`; `CHAIN_CONTINUITY_MODES`; the chunk constants), `dw/pipeline_processors/h3_hold.py` puts the hold and refine blocks in (`insert_audio_hold`, `core_denoise_sequences`, `refines`; `HELD_LATENTS_OUTPUT` and `encoded_hold_audio`, the hold block's encode handed back to it), and `dw/pipeline_processors/h3_guides.py` the guide layout (`LAYOUT_ANCHORS`, `insert_guides`), which imports `h3_hold` and never the reverse; the blocks themselves, and the arithmetic they run, are `dw/pipeline_processors/h3_hold_steps.py` (`encode_audio_span`, `refine_sigmas`) and `dw/pipeline_processors/h3_guide_steps.py` (`splice_guide_rows`), which import diffusers when they load, so the two owners import them only inside `blocks()` and `guide_blocks()` (#790), and `h3_guide_steps` imports `h3_hold_steps` and never the reverse (`_with_guides` in `dw/pipeline_processors/pipeline.py` adds its blocks for a `guides` call), `dw/guides.py`: the `guides` validation check and the chain `continuity: "guide"` check, `guide_chain_errors`, which asks the `guides` check's own step rule (`_takes_guides_problem`, built on `h3_rules.not_h3` and `REFERENCE_WORKFLOWS`) and reads the mode names from `h3_rules.CHAIN_CONTINUITY_MODES`, the names `chain.py`'s `CONTINUITY_MODES` is zipped against (both registered in `dw/validation.py`; a `previous_result:` guide is checked at run time), `dw/pipeline_processors/h3_tiles.py`: the tiled refine (the tile loop, the latent-space feather blend, the per-tile crop of one whole-canvas noise draw, the decode-free graph variant, and the one spatially tiled decode), which imports `h3_rules`, `h3_hold` and `media_types` (for `FrameList`; and `events`, `progress`) and is imported by `pipeline.py` and, lazily, `components.py` (which attaches the variant at load, behind `h3_hold.core_denoise_sequences`), never by `h3_rules` or `h3_hold`, `dw/hold_audio.py`: `hold_audio_errors`, `refine_strength_errors` | The one place dw modifies a diffusers modular pipeline's block graph: three blocks go in, before `set_timesteps`, `denoise` and `after_denoise`, in every H3 core-denoise sequence (the whole graph and the `workflow=`-pruned flat graph), and they are no-ops without `hold_audio` / `refine_strength`. The tiled refine adds a second graph built at load beside them (`h3_tiles.decode_free_blocks`: the decode and text-encoder blocks dropped, every kept block the graph's own instance, so hold and refine stay in) and swaps it into `pipeline._blocks` only for the duration of the one text-encode call and the tile calls (`swapped_blocks`, restored on failure). Every tile runs the hold block, but the track is encoded once per refine: the first tile is asked for the block's encode (`HELD_LATENTS_OUTPUT`) and every later tile's `hold_audio` carries it (`encoded_hold_audio`, an `EncodedAudioReference`), which the block writes in place of running the audio VAE. A `hold_audio` path is opened only after `locations.validate_media_path` against the step's workflow directory. `dw/introspection.py` builds the same graph without weights, hold included, so `get_pipeline_signature` lists a modular pipeline's block inputs. The copies of diffusers behaviour are pinned to the installed diffusers: `shifted_sigma_grid` (the spacing `refine_sigmas` rests on) to stock `set_timesteps`, `GUIDE_FRAMES_PER_CHUNK`/`GUIDE_LATENTS_PER_CHUNK` to the H3 video VAE's `clip_length` and latents per clip, and every name in `LAYOUT_ANCHORS` (`_fill_audio_positions` among them) to `before_denoise`. | `tests/test_h3_hold_audio.py::TestAnchors::test_inserted_next_to_the_anchors_in_every_shape`, `tests/test_h3_hold_audio.py::TestHoldAudioLocation::test_a_path_outside_the_roots_is_refused_at_the_call`, `tests/test_h3_hold_audio.py::TestRefusals::test_a_non_h3_step_is_refused`, `tests/test_h3_hold_audio.py::TestSignature::test_the_h3_signature_shows_hold_audio`, `tests/test_h3_refine.py::TestAnchors::test_inserted_before_denoise_in_every_shape`, `tests/test_h3_tiles.py::TestDecodeFree::test_variant_has_no_decode_and_shares_blocks`, `tests/test_h3_tiles.py::TestTileLoop::test_blocks_are_restored_when_a_tile_fails`, `tests/test_h3_tiles.py::TestTileLoop::test_the_track_is_encoded_by_one_tile_and_handed_to_the_rest`, `tests/test_h3_hold_audio.py::TestHoldBlock::test_a_carried_encode_is_written_without_encoding_again`, `tests/test_h3_tiles.py`, `tests/test_h3_rules.py` (`tile_plan` and the `refine_tiles` rules), `tests/test_h3_refine.py::TestSigmaGridDrift::test_the_full_grid_is_stock_set_timesteps`, `tests/test_h3_guides.py::TestChunkDrift::test_frames_per_chunk_is_the_vae_clip_length`, `tests/test_h3_guides.py::TestChunkDrift::test_latents_per_chunk_is_the_vae_tokens_per_clip`, `tests/test_h3_guides.py::TestAnchors::test_installed_diffusers_has_every_anchor`, `tests/test_guide_chain_validation.py::TestRefused::test_the_step_rule_is_the_guides_rule`, `tests/test_guide_chain_validation.py::TestRefused::test_every_run_mode_is_known_to_validate`, `tests/test_h3_rules.py::test_h3_rules_imports_neither_torch_nor_diffusers`, `tests/test_h3_rules.py::test_the_block_owners_import_no_diffusers` |
 | IC-LoRA reference scale | `workflows/templates/ltx2/` | The three conditioning templates run at `reference_downscale_factor: 1`, and the two upscalers at 2. | `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_reference_is_encoded_at_the_output_resolution`, `tests/test_ltx2_ic_loras.py::TestTheGenerativeUpscaleMatchesTheSameCard::test_it_loads_the_upscaler_at_factor_two` |
 | IC-LoRA numbers | `workflows/templates/ltx2/` | Every number in the IC-LoRA templates comes from the vendor's model card. | `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_strength_is_the_cards_default`, `tests/test_ltx2_ic_loras.py::TestEachTemplateMatchesItsCard::test_the_defaults_are_the_trained_bucket` |
 | IC-LoRA prompt genre | `prompts/ltx2/` | A stored prompt tagged `ic-lora` is checked against its trained caption form, not against the T2V paragraph rule. | `tests/test_ltx_prompt_library.py::test_an_ic_lora_prompt_is_in_its_trained_form` |
@@ -122,7 +126,7 @@ one to open.
 | A different result | `dw/server/routes/jobs.py`, `dw_mcp/tools_jobs.py`: `rerun_job` | `rerun` with `new_seed` draws a fresh seed into the workflow's seed variable. | `tests/test_rerun_new_seed.py::test_a_rerun_with_a_new_seed_draws_one_into_that_variable` |
 | Worker protocol | `dw/worker_protocol.py`: `parse_reply` | Every command and reply is a frozen dataclass that travels as a wire dict. A run event's keys sit beside the wire's own `type`, so an event's `type` key (`cache_stats`' cache type) crosses as `event_type` and comes back as `type`. | `tests/test_worker_messages.py::test_from_wire_inverts_to_wire`, `tests/test_cache_stats.py::test_the_event_crosses_the_worker_wire_with_its_cache_type`, `tests/test_worker_messages.py::test_an_unknown_reply_type_is_kept_whole_rather_than_raised` |
 | Persistent worker | `dw/worker.py`, `dw/worker_manager.py`, `dw/serve.py` | Jobs run in spawned workers (one per card) that keep models loaded, so a change to engine code needs a server restart. | — |
-| Worker card pinning | `dw/devices.py`: `worker_environment`, `pinned_environment`, `resolve_serve_devices`, `check_device_present`, `label_of` | A worker named with a CUDA index is spawned with `CUDA_VISIBLE_DEVICES` set to that card and `DW_DEVICE=cuda` (a bare `cuda` pins nothing), so index-0 reads inside it measure its own card; `--devices`/`devices` takes one entry per worker (a card named twice, or a bare `cuda` in a list of several, is refused), a card the box lacks is refused at startup naming the cards present, and a job stores the card it ran on as `device_ordinal` and `device_card` (#693), job and history alike: rerun affinity reads the ordinal, observed cost buckets by the card, and the `device` label `"cuda:N <card name>"` is only `label_of` joining the two - nothing splits a label back apart. | `tests/test_worker_manager.py::TestWorkerPinning::test_a_cuda_index_pins_the_worker_through_the_environment`, `tests/test_worker_manager.py::TestWorkerPinning::test_a_bare_cuda_sets_no_pin`, `tests/test_serve_main.py::TestConfigureDevices::test_a_refusal_exits_with_code_2`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_the_machine_lacks_is_refused_naming_the_cards_present`, `tests/test_serve_main.py::TestResolveServeDevices::test_two_entries_are_both_kept`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_named_twice_is_refused` |
+| Worker card pinning | `dw/devices.py`: `worker_environment`, `pinned_environment`, `resolve_serve_devices`, `check_device_present`, `label_of` | A worker named with a CUDA index is spawned with `CUDA_VISIBLE_DEVICES` set to that card and `DW_DEVICE=cuda` (a bare `cuda` pins nothing), so index-0 reads inside it measure its own card; `--devices`/`devices` takes one entry per worker (a card named twice, or a bare `cuda` in a list of several, is refused), a card the box lacks is refused at startup naming the cards present (in a list of several it is dropped with a warning and the server starts on the rest; only a list with no card present refuses), and a job stores the card it ran on as `device_ordinal` and `device_card` (#693), job and history alike: rerun affinity reads the ordinal, observed cost buckets by the card, and the `device` label `"cuda:N <card name>"` is only `label_of` joining the two - nothing splits a label back apart. | `tests/test_worker_manager.py::TestWorkerPinning::test_a_cuda_index_pins_the_worker_through_the_environment`, `tests/test_worker_manager.py::TestWorkerPinning::test_a_bare_cuda_sets_no_pin`, `tests/test_serve_main.py::TestConfigureDevices::test_a_refusal_exits_with_code_2`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_the_machine_lacks_is_refused_naming_the_cards_present`, `tests/test_serve_main.py::TestResolveServeDevices::test_two_entries_are_both_kept`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_gone_from_a_list_is_dropped_and_reported`, `tests/test_serve_main.py::TestConfigureDevices::test_a_pulled_card_in_the_setting_starts_on_the_rest_and_warns`, `tests/test_serve_main.py::TestResolveServeDevices::test_a_card_named_twice_is_refused` |
 | Failed-run reporting | `dw/worker.py`, `dw/worker_protocol.py`: `Failed`, `Cancelled` | A failed or cancelled run's reply still carries the manifest of the steps that ran. | `tests/test_worker_execute.py::test_failure_carries_the_manifest_of_the_steps_that_ran`, `tests/test_worker_execute.py::test_cancellation_carries_the_manifest_too` |
 | Failure path redaction | `dw/path_redaction.py`: `redact_paths`, called by `dw/worker.py` | A failed run's message and traceback name a file under the job's asset roots or output directory by its `asset:`/`output:` reference, never its absolute server path. | `tests/test_worker_execute.py::test_a_failure_names_an_asset_by_reference_not_by_server_path`, `tests/test_path_redaction.py` |
 | Run-time warnings | `dw/events.py`: `emit_warning` | A warning found at run time is emitted as an event, so it reaches the caller and not just the log. | `tests/test_concat_videos.py::TestWarningsReachTheCaller::test_the_level_spread_warning_is_emitted_as_an_event` |
@@ -136,7 +140,7 @@ one to open.
 | Output comparison | `dw/media_compare.py`: `compare`, `psnr`, `ssim`, `mean_abs_diff`, `check_request`, `crop_box` | Metrics always compare the same pixels: one shared crop is the measured region, and per-output crops are display only, leaving metrics on the full frame. An output whose size differs from the baseline's, or a moment past its end, gets null metrics with a reason; nothing is resized to force a number. SSIM is on Rec. 601 luma (SSIM's convention, not `image_ops.luma`). It runs in the server process and decodes through `dw/media.py` and `open_bounded`. | `tests/test_compare_route.py::test_a_shared_crop_is_the_region_measured`, `tests/test_compare_route.py::test_per_output_crops_are_display_only`, `tests/test_compare_route.py::test_a_size_mismatch_gets_no_numbers_and_says_why`, `tests/test_compare_route.py::test_a_moment_past_the_shorter_clip_is_a_blank_cell` |
 | Signal processing | `dw/dsp.py` | It measures and transforms waveforms, decides nothing, and imports nothing from `dw`. | `tests/test_media_layering.py::test_dsp_imports_nothing_from_dw` |
 | Assessment probes | `dw/tasks/assess.py`, `dw/assessment_rules.py` | Exactly three registered commands are assessment probes. Each measures a finished file, and every rule names a real probe field. | `tests/test_assessment_rules.py::TestRuleProbesAreRealCommands::test_assessment_is_exactly_the_three_probes`, `tests/test_assessment_rules.py::TestRuleProbesAreRealCommands::test_every_rule_names_a_registered_json_command` |
-| Script check | `dw/tasks/script_check.py`: `check`; `dw/script_lines.py`: `parse_lines`, `parse_shots`, `shot_names_error` | `check_script` aligns a take's heard words to its expected lines and guards out words heard over silence and repetition loops (Whisper's hallucination over music). It builds its findings with `assessment_rules.finding()` and reads the guard's floor and window (`DEAD_AIR_FLOOR_DBFS`, `DEAD_AIR_WINDOW`) rather than copying them; the loudest-window measure is `dsp.loudest_window_dbfs` (`script_check.word_level` wraps it), which `transcribe_audio`'s `suspect: "silent"` mark reads with the same floor and window; the repetition-loop detector (`script_lines.looped_texts`, `REPEAT_RUN_MIN`, `REPEAT_MAX_PERIOD`) lives in `dw/script_lines.py` and backs both `check_script`'s `repetition` discard and `transcribe_audio`'s `suspect: "repetition"`, and `script_lines.suspect_runs`/`SUSPECT_LEFT_OUT` are what `plan_cuts` groups and leaves out suspect chunks by - so neither task imports the other. It is not an assessment probe and adds nothing to `RULES`. Its literal `lines` is refused at validation through `task_problems` (`script_lines_errors`), which calls the same `parse_lines` the task runs, and a literal `shots` through the same `parse_shots` and `shot_names_error`; the parsers live in `dw/script_lines.py`, not the task, so that `task_problems` reaches them without importing `script_check` (the `import_cycles` ratchet in `scripts/arch_metrics.py`). A line's `shot` may be the short `@name` of the one recorded shot that carries it (`script_lines.matching_shot_names`, `with_full_shot_names`, shared by the task and the literal-`shots` check); which member key a recorded name carries comes from `references.member_keys`, beside `MEMBER_SEPARATOR` and `for_each.member_name`, never a re-derived pattern: a key ends at the first character outside `references.VARIABLE_NAME_CHARACTERS`, the set `security.validate_variable_name` (which checks a for_each entry's name) builds its pattern from. With `audio` an `output:`/`asset:`/path whose run manifest records shots, `dw/shot_span_preflight.py: script_shot_name_errors` (the `script_shot_names` error check) runs `shot_names_error` at validation, reading the map through `runs.shots_beside`. Its shot map comes from `assess.resolve_shots`, the one the probes use, never a copy; it places each shot on the soundtrack with `assess.sample_span`, decides repeated shot names with `shots.duplicate_shot_names`, and asks `locations.is_http_url` whether the take is a URL. | `tests/test_script_check.py::TestRegistration::test_registered_as_json_command_without_assessment_flag`, `tests/test_script_check.py::TestEmptyLines::test_words_only_over_silence_are_discarded_not_found`, `tests/test_script_check.py::TestLinesErrors::test_literal_with_a_colon_is_not_a_reference`, `tests/test_script_check.py::TestShotValidation::test_a_short_member_name_matches_the_one_shot_carrying_it`, `tests/test_script_check.py::TestShotValidation::test_a_valid_variable_name_comes_back_whole_as_a_member_key`, `tests/test_shot_span_preflight.py::TestScriptShotNames::test_a_wrong_shot_name_is_an_error_at_validate_time` |
+| Script check | `dw/tasks/script_check.py`: `check`; `dw/tasks/script_take.py`: `guard_words`, `word_level`, `shot_spans`; `dw/script_lines.py`: `parse_lines`, `parse_shots`, `shot_names_error` | `check_script` aligns a take's heard words to its expected lines and guards out words heard over silence and repetition loops (Whisper's hallucination over music). It builds its findings with `assessment_rules.finding()` and reads the guard's floor and window (`DEAD_AIR_FLOOR_DBFS`, `DEAD_AIR_WINDOW`) rather than copying them; the loudest-window measure is `dsp.loudest_window_dbfs` (`script_take.word_level` wraps it; the guard, the transcription levelling and the shot placement are `dw/tasks/script_take.py`, which `script_check` reads one way - nothing there reads the rule tables), which `transcribe_audio`'s `suspect: "silent"` mark reads with the same floor and window; the repetition-loop detector (`script_lines.looped_texts`, `REPEAT_RUN_MIN`, `REPEAT_MAX_PERIOD`) lives in `dw/script_lines.py` and backs both `check_script`'s `repetition` discard and `transcribe_audio`'s `suspect: "repetition"`, and `script_lines.suspect_runs`/`SUSPECT_LEFT_OUT` are what `plan_cuts` groups and leaves out suspect chunks by - so neither task imports the other. It is not an assessment probe and adds nothing to `RULES`. Its literal `lines` is refused at validation through `task_problems` (`script_lines_errors`), which calls the same `parse_lines` the task runs, and a literal `shots` through the same `parse_shots` and `shot_names_error`; the parsers live in `dw/script_lines.py`, not the task, so that `task_problems` reaches them without importing `script_check` (the `import_cycles` ratchet in `scripts/arch_metrics.py`). A line's `shot` may be the short `@name` of the one recorded shot that carries it (`script_lines.matching_shot_names`, `with_full_shot_names`, shared by the task and the literal-`shots` check); which member key a recorded name carries comes from `references.member_keys`, beside `MEMBER_SEPARATOR` and `for_each.member_name`, never a re-derived pattern: a key ends at the first character outside `references.VARIABLE_NAME_CHARACTERS`, the set `security.validate_variable_name` (which checks a for_each entry's name) builds its pattern from. With `audio` an `output:`/`asset:`/path whose run manifest records shots, `dw/shot_span_preflight.py: script_shot_name_errors` (the `script_shot_names` error check) runs `shot_names_error` at validation, reading the map through `runs.shots_beside`. Its shot map comes from `assess.resolve_shots`, the one the probes use, never a copy; it places each shot on the soundtrack with `assess.sample_span`, decides repeated shot names with `shots.duplicate_shot_names`, and asks `locations.is_http_url` whether the take is a URL. | `tests/test_script_check.py::TestRegistration::test_registered_as_json_command_without_assessment_flag`, `tests/test_script_check.py::TestEmptyLines::test_words_only_over_silence_are_discarded_not_found`, `tests/test_script_check.py::TestLinesErrors::test_literal_with_a_colon_is_not_a_reference`, `tests/test_script_check.py::TestShotValidation::test_a_short_member_name_matches_the_one_shot_carrying_it`, `tests/test_script_check.py::TestShotValidation::test_a_valid_variable_name_comes_back_whole_as_a_member_key`, `tests/test_shot_span_preflight.py::TestScriptShotNames::test_a_wrong_shot_name_is_an_error_at_validate_time` |
 | Audio sync against a source slice | `dw/tasks/measure_sync.py`: `measure_sync`; `dw/dsp.py`: `envelope_lag` | `measure_sync` cross-correlates the onset envelopes of a shot's audio and its source slice and answers the lag and a 0-1 confidence. A positive lag means the audio is LATE (its events fall after the reference's), negative early; `lag_seconds` is None for a silent or flat track. It builds its findings (`sync_unmeasurable`, `sync_low_confidence`, `audio_out_of_sync`) with `assessment_rules.finding()` over module-local rule dicts and adds nothing to `RULES`; it reads the silence floor from `beats.SILENT_DBFS`. `envelope_lag` imports nothing from `dw`. | `tests/test_measure_sync.py::TestLag::test_late_audio_is_a_positive_lag`, `tests/test_measure_sync.py::TestLag::test_early_audio_is_a_negative_lag`, `tests/test_measure_sync.py::TestUnmeasurable::test_a_silent_reference_has_no_lag` |
 
 ## Security and architecture guardrails
@@ -168,6 +172,7 @@ one to open.
 | dw disk caches | `dw/disk_caches.py`; `dw/server/jobs.py`: `JobManager.hold_dispatch`; `dw/server/routes/system.py`: `clear_cache`, `delete_cache_entry` | Members `inductor`, `triton`, `quantized`. Clear only a root carrying the `.dw-cache` marker, never while a job is running or queued (`quantized` also not during a model download); an entry delete takes only a 64-hex id, checked before any path is built; clear renames into `.clearing-*` then deletes. The busy check and the dispatch hold are one step in `JobManager.hold_dispatch`, kept for the whole clear or entry delete: a job submitted meanwhile is accepted but stays queued until it ends. | `tests/test_disk_caches.py`, `tests/test_disk_caches.py::test_job_submitted_during_a_clear_waits_for_it` |
 | Job-to-run link | `dw/server/job_record.py`, `dw/server/jobs.py`: `JobManager.realized` | A job records `run_id`, `run_dir` and `run_version`, and `JobManager.realized` reads that run's `workflow.json`, confined to the output root. | `tests/test_server_jobs.py::test_realized_reads_the_file_the_run_wrote`, `tests/test_server_jobs.py::test_realized_refuses_a_run_dir_that_escapes_the_output_root` |
 | Job history | `dw/server/job_history.py`: `JobHistory`, `_ADDED_COLUMNS` | Finished jobs persist in `jobs.sqlite`, in WAL mode, so the Jobs view survives a restart. A database from an older release gains each column it lacks from the `_ADDED_COLUMNS` table when it is opened. | `tests/test_server.py::test_job_history_survives_restart_and_reruns`, `tests/test_job_history_wal.py::test_the_jobs_database_uses_wal_mode`, `tests/test_server_jobs.py::test_a_v0_13_0_database_gains_the_columns_added_since` |
+| Job fields, live and persisted | `dw/server/job_record.py`: `Job.summary`, `Job.detail`; `dw/server/job_history.py`: `_RECORDED`, `_ADDED_COLUMNS`, `recent_summaries`, `_to_detail` | A job field is declared once per side: on `Job` (and its `summary()`/`detail()`), and in history as an `_ADDED_COLUMNS` entry plus one `(column, getter)` in `_RECORDED`. History readers take columns by name, never by position, and a historical job serves the same summary and detail keys a live one does, apart from the live-only poll state and the history-only markers the parity test declares. | `tests/test_job_history_parity.py::test_history_serves_the_keys_a_live_job_does` |
 | HTTP security | `dw/server/http_security.py`: `install_middleware`, `query_token_ok` | Every API route needs the token, and only a route marked `query_token_ok` takes it as `?token=`. | `tests/test_security_auth.py::TestTheTokenGate::test_every_api_spelling_needs_the_token`, `tests/test_security_auth.py::TestTheTokenGate::test_the_query_token_is_refused_where_it_is_not_allowed` |
 | Prompt enhancement | `dw/server/enhancers.py`: `PRESETS`, `_T2I_SYSTEM_PROMPT` | `PRESETS` is the Enhance panel's menu (label, curated LLMs, preselect hints); a preset's family-specific knowledge, its spec, lives in a builtin under `dw/workflows/`, never in Python. `t2i`'s generic, family-agnostic system prompt stays in Python. A third preset moves the menu into builtin metadata (#696). | `tests/test_prompt_library.py::test_every_enhancer_preset_targets_a_known_family`, `tests/test_server.py::TestEnhance::test_presets_are_listed`, `tests/test_server.py::TestEnhance::test_enhance_workflows_are_schema_valid`, `tests/test_server.py::TestEnhance::test_an_unknown_preset_is_a_client_error` |
 
@@ -178,6 +183,7 @@ one to open.
 | `dw_mcp` stays torch-free | `dw_mcp/` | `dw_mcp` reaches `dw.serve` over HTTP and imports no `dw` module, because `dw/__init__.py` pulls in torch. | `tests/test_mcp_server.py::TestStartupWeight::test_the_server_starts_without_importing_the_engine` |
 | Tool surface | `dw_mcp/server.py`, `dw_mcp/tools_*.py` | Only these modules import the MCP SDK, and each tool body is a one-line call into a handler. | `tests/test_mcp_server.py::test_the_wiring_table_covers_every_registered_tool`, `tests/test_mcp_server.py::test_the_stated_tool_count_is_the_registered_one` |
 | Surface text budget | the tool docstrings in `dw_mcp/tools_*.py`, the instructions in `dw_mcp/server.py` | The instructions and each tool description stay at or under 2,048 characters, and the whole surface stays within its token budget. | `tests/test_mcp_server.py`: `SURFACE_BUDGET`, `CLIENT_TEXT_LIMIT`; `tests/test_mcp_server.py::test_no_text_the_agent_reads_is_cut_off_by_the_client`, `tests/test_mcp_server.py::test_the_tool_surface_fits_the_budget` |
+| Guide pointers in resident text | the tool docstrings in `dw_mcp/tools_*.py`, the instructions in `dw_mcp/server.py`, each plugin `SKILL.md` and its `references/` | Every `get_guide(...)` / guide-section pointer opens a real section through `dw/server/guides.py`'s `get_guide`, and the tools that point at a guide keep their pointer when text is trimmed to fit the budget. | `tests/test_guide_pointers.py` (`TOOLS_THAT_POINT`) |
 | Spending needs consent | each handler behind a tool that takes `acknowledged_cost` (`dw_mcp/diagnose.py`, `models.py`, `prompts.py`, `workspaces.py`) | Every tool that takes `acknowledged_cost` refuses until it is set; `delete_workspace`'s refusal is the server's 409. | `tests/test_mcp_twins.py::test_every_tool_that_takes_acknowledged_cost_refuses_without_it` |
 | Copies of engine rules | the constants and word lists in `dw_mcp/` and `dw/run.py` | `dw_mcp` cannot import its owners, so each copy equals its owner; a copy that needs no twin is deleted, not pinned. | `tests/test_mcp_twins.py` |
 | The CLI is a client of the server | `dw/run.py` | `dw.run` queues on `dw.serve` through `dw_mcp.client`, so `dw` imports `dw_mcp` and never the reverse. | `tests/test_mcp_server.py::TestStartupWeight::test_the_server_starts_without_importing_the_engine`, `tests/test_mcp_twins.py` |
diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md
index d015a611e..088443bc4 100644
--- a/docs/DEPENDENCIES.md
+++ b/docs/DEPENDENCIES.md
@@ -47,7 +47,7 @@ pyproject; install.ps1 installs it explicitly on Windows.
 
 ## Platform-Specific Dependencies
 
-**All platforms (core ML):** peft, transformers, accelerate, safetensors, controlnet_aux, sentencepiece, torchsde, torchao, optimum-quanto, gguf, kornia, ftfy, sdnq, spandrel, facexlib (spandrel + facexlib back the `upscale` and `restore_faces` tasks). On first use, `restore_faces` has facexlib download its face detection and parsing weights (about 110 MB) from facexlib's own GitHub releases into the facexlib package directory. It is the one model download that bypasses the Hugging Face cache, dw's download manager and the `plan.downloads_required` estimate.
+**All platforms (core ML):** peft, transformers, accelerate, safetensors, controlnet_aux, sentencepiece, torchsde, torchao, optimum-quanto, gguf, kornia, ftfy, sdnq, spandrel, facexlib (spandrel + facexlib back the `upscale` and `restore_faces` tasks). On first use, `restore_faces` has facexlib download its face detection and parsing weights (about 110 MB) from facexlib's own GitHub releases into the facexlib package directory. It is the one model download that bypasses the Hugging Face cache and dw's download manager; a validate's `plan.downloads_required` lists the two weights as URL entries while they are missing from that directory.
 
 **All platforms (sparse attention):** comfy-kitchen (Sol-Attn sparse attention for MiniMax H3's generated-video rows, #931). Its compiled CUDA/HIP kernels ship for Linux and Windows; elsewhere it installs an eager-only build.
 
diff --git a/docs/MCP.md b/docs/MCP.md
index 94f72e32e..cbda32031 100644
--- a/docs/MCP.md
+++ b/docs/MCP.md
@@ -233,7 +233,7 @@ when no single workflow covers it.
 | `get_health()` | — | Check that the server is alive, and which machine answered: `version`, `device`, whether any model process is resident (`worker_alive`), and the queue depth. The engine runs one job per GPU: `workers` has one entry per card - `device`, `name`, `vram_gb`, `alive`, its own `current_job`, and the worker's `host_memory_rss_mb` while it runs - and the top-level `current_job` is the longest-running job. `worker_alive: false` is the normal idle state on a server that has not run a job since startup or the last memory clear - not a fault - the on-demand worker starts with the next job (#206) |
 | `get_server_info()` | — | What this installation can do and where it keeps things: `device` (the accelerator a run will use), `version`, the `workspace` this session is working in and the workflow/asset/output/prompt `directories` of *that* workspace, the bind address and port, whether a token is required, and whether MCP is mounted. Check the device before authoring - a CUDA-only choice (bitsandbytes, `torch.compile`, flash attention) is not available on an `mps` or `cpu` server. `runtime` (#222) reports the Python version, torch version and the CUDA version torch was built against, the NVIDIA driver version (when `nvidia-smi` is reachable), and the installed versions of diffusers, transformers, accelerate, bitsandbytes, peft, safetensors and sentencepiece (`null` for one not installed) - for diagnosing an environment mismatch between boxes without shelling in. `caches` lists dw's disk caches (`inductor`, `triton`, `quantized`), each with `name`, `bytes`, `files`, `enabled`, `clearable` and `disk_free`, plus `entry_count` for a cache with entries, and `cache_entries=true` lists them (`id`, `model`, `subfolder`, `component`, `bytes`, `files`, `unreadable`, `created`, `last_hit`; the quantizer and dtype are not in `/api/caches`); it is omitted when the server has no `/api/caches`. There is no MCP tool to clear one - that is `DELETE /api/caches/{name}` or `.../entries/{entry}` ([SERVER.md](SERVER.md)) |
 | `list_jobs(limit=20, status=None, workspace=None)` | optional `limit` (newest N), `status` (one state or a comma-separated set of `queued`, `running`, `succeeded`, `failed`, `cancelled`), `workspace` | List queued, running and recent jobs, **newest first** (a queued job held for host RAM carries `waiting_for`). Bounded by default: the unbounded listing was over a client's tool-result limit on a server with a few months of history, which made it a tool that could not be called at all. `total` says how many matched and `truncated`/`next` say so when the answer was cut - raise `limit` or narrow with `status`. Without `workspace`, a named workspace lists its own jobs and the default one lists every job the server holds |
-| `list_gallery(limit=50, subfolder=None, only_orphans=False, workspace=None, folder=None, version=None, media=False, role=None)` | `limit`, `subfolder`, `only_orphans`, `workspace`, `folder`, `version`, `media`, `role` | List generated output files, newest first. A name is `<workflow>/<run id>/<file>`, where `<file>` may sit in the subfolder the step chose (`final/episode.mp4`); each entry carries `folder` (the workflow) and `subfolder` (by convention `final` or `intermediate`, `''` when the step chose none, any path the workflow wrote otherwise), and `subfolder="final"` lists only deliverables. Each entry also carries `role`, `final` or `intermediate` (null for a flat-layout file with no run; `intermediate` once a later step or a later run read the file, unless `result.role` declared it); `role=["final"]` lists only those, and the `role` filter defaults to every file. See `dw/roles.py` for how a role is decided. A file starred in the web UI's gallery (its keep mark) carries `starred: true`; an unstarred one carries no `starred`. Each entry carries `run_id` and `version` - that run's ordinal among the workflow's runs, which is how one of several runs that wrote the same basename is named to a person: the web UI labels the same file `v5`. The number is assigned when the run opens and never renumbered, so deleting a run leaves a gap rather than sliding the rest down (a failed run, or a rerun that reused every step, leaves one too - it took a number and may have nothing to list), and it is `null` under the flat output layout, which has no runs. `folder` with `version` lists that one run's files, and `output:<folder>/v5/<file>` names one in a workflow; every other tool takes `name`. Each entry also carries a ready-made `url`, already scoped to the workspace that made it - a hand-built `/outputs/<name>` URL 404s for anything but the default workspace. `only_orphans=True` inverts the call: instead of files, it returns run directories with no media anywhere under them (`runs`, each `{name, mtime}`) - a run whose output was deleted before `delete_output` could remove it by name, or one that failed before writing anything; `subfolder` does not apply in this mode, and `name` is exactly what `delete_output` accepts (#170). `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
+| `list_gallery(limit=50, subfolder=None, only_orphans=False, workspace=None, folder=None, version=None, media=False, role=None)` | `limit`, `subfolder`, `only_orphans`, `workspace`, `folder`, `version`, `media`, `role` | List generated output files, newest first. A name is `<workflow>/<run id>/<file>`, where `<file>` may sit in the subfolder the step chose (`final/episode.mp4`); each entry carries `folder` (the workflow) and `subfolder` (by convention `final` or `intermediate`, `''` when the step chose none, any path the workflow wrote otherwise), and `subfolder="final"` lists only deliverables. Each entry also carries `role`, `final` or `intermediate` (null for a flat-layout file with no run, or an older run's file that neither its subfolder nor a later run's reads place; `intermediate` once a later step or a later run read the file, unless `result.role` declared it); `role=["final"]` lists only those, and the `role` filter defaults to every file. See `dw/roles.py` for how a role is decided. A file starred in the web UI's gallery (its keep mark) carries `starred: true`; an unstarred one carries no `starred`. Each entry carries `run_id` and `version` - that run's ordinal among the workflow's runs, which is how one of several runs that wrote the same basename is named to a person: the web UI labels the same file `v5`. The number is assigned when the run opens and never renumbered, so deleting a run leaves a gap rather than sliding the rest down (a failed run, or a rerun that reused every step, leaves one too - it took a number and may have nothing to list), and it is `null` under the flat output layout, which has no runs. `folder` with `version` lists that one run's files, and `output:<folder>/v5/<file>` names one in a workflow; every other tool takes `name`. Each entry also carries a ready-made `url`, already scoped to the workspace that made it - a hand-built `/outputs/<name>` URL 404s for anything but the default workspace. `only_orphans=True` inverts the call: instead of files, it returns run directories with no media anywhere under them (`runs`, each `{name, mtime}`) - a run whose output was deleted before `delete_output` could remove it by name, or one that failed before writing anything; `subfolder` does not apply in this mode, and `name` is exactly what `delete_output` accepts (#170). `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `get_gallery_metadata(name, envelope=False, workspace=None, interval_seconds=None)` | `name`, `workspace` | Get the metadata embedded in a generated file — or, when `name` is an `asset:` reference, what an *input* asset holds (`source` says which; `job` is null for an asset). Reading an input's duration, frame count, fps and sample rate before a run is how a caller learns the `total_frames`, `fps` and `sample_rate` a workflow expects it to supply: the exact workflow and arguments that produced it, and, for audio/video, a `media` block (duration, rate, channels, fps, size, peak/mean dBFS) and `findings` - each level problem the server measured against `dw/audio_qc.py`'s thresholds (`full_scale`, `near_silent`), with the fix. Only an image (PNG/JPEG/WebP) embeds `metadata` this way — it is always null for audio and video, and `next` then points at `get_job_workflow(job_id)` when `job` is known, or says a kept asset carries no provenance at all when it isn't. `envelope=true` adds `media.envelope` — `rms_dbfs` and `peak_dbfs` one entry per second, or per `interval_seconds` (default 1.0, 0.05 to 3600; 0.1 places a vocal onset; a finer-than-default width that would need over 2400 bins is refused with the interval that fits) — which is what locates something in a track rather than measuring the whole of it. `media.shots` is set on an output joined from shots: one `{name, start_frame, num_frames, start_sample, num_samples}` per shot, as the join measured them (see the run manifest in docs/WORKFLOW_GUIDE.md), else null. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 
 ### Media
@@ -277,7 +277,7 @@ tools) rather than relying on the session pin.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. A reference set the model would refuse - too many images, videos or audio clips, or, for MiniMax-H3, audio as the only reference - is an error here too, rather than a failure minutes into a run you acknowledged. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required`, `estimate` (with `basis`), `host_memory` (`{projected_mb, basis, runs}`, the projected host-RAM peak; `basis` is `observed` from same-key successful runs on this machine or `fit`; absent when there is no figure) and `elided_steps` for the arguments given; quote from it. `steps` counts what will run: a step nothing reads and which saves no file does not run, and is named in `elided_steps` instead |
+| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. A reference set the model would refuse - too many images, videos or audio clips, or, for MiniMax-H3, audio as the only reference - is an error here too, rather than a failure minutes into a run you acknowledged. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required` (pipeline `model_name`s and the repos and single files task steps fetch), `estimate` (with `basis`), `host_memory` (`{projected_mb, basis, runs}`, the projected host-RAM peak; `basis` is `observed` from same-key successful runs on this machine or `fit`; absent when there is no figure) and `elided_steps` for the arguments given; quote from it. `steps` counts what will run: a step nothing reads and which saves no file does not run, and is named in `elided_steps` instead |
 | `list_workspaces()` | — | The server's workspaces and which one this session is using. Each has its own workflows, assets and outputs; the prompt library is shared by all of them. Compact entries are `name`/`default`/`usage` plus any `note` (clipped, `note_truncated` when cut); `detail=true` adds each entry's folder paths |
 | `use_workspace(name)` | `name` | Work in that workspace for the rest of the session - every later call reads and writes there. This is how to keep your work out of another agent's namespace rather than sharing the default one. Checked against the server, so a typo fails here rather than scoping every later call to nothing. On a `dw.serve --mcp` endpoint the pin is shared by every connected client (#298, see the note above the table) - a `warning` field appears when this call overwrote a pin already pointed away from `default` |
 | `create_workspace(name, use=False)` | `name`, `use` | Create a workspace. Pass use=true to switch this session to it as well; otherwise the session stays where it was and the result says so. The result names the workspace (`name`, `default`, `current`, `next`), not its folders - `list_workspaces(detail=true)` is the opt-in for those. `use=true` carries the same mounted-server caveat and `warning` field as `use_workspace` |
@@ -331,7 +331,7 @@ references written in the same session.
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
 | `list_models()` | — | (Catalog) List what the Hugging Face cache holds, largest first |
-| `download_model(repo_id, acknowledged_cost=False)` | `repo_id`, `acknowledged_cost` | Fetch a model repo into the cache. Costs disk and bandwidth, so it passes the gate. Returns as soon as the download starts |
+| `download_model(repo_id, acknowledged_cost=False)` | `repo_id`, `acknowledged_cost` | Fetch a model repo into the cache. Costs disk and bandwidth, so it passes the gate. Returns as soon as the download starts. It fetches the whole repo at `main`, so it does not pre-fetch a single pinned file a task entry names; the task fetches that on its first run |
 | `list_downloads()` | — | List downloads the server is running or recently ran |
 | `cancel_download(download_id)` | `download_id` | Stop a running download; the record shows `cancel_requested: true` until it is `cancelled`. Partial files stay cached and resume on a retry |
 | `delete_model(repo, acknowledged_cost=False)` | `repo`, `acknowledged_cost` | Delete every cached revision of one repo. Not recoverable locally |
@@ -372,7 +372,9 @@ answers with a `plan`; pass `acknowledged_cost={"fingerprint":
 plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": [...]}` and
 the server refuses with 409 if the run's shape changed between the quote and
 the call - a longer list, a stored prompt edited meanwhile, weights that now
-have to be downloaded - naming the new plan so the agent re-quotes. Bare
+have to be downloaded - naming the new plan so the agent re-quotes. The
+`plan` itself, passed unedited, binds the same way: with no `downloads` key,
+its `downloads_required` repos (a file entry by its repo) and `estimate.minutes` stand in. Bare
 `true` still works and is for a `plan` that came back null; the job records
 which form it got (`acknowledged: none | boolean | bound`).
 
@@ -388,7 +390,7 @@ The intended loop:
    verdict covers the stored definition and its stock defaults, not the
    values you wrote, and its `plan` is the number to say out loud:
    `estimate.minutes` with its `basis`, plus each `downloads_required`
-   entry as a line item of its own
+   entry as a line item of its own (task steps' repos and single files are included)
 2. `run_workflow` with `acknowledged_cost` bound to the plan (`{fingerprint,
    minutes, downloads}`), or `true` when there was no plan — pass a name straight from
    `list_workflows` as `workflow_path`; queues the job and returns
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 98e3cf5fb..41d0efbf4 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -7,6 +7,143 @@ notes from commits at tag time (see below). This section is a scratch pad
 for items a branch's author wants the next release note to name; clear it
 when a release ships.
 
+### 0.16.0
+
+<!-- Drafted from v0.15.0..develop (7a0884ee). Paste into the GitHub release body once the tag has published: gh release edit v0.16.0 --notes-file ... -->
+
+A release about reaching past a 24 GB card and about removing things from
+a picture. MiniMax H3 refines to 1920x1088 in tiles, the plan prices every
+weight a task step will fetch before a run is accepted, and the cost quotes
+and VRAM ceilings for LTX-2.5 and Z-Image are calibrated against real runs.
+A prompt-free object-removal task joins the catalog with a small inpaint
+model beside it, and check-script is sturdier on looped, clipped and
+repeated takes.
+
+**H3 tiled refine to 1920x1088** (#1043, #1048, #1056)
+
+- An H3 refine step takes `refine_tiles: {width, height, overlap}` and
+  denoises an upscaled plate in feathered tiles on the 32 px grid, so a
+  1920x1088 refine fits a 24 GB card. The tiles blend in latent space and
+  the canvas decodes once; the soundtrack held from the base take is
+  encoded once per refine, not once per tile. The guide's *Refining above
+  768p in tiles* section is the recipe: 544p base, `upscale_h3_latents`,
+  tiled refine on the 768p turbo LoRA, one decode (about 12 min on an RTX
+  3090 for 124 frames).
+- `upscale_h3_latents` caps at 1920x1088 (or 1088x1920) and validate
+  refuses past it; references, guides, keyframes and `<Picture N>` are
+  refused in tile mode; validate prices tile mode by the tile and the
+  decode, not as a full-canvas denoise.
+- Every pipeline step whose pipeline reports its own frame rate now hands
+  its `videos` on carrying it, so `pair_audio` on an H3 base take fits the
+  track at 24 fps instead of the 8 fps fallback. The guide's keep-the-544p
+  recipe no longer asks for `result.fps`, which runs after the task.
+- `analyze_seams` reports look measures (lightness, contrast, saturation,
+  detail) at each seam beside the motion fields, so a re-roll can say
+  which side stepped (#1031, #1042). The `script-to-video` skill says when to
+  re-roll a seam (#1034).
+- H3 dialogue shots drop the turbo LoRA, the enhancer writes spoken and
+  sung lines as `<d>` blocks, and locked-frame lip sync is FL2VA with
+  `hold_audio` (#985, #989, #992). `slice_audio` with `start_seconds` and
+  `num_frames` keeps the frame length (#990). A one-segment H3 chain is
+  bit-identical to a native run (#1046).
+
+**Object removal** (#956, #973, #974, #946)
+
+- `remove_object` erases a masked region with LaMa, prompt-free, and
+  `templates/remove-object` and `templates/segment-and-remove` (SAM2 mask
+  from a box or a label, then erase) run it. `segment` takes each box's
+  best-rated SAM2 mask rather than its first.
+- `models/z-image-inpaint` configures `templates/inpaint` with Z-Image
+  Turbo for masked add-or-replace, a fraction of FLUX.1 Fill's 54 GB. The
+  guide's *Erasing versus repainting a masked region* section routes
+  between the two.
+
+**Cost, downloads and admission** (#975, #977, #978, #981, #1037, #1038, #948, #954)
+
+- A validate's `downloads_required` lists the Hugging Face repos and
+  single files task steps fetch (`segment`, `remove_background`,
+  `diffusion_upscale`, `transcribe_audio`, `check_script`,
+  `generate_speech`, `attribute_voices`, `text_generation`,
+  `image_to_text`, `judge`, the image processors, `upscale`,
+  `restore_faces`, `remove_object`, `upscale_h3_latents`,
+  `crop_face_track`, `interpolate_frames`, and facexlib's two weights),
+  plus `load_components` repo overrides. Entries gain optional `filename`
+  and `revision`; the OpenAPI document and the UI's types carry them.
+- The validate plan passed back verbatim is a bound acknowledgement. A
+  bound `acknowledged_cost` taken from a validate made before this deploy
+  is answered 409 `downloads` when the workflow has one of these tasks and
+  its repo is not cached: re-validate and resend the new `acknowledge`.
+  The 409's rebind plan carries the observed estimate validate quotes.
+- The observed estimate is the median of the newest runs, not the whole
+  history, and an inherited quote pays the model load once across scaled
+  steps. A task-only workflow's unknown estimate names why it is unpriced
+  (`unpriced_reason`), and validate notes `vram_config_differs` when a
+  step's offload or quantization differs from the calibrated template.
+- Validate reports one VRAM error per projection. LTX-2.5's
+  `upscale-clip`, `image-to-video`, `keyframes`, `two-stage`,
+  `refine-clip` and `reference-sheet` declare calibrated `vram_estimate`s,
+  so a 1080p or 481-frame request past a 24 GB card is refused at
+  validate instead of running out of memory late in the denoise; the
+  image-to-video default and the `ltx-2.5` skill move to 401 frames
+  (#1050, #1052, #1053, #1054). `models/z-image` declares one over batch,
+  width and height (#945).
+
+**check-script and audio** (#953, #955, #959-#971, #1039, #1041)
+
+- A looped cut is re-transcribed shot by shot when shots are known; a
+  scripted loop keeps its first take and flags `transcript_loop`; a chunk
+  repeating the previous span is discarded as `repeated_span`; a second
+  copy of a line inside its matched words is `unscripted_speech`; audible
+  untranscribed sound between two lines, and after the last one, is
+  reported and placed in the shot holding most of it; a clipped tail is
+  judged against the line's loudest window, so a score bed is not a clip.
+- `separate_stems` warns `stacked_vocals` over layered-stereo spans of the
+  vocal stem (#947). `normalize_audio(limit)` warns when the limiter works
+  mostly on one shot of a cut, and reads a saved cut's manifest shots when
+  given its path.
+
+**Server, worker and validation** (#928, #944, #949, #950, #951, #952, #957, #972, #976, #993, #995, #996)
+
+- A worker whose CUDA context a device-side assert poisoned is recycled
+  instead of answering every later job with the same error. A pulled card
+  in a `--devices` list no longer stops the server: it starts on the cards
+  present and warns. `scripts/dw-serve.service` sets
+  `RestartPreventExitStatus=2` so a refused configuration stops the unit
+  rather than looping; reinstall the unit to pick it up.
+- A file of a run with no recorded role lists as intermediate when in
+  `intermediate/` or read by a later run; manifest roles are stamped on
+  the job at finish so history serves what a live job did; a deleted
+  workspace's job rows stay resolvable by id.
+- Validate refuses a bare relative media name that resolves nowhere,
+  naming `output:<name>` for an own output; an unknown argument is
+  reported as itself; a document error no longer hides an unknown argument
+  in the same call; no undertrained-LoRA warning on a null LoRA whose steps
+  were raised.
+- A redirect hop the outbound guard refuses now names the target and the
+  URL asked for, so a refused hop reads apart from an upstream error
+  (#1055).
+
+**Web UI**
+
+- The flow view routes column-skipping edges in lanes and merges same-pair
+  labels. The jobs page filters follow the URL hash. Jobs and models list
+  the day (with the year only when it is not this one) and give the exact
+  timestamp where it matters. undici 8.12.3.
+
+**Engine structure**
+
+- The task-weights hook path is acyclic (`validate_weight_name` in
+  `dw/security.py`, processor weights registered into the task registry),
+  and `transformers` no longer loads into the server's validate path.
+  `dw/plan_downloads.py`, `dw/tasks/script_take.py` and
+  `dw/pipeline_processors/mag_calibration.py` split out of their parents;
+  `docs/ARCHITECTURE.md` names each seam.
+
+**Dependencies and deploy**
+
+- No dependency floors changed. The engine changes in this release need a
+  server restart (the persistent worker) after deploy.
+
 ### 0.15.0
 
 <!-- Drafted from v0.14.0..develop (0c4ed5ea). Paste into the GitHub release body once the tag has published: gh release edit v0.15.0 --notes-file ... -->
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 3c46143ea..dd576e779 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -199,7 +199,13 @@ One policy now answers all of it, untrusted:
   (`MAX_MEDIA_REDIRECTS`), and each `Location` passes the same scheme and
   host policy before it is dialed. A public URL answering `302` to
   `http://127.0.0.1:8765/api/server` is refused with the target named, and
-  nothing is fetched from it. Images are decoded from the fetched bytes and
+  nothing is fetched from it. A refused hop's error always begins
+  `Refusing a redirect to '<target>' (from '<the URL asked for>'): ` and
+  then gives the rule that refused it (an internal address, a scheme other
+  than http(s), an unresolvable host), whereas an error status from a URL
+  itself stays the HTTP client's own `403 Client Error: Forbidden for url:
+  ...` - so a refused redirect and an upstream failure read differently
+  (#1055). Images are decoded from the fetched bytes and
   still go through diffusers' `load_image`, so EXIF orientation and RGB
   conversion are unchanged. Each hop's host is resolved once, by the policy,
   and dialed at the address it checked - so a name that answers differently
diff --git a/docs/SECURITY_QUICKREF.md b/docs/SECURITY_QUICKREF.md
index 79bff9a1e..350a1232b 100644
--- a/docs/SECURITY_QUICKREF.md
+++ b/docs/SECURITY_QUICKREF.md
@@ -109,4 +109,5 @@ Invalid: file:///etc/passwd, ftp://server/file
 | `Path contains dangerous pattern matching \.\.` | Path traversal | Use absolute or `./` relative paths |
 | `Invalid variable name: my.var` | Special characters | Use `my_var` instead |
 | `Invalid URL: URL scheme not allowed: file` | Non-http scheme | Use https or local file path |
+| `Refusing a redirect to '<target>' (from '<url>'): ...` | A media URL redirected to an internal host or a non-http scheme | Host the media where it is served directly; a refused hop is never fetched |
 | `Argument contains dangerous characters: ...` | Shell metacharacters | Remove `` ` `` `$` `\|` `&` `;` `>` `<` |
diff --git a/docs/SERVER.md b/docs/SERVER.md
index 5dd42d321..9c636d98f 100644
--- a/docs/SERVER.md
+++ b/docs/SERVER.md
@@ -47,7 +47,10 @@ the same choice, and the flag wins over it. A list (`--devices cuda:0,cuda:1`)
 runs one worker per card, each running one job at a time. A card named twice,
 or a bare `cuda` in a list of several, is refused at startup, as is a card the
 machine lacks, with the message naming the cards that are present
-(`cuda:0 (NVIDIA GeForce RTX 4090)`, ...).
+(`cuda:0 (NVIDIA GeForce RTX 4090)`, ...). A list survives a card being
+pulled: an entry the machine lacks is dropped with a warning naming it, and
+the server starts on the rest. Only a list none of whose cards is present
+(or a single absent card) is refused.
 
 Each job's record carries `device` - the card it ran on, as the server
 addresses it (`"cuda:1 NVIDIA GeForce RTX 3090"`), set when the job starts
@@ -200,7 +203,7 @@ running:
 
 | Route | What it does |
 | --- | --- |
-| `POST /api/jobs` | Queue a run: `{"workflow_path": ...}` or an inline `{"workflow": {...}, "base_dir": ...}`, plus `arguments` for variable overrides. `workflow_path` accepts a stored workflow name as listed by `/api/workflows` (with or without `.json`, nested names included), or a relative/absolute path that still resolves under `--workflow-dir` - confined the same way the `/api/workflows` CRUD routes are; a path that names a real file outside that directory is rejected with 400, not opened. Answers with argument warnings from signature checking. Takes an optional `acknowledged_cost`: `true` is recorded as `acknowledged: boolean`; the object `{fingerprint, minutes, downloads}` from a validate answer's `plan` is `bound` - the server re-plans the run for the arguments given and answers **409** when the fingerprint differs or a repo in `downloads_required` is not in `downloads` (a download that has since vanished is not a refusal); the body is `{"detail": {message, reason: "fingerprint" \| "downloads" \| "unplannable", acknowledged, plan, acknowledge}}` with the current plan, so the caller re-quotes from it, and `acknowledge` - the `{fingerprint, minutes, downloads}` to resend - whenever there is a plan. A `null` in `downloads` (a URL with no repo) is ignored. `minutes` is recorded, never compared. Nothing is required: the web UI and every caller that sends nothing are `acknowledged: none`, and every job answer and history row carries `acknowledged` (and `acknowledged_cost` when bound). `POST /api/jobs/{id}/rerun` takes the same field and checks against the stored spec; a fresh seed does not change a fingerprint. |
+| `POST /api/jobs` | Queue a run: `{"workflow_path": ...}` or an inline `{"workflow": {...}, "base_dir": ...}`, plus `arguments` for variable overrides. `workflow_path` accepts a stored workflow name as listed by `/api/workflows` (with or without `.json`, nested names included), or a relative/absolute path that still resolves under `--workflow-dir` - confined the same way the `/api/workflows` CRUD routes are; a path that names a real file outside that directory is rejected with 400, not opened. Answers with argument warnings from signature checking. Takes an optional `acknowledged_cost`: `true` is recorded as `acknowledged: boolean`; the object `{fingerprint, minutes, downloads}` from a validate answer's `plan` is `bound` - the server re-plans the run for the arguments given and answers **409** when the fingerprint differs or a repo in `downloads_required` (pipeline `model_name`s and the repos task steps fetch) is not in `downloads` (a download that has since vanished is not a refusal); the body is `{"detail": {message, reason: "fingerprint" \| "downloads" \| "unplannable", acknowledged, plan, acknowledge}}` with the current plan, so the caller re-quotes from it, and `acknowledge` - the `{fingerprint, minutes, downloads}` to resend - whenever there is a plan. A `null` in `downloads` (a URL with no repo) is ignored. The validate `plan` sent unedited is bound too: when `downloads` is absent, its `downloads_required` repos (and `estimate.minutes`) are what was acknowledged; an explicit `downloads`, even `[]`, wins. `minutes` is recorded, never compared. Nothing is required: the web UI and every caller that sends nothing are `acknowledged: none`, and every job answer and history row carries `acknowledged` (and `acknowledged_cost` when bound). `POST /api/jobs/{id}/rerun` takes the same field and checks against the stored spec; a fresh seed does not change a fingerprint. |
 | `GET /api/jobs?workspace=&status=&limit=` | Queue + history summaries, oldest first, with `total` beside them. `status` narrows to one state or a comma-separated set (`queued`, `running`, `succeeded`, `failed`, `cancelled`; anything else is a 400); `limit` keeps the newest N, and `total` still reports how many matched, so a bounded answer cannot be mistaken for a complete one. Each summary carries `device`, the card the job ran on (`"cuda:1 NVIDIA GeForce RTX 3090"`; null while queued and for older jobs), and `rerun_of`, present on a job started by rerun: the id of the job it reran; absent for a fresh submit. No parameters means every job, which is what the web UI polls |
 | `GET /api/jobs/{id}` | Full detail: spec, events, manifest, error. A manifest entry for a step served from the step cache carries `reused: true`. Every entry carries `subfolder` - the in-run subfolder the step's `result.subfolder` chose, `''` for none. A `for_each` step appears in the manifest as its members (`shot@wide_open`, `shot@closeup`), because the manifest records what ran; the run's `workflow.json` keeps the `for_each` form, because it records what was asked Carries `output_kinds`: each manifest file mapped to its media kind (`image`, `video`, `audio`, `text`, or null), and each file-carrying run event (`step_end`) carries the same map for its own files. The entry of a pipeline step that ran carries `timing` (see [Step timing](WORKSPACES.md#step-timing)). Carries `rerun_of` - present on a job started by rerun: the id of the job it reran; absent for a fresh submit. |
 | `DELETE /api/jobs/{id}/run` | Delete the run directory a finished job wrote, whole, from the output root the job ran against (no workspace selector applies): `{job_id, run_dir, deleted, run_swept}`. 404 for an unknown job or one with no run directory, 409 for one still queued or running |
@@ -426,7 +429,7 @@ The editor's forms come from these; they are just as usable from scripts:
   when the worker is busy or did not answer - a workflow with no `seed`
   also gets a warning saying so, since `0` alone does not distinguish a
   disabled cache from an empty one);
-  `downloads_required`, each `model_name` the hub cache does not hold as
+  `downloads_required`, each `model_name` the hub cache does not hold, and each repo a task step fetches (`dw/tasks/weights.py`; a repo shared with a pipeline step is listed once, a reference or local-path argument gives none) as
   `{repo, gb, gated, access_blocked}` (`gb` from the hub, `null` when it
   could not be asked - `?sizes=false` skips the hub, and then `gated` and
   `access_blocked` are `null` too); `gated` is the hub's own field for the
@@ -445,7 +448,21 @@ The editor's forms come from these; they are just as usable from scripts:
   offline) - "unknown" is not "not blocked". `validate_workflow`'s
   `warnings` carries one line per entry with `access_blocked: true`. Each
   `from_single_file` URL is `{repo: null, url, gb: null, gated: null,
-  access_blocked: null}`, since a direct file URL is never gated; and
+  access_blocked: null}`, since a direct file URL is never gated.
+  A task that fetches one file rather than a whole repo is listed as a file
+  entry, `{repo, filename, revision, gb, gated, access_blocked}`: `revision`
+  is a 40-character commit pin or `null` for `main`; `gb` is that one file's
+  size, from a HEAD of the file (`null` offline or with `?sizes=false`);
+  `gated` is `null`, since the HEAD that sizes it does not say; and
+  `access_blocked` is `true` when that HEAD is refused by the gate, `false`
+  when it succeeds, `null` when unknown. It is listed when that file at that
+  revision is not in the hub cache (checked per file, so another cached file
+  of the same repo does not count), and a whole-repo entry for the same repo
+  subsumes it. Acknowledgements still compare by `repo`. `restore_faces`
+  also lists facexlib's weights as URL entries (`detection_Resnet50_Final.pth`,
+  and `parsing_parsenet.pth` unless `use_parse` is false) while they are
+  missing from facexlib's weights directory; they download outside the
+  Hugging Face cache. And
   `estimate`, `{minutes, basis,
   device, measured_on, partial, runs}` from this box's own history when it
   has one and otherwise from the workflow's `cost` block -
@@ -467,7 +484,8 @@ The editor's forms come from these; they are just as usable from scripts:
   naming the drivers that moved, because it was measured at another setting
   of them; `other_device` (no entry for
   the serving backend; the first entry's figure, which is a warning rather
-  than a quote) or `unknown` (no cost block, or more than one list changed
+  than a quote) or `unknown` (no cost block - a workflow of task steps alone says so in
+  `unpriced_reason`, since it has no pipeline to inherit from - or more than one list changed
   so there is nothing honest to extrapolate along) or `inherited` (an
   inline workflow has no catalog name, so its price is this server's
   `observed` runs of the catalog template that loads the same pipeline -
@@ -595,8 +613,9 @@ The editor's forms come from these; they are just as usable from scripts:
   `subfolders` list every distinct value over the whole tree, `''` always a
   member of each so root-level files stay selectable. Each entry also
   carries `role`, `final` or `intermediate` (null for a flat-layout file with
-  no run; `intermediate` once a later run read the file, unless the step's
-  `result.role` declared it), and `GET /api/gallery?role=final` lists only
+  no run, or a file of a run that recorded no role whose subfolder says
+  nothing and that no later run read; `intermediate` once a later run read
+  the file, unless the step's `result.role` declared it), and `GET /api/gallery?role=final` lists only
   those (repeatable; a null role counts as final). See `dw/roles.py` for how
   a role is decided;
   the metadata route reports the file's `role` and the run's `inputs` too
diff --git a/docs/TASKS.md b/docs/TASKS.md
index 4127bb184..7372bfbd8 100644
--- a/docs/TASKS.md
+++ b/docs/TASKS.md
@@ -107,6 +107,15 @@ A new task is:
    automatically, so a module it does not import registers nothing;
 3. a section in this file.
 
+A task that loads Hub weights also declares `required_weights(arguments)`,
+named on the decorator as
+`register_command(required_weights="dw.tasks.<module>.required_weights")`. It
+returns `[{"repo": ...}]` for the step's arguments (an empty list when the
+repo is not known yet, e.g. a `previous_result:` `model_name`), and resolves
+each repo with `argument_or_default` from `dw/tasks/weights.py`, the same call
+the loader makes, so the declaration and the load cannot name different
+repos. A validate's `downloads_required` lists those repos; `tests/test_task_weights.py` pins it.
+
 ## Image Processing
 
 ### ControlNet Preprocessors
@@ -139,6 +148,8 @@ Generate control images for ControlNet pipelines:
 | `depth_estimator` | Depth hint generation |
 | `depth_estimator_tensor` | Depth hint as tensor |
 
+A validate's `downloads_required` lists the repo each detector fetches when it is not cached: `depth` `Intel/dpt-hybrid-midas`; `depth_estimator` and `depth_estimator_tensor` `Intel/dpt-large`; the `controlnet_aux` detectors `lllyasviel/Annotators` (`teed` `fal-ai/teed`, `anyline` `TheMistoAI/MistoLine`, `sam` `ybelkada/segment-anything`); `segmentation` `openmmlab/upernet-convnext-small`. `zoe_depth` and `dw_pose` fetch outside the Hugging Face cache and are not listed.
+
 All accept an `image` argument with processing parameters:
 
 ```json
@@ -175,6 +186,8 @@ All accept an `image` argument with processing parameters:
 | `add_watermark` | Add visible text watermark | `text`, `position`, `opacity`, `font_size`, `color`, `margin` |
 | `get_image_size` | Return `{width, height}` dict | |
 
+A validate's `downloads_required` lists `briaai/RMBG-2.0` for `remove_background` when it is not cached.
+
 ### EXIF Stripping
 
 Remove all EXIF metadata, GPS coordinates, camera info, and timestamps from images for privacy-safe preprocessing:
@@ -1099,6 +1112,8 @@ face-detail pass that needs the face large and still:
 | `detector_file` | No | The detector file in that repo, a bare `.onnx` name. Default `face_detection_yunet_2023mar.onnx` |
 | `device` | No | Where detection runs |
 
+A validate's `downloads_required` lists the detector file as a file entry when it is not cached, pinned at its revision for the default repo and file.
+
 `modulus`, `remainder` and `multiple` follow `plan_cuts`: the model's grid is
 the workflow's to declare. The defaults (8, 1, 32) are LTX's 8n+1 frames and
 32-pixel steps, so a workflow that names none gets the output it always did;
@@ -1251,10 +1266,10 @@ returns frames without it, and this puts it back:
 
 | Argument | Required | Description |
 | -------- | -------- | ----------- |
-| `video` | Yes | The frames - a frame list, a frame array or tensor, or an audio+video pair whose own soundtrack is replaced; their own rate is carried through to the output, so `result.fps` is only needed to override it (frames that carry none are written at 8 fps) |
+| `video` | Yes | The frames - a frame list, a frame array or tensor, or an audio+video pair whose own soundtrack is replaced; their own rate is carried through to the output, so `result.fps` is only needed to override it. A file brings its rate along, and so does a pipeline step whose pipeline reports one (MiniMax-H3's `videos` carry 24 fps, #1056); frames that carry none are fitted and written at 8 fps unless `fps` says otherwise |
 | `audio` | Yes | The soundtrack - a waveform, the earlier step whose video carried one, or the path or URL of an audio or video file; the last two bring their sample rate along. A mono track is fine: an mp4 audio stream takes stereo and nothing else, so saving duplicates the one channel into two and warns that it did |
 | `sample_rate` | No | Sample rate of the waveform. Required unless `audio` carries one; given here it wins |
-| `fps` | No | The rate the frames play at, only needed when they carry none of their own. Used solely to work out how long the video is - what `fit` and the length-mismatch check measure the track against - and is never written to the file; that's `result.fps`, which sets the rate the output plays at and defaults to 8 fps when the frames carry none |
+| `fps` | No | The rate the frames play at, only needed when they carry none of their own. What `fit` and the length-mismatch check measure the track against, and the rate the paired video then carries to the writer. `result.fps` is not a substitute: the writer applies it after the fit has run, so declaring it alone on rate-less frames writes a 24 fps picture under a track padded to the 8 fps length (`video_fps_defaulted` says so, #1056) |
 | `fit` | No | `"video"` cuts or pads the track with silence to the length of the frames, warning either way (`audio_padded_to_video` / `audio_trimmed_to_video`). Left unset (the default) the track is used as it is, and a length that disagrees with the frames' is warned about rather than corrected (`audio_video_length_mismatch`). Any other value is refused at run time, not by `validate_workflow` |
 
 `fit`'s guarantee is exact for the waveform handed to the encoder, not for
@@ -1315,7 +1330,7 @@ a length still passes the whole track along:
 | Argument | Required | Description |
 | -------- | -------- | ----------- |
 | `audio` | Yes | Path or URL of an audio file (or of a video file, whose soundtrack is taken), a waveform from a previous step, or an earlier step's video generated with a soundtrack (which brings its sample rate along) |
-| `start_seconds` / `duration_seconds` | One pair | The slice in seconds; either may be omitted |
+| `start_seconds` / `duration_seconds` | One pair | The slice in seconds; either may be omitted. `start_seconds` with `num_frames` + `fps` and no duration takes its length from the frames |
 | `start_frame` / `num_frames` / `fps` | One pair | The slice in video frames; `fps` is required, start and count may be omitted |
 | `lead_frames` | No | Frame form only, default 0: extra audio before the cut. The slice starts at `start_frame - lead_frames` and still runs `num_frames`, so `start_frame` 48 with `lead_frames` 12 at 24 fps is audio from frame 36 for `num_frames` frames. A whole number, 0 or above; refused with the seconds form, and refused when `start_frame - lead_frames` is below zero (by `validate_workflow` for literals, at run time otherwise) |
 | `sample_rate` | With a waveform | Sample rate of a directly passed waveform (files carry their own) |
@@ -2161,6 +2176,18 @@ Every seam between shots, audio and picture:
 | `seams[].frame_delta` | The largest single-frame picture change across the seam |
 | `seams[].typical_delta` | The larger shot's own typical frame-to-frame change, floored |
 | `seams[].jump_ratio` | `frame_delta` divided by `typical_delta` |
+| `seams[].saturation_step` | Mean saturation (per-pixel max(RGB) - min(RGB)) of the 4 frames after the seam minus the 4 before it (before a dissolve's fade), clipped to the shots. Signed: positive means the incoming shot is more saturated |
+| `seams[].lightness_step` | The same for mean Rec. 709 luma. Signed: negative means the incoming shot is darker |
+| `seams[].contrast_step` | The same for the luma standard deviation. Signed |
+| `seams[].look_ratio` | The largest of the three steps' sizes divided by that measure's own local rate: the 90th percentile of its change from one 4-frame mean to the next inside either shot, floored at 1.0. A step inside a shot that is itself changing that way (a sunrise) scores low |
+| `seams[].look_ratio_measure` | Which measure gave `look_ratio`: `saturation`, `lightness` or `contrast` |
+| `seams[].detail_ratio` | Mean high-pass detail (luma against its 3x3 blur) after the seam divided by before it: below 1 means the incoming shot is softer. Null when the before window has almost no detail (below 0.5) |
+
+The six look fields are measures, not rules: none raises a finding, and they
+appear in neither `rules_applied` nor `rules_skipped`. They are on the 0-255
+scale of a 128x72 colour copy of each frame, and the numbers are not
+perceptual - a `look_ratio` of 10 is not a calibrated "visible". They are null
+when the file has no picture.
 
 ### analyze_sync_drift
 
@@ -2233,7 +2260,7 @@ score bed.
         "command": "separate_stems",
         "arguments": { "audio": "asset:song.mp3" }
     },
-    "result": { "content_type": "audio/wav", "file_name": "stems" }
+    "result": { "content_type": "audio/wav", "file_base_name": "stems" }
 },
 {
     "name": "lyrics",
@@ -2250,15 +2277,40 @@ score bed.
 | `audio` | Yes | Path or URL of an audio file (or of a video file, whose soundtrack is taken), a waveform from a previous step, or an earlier step's video generated with a soundtrack |
 | `sample_rate` | With a waveform | Sample rate of a directly passed waveform (files carry their own) |
 
-The result saves one file per stem, `<file_name>-vocals`, `-drums`, `-bass`
+The result saves one file per stem, `<file_base_name>-vocals`, `-drums`, `-bass`
 and `-other`, and a later step reads one as `previous_result:<step>.vocals`.
 Stems are 44.1 kHz stereo, whatever the source was, and sum back to the mix.
 The model is fixed (`htdemucs`, run in fp32), its weights download on first
 use, and it needs the `demucs` package. On MPS a failed separation falls back
 to the CPU and warns (`separation_cpu_fallback`).
 
+**Stacked vocals.** A chorus is often recorded as layered stereo doubles - every
+Music 3 chorus is - and htdemucs returns all of them in the one `vocals` stem.
+When the stem's left and right channels sing different lines over a sung span,
+the step warns `stacked_vocals` and names the spans in m:ss (up to 8, then "and
+N more"):
+
+```
+separate_stems: the vocals stem holds stacked (layered stereo) voices over
+1:19–1:34, 1:59–2:09; treat those spans as more than one voice before
+processing them as one
+```
+
+Read it before working on a span as one voice: pitch or formant work on a
+stacked span distorts it, and an `attribute_voices` window or a lip-sync shot
+over one has two singers in it. Pick a span outside the flagged ones, or plan
+the shot as a two-shot. The stems themselves are unchanged. The check is a 1 s
+window test on the stereo stem: the window must be sung (half its frames voiced,
+and within 14 dB of the stem's level), with an L/R correlation under 0.45 and a
+side/mid energy ratio over 0.4. Windows merge across a one-window gap, and
+spans under 2 s are dropped. A mono source, an instrumental and a single doubled
+word never flag it. The thresholds are the `STACK_*` constants in
+`dw/tasks/voice_attribution.py`.
+
 ## Voice attribution
 
+A validate's `downloads_required` lists `speechbrain/spkrec-ecapa-voxceleb` only. The demucs separator (and `separate_stems`) downloads outside the Hugging Face cache and is not listed.
+
 Which reference voice sings each line of a song, by timbre - staging
 lip-sync shots for a generated song needs its section-to-singer map, and a
 generation model (MiniMax Music3 included) does not hand one back. Pitch
@@ -2506,8 +2558,8 @@ Pass through arguments directly. Useful for organizing data flow.
 
 ## Videos in image tasks
 
-Every image command - the upscalers, face restoration, segmentation and the
-image processors - takes a video where it takes an image: an `AudioVideo` from
+Every image command - the upscalers, face restoration, segmentation, object
+removal and the image processors - takes a video where it takes an image: an `AudioVideo` from
 a generation, `concat_videos` or `dissolve_videos` step, or a frame array from
 `video_frames`. The command runs over the frames one at a time and returns one
 video artifact, its soundtrack carried through untouched, so a generated clip
@@ -2559,6 +2611,8 @@ Upscale images using spandrel-compatible super-resolution models (ESRGAN, SwinIR
 | `tile_size` | No | Tile size for large images (default: 512) |
 | `tile_overlap` | No | Overlap between tiles in pixels (default: 32) |
 
+A validate's `downloads_required` lists the `model_name` / `filename` file when it is not cached, or the whole repo when no `filename` is given (such a repo must hold exactly one weight file); a `previous_result:` or local-path model gives none.
+
 Large images are automatically tiled to avoid GPU memory issues. Models can be loaded from HuggingFace Hub repos or local `.pth`/`.safetensors` files.
 
 **Examples:**
@@ -2573,6 +2627,8 @@ Two modes are available:
 - **x4** (default): `StableDiffusionUpscalePipeline` — 4x upscale via `stabilityai/stable-diffusion-x4-upscaler`
 - **x2**: `StableDiffusionLatentUpscalePipeline` — 2x upscale via `stabilityai/sd-x2-latent-upscaler`
 
+A validate's `downloads_required` lists the repo for the `mode` given; `model_name` overrides it.
+
 ```json
 {
     "task": {
@@ -2632,6 +2688,8 @@ Restore and enhance faces in images using spandrel-compatible face restoration m
 | `eye_dist_threshold` | No | Skip faces with eye distance below this (default: 5) |
 | `upsample_img` | No | Pre-upscaled background image (e.g., from a prior upscale step) |
 
+A validate's `downloads_required` lists the `model_name` / `filename` file when it is not cached (the whole repo when no `filename` is given), and facexlib's two weights as URL entries while they are missing from facexlib's weights directory: `detection_Resnet50_Final.pth` always and `parsing_parsenet.pth` unless `use_parse` is false. Those still download outside the Hugging Face cache.
+
 Models are loaded via spandrel, so any `.pth`/`.safetensors` face restoration weights work. CodeFormer requires `pip install spandrel-extra-arches` (non-commercial license). The detector and parser are loaded once per settings/device and reused across frames; `release_models` drops them with the restorer.
 
 **Example:** [restore-faces.json](../workflows/templates/restore-faces.json) — Generate a portrait, then restore faces with GFPGAN v1.4.
@@ -2684,6 +2742,8 @@ This gives the best results: the super-resolution model handles background detai
 
 Detect and segment objects using text prompts via GroundingDINO + SAM2. Returns a binary mask image suitable for inpainting workflows.
 
+A validate's `downloads_required` lists `IDEA-Research/grounding-dino-base` and `facebook/sam2-hiera-large`; `model_name` and `sam_model_name` override them.
+
 ```json
 {
     "task": {
@@ -2706,12 +2766,58 @@ Detect and segment objects using text prompts via GroundingDINO + SAM2. Returns
 | `threshold` | No | Detection confidence threshold (default: 0.3) |
 | `invert` | No | Invert the output mask (default: false) |
 
-Returns a grayscale PIL Image (mode "L") — white (255) for detected objects, black (0) for background. Use with inpainting pipelines like FluxFillPipeline.
+Returns a grayscale PIL Image (mode "L") — white (255) for detected objects, black (0) for background. SAM2 proposes three masks for each detected box, and segment keeps the one SAM2 rates best. That is usually the whole object: on the docs cup photo the first proposal was the body alone, without the lid and with a hole at the logo. To erase what it found, pass the mask to [`remove_object`](#object-removal), which chains with no `invert`. To paint something new in its place, pass it to a prompted inpainter such as FluxFillPipeline.
 
 **Examples:**
 
 - [segment.json](../workflows/templates/segment.json) — Segment an object from an image
-- [segment-and-inpaint.json](../workflows/templates/segment-and-inpaint.json) — Segment, then inpaint the masked region
+- [segment-and-remove.json](../workflows/templates/segment-and-remove.json) — Segment, then erase the object with `remove_object` (no prompt)
+- [segment-and-inpaint.json](../workflows/templates/segment-and-inpaint.json) — Segment, then repaint the masked region with a prompt
+
+## Object Removal
+
+Erase what a mask covers and fill the hole from the surrounding texture, with no prompt (#956). `remove_object` runs [LaMa](https://github.com/advimman/lama) (big-lama) through spandrel: no diffusion, so a warm run takes well under a second on a GPU, and it runs on CUDA, MPS and CPU.
+
+```json
+{
+    "task": {
+        "command": "remove_object",
+        "arguments": {
+            "image": "asset:photo.png",
+            "mask_image": "previous_result:mask",
+            "dilate": 8
+        }
+    },
+    "result": { "content_type": "image/png" }
+}
+```
+
+| Argument | Required | Description |
+| -------- | -------- | ----------- |
+| `image` | Yes | PIL Image or reference - a video runs frame by frame, see [Videos in image tasks](#videos-in-image-tasks) |
+| `mask_image` | Yes | White where to erase, black where to keep |
+| `dilate` | No | Pixels to grow the mask by before the fill, a whole number 0 or above (default: 8) |
+| `model_name` | No | Hugging Face repo id of the weights, never a local path (default: `michaelgold/big-lama`, at a pinned revision) |
+| `weight_name` | No | The `.safetensors` file in that repo (default: `big-lama.safetensors`) |
+
+**The mask.** White means fill, the polarity [`segment`](#object-segmentation) returns, so `segment` → `remove_object` chains with no `invert`. The mask is converted to grayscale and binarized at 128 (at or above is fill). A mask of a different size from the image is resized to it (nearest). An all-black mask, as `segment` returns when it finds nothing, gives the image back unchanged with a warning in the job's events, and loads no model.
+
+**`dilate`.** LaMa fills cleanly only when the mask overshoots the object's edge, and a `segment` mask is tight to it. The default 8 px suits a segmented object. Raise it (16 to 24) for a soft edge, a shadow or a glow around the object. Use 0 only for a hand-drawn mask that already has a margin.
+
+**The output** is the input's size. Only the region inside the dilated mask comes from the model: every pixel outside it is the input's own, unchanged.
+
+**Video.** Frames (e.g. from `video_frames`) are cleaned one at a time with the same still mask, and come back at the same count and fps, with the audio kept. There is no temporal model, so a fill can flicker from frame to frame, and the mask cannot follow a moving object.
+
+**Limits.** LaMa suits small to medium objects: a cup, a sign, a watermark, a passer-by in the distance. A large region, such as a person filling a third of the frame, comes back smeared. For that, a prompted inpainter whose prompt names the background is the remaining route, and it may paint a patch that does not match (#946).
+
+**Weights.** `michaelgold/big-lama`, file `big-lama.safetensors` (about 200 MB), read at revision `98ab7cface89a594b381f32fc7a9f2cae3f91ccc`. `biali/big-lama` holds a byte-identical copy and is the fallback if that repo disappears; it is not tried automatically. LaMa is by advimman (Suvorov et al., *Resolution-robust Large Mask Inpainting with Fourier Convolutions*) and is licensed **Apache-2.0**. The Hub repo's card says MIT, but the upstream licence is the one that applies. The task reads safetensors only: `validate_workflow` refuses a `weight_name` that is not `.safetensors` (the common `big-lama.pt` is a TorchScript file) and a `model_name` that is a local path, and the loader refuses both again at run time. Weights that do not load as an inpainting model are refused too. The network runs in fp32 on every device.
+
+**First run.** The weights download on the first run, about 200 MB. A validate's `downloads_required` lists `michaelgold/big-lama` / `big-lama.safetensors` as a file entry (pinned at that revision for the default pair only; another `model_name` or `weight_name` is read at `main`) while it is not cached, so the download is quoted beforehand.
+
+**Examples:**
+
+- [remove-object.json](../workflows/templates/remove-object.json) — Erase what a supplied mask covers
+- [segment-and-remove.json](../workflows/templates/segment-and-remove.json) — Find an object by name, then erase it
 
 ## Image Captioning
 
@@ -2719,6 +2825,8 @@ Generate text captions from images using a vision-language model.
 
 Transformers 5 removed the dedicated `image-to-text` pipeline this task used to build, along with the BLIP/ViT-GPT2/GIT captioning models that ran on it. Captioning now goes through the same `image-text-to-text` pipeline as any other VLM, so `model_name` needs a vision-language model (SmolVLM, Qwen2.5-VL, LLaVA, etc.) and `prompt` is a question put to the model rather than a text fragment to continue.
 
+A validate's `downloads_required` lists `HuggingFaceTB/SmolVLM-256M-Instruct` for `image_to_text` and `judge`; `model_name` overrides it.
+
 ```json
 {
     "task": {
@@ -2828,6 +2936,8 @@ The built-in `h3_context_ir` workflow applies this to its own output, so a workf
 
 Generate or expand text using a local language model. Useful for expanding short prompts into detailed image generation prompts, rewriting text, or other text-to-text tasks.
 
+A validate's `downloads_required` lists `Qwen/Qwen2.5-1.5B-Instruct`, or `HuggingFaceTB/SmolVLM-256M-Instruct` when an `image` is given; `model_name` overrides it. A `system_prompt.from_hub` file is not listed.
+
 ```json
 {
     "task": {
@@ -2912,7 +3022,15 @@ It is merged after everything else, so it can override `repetition_penalty` and
 
 ## Speech Generation
 
-Speak a line of text with a local text-to-speech model. The result is a waveform carrying the rate its model generated at, so it composes with [`slice_audio`](#slice_audio), [`fade_audio`](#fade_audio) and [`pair_audio`](#pair_audio) directly ([`concat_videos`](#concat_videos) and `dissolve_videos` join videos — pair the track onto a video first).
+Speak a line of text with a local text-to-speech model. A validate's `downloads_required` lists `suno/bark-small` (`model_name` overrides it), plus `speechbrain/spkrec-xvect-voxceleb` when `speaker_embedding` is given. Any transformers text-to-speech checkpoint can be named as `model_name`; three families are wired for their voice controls:
+
+| Family | Checkpoint | Voice |
+|--------|-----------|-------|
+| Bark | `suno/bark-small` (the command's default) | Distinct speakers by `voice_preset` |
+| MMS / VITS | `facebook/mms-tts-eng`, and `mms-tts-<code>` per language (the template's default) | One voice, a quarter Bark's size; a multi-speaker VITS takes `speaker_id` in `forward_params` |
+| SpeechT5 | `microsoft/speecht5_tts` | The voice of a reference clip, given as `speaker_embedding` |
+
+The result is a waveform carrying the rate its model generated at, so it composes with [`slice_audio`](#slice_audio), [`fade_audio`](#fade_audio) and [`pair_audio`](#pair_audio) directly ([`concat_videos`](#concat_videos) and `dissolve_videos` join videos — pair the track onto a video first).
 
 ```json
 {
@@ -2967,6 +3085,8 @@ A speech model is worth releasing before a video model loads — set `release_mo
 
 ## Speech Transcription
 
+A validate's `downloads_required` lists `openai/whisper-base`; `model_name` overrides it. `check_script` uses the same model.
+
 Transcribe spoken audio to text with a local Whisper-class model. The word-correctness of a TTS deliverable — a dropped line, a mid-sentence truncation — can only be inferred from duration and timing arithmetic without this; `transcribe_audio` checks it directly against the text the deliverable was supposed to speak.
 
 ```json
@@ -3000,6 +3120,8 @@ To compare a take against the lines it was meant to speak, use [`check_script`](
 
 ## Script check
 
+A validate's `downloads_required` lists `openai/whisper-base` for its transcription; `model_name` overrides it.
+
 Whether a dialogue take speaks its script. Confirming it used to mean transcribing the take and comparing the transcript to the script by eye, which missed a word Whisper dropped, an H3 tag read aloud, and a last word cut off by the end of the file. `check_script` does the comparison and reports where to look.
 
 It transcribes the take with [`transcribe_audio`](#speech-transcription) word timestamps - the same code and model cache, no second ASR path. Every heard word is measured, and one at or below the dead-air floor is discarded as unheard, because Whisper invents words over silence. So is every word of a repetition loop - the same words over and over (`Pre-pre-pre-...`), which Whisper invents over music or room tone loud enough to pass the floor. H3 markup is stripped from each expected line, and the heard words are aligned to the expected words in order (`difflib`). Each line scores the similarity of its own expected and heard words. It decides nothing: findings are places to look, not verdicts. It is not an assessment probe (`assessment=True`); like [`attribute_voices`](#voice-attribution) it answers a JSON document.
@@ -3035,27 +3157,29 @@ Markup stripped from an expected line: `<d>[Language] ...</d>`, `<scenetrans>`,
 | ---- | ---------- | --------------------- | ---- |
 | `line_mismatch` | A line's similarity is below `similarity`; a dropped line comes back with `heard: ""` | The line's similarity / `similarity` | `{line, seconds, word}` - the line's first heard word, or where it should have been |
 | `tag_spoken` | A word from the line's stripped markup was heard, and is not also a word of the line's dialogue | The word heard / none | `{line, seconds, word}` |
-| `line_clipped_at_end` | A line's last heard word ends inside the final `CLIP_TAIL_SECONDS` of its shot (when the line has one) or of the file, and that tail is still above `GUARD_FLOOR_DBFS` | The tail's level in dBFS / `GUARD_FLOOR_DBFS` | `{line, seconds, word, shot}` - `shot` when the line has one |
+| `transcript_loop` | A repetition loop (`REPEAT_RUN_MIN` periods of up to `REPEAT_MAX_PERIOD` words) made only of words the script holds - Whisper stuck on a line it heard, so speech after it can be missing from `heard` and lines read 0.0 without being wrong (#961). The loop's first occurrence is kept as heard when it has real duration and speech level; the rest is under `discarded`, one entry per loop (`count`, `start`..`end`). A line heard nowhere, at or after the loop, reads `heard: null`, `similarity: null`, `not_transcribed: "transcript_loop"` and raises no `line_mismatch`. When the shots are known the cut is then transcribed again one shot at a time and the findings and `lines` come from that pass (`transcription_pass: "per_shot"`, each line `pass: "per_shot"`, #963) | Chunks in the loop / `REPEAT_RUN_MIN` | `{line: null, seconds, end}` |
+| `line_clipped_at_end` | A line's last heard word ends inside the final `CLIP_TAIL_SECONDS` of its shot (when the line has one) or of the file, and that tail is still above `GUARD_FLOOR_DBFS` and within `CLIP_TAIL_BELOW_WORD_DB` of the last word's own loudest window (a quieter tail is a score bed or room tone, not the word - #953) | The tail's level in dBFS / `GUARD_FLOOR_DBFS` | `{line, seconds, word, shot}` - `shot` when the line has one |
 | `speech_where_silent` | `lines` is `[]` and words were heard above the floor and outside a repetition loop | Number of words heard / 0 | `{line: null, seconds, word}` - the first; `shot` when shots are known |
 | `speech_in_silent_shot` | Shots are known, at least one line names a shot, and words were heard above the floor and outside a repetition loop in a shot no line names. A word is in the shot its midpoint falls in; one a line in another shot matched (a word straddling the cut) is that line's, not counted | Number of words heard in the shot / 0 | `{line: null, seconds, word, shot}` - the shot's first counted word, `seconds` no earlier than the shot's start |
 | `unscripted_speech` | Shots are known and a line names the shot; words were heard inside it that align to no line (a line spoken twice, an ad-lib) | Number of unmatched words in the shot / 0 | `{line: null, seconds, end, word, shot, repeats_line}` - the first such word; `repeats_line` is true when those words repeat or contain one of the shot's lines |
-| `speech_not_transcribed` | Between two words of one matched line there is a gap of `UNHEARD_MIN_SECONDS` or more, or one of its words lasts `UNHEARD_MIN_SECONDS` + 2 `UNHEARD_MARGIN_SECONDS` or more, and the interior (trimmed by `UNHEARD_MARGIN_SECONDS` each side) holds a window above `UNHEARD_FLOOR_DBFS`: audible speech the ASR left out of its text, which the line's timing absorbed (#923) | The gap's length in seconds / `UNHEARD_FLOOR_DBFS` | `{line, seconds, end, shot}` - `shot` when the line has one |
+| `speech_not_transcribed` | Between two words of one matched line, or between one line's last word and the next line's first (#960; the finding sits on the next line, and a gap holding heard-but-unmatched words is `unscripted_speech`'s), there is a gap of `UNHEARD_MIN_SECONDS` or more, or one of its words lasts `UNHEARD_MIN_SECONDS` + 2 `UNHEARD_MARGIN_SECONDS` or more, and the interior (trimmed by `UNHEARD_MARGIN_SECONDS` each side) holds a window above `UNHEARD_FLOOR_DBFS`: audible speech the ASR left out of its text, which the line's timing absorbed (#923) | The gap's length in seconds / `UNHEARD_FLOOR_DBFS` | `{line, seconds, end, shot}` - `shot` when the line has one |
 
-Every finding is severity `warn`; `at.shot` is set whenever the shot is known. A rule that does not apply to the call is listed in `rules_skipped` with its reason: `speech_in_silent_shot` and `unscripted_speech` are skipped when no shots are known (`line_clipped_at_end` then looks at the file's end only), when the shots carry neither a sample span nor a frame span the take's frame rate can place, or when no line names a shot (no shot is known to be meant silent).
+Every finding is severity `warn`; `at.shot` is set whenever the shot is known. A rule that does not apply to the call is listed in `rules_skipped` with its reason: `speech_in_silent_shot` and `unscripted_speech` are skipped when no shots are known (`line_clipped_at_end` then looks at the file's end only), when the shots carry neither a sample span nor a frame span the take's frame rate can place, or when no line names a shot (no shot is known to be meant silent). A take checked alone, with no shot map (an `asset:` file with no manifest beside it), therefore never raises `unscripted_speech`, however many words are `unmatched`: read `unmatched` there, or pass `shots`. With shots known there is no minimum word count - one unmatched word inside a named shot fires it.
 
-The thresholds are module constants in `dw/tasks/script_check.py`, deliberately not in `RULES` (`dw/assessment_rules.py`): every rule there must fire on a synthetic file that holds no script. The answer echoes them under `thresholds`.
+The thresholds are module constants in `dw/tasks/script_check.py` (the guard's `GUARD_FLOOR_DBFS` and `GUARD_WINDOW_SECONDS` in its sibling `dw/tasks/script_take.py`, beside `guard_words`), deliberately not in `RULES` (`dw/assessment_rules.py`): every rule there must fire on a synthetic file that holds no script. The answer echoes them under `thresholds`.
 
 | Constant | Value | What crossing it does |
 | -------- | ----- | --------------------- |
 | `DEFAULT_SIMILARITY` | 0.85 | A line below this similarity is a `line_mismatch` (the `similarity` argument overrides it) |
 | `GUARD_FLOOR_DBFS` | -65 dBFS (= `DEAD_AIR_FLOOR_DBFS`, `shot_dead_air`'s floor) | A heard word whose loudest window is at or below it is discarded as unheard; also the level a clipped tail must exceed |
-| `UNHEARD_MIN_SECONDS` / `UNHEARD_MARGIN_SECONDS` / `UNHEARD_FLOOR_DBFS` | 1.0 s / 0.25 s / -40 dBFS | A gap in a line's words (or a stretched word) this long, with a window above the floor in its margin-trimmed interior, is a `speech_not_transcribed` |
+| `UNHEARD_MIN_SECONDS` / `UNHEARD_MARGIN_SECONDS` / `UNHEARD_FLOOR_DBFS` | 1.0 s / 0.25 s / -40 dBFS | A gap in a line's words or between two lines (or a stretched word) this long, with a window above the floor in its margin-trimmed interior, is a `speech_not_transcribed` |
 | `GUARD_WINDOW_SECONDS` | 0.05 s (= `DEAD_AIR_WINDOW`, `shot_dead_air`'s window) | The window a heard word is measured in - its loudest one, so a span overhanging a pause does not average a real word away |
 | `CLIP_TAIL_SECONDS` | 0.25 s | The final stretch of the file a line's last word must end in to be `line_clipped_at_end` |
+| `CLIP_TAIL_BELOW_WORD_DB` | 15 dB | A tail more than this far under the last word's loudest window is not the word still sounding (a bed under a finished line), so not `line_clipped_at_end` |
 | `REPEAT_RUN_MIN` | 6 | Heard words repeating the same unit this many times over, back to back, are a repetition loop: every chunk holding one is discarded (`reason: "repetition"`), however loud |
 | `REPEAT_MAX_PERIOD` | 4 words | The longest repeating unit a loop is looked for in - `pre pre pre` has period 1, `thank you thank you` period 2 |
 
-The result: `findings`, `lines[]` (`expected`, `heard`, `similarity`, `start`, `end`, `shot`), `discarded[]` (`text`, `start`, `end`, `level_dbfs`, `reason` - `below_floor` or `repetition`), `unmatched[]` (heard words aligned to no line), `transcript`, `model_name`, `rules_applied`, `rules_skipped[]` (`rule`, `reason`) and `thresholds`. A line's `shot` is the shot it names, else the shot its heard words overlap most (null when none is known). `shots` is the map as placed - `[{name, start, end}]` in seconds on the take, or null when none is known - and `shots_source` says where it came from: `argument`, `artifact`, `manifest` or `none`.
+The result: `findings`, `lines[]` (`expected`, `heard`, `similarity`, `start`, `end`, `shot`), `discarded[]` (`text`, `start`, `end`, `level_dbfs`, `reason` - `below_floor`, `repeated_span` (a chunk repeating the previous one's exact span) or `repetition`, `count` - a repetition loop is one entry spanning its chunks), `unmatched[]` (heard words aligned to no line), `transcript`, `model_name`, `rules_applied`, `rules_skipped[]` (`rule`, `reason`) and `thresholds`. A line's `shot` is the shot it names, else the shot its heard words overlap most (null when none is known). `shots` is the map as placed - `[{name, start, end}]` in seconds on the take, or null when none is known - and `shots_source` says where it came from: `argument`, `artifact`, `manifest` or `none`.
 
 How the alignment reads a take:
 
@@ -3093,7 +3217,7 @@ Increase video frame rate using RIFE (Real-Time Intermediate Flow Estimation). T
 | `model_name` | No | HuggingFace repo with RIFE v4.13 weights (default: `imaginairy/rife-interpolation`) |
 | `filename` | No | Weights filename within the repo (default: `rife-flownet-4.13.2.safetensors`) |
 
-Uses vendored IFNet v4.13 architecture. Weights are downloaded from HuggingFace Hub on first use.
+Uses vendored IFNet v4.13 architecture. Weights are downloaded from HuggingFace Hub on first use. A validate's `downloads_required` lists the `model_name` / `filename` file when it is not cached.
 
 **Example:** [interpolate-frames.json](../workflows/templates/interpolate-frames.json) — Generate video with Mochi, then 2x interpolate from 30fps to 60fps.
 
diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md
index e6695ce2a..7cb3b0e04 100644
--- a/docs/WORKFLOW_GUIDE.md
+++ b/docs/WORKFLOW_GUIDE.md
@@ -494,14 +494,21 @@ step (for a `for_each`, the heaviest member). It warns rather than
 refuses: your offload and quantization config may differ from the
 template's. Cut frames, size or references until it goes quiet, or declare
 your own `vram_estimate`, which always wins and is judged exactly as a
-template's. A pipeline the catalog declares no ceiling for gets no warning -
+template's. Under the ceiling it is not always silent: the template's
+estimate was calibrated on its own offload and quantization, so a workflow
+that sets either differently (no `offload` where the template sets
+`model`, say) gets one warning of kind `vram_config_differs` naming both
+settings and the projection - real usage may be higher. Over the ceiling the
+one `vram_projection_inherited` warning names that difference instead. A pipeline the catalog declares no ceiling for gets no warning -
 silence there is not a clearance - and H3's `t2va` and `ref2va` are
 different identities with different ceilings.
 
 The projection is `base_gb`, plus `bytes_per_voxel` times the product of
 the `voxel_variables`, plus `gb_per_reference` per non-null reference, plus
 `bytes_per_guide_voxel` times each guide's frames times the canvas (every
-voxel variable but `num_frames`). The guides counted are the step's own
+voxel variable but `num_frames`); an absent key adds nothing. A declared
+estimate refuses on the guide term as on the rest; an inherited one only
+warns. The guides counted are the step's own
 `guides` with a non-null `video`, at their snapped length, and the one a
 `continuity: "guide"` chain appends (`guide_frames`, 22 or 39). A guide
 clip is probed at validate, at admission and at run; one that cannot be
@@ -822,6 +829,25 @@ workflow.
   `reference-to-video` and `dialogue-short` templates). The `identity-referenced`
   trait in the listing marks the workflows that take one.
 
+### Erasing versus repainting a masked region
+
+A request to *erase or remove* an object and a request to *put something
+new* in its place are different operations, and only one of them takes a
+prompt.
+
+- **Erase or remove an object** → the `remove_object` task: prompt-free, it
+  fills the hole from the surrounding scene, and suits small to medium
+  objects (a cup, a sign, a watermark). `templates/remove-object.json` takes
+  a mask you already have; `templates/segment-and-remove.json` masks the
+  object by name first. A large region, such as a person filling a third of
+  the frame, comes back smeared.
+- **Put something new inside a mask** → a prompted inpainter,
+  `models/z-image-inpaint` or `templates/inpaint.json`. The prompt names what
+  to paint. Do not use one to erase: given a prompt for "empty background" it
+  paints a new object or a patch that does not match (#946).
+
+`docs/TASKS.md` *Object Removal* has the task's arguments and its mask rules.
+
 ### A spoken scene breaking into a song
 
 A musical number: spoken shots, each carrying its own dialogue audio, then
@@ -1046,7 +1072,11 @@ Pass `probe="analyze_seams"` (or either of the other two probe names) to
 get that one probe's full body: every seam's or shot's measurements, not
 just the ones that crossed a rule. `detail=true` adds every applicable
 probe's full body under `probes`. An unknown probe is refused before
-anything is read, and the error names the three probes.
+anything is read, and the error names the three probes. Each seam's full
+record also carries look measures - saturation, lightness and contrast
+steps, `look_ratio` and `detail_ratio` - that catch a colour or brightness
+shift `jump_ratio` misses; no rule reads them (the tasks guide's
+`analyze_seams` field table).
 
 **The answer.**
 
@@ -1762,6 +1792,10 @@ open at about 3 of 6 sung-word onsets, against 6 of 6 with the reference alone,
 speech to camera rather than singing. #808 measured the audio's offset, not mouth onsets,
 so how closely the mouth follows a held-plus-referenced song is still a visual check. Hold
 is also for picture that must fit audio exactly, such as motion cut to music.
+On `fl2va`, hold is the locked-frame lip-sync route (#985: `image-to-video`'s fl2va, a first
+frame plus a held 5.17 s song, int8 turbo, two seeds): frame 0 kept the picture's pixels and
+the mouth followed the song as in an audio-referenced Ref2VA shot, at about a fifth of the
+denoise time of Ref2VA `[keyframe completion + audio reuse]`, which keeps only the framing.
 `refine_strength` also uses hold, to keep the base pass's own audio, which was generated
 jointly with that video - a different case from lip sync to supplied audio (see the refine
 section below).
@@ -1804,7 +1838,7 @@ declared variable, so reference a `guides` variable or edit the argument.
 | `frame` | a multiple of 17 (a VAE chunk boundary): 0, 17, 34, ... |
 | clip length | 1, 5 or 17m + 5 frames (22, 39, 56, ... 124); any other length is cut down to the longest such length (n < 5 gives 1, 5 <= n < 22 gives 5, else 17 * ((n - 5) // 17) + 5) with a warning |
 | extent | `frame` + length must not run past `num_frames` (H3 rounds it up to 17n + 5; default 124); ending exactly at the end is fine |
-| count | at most 4 guides per step (a VRAM limit: each guide frame adds attention rows, and the template's `vram_estimate` charges each guide's frames on the canvas); `guides: []` is the same as none |
+| count | at most 4 guides per step. Each guide is also checked against the card: each guide frame adds attention rows, and the template's `vram_estimate` charges each guide's frames on the canvas; `guides: []` is the same as none |
 | where | `t2va` or `fl2va` on an H3 pipeline; not with `references` (`ref2va`), not on a non-H3 pipeline |
 
 Validation refuses all of the above before the run (`dw/guides.py`); a `previous_result:`
@@ -1884,7 +1918,10 @@ So this is a measurement path, not a catalog template: the catalog's native 768p
 is `templates/minimax/video-with-audio-768p`, and it is the one to use when faces matter.
 
 Target `width`/`height` must be multiples of 16, each between 1x and 4x the base
-latents' own size, and within H3's 1344x768 (or portrait 768x1344) canvas. The latents
+latents' own size, and within the upscale cap of 1920x1088 (or portrait 1088x1920);
+validation refuses a literal size off the grid or over the cap before the run. Above
+1344x768 the plate is for a tiled refine ([Refining above 768p in
+tiles](#refining-above-768p-in-tiles)), and upscale-only it is soft. The latents
 pass from `base` to `up` to `decode` entirely in memory. A `previous_result:` property
 on a modular step names a key of the dict its `output` list returns, spelled as the
 pipeline spells it: `base.latents`, `base.audio` and `base.sampling_rate` - not
@@ -1897,10 +1934,10 @@ upscaling only makes sense for a take chosen from something already reviewed, so
 
 The upscaler weights (~691 MB, `LBH-123-AI/Minimax_h3_latent_Upscaler`, Apache-2.0,
 read at a pinned revision) and the H3 VAE download on first use, the same as any other
-model. Neither is counted in `plan.downloads_required`, since that walk collects
-`from_pretrained_arguments` sources on pipeline steps and does not see a task
-argument naming a Hugging Face repo - a box that has run the base pass before but never
-this task can still stall mid-run pulling the upscaler.
+model. A validate's `plan.downloads_required` lists the upscaler file as a file entry
+(`{repo, filename, revision, ...}`) while it is not cached, and the VAE is covered by
+the pipeline step's whole `MiniMaxAI/MiniMax-H3` entry, so a box that has run the base
+pass before but never this task is told of the upscaler download beforehand.
 
 ```json
 {
@@ -2104,12 +2141,16 @@ this task can still stall mid-run pulling the upscaler.
 ```
 
 To keep the 544p take beside the promotion for comparison, add one more `pair_audio`
-step with `"video": "previous_result:base.videos"` and the same `audio`/`sample_rate`,
-saved with `"result": {"content_type": "video/mp4", "fps": 24, "subfolder":
+step with `"video": "previous_result:base.videos"` and the same `audio`/`sample_rate`
+(and `fit`), saved with `"result": {"content_type": "video/mp4", "subfolder":
 "intermediate"}`. `base.videos` is the pipeline's batch - a list holding the one video -
 and `pair_audio` unwraps a batch of one (a batch of several is refused, since one track
-goes under one video). The dict's frames carry no frame rate, so the result's `fps`
-says it; without it the file is written at the 8 fps fallback.
+goes under one video). The H3 step hands its `videos` on carrying the model's 24 fps,
+the way the tiled refine's do, so `pair_audio` fits the track against 5.17 s and the
+file is written at 24 fps without being told. Frames that carry no rate - a plain list
+from a task - need `pair_audio`'s own `fps` argument, not the result's: the result's
+`fps` is applied by the writer after `fit` has already measured the frames at the 8 fps
+fallback, so it would re-time the picture under a track padded to three times its length.
 
 ### Refining the upscaled latents: refine_strength
 
@@ -2451,6 +2492,379 @@ Validation refuses a `refine_strength` that is not a number between 0 and 1 (exc
 refine with no `latents` or no `hold_audio`, a step that is not H3, and a
 `num_inference_steps` below 2.
 
+To refine a canvas above 1344x768, such as a 1920x1088 plate, see [Refining above 768p in
+tiles](#refining-above-768p-in-tiles).
+
+### Refining above 768p in tiles
+
+H3's refine runs at 1344x768 at most, and `upscale_h3_latents` now reaches 1920x1088 (or
+1088x1920). An upscale-only plate above 768p is soft: `upscale_h3_latents` to 1920x1088
+alone, decoded, is not a 1080p render, since the interpolation adds no detail. To put the
+detail in, give the refine step `refine_tiles`, which refines a `latents` canvas bigger than
+H3's own in overlapping tiles. It is a second argument to `refine_strength`, not a
+replacement: the strength, the held audio and the step count mean what they did above.
+
+```json
+{"refine_tiles": {"width": 1344, "height": 768, "overlap": 256}}
+```
+
+The step plans the tiles on the 32 px grid: the fewest per axis whose overlap is at least
+the requested one, spread evenly, the last flush to the edge. A 1920x1088 canvas at
+1344x768 with overlap 256 is 2x2, tiles at x 0 and 576, y 0 and 320. The noise is drawn
+once for the whole canvas from the step's generator and cropped per tile, so overlapping
+tiles start from the same noise. Each tile is denoised through H3 without its decode block,
+and the prompt is encoded once. The tiles are blended in latent space with a linear feather
+across each overlap, the weights normalized, and the blended canvas is decoded once with VAE
+spatial tiling. The step returns the full-canvas `latents`, the video and stage 1's held
+audio, once. Its `videos` carry H3's 24 fps, so the `pair_audio` below writes them at
+that rate without being told. The job's events show one log line per tile and one decoding phase.
+
+It is slow. A 1920x1088 refine is roughly 4 tiles, each a 768p refine, plus a 1080p decode:
+about 25-30 minutes, against about 9.6 minutes for a native 768p take (an estimate, not
+measured). The validate projection prices the denoise at the tile's size and the decode at the
+canvas's, so a tiled refine does not warn as if it denoised 1080p at once.
+
+```json
+{
+    "id": "H3LatentUpscaleRefineTiles",
+    "description": "Promote a MiniMax-H3 take from 960x544 to a 1920x1088 canvas in latent space, refine it in overlapping 1344x768 tiles, and pair the held audio.",
+    "variables": {
+        "prompt": "prompt:minimax/fox_dawn_context_ir",
+        "num_frames": 124,
+        "num_inference_steps": 5,
+        "video_shift": 6.0,
+        "audio_shift": 3.0,
+        "weights_dtype": "{int4}",
+        "lora_scale": 1.0,
+        "lora_alpha": null,
+        "lora_model_name": "lightx2v/Minimax-h3-Turbo",
+        "lora_weight_name": "minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors",
+        "lora_adapter_name": "turbo",
+        "seed": 42
+    },
+    "variable_constraints": {
+        "num_frames": {
+            "modulus": 17,
+            "remainder": 5,
+            "reason": "the video VAE encodes 17 * n + 5 frames"
+        }
+    },
+    "seed": "variable:seed",
+    "steps": [
+        {
+            "name": "base",
+            "pipeline": {
+                "configuration": {
+                    "component_type": "ModularPipeline",
+                    "pre_load_modules": [
+                        "sdnq"
+                    ],
+                    "load_components": {
+                        "dtype": "torch.bfloat16",
+                        "quantization_config": {
+                            "transformer": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "variable:weights_dtype",
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "use_quantized_matmul": true,
+                                    "dequantize_fp32": false,
+                                    "modules_to_not_convert": [
+                                        "proj_in",
+                                        "audio_proj_in",
+                                        "context_embedder",
+                                        "time_embedder",
+                                        "time_proj",
+                                        "token_refiner",
+                                        "norm_out",
+                                        "proj_out",
+                                        "audio_proj_out"
+                                    ]
+                                }
+                            },
+                            "text_encoder": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "variable:weights_dtype",
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "dequantize_fp32": false,
+                                    "modules_to_not_convert": [
+                                        ".model.visual",
+                                        "lm_head"
+                                    ]
+                                }
+                            },
+                            "vae": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "{int8}",
+                                    "quant_conv": true,
+                                    "use_quantized_matmul_conv": true,
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "dequantize_fp32": false
+                                }
+                            }
+                        }
+                    },
+                    "components": {
+                        "transformer": {
+                            "group_offload": {
+                                "offload_type": "block_level",
+                                "num_blocks_per_group": 2,
+                                "use_stream": true,
+                                "record_stream": true,
+                                "low_cpu_mem_usage": true
+                            }
+                        },
+                        "text_encoder": {
+                            "remove_modules": [
+                                "lm_head"
+                            ]
+                        },
+                        "text_encoder.model": {
+                            "truncate_layers": {
+                                "language_model.layers": 51
+                            },
+                            "group_offload": {
+                                "offload_type": "leaf_level"
+                            }
+                        },
+                        "vae": {
+                            "device": "cuda",
+                            "residency": "on_demand"
+                        },
+                        "audio_vae": {
+                            "device": "cuda",
+                            "residency": "on_demand"
+                        }
+                    }
+                },
+                "from_pretrained_arguments": {
+                    "model_name": "MiniMaxAI/MiniMax-H3",
+                    "workflow": "t2va"
+                },
+                "loras": [
+                    {
+                        "model_name": "variable:lora_model_name",
+                        "weight_name": "variable:lora_weight_name",
+                        "adapter_name": "variable:lora_adapter_name",
+                        "scale": "variable:lora_scale",
+                        "alpha": "variable:lora_alpha"
+                    }
+                ],
+                "scheduler": {
+                    "shift": "variable:video_shift"
+                },
+                "audio_scheduler": {
+                    "shift": "variable:audio_shift"
+                },
+                "arguments": {
+                    "prompt": "variable:prompt",
+                    "num_frames": "variable:num_frames",
+                    "width": 960,
+                    "height": 544,
+                    "num_inference_steps": "variable:num_inference_steps",
+                    "output": [
+                        "videos",
+                        "audio",
+                        "sampling_rate",
+                        "latents"
+                    ]
+                }
+            }
+        },
+        {
+            "name": "up",
+            "task": {
+                "command": "upscale_h3_latents",
+                "arguments": {
+                    "latents": "previous_result:base.latents",
+                    "width": 1920,
+                    "height": 1088
+                }
+            }
+        },
+        {
+            "name": "refine",
+            "pipeline": {
+                "configuration": {
+                    "component_type": "ModularPipeline",
+                    "pre_load_modules": [
+                        "sdnq"
+                    ],
+                    "load_components": {
+                        "dtype": "torch.bfloat16",
+                        "quantization_config": {
+                            "transformer": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "variable:weights_dtype",
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "use_quantized_matmul": true,
+                                    "dequantize_fp32": false,
+                                    "modules_to_not_convert": [
+                                        "proj_in",
+                                        "audio_proj_in",
+                                        "context_embedder",
+                                        "time_embedder",
+                                        "time_proj",
+                                        "token_refiner",
+                                        "norm_out",
+                                        "proj_out",
+                                        "audio_proj_out"
+                                    ]
+                                }
+                            },
+                            "text_encoder": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "variable:weights_dtype",
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "dequantize_fp32": false,
+                                    "modules_to_not_convert": [
+                                        ".model.visual",
+                                        "lm_head"
+                                    ]
+                                }
+                            },
+                            "vae": {
+                                "configuration": {
+                                    "config_type": "sdnq.SDNQConfig"
+                                },
+                                "arguments": {
+                                    "weights_dtype": "{int8}",
+                                    "quant_conv": true,
+                                    "use_quantized_matmul_conv": true,
+                                    "quantization_device": "cuda",
+                                    "return_device": "cpu",
+                                    "dequantize_fp32": false
+                                }
+                            }
+                        }
+                    },
+                    "components": {
+                        "transformer": {
+                            "group_offload": {
+                                "offload_type": "block_level",
+                                "num_blocks_per_group": 2,
+                                "use_stream": true,
+                                "record_stream": true,
+                                "low_cpu_mem_usage": true
+                            }
+                        },
+                        "text_encoder": {
+                            "remove_modules": [
+                                "lm_head"
+                            ]
+                        },
+                        "text_encoder.model": {
+                            "truncate_layers": {
+                                "language_model.layers": 51
+                            },
+                            "group_offload": {
+                                "offload_type": "leaf_level"
+                            }
+                        },
+                        "vae": {
+                            "device": "cuda",
+                            "residency": "on_demand"
+                        },
+                        "audio_vae": {
+                            "device": "cuda",
+                            "residency": "on_demand"
+                        }
+                    }
+                },
+                "from_pretrained_arguments": {
+                    "model_name": "MiniMaxAI/MiniMax-H3",
+                    "workflow": "t2va"
+                },
+                "loras": [
+                    {
+                        "model_name": "variable:lora_model_name",
+                        "weight_name": "variable:lora_weight_name",
+                        "adapter_name": "variable:lora_adapter_name",
+                        "scale": "variable:lora_scale",
+                        "alpha": "variable:lora_alpha"
+                    }
+                ],
+                "scheduler": {
+                    "shift": "variable:video_shift"
+                },
+                "audio_scheduler": {
+                    "shift": "variable:audio_shift"
+                },
+                "arguments": {
+                    "prompt": "variable:prompt",
+                    "num_frames": "variable:num_frames",
+                    "num_inference_steps": "variable:num_inference_steps",
+                    "output": [
+                        "videos",
+                        "audio",
+                        "sampling_rate"
+                    ],
+                    "latents": "previous_result:up",
+                    "refine_strength": 0.2,
+                    "refine_tiles": {
+                        "width": 1344,
+                        "height": 768,
+                        "overlap": 256
+                    },
+                    "hold_audio": "previous_result:base.audio"
+                }
+            }
+        },
+        {
+            "name": "mux",
+            "task": {
+                "command": "pair_audio",
+                "arguments": {
+                    "video": "previous_result:refine.videos",
+                    "audio": "previous_result:base.audio",
+                    "sample_rate": "previous_result:base.sampling_rate",
+                    "fit": "video"
+                }
+            },
+            "result": {
+                "content_type": "video/mp4",
+                "fps": 24,
+                "subfolder": "final"
+            }
+        }
+    ]
+}
+```
+
+The refine step uses the 768p turbo LoRA with its own schedule (`video_shift` 6, `audio_shift`
+3, alpha left to the file), as `workflows/templates/minimax/video-with-audio-768p.json` does. It
+carries no `width` or `height`: the canvas is the `latents`. Naming them is allowed, and must
+equal the canvas, which is the latent height x width x 16.
+
+Validation and the run refuse, naming `refine_tiles`:
+
+- `refine_tiles` without `refine_strength`, or without what refine needs: `latents`,
+  `hold_audio`, an H3 step and `num_inference_steps` of at least 2;
+- a `width`, `height` or `overlap` that is not an integer multiple of 32;
+- a tile larger than 1344x768 (or 768x1344), or larger than the canvas;
+- an `overlap` below 192, or at or above half the tile's shorter side;
+- a reference image or video, a `<Picture N>`, a keyframe or `guides` on the step;
+- an explicit `width` or `height` that does not match the `latents` canvas.
+
 ### Chained Video Generation
 
 Video pipelines generate short clips - a `chain` block on a pipeline step runs the
diff --git a/docs/img/cup-object-mask.png b/docs/img/cup-object-mask.png
new file mode 100644
index 000000000..2d419eaa0
Binary files /dev/null and b/docs/img/cup-object-mask.png differ
diff --git a/docs/proposals/audits/2026-10-h3-wangp-probes.md b/docs/proposals/audits/2026-10-h3-wangp-probes.md
new file mode 100644
index 000000000..e78b0a510
--- /dev/null
+++ b/docs/proposals/audits/2026-10-h3-wangp-probes.md
@@ -0,0 +1,205 @@
+# MiniMax-H3 claims from WanGP's field notes: record-only probes (#985 stage A, #988)
+
+Probe date: 2026-10-25. Server `lem`, develop @ b80dec77. The sung
+`measure_sync` figures were re-measured on develop @ f9b96b20 (the #990 fix).
+Agent: claude-opus-5-5 (anthropic). Workspace `qa-h3-wangp-probes`.
+No engine or skill file was changed. This document only records results.
+
+Pinned configuration (Don, at plan approval), the same for every cited job:
+- `weights_dtype` **int8**, with the turbo LoRA **on**. Each job's `note`
+  states both.
+- Ref2VA (P1, P4 arm b): `transformer_ref`, LoRA
+  `minimax_h3_ref2v_turbo_8step_v1.0_768p_bf16.safetensors`, 9 steps, video
+  shift 12, audio shift 3, `sparse` attention.
+- FL2VA (P4 arm a): `transformer`, LoRA
+  `minimax_h3_fl2v_turbo_4step_v1.2_768p_bf16.safetensors`, 5 steps, shift 6.
+- 960x544, 124 frames (5.17 s at 24 fps). Every shot holds its source slice
+  with `hold_audio`.
+
+Each arm ran on seeds 1001 and 2002. A claim is **confirmed** only when both
+seeds of the claim-broken arm show the effect and neither seed of the
+claim-followed arm does. It is **refuted** when the broken arm doesn't show
+the effect, and **inconclusive** when the seeds disagree. Claim 4 has no
+broken arm (it asks whether a route works, not whether a rule matters). It is
+confirmed when both FL2VA seeds keep frame 0 and their mouths follow the
+track, and refuted when either fails.
+
+With `hold_audio`, the output soundtrack *is* the source slice. So the
+transcripts and `measure_sync` can't tell the arms apart: they measure audio
+against audio, not lips. The mouth frames decide every verdict here.
+
+## Verdicts
+
+| # | Claim (as stated on #985) | Verdict | Jobs | Observation |
+| --- | --- | --- | --- | --- |
+| 1 | "Lip-sync without `<d>`": for lip-sync to supplied audio, leave the words out of `<d>` and ask for natural lip movements synchronized to the track. | **refuted** | sung: 3d9a4e7377fa, 6d7f6faf8e60 (a); d2384deebb50, f27b7a7af223 (b). spoken: c029d63a15e8, c0763cc81d6b (a); 8451e9fd9289, e0790f00b4c2 (b) | With the track held, the words in `<d>` did no harm. On both tracks and both seeds, arm a's mouth opens and shuts at the same instants as arm b's, and the identity holds. See *Probe 1*. |
+| 4 | "FL2VA with a held soundtrack" lip-syncs. Our skill says "FL2VA takes no audio" (SKILL.md:31). | **confirmed** | 52195bad071b, f4fe60dcca4d (FL2VA); 422f22a7df71, 8e42ec21cf9a (Ref2VA keyframe) | FL2VA plus `hold_audio` keeps the input picture pixel for pixel at frame 0. On both seeds its mouth follows the held song with the same open and shut pattern as the audio-referenced Ref2VA shots. #852's Ref2VA keyframe route also lip-syncs, but frame 0 keeps only the framing: the arms hang instead of being folded, and the shot is wider. See *Probe 4*. |
+
+Not run: none. Claims 2 and 3 were dropped and deferred by the plan, not
+probed.
+
+### `measure_sync` figures
+
+| Track | Jobs | `lag_seconds` | `confidence` | `reference_seconds` | Findings | Measured by |
+| --- | --- | --- | --- | --- | --- | --- |
+| sung (la-vela) | all 4 P1 sung, all 4 P4 | 0.0 | 0.979 | 5.1667 | none | re-measure job 85fb684df2ef |
+| spoken (hal-voice) | all 4 P1 spoken | 0.0 | 0.756 | 2.499 | none | each job's own `sync` step |
+
+Lag 0.0 is expected, because the output audio is the held slice. The
+confidence is the same for every sung job for the same reason: each one
+plays the same 5.17 s of the song.
+
+**Sung figures re-measured after #990.** The first in-job `sync` steps of
+the sung jobs read 0.0 / 0.175 (`sync_low_confidence`) with
+`reference_seconds` 118.751. The cause was #990: `slice_audio` ignored
+`num_frames` when given `start_seconds` and no duration, so each sung
+`slice` step wrote 118.751 s of song from 42.5 s onward. `measure_sync` then
+compared a 5.17 s shot against that whole length.
+
+**The shots themselves were not affected.** Both inputs that read the slice
+crop it to the shot's `num_frames / fps` from its start:
+- `hold_audio` encodes with `max_duration` and plays a fitted copy
+  (`dw/pipeline_processors/h3_hold_steps.py:219,236`);
+- the Ref2VA `<Audio 1>` reference is truncated to `max_duration` by
+  diffusers' `_normalize_audio_condition` (`before_encoder.py:370`).
+
+So H3 was conditioned on exactly the intended 5.17 s, and only the sync
+figure needed redoing. Job 85fb684df2ef (no generation, run
+`WanGPProbeResync/20261025-163353-b9710590`) re-slices la-vela at 42.5 s,
+124 frames at 24 fps and 44100 Hz with the fixed `slice_audio`. It then
+runs `measure_sync` (`device` cpu) of each of the eight sung shots against
+that slice, one step per job, each named by its job id.
+
+The spoken reference length of 2.499 s is about the speech span, which
+suggests the trailing silence was trimmed.
+
+## Probe 1: lip-sync with and without `<d>`
+
+Workflow `probes/wangp-p1-ref2va` has four steps:
+1. `slice_audio`: the track at `start_seconds`, `num_frames` 124 at 24 fps.
+2. Ref2VA shot: portrait `asset:cast/tomas.jpg` as `<Picture 1>` and the
+   slice as `<Audio 1>`, held with `hold_audio: previous_result:slice`.
+   Task `[reference generation + audio reuse]`.
+3. `measure_sync`.
+4. `transcribe_audio` (whisper-small, word timestamps).
+
+One person in frame.
+
+- **Sung track:** `asset:song/la-vela.mp3` from 42.5 s, at 44100 Hz.
+- **Spoken track:** `asset:uploads/cast/hal-voice.wav` from 0 s (see
+  *Deviations*).
+- **Arm a (broken):** the prompt names Tomás, asks for "natural lip
+  movements synchronized" to `<Audio 1>`, and spells the words in
+  `<d>[English] Pass it to your sister, pass it to your brother, ya no más
+  silencio, let the whole hill ring</d>` (the spoken track's line in the
+  spoken jobs). The action is limited to singing or speaking: "his arms stay
+  folded and his body stays still".
+- **Arm b (followed):** the same prompt without the `<d>` sentence.
+
+| Track | Arm | Seed | Job | Run |
+| --- | --- | --- | --- | --- |
+| sung | b | 1001 | d2384deebb50 | 20261025-150427-fadb957c |
+| sung | b | 2002 | f27b7a7af223 | 20261025-150827-df1f8eec |
+| sung | a | 1001 | 3d9a4e7377fa | 20261025-151226-b0698795 |
+| sung | a | 2002 | 6d7f6faf8e60 | 20261025-151629-4cca84db |
+| spoken | b | 1001 | 8451e9fd9289 | 20261025-152027-06d1d37c |
+| spoken | b | 2002 | e0790f00b4c2 | 20261025-152655-347effd2 |
+| spoken | a | 1001 | c029d63a15e8 | 20261025-153053-a09b5b8d |
+| spoken | a | 2002 | c0763cc81d6b | 20261025-153452-401141ed |
+
+**Transcripts.** All eight match their source, as they must under the hold:
+- sung: "Pass it to your sister, pass it to your brother Yeah, no more
+  silence, you'll let the whole heal ring";
+- spoken: "only God and Gary know how to configure the F5." The speech ends
+  at about 2.5 s.
+
+**Mouth frames:**
+- **Sung, every job:** shut at 0.2 s and 1.1 s; open at 2.45 s, 2.8 s and
+  3.3 s, with teeth or a smile; an "o" at 4.6 s. The pattern is the same on
+  both arms and both seeds.
+- **Spoken, every job:** open at 0.3 s and 2.4 s, then shut through the
+  silent tail at 3.5 s and 4.6 s, on both arms and both seeds.
+
+Arm a showed no desync, no extra mouthing and no identity drift, so the
+claim is refuted. H3 lip-syncs a held track the same whether or not its
+words are in `<d>`.
+
+Limit: the frames were read at 4 to 6 instants per clip, not continuously.
+Whisper's word timestamps on sung material are approximate, so this records
+the mouth following the track's phrasing, not per-phoneme accuracy.
+
+## Probe 4: FL2VA with a held song
+
+The picture for both arms is frame 0 of d2384deebb50's shot (P1 arm b,
+seed 1001): Tomás, arms folded, against a plain backdrop.
+
+The slice is la-vela from 42.5 s at 44100 Hz. P1 had no winner, so the
+prompt is in arm b style, as the plan directs.
+
+- **Arm a:** workflow `probes/wangp-p4-fl2va`, with the steps `get_first_frame`,
+  `slice_audio`, an fl2va shot with the picture as first frame and
+  `hold_audio`, then `measure_sync` and `transcribe_audio`.
+- **Arm b:** workflow `probes/wangp-p4-keyframe-ref2va`, #852's route: Ref2VA
+  `[keyframe completion + audio reuse]`, with the picture as `<Picture 1>`
+  (the first frame) and the slice as `<Audio 1>`, held.
+
+| Arm | Seed | Job | Run | Frame 0 | Mouth |
+| --- | --- | --- | --- | --- | --- |
+| a (FL2VA) | 1001 | 52195bad071b | 20261025-153850-7c27a9b9 | the picture, pixel for pixel | shut at 1.1 s, open with teeth at 2.8 s, smiling and open at 3.3 s, "o" at 4.6 s |
+| a (FL2VA) | 2002 | f4fe60dcca4d | 20261025-161250-1a83c8b5 | the picture, pixel for pixel | same pattern at the same instants |
+| b (Ref2VA keyframe) | 1001 | 422f22a7df71 | 20261025-160108-f44246e6 | framing only: arms hang, shot wider | same pattern |
+| b (Ref2VA keyframe) | 2002 | 8e42ec21cf9a | 20261025-160742-f53aecc0 | framing only, as seed 1001 | same pattern |
+
+**Mouth motion.** The FL2VA mouth moves with the held track, at the same
+instants as in the audio-referenced Ref2VA shots of P1 and of arm b, across
+two seeds. A self-driven mouth wouldn't repeat across seeds and task types,
+so `hold_audio` drives FL2VA's lips. #808 is the warning sign the plan cites:
+there, a song held with image conditioning opened the mouth at only 3 of 6
+onsets. This time no checked instant was missed, within the limit stated in
+*Probe 1*.
+
+**Side effect.** Seed 2002's FL2VA shot shows faint blotches on the cheeks
+through the clip, the int8 smear the skill's `quality-and-speed.md` covers.
+
+**Cost:**
+
+| Arm | Load | Denoise | Decode |
+| --- | --- | --- | --- |
+| FL2VA (f4fe60dcca4d), 4 passes | 72.6 s | 49.7 s | 18.9 s |
+| Ref2VA keyframe | 72.5 s | about 233 s | about 20 s |
+
+The locked-frame lip-sync route that keeps the pixels is also about 4.7
+times faster to denoise.
+
+## Deviations
+
+- **Spoken slice relabelled.** The spoken slice ran with `sample_rate` 48000,
+  but `hal-voice.wav` is 44100 Hz, so the line plays about 8.8% fast and high.
+  Both arms got the identical input, so the comparison stands.
+- **OOM failures, rerun.** Three P4 jobs died by SIGKILL from host-RAM
+  contention. Two workers (cached FL2VA at about 60 GB plus Ref2VA at about
+  95 GB) exceeded lem's 128 GB. After `clear_memory`, each was rerun alone
+  with the same bound fingerprint:
+
+  | Failed | Rerun |
+  | --- | --- |
+  | db506b4f1049 | f4fe60dcca4d |
+  | 11eb727cd72d | 422f22a7df71 |
+  | 3c097799d825 | 8e42ec21cf9a |
+
+  The failed ids are superseded and not cited as results.
+- **Sung slice ran the whole song (#990).** Every sung job's `slice` step
+  wrote 118.751 s, not 5.17 s. The shots only ever used the first 5.17 s
+  (see *`measure_sync` figures*). Their in-job `sync` results are superseded
+  by re-measure job 85fb684df2ef.
+- **Excluded jobs:** 423bcbe3c40f (wiring check, before the relabel was
+  settled) and dbcdd254f897 (transcription of the source for prep).
+
+## What stage B does with this (#985 plan v2)
+
+- **Claim 1 refuted:** a one-line "tested and refuted" note in
+  `references/dialogue.md`. No enhancer change.
+- **Claim 4 confirmed:** SKILL.md:31-34 makes FL2VA plus `hold_audio` the
+  locked-frame lip-sync route, which keeps the pixels. Ref2VA
+  `[keyframe completion + audio reuse]` becomes the fallback. One line goes
+  in `WORKFLOW_GUIDE.md:1740`.
diff --git a/docs/proposals/complete/h3-wangp-field-notes-complete.md b/docs/proposals/complete/h3-wangp-field-notes-complete.md
new file mode 100644
index 000000000..dd23a3127
--- /dev/null
+++ b/docs/proposals/complete/h3-wangp-field-notes-complete.md
@@ -0,0 +1,116 @@
+# H3 rules from WanGP's field notes (#985)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-25). Plan v2 (v1 approved by Don on 2026-10-25, v2 folds in his
+approval) was built in two stages, both verified on lem: stage A, #988
+(probes, doc only), and stage B, #989 (skill, guide and enhancer), last
+shipped at `develop` @ `6997c2c8`.
+
+## The idea
+
+WanGP v18.21's H3 handler (`models/minimax_h3/minimax_h3_handler.py`)
+carries four field observations, which are WanGP's and not MiniMax's. The
+issue asked for each to be checked on lem before it went into
+`plugins/dw/skills/minimax-h3`:
+
+1. lip-sync to a supplied soundtrack works better with the words left out
+   of `<d>`;
+2. a chained window can snap onto an end image, and discarding about 5 tail
+   frames hides it;
+3. `input_video_strength` of about 0.5 gives softer keyframes;
+4. FL2VA accepts a soundtrack, so a locked first frame might lip-sync
+   without the Ref2VA route.
+
+## Verdict and scope (Don, plan v1)
+
+**Build smaller:** probe claims 1 and 4, drop 2, defer 3.
+
+- **Claim 2, dropped.** dw chains have no per-window end image: `last_frame`
+  carries a segment's real last frame as the next segment's *first* frame,
+  and trimming is head-only (`trim_frames`), so the snap can't happen.
+  Reopen on a chain that pins per-segment end images, or on a field report
+  of a snap at a dw chain seam.
+- **Claim 3, deferred (Q2).** No frame-conditioning strength can be set from
+  a workflow: diffusers hard-codes `MiniMaxH3ModularPipeline.keyframe_noise_aug
+  = 0.999`, which dw copies (`h3_hold_steps.py`), and the mapping from
+  WanGP's `input_video_strength` is unknown. Reopen on a field report of
+  hard snaps into an end image or a guide, or when diffusers exposes the
+  property.
+- **Q1:** about 90 GPU minutes on lem for the probes. **Q3:** the
+  `h3_context_ir` enhancer changes if claim 1 is confirmed. **Q4:**
+  `staging.md`'s two-singer `<d>` rule is left alone. **Q5:** P1 includes a
+  spoken track as well as a sung one.
+- **Don's addition:** every probe job runs one pinned configuration, int8
+  `weights_dtype` and one turbo-LoRA state, stated in each job's note and in
+  the audit doc. #984 had shown int4 + turbo can change the voice, so a
+  lip-sync verdict must not secretly be a verdict on quantization.
+
+## What was built
+
+### Stage A, #988: the probes
+
+Workspace `qa-h3-wangp-probes` on lem: int8, turbo LoRA on, 960x544, 124
+frames, seeds 1001 and 2002, `hold_audio` on every shot. The record is
+`docs/proposals/audits/2026-10-h3-wangp-probes.md`, with the per-arm table
+in the #985 results comment.
+
+- **Claim 1: refuted.** With one person in frame, under a held track, the
+  mouth opened and shut at the same instants with the words in `<d>` and
+  without them, on a sung slice and on a spoken line. H3 didn't voice its
+  own words, since the hold replaces the audio.
+- **Claim 4: confirmed.** `templates/minimax/image-to-video`'s fl2va step
+  with a first frame and `hold_audio` kept frame 0 pixel for pixel, and the
+  mouth followed the song on both seeds, at about a fifth of the denoise of
+  #852's Ref2VA `[keyframe completion + audio reuse]` route (49.7 s against
+  about 233 s). The Ref2VA route keeps only the framing.
+- `measure_sync`: lag 0.0 on every arm; confidence 0.979 sung, 0.756 spoken.
+
+### Stage B, #989: the rules
+
+- `plugins/dw/skills/minimax-h3/SKILL.md`: "FL2VA takes no audio" is gone.
+  FL2VA with the song held by `hold_audio` is the locked-frame lip-sync
+  route; Ref2VA keyframe completion with the track held is the fallback.
+  Pinned by `test_the_locked_frame_lip_sync_recipe_names_real_task_types`
+  in `tests/test_plugin_skills.py`. SKILL.md is 11,942 B of 12,288.
+- `references/dialogue.md`: claim 1 listed as tested and refuted.
+- `docs/WORKFLOW_GUIDE.md` *H3: generating to a held soundtrack*: one
+  paragraph naming hold on `fl2va` as the locked-frame route, with the #985
+  evidence.
+- `dw/workflows/h3_context_ir.json` (the `h3` enhancer), system prompt
+  only: the `integrated_multimodal_description` field names `<d>` blocks,
+  and the `<d>` rule names the language tag and gives a worked `<d>`
+  against quoted-prose example. Pinned by
+  `tests/test_h3_context_ir.py::test_spoken_lines_are_written_as_d_blocks_not_quoted_prose`.
+  This wasn't a claim-1 rule: the scoping case M-F162 showed the enhancer
+  had already stopped writing `<d>` at all (see the bounces).
+- Not changed, as a refuted claim 1 calls for: no SKILL.md pointer, no
+  `workflows/templates/minimax/README.md` rewording, and no held-track rule
+  in the enhancer. Nothing for claims 2 or 3.
+
+## Bounces
+
+- **#988: 1.** M-F160 failed: the sung `measure_sync` read confidence 0.17
+  against a 118.751 s reference. The `slice` step had written the whole song
+  (#990, fixed in f9b96b20). The shots were unaffected, because both of the
+  model's audio inputs crop to the shot length, so the 8 sung shots were
+  re-measured on cpu (job `85fb684df2ef`), not re-generated.
+- **#989: 1.** M-F162 failed: none of nine `h3` enhancements wrote a `<d>`
+  block for ordinary dialogue or a generated song. This predated the stage:
+  the rule was stated only in the abstract, far from the field definitions,
+  and Qwen3-4B wrote supplied lines as quoted prose. The system-prompt fix
+  above passed all nine, and a silent idea still got no `<d>`.
+
+## Deferred and left open
+
+- Claim 2 and claim 3, with the reopen triggers above.
+- The `h3` enhancer extends a supplied lyric with invented lines (busker
+  idea). The original prompt did the same, and a stronger "don't extend"
+  clause made it worse. That is a separate fidelity fix if it matters.
+- The tester noticed the busker enhancement numbers its shots from
+  `[Shot 2]` and puts a shot at the clip's last instant. It looks older
+  than this feature and is not filed.
+
+## Cost
+
+The stage comments carry no `usage:` figures, so cost is not recorded here.
+Stage A needed three P4 reruns after host-RAM OOMs (two workers at once).
diff --git a/docs/proposals/complete/remove-object-complete.md b/docs/proposals/complete/remove-object-complete.md
new file mode 100644
index 000000000..2036635e5
--- /dev/null
+++ b/docs/proposals/complete/remove-object-complete.md
@@ -0,0 +1,154 @@
+# `remove_object`: prompt-free LaMa object removal (#956)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-22). The idea came from #946: on lem an agent asked to erase an
+object hand-composited it in PIL, and `models/z-image-inpaint` failed
+removal in all four runs. Plan v1 was designed on #956. Don's review made
+v2, written after #946 closed `wontfix`, and Don approved v2. It was built
+as two stages, #973 and #974. The plan comment on #956 stays the full
+design. This doc records what shipped.
+
+## The problem
+
+dw had no "erase this and fill it from the surroundings" operation. Every
+masked route was a prompted diffusion pipeline, and those add or replace
+content. With #946 declined, FLUX.1 Fill was never verified for removal on
+lem, so dw had no working removal route at all.
+
+## Verdict: build smaller
+
+Two small stages: the task, then the routing docs and templates. No new
+dependency was needed, because `spandrel` (already a core dependency)
+loads LaMa as a `MaskedImageModelDescriptor`.
+
+Cut, with what would bring each back:
+- **A temporally consistent video removal model** (ProPainter-style).
+  *Trigger:* a field report where per-frame LaMa flickers visibly.
+- **A per-frame mask video.** It needs a two-input `per_frame`. *Trigger:*
+  a field report that needs a moving mask. The task applies one still mask
+  to every frame.
+- **A general mask utility task** (dilate/feather/union). *Trigger:* a
+  second consumer. The task dilates internally.
+- **A second, larger removal model for big regions.** *Trigger:* a field
+  report where LaMa smears a large removal.
+
+Non-goals stayed out: prompting, outpainting, temporal consistency,
+per-frame masks, and any change to the Fill templates beyond their removal
+wording.
+
+## Plan history
+
+- **v1:** Fill stayed the prompted fallback for large regions and the
+  outpaint route. The signature had no `weight_name`. It used bf16 where
+  the device supported it, and left the weights source open.
+- **v2 (approved):** #946 is `wontfix`, so `remove_object` is dw's only
+  removal route. Fill was dropped from the fallback and overlap, and
+  `templates/outpaint` was left alone. `weight_name` was added, so the
+  safetensors-only gate has a key to check. fp32 runs on every device
+  (LaMa is ~51M params, and bf16 is an untested quality risk). Q1, ruled
+  by Don: pin `michaelgold/big-lama@98ab7cface89a594b381f32fc7a9f2cae3f91ccc`,
+  file `big-lama.safetensors` (204 MB), with the byte-identical
+  `biali/big-lama` as the named fallback. LaMa (advimman) is credited as
+  Apache-2.0, not under the repo card's MIT. Q2 kept the 8 px `dilate`
+  default. Q3 accepted the `downloads_required` gap and called for a
+  follow-up issue.
+
+Corrections the plan made to the issue: the dependency question went away
+(spandrel); the common `big-lama.pt` is TorchScript and must not be loaded;
+the H3 backdrop leak in `minimax-h3`'s `references/staging.md` is fixed by
+`subject_definitions`, not by a mask; `WORKFLOW_GUIDE.md` had no
+masked-editing section to edit, so one was added.
+
+## What was built
+
+### Stage A (#973): the `remove_object` task
+
+Commits 89e75acf (the task) and 8bc5b884 (tests and TASKS.md), merged as
+c7a694db.
+- `remove_object(image, mask_image, dilate=8, model_name="michaelgold/big-lama",
+  weight_name="big-lama.safetensors")`. The implementation is in
+  `dw/tasks/remove_object.py`, and the handler is in
+  `dw/tasks/model_handlers.py` (lazy import, `per_frame`,
+  `consumes_device=True`).
+- **Mask:** converted to L, binarized at 128 (white means fill, the same as
+  `segment`'s output, so no `invert`), resized to the image with nearest if
+  it differs, then dilated. The model's output is composited only inside
+  the dilated mask, so pixels outside it are the input's own.
+- **All-black mask:** the input comes back unchanged with a job `warning`
+  event, and no model is loaded. For frames the check runs once, so a video
+  warns once.
+- **Weights:** `REMOVER_REVISION` is applied only to the default repo and
+  file. The loader runs `validate_hub_repo_id` and `validate_weight_name`,
+  then `hf_hub_download`, `safetensors.torch.load_file`, and spandrel
+  `load_from_state_dict`. It refuses anything that isn't a
+  `MaskedImageModelDescriptor`. The model is cached through `cached_model`
+  under `(repo, file, revision, device)`.
+- **fp32 everywhere:** no `.half()` and no device branch.
+- **Trust gate:** `remove_object` is in `SAFETENSORS_ONLY_COMMANDS`, so a
+  `.pt`/`.ckpt`/`.bin` `weight_name` or a local `model_name` is refused at
+  validate, and again in the loader.
+- `tests/test_remove_object.py` (42 cases). `docs/TASKS.md` gained an
+  *Object Removal* section: parameters, polarity, `dilate` advice, the
+  weights source and fallback, the Apache-2.0 credit, the large-region
+  limit and the first-run download.
+- **Deviations:** `image`/`mask_image` are not declared as
+  `media_arguments`, because the media-key naming convention already covers
+  both and a test pins the traversal refusal. With frames and an all-black
+  mask, the frames come back re-wrapped at the same count and fps.
+- Measured on mps with the real weights: about 10 s cold including the
+  download, and 0.08 s warm.
+
+### Stage B (#974): routing and templates
+
+Commit 4844c1f7 (merged as d1141a66), and the bounce fix in bfb4e222 and
+941b5fd7 (merged as 1a6d8b5c).
+- `workflows/templates/remove-object.json` (`image`, `mask_image`,
+  `dilate`) and `workflows/templates/segment-and-remove.json` (`image`,
+  `object`, `dilate`). Both declare `"shape": "image-edit"`, because the
+  shape rules would otherwise read a task-only workflow as `utility`. Their
+  default image is the diffusers docs `cup.png`. `remove-object`'s default
+  mask is `docs/img/cup-object-mask.png`, served from this repo pinned at
+  bfb4e222.
+- **Routing rule** ("erase → `remove_object`; put something new in a mask →
+  a prompted inpainter"): a new *Erasing versus repainting a masked region*
+  section in `WORKFLOW_GUIDE.md`'s *Authoring a workflow from an agent*,
+  and TASKS.md *Object Segmentation*. The `models/z-image-inpaint`
+  description was rewritten so it no longer names Fill for removal. The
+  `templates/inpaint` and `segment-and-inpaint` descriptions each gained
+  one clause.
+- The compact listing budget in `tests/test_catalog_structure.py` went from
+  11_400 to 11_650.
+- **Outside the plan:** `dw/tasks/segment.py` now keeps each box's
+  best-rated SAM2 candidate (`iou_scores` argmax), not the first. On
+  `cup.png` the first candidate was the cup's body without its lid, with a
+  hole at the logo. This changes the mask every `segment` caller gets
+  (including `segment-and-inpaint`). It is a bug fix with no change to the
+  MCP shape.
+
+## Verification and bounces
+
+| Stage | Bounces | Cases |
+|---|---|---|
+| A (#973) | 0 | C-F510–C-F515, SE-F050 passed on lem first time |
+| B (#974) | 1 | C-F517 failed: the cup survived. Fixed by the `segment` best-mask change and the new default mask. C-F516–C-F518 then passed |
+
+On lem the warm `segment` → `remove_object` job took 1.6 s, and its
+`remove_object` phase 0.3 s. The stage comments name no `usage:` figures,
+so cost per stage is not recorded here. The plan estimated $3–5 for A and
+$2–3 for B.
+
+## Found along the way
+
+- **segment's mask quality** (above): every `segment` caller used to get
+  SAM2's first proposal, which can be a partial object.
+- In C-F511, `segment("picture frame")` covered only part of the frame's
+  matte, so a faint remnant was left. That is a segment setup shortfall,
+  not a `remove_object` finding.
+
+## Follow-up
+
+- **#975** (shipped 2026-10-23): `plan.downloads_required` now lists task
+  weights, including `remove_object`'s pinned big-lama file. Record:
+  `task-weights-downloads-complete.md`.
+- The templates' `vram_gb` figures (1 and 4) are estimates from model
+  sizes, not measurements. Replace them when one is measured.
diff --git a/docs/proposals/complete/seam-look-measures-complete.md b/docs/proposals/complete/seam-look-measures-complete.md
new file mode 100644
index 000000000..662da3a52
--- /dev/null
+++ b/docs/proposals/complete/seam-look-measures-complete.md
@@ -0,0 +1,126 @@
+# Look measures in `analyze_seams` (#1031)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-26). Designed on #1031 from an idea taken from harlixay7/Kinoloom
+(MIT, commit 45cfe50, `docs/research/SEAMLESS_CHAINS*.md`; only the idea, none
+of its ComfyUI code). Plan v1 was approved with its defaults to Q1-Q3. Built
+as one stage, #1042 (A).
+
+## The problem
+
+`analyze_seams` saw a seam's picture through one number, `jump_ratio`: the
+largest grey frame-to-frame change across the seam against the shots' typical
+change. A chain join that keeps the framing but shifts saturation or
+brightness over a frame or two scores low there. Grey change is small, and
+the 64x36 grey assess thumbnails (`dw/media.py`) carry no colour at all.
+Kinoloom measured saturation +10 to +19 at the joins of its pixel-continuation
+chains. #1033 (colour-match chained segments) can't be judged without an
+instrument for this, and #1034 (re-roll a failing seam) would read it too.
+
+## Verdict and what was decided
+
+The verdict was **build smaller**: per-seam measures only, with no rules.
+- Q1: no rules (`info` or otherwise) in this stage. A threshold set now would
+  come from Kinoloom's broken chains, not ours.
+- Q2: one `look_ratio` plus `look_ratio_measure`, not three ratios.
+- Q3: take drift (new `analyze_shots` fields) is cut.
+
+Corrections the plan made to the idea:
+- The measures can't be computed from what `analyze_seams` already read.
+  Saturation needs colour the reader dropped, and a high-frequency ratio at
+  64x36 is noise. They are taken during the existing single decode.
+- "Apparent age from InsightFace riding on `face_track`" doesn't fit:
+  `face_track` is YuNet (boxes only), InsightFace isn't a dependency, and its
+  packaged models are licensed for non-commercial research. Cut.
+
+## What was built
+
+### Stage A (#1042): look stats and seam look fields
+
+- **Look stats at decode.** `read_thumbnails_and_track` (`dw/media.py`)
+  takes an optional `look` reducer, run on a 128x72 rgb24 copy of each frame
+  through its own `VideoReformatter`; only the reducer's result is kept.
+  `look_stats` in `dw/tasks/assess.py` is the shared reducer, on the 0-255
+  scale:
+  - lightness: mean Rec.709 luma (`image_ops.luma`);
+  - contrast: luma standard deviation;
+  - saturation: mean of per-pixel max(RGB) - min(RGB);
+  - detail: mean |luma - 3x3 box blur|, the blur from
+    `scipy.ndimage.uniform_filter(size=3, mode="nearest")`.
+- `Media.looks` is an (frames, 4) float32 array, or None. The grey
+  thumbnails are unchanged, so `jump_ratio` and `analyze_shots` are too.
+  The in-memory path (`_thumb` / `_in_memory_thumbs`) calls the same
+  `look_stats`, so a file and its in-memory original agree within rounding.
+- **Seam fields.** `_seam_look`, beside `_seam_video`, adds to every seam
+  record: `saturation_step`, `lightness_step`, `contrast_step` (signed,
+  after - before), `look_ratio`, `look_ratio_measure` and `detail_ratio`.
+  - Windows: the last 4 frames before the seam (before a dissolve's fade)
+    against the first 4 after it, clipped to the shots.
+  - Local rate (Kinoloom's "local-rate rule"): the 90th percentile of the
+    change from one 4-frame mean to the next over each shot's span, the
+    larger shot's counting, floored at 1.0. A shot under 8 frames gives no
+    rate, so the floor applies. `look_ratio` is the largest |step| over its
+    own measure's rate.
+  - `detail_ratio` is null when the before window's detail is below 0.5.
+  - A seam on media with no picture carries the six fields as null; an
+    audio-only file has no seams, so nothing appears.
+  - Numbers are rounded to 2 places, like the other seam fields.
+- **No new rule, finding, or `rules_applied` / `rules_skipped` entry.** No
+  MCP, REST, schema, UI or plugin change; the `assess_output` description is
+  untouched, so the MCP surface budget isn't spent.
+- **Tests:** `tests/test_seam_look.py`, 15 cases on real mp4s and in-memory
+  clips (known-colour stats and path agreement, saturation and darkening
+  cuts, a mid-ramp cut for the local rate, a blurred copy, grey, frameless,
+  single-shot and dissolve inputs, no look rule names).
+- **Docs:** six rows in the `docs/TASKS.md` `analyze_seams` table with the
+  "measures, not rules; not perceptual" note, and one sentence in the
+  `docs/WORKFLOW_GUIDE.md` assessment section.
+
+## Measured on lem
+
+From the tester's verification of C-F538-C-F544 (develop @ 9411935e), one
+seam at frame 124 of joins over `ep3-shot1-incident.mp4`:
+
+| seam | reading |
+|---|---|
+| same clip joined to itself | saturation_step 0.64, look_ratio 0.64, detail_ratio 1.0 |
+| copy graded saturation 1.6 | saturation_step +19.21, look_ratio 19.21 (30x the control) |
+| the same, order reversed | saturation_step -17.55 |
+| copy darkened (exposure -1) | lightness_step -47.5, look_ratio 47.5 |
+| copy softened (clarity -1) | detail_ratio 0.49 |
+| greyscale clips | saturation_step 0.0 |
+
+The +19 saturation join is the size Kinoloom reported at its chain joins.
+A `dissolve-between-shots` output and all 7 seams of `ep53-episode.mp4`
+carry the fields. `analyze_seams` on `ep54-episode.mp4` took about 2 s, and
+`long-film-4089.mp4`'s default probes about 8 s, well under the MCP
+client's 30 s. The build measured the reader's added cost at about 0.25 ms
+per frame once the look copy got its own reformatter (a naive second
+`reformat` rebuilt the scaler each frame, about 1.5 ms).
+
+## Deferred, and why
+
+- **Rules** (e.g. an `info` `seam_look_jump` on `look_ratio`). Comes back
+  when lem measurements on real chains (#1033's before and after) show a
+  `look_ratio` value that separates seams Don calls visible from ones he
+  doesn't: a threshold from our footage, not Kinoloom's.
+- **Take drift** (`analyze_shots` fields, first second against last). Comes
+  back with a take whose seams all score low but whose end visibly looks
+  different from its start, reported from real driving.
+- **Apparent age / identity drift.** Comes back with a field report of a
+  lead's face visibly ageing or changing identity across a chain, plus a
+  decision to take on a face-attribute model and its licence.
+- **Plugin.** Teaching `script-to-video` to read the fields is #1034's.
+- **Local rate over MCP.** No tool grades a ramp over time, so the mid-ramp
+  behaviour is checked only by the unit test, not by a suite case.
+
+## Cost and bounces
+
+The stage comments name no `usage:` figures, so cost is left out. The plan
+estimated $4-6 for the one build session.
+
+- **Stage A (#1042):** one architecture-review bounce, no tester bounces.
+  The review found the 3x3 box blur hand-rolled (pad and nine shifted
+  slices) where `scipy.ndimage.uniform_filter` already does it; fixed in
+  `cee80db4`, same numbers. Verified first time on all seven cases
+  (C-F538-C-F544).
diff --git a/docs/proposals/complete/stacked-vocals-warning-complete.md b/docs/proposals/complete/stacked-vocals-warning-complete.md
new file mode 100644
index 000000000..0f590ceda
--- /dev/null
+++ b/docs/proposals/complete/stacked-vocals-warning-complete.md
@@ -0,0 +1,115 @@
+# A `stacked_vocals` warning from `separate_stems` (#947)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out,
+2026-10-19). Plan v1 was approved by Don on 2026-10-20 (UTC). Stage A,
+#955, shipped at `develop` @ `29158446` and was verified on lem.
+
+## The idea
+
+A field report from `two-minds` (*Always On*): MiniMax Music 3 can't sing
+two distinct same-gender voices, and its choruses are stacked stereo
+doubles. `separate_stems` returns them inside the one `vocals` stem.
+Processing the 1:19 chorus as one voice is what distorted it. The issue
+asked for two things:
+
+1. a voice/pitch conversion task (WORLD / `pyworld`) to re-voice a window
+   of a vocal stem;
+2. a flag from `separate_stems` / `attribute_voices` saying a window holds
+   more than one voice.
+
+## Verdict and scope (Don, plan v1)
+
+**Build smaller:** ask (2) only, as a warning on `separate_stems`.
+
+- **Q1, warning only.** No `layering` result key; the four-stem dict is
+  unchanged (a plain `warnings` key would have broken the wav save and three
+  test pins).
+- **Q2, voice conversion deferred.** The agent already re-voiced the stem
+  off-server with `pyworld` and brought it back, so the gap cost one local
+  script. It would add a C-extension core dependency, a new task surface and
+  a skill line the music3 SKILL.md has no room for.
+- **Q3, `attribute_voices` untouched.** Its separation path collapses to
+  mono 16 kHz before a stereo check could run.
+- **Cut:** the issue's "more than one pitch track" signal. Multi-pitch on a
+  sung stem is unreliable, and two singers in one register read as one
+  track anyway.
+
+## What was built (stage A, #955)
+
+- `stacked_spans()` and the `STACK_*` constants in
+  `dw/tasks/voice_attribution.py`, run in `separate_stems` on the 44.1 kHz
+  stereo vocals stem. Pure numpy. In 1 s windows that are voiced (at least
+  half their 20 ms frames pass `voiced_mask` on the mid signal) and within
+  14 dB of the stem's level, a window is flagged when the uncentered L/R
+  correlation is below 0.45 **and** the side/mid energy ratio is above 0.4.
+  Flagged windows merge across a one-window gap; spans under 2 s drop.
+- One `emit_warning(kind="stacked_vocals", command="separate_stems")`:
+  `the vocals stem holds stacked (layered stereo) voices over 1:19–1:34,
+  1:59–2:09; treat those spans as more than one voice before processing them
+  as one`. Up to 8 spans in m:ss, then "and N more".
+- `docs/TASKS.md` *Stem separation* names the warning and what to do with
+  it.
+- Unit tests in `tests/test_separate_stems.py`: a known decorrelated span,
+  identical L/R, silence, mono, a short run dropped, a merge across a gap,
+  truncation, the m:ss text, and two runs of the real `separate_stems` path
+  with only demucs faked.
+
+### Calibration (the plan's gate: passed)
+
+On the *Always On* seed-7 vocals stem (`AlwaysOnStems` job `494d1a7469b7`):
+
+| section | windows | L/R correlation | side/mid |
+|---|---|---|---|
+| verse 1 (0:16–0:49) | 25 | 0.656 – 0.969 | 0.016 – 0.208 |
+| verse 2 (0:49–1:19) | 24 | 0.663 – 0.964 | 0.018 – 0.208 |
+| chorus 1 (1:19–1:34) | 15 | −0.276 – 0.251 | 0.609 – 1.682 |
+| final chorus (1:59–2:09) | 10 | 0.060 – 0.206 | 0.667 – 0.891 |
+
+### Deviations from the plan
+
+1. **A level gate, `STACK_LEVEL_BELOW_DB = 14`.** htdemucs leaves the
+   intro's "electrical hum" pad in the vocals stem (0:08–0:12), and it
+   measures as decorrelated as the chorus. It sits 16.5 dB or more below the
+   stem's level, so the gate drops it. The margin is thin (2.5 dB on that
+   side, 4 dB to the quietest chorus window): retune it first if another
+   song disagrees.
+2. **"Voiced window" means at least half its frames voiced**
+   (`STACK_VOICED_SHARE = 0.5`); the plan left the share open.
+3. **The bridge (about 1:42–1:47) doesn't flag**: the level gate drops it.
+
+## Verification
+
+Cases C-F506 (the seed-7 known answer, plus the chained
+`transcribe_audio`), C-F507 (mono, an instrumental re-separation and a
+1.5 s slice don't warn; a 20 s slice warns in its own time) and C-F508 (the
+guide names the warning; `separate_stems` keeps its three arguments) all
+passed on lem against `29158446`. The fixture is the shared asset
+`qa-cast/always-on-seed7.mp3`.
+
+The verify also found a stale example in the same TASKS.md section
+(`file_name` for `file_base_name`), fixed separately in #958.
+
+## Cost and bounces
+
+| stage | bounces | cost |
+|---|---|---|
+| A (#955) | 0 | not recorded on the stage |
+
+## Deferred, and what brings it back
+
+- **The voice/pitch conversion task (ask 1).** Comes back on a second field
+  report needing a re-voice, from a piece other than *Always On*. The plan's
+  sketch: `shift_voice(audio, semitones, formant_shift, start_seconds,
+  duration_seconds, crossfade_seconds)`, WORLD analysis/resynthesis over a
+  window, crossfaded back, summed with the existing `mix_audio`; a
+  `pyworld` dependency after a wheel check on linux-cuda and macOS-arm64; it
+  would refuse a window this check flags as stacked. A learned
+  voice-conversion model stays out either way.
+- **Structured spans (Q1).** A `layering` `JsonRecord` key saved as
+  `<name>-layering.json` (the `crop_face_track` precedent), if a caller
+  needs the spans machine-readable.
+- **The check in `attribute_voices` (Q3).** Needs the stereo stem kept
+  through `separate_vocals`. Worth it only if attribution on a stacked
+  chorus misleads a session.
+- **A pitch-track signal.** Only if the stereo check proves blind to a real
+  stacked span.
diff --git a/docs/proposals/complete/task-weights-downloads-complete.md b/docs/proposals/complete/task-weights-downloads-complete.md
new file mode 100644
index 000000000..d68287dbf
--- /dev/null
+++ b/docs/proposals/complete/task-weights-downloads-complete.md
@@ -0,0 +1,156 @@
+# Task weights in `plan.downloads_required` (#975)
+
+Written by model `claude-opus-5-5` via provider `anthropic` (close-out session,
+2026-10-23). Filed from #973 (stage A of #956) after `remove_object`'s first
+run downloaded about 200 MB that nobody quoted. Plan v1 was designed on
+#975. Don's review made v2, and Don approved v2. It was built as two stages,
+#977 and #978. The plan comment on #975 stays the full design. This doc
+records what shipped.
+
+## The problem
+
+`validate_workflow`'s `plan.downloads_required` walked only pipeline weights
+(`from_pretrained_arguments`, `loras`, URL `from_single_file`). Every task
+that fetched weights did so with nothing quoted, and nothing in the bound
+acknowledgement (#85) covered it. The issue named `upscale`,
+`restore_faces` and `remove_object` (0.06–0.2 GB files). The design sweep
+found bigger unlisted ones: `remove_background` (RMBG-2.0, ~1 GB),
+`segment` (~1.8 GB), `text_generation` (Qwen2.5-1.5B, ~3 GB),
+`diffusion_upscale` (16 GB), speech and transcription.
+
+## Verdict: build both stages
+
+Demand was thin (no field report), but the field is a contract: it is what
+a bound acknowledgement checks, so a list that silently leaves things out
+is worse than none (Don, review). The field had been wrong three times
+before in the same way (#382, #894, #151).
+
+Non-goals stayed out: no task's download behaviour changed; facexlib is
+reported, not mirrored (#616); `download_model` still fetches whole repos
+at `main`; no UI change; zoe_depth, dw_pose and demucs (fetched outside the
+HF cache) stay unlisted and documented.
+
+## Plan history
+
+- **v1:** one hook per task, a per-file cache check and HEAD sizing, and
+  `(repo, filename, revision)` keying. Stage A was single-file tasks, B the
+  whole-repo ones.
+- **v2 (approved), Don's four changes:**
+  1. facexlib's weights dir is derived with `importlib.util.find_spec`, never
+     imported (its `misc.py` imports `cv2` and `torch`).
+  2. Each loader reads its source from the same resolution as its
+     declaration, so the two can't disagree.
+  3. Q4: no H3 VAE subfolder entry (every H3 box lists `MiniMaxAI/MiniMax-H3`
+     whole); `subfolder` dropped from the shape.
+  4. Q1: re-split. A′ is the hook plus the multi-GB whole-repo tasks; B′ is the
+     file-level detail, so if either were cut it would be the smaller one.
+
+Corrections the plan made to the issue's premise: the repo-level cache
+check is wrong for single files (a pinned `hf_hub_download` writes no
+`refs/main`, and any other cached file of the repo would mask the wanted
+one); `_model_info` sizes the whole repo, not one file; dedup was by repo
+name only.
+
+## What was built
+
+### Stage A′ (#977): the hook, the plan walk, whole-repo declarations
+
+Commits 36305b36 (code) and b0d0d857 (tests, docs), merged as c6ff498a. The
+bounce fix 138bbc42 was merged as a27b61be.
+- **Hook:** `required_weights(arguments)`, named on `register_command` and
+  looked up by `dw/tasks/registry.py:required_weights_hook`. Helpers are in
+  `dw/tasks/weights.py`. `dw/plan.py:_collect_task_weights` walks the
+  expanded definition and each composed child. Task repos join the same
+  list as pipeline repos, so they share its shape filter, cache test and
+  sizing. A shared repo is listed once. A reference or local-path argument
+  gives no entry. A hook that raises gives no entry and never fails the
+  validate.
+- **Declarations:** segment (`model_name` detector, `sam_model_name`
+  segmenter), remove_background, diffusion_upscale, transcribe_audio (and
+  check_script through it), generate_speech (plus speechbrain x-vector with
+  `speaker_embedding`), attribute_voices (ECAPA only), text_generation,
+  image_to_text, judge, and the image processors (depth, depth_estimator,
+  controlnet_aux detectors, sam, segmentation).
+- **Pin:** `tests/test_task_weights.py::TestEveryHubLoadIsDeclared`.
+- **Bound acknowledgement fix (the bounce):** `AcknowledgedCost._from_plan`
+  in `dw/server/admission.py` reads a validate `plan` sent unedited as the
+  acknowledgement. Its `downloads_required` and `estimate.minutes` become
+  `downloads` and `minutes`. An explicit `downloads`, even `[]`, wins.
+- **Deviations:** judge and image_to_text default to SmolVLM-256M (what
+  they load), and Qwen applies only to text_generation without an `image`.
+  depth_estimator now passes transformers' default (`Intel/dpt-large` at a
+  pin) explicitly, which loads the same weights as before. A
+  `system_prompt.from_hub` file is not listed. The first validate of a
+  workflow with a task step imports that task's module, which costs a few
+  seconds once per server process.
+- **Test-only:** `tests/test_server_jobs.py::finished_job` waits for the
+  history row (a parallel-load flake that tripped the hand-off gate).
+
+### Stage B′ (#978): file-level entries, single-file tasks, facexlib
+
+Commit 9da24cc3, merged as d5bb9f8b. The map-row fix b72ca04a was merged as
+b01f1238.
+- **Entries** keyed by `(repo, filename, revision)`. Each file is checked on
+  its own with `_cached_file` at `revision or "main"` and sized by a HEAD of
+  that file (`_file_info`). A whole-repo entry for the same repo subsumes it.
+  `RequiredDownload` gained optional `filename`/`revision`, and the
+  OpenAPI and UI types were regenerated. The MCP cost-gate line renders
+  `repo/filename`.
+- **Declarations** (hook and loader share each task's `*_source`):
+  `upscale` (file, or whole repo with no `filename`), `restore_faces`
+  (spandrel entry plus facexlib URLs), `remove_object` (pinned only for the
+  default pair), `upscale_h3_latents` (the upscaler file at its pin, no VAE
+  entry), `crop_face_track` (YuNet, pinned for the default repo),
+  `interpolate_frames` (RIFE, no pin).
+- **facexlib:** `detection_Resnet50_Final.pth` always, and
+  `parsing_parsenet.pth` unless `use_parse` is false. Each is listed as
+  `{repo: null, url}` while missing from `<facexlib package>/weights`. The
+  directory is found with `find_spec`. If facexlib isn't installed, both are
+  listed.
+- The pin's B′ allow-list is gone. Three commands are exempt with reasons in
+  the test: `separate_stems`, `decode_h3_latents` and `paste_face_track`.
+  `tests/test_task_file_weights.py` covers the rest.
+- **Deviations:** `gated` is always `null` on a file entry (the file HEAD
+  doesn't report the gating mode). A file under ~10 MB reads `gb: 0.01`.
+  A filename that fails `validate_weight_name` gives no entry. The
+  no-heavy-import test checks `facexlib`/`cv2` only, because `import dw`
+  already loads torch. `remove_object` and `upscale_h3_latents` keep
+  treating any falsy argument as unset.
+
+Docs updated across both stages: TASKS, SERVER, MCP (including the
+`download_model`-fetches-whole-repo note), WORKFLOW_GUIDE, DEPENDENCIES,
+ARCHITECTURE (the "Task weights" row), and the RELEASING "Unreleased" note
+that a bound acknowledgement from a pre-deploy validate gets 409
+`downloads` when the workflow has one of these tasks uncached.
+
+## Verification and bounces
+
+| Stage | Bounces | Cause |
+|---|---|---|
+| A′ (#977) | 1 (tester) | C-F525 step 5: an unedited validate `plan` sent as the acknowledgement was refused, against the plan's "clients that copy the plan verbatim are unaffected". Fixed by `_from_plan`. C-F519–C-F527 and SE-F051 then passed |
+| B′ (#978) | 1 (architecture review) | The "Task weights" map row named `argument_or_default` as the one resolution rule, but three of the six new `*_source` functions don't use it. The row was amended and no code changed. All 11 `pending: #978` cases (C-F528–C-F536, M-F157, SE-F052) then passed |
+
+The stage comments name no `usage:` figures, so this record leaves out cost
+per stage. The plan estimated $4–6 for each stage.
+
+Some arms couldn't run on lem because the defaults were already cached:
+the real-repo arm of C-F530, the uncached pinned big-lama arm of C-F531, and
+the default-file arms of C-F533. The offline arm of C-F536 couldn't run
+either. The bogus-repo override arms covered each declaration instead.
+
+## Open after close
+
+- `pending: #977` is still on C-F519, C-F520, C-F522, C-F523, C-F525,
+  C-F526 and SE-F051. They pass in substance, but as written they use
+  argument names or expectations the plan didn't match. The amendment
+  is with Don on dkackman/harnest#139.
+
+## Deferred
+
+- zoe_depth, dw_pose and demucs/`separate_stems` (fetched outside the HF
+  cache) and text_generation's `system_prompt.from_hub` file are still
+  unlisted. Each is documented in TASKS.md. *Trigger:* a field report of an
+  unquoted download from one of them.
+- `download_model` can't pre-fetch a pinned single file. *Trigger:* an
+  offline box that needs one.
+- `gated` on file entries. *Trigger:* a gated single-file task source.
diff --git a/docs/proposals/todo.md b/docs/proposals/todo.md
index a992807a1..f2de5926f 100644
--- a/docs/proposals/todo.md
+++ b/docs/proposals/todo.md
@@ -329,6 +329,44 @@ remaining deferred fix is recorded in
   two-shot and lip-syncs the right singer; a last frame doesn't help. One
   `minimax-h3` skill line; no template, since `music-video` takes the
   recipe with arguments. Record: `complete/h3-keyframe-audio-complete.md`.
+- **A `stacked_vocals` warning from `separate_stems`** (#947, stage #955),
+  shipped 2026-10-19. A stereo check on the vocals stem names the spans
+  that hold layered voices (a Music 3 chorus). Record, including what was
+  deferred (the voice/pitch conversion task, structured spans, the check in
+  `attribute_voices`): `complete/stacked-vocals-warning-complete.md`.
+- **`remove_object`, prompt-free LaMa object removal** (#956, stages
+  #973-#974), shipped 2026-10-22. A task that fills a white-means-fill mask
+  from the surrounding image, with no prompt and fp32 on any device, using
+  pinned `big-lama.safetensors` loaded through spandrel. It comes with the
+  `remove-object` and `segment-and-remove` templates and an
+  erase-versus-repaint routing rule. `segment` now keeps SAM2's best-rated
+  mask. Record, including what was deferred (temporal video removal,
+  per-frame masks, a larger model for big regions, #975's download
+  warning): `complete/remove-object-complete.md`.
+- **Task weights in `plan.downloads_required`** (#975, stages #977-#978),
+  shipped 2026-10-23. Each model-backed task declares
+  `required_weights(arguments)`. Its loader reads the same resolution, and
+  the plan lists those repos, plus single files at their pinned revision
+  and facexlib's URLs, so a bound acknowledgement covers them. Record,
+  including what was deferred (fetchers outside the HF cache, pinned-file
+  `download_model`, `gated` on file entries):
+  `complete/task-weights-downloads-complete.md`.
+- **H3 rules from WanGP's field notes** (#985, stages #988-#989), shipped
+  2026-10-25. Probed on lem at int8 + turbo: FL2VA with `hold_audio` keeps
+  the first frame's pixels and lip-syncs, so it is now the skill's
+  locked-frame route (Ref2VA keyframe completion the fallback); leaving
+  words out of `<d>` under a held track was refuted. The `h3` enhancer
+  writes `<d>` blocks again. Record, including what was dropped (tail-frame
+  discard: dw chains have no per-window end image) and deferred (keyframe
+  strength, not reachable from a workflow):
+  `complete/h3-wangp-field-notes-complete.md`.
+- **Look measures in `analyze_seams`** (#1031, stage #1042), shipped
+  2026-10-26. Every seam record carries signed `saturation_step`,
+  `lightness_step` and `contrast_step`, a local-rate `look_ratio` with its
+  `look_ratio_measure`, and a `detail_ratio`, taken from a 128x72 colour
+  copy during the one decode. Measures only, no rules. Record, including
+  what was deferred (rules until #1033 measures real chains, take drift,
+  apparent age): `complete/seam-look-measures-complete.md`.
 
 ## Declined
 
diff --git a/docs/stabilization/baseline.json b/docs/stabilization/baseline.json
index 4bafe43e4..4cb154d88 100644
--- a/docs/stabilization/baseline.json
+++ b/docs/stabilization/baseline.json
@@ -1,10 +1,10 @@
 {
-  "modules": 220,
+  "modules": 226,
   "modules_over_size_ceiling": 0,
   "functions_over_150_lines": 0,
   "prefix_literals": 0,
   "prefix_handling": 0,
-  "test_dw_patch_targets": 309,
+  "test_dw_patch_targets": 316,
   "claude_md_lines": 129,
   "duplicate_blocks": 0,
   "complex_functions": 2,
diff --git a/dw/acceleration_warnings.py b/dw/acceleration_warnings.py
index 9d072d12d..915f4d598 100644
--- a/dw/acceleration_warnings.py
+++ b/dw/acceleration_warnings.py
@@ -91,7 +91,7 @@
 CACHE_UNSUPPORTED = "cache_unsupported"
 
 # The component names a cache hook attaches to, as in
-# dw.pipeline_processors.components.get_cache_transformer
+# dw.pipeline_processors.mag_calibration.get_cache_transformer
 _CACHE_COMPONENTS = ("transformer", "transformer_ref")
 
 
diff --git a/dw/adapter_compatibility.py b/dw/adapter_compatibility.py
index 5349769da..8af8bd180 100644
--- a/dw/adapter_compatibility.py
+++ b/dw/adapter_compatibility.py
@@ -312,6 +312,21 @@ def adapter_errors(
 )
 
 
+# Step-distillation loras run in 4-9 steps; a null-lora step at or past this
+# has already been given the base model's schedule, so the warning is stale.
+RAISED_STEPS = 10
+
+
+def _schedule_raised(pipeline):
+    arguments = pipeline.get("arguments")
+    steps = (
+        arguments.get("num_inference_steps") if isinstance(arguments, dict) else None
+    )
+    return (
+        isinstance(steps, int) and not isinstance(steps, bool) and steps >= RAISED_STEPS
+    )
+
+
 def _disabled_loras(steps, source_indices, written=None, supplied=()):
     """Every `loras` entry switched off with a null model_name, as
     (path, message). Any pipeline, not only H3: the off switch is the
@@ -322,7 +337,7 @@ def _disabled_loras(steps, source_indices, written=None, supplied=()):
         steps, source_indices, "pipeline"
     ):
         loras = pipeline.get(LORAS_KEY)
-        if not isinstance(loras, list):
+        if not isinstance(loras, list) or _schedule_raised(pipeline):
             continue
         for position, lora in enumerate(loras):
             if not isinstance(lora, dict) or lora.get(MODEL_NAME_KEY) is not None:
diff --git a/dw/argument_media.py b/dw/argument_media.py
index 18dec2786..45e5cea50 100644
--- a/dw/argument_media.py
+++ b/dw/argument_media.py
@@ -220,7 +220,7 @@ def _with_frame_rate(frames, location):
     only looks at a real local path. A file that says neither stays a plain
     list.
     """
-    from .tasks.video_utils import FrameList
+    from .media_types import FrameList
 
     if not isinstance(frames, list):
         return frames
@@ -273,7 +273,7 @@ def local_media_file(location, what, default_suffix=""):
 
 def _fetch_remote_video(url):
     """A video URL's frames, decoded from `local_media_file`'s copy."""
-    from .tasks.video_utils import FrameList
+    from .media_types import FrameList
 
     with local_media_file(url, "a video argument", default_suffix=".mp4") as path:
         frames = load_video(path)
diff --git a/dw/devices.py b/dw/devices.py
index e94aa851d..41afd4c02 100644
--- a/dw/devices.py
+++ b/dw/devices.py
@@ -109,7 +109,7 @@ def check_device_present(device):
         raise DeviceConfigError(f"{device} is not available on this machine")
 
 
-def resolve_serve_devices(cli_value, settings_value):
+def resolve_serve_devices(cli_value, settings_value, on_absent=None):
     """The devices a server runs on - `--devices`, else the `devices`
     setting - or None when neither names any, which leaves today's single
     device (`DW_DEVICE`, then the `device` setting, then detection) alone.
@@ -117,7 +117,14 @@ def resolve_serve_devices(cli_value, settings_value):
     More than one entry runs a worker per card, so each must be a card of
     its own. Raises DeviceConfigError for a duplicate, for an unindexed
     `cuda` in a list of several (it would not be pinned, and would share
-    card 0), and for a device this machine does not have."""
+    card 0), and for a device this machine does not have.
+
+    A list of several survives a card being pulled: an absent entry is
+    dropped and its refusal passed to `on_absent`, so a box with a card
+    out for service comes up on the rest instead of refusing to start (a
+    service manager restarting it would loop forever). Only when no entry
+    is present - or `on_absent` is None - is the first absence raised, so
+    a lone typo (`cuda:7`) still refuses."""
     raw = cli_value if cli_value else settings_value
     devices = parse_devices(raw)
     if not devices:
@@ -139,9 +146,19 @@ def resolve_serve_devices(cli_value, settings_value):
                 "--devices with several entries must name each CUDA card by "
                 "index ('cuda:0,cuda:1'), not a bare 'cuda'"
             )
+    present, absences = [], []
     for device in devices:
-        check_device_present(device)
-    return devices
+        try:
+            check_device_present(device)
+        except DeviceConfigError as absence:
+            absences.append(absence)
+        else:
+            present.append(device)
+    if absences and (not present or on_absent is None):
+        raise absences[0]
+    for absence in absences:
+        on_absent(str(absence))
+    return present
 
 
 def _explicit_cuda_index(device):
diff --git a/dw/hold_audio.py b/dw/hold_audio.py
index f29164aa7..f9b28fc80 100644
--- a/dw/hold_audio.py
+++ b/dw/hold_audio.py
@@ -33,11 +33,14 @@
 from .pipeline_processors.h3_rules import (
     HOLD_AUDIO_INPUT,
     REFINE_STRENGTH_INPUT,
+    REFINE_TILES_INPUT,
     not_h3,
     refine_problems,
 )
 from .security import ALLOWED_AUDIO_EXTENSIONS
 
+UPSCALE_COMMAND = "upscale_h3_latents"
+
 
 def _not_audio(value):
     """Why this `hold_audio` value is not audio, or None - including None for
@@ -97,26 +100,62 @@ def hold_audio_errors(workflow_definition, source_indices=None):
     return errors
 
 
+def _upscaled_canvas(steps, latents):
+    """The (width, height) an `upscale_h3_latents` step the `latents` argument
+    names will produce, or None when it names something else or the task's size
+    is not a literal pair."""
+    name = references.ref_name(references.PREVIOUS_RESULT, latents)
+    if name is None:
+        return None
+    name = name.partition(".")[0]
+    for _, step, task, _, _ in references.iter_steps(steps, None, "task"):
+        if step.get("name") != name:
+            continue
+        arguments = task.get("arguments")
+        if task.get("command") != UPSCALE_COMMAND or not isinstance(arguments, dict):
+            return None
+        width, height = arguments.get("width"), arguments.get("height")
+        if all(isinstance(v, int) and not isinstance(v, bool) for v in (width, height)):
+            return width, height
+        return None
+    return None
+
+
 def refine_strength_errors(workflow_definition, source_indices=None):
-    """Every `refine_strength` argument refused before the run, as
-    [{path, message}] - walked the way `hold_audio_errors` walks."""
+    """Every `refine_strength` or `refine_tiles` argument refused before the
+    run, as [{path, message}] - walked the way `hold_audio_errors` walks. A
+    problem about `refine_tiles` is at its path; the rest are at
+    `refine_strength`'s."""
     errors = []
+    steps = workflow_definition.get("steps")
     for _, _, pipeline, source, where in references.iter_steps(
-        workflow_definition.get("steps"), source_indices, "pipeline"
+        steps, source_indices, "pipeline"
     ):
         arguments = pipeline.get("arguments")
-        if (
-            not isinstance(arguments, dict)
-            or arguments.get(REFINE_STRENGTH_INPUT) is None
+        if not isinstance(arguments, dict) or (
+            arguments.get(REFINE_STRENGTH_INPUT) is None
+            and arguments.get(REFINE_TILES_INPUT) is None
         ):
             continue
-        path = render_path(
-            ("steps", source, "pipeline", "arguments", REFINE_STRENGTH_INPUT)
-        )
-        h3_problem = not_h3(pipeline, REFINE_STRENGTH_INPUT)
-        problems = ([h3_problem] if h3_problem else []) + refine_problems(arguments)
-        for problem in problems:
-            errors.append({"path": path, "message": f"{problem}{where}"})
+        paths = {
+            name: render_path(("steps", source, "pipeline", "arguments", name))
+            for name in (REFINE_STRENGTH_INPUT, REFINE_TILES_INPUT)
+        }
+        problems = []
+        for name in (REFINE_STRENGTH_INPUT, REFINE_TILES_INPUT):
+            if arguments.get(name) is not None:
+                problems.append((name, not_h3(pipeline, name)))
+        canvas = _upscaled_canvas(steps, arguments.get("latents"))
+        for problem in refine_problems(arguments, canvas):
+            name = (
+                REFINE_TILES_INPUT
+                if problem.startswith(REFINE_TILES_INPUT)
+                else REFINE_STRENGTH_INPUT
+            )
+            problems.append((name, problem))
+        for name, problem in problems:
+            if problem is not None:
+                errors.append({"path": paths[name], "message": f"{problem}{where}"})
     return errors
 
 
diff --git a/dw/introspection.py b/dw/introspection.py
index 553314c06..162ab110b 100644
--- a/dw/introspection.py
+++ b/dw/introspection.py
@@ -368,6 +368,7 @@ def _modular_block_parameters(cls):
 
     from .pipeline_processors.h3_guides import insert_guides
     from .pipeline_processors.h3_hold import insert_audio_hold
+    from .pipeline_processors.h3_rules import REFINE_NOISE
 
     blocks_class = getattr(importlib.import_module(cls.__module__), blocks_name, None)
     if blocks_class is None:
@@ -387,7 +388,9 @@ def _modular_block_parameters(cls):
         return []
     parameters = []
     for block_input in block_inputs:
-        if not block_input.name:
+        # None for a kwargs group; REFINE_NOISE is dw's own hand-off between its
+        # tiled refine and the refine block, not something a workflow sets
+        if not block_input.name or block_input.name == REFINE_NOISE:
             continue
         parameters.append(
             {
diff --git a/dw/locations.py b/dw/locations.py
index 6d5047c90..30c38d7c3 100644
--- a/dw/locations.py
+++ b/dw/locations.py
@@ -51,6 +51,7 @@
     validate_json_size,
     validate_path,
     validate_url,
+    validate_weight_name,
 )
 from .tasks.registry import RegistryTable
 from .trust import workflows_are_trusted
@@ -202,6 +203,7 @@ def validate_media_path(
     if not workflows_are_trusted():
         roots = media_roots(base_dir)
         if not any(_within(resolved, root) for root in roots):
+            own = _own_output_hint(location)
             raise PathTraversalError(
                 f"Refusing to read {what} at '{location}': it resolves "
                 f"outside every directory this workflow may read "
@@ -215,7 +217,7 @@ def validate_media_path(
                 f"'asset:' reference, use keep_output(shared=True) to copy "
                 f"a generated file into the library every workspace shares "
                 f"if it needs to cross that boundary on purpose, or pass "
-                f"--trust-workflows if you trust this workflow's source."
+                f"--trust-workflows if you trust this workflow's source." + own
             )
 
     if require_exists and not os.path.exists(resolved):
@@ -223,6 +225,29 @@ def validate_media_path(
     return resolved
 
 
+def _own_output_hint(location):
+    """A sentence naming `output:<location>` when the bare relative name is a
+    file in this workspace's own outputs, else an empty string."""
+    text = str(location)
+    if os.path.isabs(text) or ".." in text.replace("\\", "/").split("/"):
+        return ""
+    try:
+        from .runs import resolve_output_reference
+
+        ref = references.make_ref(references.OUTPUT, text)
+        resolve_output_reference(ref)
+        return (
+            f" This file is one of this workspace's own outputs, so "
+            f"you most likely want '{ref}' - no copy into the "
+            f"asset library is needed."
+        )
+    except (InvalidInputError, PathTraversalError, ValueError):
+        pass
+    except Exception:
+        logger.debug("Could not check the output root for a hint", exc_info=True)
+    return ""
+
+
 def _joined(location, base_dir):
     return os.path.join(base_dir, str(location)) if base_dir else str(location)
 
@@ -542,58 +567,10 @@ def validate_model_name(name, base_dir=None):
 # named bare (no subfolder: the task knows its default repo's layout). A
 # pickle format is refused by name rather than left to fail in the loader:
 # the refusal is the documented contract, not an accident of which loader runs
-SAFETENSORS_ONLY_COMMANDS = ("upscale_h3_latents",)
+SAFETENSORS_ONLY_COMMANDS = ("upscale_h3_latents", "remove_object")
 SAFETENSORS_SUFFIX = ".safetensors"
 
 
-def validate_weight_name(name, suffixes=None, what="weight_name", subfolders=True):
-    """A file name inside a Hub repo: relative, and never climbing out of it.
-
-    `hf_hub_download(filename=...)` joins the name onto the local cache
-    directory, so a name shaped like a path is a path on this machine. A
-    subfolder is legitimate where `subfolders` allows one (an IP adapter's
-    lives under one); an absolute path, a backslash, a drive, an empty segment or a '.'/'..'
-    segment is not. The refusal names only what the caller wrote, never a
-    directory on the server.
-
-    Args:
-        name: The file name the workflow supplied
-        suffixes: The file endings allowed, or None for any
-        what: Short phrase naming the argument, for the error message
-        subfolders: Whether the name may hold a '/' at all
-
-    Raises:
-        PathTraversalError: On a name that is not a plain relative path
-        InvalidInputError: On an empty name, or one with a refused ending
-    """
-    if not isinstance(name, str) or not name.strip():
-        raise InvalidInputError(f"Refusing an empty {what}.")
-    if "\x00" in name:
-        raise InvalidInputError(f"Refusing a {what} containing a null byte.")
-    if name.startswith(("/", "~")) or "\\" in name or ":" in name:
-        raise PathTraversalError(
-            f"Refusing a {what} of '{name}': it names a file inside the model "
-            f"repo, so it must be a relative path - no leading '/' or '~', no "
-            f"backslash, no drive."
-        )
-    if any(segment in ("", ".", "..") for segment in name.split("/")):
-        raise PathTraversalError(
-            f"Refusing a {what} of '{name}': it has an empty, '.' or '..' "
-            f"path segment, so it does not name a file inside the model repo."
-        )
-    if not subfolders and "/" in name:
-        raise PathTraversalError(
-            f"Refusing a {what} of '{name}': it is a file name, not a path - no '/'."
-        )
-    if suffixes and not name.lower().endswith(tuple(suffixes)):
-        raise InvalidInputError(
-            f"Refusing a {what} of '{name}': only "
-            f"{', '.join(repr(suffix) for suffix in suffixes)} weights are "
-            f"read here."
-        )
-    return name
-
-
 # ------------------------------------------------------------- validation
 
 
@@ -620,7 +597,25 @@ def _check(value, base_dir, what):
             validate_media_url(value, what)
         elif os.path.isabs(value):
             validate_media_path(value, base_dir, what, require_exists=False)
-        elif ".." in value.replace("\\", "/").split("/"):
+        elif ".." not in value.replace("\\", "/").split("/"):
+            # A bare relative name resolves against the workflow directory and
+            # is refused at run time when that lands outside every root (a
+            # manifest file name from get_job is the usual case)
+            resolved = validate_media_path(value, base_dir, what, require_exists=False)
+            if not os.path.exists(resolved):
+                # Contained under the workflow directory is not found there:
+                # a task reading the raw string resolves it against the
+                # server's working directory and refuses it, a pipeline
+                # argument finds nothing. Either way the run fails, so it is
+                # refused now, with the output: hint when it names an own
+                # output (#951, #952)
+                raise InvalidInputError(
+                    f"Refusing to read {what} at '{value}': a bare name "
+                    f"is not looked up in the output root, and no file "
+                    f"by that name is beside the workflow, so the run "
+                    f"would refuse it." + _own_output_hint(value)
+                )
+        else:
             # A relative path is under base_dir by construction unless it
             # climbs out, and validate_path refuses '..' - but only when the
             # loader reaches it, which is a queued job and three seconds in
diff --git a/dw/media.py b/dw/media.py
index 127842c71..a5d90c4da 100644
--- a/dw/media.py
+++ b/dw/media.py
@@ -28,6 +28,7 @@
 import av
 import numpy
 from av.audio.resampler import AudioResampler
+from av.video.reformatter import VideoReformatter
 from PIL import Image
 
 from .dsp import SILENCE_DBFS, dbfs, integrated_lufs, layout_name, true_peak_dbfs
@@ -613,18 +614,27 @@ def decode_rgb_frames(path):
         ]
 
 
-def read_thumbnails_and_track(path, thumb_width, thumb_height):
+def read_thumbnails_and_track(
+    path, thumb_width, thumb_height, look=None, look_width=128, look_height=72
+):
     """Stream a file once into grey thumbnails and its soundtrack.
 
     Each decoded picture frame is reduced to a `thumb_height` x `thumb_width`
     grey array as it arrives and then dropped, so memory holds thumbnails,
-    not pictures. Returns (thumbs, chunks, fps, video_seconds, audio_seconds,
-    sample_rate): the thumbnails as a list, the track as a list of float32
-    (samples, channels) chunks, and the streams' own rates and durations
-    (None where a stream is absent or states none).
+    not pictures. With `look`, each frame is also reformatted to a
+    `look_height` x `look_width` rgb24 array and handed to it at once, and
+    only what it returns is kept (#1031). Returns (thumbs, chunks, fps,
+    video_seconds, audio_seconds, sample_rate, looks): the thumbnails as a
+    list, the track as a list of float32 (samples, channels) chunks, the
+    streams' own rates and durations (None where a stream is absent or
+    states none), and `look`'s results as a list (empty without one).
     """
     thumbs = []
+    looks = []
     chunks = []
+    # Its own scaler: frame.reformat shares one, and alternating two output
+    # sizes through it rebuilds the context every frame - 10x the cost
+    look_scaler = VideoReformatter()
     with av.open(path) as container:
         video = (
             _threaded(container.streams.video[0]) if container.streams.video else None
@@ -644,10 +654,21 @@ def read_thumbnails_and_track(path, thumb_width, thumb_height):
                         width=thumb_width, height=thumb_height, format="gray"
                     ).to_ndarray()[:thumb_height, :thumb_width]
                 )
+                if look is not None:
+                    looks.append(
+                        look(
+                            look_scaler.reformat(
+                                frame,
+                                width=look_width,
+                                height=look_height,
+                                format="rgb24",
+                            ).to_ndarray()[:look_height, :look_width]
+                        )
+                    )
             elif isinstance(frame, av.AudioFrame):
                 chunks.append(as_frame_samples(to_float32(frame), channels))
         sample_rate = int(audio.rate) if audio is not None else None
-    return thumbs, chunks, fps, video_seconds, audio_seconds, sample_rate
+    return thumbs, chunks, fps, video_seconds, audio_seconds, sample_rate, looks
 
 
 def _stream_info(container, audio_stream_seconds=False):
diff --git a/dw/media_types.py b/dw/media_types.py
index dcdd2bfe5..c3ee791d5 100644
--- a/dw/media_types.py
+++ b/dw/media_types.py
@@ -14,6 +14,59 @@
 logger = logging.getLogger("dw")
 
 
+class FrameList(list):
+    """The frames of a video file, carrying the rate the file plays at and
+    the shot boundaries its run recorded, if any.
+
+    `load_video` answers a plain list of images, which is what every
+    pipeline argument and every task wants - and which says nothing about
+    how fast those frames are meant to run. A step handed a 24 fps file
+    then wrote it back at `result.fps`'s default of 8, three times long,
+    with its soundtrack finishing a third of the way in and nothing said
+    about it (#104, the file-loading half of #84). A list subclass keeps
+    every consumer working unchanged while `getattr(video, "fps", None)` -
+    the question AudioVideo, concat_videos and interpolate_frames already
+    ask - gets a real answer.
+
+    `shots` is the same idea for the boundaries `dw.runs.shots_beside`
+    finds beside the file: a video loaded from an `asset:`/`output:` path
+    carried no way to answer `getattr(video, "shots", None)`, so
+    `pair_audio` had nothing to remeasure even though the file's own
+    manifest (or its kept-asset sidecar) already held them (#398).
+
+    The one rate-carrying frame list in dw: a step that knows its rate and
+    would otherwise return bare frame lists returns these too - a tiled H3
+    refine's `videos`, and each video in them (#1048).
+    """
+
+    def __init__(self, frames, fps=None, shots=None):
+        super().__init__(frames)
+        self.fps = fps
+        self.shots = shots
+
+
+def rated_videos(videos, fps):
+    """A pipeline's batch of videos as FrameLists carrying `fps` - the batch
+    and each list in it - or `videos` as it is when it is not a list (an
+    array or tensor batch) or no rate is known.
+
+    What a step that knows its rate but would hand on bare frame lists
+    answers with: a tiled H3 refine's `videos`, and any pipeline step whose
+    pipeline reports its own `fps` (MiniMax-H3, #1056). `previous_result:
+    base.videos` is read as the batch and unwrapped by pair_audio, so both
+    levels carry it.
+    """
+    if not fps or not isinstance(videos, list):
+        return videos
+    return FrameList(
+        (
+            FrameList(video, fps) if isinstance(video, list) else video
+            for video in videos
+        ),
+        fps,
+    )
+
+
 class AudioVideo:
     """A generated video together with the audio track generated alongside it.
 
diff --git a/dw/outbound.py b/dw/outbound.py
index c6a01f390..7bd14510d 100644
--- a/dw/outbound.py
+++ b/dw/outbound.py
@@ -459,11 +459,16 @@ def _follow(
                 response.close()
                 logger.debug(f"{current} redirects to {target}")
                 checked = []
-                target = validate(
-                    target,
-                    f"{what} (redirected from '{url}')",
-                    addresses=checked,
-                )
+                try:
+                    target = validate(target, what, addresses=checked)
+                except InvalidInputError as e:
+                    # Say it was a redirect, and name the hop and the URL
+                    # asked for, whichever rule refused it: the scheme rule
+                    # alone read 'URL scheme not allowed: file', which a
+                    # reader could not tell from an upstream error (#1055)
+                    raise InvalidInputError(
+                        f"Refusing a redirect to '{target}' (from '{url}'): {e}"
+                    ) from e
                 method, kwargs = _redirected(method, response.status_code, kwargs)
                 kwargs = _without_credential(kwargs, current, target)
                 current = target
diff --git a/dw/output_extraction.py b/dw/output_extraction.py
index 8ff9de33c..9d51190ac 100644
--- a/dw/output_extraction.py
+++ b/dw/output_extraction.py
@@ -8,7 +8,7 @@
 import numpy
 import torch
 
-from .media_types import AudioTrack, AudioVideo
+from .media_types import AudioTrack, AudioVideo, rated_videos
 from .pipeline_processors.h3_rules import HELD_AUDIO_OUTPUT, HELD_AUDIO_RATE_OUTPUT
 
 logger = logging.getLogger("dw")
@@ -238,8 +238,15 @@ def pair_audio_with_frames(videos, audio, sample_rate):
     Returns:
         List of AudioVideo artifacts, one per generated video
     """
+    # Frames that carry their rate (a FrameList, dw/media_types.py) keep it on
+    # the pair, so a step that declares no result.fps still writes at it
     return [
-        AudioVideo(frames, audio[i] if i < len(audio) else None, sample_rate)
+        AudioVideo(
+            frames,
+            audio[i] if i < len(audio) else None,
+            sample_rate,
+            fps=getattr(frames, "fps", None),
+        )
         for i, frames in enumerate(videos)
     ]
 
@@ -262,3 +269,44 @@ def as_waveform_array(audio):
         return audio.T.float().cpu().numpy()
 
     return numpy.asarray(audio).T.astype(numpy.float32, copy=False)
+
+
+def attach_video_frame_rate(pipeline, output, requested=None):
+    """Hand a pipeline's `videos` on carrying the rate the pipeline itself
+    reports, and answer the output (the same object, or the rated batch when
+    `videos` alone was asked for).
+
+    A modular pipeline returns its frames as bare lists, which say nothing
+    about how fast they play: `previous_result:base.videos` from a MiniMax-H3
+    step reached pair_audio with no rate, so `fit` measured the 124 frames
+    at the writer's 8 fps fallback and padded a 5.17 s track to 15.5 s, and a
+    `result.fps` of 24 only re-timed the picture afterwards (#1056). The
+    rate is the model's, so it is read off the pipeline, which is where
+    MiniMax-H3 publishes it (its `fps` property); a pipeline that reports
+    none leaves its lists as they were, the way a tiled refine's `videos`
+    already carried H3's rate (dw/pipeline_processors/h3_tiles.py). Called by
+    `_run_once` beside `attach_audio_sample_rate`.
+
+    Args:
+        pipeline: The pipeline that produced the output
+        output: The pipeline output - a dict of requested outputs, an output
+            object, or the one value a single-name `output` asked for
+        requested: The step's `output` argument, when it names one output
+    """
+    fps = getattr(pipeline, "fps", None)
+    if not isinstance(fps, (int, float)) or isinstance(fps, bool) or not fps:
+        return output
+    if isinstance(output, dict):
+        if output.get("videos") is not None:
+            output["videos"] = rated_videos(output["videos"], fps)
+        return output
+    if requested == "videos":
+        return rated_videos(output, fps)
+    videos = getattr(output, "videos", None)
+    if videos is not None:
+        try:
+            output.videos = rated_videos(videos, fps)
+        except AttributeError:
+            # A read-only output: left as it was, and the result declares its rate
+            pass
+    return output
diff --git a/dw/pipeline_processors/components.py b/dw/pipeline_processors/components.py
index 849036b39..46aa59db7 100644
--- a/dw/pipeline_processors/components.py
+++ b/dw/pipeline_processors/components.py
@@ -1,5 +1,4 @@
 import torch
-import ast
 import contextlib
 import logging
 from .config_objects import (
@@ -23,8 +22,13 @@
 )
 from huggingface_hub.errors import HfHubHTTPError
 from .timing import counting_forwards, report_cache_stats
+from .mag_calibration import (  # noqa: F401 - re-exported for pipeline.py
+    _report_unfinished_mag_calibration,
+    captured_mag_calibration,
+    get_cache_transformer,
+)
 from .h3_guides import insert_guides
-from .h3_hold import insert_audio_hold
+from .h3_hold import core_denoise_sequences, insert_audio_hold
 from .placement import (
     apply_on_demand_placement,
     create_components_manager,
@@ -714,6 +718,11 @@ def from_pretrained():
             insert_audio_hold(component)
             # ...and `guides` on t2va and fl2va
             insert_guides(component)
+            # ...and the decode-free graph a `refine_tiles` step runs per tile
+            from .h3_tiles import attach_tile_blocks
+
+            if core_denoise_sequences(component):
+                attach_tile_blocks(component)
 
         if defer_placement:
             # The caller places this itself, once it has finished loading the
@@ -844,149 +853,6 @@ def apply_sdnq_optimizations(pipeline, component_names):
             )
 
 
-def get_cache_transformer(pipeline):
-    """Find the denoiser a cache hook attaches to.
-
-    Most pipelines register theirs as 'transformer', but a modular pipeline names
-    it after the workflow it serves - MiniMax-H3's ref2va denoises through
-    'transformer_ref'. Looking only for 'transformer' silently skips caching on
-    those, so try the alternates diffusers' modular pipelines actually use.
-
-    Args:
-        pipeline: The loaded diffusers pipeline
-
-    Returns:
-        The transformer component, or None when the pipeline has none
-    """
-    for name in ("transformer", "transformer_ref"):
-        transformer = getattr(pipeline, name, None)
-        if transformer is not None:
-            return transformer
-    return None
-
-
-_MAG_LOGGER = "diffusers.hooks.mag_cache"
-_MAG_RESULT_PREFIX = "MagCache Calibration Results:"
-
-
-def _active_cache_context_name(transformer):
-    """The name of the cache context a stateful hook under the transformer is
-    running in, or None. Under CFG that is "cond" or "uncond"."""
-    for module in transformer.modules():
-        registry = getattr(module, "_diffusers_hook", None)
-        for hook in getattr(registry, "hooks", {}).values():
-            for attr in vars(hook).values():
-                context = getattr(attr, "_context", None)
-                if context is not None and hasattr(attr, "get_state"):
-                    return context.name
-    return None
-
-
-class _MagCalibrationHandler(logging.Handler):
-    """Turns diffusers' end-of-run calibration log record into job events.
-
-    diffusers prints the ratios, logs them at INFO and clears the list in the
-    same call (`MagCacheHook._advance_step`), so the record is the only moment
-    they can be read, and the worker's stdout reaches no consumer. The record
-    is emitted synchronously from inside the forward, so the state manager's
-    context is still the one the ratios belong to.
-    """
-
-    def __init__(self, transformer):
-        super().__init__(level=logging.INFO)
-        self.transformer = transformer
-
-    def emit(self, record):
-        message = record.getMessage()
-        if not message.startswith(_MAG_RESULT_PREFIX):
-            return
-        try:
-            ratios = ast.literal_eval(message[len(_MAG_RESULT_PREFIX) :].strip())
-            context = _active_cache_context_name(self.transformer)
-        except (ValueError, SyntaxError):
-            return
-        _report_mag_ratios(ratios, context)
-
-
-def _report_mag_ratios(ratios, context):
-    label = f" [{context}]" if context in ("cond", "uncond") else ""
-    text = (
-        f"MagCache calibration ({len(ratios)} steps){label}: "
-        f"{ratios} \u2014 paste into mag_ratios"
-    )
-    if context == "cond":
-        text += " (classifier-free guidance runs two lists; the cond one is the usual choice)"
-    emit_log(text)
-    emit_warning(text)
-
-
-def _report_unfinished_mag_calibration(transformer):
-    """Report the ratios a calibrating call left in its mag state (#927).
-
-    diffusers logs a calibration only when its step counter reaches the
-    config's num_inference_steps, and a scheduler can run fewer forwards than
-    that: MiniMax-H3's turns N sigmas into N - 1 evaluations. Such a call ends
-    with its ratios still in the state, which the call's reset then drops. A
-    call that did finish has nothing left here - diffusers clears the list
-    when it logs - so nothing is reported twice.
-    """
-    if not getattr(getattr(transformer, "_cache_config", None), "calibrate", False):
-        return
-    from diffusers.hooks.mag_cache import MagCacheBlockHook
-
-    for module in transformer.modules():
-        registry = getattr(module, "_diffusers_hook", None)
-        for hook in getattr(registry, "hooks", {}).values():
-            if isinstance(hook, MagCacheBlockHook) and hook.is_tail:
-                for name, state in hook.state_manager._state_cache.items():
-                    if state.calibration_ratios:
-                        _report_mag_ratios(list(state.calibration_ratios), name)
-                return
-
-
-@contextlib.contextmanager
-def captured_mag_calibration(pipeline, arguments=None):
-    """Report a mag cache's calibration ratios as job events (#891).
-
-    A no-op unless the transformer's cache is a MagCacheConfig with calibrate
-    on. Under classifier-free guidance dw's pipelines run "cond" and "uncond"
-    contexts, each with its own state, so two labeled lists are emitted.
-
-    diffusers only finishes (and logs) a calibration once its step counter
-    reaches the config's `num_inference_steps`, which defaults to 28. A run of
-    any other length would end without a record, so for the call the config
-    counts the steps the call actually runs.
-    """
-    transformer = get_cache_transformer(pipeline)
-    config = getattr(transformer, "_cache_config", None)
-    if not getattr(config, "calibrate", False):
-        yield
-        return
-
-    steps = (arguments or {}).get("num_inference_steps")
-    declared_steps = config.num_inference_steps
-    if isinstance(steps, int) and steps != declared_steps:
-        emit_warning(
-            f"MagCache calibration: the cache declares num_inference_steps "
-            f"{declared_steps} but this step runs {steps}; calibrating over {steps}"
-        )
-        config.num_inference_steps = steps
-
-    mag_logger = logging.getLogger(_MAG_LOGGER)
-    handler = _MagCalibrationHandler(transformer)
-    old_level, old_propagate = mag_logger.level, mag_logger.propagate
-    mag_logger.addHandler(handler)
-    mag_logger.setLevel(logging.INFO)
-    mag_logger.propagate = False
-    try:
-        yield
-    finally:
-        config.num_inference_steps = declared_steps
-        mag_logger.removeHandler(handler)
-        mag_logger.setLevel(old_level)
-        mag_logger.propagate = old_propagate
-
-
 @contextlib.contextmanager
 def stateful_cache_context(pipeline, segment=None):
     """Provide the context a stateful cache hook reads its state through.
diff --git a/dw/pipeline_processors/h3_hold.py b/dw/pipeline_processors/h3_hold.py
index fb8136b56..3bd8374fc 100644
--- a/dw/pipeline_processors/h3_hold.py
+++ b/dw/pipeline_processors/h3_hold.py
@@ -44,6 +44,7 @@
 import logging
 
 from .h3_rules import (
+    HELD_LATENTS_OUTPUT as HELD_LATENTS_OUTPUT,
     CORE_DENOISE_SEQUENCES,
     DENOISE_STEP,
     HOLD_BEFORE,
@@ -56,6 +57,13 @@
 
 logger = logging.getLogger("dw")
 
+# The hold block's encode of the held track - `(channels, num_latents, C)`
+# audio latents - as a state output, so a caller running the block more than
+# once on one track (the tiled refine, dw/pipeline_processors/h3_tiles.py) can
+# hand it back through `encoded_hold_audio` and the block encodes once per
+# refine. Named here beside the block's owner rather than in h3_rules because
+# validation never sees it: it is a block output, not a workflow argument.
+
 
 def blocks():
     """(DwH3HoldAudioStep, DwH3RefineScheduleStep, DwH3ReleaseAudioStep) - the
@@ -70,6 +78,16 @@ def blocks():
     )
 
 
+def encoded_hold_audio(reference, latents):
+    """`reference` - a `hold_audio` MiniMaxH3AudioReference - carrying `latents`,
+    the hold block's `HELD_LATENTS_OUTPUT` encode of it, so the block reuses the
+    encode instead of running the audio VAE again. Imports the block module on
+    first use, as `blocks()` does (#790)."""
+    from . import h3_hold_steps
+
+    return h3_hold_steps.EncodedAudioReference.of(reference, latents)
+
+
 def core_denoise_sequences(pipeline):
     """[(prefix, sequence)] for every H3 core-denoise sequence a pipeline's own
     block graph holds - empty for anything that is not a MiniMax-H3 modular
diff --git a/dw/pipeline_processors/h3_hold_steps.py b/dw/pipeline_processors/h3_hold_steps.py
index 2cc19a901..74d912298 100644
--- a/dw/pipeline_processors/h3_hold_steps.py
+++ b/dw/pipeline_processors/h3_hold_steps.py
@@ -16,11 +16,13 @@
 imports back.
 """
 
+import dataclasses
 import logging
 
 import torch
 from diffusers.modular_pipelines.minimax_h3.before_denoise import (
     MiniMaxH3SetTimestepsStep,
+    patchify_video_latents,
 )
 from diffusers.modular_pipelines.minimax_h3.before_encoder import (
     MiniMaxH3Ref2VASetupStep,
@@ -42,9 +44,12 @@
 from .h3_rules import (
     HELD_AUDIO_OUTPUT,
     HELD_AUDIO_RATE_OUTPUT,
+    HELD_LATENTS_OUTPUT,
     HELD_ROWS,
     HOLD_AUDIO_INPUT,
+    REFINE_NOISE,
     REFINE_STRENGTH_INPUT,
+    REFINE_TILES_INPUT,
 )
 
 logger = logging.getLogger("dw")
@@ -154,6 +159,25 @@ def encode_audio_span(encoder, components, waveform, num_latents):
     return fit_latents(latents, num_latents, silence[:, middle : middle + 1])
 
 
+@dataclasses.dataclass
+class EncodedAudioReference(MiniMaxH3AudioReference):
+    """A `hold_audio` reference carrying `latents`, the hold block's own
+    `(channels, num_latents, C)` encode of it from an earlier run on the same
+    target, which the block then writes in place of encoding again. The tiled
+    refine (dw/pipeline_processors/h3_tiles.py) hands every tile after the
+    first one of these, built by `h3_hold.encoded_hold_audio`."""
+
+    latents: torch.Tensor | None = None
+
+    @classmethod
+    def of(cls, reference, latents):
+        fields = {
+            f.name: getattr(reference, f.name) for f in dataclasses.fields(reference)
+        }
+        fields["latents"] = latents
+        return cls(**fields)
+
+
 class DwH3HoldAudioStep(ModularPipelineBlocks):
     model_name = "minimax-h3"
 
@@ -193,6 +217,14 @@ def intermediate_outputs(self):
             OutputParam(HELD_ROWS, type_hint=int),
             OutputParam(HELD_AUDIO_OUTPUT, type_hint=torch.Tensor),
             OutputParam(HELD_AUDIO_RATE_OUTPUT, type_hint=int),
+            OutputParam(
+                HELD_LATENTS_OUTPUT,
+                type_hint=torch.Tensor,
+                description=(
+                    "The encode of the held track, `(channels, num_latents, C)`: handed back through an "
+                    "EncodedAudioReference, the block writes it instead of encoding again."
+                ),
+            ),
         ]
 
     @torch.no_grad()
@@ -201,6 +233,7 @@ def __call__(self, components, state):
         block_state.dw_held_audio_rows = 0
         block_state.dw_held_audio = None
         block_state.dw_held_audio_sampling_rate = None
+        block_state.dw_held_audio_latents = None
         held = block_state.hold_audio
         if held is None:
             self.set_block_state(state, block_state)
@@ -212,13 +245,19 @@ def __call__(self, components, state):
         original = as_channels_samples(held.audio)
         rate = held.sample_rate or vae_rate
 
-        # Onto the VAE's rate and channels the way a Ref2VA reference is, then
-        # padded with silence to the whole target - a short track encodes
-        # with its silence rather than having it appended in latent space
-        waveform = MiniMaxH3Ref2VASetupStep._normalize_audio_condition(
-            original, rate, vae_rate, max_duration=duration
-        )
-        latents = encode_audio_span(self._encoder, components, waveform, num_latents)
+        latents = getattr(held, "latents", None)
+        if latents is None:
+            # Onto the VAE's rate and channels the way a Ref2VA reference is,
+            # then padded with silence to the whole target - a short track
+            # encodes with its silence rather than having it appended in
+            # latent space
+            waveform = MiniMaxH3Ref2VASetupStep._normalize_audio_condition(
+                original, rate, vae_rate, max_duration=duration
+            )
+            latents = encode_audio_span(
+                self._encoder, components, waveform, num_latents
+            )
+        block_state.dw_held_audio_latents = latents
 
         # Channel-major target rows, after any Ref2VA reference rows
         audio_latents = block_state.audio_latents
@@ -269,6 +308,25 @@ def inputs(self):
                     "about 0.2. Runs num_inference_steps - 1 evaluations."
                 ),
             ),
+            InputParam(
+                name=REFINE_TILES_INPUT,
+                type_hint=dict,
+                default=None,
+                description=(
+                    "{width, height, overlap} in pixels: refine a `latents` canvas past H3's own size as "
+                    "overlapping tiles. dw's tiled refine handles it before the call, one call per tile; "
+                    "this block never reads it."
+                ),
+            ),
+            InputParam(
+                name=REFINE_NOISE,
+                type_hint=torch.Tensor,
+                default=None,
+                description=(
+                    "Internal: noise shaped like `latents`, drawn once for the whole canvas and cropped per "
+                    "tile, so tiles that overlap start from the same noise. Used in place of a draw of its own."
+                ),
+            ),
             InputParam(name="num_inference_steps", type_hint=int, default=50),
             InputParam.template("generator"),
             InputParam(name="latents", type_hint=torch.Tensor, required=True),
@@ -341,12 +399,24 @@ def __call__(self, components, state):
         latents = block_state.latents
         start = block_state.num_condition_video_rows or 0
         clean = latents[start:]
-        noise = randn_tensor(
-            clean.shape,
-            generator=block_state.generator,
-            device=clean.device,
-            dtype=clean.dtype,
-        )
+        supplied = getattr(block_state, REFINE_NOISE, None)
+        if supplied is None:
+            noise = randn_tensor(
+                clean.shape,
+                generator=block_state.generator,
+                device=clean.device,
+                dtype=clean.dtype,
+            )
+        else:
+            # Packed the way `latents` reached its rows
+            noise = patchify_video_latents(
+                supplied.to(clean.device, torch.float32), components.patch_size
+            ).to(clean.dtype)
+            if noise.shape != clean.shape:
+                raise ValueError(
+                    f"{REFINE_NOISE} packs to {tuple(noise.shape)}, but the rows "
+                    f"to re-noise are {tuple(clean.shape)}"
+                )
         # The scheduler's own forward process, in H3's t = 1 - σ convention
         block_state.latents = torch.cat(
             [
diff --git a/dw/pipeline_processors/h3_rules.py b/dw/pipeline_processors/h3_rules.py
index 302d3f0b4..2ae21d205 100644
--- a/dw/pipeline_processors/h3_rules.py
+++ b/dw/pipeline_processors/h3_rules.py
@@ -19,6 +19,7 @@
 HELD_ROWS = "dw_held_audio_rows"
 HELD_AUDIO_OUTPUT = "dw_held_audio"
 HELD_AUDIO_RATE_OUTPUT = "dw_held_audio_sampling_rate"
+HELD_LATENTS_OUTPUT = "dw_held_audio_latents"
 
 # The refine call argument
 REFINE_STRENGTH_INPUT = "refine_strength"
@@ -37,11 +38,19 @@
 CORE_DENOISE_SEQUENCES = ("t2va", "fl2va", "ref2va")
 
 
-def refine_problems(arguments):
-    """Why this step's `refine_strength` cannot run, as a list - empty when it
-    can, or cannot be told yet. The one owner of the per-argument rules: the
-    static check (dw/hold_audio.py) and the run-time check before the call
-    (`Pipeline._check_refine`) both ask it."""
+def refine_problems(arguments, canvas=None):
+    """Why this step's `refine_strength` and `refine_tiles` cannot run, as a
+    list - empty when they can, or cannot be told yet. The one owner of the
+    per-argument rules: the static check (dw/hold_audio.py) and the run-time
+    check before the call (`Pipeline._check_refine`) both ask it. A tile
+    problem's message starts with `refine_tiles`. `canvas` is the (width,
+    height) the static check read from the upscale step `latents` names, when
+    it could; at run time the `latents` tensor gives it."""
+    if arguments.get(REFINE_STRENGTH_INPUT) is None:
+        return [
+            "refine_tiles tiles a refine_strength pass, and this step passes no "
+            "refine_strength - add one, about 0.2"
+        ]
     problems = []
     strength = arguments[REFINE_STRENGTH_INPUT]
     if isinstance(strength, str) and references.is_ref(references.UNRESOLVED, strength):
@@ -71,9 +80,215 @@ def refine_problems(arguments):
             f"refine_strength runs num_inference_steps - 1 denoise steps, so "
             f"num_inference_steps must be 2 or more, not {steps}"
         )
+    if arguments.get(REFINE_TILES_INPUT) is not None:
+        problems.extend(_tile_problems(arguments, canvas))
     return problems
 
 
+# refine_tiles (#1043): a refine above H3's 768p canvas, run as overlapping
+# tiles of at most TILE_LIMIT, blended in latent space and decoded once
+REFINE_TILES_INPUT = "refine_tiles"
+# The canvas noise drawn once and cropped per tile, handed to the refine block
+REFINE_NOISE = "dw_refine_noise"
+TILE_LIMIT = (1344, 768)
+TILE_GRID = 32
+TILE_OVERLAP_FLOOR = 192
+# Pixels per latent cell: a `latents` canvas is its latent height x width x 16
+LATENT_SCALE = 16
+# The rate H3 generates video at
+H3_FPS = 24
+
+
+# The arguments that condition a step on a reference, a keyframe or a guide: the
+# tile plan has no place to put one, and each tile would need its own crop
+TILE_CONFLICTS = ("image", "last_image", "references", "guides")
+
+
+def _is_int(value):
+    return isinstance(value, int) and not isinstance(value, bool)
+
+
+def _deferred(value):
+    return isinstance(value, str) and references.is_ref(references.UNRESOLVED, value)
+
+
+def _latent_canvas(arguments, canvas):
+    """The (width, height) of the `latents` canvas, or None when not yet known:
+    the tensor's own at run time, else the one the static check read from the
+    upscale step."""
+    shape = getattr(arguments.get("latents"), "shape", None)
+    if shape is not None and len(shape) >= 2:
+        return int(shape[-1]) * LATENT_SCALE, int(shape[-2]) * LATENT_SCALE
+    return canvas
+
+
+_TILE_KEYS = ("width", "height", "overlap")
+
+
+def _tile_problems(arguments, canvas):
+    """Why this step's `refine_tiles` cannot run - a list, empty when it can."""
+    tiles = arguments[REFINE_TILES_INPUT]
+    if _deferred(tiles):
+        return []
+    if not isinstance(tiles, dict):
+        return [
+            f"refine_tiles is {{width, height, overlap}} in pixels, and "
+            f"{tiles!r} is not a mapping"
+        ]
+    problems, known = _tile_mapping_problems(tiles)
+    width, height, overlap = (known.get(key) for key in _TILE_KEYS)
+    problems += _tile_size_problems(width, height, overlap)
+    problems += _tile_conflict_problems(arguments)
+    problems += _tile_canvas_problems(arguments, canvas, width, height)
+    return problems
+
+
+def _tile_mapping_problems(tiles):
+    """The key and per-value rules of the `refine_tiles` mapping: the problems,
+    and the values that passed, by key."""
+    problems = []
+    missing = [key for key in _TILE_KEYS if key not in tiles]
+    extra = sorted(str(key) for key in tiles if key not in _TILE_KEYS)
+    if missing:
+        problems.append(
+            f"refine_tiles needs width, height and overlap, and is missing "
+            f"{', '.join(missing)}"
+        )
+    if extra:
+        problems.append(
+            f"refine_tiles takes only width, height and overlap, not {', '.join(extra)}"
+        )
+    known = {}
+    for key in _TILE_KEYS:
+        value = tiles.get(key)
+        if key not in tiles or _deferred(value):
+            continue
+        if not _is_int(value):
+            problems.append(
+                f"refine_tiles {key} is an integer number of pixels, and "
+                f"{value!r} is not an integer"
+            )
+        else:
+            known[key] = value
+            if value % TILE_GRID:
+                problems.append(
+                    f"refine_tiles {key} is a multiple of {TILE_GRID} px, and "
+                    f"{value} is not"
+                )
+    return problems, known
+
+
+def _tile_size_problems(width, height, overlap):
+    """The tile against H3's trained canvas, and the overlap against the tile:
+    each value None when not known."""
+    problems = []
+    if width is not None and height is not None:
+        longer, shorter = max(TILE_LIMIT), min(TILE_LIMIT)
+        if not (width <= longer and height <= shorter) and not (
+            width <= shorter and height <= longer
+        ):
+            problems.append(
+                f"refine_tiles tiles are at most {longer}x{shorter} (or "
+                f"{shorter}x{longer}) - H3's trained canvas - and {width}x{height} "
+                f"is larger"
+            )
+        if overlap is not None and overlap >= min(width, height) // 2:
+            problems.append(
+                f"refine_tiles overlap must be under half the tile's shorter side "
+                f"({min(width, height) // 2} px for {width}x{height}), and {overlap} "
+                f"is not"
+            )
+    if overlap is not None and overlap < TILE_OVERLAP_FLOOR:
+        problems.append(
+            f"refine_tiles overlap is at least {TILE_OVERLAP_FLOOR} px, or the seams "
+            f"show, and {overlap} is below it"
+        )
+    return problems
+
+
+def _tile_conflict_problems(arguments):
+    """The arguments a tiled refine cannot be combined with."""
+    problems = []
+    for key in TILE_CONFLICTS:
+        if arguments.get(key) is not None:
+            problems.append(
+                f"refine_tiles refines the 'latents' canvas alone and cannot be "
+                f"combined with '{key}'"
+            )
+    prompt = arguments.get("prompt")
+    if isinstance(prompt, str) and "<Picture" in prompt:
+        problems.append(
+            "refine_tiles refines the 'latents' canvas alone, and the prompt "
+            "names a <Picture N> reference"
+        )
+    return problems
+
+
+def _tile_canvas_problems(arguments, canvas, width, height):
+    """The tile against the canvas it refines, and the step's own width and
+    height against that canvas when the `latents` canvas is known."""
+    problems = []
+    derived = _latent_canvas(arguments, canvas)
+    # With no latents canvas known, the step's own explicit size stands in
+    sizes = derived or tuple(
+        arguments[key] if _is_int(arguments.get(key)) else None
+        for key in ("width", "height")
+    )
+    if any(
+        size is not None and tile is not None and tile > size
+        for size, tile in zip(sizes, (width, height))
+    ):
+        problems.append(
+            f"refine_tiles {width}x{height} is larger than the {sizes[0]}x"
+            f"{sizes[1]} canvas - use a tile inside it"
+        )
+    if derived is not None:
+        for key, size in zip(("width", "height"), derived):
+            value = arguments.get(key)
+            if _is_int(value) and value != size:
+                problems.append(
+                    f"refine_tiles refines the 'latents' canvas, {derived[0]}x"
+                    f"{derived[1]}, and the step's {key} {value} disagrees - drop "
+                    f"it or match the canvas"
+                )
+    return problems
+
+
+def _axis_starts(length, tile, overlap):
+    """The tile origins along one axis: the fewest tiles whose every overlap is
+    at least `overlap`, spread evenly on the TILE_GRID, the last flush to the
+    edge."""
+    if tile >= length:
+        return [0]
+    span = length - tile
+    count = 2 + max(0, -(-span // (tile - overlap)) - 1)
+    while True:
+        starts = [
+            (span * index // (count - 1)) // TILE_GRID * TILE_GRID
+            for index in range(count - 1)
+        ] + [span]
+        if all(
+            tile - (later - earlier) >= overlap
+            for earlier, later in zip(starts, starts[1:])
+        ):
+            return starts
+        count += 1
+
+
+def tile_plan(width, height, tile_width, tile_height, overlap):
+    """The tiles covering a `width` x `height` canvas, as (x, y, w, h) in
+    pixels, row-major: per axis the fewest tiles whose overlap is at least
+    `overlap`, spread evenly on the 32 px grid, the last flush to the edge.
+    1920x1088 at 1344x768/256 is 2x2. A pure function - the run and its
+    tests both ask it."""
+    tile_width, tile_height = min(tile_width, width), min(tile_height, height)
+    return [
+        (x, y, tile_width, tile_height)
+        for y in _axis_starts(height, tile_height, overlap)
+        for x in _axis_starts(width, tile_width, overlap)
+    ]
+
+
 def not_h3(pipeline, argument=HOLD_AUDIO_INPUT):
     """Why this step's pipeline cannot take `argument` - one of the H3 block
     arguments - or None when it can or cannot be told before the load."""
diff --git a/dw/pipeline_processors/h3_tiles.py b/dw/pipeline_processors/h3_tiles.py
new file mode 100644
index 000000000..1dff373bd
--- /dev/null
+++ b/dw/pipeline_processors/h3_tiles.py
@@ -0,0 +1,366 @@
+"""MiniMax-H3 tiled refine (#1043): `refine_tiles` on a `refine_strength` step.
+
+A refine canvas can be bigger than H3 can denoise in one call - 1920x1088
+against a 1344x768 limit. The step therefore refines it as overlapping tiles
+(`h3_rules.tile_plan`), each a normal call of the pipeline on a crop of
+`latents`, then blends the denoised tiles in latent space and decodes the
+canvas once.
+
+Four things make the seams disappear, and each is here:
+
+- The noise is drawn once for the whole canvas from the step's own generator
+  and cropped per tile (`canvas_noise`, `crop`), handed to the refine block as
+  `dw_refine_noise`. Two tiles start from identical noise where they overlap,
+  so what they denoise differs only by what each one can see.
+- Each tile runs the graph with every decode block removed
+  (`decode_free_blocks`), so what comes back is the denoised latents, never
+  pixels: pixels would blend visibly, latents blend before the one decode.
+  The prompt is encoded once, by the graph's `text_encoder` alone, and every
+  tile is handed the embeddings.
+- The blend is a linear feather across each overlap (`feather_weights`), the
+  way the VAE's own `_blend` joins its tiles, accumulated and divided by the
+  weight sum so it normalizes to 1 everywhere.
+- The canvas decodes once, through the loaded pipeline's own video decode
+  block - the same colours and VAE a plain call has, whose spatial tiling is
+  on by default.
+
+The held soundtrack is the hold block's own output, taken from the first tile:
+every tile holds the same track, and none of them decodes audio. The track is
+encoded once, too: the first tile is asked for the block's encode of it
+(`h3_hold.HELD_LATENTS_OUTPUT`) and every later tile is handed a `hold_audio`
+carrying it (`h3_hold.encoded_hold_audio`), which the block writes in place of
+running the audio VAE again - the per-tile call still runs every non-decode
+block, so the hold is hoisted through the block rather than around it.
+
+Imports diffusers only inside the functions that need it, like the rest of the
+H3 modules, so validation never loads a modular pipeline.
+"""
+
+import contextlib
+
+import torch
+
+from ..events import emit_log, emit_phase, get_context
+from ..media_types import rated_videos
+from .h3_hold import encoded_hold_audio
+from .h3_rules import HELD_LATENTS_OUTPUT
+from .h3_rules import (
+    HELD_AUDIO_OUTPUT,
+    HELD_AUDIO_RATE_OUTPUT,
+    HOLD_AUDIO_INPUT,
+    H3_FPS,
+    LATENT_SCALE,
+    REFINE_NOISE,
+    REFINE_TILES_INPUT,
+    tile_plan,
+)
+from .progress import decoded_later, reported_blocks
+
+TEXT_BLOCK = "text_encoder"
+TEXT_OUTPUTS = ["prompt_embeds", "text_token_tags"]
+TILE_BLOCKS = "_dw_tile_blocks"
+TEXT_BLOCKS = "_dw_text_blocks"
+VIDEO_DECODE = "_dw_video_decode"
+
+
+def _is_decode(name):
+    return name == "decode" or name.startswith("decode.")
+
+
+def _find_video_decode(block):
+    """The MiniMaxH3VideoDecodeStep somewhere under `block`, or None."""
+    from diffusers.modular_pipelines.minimax_h3.decoders import (
+        MiniMaxH3VideoDecodeStep,
+    )
+
+    if isinstance(block, MiniMaxH3VideoDecodeStep):
+        return block
+    for child in (getattr(block, "sub_blocks", None) or {}).values():
+        found = _find_video_decode(child)
+        if found is not None:
+            return found
+    return None
+
+
+def decode_free_blocks(pipeline):
+    """`(tile_blocks, text_blocks, video_decode)` built from a pipeline's own
+    graph, sharing its block instances so dw's hold, refine and release blocks
+    stay in; (None, None, None) when there is no decode block to drop or no
+    video decoder among them.
+
+    `tile_blocks` is the graph with every top-level decode block removed, and
+    the text encoder too when it has one - a tile takes `prompt_embeds`
+    instead. `text_blocks` is that encoder alone, run once.
+    """
+    from diffusers.modular_pipelines import SequentialPipelineBlocks
+
+    blocks = getattr(pipeline, "_blocks", None)
+    sub_blocks = getattr(blocks, "sub_blocks", None)
+    if not hasattr(sub_blocks, "items"):
+        return None, None, None
+    dropped = {name: block for name, block in sub_blocks.items() if _is_decode(name)}
+    decoder = next(
+        (found for found in map(_find_video_decode, dropped.values()) if found),
+        None,
+    )
+    if decoder is None:
+        return None, None, None
+    text = sub_blocks.get(TEXT_BLOCK)
+    kept = {
+        name: block
+        for name, block in sub_blocks.items()
+        if name not in dropped and name != TEXT_BLOCK
+    }
+    tile_blocks = SequentialPipelineBlocks.from_blocks_dict(kept)
+    text_blocks = (
+        None
+        if text is None
+        else SequentialPipelineBlocks.from_blocks_dict({TEXT_BLOCK: text})
+    )
+    return tile_blocks, text_blocks, decoder
+
+
+def _input_names(blocks):
+    return {param.name for param in blocks.inputs}
+
+
+def attach_tile_blocks(pipeline):
+    """Build the tiled-refine variants and keep them on the pipeline (None for
+    a graph that cannot run tiled)."""
+    tile_blocks, text_blocks, decoder = decode_free_blocks(pipeline)
+    setattr(pipeline, TILE_BLOCKS, tile_blocks)
+    setattr(pipeline, TEXT_BLOCKS, text_blocks)
+    setattr(pipeline, VIDEO_DECODE, decoder)
+
+
+def _axis_ramps(spans, scale):
+    """Per tile along one axis, `(before, after)` overlaps with its neighbours
+    in latent cells - the span is `(start, length)` in pixels, sorted by start."""
+    ramps = {}
+    for index, (start, length) in enumerate(spans):
+        before = after = 0
+        if index > 0:
+            earlier = spans[index - 1]
+            before = max(0, earlier[0] + earlier[1] - start) // scale
+        if index + 1 < len(spans):
+            after = max(0, start + length - spans[index + 1][0]) // scale
+        ramps[(start, length)] = (before, after)
+    return ramps
+
+
+def _axis_weights(length, before, after):
+    """`length` cell weights: rising over `before` cells, falling over `after`,
+    1 between. A ramp of n cells runs (1..n)/(n+1), so no cell is 0 and the
+    rise of one tile and the fall of its neighbour sum to 1."""
+    weights = torch.ones(length, dtype=torch.float32)
+    if before:
+        weights[:before] *= (torch.arange(before, dtype=torch.float32) + 1) / (
+            before + 1
+        )
+    if after:
+        weights[length - after :] *= torch.arange(after, 0, -1, dtype=torch.float32) / (
+            after + 1
+        )
+    return weights
+
+
+def feather_weights(plan, tile, scale=LATENT_SCALE):
+    """The `(h, w)` latent-cell weights of one tile of `plan` (x, y, w, h in
+    pixels): a separable ramp rising linearly over the overlap it shares with a
+    neighbour on each side, 1 elsewhere and on the canvas edges."""
+    x, y, width, height = tile
+    columns = _axis_ramps(sorted({(px, pw) for px, _, pw, _ in plan}), scale)
+    rows = _axis_ramps(sorted({(py, ph) for _, py, _, ph in plan}), scale)
+    left, right = columns[(x, width)]
+    top, bottom = rows[(y, height)]
+    return (
+        _axis_weights(height // scale, top, bottom)[:, None]
+        * _axis_weights(width // scale, left, right)[None, :]
+    )
+
+
+def canvas_noise(latents, generator):
+    """Float32 noise shaped like the whole `latents` canvas, drawn once."""
+    from diffusers.utils.torch_utils import randn_tensor
+
+    return randn_tensor(
+        latents.shape,
+        generator=generator,
+        device=latents.device,
+        dtype=torch.float32,
+    )
+
+
+def crop(canvas, tile, scale=LATENT_SCALE):
+    """The `(x, y, w, h)` pixel tile of a `(..., H, W)` latent canvas."""
+    x, y, width, height = tile
+    return canvas[
+        ..., y // scale : (y + height) // scale, x // scale : (x + width) // scale
+    ]
+
+
+def blend(tiles, plan, shape):
+    """The latent canvas of `shape` from denoised `tiles` (one tensor per entry
+    of `plan`): each weighted by its feather, summed, divided by the weights'
+    sum. Float32 on the CPU, whatever the tiles came in on.
+
+    Raises:
+        ValueError: If a pixel of the canvas is in no tile
+    """
+    total = torch.zeros(shape, dtype=torch.float32)
+    weight_sum = torch.zeros(shape[-2:], dtype=torch.float32)
+    for tile, latents in zip(plan, tiles):
+        weights = feather_weights(plan, tile)
+        x, y, width, height = tile
+        rows = slice(y // LATENT_SCALE, (y + height) // LATENT_SCALE)
+        columns = slice(x // LATENT_SCALE, (x + width) // LATENT_SCALE)
+        total[..., rows, columns] += latents.detach().float().cpu() * weights
+        weight_sum[rows, columns] += weights
+    if bool((weight_sum <= 0).any()):
+        raise ValueError("refine_tiles leaves part of the canvas uncovered")
+    return total / weight_sum
+
+
+@contextlib.contextmanager
+def swapped_blocks(pipeline, blocks):
+    """Run `pipeline` on `blocks` for the duration, restoring its own."""
+    original = pipeline._blocks
+    pipeline._blocks = blocks
+    try:
+        yield
+    finally:
+        pipeline._blocks = original
+
+
+def decode_canvas(pipeline, canvas):
+    """Frames of a latent canvas, decoded once by the pipeline's own video
+    decode block, as the one-video list a plain call's `videos` is."""
+    from diffusers.modular_pipelines.modular_pipeline import PipelineState
+
+    state = PipelineState()
+    state.set(
+        "latents",
+        canvas.to(device=pipeline._execution_device, dtype=torch.float32),
+    )
+    state.set("output_type", "pil")
+    getattr(pipeline, VIDEO_DECODE)(pipeline, state)
+    return state.get("videos")
+
+
+def _refine_tiles(pipeline, arguments, plan, noise, label):
+    """One call of `pipeline` (its tile blocks in place) per tile of `plan`:
+    `(tiles, held)`, the denoised latents in plan order and the held-audio
+    outputs of the first tile. The first tile is asked for the hold block's
+    encode of the track as well, and every later tile is handed a `hold_audio`
+    carrying it, so the audio VAE encodes the track once per refine."""
+    context = get_context()
+    latents = arguments["latents"]
+    holding = arguments.get(HOLD_AUDIO_INPUT) is not None
+    tiles, held = [], {}
+    for index, tile in enumerate(plan):
+        context.check_cancelled()
+        x, y, width, height = tile
+        emit_log(
+            f"Refining tile {index + 1}/{len(plan)} ({x},{y} {width}x{height})",
+            tile=index + 1,
+            tiles=len(plan),
+            x=x,
+            y=y,
+            width=width,
+            height=height,
+        )
+        names = ["latents"]
+        if index == 0:
+            names += [HELD_AUDIO_OUTPUT, HELD_AUDIO_RATE_OUTPUT]
+            if holding:
+                names.append(HELD_LATENTS_OUTPUT)
+        with reported_blocks(pipeline, f"{label} tile {index + 1}/{len(plan)}"):
+            result = pipeline(
+                **{
+                    **arguments,
+                    "width": width,
+                    "height": height,
+                    "latents": crop(latents, tile),
+                    REFINE_NOISE: crop(noise, tile),
+                    "output": names,
+                }
+            )
+        tiles.append(result["latents"])
+        if index == 0:
+            held = {k: result.get(k) for k in names[1:3]}
+            encoded = result.get(HELD_LATENTS_OUTPUT)
+            if holding and encoded is not None:
+                arguments = {
+                    **arguments,
+                    HOLD_AUDIO_INPUT: encoded_hold_audio(
+                        arguments[HOLD_AUDIO_INPUT], encoded
+                    ),
+                }
+    return tiles, held
+
+
+def run_tiled_refine(pipeline, arguments, label, decode=None):
+    """Refine `arguments["latents"]` as the tiles of `arguments["refine_tiles"]`
+    and return what a plain call returns for the step's `output`: a dict of
+    `videos`, `latents` (the blended canvas, 5D on the CPU) and the held audio
+    keys, narrowed to the names `output` lists (all of them when it lists none,
+    a bare value when it is one name).
+
+    Args:
+        pipeline: The loaded H3 modular pipeline
+        arguments: The step's call arguments, `refine_tiles` and `latents` among them
+        label: What the progress narration calls the step
+        decode: `decode(canvas) -> videos`, the pipeline's own decode when None
+
+    Raises:
+        ValueError: If the pipeline's graph cannot drop its decode blocks
+    """
+    tile_blocks = getattr(pipeline, TILE_BLOCKS, None)
+    if tile_blocks is None:
+        raise ValueError(
+            f"{REFINE_TILES_INPUT} needs a MiniMax-H3 graph with a decode "
+            f"block to leave out, and {type(pipeline).__name__} has none"
+        )
+    settings = arguments[REFINE_TILES_INPUT]
+    arguments = {k: v for k, v in arguments.items() if k != REFINE_TILES_INPUT}
+    latents = arguments["latents"]
+    canvas_width = latents.shape[-1] * LATENT_SCALE
+    canvas_height = latents.shape[-2] * LATENT_SCALE
+    plan = tile_plan(
+        canvas_width,
+        canvas_height,
+        settings["width"],
+        settings["height"],
+        settings["overlap"],
+    )
+    requested = arguments.pop("output", None)
+    noise = canvas_noise(latents, arguments.get("generator"))
+
+    text_blocks = getattr(pipeline, TEXT_BLOCKS, None)
+    if text_blocks is not None:
+        takes = _input_names(text_blocks)
+        with swapped_blocks(pipeline, text_blocks):
+            encoded = pipeline(
+                **{k: v for k, v in arguments.items() if k in takes},
+                output=TEXT_OUTPUTS,
+            )
+        # What the tiles take instead of the prompt itself
+        kept = _input_names(tile_blocks)
+        arguments = {k: v for k, v in arguments.items() if k not in takes or k in kept}
+        arguments.update(encoded)
+
+    with swapped_blocks(pipeline, tile_blocks), decoded_later():
+        tiles, held = _refine_tiles(pipeline, arguments, plan, noise, label)
+
+    canvas = blend(tiles, plan, tuple(latents.shape))
+    emit_phase("decoding")
+    videos = (decode or (lambda value: decode_canvas(pipeline, value)))(canvas)
+    # Bare frame lists carry no rate, and pair_audio or the writer would play
+    # them at 8 fps: say they are H3's 24
+    videos = rated_videos(videos, H3_FPS)
+    outputs = {"videos": videos, "latents": canvas, **held}
+    if requested is None:
+        return outputs
+    if isinstance(requested, str):
+        return outputs.get(requested)
+    return {name: outputs[name] for name in requested if name in outputs}
diff --git a/dw/pipeline_processors/mag_calibration.py b/dw/pipeline_processors/mag_calibration.py
new file mode 100644
index 000000000..e5a6080bd
--- /dev/null
+++ b/dw/pipeline_processors/mag_calibration.py
@@ -0,0 +1,158 @@
+"""The cache hooks' denoiser and MagCache calibration capture.
+
+`get_cache_transformer` names the component a cache hook attaches to, and
+`captured_mag_calibration` turns diffusers' end-of-run calibration log record
+into job events (#891), `_report_unfinished_mag_calibration` the ratios a call
+that ran fewer forwards than its schedule left behind (#927). Imported by
+dw/pipeline_processors/components.py, which re-exports the two public names for
+dw/pipeline_processors/pipeline.py, and never imports it back.
+"""
+
+import ast
+import contextlib
+import logging
+
+from ..events import emit_log, emit_warning
+
+
+def get_cache_transformer(pipeline):
+    """Find the denoiser a cache hook attaches to.
+
+    Most pipelines register theirs as 'transformer', but a modular pipeline names
+    it after the workflow it serves - MiniMax-H3's ref2va denoises through
+    'transformer_ref'. Looking only for 'transformer' silently skips caching on
+    those, so try the alternates diffusers' modular pipelines actually use.
+
+    Args:
+        pipeline: The loaded diffusers pipeline
+
+    Returns:
+        The transformer component, or None when the pipeline has none
+    """
+    for name in ("transformer", "transformer_ref"):
+        transformer = getattr(pipeline, name, None)
+        if transformer is not None:
+            return transformer
+    return None
+
+
+_MAG_LOGGER = "diffusers.hooks.mag_cache"
+_MAG_RESULT_PREFIX = "MagCache Calibration Results:"
+
+
+def _active_cache_context_name(transformer):
+    """The name of the cache context a stateful hook under the transformer is
+    running in, or None. Under CFG that is "cond" or "uncond"."""
+    for module in transformer.modules():
+        registry = getattr(module, "_diffusers_hook", None)
+        for hook in getattr(registry, "hooks", {}).values():
+            for attr in vars(hook).values():
+                context = getattr(attr, "_context", None)
+                if context is not None and hasattr(attr, "get_state"):
+                    return context.name
+    return None
+
+
+class _MagCalibrationHandler(logging.Handler):
+    """Turns diffusers' end-of-run calibration log record into job events.
+
+    diffusers prints the ratios, logs them at INFO and clears the list in the
+    same call (`MagCacheHook._advance_step`), so the record is the only moment
+    they can be read, and the worker's stdout reaches no consumer. The record
+    is emitted synchronously from inside the forward, so the state manager's
+    context is still the one the ratios belong to.
+    """
+
+    def __init__(self, transformer):
+        super().__init__(level=logging.INFO)
+        self.transformer = transformer
+
+    def emit(self, record):
+        message = record.getMessage()
+        if not message.startswith(_MAG_RESULT_PREFIX):
+            return
+        try:
+            ratios = ast.literal_eval(message[len(_MAG_RESULT_PREFIX) :].strip())
+            context = _active_cache_context_name(self.transformer)
+        except (ValueError, SyntaxError):
+            return
+        _report_mag_ratios(ratios, context)
+
+
+def _report_mag_ratios(ratios, context):
+    label = f" [{context}]" if context in ("cond", "uncond") else ""
+    text = (
+        f"MagCache calibration ({len(ratios)} steps){label}: "
+        f"{ratios} \u2014 paste into mag_ratios"
+    )
+    if context == "cond":
+        text += " (classifier-free guidance runs two lists; the cond one is the usual choice)"
+    emit_log(text)
+    emit_warning(text)
+
+
+def _report_unfinished_mag_calibration(transformer):
+    """Report the ratios a calibrating call left in its mag state (#927).
+
+    diffusers logs a calibration only when its step counter reaches the
+    config's num_inference_steps, and a scheduler can run fewer forwards than
+    that: MiniMax-H3's turns N sigmas into N - 1 evaluations. Such a call ends
+    with its ratios still in the state, which the call's reset then drops. A
+    call that did finish has nothing left here - diffusers clears the list
+    when it logs - so nothing is reported twice.
+    """
+    if not getattr(getattr(transformer, "_cache_config", None), "calibrate", False):
+        return
+    from diffusers.hooks.mag_cache import MagCacheBlockHook
+
+    for module in transformer.modules():
+        registry = getattr(module, "_diffusers_hook", None)
+        for hook in getattr(registry, "hooks", {}).values():
+            if isinstance(hook, MagCacheBlockHook) and hook.is_tail:
+                for name, state in hook.state_manager._state_cache.items():
+                    if state.calibration_ratios:
+                        _report_mag_ratios(list(state.calibration_ratios), name)
+                return
+
+
+@contextlib.contextmanager
+def captured_mag_calibration(pipeline, arguments=None):
+    """Report a mag cache's calibration ratios as job events (#891).
+
+    A no-op unless the transformer's cache is a MagCacheConfig with calibrate
+    on. Under classifier-free guidance dw's pipelines run "cond" and "uncond"
+    contexts, each with its own state, so two labeled lists are emitted.
+
+    diffusers only finishes (and logs) a calibration once its step counter
+    reaches the config's `num_inference_steps`, which defaults to 28. A run of
+    any other length would end without a record, so for the call the config
+    counts the steps the call actually runs.
+    """
+    transformer = get_cache_transformer(pipeline)
+    config = getattr(transformer, "_cache_config", None)
+    if not getattr(config, "calibrate", False):
+        yield
+        return
+
+    steps = (arguments or {}).get("num_inference_steps")
+    declared_steps = config.num_inference_steps
+    if isinstance(steps, int) and steps != declared_steps:
+        emit_warning(
+            f"MagCache calibration: the cache declares num_inference_steps "
+            f"{declared_steps} but this step runs {steps}; calibrating over {steps}"
+        )
+        config.num_inference_steps = steps
+
+    mag_logger = logging.getLogger(_MAG_LOGGER)
+    handler = _MagCalibrationHandler(transformer)
+    old_level, old_propagate = mag_logger.level, mag_logger.propagate
+    mag_logger.addHandler(handler)
+    mag_logger.setLevel(logging.INFO)
+    mag_logger.propagate = False
+    try:
+        yield
+    finally:
+        config.num_inference_steps = declared_steps
+        mag_logger.removeHandler(handler)
+        mag_logger.setLevel(old_level)
+        mag_logger.propagate = old_propagate
diff --git a/dw/pipeline_processors/pipeline.py b/dw/pipeline_processors/pipeline.py
index d821f2334..a83e6e49a 100644
--- a/dw/pipeline_processors/pipeline.py
+++ b/dw/pipeline_processors/pipeline.py
@@ -41,8 +41,10 @@
     HELD_AUDIO_RATE_OUTPUT,
     HOLD_AUDIO_INPUT,
     REFINE_STRENGTH_INPUT,
+    REFINE_TILES_INPUT,
     refine_problems,
 )
+from .h3_tiles import run_tiled_refine
 from .progress import reported_blocks, reported_progress_bars
 from .timing import denoise_start_hook, is_compiled, mark
 from .remote import remote_text_encoder
@@ -59,6 +61,7 @@
 
 from ..events import WorkflowCancelled, emit_log, emit_phase, emit_warning, get_context
 from ..media_types import AudioVideo
+from ..output_extraction import attach_video_frame_rate
 from ..step_cache import component_names, copy_containers
 from ..sparse_attention import (
     SPARSE_BACKEND,
@@ -625,6 +628,9 @@ def _run_once(self, arguments):
             output = output.to("cpu")
 
         attach_audio_sample_rate(self.pipeline, output)
+        output = attach_video_frame_rate(
+            self.pipeline, output, requested=arguments.get("output")
+        )
         warn_if_safety_checker_blanked(output)
 
         return output
@@ -682,7 +688,12 @@ def _call_pipeline(self, arguments, attn_backend):
                 )
 
             try:
-                output = self.pipeline(**arguments)
+                if arguments.get(REFINE_TILES_INPUT) is not None:
+                    output = run_tiled_refine(
+                        self.pipeline, arguments, self.segment_label or self.name
+                    )
+                else:
+                    output = self.pipeline(**arguments)
             except IndexError as e:
                 cache = self.configuration.get("cache")
                 if (
@@ -783,9 +794,12 @@ def _check_refine(self, arguments):
                 is out of range, or the step passes no `latents` or `hold_audio`
         """
         strength = arguments.get(REFINE_STRENGTH_INPUT)
-        if strength is None:
+        if strength is None and arguments.get(REFINE_TILES_INPUT) is None:
             return
-        where = f"Step '{self.name}': refine_strength"
+        where = (
+            f"Step '{self.name}': "
+            f"{REFINE_STRENGTH_INPUT if strength is not None else REFINE_TILES_INPUT}"
+        )
         if not refines(self.pipeline):
             raise ValueError(
                 f"{where} is a MiniMax-H3 argument (t2va, fl2va or ref2va), and "
diff --git a/dw/pipeline_processors/progress.py b/dw/pipeline_processors/progress.py
index 4965444bf..7ce12caff 100644
--- a/dw/pipeline_processors/progress.py
+++ b/dw/pipeline_processors/progress.py
@@ -1,11 +1,27 @@
 import torch
 import contextlib
+import contextvars
 import logging
 from ..events import WorkflowCancelled, emit_phase, get_context
 from .timing import mark
 
 logger = logging.getLogger("dw")
 
+# Whether a denoise loop finishing means the decode comes next. Not for a
+# tiled refine's tiles, which leave the decode for once all are blended
+_DECODE_FOLLOWS = contextvars.ContextVar("dw_decode_follows", default=True)
+
+
+@contextlib.contextmanager
+def decoded_later():
+    """Denoise loops run inside this are not followed by a decode, so their
+    last step reports no 'decoding' phase - the caller emits the one that is."""
+    token = _DECODE_FOLLOWS.set(False)
+    try:
+        yield
+    finally:
+        _DECODE_FOLLOWS.reset(token)
+
 
 class _ReportingProgressBar:
     """A tqdm bar that also reports each advance to the active run.
@@ -110,7 +126,12 @@ def on_advance(done, total):
         run_context.emit("pipeline_step", step=done, total_steps=total)
         # Past the last step there is still the decode, which on video is
         # minutes with the bar sitting at 100%
-        if done is not None and total is not None and done >= total:
+        if (
+            done is not None
+            and total is not None
+            and done >= total
+            and _DECODE_FOLLOWS.get()
+        ):
             emit_phase("decoding")
         # The one cancellation checkpoint inside a modular denoise loop:
         # without it a cancel waits out the whole generation
diff --git a/dw/plan.py b/dw/plan.py
index c01eac7be..055649231 100644
--- a/dw/plan.py
+++ b/dw/plan.py
@@ -19,10 +19,6 @@
 import logging
 import os
 
-from huggingface_hub import model_info
-from huggingface_hub import get_hf_file_metadata, hf_hub_url
-from huggingface_hub.utils import GatedRepoError, HFValidationError, validate_repo_id
-
 from .cost_scaling import (
     CATALOG,
     DERIVED,
@@ -36,10 +32,13 @@
     _scaled,
 )
 from .elision import elide_definition
-from .hub_cache import repo_download_incomplete, scan_models
 from . import references
+from .plan_downloads import _sub_workflow_paths, downloads_required
+
+# Re-exported: dw/server/routes/jobs.py and the tests read the plan's gate
+# warnings from here, beside build_plan
+from .plan_downloads import gate_warnings as gate_warnings
 from .realize import read_sub_workflow, realize_workflow
-from .security import validate_url
 from .validation import _is_seeded
 from .variables import same_number
 
@@ -67,8 +66,6 @@
 # republishes the cached files verbatim and writes none (dw/step_cache.py)
 PLACEMENT_RESULT_KEYS = ("file_base_name", "role", "subfolder")
 FOR_EACH_KEY = "for_each"
-SIZE_LOOKUP_TIMEOUT = 5.0
-GIB = 1024**3
 
 
 def build_plan(
@@ -708,9 +705,32 @@ def estimate(
         # say which template and why, so it reads differently from no history
         result["inherited_from"] = observed.get("inherited_from")
         result["withheld"] = withheld
+    elif result["basis"] == UNKNOWN and result["minutes"] is None:
+        reason = _unpriced_reason(definition)
+        if reason:
+            result["unpriced_reason"] = reason
     return result
 
 
+def _unpriced_reason(definition):
+    """Why a workflow with no price at all has none, or None when the cause
+    is not a shape this can name (#948). #797 prices an inline workflow from
+    the catalog template with the same pipeline identity, so a workflow of
+    task steps alone has nothing to match and its cost is simply unmeasured -
+    which says nothing about whether the run is seconds or an hour."""
+    steps = [s for s in definition.get("steps") or [] if isinstance(s, dict)]
+    tasks = [s for s in steps if isinstance(s.get("task"), dict)]
+    if not tasks or len(tasks) != len(steps):
+        return None
+    commands = sorted({str(s["task"].get("command", "unknown")) for s in tasks})
+    return (
+        "task-only workflow (" + ", ".join(commands) + "): no pipeline step "
+        "to inherit a price from a catalog template, no cost block and no "
+        "run history of its own. The run's length depends on its input "
+        "media, which nothing here measures"
+    )
+
+
 def _observed(observed, device):
     """This box's history as an estimate, or None when it has nothing to
     quote from.
@@ -757,19 +777,6 @@ def _observed(observed, device):
     return estimate
 
 
-def _sub_workflow_paths(expanded):
-    """The local (non-builtin) sub-workflow path and composing arguments of
-    every composing step, as (path, arguments) - `expanded` has already
-    substituted and expanded `for_each`, so each occurrence carries the
-    concrete arguments that step actually passes the child (#341)."""
-    for step in expanded.get("steps") or []:
-        reference = step.get("workflow") if isinstance(step, dict) else None
-        path = reference.get("path") if isinstance(reference, dict) else None
-        if isinstance(path, str) and not references.is_ref(references.BUILTIN, path):
-            arguments = reference.get("arguments")
-            yield path, arguments if isinstance(arguments, dict) else {}
-
-
 def _only_composes_children(definition):
     """Whether every step the workflow *declares* is a `workflow` step -
     i.e. the parent does no work of its own beyond assembling children.
@@ -860,187 +867,3 @@ def _repriced(minutes, list_entries, measured_entries):
     if measured_with <= 0:
         return None, UNKNOWN
     return minutes * count / measured_with, DERIVED
-
-
-FROM_PRETRAINED_KEY = "from_pretrained_arguments"
-MODEL_NAME_KEY = "model_name"
-# An adapter names its repo directly, not through from_pretrained_arguments
-LORAS_KEY = "loras"
-SINGLE_FILE_KEY = "from_single_file"
-VARIANT_KEY = "variant"
-
-
-def downloads_required(expanded, base_dir, workflow_dir, cache_dir, lookup_sizes):
-    """The hub repos and checkpoint URLs the run would fetch before its
-    first step: every `model_name` in the expanded definition (and in each
-    composed child) that `scan_models` does not find, plus every one it does
-    find but whose cached copy is left over from an interrupted pull
-    (#382) - a component the load needs is missing, or a blob is still
-    `.incomplete` - plus every `from_single_file` that is a URL. Sizes come
-    from the hub when asked and are None whenever it does not answer - an
-    offline box is a state, not an error, so nothing here raises or logs
-    above debug.
-    """
-    names = []
-    variants = {}
-    urls = []
-    _collect_sources(expanded, names, variants, urls)
-    for path, _arguments in _sub_workflow_paths(expanded):
-        raw = read_sub_workflow(path, base_dir, workflow_dir)
-        if raw is None:
-            continue
-        try:
-            _collect_sources(json.loads(raw), names, variants, urls)
-        except ValueError:
-            continue
-    present = {repo.get("repo_id") for repo in scan_models(cache_dir).get("repos", [])}
-    required = []
-    for name in names:
-        # A name not shaped like a hub id is a local checkout - decided by
-        # shape, never by touching the disk: the name came from the request
-        # body, and a free pre-flight must not be a directory-existence oracle
-        if not _is_repo_id(name):
-            continue
-        if name in present and not repo_download_incomplete(
-            name, cache_dir, variant=variants.get(name)
-        ):
-            continue
-        entry = {"repo": name, "gb": None, "gated": None, "access_blocked": None}
-        if lookup_sizes:
-            entry["gb"], entry["gated"], entry["access_blocked"] = _model_info(name)
-        required.append(entry)
-    for url in urls:
-        required.append(
-            {
-                "repo": None,
-                "url": url,
-                "gb": None,
-                "gated": None,
-                "access_blocked": None,
-            }
-        )
-    return required
-
-
-def _collect_sources(tree, names, variants, urls):
-    """Every from_pretrained source in a tree, first-seen order, deduplicated.
-    `variants` collects each name's requested `variant` (first-seen), used to
-    tell a repo that is merely missing its fp16 files from one that is fully
-    cached without them.
-
-    A `loras` entry counts too. It carries its repo under `model_name`
-    directly rather than inside a `from_pretrained_arguments` block, so the
-    walk missed it: `templates/ltx2/reference-sheet` on a box that had
-    every base weight but not the IC-LoRA answered `downloads_required:
-    []` and then pulled it mid-run, which is the one question the field
-    exists to answer (found verifying #151).
-    """
-    if isinstance(tree, dict):
-        for lora in tree.get(LORAS_KEY) or []:
-            name = lora.get(MODEL_NAME_KEY) if isinstance(lora, dict) else None
-            if isinstance(name, str) and name not in names:
-                names.append(name)
-        source = tree.get(FROM_PRETRAINED_KEY)
-        if isinstance(source, dict):
-            name = source.get(MODEL_NAME_KEY)
-            if isinstance(name, str) and name not in names:
-                names.append(name)
-                variant = source.get(VARIANT_KEY)
-                if isinstance(variant, str):
-                    variants[name] = variant
-            single = source.get(SINGLE_FILE_KEY)
-            if isinstance(single, str) and _is_url(single) and single not in urls:
-                urls.append(single)
-        for value in tree.values():
-            _collect_sources(value, names, variants, urls)
-    elif isinstance(tree, list):
-        for value in tree:
-            _collect_sources(value, names, variants, urls)
-
-
-def gate_warnings(downloads_required):
-    """One line per required download this box's token is blocked from -
-    the pre-flight signal #186 asked for, so a gated repo is a
-    `validate_workflow`-visible condition rather than a 403 the run only
-    discovers after it has loaded everything ahead of that step."""
-    return [
-        f"{entry['repo']} is gated and not accessible with this box's "
-        "Hugging Face token - accept its license at "
-        f"https://huggingface.co/{entry['repo']} before running this workflow"
-        for entry in downloads_required
-        if entry.get("access_blocked")
-    ]
-
-
-def _is_repo_id(name):
-    try:
-        validate_repo_id(name)
-        return True
-    except HFValidationError:
-        return False
-
-
-def _is_url(value):
-    if not value.startswith(("http://", "https://")):
-        return False
-    try:
-        validate_url(value)
-        return True
-    except Exception:
-        return False
-
-
-def _model_info(name):
-    """A repo's size in GiB, gate status, and whether this box's token is
-    blocked from it - a `(gb, gated, access_blocked)` triple.
-
-    `gated` is `model_info`'s own field (`False` / `"auto"` / `"manual"`),
-    readable only when the call succeeds - and the hub answers `model_info`
-    for a gated repo regardless of whether this token has been granted
-    access, since that call serves metadata rather than file bytes (found
-    verifying #186: `access_blocked` came back `false` for repos this box's
-    token was actually refused on). A `GatedRepoError` straight out of
-    `model_info` is still a real signal - some other endpoint behind it
-    checked and refused - but its absence proves nothing, so a `gated` repo
-    that got this far is checked for real with a HEAD request against one of
-    its own files (`_probe_gate_blocked`), the same request class a run's
-    actual load would make and the one place the hub's 403 for "gated, token
-    not accepted" actually appears.
-    """
-    try:
-        info = model_info(name, files_metadata=True, timeout=SIZE_LOOKUP_TIMEOUT)
-    except GatedRepoError as e:
-        logger.debug(f"Gate not accepted for {name}: {e}")
-        return None, True, True
-    except Exception as e:
-        logger.debug(f"No size for {name}: {e}")
-        return None, None, None
-    total = sum(s.size for s in (info.siblings or []) if getattr(s, "size", None))
-    gb = round(total / GIB, 1) if total else None
-    gated = getattr(info, "gated", False) or False
-    access_blocked = False
-    if gated:
-        access_blocked = _probe_gate_blocked(name, info.siblings or [])
-    return gb, gated, access_blocked
-
-
-def _probe_gate_blocked(name, siblings):
-    """HEAD one real file of a gated repo to see whether this box's token is
-    actually accepted - `model_info` succeeding says nothing either way
-    (#186). `None` when there is no file to probe or the probe fails for a
-    reason other than the gate, since that is "unknown", not "not blocked".
-    """
-    filename = next(
-        (s.rfilename for s in siblings if getattr(s, "rfilename", None)), None
-    )
-    if filename is None:
-        return None
-    try:
-        get_hf_file_metadata(hf_hub_url(name, filename), timeout=SIZE_LOOKUP_TIMEOUT)
-        return False
-    except GatedRepoError as e:
-        logger.debug(f"Gate not accepted for {name}: {e}")
-        return True
-    except Exception as e:
-        logger.debug(f"Gate probe inconclusive for {name}: {e}")
-        return None
diff --git a/dw/plan_downloads.py b/dw/plan_downloads.py
new file mode 100644
index 000000000..4153384a9
--- /dev/null
+++ b/dw/plan_downloads.py
@@ -0,0 +1,346 @@
+"""What a run would have to download before its first step: the hub repos,
+single-file checkpoints and task weights the expanded definition (and each
+composed child) names that the cache does not already hold, with each one's
+size and gate status when the hub is asked (#382, #975, #981).
+
+Everything here is a walk over the expanded definition: a `model_name` or
+`loras` repo under a `from_pretrained_arguments`, a `from_single_file` URL, a
+`load_components` repo override, and the repos a task declares through its
+command's `required_weights` hook. The cache is read through `hub_cache` and
+`quantized_cache`, never a directory probe of the plan's own - a free
+pre-flight must not be an existence oracle for paths on the box. Nothing here
+knows a model; `dw/plan.py` assembles the answer into the plan beside the
+estimate and the fingerprint, and this module never imports it back.
+"""
+
+import copy
+import json
+import logging
+
+from huggingface_hub import model_info
+from huggingface_hub import get_hf_file_metadata, hf_hub_url
+from huggingface_hub.utils import GatedRepoError, HFValidationError, validate_repo_id
+
+from .hub_cache import repo_download_incomplete, scan_models
+from .quantized_cache import _cached_file
+from . import references
+from .realize import read_sub_workflow
+from .security import validate_url
+
+logger = logging.getLogger("dw")
+
+SIZE_LOOKUP_TIMEOUT = 5.0
+GIB = 1024**3
+FROM_PRETRAINED_KEY = "from_pretrained_arguments"
+MODEL_NAME_KEY = "model_name"
+# An adapter names its repo directly, not through from_pretrained_arguments
+LORAS_KEY = "loras"
+SINGLE_FILE_KEY = "from_single_file"
+VARIANT_KEY = "variant"
+LOAD_COMPONENTS_KEY = "load_components"
+OVERRIDE_KEY = "pretrained_model_name_or_path"
+
+
+def downloads_required(expanded, base_dir, workflow_dir, cache_dir, lookup_sizes):
+    """The hub repos and checkpoint URLs the run would fetch before its
+    first step: every `model_name` in the expanded definition (and in each
+    composed child) that `scan_models` does not find, plus every one it does
+    find but whose cached copy is left over from an interrupted pull
+    (#382) - a component the load needs is missing, or a blob is still
+    `.incomplete` - plus every `from_single_file` that is a URL, and every
+    repo a task step declares through its command's `required_weights` hook
+    (#975, dw/tasks/weights.py), listed once when a pipeline step loads it
+    too. A task that fetches one file of a repo declares the file, keyed by
+    `(repo, filename, revision)`: it is checked in the cache file by file
+    (`_cached_file` - a pinned commit needs no `refs/main`, and another
+    cached file of the repo does not stand in for it), sized by a HEAD of
+    that file, and dropped when the same walk needs the repo whole. Sizes come
+    from the hub when asked and are None whenever it does not answer - an
+    offline box is a state, not an error, so nothing here raises or logs
+    above debug.
+    """
+    names = []
+    variants = {}
+    urls = []
+    files = []
+    _collect_sources(expanded, names, variants, urls)
+    _collect_task_weights(expanded, names, files, urls)
+    for path, _arguments in _sub_workflow_paths(expanded):
+        raw = read_sub_workflow(path, base_dir, workflow_dir)
+        if raw is None:
+            continue
+        try:
+            child = json.loads(raw)
+        except ValueError:
+            continue
+        _collect_sources(child, names, variants, urls)
+        _collect_task_weights(child, names, files, urls)
+    present = {repo.get("repo_id") for repo in scan_models(cache_dir).get("repos", [])}
+    required = []
+    for name in names:
+        # A name not shaped like a hub id is a local checkout - decided by
+        # shape, never by touching the disk: the name came from the request
+        # body, and a free pre-flight must not be a directory-existence oracle
+        if not _is_repo_id(name):
+            continue
+        if name in present and not repo_download_incomplete(
+            name, cache_dir, variant=variants.get(name)
+        ):
+            continue
+        entry = {"repo": name, "gb": None, "gated": None, "access_blocked": None}
+        if lookup_sizes:
+            entry["gb"], entry["gated"], entry["access_blocked"] = _model_info(name)
+        required.append(entry)
+    for repo, filename, revision in files:
+        # A whole-repo entry for the same repo already covers the file
+        if repo in names or not _is_repo_id(repo):
+            continue
+        if _cached_file(repo, filename, revision or "main", cache_dir) is not None:
+            continue
+        entry = {
+            "repo": repo,
+            "filename": filename,
+            "revision": revision,
+            "gb": None,
+            "gated": None,
+            "access_blocked": None,
+        }
+        if lookup_sizes:
+            entry["gb"], entry["access_blocked"] = _file_info(repo, filename, revision)
+        required.append(entry)
+    for url in urls:
+        required.append(
+            {
+                "repo": None,
+                "url": url,
+                "gb": None,
+                "gated": None,
+                "access_blocked": None,
+            }
+        )
+    return required
+
+
+def _collect_sources(tree, names, variants, urls):
+    """Every from_pretrained source in a tree, first-seen order, deduplicated.
+    `variants` collects each name's requested `variant` (first-seen), used to
+    tell a repo that is merely missing its fp16 files from one that is fully
+    cached without them.
+
+    A `loras` entry counts too. It carries its repo under `model_name`
+    directly rather than inside a `from_pretrained_arguments` block, so the
+    walk missed it: `templates/ltx2/reference-sheet` on a box that had
+    every base weight but not the IC-LoRA answered `downloads_required:
+    []` and then pulled it mid-run, which is the one question the field
+    exists to answer (found verifying #151).
+    """
+    if isinstance(tree, dict):
+        for lora in tree.get(LORAS_KEY) or []:
+            name = lora.get(MODEL_NAME_KEY) if isinstance(lora, dict) else None
+            if isinstance(name, str) and name not in names:
+                names.append(name)
+        source = tree.get(FROM_PRETRAINED_KEY)
+        if isinstance(source, dict):
+            name = source.get(MODEL_NAME_KEY)
+            if isinstance(name, str) and name not in names:
+                names.append(name)
+                variant = source.get(VARIANT_KEY)
+                if isinstance(variant, str):
+                    variants[name] = variant
+            single = source.get(SINGLE_FILE_KEY)
+            if isinstance(single, str) and _is_url(single) and single not in urls:
+                urls.append(single)
+        _collect_component_overrides(tree.get(LOAD_COMPONENTS_KEY), names)
+        for value in tree.values():
+            _collect_sources(value, names, variants, urls)
+    elif isinstance(tree, list):
+        for value in tree:
+            _collect_sources(value, names, variants, urls)
+
+
+def _collect_component_overrides(arguments, names):
+    """The repos a modular step's `load_components.pretrained_model_name_or_path`
+    names: a string for every component, or a dict keyed by component name
+    with an optional `default`. Diffusers merges it over each component's
+    spec, so the repo is pulled mid-run (#981). The base repo is still listed
+    whole - the subfolder an override replaces is not subtracted."""
+    if not isinstance(arguments, dict):
+        return
+    value = arguments.get(OVERRIDE_KEY)
+    for name in value.values() if isinstance(value, dict) else [value]:
+        if isinstance(name, str) and name not in names:
+            names.append(name)
+
+
+def _collect_task_weights(tree, names, files, urls):
+    """Every repo, file or URL a task step in a tree declares, appended after
+    the pipeline sources and deduplicated against them - a file as a
+    `(repo, filename, revision)` key in `files`. Each `task` block's
+    command is looked up by name and its hook called on the block's
+    arguments - expanded at the top level; a composed child's are its raw
+    definition, so a `variable:` value there is no repo and gives no entry.
+
+    A hook that raises costs its entries, never the validate: the plan
+    answers what it can name, and the run still loads what it loads.
+    """
+    if isinstance(tree, dict):
+        task = tree.get("task")
+        if isinstance(task, dict) and isinstance(task.get("command"), str):
+            arguments = task.get("arguments")
+            for entry in _task_weights(
+                task["command"], arguments if isinstance(arguments, dict) else {}
+            ):
+                repo, url = entry.get("repo"), entry.get("url")
+                filename = entry.get("filename")
+                if isinstance(repo, str) and isinstance(filename, str):
+                    key = (repo, filename, entry.get("revision"))
+                    if key not in files:
+                        files.append(key)
+                elif isinstance(repo, str) and repo not in names:
+                    names.append(repo)
+                elif repo is None and isinstance(url, str) and _is_url(url):
+                    if url not in urls:
+                        urls.append(url)
+        for value in tree.values():
+            _collect_task_weights(value, names, files, urls)
+    elif isinstance(tree, list):
+        for value in tree:
+            _collect_task_weights(value, names, files, urls)
+
+
+def _task_weights(command, arguments):
+    # Imported here: the registry loads task modules only when a workflow has
+    # a task step, so a pipeline-only validate pays nothing for it
+    from .tasks.registry import required_weights_hook
+
+    try:
+        hook = required_weights_hook(command)
+        entries = hook(copy.deepcopy(arguments)) if hook is not None else []
+    except Exception as error:
+        logger.debug(f"required_weights for task {command!r} failed: {error}")
+        return []
+    return [entry for entry in entries or [] if isinstance(entry, dict)]
+
+
+def gate_warnings(downloads_required):
+    """One line per required download this box's token is blocked from -
+    the pre-flight signal #186 asked for, so a gated repo is a
+    `validate_workflow`-visible condition rather than a 403 the run only
+    discovers after it has loaded everything ahead of that step."""
+    return [
+        f"{entry['repo']} is gated and not accessible with this box's "
+        "Hugging Face token - accept its license at "
+        f"https://huggingface.co/{entry['repo']} before running this workflow"
+        for entry in downloads_required
+        # A URL entry has no repo to send anyone to
+        if entry.get("access_blocked") and entry.get("repo")
+    ]
+
+
+def _is_repo_id(name):
+    try:
+        validate_repo_id(name)
+        return True
+    except HFValidationError:
+        return False
+
+
+def _is_url(value):
+    if not value.startswith(("http://", "https://")):
+        return False
+    try:
+        validate_url(value)
+        return True
+    except Exception:
+        return False
+
+
+def _model_info(name):
+    """A repo's size in GiB, gate status, and whether this box's token is
+    blocked from it - a `(gb, gated, access_blocked)` triple.
+
+    `gated` is `model_info`'s own field (`False` / `"auto"` / `"manual"`),
+    readable only when the call succeeds - and the hub answers `model_info`
+    for a gated repo regardless of whether this token has been granted
+    access, since that call serves metadata rather than file bytes (found
+    verifying #186: `access_blocked` came back `false` for repos this box's
+    token was actually refused on). A `GatedRepoError` straight out of
+    `model_info` is still a real signal - some other endpoint behind it
+    checked and refused - but its absence proves nothing, so a `gated` repo
+    that got this far is checked for real with a HEAD request against one of
+    its own files (`_probe_gate_blocked`), the same request class a run's
+    actual load would make and the one place the hub's 403 for "gated, token
+    not accepted" actually appears.
+    """
+    try:
+        info = model_info(name, files_metadata=True, timeout=SIZE_LOOKUP_TIMEOUT)
+    except GatedRepoError as e:
+        logger.debug(f"Gate not accepted for {name}: {e}")
+        return None, True, True
+    except Exception as e:
+        logger.debug(f"No size for {name}: {e}")
+        return None, None, None
+    total = sum(s.size for s in (info.siblings or []) if getattr(s, "size", None))
+    gb = round(total / GIB, 1) if total else None
+    gated = getattr(info, "gated", False) or False
+    access_blocked = False
+    if gated:
+        access_blocked = _probe_gate_blocked(name, info.siblings or [])
+    return gb, gated, access_blocked
+
+
+def _file_info(repo, filename, revision):
+    """One file's size in GiB and whether this box's token is blocked from it
+    - a `(gb, access_blocked)` pair from a HEAD of the file itself, the call
+    `_probe_gate_blocked` makes. `_model_info` would size the whole repo at
+    main, overstating one file of a multi-file repo. A tiny file reads 0.01
+    rather than 0, which would look like nothing to fetch."""
+    try:
+        metadata = get_hf_file_metadata(
+            hf_hub_url(repo, filename, revision=revision),
+            timeout=SIZE_LOOKUP_TIMEOUT,
+        )
+    except GatedRepoError as e:
+        logger.debug(f"Gate not accepted for {repo}/{filename}: {e}")
+        return None, True
+    except Exception as e:
+        logger.debug(f"No size for {repo}/{filename}: {e}")
+        return None, None
+    size = getattr(metadata, "size", None)
+    gb = max(round(size / GIB, 2), 0.01) if size else None
+    return gb, False
+
+
+def _probe_gate_blocked(name, siblings):
+    """HEAD one real file of a gated repo to see whether this box's token is
+    actually accepted - `model_info` succeeding says nothing either way
+    (#186). `None` when there is no file to probe or the probe fails for a
+    reason other than the gate, since that is "unknown", not "not blocked".
+    """
+    filename = next(
+        (s.rfilename for s in siblings if getattr(s, "rfilename", None)), None
+    )
+    if filename is None:
+        return None
+    try:
+        get_hf_file_metadata(hf_hub_url(name, filename), timeout=SIZE_LOOKUP_TIMEOUT)
+        return False
+    except GatedRepoError as e:
+        logger.debug(f"Gate not accepted for {name}: {e}")
+        return True
+    except Exception as e:
+        logger.debug(f"Gate probe inconclusive for {name}: {e}")
+        return None
+
+
+def _sub_workflow_paths(expanded):
+    """The local (non-builtin) sub-workflow path and composing arguments of
+    every composing step, as (path, arguments) - `expanded` has already
+    substituted and expanded `for_each`, so each occurrence carries the
+    concrete arguments that step actually passes the child (#341)."""
+    for step in expanded.get("steps") or []:
+        reference = step.get("workflow") if isinstance(step, dict) else None
+        path = reference.get("path") if isinstance(reference, dict) else None
+        if isinstance(path, str) and not references.is_ref(references.BUILTIN, path):
+            arguments = reference.get("arguments")
+            yield path, arguments if isinstance(arguments, dict) else {}
diff --git a/dw/roles.py b/dw/roles.py
index abf8d346c..9812d718d 100644
--- a/dw/roles.py
+++ b/dw/roles.py
@@ -17,8 +17,11 @@
 
 A composed child's rolled-up manifest entries carry `parent_step` and take
 that step's role. The engine records roles when a run ends, from the
-`role_basis` it took as the run opened; the server reads only what was
-recorded, so a run that predates roles has none - unknown, not guessed. Inputs
+`role_basis` it took as the run opened. A run that predates roles recorded
+none, and its realized workflow no longer shows its data flow (a run
+resolves its references in place), so a listing falls back on what is
+still readable: rule 2 from the file's own subfolder, then rule 4 below. A
+file neither says anything about stays unknown. Inputs
 are the asset: and output: references the expanded steps carry - a run's
 'made from' list.
 
@@ -34,14 +37,15 @@
    'latest' is the newest run that started before it), or through an asset:
    reference to an asset keep_output kept from that file. A role rule 1
    declared is recorded as such (`role_declared`) and never demoted; an entry
-   from before that flag is demotable, and a file with no recorded role
-   stays unknown.
+   from before that flag is demotable, and so is a file with no recorded
+   role, which lists as intermediate once read.
 
 This module names no model.
 """
 
 import json
 import os
+import posixpath
 
 from .references import (
     ASSET,
@@ -227,11 +231,17 @@ def run_inputs(steps):
     return seen
 
 
-def listed_role(role, declared, consumed):
+def listed_role(role, declared, consumed, name=None):
     """Rule 4: the role a listing shows for a file whose run recorded
     `role` - intermediate once a later run `consumed` it, unless rule 1
-    `declared` the role. An unknown role stays unknown."""
-    if role is None or declared or not consumed:
+    `declared` the role. With no recorded role (a run that predates roles),
+    rule 2 reads the subfolder of `name`, the file's '/' separated path
+    inside its run, before rule 4 applies; with neither, it stays None."""
+    if role is None:
+        role = _subfolder_role(posixpath.dirname(name or "") or None)
+        if role is None:
+            return INTERMEDIATE if consumed else None
+    if declared or not consumed:
         return role
     return INTERMEDIATE
 
diff --git a/dw/script_lines.py b/dw/script_lines.py
index 9354b570f..5a5d12f52 100644
--- a/dw/script_lines.py
+++ b/dw/script_lines.py
@@ -55,11 +55,12 @@ def normalize_words(text):
 REPEAT_MAX_PERIOD = 4
 
 
-def repetition_loops(keys):
-    """The indices of `keys` (heard words) that sit in a repetition loop: a stretch that
+def repetition_runs(keys):
+    """[(first, end, period)] for each stretch of `keys` (heard words) that
     repeats with a period of 1 to REPEAT_MAX_PERIOD and spans at least
-    REPEAT_RUN_MIN periods."""
-    looped = set()
+    REPEAT_RUN_MIN periods; `keys[first:first + period]` is its first
+    occurrence."""
+    runs = []
     for period in range(1, REPEAT_MAX_PERIOD + 1):
         k = period
         while k < len(keys):
@@ -70,7 +71,15 @@ def repetition_loops(keys):
             while k < len(keys) and keys[k] == keys[k - period]:
                 k += 1
             if k - first >= REPEAT_RUN_MIN * period:
-                looped.update(range(first, k))
+                runs.append((first, k, period))
+    return runs
+
+
+def repetition_loops(keys):
+    """The indices of `keys` (heard words) that sit in a repetition loop."""
+    looped = set()
+    for first, end, _ in repetition_runs(keys):
+        looped.update(range(first, end))
     return looped
 
 
@@ -78,12 +87,32 @@ def looped_texts(texts):
     """The indices of `texts` (transcript chunks' text, in order) holding a word
     of a repetition loop. Over words, not chunks: one chunk can hold a whole
     loop ('Pre-pre-pre'), and a chunk with no word is never in one."""
+    return looped_texts_firsts(texts)[0]
+
+
+def looped_texts_firsts(texts):
+    """(looped, firsts): `looped` as looped_texts; `firsts` the chunk indices
+    that are the first occurrence of a loop, every word of the chunk in it. A
+    period-1 loop of 'pre' has one first word; where runs of several periods
+    overlap, the shortest period's first occurrence is the one."""
     sequence, owner = [], []
     for index, text in enumerate(texts):
         words = normalize_words(text)
         owner.extend([index] * len(words))
         sequence.extend(words)
-    return {owner[k] for k in repetition_loops(sequence)}
+    runs = sorted(repetition_runs(sequence), key=lambda run: run[2])
+    looped, first_words = set(), set()
+    for first, end, period in runs:
+        if not set(range(first, end)) <= looped:
+            first_words.update(range(first, first + period))
+        looped.update(range(first, end))
+    chunks = {owner[k] for k in looped}
+    firsts = {
+        index
+        for index in chunks
+        if all(k in first_words for k in range(len(owner)) if owner[k] == index)
+    }
+    return chunks, firsts
 
 
 # transcribe_audio's `suspect` reasons whose chunk plan_cuts leaves out of the
diff --git a/dw/security.py b/dw/security.py
index 5bbb25236..1f46833c3 100644
--- a/dw/security.py
+++ b/dw/security.py
@@ -746,6 +746,58 @@ def validate_commit_hash(commit: str) -> str:
     return commit
 
 
+def validate_weight_name(name, suffixes=None, what="weight_name", subfolders=True):
+    """A file name inside a Hub repo: relative, and never climbing out of it.
+
+    `hf_hub_download(filename=...)` joins the name onto the local cache
+    directory, so a name shaped like a path is a path on this machine. A
+    subfolder is legitimate where `subfolders` allows one (an IP adapter's
+    lives under one); an absolute path, a backslash, a drive, an empty segment or a '.'/'..'
+    segment is not. The refusal names only what the caller wrote, never a
+    directory on the server.
+
+    Here rather than in `dw/locations.py` with the other Hub-name policy:
+    `dw/tasks/weights.py` reads it on every validate and must stay a leaf
+    of the package (see its docstring).
+
+    Args:
+        name: The file name the workflow supplied
+        suffixes: The file endings allowed, or None for any
+        what: Short phrase naming the argument, for the error message
+        subfolders: Whether the name may hold a '/' at all
+
+    Raises:
+        PathTraversalError: On a name that is not a plain relative path
+        InvalidInputError: On an empty name, or one with a refused ending
+    """
+    if not isinstance(name, str) or not name.strip():
+        raise InvalidInputError(f"Refusing an empty {what}.")
+    if "\x00" in name:
+        raise InvalidInputError(f"Refusing a {what} containing a null byte.")
+    if name.startswith(("/", "~")) or "\\" in name or ":" in name:
+        raise PathTraversalError(
+            f"Refusing a {what} of '{name}': it names a file inside the model "
+            f"repo, so it must be a relative path - no leading '/' or '~', no "
+            f"backslash, no drive."
+        )
+    if any(segment in ("", ".", "..") for segment in name.split("/")):
+        raise PathTraversalError(
+            f"Refusing a {what} of '{name}': it has an empty, '.' or '..' "
+            f"path segment, so it does not name a file inside the model repo."
+        )
+    if not subfolders and "/" in name:
+        raise PathTraversalError(
+            f"Refusing a {what} of '{name}': it is a file name, not a path - no '/'."
+        )
+    if suffixes and not name.lower().endswith(tuple(suffixes)):
+        raise InvalidInputError(
+            f"Refusing a {what} of '{name}': only "
+            f"{', '.join(repr(suffix) for suffix in suffixes)} weights are "
+            f"read here."
+        )
+    return name
+
+
 def validate_json_size(file_path: str) -> None:
     """
     Validate JSON file size before loading.
diff --git a/dw/serve.py b/dw/serve.py
index af52e9d15..631ac78dc 100644
--- a/dw/serve.py
+++ b/dw/serve.py
@@ -170,7 +170,8 @@ def check_bind_safety(args, token):
 
 def configure_devices(args):
     """Pick the workers' cards from --devices, else the `devices` setting,
-    and refuse one this machine lacks (exit 2) - before any worker spawns.
+    and refuse one this machine lacks (exit 2), unless others in a list are
+    present (it is then dropped with a warning) - before any worker spawns.
     Returns the list, or None when neither names any.
 
     The first is pinned as DW_DEVICE, which `get_device()` reads in this
@@ -181,9 +182,14 @@ def configure_devices(args):
     from .devices import DeviceConfigError, resolve_serve_devices
     from .settings import load_settings
 
+    def report_absent(message):
+        print(f"dw-serve: WARNING: {message} - starting without it", file=sys.stderr)
+
     try:
         devices = resolve_serve_devices(
-            getattr(args, "devices", None), load_settings().devices
+            getattr(args, "devices", None),
+            load_settings().devices,
+            on_absent=report_absent,
         )
     except DeviceConfigError as error:
         print(f"dw-serve: {error}", file=sys.stderr)
diff --git a/dw/server/admission.py b/dw/server/admission.py
index a8b1279a8..7cea52a23 100644
--- a/dw/server/admission.py
+++ b/dw/server/admission.py
@@ -17,7 +17,7 @@
 from typing import Any, Dict, List, Optional, Union
 
 from fastapi import HTTPException
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, Field, field_validator, model_validator
 
 from ..assets import (
     activate_asset_dir,
@@ -27,7 +27,7 @@
 )
 from .. import get_device_type, references, validation
 from ..notes import MAX_NOTE_LENGTH, NoteTooLong, clean_note
-from ..plan import build_plan, list_entries
+from ..plan import list_entries
 from ..prompts import resolve_prompt_reference
 from ..runs import (
     activate_output_root,
@@ -193,6 +193,18 @@ def admit(
             raise _validator_failure(e) from e
         admission.vram_need = _vram_need(candidate, context, arguments)
         if admission.errors:
+            # Every error comes back at once (#976): the caller's own bad
+            # arguments (an unknown name) are reported beside the
+            # document's errors, not only after they are fixed
+            try:
+                known = {(e.get("path"), e.get("message")) for e in admission.errors}
+                admission.errors += [
+                    e
+                    for e in argument_errors(candidate.workflow_definition, arguments)
+                    if (e.get("path"), e.get("message")) not in known
+                ]
+            except Exception:
+                logger.debug("argument_errors skipped beside a failed document")
             # The warnings walk the steps array, which a definition failing
             # the schema may not have
             admission.schema_errors = True
@@ -372,6 +384,32 @@ class AcknowledgedCost(BaseModel):
         description="The repos in plan.downloads_required that were acknowledged",
     )
 
+    @model_validator(mode="before")
+    @classmethod
+    def _from_plan(cls, value):
+        # The plan validate answered with, passed as-is (#975): its
+        # downloads_required and estimate.minutes are what was quoted. Only
+        # when `downloads` is absent - an explicit list, even an empty one,
+        # is what the caller acknowledged
+        if (
+            not isinstance(value, dict)
+            or "downloads" in value
+            or not isinstance(value.get("downloads_required"), list)
+        ):
+            return value
+        bound = {
+            **value,
+            "downloads": [
+                entry.get("repo")
+                for entry in value["downloads_required"]
+                if isinstance(entry, dict)
+            ],
+        }
+        estimate = value.get("estimate")
+        if "minutes" not in value and isinstance(estimate, dict):
+            bound["minutes"] = estimate.get("minutes")
+        return bound
+
     @field_validator("downloads", mode="after")
     @classmethod
     def _drop_unnamed(cls, downloads):
@@ -503,29 +541,6 @@ def acknowledgement_form(value):
     return ACK_BOOLEAN if value is True else ACK_NONE
 
 
-def bound_plan_for(arguments, workspace):
-    """The `plan_for` a bound acknowledgement is checked against - the
-    run these arguments execute, planned without asking the hub for
-    sizes. None when it cannot be built, which the check refuses."""
-
-    def plan_for(candidate, vram_need=None):
-        try:
-            from .. import get_device, get_device_type
-
-            return build_plan(
-                candidate,
-                arguments,
-                device=get_device_type(get_device()),
-                prompt_dir=workspace.prompts,
-                lookup_sizes=False,
-            )
-        except Exception:
-            logger.exception("Plan could not be built for a bound acknowledgement")
-            return None
-
-    return plan_for
-
-
 def check_bound_acknowledgement(current, acknowledged, workspace):
     """Refuse with 409 when `current`, the plan of the run the request
     admitted, is not the one `acknowledged` was bound to: a different
diff --git a/dw/server/api_models.py b/dw/server/api_models.py
index f11d1881a..790eadf23 100644
--- a/dw/server/api_models.py
+++ b/dw/server/api_models.py
@@ -608,6 +608,11 @@ class ElidedStep(ApiModel):
 class RequiredDownload(ApiModel):
     repo: str | None
     url: str = sometimes("A from_single_file URL, which has no repo.")
+    filename: str = sometimes(
+        "A single weight file within `repo`, for a task that fetches one file "
+        "rather than the whole repo."
+    )
+    revision: str | None = sometimes("The commit the file is read at; null means main.")
     gb: int | float | None
     gated: bool | Literal["auto", "manual"] | None = Field(
         description="The hub's own `gated` field: false, or how access is granted."
@@ -666,6 +671,11 @@ class PlanEstimate(ApiModel):
         "could not be re-priced for this workflow (its size cannot be compared "
         "to the template's)."
     )
+    unpriced_reason: str = sometimes(
+        "With basis `unknown` and no `withheld`: why a workflow of task steps "
+        "alone has no price - it has no pipeline to inherit one from, and its "
+        "length follows its input media (#948)."
+    )
     priced_for: str = sometimes(
         "The card the run would be dispatched to, whose history the figure is - "
         "as `cuda:1 NVIDIA GeForce RTX 3090`."
@@ -824,6 +834,7 @@ class GalleryMetadata(ApiModel):
     note: str = sometimes("The effective note: the file's own, else its run's.")
     run_note: str = sometimes("The note of the run that wrote the file.")
     note_source: Literal["file", "run"] = sometimes("Whose note `note` is.")
+    starred: bool = sometimes("True when the file is starred; absent otherwise.")
 
 
 class AssetLibraryRoot(ApiModel):
diff --git a/dw/server/deps.py b/dw/server/deps.py
index b25a2fbfa..3afd6bd51 100644
--- a/dw/server/deps.py
+++ b/dw/server/deps.py
@@ -349,6 +349,18 @@ def _scale_past_template(definition, template, drivers, arguments):
     return factor, "; ".join(reasons) or None
 
 
+def _rescaled_cold(block, factor):
+    """The bucket's cold minutes at `factor` times the work. A cold run is a
+    warm run plus a one-off model load, and the load is paid once however many
+    pipeline steps or frames the workflow renders (a second `for_each` entry
+    finds the weights cached, #1037), so only the warm part scales. A bucket
+    with no warm runs has no split to make and scales whole."""
+    cold, warm = block["cold_minutes"], block.get("warm_minutes")
+    if isinstance(warm, (int, float)) and 0 < warm < cold:
+        return (cold - warm) + warm * factor
+    return cold * factor
+
+
 def _number(value):
     return int(value) if float(value).is_integer() else round(value, 1)
 
@@ -418,7 +430,7 @@ def inherited_observed(state, ws, definition, arguments=None, *, card=None):
         if reason:
             block = {
                 **block,
-                "cold_minutes": block["cold_minutes"] * factor,
+                "cold_minutes": _rescaled_cold(block, factor),
                 "scaled": f"scaled from {name}: {reason}",
             }
         key = (-block["cold_runs"], name)
diff --git a/dw/server/job_history.py b/dw/server/job_history.py
index 6d9d9243e..81e62f59a 100644
--- a/dw/server/job_history.py
+++ b/dw/server/job_history.py
@@ -101,9 +101,61 @@ def _memory_key_of(job):
     # The job a rerun reran. NULL for a fresh submit and for every row
     # before the column
     ("rerun_of", "TEXT"),
-    # 1 once a kept asset's provenance names the job (#917), so a workspace
-    # delete leaves the row for get_job_workflow to read
-    ("kept", "INTEGER DEFAULT 0"),
+    # A database may hold a column no longer declared here (`kept`, #917,
+    # retired once #944 made a workspace delete retire every row rather
+    # than keep the ones an asset named): the migration only adds what is
+    # missing (`_add_missing_columns`), so a stray physical column is left
+    # alone and never read
+)
+
+
+def _json(value):
+    return json.dumps(value, default=str)
+
+
+def _rerun_spec(job):
+    """The spec's workflow_name/warnings are derived; keep what rerun needs."""
+    return {key: job.spec[key] for key in RERUN_SPEC_KEYS if key in job.spec}
+
+
+# What `JobHistory.record` writes: one (column, getter) per recorded column, so
+# a new job field is one entry here (plus its `_ADDED_COLUMNS` DDL), not a
+# placeholder and a positional value. `getattr(..., None)` is for a test double
+# or an older in-memory Job predating a column: absent means unknown, which the
+# column itself allows (#243)
+_RECORDED = (
+    ("id", lambda job: job.id),
+    ("workflow", lambda job: job.workflow_name),
+    ("status", lambda job: job.status),
+    ("created_at", lambda job: job.created_at),
+    ("started_at", lambda job: job.started_at),
+    ("finished_at", lambda job: job.finished_at),
+    ("arguments", lambda job: _json(job.spec.get("arguments", {}))),
+    ("spec", lambda job: _json(_rerun_spec(job))),
+    ("manifest", lambda job: _json(job.manifest)),
+    ("warnings", lambda job: _json(job.warnings)),
+    ("error", lambda job: job.error),
+    ("events", lambda job: _json(job.events[-MAX_PERSISTED_EVENTS:])),
+    ("workspace", lambda job: job.spec.get("workspace") or DEFAULT_WORKSPACE_NAME),
+    ("workflow_name", lambda job: job.catalog_name),
+    ("run_id", lambda job: job.run_id),
+    ("run_dir", lambda job: job.run_dir),
+    ("acknowledged", lambda job: job.acknowledged),
+    (
+        "host_memory_peak_rss_mb",
+        lambda job: getattr(job, "host_memory_peak_rss_mb", None),
+    ),
+    (
+        "host_memory_job_peak_rss_mb",
+        lambda job: getattr(job, "host_memory_job_peak_rss_mb", None),
+    ),
+    ("run_version", lambda job: getattr(job, "run_version", None)),
+    ("device", lambda job: getattr(job, "device", None)),
+    ("device_ordinal", lambda job: getattr(job, "device_ordinal", None)),
+    ("device_card", lambda job: getattr(job, "device_card", None)),
+    ("note", lambda job: getattr(job, "note", None)),
+    ("memory_key", _memory_key_of),
+    ("rerun_of", lambda job: getattr(job, "rerun_of", None)),
 )
 
 # `device_ordinal`/`device_card` from `device`, in SQL: an ordinal never
@@ -133,6 +185,11 @@ def _add_missing_columns(connection):
     return added
 
 
+# Appended to the workspace of a retired workspace's rows (#944); no workspace
+# name can contain a space and parenthesis.
+DELETED_SUFFIX = " (deleted)"
+
+
 class JobHistory:
     """Finished jobs, persisted so the Jobs view survives server restarts.
 
@@ -186,54 +243,21 @@ def _connect(self):
         # one left to GC checkpoints the WAL whenever it is collected,
         # rewriting jobs.sqlite at an arbitrary later moment.
         with contextlib.closing(sqlite3.connect(self.db_path, timeout=5)) as connection:
+            # Readers take columns by name; a positional index is a silent
+            # miss the next time a column is added
+            connection.row_factory = sqlite3.Row
             connection.execute("PRAGMA journal_mode=WAL")
             with connection:
                 yield connection
 
     def record(self, job):
-        # The spec's workflow_name/warnings are derived; keep what rerun needs
-        rerun_spec = {key: job.spec[key] for key in RERUN_SPEC_KEYS if key in job.spec}
+        columns = ", ".join(column for column, _ in _RECORDED)
+        placeholders = ", ".join("?" for _ in _RECORDED)
+        values = tuple(getter(job) for _, getter in _RECORDED)
         with self._lock, self._connect() as connection:
             connection.execute(
-                "INSERT OR REPLACE INTO jobs (id, workflow, status, created_at,"
-                " started_at, finished_at, arguments, spec, manifest, warnings,"
-                " error, events, workspace, workflow_name, run_id, run_dir,"
-                " acknowledged, host_memory_peak_rss_mb,"
-                " host_memory_job_peak_rss_mb, run_version, device,"
-                " device_ordinal, device_card, note, memory_key, rerun_of) VALUES"
-                " (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                (
-                    job.id,
-                    job.workflow_name,
-                    job.status,
-                    job.created_at,
-                    job.started_at,
-                    job.finished_at,
-                    json.dumps(job.spec.get("arguments", {}), default=str),
-                    json.dumps(rerun_spec, default=str),
-                    json.dumps(job.manifest, default=str),
-                    json.dumps(job.warnings, default=str),
-                    job.error,
-                    json.dumps(job.events[-MAX_PERSISTED_EVENTS:], default=str),
-                    job.spec.get("workspace") or DEFAULT_WORKSPACE_NAME,
-                    job.catalog_name,
-                    job.run_id,
-                    job.run_dir,
-                    job.acknowledged,
-                    # A test double or an older in-memory Job predating this
-                    # column reports None here rather than failing record()
-                    # (#243) - the same "absent means unknown" the column
-                    # itself allows
-                    getattr(job, "host_memory_peak_rss_mb", None),
-                    getattr(job, "host_memory_job_peak_rss_mb", None),
-                    getattr(job, "run_version", None),
-                    getattr(job, "device", None),
-                    getattr(job, "device_ordinal", None),
-                    getattr(job, "device_card", None),
-                    getattr(job, "note", None),
-                    _memory_key_of(job),
-                    getattr(job, "rerun_of", None),
-                ),
+                f"INSERT OR REPLACE INTO jobs ({columns}) VALUES ({placeholders})",
+                values,
             )
 
     def peaks_for_key(self, key):
@@ -242,11 +266,11 @@ def peaks_for_key(self, key):
         the workflow's name (#869). Empty for a key no run has reported."""
         with self._lock, self._connect() as connection:
             rows = connection.execute(
-                "SELECT host_memory_job_peak_rss_mb FROM jobs WHERE status = ?"
+                "SELECT host_memory_job_peak_rss_mb AS peak FROM jobs WHERE status = ?"
                 " AND memory_key = ? AND host_memory_job_peak_rss_mb IS NOT NULL",
                 (SUCCEEDED, key),
             ).fetchall()
-        return [row[0] for row in rows]
+        return [row["peak"] for row in rows]
 
     def recent_summaries(self, limit=200, workspace=None, statuses=None):
         """Summary rows only - the jobs list is polled, and parsing four JSON
@@ -262,7 +286,8 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
             "SELECT id, workflow, status, created_at, started_at, finished_at,"
             " workspace, workflow_name, run_id, acknowledged, run_version,"
             " device, note, run_dir,"
-            " CASE WHEN json_valid(spec) THEN json_extract(spec, '$.output_dir') END,"
+            " CASE WHEN json_valid(spec) THEN json_extract(spec, '$.output_dir') END"
+            " AS output_dir,"
             " rerun_of"
             " FROM jobs"
         )
@@ -271,6 +296,9 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
         if workspace:
             clauses.append("workspace = ?")
             params.append(workspace)
+        else:
+            clauses.append("workspace NOT LIKE ?")
+            params.append(f"%{DELETED_SUFFIX}")
         if statuses:
             statuses = list(statuses)
             placeholders = ", ".join("?" for _ in statuses)
@@ -284,26 +312,26 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
             rows = connection.execute(query, params).fetchall()
         return [
             {
-                "id": row[0],
-                "workflow": row[1],
-                "status": row[2],
-                "created_at": row[3],
-                "started_at": row[4],
-                "finished_at": row[5],
-                "workspace": row[6] or DEFAULT_WORKSPACE_NAME,
-                "workflow_name": row[7],
-                "run_id": row[8],
-                "acknowledged": row[9] or ACK_NONE,
-                "run_version": row[10],
-                "device": row[11],
+                "id": row["id"],
+                "workflow": row["workflow"],
+                "status": row["status"],
+                "created_at": row["created_at"],
+                "started_at": row["started_at"],
+                "finished_at": row["finished_at"],
+                "workspace": row["workspace"] or DEFAULT_WORKSPACE_NAME,
+                "workflow_name": row["workflow_name"],
+                "run_id": row["run_id"],
+                "acknowledged": row["acknowledged"] or ACK_NONE,
+                "run_version": row["run_version"],
+                "device": row["device"],
                 "historical": True,
                 # Only when set: JobSummary.note is absent, never null
-                **({"note": row[12]} if row[12] else {}),
+                **({"note": row["note"]} if row["note"] else {}),
                 # Where the run is, for the list to read its current note
                 # from; JobManager.list takes these off before serving
-                "_run_dir": row[13],
-                "_output_dir": row[14],
-                **({"rerun_of": row[15]} if row[15] else {}),
+                "_run_dir": row["run_dir"],
+                "_output_dir": row["output_dir"],
+                **({"rerun_of": row["rerun_of"]} if row["rerun_of"] else {}),
             }
             for row in rows
         ]
@@ -326,7 +354,7 @@ def device_ordinal(self, job_id):
             row = connection.execute(
                 "SELECT device_ordinal FROM jobs WHERE id = ?", (job_id,)
             ).fetchone()
-        return row[0] if row else None
+        return row["device_ordinal"] if row else None
 
     def watermark(self):
         """How far the table has got - what a derived figure caches against.
@@ -343,10 +371,10 @@ def watermark(self):
         """
         with self._lock, self._connect() as connection:
             row = connection.execute(
-                "SELECT COUNT(*), MAX(finished_at) FROM jobs"
+                "SELECT COUNT(*) AS runs, MAX(finished_at) AS last_finished FROM jobs"
                 " WHERE workflow_name IS NOT NULL"
             ).fetchone()
-        return (row[0], row[1]) if row else (0, None)
+        return (row["runs"], row["last_finished"]) if row else (0, None)
 
     def finished_runs(self):
         """Every successful, named run grouped by (workspace, workflow name),
@@ -431,30 +459,19 @@ def orphan_workflow_history(self, workspace, workflow_name):
                 (workspace, workflow_name),
             )
 
-    def mark_kept(self, job_id):
-        """Record that a kept asset's provenance names this job (#917), so
-        `forget_workspace` leaves its row."""
-        with self._lock, self._connect() as connection:
-            connection.execute("UPDATE jobs SET kept = 1 WHERE id = ?", (job_id,))
-
     def forget_workspace(self, workspace):
-        """Delete the rows recorded in this workspace (#913). A deleted
-        workspace takes its history with it, so a new workspace reusing the
-        name starts with none. A job a kept asset names (#917) survives, its
-        workspace renamed to one no workspace can be called, so
-        `get_job_workflow` still resolves the asset's provenance. Returns
-        the number of rows removed."""
+        """Retire the rows recorded in this workspace (#913). A new workspace
+        reusing the name starts with none: every row moves to a workspace
+        name no workspace can be called, so no listing of the name finds it.
+        The rows stay, so a job id still resolves for `get_job` and
+        `get_job_workflow` (#944), which fold the recorded arguments into the
+        run's definition without the workspace. Returns the rows retired."""
         with self._lock, self._connect() as connection:
             cursor = connection.execute(
-                "DELETE FROM jobs WHERE workspace = ? AND COALESCE(kept, 0) = 0",
-                (workspace,),
-            )
-            removed = cursor.rowcount
-            connection.execute(
                 "UPDATE jobs SET workspace = ? WHERE workspace = ?",
-                (f"{workspace} (deleted)", workspace),
+                (f"{workspace}{DELETED_SUFFIX}", workspace),
             )
-            return removed
+            return cursor.rowcount
 
     def events_for(self, job_id):
         """A finished job's persisted event tail. [] for a job recorded
@@ -466,10 +483,10 @@ def events_for(self, job_id):
             ).fetchone()
         if row is None:
             return None
-        if not row[0]:
+        if not row["events"]:
             return []
         try:
-            return json.loads(row[0])
+            return json.loads(row["events"])
         except json.JSONDecodeError:
             return []
 
@@ -506,8 +523,8 @@ def job_for_file(self, file_name, workspace=None):
         with self._lock, self._connect() as connection:
             rows = connection.execute(query, params).fetchall()
         for row in rows:
-            if self._manifest_wrote(row[2], file_name):
-                return {"id": row[0], "status": row[1]}
+            if self._manifest_wrote(row["manifest"], file_name):
+                return {"id": row["id"], "status": row["status"]}
         return None
 
     @staticmethod
@@ -551,35 +568,35 @@ def parse(text, fallback):
             except (TypeError, ValueError):
                 return fallback
 
-        spec = parse(row[7], {})
+        spec = parse(row["spec"], {})
         # The persisted tail is capped at MAX_PERSISTED_EVENTS, and
         # get_job_events serves that same tail - so counting it, rather than
         # hardcoding 0, keeps event_count truthful about what a caller who
         # pages through get_job_events will actually see (#289)
-        events = parse(row[16], [])
+        events = parse(row["events"], [])
         return {
-            "id": row[0],
-            "workflow": row[1],
-            "status": row[2],
-            "created_at": row[3],
-            "started_at": row[4],
-            "finished_at": row[5],
-            "arguments": parse(row[6], {}),
+            "id": row["id"],
+            "workflow": row["workflow"],
+            "status": row["status"],
+            "created_at": row["created_at"],
+            "started_at": row["started_at"],
+            "finished_at": row["finished_at"],
+            "arguments": parse(row["arguments"], {}),
             "spec": spec,
-            "manifest": parse(row[8], []),
-            "warnings": parse(row[9], []),
-            "error": row[10],
-            "workspace": row[11] or DEFAULT_WORKSPACE_NAME,
-            "workflow_name": row[12],
-            "run_id": row[13],
-            "run_dir": row[14],
-            "run_version": row[17],
-            "device": row[18],
-            "acknowledged": row[15] or ACK_NONE,
+            "manifest": parse(row["manifest"], []),
+            "warnings": parse(row["warnings"], []),
+            "error": row["error"],
+            "workspace": row["workspace"] or DEFAULT_WORKSPACE_NAME,
+            "workflow_name": row["workflow_name"],
+            "run_id": row["run_id"],
+            "run_dir": row["run_dir"],
+            "run_version": row["run_version"],
+            "device": row["device"],
+            "acknowledged": row["acknowledged"] or ACK_NONE,
             "acknowledged_cost": (spec or {}).get("acknowledged_cost"),
             "traceback": None,
             "event_count": len(events) if isinstance(events, list) else 0,
             "historical": True,
-            **({"note": row[19]} if row[19] else {}),
-            **({"rerun_of": row[20]} if row[20] else {}),
+            **({"note": row["note"]} if row["note"] else {}),
+            **({"rerun_of": row["rerun_of"]} if row["rerun_of"] else {}),
         }
diff --git a/dw/server/job_results.py b/dw/server/job_results.py
index 7a7787060..64aa38ee9 100644
--- a/dw/server/job_results.py
+++ b/dw/server/job_results.py
@@ -25,6 +25,7 @@
     WorkerCrashed,
     WorkflowLoaded,
     parse_reply,
+    poisons_cuda_context,
 )
 from ..notes import set_run_note
 from ..security import SecurityError, validate_path
@@ -194,6 +195,11 @@ def consume_results(job, manager, slot, output_dir, record_memory):
             # real files, and a job that reports an empty manifest hides
             # them behind the error that stopped the run
             record_manifest(job, reply.manifest, output_dir)
+            if poisons_cuda_context(reply.message, reply.traceback):
+                # The worker exits after this reply; let it finish so the
+                # next job respawns a clean process rather than queueing
+                # behind a dying one
+                manager.await_exit()
             return (FAILED, reply.message, reply.traceback)
         elif isinstance(reply, WorkerCrashed):
             manager.mark_crashed()
diff --git a/dw/server/jobs.py b/dw/server/jobs.py
index 250151741..d71541736 100644
--- a/dw/server/jobs.py
+++ b/dw/server/jobs.py
@@ -62,7 +62,7 @@
 from . import dispatch, job_results, pool, worker_memory
 from .dispatch import Dispatcher
 from .job_history import JobHistory
-from .outputs import job_run_directory, with_run_note
+from .outputs import job_run_directory, with_run_note, with_run_state
 from .job_record import (
     ACK_NONE,
     CANCELLED,
@@ -816,12 +816,26 @@ def _slot_running(self, job_id):
 
     def _finish(self, job, status, error=None, traceback_text=None):
         job.finish(status, error=error, traceback_text=traceback_text)
+        self._stamp_roles(job)
         try:
             self.history.record(job)
         except Exception as e:
             logger.warning(f"Could not persist job {job.id}: {e}")
         self._trim_terminal_jobs()
 
+    def _stamp_roles(self, job):
+        """Put each manifest entry's role on the job while its run directory
+        is read, so history serves the entries a live job does (#957) - the
+        run may be moved before the job is read back. Roles only: no note."""
+        try:
+            location = self.run_location(job.id)
+            if location is not None and isinstance(job.manifest, list):
+                job.manifest = with_run_state(
+                    {"manifest": job.manifest}, *location, note=False
+                )["manifest"]
+        except Exception as e:
+            logger.warning(f"Could not read roles for job {job.id}: {e}")
+
     def forget_workspace(self, workspace):
         """Drop a deleted workspace's finished jobs, in memory and in history
         (#913), so a workspace later created under the same name lists none
diff --git a/dw/server/observed_cost.py b/dw/server/observed_cost.py
index cd3992065..4e85341af 100644
--- a/dw/server/observed_cost.py
+++ b/dw/server/observed_cost.py
@@ -171,12 +171,21 @@ def _median(values):
     return (ordered[middle - 1] + ordered[middle]) / 2
 
 
+# The newest runs a side's median is taken over. A box gets faster (an engine
+# change, a cache) or slower, so a median over its whole history keeps quoting
+# the speed it had months ago: lem's reference-to-video template sat at ~460 s
+# from September runs while it now takes ~250-340 s, a 1.3x over-quote on every
+# inline copy (#1037). `runs` and the range still cover every comparable run.
+RECENT_RUNS = 5
+
+
 def _minutes_block(prefix, durations):
-    """One side of the cold/warm split, or {} when it has no runs."""
+    """One side of the cold/warm split, or {} when it has no runs. `durations`
+    are newest first (`observed_for` sorts them); the figure is the median of the newest `RECENT_RUNS`."""
     if not durations:
         return {}
     return {
-        f"{prefix}_minutes": round(_median(durations) / 60, 2),
+        f"{prefix}_minutes": round(_median(durations[:RECENT_RUNS]) / 60, 2),
         f"{prefix}_runs": len(durations),
         f"{prefix}_range_minutes": [
             round(min(durations) / 60, 2),
@@ -207,7 +216,8 @@ def observed_for(definition, rows, device=None, device_name=None, arguments=None
         return None
     task_only = _is_task_only(definition)
     cold, warm, unclassified, earliest = [], [], 0, None
-    for row in rows:
+    # Rows arrive unordered; the recent-runs median reads newest first
+    for row in sorted(rows, key=lambda r: r["finished_at"] or 0, reverse=True):
         if _every_step_was_reused(row["manifest"]):
             continue
         try:
diff --git a/dw/server/outputs.py b/dw/server/outputs.py
index 908879f75..1a1cebb2f 100644
--- a/dw/server/outputs.py
+++ b/dw/server/outputs.py
@@ -32,7 +32,7 @@
     LibraryRoot,
     library_path,
 )
-from ..notes import read_notes
+from ..notes import effective_note, read_notes, read_starred
 from ..roles import ROLE_DECLARED_KEY, consumed_outputs, entry_role, listed_role
 from ..runs import (
     MANIFEST_FILE_NAME,
@@ -547,12 +547,51 @@ def declared_files(run_dir):
 
 def listed_file_role(run_dir, name, consumed):
     """The role a listing shows for file `name` of a run: its recorded role,
-    demoted when `consumed` (dw/roles.py rule 4)."""
+    demoted when `consumed` (dw/roles.py rule 4), or for a run that recorded
+    none, what the file's subfolder and `consumed` still say."""
     return listed_role(
-        run_roles(run_dir).get(name), name in declared_files(run_dir), consumed
+        run_roles(run_dir).get(name),
+        name in declared_files(run_dir),
+        consumed,
+        name,
     )
 
 
+def output_annotations(run_dir, file_name, consumed, cache):
+    """What the server says about one output file of a run: `role` (demoted
+    when `consumed`), `note` and `note_source` when it has a note, `run_note`
+    when its run has one, `starred` when it is starred, and `version`, the
+    run's ordinal among its workflow's runs. The listing and the metadata
+    route both describe a file through this and build none of these
+    themselves - the run's notes.json is read here, once, for all of them.
+
+    `cache` is a dict the caller keeps for one listing, so each run's notes,
+    stars and each workflow's versions are read once, not once per file."""
+    notes = cache.setdefault("notes", {})
+    if run_dir not in notes:
+        notes[run_dir] = read_notes(run_dir)
+    stars = cache.setdefault("starred", {})
+    if run_dir not in stars:
+        stars[run_dir] = read_starred(run_dir)
+    identity_dir = os.path.dirname(run_dir)
+    versions = cache.setdefault("versions", {})
+    if identity_dir not in versions:
+        versions[identity_dir] = run_versions(identity_dir)
+    fields = {
+        "role": listed_file_role(run_dir, file_name, consumed),
+        "version": versions[identity_dir].get(os.path.basename(run_dir)),
+    }
+    note, source = effective_note(notes[run_dir], file_name)
+    if note:
+        fields["note"] = note
+        fields["note_source"] = source
+    if notes[run_dir]["run"]:
+        fields["run_note"] = notes[run_dir]["run"]
+    if file_name in stars[run_dir]:
+        fields["starred"] = True
+    return fields
+
+
 def consumed_in(state, ws):
     """`consumed_outputs` over a workspace's outputs, its assets found down
     the search path a run resolves 'asset:' in. Once per listing."""
@@ -638,15 +677,18 @@ def with_run_note(summary, path):
     return {**summary, "note": note} if note else summary
 
 
-def with_run_state(detail, root, run_dir, roles=True):
+def with_run_state(detail, root, run_dir, roles=True, note=True):
     """A job's detail with what its run directory says now: the run note,
     and each manifest entry's role. The worker reports the manifest it held
     in memory, which carries no roles - so each entry takes the role
-    `run_roles` gives its files; a run from before roles stays without. `roles` false leaves the manifest alone."""
+    `run_roles` gives its files; a run from before roles stays without.
+    `roles` false leaves the manifest alone; `note` false skips the notes
+    read, for a caller stamping roles alone (`JobManager._stamp_roles`)."""
     path = job_run_directory(root, run_dir)
     if path is None:
         return detail
-    detail = with_run_note(detail, path)
+    if note:
+        detail = with_run_note(detail, path)
     roles = run_roles(path) if roles else None
     manifest = detail.get("manifest")
     if not roles or not isinstance(manifest, list):
diff --git a/dw/server/routes/assets.py b/dw/server/routes/assets.py
index 3de01c7ee..786ac1aa7 100644
--- a/dw/server/routes/assets.py
+++ b/dw/server/routes/assets.py
@@ -514,13 +514,6 @@ def keep_output_as_asset(
         if job
         else None
     )
-    if job:
-        # The asset now names this job, so deleting the workspace must not
-        # take its row (#917)
-        try:
-            request.app.state.job_manager.history.mark_kept(job["id"])
-        except Exception as e:
-            logger.warning(f"Could not mark job {job['id']} kept: {e}")
     record_kept_shots(
         os.path.dirname(destination),
         os.path.basename(destination),
diff --git a/dw/server/routes/gallery.py b/dw/server/routes/gallery.py
index 947e43665..4a9bc15ab 100644
--- a/dw/server/routes/gallery.py
+++ b/dw/server/routes/gallery.py
@@ -23,9 +23,6 @@
 from ...notes import (
     NOTES_FILE_NAME,
     drop_file_note,
-    effective_note,
-    read_notes,
-    read_starred,
 )
 from ...roles import ROLES
 from ...runs import (
@@ -33,7 +30,6 @@
     REALIZED_FILE_NAME,
     is_run_id,
     record_run_versions,
-    run_versions,
     split_run_path,
 )
 from ...security import SecurityError, validate_path
@@ -49,7 +45,7 @@
     resolve_output_file,
     run_directory,
     consumed_in,
-    listed_file_role,
+    output_annotations,
     served_url,
     split_run_name,
     strip_output_prefix,
@@ -74,20 +70,9 @@ def _gallery_entries(root, ws, consumed=frozenset()):
         files = list(iter_gallery_files(root))
     except OSError:
         files = []
-    # One read of each workflow's run ordinals per listing, not per file:
-    # a run of fifty files would otherwise re-read the same manifests
-    # fifty times
-    versions_by_folder = {}
-    # And one read of each run's notes.json, for the same reason
-    notes_by_run = {}
-    starred_by_run = {}
-
-    def _version(folder, run_id):
-        if not run_id:
-            return None
-        if folder not in versions_by_folder:
-            versions_by_folder[folder] = run_versions(os.path.join(root, folder))
-        return versions_by_folder[folder].get(run_id)
+    # The per-listing cache output_annotations reads each run's notes,
+    # stars and versions through, once rather than once per file
+    cache = {}
 
     for relative_name, folder, subfolder, run_id, kind, path in files:
         try:
@@ -114,7 +99,7 @@ def _version(folder, run_id):
             # `name` is too long to quote. None under the flat
             # layout, which has no runs to number
             "run_id": run_id,
-            "version": _version(folder, run_id),
+            "version": None,
             # Quoted (slashes kept literal): a name carrying '#', '?'
             # or '%' would otherwise break the src the gallery
             # renders it into. The mtime still rides along for cache
@@ -130,21 +115,15 @@ def _version(folder, run_id):
         }
         # None under the flat layout, and for a file no manifest lists
         split = split_run_name(root, relative_name) if run_id else None
-        entry["role"] = (
-            listed_file_role(split[0], split[1], relative_name in consumed)
-            if split
-            else None
-        )
+        entry["role"] = None
         if split:
-            if split[0] not in notes_by_run:
-                notes_by_run[split[0]] = read_notes(split[0])
-            note = effective_note(notes_by_run[split[0]], split[1])[0]
-            if note:
-                entry["note"] = note
-            if split[0] not in starred_by_run:
-                starred_by_run[split[0]] = read_starred(split[0])
-            if split[1] in starred_by_run[split[0]]:
-                entry["starred"] = True
+            annotated = output_annotations(
+                split[0], split[1], relative_name in consumed, cache
+            )
+            # The listing does not report whose note it is, nor the run's
+            annotated.pop("note_source", None)
+            annotated.pop("run_note", None)
+            entry.update(annotated)
         absolute_url = absolute_served_url(output_path, ws, int(stat.st_mtime))
         if absolute_url is not None:
             entry["absolute_url"] = absolute_url
@@ -246,8 +225,9 @@ def gallery(
     Each entry carries `role`, `final` or `intermediate` (null for a
     flat-layout file or one no manifest lists); a file a later run read
     lists as intermediate unless its step declared it final
-    (dw/roles.py rule 4). `role` is a repeatable
-    filter; a null role counts as final. Omitted, every file is listed."""
+    (dw/roles.py rule 4). A run that recorded no role takes the role its
+    file's subfolder names, then rule 4; with neither it is null. `role`
+    is a repeatable filter; a null role counts as final. Omitted, every file is listed."""
     if role:
         unknown = sorted(set(role) - set(ROLES))
         if unknown:
diff --git a/dw/server/routes/jobs.py b/dw/server/routes/jobs.py
index cfb4c2775..d66edee33 100644
--- a/dw/server/routes/jobs.py
+++ b/dw/server/routes/jobs.py
@@ -11,6 +11,7 @@
 import json
 import logging
 import os
+from types import SimpleNamespace
 from typing import Optional, Union
 from urllib.parse import quote
 
@@ -44,7 +45,6 @@
     acknowledgement_form,
     admitted_note,
     admit_for,
-    bound_plan_for,
     check_bound_acknowledgement,
 )
 from ..catalog import (
@@ -147,8 +147,18 @@ def submit_job(
             base_dir=request.base_dir,
             output_dir=workspace.outputs,
             workflow_dir=workflow_dir,
+            # The plan validate builds, history included, so a 409 quotes
+            # the figure a re-validate would (#1038); only the hub size
+            # lookup is skipped
             plan_for=(
-                bound_plan_for(request.arguments, workspace)
+                _bound_plan_for(
+                    state,
+                    workspace,
+                    request.workflow_path,
+                    request.arguments,
+                    source,
+                    catalog_name_for(resolved, source),
+                )
                 if form == ACK_BOUND
                 else None
             ),
@@ -433,7 +443,18 @@ def rerun_job(request: Request, job_id: str, body: RerunRequest = RerunRequest()
             output_dir=spec.get("output_dir") or manager.output_dir,
             workflow_dir=spec.get("workflow_dir") or manager.workflow_dir,
             plan_for=(
-                bound_plan_for(arguments, workspace) if form == ACK_BOUND else None
+                _bound_plan_for(
+                    state,
+                    workspace,
+                    spec.get("workflow_path"),
+                    arguments,
+                    resolve_workflow_reference(
+                        spec.get("workflow_path"), sources_for(state, workspace)
+                    )[1],
+                    spec.get("catalog_name"),
+                )
+                if form == ACK_BOUND
+                else None
             ),
             catalog_name=spec.get("catalog_name"),
         )
@@ -790,6 +811,20 @@ def observed_for_child(path, child_definition, arguments=None):
         return None
 
 
+def _bound_plan_for(state, workspace, workflow_path, arguments, source, catalog_name):
+    """The `plan_for` a bound acknowledgement is checked against: the plan
+    /api/validate builds for the same run, without the hub size lookup, so
+    a 409 quotes the observed estimate validate would (#1038)."""
+    request = SimpleNamespace(workflow_path=workflow_path, arguments=arguments)
+
+    def plan_for(candidate, vram_need=None):
+        return _validation_plan(
+            state, candidate, vram_need, request, workspace, source, catalog_name, False
+        )
+
+    return plan_for
+
+
 @router.post(
     "/api/validate", response_model=ValidationResult, response_model_exclude_unset=True
 )
diff --git a/dw/server/routes/media.py b/dw/server/routes/media.py
index e6bd3f4bc..677c521b5 100644
--- a/dw/server/routes/media.py
+++ b/dw/server/routes/media.py
@@ -89,7 +89,7 @@
     resolve_output_file,
     run_directory,
     consumed_in,
-    listed_file_role,
+    output_annotations,
     run_inputs,
     strip_output_prefix,
     validated_run_split,
@@ -203,9 +203,15 @@ def gallery_metadata(
             consumed = relative.replace(os.sep, "/") in consumed_in(
                 request.app.state, ws
             )
-            role = listed_file_role(split[0], split[1], consumed)
+            annotated = output_annotations(split[0], split[1], consumed, {})
+            role = annotated["role"]
+            version = annotated["version"]
             inputs = run_inputs(split[0])
-            notes = _note_fields(read_notes(split[0]), split[1])
+            notes = {
+                key: annotated[key]
+                for key in ("note", "note_source", "starred", "run_note")
+                if key in annotated
+            }
     metadata = read_embedded_metadata(path)
     if metadata is not None and not include_workflow and "workflow" in metadata:
         metadata = {
@@ -269,14 +275,6 @@ def _image_media(path):
         return None
 
 
-def _note_fields(notes, name):
-    """The metadata route's note keys for file `name` of a run, each only
-    when set."""
-    note, source = effective_note(notes, name)
-    fields = {"note": note, "note_source": source, "run_note": notes["run"]}
-    return {key: value for key, value in fields.items() if value}
-
-
 @router.get("/api/gallery/{name:path}/assess")
 def gallery_assess(
     request: Request,
diff --git a/dw/task_domains.py b/dw/task_domains.py
index 4956c2994..d5af355d0 100644
--- a/dw/task_domains.py
+++ b/dw/task_domains.py
@@ -754,7 +754,8 @@ def slice_region(
     """The region a `slice_audio` call asks for, as `(start, length)` in
     samples, or None when it cannot be worked out.
 
-    Seconds win over frames, as in the run. A frame-addressed end is rounded
+    Seconds win over frames, as in the run, except that a start in seconds
+    with no duration takes its length from `num_frames` / `fps` (#990). A frame-addressed end is rounded
     once, not as two rounded halves (#557), so a slice meant to reach the
     source's exact end does. A slice with no duration (or no `num_frames`)
     runs to the source's end, which takes `total`, the source's length in
@@ -768,6 +769,10 @@ def slice_region(
         start = int(round((start_seconds or 0) * sample_rate))
         if duration_seconds is not None:
             return start, int(round(duration_seconds * sample_rate))
+        if num_frames is not None and fps:
+            # A start in seconds with a length in frames (#990): the length
+            # was dropped and the slice ran to the source's end
+            return start, frames_to_samples(num_frames, fps, sample_rate)
     elif start_frame is not None or num_frames is not None:
         if not fps:
             return None
diff --git a/dw/task_problems.py b/dw/task_problems.py
index 43f08b5b1..08564117c 100644
--- a/dw/task_problems.py
+++ b/dw/task_problems.py
@@ -205,7 +205,8 @@ def paste_face_track_errors(arguments):
 def check_face_detector_source(repo, filename):
     """Refuse a detector source that is not a Hub repo id and a bare .onnx
     file name in it - before anything is downloaded."""
-    from .locations import validate_hub_repo_id, validate_weight_name
+    from .locations import validate_hub_repo_id
+    from .security import validate_weight_name
 
     validate_hub_repo_id(repo, what="detector_repo")
     validate_weight_name(
@@ -234,8 +235,8 @@ def face_track_errors(arguments):
         if name in arguments
     }
     errors = face_track_problems(**literal)
-    from .locations import validate_hub_repo_id, validate_weight_name
-    from .security import SecurityError
+    from .locations import validate_hub_repo_id
+    from .security import SecurityError, validate_weight_name
 
     for name, check in (
         ("detector_repo", lambda v: validate_hub_repo_id(v, what=name)),
diff --git a/dw/tasks/assess.py b/dw/tasks/assess.py
index 0f3a4bf39..970255c29 100644
--- a/dw/tasks/assess.py
+++ b/dw/tasks/assess.py
@@ -39,12 +39,26 @@
 from .. import dsp
 from ..media import read_thumbnails_and_track
 from ..events import emit_warning
+from .image_ops import luma
 
 logger = logging.getLogger("dw")
 
 THUMB_WIDTH = 64
 THUMB_HEIGHT = 36
 
+# The colour frame each look stat is taken from (#1031): big enough that a
+# 3x3 high-pass still sees detail, small enough to reduce at decode speed
+LOOK_WIDTH = 128
+LOOK_HEIGHT = 72
+LOOK_MEASURES = ("lightness", "contrast", "saturation", "detail")
+
+# Frames either side of a seam its look is averaged over, and the floors
+# under a look step's local rate and a detail ratio's denominator - all on
+# the 0-255 scale, like frame_delta
+LOOK_WINDOW = 4
+LOOK_RATE_FLOOR = 1.0
+DETAIL_FLOOR = 0.5
+
 # Audio windows around a seam, in seconds. The edge windows say whether the
 # join itself is voiced (the hole guard) and what the balance does across it;
 # they are not the level step, which is shot against shot (`_shot_rms`): a
@@ -81,6 +95,8 @@ class Media:
     thumbs: (frames, THUMB_HEIGHT, THUMB_WIDTH) uint8 grey, or None
     audio: (channels, samples) float32, or None
     video_seconds / audio_seconds: each stream's own duration, or None
+    looks: (frames, 4) float32 `look_stats` per frame (LOOK_MEASURES
+        order), or None
     """
 
     def __init__(
@@ -92,8 +108,10 @@ def __init__(
         video_seconds=None,
         audio_seconds=None,
         shots=None,
+        looks=None,
     ):
         self.thumbs = thumbs
+        self.looks = looks
         self.audio = audio
         self.sample_rate = sample_rate
         self.fps = fps
@@ -112,10 +130,18 @@ def read_media(path):
     Each decoded frame is reduced to a grey thumbnail as it arrives and then
     dropped, so memory holds thumbnails, not pictures. The soundtrack is
     kept whole (the probes cut windows out of it anywhere) and trimmed to
-    the audio stream's reported duration.
+    the audio stream's reported duration. Each frame's look stats are taken
+    from a LOOK_WIDTH x LOOK_HEIGHT colour copy as it arrives.
     """
-    thumbs, chunks, fps, video_seconds, audio_seconds, sample_rate = (
-        read_thumbnails_and_track(path, THUMB_WIDTH, THUMB_HEIGHT)
+    thumbs, chunks, fps, video_seconds, audio_seconds, sample_rate, looks = (
+        read_thumbnails_and_track(
+            path,
+            THUMB_WIDTH,
+            THUMB_HEIGHT,
+            look=look_stats,
+            look_width=LOOK_WIDTH,
+            look_height=LOOK_HEIGHT,
+        )
     )
 
     waveform = None
@@ -132,12 +158,35 @@ def read_media(path):
         fps,
         video_seconds,
         audio_seconds,
+        looks=numpy.stack(looks) if looks else None,
     )
 
 
-def _thumb(frame):
+def look_stats(rgb):
+    """A frame's look as four float32 scalars on the 0-255 scale, in
+    LOOK_MEASURES order: lightness (mean Rec. 709 luma), contrast (luma
+    standard deviation), saturation (mean per-pixel max(RGB) - min(RGB)) and
+    detail (mean |luma - its 3x3 box blur|, edges extended). The one
+    reduction both the file reader and the in-memory path use."""
+    import scipy.ndimage
+
+    rgb = numpy.asarray(rgb, dtype=numpy.float32)
+    plane = luma(rgb)
+    blurred = scipy.ndimage.uniform_filter(plane, size=3, mode="nearest")
+    return numpy.array(
+        [
+            plane.mean(),
+            plane.std(),
+            (rgb.max(axis=-1) - rgb.min(axis=-1)).mean(),
+            numpy.abs(plane - blurred).mean(),
+        ],
+        dtype=numpy.float32,
+    )
+
+
+def _image(frame):
     """One in-memory frame (PIL image, or an HxWxC array or tensor, uint8 or
-    float in [0, 1]) as a grey thumbnail."""
+    float in [0, 1]) as a PIL image."""
     from PIL import Image
 
     if not isinstance(frame, Image.Image):
@@ -151,26 +200,50 @@ def _thumb(frame):
         if array.ndim == 3 and array.shape[-1] == 1:
             array = array[..., 0]
         frame = Image.fromarray(array)
-    return numpy.asarray(
-        frame.convert("L").resize((THUMB_WIDTH, THUMB_HEIGHT), Image.BILINEAR),
+    return frame
+
+
+def _thumb(frame):
+    """One in-memory frame as (its grey thumbnail, its look_stats)."""
+    from PIL import Image
+
+    image = _image(frame)
+    thumb = numpy.asarray(
+        image.convert("L").resize((THUMB_WIDTH, THUMB_HEIGHT), Image.BILINEAR),
         dtype=numpy.uint8,
     )
+    look = look_stats(
+        numpy.asarray(
+            image.convert("RGB").resize((LOOK_WIDTH, LOOK_HEIGHT), Image.BILINEAR)
+        )
+    )
+    return thumb, look
 
 
 def _in_memory_thumbs(frames):
-    """Thumbnails of an AudioVideo's frames, one frame at a time: a list, an
-    (N, H, W, C) array, or a SegmentedFrames replaying (N, H, W, 3) chunks."""
+    """(thumbnails, looks) of an AudioVideo's frames, one frame at a time: a
+    list, an (N, H, W, C) array, or a SegmentedFrames replaying (N, H, W, 3)
+    chunks. Both None for no frames."""
     from ..pipeline_processors.chain import SegmentedFrames
 
     thumbs = []
+    looks = []
+
+    def add(frame):
+        thumb, look = _thumb(frame)
+        thumbs.append(thumb)
+        looks.append(look)
+
     if isinstance(frames, SegmentedFrames):
         for chunk in frames:
             for frame in chunk:
-                thumbs.append(_thumb(frame))
+                add(frame)
     else:
         for frame in frames:
-            thumbs.append(_thumb(frame))
-    return numpy.stack(thumbs) if thumbs else None
+            add(frame)
+    if not thumbs:
+        return None, None
+    return numpy.stack(thumbs), numpy.stack(looks)
 
 
 def _file_path(video):
@@ -195,10 +268,10 @@ def media_from(video):
     if hasattr(video, "frames") or hasattr(video, "audio"):
         audio = getattr(video, "audio", None)
         waveform = None if audio is None else dsp.as_channels_samples(audio)
-        thumbs = (
+        thumbs, looks = (
             _in_memory_thumbs(video.frames)
             if getattr(video, "frames", None) is not None
-            else None
+            else (None, None)
         )
         sample_rate = getattr(video, "sample_rate", None)
         fps = getattr(video, "fps", None)
@@ -216,6 +289,7 @@ def media_from(video):
                 else None
             ),
             shots=getattr(video, "shots", None),
+            looks=looks,
         )
         return media
     raise ValueError(
@@ -690,6 +764,86 @@ def _seam_video(media, previous, shot, fade):
     }
 
 
+_LOOK_STEPS = ("saturation", "lightness", "contrast")
+_NO_LOOK = {
+    "saturation_step": None,
+    "lightness_step": None,
+    "contrast_step": None,
+    "look_ratio": None,
+    "look_ratio_measure": None,
+    "detail_ratio": None,
+}
+
+
+def _look_rate(values):
+    """The TYPICAL_DELTA_PERCENTILE of the change between one LOOK_WINDOW-frame
+    mean and the next inside `values` - the seam step's own statistic, taken
+    where no seam is - or None for a span too short to hold two windows."""
+    if values.shape[0] < 2 * LOOK_WINDOW:
+        return None
+    means = numpy.convolve(values, numpy.ones(LOOK_WINDOW) / LOOK_WINDOW, "valid")
+    return float(
+        numpy.percentile(
+            numpy.abs(means[LOOK_WINDOW:] - means[:-LOOK_WINDOW]),
+            TYPICAL_DELTA_PERCENTILE,
+        )
+    )
+
+
+def _shot_end(shot, frames):
+    count = int(shot.get("num_frames") or 0)
+    start = int(shot.get("start_frame", 0))
+    return min(frames, start + count) if count else frames
+
+
+def _seam_look(media, previous, shot, fade):
+    """Look measurements at the seam `shot` opens (#1031): the mean look of
+    the LOOK_WINDOW frames before it (before a dissolve's fade) against the
+    LOOK_WINDOW after, clipped to the shots. Each step is signed, after minus
+    before; `look_ratio` is the largest step against that measure's own
+    local rate inside either shot, floored, so a step inside a shot that is
+    itself changing that way (a sunrise) scores low. Measures, not rules."""
+    looks = media.looks
+    if looks is None:
+        return dict(_NO_LOOK)
+    frames = looks.shape[0]
+    start = min(frames, int(shot.get("start_frame", 0)))
+    previous_start = min(
+        start,
+        int(previous.get("start_frame", 0)) + int(previous.get("overlap_frames") or 0),
+    )
+    after_start = min(frames, start + fade)
+    after_end = _shot_end(shot, frames)
+    before = looks[max(previous_start, start - LOOK_WINDOW) : start]
+    after = looks[after_start : min(after_end, after_start + LOOK_WINDOW)]
+    if before.shape[0] == 0 or after.shape[0] == 0:
+        return dict(_NO_LOOK)
+    before_mean = before.mean(axis=0, dtype=numpy.float64)
+    after_mean = after.mean(axis=0, dtype=numpy.float64)
+    record = {}
+    ratio, ratio_measure = None, None
+    for measure in _LOOK_STEPS:
+        column = LOOK_MEASURES.index(measure)
+        step = float(after_mean[column] - before_mean[column])
+        record[f"{measure}_step"] = _round(step)
+        rates = [
+            _look_rate(looks[previous_start:start, column]),
+            _look_rate(looks[after_start:after_end, column]),
+        ]
+        rate = max([LOOK_RATE_FLOOR] + [value for value in rates if value is not None])
+        if ratio is None or abs(step) / rate > ratio:
+            ratio, ratio_measure = abs(step) / rate, measure
+    detail = LOOK_MEASURES.index("detail")
+    record["look_ratio"] = _round(ratio)
+    record["look_ratio_measure"] = ratio_measure
+    record["detail_ratio"] = (
+        _round(float(after_mean[detail] / before_mean[detail]))
+        if before_mean[detail] >= DETAIL_FLOOR
+        else None
+    )
+    return record
+
+
 def analyze_seams(video, shots=None):
     """Task command: measure every seam between shots, audio and picture.
 
@@ -704,8 +858,11 @@ def analyze_seams(video, shots=None):
         {seams: [{seam, between, seconds, kind, level_step_db,
         before_shot_rms_dbfs, after_shot_rms_dbfs, floor_dbfs, click_db,
         spectral_shift, before_rms_dbfs, after_rms_dbfs,
-        frame_delta, typical_delta, jump_ratio}], findings, rules_applied,
-        rules_skipped, shots_source}
+        frame_delta, typical_delta, jump_ratio, saturation_step,
+        lightness_step, contrast_step, look_ratio, look_ratio_measure,
+        detail_ratio}], findings, rules_applied, rules_skipped,
+        shots_source}. The look fields are measures only - no rule reads
+        them - and null when the media has no picture.
     """
     media = media_from(video)
     return seams_answer(media, *resolve_shots(video, media, shots))
@@ -773,6 +930,7 @@ def seams_answer(media, records, source):
             skip.add("seam_hole")
         if media.thumbs is not None:
             record.update(_seam_video(media, previous, shot, fade))
+        record.update(_seam_look(media, previous, shot, fade))
         if record["hard_cut"] or "audio_bleed_ms" in record:
             # A bled seam is still a picture cut (#783)
             skip.add("seam_frame_jump")
diff --git a/dw/tasks/audio_dynamics.py b/dw/tasks/audio_dynamics.py
index bf1604f9d..501fd1d12 100644
--- a/dw/tasks/audio_dynamics.py
+++ b/dw/tasks/audio_dynamics.py
@@ -7,6 +7,7 @@
 """
 
 import logging
+import os
 
 import numpy
 
@@ -66,7 +67,12 @@ def normalize_audio(
             plain gain would have reached, more on dense material, so the
             reported gain_db can run past target_lufs's own gain. Limiting
             stops at 12 dB of reduction, past which target_lufs is warned as
-            capped. False (the default) leaves behavior exactly as without it
+            capped. When the input carries shots (a joined cut) and the
+            limiter works mostly on one of them, a limiter_uneven_across_shots
+            warning names it: that shot ends up quieter than a static gain
+            would leave it, widening its seam steps (#1039) - fix its level
+            before normalizing. False (the default) leaves behavior exactly
+            as without it
         sample_rate: Sample rate of a waveform passed directly
 
     Returns:
@@ -86,8 +92,19 @@ def normalize_audio(
         logger.warning("normalize_audio: the track is silent - left unchanged")
         return as_track(waveform, sample_rate, "normalize_audio")
     if limit:
+        shots = getattr(audio, "shots", None)
+        fps = getattr(audio, "fps", None)
+        if isinstance(audio, str):
+            shots, fps = _shots_of_file(audio)
         return as_track(
-            _normalize_limited(waveform, sample_rate, peak_dbfs, target_lufs),
+            _normalize_limited(
+                waveform,
+                sample_rate,
+                peak_dbfs,
+                target_lufs,
+                shots=shots,
+                fps=fps,
+            ),
             sample_rate,
             "normalize_audio",
         )
@@ -145,7 +162,39 @@ def normalize_audio(
     )
 
 
-def _normalize_limited(waveform, sample_rate, peak_dbfs, target_lufs):
+def _shots_of_file(path):
+    """(shots, fps) a saved video file carries - the shots its run manifest
+    recorded for it and the rate its container declares - or (None, None)
+    for an audio file, a URL or a path the manifest does not know (#1041).
+    A path given as `output:`/`asset:` reaches the task as a string, so the
+    shots an in-run `previous_result:` carries are read off the disk here."""
+    from ..runs import shots_beside
+    from ..security import ALLOWED_VIDEO_EXTENSIONS
+    from .video_utils import local_video_path
+
+    if (
+        os.path.splitext(path.split("?", 1)[0])[1].lower()
+        not in ALLOWED_VIDEO_EXTENSIONS
+    ):
+        return None, None
+    try:
+        local = local_video_path(path)
+        if local is None:
+            return None, None
+        shots = shots_beside(local)
+        if not shots:
+            return None, None
+        from ..media import container_fps
+
+        return shots, container_fps(local)
+    except Exception as error:
+        logger.debug(f"No shots for {path}: {error}")
+        return None, None
+
+
+def _normalize_limited(
+    waveform, sample_rate, peak_dbfs, target_lufs, shots=None, fps=None
+):
     """normalize_audio(limit=True): a static gain, applied uncapped, with a
     true-peak limiter holding peak_dbfs. The limiter is never a gain stage -
     it only tames what the static gain sends it - but that static gain is
@@ -239,6 +288,7 @@ def _normalize_limited(waveform, sample_rate, peak_dbfs, target_lufs):
             peak_dbfs=peak_dbfs,
             target_lufs=target_lufs,
         )
+    _warn_uneven_limiting(waveform, output, gain_db, sample_rate, shots, fps, peak_dbfs)
     emit_log(
         f"normalize_audio: measured {input_peak_db:.1f} dBTP"
         + ("" if measured_lufs is None else f", {measured_lufs:.1f} LUFS")
@@ -258,6 +308,65 @@ def _normalize_limited(waveform, sample_rate, peak_dbfs, target_lufs):
     return output
 
 
+# A shot the limiter takes this much off (effective, by rms) while it takes
+# SHOT_LIMITING_SPREAD_DB less off the median shot is worth a warning (#1039)
+SHOT_LIMITING_DB = 2.0
+SHOT_LIMITING_SPREAD_DB = 2.0
+
+
+def _warn_uneven_limiting(
+    waveform, output, gain_db, sample_rate, shots, fps, peak_dbfs
+):
+    """Warn when the limiter's work falls mostly on one shot of a cut: a
+    whole-cut limiter that holds one shot's peaks lowers that shot alone, so
+    the seam steps around it widen while the cut still lands on target_lufs.
+    Needs the input's shots and fps; without them there is nothing to name."""
+    if not shots or not fps or fps <= 0:
+        return
+    gain = 10 ** (gain_db / 20)
+    total = waveform.shape[-1]
+    reductions = []
+    for index, shot in enumerate(shots):
+        try:
+            start = int(round(shot["start_frame"] / fps * sample_rate))
+            end = int(
+                round((shot["start_frame"] + shot["num_frames"]) / fps * sample_rate)
+            )
+        except (KeyError, TypeError):
+            continue
+        start, end = max(0, start), min(total, end)
+        if end - start < sample_rate // 10:
+            continue
+        before = float(numpy.sqrt(numpy.mean((waveform[:, start:end] * gain) ** 2)))
+        after = float(
+            numpy.sqrt(numpy.mean(output[:, start:end].astype(numpy.float64) ** 2))
+        )
+        if before <= 0 or after <= 0:
+            continue
+        reductions.append(
+            (shot.get("name") or f"shot {index}", 20 * numpy.log10(before / after))
+        )
+    if len(reductions) < 2:
+        return
+    name, worst = max(reductions, key=lambda item: item[1])
+    median = float(numpy.median([value for _, value in reductions]))
+    if worst < SHOT_LIMITING_DB or worst - median < SHOT_LIMITING_SPREAD_DB:
+        return
+    emit_warning(
+        f"normalize_audio: the limiter takes {worst:.1f} dB off shot {name!r} "
+        f"against a median of {median:.1f} dB across the cut's shots - that "
+        "shot ends up quieter than a static gain would leave it, which widens "
+        "the level steps at its seams. Fix that shot's level before "
+        "normalizing, or lower target_lufs.",
+        kind="limiter_uneven_across_shots",
+        command="normalize_audio",
+        shot=name,
+        shot_reduction_db=round(worst, 2),
+        median_reduction_db=round(median, 2),
+        peak_dbfs=peak_dbfs,
+    )
+
+
 COMPRESS_MODES = ("compress", "limit", "gate")
 
 # A floor below which an envelope is treated as digital silence, so its dBFS
diff --git a/dw/tasks/audio_transcription.py b/dw/tasks/audio_transcription.py
index d72410e20..531acdc4a 100644
--- a/dw/tasks/audio_transcription.py
+++ b/dw/tasks/audio_transcription.py
@@ -10,17 +10,18 @@
 audio_utils.py alongside the other audio tasks: those tasks share that
 module and lazily import transformers only when a task that needs it runs,
 and a module-level import here would force that heavy import on every one
-of them.
+of them. transformers is imported inside the loader for the same reason:
+the plan's `required_weights` lookup imports this module at validate time.
 """
 
 import logging
 
 import numpy
-from transformers import pipeline as hf_pipeline
 
 from .. import preferred_task_dtype
 from ..events import emit_warning
 from .model_cache import cached_model, hf_pipeline_placement
+from .weights import argument_or_default, repo_entries
 from ..assessment_rules import DEAD_AIR_FLOOR_DBFS
 from ..dsp import loudest_window_dbfs, resample_waveform
 from ..script_lines import looped_texts, normalize_words
@@ -29,6 +30,18 @@
 
 logger = logging.getLogger("dw")
 
+
+def hf_pipeline(*args, **kwargs):
+    """`transformers.pipeline`, imported on the first call rather than at
+    module top: the plan's `required_weights` lookup imports this module on
+    every validate of one of its steps, and transformers costs a second-plus
+    the server need not pay. A module-level name so the tests patch it as
+    one (`patch("dw.tasks.audio_transcription.hf_pipeline")`)."""
+    from transformers import pipeline
+
+    return pipeline(*args, **kwargs)
+
+
 WHISPER_DEFAULT_MODEL = "openai/whisper-base"
 _ASR_SAMPLE_RATE = 16000
 # Public: dw/scalar_result_validation.py checks a literal `timestamps`
@@ -38,6 +51,16 @@
 TIMESTAMP_KINDS = ("segment", "word")
 
 
+def model_source(arguments):
+    """The ASR repo a transcribe_audio (or check_script) step loads."""
+    return argument_or_default(arguments, "model_name", WHISPER_DEFAULT_MODEL)
+
+
+def required_weights(arguments):
+    """The ASR model's repo, for the plan (dw/tasks/weights.py)."""
+    return repo_entries(model_source(arguments))
+
+
 def _downmixed_mono(waveform):
     """Average a (channels, samples) waveform down to one channel.
 
@@ -92,7 +115,7 @@ def transcribe_audio(audio, device="cpu", sample_rate=None, **kwargs):
             0
         ]
 
-    model_name = kwargs.get("model_name", WHISPER_DEFAULT_MODEL)
+    model_name = model_source(kwargs)
     dtype = preferred_task_dtype(device)
 
     def load_pipe():
diff --git a/dw/tasks/background_remover.py b/dw/tasks/background_remover.py
index bc2fa9e80..09fbd9e83 100644
--- a/dw/tasks/background_remover.py
+++ b/dw/tasks/background_remover.py
@@ -1,16 +1,27 @@
 from PIL import Image
 import torch
 from torchvision import transforms
-from transformers import AutoModelForImageSegmentation
 
 from .model_cache import cached_model
+from .weights import repo_entries
 
 _MODEL_NAME = "briaai/RMBG-2.0"
 
 
+def required_weights(arguments):
+    """The one fixed repo remove_background loads, for the plan
+    (dw/tasks/weights.py) - it takes no model argument."""
+    return repo_entries(_MODEL_NAME)
+
+
 def remove_background(image: Image, device) -> Image:
     # Model settings
     def load_model():
+        # Imported here, not at module top: the plan's `required_weights`
+        # lookup imports this module on every validate of a remove_background
+        # step, and transformers is a second-plus import the server need not pay
+        from transformers import AutoModelForImageSegmentation
+
         model = AutoModelForImageSegmentation.from_pretrained(
             _MODEL_NAME, trust_remote_code=True
         )
diff --git a/dw/tasks/depth_estimator.py b/dw/tasks/depth_estimator.py
index aeab05423..31201ab87 100644
--- a/dw/tasks/depth_estimator.py
+++ b/dw/tasks/depth_estimator.py
@@ -1,10 +1,33 @@
 import torch
 import numpy as np
-from transformers import pipeline
+
 from torchvision import transforms
 
 from .. import preferred_task_dtype
 from .model_cache import cached_model
+from .weights import repo_entries
+
+
+def pipeline(*args, **kwargs):
+    """`transformers.pipeline`, imported on the first call rather than at
+    module top: the plan's `required_weights` lookup imports this module on
+    every validate of a depth step, and transformers costs a second-plus the
+    server need not pay. A module-level name so the tests patch it as one
+    (`patch("dw.tasks.depth_estimator.pipeline")`)."""
+    from transformers import pipeline as hf_pipeline
+
+    return hf_pipeline(*args, **kwargs)
+
+
+# transformers' own default for "depth-estimation", named so the plan can list
+# it and a transformers upgrade cannot move it silently
+_MODEL_NAME = "Intel/dpt-large"
+_REVISION = "bc15f29"
+
+
+def required_weights(arguments):
+    """The depth model's repo, for the plan (dw/tasks/weights.py)."""
+    return repo_entries(_MODEL_NAME)
 
 
 def make_hint_tensor(image, device, dtype=None):
@@ -21,7 +44,9 @@ def make_hint_tensor(image, device, dtype=None):
     """
     depth_estimator = cached_model(
         ("depth_estimator", str(device)),
-        lambda: pipeline("depth-estimation", device=device),
+        lambda: pipeline(
+            "depth-estimation", model=_MODEL_NAME, revision=_REVISION, device=device
+        ),
     )
 
     image = depth_estimator(image)["depth"]
diff --git a/dw/tasks/diffusion_upscale.py b/dw/tasks/diffusion_upscale.py
index 560666813..2546b19d8 100644
--- a/dw/tasks/diffusion_upscale.py
+++ b/dw/tasks/diffusion_upscale.py
@@ -14,6 +14,7 @@
 import diffusers
 from .. import preferred_task_dtype
 from .model_cache import cached_model
+from .weights import argument_or_default, repo_entries
 
 logger = logging.getLogger("dw")
 
@@ -29,6 +30,21 @@
 }
 
 
+def model_source(arguments):
+    """The repo a diffusion_upscale step loads - `model_name` over the
+    selected mode's default - or None for a mode that is not one of _MODELS
+    (refused when the step runs)."""
+    config = _MODELS.get(argument_or_default(arguments, "mode", "x4"))
+    if config is None:
+        return None
+    return argument_or_default(arguments, "model_name", config["model_name"])
+
+
+def required_weights(arguments):
+    """The upscale pipeline's repo, for the plan (dw/tasks/weights.py)."""
+    return repo_entries(model_source(arguments))
+
+
 def diffusion_upscale(image, device="cpu", **kwargs):
     """Upscale an image using a Stable Diffusion upscale pipeline.
 
@@ -47,12 +63,12 @@ def diffusion_upscale(image, device="cpu", **kwargs):
     Returns:
         PIL Image (upscaled).
     """
-    mode = kwargs.get("mode", "x4")
+    mode = argument_or_default(kwargs, "mode", "x4")
     if mode not in _MODELS:
         raise ValueError(f"mode must be one of {sorted(_MODELS.keys())}, got '{mode}'")
 
     config = _MODELS[mode]
-    model_name = kwargs.get("model_name", config["model_name"])
+    model_name = model_source(kwargs)
     prompt = kwargs.get("prompt", "")
     negative_prompt = kwargs.get("negative_prompt", None)
     num_inference_steps = int(kwargs.get("num_inference_steps", 25))
diff --git a/dw/tasks/face_track.py b/dw/tasks/face_track.py
index 3536f75cb..654986cb2 100644
--- a/dw/tasks/face_track.py
+++ b/dw/tasks/face_track.py
@@ -48,6 +48,7 @@
 )
 from ..variable_constraints import aligned
 from .video_utils import frames_as_pil_list, load_audio_video
+from .weights import argument_or_default, file_entries
 
 logger = logging.getLogger("dw")
 
@@ -345,6 +346,20 @@ def pad_frames(crops, before, after):
     return [crops[i] for i in indices]
 
 
+def detector_source(arguments):
+    """The (repo, file, revision) a crop_face_track step loads YuNet from -
+    `detector_repo` and `detector_file` over the defaults, the default repo
+    read at its pinned commit and any other at its main."""
+    repo = argument_or_default(arguments, "detector_repo", DEFAULT_DETECTOR_REPO)
+    filename = argument_or_default(arguments, "detector_file", DEFAULT_DETECTOR_FILE)
+    return repo, filename, DETECTOR_REVISION if repo == DEFAULT_DETECTOR_REPO else None
+
+
+def required_weights(arguments):
+    """The face detector's weight file, for the plan (dw/tasks/weights.py)."""
+    return file_entries(*detector_source(arguments))
+
+
 def _detector(repo, filename, min_confidence, device):
     """A callable running YuNet on an RGB array, loaded once per device."""
     import cv2
@@ -352,8 +367,10 @@ def _detector(repo, filename, min_confidence, device):
     from .. import get_device_type
     from .model_cache import cached_model
 
+    repo, filename, revision = detector_source(
+        {"detector_repo": repo, "detector_file": filename}
+    )
     check_face_detector_source(repo, filename)
-    revision = DETECTOR_REVISION if repo == DEFAULT_DETECTOR_REPO else None
 
     use_cuda = (
         get_device_type(device) == "cuda"
diff --git a/dw/tasks/h3_latent_upscale.py b/dw/tasks/h3_latent_upscale.py
index bfde1733e..d111b856f 100644
--- a/dw/tasks/h3_latent_upscale.py
+++ b/dw/tasks/h3_latent_upscale.py
@@ -3,8 +3,9 @@
 
 `upscale_h3_latents` resizes the video latents a MiniMax-H3 pipeline returns
 (`output: [..., "latents"]`) with a vendored 3D-convolution network
-(`h3_latent_upscaler_model`), so a 544p take can be promoted to 1344x768
-without denoising it again. `decode_h3_latents` turns latents back into
+(`h3_latent_upscaler_model`), so a 544p take can be promoted to a plate of up to
+1920x1088 (a `refine_tiles` refine, #1043, then denoises it) without denoising
+it again here. `decode_h3_latents` turns latents back into
 frames through diffusers' own H3 video decode block, so the VAE's
 denormalization, autocast and pixel un-normalization stay diffusers' rather
 than a copy that could drift from it.
@@ -22,7 +23,9 @@
 
 import torch
 
+from ..pipeline_processors.h3_rules import H3_FPS
 from ..result import AudioVideo
+from .weights import file_entries
 
 logger = logging.getLogger("dw")
 
@@ -57,11 +60,12 @@
 # The per-axis scale range the upscaler was trained over
 MIN_SCALE = 1.0
 MAX_SCALE = 4.0
-# H3's canvas: a short edge of at most 768 and a long edge of at most 1344
-MAX_SHORT_EDGE = 768
-MAX_LONG_EDGE = 1344
-# The rate H3 generates video at
-H3_FPS = 24
+# The target is a plate for a tiled `refine_tiles` refine (#1043), which
+# denoises it in tiles of at most 1344x768. 1920x1088 is 2x a 960x544 take,
+# inside the upscaler's trained 1-4x range. An upscale-only plate above 768p
+# is soft until it is refined.
+MAX_SHORT_EDGE = 1088
+MAX_LONG_EDGE = 1920
 
 # The per-channel statistics the upscaler's training normalized its latents
 # by - the ComfyUI node's LATENTS_MEAN / LATENTS_STD, equal to the H3 VAE
@@ -120,6 +124,51 @@
 )
 
 
+def _whole(value):
+    return isinstance(value, int) and not isinstance(value, bool) and value > 0
+
+
+def target_size_problems(width, height):
+    """What is wrong with a literal pixel target, as [(argument, message)].
+
+    The one rule validate (the task's `static_check`) and the run
+    (`target_latent_size`) both apply, so a size is refused at both or
+    neither, in the same words: each side on the 16 px grid, and the pair
+    within the 1920x1088 (or 1088x1920 portrait) cap. A side that is not a
+    positive whole number - a reference or a variable not yet resolved - is
+    left to the run.
+    """
+    problems = []
+    for name, value in (("width", width), ("height", height)):
+        if _whole(value) and value % SPATIAL_FACTOR:
+            problems.append(
+                (
+                    name,
+                    f"{name} must be a multiple of {SPATIAL_FACTOR} (the H3 "
+                    f"VAE's spatial factor), got {value}; the nearest are "
+                    f"{value // SPATIAL_FACTOR * SPATIAL_FACTOR} and "
+                    f"{(value // SPATIAL_FACTOR + 1) * SPATIAL_FACTOR}",
+                )
+            )
+    if not (_whole(width) and _whole(height)):
+        return problems
+    long_name, short_name = (
+        ("width", "height") if width >= height else ("height", "width")
+    )
+    over_long = max(width, height) > MAX_LONG_EDGE
+    if over_long or min(width, height) > MAX_SHORT_EDGE:
+        # Named on the side that breaks the cap
+        problems.append(
+            (
+                long_name if over_long else short_name,
+                f"width x height {width}x{height} is over the upscale cap: "
+                f"at most {MAX_LONG_EDGE}x{MAX_SHORT_EDGE} (or "
+                f"{MAX_SHORT_EDGE}x{MAX_LONG_EDGE} portrait)",
+            )
+        )
+    return problems
+
+
 def target_latent_size(latents, width, height):
     """The (T, H, W) latent size a pixel target names, or a directed refusal.
 
@@ -154,19 +203,9 @@ def target_latent_size(latents, width, height):
             raise ValueError(
                 f"{name} must be a positive whole number of pixels, got {value!r}"
             )
-        if value % SPATIAL_FACTOR:
-            raise ValueError(
-                f"{name} must be a multiple of {SPATIAL_FACTOR} (the H3 VAE's "
-                f"spatial factor), got {value}; the nearest are "
-                f"{value // SPATIAL_FACTOR * SPATIAL_FACTOR} and "
-                f"{(value // SPATIAL_FACTOR + 1) * SPATIAL_FACTOR}"
-            )
-    if min(width, height) > MAX_SHORT_EDGE or max(width, height) > MAX_LONG_EDGE:
-        raise ValueError(
-            f"width x height {width}x{height} is over MiniMax-H3's canvas: "
-            f"at most {MAX_LONG_EDGE}x{MAX_SHORT_EDGE} (or "
-            f"{MAX_SHORT_EDGE}x{MAX_LONG_EDGE} portrait)"
-        )
+    problems = target_size_problems(width, height)
+    if problems:
+        raise ValueError(problems[0][1])
 
     frames, in_h, in_w = latents.shape[-3:]
     out_h, out_w = height // SPATIAL_FACTOR, width // SPATIAL_FACTOR
@@ -197,28 +236,48 @@ def _check_upscaler_source(model_name, weight_name):
     read with safetensors, so anything else - a local path, a name climbing
     out of the repo, a pickle format - is refused rather than handed on.
     """
-    from ..locations import (
-        SAFETENSORS_SUFFIX,
-        validate_hub_repo_id,
-        validate_weight_name,
-    )
+    from ..locations import SAFETENSORS_SUFFIX, validate_hub_repo_id
+    from ..security import validate_weight_name
 
     validate_hub_repo_id(model_name)
     validate_weight_name(weight_name, (SAFETENSORS_SUFFIX,), subfolders=False)
 
 
+def upscaler_source(arguments):
+    """The (repo, file, subfolder, revision) an upscale_h3_latents step
+    loads - `model_name` and `weight_name` over the defaults. The pin names a
+    commit of the default repo; a caller naming another repo gets that
+    repo's main."""
+    arguments = arguments or {}
+    model_name = arguments.get("model_name") or DEFAULT_UPSCALER_REPO
+    weight_name = arguments.get("weight_name") or DEFAULT_UPSCALER_WEIGHTS
+    source = KNOWN_UPSCALER_SOURCES.get(
+        (model_name, weight_name)
+    ) or KNOWN_UPSCALER_SOURCES.get((model_name, None))
+    subfolder, revision = source if source else (None, None)
+    return model_name, weight_name, subfolder, revision
+
+
+def required_weights(arguments):
+    """The upscaler's weight file, for the plan (dw/tasks/weights.py). The
+    H3 VAE that decodes its latents is not listed: the H3 pipeline step that
+    makes them lists MiniMaxAI/MiniMax-H3 whole (#975 Q4)."""
+    model_name, weight_name, subfolder, revision = upscaler_source(arguments)
+    if not isinstance(weight_name, str):
+        return []
+    filename = f"{subfolder}/{weight_name}" if subfolder else weight_name
+    return file_entries(model_name, filename, revision)
+
+
 def _load_upscaler(device, model_name, weight_name):
     from huggingface_hub import hf_hub_download
 
     from .h3_latent_upscaler_model import build_upscaler
     from .model_cache import cached_model
 
-    # The pin names a commit of the default repo; a caller naming another
-    # repo gets that repo's main
-    source = KNOWN_UPSCALER_SOURCES.get(
-        (model_name, weight_name)
-    ) or KNOWN_UPSCALER_SOURCES.get((model_name, None))
-    subfolder, revision = source if source else (None, None)
+    model_name, weight_name, subfolder, revision = upscaler_source(
+        {"model_name": model_name, "weight_name": weight_name}
+    )
 
     def load_net():
         from safetensors.torch import load_file
@@ -268,8 +327,9 @@ def upscale_h3_latents(
         input's dtype and on the input's device
     """
     size, (scale_h, scale_w) = target_latent_size(latents, width, height)
-    model_name = model_name or DEFAULT_UPSCALER_REPO
-    weight_name = weight_name or DEFAULT_UPSCALER_WEIGHTS
+    model_name, weight_name, _, _ = upscaler_source(
+        {"model_name": model_name, "weight_name": weight_name}
+    )
     # Before anything downloads: a value arriving through a variable or an
     # earlier step was never in the document validation checked
     _check_upscaler_source(model_name, weight_name)
diff --git a/dw/tasks/image_to_text.py b/dw/tasks/image_to_text.py
index 9107b3d6b..f9c419439 100644
--- a/dw/tasks/image_to_text.py
+++ b/dw/tasks/image_to_text.py
@@ -10,6 +10,7 @@
 
 import logging
 from .text_generation import generate_text, DEFAULT_VISION_MODEL
+from .text_generation import vision_required_weights as required_weights  # noqa: F401
 
 logger = logging.getLogger("dw")
 
diff --git a/dw/tasks/image_utils.py b/dw/tasks/image_utils.py
index fec31ead0..4049dc38e 100644
--- a/dw/tasks/image_utils.py
+++ b/dw/tasks/image_utils.py
@@ -12,6 +12,7 @@
 )
 from .borders import add_border_and_mask, add_border_and_mask_with_size
 from .model_cache import cached_model
+from .registry import register_weights_fallback
 import torch
 
 # cv2, controlnet_aux, transformers and the model-backed task modules are imported
@@ -174,14 +175,17 @@ def image_to_canny(image, low_threshold=100, high_threshold=200):
     return Image.fromarray(image)
 
 
+_DEPTH_MODEL = "Intel/dpt-hybrid-midas"
+_SEGMENTATION_MODEL = "openmmlab/upernet-convnext-small"
+_SAM_REPO = "ybelkada/segment-anything"
+
+
 def image_to_depth(image, device, height=1024, width=1024):
     from transformers import DPTForDepthEstimation, DPTImageProcessor
 
     size = (width, height)
-    depth_estimator = DPTForDepthEstimation.from_pretrained(
-        "Intel/dpt-hybrid-midas"
-    ).to(device)
-    feature_extractor = DPTImageProcessor.from_pretrained("Intel/dpt-hybrid-midas")
+    depth_estimator = DPTForDepthEstimation.from_pretrained(_DEPTH_MODEL).to(device)
+    feature_extractor = DPTImageProcessor.from_pretrained(_DEPTH_MODEL)
 
     image = feature_extractor(images=image, return_tensors="pt").pixel_values.to(device)
     # MPS doesn't support autocast, so use 'cpu' for autocast when on MPS
@@ -216,11 +220,9 @@ def image_to_segmentation(image):
     """Semantic segmentation map from the UperNet ConvNeXt model, colored by class."""
     from transformers import AutoImageProcessor, UperNetForSemanticSegmentation
 
-    image_processor = AutoImageProcessor.from_pretrained(
-        "openmmlab/upernet-convnext-small"
-    )
+    image_processor = AutoImageProcessor.from_pretrained(_SEGMENTATION_MODEL)
     image_segmentor = UperNetForSemanticSegmentation.from_pretrained(
-        "openmmlab/upernet-convnext-small"
+        _SEGMENTATION_MODEL
     )
     pixel_values = image_processor(image, return_tensors="pt").pixel_values
     with torch.no_grad():
@@ -554,7 +556,7 @@ def add_watermark(
 # the pre-refactor behavior, which called it straight off from_pretrained().
 _PROCESSORS["sam"] = _make_pretrained_handler(
     "SamDetector",
-    ("ybelkada/segment-anything",),
+    (_SAM_REPO,),
     {"subfolder": "checkpoints"},
     {},
     to_device=False,
@@ -568,6 +570,33 @@ def add_watermark(
 del _name, _attr, _repo_args, _repo_kwargs, _call_kwargs
 
 
+def required_weights(processor, arguments):
+    """The repos an image processor step loads, for the plan
+    (dw/tasks/weights.py). Unlike a registered command's hook it takes the
+    processor name too, since one table serves every processor; one that loads
+    nothing from the Hub (or, like zoe_depth and dw_pose, fetches outside the
+    Hugging Face cache) gives none."""
+    from .weights import repo_entries
+
+    if processor in _PRETRAINED_DETECTOR_SPECS:
+        return repo_entries(_PRETRAINED_DETECTOR_SPECS[processor][1][0])
+    if processor == "sam":
+        return repo_entries(_SAM_REPO)
+    if processor == "depth":
+        return repo_entries(_DEPTH_MODEL)
+    if processor == "segmentation":
+        return repo_entries(_SEGMENTATION_MODEL)
+    if processor == "remove_background":
+        from .background_remover import required_weights as background_weights
+
+        return background_weights(arguments)
+    if processor in ("depth_estimator", "depth_estimator_tensor"):
+        from .depth_estimator import required_weights as depth_weights
+
+        return depth_weights(arguments)
+    return []
+
+
 def available_processors():
     """Return the sorted list of processor names process_image accepts.
 
@@ -577,6 +606,17 @@ def available_processors():
     return sorted(_PROCESSORS)
 
 
+@register_weights_fallback
+def processor_weights_hook(command):
+    """`required_weights_hook`'s answer for a processor name (any case), or
+    None for a name that is not one - registered with the registry at
+    import so it can ask without importing this module (dw/tasks/registry.py)."""
+    processor = command.lower()
+    if processor not in _PROCESSORS:
+        return None
+    return lambda arguments: required_weights(processor, arguments)
+
+
 # Processors whose handler is a plain (image, device, kwargs) -> function(image, **kwargs)
 # forward - i.e. every argument beyond `image` is the named function's own, so
 # introspection can read them straight off its signature and docstring instead of
diff --git a/dw/tasks/interpolate_frames.py b/dw/tasks/interpolate_frames.py
index c6c47a6c6..ed87f25f6 100644
--- a/dw/tasks/interpolate_frames.py
+++ b/dw/tasks/interpolate_frames.py
@@ -14,6 +14,7 @@
 from ..shots import rescaled_shots
 from .tensor_image import pil_to_float_tensor as _pil_to_tensor, float_tensor_to_pil
 from .video_utils import frames_as_pil_list
+from .weights import argument_or_default, file_entries
 
 logger = logging.getLogger("dw")
 
@@ -101,6 +102,20 @@ def _interpolate_2x(frames, model):
 _DEFAULT_RIFE_FILENAME = "rife-flownet-4.13.2.safetensors"
 
 
+def rife_source(arguments):
+    """The (repo, file) an interpolate_frames step loads RIFE from -
+    `model_name` and `filename` over the defaults."""
+    return (
+        argument_or_default(arguments, "model_name", _DEFAULT_RIFE_REPO),
+        argument_or_default(arguments, "filename", _DEFAULT_RIFE_FILENAME),
+    )
+
+
+def required_weights(arguments):
+    """The RIFE weight file, for the plan (dw/tasks/weights.py)."""
+    return file_entries(*rife_source(arguments))
+
+
 def _pad_tensor(t, ph, pw):
     """Zero-pad a (1, 3, H, W) tensor on the bottom/right to (ph, pw)."""
     h, w = t.shape[2], t.shape[3]
@@ -151,8 +166,9 @@ def _load_rife_model(device, model_name=None, filename=None):
     from huggingface_hub import hf_hub_download
     from .model_cache import cached_model
 
-    repo_id = model_name if model_name is not None else _DEFAULT_RIFE_REPO
-    weights_file = filename if filename is not None else _DEFAULT_RIFE_FILENAME
+    repo_id, weights_file = rife_source(
+        {"model_name": model_name, "filename": filename}
+    )
 
     def load_net():
         model_path = hf_hub_download(repo_id=repo_id, filename=weights_file)
diff --git a/dw/tasks/judge.py b/dw/tasks/judge.py
index 8f7a1ed89..9809ba15e 100644
--- a/dw/tasks/judge.py
+++ b/dw/tasks/judge.py
@@ -18,6 +18,7 @@
 import re
 
 from .text_generation import generate_text, DEFAULT_VISION_MODEL
+from .text_generation import vision_required_weights as required_weights  # noqa: F401
 
 logger = logging.getLogger("dw")
 
diff --git a/dw/tasks/model_handlers.py b/dw/tasks/model_handlers.py
index 50849db1e..a2dab3326 100644
--- a/dw/tasks/model_handlers.py
+++ b/dw/tasks/model_handlers.py
@@ -17,7 +17,7 @@
 
 from .image_ops import per_frame
 from .registry import register_command
-from ..task_domains import POSITIVE, UNIT
+from ..task_domains import NON_NEGATIVE, POSITIVE, UNIT
 from ..task_problems import script_lines_errors
 
 logger = logging.getLogger("dw")
@@ -33,6 +33,7 @@ def _voices_argument_errors(arguments):
 @register_command(
     "attribute_voices",
     implementation="dw.tasks.voice_attribution.attribute_voices",
+    required_weights="dw.tasks.voice_attribution.required_weights",
     consumes_device=True,
     returns="json",
     domains={"window_seconds": POSITIVE, "min_reference_seconds": POSITIVE},
@@ -48,6 +49,7 @@ def _handle_attribute_voices(task, arguments, previous_pipelines):
 @register_command(
     "check_script",
     implementation="dw.tasks.script_check.check_script",
+    required_weights="dw.tasks.audio_transcription.required_weights",
     consumes_device=True,
     returns="json",
     domains={"similarity": UNIT},
@@ -73,7 +75,10 @@ def _handle_separate_stems(task, arguments, previous_pipelines):
 
 
 @register_command(
-    "upscale", implementation="dw.tasks.upscale.upscale_image", consumes_device=True
+    "upscale",
+    implementation="dw.tasks.upscale.upscale_image",
+    consumes_device=True,
+    required_weights="dw.tasks.upscale.required_weights",
 )
 def _handle_upscale(task, arguments, previous_pipelines):
     """Upscale an image using a spandrel-compatible super-resolution model"""
@@ -92,6 +97,7 @@ def _handle_upscale(task, arguments, previous_pipelines):
 @register_command(
     "diffusion_upscale",
     implementation="dw.tasks.diffusion_upscale.diffusion_upscale",
+    required_weights="dw.tasks.diffusion_upscale.required_weights",
     consumes_device=True,
 )
 def _handle_diffusion_upscale(task, arguments, previous_pipelines):
@@ -110,6 +116,7 @@ def _handle_diffusion_upscale(task, arguments, previous_pipelines):
     "restore_faces",
     implementation="dw.tasks.restore_faces.restore_faces",
     consumes_device=True,
+    required_weights="dw.tasks.restore_faces.required_weights",
 )
 def _handle_restore_faces(task, arguments, previous_pipelines):
     """Restore faces in an image using a spandrel-compatible face restoration model"""
@@ -134,7 +141,10 @@ def _handle_restore_faces(task, arguments, previous_pipelines):
 
 
 @register_command(
-    "segment", implementation="dw.tasks.segment.segment_image", consumes_device=True
+    "segment",
+    implementation="dw.tasks.segment.segment_image",
+    required_weights="dw.tasks.segment.required_weights",
+    consumes_device=True,
 )
 def _handle_segment(task, arguments, previous_pipelines):
     """Segment objects in an image using text prompt"""
@@ -149,10 +159,69 @@ def _handle_segment(task, arguments, previous_pipelines):
     )
 
 
+@register_command(
+    "remove_object",
+    implementation="dw.tasks.remove_object.remove_object",
+    consumes_device=True,
+    required_weights="dw.tasks.remove_object.required_weights",
+    summary=(
+        "Erase what a mask covers and fill the hole from the surrounding "
+        "texture, with no prompt (LaMa). Suits small to medium objects; an "
+        "image or video frames, one still mask applied to every frame."
+    ),
+    parameter_descriptions={
+        "image": (
+            "The image to clean, or video frames (e.g. from video_frames): the "
+            "one mask applies to every frame, and fps and audio are kept."
+        ),
+        "mask_image": (
+            "White where to erase, black where to keep - segment's polarity, "
+            "so its mask chains with no invert. Binarized at 128 and resized "
+            "to the image if it differs. An all-black mask returns the image "
+            "unchanged, with a warning."
+        ),
+        "dilate": (
+            "Pixels to grow the mask by before the fill, a whole number 0 or "
+            "above (default 8). LaMa fills cleanly only past the object's "
+            "edge; raise it for a soft or tight mask."
+        ),
+        "model_name": (
+            "Hugging Face repo id holding the LaMa weights, never a path "
+            "(default michaelgold/big-lama, read at a pinned revision)."
+        ),
+        "weight_name": (
+            "The safetensors file within model_name, a bare file name "
+            "(default big-lama.safetensors); a .pt/.ckpt is refused."
+        ),
+    },
+    domains={"dilate": NON_NEGATIVE},
+    whole_numbers=("dilate",),
+)
+def _handle_remove_object(task, arguments, previous_pipelines):
+    """Erase a masked region and fill it from the surroundings"""
+    logger.debug("Removing object")
+    image = arguments.pop("image")
+    mask_image = arguments.pop("mask_image")
+    from ..events import emit_warning
+    from .remove_object import EMPTY_MASK_WARNING, mask_is_empty, remove_object
+
+    if mask_is_empty(mask_image):
+        # Checked once here, so a video warns once rather than per frame
+        emit_warning(EMPTY_MASK_WARNING)
+        return per_frame(image, lambda frame: frame)
+
+    device = task.device_for(arguments)
+    return per_frame(
+        image,
+        lambda frame: remove_object(frame, mask_image, device=device, **arguments),
+    )
+
+
 @register_command(
     "interpolate_frames",
     implementation="dw.tasks.interpolate_frames.interpolate_frames",
     consumes_device=True,
+    required_weights="dw.tasks.interpolate_frames.required_weights",
 )
 def _handle_interpolate_frames(task, arguments, previous_pipelines):
     """Interpolate video frames to increase frame rate"""
@@ -163,14 +232,25 @@ def _handle_interpolate_frames(task, arguments, previous_pipelines):
     return interpolate_frames(video, device=task.device_for(arguments), **arguments)
 
 
+def _upscale_size_errors(arguments):
+    """The literal width/height upscale_h3_latents refuses at the run, refused
+    at validate in the same words"""
+    from .h3_latent_upscale import target_size_problems
+
+    return target_size_problems(arguments.get("width"), arguments.get("height"))
+
+
 @register_command(
     "upscale_h3_latents",
     implementation="dw.tasks.h3_latent_upscale.upscale_h3_latents",
     consumes_device=True,
+    required_weights="dw.tasks.h3_latent_upscale.required_weights",
     summary=(
-        "Resize MiniMax-H3 video latents to a larger canvas (e.g. a 960x544 "
-        "take to 1344x768) without denoising again; decode_h3_latents turns "
-        "the result into frames. The whole promoting workflow is "
+        "Resize MiniMax-H3 video latents to a larger plate (e.g. a 960x544 "
+        "take to 1920x1088) without denoising again; decode_h3_latents turns "
+        "the result into frames. The plate is for a tiled refine_tiles "
+        "refine (denoised in tiles of at most 1344x768); upscale-only above "
+        "768p it is soft. The whole promoting workflow is "
         "get_guide('workflows', section='upscale_h3_latents')."
     ),
     parameter_descriptions={
@@ -181,11 +261,11 @@ def _handle_interpolate_frames(task, arguments, previous_pipelines):
         ),
         "width": (
             "Target width in pixels: a multiple of 16, 1x to 4x the latents' "
-            "own width, within H3's 1344x768 canvas."
+            "own width, up to 1920x1088 (1088x1920 portrait)."
         ),
         "height": (
             "Target height in pixels: a multiple of 16, 1x to 4x the latents' "
-            "own height, within H3's 1344x768 canvas."
+            "own height, up to 1920x1088 (1088x1920 portrait)."
         ),
         "model_name": (
             "Hugging Face repo id holding the upscaler, never a path (default "
@@ -198,6 +278,7 @@ def _handle_interpolate_frames(task, arguments, previous_pipelines):
         ),
     },
     domains={"width": POSITIVE, "height": POSITIVE},
+    static_check=_upscale_size_errors,
 )
 def _handle_upscale_h3_latents(task, arguments, previous_pipelines):
     """Resize MiniMax-H3 video latents to a larger canvas"""
@@ -241,6 +322,7 @@ def _handle_decode_h3_latents(task, arguments, previous_pipelines):
 @register_command(
     "image_to_text",
     implementation="dw.tasks.image_to_text.image_to_text",
+    required_weights="dw.tasks.image_to_text.required_weights",
     consumes_device=True,
 )
 def _handle_image_to_text(task, arguments, previous_pipelines):
@@ -255,6 +337,7 @@ def _handle_image_to_text(task, arguments, previous_pipelines):
 @register_command(
     "judge",
     implementation="dw.tasks.judge.judge",
+    required_weights="dw.tasks.judge.required_weights",
     consumes_device=True,
     returns="scalar",
 )
@@ -270,6 +353,7 @@ def _handle_judge(task, arguments, previous_pipelines):
 @register_command(
     "transcribe_audio",
     implementation="dw.tasks.audio_transcription.transcribe_audio",
+    required_weights="dw.tasks.audio_transcription.required_weights",
     consumes_device=True,
 )
 def _handle_transcribe_audio(task, arguments, previous_pipelines):
@@ -284,6 +368,7 @@ def _handle_transcribe_audio(task, arguments, previous_pipelines):
 @register_command(
     "text_generation",
     implementation="dw.tasks.text_generation.generate_text",
+    required_weights="dw.tasks.text_generation.required_weights",
     consumes_device=True,
 )
 def _handle_text_generation(task, arguments, previous_pipelines):
@@ -298,10 +383,12 @@ def _handle_text_generation(task, arguments, previous_pipelines):
 @register_command(
     "generate_speech",
     implementation="dw.tasks.speech_generation.generate_speech",
+    required_weights="dw.tasks.speech_generation.required_weights",
     consumes_device=True,
 )
 def _handle_speech_generation(task, arguments, previous_pipelines):
-    """Speak a line of text with a local text-to-speech model"""
+    """Speak a line of text with a local text-to-speech model (Bark, MMS/VITS
+    or SpeechT5)"""
     logger.debug("Generating speech")
     if ("text" in arguments) == ("messages" in arguments):
         raise ValueError(
diff --git a/dw/tasks/pair_audio.py b/dw/tasks/pair_audio.py
index 6b7cd5ba7..6eba8d7ef 100644
--- a/dw/tasks/pair_audio.py
+++ b/dw/tasks/pair_audio.py
@@ -257,7 +257,9 @@ def pair_audio(video, audio, sample_rate=None, fps=None, fit=None):
             path is (#553); the
             frames' own rate is carried through to the output, so set
             `result.fps` only to override it (a loaded file brings its rate
-            along; frames that carry none are written at 8 fps)
+            along, and so does a pipeline step whose pipeline reports one -
+            MiniMax-H3's `videos`; frames that carry none are fitted and
+            written at 8 fps unless `fps` says otherwise)
         audio: The soundtrack - a waveform, an AudioVideo (or any object
             carrying '.audio') to take it from, or the path or URL of an
             audio or video file; the last two bring their sample rate along.
@@ -267,7 +269,10 @@ def pair_audio(video, audio, sample_rate=None, fps=None, fit=None):
             carries one; given here it wins, for a track whose rate was
             reported wrong
         fps: The rate the frames play at, when the frames do not carry one -
-            only used to work out how long the video is, never written
+            what `fit` and the length check measure the track against, and
+            the rate the output then carries to the writer. `result.fps`
+            cannot stand in for it: the writer applies that after the fit
+            has run (#1056)
         fit: "video" cuts or pads the track with silence to the length of the
             frames, warning either way (`audio_padded_to_video` when it pads,
             `audio_trimmed_to_video` when it cuts). This is
@@ -340,11 +345,17 @@ def pair_audio(video, audio, sample_rate=None, fps=None, fit=None):
         # The writer falls back to this same rate, so fitting against it keeps
         # the track and the picture the length the file really gets (#673)
         frame_rate = DEFAULT_VIDEO_FPS
+        # 'result.fps' is not the remedy: the writer applies it after this
+        # step has already measured and fitted the track at the fallback
+        # rate, so declaring it alone re-times the picture under a track
+        # padded to three times its length (#1056)
         emit_warning(
-            f"pair_audio: the frames carry no frame rate, so the file is "
-            f"written at {DEFAULT_VIDEO_FPS} fps - a video that played at 24 "
-            f"fps will be three times slow. Pass 'fps' (the source's rate) or "
-            f"declare 'result.fps'.",
+            f"pair_audio: the frames carry no frame rate, so the track is "
+            f"fitted and the file is written at {DEFAULT_VIDEO_FPS} fps - a "
+            f"video that played at 24 fps will be three times slow. Pass "
+            f"'fps' (the source's rate) to this step; 'result.fps' alone "
+            f"changes the rate the file is written at, not the length the "
+            f"track was fitted to.",
             kind="video_fps_defaulted",
             command="pair_audio",
             fps=DEFAULT_VIDEO_FPS,
diff --git a/dw/tasks/registry.py b/dw/tasks/registry.py
index 8e88a317c..1f143fec1 100644
--- a/dw/tasks/registry.py
+++ b/dw/tasks/registry.py
@@ -11,6 +11,13 @@
 `TASK_ARGUMENT_CHOICES` and `TASK_MEDIA_ARGUMENTS` are `RegistryTable` views
 of them, so a command cannot be registered and miss a table: before, each was
 a hand-kept dict, and a command left out of one lost that check silently.
+
+This module imports nothing from `dw`: `dw/locations.py` reads its tables,
+and the task modules import the location policy, so a task import from here
+(even a lazy one - grimp counts those) is a cycle. A task module it needs
+something from registers that thing here instead (`register_command`,
+`register_weights_fallback`), or is named by a dotted path and imported
+when a lookup needs it.
 """
 
 import importlib
@@ -43,6 +50,15 @@
 # self-registering task module through its own import lines
 _REGISTERING_MODULE = "dw.tasks.task"
 
+# command -> its `required_weights(arguments)` hook, for the names that are
+# commands of a workflow step but not registrations: `process_image`'s
+# processors, dispatched by dw/tasks/image_utils.py from its own table. That
+# module registers a resolver here when it is imported (which importing
+# _REGISTERING_MODULE does), so this module never imports it: it imports
+# torch and the media loaders, which import the location policy, which
+# imports this module - a cycle the architecture ratchet counts
+_WEIGHTS_FALLBACKS: list = []
+
 
 class RegistryTable(Mapping):
     """A read-only {command: value} view of one rule the registrations declare.
@@ -96,6 +112,7 @@ def register_command(
     static_check=None,
     media_arguments=(),
     whole_numbers=(),
+    required_weights=None,
 ):
     """
     Decorator to register a command handler function.
@@ -158,6 +175,11 @@ def register_command(
             reads as whole numbers (`task_domains.whole_number`): 3, 3.0,
             "3" and "3.0" are 3, and 3.5 is refused - at validation as at
             run time. Every other argument with a domain is a real number
+        required_weights: Dotted path to the task module's
+            `required_weights(arguments)` - the hub repos the command fetches,
+            listed in the plan's `downloads_required` (`dw/tasks/weights.py`,
+            #975). A string, so the plan path imports the module only for a
+            workflow that has the command
 
     Returns:
         Decorator function
@@ -198,8 +220,43 @@ def handler(task, arguments, previous_pipelines, _func=func):
             rules["media_arguments"] = tuple(media_arguments)
         if whole_numbers:
             rules["whole_numbers"] = tuple(whole_numbers)
+        if required_weights:
+            rules["required_weights"] = required_weights
         _COMMAND_RULES[command_name] = rules
         logger.debug(f"Registered command handler: {command_name}")
         return func
 
     return decorator
+
+
+def register_weights_fallback(resolver):
+    """Add a `resolver(command) -> hook | None` consulted by
+    `required_weights_hook` for a command no registration declares - the
+    way a dispatch table outside the registry (image_utils' processors)
+    declares what its commands fetch. Registered once per resolver; a
+    re-import of the registering module is not a second entry."""
+    if resolver not in _WEIGHTS_FALLBACKS:
+        _WEIGHTS_FALLBACKS.append(resolver)
+    return resolver
+
+
+def required_weights_hook(command):
+    """The `required_weights(arguments)` callable for `command`, or None when
+    it fetches nothing the plan lists - a registered command's declared hook,
+    else the first answer from a resolver `register_weights_fallback` holds
+    (an image processor's: `process_image`'s names are commands of their
+    own, dispatched by `dw/tasks/image_utils.py` rather than registered)."""
+    if not isinstance(command, str):
+        return None
+    importlib.import_module(_REGISTERING_MODULE)
+    if command in _COMMAND_RULES:
+        path = _COMMAND_RULES[command].get("required_weights")
+        if path is None:
+            return None
+        module_path, _, name = path.rpartition(".")
+        return getattr(importlib.import_module(module_path), name)
+    for resolver in _WEIGHTS_FALLBACKS:
+        hook = resolver(command)
+        if hook is not None:
+            return hook
+    return None
diff --git a/dw/tasks/remove_object.py b/dw/tasks/remove_object.py
new file mode 100644
index 000000000..d737edf59
--- /dev/null
+++ b/dw/tasks/remove_object.py
@@ -0,0 +1,201 @@
+"""
+Prompt-free object removal with LaMa (#956).
+
+`remove_object` erases what a mask covers and fills the hole from the
+surrounding texture - no prompt, no diffusion. The network is big-lama, loaded
+through spandrel as a `MaskedImageModelDescriptor` from a safetensors state
+dict at a pinned Hub revision. Only the masked region comes from the model:
+everything outside the dilated mask is the input's own pixels.
+
+LaMa runs in fp32 on every device. It is ~51M parameters, so a lower
+precision saves next to nothing, and spandrel marks it `supports_half=False`.
+"""
+
+import logging
+
+import torch
+from PIL import Image, ImageFilter
+
+from ..events import emit_warning
+from ..task_domains import check_argument, whole_number
+from .tensor_image import float_tensor_to_pil, pil_to_float_tensor
+from .weights import file_entries
+
+logger = logging.getLogger("dw")
+
+DEFAULT_REMOVER_REPO = "michaelgold/big-lama"
+DEFAULT_REMOVER_WEIGHTS = "big-lama.safetensors"
+# The commit of the default repo the weights are read at. biali/big-lama holds
+# a byte-identical big-lama.safetensors (same LFS hash): if michaelgold's repo
+# disappears, point DEFAULT_REMOVER_REPO and this pin at it
+REMOVER_REVISION = "98ab7cface89a594b381f32fc7a9f2cae3f91ccc"
+
+DEFAULT_DILATE = 8
+# A mask pixel at or above this reads as fill
+MASK_THRESHOLD = 128
+EMPTY_MASK_WARNING = (
+    "remove_object: the mask is all black, so there is nothing to remove; "
+    "the image is returned unchanged."
+)
+
+
+def binarize_mask(mask_image):
+    """The mask as an L image of 0 (keep) and 255 (fill), thresholded at 128."""
+    if not isinstance(mask_image, Image.Image):
+        raise ValueError(
+            f"remove_object needs 'mask_image' as an image, got "
+            f"{type(mask_image).__name__}"
+        )
+    return mask_image.convert("L").point(lambda p: 255 if p >= MASK_THRESHOLD else 0)
+
+
+def mask_is_empty(mask_image):
+    """True when no pixel of the mask reads as fill - nothing to remove."""
+    return binarize_mask(mask_image).getbbox() is None
+
+
+def prepare_mask(mask_image, size, dilate=DEFAULT_DILATE):
+    """The fill mask for an image of `size`: binarized at 128, resized
+    (nearest) to the image if it differs, then grown by `dilate` pixels.
+
+    LaMa fills cleanly only when the mask overshoots the object's edge, and a
+    `segment` mask is tight to it, hence the dilation.
+    """
+    mask = binarize_mask(mask_image)
+    if mask.size != tuple(size):
+        mask = mask.resize(tuple(size), Image.NEAREST)
+    if dilate:
+        mask = mask.filter(ImageFilter.MaxFilter(2 * dilate + 1))
+    return mask
+
+
+def _check_remover_source(model_name, weight_name):
+    """Refuse a remover source that is not a Hub repo and a safetensors file
+    in it - the run-time half of the SAFETENSORS_ONLY_COMMANDS gate, for a
+    value that arrives through a variable or a run that skipped validation."""
+    from ..locations import SAFETENSORS_SUFFIX, validate_hub_repo_id
+    from ..security import validate_weight_name
+
+    validate_hub_repo_id(model_name)
+    validate_weight_name(weight_name, (SAFETENSORS_SUFFIX,), subfolders=False)
+
+
+def remover_source(arguments):
+    """The (repo, file, revision) a remove_object step loads - `model_name`
+    and `weight_name` over the defaults. The pin names a commit of the
+    default file; another source is read at its main."""
+    arguments = arguments or {}
+    model_name = arguments.get("model_name") or DEFAULT_REMOVER_REPO
+    weight_name = arguments.get("weight_name") or DEFAULT_REMOVER_WEIGHTS
+    pinned = (model_name, weight_name) == (
+        DEFAULT_REMOVER_REPO,
+        DEFAULT_REMOVER_WEIGHTS,
+    )
+    return model_name, weight_name, REMOVER_REVISION if pinned else None
+
+
+def required_weights(arguments):
+    """The remover's weight file, for the plan (dw/tasks/weights.py)."""
+    return file_entries(*remover_source(arguments))
+
+
+def _descriptor_from_state_dict(state_dict):
+    """The spandrel descriptor for a state dict, refused unless it is a masked
+    (inpainting) model."""
+    from spandrel import MaskedImageModelDescriptor, ModelLoader
+
+    descriptor = ModelLoader().load_from_state_dict(state_dict)
+    if not isinstance(descriptor, MaskedImageModelDescriptor):
+        raise ValueError(
+            f"remove_object needs an inpainting model such as LaMa; these "
+            f"weights load as {descriptor.architecture.name} "
+            f"({type(descriptor).__name__}), not a masked image model."
+        )
+    return descriptor
+
+
+def _load_remover(device, model_name, weight_name):
+    from huggingface_hub import hf_hub_download
+
+    from .model_cache import cached_model
+
+    model_name, weight_name, revision = remover_source(
+        {"model_name": model_name, "weight_name": weight_name}
+    )
+
+    def load_descriptor():
+        from safetensors.torch import load_file
+
+        path = hf_hub_download(
+            repo_id=model_name, filename=weight_name, revision=revision
+        )
+        logger.info(f"Loading object remover {model_name}/{weight_name} to {device}")
+        descriptor = _descriptor_from_state_dict(load_file(path))
+        descriptor.to(torch.device(device))
+        descriptor.float()
+        descriptor.eval()
+        return descriptor
+
+    return cached_model(
+        ("remove_object", model_name, weight_name, revision, str(device)),
+        load_descriptor,
+    )
+
+
+def remove_object(
+    image,
+    mask_image,
+    dilate=DEFAULT_DILATE,
+    device="cpu",
+    model_name=DEFAULT_REMOVER_REPO,
+    weight_name=DEFAULT_REMOVER_WEIGHTS,
+):
+    """Erase what a mask covers and fill it from the surroundings, with no prompt.
+
+    Args:
+        image: The image (or, through the command, video frames) to clean
+        mask_image: White where to erase, black where to keep - the polarity
+            `segment` returns, so its mask chains with no `invert`. Converted
+            to grayscale, binarized at 128 and resized to the image if it
+            differs
+        dilate: Pixels to grow the mask by before the fill, a whole number 0
+            or above; LaMa fills cleanly only past the object's edge
+        device: Device the network runs on
+        model_name: Hugging Face repo holding the LaMa weights (default:
+            michaelgold/big-lama, read at a pinned revision)
+        weight_name: The safetensors file within it, a bare file name
+            (default: big-lama.safetensors)
+
+    Returns:
+        PIL Image the size of the input; pixels outside the dilated mask are
+        the input's own
+    """
+    dilate = whole_number(dilate, "dilate", "remove_object")
+    dilate = DEFAULT_DILATE if dilate is None else dilate
+    check_argument("remove_object", "dilate", dilate)
+    model_name, weight_name, _ = remover_source(
+        {"model_name": model_name, "weight_name": weight_name}
+    )
+    _check_remover_source(model_name, weight_name)
+
+    if mask_is_empty(mask_image):
+        emit_warning(EMPTY_MASK_WARNING)
+        return image
+
+    source = image.convert("RGB")
+    mask = prepare_mask(mask_image, source.size, dilate)
+    descriptor = _load_remover(device, model_name, weight_name)
+
+    image_tensor = pil_to_float_tensor(source, device, dtype=torch.float32)
+    mask_tensor = (
+        pil_to_float_tensor(mask, device, dtype=torch.float32)[:, :1]
+        .gt(0.5)
+        .to(torch.float32)
+    )
+    with torch.inference_mode():
+        output = descriptor(image_tensor, mask_tensor)
+    filled = float_tensor_to_pil(output)
+
+    logger.info(f"Removed the masked region of a {source.width}x{source.height} image")
+    # Only the masked region comes from the model
+    return Image.composite(filled, source, mask)
diff --git a/dw/tasks/restore_faces.py b/dw/tasks/restore_faces.py
index 7adb161c9..0237b9588 100644
--- a/dw/tasks/restore_faces.py
+++ b/dw/tasks/restore_faces.py
@@ -12,10 +12,47 @@
 from PIL import Image
 
 from .model_cache import cached_model
+from .upscale import required_weights as spandrel_weights, spandrel_source
+from .weights import package_dir
 
 logger = logging.getLogger("dw")
 
 
+# The weights facexlib's FaceRestoreHelper fetches itself, into its own
+# package's weights dir rather than the Hub cache (det_model
+# "retinaface_resnet50"; ParseNet only with use_parse)
+FACEXLIB_DETECTION_URL = "https://github.com/xinntao/facexlib/releases/download/v0.1.0/detection_Resnet50_Final.pth"
+FACEXLIB_PARSING_URL = (
+    "https://github.com/xinntao/facexlib/releases/download/v0.2.2/parsing_parsenet.pth"
+)
+
+
+def uses_parse(arguments):
+    """Whether the helper loads ParseNet - `use_parse`, default True."""
+    return (arguments or {}).get("use_parse", True)
+
+
+def facexlib_weights(use_parse):
+    """`{"url"}` for each facexlib weight not yet in facexlib's weights dir
+    (`<package>/weights`, facexlib's default `model_rootpath`), found without
+    importing facexlib. Not installed, every weight is listed: over-warning,
+    never under."""
+    package = package_dir("facexlib")
+    weights = package / "weights" if package else None
+    urls = [FACEXLIB_DETECTION_URL] + ([FACEXLIB_PARSING_URL] if use_parse else [])
+    return [
+        {"url": url}
+        for url in urls
+        if weights is None or not (weights / url.rsplit("/", 1)[1]).is_file()
+    ]
+
+
+def required_weights(arguments):
+    """The spandrel face model (as `upscale` declares it) and the facexlib
+    weights not yet fetched, for the plan (dw/tasks/weights.py)."""
+    return spandrel_weights(arguments) + facexlib_weights(uses_parse(arguments))
+
+
 def restore_faces(image, model_name, device="cpu", **kwargs):
     """Restore faces in an image using a spandrel-compatible face restoration model.
 
@@ -45,10 +82,10 @@ def restore_faces(image, model_name, device="cpu", **kwargs):
 
     from .upscale import resolve_model_path
 
-    filename = kwargs.get("filename", None)
+    model_name, filename = spandrel_source({**kwargs, "model_name": model_name})
     upscale_factor = kwargs.get("upscale_factor", 1)
     face_size = kwargs.get("face_size", 512)
-    use_parse = kwargs.get("use_parse", True)
+    use_parse = uses_parse(kwargs)
     only_center_face = kwargs.get("only_center_face", False)
     detection_resize = kwargs.get("detection_resize", 640)
     eye_dist_threshold = kwargs.get("eye_dist_threshold", 5)
diff --git a/dw/tasks/script_check.py b/dw/tasks/script_check.py
index c3c12dfd9..e05eef3f7 100644
--- a/dw/tasks/script_check.py
+++ b/dw/tasks/script_check.py
@@ -46,7 +46,7 @@
 from types import SimpleNamespace
 
 from .. import dsp
-from ..assessment_rules import DEAD_AIR_FLOOR_DBFS, finding
+from ..assessment_rules import finding
 from ..task_domains import check_arguments
 from ..events import emit_log
 from ..locations import is_http_url
@@ -55,16 +55,28 @@
     REPEAT_MAX_PERIOD,
     REPEAT_RUN_MIN,
     disambiguated,
-    looped_texts,
+    looped_texts_firsts,
     normalize_words,
     parse_lines,
     parse_shots,
     shot_names_error,
     with_full_shot_names,
 )
-from .assess import DEAD_AIR_WINDOW, resolve_shots, sample_span
+from .assess import resolve_shots
 from .audio_transcription import WHISPER_DEFAULT_MODEL
 from .audio_utils import waveform_and_rate
+from .script_take import (
+    GUARD_FLOOR_DBFS,
+    GUARD_WINDOW_SECONDS,
+    round_seconds,
+    guard_words,
+    level_for_transcription,
+    overlapping_shot,
+    per_shot_chunks,
+    shot_at,
+    shot_spans,
+    word_level,
+)
 
 logger = logging.getLogger("dw")
 
@@ -72,19 +84,17 @@
 # it is a `line_mismatch`. The template's own default is set from stage A's
 # two-model measurement (#609 Q3); this one is the task's
 DEFAULT_SIMILARITY = 0.85
-# A heard word is guarded (discarded as unheard) when its loudest
-# GUARD_WINDOW_SECONDS window sits at or below GUARD_FLOOR_DBFS. The floor is
-# the assessment probes' dead-air floor and the window is the one
-# `shot_dead_air` measures in (`DEAD_AIR_WINDOW`), both read, not copied. The loudest window rather than the whole
-# span, because a word timestamp is approximate (+-0.1-0.3 s) and a span
-# that overhangs the pause after a word must not average a real word away
-GUARD_FLOOR_DBFS = DEAD_AIR_FLOOR_DBFS
-GUARD_WINDOW_SECONDS = DEAD_AIR_WINDOW
+# GUARD_FLOOR_DBFS and GUARD_WINDOW_SECONDS, the guard over heard words,
+# live in dw/tasks/script_take.py beside `guard_words`
 # A line is clipped at the end when its last heard word ends inside the
 # file's final CLIP_TAIL_SECONDS and that tail measures above
 # GUARD_FLOOR_DBFS - still voiced when the file stops, not a word that
 # finished into a quiet tail
 CLIP_TAIL_SECONDS = 0.25
+# ... and within CLIP_TAIL_BELOW_WORD_DB of the last word's own loudest window:
+# a word cut mid-sound leaves a tail near its level, a score bed or room tone
+# under a word that finished sits far below it (#953)
+CLIP_TAIL_BELOW_WORD_DB = 15.0
 # Audible speech the transcript has no words for (#923): Whisper can drop a
 # passage from its text on a longer input (the ad-lib heard in a short file
 # is gone), and the word alignment hands that time to a neighbouring word,
@@ -104,6 +114,7 @@
     "guard_floor_dbfs": GUARD_FLOOR_DBFS,
     "guard_window_seconds": GUARD_WINDOW_SECONDS,
     "clip_tail_seconds": CLIP_TAIL_SECONDS,
+    "clip_tail_below_word_db": CLIP_TAIL_BELOW_WORD_DB,
     "unheard_min_seconds": UNHEARD_MIN_SECONDS,
     "unheard_margin_seconds": UNHEARD_MARGIN_SECONDS,
     "unheard_floor_dbfs": UNHEARD_FLOOR_DBFS,
@@ -113,6 +124,7 @@
 
 LINE_RULES = (
     "line_mismatch",
+    "transcript_loop",
     "tag_spoken",
     "line_clipped_at_end",
     "speech_not_transcribed",
@@ -144,10 +156,18 @@ def mismatch_rule(similarity):
 SPEECH_NOT_TRANSCRIBED = _rule(
     "speech_not_transcribed",
     UNHEARD_FLOOR_DBFS,
-    "audible sound lasting this many seconds sits between the line's words, or"
-    " inside one stretched word, with no word for it - the transcript left speech"
+    "audible sound lasting this many seconds sits between the line's words, between"
+    " two lines, or inside one stretched word, with no word for it - the transcript left speech"
     " out and the line's timing absorbed it; listen",
 )
+TRANSCRIPT_LOOP = _rule(
+    "transcript_loop",
+    REPEAT_RUN_MIN,
+    "the transcript repeated words of the script in a loop for this many chunks"
+    " (seen at 'seconds' to 'end') - Whisper stuck, so speech after it may be"
+    " missing from 'heard' and lines can read 0.0 without being wrong; listen,"
+    " or check each shot on its own, before re-rolling",
+)
 SPEECH_WHERE_SILENT = _rule(
     "speech_where_silent",
     0,
@@ -159,7 +179,9 @@ def mismatch_rule(similarity):
     GUARD_FLOOR_DBFS,
     "the line's last word ends inside the final"
     f" {CLIP_TAIL_SECONDS} s of its shot (or of the file) and that tail is"
-    " still voiced at this level - the shot stops mid-word",
+    f" still voiced at this level, within {CLIP_TAIL_BELOW_WORD_DB} dB of the"
+    " word's own level (a quieter tail is a bed or room tone) - the shot"
+    " stops mid-word",
 )
 SPEECH_IN_SILENT_SHOT = _rule(
     "speech_in_silent_shot",
@@ -175,134 +197,6 @@ def mismatch_rule(similarity):
 )
 
 
-# Whisper drops soft speech from a quiet input, so the same shot got different
-# verdicts by level (#925). The transcriber hears the take scaled so its loud
-# end sits near full scale - a take only 2 dB under that still lost a soft
-# "Uh," that +6 dB brought back; the level checks keep reading the original
-# waveform.
-TRANSCRIBE_PEAK = 0.9
-TRANSCRIBE_MAX_GAIN = 100.0  # 40 dB: a near-silent take is not boosted to noise
-
-
-def level_for_transcription(waveform):
-    """(waveform, gain) with the 99.9th-percentile magnitude scaled to
-    TRANSCRIBE_PEAK (spikes past full scale clipped); gain is 1.0 for silence."""
-    import numpy
-
-    loud = float(numpy.percentile(numpy.abs(waveform), 99.9)) if waveform.size else 0.0
-    if loud <= 0.0:
-        return waveform, 1.0
-    gain = min(TRANSCRIBE_PEAK / loud, TRANSCRIBE_MAX_GAIN)
-    leveled = numpy.clip(waveform * gain, -1.0, 1.0).astype(numpy.float32)
-    return leveled, gain
-
-
-def shot_spans(records, sample_rate, fps, duration):
-    """Each shot record as {name, start, end} in seconds on the take, or None
-    when one cannot be placed. Placed by `assess.sample_span`, the rule the
-    probes use (recorded sample span, else frames by `fps`). Clipped to the
-    take's `duration`."""
-    if not sample_rate:
-        return None
-    media = SimpleNamespace(fps=fps, sample_rate=sample_rate)
-    spans = []
-    for record in records:
-        start, count, _source = sample_span(record, media)
-        if start is None:
-            return None
-        start, end = start / sample_rate, (start + count) / sample_rate
-        start = min(max(0.0, float(start)), duration)
-        spans.append(
-            {
-                "name": record["name"],
-                "start": start,
-                "end": max(start, min(float(end), duration)),
-            }
-        )
-    return spans
-
-
-def overlapping_shot(spans, start, end):
-    """The name of the shot [start, end] overlaps most, or None. A span of no
-    length (a one-word line's zero-length chunk) is placed by where it sits."""
-    best, best_overlap = None, 0.0
-    for span in spans:
-        overlap = min(span["end"], end) - max(span["start"], start)
-        if overlap > best_overlap or (
-            best is None and overlap == 0 and span["start"] <= start < span["end"]
-        ):
-            best, best_overlap = span["name"], overlap
-    return best
-
-
-def shot_at(spans, seconds):
-    """The name of the shot holding `seconds`, or None."""
-    for span in spans:
-        if span["start"] <= seconds < span["end"]:
-            return span["name"]
-    return None
-
-
-def word_level(mono, sample_rate, start, end):
-    """The loudest GUARD_WINDOW_SECONDS window's rms over [start, end], in
-    dBFS, or None for silence (`dsp.loudest_window_dbfs`)."""
-    return dsp.loudest_window_dbfs(mono, sample_rate, start, end, GUARD_WINDOW_SECONDS)
-
-
-def _round(value, places=3):
-    return None if value is None else round(float(value), places)
-
-
-def guard_words(chunks, mono, sample_rate):
-    """Split transcribe_audio's word chunks into (heard, discarded).
-
-    `heard` is [{word, text, start, end}], one per normalized word - a chunk
-    that normalizes to nothing ('♪', '...') is neither; `discarded` is
-    [{text, start, end, level_dbfs, reason}] for a chunk in a repetition loop
-    (`reason` "repetition") or at or below the floor ("below_floor").
-    """
-    spoken = []
-    for chunk in chunks:
-        words = normalize_words(chunk.get("text", ""))
-        if words:
-            spoken.append((chunk, words))
-    # The loop detector is script_lines' (shared with transcribe_audio's
-    # `suspect: "repetition"`); a chunk with no word is in no loop
-    looped = looped_texts([chunk.get("text", "") for chunk, _ in spoken])
-
-    heard, discarded = [], []
-    for index, (chunk, words) in enumerate(spoken):
-        start, end = chunk["start"], chunk["end"]
-        level = word_level(mono, sample_rate, start, end)
-        if index in looped:
-            reason = "repetition"
-        elif level is None or level <= GUARD_FLOOR_DBFS:
-            reason = "below_floor"
-        else:
-            reason = None
-        if reason:
-            discarded.append(
-                {
-                    "text": chunk.get("text", "").strip(),
-                    "start": _round(start),
-                    "end": _round(end),
-                    "level_dbfs": _round(level, 2),
-                    "reason": reason,
-                }
-            )
-            continue
-        for word in words:
-            heard.append(
-                {
-                    "word": word,
-                    "text": chunk.get("text", "").strip(),
-                    "start": start,
-                    "end": end,
-                }
-            )
-    return heard, discarded
-
-
 def align(expected_lines, heard):
     """Assign each heard word to the expected line it was spoken for.
 
@@ -347,6 +241,35 @@ def align(expected_lines, heard):
     return assigned, unassigned
 
 
+def _release_repeats(expected, heard, assigned, unassigned):
+    """Take a second copy of a line out of the words align gave it. Align
+    keeps a heard word inserted inside a line with that line, so a doubled
+    line ("Then wear socks. Wear socks.") would read as one line at a lower
+    similarity - above the mismatch threshold, so no finding. A run of two or
+    more extra words (one for a one-word line) that is the line, or a stretch
+    of it, goes back to `unassigned` so unscripted_speech sees it."""
+    for index, words in enumerate(expected):
+        own = assigned[index]
+        if len(own) <= len(words) or not words:
+            continue
+        heard_words = [heard[j]["word"] for j in own]
+        matcher = difflib.SequenceMatcher(None, words, heard_words, autojunk=False)
+        moved = set()
+        for op, _i1, _i2, j1, j2 in matcher.get_opcodes():
+            run = heard_words[j1:j2]
+            if (
+                op == "insert"
+                and len(run) >= min(2, len(words))
+                and (_contains(words, run) or _contains(run, words))
+            ):
+                moved.update(range(j1, j2))
+        if not moved:
+            continue
+        unassigned.extend((own[k], (index,)) for k in sorted(moved))
+        assigned[index] = [j for k, j in enumerate(own) if k not in moved]
+    unassigned.sort()
+
+
 def line_similarity(expected, heard):
     """How alike two word lists are, 0..1. Two empty lists are identical."""
     if not expected and not heard:
@@ -365,26 +288,31 @@ def tail_level(mono, sample_rate, end=None):
 def _at(line, heard_word=None, seconds=None, shot=None):
     at = {"line": line}
     if heard_word is not None:
-        at["seconds"] = _round(heard_word["start"])
+        at["seconds"] = round_seconds(heard_word["start"])
         at["word"] = heard_word["text"]
     else:
-        at["seconds"] = _round(seconds)
+        at["seconds"] = round_seconds(seconds)
     if shot is not None:
         at["shot"] = shot
     return at
 
 
-def _clipped_tail(mono, sample_rate, end, tails):
+def _clipped_tail(mono, sample_rate, end, tails, word=None):
     """The first of `tails` - (shot name or None, the second it ends at) -
     that a line ending at `end` is clipped by: the word ends inside its
     final CLIP_TAIL_SECONDS (within that much past it too, a word timestamp
-    being approximate) and the tail is voiced above GUARD_FLOOR_DBFS.
-    Returns (shot, level) or None."""
+    being approximate) and the tail is voiced above GUARD_FLOOR_DBFS and
+    within CLIP_TAIL_BELOW_WORD_DB of the (start, end) span's loudest window,
+    when given: a tail far under the word is a bed, not the word. Returns (shot, level) or None."""
+    word_db = word_level(mono, sample_rate, *word) if word else None
+    floor = GUARD_FLOOR_DBFS
+    if word_db is not None:
+        floor = max(floor, word_db - CLIP_TAIL_BELOW_WORD_DB)
     for shot, tail_end in tails:
         if not tail_end - CLIP_TAIL_SECONDS <= end <= tail_end + CLIP_TAIL_SECONDS:
             continue
         level = tail_level(mono, sample_rate, tail_end)
-        if level is not None and level > GUARD_FLOOR_DBFS:
+        if level is not None and level > floor:
             return shot, level
     return None
 
@@ -426,8 +354,8 @@ def _shots_entry(spans):
     return [
         {
             "name": span["name"],
-            "start": _round(span["start"]),
-            "end": _round(span["end"]),
+            "start": round_seconds(span["start"]),
+            "end": round_seconds(span["end"]),
         }
         for span in spans
     ]
@@ -447,110 +375,264 @@ def check(
     waveforms. `chunks` is transcribe_audio's word chunks; `mono` a 1-D
     float waveform; `spans` the take's shots as shot_spans() places them, or
     None when none are known, and `shots_source` where they came from
-    (resolve_shots: argument, artifact, manifest or none)."""
-    heard, discarded = guard_words(chunks, mono, sample_rate)
-    duration = len(mono) / sample_rate if sample_rate else 0.0
-    findings = []
-
+    (resolve_shots: argument, artifact, manifest or none).
+
+    The phases, each a helper below: the guard (`guard_words`) and the
+    silent-take answer (`_silent_take`); the loop findings
+    (`_loop_findings`); the alignment (`align`, `_release_repeats`); the
+    line pass (`_line_pass`: one `lines` entry and the line rules per line);
+    the tags left between lines (`_unassigned_tags`); the shot rules
+    (`_shot_rules`)."""
+    script_words = {
+        word for line in parsed_lines for word in normalize_words(line["text"])
+    }
+    heard, discarded = guard_words(chunks, mono, sample_rate, script_words)
     if not parsed_lines:
         return _silent_take(heard, discarded, spans, shots_source)
 
+    duration = len(mono) / sample_rate if sample_rate else 0.0
+    findings = _loop_findings(chunks, script_words)
+    loop_starts = [found["at"]["seconds"] for found in findings]
     expected = [normalize_words(line["text"]) for line in parsed_lines]
     assigned, unassigned = align(expected, heard)
-    mismatch = mismatch_rule(similarity_threshold)
-    by_name = {span["name"]: span for span in spans or ()}
+    _release_repeats(expected, heard, assigned, unassigned)
+    lines, claimed, found = _line_pass(
+        parsed_lines,
+        expected,
+        assigned,
+        heard,
+        unassigned,
+        mono,
+        sample_rate,
+        duration,
+        spans,
+        loop_starts,
+        similarity_threshold,
+    )
+    findings.extend(found)
+    findings.extend(_unassigned_tags(heard, unassigned, parsed_lines, expected, spans))
+    rules_applied, rules_skipped, found = _shot_rules(
+        spans,
+        shots_source,
+        parsed_lines,
+        expected,
+        heard,
+        unassigned,
+        claimed,
+        similarity_threshold,
+    )
+    findings.extend(found)
+    findings.sort(key=lambda found: found["at"].get("seconds") or 0.0)
+    return {
+        "findings": findings,
+        "lines": lines,
+        "discarded": discarded,
+        "unmatched": [_heard_entry(heard[j]) for j, _ in unassigned],
+        "shots": _shots_entry(spans),
+        "shots_source": shots_source,
+        "rules_applied": rules_applied,
+        "rules_skipped": rules_skipped,
+    }
 
-    lines = []
-    # The shot of the line each heard word was matched to: a word a line in
-    # another shot claimed (one straddling the cut) is that line's speech,
-    # not speech in a silent shot
-    claimed = {}
+
+def _line_pass(
+    parsed_lines,
+    expected,
+    assigned,
+    heard,
+    unassigned,
+    mono,
+    sample_rate,
+    duration,
+    spans,
+    loop_starts,
+    similarity_threshold,
+):
+    """The line pass: each line's `lines` entry (`_line_entry`) and, for a
+    line something was heard for, the gap before it
+    (`_between_lines_findings`), its clipped tail (`_clipped_findings`) and
+    the sound its words leave out (`_untranscribed_findings`); then the
+    stretch after the last line heard, to the end of the take.
+
+    Returns (lines, claimed, findings): `claimed` maps each assigned heard
+    index to the shot of the line it was matched to - a word a line in
+    another shot claimed (one straddling the cut) is that line's speech, not
+    speech in a silent shot."""
+    by_name = {span["name"]: span for span in spans or ()}
+    mismatch = mismatch_rule(similarity_threshold)
+    lines, claimed, findings = [], {}, []
+    strays = [heard[j] for j, _ in unassigned]
     previous_end = 0.0
+    heard_end = None  # end of the last word any earlier line was heard to say
+    last_line = last_shot = None
     for index, (line, words, indices) in enumerate(
         zip(parsed_lines, expected, assigned)
     ):
         own = [heard[j] for j in indices]
-        # A markup word spoken aloud is tag_spoken's to report, not a
-        # mismatch too: it is left out of the line's score
-        tokens = set(line["tokens"]) - set(words)
-        score = line_similarity(
-            words, [word["word"] for word in own if word["word"] not in tokens]
-        )
-        start = own[0]["start"] if own else None
-        end = own[-1]["end"] if own else None
         # The shot the line names, else the one its heard words overlap most
         shot = line["shot"]
         if shot is None and spans is not None and own:
-            shot = overlapping_shot(spans, start, end)
+            shot = overlapping_shot(spans, own[0]["start"], own[-1]["end"])
         span = by_name.get(shot)
         claimed.update((j, shot) for j in indices)
-        lines.append(
-            {
-                "expected": line["text"],
-                "heard": _joined(own),
-                "similarity": round(score, 4),
-                "start": _round(start),
-                "end": _round(end),
-                "shot": shot,
-            }
+        # Where a dropped line sits: its shot's start, else after the last
+        # line heard
+        position = span["start"] if span else previous_end
+        entry, found = _line_entry(
+            index,
+            line,
+            words,
+            own,
+            shot,
+            position,
+            # A line nothing was heard for, at or after a transcript_loop,
+            # was never transcribed: Whisper was stuck, so it is not a 0.0
+            # mismatch
+            looped=not own and any(at <= position for at in loop_starts),
+            mismatch=mismatch,
+            similarity_threshold=similarity_threshold,
         )
-        if score < similarity_threshold:
-            if own:
-                at = _at(index, own[0], shot=shot)
-            else:
-                # A dropped line: where its shot starts, else after the last
-                # line heard
-                at = _at(
+        lines.append(entry)
+        findings.extend(found)
+        if not own:
+            continue
+        start, end = own[0]["start"], own[-1]["end"]
+        if heard_end is not None:
+            findings.extend(
+                _between_lines_findings(
+                    mono,
+                    sample_rate,
                     index,
-                    seconds=span["start"] if span else previous_end,
-                    shot=shot,
+                    heard_end,
+                    start,
+                    shot,
+                    strays,
+                    spans,
+                    parsed_lines,
                 )
-            findings.append(finding(mismatch, round(score, 4), at))
+            )
+        if heard_end is None or end >= heard_end:
+            last_line, last_shot = index, shot
+        heard_end = max(heard_end or 0.0, end)
+        tails = ([(shot, span["end"])] if span else []) + [(None, duration)]
+        findings.extend(_clipped_findings(mono, sample_rate, tails, index, own, shot))
+        findings.extend(_untranscribed_findings(mono, sample_rate, index, own, shot))
+        previous_end = end
+
+    if heard_end is not None:
+        # The stretch after the last line heard, to the end of the take: the
+        # same rule as between two lines, so a shot checked alone agrees with
+        # the cut (#970)
+        findings.extend(
+            _between_lines_findings(
+                mono,
+                sample_rate,
+                last_line,
+                heard_end,
+                duration,
+                last_shot,
+                strays,
+                spans,
+                parsed_lines,
+            )
+        )
+    return lines, claimed, findings
 
-        for word in own:
-            if word["word"] in tokens:
-                findings.append(
-                    finding(TAG_SPOKEN, word["word"], _at(index, word, shot=shot))
-                )
 
+def _line_entry(
+    index, line, words, own, shot, position, looped, mismatch, similarity_threshold
+):
+    """One line's `lines` entry and its own findings: `line_mismatch` when
+    its heard words score under the threshold (placed at its first heard
+    word, else at `position`), and `tag_spoken` for each markup word heard
+    in it. A looped line (`looped`) scores nothing and is marked
+    `not_transcribed`. Returns (entry, findings)."""
+    # A markup word spoken aloud is tag_spoken's to report, not a
+    # mismatch too: it is left out of the line's score
+    tokens = set(line["tokens"]) - set(words)
+    score = line_similarity(
+        words, [word["word"] for word in own if word["word"] not in tokens]
+    )
+    entry = {
+        "expected": line["text"],
+        "heard": None if looped else _joined(own),
+        "similarity": None if looped else round(score, 4),
+        "start": round_seconds(own[0]["start"]) if own else None,
+        "end": round_seconds(own[-1]["end"]) if own else None,
+        "shot": shot,
+    }
+    findings = []
+    if looped:
+        entry["not_transcribed"] = "transcript_loop"
+    elif score < similarity_threshold:
         if own:
-            tails = ([(shot, span["end"])] if span else []) + [(None, duration)]
-            findings.extend(
-                _clipped_findings(mono, sample_rate, tails, index, own, shot)
-            )
-            findings.extend(
-                _untranscribed_findings(mono, sample_rate, index, own, shot)
+            at = _at(index, own[0], shot=shot)
+        else:
+            at = _at(index, seconds=position, shot=shot)
+        findings.append(finding(mismatch, round(score, 4), at))
+    for word in own:
+        if word["word"] in tokens:
+            findings.append(
+                finding(TAG_SPOKEN, word["word"], _at(index, word, shot=shot))
             )
-            previous_end = end
+    return entry, findings
 
-    findings.extend(_unassigned_tags(heard, unassigned, parsed_lines, expected, spans))
 
+def _shot_rules(
+    spans,
+    shots_source,
+    parsed_lines,
+    expected,
+    heard,
+    unassigned,
+    claimed,
+    similarity_threshold,
+):
+    """The shot rules (`SHOT_RULES`) when the shots are known and a line
+    names one (`_no_shot_reason`), else their skip entries. Returns
+    (rules_applied, rules_skipped, findings); `SILENT_RULES` are skipped
+    whenever lines were given."""
     rules_applied = list(LINE_RULES)
     rules_skipped = [
         {"rule": rule, "reason": "lines were given - speech is expected"}
         for rule in SILENT_RULES
     ]
+    findings = []
     no_shot = _no_shot_reason(shots_source, spans, parsed_lines)
     if no_shot is None:
         rules_applied.extend(SHOT_RULES)
         findings.extend(_silent_shot_findings(spans, parsed_lines, heard, claimed))
         findings.extend(
-            _unscripted_findings(spans, parsed_lines, expected, heard, unassigned)
+            _unscripted_findings(
+                spans, parsed_lines, expected, heard, unassigned, similarity_threshold
+            )
         )
     else:
         rules_skipped.extend({"rule": rule, "reason": no_shot} for rule in SHOT_RULES)
-
-    findings.sort(key=lambda found: found["at"].get("seconds") or 0.0)
-    return {
-        "findings": findings,
-        "lines": lines,
-        "discarded": discarded,
-        "unmatched": [_heard_entry(heard[j]) for j, _ in unassigned],
-        "shots": _shots_entry(spans),
-        "shots_source": shots_source,
-        "rules_applied": rules_applied,
-        "rules_skipped": rules_skipped,
-    }
+    return rules_applied, rules_skipped, findings
+
+
+def _loop_findings(chunks, script_words):
+    """A `transcript_loop` finding for each repetition loop over the script's
+    own words: Whisper stuck on a line it heard, so what follows the loop was
+    never transcribed and its lines read as mismatches (#961)."""
+    spoken = [c for c in chunks if normalize_words(c.get("text", ""))]
+    looped, firsts = looped_texts_firsts([c.get("text", "") for c in spoken])
+    found, run = [], []
+    for index in sorted(looped) + [None]:
+        if run and (index is None or index != run[-1] + 1):
+            if any(i in firsts for i in run):
+                members = [spoken[i] for i in run]
+                if all(
+                    set(normalize_words(m["text"])) <= script_words for m in members
+                ):
+                    at = _at(None, seconds=members[0]["start"])
+                    at["end"] = round_seconds(members[-1]["end"])
+                    found.append(finding(TRANSCRIPT_LOOP, len(members), at))
+            run = []
+        if index is not None:
+            run.append(index)
+    return found
 
 
 def _heard_shot(spans, word):
@@ -590,8 +672,8 @@ def _silent_take(heard, discarded, spans, shots_source):
 def _untranscribed_findings(mono, sample_rate, index, own, shot):
     """speech_not_transcribed: audible sound in a gap the line's words leave
     - between two of them - or inside one word stretched over
-    UNHEARD_MIN_SECONDS (#923). Not the gap before a line's first word: a pause
-    between shots may hold music or ambience above the floor."""
+    UNHEARD_MIN_SECONDS (#923). The gap before a line's first word is
+    _between_lines_findings'."""
     intervals = [(a["end"], b["start"]) for a, b in zip(own, own[1:])]
     findings = []
     for start, end in intervals:
@@ -611,27 +693,101 @@ def _untranscribed_findings(mono, sample_rate, index, own, shot):
     return [found for found in findings if found is not None]
 
 
+def _between_lines_findings(
+    mono, sample_rate, index, start, end, shot, strays, spans=None, parsed_lines=()
+):
+    """speech_not_transcribed for the stretch between one line's last word and
+    the next line's first (#960): audible sound with no word, which the
+    in-line check cannot see when the timing leaves it outside both lines.
+    Heard-but-unmatched words in the gap are unscripted_speech's, but only the
+    stretches they cover: each stretch left between them is judged on its own
+    (#964). Each stretch is attributed to the shot holding most of it, and
+    to the line naming that shot (null when none does), not to the next
+    line's shot by default."""
+    if end - start < UNHEARD_MIN_SECONDS:
+        return []
+    inside = sorted(
+        (w for w in strays if w["start"] < end and w["end"] > start),
+        key=lambda w: w["start"],
+    )
+    stretches, cursor = [], start
+    for word in inside:
+        stretches.append((cursor, word["start"]))
+        cursor = max(cursor, word["end"])
+    stretches.append((cursor, end))
+    found = []
+    for lo, hi in stretches:
+        if hi - lo < UNHEARD_MIN_SECONDS:
+            continue
+        audible = _audible_extent(mono, sample_rate, lo, hi)
+        if audible is None:
+            continue
+        lo, hi = audible
+        where_line, where_shot = index, shot
+        holder = None if spans is None else overlapping_shot(spans, lo, hi)
+        if holder is not None and holder != shot:
+            where_shot = holder
+            where_line = next(
+                (i for i, line in enumerate(parsed_lines) if line["shot"] == holder),
+                None,
+            )
+        found.append(_untranscribed(mono, sample_rate, where_line, lo, hi, where_shot))
+    return [f for f in found if f is not None]
+
+
+def _audible_extent(mono, sample_rate, start, end):
+    """The span of the stretch [start, end] from its first to its last window
+    above UNHEARD_FLOOR_DBFS, or None when that is shorter than
+    UNHEARD_MIN_SECONDS (#967): sub-floor time at either edge is not "audible
+    sound", and must not size or place the finding. An edge that is itself
+    audible stays the stretch's own edge."""
+    inner_start, inner_end = (
+        start + UNHEARD_MARGIN_SECONDS,
+        end - UNHEARD_MARGIN_SECONDS,
+    )
+    first = last = None
+    cursor = inner_start
+    while cursor < inner_end:
+        stop = min(cursor + GUARD_WINDOW_SECONDS, inner_end)
+        level = word_level(mono, sample_rate, cursor, stop)
+        if level is not None and level > UNHEARD_FLOOR_DBFS:
+            if first is None:
+                first = cursor
+            last = stop
+        cursor = stop
+    if first is None:
+        return None
+    first = start if first <= inner_start else first
+    last = end if last >= inner_end else last
+    return (first, last) if last - first >= UNHEARD_MIN_SECONDS else None
+
+
 def _untranscribed(mono, sample_rate, index, start, end, shot):
     lo, hi = start + UNHEARD_MARGIN_SECONDS, end - UNHEARD_MARGIN_SECONDS
     level = word_level(mono, sample_rate, lo, hi)
     if level is None or level <= UNHEARD_FLOOR_DBFS:
         return None
     at = _at(index, seconds=start, shot=shot)
-    at["end"] = _round(end)
-    return finding(SPEECH_NOT_TRANSCRIBED, _round(end - start, 2), at)
+    at["end"] = round_seconds(end)
+    return finding(SPEECH_NOT_TRANSCRIBED, round_seconds(end - start, 2), at)
 
 
 def _clipped_findings(mono, sample_rate, tails, index, own, shot):
     """line_clipped_at_end for one heard line, as a list of zero or one
-    finding: its last word ends in a voiced tail of its shot or the file."""
+    finding: its last word ends in a voiced tail of its shot or the file. The
+    tail is judged against the whole line's loudest window, not the last
+    word's: under a score the ASR stretches the last word over the bed, and a
+    bed measured against itself passes the guard (#959)."""
     end = own[-1]["end"]
-    clipped = _clipped_tail(mono, sample_rate, end, tails)
+    clipped = _clipped_tail(
+        mono, sample_rate, end, tails, (own[0]["start"], own[-1]["end"])
+    )
     if clipped is None:
         return []
-    at = {"line": index, "seconds": _round(end), "word": own[-1]["text"]}
+    at = {"line": index, "seconds": round_seconds(end), "word": own[-1]["text"]}
     if clipped[0] is not None or shot is not None:
         at["shot"] = clipped[0] or shot
-    return [finding(CLIPPED_AT_END, _round(clipped[1], 2), at)]
+    return [finding(CLIPPED_AT_END, round_seconds(clipped[1], 2), at)]
 
 
 def _unassigned_tags(heard, unassigned, parsed_lines, expected, spans):
@@ -672,15 +828,18 @@ def _silent_shot_findings(spans, parsed_lines, heard, claimed):
         if inside:
             at = _at(None, inside[0], shot=span["name"])
             # A word straddling the cut into this shot is placed at the cut
-            at["seconds"] = max(at["seconds"], _round(span["start"]))
+            at["seconds"] = max(at["seconds"], round_seconds(span["start"]))
             findings.append(finding(SPEECH_IN_SILENT_SHOT, len(inside), at))
     return findings
 
 
-def _unscripted_findings(spans, parsed_lines, expected, heard, unassigned):
+def _unscripted_findings(
+    spans, parsed_lines, expected, heard, unassigned, similarity_threshold
+):
     """unscripted_speech: heard words align left to no line that sit inside a
     shot a line names. `repeats_line` is set when the shot's words, in order,
-    contain one of its lines' words again."""
+    contain one of its lines' words again, or score at least the mismatch
+    threshold against one of them (a repeat misheard as the line was)."""
     findings = []
     for span in spans:
         lines = [
@@ -699,10 +858,15 @@ def _unscripted_findings(spans, parsed_lines, expected, heard, unassigned):
             continue
         at = _at(None, inside[0], shot=span["name"])
         words = [word["word"] for word in inside]
-        at["end"] = _round(inside[-1]["end"])
+        at["end"] = round_seconds(inside[-1]["end"])
         at["repeats_line"] = any(
             line and _contains(words, line) for line in lines
         ) or any(line and _contains(line, words) for line in lines)
+        if not at["repeats_line"]:
+            at["repeats_line"] = any(
+                line and line_similarity(line, words) >= similarity_threshold
+                for line in lines
+            )
         findings.append(finding(UNSCRIPTED_SPEECH, len(inside), at))
     return findings
 
@@ -716,8 +880,8 @@ def _contains(words, part):
 def _heard_entry(word):
     return {
         "text": word["text"],
-        "start": _round(word["start"]),
-        "end": _round(word["end"]),
+        "start": round_seconds(word["start"]),
+        "end": round_seconds(word["end"]),
     }
 
 
@@ -830,15 +994,44 @@ def check_script(
 
             fps = (probe_metadata(path) or {}).get("fps")
         spans = shot_spans(records, rate, fps, len(mono) / rate if rate else 0.0)
+    chunks, whole = transcript["chunks"], True
+    script_words = {w for line in parsed_lines for w in normalize_words(line["text"])}
+    if spans and parsed_lines and _loop_findings(chunks, script_words):
+        # Whisper looped on the whole cut and never transcribed what follows
+        # (#961): the shots are known, so transcribe each on its own (#963)
+        emit_log("check_script: transcript_loop on the cut; transcribing per shot")
+        chunks, whole = (
+            per_shot_chunks(
+                lambda piece, sr: transcribe_audio(
+                    piece,
+                    device=device,
+                    sample_rate=sr,
+                    model_name=model_name,
+                    timestamps="word",
+                )["chunks"],
+                waveform,
+                rate,
+                spans,
+            ),
+            False,
+        )
     answer = check(
         parsed_lines,
-        transcript["chunks"],
+        chunks,
         mono,
         rate,
         float(similarity),
         spans=spans,
         shots_source=shots_source,
     )
+    answer["transcription_pass"] = "whole_cut" if whole else "per_shot"
+    if not whole:
+        answer["transcription_note"] = (
+            "the whole-cut transcript looped, so each shot was transcribed on"
+            " its own and 'lines' and 'findings' come from that pass"
+        )
+        for line in answer["lines"]:
+            line["pass"] = "per_shot"
     answer["transcript"] = transcript["text"]
     answer["model_name"] = model_name
     answer["thresholds"] = dict(THRESHOLDS, similarity=float(similarity))
diff --git a/dw/tasks/script_take.py b/dw/tasks/script_take.py
new file mode 100644
index 000000000..0f94a5bc2
--- /dev/null
+++ b/dw/tasks/script_take.py
@@ -0,0 +1,223 @@
+"""The take side of `check_script` (`dw/tasks/script_check.py`): what the
+transcriber hears, which heard words are kept, and where each sits.
+
+`script_check` reads this module; nothing here reads `script_check`, so the
+rule tables and findings stay on the other side of the seam. It holds:
+
+- the levelling the transcriber hears the take at (`level_for_transcription`,
+  `per_shot_chunks`) - the level checks keep reading the original waveform;
+- the shot placement the probes' rule gives (`shot_spans` via
+  `assess.sample_span`, `overlapping_shot`, `shot_at`);
+- the guard (`guard_words`): a heard word at or below the dead-air floor
+  (`GUARD_FLOOR_DBFS`, the probes' `DEAD_AIR_FLOOR_DBFS`), one repeating the
+  previous chunk's exact span, or one inside a repetition loop
+  (`script_lines.looped_texts_firsts`) is discarded, never raised as a
+  finding. `word_level` is the measure the guard and the level checks share
+  (`dsp.loudest_window_dbfs` over `GUARD_WINDOW_SECONDS`, the window
+  `shot_dead_air` measures in).
+"""
+
+from types import SimpleNamespace
+
+from .. import dsp
+from ..assessment_rules import DEAD_AIR_FLOOR_DBFS
+from ..script_lines import looped_texts_firsts, normalize_words
+from .assess import DEAD_AIR_WINDOW, sample_span
+
+# A heard word is guarded (discarded as unheard) when its loudest
+# GUARD_WINDOW_SECONDS window sits at or below GUARD_FLOOR_DBFS. The floor is
+# the assessment probes' dead-air floor and the window is the one
+# `shot_dead_air` measures in (`DEAD_AIR_WINDOW`), both read, not copied. The loudest window rather than the whole
+# span, because a word timestamp is approximate (+-0.1-0.3 s) and a span
+# that overhangs the pause after a word must not average a real word away
+GUARD_FLOOR_DBFS = DEAD_AIR_FLOOR_DBFS
+GUARD_WINDOW_SECONDS = DEAD_AIR_WINDOW
+
+# Whisper drops soft speech from a quiet input, so the same shot got different
+# verdicts by level (#925). The transcriber hears the take scaled so its loud
+# end sits near full scale - a take only 2 dB under that still lost a soft
+# "Uh," that +6 dB brought back; the level checks keep reading the original
+# waveform.
+TRANSCRIBE_PEAK = 0.9
+TRANSCRIBE_MAX_GAIN = 100.0  # 40 dB: a near-silent take is not boosted to noise
+
+
+def level_for_transcription(waveform):
+    """(waveform, gain) with the 99.9th-percentile magnitude scaled to
+    TRANSCRIBE_PEAK (spikes past full scale clipped); gain is 1.0 for silence."""
+    import numpy
+
+    loud = float(numpy.percentile(numpy.abs(waveform), 99.9)) if waveform.size else 0.0
+    if loud <= 0.0:
+        return waveform, 1.0
+    gain = min(TRANSCRIBE_PEAK / loud, TRANSCRIBE_MAX_GAIN)
+    leveled = numpy.clip(waveform * gain, -1.0, 1.0).astype(numpy.float32)
+    return leveled, gain
+
+
+def shot_spans(records, sample_rate, fps, duration):
+    """Each shot record as {name, start, end} in seconds on the take, or None
+    when one cannot be placed. Placed by `assess.sample_span`, the rule the
+    probes use (recorded sample span, else frames by `fps`). Clipped to the
+    take's `duration`."""
+    if not sample_rate:
+        return None
+    media = SimpleNamespace(fps=fps, sample_rate=sample_rate)
+    spans = []
+    for record in records:
+        start, count, _source = sample_span(record, media)
+        if start is None:
+            return None
+        start, end = start / sample_rate, (start + count) / sample_rate
+        start = min(max(0.0, float(start)), duration)
+        spans.append(
+            {
+                "name": record["name"],
+                "start": start,
+                "end": max(start, min(float(end), duration)),
+            }
+        )
+    return spans
+
+
+def overlapping_shot(spans, start, end):
+    """The name of the shot [start, end] overlaps most, or None. A span of no
+    length (a one-word line's zero-length chunk) is placed by where it sits."""
+    best, best_overlap = None, 0.0
+    for span in spans:
+        overlap = min(span["end"], end) - max(span["start"], start)
+        if overlap > best_overlap or (
+            best is None and overlap == 0 and span["start"] <= start < span["end"]
+        ):
+            best, best_overlap = span["name"], overlap
+    return best
+
+
+def shot_at(spans, seconds):
+    """The name of the shot holding `seconds`, or None."""
+    for span in spans:
+        if span["start"] <= seconds < span["end"]:
+            return span["name"]
+    return None
+
+
+def word_level(mono, sample_rate, start, end):
+    """The loudest GUARD_WINDOW_SECONDS window's rms over [start, end], in
+    dBFS, or None for silence (`dsp.loudest_window_dbfs`)."""
+    return dsp.loudest_window_dbfs(mono, sample_rate, start, end, GUARD_WINDOW_SECONDS)
+
+
+def round_seconds(value, places=3):
+    return None if value is None else round(float(value), places)
+
+
+def guard_words(chunks, mono, sample_rate, script_words=None):
+    """Split transcribe_audio's word chunks into (heard, discarded).
+
+    `heard` is [{word, text, start, end}], one per normalized word - a chunk
+    that normalizes to nothing ('♪', '...') is neither; `discarded` is
+    [{text, start, end, level_dbfs, reason, count}] for a chunk at or below
+    the floor ("below_floor"), a chunk repeating the previous one's exact span
+    ("repeated_span": words cannot share a span, #971) or a repetition loop
+    ("repetition": one entry
+    per run of consecutive looped chunks, `count` chunks, `text` the first's,
+    `start`/`end` the run's span).
+
+    A loop's first occurrence is kept as heard when `script_words` (the
+    words the script holds) contains all of its words and it has real
+    duration and speech level: Whisper loops on a line it did hear (#961).
+    """
+    spoken = []
+    for chunk in chunks:
+        words = normalize_words(chunk.get("text", ""))
+        if words:
+            spoken.append((chunk, words))
+    # The loop detector is script_lines' (shared with transcribe_audio's
+    # `suspect: "repetition"`); a chunk with no word is in no loop
+    looped, firsts = looped_texts_firsts([chunk.get("text", "") for chunk, _ in spoken])
+
+    heard, discarded = [], []
+    run_end = None  # spoken index of the last chunk folded into discarded[-1]
+    for index, (chunk, words) in enumerate(spoken):
+        start, end = chunk["start"], chunk["end"]
+        level = word_level(mono, sample_rate, start, end)
+        before = spoken[index - 1] if index else None
+        previous_span = (
+            None
+            if before is None
+            else (before[0]["start"], before[0]["end"], before[1])
+        )
+        first_of_line = (
+            index in firsts
+            and script_words is not None
+            and set(words) <= script_words
+            and end > start
+        )
+        if (start, end, words) == previous_span:
+            reason = "repeated_span"
+        elif index in looped and not first_of_line:
+            reason = "repetition"
+        elif level is None or level <= GUARD_FLOOR_DBFS:
+            reason = "below_floor"
+        else:
+            reason = None
+        if (
+            reason in ("repetition", "repeated_span")
+            and run_end == index - 1
+            and discarded[-1]["reason"] == reason
+        ):
+            # A loop is one entry: its span, its chunk count, its loudest level
+            last = discarded[-1]
+            last["end"] = round_seconds(max(last["end"], end))
+            last["count"] += 1
+            if level is not None and (
+                last["level_dbfs"] is None or level > last["level_dbfs"]
+            ):
+                last["level_dbfs"] = round_seconds(level, 2)
+            run_end = index
+            continue
+        if reason:
+            discarded.append(
+                {
+                    "text": chunk.get("text", "").strip(),
+                    "start": round_seconds(start),
+                    "end": round_seconds(end),
+                    "level_dbfs": round_seconds(level, 2),
+                    "reason": reason,
+                    "count": 1,
+                }
+            )
+            run_end = index if reason in ("repetition", "repeated_span") else None
+            continue
+        run_end = None
+        for word in words:
+            heard.append(
+                {
+                    "word": word,
+                    "text": chunk.get("text", "").strip(),
+                    "start": start,
+                    "end": end,
+                }
+            )
+    return heard, discarded
+
+
+def per_shot_chunks(transcribe, waveform, rate, spans):
+    """Word chunks from transcribing each shot's span on its own, timestamps
+    moved back onto the take's clock. `transcribe(leveled, rate)` is
+    transcribe_audio's chunks for one slice; each is levelled alone."""
+    chunks = []
+    for span in spans:
+        lo, hi = int(round(span["start"] * rate)), int(round(span["end"] * rate))
+        if hi <= lo:
+            continue
+        piece, _gain = level_for_transcription(waveform[..., lo:hi])
+        for chunk in transcribe(piece, rate):
+            chunks.append(
+                dict(
+                    chunk,
+                    start=chunk["start"] + span["start"],
+                    end=chunk["end"] + span["start"],
+                )
+            )
+    return chunks
diff --git a/dw/tasks/segment.py b/dw/tasks/segment.py
index afef6bee8..588df9eed 100644
--- a/dw/tasks/segment.py
+++ b/dw/tasks/segment.py
@@ -9,20 +9,53 @@
 import torch
 import numpy as np
 from PIL import Image, ImageOps
-from transformers import (
-    AutoProcessor,
-    AutoModelForZeroShotObjectDetection,
-    Sam2Model,
-    Sam2Processor,
-)
 from .model_cache import cached_model
+from .weights import argument_or_default, repo_entries
 
 logger = logging.getLogger("dw")
 
+
+class _TransformersClass:
+    """A `transformers` class resolved on its first attribute read rather
+    than at module top: the plan's `required_weights` lookup imports this
+    module on every validate of a segment step, and transformers costs a
+    second-plus the server need not pay. Module-level names so the tests
+    patch them as such (`patch("dw.tasks.segment.Sam2Model")`)."""
+
+    def __init__(self, name):
+        self._name = name
+
+    def __getattr__(self, attribute):
+        import transformers
+
+        return getattr(getattr(transformers, self._name), attribute)
+
+
+AutoProcessor = _TransformersClass("AutoProcessor")
+AutoModelForZeroShotObjectDetection = _TransformersClass(
+    "AutoModelForZeroShotObjectDetection"
+)
+Sam2Model = _TransformersClass("Sam2Model")
+Sam2Processor = _TransformersClass("Sam2Processor")
+
 _DEFAULT_DINO_MODEL = "IDEA-Research/grounding-dino-base"
 _DEFAULT_SAM_MODEL = "facebook/sam2-hiera-large"
 
 
+def model_sources(arguments):
+    """The (detector, segmenter) repos a segment step loads - `model_name`
+    and `sam_model_name` over the defaults."""
+    return (
+        argument_or_default(arguments, "model_name", _DEFAULT_DINO_MODEL),
+        argument_or_default(arguments, "sam_model_name", _DEFAULT_SAM_MODEL),
+    )
+
+
+def required_weights(arguments):
+    """The detector and segmenter repos, for the plan (dw/tasks/weights.py)."""
+    return repo_entries(*model_sources(arguments))
+
+
 def grounding_query(prompt):
     """A prompt in the form GroundingDINO scores: lowercase, each phrase ending
     in a period. 'cat' scored 0.20 against a photo of a cat - under the 0.3
@@ -47,8 +80,7 @@ def segment_image(image, prompt, device="cpu", **kwargs):
     Returns:
         PIL Image in mode "L" — white (255) for detected objects, black (0) for background.
     """
-    model_name = kwargs.get("model_name", _DEFAULT_DINO_MODEL)
-    sam_model_name = kwargs.get("sam_model_name", _DEFAULT_SAM_MODEL)
+    model_name, sam_model_name = model_sources(kwargs)
     threshold = kwargs.get("threshold", 0.3)
     invert = kwargs.get("invert", False)
 
@@ -120,7 +152,12 @@ def load_sam():
         sam_outputs.pred_masks, sam_inputs["original_sizes"]
     )
 
-    combined = masks[0][:, 0].sum(dim=0).clamp(0, 1)
+    # SAM2 answers each box with three candidate masks and rates each in
+    # iou_scores. Take each box's best-rated one: the first is often a part of
+    # the object - on the docs cup it was the body alone, missing the lid and
+    # with a hole where the logo is, so remove_object left the cup (#974)
+    best = sam_outputs.iou_scores[0].argmax(dim=-1).cpu()
+    combined = masks[0][torch.arange(len(best)), best].sum(dim=0).clamp(0, 1)
     mask_array = (combined.cpu().numpy() * 255).astype(np.uint8)
 
     mask_image = Image.fromarray(mask_array, mode="L")
diff --git a/dw/tasks/speech_generation.py b/dw/tasks/speech_generation.py
index 7692abbfc..6cd5c5f8b 100644
--- a/dw/tasks/speech_generation.py
+++ b/dw/tasks/speech_generation.py
@@ -28,6 +28,7 @@
 from .audio_utils import load_audio
 from ..trust import require_trusted_generate_arguments
 from .model_cache import cached_model, hf_pipeline_placement
+from .weights import argument_or_default, repo_entries
 
 logger = logging.getLogger("dw")
 
@@ -47,6 +48,21 @@
 _SPEAKER_ENCODER_SAMPLE_RATE = 16000
 
 
+def model_source(arguments):
+    """The text-to-speech repo a generate_speech step loads."""
+    return argument_or_default(arguments, "model_name", _DEFAULT_MODEL)
+
+
+def required_weights(arguments):
+    """The speech model's repo, plus speechbrain's speaker encoder when the
+    step clones a voice from a `speaker_embedding` clip, for the plan
+    (dw/tasks/weights.py)."""
+    encoder = (
+        _SPEAKER_ENCODER_MODEL if (arguments or {}).get("speaker_embedding") else None
+    )
+    return repo_entries(model_source(arguments), encoder)
+
+
 def _speaker_embedding_tensor(location, device, dtype):
     """The x-vector speechbrain's spkrec-xvect-voxceleb extracts from a
     reference audio file - what SpeechT5 conditions its voice on.
@@ -120,7 +136,14 @@ def _generation_settings(value, name):
 
 
 def generate_speech(text=None, device="cpu", seed=None, **kwargs):
-    """Speak a line of text with a local text-to-speech model.
+    """Speak a line of text with a local text-to-speech model - any
+    transformers text-to-speech checkpoint named by model_name. Three
+    families are wired for their voice controls: Bark (suno/bark-small, the
+    default; distinct speakers by voice_preset), MMS/VITS
+    (facebook/mms-tts-eng and the other per-language mms-tts-* checkpoints;
+    one voice, small and fast; a multi-speaker VITS takes speaker_id through
+    forward_params) and SpeechT5 (microsoft/speecht5_tts; speaks in the
+    voice of a reference clip given as speaker_embedding).
 
     Args:
         text: The line to speak. Mutually exclusive with messages - exactly
@@ -188,7 +211,7 @@ def generate_speech(text=None, device="cpu", seed=None, **kwargs):
         kwargs.get("generate_kwargs"), "generate_kwargs"
     )
 
-    model_name = kwargs.get("model_name", _DEFAULT_MODEL)
+    model_name = model_source(kwargs)
     voice_preset = kwargs.get("voice_preset", None)
     speaker_embedding = kwargs.get("speaker_embedding", None)
     dtype = preferred_task_dtype(device)
diff --git a/dw/tasks/text_generation.py b/dw/tasks/text_generation.py
index 03a810635..713d396dd 100644
--- a/dw/tasks/text_generation.py
+++ b/dw/tasks/text_generation.py
@@ -17,14 +17,27 @@
 import re
 
 from huggingface_hub import get_hf_file_metadata, hf_hub_download, hf_hub_url
-from transformers import pipeline as hf_pipeline
 from .. import preferred_task_dtype
-from ..locations import validate_hub_repo_id, validate_weight_name
+from ..locations import validate_hub_repo_id
+from ..security import validate_weight_name
 from ..trust import require_trusted_generate_arguments
 from .model_cache import cached_model, hf_pipeline_placement
+from .weights import argument_or_default, repo_entries
 
 logger = logging.getLogger("dw")
 
+
+def hf_pipeline(*args, **kwargs):
+    """`transformers.pipeline`, imported on the first call rather than at
+    module top: the plan's `required_weights` lookup imports this module on
+    every validate of one of its steps, and transformers costs a second-plus
+    the server need not pay. A module-level name so the tests patch it as
+    one (`patch("dw.tasks.text_generation.hf_pipeline")`)."""
+    from transformers import pipeline
+
+    return pipeline(*args, **kwargs)
+
+
 _DEFAULT_MODEL = "Qwen/Qwen2.5-1.5B-Instruct"
 # Small enough to stand in for the old captioning default; override for
 # anything needing real detail
@@ -328,6 +341,26 @@ def _validated_generate_kwargs(value):
     return value
 
 
+def model_source(arguments):
+    """The repo a text_generation step loads - `model_name` over the text
+    default, or over the vision default when the step gives an image (an
+    image_to_text or judge step always does)."""
+    default = DEFAULT_VISION_MODEL if (arguments or {}).get("image") else _DEFAULT_MODEL
+    return argument_or_default(arguments, "model_name", default)
+
+
+def required_weights(arguments):
+    """The language model's repo, for the plan (dw/tasks/weights.py). A
+    `system_prompt.from_hub` file is a single-file fetch, not listed."""
+    return repo_entries(model_source(arguments))
+
+
+def vision_required_weights(arguments):
+    """required_weights for a task that always hands generate_text an image
+    (image_to_text, judge)."""
+    return required_weights({**(arguments or {}), "image": True})
+
+
 def generate_text(prompt, device="cpu", **kwargs):
     """Generate text from a prompt using a local language model.
 
@@ -372,12 +405,8 @@ def generate_text(prompt, device="cpu", **kwargs):
     )
     generate_kwargs = _validated_generate_kwargs(kwargs.get("generate_kwargs"))
 
-    if images is None:
-        pipeline_task = "text-generation"
-        model_name = kwargs.get("model_name", _DEFAULT_MODEL)
-    else:
-        pipeline_task = "image-text-to-text"
-        model_name = kwargs.get("model_name", DEFAULT_VISION_MODEL)
+    pipeline_task = "text-generation" if images is None else "image-text-to-text"
+    model_name = model_source({**kwargs, "image": images})
 
     dtype = preferred_task_dtype(device)
 
diff --git a/dw/tasks/upscale.py b/dw/tasks/upscale.py
index c40c3e8be..6d83a7f69 100644
--- a/dw/tasks/upscale.py
+++ b/dw/tasks/upscale.py
@@ -12,6 +12,7 @@
 
 from .model_cache import cached_model
 from .tensor_image import pil_to_float_tensor, float_tensor_to_pil
+from .weights import file_entries, repo_entries
 
 logger = logging.getLogger("dw")
 
@@ -19,6 +20,23 @@
 _MAX_PIXELS_NO_TILE = 512 * 512
 
 
+def spandrel_source(arguments):
+    """The (model_name, filename) an upscale or restore_faces step loads -
+    filename None reads the repo's one weight file (`resolve_model_path`)."""
+    arguments = arguments or {}
+    return arguments.get("model_name"), arguments.get("filename")
+
+
+def required_weights(arguments):
+    """The weight file, or with no `filename` the repo whole - the task needs
+    such a repo to hold exactly one weight file, so the repo's size is the
+    file's - for the plan (dw/tasks/weights.py)."""
+    model_name, filename = spandrel_source(arguments)
+    if filename is None:
+        return repo_entries(model_name)
+    return file_entries(model_name, filename)
+
+
 def upscale_image(image, model_name, device="cpu", **kwargs):
     """Upscale an image using a spandrel-compatible super-resolution model.
 
@@ -42,7 +60,7 @@ def upscale_image(image, model_name, device="cpu", **kwargs):
             "spandrel is required for upscaling. Install with: pip install spandrel"
         )
 
-    filename = kwargs.get("filename", None)
+    model_name, filename = spandrel_source({**kwargs, "model_name": model_name})
     tile_size = kwargs.get("tile_size", 512)
     tile_overlap = kwargs.get("tile_overlap", 32)
 
diff --git a/dw/tasks/video_handlers.py b/dw/tasks/video_handlers.py
index 5f2c60faa..814fd5e94 100644
--- a/dw/tasks/video_handlers.py
+++ b/dw/tasks/video_handlers.py
@@ -286,6 +286,7 @@ def _handle_stabilize_video(task, arguments, previous_pipelines):
     "crop_face_track",
     implementation="dw.tasks.face_track.crop_face_track",
     consumes_device=True,
+    required_weights="dw.tasks.face_track.required_weights",
     summary=(
         "Follow one face through a clip and crop a steady square around it, "
         "with a per-frame record of the box and a face-detail strength."
diff --git a/dw/tasks/video_utils.py b/dw/tasks/video_utils.py
index 45077a74d..47a4304b0 100644
--- a/dw/tasks/video_utils.py
+++ b/dw/tasks/video_utils.py
@@ -22,7 +22,15 @@
     frames_at,
     grid_tile,
 )
-from ..media_types import AudioVideo, FittedVideo, fit_codec_padding
+
+# FrameList lives beside AudioVideo; re-exported here, where it was first
+# defined, so `from dw.tasks.video_utils import FrameList` keeps working
+from ..media_types import (  # noqa: F401
+    AudioVideo,
+    FittedVideo,
+    FrameList,
+    fit_codec_padding,
+)
 from ..task_domains import frame_size_error, whole_number
 
 logger = logging.getLogger("dw")
@@ -363,33 +371,6 @@ def _to_pil(frame):
     raise TypeError(f"Cannot convert a {type(frame).__name__} to an image")
 
 
-class FrameList(list):
-    """The frames of a video file, carrying the rate the file plays at and
-    the shot boundaries its run recorded, if any.
-
-    `load_video` answers a plain list of images, which is what every
-    pipeline argument and every task wants - and which says nothing about
-    how fast those frames are meant to run. A step handed a 24 fps file
-    then wrote it back at `result.fps`'s default of 8, three times long,
-    with its soundtrack finishing a third of the way in and nothing said
-    about it (#104, the file-loading half of #84). A list subclass keeps
-    every consumer working unchanged while `getattr(video, "fps", None)` -
-    the question AudioVideo, concat_videos and interpolate_frames already
-    ask - gets a real answer.
-
-    `shots` is the same idea for the boundaries `dw.runs.shots_beside`
-    finds beside the file: a video loaded from an `asset:`/`output:` path
-    carried no way to answer `getattr(video, "shots", None)`, so
-    `pair_audio` had nothing to remeasure even though the file's own
-    manifest (or its kept-asset sidecar) already held them (#398).
-    """
-
-    def __init__(self, frames, fps=None, shots=None):
-        super().__init__(frames)
-        self.fps = fps
-        self.shots = shots
-
-
 def load_audio_video(location, base_dir=None):
     """Load a video file - frames and the audio muxed with them - as an AudioVideo.
 
diff --git a/dw/tasks/voice_attribution.py b/dw/tasks/voice_attribution.py
index 2813f9d9f..d976e3ab5 100644
--- a/dw/tasks/voice_attribution.py
+++ b/dw/tasks/voice_attribution.py
@@ -36,6 +36,7 @@
 from ..dsp import resample_waveform
 from .audio_utils import waveform_and_rate, load_audio
 from .model_cache import cached_model
+from .weights import repo_entries
 
 logger = logging.getLogger("dw")
 
@@ -105,6 +106,38 @@
     "voices_too_similar": VOICES_TOO_SIMILAR,
 }
 
+# separate_stems' stacked-vocals check (#947), on the 44.1 kHz stereo vocal
+# stem. Music 3 records a chorus as layered stereo doubles, and htdemucs
+# returns them in the one vocal stem: one voice processed as one where two
+# sing distorts (the 1:19 chorus of `two-minds` *Always On*). A window is
+# stacked when it is sung - at least STACK_VOICED_SHARE of its frames
+# voiced, and its mid level within STACK_LEVEL_BELOW_DB of the stem's level
+# (the VOICED_LEVEL_PERCENTILE frame rms) - and its left and right channels
+# disagree: their correlation below STACK_CORRELATION_MAX and the side/mid
+# energy ratio above STACK_SIDE_RATIO_MIN. The level gate is there because
+# faint content decorrelates as readily as a double: on *Always On* an
+# intro hum 16.5 dB down measured as stacked as the chorus. Flagged windows
+# merge across gaps of one window or less, and a span shorter than
+# STACK_MIN_SPAN_SECONDS (a single doubled word) is dropped. Calibrated on
+# *Always On* take A (job 494d1a7469b7): its chorus windows measure
+# correlation -0.28 to 0.25 and side/mid 0.61 to 1.68, its verse windows
+# 0.66 to 0.97 and 0.02 to 0.21
+STACK_WINDOW_SECONDS = 1.0
+STACK_VOICED_SHARE = 0.5
+STACK_LEVEL_BELOW_DB = 14.0
+STACK_CORRELATION_MAX = 0.45
+STACK_SIDE_RATIO_MIN = 0.4
+STACK_MIN_SPAN_SECONDS = 2.0
+# How many spans the warning names before "and N more"
+STACK_SPANS_LISTED = 8
+
+
+def required_weights(arguments):
+    """speechbrain's speaker encoder, for the plan (dw/tasks/weights.py).
+    The demucs separator downloads outside the Hugging Face cache and is not
+    listed (docs/TASKS.md)."""
+    return repo_entries(_EMBEDDER_MODEL)
+
 
 def _missing(package, error):
     return RuntimeError(
@@ -331,16 +364,22 @@ def voiced_mask(waveform, sample_rate):
     """Per-frame voiced flags for a mono waveform, the frame length in
     samples and the floor used: FRAME_SECONDS frames whose rms reaches
     voiced_floor_dbfs."""
-    frame = max(1, int(round(FRAME_SECONDS * sample_rate)))
-    count = len(waveform) // frame
-    if count == 0:
+    rms, frame = _frame_rms(waveform, sample_rate)
+    if len(rms) == 0:
         return numpy.zeros(0, dtype=bool), frame, VOICED_FLOOR_MIN_DBFS
-    frames = waveform[: count * frame].reshape(count, frame)
-    rms = numpy.sqrt(numpy.mean(frames.astype(numpy.float64) ** 2, axis=1))
     floor_dbfs = voiced_floor_dbfs(rms)
     return rms >= 10 ** (floor_dbfs / 20), frame, floor_dbfs
 
 
+def _frame_rms(waveform, sample_rate):
+    """The rms of each FRAME_SECONDS frame of a mono waveform, and the frame
+    length in samples."""
+    frame = max(1, int(round(FRAME_SECONDS * sample_rate)))
+    count = len(waveform) // frame
+    frames = waveform[: count * frame].reshape(count, frame)
+    return numpy.sqrt(numpy.mean(frames.astype(numpy.float64) ** 2, axis=1)), frame
+
+
 class _Voicing:
     """The voiced frames of the vocal stem, answering spans in seconds."""
 
@@ -868,6 +907,74 @@ def attribute_voices(
 STEMS_COMMAND = "separate_stems"
 
 
+def stacked_spans(stereo, sample_rate):
+    """The spans of a stereo vocal stem that hold stacked (layered stereo)
+    voices, as (start, end) seconds: the STACK_* check above. A mono stem, or
+    one with nothing sung, has none."""
+    audio = numpy.asarray(stereo, dtype=numpy.float64)
+    if audio.ndim != 2 or audio.shape[0] < 2:
+        return []
+    left, right = audio[0], audio[1]
+    mid, side = (left + right) / 2, (left - right) / 2
+    window = max(1, int(round(STACK_WINDOW_SECONDS * sample_rate)))
+    voiced, frame, _ = voiced_mask(mid, sample_rate)
+    rms, _ = _frame_rms(mid, sample_rate)
+    if not voiced.any():
+        return []
+    level = float(numpy.percentile(rms, VOICED_LEVEL_PERCENTILE))
+    quietest = level * 10 ** (-STACK_LEVEL_BELOW_DB / 20)
+    flagged = []
+    for index in range(len(mid) // window):
+        span = slice(index * window, (index + 1) * window)
+        frames = voiced[span.start // frame : span.stop // frame]
+        if len(frames) == 0 or frames.mean() < STACK_VOICED_SHARE:
+            continue
+        lw, rw, mw, sw = left[span], right[span], mid[span], side[span]
+        mid_energy = float(mw @ mw)
+        if math.sqrt(mid_energy / window) < quietest:
+            continue
+        denominator = math.sqrt(float(lw @ lw) * float(rw @ rw))
+        correlation = float(lw @ rw) / denominator if denominator else 1.0
+        if (
+            correlation < STACK_CORRELATION_MAX
+            and float(sw @ sw) / mid_energy > STACK_SIDE_RATIO_MIN
+        ):
+            flagged.append(index)
+    runs = []
+    for index in flagged:
+        # a gap of one window or less joins the run
+        if runs and index - runs[-1][1] <= 1:
+            runs[-1][1] = index + 1
+        else:
+            runs.append([index, index + 1])
+    seconds = window / sample_rate
+    return [
+        (first * seconds, last * seconds)
+        for first, last in runs
+        if (last - first) * seconds >= STACK_MIN_SPAN_SECONDS
+    ]
+
+
+def _minutes(seconds):
+    whole = int(seconds)
+    return f"{whole // 60}:{whole % 60:02d}"
+
+
+def stacked_vocals_message(spans):
+    """The stacked_vocals warning for these spans."""
+    listed = ", ".join(
+        f"{_minutes(start)}–{_minutes(end)}"
+        for start, end in spans[:STACK_SPANS_LISTED]
+    )
+    if len(spans) > STACK_SPANS_LISTED:
+        listed += f" and {len(spans) - STACK_SPANS_LISTED} more"
+    return (
+        f"{STEMS_COMMAND}: the vocals stem holds stacked (layered stereo) "
+        f"voices over {listed}; treat those spans as more than one voice "
+        "before processing them as one"
+    )
+
+
 def separate_stems(audio, sample_rate=None, device="cpu"):
     """Task command: split a mix into its vocals, drums, bass and other stems.
 
@@ -899,6 +1006,13 @@ def separate_stems(audio, sample_rate=None, device="cpu"):
     stems, stem_rate = _separate_with_fallback(
         _run_separator_stems, STEMS_COMMAND, waveform, rate, device, torch.float32
     )
+    spans = stacked_spans(stems["vocals"], stem_rate)
+    if spans:
+        emit_warning(
+            stacked_vocals_message(spans),
+            kind="stacked_vocals",
+            command=STEMS_COMMAND,
+        )
     return {
         name: as_track(array, stem_rate, STEMS_COMMAND) for name, array in stems.items()
     }
diff --git a/dw/tasks/weights.py b/dw/tasks/weights.py
new file mode 100644
index 000000000..32a1b53db
--- /dev/null
+++ b/dw/tasks/weights.py
@@ -0,0 +1,90 @@
+"""What a task step fetches from the Hub: the `required_weights` hook's helpers.
+
+Every model-backed task module exports `required_weights(arguments) ->
+list[dict]` - each dict `{"repo": <hub id>}` for a whole repo, `{"repo",
+"filename", "revision"}` for one file of it (revision None is main), or
+`{"url"}` for a fetch from outside the Hub - and its loader
+reads the repo it loads from the same resolution, so the plan's
+`downloads_required` (dw/plan.py) and the run cannot disagree about which
+argument wins over which default (#975). A command names its hook on its
+registration (`register_command(required_weights=...)`, a dotted path, so the
+plan path imports a task module only when a workflow has that task).
+
+A hook reads the step's *expanded* arguments, which at validate time can still
+hold a reference (`previous_result:mask`) or a local checkout path. Neither is
+a download it can name, so it gives no entry and never raises: whether a name
+is a hub id is decided by its shape, never by touching the disk, as the
+pipeline walk decides it.
+
+Torch-free on purpose: `dw/plan.py` imports it on every validate. And a
+leaf of the package on purpose: its one `dw` import is `dw/security.py`.
+`dw/locations.py` imports the task registry, whose hook lookup reaches the
+task modules, which import this module - so an import of the location
+policy from here closed a cycle (the architecture ratchet's
+`import_cycles`), and `validate_weight_name` lives in `dw/security.py` for
+that reason.
+"""
+
+import importlib.util
+from pathlib import Path
+
+from huggingface_hub.utils import HFValidationError, validate_repo_id
+
+
+def argument_or_default(arguments, name, default):
+    """The value the task will load for `name`: the step's own argument when
+    it gives one, else the task's default - the one rule both the hook and the
+    loader read, so an override and a default cannot be resolved two ways."""
+    value = (arguments or {}).get(name)
+    return default if value is None else value
+
+
+def is_hub_repo(value):
+    """Whether `value` is shaped like a hub repo id - a reference
+    (`previous_result:x`), a path (`/models/x`, `./x`) or a non-string is not."""
+    if not isinstance(value, str):
+        return False
+    try:
+        validate_repo_id(value)
+        return True
+    except HFValidationError:
+        return False
+
+
+def repo_entries(*names):
+    """`[{"repo": name}, ...]` for each name shaped like a hub repo id, in
+    order and once each; every other value is dropped silently."""
+    entries = []
+    for name in names:
+        if is_hub_repo(name) and {"repo": name} not in entries:
+            entries.append({"repo": name})
+    return entries
+
+
+def file_entries(repo, filename, revision=None):
+    """`[{"repo", "filename", "revision"}]` for one file of a hub repo, or
+    `[]` when the repo is not shaped like a hub id or the file name is not a
+    plain relative name inside it - the plan checks the cache by joining the
+    name onto it, so a name climbing out would make that check a probe of
+    the disk."""
+    from ..security import SecurityError, validate_weight_name
+
+    if not is_hub_repo(repo):
+        return []
+    try:
+        validate_weight_name(filename)
+    except SecurityError:
+        return []
+    return [{"repo": repo, "filename": filename, "revision": revision}]
+
+
+def package_dir(name):
+    """The directory a package is installed in, found without importing it,
+    or None when it is not installed - facexlib's import loads cv2, which a
+    validate should not pay for."""
+    try:
+        spec = importlib.util.find_spec(name)
+    except (ImportError, ValueError):
+        return None
+    locations = list(spec.submodule_search_locations or []) if spec else []
+    return Path(locations[0]) if locations else None
diff --git a/dw/validation.py b/dw/validation.py
index 06d692601..bf081258e 100644
--- a/dw/validation.py
+++ b/dw/validation.py
@@ -302,6 +302,15 @@ def _task_errors(context):
     )
     if context.arguments is None:
         errors = [e for e in errors if "variable" not in e]
+    elif argument_errors(context.definition, context.arguments):
+        # A bad argument leaves every argument unfolded, so a variable the
+        # caller did supply still reads as null here (#972). The argument
+        # error is the one to say; drop the finding for a supplied name
+        errors = [
+            e
+            for e in errors
+            if "variable" not in e or e["variable"] not in context.supplied
+        ]
     return errors
 
 
@@ -656,7 +665,8 @@ def _null_variable_argument_warnings(context):
     # A step loading a pipeline the catalog declares a VRAM ceiling for, in a
     # workflow that declares none, projected past it - a warning, since this
     # workflow's offload/quantization may be leaner than the template's
-    # (#502)
+    # (#502); under it, a note when that offload/quantization differs from
+    # the one the estimate was calibrated on (#954)
     Check(
         "inherited_vram_warnings",
         # No index, nothing to inherit - and no expansion read for it
diff --git a/dw/vram_estimate.py b/dw/vram_estimate.py
index b2945db99..7346339f1 100644
--- a/dw/vram_estimate.py
+++ b/dw/vram_estimate.py
@@ -50,6 +50,16 @@
 #516 and most of this module's own tests do - projection falls back to every
 pipeline step, unchanged from before.
 
+A refine step that carries `refine_tiles` does not denoise its canvas in one
+call (#1043): it denoises overlapping tiles one at a time, then decodes the
+blended canvas once with VAE spatial tiling, after the denoise calls. Pricing
+it by the canvas would warn for a run that fits, so a tiled step is priced as
+the larger of two stages (`tiled_required_gb`) - the denoise at the tile's own
+`width`/`height`, with the base, references and guides as for any step, and
+the decode at the canvas's voxel term alone, since the resident base belongs
+to the denoise. A `refine_tiles` that is not a dict of numeric `width` and
+`height` is not tile mode, and the step is priced as before.
+
 The entries checked are the serving device's own (see `_entries_for`);
 `bytes_per_voxel` was calibrated on CUDA, so a check against a Mac's capacity
 is an estimate of an estimate.
@@ -67,6 +77,10 @@
 GUIDE_VOXEL_KEY = "bytes_per_guide_voxel"
 # The voxel variable a guide's own frame count stands in for
 FRAMES_VARIABLE = "num_frames"
+# The H3 argument that puts a refine step in tile mode (the name
+# `pipeline_processors.h3_rules.REFINE_TILES_INPUT` owns; kept local so this
+# module takes no dependency on the processors package)
+TILES_KEY = "refine_tiles"
 _SOURCE_KEYS = (FROM_FILE_KEY, FROM_PREVIOUS_RESULT_KEY)
 
 
@@ -173,6 +187,39 @@ def required_gb(estimate, values, references=0, guides=()):
     )
 
 
+def tile_size(arguments):
+    """The (width, height) of `refine_tiles` in a step's pipeline arguments,
+    or None when the step is not in tile mode: the argument is absent, not a
+    dict, or its width or height is not a positive number."""
+    tiles = arguments.get(TILES_KEY) if isinstance(arguments, dict) else None
+    if not isinstance(tiles, dict):
+        return None
+    width = _as_number(tiles.get("width"))
+    height = _as_number(tiles.get("height"))
+    if width is None or height is None or width <= 0 or height <= 0:
+        return None
+    return width, height
+
+
+def tiled_required_gb(estimate, values, tile, references=0, guides=()):
+    """The projected requirement of a step in tile mode (#1043), or None when
+    `required_gb` cannot compute `values`: the larger of the denoise, priced
+    at `tile`'s (width, height) in place of the canvas's, and the decode,
+    which is the canvas's own voxel term - `bytes_per_voxel` times the
+    canvas voxels - without `base_gb`, since the tiled path decodes after the
+    denoise calls and the resident base belongs to the denoise."""
+    if required_gb(estimate, values) is None:
+        return None
+    denoise = required_gb(
+        estimate, {**values, "width": tile[0], "height": tile[1]}, references, guides
+    )
+    voxels = 1.0
+    for name in estimate.get("voxel_variables", []):
+        voxels *= _as_number(values.get(name))
+    decode = estimate.get("bytes_per_voxel", 0) * voxels / (1024**3)
+    return max(denoise, decode)
+
+
 def _guide_frames(pipeline, values, variables, base_dir, probe):
     """[(frames, worst_case)] for every guide the step lays in, or None when
     one cannot be probed and the step's `num_frames` is not a number to charge
@@ -330,9 +377,12 @@ def _projections(definition, estimate, arguments, base_dir=None, probe=None):
         )
         if guides is None:
             continue
-        projected = required_gb(
-            estimate, values, references, [frames for frames, _ in guides]
-        )
+        frames = [count for count, _ in guides]
+        tile = tile_size(step_arguments)
+        if tile is not None:
+            projected = tiled_required_gb(estimate, values, tile, references, frames)
+        else:
+            projected = required_gb(estimate, values, references, frames)
         if projected is not None:
             yield index, step, values, references, guides, projected
 
@@ -414,6 +464,22 @@ def _formula(estimate):
     return formula
 
 
+def _tiled_note(step, values):
+    """(priced values, ' (refine_tiles 1344x768: ...)') for a step in tile
+    mode (#1043), or (values, '') when it is not. The priced values are what
+    the denoise was charged: the tile in place of the canvas."""
+    pipeline = step.get("pipeline") if isinstance(step, dict) else None
+    tile = tile_size(pipeline.get("arguments") if isinstance(pipeline, dict) else None)
+    if tile is None:
+        return values, ""
+    width, height = (int(n) if n == int(n) else n for n in tile)
+    note = (
+        f" (refine_tiles {width}x{height}: denoise priced per tile, decode at "
+        f"the {values.get('width')}x{values.get('height')} canvas)"
+    )
+    return {**values, "width": width, "height": height}, note
+
+
 def _with_guides(guides):
     """' with 3 guides (22+22+124 frames)', naming the guides charged at the
     worst case, or '' with none."""
@@ -493,11 +559,21 @@ def vram_estimate_errors(
         else ""
     )
     where = _where(estimate, index, step, supplied, source_indices, written)
+    values, tiled = _tiled_note(step, values)
+    exceeded = [
+        entry
+        for entry in entries
+        if entry.get("vram_gb") is not None and projected > entry["vram_gb"]
+    ]
+    # The synthetic capacity entry _entries_for adds (the card's reported
+    # 23.6 beside a catalog "24") only speaks when no declared card does, so
+    # one projection never reads twice (#1053)
+    declared = [entry for entry in exceeded if "device" in entry]
+    if declared:
+        exceeded = declared
     errors = []
-    for entry in entries:
+    for entry in exceeded:
         capacity = entry.get("vram_gb")
-        if capacity is None or projected <= capacity:
-            continue
         device_label = entry.get("name") or entry.get("device", "this device")
         errors.append(
             {
@@ -505,7 +581,7 @@ def vram_estimate_errors(
                 "message": (
                     f"{member}{'*'.join(voxel_variables)} = "
                     f"{'*'.join(str(values.get(v)) for v in voxel_variables)}"
-                    f"{with_references}{_with_guides(guides)} projects to "
+                    f"{tiled}{with_references}{_with_guides(guides)} projects to "
                     f"{projected:.2f} GB VRAM, "
                     f"above the {capacity} GB declared for {device_label}"
                     f"{because}. {_formula(estimate)}"
@@ -515,6 +591,44 @@ def vram_estimate_errors(
     return errors
 
 
+def largest_projection(
+    definition,
+    arguments=None,
+    supplied=(),
+    device_type=None,
+    capacity_gb=None,
+    source_indices=None,
+    written=None,
+    capacity_label=None,
+    base_dir=None,
+    probe=None,
+):
+    """The largest step a declared vram_estimate projects, as
+    {path, gb, card} (`card` names the smallest card checked against), over
+    or under the ceiling alike; None when nothing is projected. The same
+    arguments as `vram_estimate_errors`, for a note on a projection that
+    passes."""
+    estimate = declared_estimate(definition)
+    if estimate is None:
+        return None
+    cost = definition.get("cost")
+    entries = _entries_for(
+        cost if isinstance(cost, list) else [], device_type, capacity_gb, capacity_label
+    )
+    cards = [e for e in entries if _as_number(e.get("vram_gb")) is not None]
+    projections = list(_projections(definition, estimate, arguments, base_dir, probe))
+    if not cards or not projections:
+        return None
+    index, step, _, _, _, projected = max(projections, key=lambda p: p[-1])
+    card = min(cards, key=lambda e: e["vram_gb"])
+    label = card.get("name") or card.get("device", "this device")
+    return {
+        "path": _where(estimate, index, step, supplied, source_indices, written),
+        "gb": projected,
+        "card": f"{card['vram_gb']} GB {label}",
+    }
+
+
 def required_vram_gb(
     definition, arguments=None, device_type=None, base_dir=None, probe=None
 ):
diff --git a/dw/vram_inheritance.py b/dw/vram_inheritance.py
index c6d37482a..ff7549116 100644
--- a/dw/vram_inheritance.py
+++ b/dw/vram_inheritance.py
@@ -23,7 +23,11 @@
 An inherited ceiling warns and never refuses (#479, Q3): the hand-built
 workflow may offload or quantize differently from the template, and the
 escape hatch for a leaner config is declaring its own `vram_estimate`, which
-always wins. There is no run-time backstop - the worker has no catalog, and
+always wins. A projection *under* the ceiling is not silent when the
+workflow's offload or quantization differs from the template's: the
+estimate was calibrated on that configuration, so it gets a
+`vram_config_differs` note (#954) naming both settings. Over the ceiling
+the one warning names the difference instead. There is no run-time backstop - the worker has no catalog, and
 the pre-queue check covers every server submission.
 """
 
@@ -38,9 +42,16 @@
     same_number,
     undeclared_variable_references,
 )
-from .vram_estimate import pipeline_identity, vram_estimate_errors
+from .vram_estimate import (
+    largest_projection,
+    pipeline_identity,
+    vram_estimate_errors,
+)
 
 KIND = "vram_projection_inherited"
+# A projection under the ceiling whose offload or quantization is not the
+# one the template was calibrated on (#954)
+CONFIG_KIND = "vram_config_differs"
 
 
 def template_identity(definition):
@@ -285,10 +296,49 @@ def build_index(catalog):
             "vram_estimate": definition[ESTIMATE_KEY],
             "cost": cost,
             "template": name,
+            "definition": definition,
         }
     return found
 
 
+# The differences that move a template's measured VRAM; frame count is scaled
+# by the projection and cache, attention backend and LoRA are named elsewhere
+_CALIBRATED = (("offload", "offload"), ("quantization", "quantization_config"))
+
+
+def _setting_text(definition, label, key, arguments=None):
+    """How `definition` sets `key`, as 'offload: model' - or 'no offload' when
+    it sets none - with `variable:` references resolved."""
+    values = sorted(
+        _found_expanded(definition, key, _compared_variables(definition, arguments))
+    )
+    if not values:
+        return f"no {label}"
+    shown = ", ".join(
+        value if len(value) <= 60 else value[:57] + "..."
+        for value in (v.strip('"') for v in values)
+    )
+    return f"{key}: {shown}"
+
+
+def calibration_differences(written, entry, arguments=None):
+    """(labels, calibrated text, written text) for the offload and
+    quantization `written` sets differently from the template `entry` was
+    built from; empty when they match or the template was not kept."""
+    template = entry.get("definition")
+    if not isinstance(template, dict) or not isinstance(written, dict):
+        return [], "", ""
+    labels = []
+    calibrated = []
+    used = []
+    for label, key in _CALIBRATED:
+        if sets_differently(written, template, key, arguments):
+            labels.append(label)
+            calibrated.append(_setting_text(template, label, key))
+            used.append(_setting_text(written, label, key, arguments))
+    return labels, "; ".join(calibrated), "; ".join(used)
+
+
 def inherited_vram_warnings(
     definition,
     index,
@@ -316,6 +366,14 @@ def inherited_vram_warnings(
     variables = definition.get("variables")
     variables = variables if isinstance(variables, dict) else {}
     identities = [pipeline_identity(step, variables) for step in steps]
+    written_definition = written if isinstance(written, dict) else definition
+    written_variables = written_definition.get("variables")
+    written_variables = {
+        **(written_variables if isinstance(written_variables, dict) else {}),
+        **(arguments or {}),
+    }
+    written_steps = written_definition.get("steps")
+    written_steps = written_steps if isinstance(written_steps, list) else []
     warnings = []
     for identity in dict.fromkeys(i for i in identities if i in index):
         entry = index[identity]
@@ -336,9 +394,20 @@ def inherited_vram_warnings(
             },
             "cost": entry["cost"],
         }
-        errors = vram_estimate_errors(
-            matched,
-            arguments,
+        # Only this identity's written steps, so another pipeline's offload
+        # is not held against this one's calibration
+        own = {
+            **written_definition,
+            "steps": [
+                step
+                if isinstance(step, dict)
+                and pipeline_identity(step, written_variables) == identity
+                else {}
+                for step in written_steps
+            ],
+        }
+        labels, calibrated, used = calibration_differences(own, entry, arguments)
+        common = dict(
             supplied=supplied,
             device_type=device_type,
             capacity_gb=capacity_gb,
@@ -348,15 +417,35 @@ def inherited_vram_warnings(
             base_dir=base_dir,
             probe=probe,
         )
-        if not errors:
-            continue
-        error = errors[0]
-        warnings.append(
-            f"{error['path']}: {KIND}: {error['message'].rstrip('.')}. The "
-            f"ceiling is inherited from '{entry['template']}', which loads "
-            f"the same pipeline; this workflow declares no vram_estimate and "
-            f"its offload and quantization config may differ from the "
-            f"template's, so this warns rather than refuses - declare a "
-            f"vram_estimate to be judged by your own numbers"
-        )
+        errors = vram_estimate_errors(matched, arguments, **common)
+        if errors:
+            error = errors[0]
+            if labels:
+                config = (
+                    f"its {' and '.join(labels)} differs from the template's "
+                    f"(calibrated with {calibrated}; this workflow sets {used})"
+                )
+            else:
+                config = (
+                    "its offload and quantization config may differ from the template's"
+                )
+            warnings.append(
+                f"{error['path']}: {KIND}: {error['message'].rstrip('.')}. The "
+                f"ceiling is inherited from '{entry['template']}', which loads "
+                f"the same pipeline; this workflow declares no vram_estimate and "
+                f"{config}, so this warns rather than refuses - declare a "
+                f"vram_estimate to be judged by your own numbers"
+            )
+        elif labels:
+            projection = largest_projection(matched, arguments, **common)
+            if projection is None:
+                continue
+            warnings.append(
+                f"{projection['path']}: {CONFIG_KIND}: the VRAM projection is "
+                f"inherited from '{entry['template']}', calibrated with "
+                f"{calibrated}; this workflow sets {used}, so real usage may "
+                f"be higher than the projection ({projection['gb']:.1f} GB of "
+                f"{projection['card']}) - declare a vram_estimate to be "
+                f"judged by your own numbers"
+            )
     return warnings
diff --git a/dw/worker.py b/dw/worker.py
index a41397910..6124fb1d0 100644
--- a/dw/worker.py
+++ b/dw/worker.py
@@ -25,6 +25,7 @@
 from dw.events import RunContext, WorkflowCancelled
 from dw import get_device_type, empty_device_cache, device_memory_stats
 from dw.worker_protocol import (
+    poisons_cuda_context,
     Cancelled,
     Failed,
     MemoryCleared,
@@ -308,6 +309,12 @@ def _handle_execute(self, command: Dict[str, Any]):
             self._evict_untouched_pipelines(job.context)
             self._cleanup_between_runs()
             self._reply(failure)
+            if poisons_cuda_context(failure.message, failure.traceback):
+                # A device-side assert leaves the context unusable: every
+                # later job on this card fails with the sticky error. Exit
+                # after the reply so the manager respawns a clean process
+                logger.error("CUDA context is poisoned - worker will restart")
+                self.pending_shutdown = True
         finally:
             if job.asset_token is not None:
                 deactivate_asset_dir(job.asset_token)
diff --git a/dw/worker_manager.py b/dw/worker_manager.py
index 09e48922c..3eef0ce3b 100644
--- a/dw/worker_manager.py
+++ b/dw/worker_manager.py
@@ -221,6 +221,19 @@ def terminate_worker(self):
         if process.is_alive():
             process.kill()
 
+    def await_exit(self):
+        """Wait for a worker that is exiting on its own (a poisoned CUDA
+        context), terminating it if it lingers, and clear the tracking state
+        so the next job respawns it."""
+        process = self.worker_process
+        if process is None:
+            return
+        process.join(timeout=WORKER_SHUTDOWN_TIMEOUT_SECONDS)
+        if process.is_alive():
+            process.terminate()
+            process.join(timeout=WORKER_TERMINATE_TIMEOUT_SECONDS)
+        self.mark_crashed()
+
     def crash_details(self):
         """Why the worker process is gone, as far as the OS will say.
 
diff --git a/dw/worker_protocol.py b/dw/worker_protocol.py
index 535bb3772..4d381b306 100644
--- a/dw/worker_protocol.py
+++ b/dw/worker_protocol.py
@@ -254,3 +254,19 @@ def parse_reply(wire: Dict[str, Any]):
     no class claims, never an exception."""
     reply_type = _REPLY_TYPES.get(wire.get("type"), UnknownReply)
     return reply_type.from_wire(wire)
+
+
+_POISONED_CUDA_MARKERS = (
+    "device-side assert",
+    "CUDA_ERROR_ASSERT",
+    "Sticky error detected",
+    "illegal memory access",
+)
+
+
+def poisons_cuda_context(*texts) -> bool:
+    """True when a failure's text shows a CUDA error that no later call in
+    this process can recover from."""
+    return any(
+        marker in (text or "") for text in texts for marker in _POISONED_CUDA_MARKERS
+    )
diff --git a/dw/workflows/h3_context_ir.json b/dw/workflows/h3_context_ir.json
index 82cd15613..3f93623aa 100644
--- a/dw/workflows/h3_context_ir.json
+++ b/dw/workflows/h3_context_ir.json
@@ -4,7 +4,7 @@
     "variables": {
         "prompt": "Task: T2VA. Duration: 5.17 seconds. Idea: a red fox trotting through a snowy pine forest at dawn.",
         "image": null,
-        "system_prompt": "You rewrite a user's video idea into a MiniMax-H3 Context-IR prompt, the format MiniMax's two prompt-writing guides define (docs/VIDEO_PROMPT_WRITING_GUIDE_base_en.md and docs/VIDEO_PROMPT_WRITING_GUIDE_ref_en.md in the MiniMaxAI/MiniMax-H3 model repository; this text follows them and is checked against them). Output only the rewritten prompt - no preamble, no commentary, no markdown fences, no explanation of what you did.\n\nThe user message states the task (T2VA, I2VA, FL2VA, L2VA or Ref2VA), the duration in seconds, and the idea. It may also state a continuity mode - \"Continuity: standalone\" or \"Continuity: continuation\" - which is standalone when absent. Structure the output as an optional instruction block, one blank line, then the three core fields.\n\nINSTRUCTION BLOCK, by task:\n- T2VA: none. Begin directly with the core fields.\n- I2VA: exactly \"For the target video, at 0.00 seconds into the target video, <Picture 1> (from [Shot 1]) is fully referenced.\"\n- FL2VA: exactly \"How the reference pictures align with the target video - Picture 1 (from Shot 1) aligns with the 0.00-second mark of the target video; Picture 2 (from Shot N) aligns with the S.SS-second mark of the target video.\" where S.SS is the duration to two decimal places and N is the index of the final shot.\n- L2VA: exactly \"How the reference pictures align with the target video - <Picture 1> (from [Shot N]) aligns with the S.SS-second mark of the target video.\"\n- Ref2VA: none of the above. Ref2VA has its own six-section layout, given below.\n\nCORE FIELDS for T2VA, I2VA, FL2VA and L2VA, in this order, separated by blank lines:\nintegrated_multimodal_description: the timeline - visual style, initial composition, subject appearance and position, scene and key props, actions and reactions, shot changes, spoken language and synchronized diegetic sound. This field is always written in full, whatever the brief says about sound or music; a silent brief still gets its complete visual timeline here.\noverall_soundscape: ambient sound, physical action sounds and non-verbal human sounds across the whole video. If the brief says there is no sound, this field is exactly one line reading \"overall_soundscape: N/A\" - not a description of silence.\nnon_diegetic_music: background score the audience hears and the characters cannot. If the brief says there is no music, this field is exactly one line reading \"non_diegetic_music: N/A\". Never describe silence in words and never invent audio a silent brief did not ask for.\n\nREF2VA uses six sections instead, in this order, separated by blank lines:\nsubject_definitions: one line per referenced item. <Subject N> is reusable visible content - a person, animal, object, scene, costume, style, action. <Picture N> is a reference image acting as a keyframe or composition anchor; an image that only defines a subject is cited inside that subject's line instead of getting one of its own. <Video N> is a whole-video relationship - an edit source, a continuation point, or a temporal-structure reference. <Audio N> is an audio asset that is copied or referenced; when it fixes a speaker's voice, name that speaker's ID in its line (\"<Audio 1> is the voice-timbre reference for <Subject 1> (S1).\"). One subject may draw on several assets (\"whose appearance comes from <Picture 1> and whose walking motion comes from <Video 1>\"), and an image that plans shots is a storyboard reference (\"<Picture 3> is a storyboard reference for [Shot 1] and [Shot 2], defining their viewpoint, subject placement, and shot order.\"). A label keeps the same meaning in every later section. The references appear in the order the request passes them, and each label type is numbered independently within its own category: the first video is <Video 1> whether or not pictures precede it, and a video reference does not by itself produce an <Audio N> - an audio label exists only for an audio asset the request passes.\nsummary: a square-bracketed task-type prefix followed by one short paragraph on the target video and its main reference relationships. The prefix combines, with \" + \" and without repeats, only the types the references actually play: \"keyframe completion\" (an image is a concrete first, last or key frame), \"reference generation\" (an image, video or audio guides a character, scene, style, action, camera, or storyboard without being a concrete frame or an edited source), \"video editing\" (a source video is directly modified), \"video continuation\" (new content continues or extends a source video), \"audio reuse\" (all or part of an audio signal is copied into the soundtrack), \"audio reference\" (only an audio's style, timbre, content, beat or continuity is followed). A video that only lends camera, cuts or rhythm is reference generation, not editing or continuation. A video edit opens with \"The target video is an edited version of <Video N>.\"\nretention_analysis: one line per referenced item, stating its relationship marker and what that means for it. Visible content (<Subject N>, <Picture N>, <Video N>) uses exactly one of: fully_preserved (its defined role is kept whole), partially_preserved (still used, some defined characteristics changed or only partly kept), attribute_transfer (its characteristics move onto a different identifiable subject), weak_reference (only broad similarity of style, category, composition or atmosphere). Audio (<Audio N>) uses exactly one of: fully_copy (the whole signal is the whole final soundtrack), partially_copy (part of the timeline or selected layers are copied, or sounds are added or replaced around it), reference (nothing copied; timbre, rhythm, music style, dialogue content or texture followed), weak_reference (only broad similarity of category or atmosphere). Write the entry as \"<Subject 1> (appears in [Shot 1], [Shot 3]): fully_preserved - ...\", \"<Picture 2> ([Shot 1] first frame): fully_preserved - ...\", \"<Audio 1>: partially_copy - ...\". Choose the marker within the role subject_definitions gave the label; new actions, backgrounds or events in the target video are not losses of fidelity.\ndetailed_description: one or two sentences establishing the overall style before [Shot 1] (\"The target video is in a realistic photographic style with soft window light.\"), then the same shot-by-shot timeline the other tasks put in integrated_multimodal_description, as detailed and explicit as possible - composition, appearance, environment and lighting, actions and state changes, camera movement, sound, and the points where referenced content actually takes effect. A generation task runs 350-500 words here, spread across the shots by their information load; dialogue-dense content fits the whole spoken timeline first. Never reduce it to a plot summary or a list of reference relationships.\noverall_soundscape: as above.\nnon_diegetic_music: as above.\n\nCONTINUITY MODES. These are this workflow engine's convention for writing one segment of a chained take and are not part of Context-IR; the user message states one when it applies, and standalone is assumed when it does not. They decide how the clip opens:\n- standalone, the default: the clip is a complete piece. [Shot 1] establishes the scene, and when a reference image is supplied [Shot 1] opens on that image - its framing, lighting and style.\n- continuation: the clip is one segment cut out of a longer unbroken take, and a <Video N> reference holds the frames immediately before it. Write one continuous shot - no cuts, and no later timestamped shots. [Shot 1] opens already in progress, on the framing, shot size, camera position, pose and lighting that <Video N> ends on, and carries them on from there. A supplied reference image constrains subject identity, wardrobe, set and palette alone and leaves the opening composition to <Video N>; the summary prefix includes \"video continuation\", and in retention_analysis the video reference is fully_preserved (it is the continuation point) and the subject the image defines is fully_preserved in its identity role. The clip begins mid-action and ends mid-action: it establishes nothing and resolves nothing. The stated duration is this segment's own, not that of the finished video it belongs to.\n\n\nRULES for the shot-by-shot body, whichever field carries it:\n- Open [Shot 1] with the overall style and initial composition, which in continuation mode is the one <Video N> ends on (in Ref2VA the style sentence sits just before [Shot 1] instead of inside it). Styles include Cinematic, live-action, 2D-animated, 3D CG, claymation, watercolor, vintage film. Derive it from the reference image when there is one, otherwise from the user's text.\n- Do not timestamp the first shot. Every later shot opens with a strictly increasing cut time inside the duration: \"[Shot 2] At 00:03.500, the camera cuts to ...\". A cut must introduce new information; when only framing or angle changes, use camera motion instead. FL2VA favours a single continuous shot unless the user asks otherwise, and continuation mode allows no cut at all.\n- Write camera motion as natural English inside the shot, as motion type plus optional amplitude and speed. Motion types: Zoom In, Zoom Out, Push In, Pull Out, Pan Left, Pan Right, Truck Left, Truck Right, Tilt Up, Tilt Down, Pedestal Up, Pedestal Down, Arc Shot, Tracking Shot, Static Shot, Shake Slightly, Shake Strongly, POV, Roll Clockwise, Roll Counterclockwise. Amplitude: \"with small amplitude\", \"with large amplitude\". Speed: \"at slow speed\", \"at fast speed\". Omit amplitude and speed when they are medium and normal.\n- Give every subject who speaks, sings or vocalises off-screen a stable ID - (S1), (S2), and (S1,S2) for unison - kept across shots. Characters who never vocalise get no ID. The first time a speaker appears, establish identity: character type, age, gender, on- or off-screen, pitch, timbre, speaking rate, accent.\n- Put spoken and sung content inside <d>[Language] ...</d> and nothing else. Identity, action and delivery stay outside the tag. Preserve the user's wording and punctuation verbatim; never translate or rewrite supplied lines. Invent dialogue only when the user asked for speech without supplying any.\n- Dialogue fidelity: write [unclear] for a span that cannot be made out; standardise punctuation and end every <d> block with terminal punctuation before </d>; never write speaker IDs such as (Sx) inside retention_analysis, which describes references, not speech; when an <Audio N> is referenced for a speaker's timbre only, do not carry its original words over - the dialogue is what the brief supplies.\n- Voiceover uses the exact phrase \"says in an off-screen voiceover\", and the text right after every voiceover <d> block states that the character's lips remain completely closed.\n- Use <scenetrans> at both connecting points of a line that continues across a cut, and <cutoff> when speech is truncated by the end of the video.\n- Put text actually visible on screen in double quotation marks, verbatim and untranslated.\n- When a reference image is supplied, the description must match what is actually in it - subject, setting, lighting and style - and in standalone mode [Shot 1] must open on that image's framing rather than on an invented scene; in continuation mode the opening framing is <Video N>'s and the image constrains the rest. Never describe content the image contradicts.\n- Every detail must be something visible or audible, in plain words. No negative phrasing - H3 is guidance-distilled and has no negative prompt, so say what is there, never what is not.",
+        "system_prompt": "You rewrite a user's video idea into a MiniMax-H3 Context-IR prompt, the format MiniMax's two prompt-writing guides define (docs/VIDEO_PROMPT_WRITING_GUIDE_base_en.md and docs/VIDEO_PROMPT_WRITING_GUIDE_ref_en.md in the MiniMaxAI/MiniMax-H3 model repository; this text follows them and is checked against them). Output only the rewritten prompt - no preamble, no commentary, no markdown fences, no explanation of what you did.\n\nThe user message states the task (T2VA, I2VA, FL2VA, L2VA or Ref2VA), the duration in seconds, and the idea. It may also state a continuity mode - \"Continuity: standalone\" or \"Continuity: continuation\" - which is standalone when absent. Structure the output as an optional instruction block, one blank line, then the three core fields.\n\nINSTRUCTION BLOCK, by task:\n- T2VA: none. Begin directly with the core fields.\n- I2VA: exactly \"For the target video, at 0.00 seconds into the target video, <Picture 1> (from [Shot 1]) is fully referenced.\"\n- FL2VA: exactly \"How the reference pictures align with the target video - Picture 1 (from Shot 1) aligns with the 0.00-second mark of the target video; Picture 2 (from Shot N) aligns with the S.SS-second mark of the target video.\" where S.SS is the duration to two decimal places and N is the index of the final shot.\n- L2VA: exactly \"How the reference pictures align with the target video - <Picture 1> (from [Shot N]) aligns with the S.SS-second mark of the target video.\"\n- Ref2VA: none of the above. Ref2VA has its own six-section layout, given below.\n\nCORE FIELDS for T2VA, I2VA, FL2VA and L2VA, in this order, separated by blank lines:\nintegrated_multimodal_description: the timeline - visual style, initial composition, subject appearance and position, scene and key props, actions and reactions, shot changes, every spoken or sung line as a <d> block (see RULES), and synchronized diegetic sound. This field is always written in full, whatever the brief says about sound or music; a silent brief still gets its complete visual timeline here.\noverall_soundscape: ambient sound, physical action sounds and non-verbal human sounds across the whole video. If the brief says there is no sound, this field is exactly one line reading \"overall_soundscape: N/A\" - not a description of silence.\nnon_diegetic_music: background score the audience hears and the characters cannot. If the brief says there is no music, this field is exactly one line reading \"non_diegetic_music: N/A\". Never describe silence in words and never invent audio a silent brief did not ask for.\n\nREF2VA uses six sections instead, in this order, separated by blank lines:\nsubject_definitions: one line per referenced item. <Subject N> is reusable visible content - a person, animal, object, scene, costume, style, action. <Picture N> is a reference image acting as a keyframe or composition anchor; an image that only defines a subject is cited inside that subject's line instead of getting one of its own. <Video N> is a whole-video relationship - an edit source, a continuation point, or a temporal-structure reference. <Audio N> is an audio asset that is copied or referenced; when it fixes a speaker's voice, name that speaker's ID in its line (\"<Audio 1> is the voice-timbre reference for <Subject 1> (S1).\"). One subject may draw on several assets (\"whose appearance comes from <Picture 1> and whose walking motion comes from <Video 1>\"), and an image that plans shots is a storyboard reference (\"<Picture 3> is a storyboard reference for [Shot 1] and [Shot 2], defining their viewpoint, subject placement, and shot order.\"). A label keeps the same meaning in every later section. The references appear in the order the request passes them, and each label type is numbered independently within its own category: the first video is <Video 1> whether or not pictures precede it, and a video reference does not by itself produce an <Audio N> - an audio label exists only for an audio asset the request passes.\nsummary: a square-bracketed task-type prefix followed by one short paragraph on the target video and its main reference relationships. The prefix combines, with \" + \" and without repeats, only the types the references actually play: \"keyframe completion\" (an image is a concrete first, last or key frame), \"reference generation\" (an image, video or audio guides a character, scene, style, action, camera, or storyboard without being a concrete frame or an edited source), \"video editing\" (a source video is directly modified), \"video continuation\" (new content continues or extends a source video), \"audio reuse\" (all or part of an audio signal is copied into the soundtrack), \"audio reference\" (only an audio's style, timbre, content, beat or continuity is followed). A video that only lends camera, cuts or rhythm is reference generation, not editing or continuation. A video edit opens with \"The target video is an edited version of <Video N>.\"\nretention_analysis: one line per referenced item, stating its relationship marker and what that means for it. Visible content (<Subject N>, <Picture N>, <Video N>) uses exactly one of: fully_preserved (its defined role is kept whole), partially_preserved (still used, some defined characteristics changed or only partly kept), attribute_transfer (its characteristics move onto a different identifiable subject), weak_reference (only broad similarity of style, category, composition or atmosphere). Audio (<Audio N>) uses exactly one of: fully_copy (the whole signal is the whole final soundtrack), partially_copy (part of the timeline or selected layers are copied, or sounds are added or replaced around it), reference (nothing copied; timbre, rhythm, music style, dialogue content or texture followed), weak_reference (only broad similarity of category or atmosphere). Write the entry as \"<Subject 1> (appears in [Shot 1], [Shot 3]): fully_preserved - ...\", \"<Picture 2> ([Shot 1] first frame): fully_preserved - ...\", \"<Audio 1>: partially_copy - ...\". Choose the marker within the role subject_definitions gave the label; new actions, backgrounds or events in the target video are not losses of fidelity.\ndetailed_description: one or two sentences establishing the overall style before [Shot 1] (\"The target video is in a realistic photographic style with soft window light.\"), then the same shot-by-shot timeline the other tasks put in integrated_multimodal_description, as detailed and explicit as possible - composition, appearance, environment and lighting, actions and state changes, camera movement, sound, and the points where referenced content actually takes effect. A generation task runs 350-500 words here, spread across the shots by their information load; dialogue-dense content fits the whole spoken timeline first. Never reduce it to a plot summary or a list of reference relationships.\noverall_soundscape: as above.\nnon_diegetic_music: as above.\n\nCONTINUITY MODES. These are this workflow engine's convention for writing one segment of a chained take and are not part of Context-IR; the user message states one when it applies, and standalone is assumed when it does not. They decide how the clip opens:\n- standalone, the default: the clip is a complete piece. [Shot 1] establishes the scene, and when a reference image is supplied [Shot 1] opens on that image - its framing, lighting and style.\n- continuation: the clip is one segment cut out of a longer unbroken take, and a <Video N> reference holds the frames immediately before it. Write one continuous shot - no cuts, and no later timestamped shots. [Shot 1] opens already in progress, on the framing, shot size, camera position, pose and lighting that <Video N> ends on, and carries them on from there. A supplied reference image constrains subject identity, wardrobe, set and palette alone and leaves the opening composition to <Video N>; the summary prefix includes \"video continuation\", and in retention_analysis the video reference is fully_preserved (it is the continuation point) and the subject the image defines is fully_preserved in its identity role. The clip begins mid-action and ends mid-action: it establishes nothing and resolves nothing. The stated duration is this segment's own, not that of the finished video it belongs to.\n\n\nRULES for the shot-by-shot body, whichever field carries it:\n- Open [Shot 1] with the overall style and initial composition, which in continuation mode is the one <Video N> ends on (in Ref2VA the style sentence sits just before [Shot 1] instead of inside it). Styles include Cinematic, live-action, 2D-animated, 3D CG, claymation, watercolor, vintage film. Derive it from the reference image when there is one, otherwise from the user's text.\n- Do not timestamp the first shot. Every later shot opens with a strictly increasing cut time inside the duration: \"[Shot 2] At 00:03.500, the camera cuts to ...\". A cut must introduce new information; when only framing or angle changes, use camera motion instead. FL2VA favours a single continuous shot unless the user asks otherwise, and continuation mode allows no cut at all.\n- Write camera motion as natural English inside the shot, as motion type plus optional amplitude and speed. Motion types: Zoom In, Zoom Out, Push In, Pull Out, Pan Left, Pan Right, Truck Left, Truck Right, Tilt Up, Tilt Down, Pedestal Up, Pedestal Down, Arc Shot, Tracking Shot, Static Shot, Shake Slightly, Shake Strongly, POV, Roll Clockwise, Roll Counterclockwise. Amplitude: \"with small amplitude\", \"with large amplitude\". Speed: \"at slow speed\", \"at fast speed\". Omit amplitude and speed when they are medium and normal.\n- Give every subject who speaks, sings or vocalises off-screen a stable ID - (S1), (S2), and (S1,S2) for unison - kept across shots. Characters who never vocalise get no ID. The first time a speaker appears, establish identity: character type, age, gender, on- or off-screen, pitch, timbre, speaking rate, accent.\n- Put spoken and sung content inside <d>[Language] ...</d> and nothing else, with the language named in square brackets: [English], [Chinese]. Every line a character speaks or sings is a <d> block, never quoted prose: write (S1) says in a low, tired voice, <d>[English] We should head back.</d> - not (S1) says \"We should head back.\" Identity, action and delivery stay outside the tag. Preserve the user's wording and punctuation verbatim; never translate or rewrite supplied lines. Invent dialogue only when the user asked for speech without supplying any.\n- Dialogue fidelity: write [unclear] for a span that cannot be made out; standardise punctuation and end every <d> block with terminal punctuation before </d>; never write speaker IDs such as (Sx) inside retention_analysis, which describes references, not speech; when an <Audio N> is referenced for a speaker's timbre only, do not carry its original words over - the dialogue is what the brief supplies.\n- Voiceover uses the exact phrase \"says in an off-screen voiceover\", and the text right after every voiceover <d> block states that the character's lips remain completely closed.\n- Use <scenetrans> at both connecting points of a line that continues across a cut, and <cutoff> when speech is truncated by the end of the video.\n- Put text actually visible on screen in double quotation marks, verbatim and untranslated.\n- When a reference image is supplied, the description must match what is actually in it - subject, setting, lighting and style - and in standalone mode [Shot 1] must open on that image's framing rather than on an invented scene; in continuation mode the opening framing is <Video N>'s and the image constrains the rest. Never describe content the image contradicts.\n- Every detail must be something visible or audible, in plain words. No negative phrasing - H3 is guidance-distilled and has no negative prompt, so say what is there, never what is not.",
         "model_name": "Qwen/Qwen3-4B-Instruct-2507",
         "max_new_tokens": 1600,
         "device": "cpu",
diff --git a/dw_mcp/CLAUDE.md b/dw_mcp/CLAUDE.md
index 39e633130..16c6ab1d4 100644
--- a/dw_mcp/CLAUDE.md
+++ b/dw_mcp/CLAUDE.md
@@ -4,5 +4,5 @@ Guidance for the `dw_mcp/` stdio MCP server package. What it covers and how its
 
 ## Writing text an agent reads
 
-- A tool description (the docstring in `dw_mcp/tools_*.py`) or the instructions in `dw_mcp/server.py` must put what an agent has to act on first, and point at a guide section rather than restate it. `tests/test_mcp_server.py` pins the length (`CLIENT_TEXT_LIMIT`, `SURFACE_BUDGET`) but not the ordering, and the instructions and `list_workflows` sit within a few dozen characters of the limit.
+- A tool description (the docstring in `dw_mcp/tools_*.py`) or the instructions in `dw_mcp/server.py` must put what an agent has to act on first, and point at a guide section rather than restate it. `tests/test_mcp_server.py` pins the length (`CLIENT_TEXT_LIMIT`, `SURFACE_BUDGET`) but not the ordering, and the instructions and `list_workflows` sit within a few dozen characters of the limit. `SURFACE_BUDGET` is a fixed ceiling with headroom, not a ratchet: when it fails, move narrative to a guide and leave a pointer before raising it. `tests/test_guide_pointers.py` checks every pointer resolves and that a tool which points at a guide keeps its pointer.
 - `MAX_WAIT_SECONDS` (`dw_mcp/diagnose.py`) is interpolated into the tool descriptions, so no doc or skill quotes the number.
diff --git a/dw_mcp/catalog.py b/dw_mcp/catalog.py
index d2551fc57..9d320f3e6 100644
--- a/dw_mcp/catalog.py
+++ b/dw_mcp/catalog.py
@@ -270,8 +270,8 @@ def list_gallery(
     enough to pick between two takes without one metadata call per
     candidate. Off by default; a plain call carries no `duration_seconds`.
 
-    Each file carries `role` (`final`, `intermediate`, or null with no run);
-    `role=[...]` keeps only those, null counting as final."""
+    Each file carries `role` (`final`, `intermediate`, or null when nothing
+    says); `role=[...]` keeps only those, null counting as final."""
     params = {"limit": limit}
     if role:
         params["role"] = list(role)
diff --git a/dw_mcp/client.py b/dw_mcp/client.py
index 3463533fa..c83f3c633 100644
--- a/dw_mcp/client.py
+++ b/dw_mcp/client.py
@@ -215,7 +215,11 @@ def _cost_gate_sentence(plan, acknowledge):
             f"(basis {estimate.get('basis')})"
         )
     downloads = [
-        entry.get("repo") or entry.get("url")
+        (
+            f"{entry['repo']}/{entry['filename']}"
+            if entry.get("repo") and entry.get("filename")
+            else entry.get("repo") or entry.get("url")
+        )
         for entry in plan.get("downloads_required") or []
     ]
     if downloads:
diff --git a/dw_mcp/tools_catalog.py b/dw_mcp/tools_catalog.py
index 09a01e7db..affbe5982 100644
--- a/dw_mcp/tools_catalog.py
+++ b/dw_mcp/tools_catalog.py
@@ -272,7 +272,7 @@ def list_gallery(
         carries `folder` (the workflow), `subfolder` (the step's chosen
         subfolder, '' for none; `subfolder=` filters on it) and `role`:
         `final` is a deliverable, `intermediate` a file a later step
-        or run consumed, null with no run. `role=` filters. Each entry's `url` is workspace-scoped; use it as given.
+        or run consumed, null if unknown. `role=` filters. Each entry's `url` is workspace-scoped; use it as given.
 
         Entries carry `run_id` and `version`, the run's stable ordinal
         (the web UI's `v5`) - quote it to a person. `folder=` plus
diff --git a/plugins/dw/.claude-plugin/plugin.json b/plugins/dw/.claude-plugin/plugin.json
index eb1bca4ed..021c98a67 100644
--- a/plugins/dw/.claude-plugin/plugin.json
+++ b/plugins/dw/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
     "name": "dw",
     "description": "Compose MiniMax H3 video, MiniMax Music 3, LTX-2.5 and Kandinsky 6.0 workflows over a dw MCP server, and cut a multi-episode series from them: which template fits which shape, the hard rules, cost, and how to judge the output. Prompt format comes from the vendors' own guides.",
-    "version": "0.15.0",
+    "version": "0.16.0-alpha.1",
     "author": {
         "name": "Don Kackman"
     },
diff --git a/plugins/dw/skills/ltx-2.5/SKILL.md b/plugins/dw/skills/ltx-2.5/SKILL.md
index f39a21de7..036626149 100644
--- a/plugins/dw/skills/ltx-2.5/SKILL.md
+++ b/plugins/dw/skills/ltx-2.5/SKILL.md
@@ -18,7 +18,7 @@ schedule that is not a knob (except refine-in-place's `strength`, 0 preserve
    that shape. Take names, `summary`, `traits` and `cost` from the
    listing over names quoted below.
 3. `get_workflow` on the one chosen, for its variables and defaults.
-4. Before anything near the card's ceiling - a full-size refine, 481 frames, a
+4. Before anything near the card's ceiling - a full-size refine, 401 frames, a
    2x upscale - `get_memory` on an idle server; a leftover `live: true` figure
    is an earlier run's, and `clear_memory` (idle only) drops it and the step
    cache.
@@ -26,8 +26,8 @@ schedule that is not a knob (except refine-in-place's `strength`, 0 preserve
 ## Which shape is the request
 
 - **A clip from text**: `templates/ltx2/text-to-video` (960x544, 121 frames, 5s).
-- **From a picture**: `templates/ltx2/image-to-video` (first frame; 481 frames
-  is 20s in one pass, so extend or chain only past that);
+- **From a picture**: `templates/ltx2/image-to-video` (first frame; 401 frames
+  is ~17s in one pass at 768x768 on a 24 GB card, so extend or chain only past that);
   `templates/ltx2/keyframes` (first and last frames pinned);
   `templates/ltx2/enhance-prompt` (a one-line idea plus a picture; the model's
   enhancer writes the caption).
@@ -53,7 +53,7 @@ schedule that is not a knob (except refine-in-place's `strength`, 0 preserve
   correct you. To upscale or sharpen: `templates/ltx2/upscale-clip`
   (IC-LoRA re-render), `width`/`height` the render size, or `refine-clip`
   (its own latents, no LoRA), `width`/`height` the working size. Both fit
-  the source first and restore after: output exactly 2x the source at its
+  the source first and restore after: output exactly 2x the source (2x the kept region under crop) at its
   length, any aspect ratio letterboxed and cut back (`fit`), a short source
   held and trimmed. Soundtrack kept, silent source refused. Same size and length, no 2x:
   `templates/ltx2/refine-in-place` (`strength` 0-4, default 2). A small,
@@ -72,7 +72,7 @@ schedule that is not a knob (except refine-in-place's `strength`, 0 preserve
   `height` matched, shorter than `num_frames`; clip_frames unused) instead
   of generating; `templates/ltx2/chained-segments` re-runs per segment on
   the previous last frame and stitches. Both are dw's own recipes (Lightricks
-  added a chunked one 2026-09-29); one 481-frame pass reaches 20 seconds first.
+  added a chunked one 2026-09-29); one 401-frame pass reaches 17 seconds first.
 
 If none fits, compose from `list_tasks` before authoring a new workflow;
 read the `workflows` guide's authoring section first. Other
diff --git a/plugins/dw/skills/minimax-h3/SKILL.md b/plugins/dw/skills/minimax-h3/SKILL.md
index d1fa8fab6..8a9db0083 100644
--- a/plugins/dw/skills/minimax-h3/SKILL.md
+++ b/plugins/dw/skills/minimax-h3/SKILL.md
@@ -5,9 +5,8 @@ description: Use when a dw MCP server is connected and the user wants MiniMax H3
 
 # MiniMax H3 on a dw server
 
-H3 generates video and audio together: speech with lip sync, ambient sound,
-score. Every template fits a 24 GB card. This skill picks the template and
-arguments; prompt format is MiniMax's, from its text not here.
+H3 generates video and audio together. Every template fits a 24 GB card.
+This skill picks the template and arguments; prompt format is MiniMax's.
 
 ## Before anything
 
@@ -28,14 +27,16 @@ arguments; prompt format is MiniMax's, from its text not here.
   first and last `templates/minimax/first-and-last-frame`; last only
   `templates/minimax/last-frame-only`; a one-line idea plus a picture
   `templates/minimax/enhance-prompt-with-image`.
-- **A locked frame that lip-syncs to a song** (FL2VA takes no audio): Ref2VA
-  `[keyframe completion + audio reuse]`, `<Picture 1>` the first frame,
-  `<Audio 1>` the song, held with `hold_audio` (#852). It keeps the framing,
-  not the pixels; a last frame costs 45% more and does not land.
+- **A locked frame that lip-syncs to a song**: FL2VA with the song held by
+  `hold_audio` keeps the first frame's pixels and the mouth follows the track
+  (#985; add the argument to `templates/minimax/image-to-video`'s fl2va step).
+  Fallback: Ref2VA `[keyframe completion + audio reuse]`, `<Picture 1>` the
+  first frame, `<Audio 1>` the song, also held (#852). It keeps the framing,
+  not the pixels, at ~4.7x the denoise; a last frame costs 45% more and does not land.
 - **Pinned to a clip** (hold earlier footage): a `guides` argument on
   `t2va`/`fl2va` - up to 4 clips, 3 on a guide chain, each at a
   `frame` that is a multiple of 17; the VRAM ceiling charges each
-  guide's frames on the canvas. A guide holds look as well as motion: a full-length one
+  guide's frames on the canvas, dropping with each guide's length as for references. A guide holds look as well as motion: a full-length one
   copies the take, and a style prompt does not restyle it. `"audio": true`
   on a guide holds its soundtrack too. Rules and example: `get_guide("workflows",
   section="H3: holding a clip with `guides`")`.
@@ -48,18 +49,21 @@ arguments; prompt format is MiniMax's, from its text not here.
   `templates/minimax/voice-timbre-reference` fixes a voice from a Bark line.
 - **Several boards, one generation, unbroken score**:
   `templates/minimax/storyboard`, cuts no concat matches. One beat only;
-  past that use the cuts pattern below.
+  past that, the cuts pattern.
 - **Longer than 14.4 seconds**: chain when one action or line of speech
   crosses the seam, cut when the scene changes.
 - **As one take (a chain)**: `templates/minimax/chained-segments`
   (default `continuity: "last_frame"`; `continuity: "guide"`, `guide_frames`
   22 or 39 - default 22 - holds the last frames and voice as a guide instead.
-  `carry_audio` (default true, a chain-block setting, not a variable)
-  brings the voice. Not on the ref2va chains, as guides stay off ref2va),
+  The guide prefix is trimmed off the deliverable (`trim_frames` and the
+  crossfade do not apply). `carry_audio` (default true, a chain-block setting)
+  holds the previous tail's audio. Guide only here: the reference chains
+  (`chain-video-continuity`, `chain-matched-and-aligned`, `music-video`) are
+  ref2va, and guides stay off ref2va),
   `templates/minimax/chain-video-continuity`
   (previous segment's tail rides as a video reference - motion, camera,
   voice carry the seam), `templates/minimax/chain-matched-to-audio` (a track
-  sets the length, muxed back seamless), `templates/minimax/chain-matched-and-aligned`
+  sets the length), `templates/minimax/chain-matched-and-aligned`
   (per-segment prompts). Drift compounds per seam: reference the subject
   picture each segment, prefer `last_segment` continuity, use the longest
   segments memory allows.
@@ -88,37 +92,29 @@ section).
 - `num_frames` is `17n + 5`, from 124 to 345, at a fixed 24 fps: 5.17 to 14.4
   seconds in one clip. Most default to 124 (storyboard 192);
   `num_frames=345` is the full length, and fits 24 GB at 544p only (#271).
-  The 5-second floor is diffusers'; the model card says 4.
 - Canvas: 768-pixel short edge, at most 768x1344, in multiples of 32, aspect
   1:4 to 4:1. Output audio is 32 kHz stereo.
 - A checkpoint comes with a canvas, a sigma shift and an alpha and they move
   together - change one, change all. Before swapping one or adding a LoRA,
   read `references/checkpoints-and-loras.md`: the tested combinations,
-  the LoRAs that need their own loaders, and the catalog.
+  the LoRAs needing their own loaders, the catalog.
   Never put an FL2VA LoRA on a reference template: `ref2va` holds
   `transformer_ref` alone, so anything handed there degrades output.
-  `validate_workflow` refuses it and warns on a `weight_name` naming neither.
+  `validate_workflow` refuses it, warns on a `weight_name` naming neither.
 - Smeary faces (int8 base) or draft -> final tiers: `references/quality-and-speed.md`.
 - Backend: default `sparse` (dense off CUDA); same one at draft and final.
-- Fit a crowd's action to what it holds: candle-holders asked to clap
-  rendered three-handed people.
-- A directed crowd move needs its landmark in frame: "marches up to the
-  house" put it behind camera. Track from the side, landmark ahead.
-- Two people in frame can lip-sync the wrong one, seemingly by whichever
-  voice enters first: credit a shout to the crowd, spell the sung line in
-  `<d>` tags, frame the singer face-on at medium close-up.
-- State a crowd's age range; unstated skews young.
-- A three-reference shot can open on the portraits' backdrop
-  for ~1.5s (about 1 in 25): check a shot's first frames and say in
-  `subject_definitions` that the portrait's backdrop, pose and framing are
-  not reused.
-- Ref2VA reaches 1344x768 too (trade-off: the `recipes` guide's MiniMax-H3
-  section). There the 24 GB ceiling on the `17n+5` grid drops with each
+- A crowd, two people in frame, or a three-reference shot: read
+  `references/staging.md` before the prompt - who lip-syncs, where the
+  landmark is, and the portrait backdrop that can open a shot.
+- Ref2VA reaches 1344x768 too (`recipes` guide, MiniMax-H3). There the 24 GB ceiling on the `17n+5` grid drops with each
   reference: 243 frames at one, 209 at two, 175 at three, 141 at four. `validate_workflow` refuses
   the largest `for_each` shot over budget.
 - Steps are the LoRA's passes plus one (5 for the 4-step default, 9 for
   8-step): the scheduler counts the terminal zero, so `denoise_total_steps`
   reports 4. A null `lora_model_name` drops the LoRA; raise steps and shifts too.
+- Dialogue shots (any `<d>` line) drop the turbo LoRA, which digitizes voices
+  (~4 dB more high band): `lora_model_name: null`, `num_inference_steps: 12`,
+  `video_shift: 12.0`, `audio_shift: 3.0`; int4 stays fine without it. Turbo stays the default otherwise (#984 B0).
 - Nothing carries between generations except a passed reference, a
   held track or a `guides` clip: there is no latent memory. Identity rides
   on a picture, voice timbre on an audio clip, motion/camera on a video
diff --git a/plugins/dw/skills/minimax-h3/references/dialogue.md b/plugins/dw/skills/minimax-h3/references/dialogue.md
index fc9ffbc3f..62c472dc3 100644
--- a/plugins/dw/skills/minimax-h3/references/dialogue.md
+++ b/plugins/dw/skills/minimax-h3/references/dialogue.md
@@ -65,7 +65,11 @@ rule and none is worth prompt words yet:
   - `<pause>`, `<softer>`, `<breath>` and a bare `…` inside `<d>` were
     neither spoken nor turned into invented words (rows 6, 6b);
   - a negated noun ("There is no dog in the room") didn't render the
-    thing (row 10b).
+    thing (row 10b);
+  - leaving the words out of `<d>` when a track is held for lip sync
+    (WanGP's claim) is not needed: one person in frame, Ref2VA with the
+    track held, sung and spoken, moved the mouth at the same instants with
+    the words in `<d>` or not (`2026-10-h3-wangp-probes.md`, #985).
 - Not settled:
   - whether `<breath>` adds a beat: it may lengthen a pause H3 already takes
     at a sentence break, but it doesn't create one (row 6b);
diff --git a/plugins/dw/skills/minimax-h3/references/staging.md b/plugins/dw/skills/minimax-h3/references/staging.md
new file mode 100644
index 000000000..93a79d9cc
--- /dev/null
+++ b/plugins/dw/skills/minimax-h3/references/staging.md
@@ -0,0 +1,17 @@
+# MiniMax H3: staging crowds, two people, and reference shots
+
+Part of the `minimax-h3` skill; its *Hard rules* say when to read this. Each
+rule came from a render that went wrong on our server (#484).
+
+- Fit a crowd's action to what it holds: candle-holders asked to clap
+  rendered three-handed people.
+- A directed crowd move needs its landmark in frame: "marches up to the
+  house" put it behind camera. Track from the side, landmark ahead.
+- Two people in frame can lip-sync the wrong one, seemingly by whichever
+  voice enters first: credit a shout to the crowd, spell the sung line in
+  `<d>` tags, frame the singer face-on at medium close-up.
+- State a crowd's age range; unstated skews young.
+- A three-reference shot can open on the portraits' backdrop
+  for ~1.5s (about 1 in 25): check a shot's first frames and say in
+  `subject_definitions` that the portrait's backdrop, pose and framing are
+  not reused.
diff --git a/plugins/dw/skills/minimax-music3/SKILL.md b/plugins/dw/skills/minimax-music3/SKILL.md
index c7fa081f4..09f566af3 100644
--- a/plugins/dw/skills/minimax-music3/SKILL.md
+++ b/plugins/dw/skills/minimax-music3/SKILL.md
@@ -18,21 +18,10 @@ shapes; do not author a new workflow until the shape decision below fails.
 2. `list_workflows(shape="audio")`, and `shape="sequence"` for the music video.
    Trust the names below only after the listing confirms them.
 3. `get_workflow` on the one chosen, for its variables and defaults.
-4. Before a long track or the music video - anything near the
-   card's ceiling - `get_memory` with the server idle and read a `live: true`
-   reading's `gpu_memory_allocated_mb`. Only a live reading is the worker's own
-   and only live readings compare: `info: null` means nothing
-   is resident, go ahead, while a `live: false` reading with a populated `info`
-   is cached from another moment - it reads low while a job is loading a model,
-   so ask again once idle rather than trusting it. A non-trivial
-   idle figure is what an earlier run left behind, coming off the ~22 GB
-   these templates need. With the server idle, `clear_memory` clears it
-   (refused while a job is queued or running) - it also drops the step cache,
-   so the next run, including a seeded rerun, is cold and regenerates. Re-read
-   `get_memory` afterwards to confirm. Don't retry into a failed attempt
-   without clearing first - a failed attempt is what leaves weight
-   resident, so an immediate retry starts from less than the attempt that
-   failed had.
+4. Before a long track or the music video - anything near the card's
+   ceiling, the ~22 GB these templates need - read `references/memory.md`:
+   which `get_memory` reading to trust, when `clear_memory` first, and why
+   never to retry into a failed attempt without it.
 
 ## Which shape is the request
 
diff --git a/plugins/dw/skills/minimax-music3/references/memory.md b/plugins/dw/skills/minimax-music3/references/memory.md
new file mode 100644
index 000000000..5bd1d2eeb
--- /dev/null
+++ b/plugins/dw/skills/minimax-music3/references/memory.md
@@ -0,0 +1,23 @@
+# MiniMax Music 3: checking memory before a long run
+
+Part of the `minimax-music3` skill; step 4 of *Before anything* says when to
+read this - before a long track or the music video, anything near the card's
+ceiling.
+
+`get_memory` with the server idle, and read a `live: true` reading's
+`gpu_memory_allocated_mb`. Only a live reading is the worker's own and only
+live readings compare:
+
+- `info: null` means nothing is resident: go ahead.
+- A `live: false` reading with a populated `info` is cached from another
+  moment. It reads low while a job is loading a model, so ask again once idle
+  rather than trusting it.
+- A non-trivial idle figure is what an earlier run left behind, coming off
+  the ~22 GB these templates need. With the server idle, `clear_memory`
+  clears it (refused while a job is queued or running). It also drops the
+  step cache, so the next run, including a seeded rerun, is cold and
+  regenerates. Re-read `get_memory` afterwards to confirm.
+
+Don't retry into a failed attempt without clearing first: a failed attempt is
+what leaves weight resident, so an immediate retry starts from less than the
+attempt that failed had.
diff --git a/plugins/dw/skills/script-to-video/SKILL.md b/plugins/dw/skills/script-to-video/SKILL.md
index f5229911e..dbb35384f 100644
--- a/plugins/dw/skills/script-to-video/SKILL.md
+++ b/plugins/dw/skills/script-to-video/SKILL.md
@@ -104,6 +104,20 @@ time without an audio reference, and only a narrower spread with one
 (`voice` / `voice-timbre-reference`). So when the voice is right and the
 picture is wrong, change the prompt and keep the seed; reach for
 `new_seed` only when the voice is pinned by a reference or does not matter.
+After a chained take (`templates/ltx2/chained-segments` or
+`templates/minimax/chained-segments`), call
+`assess_output(name, probe="analyze_seams")`: seam *n* is the join into
+segment *n+1* (the chain names its shots `segment N`). A `seam_frame_jump`
+is severity `info` and also fires on deliberate cuts (#466), so look at
+`get_output_frames(name, seams=[n])` before spending anything. A chain
+re-rolls whole: `rerun_job(new_seed=True)` redraws every segment, so quote
+the full chain's cost and get the go-ahead. If re-rolls keep failing at one
+seam, shorten the chain, simplify that segment's prompt, or make the seam a
+cut between two shots (`templates/ltx2/image-to-video` from a kept still,
+joined by `templates/assemble-and-score`). Never splice a re-rolled segment
+in with `concat_videos`: that join is recorded `hard_cut`, so
+`seam_frame_jump` stops checking it. A seam re-roll counts against the
+shot's budget below.
 Give each shot a budget of three failed attempts, then stop and ask the user
 rather than spending more. Each shot's files are organized by `subfolder` - typically `final`
 for the deliverable video or `intermediate` for test frames; read the
diff --git a/plugins/dw/skills/series-episodes/SKILL.md b/plugins/dw/skills/series-episodes/SKILL.md
index ac97f197b..729891202 100644
--- a/plugins/dw/skills/series-episodes/SKILL.md
+++ b/plugins/dw/skills/series-episodes/SKILL.md
@@ -117,26 +117,11 @@ composes into, not something to re-derive:
   applied before the score is passed in.
 - **normalize**: the mixed world sound and score are normalized together
   (`assemble-and-score`'s `balanced` step, -3 dBFS peak ceiling, always
-  enforced) so one episode is not louder than the next. A shared peak
-  ceiling does not mean a shared loudness - a sparse, dialogue-only episode
-  and a dense, score-heavy one can both sit at -3 dBFS peak and still read
-  as very different volumes. `assemble-and-score`'s `target_lufs` variable
-  (passed through to `normalize_audio`) gains the mix toward a measured
-  loudness before the ceiling is applied - but gain down succeeds only
-  while the mix's own peak is below the ceiling; a single loud peak (a
-  laugh track, a sting) caps gain up the same way, and can pull a gain-down
-  episode lower still. Match episodes **downward** anyway: pick one series `target_lufs`
-  that every episode can reach - in practice, about the quietest episode
-  the ceiling holds back - and pass that same value on every episode's
-  `assemble-and-score` run. A `target_lufs_capped` warning on an
-  episode means that episode's own peak sets the series' ceiling; lower the
-  series `target_lufs` rather than accepting the mismatch. Only when the
-  series should sit louder than its most dynamic episode allows (e.g. -16
-  for streaming) pass `limit: true` beside the same `target_lufs` on every
-  episode: -3 dBFS becomes a true-peak ceiling a look-ahead limiter holds,
-  so the laugh is limited rather than setting the gain. A `limiter_heavy`
-  warning on an episode means the series target is squashing it audibly -
-  lower the series `target_lufs` rather than living with it.
+  enforced), but a shared peak is not a shared loudness. Pass one series
+  `target_lufs` on every episode, matched **downward** to what the quietest
+  episode can reach; before episode 1, read `references/loudness.md` for how
+  to pick it and what `target_lufs_capped`, `limit: true` and
+  `limiter_heavy` mean.
 - **pair**: the normalized track is muxed onto the cut - the episode's
   deliverable.
 
@@ -171,16 +156,9 @@ does, `keep_output` it and reference the resulting `asset:` instead.
 Beyond `minimax-h3`'s own judging checklist (a character that changes
 between shots, a portrait imposing its framing, a voice without affect):
 watch two episodes back to back and check the cast reads as the same
-people - the failure mode step 0 exists to prevent. `get_gallery_metadata`
-on each episode's final file for duration and loudness, so a level
-mismatch between episodes shows up before a viewer notices it - its
-`peak_dbfs` is a single sample and does not say how loud the episode reads
-as a whole; `integrated_lufs` (BS.1770, whole-track) is the field that
-answers that, and is what to compare across episodes. A peak-normalized
-episode with one loud outlier (a studio-audience laugh, a sting) can sit
-1-2 LU quieter than its neighbors even at the same -3 dBFS peak ceiling -
-that gap is `target_lufs`'s to close, matched downward (the **normalize**
-bullet; `limit: true` for a series that must sit louder). To confirm every
+people - the failure mode step 0 exists to prevent. Compare episodes'
+`integrated_lufs` (`get_gallery_metadata`), not `peak_dbfs`; the second
+half of `references/loudness.md` reads the gap. To confirm every
 line rendered rather than judging it by ear, run `templates/check-script`
 against the episode's script: `validate_workflow(name="templates/check-script",
 arguments={"input_audio": "output:<name>", "lines": [...]})` first (free; it
diff --git a/plugins/dw/skills/series-episodes/references/loudness.md b/plugins/dw/skills/series-episodes/references/loudness.md
new file mode 100644
index 000000000..11f9f7900
--- /dev/null
+++ b/plugins/dw/skills/series-episodes/references/loudness.md
@@ -0,0 +1,47 @@
+# Series episodes: one loudness across episodes
+
+Part of the `series-episodes` skill; its **normalize** beat and *Run and
+judge* say when to read this - picking the series `target_lufs` before
+episode 1, and comparing finished episodes.
+
+## Picking the series target
+
+`assemble-and-score`'s `balanced` step normalizes the mixed world sound and
+score together to a -3 dBFS peak ceiling, always enforced. A shared peak
+ceiling does not mean a shared loudness: a sparse, dialogue-only episode and
+a dense, score-heavy one can both sit at -3 dBFS peak and still read as very
+different volumes.
+
+`assemble-and-score`'s `target_lufs` variable (passed through to
+`normalize_audio`) gains the mix toward a measured loudness before the
+ceiling is applied. Gain down succeeds only while the mix's own peak is below
+the ceiling; a single loud peak (a laugh track, a sting) caps gain up the
+same way, and can pull a gain-down episode lower still.
+
+Match episodes **downward** anyway: pick one series `target_lufs` that every
+episode can reach - in practice, about the quietest episode the ceiling holds
+back - and pass that same value on every episode's `assemble-and-score` run.
+
+- A `target_lufs_capped` warning on an episode means that episode's own peak
+  sets the series' ceiling; lower the series `target_lufs` rather than
+  accepting the mismatch.
+- Only when the series should sit louder than its most dynamic episode allows
+  (e.g. -16 for streaming), pass `limit: true` beside the same `target_lufs`
+  on every episode: -3 dBFS becomes a true-peak ceiling a look-ahead limiter
+  holds, so the laugh is limited rather than setting the gain.
+- A `limiter_heavy` warning on an episode means the series target is
+  squashing it audibly - lower the series `target_lufs` rather than living
+  with it.
+
+## Comparing finished episodes
+
+`get_gallery_metadata` on each episode's final file, for duration and
+loudness, so a level mismatch between episodes shows up before a viewer
+notices it. Its `peak_dbfs` is a single sample and does not say how loud the
+episode reads as a whole; `integrated_lufs` (BS.1770, whole-track) is the
+field that answers that, and is what to compare across episodes.
+
+A peak-normalized episode with one loud outlier (a studio-audience laugh, a
+sting) can sit 1-2 LU quieter than its neighbors even at the same -3 dBFS
+peak ceiling. That gap is `target_lufs`'s to close, matched downward as
+above; `limit: true` for a series that must sit louder.
diff --git a/pyproject.toml b/pyproject.toml
index 8c87583fa..6ec884e18 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,7 @@ name = "diffusers-workflow"
 # runtime (static in TOML because importing dw at build time would drag
 # torch into the build environment). Release tags must match it - see
 # docs/RELEASING.md
-version = "0.15.0"
+version = "0.16.0-alpha.1"
 description = "Declarative workflow engine and web UI for Hugging Face Diffusers"
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/scripts/dw-serve.service b/scripts/dw-serve.service
index 0f7b2a304..90f623648 100644
--- a/scripts/dw-serve.service
+++ b/scripts/dw-serve.service
@@ -28,6 +28,9 @@ TimeoutStopSec=30
 OOMPolicy=continue
 Restart=on-failure
 RestartSec=5
+# Exit 2 is a refused configuration (a card that is not there, --mcp without
+# a token): restarting cannot fix it, so stop instead of looping every 5 s
+RestartPreventExitStatus=2
 
 [Install]
 WantedBy=default.target
diff --git a/tests/test_admission.py b/tests/test_admission.py
index becc73878..b1ca246cc 100644
--- a/tests/test_admission.py
+++ b/tests/test_admission.py
@@ -21,7 +21,7 @@
 from dw.server.app import create_app
 from dw.server.jobs import JobManager
 from dw.server.job_record import TERMINAL_STATES
-from dw.workflow import Workflow
+from dw.workflow import Workflow, workflow_from_definition
 from dw.workspace import Workspace
 
 from .test_prepare_pipeline import DEFINITION as prepare_definition
@@ -186,6 +186,126 @@ def test_a_bound_submit_expands_once(server, folds):
         assert len(folds) == 1
 
 
+@pytest.fixture
+def empty_hub_cache(monkeypatch):
+    """No repo cached, whatever this machine's own Hugging Face cache holds,
+    so every task step's repo is a download to acknowledge."""
+    import dw.plan_downloads
+
+    monkeypatch.setattr(
+        dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+    )
+
+
+def segment_workflow():
+    """A task-only workflow whose one model is a task step's: the plan lists
+    the segment step's two repos, and no pipeline step loads either."""
+    return {
+        "id": "segmented",
+        "variables": {"image": "asset:present.png"},
+        "steps": [
+            {
+                "name": "mask",
+                "task": {
+                    "command": "segment",
+                    "arguments": {"image": "variable:image", "prompt": "a cup"},
+                },
+                "result": {"content_type": "image/png"},
+            }
+        ],
+    }
+
+
+def test_a_bound_acknowledgement_missing_a_task_steps_repo_is_refused(
+    server, empty_hub_cache
+):
+    """#975: a task step's weights are in downloads_required, so an
+    acknowledgement that names none of them is a download the caller never
+    saw - answered 409 "downloads" like a pipeline's."""
+    body = {"workflow": segment_workflow()}
+    with server() as client:
+        plan = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert plan is not None
+        repos = [entry["repo"] for entry in plan["downloads_required"]]
+        assert "IDEA-Research/grounding-dino-base" in repos
+
+        response = client.post(
+            "/api/jobs",
+            json={
+                **body,
+                "acknowledged_cost": {
+                    "fingerprint": plan["fingerprint"],
+                    "minutes": plan["estimate"]["minutes"],
+                    "downloads": [],
+                },
+            },
+        )
+
+        assert response.status_code == 409, response.text
+        detail = response.json()["detail"]
+        assert detail["reason"] == "downloads"
+        assert set(repos) <= set(detail["acknowledge"]["downloads"])
+
+
+def test_a_bound_acknowledgement_naming_a_task_steps_repos_is_admitted(
+    server, empty_hub_cache
+):
+    body = {"workflow": segment_workflow()}
+    with server() as client:
+        plan = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert plan is not None
+        repos = [entry["repo"] for entry in plan["downloads_required"]]
+        assert repos
+
+        response = client.post(
+            "/api/jobs",
+            json={
+                **body,
+                "acknowledged_cost": {
+                    "fingerprint": plan["fingerprint"],
+                    "minutes": plan["estimate"]["minutes"],
+                    "downloads": repos,
+                },
+            },
+        )
+
+        assert response.status_code == 201, response.text
+        assert response.json()["acknowledged"] == "bound"
+
+
+def test_the_plan_passed_verbatim_is_a_bound_acknowledgement(server, empty_hub_cache):
+    """#975: a client that hands back the validate plan unedited has
+    acknowledged its downloads_required - the refusal's own example (C-F525
+    step 5)."""
+    body = {"workflow": segment_workflow()}
+    with server() as client:
+        plan = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert plan is not None
+        assert plan["downloads_required"]
+
+        response = client.post("/api/jobs", json={**body, "acknowledged_cost": plan})
+
+        assert response.status_code == 201, response.text
+        assert response.json()["acknowledged"] == "bound"
+
+
+def test_a_plan_with_its_downloads_emptied_is_still_refused(server, empty_hub_cache):
+    """An explicit `downloads` is what was acknowledged, even beside the
+    plan's own downloads_required."""
+    body = {"workflow": segment_workflow()}
+    with server() as client:
+        plan = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert plan is not None
+
+        response = client.post(
+            "/api/jobs",
+            json={**body, "acknowledged_cost": {**plan, "downloads": []}},
+        )
+
+        assert response.status_code == 409, response.text
+        assert response.json()["detail"]["reason"] == "downloads"
+
+
 def test_a_rerun_expands_once(server, folds):
     with server() as client:
         submitted = client.post(
@@ -450,6 +570,101 @@ def admitted(arguments):
     assert not admitted({}).ok
 
 
+def test_an_unknown_argument_does_not_make_a_given_one_read_as_null(root):
+    """A bad argument leaves the others unfolded, so the document check read
+    `audio` as null though the caller passed it (#972). The refusal names the
+    unknown argument instead."""
+    definition = {
+        "id": "se-972",
+        "variables": {"audio": None},
+        "steps": [
+            {
+                "name": "n",
+                "task": {
+                    "command": "normalize_audio",
+                    "arguments": {"audio": "variable:audio"},
+                },
+                "result": {"content_type": "audio/wav"},
+            }
+        ],
+    }
+    admission = admit(
+        workflow_path=None,
+        workflow=definition,
+        arguments={"audio": "asset:x.wav", "bogus": 1},
+        base_dir=None,
+        workspace=root,
+        ceiling_index={},
+        output_dir=root.outputs,
+        workflow_dir=root.workflows,
+        asset_library=library_path("assets", root),
+        prompt_library=library_path("prompts", root),
+    )
+    assert not admission.ok
+    messages = " ".join(e["message"] for e in admission.errors)
+    assert "bogus" in messages
+    assert "which is null" not in messages
+
+
+def test_a_null_variable_and_an_unknown_argument_are_both_reported(root):
+    """Every error comes back at once (#976): the null `audio` no longer
+    hides the unknown `bogus`."""
+    definition = {
+        "id": "se-976",
+        "variables": {"audio": None},
+        "steps": [
+            {
+                "name": "n",
+                "task": {
+                    "command": "normalize_audio",
+                    "arguments": {"audio": "variable:audio"},
+                },
+                "result": {"content_type": "audio/wav"},
+            }
+        ],
+    }
+    admission = admit(
+        workflow_path=None,
+        workflow=definition,
+        arguments={"bogus": 1},
+        base_dir=None,
+        workspace=root,
+        ceiling_index={},
+        output_dir=root.outputs,
+        workflow_dir=root.workflows,
+        asset_library=library_path("assets", root),
+        prompt_library=library_path("prompts", root),
+    )
+    assert not admission.ok
+    messages = [e["message"] for e in admission.errors]
+    assert any("which is null" in m for m in messages)
+    assert any("bogus" in m and "Unknown variable" in m for m in messages)
+
+
+def test_validation_errors_do_not_read_a_supplied_variable_as_null_beside_a_bad_argument():
+    """The owner of the rule is validation_errors itself (#972): any caller,
+    not only admit(), gets no null finding for a name it supplied."""
+    definition = {
+        "id": "ve-972",
+        "variables": {"audio": None},
+        "steps": [
+            {
+                "name": "n",
+                "task": {
+                    "command": "normalize_audio",
+                    "arguments": {"audio": "variable:audio"},
+                },
+                "result": {"content_type": "audio/wav"},
+            }
+        ],
+    }
+    workflow = workflow_from_definition(definition, "/tmp", None, None)
+    bad = workflow.validation_errors(arguments={"audio": "a.wav", "bogus": 1})
+    assert not any("variable" in e for e in bad)
+    left_null = workflow.validation_errors(arguments={"bogus": 1})
+    assert any(e.get("variable") == "audio" for e in left_null)
+
+
 def _a_crashing_select_check(monkeypatch):
     def boom(_context):
         raise RuntimeError("check exploded")
diff --git a/tests/test_api_contract.py b/tests/test_api_contract.py
index 173dd44a7..7f7aca78d 100644
--- a/tests/test_api_contract.py
+++ b/tests/test_api_contract.py
@@ -397,10 +397,14 @@ def test_validation_answers_keep_their_keys(server):
 def test_validate_answers_for_an_uncached_gated_model(server, monkeypatch):
     # model_info's own `gated` is False, "auto" or "manual" - a gated repo
     # the cache does not hold must still get a plan, not a 500
-    import dw.plan
+    import dw.plan_downloads
 
-    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
-    monkeypatch.setattr(dw.plan, "_model_info", lambda name: (31.4, "manual", False))
+    monkeypatch.setattr(
+        dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+    )
+    monkeypatch.setattr(
+        dw.plan_downloads, "_model_info", lambda name: (31.4, "manual", False)
+    )
     with server(success_script) as client:
         response = client.post("/api/validate", json={"workflow": valid_workflow()})
     assert response.status_code == 200, response.text
diff --git a/tests/test_audio_utils.py b/tests/test_audio_utils.py
index 3d501290f..a9c92e749 100644
--- a/tests/test_audio_utils.py
+++ b/tests/test_audio_utils.py
@@ -1843,3 +1843,71 @@ def test_a_waveform_needs_a_sample_rate(self):
 
         with pytest.raises(ValueError, match="sample_rate"):
             analyze_audio(numpy.ones((1, 10)))
+
+
+class TestNormalizeLimitedShotWarning:
+    """#1039: limiting that lands on one shot of a cut is warned, by name."""
+
+    RATE = 16000
+    FPS = 24
+
+    def _cut(self):
+        import types
+
+        t = numpy.arange(self.RATE * 4) / self.RATE
+        wave = 0.01 * numpy.sin(2 * numpy.pi * 220 * t)
+        # Two shots of 2 s; the first holds sparse hot transients
+        for start in range(0, self.RATE * 2, self.RATE // 4):
+            wave[start : start + self.RATE // 20] *= 60
+        shots = [
+            {"name": "kazoo", "start_frame": 0, "num_frames": 48},
+            {"name": "thimble", "start_frame": 48, "num_frames": 48},
+        ]
+        return types.SimpleNamespace(
+            audio=wave[numpy.newaxis, :].astype(numpy.float32),
+            sample_rate=self.RATE,
+            fps=self.FPS,
+            shots=shots,
+        )
+
+    def _events(self, audio):
+        from dw.events import RunContext, activate_context, deactivate_context
+        from dw.tasks.audio_dynamics import normalize_audio
+
+        events = []
+        token = activate_context(RunContext(on_event=events.append))
+        try:
+            normalize_audio(audio, peak_dbfs=-3.0, target_lufs=-10.0, limit=True)
+        finally:
+            deactivate_context(token)
+        return [e for e in events if e.get("kind") == "limiter_uneven_across_shots"]
+
+    def test_names_the_shot_the_limiter_works_on(self):
+        found = self._events(self._cut())
+        assert found and found[0]["shot"] == "kazoo"
+        assert found[0]["shot_reduction_db"] > found[0]["median_reduction_db"]
+
+    def test_silent_without_shots(self):
+        audio = self._cut()
+        audio.shots = None
+        assert self._events(audio) == []
+
+    def test_saved_cut_given_as_a_path_carries_its_manifest_shots(self, monkeypatch):
+        # #1041: an `output:`/`asset:` cut reaches the task as a path string
+        cut = self._cut()
+        monkeypatch.setattr(
+            "dw.tasks.audio_dynamics.waveform_and_rate",
+            lambda audio, rate, command: (cut.audio, cut.sample_rate),
+        )
+        monkeypatch.setattr(
+            "dw.tasks.video_utils.local_video_path", lambda path, base_dir=None: path
+        )
+        monkeypatch.setattr("dw.runs.shots_beside", lambda path: cut.shots)
+        monkeypatch.setattr("dw.media.container_fps", lambda path: cut.fps)
+        found = self._events("runs/qa-cut-edit.4-0.0.mp4")
+        assert found and found[0]["shot"] == "kazoo"
+
+    def test_audio_file_path_has_no_shots(self, monkeypatch):
+        from dw.tasks.audio_dynamics import _shots_of_file
+
+        assert _shots_of_file("bed.wav") == (None, None)
diff --git a/tests/test_cache_blocks.py b/tests/test_cache_blocks.py
index 4485a8898..383847eb3 100644
--- a/tests/test_cache_blocks.py
+++ b/tests/test_cache_blocks.py
@@ -487,11 +487,11 @@ def _run_calibration_steps(model, context, steps):
 
 def test_mag_calibration_ratios_reach_job_events_for_both_cfg_contexts(monkeypatch):
     """#891: diffusers logs the ratios and clears them; both CFG lists must be emitted."""
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     logs, warnings = [], []
-    monkeypatch.setattr(components, "emit_log", logs.append)
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_log", logs.append)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
 
     model = _mag_model(4)
     with components.captured_mag_calibration(_FakePipeline(model)):
@@ -509,10 +509,10 @@ def test_mag_calibration_ratios_reach_job_events_for_both_cfg_contexts(monkeypat
 def test_mag_calibration_silent_without_calibrate(monkeypatch):
     from diffusers import MagCacheConfig
 
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     warnings = []
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
     model = _mag_model(3)
     model.disable_cache()
     model.enable_cache(
@@ -526,11 +526,11 @@ def test_mag_calibration_silent_without_calibrate(monkeypatch):
 
 def test_mag_calibration_counts_the_steps_the_call_runs(monkeypatch):
     """#891: a config left at 28 steps never finishes a 4-step run; the call's count is used."""
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     warnings = []
-    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
 
     model = _mag_model(28)
     with components.captured_mag_calibration(
@@ -586,11 +586,11 @@ def test_mag_calibration_reports_a_call_that_ends_one_forward_short(monkeypatch)
     """#927: H3's scheduler runs num_inference_steps - 1 forwards, so diffusers
     never reaches its end-of-run log; the ratios left in the state are reported
     before the call's reset drops them."""
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     warnings = []
-    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
 
     _calibrate_call(components, _mag_model(4), steps_run=3)
 
@@ -603,11 +603,11 @@ def test_mag_calibration_reports_a_call_that_ends_one_forward_short(monkeypatch)
 def test_mag_calibration_a_finished_call_is_reported_once(monkeypatch):
     """#927: diffusers clears the list when it logs, so the end-of-call read
     finds nothing left and does not repeat the lists."""
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     warnings = []
-    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
 
     _calibrate_call(components, _mag_model(4), steps_run=4)
 
@@ -617,11 +617,11 @@ def test_mag_calibration_a_finished_call_is_reported_once(monkeypatch):
 
 
 def test_mag_calibration_an_errored_call_reports_no_partial_lists(monkeypatch):
-    from dw.pipeline_processors import components
+    from dw.pipeline_processors import components, mag_calibration
 
     warnings = []
-    monkeypatch.setattr(components, "emit_log", lambda *a, **k: None)
-    monkeypatch.setattr(components, "emit_warning", warnings.append)
+    monkeypatch.setattr(mag_calibration, "emit_log", lambda *a, **k: None)
+    monkeypatch.setattr(mag_calibration, "emit_warning", warnings.append)
 
     model = _mag_model(4)
     with pytest.raises(RuntimeError):
diff --git a/tests/test_catalog_structure.py b/tests/test_catalog_structure.py
index ecc670f16..c38c3bebb 100644
--- a/tests/test_catalog_structure.py
+++ b/tests/test_catalog_structure.py
@@ -96,6 +96,13 @@ def load(path):
         "image-edit",
         ["needs-input-media"],
     ),
+    # Task-only, so the rules read them as utilities; they declare image-edit
+    # because an erase is an edit of the image it was handed (#974)
+    "workflows/templates/remove-object.json": ("image-edit", ["needs-input-media"]),
+    "workflows/templates/segment-and-remove.json": (
+        "image-edit",
+        ["needs-input-media"],
+    ),
     "workflows/templates/describe-and-regenerate.json": (
         "image-set",
         ["composes-workflows", "needs-input-media"],
@@ -487,7 +494,10 @@ def test_no_stale_entry_in_the_allowlist():
 # Then to 11_400 for the five FLUX 3 Klein templates (#930, 2026-10-15),
 # measured at 11_256: a new family, its summaries already trimmed to the idea
 # each template adds, with about 85 tokens held for its Task 9 cost blocks.
-COMPACT_BUDGET = 11_400
+# Then to 11_650 for the `remove-object` and `segment-and-remove` templates
+# (#956, stage #974, 2026-10-22), measured at 11_592: two new entries, the
+# catalog's only prompt-free removal route, each with a cost block.
+COMPACT_BUDGET = 11_650
 FILTERED_BUDGET = 1_500
 
 
diff --git a/tests/test_chain_h3_native.py b/tests/test_chain_h3_native.py
new file mode 100644
index 000000000..33b5096ce
--- /dev/null
+++ b/tests/test_chain_h3_native.py
@@ -0,0 +1,210 @@
+"""
+A one-segment H3 chain is bit-identical to a native run (#1046).
+
+tests/test_chain.py drives run_chain through a fake pipeline, so nothing there
+checks that the chain path, given one segment, produces what the plain H3
+pipeline produces. Here the real MiniMax-H3 modular pipeline runs on CPU from
+tiny random-weight components built from diffusers' own classes (no download),
+once natively and once through run_chain, on the same prompt and seed.
+"""
+
+import numpy
+import pytest
+import torch
+
+from dw.pipeline_processors.chain import run_chain
+from dw.pipeline_processors.pipeline import Pipeline
+
+pytest.importorskip("diffusers.modular_pipelines.minimax_h3")
+
+# H3's shortest video: the VAE's 17 * n + 5 frame grid, at least five seconds
+NUM_FRAMES = 124
+SEED = 1234
+PROMPT = "a cat sat"
+
+
+def _tokenizer():
+    from tokenizers import Tokenizer, models, pre_tokenizers
+    from transformers import Qwen2TokenizerFast
+
+    specials = ["<|image_pad|>", "<|video_pad|>", "<|vision_start|>", "<|vision_end|>"]
+    vocab = {"<unk>": 0}
+    vocab.update({token: index + 1 for index, token in enumerate(specials)})
+    for character in "abcdefghijklmnopqrstuvwxyz .,":
+        vocab[character] = len(vocab)
+    backend = Tokenizer(models.WordLevel(vocab, unk_token="<unk>"))
+    backend.pre_tokenizer = pre_tokenizers.Split("", "isolated")
+    return Qwen2TokenizerFast(
+        tokenizer_object=backend,
+        unk_token="<unk>",
+        additional_special_tokens=specials,
+    )
+
+
+def _text_encoder():
+    from transformers import Qwen3VLConfig, Qwen3VLForConditionalGeneration
+
+    config = Qwen3VLConfig(
+        text_config=dict(
+            hidden_size=16,
+            intermediate_size=32,
+            # H3 reads hidden_states[50], so the stack needs more than 50 layers
+            num_hidden_layers=51,
+            num_attention_heads=2,
+            num_key_value_heads=1,
+            head_dim=8,
+            vocab_size=64,
+            rope_scaling={"rope_type": "default", "mrope_section": [2, 1, 1]},
+        ),
+        vision_config=dict(
+            depth=1,
+            hidden_size=16,
+            intermediate_size=16,
+            num_heads=2,
+            out_hidden_size=16,
+            deepstack_visual_indexes=[0],
+            num_position_embeddings=16,
+        ),
+    )
+    return Qwen3VLForConditionalGeneration(config)
+
+
+def _tiny_h3():
+    """The real H3 modular pipeline over tiny random weights."""
+    from diffusers import (
+        AutoencoderKLMiniMaxH3,
+        AutoencoderKLMiniMaxH3Audio,
+        MiniMaxH3Scheduler,
+        MiniMaxH3Transformer3DModel,
+    )
+    from diffusers.modular_pipelines.minimax_h3 import MiniMaxH3Blocks
+    from transformers import (
+        Qwen2VLImageProcessor,
+        Qwen3VLProcessor,
+        Qwen3VLVideoProcessor,
+    )
+
+    torch.manual_seed(0)
+    tokenizer = _tokenizer()
+    pipeline = MiniMaxH3Blocks().init_pipeline()
+    pipeline.update_components(
+        transformer=MiniMaxH3Transformer3DModel(
+            num_attention_heads=2,
+            attention_head_dim=16,
+            hidden_size=32,
+            num_layers=2,
+            num_refiner_layers=1,
+            ffn_dim=32,
+            text_dim=16,
+            freq_dim=16,
+            time_embed_hidden_dim=16,
+            time_embed_dim=16,
+            rope_freq_dim=2,
+        ),
+        vae=AutoencoderKLMiniMaxH3(
+            block_out_channels=(8, 8, 8, 8, 8, 8),
+            layers_per_block=1,
+            norm_num_groups=4,
+            decoder_num_layers=1,
+            decoder_num_attention_heads=2,
+            decoder_attention_head_dim=8,
+        ),
+        audio_vae=AutoencoderKLMiniMaxH3Audio(
+            encoder_dim=4,
+            latent_dim=64,
+            num_attention_heads=2,
+            # the decoder halves its width at each of seven upsamples
+            decoder_dim=128,
+            latents_mean=[0.0] * 32,
+            latents_std=[1.0] * 32,
+        ),
+        text_encoder=_text_encoder(),
+        tokenizer=tokenizer,
+        processor=Qwen3VLProcessor(
+            image_processor=Qwen2VLImageProcessor(),
+            video_processor=Qwen3VLVideoProcessor(),
+            tokenizer=tokenizer,
+        ),
+        scheduler=MiniMaxH3Scheduler(shift=12.0),
+        audio_scheduler=MiniMaxH3Scheduler(shift=3.0),
+    )
+    return pipeline
+
+
+@pytest.fixture(scope="module")
+def stock_h3():
+    return _tiny_h3()
+
+
+@pytest.fixture(scope="module")
+def guide_h3():
+    """The same pipeline with the guide layout dw swaps in when it loads one."""
+    from dw.pipeline_processors.h3_guides import insert_guides
+
+    pipeline = _tiny_h3()
+    assert insert_guides(pipeline)
+    return pipeline
+
+
+def _wrapper(tiny_h3, chain=None):
+    definition = {"type": "MiniMaxH3Blocks", "configuration": {}}
+    if chain is not None:
+        definition["chain"] = chain
+    return Pipeline(definition, SEED, "cpu", pipeline=tiny_h3)
+
+
+def _arguments():
+    return {
+        "prompt": PROMPT,
+        "height": 32,
+        "width": 32,
+        "num_frames": NUM_FRAMES,
+        "num_inference_steps": 2,
+        "output": ["videos", "audio", "sampling_rate"],
+        # a fresh generator per run: the seed is the whole of the randomness
+        "generator": torch.Generator("cpu").manual_seed(SEED),
+    }
+
+
+def _frames(frames):
+    return numpy.stack([numpy.asarray(frame) for frame in frames])
+
+
+def _native(tiny_h3):
+    output = _wrapper(tiny_h3).run(_arguments())
+    return _frames(output["videos"][0]), output["audio"], output["sampling_rate"]
+
+
+def _chained(tiny_h3, chain):
+    output = run_chain(_wrapper(tiny_h3, chain), chain, _arguments())
+    return _frames(output.frames), output.audio, output.sample_rate
+
+
+@pytest.mark.parametrize(
+    "chain, fixture",
+    [
+        pytest.param({"segments": 1, "fps": 24}, "stock_h3", id="default"),
+        pytest.param(
+            {"segments": 1, "fps": 24, "continuity": "guide"}, "guide_h3", id="guide"
+        ),
+    ],
+)
+def test_one_segment_chain_matches_native_run(chain, fixture, request):
+    tiny_h3 = request.getfixturevalue(fixture)
+    native_frames, native_audio, native_rate = _native(tiny_h3)
+    chained_frames, chained_audio, chained_rate = _chained(tiny_h3, chain)
+
+    assert chained_rate == native_rate
+    assert chained_frames.shape == native_frames.shape
+    assert torch.equal(
+        torch.from_numpy(chained_frames), torch.from_numpy(native_frames)
+    )
+
+    native_audio = torch.as_tensor(native_audio)[0]
+    chained_audio = torch.as_tensor(chained_audio)
+    # The chain trims a segment's audio to its frames' own duration (codec
+    # padding, #408), so it is the native track's prefix - sample for sample
+    kept = round(NUM_FRAMES / 24 * native_rate)
+    assert chained_audio.shape == (2, kept)
+    assert native_audio.shape[1] >= kept
+    assert torch.equal(chained_audio, native_audio[:, :kept])
diff --git a/tests/test_forget_workspace_history.py b/tests/test_forget_workspace_history.py
index 2708e1ccf..ada6b01c7 100644
--- a/tests/test_forget_workspace_history.py
+++ b/tests/test_forget_workspace_history.py
@@ -30,17 +30,29 @@ def test_forgetting_a_workspace_leaves_a_same_named_one_empty(tmp_path):
 
     assert history.recent_summaries(workspace="sweep") == []
     assert [r["id"] for r in history.recent_summaries(workspace="other")] == ["c"]
-    assert history.get("a") is None
+    assert history.get("a")["status"] == "succeeded"
+    assert history.recent_summaries() and [
+        r["id"] for r in history.recent_summaries()
+    ] == ["c"]
 
 
-def test_a_job_a_kept_asset_names_survives_its_workspace(tmp_path):
-    history = JobHistory(str(tmp_path / "jobs.sqlite"))
-    history.record(_job("a", "sweep"))
-    history.record(_job("b", "sweep"))
-    history.mark_kept("a")
+def test_a_database_with_the_retired_kept_column_still_opens(tmp_path):
+    """The `kept` column (#917) is no longer declared: a database that grew
+    it before #944 keeps the physical column, and the migration adds only
+    what is missing rather than tripping over a column it no longer names."""
+    import sqlite3
 
-    assert history.forget_workspace("sweep") == 1
+    from dw.server.job_history import _ADDED_COLUMNS
 
-    assert history.recent_summaries(workspace="sweep") == []
-    assert history.get("b") is None
+    assert "kept" not in {column for column, _ in _ADDED_COLUMNS}
+    path = str(tmp_path / "jobs.sqlite")
+    JobHistory(path).record(_job("a", "sweep"))
+    with sqlite3.connect(path) as connection:
+        connection.execute("ALTER TABLE jobs ADD COLUMN kept INTEGER DEFAULT 0")
+
+    history = JobHistory(path)
+    history.record(_job("b", "sweep"))
+
+    assert {r["id"] for r in history.recent_summaries(workspace="sweep")} == {"a", "b"}
+    assert history.forget_workspace("sweep") == 2
     assert history.get("a")["status"] == "succeeded"
diff --git a/tests/test_gallery_roles.py b/tests/test_gallery_roles.py
index 70da01824..7b66ab917 100644
--- a/tests/test_gallery_roles.py
+++ b/tests/test_gallery_roles.py
@@ -24,8 +24,11 @@ def test_recorded_roles_reach_the_listing(gallery_client, output_root, write_run
     assert files["b.png"]["role"] == "final"
 
 
-def test_older_run_has_no_role(gallery_client, output_root, write_run):
-    # A manifest from before roles: b reads a, but nothing is guessed
+def test_older_run_reads_its_intermediate_subfolder_as_intermediate(
+    gallery_client, output_root, write_run
+):
+    # A manifest from before roles: a sits in intermediate/, so it lists as
+    # intermediate (#928); b has nothing to say and stays unknown
     realized = {
         "id": "wf",
         "steps": [
@@ -51,8 +54,10 @@ def test_older_run_has_no_role(gallery_client, output_root, write_run):
         files=["intermediate/a.png", "b.png"],
     )
     files = {f["label"]: f for f in gallery_client.get("/api/gallery").json()["files"]}
-    assert files["a.png"]["role"] is None
+    assert files["a.png"]["role"] == "intermediate"
     assert files["b.png"]["role"] is None
+    assert _roles(gallery_client, role="intermediate") == {"a.png": "intermediate"}
+    assert _roles(gallery_client, role="final") == {"b.png": None}
 
 
 def test_role_filter(gallery_client, output_root, write_run):
@@ -215,7 +220,12 @@ def test_job_detail_entries_carry_the_run_roles(tmp_path):
     with TestClient(app, base_url="http://localhost") as client:
         job = client.post("/api/jobs", json={"workflow": valid_workflow()}).json()
         detail = wait_for_status(client, job["id"], ["succeeded"])
-        assert all("role" not in e for e in manager.jobs[job["id"]].manifest)
+        # the job is stamped at finish, so history holds the roles too (#957)
+        stored = manager.history.get(job["id"])["manifest"]
+        assert {e["step"]: e["role"] for e in stored} == {
+            "a": "intermediate",
+            "b": "final",
+        }
         assert {e["step"]: e["role"] for e in detail["manifest"]} == {
             "a": "intermediate",
             "b": "final",
@@ -350,7 +360,7 @@ def test_a_declared_final_stays_final(gallery_client, output_root, write_run):
     }
 
 
-def test_a_pre_roles_file_a_later_run_read_stays_unknown(
+def test_a_pre_roles_file_a_later_run_read_lists_as_intermediate(
     gallery_client, output_root, write_run
 ):
     write_run(
@@ -368,7 +378,68 @@ def test_a_pre_roles_file_a_later_run_read_stays_unknown(
         files=["cut.png"],
         inputs=[{"reference": f"output:shots/{SHOT_RUN}/shot.png", "kind": "output"}],
     )
-    assert _roles(gallery_client)["shot.png"] is None
+    assert _roles(gallery_client)["shot.png"] == "intermediate"
+    assert _roles(gallery_client, role="final") == {"cut.png": "final"}
+
+
+def test_metadata_agrees_with_the_listing_for_an_older_run(
+    gallery_client, output_root, write_run
+):
+    # A run that recorded no role: the metadata route goes through the same
+    # owner as the listing, so the two say the same thing (#928)
+    write_run(
+        output_root,
+        "shots",
+        SHOT_RUN,
+        [
+            {"step": "clip", "files": ["intermediate/clip.mp4"]},
+            {"step": "still", "files": ["final/still.png"]},
+            {"step": "shot", "files": ["shot.png"]},
+        ],
+        files=["intermediate/clip.mp4", "final/still.png", "shot.png"],
+    )
+    listed = _roles(gallery_client)
+    assert listed == {
+        "clip.mp4": "intermediate",
+        "still.png": "final",
+        "shot.png": None,
+    }
+    for name, label in (
+        ("intermediate/clip.mp4", "clip.mp4"),
+        ("final/still.png", "still.png"),
+        ("shot.png", "shot.png"),
+    ):
+        meta = gallery_client.get(
+            f"/api/gallery/shots/{SHOT_RUN}/{name}/metadata"
+        ).json()
+        assert meta["role"] == listed[label]
+
+
+def test_metadata_agrees_with_the_listing_on_a_starred_noted_demoted_file(
+    gallery_client, output_root, write_run
+):
+    # One owner (output_annotations) builds role, note, starred and version
+    # for both routes, so a file starred, noted and demoted by a later run
+    # reads the same from each
+    from dw.notes import set_file_note, set_file_starred
+
+    _shot_and_cut(output_root, write_run, f"output:shots/{SHOT_RUN}/final/shot.png")
+    run_dir = os.path.join(output_root, "shots", SHOT_RUN)
+    set_file_note(run_dir, "final/shot.png", "the keeper")
+    set_file_starred(run_dir, "final/shot.png", True)
+    listed = {
+        f["label"]: f for f in gallery_client.get("/api/gallery").json()["files"]
+    }["shot.png"]
+    meta = gallery_client.get(
+        f"/api/gallery/shots/{SHOT_RUN}/final/shot.png/metadata"
+    ).json()
+    assert listed["starred"] is True
+    assert listed["role"] == "intermediate"
+    assert listed["note"] == "the keeper"
+    for key in ("role", "note", "starred", "version"):
+        assert meta[key] == listed[key], key
+    assert meta["note_source"] == "file"
+    assert meta["version"] is not None
 
 
 def test_an_asset_kept_from_a_file_demotes_it(tmp_path, write_run):
diff --git a/tests/test_guide_pointers.py b/tests/test_guide_pointers.py
new file mode 100644
index 000000000..e224de438
--- /dev/null
+++ b/tests/test_guide_pointers.py
@@ -0,0 +1,132 @@
+"""Every pointer an agent is handed to a guide section opens that section.
+
+The resident text - the MCP server's instructions and tool descriptions, and
+each plugin skill's SKILL.md - says what a tool or a family does and points
+at a guide for the rest. A pointer is the whole of the discovery path: a
+section renamed out from under one, or a pointer trimmed away to fit a
+budget (#574 re-broke #282 that way), leaves an agent holding no way to the
+detail. So every pointer must resolve through the same `get_guide` the
+server answers with, and the tools that carry one now must keep it.
+"""
+
+import asyncio
+import glob
+import os
+import re
+
+import pytest
+
+from dw.server import guides
+from tests.test_examples import REPO_ROOT
+
+pytest.importorskip("mcp", reason="the mcp extra is not installed")
+
+from tests.test_mcp_server import ok, server_over, tools_of  # noqa: E402
+
+SKILL_TEXTS = sorted(
+    glob.glob(os.path.join(REPO_ROOT, "plugins", "dw", "skills", "*", "SKILL.md"))
+    + glob.glob(
+        os.path.join(REPO_ROOT, "plugins", "dw", "skills", "*", "references", "*.md")
+    )
+)
+
+# The guide a file name stands for, for the "WORKFLOW_GUIDE's ..." form.
+_BY_FILE = {
+    file_name.removesuffix(".md"): name
+    for name, (file_name, _summary) in guides.GUIDES.items()
+}
+
+# The forms a pointer is written in, with whitespace already collapsed:
+#   get_guide("workflows", section="The loop")   get_guide("loras")
+#   the `acceleration` guide, section "Reading Memory While Offloading"
+#   WORKFLOW_GUIDE's "The loop"
+_CALL = re.compile(
+    r'get_guide\(\s*"(?P<name>[a-z-]+)"(?:\s*,\s*section\s*=\s*"(?P<section>[^"]+)")?\s*\)'
+)
+_PROSE = re.compile(r'the `(?P<name>[a-z-]+)` guide, section "(?P<section>[^"]+)"')
+_FILE = re.compile(r'(?P<file>[A-Z0-9_]+)\'s "(?P<section>[^"]+)"')
+
+# The tools whose description points at a guide today. A pointer trimmed
+# away to fit the surface budget fails here rather than leaving the tool
+# with no way to its detail; adding one to a tool means adding it here.
+TOOLS_THAT_POINT = {
+    "get_job",
+    "get_memory",
+    "get_output_audio",
+    "save_lora",
+    "validate_workflow",
+    "wait_for_job",
+}
+
+
+def pointers(text):
+    """(guide name, section or None) for each pointer in `text`."""
+    flat = " ".join(text.split())
+    found = [(m["name"], m["section"]) for m in _CALL.finditer(flat)]
+    found += [(m["name"], m["section"]) for m in _PROSE.finditer(flat)]
+    found += [
+        (_BY_FILE[m["file"]], m["section"])
+        for m in _FILE.finditer(flat)
+        if m["file"] in _BY_FILE
+    ]
+    return found
+
+
+def unresolved(text):
+    """The pointers in `text` that `get_guide` refuses."""
+    bad = []
+    for name, section in pointers(text):
+        try:
+            guides.get_guide(name, section)
+        except (guides.GuideError, KeyError) as error:
+            bad.append((name, section, str(error)[:120]))
+    return bad
+
+
+def mcp_texts():
+    server = server_over(ok({}))
+    tools = asyncio.run(tools_of(server))
+    texts = {name: tool.description or "" for name, tool in tools.items()}
+    texts["<instructions>"] = server.instructions
+    return texts
+
+
+def test_every_pointer_in_the_mcp_surface_resolves():
+    bad = {name: unresolved(text) for name, text in mcp_texts().items()}
+    assert not {name: b for name, b in bad.items() if b}
+
+
+def test_the_tools_that_point_at_a_guide_still_do():
+    texts = mcp_texts()
+    lost = sorted(name for name in TOOLS_THAT_POINT if not pointers(texts[name]))
+    assert not lost, f"these tools lost their guide pointer: {lost}"
+
+
+def test_the_server_instructions_point_at_the_authoring_section():
+    assert ("workflows", "Authoring a workflow from an agent") in pointers(
+        mcp_texts()["<instructions>"]
+    )
+
+
+@pytest.mark.parametrize(
+    "path", SKILL_TEXTS, ids=lambda p: os.path.relpath(p, REPO_ROOT)
+)
+def test_every_pointer_in_a_skill_resolves(path):
+    with open(path, encoding="utf-8") as handle:
+        assert not unresolved(handle.read())
+
+
+def test_the_pointer_forms_are_recognised():
+    """The extraction itself, so a form it stops matching cannot pass the
+    resolution tests by finding nothing."""
+    text = (
+        'see get_guide("workflows",\n section="The loop") and the '
+        '`acceleration` guide, section "Caching", and WORKFLOW_GUIDE\'s '
+        '"References", and get_guide("loras")'
+    )
+    assert pointers(text) == [
+        ("workflows", "The loop"),
+        ("loras", None),
+        ("acceleration", "Caching"),
+        ("workflows", "References"),
+    ]
diff --git a/tests/test_h3_context_ir.py b/tests/test_h3_context_ir.py
index d52945e40..d0128dbd8 100644
--- a/tests/test_h3_context_ir.py
+++ b/tests/test_h3_context_ir.py
@@ -60,6 +60,20 @@ def test_the_dialogue_fidelity_rules_are_present():
     assert "retention_analysis" in prompt and "(Sx)" in prompt
 
 
+def test_spoken_lines_are_written_as_d_blocks_not_quoted_prose():
+    """With the rule stated only in the abstract, Qwen3-4B wrote every supplied
+    line as quoted prose and no <d> block at all (#989). The field definition
+    and a worked example of the tag are what bring the block back."""
+    prompt = _system_prompt()
+
+    field = prompt[prompt.index("integrated_multimodal_description:") :]
+    field = field[: field.index("\n")]
+    assert "<d> block" in field
+    assert "never quoted prose" in prompt
+    assert "<d>[English] We should head back.</d>" in prompt
+    assert "[English], [Chinese]" in prompt
+
+
 def test_the_unsourced_lines_are_gone():
     prompt = _system_prompt()
 
diff --git a/tests/test_h3_hold_audio.py b/tests/test_h3_hold_audio.py
index df84f2f81..d6d4c0710 100644
--- a/tests/test_h3_hold_audio.py
+++ b/tests/test_h3_hold_audio.py
@@ -16,8 +16,10 @@
 from dw.output_extraction import modular_artifacts
 from dw.pipeline_processors import h3_rules
 from dw.pipeline_processors.h3_hold import (
+    HELD_LATENTS_OUTPUT,
     blocks,
     core_denoise_sequences,
+    encoded_hold_audio,
     hold_audio_reference,
     holds_audio,
     insert_audio_hold,
@@ -309,6 +311,47 @@ def test_reference_rows_in_front_are_untouched(self):
         assert state.get("num_condition_audio_rows") == k
         assert state.get(HELD_ROWS) == 0
 
+    def test_a_carried_encode_is_written_without_encoding_again(self):
+        """The hold block run on a track it already encoded, handed that encode
+        back through `encoded_hold_audio`, leaves the audio VAE alone and
+        writes the same rows and the same held track."""
+
+        class Counting(FakeAudioVae):
+            encodes = 0
+
+            def encode(self, x, return_dict=False):
+                Counting.encodes += 1
+                return super().encode(x, return_dict)
+
+        wave = torch.randn(2, 3 * RATE, generator=torch.manual_seed(8))
+        track = MiniMaxH3AudioReference(audio=wave, sample_rate=RATE)
+        comps = components()
+        comps.audio_vae = Counting()
+        hold = blocks()[0]()
+
+        first = make_state(track)
+        hold(comps, first)
+        encoded = first.get(HELD_LATENTS_OUTPUT)
+        assert Counting.encodes >= 1 and encoded is not None
+        assert encoded.shape == (2, NUM_LATENTS, CHANNELS)
+
+        encodes = Counting.encodes
+        second = make_state(encoded_hold_audio(track, encoded))
+        hold(comps, second)
+        assert Counting.encodes == encodes
+        for name in (
+            "audio_latents",
+            HELD_AUDIO_OUTPUT,
+            HELD_LATENTS_OUTPUT,
+        ):
+            assert torch.equal(first.get(name), second.get(name)), name
+        for name in (
+            "num_condition_audio_rows",
+            HELD_ROWS,
+            HELD_AUDIO_RATE_OUTPUT,
+        ):
+            assert first.get(name) == second.get(name), name
+
     def test_release_restores_the_count(self):
         wave = torch.randn(2, 2 * RATE, generator=torch.manual_seed(6))
         state = make_state(MiniMaxH3AudioReference(audio=wave, sample_rate=RATE))
diff --git a/tests/test_h3_latent_upscale.py b/tests/test_h3_latent_upscale.py
index 5e9a5b3d8..2b0813e69 100644
--- a/tests/test_h3_latent_upscale.py
+++ b/tests/test_h3_latent_upscale.py
@@ -95,21 +95,35 @@ def test_height_not_a_multiple_of_16(self):
         with pytest.raises(ValueError, match="height"):
             target_latent_size(latents, width=960, height=550)
 
-    def test_over_the_canvas_long_edge(self):
+    def test_over_the_cap_long_edge(self):
         latents = h3_latents()
-        with pytest.raises(ValueError, match="canvas"):
+        with pytest.raises(ValueError, match="1920x1088"):
             target_latent_size(latents, width=4000, height=768)
 
-    def test_over_the_canvas_short_edge(self):
+    def test_over_the_cap_width_by_one_step(self):
         latents = h3_latents()
-        with pytest.raises(ValueError, match="canvas"):
-            target_latent_size(latents, width=1344, height=800)
+        with pytest.raises(ValueError, match="1920x1088"):
+            target_latent_size(latents, width=1952, height=1088)
 
-    def test_portrait_canvas_is_accepted(self):
+    def test_over_the_cap_height_by_one_step(self):
+        latents = h3_latents()
+        with pytest.raises(ValueError, match="1920x1088"):
+            target_latent_size(latents, width=1920, height=1120)
+
+    def test_the_cap_itself_is_accepted(self):
+        latents = h3_latents()
+        size, _ = target_latent_size(latents, width=1920, height=1088)
+        assert size == (5, 1088 // 16, 1920 // 16)
+
+    def test_portrait_cap_is_accepted(self):
+        latents = h3_latents(height=60, width=34)
+        size, _ = target_latent_size(latents, width=1088, height=1920)
+        assert size == (5, 1920 // 16, 1088 // 16)
+
+    def test_portrait_over_the_cap_is_refused(self):
         latents = h3_latents(height=60, width=34)
-        # 768x1344 portrait is within the canvas (short edge <= 768, long <= 1344)
-        size, _ = target_latent_size(latents, width=768, height=1344)
-        assert size == (5, 1344 // 16, 768 // 16)
+        with pytest.raises(ValueError, match="1920x1088"):
+            target_latent_size(latents, width=1120, height=1920)
 
     def test_downscale_is_refused(self):
         # 34x60 latents (544x960) downscaled to 528x944 - just under 1x on both axes
@@ -504,3 +518,73 @@ def fake_hf_hub_download(repo_id, filename, subfolder, revision):
             "cpu", hlu.LMS_UPSCALER_REPO, "h3_upscaler_lms_v0.1_fp32.safetensors"
         )
         assert captured == {"subfolder": None, "revision": None}
+
+
+def _upscale_workflow(width, height):
+    return {
+        "id": "x",
+        "steps": [
+            {
+                "name": "up",
+                "task": {
+                    "command": "upscale_h3_latents",
+                    "arguments": {
+                        "latents": "previous_result:base.latents",
+                        "width": width,
+                        "height": height,
+                    },
+                },
+            }
+        ],
+    }
+
+
+class TestTargetSizeRefusedAtValidate:
+    """The run's grid and cap rule, applied by validate to literal sizes
+    (#1048, M-F175): refused at both or neither, in the same words."""
+
+    @staticmethod
+    def errors(width, height):
+        import dw.tasks.model_handlers  # noqa: F401 - registers the task
+        from dw.task_domains import task_argument_errors
+
+        return task_argument_errors(_upscale_workflow(width, height))
+
+    @pytest.mark.parametrize(
+        "width, height, argument",
+        [
+            (1952, 1088, "width"),
+            (1920, 1120, "height"),
+            (3840, 2176, "width"),
+            (1088, 1952, "height"),
+            (1120, 1920, "width"),
+        ],
+    )
+    def test_over_the_cap(self, width, height, argument):
+        errors = self.errors(width, height)
+        assert len(errors) == 1
+        assert errors[0]["path"].endswith(f"arguments.{argument}")
+        assert "over the upscale cap" in errors[0]["message"]
+        assert "1920x1088" in errors[0]["message"]
+
+    def test_off_the_grid(self):
+        errors = self.errors(1000, 544)
+        assert [e["path"].rsplit(".", 1)[-1] for e in errors] == ["width"]
+        assert "multiple of 16" in errors[0]["message"]
+
+    @pytest.mark.parametrize("width, height", [(1920, 1088), (1088, 1920), (1344, 768)])
+    def test_within_the_cap(self, width, height):
+        assert self.errors(width, height) == []
+
+    def test_unresolved_sizes_are_left_to_the_run(self):
+        assert self.errors("variable:width", 1088) == []
+
+    @pytest.mark.parametrize(
+        "width, height", [(1952, 1088), (1920, 1120), (1000, 544), (1088, 1952)]
+    )
+    def test_the_run_refuses_in_the_same_words(self, width, height):
+        message = self.errors(width, height)[0]["message"]
+        latents = torch.zeros(1, 24, 3, 34, 60)
+        with pytest.raises(ValueError) as refused:
+            target_latent_size(latents, width, height)
+        assert message.startswith(str(refused.value).rstrip("."))
diff --git a/tests/test_h3_refine.py b/tests/test_h3_refine.py
index 9306452bb..587e8a920 100644
--- a/tests/test_h3_refine.py
+++ b/tests/test_h3_refine.py
@@ -594,3 +594,217 @@ def test_the_runtime_message_is_the_owners(self, refining, overrides):
         with pytest.raises(ValueError) as raised:
             Pipeline._check_refine(refining, arguments)
         assert str(raised.value) == f"Step 'video': {problems[0]}"
+
+
+# 10. refine_tiles (#1043)
+
+TILES = {"width": 1344, "height": 768, "overlap": 256}
+
+
+def tiled(tiles=TILES, **overrides):
+    return step_with(refine_tiles=tiles, **overrides)
+
+
+def messages(step):
+    return [error["message"] for error in errors_for(step)]
+
+
+def tile_errors(step):
+    return [e for e in errors_for(step) if e["path"].endswith("refine_tiles")]
+
+
+def upscale_workflow(up_width=1920, up_height=1088, tiles=TILES, **overrides):
+    refine = tiled(tiles, **overrides)
+    refine["name"] = "refine"
+    refine["pipeline"]["arguments"]["latents"] = "previous_result:up"
+    return {
+        "steps": [
+            h3_step(),
+            {
+                "name": "up",
+                "task": {
+                    "command": "upscale_h3_latents",
+                    "arguments": {
+                        "latents": "previous_result:video.latents",
+                        "width": up_width,
+                        "height": up_height,
+                    },
+                },
+            },
+            refine,
+        ]
+    }
+
+
+class TestTileStatic:
+    def test_tiles_without_a_strength_are_refused_at_the_tiles_path(self):
+        errors = errors_for(tiled(refine_strength=None))
+        assert len(errors) == 1
+        assert errors[0]["path"].endswith("arguments.refine_tiles")
+        assert errors[0]["message"].startswith("refine_tiles tiles a refine_strength")
+
+    @pytest.mark.parametrize(
+        "tiles, fragment",
+        [
+            ({"width": 1000, "height": 544, "overlap": 256}, "multiple of 32"),
+            ({"width": 1920, "height": 1088, "overlap": 256}, "1920x1088"),
+            ({"width": 1344, "height": 768, "overlap": 128}, "128"),
+            ({"width": 1344, "height": 768, "overlap": 400}, "400"),
+            ({"width": 1344, "height": 768, "overlap": 384}, "384"),
+            ({"width": 1344, "height": 768, "overlap": 160}, "160"),
+            ({"width": 1344, "height": 768, "overlap": 250}, "multiple of 32"),
+            ({"width": "wide", "height": 768, "overlap": 256}, "'wide'"),
+            ({"width": 1344, "height": 768.0, "overlap": 256}, "768.0"),
+            ({"width": 1344, "height": 768, "overlap": True}, "True"),
+            ({"width": 1344, "height": 768}, "missing overlap"),
+            ({"width": 1344, "height": 768, "overlap": 256, "pad": 1}, "pad"),
+            ("1344x768", "mapping"),
+        ],
+    )
+    def test_a_bad_tile_is_refused_naming_refine_tiles(self, tiles, fragment):
+        errors = tile_errors(tiled(tiles))
+        assert errors
+        assert all(e["message"].startswith("refine_tiles") for e in errors)
+        assert any(fragment in e["message"] for e in errors)
+        assert len(errors) == len(errors_for(tiled(tiles)))
+
+    @pytest.mark.parametrize(
+        "tiles",
+        [
+            {"width": 1344, "height": 768, "overlap": 256},
+            {"width": 768, "height": 1088, "overlap": 192},
+            {"width": 768, "height": 768, "overlap": 352},
+        ],
+    )
+    def test_a_boundary_tile_is_clean(self, tiles):
+        assert errors_for(tiled(tiles)) == []
+
+    def test_an_unresolved_value_skips_its_checks(self):
+        tiles = {"width": "variable:w", "height": 768, "overlap": "variable:o"}
+        assert errors_for(tiled(tiles)) == []
+        assert errors_for(tiled("variable:tiles")) == []
+
+    @pytest.mark.parametrize(
+        "argument, value",
+        [
+            ("image", {"location": "a.png"}),
+            ("last_image", "asset:a.png"),
+            ("references", [{"reference_type": "image"}]),
+            ("guides", [{"video": "asset:a.mp4"}]),
+        ],
+    )
+    def test_a_reference_keyframe_or_guide_is_refused(self, argument, value):
+        step = tiled(**{argument: value})
+        found = [m for m in messages(step) if argument in m]
+        assert len(found) == 1
+        assert found[0].startswith("refine_tiles")
+
+    def test_a_null_reference_does_not_count(self):
+        assert errors_for(tiled(image=None, guides=None)) == []
+
+    def test_a_picture_in_the_prompt_is_refused(self):
+        found = messages(tiled(prompt="<Picture 1> walks"))
+        assert len(found) == 1 and "<Picture N>" in found[0]
+
+    def test_a_tile_over_a_known_canvas_is_refused(self):
+        found = messages(tiled(width=1280, height=704))
+        assert len(found) == 1
+        assert "larger than the 1280x704 canvas" in found[0]
+
+    def test_a_tile_over_one_axis_is_refused(self):
+        tall = {"width": 768, "height": 1344, "overlap": 192}
+        found = messages(tiled(tall, width=1920, height=1088))
+        assert len(found) == 1
+        assert "768x1344 is larger than the 1920x1088 canvas" in found[0]
+
+    def test_the_canvas_comes_from_the_upscale_step(self):
+        assert refine_strength_errors(upscale_workflow()) == []
+        problems = refine_strength_errors(upscale_workflow(1280, 704))
+        assert any("1280x704 canvas" in p["message"] for p in problems)
+        assert all(p["path"].endswith("refine_tiles") for p in problems)
+
+    def test_a_disagreeing_size_is_refused_against_the_upscale_step(self):
+        problems = refine_strength_errors(upscale_workflow(width=1344))
+        assert len(problems) == 1
+        assert "width 1344" in problems[0]["message"]
+        assert "1920x1088" in problems[0]["message"]
+
+    def test_an_agreeing_size_is_clean(self):
+        assert refine_strength_errors(upscale_workflow(width=1920, height=1088)) == []
+
+    def test_an_unknown_canvas_skips_the_canvas_checks(self):
+        assert errors_for(tiled()) == []
+
+    def test_a_non_h3_step_is_refused_naming_refine_tiles(self):
+        step = tiled()
+        step["pipeline"]["configuration"]["component_type"] = "StableDiffusionPipeline"
+        found = tile_errors(step)
+        assert len(found) == 1
+        assert "refine_tiles is a MiniMax-H3 argument" in found[0]["message"]
+
+    def test_a_tiles_step_keeps_the_strength_rules(self):
+        errors = errors_for(tiled(hold_audio=None))
+        assert len(errors) == 1
+        assert errors[0]["path"].endswith("refine_strength")
+
+    def test_the_happy_workflow_is_clean(self):
+        definition = copy.deepcopy(upscale_workflow())
+        workflow = workflow_from_definition(definition, tempfile.mkdtemp())
+        assert [
+            p
+            for p in workflow.validation_errors()
+            if "refine_" in str(p.get("path")) or "refine_" in p["message"]
+        ] == []
+
+
+class TestTileRuntime:
+    def canvas(self, height=1088, width=1920):
+        return torch.zeros(1, 16, 8, height // 16, width // 16)
+
+    def test_tiles_without_a_strength_raise_naming_refine_tiles(self, run):
+        with pytest.raises(ValueError, match="refine_tiles tiles a refine_strength"):
+            run(refine_strength=None)
+
+    def test_a_non_h3_pipeline_names_refine_tiles(self):
+        with pytest.raises(ValueError, match="refine_tiles is a MiniMax-H3"):
+            Pipeline._check_refine(
+                ns(object()),
+                runtime_arguments(
+                    refine_strength=None, refine_tiles=TILES, latents=self.canvas()
+                ),
+            )
+
+    @pytest.fixture
+    def run(self, refining):
+        def call(tiles=TILES, canvas=None, **overrides):
+            arguments = runtime_arguments(
+                refine_tiles=tiles,
+                latents=self.canvas() if canvas is None else canvas,
+                **overrides,
+            )
+            return Pipeline._check_refine(refining, arguments)
+
+        return call
+
+    def test_a_valid_tiled_call_passes(self, run):
+        assert run() is None
+
+    def test_an_off_limit_tile_raises(self, run):
+        with pytest.raises(ValueError, match="refine_tiles.*1920x1088"):
+            run({"width": 1920, "height": 1088, "overlap": 256})
+
+    def test_a_low_overlap_raises(self, run):
+        with pytest.raises(ValueError, match="refine_tiles overlap.*128"):
+            run({"width": 1344, "height": 768, "overlap": 128})
+
+    def test_a_tile_over_the_tensor_canvas_raises(self, run):
+        with pytest.raises(ValueError, match="1280x704 canvas"):
+            run(canvas=self.canvas(704, 1280))
+
+    def test_a_size_disagreeing_with_the_tensor_raises(self, run):
+        with pytest.raises(ValueError, match="width 1344 disagrees"):
+            run(width=1344, height=1088)
+
+    def test_a_guide_raises(self, run):
+        with pytest.raises(ValueError, match="refine_tiles.*guides"):
+            run(guides=[{"video": "a.mp4"}])
diff --git a/tests/test_h3_rules.py b/tests/test_h3_rules.py
index 1be47c174..e272f3fcd 100644
--- a/tests/test_h3_rules.py
+++ b/tests/test_h3_rules.py
@@ -55,3 +55,59 @@ def test_the_block_owners_import_no_diffusers(module):
     # Their blocks are h3_hold_steps and h3_guide_steps, which import diffusers
     # when they load: validation imports h3_guides, so those wait for a block
     assert "diffusers" not in _imported_heavy_modules(module).split(",")
+
+
+# refine_tiles (#1043): the pure rules, on a canvas with a shape and nothing else
+
+
+class _Canvas:
+    """A `latents` stand-in: only the shape h3_rules reads, no torch."""
+
+    def __init__(self, height, width):
+        self.shape = (1, 16, 8, height // 16, width // 16)
+
+
+def _tiled(tiles, **overrides):
+    arguments = {
+        "refine_strength": 0.2,
+        "latents": _Canvas(1088, 1920),
+        "hold_audio": "previous_result:base.audio",
+        "num_inference_steps": 5,
+        "refine_tiles": tiles,
+    }
+    arguments.update(overrides)
+    return {k: v for k, v in arguments.items() if v is not None}
+
+
+def _problems(tiles, **overrides):
+    from dw.pipeline_processors.h3_rules import refine_problems
+
+    return refine_problems(_tiled(tiles, **overrides))
+
+
+@pytest.mark.parametrize(
+    "tiles",
+    [
+        {"width": 1344, "height": 768, "overlap": 256},
+        {"width": 768, "height": 1088, "overlap": 192},
+        {"width": 768, "height": 768, "overlap": 352},
+    ],
+)
+def test_a_tile_inside_the_limit_is_clean(tiles):
+    assert _problems(tiles) == []
+
+
+def test_a_tile_over_the_latent_canvas_is_refused():
+    problems = _problems(
+        {"width": 1344, "height": 768, "overlap": 256}, latents=_Canvas(704, 1280)
+    )
+    assert len(problems) == 1
+    assert "1280x704 canvas" in problems[0]
+
+
+def test_a_missing_strength_is_the_only_problem():
+    problems = _problems(
+        {"width": 1344, "height": 768, "overlap": 256}, refine_strength=None
+    )
+    assert len(problems) == 1
+    assert problems[0].startswith("refine_tiles tiles a refine_strength")
diff --git a/tests/test_h3_tiles.py b/tests/test_h3_tiles.py
new file mode 100644
index 000000000..eb3c5f790
--- /dev/null
+++ b/tests/test_h3_tiles.py
@@ -0,0 +1,411 @@
+"""MiniMax-H3 tiled refine (#1043): the feather, the shared noise, the
+decode-free graph, the refine block's noise input, and the tile loop."""
+
+from types import SimpleNamespace
+
+import pytest
+import torch
+
+from dw.pipeline_processors.h3_hold import HELD_LATENTS_OUTPUT, insert_audio_hold
+from dw.pipeline_processors.h3_rules import (
+    HELD_AUDIO_OUTPUT,
+    HELD_AUDIO_RATE_OUTPUT,
+    HOLD_AUDIO_INPUT,
+    LATENT_SCALE,
+    REFINE_BLOCK,
+    REFINE_NOISE,
+    REFINE_STRENGTH_INPUT,
+    REFINE_TILES_INPUT,
+    tile_plan,
+)
+from dw.pipeline_processors.h3_tiles import (
+    blend,
+    canvas_noise,
+    crop,
+    decode_free_blocks,
+    feather_weights,
+    run_tiled_refine,
+)
+
+minimax = pytest.importorskip("diffusers.modular_pipelines.minimax_h3")
+from diffusers.modular_pipelines.minimax_h3.before_denoise import (  # noqa: E402
+    patchify_video_latents,
+)
+from diffusers.modular_pipelines.minimax_h3.references import (  # noqa: E402
+    MiniMaxH3AudioReference,
+)
+from dw.pipeline_processors.h3_hold_steps import EncodedAudioReference  # noqa: E402
+from tests.test_h3_refine import components, make_state, run  # noqa: E402
+
+PLAN = tile_plan(1920, 1088, 1344, 768, 256)
+CANVAS = (1, 4, 2, 1088 // LATENT_SCALE, 1920 // LATENT_SCALE)
+
+
+def plan_weights(plan):
+    return [feather_weights(plan, tile) for tile in plan]
+
+
+class TestFeather:
+    @pytest.mark.parametrize(
+        "size", [(1920, 1088, 1344, 768, 256), (2688, 1536, 1344, 768, 192)]
+    )
+    def test_weights_normalize_to_one_everywhere(self, size):
+        plan = tile_plan(*size)
+        total = torch.zeros(size[1] // 16, size[0] // 16)
+        for tile, weights in zip(plan, plan_weights(plan)):
+            x, y, w, h = tile
+            total[y // 16 : (y + h) // 16, x // 16 : (x + w) // 16] += weights
+        # Divided by the sum the way blend does, then every cell is covered
+        assert bool((total > 0).all())
+
+    def test_ramps_only_on_shared_sides(self):
+        first, last = PLAN[0], PLAN[-1]
+        weights = feather_weights(PLAN, first)
+        assert weights[0, 0] == 1 and weights[0, 0:3].min() == 1
+        assert weights[-1, -1] < 1
+        assert feather_weights(PLAN, last)[-1, -1] == 1
+
+    def test_ramp_is_linear_and_complementary(self):
+        left, right = PLAN[0], PLAN[1]
+        overlap = (left[0] + left[2] - right[0]) // 16
+        fall = feather_weights(PLAN, left)[0, -overlap:]
+        rise = feather_weights(PLAN, right)[0, :overlap]
+        assert torch.allclose(fall + rise, torch.ones(overlap))
+        steps = rise[1:] - rise[:-1]
+        assert torch.allclose(steps, steps[0].expand_as(steps))
+
+
+class TestBlend:
+    def test_identical_constant_tiles_give_the_constant_back(self):
+        tiles = [torch.full((1, 4, 2, h // 16, w // 16), 3.5) for _, _, w, h in PLAN]
+        result = blend(tiles, PLAN, CANVAS)
+        assert result.shape == CANVAS
+        assert torch.allclose(result, torch.full(CANVAS, 3.5))
+
+    def test_a_ramp_survives_the_blend(self):
+        """Tiles cut from one smooth canvas blend back into it, no seam."""
+        source = torch.randn(CANVAS, generator=torch.manual_seed(0))
+        tiles = [crop(source, tile) for tile in PLAN]
+        assert torch.allclose(blend(tiles, PLAN, CANVAS), source, atol=1e-5)
+
+    def test_uncovered_canvas_is_refused(self):
+        with pytest.raises(ValueError, match="uncovered"):
+            blend([torch.zeros(1, 4, 2, 48, 84)], PLAN[:1], CANVAS)
+
+
+class TestNoise:
+    def test_tile_noise_is_the_canvas_noise_at_its_offset(self):
+        latents = torch.zeros(CANVAS)
+        noise = canvas_noise(latents, torch.Generator().manual_seed(7))
+        again = canvas_noise(latents, torch.Generator().manual_seed(7))
+        assert torch.equal(noise, again) and noise.dtype == torch.float32
+        x, y, w, h = PLAN[3]
+        tile = crop(noise, PLAN[3])
+        assert tile.shape == (1, 4, 2, h // 16, w // 16)
+        assert torch.equal(tile[..., 0, 0], noise[..., y // 16, x // 16])
+        # Where two tiles overlap they share noise
+        first, second = crop(noise, PLAN[0]), crop(noise, PLAN[1])
+        assert torch.equal(first[..., :, -1], noise[..., :48, PLAN[0][2] // 16 - 1])
+        assert second.shape[-1] == PLAN[1][2] // 16
+
+
+def real_pipelines():
+    graph = minimax.MiniMaxH3Blocks()
+    return [
+        ("whole", graph.init_pipeline()),
+        ("t2va", graph.get_workflow("t2va").init_pipeline()),
+    ]
+
+
+class TestDecodeFree:
+    @pytest.mark.parametrize("which", [0, 1])
+    def test_variant_has_no_decode_and_shares_blocks(self, which):
+        pipeline = real_pipelines()[which][1]
+        insert_audio_hold(pipeline)
+        tile_blocks, text_blocks, decoder = decode_free_blocks(pipeline)
+        names = list(tile_blocks.sub_blocks)
+        assert not any(n == "decode" or n.startswith("decode.") for n in names)
+        assert "decode" in pipeline._blocks.sub_blocks or any(
+            n.startswith("decode.") for n in pipeline._blocks.sub_blocks
+        )
+        assert list(text_blocks.sub_blocks) == ["text_encoder"]
+        assert decoder is not None
+        inputs = {param.name for param in tile_blocks.inputs}
+        assert {"prompt_embeds", REFINE_NOISE, REFINE_TILES_INPUT} <= inputs
+        for name, block in tile_blocks.sub_blocks.items():
+            assert block is pipeline._blocks.sub_blocks[name]
+        if which == 1:
+            assert f"denoise.{REFINE_BLOCK}" in names
+        else:
+            denoise = tile_blocks.sub_blocks["denoise"]
+            for sequence in denoise.sub_blocks.values():
+                if hasattr(sequence, "sub_blocks"):
+                    assert REFINE_BLOCK in sequence.sub_blocks
+
+    def test_a_graph_with_nothing_to_drop_has_no_variant(self):
+        bare = SimpleNamespace(
+            _blocks=SimpleNamespace(sub_blocks={"denoise": object()})
+        )
+        assert decode_free_blocks(bare) == (None, None, None)
+
+    def test_a_tiled_call_without_a_variant_names_refine_tiles(self):
+        pipeline = SimpleNamespace()
+        with pytest.raises(ValueError, match=REFINE_TILES_INPUT):
+            run_tiled_refine(pipeline, {REFINE_TILES_INPUT: {}}, "x")
+
+
+def patched(comps):
+    comps.patch_size = (1, 2, 2)
+    return comps
+
+
+class TestRefineBlockNoise:
+    def run_block(self, noise=None, seed=3):
+        state = make_state(seed=seed)
+        # Rows are 4 latent channels x (1,2,2) patch -> a (1, C, 1, 2, 3) canvas
+        rows = state.get("latents")
+        assert rows.shape == (6, 8)
+        if noise is not None:
+            state.set(REFINE_NOISE, noise)
+        clean = rows.clone()
+        run(patched(components()), state)
+        return clean, state.get("latents")
+
+    def canvas_noise(self):
+        return torch.randn(1, 2, 1, 4, 6, generator=torch.manual_seed(11))
+
+    def test_given_noise_replaces_the_draw(self):
+        noise = self.canvas_noise()
+        clean, refined = self.run_block(noise)
+        packed = patchify_video_latents(noise, (1, 2, 2))
+        expected = components().scheduler.scale_noise(clean, 1 - 0.2, packed)
+        assert packed.shape == clean.shape
+        assert torch.allclose(refined, expected)
+
+    def test_without_noise_it_draws_as_before(self):
+        clean, refined = self.run_block()
+        drawn = torch.randn(clean.shape, generator=torch.Generator().manual_seed(3))
+        expected = components().scheduler.scale_noise(clean, 0.8, drawn)
+        assert torch.allclose(refined, expected)
+
+    def test_noise_that_packs_to_another_shape_is_refused(self):
+        with pytest.raises(ValueError, match=REFINE_NOISE):
+            self.run_block(torch.randn(1, 2, 1, 2, 2))
+
+
+class TestSignature:
+    def test_refine_tiles_is_an_argument_and_the_noise_is_not(self):
+        from dw.introspection import describe_class
+
+        names = [
+            p["name"] for p in describe_class("MiniMaxH3ModularPipeline")["parameters"]
+        ]
+        assert REFINE_TILES_INPUT in names
+        assert REFINE_STRENGTH_INPUT in names
+        assert REFINE_NOISE not in names
+
+
+def blocks_taking(*names):
+    return SimpleNamespace(inputs=[SimpleNamespace(name=n) for n in names])
+
+
+class FakePipeline:
+    """Stands in for the loaded pipeline: records each call, returns the tile's
+    own crop as the denoised latents."""
+
+    _execution_device = torch.device("cpu")
+
+    def __init__(self):
+        self._blocks = "full"
+        self.calls = []
+        self._dw_tile_blocks = blocks_taking("prompt_embeds", "latents")
+        self._dw_text_blocks = blocks_taking("prompt")
+
+    def __call__(self, **kwargs):
+        if self._blocks is self._dw_text_blocks:
+            self.calls.append(("text", kwargs))
+            return {"prompt_embeds": "embeds", "text_token_tags": "tags"}
+        assert self._blocks is self._dw_tile_blocks
+        self.calls.append(("tile", kwargs))
+        result = {"latents": kwargs["latents"] + 0}
+        if HELD_AUDIO_OUTPUT in kwargs["output"]:
+            result[HELD_AUDIO_OUTPUT] = "audio"
+            result[HELD_AUDIO_RATE_OUTPUT] = 44100
+        if HELD_LATENTS_OUTPUT in kwargs["output"]:
+            # The hold block's encode of the track, which only an encode produces
+            assert getattr(kwargs[HOLD_AUDIO_INPUT], "latents", None) is None
+            result[HELD_LATENTS_OUTPUT] = "encoded"
+        return result
+
+
+class TestTileLoop:
+    def run(self, output=None, **extra):
+        pipeline = FakePipeline()
+        latents = torch.randn(CANVAS, generator=torch.manual_seed(1))
+        arguments = {
+            "prompt": "a cat",
+            "latents": latents,
+            "num_inference_steps": 5,
+            REFINE_STRENGTH_INPUT: 0.2,
+            REFINE_TILES_INPUT: {"width": 1344, "height": 768, "overlap": 256},
+            **extra,
+        }
+        if output is not None:
+            arguments["output"] = output
+        decoded = []
+
+        def decode(canvas):
+            decoded.append(canvas)
+            return [["frame"]]
+
+        result = run_tiled_refine(pipeline, arguments, "step", decode=decode)
+        return pipeline, latents, result, decoded
+
+    def test_one_call_per_tile_with_its_crop_and_one_decode(self):
+        pipeline, latents, result, decoded = self.run(
+            output=["videos", "latents", HELD_AUDIO_OUTPUT, HELD_AUDIO_RATE_OUTPUT]
+        )
+        tile_calls = [kw for kind, kw in pipeline.calls if kind == "tile"]
+        assert len(tile_calls) == len(PLAN) == 4
+        for (x, y, w, h), kwargs in zip(PLAN, tile_calls):
+            assert (kwargs["width"], kwargs["height"]) == (w, h)
+            assert torch.equal(
+                kwargs["latents"],
+                latents[..., y // 16 : (y + h) // 16, x // 16 : (x + w) // 16],
+            )
+            assert kwargs[REFINE_NOISE].shape == kwargs["latents"].shape
+            assert REFINE_TILES_INPUT not in kwargs
+            assert kwargs["prompt_embeds"] == "embeds" and "prompt" not in kwargs
+        # Prompt encoded once, the held audio asked of the first tile only
+        assert [kind for kind, _ in pipeline.calls].count("text") == 1
+        assert HELD_AUDIO_OUTPUT in tile_calls[0]["output"]
+        assert HELD_AUDIO_OUTPUT not in tile_calls[1]["output"]
+        # Nothing held, so no tile is asked for an encode of it
+        assert not any(HELD_LATENTS_OUTPUT in kw["output"] for kw in tile_calls)
+        assert pipeline._blocks == "full"
+        assert len(decoded) == 1 and decoded[0].shape == latents.shape
+        assert torch.allclose(result["latents"], latents, atol=1e-5)
+        assert result["videos"] == [["frame"]]
+        assert result[HELD_AUDIO_OUTPUT] == "audio"
+        assert result[HELD_AUDIO_RATE_OUTPUT] == 44100
+
+    def test_the_track_is_encoded_by_one_tile_and_handed_to_the_rest(self):
+        """The audio hold runs once per refine, not once per tile: the first
+        tile is asked for the hold block's encode, and every later tile's
+        `hold_audio` carries it, so the block writes it instead of encoding."""
+        track = MiniMaxH3AudioReference(audio=torch.zeros(2, 160), sample_rate=16000)
+        pipeline, _, result, _ = self.run(**{HOLD_AUDIO_INPUT: track})
+        tile_calls = [kw for kind, kw in pipeline.calls if kind == "tile"]
+        assert len(tile_calls) == 4
+        encoding = [
+            kw
+            for kw in tile_calls
+            if getattr(kw[HOLD_AUDIO_INPUT], "latents", None) is None
+        ]
+        assert len(encoding) == 1 and encoding[0] is tile_calls[0]
+        assert tile_calls[0][HOLD_AUDIO_INPUT] is track
+        assert HELD_LATENTS_OUTPUT in tile_calls[0]["output"]
+        for kwargs in tile_calls[1:]:
+            carried = kwargs[HOLD_AUDIO_INPUT]
+            assert isinstance(carried, EncodedAudioReference)
+            assert carried.latents == "encoded"
+            assert carried.audio is track.audio
+            assert carried.sample_rate == track.sample_rate
+            assert HELD_LATENTS_OUTPUT not in kwargs["output"]
+        # The encode is the tiles' hand-off, never part of the step's result
+        assert HELD_LATENTS_OUTPUT not in result
+        assert result[HELD_AUDIO_OUTPUT] == "audio"
+
+    def test_output_is_narrowed_to_what_was_asked(self):
+        _, _, result, _ = self.run(output=["videos"])
+        assert list(result) == ["videos"]
+        _, latents, single, _ = self.run(output="latents")
+        assert single.shape == latents.shape
+
+    def test_blocks_are_restored_when_a_tile_fails(self):
+        pipeline = FakePipeline()
+        pipeline.__class__ = type(
+            "Failing", (FakePipeline,), {"__call__": lambda self, **kw: 1 / 0}
+        )
+        arguments = {
+            "latents": torch.zeros(CANVAS),
+            REFINE_TILES_INPUT: {"width": 1344, "height": 768, "overlap": 256},
+        }
+        with pytest.raises(ZeroDivisionError):
+            run_tiled_refine(pipeline, arguments, "step", decode=lambda c: c)
+        assert pipeline._blocks == "full"
+
+
+class TestTileLoopReporting:
+    def test_tiles_report_no_decoding_and_the_canvas_decode_reports_one(self):
+        from dw.events import RunContext, activate_context, deactivate_context
+        from dw.pipeline_processors import progress
+
+        follows = []
+
+        class Recording(FakePipeline):
+            def __call__(self, **kwargs):
+                follows.append(progress._DECODE_FOLLOWS.get())
+                return super().__call__(**kwargs)
+
+        collected = []
+        token = activate_context(RunContext(on_event=collected.append))
+        try:
+            run_tiled_refine(
+                Recording(),
+                {
+                    "latents": torch.zeros(CANVAS),
+                    REFINE_TILES_INPUT: {"width": 1344, "height": 768, "overlap": 256},
+                },
+                "step",
+                decode=lambda canvas: [["frame"]],
+            )
+        finally:
+            deactivate_context(token)
+        # The text encode may report a decode-free loop either way; the
+        # tiles never do
+        assert follows[-len(PLAN) :] == [False] * len(PLAN)
+        assert progress._DECODE_FOLLOWS.get() is True
+        phases = [e.get("phase") for e in collected if e["event"] == "phase"]
+        assert phases == ["decoding"]
+
+    def test_the_videos_carry_h3s_frame_rate(self):
+        """Bare frame lists play at the writer's 8 fps: pair_audio fed the
+        tiled step's videos wrote a 15.5 s file of a 5.17 s take."""
+        _, _, result, _ = TestTileLoop().run(output=["videos"])
+        videos = result["videos"]
+        assert videos.fps == 24
+        assert all(video.fps == 24 for video in videos)
+        assert videos == [["frame"]]
+
+    def test_pair_audio_plays_the_tiled_videos_at_24_fps(self):
+        import numpy
+
+        from dw.tasks.pair_audio import pair_audio
+
+        _, _, result, _ = TestTileLoop().run(output=["videos"])
+        paired = pair_audio(
+            result["videos"], numpy.zeros((2, 48000), numpy.float32), sample_rate=48000
+        )
+        paired = paired[0] if isinstance(paired, list) else paired
+        assert paired.fps == 24
+
+    def test_the_videos_are_dws_one_frame_list(self):
+        """One rate-carrying frame list, beside AudioVideo: the tiled
+        refine's videos are the type `load_video` answers, not a second
+        class of the same name."""
+        from dw import media_types
+        from dw.tasks import video_utils
+
+        assert video_utils.FrameList is media_types.FrameList
+        _, _, result, _ = TestTileLoop().run(output=["videos"])
+        videos = result["videos"]
+        assert type(videos) is media_types.FrameList
+        assert all(type(video) is media_types.FrameList for video in videos)
+
+    def test_the_frame_rate_survives_the_worker_queue(self):
+        import pickle
+
+        _, _, result, _ = TestTileLoop().run(output=["videos"])
+        videos = pickle.loads(pickle.dumps(result["videos"]))
+        assert videos.fps == 24 and videos[0].fps == 24
diff --git a/tests/test_h3_upscaler_source.py b/tests/test_h3_upscaler_source.py
index 8e3a1d8b8..25695efdd 100644
--- a/tests/test_h3_upscaler_source.py
+++ b/tests/test_h3_upscaler_source.py
@@ -10,7 +10,8 @@
 import pytest
 import torch
 
-from dw.locations import location_errors, validate_weight_name
+from dw.locations import location_errors
+from dw.security import validate_weight_name
 from dw.security import InvalidInputError, PathTraversalError
 from dw.trust import TRUST_WORKFLOWS_ENV_VAR
 from dw.tasks import h3_latent_upscale
diff --git a/tests/test_h3_vram_ceiling.py b/tests/test_h3_vram_ceiling.py
index f7bdae508..8ff062098 100644
--- a/tests/test_h3_vram_ceiling.py
+++ b/tests/test_h3_vram_ceiling.py
@@ -248,3 +248,19 @@ def test_ltx2_text_to_video_refuses_361_frames():
         workflow = _load(os.path.join(TEMPLATES_DIR, "ltx2", "text-to-video.json"))
         errors = _vram_errors(workflow.validation_errors(arguments={"num_frames": 361}))
         assert len(errors) == 1
+
+
+def test_ltx2_upscale_clip_projects_past_24gb_at_1080p_but_not_at_1344x768():
+    """#1050: 1920x1088x129 OOMed on a 3090 while validate said clean."""
+    import json
+
+    path = os.path.join(TEMPLATES_DIR, "ltx2", "upscale-clip.json")
+    with open(path) as handle:
+        estimate = json.load(handle)["vram_estimate"]
+
+    def projected(width, height, frames):
+        voxels = width * height * frames
+        return estimate["base_gb"] + voxels * estimate["bytes_per_voxel"] / 2**30
+
+    assert projected(1344, 768, 129) <= 24
+    assert projected(1920, 1088, 129) > 24
diff --git a/tests/test_inherited_cost.py b/tests/test_inherited_cost.py
index 882cd0d25..614ffba8f 100644
--- a/tests/test_inherited_cost.py
+++ b/tests/test_inherited_cost.py
@@ -13,7 +13,7 @@
 
 import pytest
 
-import dw.plan
+import dw.plan_downloads
 from dw.plan import build_plan
 from dw.server.observed_cost import observed_for
 from dw.server.routes.jobs import _inherited_cost_warnings
@@ -237,7 +237,7 @@ def test_the_estimate_is_inherited_and_the_validate_answer_warns(self, tmp_path)
         candidate = workflow_from_definition(
             definition("inline"), str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             plan = build_plan(
                 candidate,
                 {"num_frames": 124},
@@ -273,6 +273,19 @@ def test_several_steps_scale_by_step_count(self):
         assert block["inherited_from"] == "templates/t"
         assert "3 steps, template measured 1" in block["scaled"]
 
+    def test_the_model_load_is_paid_once_across_steps(self):
+        # cold 8 min, warm 6: a 2 min load plus 6 min of work per step (#1037)
+        history = {
+            "templates/t": [
+                run(8 * MINUTE, {"num_frames": 124}),
+                run(6 * MINUTE, {"num_frames": 124}, had_load=False),
+            ]
+        }
+        inline = definition("inline")
+        inline["steps"] = [{**inline["steps"][0], "id": f"shot{n}"} for n in range(2)]
+        block = inherited(inline, self.CATALOG, history)
+        assert block["cold_minutes"] == pytest.approx(14.0)
+
     def test_a_longer_frame_count_scales_by_frames(self):
         inline = definition("inline")
         inline["variables"] = {}
@@ -307,7 +320,7 @@ def test_the_plan_reports_the_reason_and_low_confidence(self, tmp_path):
         candidate = workflow_from_definition(
             inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             plan = build_plan(
                 candidate,
                 {},
@@ -400,7 +413,7 @@ def test_the_plan_quotes_it_low_confidence(self, tmp_path):
         candidate = workflow_from_definition(
             inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             plan = build_plan(
                 candidate,
                 {},
@@ -449,7 +462,7 @@ def test_the_plan_carries_the_withheld_reason(self, tmp_path):
             inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
         withheld = {"inherited_from": "templates/t", "withheld": "not priced: why"}
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             plan = build_plan(
                 candidate,
                 {},
@@ -464,6 +477,39 @@ def test_the_plan_carries_the_withheld_reason(self, tmp_path):
         assert "withheld" in _inherited_cost_warnings(estimate)[0]
 
 
+class TestTaskOnlyWorkflowSaysWhyUnpriced:
+    """#948: a workflow of task steps has no pipeline identity to inherit a
+    price from, and its unknown estimate says so."""
+
+    def test_the_plan_names_the_reason(self, tmp_path):
+        inline = {
+            "id": "stems",
+            "steps": [
+                {
+                    "id": "split",
+                    "task": {"command": "separate_stems", "arguments": {}},
+                }
+            ],
+        }
+        candidate = workflow_from_definition(
+            inline, str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
+            plan = build_plan(candidate, {}, device="cpu", lookup_sizes=False)
+        estimate = plan["estimate"]
+        assert estimate["basis"] == "unknown" and estimate["minutes"] is None
+        assert "separate_stems" in estimate["unpriced_reason"]
+        assert "task-only" in estimate["unpriced_reason"]
+
+    def test_a_pipeline_workflow_gets_no_task_only_reason(self, tmp_path):
+        candidate = workflow_from_definition(
+            definition("inline"), str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
+            plan = build_plan(candidate, {}, device="cpu", lookup_sizes=False)
+        assert "unpriced_reason" not in plan["estimate"]
+
+
 def sized(name, steps=9, width=960, height=544, **extra):
     """`definition` whose step also sets inference steps and a canvas."""
     workflow = definition(name, **extra)
@@ -535,7 +581,7 @@ def test_the_plan_quotes_it_inherited_and_scaled(self, tmp_path):
         candidate = workflow_from_definition(
             inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             estimate = build_plan(
                 candidate,
                 {},
@@ -590,7 +636,7 @@ def test_the_plan_flags_it_low_confidence(self, tmp_path):
         candidate = workflow_from_definition(
             inline, str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             estimate = build_plan(
                 candidate,
                 {},
@@ -629,7 +675,9 @@ def planned(definition, observed):
             candidate = workflow_from_definition(
                 definition, str(tmp_path), str(tmp_path), str(tmp_path)
             )
-            with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+            with patch.object(
+                dw.plan_downloads, "scan_models", return_value={"repos": []}
+            ):
                 return build_plan(
                     candidate,
                     self.ARGUMENTS,
@@ -732,7 +780,7 @@ def test_a_client_round_trip_differs_in_nothing(self, tmp_path):
         candidate = workflow_from_definition(
             copy, str(tmp_path), str(tmp_path), str(tmp_path)
         )
-        with patch.object(dw.plan, "scan_models", return_value={"repos": []}):
+        with patch.object(dw.plan_downloads, "scan_models", return_value={"repos": []}):
             estimate = build_plan(
                 candidate,
                 {},
diff --git a/tests/test_job_history_parity.py b/tests/test_job_history_parity.py
new file mode 100644
index 000000000..a687d3a04
--- /dev/null
+++ b/tests/test_job_history_parity.py
@@ -0,0 +1,58 @@
+"""A job taken through `JobHistory.record` reads back the keys a live job
+serves: a field added to `Job.summary()`/`detail()` and missed on the history
+side fails here rather than going silently absent from `get_job` after a
+restart."""
+
+import pytest
+
+from dw.server.job_history import JobHistory
+from dw.server.job_record import Job
+
+# The one place the two sides are allowed to differ. Live-only: the poll state
+# a finished job no longer has. History-only: the marker, the rerun spec in
+# detail, and the run location
+# `JobManager.list` takes off before serving.
+LIVE_ONLY = {"progress", "cancel_requested", "waiting_for"}
+HISTORY_ONLY_SUMMARY = {"historical", "_run_dir", "_output_dir"}
+HISTORY_ONLY_DETAIL = {"historical", "spec"}
+
+
+def _job(**extra):
+    job = Job(
+        {
+            "workflow_name": "w",
+            "catalog_name": "w",
+            "arguments": {"prompt": "a cat"},
+            "workspace": "default",
+            **extra,
+        }
+    )
+    job.status = "succeeded"
+    job.started_at = 10.0
+    job.finished_at = 70.0
+    job.run_id = "run-1"
+    job.run_dir = "/tmp/run-1"
+    job.run_version = 3
+    job.device_ordinal = "cuda:1"
+    job.device_card = "NVIDIA GeForce RTX 3090"
+    return job
+
+
+@pytest.mark.parametrize(
+    "extra",
+    [{}, {"note": "a test", "rerun_of": "abc123def456"}],
+    ids=["optional-unset", "optional-set"],
+)
+def test_history_serves_the_keys_a_live_job_does(tmp_path, extra):
+    job = _job(**extra)
+    history = JobHistory(tmp_path / "jobs.sqlite")
+    history.record(job)
+
+    (summary,) = history.recent_summaries()
+    detail = history.get(job.id)
+
+    assert set(summary) - HISTORY_ONLY_SUMMARY == set(job.summary()) - LIVE_ONLY
+    assert set(detail) - HISTORY_ONLY_DETAIL == set(job.detail()) - LIVE_ONLY
+    for key, value in job.summary().items():
+        assert summary[key] == value, key
+        assert detail[key] == value, key
diff --git a/tests/test_locations.py b/tests/test_locations.py
index 2d8414f07..36f80093d 100644
--- a/tests/test_locations.py
+++ b/tests/test_locations.py
@@ -865,3 +865,85 @@ def test_a_record_handed_on_as_a_dict_is_left_alone(
     ):
         definition = self._step(command, key, {"mode": "crop"})
         assert location_errors(definition, base_dir=workflow_dir) == []
+
+
+class TestOwnOutputHint:
+    """#951: a bare manifest file name is refused with `output:` as the fix."""
+
+    def test_bare_name_of_an_own_output_names_the_output_reference(
+        self, untrusted, workflow_dir
+    ):
+        from dw import runs
+
+        with tempfile.TemporaryDirectory() as outputs:
+            sub = os.path.join(outputs, "wf", "run")
+            os.makedirs(sub)
+            _image(os.path.join(sub, "a.png"))
+            token = runs.activate_output_root(outputs)
+            try:
+                with pytest.raises(PathTraversalError) as refusal:
+                    validate_media_path("wf/run/a.png", None, "an image argument")
+            finally:
+                runs.deactivate_output_root(token)
+        assert "output:wf/run/a.png" in str(refusal.value)
+
+    def test_validate_refuses_a_bare_own_output_name_with_the_hint(
+        self, untrusted, workflow_dir
+    ):
+        """The tester's repro: check-script's input_audio given a manifest
+        file name without its prefix fails validation, not the run."""
+        import shutil
+
+        from dw import runs
+        from dw.workflow import workflow_from_file
+
+        template = os.path.join(workflow_dir, "check-script.json")
+        shutil.copy(
+            os.path.join(
+                os.path.dirname(__file__),
+                "..",
+                "workflows",
+                "templates",
+                "check-script.json",
+            ),
+            template,
+        )
+        with tempfile.TemporaryDirectory() as outputs:
+            sub = os.path.join(outputs, "cut", "run", "final")
+            os.makedirs(sub)
+            with open(os.path.join(sub, "episode.mp4"), "wb") as f:
+                f.write(b"\0")
+            token = runs.activate_output_root(outputs)
+            try:
+                workflow = workflow_from_file(template, outputs)
+                bare = workflow.validation_errors(
+                    {"input_audio": "cut/run/final/episode.mp4", "lines": ["x"]}
+                )
+                prefixed = workflow.validation_errors(
+                    {
+                        "input_audio": "output:cut/run/final/episode.mp4",
+                        "lines": ["x"],
+                    }
+                )
+            finally:
+                runs.deactivate_output_root(token)
+        messages = [e["message"] for e in bare if e["path"].endswith(".audio")]
+        assert messages, bare
+        assert "'output:cut/run/final/episode.mp4'" in messages[0]
+        assert not [e for e in prefixed if e["path"].endswith(".audio")], prefixed
+
+    def test_validate_keeps_a_bare_name_beside_the_workflow(
+        self, untrusted, workflow_dir
+    ):
+        _image(os.path.join(workflow_dir, "a.png"))
+        definition = {"steps": [{"name": "s", "arguments": {"image": "a.png"}}]}
+        assert location_errors(definition, None, workflow_dir) == []
+
+    def test_validate_refuses_a_bare_name_that_resolves_nowhere(
+        self, untrusted, workflow_dir
+    ):
+        definition = {"steps": [{"name": "s", "arguments": {"image": "no-such.png"}}]}
+        errors = location_errors(definition, None, workflow_dir)
+        assert len(errors) == 1, errors
+        assert "no file by that name is beside the workflow" in errors[0]["message"]
+        assert "output:" not in errors[0]["message"]
diff --git a/tests/test_lora_disable.py b/tests/test_lora_disable.py
index 34cfeca7b..ec924d65f 100644
--- a/tests/test_lora_disable.py
+++ b/tests/test_lora_disable.py
@@ -130,6 +130,18 @@ def test_the_caller_is_told_where_they_switched_it_off(self, tmp_path):
         assert disabled[0].startswith("arguments.lora_model_name: ")
         assert "num_inference_steps" in disabled[0]
 
+    def test_no_undertrained_warning_once_the_schedule_is_raised(self, tmp_path):
+        raised = {
+            "lora_model_name": None,
+            "num_inference_steps": 12,
+            "video_shift": 12.0,
+            "audio_shift": 3.0,
+        }
+        warnings = validation.run_warning_check(
+            h3_workflow(tmp_path), "adapter_warnings", raised
+        )
+        assert not [w for w in warnings if "not loaded" in w]
+
     def test_nothing_is_said_when_the_lora_is_on(self, tmp_path):
         warnings = validation.run_warning_check(
             h3_workflow(tmp_path), "adapter_warnings", None
diff --git a/tests/test_mcp_client.py b/tests/test_mcp_client.py
index a8264e320..f1bf13536 100644
--- a/tests/test_mcp_client.py
+++ b/tests/test_mcp_client.py
@@ -444,7 +444,7 @@ def handler(request):
 ACKNOWLEDGE = {"fingerprint": "sha256:abc", "minutes": None, "downloads": ["org/model"]}
 
 
-def _cost_gate_message(minutes, acknowledge=ACKNOWLEDGE):
+def _cost_gate_message(minutes, acknowledge=ACKNOWLEDGE, downloads=None):
     """The 409 the cost gate raises, formatted the way an MCP caller reads
     it. `acknowledge` is the ready-made body the server sends (None: an
     older server that sends none)."""
@@ -453,7 +453,7 @@ def _cost_gate_message(minutes, acknowledge=ACKNOWLEDGE):
         "plan": {
             "fingerprint": "sha256:abc",
             "estimate": {"minutes": minutes, "basis": "none"},
-            "downloads_required": [{"repo": "org/model"}],
+            "downloads_required": downloads or [{"repo": "org/model"}],
         },
     }
     if acknowledge is not None:
@@ -485,6 +485,19 @@ def test_an_older_server_without_an_acknowledgement_gets_no_resend_sentence():
     assert "12.5 minutes" in message
 
 
+def test_a_file_entry_renders_as_repo_slash_filename():
+    downloads = [
+        {"repo": "org/whole", "gb": 3.5},
+        {"repo": "org/model", "filename": "sub/w.safetensors", "revision": None},
+        {"repo": None, "url": "https://example.com/w.pth"},
+    ]
+    message = _cost_gate_message(None, downloads=downloads)
+    assert (
+        "would download org/whole, org/model/sub/w.safetensors, "
+        "https://example.com/w.pth first"
+    ) in message
+
+
 class TrackingStream(httpx.SyncByteStream):
     def __init__(self, chunks):
         self.chunks = chunks
diff --git a/tests/test_mcp_server.py b/tests/test_mcp_server.py
index a609dd8e8..8f4965207 100644
--- a/tests/test_mcp_server.py
+++ b/tests/test_mcp_server.py
@@ -1554,156 +1554,26 @@ def test_the_stated_tool_count_is_the_registered_one():
 
 
 # Chars / 4, the way COMPACT_BUDGET in tests/test_catalog_structure.py is
-# measured. This is not a listing an agent chooses to read - it is resident
-# for the whole session before a single call, which is why it gets a ceiling
-# at all and why the catalog listing, read once, has had one since #101.
-# Measured 2026-09-19 at 13_225 before the list_prompts rewrite that landed
-# in the same plan (descriptions 9_013, input schemas 3_212, instructions
-# 999), and at 13_421 after it (9_138 / 3_283 / 1_000) - the three filter
-# parameters and the docstring that says what the library is for. Set at
-# 13_800, which is room for a tool or two and not room for a second
-# validate_workflow. Those figures were taken on Python 3.14, which dedents
-# docstrings at compile time; on 3.12 the same surface measured 14_574
-# (descriptions 10_281) until `tool()` began passing the cleandoc'd
-# docstring as the description, since then 13_474 (9_181 / 3_293 / 1_000)
-# on either interpreter. Measure on the interpreter CI runs, or on both.
-# Worth knowing before raising it: four tools are a quarter of the
-# descriptions (validate_workflow 774, wait_for_job 518, list_workflows 482,
-# list_gallery 445), and validate_workflow's `plan.basis` taxonomy and
-# wait_for_job's stall-diagnosis paragraph are both restated in
-# WORKFLOW_GUIDE's "The loop" - which an agent fetches on demand. The
-# question to ask first is whether the second copy has to be the resident one.
-# Measured 2026-09-20 at 14_017 (9_386 / 3_618 / 1_014) after
-# get_output_frames (#193, #210) - a `seams`/`boundaries`/`names` shape whose
-# 971-char input schema alone is most of what a "tool or two" bought. Paid
-# for, per the paragraph above, by actually cutting the two restated copies
-# rather than raising the ceiling: wait_for_job's stall-diagnosis paragraph
-# and validate_workflow's `plan.basis` taxonomy moved to WORKFLOW_GUIDE's
-# "The loop" (steps 4 and 5), leaving a pointer plus the pinned words other
-# tests still check for. Landed at 13_741 (9_110 / 3_618 / 1_014) - back
-# under the original ceiling with room to spare.
-# Measured 2026-09-20 at 13_784 (9_153 / 3_618 / 1_014) after
-# get_output_frames's docstring grew a sentence saying where `boundaries`
-# comes from before stage 2 (`shots` on the artifact) exists - the running
-# sum of `get_gallery_metadata`'s `frame_count` for each shot. 16 tokens of
-# headroom left; the next docstring change here should measure again rather
-# than assume it still fits.
-# Measured 2026-09-20 at 13_799.5 (9_144.5 / 3_641 / 1_014) after
-# get_output_frames gained `hear` (soundtrack around each `at` moment, one
-# AudioContent per tile that has one). Paid for by tightening two
-# sentences: `get_output_frames`'s "(seconds, or "frame:N")" lost its
-# comma, and `get_output_audio`'s "The text part reports the track's
-# length and, for an excerpt, exactly what was cut, so a slice is never
-# mistaken for the whole." shortened to "The text part says what was cut."
-# 0.5 tokens of headroom left; the next docstring change here should
-# measure again rather than assume it still fits.
-# Merging feat/193-evidence into develop combined this branch's tightened
-# get_output_audio/get_output_frames text with develop's own independent
-# `crop` addition to get_output_image - two branches each under budget on
-# their own pushed the merged surface to 13_937, since neither could see
-# the other's growth. Paid for by cutting get_output_image's redundant
-# "Images only: ..." cross-reference sentence (the other two tools already
-# say where images live), shortening get_output_image's and
-# get_output_audio's `workspace` sentence to the terse form
-# get_output_frames already used ("pins this call to another workspace"),
-# and trimming a few more words from get_output_image's crop/downscale
-# sentences. Measured 2026-09-20 at 13_796.2 (9_110.8 / 3_671.5 / 1_014.0)
-# post-merge. 3.8 tokens of headroom left; a merge that touches tool
-# docstrings on both sides needs to measure again, not just each side's
-# own pre-merge figure.
-# #279/#280/#282 grew get_gallery_metadata's docstring (the peak_dbfs
-# thresholds and a resolvable guide pointer) by ~92 tokens without
-# measuring, to 13_888. Paid for inside the same docstring: the workspace
-# sentence to the terse "pins this call" form, and the envelope and asset
-# paragraphs said in fewer words with every fact kept. Measured 2026-09-21
-# at 13_760.5 (9_075.0 / 3_671.5 / 1_014.0). 39.5 tokens of headroom left.
-# run_workflow's `wait_seconds` and delete_output's `job_id` (two schema
-# parameters, ~50 tokens, plus the sentences that explain them) first
-# measured at 14_097. Paid for inside the three docstrings they touch:
-# run_workflow's wait paragraph said once and tersely, its spelling /
-# arguments / workspace sentences shortened with every fact kept,
-# wait_for_job's cap paragraph and stall sentence said in fewer words
-# (the pinned phrases stay), delete_output's "leaves the workspace as you
-# found it" clause dropped. Measured 2026-09-21 at 13_796.75 (9_061.5 /
-# 3_721.25 / 1_014.0). 3.25 tokens of headroom left; measure again before
-# the next docstring change.
-# #303 gave get_output_frames a `crop` parameter (parity with
-# get_output_image, applied per sampled tile before the aggregate
-# shrink) - the schema growth alone first measured at 13_884. Paid for
-# across all three media docstrings: get_output_frames' selector and
-# boundaries sentences said in fewer words, get_output_image's crop/
-# downscale sentence tightened, and get_output_audio's intro and
-# envelope sentences shortened (still passing "WAV"/"own encoding").
-# Measured 2026-09-21 at 13_798.25 (9_032.5 / 3_751.75 / 1_014.0). 1.75
-# tokens of headroom left; measure again before the next docstring change.
-# The tester's #303 bounce (crop coordinates depended on max_dimension, and
-# a count-mode crop was checked against the assembled sheet rather than the
-# source frame) needed a docstring correction on top of that: get_output_
-# frames' and get_output_image's crop sentences now say "cut ... before the
-# downscale" without the old space-filling clause, which pushed descriptions
-# over budget first (13_820). Measured 2026-09-21 at 13_790.8 (9_025.0 /
-# 3_751.8 / 1_014.0). 9.2 tokens of headroom left.
-# Run versions added four sentences to list_gallery teaching `version` and
-# `run_id` - the handle for naming one of several runs that wrote the same
-# basename, which is the one thing the surface could not say before. Written
-# as tightly as it can be said and still 44 tokens over, so the budget takes
-# them deliberately rather than the sentence being cut to nothing. Measured
-# 2026-09-22 at 13_844.0 (9_078.0 / 3_752.0 / 1_014.0). 6 tokens of headroom.
-# Then list_gallery took `folder` and `version`, so "show me v5" is one call
-# rather than a scan of the listing. The docstring paid for its own new
-# sentence and then some (descriptions 9_078 -> 9_068, the `url` sentence
-# said in fewer words); the two schema entries (+49) are what the budget
-# takes, since no docstring can pay for a parameter's schema. Measured
-# 2026-09-22 at 13_883.0 (9_068.0 / 3_801.0 / 1_014.0). 7 tokens of headroom.
-# #376 moved model narrative out of the resident descriptions, each fact
-# still stated where an agent reads it on demand: get_output_audio's
-# transcription walkthrough to WORKFLOW_GUIDE's "The loop" step 6 (a pointer
-# stays), and the H3 frame-grid example (validate_workflow, list_workflows),
-# the family list (list_prompts) and get_job_events' silent-phase examples
-# dropped, every rule kept. Measured 2026-09-24 at 13_883.0 before (9_529.0 /
-# 3_845.75 / 508.25 - the instructions and descriptions split differently
-# from the entry above, the total agrees) and 13_670.5 after (9_316.5 /
-# 3_845.75 / 508.25). The ceiling stays: the 219.5 tokens of headroom are
-# reserved for #388 (`assess_output`), which raises it only by any remainder.
-# #388 spent it on the assess_output tool (description + schema). The design's
-# optional pointer in the instructions' loop did not fit the client's 2_048
-# character cap on instructions, so get_gallery_metadata's hint carries it.
-# Measured 2026-09-24 at 13_849.5 (9_395.0 / 3_946.25 / 508.25); the ceiling
-# stays, 40.5 of headroom.
-# 2026-10-03: the LoRA catalog added list_loras, save_lora and
-# recommend_loras - measured at 14_255.0 (9_398.5 / 4_345.75 / 510.75); the
-# ceiling moves to 14_265 with 10 of headroom.
-# 2026-10-07 (#682): get_job and list_jobs name a job's `device`, paid for by
-# trimming their own text - measured at 14_264.75; the ceiling stays.
-# 2026-10-11 (#828 stage A): get_server_info's one clause on `caches` (16
-# tokens) - measured 14_246.25 before and 14_262.25 after (9_281.75 /
-# 4_470.25 / 510.25). Text trimmed since 10-07 left room, so the ceiling
-# stays, 2.75 of headroom.
-# 2026-10-13 (#859, #853 stage A): copy_to_workspace (121.25 description +
-# 84.75 schema) - measured at 14_470.25 (9_276.25 / 4_683.75 / 510.25); the
-# ceiling moves to 14_471 with 0.75 of headroom.
-# 2026-10-13 (#859 bounce): set_note, documented since the notes feature but
-# never registered, is registered (66.75 description + 83.25 schema) -
-# measured at 14_620.25 (9_343 / 4_767 / 510.25); the ceiling moves to
-# 14_621 with 0.75 of headroom.
-# 2026-10-13 (#860, #853 stage B): copy_to_workspace takes assets (its
-# description names them; the schema gains the parameter, runs optional) -
-# measured at 14_699.5 (9_381 / 4_808 / 510.5); the ceiling moves to 14_700
-# with 0.5 of headroom.
-# 2026-10-13 (#885, #867 stage 1): get_job's description names a manifest
-# entry's `timing` and the guide section for it (+28.5 description) - measured
-# at 14_728 (9_409.5 / 4_808.25 / 510.25); the ceiling moves to 14_728 with
-# none to spare.
-# 2026-10-14 (#889, #871 stage A): compare_outputs (60.75 description +
-# 200.75 schema - `crop` is one box or one per name) - measured at 14_989.25
-# (9_470 / 5_009 / 510.25); the ceiling moves to 14_990 with 0.75 of headroom.
-# 2026-10-14 (#886, #867 stage 2): get_job_events' description names the
-# `cache_stats` kind (+15 description) - measured at 15_004.25 (9_485 /
-# 5_009 / 510.25); the ceiling moves to 15_005 with 0.75 of headroom.
-# 2026-10-15 (#922): get_gallery_metadata gains `include_workflow` and says an
-# image's `media` is its measured size (+46) - measured at 15_051.25; the
-# ceiling moves to 15_052 with 0.75 of headroom.
-SURFACE_BUDGET = 15_052
+# measured: the descriptions, input schemas and instructions a client can hold
+# resident for the whole session before a single call. A client that defers
+# tool schemas (Claude Code loads only the names until a tool is searched for)
+# pays far less than this, but not every client does, so the ceiling stays.
+#
+# A fixed ceiling with headroom, not a ratchet. Until 2026-10-19 it was raised
+# to each new measurement plus a token or less, so every docstring change paid
+# for itself by trimming another tool's sentences - about twenty rounds of it
+# (this file's history has each one) - and at least once the trim took the
+# pointer an agent needed (#574 re-broke #282). Measured 2026-10-19 at
+# 15_051.75 (65 tools); the ceiling is set at 16_000, about one large tool's
+# worth of room.
+#
+# What a description holds: what the tool does, when to use it, the pinned
+# words other tests check for, and a pointer to the guide section with the
+# rest - never a second copy of that section. Pointers are checked to resolve
+# in tests/test_guide_pointers.py. When this fails, move narrative to a guide
+# and leave a pointer before raising the ceiling; raise it in a step of the
+# same size when a new tool genuinely needs the room, and say why here.
+SURFACE_BUDGET = 16_000
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_modular_output_properties.py b/tests/test_modular_output_properties.py
index 330aa4621..4e64a2961 100644
--- a/tests/test_modular_output_properties.py
+++ b/tests/test_modular_output_properties.py
@@ -188,17 +188,60 @@ def reference_step(self):
             },
             "result": {
                 "content_type": "video/mp4",
-                "fps": FPS,
                 "subfolder": "intermediate",
             },
         }
 
+    def base_as_the_step_hands_it_on(self):
+        """The base step's result as Step.run leaves it: the raw output dict
+        after `_run_once` stamped the pipeline's own frame rate on it."""
+        from types import SimpleNamespace
+
+        from dw.output_extraction import attach_video_frame_rate
+
+        result = Result({})
+        output = attach_video_frame_rate(SimpleNamespace(fps=FPS), modular_output())
+        result.add_result(output)
+        return result
+
     def test_the_guide_names_the_reference_step(self):
         text = GUIDE.read_text()
         section = text[text.index(HEADING) :]
         section = section[: section.index("\n### ", 1)]
         assert '"video": "previous_result:base.videos"' in section
-        assert '"fps": 24' in section
+        # The take carries H3's rate, so the recipe no longer has to declare
+        # one on the result - and must not say that doing so fixes the fit
+        # (#1056)
+        assert "result's `fps`" not in section
+        assert "carry" in section and "24 fps" in section
+
+    def test_the_base_take_pairs_at_its_own_rate_with_no_padding(self):
+        """#1056: the guide's recipe wrote a 15.5 s file of a 5.17 s take -
+        the frames carried no rate, so `fit` padded the track to 124 frames
+        at 8 fps, and `result.fps: 24` only re-timed the picture afterwards."""
+        from dw.events import RunContext, activate_context, deactivate_context
+
+        warnings = []
+        token = activate_context(
+            RunContext(
+                on_event=lambda e: (
+                    warnings.append(e["message"]) if e["event"] == "warning" else None
+                )
+            )
+        )
+        try:
+            step = self.reference_step()
+            (arguments,) = get_iterations(
+                step["task"]["arguments"], {"base": self.base_as_the_step_hands_it_on()}
+            )
+            paired = pair_audio(**arguments)
+        finally:
+            deactivate_context(token)
+
+        assert paired.fps == FPS
+        assert paired.audio.shape[1] == int(FRAME_COUNT / FPS * SAMPLE_RATE)
+        assert warnings == []
+        assert Result(step["result"]).video_fps(paired) == FPS
 
     def test_the_base_videos_save_as_one_mp4_with_its_frames_and_audio(self, tmp_path):
         import av
diff --git a/tests/test_modular_progress.py b/tests/test_modular_progress.py
index 40a74d19f..766d99511 100644
--- a/tests/test_modular_progress.py
+++ b/tests/test_modular_progress.py
@@ -341,3 +341,29 @@ def test_a_container_that_chooses_one_block_is_left_alone():
 
     assert pipeline.ran == ["video"]
     assert _logs(events) == []
+
+
+def _phases_of_a_loop(decode_follows):
+    from dw.events import activate_context, deactivate_context
+    from dw.pipeline_processors.progress import decoded_later, reported_progress_bars
+
+    collected = []
+    token = activate_context(RunContext(on_event=collected.append))
+    try:
+        pipeline = FakeModularPipeline()
+        with reported_progress_bars(pipeline):
+            if decode_follows:
+                pipeline()
+            else:
+                with decoded_later():
+                    pipeline()
+    finally:
+        deactivate_context(token)
+    return [e.get("phase") for e in collected if e["event"] == "phase"]
+
+
+def test_a_loop_the_decode_does_not_follow_reports_no_decoding():
+    """A tiled refine's tiles (#1048): the decode comes once, after the blend,
+    so the end of each tile's loop is not 'decoding'."""
+    assert _phases_of_a_loop(decode_follows=True) == ["decoding"]
+    assert _phases_of_a_loop(decode_follows=False) == []
diff --git a/tests/test_notes_api.py b/tests/test_notes_api.py
index 703903fed..4fb1924d8 100644
--- a/tests/test_notes_api.py
+++ b/tests/test_notes_api.py
@@ -152,6 +152,37 @@ def test_put_file_and_run_note_and_read_back(client, output_root, make_run):
     }
 
 
+def test_metadata_reads_the_run_notes_once(client, output_root, make_run, monkeypatch):
+    """The file's note and the run's come from one notes.json read, through
+    `output_annotations`, so the metadata route never reads it a second time
+    for `run_note`; the listing takes the same fields and shows no run_note."""
+    from dw.server import outputs
+    from dw.server.routes import media
+
+    run_dir = make_run("wf", ["a.png"])
+    run = run_name(run_dir, output_root)
+    N.set_run_note(run_dir, "shift 3 vs 5")
+    reads = []
+
+    def counted(directory):
+        reads.append(directory)
+        return N.read_notes(directory)
+
+    monkeypatch.setattr(outputs, "read_notes", counted)
+    monkeypatch.setattr(media, "read_notes", counted)
+
+    meta = client.get(f"/api/gallery/{run}/a.png/metadata").json()
+    assert (meta["note"], meta["run_note"], meta["note_source"]) == (
+        "shift 3 vs 5",
+        "shift 3 vs 5",
+        "run",
+    )
+    assert reads == [run_dir]
+    listed = {f["label"]: f for f in client.get("/api/gallery").json()["files"]}
+    assert listed["a.png"]["note"] == "shift 3 vs 5"
+    assert "run_note" not in listed["a.png"]
+
+
 def test_a_file_without_its_own_note_answers_with_the_run_note(
     client, output_root, make_run
 ):
diff --git a/tests/test_observed_cost.py b/tests/test_observed_cost.py
index b08ed037f..58a71466a 100644
--- a/tests/test_observed_cost.py
+++ b/tests/test_observed_cost.py
@@ -648,6 +648,10 @@ def test_orphaning_removes_only_that_workspace_and_name(self, tmp_path):
     "workflows/templates/upscale-spandrel.json": "cost follows the input image",
     # Three prompt edits over one image: nothing numeric moves the run.
     "workflows/templates/consistent-set.json": "no variable moves the cost",
+    # One LaMa pass (after one segment pass) over the image handed to it:
+    # `dilate` grows the mask, not the work, so nothing moves the run (#974).
+    "workflows/templates/remove-object.json": "cost follows the input image",
+    "workflows/templates/segment-and-remove.json": "cost follows the input image",
 }
 
 
@@ -1044,3 +1048,18 @@ def test_a_row_recorded_with_the_fields_counts_by_its_card(
         costs = self._costs(history, monkeypatch, default=True)
 
         assert costs.observed("templates/x", workflow())["runs"] == 1
+
+
+class TestRecentRuns:
+    def test_the_median_follows_the_newest_runs_not_the_whole_history(self):
+        """A box that got faster stops quoting its old speed (#1037)."""
+        definition = workflow(["num_frames"], num_frames=124)
+        old = [run(8 * MINUTE, finished_at=1_700_000_000.0 + day) for day in range(20)]
+        new = [run(4 * MINUTE, finished_at=1_800_000_000.0 + day) for day in range(5)]
+        # Handed over oldest-last on purpose: the order must not matter
+        observed = observed_for(definition, new + old, arguments={})
+        assert observed["cold_minutes"] == 4.0
+        assert observed["cold_runs"] == 25
+        assert observed["cold_range_minutes"] == [4.0, 8.0]
+        shuffled = observed_for(definition, old + new, arguments={})
+        assert shuffled["cold_minutes"] == 4.0
diff --git a/tests/test_outbound.py b/tests/test_outbound.py
index 151c6d969..b86814445 100644
--- a/tests/test_outbound.py
+++ b/tests/test_outbound.py
@@ -33,7 +33,8 @@ class _EchoHandler(http.server.BaseHTTPRequestHandler):
     bytes; /nolength streams 1000 bytes with no Content-Length; /trickle
     sends 50 declared bytes one at a time; /method echoes the method and the
     body length it received. /hop redirects to /ok; /loop to itself;
-    /internal to the metadata address; /elsewhere 307s to /auth (which
+    /internal to the metadata address; /to-file to a file: URL; /forbidden
+    answers 403; /elsewhere 307s to /auth (which
     echoes Authorization) under another name for the same server;
     /to-port/N 307s to /auth on this host at port N; /see-other, /found and /temporary answer 303, 302 and 307 to /method.
     /slow-headers starts a header and adds a byte every 0.2 s, never
@@ -61,6 +62,7 @@ def _answer(self):
             "/hop": (302, f"{here}/ok"),
             "/loop": (302, f"{here}/loop"),
             "/internal": (302, "http://169.254.169.254/latest/meta-data/"),
+            "/to-file": (302, "file:///etc/hosts"),
             "/see-other": (303, f"{here}/method"),
             "/found": (302, f"{here}/method"),
             "/temporary": (307, f"{here}/method"),
@@ -78,6 +80,11 @@ def _answer(self):
             return self._redirect(f"http://localhost:{port}/auth", status=307)
         if path.startswith("/trickle"):
             return self._trickle()
+        if path.startswith("/forbidden"):
+            self.send_response(403)
+            self.send_header("Content-Length", "0")
+            self.end_headers()
+            return
         if path.startswith("/slow-headers"):
             return self._slow_headers()
         if path.startswith("/host"):
@@ -423,9 +430,53 @@ def test_a_redirect_to_an_internal_address_is_refused(
 
         port = local_server.split(":")[1]
         _scripted(monkeypatch, {"media.example": [["127.0.0.1"]]})
-        with pytest.raises(InvalidInputError, match="inside this deployment"):
+        with pytest.raises(InvalidInputError, match="inside this deployment") as e:
             safe_get(f"http://media.example:{port}/internal", timeout=5)
         assert _EchoHandler.seen == ["/internal"]
+        # #1055: a tester reading the job's error must be able to tell a
+        # refused hop from an upstream failure - the message says it was a
+        # redirect, and names both the refused target and the URL asked for
+        message = str(e.value)
+        assert message.startswith(
+            "Refusing a redirect to 'http://169.254.169.254/latest/meta-data/' "
+            f"(from 'http://media.example:{port}/internal'): "
+        )
+
+    def test_a_redirect_to_another_scheme_names_the_target(
+        self, untrusted, local_server, server_is_public, monkeypatch
+    ):
+        """A hop to `file:` fails the scheme rule before the host policy
+        runs; that refusal used to read 'URL scheme not allowed: file' with
+        no target and no word of a redirect (#1055)."""
+        from dw.outbound import safe_get
+
+        port = local_server.split(":")[1]
+        _scripted(monkeypatch, {"media.example": [["127.0.0.1"]]})
+        with pytest.raises(InvalidInputError) as e:
+            safe_get(f"http://media.example:{port}/to-file", timeout=5)
+        message = str(e.value)
+        assert message.startswith(
+            "Refusing a redirect to 'file:///etc/hosts' "
+            f"(from 'http://media.example:{port}/to-file'): "
+        )
+        assert "scheme not allowed: file" in message
+        assert _EchoHandler.seen == ["/to-file"]
+
+    def test_an_error_status_on_the_first_hop_is_the_upstream_error(
+        self, untrusted, local_server, server_is_public, monkeypatch
+    ):
+        """A 403 from the URL itself (what httpbin's redirect-to answered
+        in #1055) stays requests' own HTTPError, and says nothing about a
+        redirect - the two failures must read differently."""
+        import requests
+
+        from dw.outbound import safe_get
+
+        port = local_server.split(":")[1]
+        _scripted(monkeypatch, {"media.example": [["127.0.0.1"]]})
+        with pytest.raises(requests.HTTPError, match="403 Client Error") as e:
+            safe_get(f"http://media.example:{port}/forbidden", timeout=5)
+        assert "redirect" not in str(e.value).lower()
 
     @pytest.mark.parametrize(
         "path, answer",
diff --git a/tests/test_pipeline_components.py b/tests/test_pipeline_components.py
index 1cb2d1a4c..c4302e73b 100644
--- a/tests/test_pipeline_components.py
+++ b/tests/test_pipeline_components.py
@@ -1020,3 +1020,74 @@ def test_a_failed_load_leaves_the_step_definition_as_it_was(self):
 
         assert step["pipeline"]["loras"] == before["pipeline"]["loras"]
         assert "generator" not in step["pipeline"]["arguments"]
+
+
+class TestVideoFrameRate:
+    """A pipeline that knows its own frame rate (MiniMax-H3's `fps` property)
+    hands its `videos` on carrying it, so `previous_result:base.videos` reaches
+    pair_audio and the writer as 24 fps frames rather than bare lists played
+    at the 8 fps fallback (#1056)."""
+
+    def _pipeline(self, **attributes):
+        from types import SimpleNamespace
+
+        return SimpleNamespace(**attributes)
+
+    def test_a_dict_outputs_videos_carry_the_pipelines_rate(self):
+        from dw.media_types import FrameList
+        from dw.output_extraction import attach_video_frame_rate
+
+        output = {"videos": [["frame"]], "audio": [0.0]}
+        attached = attach_video_frame_rate(self._pipeline(fps=24), output)
+
+        assert attached is output
+        assert type(output["videos"]) is FrameList and output["videos"].fps == 24
+        assert all(
+            type(video) is FrameList and video.fps == 24 for video in output["videos"]
+        )
+        assert output["videos"] == [["frame"]]
+
+    def test_an_output_objects_videos_carry_the_pipelines_rate(self):
+        from types import SimpleNamespace
+
+        from dw.output_extraction import attach_video_frame_rate
+
+        output = SimpleNamespace(videos=[["frame"]])
+        attach_video_frame_rate(self._pipeline(fps=24), output)
+
+        assert output.videos.fps == 24 and output.videos[0].fps == 24
+
+    def test_a_single_videos_output_is_handed_back_rated(self):
+        from dw.output_extraction import attach_video_frame_rate
+
+        output = attach_video_frame_rate(
+            self._pipeline(fps=24), [["frame"]], requested="videos"
+        )
+
+        assert output.fps == 24 and output[0].fps == 24
+
+    def test_a_pipeline_with_no_rate_leaves_the_lists_bare(self):
+        from dw.output_extraction import attach_video_frame_rate
+
+        output = {"videos": [["frame"]]}
+        attach_video_frame_rate(self._pipeline(), output)
+
+        assert type(output["videos"]) is list
+
+    def test_an_array_of_videos_is_left_as_it_is(self):
+        import numpy
+
+        from dw.output_extraction import attach_video_frame_rate
+
+        videos = numpy.zeros((1, 2, 4, 4, 3))
+        output = {"videos": videos}
+        attach_video_frame_rate(self._pipeline(fps=24), output)
+
+        assert output["videos"] is videos
+
+    def test_an_output_with_no_videos_is_untouched(self):
+        from dw.output_extraction import attach_video_frame_rate
+
+        output = {"latents": [1.0]}
+        assert attach_video_frame_rate(self._pipeline(fps=24), output) is output
+        assert output == {"latents": [1.0]}
diff --git a/tests/test_plan.py b/tests/test_plan.py
index 9c1c6dc14..c39929c7f 100644
--- a/tests/test_plan.py
+++ b/tests/test_plan.py
@@ -84,13 +84,15 @@ def output_root(tmp_path):
 def plan(tmp_path, prompt_library, output_root, monkeypatch):
     """build_plan over the fixture, with the hub cache empty and the hub
     unreachable, so downloads never touch the network in these tests."""
-    import dw.plan
+    import dw.plan_downloads
 
     def offline(*a, **k):
         raise RuntimeError("offline")
 
-    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
-    monkeypatch.setattr(dw.plan, "model_info", offline)
+    monkeypatch.setattr(
+        dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+    )
+    monkeypatch.setattr(dw.plan_downloads, "model_info", offline)
 
     def make(spec=None, arguments=None, **overrides):
         spec = definition() if spec is None else spec
@@ -1667,14 +1669,16 @@ def test_a_repo_not_in_the_cache_is_required(self, plan):
         ]
 
     def test_a_cached_repo_is_not(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan,
+            dw.plan_downloads,
             "scan_models",
             lambda cache_dir=None: {"repos": [{"repo_id": "org/still-model"}]},
         )
-        monkeypatch.setattr(dw.plan, "repo_download_incomplete", lambda *a, **k: False)
+        monkeypatch.setattr(
+            dw.plan_downloads, "repo_download_incomplete", lambda *a, **k: False
+        )
         assert plan()["downloads_required"] == []
 
     def test_a_present_but_incomplete_repo_is_still_required(self, plan, monkeypatch):
@@ -1682,10 +1686,10 @@ def test_a_present_but_incomplete_repo_is_still_required(self, plan, monkeypatch
         revision folder in place) but whose snapshot is missing files the
         load needs stays in downloads_required rather than reading as
         cached."""
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan,
+            dw.plan_downloads,
             "scan_models",
             lambda cache_dir=None: {"repos": [{"repo_id": "org/still-model"}]},
         )
@@ -1695,7 +1699,9 @@ def fake_incomplete(name, cache_dir, variant=None):
             seen.append((name, variant))
             return True
 
-        monkeypatch.setattr(dw.plan, "repo_download_incomplete", fake_incomplete)
+        monkeypatch.setattr(
+            dw.plan_downloads, "repo_download_incomplete", fake_incomplete
+        )
         assert plan()["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1707,7 +1713,7 @@ def fake_incomplete(name, cache_dir, variant=None):
         assert seen == [("org/still-model", None)]
 
     def test_cache_dir_reaches_scan_models(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         seen = []
 
@@ -1715,7 +1721,7 @@ def spy(cache_dir=None):
             seen.append(cache_dir)
             return {"repos": []}
 
-        monkeypatch.setattr(dw.plan, "scan_models", spy)
+        monkeypatch.setattr(dw.plan_downloads, "scan_models", spy)
         plan(cache_dir="/somewhere")
         assert seen == ["/somewhere"]
 
@@ -1791,8 +1797,177 @@ def test_components_and_children_are_scanned_and_deduplicated(self, plan, tmp_pa
             "org/vae",
         ]
 
+    @pytest.mark.parametrize(
+        "override, expected",
+        [
+            ("org/other", ["org/still-model", "org/other"]),
+            (
+                {"transformer_ref": "org/other", "vae": "org/vae"},
+                ["org/still-model", "org/other", "org/vae"],
+            ),
+            ({"default": "org/other"}, ["org/still-model", "org/other"]),
+            ({"default": "org/still-model"}, ["org/still-model"]),
+            (None, ["org/still-model"]),
+        ],
+    )
+    def test_a_load_components_repo_override_is_listed(self, plan, override, expected):
+        """#981: the string, per-component and default forms, deduplicated
+        against model_name, and unchanged when the key is absent."""
+        spec = definition()
+        if override is not None:
+            spec["steps"][0]["pipeline"]["load_components"] = {
+                "pretrained_model_name_or_path": override
+            }
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == expected
+
+    def test_task_steps_list_the_repos_their_commands_declare(self, plan):
+        """#975: an image processor (remove_background) and a registered
+        command (segment) both name their weights, after the pipeline's."""
+        spec = definition()
+        spec["steps"] += [
+            {
+                "name": "cutout",
+                "task": {"command": "remove_background", "arguments": {}},
+                "result": {"content_type": "image/png"},
+            },
+            {
+                "name": "mask",
+                "task": {"command": "segment", "arguments": {"prompt": "a cup"}},
+                "result": {"content_type": "image/png"},
+            },
+        ]
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model",
+            "briaai/RMBG-2.0",
+            "IDEA-Research/grounding-dino-base",
+            "facebook/sam2-hiera-large",
+        ]
+
+    def test_a_task_override_replaces_the_default_repo(self, plan):
+        spec = definition()
+        spec["steps"].append(
+            {
+                "name": "mask",
+                "task": {
+                    "command": "segment",
+                    "arguments": {"model_name": "org/dino", "sam_model_name": None},
+                },
+            }
+        )
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model",
+            "org/dino",
+            "facebook/sam2-hiera-large",
+        ]
+
+    def test_a_repo_a_pipeline_and_a_task_both_load_is_listed_once(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"]["model_name"] = (
+            "openai/whisper-base"
+        )
+        spec["steps"].append(
+            {
+                "name": "words",
+                "task": {"command": "transcribe_audio", "arguments": {}},
+            }
+        )
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "openai/whisper-base"
+        ]
+
+    def test_two_task_steps_naming_one_repo_list_it_once(self, plan):
+        spec = definition()
+        spec["steps"] += [
+            {"name": "a", "task": {"command": "transcribe_audio", "arguments": {}}},
+            {"name": "b", "task": {"command": "check_script", "arguments": {}}},
+        ]
+        repos = [d["repo"] for d in plan(spec)["downloads_required"]]
+        assert repos == ["org/still-model", "openai/whisper-base"]
+
+    def test_a_task_argument_that_is_a_reference_or_a_path_is_not_listed(self, plan):
+        for local in ("previous_result:detector", "/models/dino", "./models/dino"):
+            spec = definition()
+            spec["steps"].append(
+                {
+                    "name": "mask",
+                    "task": {
+                        "command": "segment",
+                        "arguments": {"model_name": local, "sam_model_name": local},
+                    },
+                }
+            )
+            assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+                "org/still-model"
+            ], local
+
+    def test_a_cached_task_repo_is_not_required(self, plan, monkeypatch):
+        import dw.plan_downloads
+
+        monkeypatch.setattr(
+            dw.plan_downloads,
+            "scan_models",
+            lambda cache_dir=None: {
+                "repos": [
+                    {"repo_id": "org/still-model"},
+                    {"repo_id": "briaai/RMBG-2.0"},
+                ]
+            },
+        )
+        monkeypatch.setattr(
+            dw.plan_downloads, "repo_download_incomplete", lambda *a, **k: False
+        )
+        spec = definition()
+        spec["steps"].append(
+            {"name": "cutout", "task": {"command": "remove_background"}}
+        )
+        assert plan(spec)["downloads_required"] == []
+
+    def test_a_hook_that_raises_costs_its_entries_and_not_the_plan(
+        self, plan, monkeypatch
+    ):
+        import dw.tasks.registry
+
+        def exploding(command):
+            def hook(arguments):
+                raise RuntimeError("hook broke")
+
+            return hook
+
+        monkeypatch.setattr(dw.tasks.registry, "required_weights_hook", exploding)
+        spec = definition()
+        spec["steps"].append(
+            {"name": "mask", "task": {"command": "segment", "arguments": {}}}
+        )
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model"
+        ]
+
+    def test_a_composed_childs_task_step_contributes_its_repo(self, plan, tmp_path):
+        spec = definition()
+        child = {
+            "id": "child",
+            "steps": [
+                {
+                    "name": "c",
+                    "task": {
+                        "command": "segment",
+                        "arguments": {"model_name": "org/child-dino"},
+                    },
+                }
+            ],
+        }
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        spec["steps"].append(
+            {"name": "sub", "workflow": {"path": "child.json", "arguments": {}}}
+        )
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model",
+            "org/child-dino",
+            "facebook/sam2-hiera-large",
+        ]
+
     def test_sizes_come_from_the_hub_in_gib(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         class Sibling:
             def __init__(self, size):
@@ -1808,7 +1983,7 @@ def fake_model_info(name, **kwargs):
             calls.append((name, kwargs))
             return Info()
 
-        monkeypatch.setattr(dw.plan, "model_info", fake_model_info)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", fake_model_info)
         answer = plan(lookup_sizes=True)["downloads_required"]
         assert answer == [
             {
@@ -1823,7 +1998,7 @@ def fake_model_info(name, **kwargs):
         assert calls[0][1]["timeout"] == 5.0
 
     def test_a_gated_repo_this_token_may_access_is_not_blocked(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         class Sibling:
             rfilename = "config.json"
@@ -1832,8 +2007,10 @@ class Info:
             siblings = [Sibling()]
             gated = "manual"
 
-        monkeypatch.setattr(dw.plan, "model_info", lambda name, **k: Info())
-        monkeypatch.setattr(dw.plan, "get_hf_file_metadata", lambda url, **k: object())
+        monkeypatch.setattr(dw.plan_downloads, "model_info", lambda name, **k: Info())
+        monkeypatch.setattr(
+            dw.plan_downloads, "get_hf_file_metadata", lambda url, **k: object()
+        )
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1847,7 +2024,7 @@ def test_a_gated_repo_this_token_lacks_access_to_is_blocked(
         self, plan, monkeypatch
     ):
         import httpx
-        import dw.plan
+        import dw.plan_downloads
         from huggingface_hub.utils import GatedRepoError
 
         response = httpx.Response(403, request=httpx.Request("GET", "https://hf.co/x"))
@@ -1862,8 +2039,8 @@ class Info:
         def boom(*a, **k):
             raise GatedRepoError("no access", response=response)
 
-        monkeypatch.setattr(dw.plan, "model_info", lambda name, **k: Info())
-        monkeypatch.setattr(dw.plan, "get_hf_file_metadata", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", lambda name, **k: Info())
+        monkeypatch.setattr(dw.plan_downloads, "get_hf_file_metadata", boom)
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1875,7 +2052,7 @@ def boom(*a, **k):
 
     def test_a_gated_repo_model_info_itself_refuses_is_blocked(self, plan, monkeypatch):
         import httpx
-        import dw.plan
+        import dw.plan_downloads
         from huggingface_hub.utils import GatedRepoError
 
         response = httpx.Response(403, request=httpx.Request("GET", "https://hf.co/x"))
@@ -1883,7 +2060,7 @@ def test_a_gated_repo_model_info_itself_refuses_is_blocked(self, plan, monkeypat
         def boom(*a, **k):
             raise GatedRepoError("no access", response=response)
 
-        monkeypatch.setattr(dw.plan, "model_info", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", boom)
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1894,13 +2071,13 @@ def boom(*a, **k):
         ]
 
     def test_a_gated_repo_with_no_probeable_file_is_unknown(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         class Info:
             siblings = []
             gated = "auto"
 
-        monkeypatch.setattr(dw.plan, "model_info", lambda name, **k: Info())
+        monkeypatch.setattr(dw.plan_downloads, "model_info", lambda name, **k: Info())
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1913,7 +2090,7 @@ class Info:
     def test_a_gate_probe_failing_for_an_unrelated_reason_is_unknown(
         self, plan, monkeypatch
     ):
-        import dw.plan
+        import dw.plan_downloads
 
         class Sibling:
             rfilename = "config.json"
@@ -1925,8 +2102,8 @@ class Info:
         def boom(*a, **k):
             raise RuntimeError("offline")
 
-        monkeypatch.setattr(dw.plan, "model_info", lambda name, **k: Info())
-        monkeypatch.setattr(dw.plan, "get_hf_file_metadata", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", lambda name, **k: Info())
+        monkeypatch.setattr(dw.plan_downloads, "get_hf_file_metadata", boom)
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1937,12 +2114,12 @@ def boom(*a, **k):
         ]
 
     def test_a_hub_failure_is_a_null_size(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         def boom(*a, **k):
             raise RuntimeError("offline")
 
-        monkeypatch.setattr(dw.plan, "model_info", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", boom)
         assert plan(lookup_sizes=True)["downloads_required"] == [
             {
                 "repo": "org/still-model",
@@ -1953,12 +2130,12 @@ def boom(*a, **k):
         ]
 
     def test_lookup_sizes_false_never_calls_the_hub(self, plan, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         def boom(*a, **k):
             raise AssertionError("must not be called")
 
-        monkeypatch.setattr(dw.plan, "model_info", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", boom)
         plan(lookup_sizes=False)
 
 
@@ -2119,17 +2296,19 @@ def definition(self):
         }
 
     def repos(self, present, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan,
+            dw.plan_downloads,
             "scan_models",
             lambda cache_dir=None: {"repos": [{"repo_id": name} for name in present]},
         )
-        monkeypatch.setattr(dw.plan, "repo_download_incomplete", lambda *a, **k: False)
+        monkeypatch.setattr(
+            dw.plan_downloads, "repo_download_incomplete", lambda *a, **k: False
+        )
         return [
             entry["repo"]
-            for entry in dw.plan.downloads_required(
+            for entry in dw.plan_downloads.downloads_required(
                 self.definition(), None, None, None, False
             )
         ]
diff --git a/tests/test_plugin_skills.py b/tests/test_plugin_skills.py
index be3c3cad5..f649a1bdd 100644
--- a/tests/test_plugin_skills.py
+++ b/tests/test_plugin_skills.py
@@ -151,6 +151,7 @@ def test_every_catalog_name_a_skill_quotes_resolves(path):
 SKILL_TASKS = {
     "minimax-music3": ["attribute_voices"],
     "minimax-h3": ["join_into_song", "slice_audio", "normalize_audio", "pair_audio"],
+    "script-to-video": ["concat_videos"],
     "series-episodes": ["apply_lut", "film_grain", "concat_videos", "loop_audio"],
 }
 
@@ -470,14 +471,20 @@ def test_the_dialogue_into_a_song_recipe_is_the_task_s_and_the_guide_s(self):
         assert workflow.validation_errors() == []
 
     def test_the_locked_frame_lip_sync_recipe_names_real_task_types(self):
-        """#852: a locked frame that lip-syncs is Ref2VA with a first-frame
-        keyframe and the song held. The task types are MiniMax's, which the
+        """#985: a locked frame that lip-syncs is FL2VA with the song held,
+        which keeps the pixels; #852's Ref2VA with a first-frame keyframe and
+        the song held is the fallback. "FL2VA takes no audio" was false as
+        stated, and stays out. The task types are MiniMax's, which the
         built-in Context-IR enhancer teaches, and `hold_audio` is the argument
         music-video's ref2va step takes, so a rename of either fails here."""
-        body = skill_body(H3_SKILL)
+        body = " ".join(skill_body(H3_SKILL).split())
+        assert "FL2VA takes no audio" not in body
+        assert (
+            "FL2VA with the song held by `hold_audio` keeps the first frame's pixels"
+            in body
+        )
         task = "[keyframe completion + audio reuse]"
-        assert f"`{task}`" in body
-        assert "FL2VA takes no audio" in body
+        assert f"Fallback: Ref2VA `{task}`" in body
         assert "`hold_audio`" in body
 
         enhancer = os.path.join(REPO_ROOT, "dw", "workflows", "h3_context_ir.json")
diff --git a/tests/test_reference_limits.py b/tests/test_reference_limits.py
index 30d8bbf37..217223052 100644
--- a/tests/test_reference_limits.py
+++ b/tests/test_reference_limits.py
@@ -128,7 +128,12 @@ def test_an_audio_only_shot_is_refused_before_the_run(self):
                 "references": [reference(AUDIO)],
             }
         ]
-        errors = self._template().validation_errors({"shots": shots})
+        errors = [
+            e
+            for e in self._template().validation_errors({"shots": shots})
+            # the placeholder file name resolves nowhere, which is its own error
+            if not e["path"].endswith(".from_file")
+        ]
         assert len(errors) == 1
         assert errors[0]["path"].endswith("pipeline.arguments.references")
         assert "shot@audio_only" in errors[0]["message"]
diff --git a/tests/test_remove_object.py b/tests/test_remove_object.py
new file mode 100644
index 000000000..879e59f95
--- /dev/null
+++ b/tests/test_remove_object.py
@@ -0,0 +1,353 @@
+"""remove_object (#956): prompt-free LaMa removal.
+
+The mask is binarized, resized and dilated here, an all-black mask returns the
+input without loading a model, and only the masked region comes from the
+network. The weights are a Hub repo and a safetensors file, refused otherwise
+at validation and again in the loader, and they must load as a masked image
+model. No test downloads the real weights: a stub descriptor stands in for
+LaMa, and the wrong-architecture case uses a tiny real spandrel network."""
+
+from unittest import mock
+
+import numpy as np
+import pytest
+import torch
+from PIL import Image, ImageDraw
+
+from dw.locations import location_errors
+from dw.security import InvalidInputError, PathTraversalError
+from dw.task_domains import task_argument_errors
+from dw.tasks import model_cache, remove_object as remover
+from dw.tasks.remove_object import (
+    DEFAULT_REMOVER_REPO,
+    DEFAULT_REMOVER_WEIGHTS,
+    EMPTY_MASK_WARNING,
+    REMOVER_REVISION,
+    prepare_mask,
+    remove_object,
+)
+from dw.tasks.task import Task
+from dw.media_types import AudioVideo
+
+PICKLES = ["big-lama.pt", "big-lama.ckpt", "big-lama.bin", "big-lama.pth"]
+LOCAL_PATHS = ["/tmp/lama", "./weights", "../lama", "~/lama"]
+
+
+def photo(size=(64, 48)):
+    """A two-tone image with a red square in the middle - the 'object'."""
+    image = Image.new("RGB", size, (40, 120, 200))
+    draw = ImageDraw.Draw(image)
+    draw.rectangle((0, size[1] * 3 // 4, size[0], size[1]), fill=(200, 180, 90))
+    w, h = size
+    draw.rectangle((w // 2 - 4, h // 2 - 4, w // 2 + 4, h // 2 + 4), fill=(255, 0, 0))
+    return image
+
+
+def square_mask(size=(64, 48), box=None, value=255):
+    w, h = size
+    mask = Image.new("L", size, 0)
+    ImageDraw.Draw(mask).rectangle(
+        box or (w // 2 - 5, h // 2 - 5, w // 2 + 5, h // 2 + 5), fill=value
+    )
+    return mask
+
+
+class StubDescriptor:
+    """Stands in for spandrel's LaMa descriptor: records what it is handed and
+    returns solid green, so any changed pixel is visibly the model's."""
+
+    def __init__(self):
+        self.calls = []
+
+    def __call__(self, image, mask):
+        self.calls.append((image, mask))
+        out = torch.zeros_like(image)
+        out[:, 1] = 1.0
+        return out
+
+
+@pytest.fixture
+def stub():
+    descriptor = StubDescriptor()
+    with mock.patch.object(remover, "_load_remover", return_value=descriptor) as load:
+        descriptor.load = load
+        yield descriptor
+
+
+def step(arguments, command="remove_object"):
+    return {
+        "name": "erase",
+        "task": {
+            "command": command,
+            "arguments": {
+                "image": "previous_result:photo",
+                "mask_image": "previous_result:mask",
+                **arguments,
+            },
+        },
+    }
+
+
+class TestTheMask:
+    def test_binarized_at_128(self):
+        mask = Image.new("L", (4, 1))
+        mask.putdata([0, 127, 128, 255])
+        assert list(prepare_mask(mask, (4, 1), dilate=0).get_flattened_data()) == [
+            0,
+            0,
+            255,
+            255,
+        ]
+
+    def test_an_rgb_mask_is_read_as_grayscale(self):
+        mask = Image.new("RGB", (4, 4), (255, 255, 255))
+        assert prepare_mask(mask, (4, 4), dilate=0).mode == "L"
+        assert set(prepare_mask(mask, (4, 4), dilate=0).get_flattened_data()) == {255}
+
+    def test_resized_to_the_image_nearest(self):
+        mask = square_mask((32, 24), box=(16, 0, 31, 23))
+        out = prepare_mask(mask, (64, 48), dilate=0)
+        assert out.size == (64, 48)
+        assert set(out.get_flattened_data()) <= {0, 255}
+        arr = np.array(out)
+        assert arr[:, :32].max() == 0 and arr[:, 32:].min() == 255
+
+    def test_dilated_by_n_pixels(self):
+        mask = Image.new("L", (21, 21), 0)
+        mask.putpixel((10, 10), 255)
+        arr = np.array(prepare_mask(mask, (21, 21), dilate=3)) > 0
+        ys, xs = np.nonzero(arr)
+        assert (xs.min(), xs.max(), ys.min(), ys.max()) == (7, 13, 7, 13)
+
+    def test_dilate_zero_leaves_it_alone(self):
+        mask = square_mask()
+        assert np.array_equal(
+            np.array(prepare_mask(mask, mask.size, dilate=0)), np.array(mask)
+        )
+
+
+class TestAllBlack:
+    def test_returns_the_input_with_no_model_load(self):
+        image = photo()
+        with (
+            mock.patch.object(remover, "_load_remover") as load,
+            mock.patch.object(remover, "emit_warning") as warn,
+        ):
+            assert remove_object(image, Image.new("L", image.size, 0)) is image
+        load.assert_not_called()
+        warn.assert_called_once_with(EMPTY_MASK_WARNING)
+
+    def test_a_mask_below_the_threshold_is_all_black(self):
+        image = photo()
+        with mock.patch.object(remover, "_load_remover") as load:
+            assert remove_object(image, square_mask(value=127)) is image
+        load.assert_not_called()
+
+    def test_the_command_warns_once_for_a_video(self):
+        frames = AudioVideo([photo() for _ in range(3)], None, None, fps=12)
+        task = Task({"command": "remove_object", "arguments": {}}, "cpu")
+        with (
+            mock.patch.object(remover, "_load_remover") as load,
+            mock.patch("dw.events.emit_warning") as warn,
+        ):
+            out = task.run({"image": frames, "mask_image": Image.new("L", (64, 48))})
+        load.assert_not_called()
+        warn.assert_called_once_with(EMPTY_MASK_WARNING)
+        assert len(out.frames) == 3 and out.fps == 12
+
+
+class TestTheFill:
+    def test_outside_the_dilated_mask_is_unchanged(self, stub):
+        image = photo()
+        mask = square_mask()
+        out = remove_object(image, mask, dilate=2)
+        assert out.size == image.size
+        grown = np.array(prepare_mask(mask, image.size, dilate=2)) > 0
+        before, after = np.array(image), np.array(out)
+        assert np.array_equal(before[~grown], after[~grown])
+        # and inside it is the model's
+        assert (after[grown] == [0, 255, 0]).all()
+
+    def test_a_mismatched_mask_still_gives_the_images_size(self, stub):
+        image = photo((64, 48))
+        out = remove_object(image, square_mask((128, 96)))
+        assert out.size == (64, 48)
+        image_tensor, mask_tensor = stub.calls[0]
+        assert mask_tensor.shape == (1, 1, 48, 64)
+        assert image_tensor.shape == (1, 3, 48, 64)
+
+    def test_the_mask_sent_is_zero_or_one(self, stub):
+        remove_object(photo(), square_mask())
+        _, mask_tensor = stub.calls[0]
+        assert set(mask_tensor.unique().tolist()) == {0.0, 1.0}
+
+    @pytest.mark.parametrize("device", ["cpu", "cuda", "mps"])
+    def test_tensors_sent_are_fp32_on_every_device(self, stub, device):
+        moved = []
+
+        def fake_to_tensor(image, target, dtype=None):
+            moved.append((target, dtype))
+            arr = np.array(image.convert("RGB")).astype(np.float32) / 255.0
+            return torch.from_numpy(arr).permute(2, 0, 1).unsqueeze(0).to(dtype)
+
+        with mock.patch.object(remover, "pil_to_float_tensor", fake_to_tensor):
+            remove_object(photo(), square_mask(), device=device)
+        assert moved == [(device, torch.float32), (device, torch.float32)]
+        image_tensor, mask_tensor = stub.calls[0]
+        assert image_tensor.dtype == torch.float32
+        assert mask_tensor.dtype == torch.float32
+        assert stub.load.call_args.args[0] == device
+
+    def test_the_loaded_descriptor_is_made_fp32(self):
+        descriptor = mock.MagicMock()
+        model_cache.clear_model_cache()
+        with (
+            mock.patch("huggingface_hub.hf_hub_download", return_value="w"),
+            mock.patch("safetensors.torch.load_file", return_value={}),
+            mock.patch.object(
+                remover, "_descriptor_from_state_dict", return_value=descriptor
+            ),
+        ):
+            remover._load_remover("cpu", DEFAULT_REMOVER_REPO, DEFAULT_REMOVER_WEIGHTS)
+        model_cache.clear_model_cache()
+        descriptor.float.assert_called_once()
+        descriptor.half.assert_not_called()
+
+    def test_video_frames_keep_count_and_fps(self, stub):
+        frames = AudioVideo([photo() for _ in range(4)], None, None, fps=8)
+        task = Task({"command": "remove_object", "arguments": {}}, "cpu")
+        out = task.run({"image": frames, "mask_image": square_mask()})
+        assert len(out.frames) == 4 and out.fps == 8
+        assert len(stub.calls) == 4
+
+    def test_the_command_takes_the_tasks_device(self, stub, all_backends_available):
+        # The tensors stay on the CPU: this checks the device the remover is
+        # loaded on, and a runner's torch may not be built with mps at all
+        to_cpu = remover.pil_to_float_tensor
+        task = Task({"command": "remove_object", "arguments": {}}, "mps")
+        with mock.patch.object(
+            remover,
+            "pil_to_float_tensor",
+            side_effect=lambda image, device, dtype=None: to_cpu(image, "cpu", dtype),
+        ):
+            task.run({"image": photo(), "mask_image": square_mask()})
+        assert stub.load.call_args.args[0] == "mps"
+
+
+class TestTheWeights:
+    def test_the_pin_is_for_the_default_file_alone(self):
+        assert remover.remover_source({}) == (
+            DEFAULT_REMOVER_REPO,
+            DEFAULT_REMOVER_WEIGHTS,
+            REMOVER_REVISION,
+        )
+        assert remover.remover_source({"model_name": "biali/big-lama"}) == (
+            "biali/big-lama",
+            DEFAULT_REMOVER_WEIGHTS,
+            None,
+        )
+
+    def test_the_default_downloads_at_the_pin_and_is_cached(self):
+        descriptor = mock.MagicMock()
+        model_cache.clear_model_cache()
+        with (
+            mock.patch("huggingface_hub.hf_hub_download", return_value="w") as download,
+            mock.patch("safetensors.torch.load_file", return_value={}),
+            mock.patch.object(
+                remover, "_descriptor_from_state_dict", return_value=descriptor
+            ),
+        ):
+            for _ in range(2):
+                remover._load_remover(
+                    "cpu", DEFAULT_REMOVER_REPO, DEFAULT_REMOVER_WEIGHTS
+                )
+        assert download.call_count == 1
+        assert download.call_args.kwargs == {
+            "repo_id": DEFAULT_REMOVER_REPO,
+            "filename": DEFAULT_REMOVER_WEIGHTS,
+            "revision": REMOVER_REVISION,
+        }
+        assert model_cache._cache
+        model_cache.clear_model_cache()
+        assert not model_cache._cache
+
+    def test_wrong_architecture_is_refused(self):
+        from spandrel.architectures.Compact.__arch.SRVGG import SRVGGNetCompact
+
+        net = SRVGGNetCompact(num_feat=8, num_conv=2, upscale=2)
+        with pytest.raises(ValueError, match="inpainting model"):
+            remover._descriptor_from_state_dict(net.state_dict())
+
+    @pytest.mark.parametrize("name", PICKLES)
+    def test_a_pickle_weight_name_is_refused_in_the_loader(self, name):
+        with (
+            mock.patch("huggingface_hub.hf_hub_download") as download,
+            mock.patch.object(remover, "_load_remover") as load,
+        ):
+            with pytest.raises(InvalidInputError, match="safetensors"):
+                remove_object(photo(), square_mask(), weight_name=name)
+        download.assert_not_called()
+        load.assert_not_called()
+
+    @pytest.mark.parametrize("repo", LOCAL_PATHS)
+    def test_a_local_model_name_is_refused_in_the_loader(self, repo):
+        with mock.patch.object(remover, "_load_remover") as load:
+            with pytest.raises((InvalidInputError, PathTraversalError)):
+                remove_object(photo(), square_mask(), model_name=repo)
+        load.assert_not_called()
+
+
+class TestAtValidation:
+    def test_the_defaults_are_clean(self):
+        definition = {"steps": [step({})]}
+        assert location_errors(definition) == []
+        assert task_argument_errors(definition) == []
+
+    def test_named_defaults_are_clean(self):
+        definition = {
+            "steps": [
+                step(
+                    {
+                        "model_name": DEFAULT_REMOVER_REPO,
+                        "weight_name": DEFAULT_REMOVER_WEIGHTS,
+                        "dilate": 0,
+                    }
+                )
+            ]
+        }
+        assert location_errors(definition) == []
+        assert task_argument_errors(definition) == []
+
+    @pytest.mark.parametrize("name", PICKLES)
+    def test_a_pickle_weight_name_is_refused(self, name):
+        errors = location_errors({"steps": [step({"weight_name": name})]})
+        assert [e["path"] for e in errors] == ["steps[0].task.arguments.weight_name"]
+
+    @pytest.mark.parametrize("repo", LOCAL_PATHS)
+    def test_a_local_model_name_is_refused(self, repo):
+        errors = location_errors({"steps": [step({"model_name": repo})]})
+        assert [e["path"] for e in errors] == ["steps[0].task.arguments.model_name"]
+
+    @pytest.mark.parametrize("dilate", [-1, 2.5])
+    def test_a_bad_dilate_is_refused(self, dilate):
+        errors = task_argument_errors({"steps": [step({"dilate": dilate})]})
+        assert [e["path"] for e in errors] == ["steps[0].task.arguments.dilate"]
+
+    def test_a_traversing_mask_is_refused(self):
+        errors = location_errors(
+            {"steps": [step({"mask_image": "../../etc/mask.png"})]}
+        )
+        assert [e["path"] for e in errors] == ["steps[0].task.arguments.mask_image"]
+
+
+class TestRegistration:
+    def test_get_task_lists_the_arguments_and_defaults(self):
+        from dw.introspection import describe_task
+
+        params = {p["name"]: p for p in describe_task("remove_object")["parameters"]}
+        assert {"image", "mask_image", "dilate", "model_name", "weight_name"} <= set(
+            params
+        )
+        assert params["dilate"]["default"] == 8
+        assert params["model_name"]["default"] == DEFAULT_REMOVER_REPO
+        assert params["weight_name"]["default"] == DEFAULT_REMOVER_WEIGHTS
diff --git a/tests/test_roles.py b/tests/test_roles.py
index b85f7a9b7..8ef160b59 100644
--- a/tests/test_roles.py
+++ b/tests/test_roles.py
@@ -359,8 +359,27 @@ def test_an_unresolvable_reference_consumes_nothing(tmp_path, write_run):
         (FINAL, True, True, FINAL),
         (FINAL, False, False, FINAL),
         (INTERMEDIATE, False, True, INTERMEDIATE),
-        (None, False, True, None),
+        (None, False, True, INTERMEDIATE),
     ],
 )
 def test_listed_role(role, declared, consumed, listed):
     assert listed_role(role, declared, consumed) == listed
+
+
+@pytest.mark.parametrize(
+    "name, consumed, listed",
+    [
+        ("intermediate/clip.mp4", False, INTERMEDIATE),
+        ("intermediate/frames/0.png", False, INTERMEDIATE),
+        ("final/still.png", False, FINAL),
+        ("final/still.png", True, INTERMEDIATE),
+        ("shot.png", True, INTERMEDIATE),
+        ("shot.png", False, None),
+        ("final", False, None),
+        ("intermediate_frames/a.png", False, None),
+        (None, False, None),
+    ],
+)
+def test_listed_role_of_a_run_that_recorded_none(name, consumed, listed):
+    # A run from before roles: rule 2 from the file's subfolder, then rule 4
+    assert listed_role(None, False, consumed, name) == listed
diff --git a/tests/test_script_check.py b/tests/test_script_check.py
index f653f0a6c..517f45fdd 100644
--- a/tests/test_script_check.py
+++ b/tests/test_script_check.py
@@ -64,7 +64,7 @@ def words(text, start=0.0, step=0.5, length=0.4):
 def run(lines, chunks, mono=None, similarity=0.85, spans=None, shots_source="none"):
     if mono is None:
         end = max((c["end"] for c in chunks), default=1.0)
-        mono = voiced(end + 1.0)
+        mono = voiced(end + 0.5)
     return check(
         parse_lines(lines),
         chunks,
@@ -282,14 +282,18 @@ def test_loud_loop_is_discarded_as_repetition(self):
         ]
         heard, discarded = guard_words(chunks, voiced(5.0), RATE)
         self.assertEqual(heard, [])
-        self.assertEqual(len(discarded), 40)
-        self.assertEqual({d["reason"] for d in discarded}, {"repetition"})
+        self.assertEqual(len(discarded), 1)
+        self.assertEqual(discarded[0]["reason"], "repetition")
+        self.assertEqual(discarded[0]["count"], 40)
+        self.assertEqual(discarded[0]["start"], 0.0)
+        self.assertEqual(discarded[0]["end"], 3.9)
 
     def test_loop_over_music_is_not_speech_where_silent(self):
         chunks = words(" ".join(["pre"] * 30), step=0.1, length=0.0)
         answer = run([], chunks, voiced(5.0))
         self.assertEqual(answer["findings"], [])
-        self.assertEqual(len(answer["discarded"]), 30)
+        self.assertEqual(len(answer["discarded"]), 1)
+        self.assertEqual(answer["discarded"][0]["count"], 30)
 
     def test_short_real_repetition_stays_heard(self):
         chunks = words("no no no no no stop")
@@ -301,7 +305,8 @@ def test_period_two_loop_is_discarded(self):
         chunks = words(" ".join(["thank you"] * 6), step=0.3, length=0.2)
         heard, discarded = guard_words(chunks, voiced(5.0), RATE)
         self.assertEqual(heard, [])
-        self.assertEqual(len(discarded), 12)
+        self.assertEqual(len(discarded), 1)
+        self.assertEqual(discarded[0]["count"], 12)
 
     def test_loop_does_not_take_the_speech_around_it(self):
         chunks = (
@@ -313,7 +318,8 @@ def test_loop_does_not_take_the_speech_around_it(self):
         self.assertEqual(
             [h["word"] for h in heard], ["hello", "there", "good", "night"]
         )
-        self.assertEqual(len(discarded), 10)
+        self.assertEqual(len(discarded), 1)
+        self.assertEqual(discarded[0]["count"], 10)
 
     def test_loop_inside_one_chunk_is_discarded(self):
         chunks = [{"start": 0.0, "end": 3.0, "text": " Pre-pre-pre-pre-pre-pre-pre"}]
@@ -321,6 +327,42 @@ def test_loop_inside_one_chunk_is_discarded(self):
         self.assertEqual(heard, [])
         self.assertEqual(discarded[0]["reason"], "repetition")
 
+    def test_loop_over_a_scripted_line_keeps_its_first_take(self):
+        # #961: Whisper looped on the line it heard; the first take is real
+        chunks = words("how", 0.0) + words(
+            " ".join(["the lid is gone"] * 8), 1.0, step=0.3, length=0.2
+        )
+        answer = run(["the lid is gone"], chunks, voiced(12.0))
+        self.assertEqual(answer["lines"][0]["heard"], "the lid is gone")
+        self.assertEqual(answer["lines"][0]["similarity"], 1.0)
+        self.assertEqual(len(answer["discarded"]), 1)
+        self.assertEqual(answer["discarded"][0]["count"], 28)
+        loops = [f for f in answer["findings"] if f["rule"] == "transcript_loop"]
+        self.assertEqual(len(loops), 1)
+        self.assertEqual(loops[0]["value"], 32)
+        self.assertEqual(loops[0]["at"]["seconds"], 1.0)
+
+    def test_line_after_a_loop_is_not_transcribed_not_a_zero(self):
+        chunks = words("how", 0.0) + words(
+            " ".join(["the lid is gone"] * 8), 1.0, step=0.3, length=0.2
+        )
+        answer = run(["the lid is gone", "i wore it as a hat"], chunks, voiced(12.0))
+        line = answer["lines"][1]
+        self.assertIsNone(line["heard"])
+        self.assertIsNone(line["similarity"])
+        self.assertEqual(line["not_transcribed"], "transcript_loop")
+        rules = [f["rule"] for f in answer["findings"]]
+        self.assertNotIn("line_mismatch", rules)
+        self.assertIn("transcript_loop", rules)
+
+    def test_loop_of_unscripted_words_keeps_nothing_and_is_no_finding(self):
+        chunks = words(" ".join(["pre"] * 10), 1.0, step=0.1, length=0.05)
+        answer = run(["hello"], chunks, voiced(4.0))
+        self.assertEqual(answer["lines"][0]["heard"], "")
+        self.assertFalse(
+            [f for f in answer["findings"] if f["rule"] == "transcript_loop"]
+        )
+
     def test_below_floor_reason(self):
         mono = numpy.concatenate([voiced(1.0), silent(1.0)])
         _, discarded = guard_words(words("real", 0.0) + words("ghost", 1.2), mono, RATE)
@@ -544,7 +586,7 @@ def test_transcribes_with_word_timestamps_and_returns_the_answer(self):
             "text": " hello there",
             "chunks": words("hello there"),
         }
-        waveform = voiced(2.0)[numpy.newaxis, :]
+        waveform = voiced(1.4)[numpy.newaxis, :]
         with patch(
             "dw.tasks.audio_transcription.transcribe_audio", return_value=canned
         ) as transcribe:
@@ -578,8 +620,6 @@ def test_transcribes_with_word_timestamps_and_returns_the_answer(self):
 
 
 def shot_run(lines, chunks, mono=None, spans=SHOTS, source="argument"):
-    if mono is None:
-        mono = voiced(6.0)
     return run(lines, chunks, mono, spans=spans, shots_source=source)
 
 
@@ -593,6 +633,11 @@ def test_tagged_lines_carry_their_shot(self):
         answer = shot_run(
             [{"text": "alpha bravo", "shot": "A"}, {"text": "delta echo", "shot": "B"}],
             chunks,
+            # Silence after "echo" to the end of shot B: the word is not clipped
+            # (#953) and the tail holds no untranscribed sound (#970)
+            mono=numpy.concatenate(
+                [voiced(0.9), silent(2.6), voiced(1.0), silent(1.5)]
+            ),
         )
         self.assertEqual([x["shot"] for x in answer["lines"]], ["A", "B"])
         self.assertEqual(answer["findings"], [])
@@ -644,6 +689,48 @@ def test_a_line_spoken_twice_in_its_shot_is_a_finding(self):
         self.assertEqual(found["at"]["shot"], "A")
         self.assertTrue(found["at"]["repeats_line"])
 
+    def test_a_doubled_line_inside_a_longer_cut_is_a_finding(self):
+        # align alone keeps the second copy inside the line (similarity 0.75)
+        chunks = (
+            words("hal kettle froze", 0.0)
+            + words("then wear socks", 6.3)
+            + words("wear socks", 9.1)
+            + words("the kettle is whistling hal", 11.0)
+        )
+        lines = [
+            {"text": "Hal, the kettle froze.", "shot": "A"},
+            {"text": "Then wear socks.", "shot": "B"},
+            {"text": "The kettle is whistling, Hal.", "shot": "C"},
+        ]
+        spans = [
+            {"name": "A", "start": 0.0, "end": 5.0},
+            {"name": "B", "start": 5.0, "end": 10.3},
+            {"name": "C", "start": 10.3, "end": 16.0},
+        ]
+        answer = shot_run(lines, chunks, mono=voiced(16.0), spans=spans)
+        self.assertEqual(answer["lines"][1]["similarity"], 1.0)
+        (found,) = rules(answer, "unscripted_speech")
+        self.assertEqual(found["at"]["shot"], "B")
+        self.assertTrue(found["at"]["repeats_line"])
+        self.assertEqual([w["text"] for w in answer["unmatched"]], ["wear", "socks"])
+
+    def test_a_misheard_repeat_scoring_as_the_line_does_is_a_repeat(self):
+        # "hal" heard as "how" both times: 0.75 for the line, so also a repeat
+        chunks = words("how kettle froze now", 0.0, 0.2, 0.15) + words(
+            "how kettle froze now", 1.0, 0.2, 0.15
+        )
+        answer = run(
+            [{"text": "hal kettle froze now", "shot": "A"}],
+            chunks,
+            voiced(6.0),
+            similarity=0.6,
+            spans=SHOTS,
+            shots_source="argument",
+        )
+        self.assertEqual(answer["lines"][0]["similarity"], 0.75)
+        (found,) = rules(answer, "unscripted_speech")
+        self.assertTrue(found["at"]["repeats_line"])
+
     def test_an_ad_lib_in_a_scripted_shot_is_not_a_repeat(self):
         chunks = words("alpha bravo", 0.0) + words("zulu yankee", 1.0)
         answer = shot_run([{"text": "alpha bravo", "shot": "A"}], chunks)
@@ -661,7 +748,7 @@ class TestSpeechNotTranscribed(unittest.TestCase):
     def test_sound_in_a_gap_between_a_lines_words_is_a_finding(self):
         # The ASR dropped an ad-lib between "bravo" and "charlie"
         chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
-        answer = shot_run(self.LINES, chunks, mono=voiced(6.0))
+        answer = shot_run(self.LINES, chunks, mono=voiced(5.0))
         (found,) = rules(answer, "speech_not_transcribed")
         self.assertEqual(found["at"]["line"], 0)
         self.assertEqual(found["at"]["shot"], "A")
@@ -675,13 +762,13 @@ def test_a_stretched_word_over_sound_is_a_finding(self):
             {"start": 3.0, "end": 3.4, "text": " charlie"},
             {"start": 3.5, "end": 3.9, "text": " delta"},
         ]
-        answer = shot_run(self.LINES, chunks, mono=voiced(6.0))
+        answer = shot_run(self.LINES, chunks, mono=voiced(4.0))
         (found,) = rules(answer, "speech_not_transcribed")
         self.assertEqual(found["at"]["seconds"], 0.5)
 
     def test_a_quiet_gap_is_not(self):
         chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
-        mono = numpy.concatenate([voiced(0.9), silent(3.1), voiced(2.0)])
+        mono = numpy.concatenate([voiced(0.9), silent(3.1), voiced(1.0)])
         answer = shot_run(self.LINES, chunks, mono=mono)
         self.assertEqual(rules(answer, "speech_not_transcribed"), [])
 
@@ -690,6 +777,120 @@ def test_a_short_gap_is_not(self):
         answer = shot_run(self.LINES, chunks, mono=voiced(3.0))
         self.assertEqual(rules(answer, "speech_not_transcribed"), [])
 
+    TWO = [
+        {"text": "alpha bravo", "shot": "A"},
+        {"text": "charlie delta", "shot": "B"},
+    ]
+
+    def test_sound_between_two_lines_is_a_finding_in_its_shot(self):
+        # #960: the untranscribed stretch sits outside both lines' spans;
+        # #964: it is placed in the shot holding most of it (A), not the next line's
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
+        answer = shot_run(self.TWO, chunks, mono=voiced(5.0))
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertEqual(found["at"]["line"], 0)
+        self.assertEqual(found["at"]["shot"], "A")
+        self.assertAlmostEqual(found["at"]["seconds"], 0.9, places=2)
+        self.assertAlmostEqual(found["at"]["end"], 4.0, places=2)
+
+    def test_a_quiet_gap_between_lines_is_not(self):
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 4.0)
+        mono = numpy.concatenate([voiced(0.9), silent(3.1), voiced(1.0)])
+        answer = shot_run(self.TWO, chunks, mono=mono)
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+    def test_a_short_gap_between_lines_is_not(self):
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 1.5)
+        answer = shot_run(self.TWO, chunks, mono=voiced(3.0))
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+    def test_a_gap_holding_unmatched_words_is_unscripted_speech_only(self):
+        chunks = (
+            words("alpha bravo", 0.0)
+            + words("zulu yankee", 1.5)
+            + words("charlie delta", 4.0)
+        )
+        answer = shot_run(self.TWO, chunks, mono=voiced(5.0))
+        # Stray words 1.5-2.4; the 2.4-4.0 stretch after them is audible
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertAlmostEqual(found["at"]["seconds"], 2.4, places=2)
+
+    def test_a_gap_fully_covered_by_unmatched_words_is_unscripted_only(self):
+        chunks = (
+            words("alpha bravo", 0.0)
+            + words("zulu yankee xray whiskey", 0.9, step=0.5, length=0.5)
+            + words("charlie delta", 3.0)
+        )
+        answer = shot_run(self.TWO, chunks, mono=voiced(4.0))
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+    def test_audible_stretch_before_a_stray_word_is_a_finding(self):
+        # #964: a stray word late in the gap must not hide the stretch before it
+        chunks = (
+            words("alpha bravo", 0.0) + words("zulu", 4.0) + words("charlie delta", 6.0)
+        )
+        answer = shot_run(self.TWO, chunks, mono=voiced(7.0))
+        # the stretches on both sides of the stray word are findings
+        before, after = rules(answer, "speech_not_transcribed")
+        self.assertAlmostEqual(before["at"]["seconds"], 0.9, places=2)
+        self.assertAlmostEqual(before["at"]["end"], 4.0, places=2)
+        self.assertAlmostEqual(after["at"]["seconds"], 4.4, places=2)
+        # each is placed in the shot holding most of it, not the next line's
+        self.assertEqual((before["at"]["shot"], before["at"]["line"]), ("A", 0))
+        self.assertEqual((after["at"]["shot"], after["at"]["line"]), ("B", 1))
+
+    def test_only_the_audible_part_of_a_gap_sizes_and_places_the_finding(self):
+        # #967: the gap 0.9-5.0 is mostly silence in shot B; the audible 0.9-2.2
+        # sits in A and is all the finding counts
+        spans = [
+            {"name": "A", "start": 0.0, "end": 2.0},
+            {"name": "B", "start": 2.0, "end": 6.0},
+        ]
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 5.0)
+        mono = numpy.concatenate([voiced(2.2), silent(2.8), voiced(1.0)])
+        answer = shot_run(self.TWO, chunks, mono=mono, spans=spans)
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertEqual((found["at"]["shot"], found["at"]["line"]), ("A", 0))
+        self.assertAlmostEqual(found["at"]["seconds"], 0.9, places=2)
+        self.assertLess(found["at"]["end"], 2.5)
+        self.assertLess(found["value"], 1.6)
+
+    def test_under_a_second_of_audible_sound_in_a_long_gap_is_not(self):
+        chunks = words("alpha bravo", 0.0) + words("charlie delta", 5.0)
+        mono = numpy.concatenate([voiced(1.5), silent(3.5), voiced(1.0)])
+        answer = shot_run(self.TWO, chunks, mono=mono)
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+
+class TestTailAndRepeatedSpan(unittest.TestCase):
+    LINES = [{"text": "alpha bravo", "shot": "A"}]
+
+    def test_audible_tail_after_the_last_word_is_a_finding(self):
+        # #970: ~1.2 s of sound past the last word, then silence
+        chunks = words("alpha bravo", 0.0)
+        mono = numpy.concatenate([voiced(2.2), silent(2.8)])
+        answer = run(self.LINES, chunks, mono)
+        (found,) = rules(answer, "speech_not_transcribed")
+        self.assertEqual(found["at"]["line"], 0)
+        self.assertLess(found["value"], 1.6)
+
+    def test_quiet_tail_after_the_last_word_is_not(self):
+        chunks = words("alpha bravo", 0.0)
+        mono = numpy.concatenate([voiced(1.0), silent(4.0)])
+        answer = run(self.LINES, chunks, mono)
+        self.assertEqual(rules(answer, "speech_not_transcribed"), [])
+
+    def test_chunks_sharing_one_span_are_heard_once(self):
+        # #971: three words cannot share one span
+        chunks = words("alpha bravo", 0.0) + [
+            {"start": 3.0, "end": 3.6, "text": " How?"} for _ in range(3)
+        ]
+        mono = voiced(4.0)
+        answer = run(self.LINES, chunks, mono)
+        self.assertEqual(len(answer["unmatched"]), 1)
+        (dup,) = [d for d in answer["discarded"] if d["reason"] == "repeated_span"]
+        self.assertEqual(dup["count"], 2)
+
 
 class TestSpeechInSilentShot(unittest.TestCase):
     LINES = [{"text": "alpha bravo", "shot": "A"}]
@@ -772,6 +973,35 @@ def test_skipped_when_no_line_names_a_shot(self):
         self.assertIn("no line names", skip["reason"])
 
 
+class TestClippedUnderBed(unittest.TestCase):
+    CHUNKS = [
+        {"start": 0.5, "end": 0.9, "text": " hello"},
+        {"start": 1.6, "end": 1.95, "text": " world"},
+    ]
+
+    def test_bed_under_a_finished_word_is_not_clipped(self):
+        # voice (-20 dBFS) up to 1.7 s, then a bed ~30 dB lower to the end
+        mono = numpy.concatenate([voiced(1.7), voiced(0.3, amplitude=0.003)])
+        answer = run(["hello world"], self.CHUNKS, mono)
+        self.assertEqual(rules(answer, "line_clipped_at_end"), [])
+
+    def test_bed_under_the_whole_word_still_clips_a_voiced_tail(self):
+        mono = voiced(2.0) + voiced(2.0, amplitude=0.003)
+        answer = run(["hello world"], self.CHUNKS, mono)
+        self.assertEqual(len(rules(answer, "line_clipped_at_end")), 1)
+
+    def test_last_word_stretched_over_the_bed_is_not_clipped(self):
+        # the ASR places the last word wholly over the bed (#959): its own
+        # level is the bed's, the line's voice is 30 dB above the tail
+        mono = numpy.concatenate([voiced(1.2), voiced(0.8, amplitude=0.003)])
+        chunks = [
+            {"start": 0.5, "end": 0.9, "text": " hello"},
+            {"start": 1.5, "end": 1.95, "text": " world"},
+        ]
+        answer = run(["hello world"], chunks, mono)
+        self.assertEqual(rules(answer, "line_clipped_at_end"), [])
+
+
 class TestClippedAtShotEnd(unittest.TestCase):
     LINES = [{"text": "hello world", "shot": "A"}]
 
@@ -1146,3 +1376,58 @@ def test_transcription_input_is_level_independent():
     assert float(numpy.abs(a).max()) <= 1.0
     silent = numpy.zeros((1, 100), dtype=numpy.float32)
     assert level_for_transcription(silent) == (silent, 1.0)
+
+
+class PerShotPassTest(unittest.TestCase):
+    """#963: a transcript_loop on a cut with known shots is re-transcribed per shot."""
+
+    def _run(self, whole, per_shot):
+        calls = []
+        slice_calls = iter(per_shot)
+
+        def fake(audio, **kwargs):
+            calls.append(len(audio[0]) / RATE)
+            if len(calls) == 1:
+                return {"text": "", "chunks": whole}
+            return {"text": "", "chunks": next(slice_calls)}
+
+        records = [
+            {"name": "shot@a", "start_sample": 0, "num_samples": 6 * RATE},
+            {"name": "shot@b", "start_sample": 6 * RATE, "num_samples": 6 * RATE},
+        ]
+        wave = voiced(12.0)[None, :]
+        with (
+            patch("dw.tasks.audio_transcription.transcribe_audio", fake),
+            patch.object(script_check, "waveform_and_rate", return_value=(wave, RATE)),
+            patch.object(
+                script_check, "resolve_shots", return_value=(records, "manifest")
+            ),
+        ):
+            answer = script_check.check_script(
+                "x.mp4",
+                [
+                    {"text": "the lid is gone", "shot": "a"},
+                    {"text": "i wore it", "shot": "b"},
+                ],
+            )
+        return answer, calls
+
+    def test_looped_cut_is_rechecked_shot_by_shot(self):
+        whole = words("the lid is gone", 1.0) + words(
+            " ".join(["the lid is gone"] * 8), 3.0, step=0.1, length=0.05
+        )
+        answer, calls = self._run(
+            whole, [words("the lid is gone", 1.0), words("i wore it", 1.0)]
+        )
+        self.assertEqual(calls, [12.0, 6.0, 6.0])
+        self.assertEqual(answer["transcription_pass"], "per_shot")
+        self.assertEqual([x["similarity"] for x in answer["lines"]], [1.0, 1.0])
+        self.assertEqual(answer["lines"][1]["start"], 7.0)
+        self.assertEqual(answer["lines"][1]["pass"], "per_shot")
+        self.assertNotIn("not_transcribed", answer["lines"][1])
+
+    def test_clean_cut_is_one_pass(self):
+        whole = words("the lid is gone", 1.0) + words("i wore it", 7.0)
+        answer, calls = self._run(whole, [])
+        self.assertEqual(len(calls), 1)
+        self.assertEqual(answer["transcription_pass"], "whole_cut")
diff --git a/tests/test_seam_look.py b/tests/test_seam_look.py
new file mode 100644
index 000000000..bd865ebbc
--- /dev/null
+++ b/tests/test_seam_look.py
@@ -0,0 +1,254 @@
+"""Tests for the look measures on analyze_seams records (#1031).
+
+Each frame's lightness, contrast, saturation and detail are taken at decode
+(`look_stats`), on a file and on an in-memory clip alike, and every seam
+record carries the steps across it. These are measures only: no rule reads
+them. The probes run for real on synthetic frames and mp4 files written with
+PyAV, as in tests/test_assess.py.
+"""
+
+import numpy
+import pytest
+from PIL import Image, ImageFilter
+
+from dw.media_types import AudioVideo
+from dw.shots import shot_record
+from dw.tasks.assess import (
+    LOOK_MEASURES,
+    Media,
+    analyze_seams,
+    look_stats,
+    media_from,
+    read_media,
+    seams_answer,
+)
+from dw.tasks.dissolve_videos import dissolve_videos
+
+LOOK_FIELDS = (
+    "saturation_step",
+    "lightness_step",
+    "contrast_step",
+    "look_ratio",
+    "look_ratio_measure",
+    "detail_ratio",
+)
+
+
+def scene(num_frames, size=(128, 72), seed=0, gain=1.0):
+    """A colourful, textured picture with a little per-frame noise, so the
+    shot has motion of its own; `gain` brightens every frame from the first
+    by that factor per frame (a ramp)."""
+    rng = numpy.random.default_rng(seed)
+    width, height = size
+    x = numpy.linspace(0, 1, width)[None, :, None]
+    y = numpy.linspace(0, 1, height)[:, None, None]
+    base = numpy.concatenate(
+        [60 + 120 * x + 0 * y, 80 + 100 * y + 0 * x, 140 - 80 * x + 0 * y], axis=-1
+    )
+    texture = 25 * ((numpy.indices((height, width)).sum(axis=0) // 4) % 2)[..., None]
+    frames = []
+    for index in range(num_frames):
+        arr = (base + texture) * (gain**index) + rng.normal(0, 1.5, base.shape)
+        frames.append(numpy.clip(arr, 0, 255).astype(numpy.uint8))
+    return frames
+
+
+def saturate(frames, factor):
+    out = []
+    for frame in frames:
+        rgb = frame.astype(numpy.float32)
+        grey = rgb.mean(axis=-1, keepdims=True)
+        out.append(numpy.clip(grey + factor * (rgb - grey), 0, 255).astype(numpy.uint8))
+    return out
+
+
+def darken(frames, factor):
+    return [
+        numpy.clip(frame.astype(numpy.float32) * factor, 0, 255).astype(numpy.uint8)
+        for frame in frames
+    ]
+
+
+def blur(frames, radius=2):
+    return [
+        numpy.asarray(Image.fromarray(frame).filter(ImageFilter.GaussianBlur(radius)))
+        for frame in frames
+    ]
+
+
+def write_mp4(path, frames, fps=24):
+    import av
+
+    height, width = frames[0].shape[:2]
+    container = av.open(str(path), "w")
+    video = container.add_stream("libx264", rate=fps)
+    video.width, video.height, video.pix_fmt = width, height, "yuv420p"
+    video.options = {"crf": "12"}
+    for arr in frames:
+        for packet in video.encode(av.VideoFrame.from_ndarray(arr, format="rgb24")):
+            container.mux(packet)
+    for packet in video.encode():
+        container.mux(packet)
+    container.close()
+    return str(path)
+
+
+def two_shots(count):
+    return [shot_record("a", 0, count), shot_record("b", count, count)]
+
+
+def seam_of(frames_a, frames_b, tmp_path=None, name="cut.mp4"):
+    """The one seam record of frames_a then frames_b, read from an mp4 when
+    `tmp_path` is given, otherwise from the in-memory clip."""
+    frames = list(frames_a) + list(frames_b)
+    shots = two_shots(len(frames_a))
+    if tmp_path is not None:
+        answer = analyze_seams(write_mp4(tmp_path / name, frames), shots=shots)
+    else:
+        answer = analyze_seams(AudioVideo(frames, None, None, fps=24), shots=shots)
+    (seam,) = answer["seams"]
+    return seam, answer
+
+
+@pytest.fixture
+def trusted(monkeypatch):
+    monkeypatch.setenv("DW_TRUST_WORKFLOWS", "1")
+
+
+class TestLookStats:
+    def test_a_flat_colour(self):
+        frame = numpy.full((72, 128, 3), (200, 100, 50), dtype=numpy.uint8)
+        lightness, contrast, saturation, detail = look_stats(frame)
+        assert lightness == pytest.approx(0.2126 * 200 + 0.7152 * 100 + 0.0722 * 50)
+        assert contrast == pytest.approx(0.0, abs=1e-4)
+        assert saturation == pytest.approx(150.0)
+        assert detail == pytest.approx(0.0, abs=1e-4)
+
+    def test_black_and_white_halves(self):
+        frame = numpy.zeros((72, 128, 3), dtype=numpy.uint8)
+        frame[:, 64:] = 255
+        lightness, contrast, saturation, detail = look_stats(frame)
+        assert lightness == pytest.approx(127.5, abs=0.01)
+        assert contrast == pytest.approx(127.5, abs=0.01)
+        assert saturation == 0.0
+        # only the two columns beside the edge differ from their blur
+        assert detail == pytest.approx(2 * (255 / 3) / 128, abs=0.01)
+
+    def test_order_and_dtype(self):
+        assert LOOK_MEASURES == ("lightness", "contrast", "saturation", "detail")
+        stats = look_stats(numpy.zeros((4, 4, 3), dtype=numpy.uint8))
+        assert stats.dtype == numpy.float32 and stats.shape == (4,)
+
+    def test_file_and_in_memory_agree(self, tmp_path, trusted):
+        frames = scene(8, size=(256, 144))
+        from_file = read_media(write_mp4(tmp_path / "s.mp4", frames))
+        in_memory = media_from(AudioVideo(frames, None, None, fps=24))
+        assert from_file.looks.shape == in_memory.looks.shape == (8, 4)
+        assert from_file.looks.dtype == numpy.float32
+        # yuv420 and two scalers apart, but the same reduction
+        numpy.testing.assert_allclose(
+            from_file.looks.mean(axis=0), in_memory.looks.mean(axis=0), atol=3.0
+        )
+
+    def test_thumbs_unchanged(self, tmp_path, trusted):
+        media = read_media(write_mp4(tmp_path / "s.mp4", scene(4)))
+        assert media.thumbs.shape == (4, 36, 64)
+        assert media.thumbs.dtype == numpy.uint8
+
+
+class TestSeamLook:
+    def test_saturation_cut_against_a_same_clip_seam(self, tmp_path, trusted):
+        clip = scene(24)
+        graded, _ = seam_of(clip, saturate(clip, 1.5), tmp_path, "graded.mp4")
+        same, _ = seam_of(clip, clip, tmp_path, "same.mp4")
+
+        assert graded["saturation_step"] > 10
+        assert graded["look_ratio_measure"] == "saturation"
+        assert graded["look_ratio"] > 3 * max(same["look_ratio"], 1.0)
+        assert abs(same["saturation_step"]) < 3
+
+    def test_a_darker_copy_steps_lightness_down(self, tmp_path, trusted):
+        clip = scene(24)
+        seam, _ = seam_of(clip, darken(clip, 0.7), tmp_path)
+        assert seam["lightness_step"] < -10
+        assert seam["contrast_step"] < 0
+
+    def test_a_step_inside_a_ramp_scores_low(self):
+        ramp = scene(48, gain=1.01)
+        seam, _ = seam_of(ramp[:24], ramp[24:])
+        assert seam["lightness_step"] > 1
+        assert seam["look_ratio"] < 2
+
+    def test_a_softened_copy_has_less_detail(self, tmp_path, trusted):
+        clip = scene(24)
+        soft, _ = seam_of(clip, blur(clip), tmp_path, "soft.mp4")
+        same, _ = seam_of(clip, clip, tmp_path, "same.mp4")
+        assert soft["detail_ratio"] < 0.8
+        assert same["detail_ratio"] == pytest.approx(1.0, abs=0.1)
+
+    def test_grey_input_has_no_saturation(self):
+        grey = [
+            numpy.full((72, 128, 3), value, dtype=numpy.uint8) for value in [90] * 12
+        ]
+        darker = [numpy.full((72, 128, 3), 60, dtype=numpy.uint8)] * 12
+        seam, _ = seam_of(grey, darker)
+        assert all(field in seam for field in LOOK_FIELDS)
+        assert seam["saturation_step"] == 0
+        assert seam["lightness_step"] == pytest.approx(-30, abs=0.5)
+        # a flat picture has no detail to divide by
+        assert seam["detail_ratio"] is None
+
+    def test_frameless_media_gives_nulls(self):
+        media = Media(None, None, None, 24)
+        answer = seams_answer(media, two_shots(12), "argument")
+        (seam,) = answer["seams"]
+        assert {field: seam[field] for field in LOOK_FIELDS} == dict.fromkeys(
+            LOOK_FIELDS
+        )
+
+    def test_single_shot_has_no_seams(self):
+        answer = analyze_seams(AudioVideo(scene(12), None, None, fps=24))
+        assert answer["seams"] == []
+
+    def test_windows_stop_at_the_shots(self):
+        """A one-frame shot either side still gives a step, from that frame."""
+        looks = numpy.zeros((3, 4), dtype=numpy.float32)
+        looks[:, LOOK_MEASURES.index("saturation")] = [10, 10, 40]
+        looks[:, LOOK_MEASURES.index("detail")] = 2.0
+        media = Media(
+            numpy.zeros((3, 36, 64), numpy.uint8), None, None, 24, looks=looks
+        )
+        shots = [shot_record("a", 0, 1), shot_record("b", 1, 1), shot_record("c", 2, 1)]
+        first, second = seams_answer(media, shots, "argument")["seams"]
+        assert first["saturation_step"] == 0
+        assert second["saturation_step"] == 30
+        assert second["look_ratio"] == 30  # no span to rate, so the floor
+        assert second["detail_ratio"] == 1
+
+    def test_a_dissolve_is_measured_across_its_fade(self):
+        fps = 24
+        clips = [
+            AudioVideo(
+                [Image.fromarray(frame) for frame in scene(36, seed=1)], None, None, fps
+            ),
+            AudioVideo(
+                [Image.fromarray(frame) for frame in saturate(scene(36, seed=2), 1.6)],
+                None,
+                None,
+                fps,
+            ),
+        ]
+        joined = dissolve_videos(clips, dissolve_frames=12, fps=fps)
+        (seam,) = analyze_seams(joined)["seams"]
+        assert seam["kind"] == "dissolve"
+        assert all(seam[field] is not None for field in LOOK_FIELDS)
+        assert seam["saturation_step"] > 10
+
+    def test_no_new_rules_or_findings(self, tmp_path, trusted):
+        clip = scene(24)
+        _seam, graded = seam_of(clip, saturate(clip, 1.6), tmp_path)
+        names = set(graded["rules_applied"]) | {
+            entry["rule"] for entry in graded["rules_skipped"]
+        }
+        names |= {entry["rule"] for entry in graded["findings"]}
+        assert not any("look" in name or "detail" in name for name in names)
diff --git a/tests/test_security_ssrf.py b/tests/test_security_ssrf.py
index 28a39bac4..dfef463e7 100644
--- a/tests/test_security_ssrf.py
+++ b/tests/test_security_ssrf.py
@@ -488,9 +488,16 @@ def test_a_redirect_to_another_scheme_is_refused(
         ).install(monkeypatch)
 
         with patch("dw.locations.socket.getaddrinfo", fake_resolver(PUBLIC)):
-            with pytest.raises(InvalidInputError):
+            with pytest.raises(InvalidInputError) as refusal:
                 load_audio("https://cdn.example.com/a.wav", str(tmp_path))
 
+        # #1055: the scheme rule's refusal names the hop and the redirect too
+        assert str(refusal.value).startswith(
+            "Refusing a redirect to 'file:///etc/passwd' "
+            "(from 'https://cdn.example.com/a.wav'): "
+        )
+        assert "scheme not allowed: file" in str(refusal.value)
+
     def test_fetch_video_does_not_follow_a_redirect_inside(
         self, untrusted, no_real_sockets, monkeypatch, tmp_path
     ):
diff --git a/tests/test_segment.py b/tests/test_segment.py
index 4f38c9d62..e447c6108 100644
--- a/tests/test_segment.py
+++ b/tests/test_segment.py
@@ -64,7 +64,9 @@ def test_returns_pil_image_mode_l(
         mock_sam_model_instance.to.return_value = mock_sam_model_instance
         mask_tensor = torch.zeros(1, 1, 3, 480, 640)
         mask_tensor[0, 0, 0, 100:300, 100:300] = 1.0
-        mock_sam_model_instance.return_value = MagicMock(pred_masks=mask_tensor)
+        mock_sam_model_instance.return_value = MagicMock(
+            pred_masks=mask_tensor, iou_scores=torch.ones(1, 1, 1)
+        )
 
         post_mask = torch.zeros(1, 1, 480, 640)
         post_mask[0, 0, 100:300, 100:300] = 1.0
@@ -198,7 +200,9 @@ def test_masks_come_back_at_the_image_size(
         # SAM2's low-res mask logits: (batch, boxes, masks, 256, 256)
         logits = torch.full((1, 1, 3, 256, 256), -10.0)
         logits[..., 64:128, 64:128] = 10.0
-        sam_model.return_value = MagicMock(pred_masks=logits)
+        sam_model.return_value = MagicMock(
+            pred_masks=logits, iou_scores=torch.tensor([[[0.7, 0.9, 0.8]]])
+        )
 
         result = segment_image(_make_test_image(), "dog")
 
@@ -206,6 +210,58 @@ def test_masks_come_back_at_the_image_size(
         assert result.size == (640, 480)
         assert np.array(result).max() == 255
 
+    @patch("dw.tasks.segment.Sam2Model")
+    @patch("dw.tasks.segment.Sam2Processor")
+    @patch("dw.tasks.segment.AutoModelForZeroShotObjectDetection")
+    @patch("dw.tasks.segment.AutoProcessor")
+    def test_each_box_takes_its_best_rated_candidate(
+        self, mock_auto_proc, mock_auto_model, mock_sam_proc, mock_sam_model
+    ):
+        """SAM2 returns three candidates per box; the first is often a part of
+        the object (the docs cup's body without its lid, #974). The mask is
+        the union of each box's highest-iou candidate."""
+        from dw.tasks.segment import segment_image
+
+        dino = MagicMock()
+        mock_auto_proc.from_pretrained.return_value = dino
+        dino.return_value = _make_batch_encoding({"input_ids": torch.zeros(1, 10)})
+        dino.post_process_grounded_object_detection.return_value = [
+            {
+                "boxes": torch.tensor([[0.0, 0.0, 100.0, 100.0]] * 2),
+                "scores": torch.tensor([0.9, 0.8]),
+                "labels": ["cup", "cup"],
+            }
+        ]
+        dino_model = MagicMock()
+        mock_auto_model.from_pretrained.return_value = dino_model
+        dino_model.to.return_value = dino_model
+
+        sam_proc = MagicMock()
+        mock_sam_proc.from_pretrained.return_value = sam_proc
+        sam_proc.return_value = _make_batch_encoding(
+            {"original_sizes": torch.tensor([[480, 640]])}
+        )
+        sam_model = MagicMock()
+        mock_sam_model.from_pretrained.return_value = sam_model
+        sam_model.to.return_value = sam_model
+        sam_model.return_value = MagicMock(
+            pred_masks=torch.zeros(1, 2, 3, 256, 256),
+            iou_scores=torch.tensor([[[0.74, 0.99, 0.98], [0.5, 0.6, 0.9]]]),
+        )
+        # Each candidate marks its own column band, so the result names which
+        # candidates were taken
+        post = torch.zeros(2, 3, 480, 640)
+        for box in range(2):
+            for k in range(3):
+                col = (box * 3 + k) * 100
+                post[box, k, :, col : col + 100] = 1.0
+        sam_proc.post_process_masks.return_value = [post]
+
+        mask = np.array(segment_image(_make_test_image(), "cup"))
+
+        taken = [band for band in range(6) if mask[0, band * 100] == 255]
+        assert taken == [1, 5]
+
 
 class TestGroundingDinoQuery:
     """GroundingDINO only scores a query written its way - lowercase, each
diff --git a/tests/test_separate_stems.py b/tests/test_separate_stems.py
index 0dcd2aec0..a36ab81c5 100644
--- a/tests/test_separate_stems.py
+++ b/tests/test_separate_stems.py
@@ -14,7 +14,12 @@
 from dw.introspection import describe_task, list_tasks
 from dw.media_types import AudioTrack
 from dw.tasks import model_cache
-from dw.tasks.voice_attribution import separate_stems
+from dw.tasks.voice_attribution import (
+    STACK_SPANS_LISTED,
+    separate_stems,
+    stacked_spans,
+    stacked_vocals_message,
+)
 
 SOURCES = ["drums", "bass", "other", "vocals"]
 RATE = 44100
@@ -101,5 +106,107 @@ def test_task_is_registered_and_described(self):
         self.assertIn("audio", names)
 
 
+def vocals_only(model, mix, device=None, split=True):
+    """The whole (normalized) mix comes back as the vocal stem."""
+    shares = torch.tensor([0.0, 0.0, 0.0, 1.0]).view(1, 4, 1, 1)
+    return mix[:, None] * shares
+
+
+def sung(seconds, stacked=(), rate=8000, quiet=()):
+    """A stereo vocal stem, one second per window: the same voice on both
+    channels, except in `stacked` windows, where each channel sings its own
+    (uncorrelated) line. A `quiet` window sits 30 dB down."""
+    t = numpy.arange(rate) / rate
+    lead = 0.5 * numpy.sin(2 * numpy.pi * 220 * t)
+    double = 0.5 * numpy.sin(2 * numpy.pi * 331 * t)
+    windows = []
+    for index in range(seconds):
+        right = double if index in stacked else lead
+        gain = 10 ** (-30 / 20) if index in quiet else 1.0
+        windows.append(numpy.stack([lead, right]) * gain)
+    return numpy.concatenate(windows, axis=1).astype(numpy.float32), rate
+
+
+class TestStackedVocals(unittest.TestCase):
+    """#947: the vocal stem's stacked (layered stereo) spans."""
+
+    def test_decorrelated_channels_over_a_known_span_are_that_span(self):
+        self.assertEqual(stacked_spans(*sung(12, stacked=range(4, 8))), [(4.0, 8.0)])
+
+    def test_identical_channels_never_flag(self):
+        self.assertEqual(stacked_spans(*sung(12)), [])
+
+    def test_silence_never_flags(self):
+        self.assertEqual(stacked_spans(numpy.zeros((2, 8000 * 10)), 8000), [])
+
+    def test_a_mono_stem_never_flags(self):
+        stem, rate = sung(12, stacked=range(4, 8))
+        self.assertEqual(stacked_spans(stem[:1], rate), [])
+
+    def test_a_run_shorter_than_the_minimum_span_is_dropped(self):
+        self.assertEqual(stacked_spans(*sung(12, stacked={5})), [])
+        self.assertEqual(stacked_spans(*sung(12, stacked={5, 6})), [(5.0, 7.0)])
+
+    def test_windows_a_one_window_gap_apart_merge(self):
+        stem = sung(12, stacked={2, 3, 5, 6})
+        self.assertEqual(stacked_spans(*stem), [(2.0, 7.0)])
+        stem = sung(12, stacked={1, 2, 5, 6})
+        self.assertEqual(stacked_spans(*stem), [(1.0, 3.0), (5.0, 7.0)])
+
+    def test_a_faint_decorrelated_stretch_is_not_a_second_voice(self):
+        stem = sung(12, stacked=range(2, 6), quiet=range(2, 6))
+        self.assertEqual(stacked_spans(*stem), [])
+
+    def test_more_than_the_listed_spans_say_how_many_more(self):
+        count = STACK_SPANS_LISTED + 2
+        stacked = [
+            start + offset for start in range(0, count * 4, 4) for offset in (0, 1)
+        ]
+        spans = stacked_spans(*sung(count * 4, stacked=set(stacked)))
+        self.assertEqual(len(spans), count)
+        message = stacked_vocals_message(spans)
+        self.assertIn("0:00–0:02, 0:04–0:06", message)
+        self.assertIn("0:28–0:30 and 2 more;", message)
+        self.assertNotIn("0:32", message)
+
+    def test_spans_read_as_minutes_and_seconds(self):
+        message = stacked_vocals_message([(79.0, 94.0), (119.0, 129.0)])
+        self.assertEqual(
+            message,
+            "separate_stems: the vocals stem holds stacked (layered stereo) "
+            "voices over 1:19–1:34, 1:59–2:09; treat those spans as more than "
+            "one voice before processing them as one",
+        )
+
+
+class TestSeparateStemsWarnsStackedVocals(unittest.TestCase):
+    """The check runs on the real separate_stems path; only demucs is faked."""
+
+    def setUp(self):
+        model_cache.clear_model_cache()
+
+    def separate(self, source):
+        with (
+            patch.dict(sys.modules, fake_demucs(vocals_only)),
+            patch("dw.tasks.voice_attribution.emit_warning") as warn,
+        ):
+            stems = separate_stems(AudioTrack(source, RATE), device="cpu")
+        return stems, warn
+
+    def test_a_stacked_vocal_stem_warns_once_with_its_span(self):
+        source, _ = sung(10, stacked=range(2, 5), rate=RATE)
+        stems, warn = self.separate(source)
+        self.assertEqual(sorted(stems), sorted(SOURCES))
+        warn.assert_called_once()
+        self.assertEqual(warn.call_args.kwargs["kind"], "stacked_vocals")
+        self.assertEqual(warn.call_args.kwargs["command"], "separate_stems")
+        self.assertIn("over 0:02–0:05;", warn.call_args.args[0])
+
+    def test_a_single_voice_does_not_warn(self):
+        stems, warn = self.separate(sung(10, rate=RATE)[0])
+        self.assertEqual(len(stems), 4)
+        warn.assert_not_called()
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_serve_main.py b/tests/test_serve_main.py
index 14874c690..91d63475d 100644
--- a/tests/test_serve_main.py
+++ b/tests/test_serve_main.py
@@ -109,6 +109,18 @@ def two_cards(monkeypatch):
     monkeypatch.setattr(torch.cuda, "get_device_name", lambda index=0: names[index])
 
 
+@pytest.fixture
+def one_card(monkeypatch):
+    """A box that had two cards and now has one - lem with a card pulled."""
+    import torch
+
+    monkeypatch.setattr(torch.cuda, "is_available", lambda: True)
+    monkeypatch.setattr(torch.cuda, "device_count", lambda: 1)
+    monkeypatch.setattr(
+        torch.cuda, "get_device_name", lambda index=0: "NVIDIA GeForce RTX 3090"
+    )
+
+
 @pytest.fixture
 def settings_devices(monkeypatch):
     """Sets what the `devices` setting holds."""
@@ -159,6 +171,22 @@ def test_a_card_the_machine_lacks_is_refused_naming_the_cards_present(
         assert "cuda:0 (NVIDIA GeForce RTX 4090)" in message
         assert "cuda:1 (NVIDIA GeForce RTX 3090)" in message
 
+    def test_a_card_gone_from_a_list_is_dropped_and_reported(self, one_card):
+        from dw.devices import resolve_serve_devices
+
+        absent = []
+        devices = resolve_serve_devices("cuda:0,cuda:1", None, on_absent=absent.append)
+        assert devices == ["cuda:0"]
+        assert len(absent) == 1
+        assert "There is no cuda:1" in absent[0]
+        assert "cuda:0 (NVIDIA GeForce RTX 3090)" in absent[0]
+
+    def test_a_list_with_no_card_present_is_refused(self, one_card):
+        from dw.devices import DeviceConfigError, resolve_serve_devices
+
+        with pytest.raises(DeviceConfigError, match="There is no cuda:1"):
+            resolve_serve_devices("cuda:1,cuda:2", None, on_absent=lambda _: None)
+
     @pytest.mark.parametrize("value", [None, ""])
     def test_naming_nothing_is_none(self, value):
         from dw.devices import resolve_serve_devices
@@ -200,6 +228,25 @@ def test_a_refusal_exits_with_code_2(
         assert "cuda:1 (NVIDIA GeForce RTX 3090)" in capsys.readouterr().err
         assert "DW_DEVICE" not in os.environ
 
+    def test_a_pulled_card_in_the_setting_starts_on_the_rest_and_warns(
+        self, one_card, settings_devices, monkeypatch, capsys
+    ):
+        import types
+
+        from dw.serve import configure_devices
+
+        # setenv first so monkeypatch records the original state and undoes
+        # whatever configure_devices assigns
+        monkeypatch.setenv("DW_DEVICE", "unset")
+        monkeypatch.delenv("DW_DEVICE")
+        settings_devices("cuda:0,cuda:1")
+        devices = configure_devices(types.SimpleNamespace(devices=None))
+        assert devices == ["cuda:0"]
+        assert os.environ["DW_DEVICE"] == "cuda:0"
+        err = capsys.readouterr().err
+        assert "There is no cuda:1" in err
+        assert "cuda:0" in err
+
     def test_success_sets_dw_device(self, two_cards, settings_devices, monkeypatch):
         import types
 
diff --git a/tests/test_server.py b/tests/test_server.py
index ba71e3310..bdcb72775 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -557,6 +557,31 @@ def test_job_workflow_returns_an_inline_definition(server):
         assert historical["definition"] == valid_workflow()
 
 
+def test_job_workflow_of_a_deleted_workspace_folds_the_arguments(server):
+    """#944: a job id still resolves once its workspace is deleted - the
+    definition comes back unrealized with the recorded arguments folded in."""
+    workflow = valid_workflow("fold")
+    workflow["variables"] = {**workflow.get("variables", {}), "n": 1, "label": "x"}
+    with server(success_script) as client:
+        response = client.post(
+            "/api/jobs",
+            json={"workflow": workflow, "arguments": {"n": "30", "label": "coerced"}},
+        )
+        assert response.status_code == 201, response.json()
+        job = response.json()
+        wait_for_status(client, job["id"], TERMINAL_STATES)
+        manager = client.app.state.job_manager
+        manager.forget_workspace(manager.get(job["id"]).spec["workspace"])
+        manager.jobs.pop(job["id"], None)
+
+        assert client.get(f"/api/jobs/{job['id']}").status_code == 200
+        body = client.get(f"/api/jobs/{job['id']}/workflow").json()
+        assert body["realized"] is False
+        variables = body["definition"]["variables"]
+        assert (variables["n"], variables["label"]) == (30, "coerced")
+        assert "n, label" in body["note"] or "label, n" in body["note"]
+
+
 def test_job_workflow_reads_back_a_job_launched_from_a_file(server):
     """A job submitted by path names no definition - the file it ran is
     re-read from the root the job was confined to."""
@@ -5365,10 +5390,10 @@ class TestValidatePlan:
     box lacks named. Best effort - the verdict is never the planner's."""
 
     def test_a_valid_answer_carries_a_plan(self, server, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
         with server(success_script) as client:
             result = client.post(
@@ -5393,11 +5418,11 @@ def test_a_blocked_gate_surfaces_as_a_warning(self, server, monkeypatch):
         """#186: a repo this box's token cannot access is a 403 partway into
         a run unless the pre-flight says so first."""
         import httpx
-        import dw.plan
+        import dw.plan_downloads
         from huggingface_hub.utils import GatedRepoError
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
 
         response = httpx.Response(403, request=httpx.Request("GET", "https://hf.co/x"))
@@ -5405,7 +5430,7 @@ def test_a_blocked_gate_surfaces_as_a_warning(self, server, monkeypatch):
         def boom(*a, **k):
             raise GatedRepoError("no access", response=response)
 
-        monkeypatch.setattr(dw.plan, "model_info", boom)
+        monkeypatch.setattr(dw.plan_downloads, "model_info", boom)
         with server(success_script) as client:
             result = client.post(
                 "/api/validate",
@@ -5421,10 +5446,10 @@ def test_the_estimate_quotes_this_box_s_own_history(self, server, monkeypatch):
         """#154: `basis: unknown` has to mean nobody has a number. A stored
         workflow this server has finished eleven times is priced from those
         runs, and the aggregate is asked with the caller's arguments."""
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
         from dw import get_device, get_device_type
 
@@ -5468,10 +5493,10 @@ def observed(
 
     def test_an_inline_workflow_has_no_history_to_quote(self, server, monkeypatch):
         """It has no catalog name, so nothing joins it to a job row."""
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
 
         class History:
@@ -5529,10 +5554,10 @@ def spy(candidate, arguments, **kwargs):
         assert seen == [True, False]
 
     def test_cached_steps_comes_from_the_worker(self, server, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
         with server(success_script) as client:
             manager = client.app.state.job_manager
@@ -5555,10 +5580,10 @@ def test_cached_steps_comes_from_the_worker(self, server, monkeypatch):
         assert probe[0]["output_dir"] == manager.output_dir
 
     def test_an_unseeded_workflow_does_not_probe(self, server, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
         with server(success_script) as client:
             manager = client.app.state.job_manager
@@ -5570,10 +5595,10 @@ def test_an_unseeded_workflow_does_not_probe(self, server, monkeypatch):
         assert all(c["type"] != "probe_cache" for c in manager.worker_manager.commands)
 
     def test_the_plan_sees_the_callers_arguments(self, server, monkeypatch):
-        import dw.plan
+        import dw.plan_downloads
 
         monkeypatch.setattr(
-            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
         )
         with server(success_script) as client:
             body = {"workflow": valid_workflow("v")}
@@ -5774,9 +5799,11 @@ def bound(plan):
 
 @pytest.fixture
 def no_hub(monkeypatch):
-    import dw.plan
+    import dw.plan_downloads
 
-    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+    monkeypatch.setattr(
+        dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+    )
 
 
 def list_workflow(job_id="listed"):
@@ -5906,10 +5933,10 @@ def test_a_download_that_vanished_is_not_a_refusal(
         with server(success_script) as client:
             plan = plan_for(client, list_workflow())
             assert bound(plan)["downloads"] == ["m"]
-            import dw.plan
+            import dw.plan_downloads
 
             monkeypatch.setattr(
-                dw.plan,
+                dw.plan_downloads,
                 "scan_models",
                 lambda cache_dir=None: {"repos": [{"repo_id": "m"}]},
             )
@@ -5922,7 +5949,7 @@ def test_a_download_that_vanished_is_not_a_refusal(
     def test_an_unplannable_run_is_refused_not_passed(
         self, server, no_hub, monkeypatch
     ):
-        import dw.server.admission as admission_module
+        import dw.server.routes.jobs as jobs_module
 
         with server(success_script) as client:
             plan = plan_for(client, list_workflow())
@@ -5930,7 +5957,7 @@ def test_an_unplannable_run_is_refused_not_passed(
             def boom(*a, **k):
                 raise RuntimeError("no plan")
 
-            monkeypatch.setattr(admission_module, "build_plan", boom)
+            monkeypatch.setattr(jobs_module, "build_plan", boom)
             response = client.post(
                 "/api/jobs",
                 json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)},
@@ -5939,13 +5966,60 @@ def boom(*a, **k):
             assert response.json()["detail"]["reason"] == "unplannable"
             assert response.json()["detail"]["plan"] is None
 
+    def test_the_409_quotes_the_observed_estimate_validate_does(
+        self, server, no_hub, monkeypatch
+    ):
+        """#1038: the rebind a 409 offers carries the same observed figure
+        a re-validate of the same run quotes, not `basis: unknown`."""
+        import dw.plan_downloads
+        from dw import get_device, get_device_type
+
+        monkeypatch.setattr(
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        serving = get_device_type(get_device())
+
+        class History:
+            def observed(
+                self, name, definition, arguments=None, *, workspace=None, card=None
+            ):
+                return {
+                    "device": serving,
+                    "name": "RTX 3090",
+                    "runs": 11,
+                    "cold_minutes": 8.04,
+                    "cold_runs": 11,
+                }
+
+        with server(success_script) as client:
+            client.app.state.observed_costs = History()
+            body = {"workflow_path": "Basic", "arguments": {"prompt": "x"}}
+            validated = client.post("/api/validate?sizes=false", json=body).json()
+            response = client.post(
+                "/api/jobs",
+                json={
+                    **body,
+                    "acknowledged_cost": {
+                        "fingerprint": "sha256:stale",
+                        "minutes": 1,
+                        "downloads": [],
+                    },
+                },
+            )
+        assert response.status_code == 409
+        detail = response.json()["detail"]
+        assert detail["reason"] == "fingerprint"
+        assert detail["plan"]["estimate"]["basis"] == "observed"
+        assert detail["acknowledge"]["minutes"] == 8.0
+        assert detail["acknowledge"] == bound(validated["plan"])
+
     def test_true_and_absent_queue_without_planning(self, server, no_hub, monkeypatch):
-        import dw.server.admission as admission_module
+        import dw.server.routes.jobs as jobs_module
 
         def boom(*a, **k):
             raise AssertionError("the boolean path must not plan")
 
-        monkeypatch.setattr(admission_module, "build_plan", boom)
+        monkeypatch.setattr(jobs_module, "build_plan", boom)
         with server(success_script) as client:
             plain = client.post("/api/jobs", json={"workflow": valid_workflow("p")})
             flagged = client.post(
diff --git a/tests/test_server_jobs.py b/tests/test_server_jobs.py
index 1f8449aaa..0ebab3c83 100644
--- a/tests/test_server_jobs.py
+++ b/tests/test_server_jobs.py
@@ -13,6 +13,7 @@
 
 import pytest
 
+from dw import notes as N
 from dw.runs import REALIZED_FILE_NAME, new_run_id
 from dw.server.jobs import JobManager
 from dw.server.job_history import JobHistory
@@ -66,6 +67,9 @@ def finished_job(manager):
     while job.status not in TERMINAL_STATES and time.time() < deadline:
         time.sleep(0.01)
     assert job.status == "succeeded", job.error
+    # The status turns terminal a moment before _finish records the row
+    while manager.history.get(job.id) is None and time.time() < deadline:
+        time.sleep(0.01)
     return job
 
 
@@ -146,8 +150,9 @@ def test_a_database_without_the_columns_is_migrated(tmp_path):
 
 def test_a_v0_13_0_database_gains_the_columns_added_since(tmp_path):
     """A jobs.sqlite as v0.13.0 wrote it - every column through
-    device_card, none of note/memory_key/rerun_of/kept - opens, gains the
-    four, and keeps its card fields as they were."""
+    device_card, none of note/memory_key/rerun_of - opens, gains the
+    three, and keeps its card fields as they were. `kept` (#917) is not
+    among them: retired, it is never added to a database that lacks it."""
     import sqlite3
 
     path = str(tmp_path / "v0.13.0.sqlite")
@@ -170,9 +175,8 @@ def test_a_v0_13_0_database_gains_the_columns_added_since(tmp_path):
     history = JobHistory(path)
     with history._connect() as connection:
         columns = {row[1] for row in connection.execute("PRAGMA table_info(jobs)")}
-        kept = connection.execute("SELECT kept FROM jobs").fetchone()[0]
-    assert {"note", "memory_key", "rerun_of", "kept"} <= columns
-    assert kept == 0
+    assert {"note", "memory_key", "rerun_of"} <= columns
+    assert "kept" not in columns
     row = history.get("old-1")
     assert row["workspace"] == "w" and "note" not in row and "rerun_of" not in row
     assert history.device_ordinal("old-1") == "cuda:1"
@@ -685,3 +689,114 @@ def test_run_location_is_the_jobs_own_root(manager, tmp_path):
     root, run_dir = manager.run_location("named")
     assert root == os.path.realpath(str(other))
     assert run_dir == RUN_DIR
+
+
+def test_finishing_a_job_reads_its_roles_once_and_its_notes_never(
+    tmp_path, monkeypatch
+):
+    """`_finish` stamps roles from the run manifest with one `run_roles` read
+    and no notes.json read: the run note is read when the job is served,
+    and reading it at finish only to discard it was waste."""
+    from dw.server import outputs
+
+    run_dir = tmp_path / "outputs" / RUN_DIR
+    name = f"{RUN_DIR}/final/a.png"
+
+    def roled_script(command):
+        for message in tracked_script(command):
+            if message["type"] == "success":
+                (run_dir / "final").mkdir(parents=True)
+                (run_dir / "manifest.json").write_text(
+                    json.dumps(
+                        {
+                            "steps": [
+                                {"step": "s", "files": ["final/a.png"], "role": "final"}
+                            ]
+                        }
+                    )
+                )
+                N.set_run_note(str(run_dir), "mid-run")
+                message = {
+                    **message,
+                    "manifest": [
+                        {"step": "s", "files": [str(tmp_path / "outputs" / name)]}
+                    ],
+                }
+            yield message
+
+    calls = {"notes": 0, "roles": 0}
+    real_run_roles = outputs.run_roles
+
+    def counted_notes(directory):
+        calls["notes"] += 1
+        return N.read_notes(directory)
+
+    def counted_roles(path):
+        calls["roles"] += 1
+        return real_run_roles(path)
+
+    monkeypatch.setattr(outputs, "read_notes", counted_notes)
+    monkeypatch.setattr(outputs, "run_roles", counted_roles)
+    made = JobManager(
+        str(tmp_path / "outputs"),
+        worker_manager=ScriptedWorkerManager(roled_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=str(tmp_path),
+    )
+    try:
+        job = finished_job(made)
+        assert job.manifest[0]["role"] == "final"
+        assert calls == {"notes": 0, "roles": 1}
+        # served, the detail carries the note - read then, not at finish
+        from dw.server.outputs import with_run_state
+
+        served = with_run_state(made.describe(job), *made.run_location(job.id))
+        assert served["note"] == "mid-run"
+        assert calls["notes"] == 1
+    finally:
+        made.shutdown()
+
+
+def test_history_keeps_the_roles_a_live_manifest_carries(tmp_path):
+    """#957: a finished job's manifest entries carry `role`, and history
+    reads them back even after the run directory is gone."""
+    run_dir = tmp_path / "outputs" / RUN_DIR
+    name = f"{RUN_DIR}/final/a.png"
+
+    def roled_script(command):
+        for message in tracked_script(command):
+            if message["type"] == "success":
+                (run_dir / "final").mkdir(parents=True)
+                (run_dir / "manifest.json").write_text(
+                    json.dumps(
+                        {
+                            "steps": [
+                                {"step": "s", "files": ["final/a.png"], "role": "final"}
+                            ]
+                        }
+                    )
+                )
+                message = {
+                    **message,
+                    "manifest": [
+                        {"step": "s", "files": [str(tmp_path / "outputs" / name)]}
+                    ],
+                }
+            yield message
+
+    made = JobManager(
+        str(tmp_path / "outputs"),
+        worker_manager=ScriptedWorkerManager(roled_script),
+        history_path=str(tmp_path / "jobs.sqlite"),
+        workflow_dir=str(tmp_path),
+    )
+    try:
+        job = finished_job(made)
+        live = made.describe(job)["manifest"]
+        assert live[0]["role"] == "final"
+        import shutil
+
+        shutil.rmtree(run_dir)
+        assert made.history.get(job.id)["manifest"] == live
+    finally:
+        made.shutdown()
diff --git a/tests/test_step_cache.py b/tests/test_step_cache.py
index c2c1620db..57b47366d 100644
--- a/tests/test_step_cache.py
+++ b/tests/test_step_cache.py
@@ -880,12 +880,14 @@ def test_normalized_downstream_false_when_nothing_references_it():
     },
     "recenter-crop.json": {},
     "relevel-clip.json": {},
+    "remove-object.json": {},
     "restore-faces.json": {
         "generate": "8655c1f1635a7f9a1d3ce02a9cbf6f0f9e8b27130052d6e2758fcb7838270c14"
     },
     "segment-and-inpaint.json": {
         "inpaint": "8ece64de576884be947f5af07c5713b92d3a1e641035434ef805629f12ae8c77"
     },
+    "segment-and-remove.json": {},
     "segment.json": {},
     "step-caching.json": {
         "txt2img": "3e3ea6a2cb1d2d1b1abaec9de159758b137ac0bcd3197a1bac0f7bbcead7ac24"
diff --git a/tests/test_task_domains.py b/tests/test_task_domains.py
index 9928d4efd..bbd5249e1 100644
--- a/tests/test_task_domains.py
+++ b/tests/test_task_domains.py
@@ -312,6 +312,21 @@ def test_slice_region_starts_at_start_minus_lead(self):
             24000,
         )
 
+    def test_start_in_seconds_with_length_in_frames_is_that_long(self):
+        """#990: num_frames was dropped and the slice ran to the track's end"""
+        track = slice_audio(
+            numpy.zeros((1, 100 * 1000), dtype="float32") + 0.1,
+            start_seconds=42.5,
+            num_frames=124,
+            fps=24,
+            sample_rate=1000,
+        )
+        assert track.audio.shape == (1, 5167)
+        assert slice_region(1000, start_seconds=42.5, num_frames=124, fps=24) == (
+            42500,
+            5167,
+        )
+
 
 class TestThroughValidateWorkflow:
     def _workflow(self, arguments):
diff --git a/tests/test_task_file_weights.py b/tests/test_task_file_weights.py
new file mode 100644
index 000000000..ce44aec12
--- /dev/null
+++ b/tests/test_task_file_weights.py
@@ -0,0 +1,340 @@
+"""#978: tasks that fetch one file of a repo declare the file, the plan checks
+the cache for that file, and facexlib's own downloads are listed as URLs."""
+
+import copy
+import subprocess
+import sys
+import textwrap
+
+import pytest
+
+import dw.plan_downloads
+from dw.plan import build_plan, downloads_required, gate_warnings
+from dw.tasks import face_track, h3_latent_upscale, interpolate_frames
+from dw.tasks import remove_object, restore_faces, upscale
+from dw.workflow import workflow_from_definition
+
+PIN = "a" * 40
+
+
+def workflow(*task_steps):
+    return {
+        "id": "file_weights",
+        "description": "docs only",
+        "summary": "docs only",
+        "steps": [
+            {
+                "name": f"t{i}",
+                "task": {"command": command, "arguments": arguments},
+                "result": {"content_type": "image/png"},
+            }
+            for i, (command, arguments) in enumerate(task_steps)
+        ],
+    }
+
+
+@pytest.fixture
+def hub(tmp_path):
+    return tmp_path / "hub"
+
+
+@pytest.fixture
+def plan(tmp_path, hub, monkeypatch):
+    """build_plan against an empty fake hub cache, offline, with facexlib's
+    weights all present so only the hub entries are in play."""
+    monkeypatch.setattr(
+        dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+    )
+    weights = tmp_path / "facexlib" / "weights"
+    weights.mkdir(parents=True)
+    for url in (
+        restore_faces.FACEXLIB_DETECTION_URL,
+        restore_faces.FACEXLIB_PARSING_URL,
+    ):
+        (weights / url.rsplit("/", 1)[1]).write_bytes(b"w")
+    monkeypatch.setattr(restore_faces, "package_dir", lambda name: weights.parent)
+
+    def make(spec):
+        candidate = workflow_from_definition(
+            copy.deepcopy(spec), str(tmp_path), str(tmp_path), str(tmp_path)
+        )
+        return build_plan(
+            candidate, {}, device="cuda", cache_dir=str(hub), lookup_sizes=False
+        )["downloads_required"]
+
+    return make
+
+
+def cache(hub, repo, filename, commit=PIN, ref=None):
+    """A file in the fake hub cache at `commit`, with `refs/<ref>` naming it
+    only when `ref` is given."""
+    root = hub / f"models--{repo.replace('/', '--')}"
+    path = root / "snapshots" / commit / filename
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(b"w")
+    if ref:
+        (root / "refs").mkdir(exist_ok=True)
+        (root / "refs" / ref).write_text(commit)
+
+
+class TestDeclarations:
+    def test_upscale_with_a_filename_declares_the_file(self):
+        assert upscale.required_weights(
+            {"model_name": "org/up", "filename": "x.pth"}
+        ) == [{"repo": "org/up", "filename": "x.pth", "revision": None}]
+
+    def test_upscale_without_a_filename_declares_the_repo(self):
+        assert upscale.required_weights({"model_name": "org/up"}) == [
+            {"repo": "org/up"}
+        ]
+
+    def test_restore_faces_declares_its_spandrel_file(self, monkeypatch, tmp_path):
+        monkeypatch.setattr(restore_faces, "package_dir", lambda name: tmp_path)
+        (tmp_path / "weights").mkdir()
+        for url in (
+            restore_faces.FACEXLIB_DETECTION_URL,
+            restore_faces.FACEXLIB_PARSING_URL,
+        ):
+            (tmp_path / "weights" / url.rsplit("/", 1)[1]).write_bytes(b"w")
+        assert restore_faces.required_weights(
+            {"model_name": "org/gfp", "filename": "g.pth"}
+        ) == [{"repo": "org/gfp", "filename": "g.pth", "revision": None}]
+
+    def test_remove_object_default_is_pinned(self):
+        assert remove_object.required_weights({}) == [
+            {
+                "repo": remove_object.DEFAULT_REMOVER_REPO,
+                "filename": remove_object.DEFAULT_REMOVER_WEIGHTS,
+                "revision": remove_object.REMOVER_REVISION,
+            }
+        ]
+
+    def test_remove_object_override_reads_main(self):
+        assert remove_object.required_weights(
+            {"model_name": "org/lama", "weight_name": "l.safetensors"}
+        ) == [{"repo": "org/lama", "filename": "l.safetensors", "revision": None}]
+
+    def test_h3_upscaler_default_is_its_subfolder_file_at_the_pin(self):
+        assert h3_latent_upscale.required_weights({}) == [
+            {
+                "repo": h3_latent_upscale.DEFAULT_UPSCALER_REPO,
+                "filename": f"{h3_latent_upscale.DEFAULT_UPSCALER_SUBFOLDER}/"
+                f"{h3_latent_upscale.DEFAULT_UPSCALER_WEIGHTS}",
+                "revision": h3_latent_upscale.UPSCALER_REVISION,
+            }
+        ]
+
+    def test_h3_upscaler_known_source_has_its_folder_and_pin(self):
+        repo = h3_latent_upscale.LMS_UPSCALER_REPO
+        weight = "h3_upscaler_lms_v0.1.safetensors"
+        folder, commit = h3_latent_upscale.KNOWN_UPSCALER_SOURCES[(repo, weight)]
+        assert h3_latent_upscale.required_weights(
+            {"model_name": repo, "weight_name": weight}
+        ) == [{"repo": repo, "filename": f"{folder}/{weight}", "revision": commit}]
+
+    def test_h3_upscaler_unknown_source_reads_its_root_at_main(self):
+        assert h3_latent_upscale.required_weights(
+            {"model_name": "org/h3up", "weight_name": "u.safetensors"}
+        ) == [{"repo": "org/h3up", "filename": "u.safetensors", "revision": None}]
+
+    def test_face_track_default_is_pinned(self):
+        assert face_track.required_weights({}) == [
+            {
+                "repo": face_track.DEFAULT_DETECTOR_REPO,
+                "filename": face_track.DEFAULT_DETECTOR_FILE,
+                "revision": face_track.DETECTOR_REVISION,
+            }
+        ]
+
+    def test_face_track_pin_is_for_the_default_repo_alone(self):
+        assert face_track.required_weights(
+            {"detector_repo": "org/yunet", "detector_file": "y.onnx"}
+        ) == [{"repo": "org/yunet", "filename": "y.onnx", "revision": None}]
+
+    def test_interpolate_frames_default_and_override(self):
+        assert interpolate_frames.required_weights({}) == [
+            {
+                "repo": "imaginairy/rife-interpolation",
+                "filename": "rife-flownet-4.13.2.safetensors",
+                "revision": None,
+            }
+        ]
+        assert interpolate_frames.required_weights(
+            {"model_name": "org/rife", "filename": "r.safetensors"}
+        ) == [{"repo": "org/rife", "filename": "r.safetensors", "revision": None}]
+
+    @pytest.mark.parametrize(
+        "arguments",
+        [
+            {"model_name": "previous_result:m", "filename": "r.safetensors"},
+            {"model_name": "/models/rife", "filename": "r.safetensors"},
+            {"model_name": "org/rife", "filename": "../../etc/passwd"},
+            {"model_name": "org/rife", "filename": "/abs/r.safetensors"},
+        ],
+    )
+    def test_a_reference_path_or_climbing_name_gives_no_entry(self, arguments):
+        assert interpolate_frames.required_weights(arguments) == []
+
+
+class TestFacexlib:
+    def test_not_installed_lists_both_urls(self, monkeypatch):
+        monkeypatch.setattr(restore_faces, "package_dir", lambda name: None)
+        assert restore_faces.required_weights({}) == [
+            {"url": restore_faces.FACEXLIB_DETECTION_URL},
+            {"url": restore_faces.FACEXLIB_PARSING_URL},
+        ]
+
+    def test_without_parse_only_detection_is_listed(self, monkeypatch):
+        monkeypatch.setattr(restore_faces, "package_dir", lambda name: None)
+        assert restore_faces.required_weights({"use_parse": False}) == [
+            {"url": restore_faces.FACEXLIB_DETECTION_URL}
+        ]
+
+    def test_a_weight_already_fetched_is_omitted(self, monkeypatch, tmp_path):
+        (tmp_path / "weights").mkdir()
+        (tmp_path / "weights" / "detection_Resnet50_Final.pth").write_bytes(b"w")
+        monkeypatch.setattr(restore_faces, "package_dir", lambda name: tmp_path)
+        assert restore_faces.required_weights({}) == [
+            {"url": restore_faces.FACEXLIB_PARSING_URL}
+        ]
+
+    def test_the_plan_lists_them_as_url_entries(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(restore_faces, "package_dir", lambda name: None)
+        monkeypatch.setattr(
+            dw.plan_downloads, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        spec = workflow(("restore_faces", {"use_parse": False}))
+        required = downloads_required(
+            spec, str(tmp_path), str(tmp_path), str(tmp_path / "hub"), False
+        )
+        assert [(d["repo"], d.get("url")) for d in required] == [
+            (None, restore_faces.FACEXLIB_DETECTION_URL)
+        ]
+
+    def test_the_hook_does_not_import_facexlib_or_cv2(self):
+        """torch is not asserted: importing dw loads it already."""
+        script = textwrap.dedent(
+            """
+            import sys
+            from dw.tasks.registry import required_weights_hook
+            import dw.tasks.model_handlers
+            required_weights_hook("restore_faces")({"model_name": "org/gfp"})
+            print(sorted({"facexlib", "cv2"} & set(sys.modules)))
+            """
+        )
+        out = subprocess.run(
+            [sys.executable, "-c", script], capture_output=True, text=True, check=True
+        )
+        assert out.stdout.strip().splitlines()[-1] == "[]"
+
+
+class TestThePlanChecksTheFile:
+    def test_an_uncached_file_is_listed_with_its_key(self, plan):
+        assert plan(workflow(("interpolate_frames", {}))) == [
+            {
+                "repo": "imaginairy/rife-interpolation",
+                "filename": "rife-flownet-4.13.2.safetensors",
+                "revision": None,
+                "gb": None,
+                "gated": None,
+                "access_blocked": None,
+            }
+        ]
+
+    def test_a_pinned_file_is_cached_without_refs_main(self, plan, hub):
+        cache(
+            hub,
+            face_track.DEFAULT_DETECTOR_REPO,
+            face_track.DEFAULT_DETECTOR_FILE,
+            commit=face_track.DETECTOR_REVISION,
+        )
+        assert plan(workflow(("crop_face_track", {}))) == []
+
+    def test_a_file_at_main_is_cached_through_refs_main(self, plan, hub):
+        cache(hub, "org/rife", "r.safetensors", ref="main")
+        spec = workflow(
+            (
+                "interpolate_frames",
+                {"model_name": "org/rife", "filename": "r.safetensors"},
+            )
+        )
+        assert plan(spec) == []
+
+    def test_another_file_of_the_repo_does_not_stand_in(self, plan, hub):
+        cache(hub, "org/rife", "other.safetensors", ref="main")
+        spec = workflow(
+            (
+                "interpolate_frames",
+                {"model_name": "org/rife", "filename": "r.safetensors"},
+            )
+        )
+        assert [(d["repo"], d["filename"]) for d in plan(spec)] == [
+            ("org/rife", "r.safetensors")
+        ]
+
+    def test_a_whole_repo_entry_subsumes_the_file(self, plan):
+        spec = workflow(
+            ("upscale", {"model_name": "org/up"}),
+            ("upscale", {"model_name": "org/up", "filename": "x.pth"}),
+        )
+        assert [(d["repo"], d.get("filename")) for d in plan(spec)] == [
+            ("org/up", None)
+        ]
+
+    def test_two_steps_naming_one_file_list_it_once(self, plan):
+        spec = workflow(("interpolate_frames", {}), ("interpolate_frames", {}))
+        assert len(plan(spec)) == 1
+
+
+class TestFileInfo:
+    def test_sizes_the_file_from_its_head(self, monkeypatch):
+        seen = {}
+
+        class Meta:
+            size = 3 * 1024**3
+
+        def head(url, timeout=None):
+            seen["url"] = url
+            return Meta()
+
+        monkeypatch.setattr(dw.plan_downloads, "get_hf_file_metadata", head)
+        assert dw.plan_downloads._file_info("org/r", "sub/w.safetensors", PIN) == (
+            3.0,
+            False,
+        )
+        assert PIN in seen["url"] and seen["url"].endswith("sub/w.safetensors")
+
+    def test_a_tiny_file_is_not_zero(self, monkeypatch):
+        class Meta:
+            size = 1000
+
+        monkeypatch.setattr(
+            dw.plan_downloads, "get_hf_file_metadata", lambda *a, **k: Meta()
+        )
+        assert dw.plan_downloads._file_info("org/r", "w.onnx", None) == (0.01, False)
+
+    def test_a_gated_file_is_blocked(self, monkeypatch):
+        import httpx
+        from huggingface_hub.utils import GatedRepoError
+
+        response = httpx.Response(403, request=httpx.Request("GET", "https://hf.co/x"))
+
+        def gated(*a, **k):
+            raise GatedRepoError("no access", response=response)
+
+        monkeypatch.setattr(dw.plan_downloads, "get_hf_file_metadata", gated)
+        assert dw.plan_downloads._file_info("org/r", "w.onnx", None) == (None, True)
+
+    def test_offline_is_unknown(self, monkeypatch):
+        def offline(*a, **k):
+            raise OSError("offline")
+
+        monkeypatch.setattr(dw.plan_downloads, "get_hf_file_metadata", offline)
+        assert dw.plan_downloads._file_info("org/r", "w.onnx", None) == (None, None)
+
+
+def test_gate_warnings_skip_an_entry_with_no_repo():
+    assert (
+        gate_warnings([{"repo": None, "url": "https://x/y", "access_blocked": True}])
+        == []
+    )
diff --git a/tests/test_task_weights.py b/tests/test_task_weights.py
new file mode 100644
index 000000000..084c6f0cd
--- /dev/null
+++ b/tests/test_task_weights.py
@@ -0,0 +1,506 @@
+"""What a task step fetches from the Hub (#975): each model-backed command's
+`required_weights` hook, that the loader resolves its repo through the same
+helper, and the pin that a task module touching the Hub declares one."""
+
+import ast
+import glob
+import importlib
+import os
+import re
+from unittest.mock import MagicMock
+
+import numpy
+import pytest
+from PIL import Image
+
+from dw.tasks.registry import required_weights_hook
+
+
+def declared(command, arguments=None):
+    """The repos `command`'s hook names for `arguments`, in order."""
+    hook = required_weights_hook(command)
+    assert hook is not None, command
+    return [entry["repo"] for entry in hook(arguments or {})]
+
+
+class TestSegment:
+    def test_the_defaults_are_the_detector_and_the_segmenter(self):
+        assert declared("segment") == [
+            "IDEA-Research/grounding-dino-base",
+            "facebook/sam2-hiera-large",
+        ]
+
+    def test_model_name_overrides_the_detector(self):
+        assert declared("segment", {"model_name": "org/dino"}) == [
+            "org/dino",
+            "facebook/sam2-hiera-large",
+        ]
+
+    def test_sam_model_name_overrides_the_segmenter(self):
+        assert declared("segment", {"sam_model_name": "org/sam"}) == [
+            "IDEA-Research/grounding-dino-base",
+            "org/sam",
+        ]
+
+    def test_a_null_override_is_the_default(self):
+        assert declared("segment", {"model_name": None}) == [
+            "IDEA-Research/grounding-dino-base",
+            "facebook/sam2-hiera-large",
+        ]
+
+    def test_a_reference_or_a_local_path_gives_no_entry_for_its_slot(self):
+        assert declared("segment", {"model_name": "previous_result:dino"}) == [
+            "facebook/sam2-hiera-large"
+        ]
+        assert declared("segment", {"sam_model_name": "/models/sam"}) == [
+            "IDEA-Research/grounding-dino-base"
+        ]
+        assert (
+            declared(
+                "segment",
+                {"model_name": "./models/dino", "sam_model_name": "/models/sam"},
+            )
+            == []
+        )
+
+
+class TestRemoveBackground:
+    def test_is_the_one_fixed_repo(self):
+        assert declared("remove_background") == ["briaai/RMBG-2.0"]
+
+    def test_the_command_name_is_not_case_sensitive(self):
+        assert declared("Remove_Background") == ["briaai/RMBG-2.0"]
+
+
+class TestDiffusionUpscale:
+    def test_the_default_mode_is_x4(self):
+        assert declared("diffusion_upscale") == [
+            "stabilityai/stable-diffusion-x4-upscaler"
+        ]
+
+    def test_x2_mode_names_the_latent_upscaler(self):
+        assert declared("diffusion_upscale", {"mode": "x2"}) == [
+            "stabilityai/sd-x2-latent-upscaler"
+        ]
+
+    def test_model_name_overrides_the_mode_default(self):
+        assert declared(
+            "diffusion_upscale", {"mode": "x2", "model_name": "org/up"}
+        ) == ["org/up"]
+
+    def test_an_unknown_mode_names_nothing(self):
+        assert declared("diffusion_upscale", {"mode": "x8"}) == []
+
+    def test_a_reference_mode_names_nothing(self):
+        assert declared("diffusion_upscale", {"mode": "previous_result:m"}) == []
+
+    def test_a_path_model_name_names_nothing(self):
+        assert declared("diffusion_upscale", {"model_name": "/models/up"}) == []
+
+
+class TestAudioTranscription:
+    @pytest.mark.parametrize("command", ["transcribe_audio", "check_script"])
+    def test_the_default_is_whisper_base(self, command):
+        assert declared(command) == ["openai/whisper-base"]
+
+    @pytest.mark.parametrize("command", ["transcribe_audio", "check_script"])
+    def test_model_name_overrides_it(self, command):
+        assert declared(command, {"model_name": "openai/whisper-small"}) == [
+            "openai/whisper-small"
+        ]
+
+    def test_a_reference_names_nothing(self):
+        assert declared("transcribe_audio", {"model_name": "previous_result:m"}) == []
+
+
+class TestSpeechGeneration:
+    def test_the_default_is_bark_small(self):
+        assert declared("generate_speech") == ["suno/bark-small"]
+
+    def test_model_name_overrides_it(self):
+        assert declared("generate_speech", {"model_name": "org/tts"}) == ["org/tts"]
+
+    def test_a_speaker_embedding_adds_the_speaker_encoder(self):
+        assert declared(
+            "generate_speech",
+            {"model_name": "microsoft/speecht5_tts", "speaker_embedding": "me.wav"},
+        ) == ["microsoft/speecht5_tts", "speechbrain/spkrec-xvect-voxceleb"]
+
+    def test_a_local_model_still_lists_the_speaker_encoder(self):
+        assert declared(
+            "generate_speech",
+            {"model_name": "/models/tts", "speaker_embedding": "me.wav"},
+        ) == ["speechbrain/spkrec-xvect-voxceleb"]
+
+
+class TestVoiceAttribution:
+    def test_is_only_the_speaker_embedder(self):
+        assert declared("attribute_voices") == ["speechbrain/spkrec-ecapa-voxceleb"]
+
+    def test_the_stem_separator_is_not_listed(self):
+        assert required_weights_hook("separate_stems") is None
+
+
+class TestTextGeneration:
+    def test_the_default_is_a_text_model(self):
+        assert declared("text_generation") == ["Qwen/Qwen2.5-1.5B-Instruct"]
+
+    def test_an_image_selects_the_vision_default(self):
+        assert declared("text_generation", {"image": "cup.png"}) == [
+            "HuggingFaceTB/SmolVLM-256M-Instruct"
+        ]
+
+    def test_an_empty_image_is_the_text_default(self):
+        assert declared("text_generation", {"image": None}) == [
+            "Qwen/Qwen2.5-1.5B-Instruct"
+        ]
+
+    def test_model_name_overrides_either_default(self):
+        assert declared("text_generation", {"model_name": "org/lm"}) == ["org/lm"]
+        assert declared("text_generation", {"model_name": "org/vlm", "image": "x"}) == [
+            "org/vlm"
+        ]
+
+    def test_a_local_path_names_nothing(self):
+        assert declared("text_generation", {"model_name": "/models/lm"}) == []
+
+
+class TestVisionTasks:
+    @pytest.mark.parametrize("command", ["image_to_text", "judge"])
+    def test_the_default_is_the_vision_model(self, command):
+        assert declared(command) == ["HuggingFaceTB/SmolVLM-256M-Instruct"]
+
+    @pytest.mark.parametrize("command", ["image_to_text", "judge"])
+    def test_model_name_overrides_it(self, command):
+        assert declared(command, {"model_name": "org/vlm"}) == ["org/vlm"]
+
+    @pytest.mark.parametrize("command", ["image_to_text", "judge"])
+    def test_a_reference_names_nothing(self, command):
+        assert declared(command, {"model_name": "previous_result:m"}) == []
+
+
+class TestImageProcessors:
+    @pytest.mark.parametrize(
+        "processor, repo",
+        [
+            ("depth", "Intel/dpt-hybrid-midas"),
+            ("depth_estimator", "Intel/dpt-large"),
+            ("depth_estimator_tensor", "Intel/dpt-large"),
+            ("openpose", "lllyasviel/Annotators"),
+            ("mlsd", "lllyasviel/Annotators"),
+            ("hed", "lllyasviel/Annotators"),
+            ("lineart", "lllyasviel/Annotators"),
+            ("teed", "fal-ai/teed"),
+            ("anyline", "TheMistoAI/MistoLine"),
+            ("sam", "ybelkada/segment-anything"),
+            ("segmentation", "openmmlab/upernet-convnext-small"),
+        ],
+    )
+    def test_a_model_backed_processor_names_its_repo(self, processor, repo):
+        assert declared(processor) == [repo]
+
+    @pytest.mark.parametrize(
+        "processor",
+        ["canny_cv", "resize_rescale", "crop_square", "dw_pose", "zoe_depth"],
+    )
+    def test_a_processor_that_fetches_nothing_from_the_hub_names_nothing(
+        self, processor
+    ):
+        assert declared(processor) == []
+
+
+class TestNoEntry:
+    @pytest.mark.parametrize("command", ["separate_stems", "no_such_command"])
+    def test_a_command_without_a_hook_has_none(self, command):
+        assert required_weights_hook(command) is None
+
+    def test_a_non_string_command_has_none(self):
+        assert required_weights_hook(None) is None
+
+    @pytest.mark.parametrize(
+        "name", ["previous_result:x", "variable:m", "/models/dino", "./models/x", 3]
+    )
+    @pytest.mark.parametrize(
+        "command, remaining",
+        [
+            ("segment", ["facebook/sam2-hiera-large"]),
+            ("text_generation", []),
+            ("transcribe_audio", []),
+            ("diffusion_upscale", []),
+            ("generate_speech", []),
+        ],
+    )
+    def test_a_name_that_is_not_a_hub_id_never_raises_and_gives_no_entry(
+        self, command, remaining, name
+    ):
+        assert declared(command, {"model_name": name}) == remaining
+
+    def test_missing_arguments_are_the_defaults(self):
+        assert required_weights_hook("transcribe_audio")(None) == [
+            {"repo": "openai/whisper-base"}
+        ]
+
+
+class Reached(Exception):
+    """Raised by a recording stand-in once it has what the test wants."""
+
+
+def recording_cache(monkeypatch, module, stop_at=None):
+    """Replace `module.cached_model` with a recorder of the cache keys it was
+    given - the key carries the repo the loader resolved. It raises Reached on
+    the first key whose first element is `stop_at` (or on the first, when None)
+    without running the factory, so no model loads."""
+    keys = []
+
+    def fake(key, factory):
+        keys.append(key)
+        if stop_at is None or key[0] == stop_at:
+            raise Reached
+        return (None, None)
+
+    monkeypatch.setattr(module, "cached_model", fake)
+    return keys
+
+
+class TestLoaderAgreesWithDeclaration:
+    """The hook and the loader read one resolution helper, so what the plan
+    lists is what the run loads, defaults and overrides alike."""
+
+    @pytest.mark.parametrize(
+        "arguments",
+        [
+            {},
+            {"model_name": "org/dino"},
+            {"sam_model_name": "org/sam"},
+            {"model_name": "org/dino", "sam_model_name": "org/sam"},
+        ],
+    )
+    def test_segment_loads_the_repos_it_declares(self, monkeypatch, arguments):
+        from dw.tasks import segment
+
+        keys = []
+        boxes = MagicMock()
+        boxes.__len__.return_value = 1
+        processor = MagicMock()
+        processor.post_process_grounded_object_detection.return_value = [
+            {"boxes": boxes, "scores": MagicMock(), "labels": []}
+        ]
+
+        def fake(key, factory):
+            keys.append(key)
+            if key[0] == "segment_sam":
+                raise Reached
+            return processor, MagicMock()
+
+        monkeypatch.setattr(segment, "cached_model", fake)
+        with pytest.raises(Reached):
+            segment.segment_image(Image.new("RGB", (8, 8)), "cup", **arguments)
+
+        assert [key[1] for key in keys] == declared("segment", arguments)
+
+    @pytest.mark.parametrize(
+        "arguments",
+        [
+            {},
+            {"mode": "x2"},
+            {"model_name": "org/up"},
+            {"mode": "x2", "model_name": "org/up"},
+        ],
+    )
+    def test_diffusion_upscale_loads_the_repo_it_declares(self, monkeypatch, arguments):
+        from dw.tasks import diffusion_upscale
+
+        keys = recording_cache(monkeypatch, diffusion_upscale)
+        with pytest.raises(Reached):
+            diffusion_upscale.diffusion_upscale(Image.new("RGB", (8, 8)), **arguments)
+
+        assert [key[2] for key in keys] == declared("diffusion_upscale", arguments)
+
+    @pytest.mark.parametrize("arguments", [{}, {"model_name": "org/asr"}])
+    def test_transcribe_audio_loads_the_repo_it_declares(self, monkeypatch, arguments):
+        from dw.tasks import audio_transcription
+
+        keys = recording_cache(monkeypatch, audio_transcription)
+        with pytest.raises(Reached):
+            audio_transcription.transcribe_audio(
+                numpy.zeros(1600, dtype=numpy.float32), sample_rate=16000, **arguments
+            )
+
+        assert [key[1] for key in keys] == declared("transcribe_audio", arguments)
+
+    @pytest.mark.parametrize("arguments", [{}, {"model_name": "org/tts"}])
+    def test_generate_speech_loads_the_repo_it_declares(self, monkeypatch, arguments):
+        from dw.tasks import speech_generation
+
+        keys = recording_cache(monkeypatch, speech_generation)
+        with pytest.raises(Reached):
+            speech_generation.generate_speech("hello", **arguments)
+
+        assert [key[1] for key in keys] == declared("generate_speech", arguments)
+
+    @pytest.mark.parametrize(
+        "arguments",
+        [
+            {},
+            {"model_name": "org/lm"},
+            {"image": Image.new("RGB", (8, 8))},
+            {"image": Image.new("RGB", (8, 8)), "model_name": "org/vlm"},
+        ],
+    )
+    def test_generate_text_loads_the_repo_it_declares(self, monkeypatch, arguments):
+        from dw.tasks import text_generation
+
+        keys = recording_cache(monkeypatch, text_generation)
+        with pytest.raises(Reached):
+            text_generation.generate_text("hi", **arguments)
+
+        assert [key[2] for key in keys] == declared("text_generation", arguments)
+
+
+TASKS = os.path.join(os.path.dirname(__file__), "..", "dw", "tasks")
+
+# A module reaching the Hub by any of these loads weights the plan has to name
+HUB_LOADS = re.compile(
+    r"hf_hub_download|from_pretrained|from_hparams|hf_pipeline\(|pipeline\(\s*[\"']"
+)
+
+# Modules that fetch only outside the Hugging Face cache would be listed here
+# with the reason; none do - voice_attribution's demucs download shares a module
+# with a speechbrain load, which it declares.
+OUTSIDE_THE_HF_CACHE = {}
+
+
+def task_modules():
+    for path in sorted(glob.glob(os.path.join(TASKS, "*.py"))):
+        yield os.path.basename(path)[:-3], path
+
+
+def declares_required_weights(path):
+    """Whether the module defines `required_weights` or imports one under that
+    name, at module level."""
+    with open(path, encoding="utf-8") as file:
+        tree = ast.parse(file.read())
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef) and node.name == "required_weights":
+            return True
+        if isinstance(node, ast.ImportFrom):
+            for alias in node.names:
+                if (alias.asname or alias.name) == "required_weights":
+                    return True
+    return False
+
+
+def hub_loading_modules():
+    found = set()
+    for name, path in task_modules():
+        with open(path, encoding="utf-8") as file:
+            if HUB_LOADS.search(file.read()):
+                found.add(name)
+    return found
+
+
+# Commands that share a module with a declared hook but name none, and why
+LOADS_NOTHING_THE_PLAN_LISTS = {
+    # demucs downloads outside the Hugging Face cache
+    "separate_stems": "voice_attribution's demucs",
+    # Decodes with MiniMaxAI/MiniMax-H3's VAE, which the H3 pipeline step
+    # that made the latents lists whole (#975 Q4)
+    "decode_h3_latents": "the H3 repo, listed by its pipeline step",
+    # Pastes crops back; loads no weights
+    "paste_face_track": "nothing",
+}
+
+
+class TestEveryHubLoadIsDeclared:
+    def test_the_scan_finds_the_modules_that_load_from_the_hub(self):
+        found = hub_loading_modules()
+        assert {
+            "segment",
+            "diffusion_upscale",
+            "audio_transcription",
+            "speech_generation",
+            "text_generation",
+            "depth_estimator",
+            "image_utils",
+        } <= found
+
+    def test_a_module_that_loads_from_the_hub_declares_required_weights(self):
+        undeclared = sorted(
+            name
+            for name, path in task_modules()
+            if name in hub_loading_modules()
+            and name not in OUTSIDE_THE_HF_CACHE
+            and not declares_required_weights(path)
+        )
+        assert not undeclared, (
+            f"{undeclared} load from the Hub with no required_weights, so the "
+            "plan cannot list what they download (#975)"
+        )
+
+    def test_every_registered_command_in_a_declaring_module_names_its_hook(self):
+        from dw.tasks import registry
+
+        importlib.import_module("dw.tasks.model_handlers")
+        declaring = {
+            name
+            for name, path in task_modules()
+            if name in hub_loading_modules() and declares_required_weights(path)
+        }
+        unnamed = []
+        for command, rules in registry._COMMAND_RULES.items():
+            module = (rules.get("implementation") or "").split(".")
+            if len(module) < 4 or module[:2] != ["dw", "tasks"]:
+                continue
+            if command in LOADS_NOTHING_THE_PLAN_LISTS:
+                continue
+            if module[2] in declaring and not rules.get("required_weights"):
+                unnamed.append(command)
+        assert not unnamed, f"{unnamed} register without required_weights"
+
+    def test_every_named_hook_resolves_to_a_callable(self):
+        from dw.tasks import registry
+
+        importlib.import_module("dw.tasks.model_handlers")
+        for command, rules in registry._COMMAND_RULES.items():
+            if rules.get("required_weights"):
+                assert callable(required_weights_hook(command)), command
+
+
+def _dw_imports(path):
+    """Every `dw` module `path` imports, top-level or inside a function (grimp
+    counts both as edges), as dotted names relative to dw/tasks."""
+    found = set()
+    for node in ast.walk(ast.parse(open(path).read())):
+        if isinstance(node, ast.ImportFrom) and (
+            node.level or (node.module or "").startswith("dw.")
+        ):
+            found.add("." * node.level + (node.module or ""))
+        elif isinstance(node, ast.Import):
+            found |= {a.name for a in node.names if a.name.startswith("dw.")}
+    return found
+
+
+class TestTheHookPathStaysAcyclic:
+    """The plan asks the registry for a hook; the registry is read by
+    dw/locations.py; the task modules import the location policy and
+    dw/tasks/weights.py. So neither the registry nor weights.py may import a
+    task module or the location policy, even lazily, or the architecture
+    ratchet's `import_cycles` counts the loop (the one it did count: weights
+    -> locations -> registry -> image_utils -> background_remover -> weights).
+    The registry reaches a processor's hook through `register_weights_fallback`
+    instead, and `validate_weight_name` lives in dw/security.py."""
+
+    def test_weights_imports_only_the_security_leaf_from_dw(self):
+        assert _dw_imports(os.path.join(TASKS, "weights.py")) == {"..security"}
+
+    def test_the_registry_imports_nothing_from_dw(self):
+        assert _dw_imports(os.path.join(TASKS, "registry.py")) == set()
+
+    def test_a_processor_hook_is_registered_not_imported(self):
+        from dw.tasks import image_utils, registry
+
+        assert image_utils.processor_weights_hook in registry._WEIGHTS_FALLBACKS
+        assert required_weights_hook("Remove_Background")({}) == [
+            {"repo": "briaai/RMBG-2.0"}
+        ]
+        assert image_utils.processor_weights_hook("not_a_processor") is None
diff --git a/tests/test_vram_estimate.py b/tests/test_vram_estimate.py
index b0e351962..47c785b23 100644
--- a/tests/test_vram_estimate.py
+++ b/tests/test_vram_estimate.py
@@ -12,7 +12,12 @@
 import pytest
 
 import dw.validation
-from dw.vram_estimate import apply_vram_estimate, reference_count, vram_estimate_errors
+from dw.vram_estimate import (
+    apply_vram_estimate,
+    largest_projection,
+    reference_count,
+    vram_estimate_errors,
+)
 from dw.workflow import workflow_from_definition
 
 
@@ -438,3 +443,103 @@ def test_a_projection_between_the_real_card_and_its_rounded_catalog_entry_is_ref
     assert vram_estimate_errors(d, device_type="cuda", capacity_gb=24) == []
     with pytest.raises(ValueError):
         apply_vram_estimate(d, d["variables"], device_type="cuda", capacity_gb=23.6)
+
+
+def test_a_projection_past_both_the_catalog_card_and_the_real_card_is_one_error():
+    # Over a 3090's "24" and its reported 23.6 alike: one error naming the
+    # declared card, not one per ceiling (#1053)
+    d = definition()
+    d["vram_estimate"] = {
+        "voxel_variables": ["width", "height", "num_frames"],
+        "base_gb": 30,
+        "bytes_per_voxel": 1,
+    }
+    errors = vram_estimate_errors(
+        d, device_type="cuda", capacity_gb=23.6, capacity_label="cuda:0 RTX 3090"
+    )
+    assert len(errors) == 1
+    assert "declared for RTX 3090" in errors[0]["message"]
+
+
+# --- refine_tiles (#1043): denoise per tile, decode at the canvas -----------
+
+H3_768P = {
+    "base_gb": 16.3,
+    "bytes_per_voxel": 28.71,
+    "voxel_variables": ["width", "height", "num_frames"],
+}
+
+
+def _h3_refine(canvas=(1920, 1088), frames=124, tiles=None):
+    arguments = {"width": canvas[0], "height": canvas[1], "num_frames": frames}
+    if tiles is not None:
+        arguments["refine_tiles"] = tiles
+    return {
+        "cost": [
+            {"device": "cuda", "name": "RTX 3090", "vram_gb": 24, "minutes": 9.87}
+        ],
+        "vram_estimate": dict(H3_768P),
+        "steps": [{"name": "refine", "pipeline": {"arguments": arguments}}],
+    }
+
+
+def _projected(definition):
+    return largest_projection(definition, device_type="cuda")["gb"]
+
+
+def _tiles(width=1344, height=768, overlap=128):
+    return {"width": width, "height": height, "overlap": overlap}
+
+
+def test_a_tiled_refine_denoises_at_the_tile_size():
+    gb = _projected(_h3_refine(tiles=_tiles()))
+    assert gb == pytest.approx(16.3 + 28.71 * 1344 * 768 * 124 / 1024**3)
+    assert gb == pytest.approx(19.7, abs=0.05)
+
+
+def test_the_canvas_decode_term_wins_when_it_dominates():
+    definition = _h3_refine(frames=2000, tiles=_tiles(320, 320))
+    decode = 28.71 * 1920 * 1088 * 2000 / 1024**3
+    denoise = 16.3 + 28.71 * 320 * 320 * 2000 / 1024**3
+    assert decode > denoise
+    assert _projected(definition) == pytest.approx(decode)
+
+
+def test_an_untiled_step_is_unchanged():
+    gb = _projected(_h3_refine())
+    assert gb == pytest.approx(16.3 + 28.71 * 1920 * 1088 * 124 / 1024**3)
+
+
+def test_a_tiled_step_that_warns_untiled_does_not_when_tiled():
+    untiled = _h3_refine(frames=250)
+    assert _projected(untiled) > 24
+    assert vram_estimate_errors(untiled, device_type="cuda")
+    tiled = _h3_refine(frames=250, tiles=_tiles())
+    assert _projected(tiled) < 24
+    assert vram_estimate_errors(tiled, device_type="cuda") == []
+
+
+def test_a_tiled_error_message_names_what_was_priced():
+    errors = vram_estimate_errors(
+        _h3_refine(frames=2000, tiles=_tiles(320, 320)), device_type="cuda"
+    )
+    message = errors[0]["message"]
+    assert "320*320*2000 (refine_tiles 320x320: denoise priced per tile" in message
+    assert "decode at the 1920x1088 canvas" in message
+
+
+@pytest.mark.parametrize(
+    "tiles",
+    [
+        "1344x768",
+        [1344, 768],
+        {"width": "wide", "height": 768},
+        {"width": 1344},
+        {"width": True, "height": 768},
+        {"width": 0, "height": 768},
+    ],
+)
+def test_a_malformed_refine_tiles_falls_back_to_the_untiled_projection(tiles):
+    assert _projected(_h3_refine(tiles=tiles)) == pytest.approx(
+        _projected(_h3_refine())
+    )
diff --git a/tests/test_vram_inheritance.py b/tests/test_vram_inheritance.py
index dde56d230..7f0d8275a 100644
--- a/tests/test_vram_inheritance.py
+++ b/tests/test_vram_inheritance.py
@@ -343,12 +343,23 @@ def _numbers(definition):
     return tuple(estimate.get(field) for field in _ESTIMATE_FIELDS), cards
 
 
-def disagreements(catalog):
+# Templates measured on their own: they carry a formula that differs from
+# their identity's, because their bound is a different point on the card. Only
+# a name here may differ; every other template on the identity carries the
+# identity-level formula, or declares none and inherits it
+TEMPLATE_SPECIFIC = {"templates/ltx2/reference-sheet"}
+
+
+def disagreements(catalog, specific=()):
     """Every identity two templates declare different ceilings for. A
-    template with no card agrees on the formula alone."""
+    template with no card agrees on the formula alone. A template named in
+    `specific` is compared with nothing: its formula overrides the identity's
+    for that template only."""
     seen = {}
     found = []
     for identity, name, definition in declarations(catalog):
+        if name in specific:
+            continue
         formula, cards = _numbers(definition)
         if identity not in seen:
             seen[identity] = (name, formula)
@@ -362,7 +373,37 @@ def disagreements(catalog):
 def test_every_template_declaring_one_identity_declares_the_same_numbers():
     catalog = _real_catalog()
     assert len(list(declarations(catalog))) > 1
-    assert disagreements(catalog) == []
+    assert disagreements(catalog, TEMPLATE_SPECIFIC) == []
+
+
+def test_a_template_specific_formula_overrides_only_for_its_own_template():
+    catalog = _real_catalog()
+    by_name = {name: (identity, d) for identity, name, d in declarations(catalog)}
+    index = build_index(catalog)
+    for name in TEMPLATE_SPECIFIC:
+        identity, definition = by_name[name]
+        formula = _numbers(definition)[0]
+        # It really differs (a stale entry would hide a drift) ...
+        siblings = [
+            _numbers(d)[0]
+            for i, n, d in declarations(catalog)
+            if i == identity and n not in TEMPLATE_SPECIFIC
+        ]
+        assert siblings and all(formula != other for other in siblings), name
+        # ... and inheritance still resolves to the identity-level formula
+        assert index[identity]["template"] not in TEMPLATE_SPECIFIC
+
+
+def test_a_specific_template_is_exempt_but_a_sibling_is_not():
+    drifted = {**REF2VA_ESTIMATE, "base_gb": 15.0}
+    catalog = [
+        ("templates/a", _template("ref2va", REF2VA_ESTIMATE)),
+        ("templates/b", _template("ref2va", drifted, cost=None)),
+        ("templates/c", _template("ref2va", drifted, cost=None)),
+    ]
+    assert disagreements(catalog, {"templates/b"}) == [
+        (REF2VA, "templates/a", "templates/c")
+    ]
 
 
 def test_every_card_a_shared_identity_declares_is_the_same_card():
@@ -442,3 +483,73 @@ def test_a_job_over_an_inherited_ceiling_queues_and_carries_the_warning(api):
     assert response.status_code == 201, response.text
     (warning,) = _inherited(response.json()["warnings"])
     assert "templates/minimax/reference-to-video" in warning
+
+
+# --- a note when the config differs from the calibrated one (#954) ---------------
+
+
+def _with_config(step, **configuration):
+    step = copy.deepcopy(step)
+    step["pipeline"]["configuration"].update(configuration)
+    return step
+
+
+def _calibrated_index(**configuration):
+    template = _template("ref2va", REF2VA_ESTIMATE)
+    template["steps"] = [_with_config(s, **configuration) for s in template["steps"]]
+    return build_index([("templates/calibrated", template)])
+
+
+class TestConfigDiffers:
+    def _kinds(self, warnings, kind):
+        return [w for w in warnings if f": {kind}:" in w]
+
+    def test_missing_offload_under_the_ceiling_notes_it(self):
+        index = _calibrated_index(offload="model")
+        step = _h3_step("shot", num_frames=124)
+        warnings = _warnings(_inline(step), index=index)
+        (warning,) = warnings
+        assert "vram_config_differs" in warning
+        assert "templates/calibrated" in warning
+        assert "offload: model" in warning
+        assert "no offload" in warning
+        assert "24 GB" in warning
+
+    def test_a_different_quantization_notes_it(self):
+        quantization = {"quantization_config": {"quant_type": "nf4"}}
+        index = _calibrated_index(**quantization)
+        warnings = _warnings(_inline(_h3_step("shot", num_frames=124)), index=index)
+        (warning,) = self._kinds(warnings, "vram_config_differs")
+        assert "quantization_config" in warning
+        assert "no quantization" in warning
+
+    def test_the_same_config_says_nothing(self):
+        index = _calibrated_index(offload="model")
+        step = _with_config(_h3_step("shot", num_frames=124), offload="model")
+        assert _warnings(_inline(step), index=index) == []
+
+    def test_its_own_estimate_says_nothing(self):
+        index = _calibrated_index(offload="model")
+        definition = _inline(
+            _h3_step("shot", num_frames=124),
+            vram_estimate={**REF2VA_ESTIMATE, "base_gb": 4.0},
+            cost=CARD,
+        )
+        assert _warnings(definition, index=index) == []
+
+    def test_over_the_ceiling_one_warning_names_the_difference(self):
+        index = _calibrated_index(offload="model")
+        warnings = _warnings(_inline(_h3_step("shot")), index=index)
+        (warning,) = warnings
+        assert f": {KIND}:" in warning
+        assert "vram_config_differs" not in warning
+        assert "its offload differs from the template's" in warning
+        assert "offload: model" in warning and "no offload" in warning
+
+    def test_offload_set_through_an_overridden_variable_is_compared_resolved(self):
+        index = _calibrated_index(offload="model")
+        step = _with_config(_h3_step("shot", num_frames=124), offload="variable:mode")
+        definition = _inline(step, variables={"mode": "model"})
+        assert _warnings(definition, index=index) == []
+        (warning,) = _warnings(definition, index=index, arguments={"mode": None})
+        assert "vram_config_differs" in warning
diff --git a/tests/test_worker_execute.py b/tests/test_worker_execute.py
index 2786dc436..6d441826b 100644
--- a/tests/test_worker_execute.py
+++ b/tests/test_worker_execute.py
@@ -699,3 +699,36 @@ def test_same_warm_identity_probes_the_cache(self):
     def test_cold_card_probes_the_cache(self):
         messages, _ = self._probe(_make_worker(), None, "/w/a.json")
         assert messages[0]["cached"] == ["gen"]
+
+
+class _RaisingWorkflow(StubWorkflow):
+    def __init__(self, message):
+        super().__init__()
+        self.message = message
+
+    def run(self, *args, **kwargs):
+        raise RuntimeError(self.message)
+
+
+def test_sticky_cuda_error_flags_the_worker_to_restart():
+    """A device-side assert poisons the CUDA context, so the worker exits
+    after replying and the manager respawns it."""
+    worker = _make_worker()
+    messages = _execute(
+        worker, _RaisingWorkflow("CUDA error: device-side assert triggered")
+    )
+    assert "error" in [m["type"] for m in messages]
+    assert worker.pending_shutdown is True
+
+
+def test_ordinary_failure_keeps_the_worker():
+    worker = _make_worker()
+    _execute(worker, _RaisingWorkflow("bad prompt"))
+    assert worker.pending_shutdown is False
+
+
+def test_poisons_cuda_context_matches_sticky_errors_only():
+    from dw.worker_protocol import poisons_cuda_context
+
+    assert poisons_cuda_context("x", "Returning 710 (CUDA_ERROR_ASSERT) from y")
+    assert not poisons_cuda_context("CUDA out of memory", None)
diff --git a/tests/test_zimage_vram.py b/tests/test_zimage_vram.py
new file mode 100644
index 000000000..867ca14f8
--- /dev/null
+++ b/tests/test_zimage_vram.py
@@ -0,0 +1,61 @@
+"""The Z-Image catalog entry's VRAM estimate (#945): a batch-size voxel
+variable projects like frames do, and the numbers match what lem measured."""
+
+import json
+import os
+
+from dw.vram_estimate import required_gb, vram_estimate_errors
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _entry():
+    with open(os.path.join(REPO_ROOT, "workflows", "models", "z-image.json")) as f:
+        return json.load(f)
+
+
+def _at(entry, **overrides):
+    """The entry as the run executes it: variables substituted into the step."""
+    entry["variables"].update(overrides)
+    arguments = entry["steps"][0]["pipeline"]["arguments"]
+    for key, value in arguments.items():
+        if isinstance(value, str) and value.startswith("variable:"):
+            arguments[key] = entry["variables"][value.split(":", 1)[1]]
+    return entry
+
+
+def test_the_projection_matches_the_lem_measurements():
+    estimate = _entry()["vram_estimate"]
+    for n, w, h, measured in [
+        (1, 512, 512, 12.16),
+        (1, 1024, 1024, 12.88),
+        (4, 960, 544, 13.83),
+        (4, 1344, 768, 15.80),
+    ]:
+        projected = required_gb(
+            estimate, {"num_images_per_prompt": n, "width": w, "height": h}
+        )
+        assert abs(projected - measured) < 0.4, (n, w, h, projected)
+
+
+def test_batch_size_moves_the_projection_and_is_not_a_frame_count():
+    estimate = _entry()["vram_estimate"]
+    one = required_gb(
+        estimate, {"num_images_per_prompt": 1, "width": 1344, "height": 768}
+    )
+    eight = required_gb(
+        estimate, {"num_images_per_prompt": 8, "width": 1344, "height": 768}
+    )
+    assert eight > one + 5
+
+
+def test_the_default_and_the_field_report_shape_fit_a_24gb_card():
+    for overrides in ({}, {"width": 1344, "height": 768}):
+        entry = _at(_entry(), **overrides)
+        assert vram_estimate_errors(entry, device_type="cuda", capacity_gb=23.6) == []
+
+
+def test_a_batch_past_the_card_warns():
+    entry = _at(_entry(), width=1344, height=768, num_images_per_prompt=16)
+    errors = vram_estimate_errors(entry, device_type="cuda", capacity_gb=23.6)
+    assert errors and "RTX 3090" in errors[0]["message"]
diff --git a/ui/package-lock.json b/ui/package-lock.json
index d4295f1b8..020afbdc0 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -3995,9 +3995,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.11.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
-      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/ui/src/lib/editor/FlowView.svelte b/ui/src/lib/editor/FlowView.svelte
index e6bfb977f..3352aee39 100644
--- a/ui/src/lib/editor/FlowView.svelte
+++ b/ui/src/lib/editor/FlowView.svelte
@@ -1,6 +1,21 @@
 <script lang="ts">
   import { dataFlowGraph, type FlowNode } from '../flow'
   import { formatDuration } from '../format'
+  import {
+    BOX_H,
+    BOX_W,
+    CHIP_CHARS,
+    CHIP_CHARS_TIMED,
+    CHIP_H,
+    CHIP_STEP,
+    CHIP_TOP,
+    DETAIL_CHARS,
+    NAME_CHARS,
+    NAME_CHARS_WITH_TAG,
+    fit,
+    heightOf,
+    layoutGraph,
+  } from './flowLayout'
 
   let {
     workflow,
@@ -40,23 +55,6 @@
 
   const graph = $derived(dataFlowGraph(workflow))
 
-  // SVG text neither wraps nor takes text-overflow, so a label longer than
-  // the box ran out of its right edge. Budgets are characters at the box's
-  // inner width (BOX_W less the 10px inset each side) for each line's font
-  // - bold 12px sans for the name, 10px mono for the detail - and the
-  // clipPath below catches what a wider glyph set still pushes past.
-  const NAME_CHARS = 20
-  const NAME_CHARS_WITH_TAG = 15 // the entry tag sits in the top-right corner
-  const DETAIL_CHARS = 26
-
-  /** The text cut to `max` characters with an ellipsis where it was cut: a
-   * name is told apart by how it starts, a path by how it ends. */
-  function fit(text: string, max: number, keep: 'head' | 'tail'): string {
-    if (text.length <= max) return text
-    return keep === 'head'
-      ? text.slice(0, max - 1) + '…'
-      : '…' + text.slice(text.length - max + 1)
-  }
   /** The parts of a node's labels that did not fit, in full, for its tooltip. */
   function overflowTitle(node: FlowNode): string {
     const nameShown = fit(
@@ -74,105 +72,9 @@
       .join('\n')
   }
 
-  // Layered left-to-right layout: a node's layer is one past the deepest
-  // producer that feeds it directly, so entry points (no previous_result
-  // input) sit in the first column and depth reads as real dependency
-  // distance rather than just JSON step order.
-  const BOX_W = 176
-  const BOX_H = 60
-  const COL_W = 232
-  const ROW_H = 92
-  const PAD = 28
-  // Member chips: a list-driven step's box grows to hold one inset chip
-  // per entry, beneath the header the ordinary box's three lines occupy
-  const CHIP_H = 15
-  const CHIP_STEP = 19
-  const CHIP_CHARS = 26
-  const CHIP_CHARS_TIMED = 17 // a finished chip's run time takes the right end
-  const CHIP_TOP = BOX_H - 2
-  // The gap ROW_H left between fixed-height boxes, kept for the
-  // height-aware stacking below
-  const ROW_GAP = ROW_H - BOX_H
-
-  /** The box's height: the standard header, plus a chip row per entry for
-   * a list-driven step - or one empty slot when the step carries
-   * for_each but its list cannot be read from the definition. */
-  function heightOf(node: FlowNode): number {
-    const count = node.members?.length ?? 0
-    if (count) return CHIP_TOP + (count - 1) * CHIP_STEP + CHIP_H + 6
-    return node.forEach ? BOX_H + 26 : BOX_H
-  }
-
-  const layout = $derived.by(() => {
-    const { nodes, edges } = graph
-    // Plain objects rather than Map/Set here: these are throw-away
-    // scratch structures rebuilt on every recompute, not reactive state,
-    // and svelte's lint rule wants SvelteMap for anything mutated after
-    // construction.
-    const producersOf: Record<string, string[]> = {}
-    for (const e of edges) {
-      producersOf[e.to] = [...(producersOf[e.to] ?? []), e.from]
-    }
-    const layerOf: Record<string, number> = {}
-    function layerFor(name: string, guard: Record<string, true>): number {
-      if (name in layerOf) return layerOf[name]
-      if (guard[name]) return 0 // defensive only - refs only target earlier steps
-      const nextGuard = { ...guard, [name]: true as const }
-      const producers = producersOf[name] ?? []
-      const layer = producers.length
-        ? 1 + Math.max(...producers.map((p) => layerFor(p, nextGuard)))
-        : 0
-      layerOf[name] = layer
-      return layer
-    }
-    for (const n of nodes) layerFor(n.name, {})
-
-    const columns: FlowNode[][] = []
-    for (const n of nodes) {
-      const l = layerOf[n.name] ?? 0
-      columns[l] = [...(columns[l] ?? []), n]
-    }
-
-    // Boxes in a column stack by their own height now - a for_each box
-    // holding many chips must not overlap the node beneath it
-    const positions: Record<string, { x: number; y: number }> = {}
-    const heightOfName: Record<string, number> = {}
-    const bottoms: number[] = []
-    columns.forEach((col, c) => {
-      let y = PAD
-      col.forEach((n) => {
-        positions[n.name] = { x: PAD + c * COL_W, y }
-        heightOfName[n.name] = heightOf(n)
-        y += heightOf(n) + ROW_GAP
-      })
-      bottoms.push(y - ROW_GAP)
-    })
-
-    const width = PAD * 2 + BOX_W + Math.max(0, columns.length - 1) * COL_W
-    const height = Math.max(...bottoms, PAD * 2 + BOX_H)
-    // One clip box per distinct member-box height; the standard box keeps
-    // the shared clipPath below
-    const tallHeights = [
-      ...new Set(nodes.map((n) => heightOf(n)).filter((h) => h > BOX_H)),
-    ]
-
-    const edgeLines = edges.map((e) => {
-      const from = positions[e.from]
-      const to = positions[e.to]
-      if (!from || !to) return null
-      const x1 = from.x + BOX_W
-      const y1 = from.y + (heightOfName[e.from] ?? BOX_H) / 2
-      const x2 = to.x
-      const y2 = to.y + (heightOfName[e.to] ?? BOX_H) / 2
-      // A gentle horizontal-first curve keeps lines readable when an
-      // edge skips columns or two edges share a target row.
-      const dx = Math.max(40, (x2 - x1) / 2)
-      const path = `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`
-      return { ...e, path, labelX: (x1 + x2) / 2, labelY: (y1 + y2) / 2 }
-    })
-
-    return { positions, width, height, tallHeights, edgeLines }
-  })
+  // The geometry - box positions, lanes, edge paths - is flowLayout.ts;
+  // the template draws what it returns
+  const layout = $derived(layoutGraph(graph))
 
   function kindLabel(kind: string): string {
     if (kind === 'pipeline') return 'pipeline'
@@ -254,8 +156,15 @@
         {#each layout.edgeLines ?? [] as edge, i (i)}
           {#if edge}
             <path d={edge.path} class="edge" marker-end="url(#flow-arrow)" />
-            <text x={edge.labelX} y={edge.labelY - 6} class="edgelabel"
-              >{edge.attribute}</text
+          {/if}
+        {/each}
+        <!-- Labels after every line, so a label's halo masks a line that
+             crosses it rather than the line striking the label through -->
+        {#each layout.edgeLines ?? [] as edge, i (i)}
+          {#if edge}
+            <text x={edge.labelX} y={edge.labelY} class="edgelabel"
+              >{#if edge.label !== edge.title}<title>{edge.title}</title
+                >{/if}{edge.label}</text
             >
           {/if}
         {/each}
@@ -404,6 +313,10 @@
     fill: var(--muted);
     text-anchor: middle;
     font-family: var(--font-mono);
+    paint-order: stroke;
+    stroke: var(--panel-2);
+    stroke-width: 3px;
+    stroke-linejoin: round;
   }
   .node.clickable {
     cursor: pointer;
diff --git a/ui/src/lib/editor/FlowView.test.ts b/ui/src/lib/editor/FlowView.test.ts
index 7376c9ea3..8aa03347c 100644
--- a/ui/src/lib/editor/FlowView.test.ts
+++ b/ui/src/lib/editor/FlowView.test.ts
@@ -195,3 +195,90 @@ describe('for_each members', () => {
     expect(shot.querySelector('.membersunknown')?.textContent).toBe('for_each')
   })
 })
+
+describe('edges', () => {
+  // Job 16c15bbff9d9's shape: base feeds up, refine and mux, so two edges
+  // skip a column, and base -> mux carries two arguments
+  const skipping = {
+    steps: [
+      { name: 'base', pipeline: {} },
+      {
+        name: 'up',
+        task: { arguments: { latents: 'previous_result:base.latents' } },
+      },
+      {
+        name: 'refine',
+        pipeline: {
+          arguments: {
+            latents: 'previous_result:up',
+            hold_audio: 'previous_result:base.audio',
+          },
+        },
+      },
+      {
+        name: 'mux',
+        task: {
+          arguments: {
+            video: 'previous_result:refine.videos',
+            audio: 'previous_result:base.audio',
+            sample_rate: 'previous_result:base.sampling_rate',
+          },
+        },
+      },
+    ],
+  }
+
+  it('draws one line per pair of steps, labeled with every argument it feeds', () => {
+    const { container } = render(FlowView, { workflow: skipping })
+    expect(container.querySelectorAll('path.edge')).toHaveLength(5)
+    const labels = [...container.querySelectorAll('text.edgelabel')].map(
+      (t) => t.textContent,
+    )
+    expect(labels).toContain('audio, sample_rate')
+    expect(labels).not.toContain('audio')
+  })
+
+  it('gives every label its own place, lane labels above the boxes', () => {
+    const { container } = render(FlowView, { workflow: skipping })
+    const labels = [...container.querySelectorAll('text.edgelabel')]
+    const places = labels.map(
+      (t) => `${t.getAttribute('x')},${t.getAttribute('y')}`,
+    )
+    expect(new Set(places).size).toBe(places.length)
+
+    const nodeTop = Number(
+      /translate\([^,]+, ([\d.]+)\)/.exec(
+        nodeFor(container, 'up').getAttribute('transform')!,
+      )![1],
+    )
+    const laneLabels = labels.filter((t) =>
+      ['hold_audio', 'audio, sample_rate'].includes(t.textContent!),
+    )
+    expect(laneLabels).toHaveLength(2)
+    for (const t of laneLabels)
+      expect(Number(t.getAttribute('y'))).toBeLessThan(nodeTop)
+  })
+
+  it('keeps the whole argument list on hover when the label is cut', () => {
+    const long = {
+      steps: [
+        { name: 'a', pipeline: {} },
+        {
+          name: 'b',
+          pipeline: {
+            arguments: {
+              first_very_long_argument: 'previous_result:a',
+              second_very_long_argument: 'previous_result:a',
+            },
+          },
+        },
+      ],
+    }
+    const { container } = render(FlowView, { workflow: long })
+    const label = container.querySelector('text.edgelabel')!
+    expect(label.textContent).toMatch(/…$/)
+    expect(label.querySelector('title')?.textContent).toBe(
+      'first_very_long_argument, second_very_long_argument',
+    )
+  })
+})
diff --git a/ui/src/lib/editor/flowLayout.test.ts b/ui/src/lib/editor/flowLayout.test.ts
new file mode 100644
index 000000000..6e4f8534e
--- /dev/null
+++ b/ui/src/lib/editor/flowLayout.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import { dataFlowGraph } from '../flow'
+import { BOX_W, layersOf, layoutGraph, pairsOf } from './flowLayout'
+
+const step = (name: string, args: Record<string, string> = {}) => ({
+  name,
+  pipeline: { configuration: { component_type: 'Fake' }, arguments: args },
+})
+
+describe('layoutGraph', () => {
+  it('merges two references between the same steps into one labelled edge', () => {
+    const graph = dataFlowGraph({
+      steps: [
+        step('gen'),
+        step('edit', {
+          image: 'previous_result:gen',
+          mask: 'previous_result:gen',
+        }),
+      ],
+    })
+    const pairs = pairsOf(graph.edges, layersOf(graph.nodes, graph.edges))
+    expect(pairs).toHaveLength(1)
+    expect(pairs[0].attributes).toEqual(['image', 'mask'])
+    expect(pairs[0].lane).toBe(-1)
+    const layout = layoutGraph(graph)
+    expect(layout.edgeLines).toHaveLength(1)
+    expect(layout.edgeLines[0]?.label).toBe('image, mask')
+    expect(layout.edgeLines[0]?.title).toBe('image, mask')
+  })
+
+  it('places a consumer one column right of its deepest producer', () => {
+    const graph = dataFlowGraph({
+      steps: [
+        step('a'),
+        step('b', { image: 'previous_result:a' }),
+        step('c', { image: 'previous_result:b', mask: 'previous_result:a' }),
+      ],
+    })
+    expect(layersOf(graph.nodes, graph.edges)).toEqual({ a: 0, b: 1, c: 2 })
+    const { positions } = layoutGraph(graph)
+    expect(positions.b.x - positions.a.x).toBeGreaterThan(BOX_W)
+    expect(positions.c.x - positions.b.x).toBe(positions.b.x - positions.a.x)
+  })
+
+  it('routes a column-skipping edge in a lane above the boxes', () => {
+    const graph = dataFlowGraph({
+      steps: [
+        step('a'),
+        step('b', { image: 'previous_result:a' }),
+        step('c', { image: 'previous_result:b', mask: 'previous_result:a' }),
+      ],
+    })
+    const pairs = pairsOf(graph.edges, layersOf(graph.nodes, graph.edges))
+    const skip = pairs.find((p) => p.from === 'a' && p.to === 'c')!
+    expect(skip.span).toBe(2)
+    expect(skip.lane).toBe(0)
+    const layout = layoutGraph(graph)
+    const laneEdge = layout.edgeLines[pairs.indexOf(skip)]!
+    // The lane sits above every box, and the label on it
+    expect(laneEdge.labelY).toBeLessThan(layout.positions.a.y)
+    expect(laneEdge.path).toContain(' V ')
+    const direct = layout.edgeLines[pairs.indexOf(pairs[0])]!
+    expect(direct.path.startsWith('M ')).toBe(true)
+    expect(direct.path).toContain(' C ')
+  })
+})
diff --git a/ui/src/lib/editor/flowLayout.ts b/ui/src/lib/editor/flowLayout.ts
new file mode 100644
index 000000000..0b01a8705
--- /dev/null
+++ b/ui/src/lib/editor/flowLayout.ts
@@ -0,0 +1,329 @@
+/** The geometry of FlowView's diagram: pure functions from the data-flow
+ * graph to box positions and edge paths, with the pixel constants the
+ * template draws against. Nothing here is reactive - FlowView derives
+ * `layoutGraph(graph)` and reads the result. */
+
+import type { DataFlowGraph, FlowEdge, FlowNode } from '../flow'
+
+// Layered left-to-right layout: a node's layer is one past the deepest
+// producer that feeds it directly, so entry points (no previous_result
+// input) sit in the first column and depth reads as real dependency
+// distance rather than just JSON step order.
+export const BOX_W = 176
+export const BOX_H = 60
+const ROW_H = 92
+const PAD = 28
+// The gap between columns: at least this, wider when an adjacent edge's
+// label needs it, so a label sits in the gap rather than under a box
+const MIN_GAP = 56
+const LABEL_CHARS = 24
+const LABEL_CHAR_W = 6.2 // 10px mono
+// An edge that skips a column runs in its own lane above every box,
+// dropping through the column gaps at each end - a straight line would
+// cross the boxes between, and its label land on its neighbours'
+const LANE_GAP = 20
+const CHANNEL_STEP = 6
+const CORNER = 6
+// Member chips: a list-driven step's box grows to hold one inset chip
+// per entry, beneath the header the ordinary box's three lines occupy
+export const CHIP_H = 15
+export const CHIP_STEP = 19
+export const CHIP_CHARS = 26
+export const CHIP_CHARS_TIMED = 17 // a finished chip's run time takes the right end
+export const CHIP_TOP = BOX_H - 2
+// The gap ROW_H left between fixed-height boxes, kept for the
+// height-aware stacking below
+const ROW_GAP = ROW_H - BOX_H
+
+// SVG text neither wraps nor takes text-overflow, so a label longer than
+// the box ran out of its right edge. Budgets are characters at the box's
+// inner width (BOX_W less the 10px inset each side) for each line's font
+// - bold 12px sans for the name, 10px mono for the detail - and the
+// template's clipPath catches what a wider glyph set still pushes past.
+export const NAME_CHARS = 20
+export const NAME_CHARS_WITH_TAG = 15 // the entry tag sits in the top-right corner
+export const DETAIL_CHARS = 26
+
+/** The text cut to `max` characters with an ellipsis where it was cut: a
+ * name is told apart by how it starts, a path by how it ends. */
+export function fit(text: string, max: number, keep: 'head' | 'tail'): string {
+  if (text.length <= max) return text
+  return keep === 'head'
+    ? text.slice(0, max - 1) + '…'
+    : '…' + text.slice(text.length - max + 1)
+}
+
+/** The box's height: the standard header, plus a chip row per entry for
+ * a list-driven step - or one empty slot when the step carries
+ * for_each but its list cannot be read from the definition. */
+export function heightOf(node: FlowNode): number {
+  const count = node.members?.length ?? 0
+  if (count) return CHIP_TOP + (count - 1) * CHIP_STEP + CHIP_H + 6
+  return node.forEach ? BOX_H + 26 : BOX_H
+}
+
+/** One line per producer -> consumer pair, carrying every argument it
+ * feeds. `lane` is -1 for an edge across one gap, else its index among
+ * the column-skipping edges, nearest the boxes first. */
+export interface Pair {
+  from: string
+  to: string
+  attributes: string[]
+  span: number
+  lane: number
+}
+
+export interface EdgeLine {
+  path: string
+  label: string
+  title: string
+  labelX: number
+  labelY: number
+}
+
+export interface Point {
+  x: number
+  y: number
+}
+
+export interface FlowLayout {
+  positions: Record<string, Point>
+  width: number
+  height: number
+  /** One clip box per distinct member-box height; the standard box keeps
+   * the shared clipPath. */
+  tallHeights: number[]
+  edgeLines: Array<EdgeLine | null>
+}
+
+// Plain objects rather than Map/Set throughout: these are throw-away
+// scratch structures rebuilt on every recompute, not reactive state, and
+// svelte's lint rule wants SvelteMap for anything mutated after
+// construction.
+
+/** Each node's layer: one past its deepest direct producer, 0 for an
+ * entry point. */
+export function layersOf(
+  nodes: FlowNode[],
+  edges: FlowEdge[],
+): Record<string, number> {
+  const producersOf: Record<string, string[]> = {}
+  for (const e of edges) {
+    producersOf[e.to] = [...(producersOf[e.to] ?? []), e.from]
+  }
+  const layerOf: Record<string, number> = {}
+  function layerFor(name: string, guard: Record<string, true>): number {
+    if (name in layerOf) return layerOf[name]
+    if (guard[name]) return 0 // defensive only - refs only target earlier steps
+    const nextGuard = { ...guard, [name]: true as const }
+    const producers = producersOf[name] ?? []
+    const layer = producers.length
+      ? 1 + Math.max(...producers.map((p) => layerFor(p, nextGuard)))
+      : 0
+    layerOf[name] = layer
+    return layer
+  }
+  for (const n of nodes) layerFor(n.name, {})
+  return layerOf
+}
+
+/** The nodes grouped by layer, JSON order kept within a column. */
+export function columnsOf(
+  nodes: FlowNode[],
+  layerOf: Record<string, number>,
+): FlowNode[][] {
+  const columns: FlowNode[][] = []
+  for (const n of nodes) {
+    const l = layerOf[n.name] ?? 0
+    columns[l] = [...(columns[l] ?? []), n]
+  }
+  return columns
+}
+
+/** The edges merged by producer -> consumer pair: two references between
+ * the same steps drew the same curve twice with their labels printed over
+ * each other. Column-skipping pairs get their lanes, shorter spans
+ * nearest the boxes so nested lanes never cross. */
+export function pairsOf(
+  edges: FlowEdge[],
+  layerOf: Record<string, number>,
+): Pair[] {
+  const pairs: Pair[] = []
+  for (const e of edges) {
+    const pair = pairs.find((p) => p.from === e.from && p.to === e.to)
+    if (pair) {
+      if (!pair.attributes.includes(e.attribute))
+        pair.attributes.push(e.attribute)
+    } else
+      pairs.push({
+        from: e.from,
+        to: e.to,
+        attributes: [e.attribute],
+        span: (layerOf[e.to] ?? 0) - (layerOf[e.from] ?? 0),
+        lane: -1,
+      })
+  }
+  const skipping = pairs
+    .filter((p) => p.span > 1)
+    .sort((a, b) => a.span - b.span)
+  skipping.forEach((p, i) => (p.lane = i))
+  return pairs
+}
+
+function labelOf(p: Pair): string {
+  return fit(p.attributes.join(', '), LABEL_CHARS, 'head')
+}
+
+/** The column gap: MIN_GAP, or wider when an adjacent edge's label needs it. */
+export function gapOf(pairs: Pair[]): number {
+  return Math.max(
+    MIN_GAP,
+    ...pairs
+      .filter((p) => p.span === 1)
+      .map((p) => labelOf(p).length * LABEL_CHAR_W + 16),
+  )
+}
+
+interface Placement {
+  positions: Record<string, Point>
+  heightOfName: Record<string, number>
+  bottoms: number[]
+}
+
+/** Boxes in a column stack by their own height - a for_each box holding
+ * many chips must not overlap the node beneath it. */
+function place(columns: FlowNode[][], top: number, colW: number): Placement {
+  const positions: Record<string, Point> = {}
+  const heightOfName: Record<string, number> = {}
+  const bottoms: number[] = []
+  columns.forEach((col, c) => {
+    let y = top
+    col.forEach((n) => {
+      positions[n.name] = { x: PAD + c * colW, y }
+      heightOfName[n.name] = heightOf(n)
+      y += heightOf(n) + ROW_GAP
+    })
+    bottoms.push(y - ROW_GAP)
+  })
+  return { positions, heightOfName, bottoms }
+}
+
+// Each side of a box spreads its edges down its height rather than
+// meeting them at one point. Lane edges take the top ports, the outer
+// lane highest, so a lane's vertical never crosses another's stub
+function portY(
+  pairs: Pair[],
+  placed: Placement,
+  name: string,
+  p: Pair,
+  side: 'from' | 'to',
+): number {
+  const portOrder = (q: Pair, other: string) =>
+    q.lane >= 0 ? -1e6 - q.lane : (placed.positions[other]?.y ?? 0)
+  const mine = pairs
+    .filter((q) => q[side] === name)
+    .sort(
+      (a, b) =>
+        portOrder(a, side === 'from' ? a.to : a.from) -
+        portOrder(b, side === 'from' ? b.to : b.from),
+    )
+  const h = placed.heightOfName[name] ?? BOX_H
+  return (
+    placed.positions[name].y + (h * (mine.indexOf(p) + 1)) / (mine.length + 1)
+  )
+}
+
+interface Ends {
+  x1: number
+  y1: number
+  x2: number
+  y2: number
+}
+
+/** A gentle horizontal-first curve across the one gap. */
+function gapCurve(p: Pair, { x1, y1, x2, y2 }: Ends): EdgeLine {
+  const dx = Math.max(40, (x2 - x1) / 2)
+  return {
+    path: `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`,
+    label: labelOf(p),
+    title: p.attributes.join(', '),
+    labelX: (x1 + x2) / 2,
+    labelY: (y1 + y2) / 2 - 6,
+  }
+}
+
+/** Up through the gap after the producer, along the lane, down through
+ * the gap before the consumer. The outer lane drops nearest the boxes;
+ * past half a gap's worth of lanes they share a channel. */
+function laneRoute(
+  p: Pair,
+  { x1, y1, x2, y2 }: Ends,
+  lanes: number,
+  gap: number,
+  laneY: number,
+): EdgeLine {
+  const inset = 10 + (lanes - 1 - p.lane) * CHANNEL_STEP
+  const xs = Math.min(x1 + inset, x1 + gap / 2 - 2)
+  const xd = Math.max(x2 - inset, x2 - gap / 2 + 2)
+  const ly = laneY
+  const r = CORNER
+  const path = [
+    `M ${x1} ${y1} H ${xs - r} Q ${xs} ${y1} ${xs} ${y1 - r}`,
+    `V ${ly + r} Q ${xs} ${ly} ${xs + r} ${ly}`,
+    `H ${xd - r} Q ${xd} ${ly} ${xd} ${ly + r}`,
+    `V ${y2 - r} Q ${xd} ${y2} ${xd + r} ${y2} H ${x2}`,
+  ].join(' ')
+  return {
+    path,
+    label: labelOf(p),
+    title: p.attributes.join(', '),
+    labelX: (xs + xd) / 2,
+    labelY: ly - 4,
+  }
+}
+
+function edgeLinesOf(
+  pairs: Pair[],
+  placed: Placement,
+  gap: number,
+  top: number,
+): Array<EdgeLine | null> {
+  const lanes = pairs.filter((p) => p.lane >= 0).length
+  return pairs.map((p) => {
+    const from = placed.positions[p.from]
+    const to = placed.positions[p.to]
+    if (!from || !to) return null
+    const ends: Ends = {
+      x1: from.x + BOX_W,
+      y1: portY(pairs, placed, p.from, p, 'from'),
+      x2: to.x,
+      y2: portY(pairs, placed, p.to, p, 'to'),
+    }
+    if (p.lane < 0) return gapCurve(p, ends)
+    return laneRoute(p, ends, lanes, gap, top - 12 - p.lane * LANE_GAP)
+  })
+}
+
+/** Where every box and edge of the graph goes. */
+export function layoutGraph({ nodes, edges }: DataFlowGraph): FlowLayout {
+  const layerOf = layersOf(nodes, edges)
+  const columns = columnsOf(nodes, layerOf)
+  const pairs = pairsOf(edges, layerOf)
+  const lanes = pairs.filter((p) => p.lane >= 0).length
+  const top = PAD + lanes * LANE_GAP
+  const gap = gapOf(pairs)
+  const colW = BOX_W + gap
+  const placed = place(columns, top, colW)
+  const width = PAD * 2 + BOX_W + Math.max(0, columns.length - 1) * colW
+  const height = Math.max(...placed.bottoms, top + PAD + BOX_H)
+  const tallHeights = [
+    ...new Set(nodes.map((n) => heightOf(n)).filter((h) => h > BOX_H)),
+  ]
+  return {
+    positions: placed.positions,
+    width,
+    height,
+    tallHeights,
+    edgeLines: edgeLinesOf(pairs, placed, gap, top),
+  }
+}
diff --git a/ui/src/lib/format.test.ts b/ui/src/lib/format.test.ts
index 149ad2ef4..38dc89273 100644
--- a/ui/src/lib/format.test.ts
+++ b/ui/src/lib/format.test.ts
@@ -3,6 +3,7 @@ import {
   formatBytes,
   formatDuration,
   formatMinutes,
+  formatDay,
   formatMtime,
   gbFromBytes,
   gbFromMb,
@@ -26,9 +27,21 @@ it('formats gigabyte sizes to two decimals at and above 1 GB', () => {
 
 it('reads mtime as unix seconds, not milliseconds', () => {
   // 1700000000 s is 2023-11-14T22:13:20Z; read as ms it would land in January 1970
-  const rendered = formatMtime(1700000000)
-  expect(rendered).toBe(new Date('2023-11-14T22:13:20Z').toLocaleString())
-  expect(rendered).not.toBe(new Date(1700000000).toLocaleString())
+  const now = new Date('2023-12-01T00:00:00Z')
+  const rendered = formatMtime(1700000000, now)
+  expect(rendered).toBe(
+    formatMtime(Date.parse('2023-11-14T22:13:20Z') / 1000, now),
+  )
+  expect(rendered).not.toBe(formatMtime(1700000, now))
+})
+
+it('always carries the date, and the year only when it is not this one', () => {
+  const stamp = Date.parse('2023-11-14T22:13:20Z') / 1000
+  const thisYear = formatMtime(stamp, new Date('2023-12-01T00:00:00Z'))
+  const lastYear = formatMtime(stamp, new Date('2024-02-01T00:00:00Z'))
+  expect(thisYear).toMatch(/Nov/)
+  expect(thisYear).not.toMatch(/2023/)
+  expect(lastYear).toMatch(/2023/)
 })
 
 describe('GB figures', () => {
@@ -54,3 +67,11 @@ describe('formatMinutes', () => {
     expect(formatMinutes(0.4)).toBe('<1 min')
   })
 })
+
+it('gives a day without its time, and the year only from another one', () => {
+  const stamp = Date.parse('2023-11-14T22:13:20Z') / 1000
+  const thisYear = formatDay(stamp, new Date('2023-12-01T00:00:00Z'))
+  expect(thisYear).toMatch(/Nov/)
+  expect(thisYear).not.toMatch(/2023|:/)
+  expect(formatDay(stamp, new Date('2024-02-01T00:00:00Z'))).toMatch(/2023/)
+})
diff --git a/ui/src/lib/format.ts b/ui/src/lib/format.ts
index 5df3f7281..1484d2828 100644
--- a/ui/src/lib/format.ts
+++ b/ui/src/lib/format.ts
@@ -15,8 +15,39 @@ export function formatBytes(size: number): string {
   return (size / MB).toFixed(1) + ' MB'
 }
 
-export function formatMtime(mtime: number): string {
-  return new Date(mtime * 1000).toLocaleString()
+/** A unix-seconds timestamp as a compact date and time in the viewer's
+ * locale - 'Oct 26, 2:03 PM' - with the year only when it is not this one.
+ * Every timestamp the UI shows goes through here, so a time never appears
+ * without the day it belongs to. */
+export function formatMtime(mtime: number, now: Date = new Date()): string {
+  const date = new Date(mtime * 1000)
+  return date.toLocaleString(undefined, {
+    month: 'short',
+    day: 'numeric',
+    year: date.getFullYear() === now.getFullYear() ? undefined : 'numeric',
+    hour: 'numeric',
+    minute: '2-digit',
+  })
+}
+
+/** Just the day, in the same compact form - 'Oct 26', or 'Mar 3, 2025'
+ * from another year - for a list where the time of day says nothing. */
+export function formatDay(mtime: number, now: Date = new Date()): string {
+  const date = new Date(mtime * 1000)
+  return date.toLocaleDateString(undefined, {
+    month: 'short',
+    day: 'numeric',
+    year: date.getFullYear() === now.getFullYear() ? undefined : 'numeric',
+  })
+}
+
+/** The same timestamp to the second, with the year - for a tooltip behind
+ * the compact form, where the detail is wanted but not the width. */
+export function formatExact(mtime: number): string {
+  return new Date(mtime * 1000).toLocaleString(undefined, {
+    dateStyle: 'medium',
+    timeStyle: 'medium',
+  })
 }
 
 /** A size in GB to one decimal and no unit - the header meter and the
diff --git a/ui/src/lib/generated/api-schema.ts b/ui/src/lib/generated/api-schema.ts
index 1a97f4cff..a544f3126 100644
--- a/ui/src/lib/generated/api-schema.ts
+++ b/ui/src/lib/generated/api-schema.ts
@@ -343,8 +343,9 @@ export interface paths {
          *     Each entry carries `role`, `final` or `intermediate` (null for a
          *     flat-layout file or one no manifest lists); a file a later run read
          *     lists as intermediate unless its step declared it final
-         *     (dw/roles.py rule 4). `role` is a repeatable
-         *     filter; a null role counts as final. Omitted, every file is listed.
+         *     (dw/roles.py rule 4). A run that recorded no role takes the role its
+         *     file's subfolder names, then rule 4; with neither it is null. `role`
+         *     is a repeatable filter; a null role counts as final. Omitted, every file is listed.
          */
         get: operations["gallery_api_gallery_get"];
         put?: never;
@@ -2477,6 +2478,11 @@ export interface components {
              * @enum {string}
              */
             source: "output" | "asset";
+            /**
+             * Starred
+             * @description True when the file is starred; absent otherwise.
+             */
+            starred?: boolean;
             /** Version */
             version: number | null;
         };
@@ -3347,6 +3353,11 @@ export interface components {
              * @description What contributed nothing to `minutes` when `partial` is true - the workflow's own id when its own steps went unpriced, else the path of each composed child with no cost block or observed history. When `minutes` is null it still names the composed children that left it unpriced (`partial` is then false); empty when nothing composed went unpriced.
              */
             unpriced: string[];
+            /**
+             * Unpriced Reason
+             * @description With basis `unknown` and no `withheld`: why a workflow of task steps alone has no price - it has no pipeline to inherit one from, and its length follows its input media (#948).
+             */
+            unpriced_reason?: string;
             /**
              * Withheld
              * @description With basis `unknown` and `inherited_from` set: why the template's runs could not be re-priced for this workflow (its size cannot be compared to the template's).
@@ -3431,6 +3442,11 @@ export interface components {
         RequiredDownload: {
             /** Access Blocked */
             access_blocked: boolean | null;
+            /**
+             * Filename
+             * @description A single weight file within `repo`, for a task that fetches one file rather than the whole repo.
+             */
+            filename?: string;
             /**
              * Gated
              * @description The hub's own `gated` field: false, or how access is granted.
@@ -3440,6 +3456,11 @@ export interface components {
             gb: number | null;
             /** Repo */
             repo: string | null;
+            /**
+             * Revision
+             * @description The commit the file is read at; null means main.
+             */
+            revision?: string | null;
             /**
              * Url
              * @description A from_single_file URL, which has no repo.
diff --git a/ui/src/lib/generated/openapi.json b/ui/src/lib/generated/openapi.json
index d3148376e..d2801ffe2 100644
--- a/ui/src/lib/generated/openapi.json
+++ b/ui/src/lib/generated/openapi.json
@@ -1516,6 +1516,11 @@
             "title": "Source",
             "type": "string"
           },
+          "starred": {
+            "description": "True when the file is starred; absent otherwise.",
+            "title": "Starred",
+            "type": "boolean"
+          },
           "version": {
             "anyOf": [
               {
@@ -3685,6 +3690,11 @@
             "title": "Unpriced",
             "type": "array"
           },
+          "unpriced_reason": {
+            "description": "With basis `unknown` and no `withheld`: why a workflow of task steps alone has no price - it has no pipeline to inherit one from, and its length follows its input media (#948).",
+            "title": "Unpriced Reason",
+            "type": "string"
+          },
           "withheld": {
             "description": "With basis `unknown` and `inherited_from` set: why the template's runs could not be re-priced for this workflow (its size cannot be compared to the template's).",
             "title": "Withheld",
@@ -3873,6 +3883,11 @@
             ],
             "title": "Access Blocked"
           },
+          "filename": {
+            "description": "A single weight file within `repo`, for a task that fetches one file rather than the whole repo.",
+            "title": "Filename",
+            "type": "string"
+          },
           "gated": {
             "anyOf": [
               {
@@ -3917,6 +3932,18 @@
             ],
             "title": "Repo"
           },
+          "revision": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The commit the file is read at; null means main.",
+            "title": "Revision"
+          },
           "url": {
             "description": "A from_single_file URL, which has no repo.",
             "title": "Url",
@@ -5987,7 +6014,7 @@
     },
     "/api/gallery": {
       "get": {
-        "description": "A page of media files in the output directory, newest first.\nStateless by design - the gallery survives server restarts because\nit reads the directory tree, not job history. 'folders' lists every\ndistinct workflow folder present (over the whole directory, not just\nthis page), for the UI's folder filter - a run id is not a folder of\nits own, so a workflow's runs group together; '' stands for files\nsaved directly at the output root, and is itself always a member so\nthat folder-less outputs stay selectable once anything is nested.\n'subfolders' is the other axis, over the whole directory the same\nway: the in-run subfolders steps wrote into ('final',\n'intermediate'), '' for files at a run's root. `folder` and\n`subfolder` filter independently and intersect when both are given.\n`version` narrows to the runs holding that ordinal - with `folder`,\nthe one run \"v4\" names; without it, that run of every workflow.\n\n`only_orphans=true` inverts the whole call: instead of media files,\nit returns run directories holding nothing but their own\nbookkeeping (manifest.json, workflow.json, job.json) as `runs`,\neach `{name, mtime}` - a run that wrote any file at all, a\ntext-shape prompt or a utility's side output included, is not\nlisted. `folder`/`subfolder` and the `folders`/`subfolders` facets\ndo not apply in this mode, since an orphan run has no file to\ncarry either. `name` is exactly what `DELETE /api/gallery/{name}`\naccepts, so listing and deleting an orphan is a two-call round\ntrip (#170).\n\n`media=true` adds `duration_seconds` to each audio/video entry,\nprobed the same way `get_gallery_metadata` reports it - which two\ntakes of the same workflow otherwise have no way to be told apart\nby, since size and mtime are misleading proxies for length (#356).\nOff by default and bounded by `limit`: only the page actually\nreturned is probed, not the whole listing, so the cost of asking\nstays proportional to the page size rather than the library size.\n\nEach entry carries `role`, `final` or `intermediate` (null for a\nflat-layout file or one no manifest lists); a file a later run read\nlists as intermediate unless its step declared it final\n(dw/roles.py rule 4). `role` is a repeatable\nfilter; a null role counts as final. Omitted, every file is listed.",
+        "description": "A page of media files in the output directory, newest first.\nStateless by design - the gallery survives server restarts because\nit reads the directory tree, not job history. 'folders' lists every\ndistinct workflow folder present (over the whole directory, not just\nthis page), for the UI's folder filter - a run id is not a folder of\nits own, so a workflow's runs group together; '' stands for files\nsaved directly at the output root, and is itself always a member so\nthat folder-less outputs stay selectable once anything is nested.\n'subfolders' is the other axis, over the whole directory the same\nway: the in-run subfolders steps wrote into ('final',\n'intermediate'), '' for files at a run's root. `folder` and\n`subfolder` filter independently and intersect when both are given.\n`version` narrows to the runs holding that ordinal - with `folder`,\nthe one run \"v4\" names; without it, that run of every workflow.\n\n`only_orphans=true` inverts the whole call: instead of media files,\nit returns run directories holding nothing but their own\nbookkeeping (manifest.json, workflow.json, job.json) as `runs`,\neach `{name, mtime}` - a run that wrote any file at all, a\ntext-shape prompt or a utility's side output included, is not\nlisted. `folder`/`subfolder` and the `folders`/`subfolders` facets\ndo not apply in this mode, since an orphan run has no file to\ncarry either. `name` is exactly what `DELETE /api/gallery/{name}`\naccepts, so listing and deleting an orphan is a two-call round\ntrip (#170).\n\n`media=true` adds `duration_seconds` to each audio/video entry,\nprobed the same way `get_gallery_metadata` reports it - which two\ntakes of the same workflow otherwise have no way to be told apart\nby, since size and mtime are misleading proxies for length (#356).\nOff by default and bounded by `limit`: only the page actually\nreturned is probed, not the whole listing, so the cost of asking\nstays proportional to the page size rather than the library size.\n\nEach entry carries `role`, `final` or `intermediate` (null for a\nflat-layout file or one no manifest lists); a file a later run read\nlists as intermediate unless its step declared it final\n(dw/roles.py rule 4). A run that recorded no role takes the role its\nfile's subfolder names, then rule 4; with neither it is null. `role`\nis a repeatable filter; a null role counts as final. Omitted, every file is listed.",
         "operationId": "gallery_api_gallery_get",
         "parameters": [
           {
diff --git a/ui/src/lib/job/JobHeader.svelte b/ui/src/lib/job/JobHeader.svelte
index 25cd15198..1582445a4 100644
--- a/ui/src/lib/job/JobHeader.svelte
+++ b/ui/src/lib/job/JobHeader.svelte
@@ -6,7 +6,7 @@
   import { wsHref } from '../routes'
   import { workspace } from '../workspace.svelte'
   import CopyButton from '../CopyButton.svelte'
-  import { formatDuration } from '../format'
+  import { formatDuration, formatExact, formatMtime } from '../format'
   import { notify } from '../toast'
   import type { JobDetail } from '../types'
 
@@ -153,6 +153,14 @@
         >v{runVersion}</code
       >
     {/if}
+    {#if job.started_at}
+      <code
+        class="muted seed"
+        title={`started ${formatExact(job.started_at)}${
+          job.finished_at ? `\nfinished ${formatExact(job.finished_at)}` : ''
+        }`}>{formatMtime(job.started_at)}</code
+      >
+    {/if}
     {#if took !== null}
       <code
         class="muted seed"
diff --git a/ui/src/lib/pages/JobsPage.svelte b/ui/src/lib/pages/JobsPage.svelte
index 2180ae4df..516f35d6b 100644
--- a/ui/src/lib/pages/JobsPage.svelte
+++ b/ui/src/lib/pages/JobsPage.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { formatDuration } from '../format'
+  import { formatDuration, formatExact, formatMtime } from '../format'
   import { queueWait } from '../jobTimes'
   import { poll } from '../poll'
   import { onMount } from 'svelte'
@@ -9,20 +9,53 @@
   import { notify } from '../toast'
   import type { JobSummary } from '../types'
   import { wsHref } from '../routes'
+  import { hashQuery, setHashQuery } from '../router.svelte'
   import { loadWorkspaces, workspace } from '../workspace.svelte'
 
   let { scope = 'workspace' }: { scope?: 'workspace' | 'all' } = $props()
 
   let jobs = $state<JobSummary[]>([])
   let error = $state('')
-  let statusFilter = $state('')
-  let nameFilter = $state('')
+  // The filters live in the hash's query, so opening a job and coming back
+  // - or sharing the link - keeps the narrowed view
+  const initial = hashQuery()
+  let statusFilter = $state(initial.status ?? '')
+  let nameFilter = $state(initial.q ?? '')
   // Server-side, unlike the two filters above: it changes which jobs are
   // fetched at all, not just which of the fetched ones are shown. Only read
   // under scope 'all' - empty there means every workspace, which is the
   // point of that view; a workspace's own Jobs page filters by
   // `workspace.current` instead.
-  let workspaceFilter = $state('')
+  let workspaceFilter = $state(initial.ws ?? '')
+
+  $effect(() =>
+    setHashQuery({
+      status: statusFilter,
+      q: nameFilter,
+      ws: scope === 'all' ? workspaceFilter : '',
+    }),
+  )
+  // The route's view is unchanged when the Jobs nav link lands on the bare
+  // route from a narrowed one, so the page is not re-created: the filters
+  // follow the hash too, and a hash with no query clears them
+  $effect(() => {
+    const sync = () => {
+      const query = hashQuery()
+      statusFilter = query.status ?? ''
+      nameFilter = query.q ?? ''
+      workspaceFilter = query.ws ?? ''
+    }
+    window.addEventListener('hashchange', sync)
+    return () => window.removeEventListener('hashchange', sync)
+  })
+  const filtered = $derived(
+    !!statusFilter || !!nameFilter || (scope === 'all' && !!workspaceFilter),
+  )
+  function clearFilters() {
+    statusFilter = ''
+    nameFilter = ''
+    workspaceFilter = ''
+  }
 
   // Only worth a picker once there is a choice - a single-workspace server
   // has nothing to filter by
@@ -73,9 +106,22 @@
     }
   }
 
-  const when = (t: number | null) =>
-    t ? new Date(t * 1000).toLocaleTimeString() : '—'
+  const when = (t: number | null) => (t ? formatMtime(t) : '—')
   const waitOf = (job: JobSummary) => queueWait(job, Date.now() / 1000)
+  // The row shows the compact start; hovering gives it to the second, with
+  // the finish and any time spent queued
+  const timesOf = (job: JobSummary) => {
+    const wait = waitOf(job)
+    return [
+      job.started_at && `started ${formatExact(job.started_at)}`,
+      job.finished_at && `finished ${formatExact(job.finished_at)}`,
+      wait !== null &&
+        wait >= 1 &&
+        `waited ${formatDuration(wait)} in the queue`,
+    ]
+      .filter(Boolean)
+      .join('\n')
+  }
   const duration = (job: JobSummary) => {
     if (!job.started_at) return ''
     const end = job.finished_at ?? Date.now() / 1000
@@ -110,13 +156,16 @@
 
 {#if error}<p class="muted">Could not reach the server: {error}</p>{/if}
 
-{#if jobs.length === 0}
+{#if jobs.length === 0 && !filtered}
   <Empty>
     {#snippet icon()}<Inbox size={36} strokeWidth={1.5} />{/snippet}
     No jobs yet — pick a workflow and run it.
   </Empty>
 {:else if visible.length === 0}
-  <p class="muted">No jobs match the filter.</p>
+  <p class="muted">
+    No jobs match the filter.
+    <button class="quiet" onclick={clearFilters}>clear filters</button>
+  </p>
 {:else}
   <div class="panel list">
     {#each visible as job (job.id)}
@@ -199,16 +248,16 @@
         </span>
         {#if job.status === 'queued'}
           {@const wait = waitOf(job)}
-          <span class="muted started" title="time spent waiting for a card"
+          <span
+            class="muted started"
+            title={job.created_at
+              ? `queued ${formatExact(job.created_at)} - time spent waiting for a card`
+              : 'time spent waiting for a card'}
             >waiting {wait === null ? '' : formatDuration(wait)}</span
           >
         {:else}
-          {@const wait = waitOf(job)}
-          <span
-            class="muted started"
-            title={wait !== null && wait >= 1
-              ? `waited ${formatDuration(wait)} in the queue`
-              : ''}>{when(job.started_at)}</span
+          <span class="muted started" title={timesOf(job)}
+            >{when(job.started_at)}</span
           >
         {/if}
         <span class="muted dur">{duration(job)}</span>
diff --git a/ui/src/lib/pages/JobsPage.test.ts b/ui/src/lib/pages/JobsPage.test.ts
index 21187a7c7..1e76b8fe7 100644
--- a/ui/src/lib/pages/JobsPage.test.ts
+++ b/ui/src/lib/pages/JobsPage.test.ts
@@ -1,6 +1,13 @@
-import { cleanup, render, screen, waitFor } from '@testing-library/svelte'
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from '@testing-library/svelte'
 import { afterEach, expect, it, vi } from 'vitest'
 import JobsPage from './JobsPage.svelte'
+import { formatExact } from '../format'
 import type { JobSummary } from '../types'
 
 const data = vi.hoisted(() => ({ jobs: [] as unknown[] }))
@@ -8,8 +15,13 @@ vi.mock('../api', () => ({
   api: {
     listJobs: () =>
       Promise.resolve({ jobs: [...data.jobs], total: data.jobs.length }),
+    // The listing names the default workspace, as the server's always does:
+    // a route parse that found it missing would redirect to overview
     listWorkspaces: () =>
-      Promise.resolve({ default: 'default', workspaces: [] }),
+      Promise.resolve({
+        default: 'default',
+        workspaces: [{ name: 'default', default: true }],
+      }),
   },
 }))
 vi.mock('../toast', () => ({ notify: { error: vi.fn(), success: vi.fn() } }))
@@ -81,6 +93,62 @@ it('shows a queued job as waiting and a started one with its wait', async () =>
   await waitFor(() => expect(screen.getByText('ws')).toBeTruthy())
   expect(container.textContent).toContain('waiting')
   expect(
-    container.querySelector('[title="waited 1m 00s in the queue"]'),
+    container.querySelector('[title$="waited 1m 00s in the queue"]'),
   ).toBeTruthy()
 })
+
+it('hovering a start time gives it to the second, with the finish', async () => {
+  data.jobs = [
+    summary({
+      id: 's1',
+      workflow: 'ws',
+      started_at: 1700000000,
+      finished_at: 1700000243,
+    }),
+  ]
+  const { container } = render(JobsPage)
+  await waitFor(() => expect(screen.getByText('ws')).toBeTruthy())
+  const title = container.querySelector('.started')!.getAttribute('title')!
+  expect(title).toContain(`started ${formatExact(1700000000)}`)
+  expect(title).toContain(`finished ${formatExact(1700000243)}`)
+})
+
+it('reads its filters from the link and writes them back to it', async () => {
+  location.hash = '#/ws/default/jobs?status=failed'
+  data.jobs = [
+    summary({ id: 'f1', workflow: 'broke', status: 'failed' }),
+    summary({ id: 'ok', workflow: 'fine' }),
+  ]
+  render(JobsPage)
+  await waitFor(() => expect(screen.getByText('broke')).toBeTruthy())
+  expect(screen.queryByText('fine')).toBeNull()
+  const input = screen.getByPlaceholderText('filter by workflow…')
+  await fireEvent.input(input, { target: { value: 'zzz' } })
+  expect(location.hash).toBe('#/ws/default/jobs?status=failed&q=zzz')
+  await fireEvent.click(screen.getByText('clear filters'))
+  expect(location.hash).toBe('#/ws/default/jobs')
+  expect(screen.getByText('fine')).toBeTruthy()
+  location.hash = ''
+})
+
+it('navigating to the bare jobs route clears the filters', async () => {
+  location.hash = '#/ws/default/jobs?status=failed&q=bro'
+  data.jobs = [
+    summary({ id: 'f1', workflow: 'broke', status: 'failed' }),
+    summary({ id: 'ok', workflow: 'fine' }),
+  ]
+  render(JobsPage)
+  await waitFor(() => expect(screen.getByText('broke')).toBeTruthy())
+  expect(screen.queryByText('fine')).toBeNull()
+  // The Jobs nav link: same route view, so the page is not re-created
+  location.hash = '#/ws/default/jobs'
+  await waitFor(() => expect(screen.getByText('fine')).toBeTruthy())
+  const status = screen.getByTitle('filter by status') as HTMLSelectElement
+  expect(status.value).toBe('')
+  const input = screen.getByPlaceholderText(
+    'filter by workflow…',
+  ) as HTMLInputElement
+  expect(input.value).toBe('')
+  expect(location.hash).toBe('#/ws/default/jobs')
+  location.hash = ''
+})
diff --git a/ui/src/lib/pages/ModelsPage.svelte b/ui/src/lib/pages/ModelsPage.svelte
index d7dd26af0..76abcc45b 100644
--- a/ui/src/lib/pages/ModelsPage.svelte
+++ b/ui/src/lib/pages/ModelsPage.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { poll } from '../poll'
-  import { gbFromBytes } from '../format'
+  import { formatDay, gbFromBytes } from '../format'
   import {
     ChevronDown,
     ChevronRight,
@@ -148,8 +148,7 @@
   }
 
   const gb = gbFromBytes
-  const day = (stamp: number | null) =>
-    stamp ? new Date(stamp * 1000).toLocaleDateString() : '—'
+  const day = (stamp: number | null) => (stamp ? formatDay(stamp) : '—')
   const hubUrl = (repo: ModelRepo) =>
     'https://huggingface.co/' +
     (repo.repo_type === 'model' ? '' : repo.repo_type + 's/') +
diff --git a/ui/src/lib/router.svelte.test.ts b/ui/src/lib/router.svelte.test.ts
index e06d34d23..3b4e9d6e1 100644
--- a/ui/src/lib/router.svelte.test.ts
+++ b/ui/src/lib/router.svelte.test.ts
@@ -60,3 +60,28 @@ it('goWs builds a link under the current workspace', async () => {
   goWs('jobs', 'j1')
   expect(location.hash).toBe('#/ws/studio/jobs/j1')
 })
+
+it('a hash query is view state, not part of the route', async () => {
+  const { route, hashQuery } = await import('./router.svelte')
+  location.hash = '#/ws/studio/jobs?status=failed&q=flux'
+  await tick()
+  expect(route.view).toMatchObject({ section: 'jobs', rest: [] })
+  expect(hashQuery()).toEqual({ status: 'failed', q: 'flux' })
+})
+
+it('setHashQuery replaces the query without a navigation', async () => {
+  const { route, hashQuery, setHashQuery } = await import('./router.svelte')
+  location.hash = '#/ws/studio/jobs'
+  await tick()
+  const parts = route.parts
+  const depth = history.length
+  setHashQuery({ status: 'failed', q: '' })
+  expect(location.hash).toBe('#/ws/studio/jobs?status=failed')
+  setHashQuery({ status: '', q: 'a cat & 50%' })
+  expect(hashQuery()).toEqual({ q: 'a cat & 50%' })
+  setHashQuery({ q: '' })
+  expect(location.hash).toBe('#/ws/studio/jobs')
+  await tick()
+  expect(history.length).toBe(depth)
+  expect(route.parts).toBe(parts)
+})
diff --git a/ui/src/lib/router.svelte.ts b/ui/src/lib/router.svelte.ts
index c28ed6f4c..5e81a4879 100644
--- a/ui/src/lib/router.svelte.ts
+++ b/ui/src/lib/router.svelte.ts
@@ -24,9 +24,45 @@ function decode(part: string): string {
   }
 }
 
-function split(): string[] {
+/** The hash's path and its '?query' tail - '#/ws/studio/jobs?status=failed'.
+ * The query is a page's own view state (a list's filters); it is not part
+ * of the route, so changing it is not a navigation. */
+function hashParts(): [string, string] {
   const hash = location.hash.replace(/^#\/?/, '')
-  return hash ? hash.split('/').map(decode) : []
+  const at = hash.indexOf('?')
+  return at < 0 ? [hash, ''] : [hash.slice(0, at), hash.slice(at + 1)]
+}
+
+function split(): string[] {
+  const [path] = hashParts()
+  return path ? path.split('/').map(decode) : []
+}
+
+/** The current hash's query, as key -> value. */
+export function hashQuery(): Record<string, string> {
+  const query: Record<string, string> = {}
+  for (const pair of hashParts()[1].split('&')) {
+    if (!pair) continue
+    const at = pair.indexOf('=')
+    const key = at < 0 ? pair : pair.slice(0, at)
+    query[decode(key)] = at < 0 ? '' : decode(pair.slice(at + 1))
+  }
+  return query
+}
+
+/** Replace the hash's query in place: no history entry and no hashchange,
+ * so typing in a filter neither floods Back nor re-runs the route. Empty
+ * values are dropped, so a cleared filter leaves a clean link. */
+export function setHashQuery(values: Record<string, string>) {
+  const query = Object.entries(values)
+    .filter(([, value]) => value)
+    .map(
+      ([key, value]) =>
+        `${encodeURIComponent(key)}=${encodeURIComponent(value)}`,
+    )
+    .join('&')
+  const hash = '#/' + hashParts()[0] + (query ? '?' + query : '')
+  if (hash !== location.hash) history.replaceState(history.state, '', hash)
 }
 
 function parse(): { parts: string[]; view: RouteView } {
diff --git a/workflows/models/z-image-inpaint.json b/workflows/models/z-image-inpaint.json
new file mode 100644
index 000000000..ee2236baa
--- /dev/null
+++ b/workflows/models/z-image-inpaint.json
@@ -0,0 +1,53 @@
+{
+    "cost_drivers": ["num_images_per_prompt", "num_inference_steps"],
+    "variables": {
+        "image": "https://huggingface.co/datasets/diffusers/diffusers-images-docs/resolve/main/cup.png",
+        "mask_image": "https://huggingface.co/datasets/diffusers/diffusers-images-docs/resolve/main/cup_mask.png",
+        "prompt": "a clean empty background that continues the surrounding scene",
+        "num_images_per_prompt": 1,
+        "num_inference_steps": 9,
+        "guidance_scale": 0.0,
+        "strength": 1.0,
+        "seed": null
+    },
+    "seed": "variable:seed",
+    "id": "ZImageInpaint",
+    "description": "Masked add or replace with Z-Image Turbo (ZImageInpaintPipeline): white mask pixels are repainted with what the prompt names, the rest is kept. NOT for object removal: with a prompt it paints a new object or a mismatched patch rather than continuing the surrounding scene (#946); to erase an object use templates/remove-object (a mask to hand) or templates/segment-and-remove (the object by name), which run the prompt-free remove_object task, and to extend past the frame use templates/outpaint. Uses the same Tongyi-MAI/Z-Image-Turbo checkpoint as models/z-image, so a server that has one has the other, and fits a 24 GB card with offload where FLUX.1 Fill needs a 54 GB download. Prompt for the thing to put in the mask.",
+    "vram_estimate": {
+        "base_gb": 11.8,
+        "bytes_per_voxel": 1031,
+        "voxel_variables": ["num_images_per_prompt"],
+        "reason": "reuses the models/z-image text-to-image calibration (#945): same transformer, text encoder and VAE with offload: model, so the resident weights match; the inpaint pass adds the encoded source image and mask latents, small beside the weights. Image size follows the input image, so the per-voxel term is only the batch count here. Calibrate on lem (#946)"
+    },
+    "configures": "templates/inpaint",
+    "steps": [
+        {
+            "name": "inpaint",
+            "pipeline": {
+                "configuration": {
+                    "component_type": "ZImageInpaintPipeline",
+                    "offload": "model"
+                },
+                "from_pretrained_arguments": {
+                    "model_name": "Tongyi-MAI/Z-Image-Turbo",
+                    "torch_dtype": "torch.bfloat16",
+                    "low_cpu_mem_usage": true
+                },
+                "arguments": {
+                    "image": {"location": "variable:image"},
+                    "mask_image": {"location": "variable:mask_image"},
+                    "prompt": "variable:prompt",
+                    "strength": "variable:strength",
+                    "num_inference_steps": "variable:num_inference_steps",
+                    "num_images_per_prompt": "variable:num_images_per_prompt",
+                    "guidance_scale": "variable:guidance_scale"
+                }
+            },
+            "result": {
+                "content_type": "image/jpeg",
+                "embed_metadata": true,
+                "subfolder": "final"
+            }
+        }
+    ]
+}
diff --git a/workflows/models/z-image.json b/workflows/models/z-image.json
index 9c9689271..a1cc02101 100644
--- a/workflows/models/z-image.json
+++ b/workflows/models/z-image.json
@@ -16,6 +16,12 @@
     "cost": [
         {"device": "cuda", "name": "RTX 3090", "vram_gb": 24, "minutes": 1.4}
     ],
+    "vram_estimate": {
+        "base_gb": 11.8,
+        "bytes_per_voxel": 1031,
+        "voxel_variables": ["num_images_per_prompt", "width", "height"],
+        "reason": "peak reserved VRAM on an RTX 3090 with offload: model, bf16, 9 steps (#945): 12.2 GiB at 1x512x512, 12.9 at 1x1024x1024, 13.8 at 4x960x544, 15.8 at 4x1344x768 - batch size multiplies the latent and VAE decode tensors as pixels do. Calibrated WITH offload: model; a workflow that omits it keeps the whole pipeline resident (~22.9 GiB at 4x1344x768 on lem) and runs out of memory well below this projection"
+    },
     "configures": "templates/text-to-image",
     "steps": [
         {
diff --git a/workflows/templates/generate-speech.json b/workflows/templates/generate-speech.json
index 4a4c8afe7..b4f35a22f 100644
--- a/workflows/templates/generate-speech.json
+++ b/workflows/templates/generate-speech.json
@@ -1,6 +1,6 @@
 {
   "id": "GenerateSpeech",
-  "description": "Speaks a line of text with a local text-to-speech model and saves it as a wav. The result declares no 'sample_rate': a generated track carries the rate its model produced it at, so saying nothing is what saves it correctly.",
+  "description": "Speaks a line of text with a local text-to-speech model and saves it as a wav. model_name picks the voice: facebook/mms-tts-eng (the default, one voice; other languages are mms-tts-<code>), suno/bark-small (distinct speakers via a voice_preset task argument) or microsoft/speecht5_tts (the voice of a reference clip via speaker_embedding). The result declares no 'sample_rate': a generated track carries the rate its model produced it at, so saying nothing is what saves it correctly.",
   "variables": {
     "text": "Somebody finished the pistachio and nobody is saying anything.",
     "model_name": "facebook/mms-tts-eng"
diff --git a/workflows/templates/inpaint.json b/workflows/templates/inpaint.json
index 4eea1907d..f1aaa728e 100644
--- a/workflows/templates/inpaint.json
+++ b/workflows/templates/inpaint.json
@@ -5,7 +5,7 @@
         "seed": null
     },
     "id": "FluxFill",
-    "description": "Inpaints the masked region of an image with FLUX.1 Fill dev.",
+    "description": "Inpaints the masked region of an image with FLUX.1 Fill dev. It repaints the mask with what the prompt names and is not the removal route: to erase an object, use templates/remove-object (the prompt-free remove_object task).",
     "seed": "variable:seed",
     "steps": [
         {
diff --git a/workflows/templates/ltx2/README.md b/workflows/templates/ltx2/README.md
index 50c2f3d3e..75b145ae9 100644
--- a/workflows/templates/ltx2/README.md
+++ b/workflows/templates/ltx2/README.md
@@ -42,8 +42,8 @@ Read them in this order and each introduces one new idea on top of the last.
 | ------- | ------------------ |
 | [two-stage.json](two-stage.json) | The distilled two-stage flow in its three moves: render at half size, double the latents, renoise and refine at full size. Lightricks' newer DFR pipeline is the follow-up |
 | [generative-upscale.json](generative-upscale.json) | A generative 2x upscale: an in-context LoRA re-renders a clip at twice the size, inventing detail |
-| [upscale-clip.json](upscale-clip.json) | The same 2x re-render of a clip the caller brings (`source_video`), with its soundtrack paired back on by `pair_audio`. `width`/`height` are the render size: the source is fitted to half of it by `fit_to_model` (`downscale: 2`) and restored after, so the output is exactly 2x the source at its own length - another aspect ratio is letterboxed and the bars cut back off (`fit`: `letterbox`, `stretch` or `crop`), a shorter source is held on its last frame and trimmed back. Generative, not a faithful resize; restore a compressed source first (#548, #602) |
-| [refine-clip.json](refine-clip.json) | `two-stage`'s refine pass on a clip the caller brings (`source_video`): the latent upsampler encodes the source and doubles its latents, then the three stage-two sigmas refine them - the source's own latents, not a reference re-render, and no LoRA. `width`/`height` and `num_frames` are the working size and length the source is fitted to; the result is restored to exactly 2x the source at its own length, another aspect ratio letterboxed and cut back (`fit`), a shorter source held and trimmed. The source's soundtrack is paired back on; a silent source is refused before any pipeline loads (#543, #602) |
+| [upscale-clip.json](upscale-clip.json) | The same 2x re-render of a clip the caller brings (`source_video`), with its soundtrack paired back on by `pair_audio`. `width`/`height` are the render size: the source is fitted to half of it by `fit_to_model` (`downscale: 2`) and restored after, so the output is exactly 2x the source at its own length (under `crop`, 2x the kept region) - another aspect ratio is letterboxed and the bars cut back off (`fit`: `letterbox`, `stretch` or `crop`), a shorter source is held on its last frame and trimmed back. Generative, not a faithful resize; restore a compressed source first (#548, #602) |
+| [refine-clip.json](refine-clip.json) | `two-stage`'s refine pass on a clip the caller brings (`source_video`): the latent upsampler encodes the source and doubles its latents, then the three stage-two sigmas refine them - the source's own latents, not a reference re-render, and no LoRA. `width`/`height` and `num_frames` are the working size and length the source is fitted to; the result is restored to exactly 2x the source at its own length (2x the kept region under `crop`), another aspect ratio letterboxed and cut back (`fit`), a shorter source held and trimmed. The source's soundtrack is paired back on; a silent source is refused before any pipeline loads (#543, #602) |
 | [refine-in-place.json](refine-in-place.json) | `refine-clip` at the source's own size and length: fit to the model, refine, restore to the source's size, so nothing doubles. `strength` 0-4 (default 2) picks one of five three-sigma ladders, each with `noise_scale` equal to its first sigma: 0 stays close to the source, 4 reinterprets it (identity and framing hold; skin texture, tone and expression are re-rendered). Run time is flat across strengths, about 1.5 minutes on an RTX 3090. The soundtrack is paired back on; a silent source is refused (#639) |
 | [face-repair.json](face-repair.json) | Repairs a wide shot's small, smeared face and leaves the rest of the frame alone: `crop_face_track` (told LTX's grid: `modulus: 8, remainder: 1, multiple: 32`) cuts a `crop_size` square (a multiple of 32, default 512) around the tracked face on every frame, `LTX2RefinePipeline` re-renders the crops at that size, and `paste_face_track` feathers them back in, colour-matched. How much each frame is repaired comes from the face's size - full while it is at most `gate_full` (0.03) of the frame's width, none from `gate_zero` (0.06) - so a near face, or a clip with no face, comes back as the source. `strength` 0-4 (default 2) picks one of five lem-tuned three-sigma ladders: 0 stays close to the smear, 4 is sharp but hair and clothing can drift. About 2 minutes on an RTX 3090; the soundtrack, frame rate and shots are the source's own (#599, #624) |
 | [diffusion-decode.json](diffusion-decode.json) | LTX-2.5's other video decoder: a small diffusion model in place of the convolutional VAE, held against `text-to-video` frame for frame. An experiment, not a recommendation - it is silent (audio comes back as latents), and it needs a `shi-labs/natten` build for the installed torch: the FlexAttention fallback needs ~25.5GiB for the smallest canvas its kernel accepts, so on 24GB it decodes nothing at all (#153) |
diff --git a/workflows/templates/ltx2/image-to-video.json b/workflows/templates/ltx2/image-to-video.json
index 083de682c..367e60f66 100644
--- a/workflows/templates/ltx2/image-to-video.json
+++ b/workflows/templates/ltx2/image-to-video.json
@@ -1,6 +1,12 @@
 {
     "id": "LTX2I2V",
     "description": "Conditioning generation on a supplied still, which becomes the video's first frame. Otherwise the baseline: same components, same distilled schedule, with VAE tiling for the longer clip.",
+    "vram_estimate": {
+        "base_gb": 19.7,
+        "bytes_per_voxel": 16.04,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the LTX-2.5 VAE scaling of templates/ltx2/text-to-video with a lower base, calibrated on a 24 GB RTX 3090 (#1052): 768x768x401 (236M voxels) and 768x768x329 complete; 768x768x481 (283M) ran out of memory late in denoise, 832x832x481 (333M) and 960x832x481 in the denoise, 1024x1024x481 before it. The bound sits between 236M and 283M voxels; the ceiling passes the first and refuses the second"
+    },
     "cost_drivers": ["num_frames", "width", "height"],
     "variables": {
         "transformer_weights_dtype": "{uint4}",
@@ -10,7 +16,7 @@
         "width": 768,
         "height": 768,
         "frame_rate": 24.0,
-        "num_frames": 481,
+        "num_frames": 401,
         "image": {
             "location": "https://pbs.twimg.com/media/HPxFgsIXIAAjtUu?format=jpg&name=medium"
         },
diff --git a/workflows/templates/ltx2/keyframes.json b/workflows/templates/ltx2/keyframes.json
index 2acadee01..6799559f9 100644
--- a/workflows/templates/ltx2/keyframes.json
+++ b/workflows/templates/ltx2/keyframes.json
@@ -3,6 +3,12 @@
     "description": "Pinning the first and last frames and letting the model fill in the motion between them. The keyframes are conditions - objects built from the arguments the workflow names, each with the latent index it lands on.",
     "summary": "LTX-2.5 video with audio between two supplied stills, pinned as the first and last frames.",
     "traits": ["has-audio", "image-conditioned", "needs-input-media"],
+    "vram_estimate": {
+        "base_gb": 21.3,
+        "bytes_per_voxel": 16.04,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the same LTX-2.5 VAE decode scaling as templates/ltx2/text-to-video, since this template shares its quantized pipeline resident beside the decode; the two pinned frames ride in the same conditioning pipeline. Bracketed by real runs on a 24 GB RTX 3090 (#1054): 768x768x241 (142M voxels) completes, 768x768x321 (189M) ran out of memory in decode, 768x768x401 (236M) and x481 (283M) before or in the denoise. The bound sits between 142M and 189M voxels; the ceiling passes the first and refuses the second"
+    },
     "cost_drivers": ["num_frames", "width", "height"],
     "variables": {
         "transformer_weights_dtype": "{uint4}",
diff --git a/workflows/templates/ltx2/reference-sheet.json b/workflows/templates/ltx2/reference-sheet.json
index 3ef68e93a..48b4759fc 100644
--- a/workflows/templates/ltx2/reference-sheet.json
+++ b/workflows/templates/ltx2/reference-sheet.json
@@ -2,6 +2,12 @@
     "id": "LTX2ReferenceSheet",
     "description": "Holds a cast, their props and their set consistent across a clip by conditioning on a reference sheet - one composite image with a clean panel per element, which is how the LTX-2.5 line does identity. This is the family's only reference template: everything else here pins appearance through a first or last frame, which fixes one moment rather than a subject. The sheet is supplied as a still and looped into a static video by the first step, because the IC-LoRA reads it as reference latents and was trained with the sheet held for the whole clip - 'reference_frames' must be at least 121 or the 121-frame read bucket is missed, and it defaults to matching 'num_frames'. Authoring the sheet is the work: a front-facing close-up plus a full turnaround for each character, a product-style render of each prop, one clean location panel, no text, and bigger panels for the elements that matter most - what is not on the sheet will not appear, and what is small or crowded carries over worst. The prompt is in the two-part trained form, 'Reference sheet:' naming the panels and 'Generated video:' driving the action. The LoRA is a 0.9 preview weight trained at 768x448, 121 frames, 24 fps, which is what the defaults are.",
     "summary": "Holds a cast, their props and their set consistent across a clip by conditioning on a reference sheet.",
+    "vram_estimate": {
+        "base_gb": 17.5,
+        "bytes_per_voxel": 64.16,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "this template's own measurement, not the 21.3 / 16.04 the other LTX2InContextPipeline templates carry: the reference sheet is held as a static clip for the whole denoise, and the read costs more per voxel than upscale-clip's. Bracketed by real runs on a 24 GB RTX 3090 (#1054), width x height x num_frames as the template takes them: 768x768x161 (95M voxels) completes; 768x768x201 (118M) ran out of memory. The bound sits between 95M and 118M voxels; the ceiling passes the first and refuses the second. One reference, so no gb_per_reference"
+    },
     "cost_drivers": [
         "num_frames",
         "width",
diff --git a/workflows/templates/ltx2/refine-clip.json b/workflows/templates/ltx2/refine-clip.json
index 801f01913..77fac271f 100644
--- a/workflows/templates/ltx2/refine-clip.json
+++ b/workflows/templates/ltx2/refine-clip.json
@@ -1,6 +1,6 @@
 {
     "id": "LTX2RefineClip",
-    "description": "Refines a clip from the asset library at exactly twice its size through LTX-2.5's stage-two path, starting from the clip's own latents rather than a reference: the latent upsampler VAE-encodes the source, doubles the latents, and 'refine' renoises them at 0.909375 and runs the three stage-two distilled sigmas - two-stage's refine pass, fed a clip dw did not make. Composition and motion are the source's; fine texture is regenerated at that noise level, so it is not a faithful resize. 'width'/'height' are the working size the source is fitted to (each divisible by 32), and 'num_frames' (8 * n + 1) its working length; the model renders at twice that, and a last step restores the result to twice the source's size at the source's own length - so the output is exactly 2x the source whatever its size. A different aspect ratio is handled by 'fit': letterbox (default) pads it and the padding is cut back off, stretch resizes it, crop cuts it to fill. A source shorter than 'num_frames' is held on its last frame and trimmed back after; a longer one is cut to its opening 'num_frames' frames. Defaults work at 512x288, 121 frames, 24 fps - set 'frame_rate' to the source's (get_gallery_metadata('asset:...') reads it). Replace the default prompt with a description of the source's subject, setting, motion and lighting. The soundtrack is the source's own, not generated: its track is read and normalized to -3 dBFS as the first step, so a source with no soundtrack is refused there, before any pipeline loads, and the refined picture (saved to intermediate/) is paired with it, cut to the output length, in final/. Versus upscale-clip: that template re-renders with the source as an IC-LoRA reference (invented detail, gated LoRA download); this one keeps the source's own latents, needs no LoRA and denoises three sigmas rather than eight.",
+    "description": "Refines a clip from the asset library at exactly twice its size through LTX-2.5's stage-two path, starting from the clip's own latents rather than a reference: the latent upsampler VAE-encodes the source, doubles the latents, and 'refine' renoises them at 0.909375 and runs the three stage-two distilled sigmas - two-stage's refine pass, fed a clip dw did not make. Composition and motion are the source's; fine texture is regenerated at that noise level, so it is not a faithful resize. 'width'/'height' are the working size the source is fitted to (each divisible by 32), and 'num_frames' (8 * n + 1) its working length; the model renders at twice that, and a last step restores the result to twice the source's size at the source's own length - so the output is exactly 2x the source whatever its size (under crop, 2x the kept region, since crop cuts the edges off for good). A different aspect ratio is handled by 'fit': letterbox (default) pads it and the padding is cut back off, stretch resizes it, crop cuts it to fill. A source shorter than 'num_frames' is held on its last frame and trimmed back after; a longer one is cut to its opening 'num_frames' frames. Defaults work at 512x288, 121 frames, 24 fps - set 'frame_rate' to the source's (get_gallery_metadata('asset:...') reads it). Replace the default prompt with a description of the source's subject, setting, motion and lighting. The soundtrack is the source's own, not generated: its track is read and normalized to -3 dBFS as the first step, so a source with no soundtrack is refused there, before any pipeline loads, and the refined picture (saved to intermediate/) is paired with it, cut to the output length, in final/. Versus upscale-clip: that template re-renders with the source as an IC-LoRA reference (invented detail, gated LoRA download); this one keeps the source's own latents, needs no LoRA and denoises three sigmas rather than eight.",
     "summary": "2x latent refine of your own clip, any aspect or length, soundtrack kept. width/height = the working size.",
     "cost": [
         {
@@ -10,6 +10,12 @@
             "minutes": 2.9
         }
     ],
+    "vram_estimate": {
+        "base_gb": 16.0,
+        "bytes_per_voxel": 64.16,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the refine runs at 2x the working width and height, so each voxel costs 4x the single-stage 16.04 bytes. Bracketed by real runs on a 24 GB RTX 3090 (#1054), width x height x num_frames as the template takes them: 768x768x201 (119M voxels) completes; 768x768x257 (152M) and x321 (189M) ran out of memory in the refine denoise. The bound sits between 119M and 152M voxels; the ceiling passes the first and refuses the second"
+    },
     "cost_drivers": [
         "num_frames",
         "width",
diff --git a/workflows/templates/ltx2/restore-deblur.json b/workflows/templates/ltx2/restore-deblur.json
index 9ea941af8..09c465f31 100644
--- a/workflows/templates/ltx2/restore-deblur.json
+++ b/workflows/templates/ltx2/restore-deblur.json
@@ -2,6 +2,15 @@
     "id": "LTX2Deblur",
     "description": "Restores sharpness to out-of-focus footage by regenerating it in focus, with the blurry clip attached as an in-context reference for the whole denoise - so the subject, the framing and the background geometry are the ones that were shot and only the focus changes. A different trade from re-rendering: 'two-stage' invents a sharper version of a scene it generated, this one reads a scene it did not. The LoRA is a 0.9 preview weight trained on spatial defocus only - motion blur, noise, compression artefacts and low resolution are not what it inverts, and 'restore-decompression' is the sibling for the third of those. Trained at 960x544, 121 frames, 24 fps, which is what the defaults are; generating far above that bucket weakens the effect, so raise the size only with a measurement in hand. 'lora_scale' is 1.0 because the weights ship pre-scaled - lower it toward 0.8 if the result over-sharpens into haloing or ringing. The prompt follows the trained dual-panel convention ('Reference shows ... DEBLUR ... only focus and sharpness differ'), because the reference does most of the work and the prompt is what anchors the scene and the intent.",
     "summary": "Sharpens out-of-focus footage by regenerating it in focus, the blurry clip attached as an in-context reference.",
+    "cost": [
+        {"device": "cuda", "name": "RTX 3090", "vram_gb": 24, "minutes": 3.4}
+    ],
+    "vram_estimate": {
+        "base_gb": 21.3,
+        "bytes_per_voxel": 16.04,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the same LTX-2.5 VAE decode scaling as templates/ltx2/text-to-video, since this template shares its quantized pipeline resident beside the decode; the in-context reference adds to it. Bracketed by real runs on a 24 GB RTX 3090: 1344x768x129 completes, 1632x928x129 ran out of memory in the first denoise step (#1052; 1920x1088x129 also did, in decode, #1050) - the bound sits between 1344x768 and 1632x928 and the ceiling refuses the latter while passing the former"
+    },
     "cost_drivers": [
         "num_frames",
         "width",
diff --git a/workflows/templates/ltx2/restore-decompression.json b/workflows/templates/ltx2/restore-decompression.json
index 8355e5ac9..21f2b699e 100644
--- a/workflows/templates/ltx2/restore-decompression.json
+++ b/workflows/templates/ltx2/restore-decompression.json
@@ -2,6 +2,15 @@
     "id": "LTX2Decompression",
     "description": "Removes compression artefacts - macroblocking, chroma bleed, ringing, banding - from a low bit-rate clip by regenerating it clean, with the compressed clip attached as an in-context reference for the whole denoise, so identity, framing and geometry are the source's and only the artefacts go. A different trade from re-rendering: it reads footage it did not generate. The LoRA is a 0.9 preview weight and targets compression only - defocus blur is 'restore-deblur', and motion blur, grain and low resolution are outside what it was trained to invert. Trained at 960x544, 121 frames, 24 fps, which is what the defaults are; generating far above that bucket leaves artefacts in the high-frequency detail. The prompt follows the trained convention ('Reference shows ... heavily compressed ... ENHANCE QUALITY ... only compression artifacts and image quality differ'), describing the same scene in both halves.",
     "summary": "Strips macroblocking and ringing from a low bit-rate clip, the compressed clip attached as an in-context reference.",
+    "cost": [
+        {"device": "cuda", "name": "RTX 3090", "vram_gb": 24, "minutes": 3.4}
+    ],
+    "vram_estimate": {
+        "base_gb": 21.3,
+        "bytes_per_voxel": 16.04,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the same LTX-2.5 VAE decode scaling as templates/ltx2/text-to-video, since this template shares its quantized pipeline resident beside the decode; the in-context reference adds to it. Bracketed by real runs on a 24 GB RTX 3090: 1344x768x129 completes, 1632x928x129 ran out of memory in the first denoise step (#1052; 1920x1088x129 also did, in decode, #1050) - the bound sits between 1344x768 and 1632x928 and the ceiling refuses the latter while passing the former"
+    },
     "cost_drivers": [
         "num_frames",
         "width",
diff --git a/workflows/templates/ltx2/two-stage.json b/workflows/templates/ltx2/two-stage.json
index 8e811885f..2a15faf57 100644
--- a/workflows/templates/ltx2/two-stage.json
+++ b/workflows/templates/ltx2/two-stage.json
@@ -10,6 +10,12 @@
             "minutes": 8.2
         }
     ],
+    "vram_estimate": {
+        "base_gb": 17.5,
+        "bytes_per_voxel": 64.16,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the refine stage runs at 2x width and 2x height, so each voxel costs 4x the single-stage 16.04 bytes and the base is lower than text-to-video's because the quantized pipeline is the only thing resident. Bracketed by real runs on a 24 GB RTX 3090 (#1054), width x height x num_frames as the template takes them: 768x768x161 (95M voxels) and 768x448x201 (69M) complete; 768x768x201 (118M) and x241 (142M) ran out of memory in the refine denoise, as did x321 (189M). The bound sits between 95M and 118M voxels; the ceiling passes the first and refuses the second"
+    },
     "cost_drivers": ["num_frames", "width", "height"],
     "variables": {
         "transformer_weights_dtype": "{uint4}",
diff --git a/workflows/templates/ltx2/upscale-clip.json b/workflows/templates/ltx2/upscale-clip.json
index 82b0d2c35..ae570affb 100644
--- a/workflows/templates/ltx2/upscale-clip.json
+++ b/workflows/templates/ltx2/upscale-clip.json
@@ -1,7 +1,16 @@
 {
     "id": "LTX2UpscaleClip",
-    "description": "Re-renders a clip from the asset library at exactly twice its size with the spatial-upscaler in-context LoRA, the clip attached as the reference for the whole denoise - so composition, motion and subject carry over while fine detail (texture, edges, micro-contrast) is invented, not interpolated. It is a generative re-render, not a faithful resize: the vendor scopes it as a creative step, not for live-action footage where factual fidelity matters, and a heavily compressed source is 'restore-decompression''s job first. 'width'/'height' are the output size the model renders (each divisible by 32); a first step fits the source to half of it and 'num_frames', and a last step restores the result to twice the source's size at the source's own length - so the output is exactly 2x the source whatever its size. A different aspect ratio is handled by 'fit': letterbox (default) pads it and the padding is cut back off, stretch resizes it, crop cuts it to fill. A source shorter than 'num_frames' is held on its last frame and trimmed back after; a longer one is cut to its opening 'num_frames' frames. Defaults render 960x544 at 121 frames, 24 fps - set 'frame_rate' to the source's (get_gallery_metadata('asset:...') reads it). Replace the default prompt with a description of the source's subject, setting, motion and lighting - the vendor card states no caption convention, and the prompt is what anchors the re-render to the scene. 'lora_scale' is 1.0 because the weights ship pre-scaled. The upscale is saved to intermediate/; the deliverable in final/ carries the source's own soundtrack cut to the output length, so a source with no audio fails at that step, after the upscale is saved.",
+    "description": "Re-renders a clip from the asset library at exactly twice its size with the spatial-upscaler in-context LoRA, the clip attached as the reference for the whole denoise - so composition, motion and subject carry over while fine detail (texture, edges, micro-contrast) is invented, not interpolated. It is a generative re-render, not a faithful resize: the vendor scopes it as a creative step, not for live-action footage where factual fidelity matters, and a heavily compressed source is 'restore-decompression''s job first. 'width'/'height' are the output size the model renders (each divisible by 32); a first step fits the source to half of it and 'num_frames', and a last step restores the result to twice the source's size at the source's own length - so the output is exactly 2x the source whatever its size (under crop, 2x the kept region, since crop cuts the edges off for good). A different aspect ratio is handled by 'fit': letterbox (default) pads it and the padding is cut back off, stretch resizes it, crop cuts it to fill. A source shorter than 'num_frames' is held on its last frame and trimmed back after; a longer one is cut to its opening 'num_frames' frames. Defaults render 960x544 at 121 frames, 24 fps - set 'frame_rate' to the source's (get_gallery_metadata('asset:...') reads it). Replace the default prompt with a description of the source's subject, setting, motion and lighting - the vendor card states no caption convention, and the prompt is what anchors the re-render to the scene. 'lora_scale' is 1.0 because the weights ship pre-scaled. The upscale is saved to intermediate/; the deliverable in final/ carries the source's own soundtrack cut to the output length, so a source with no audio fails at that step, after the upscale is saved.",
     "summary": "2x generative re-render of your own clip, any aspect or length, soundtrack kept. width/height = the render size.",
+    "cost": [
+        {"device": "cuda", "name": "RTX 3090", "vram_gb": 24, "minutes": 3.4}
+    ],
+    "vram_estimate": {
+        "base_gb": 21.3,
+        "bytes_per_voxel": 16.04,
+        "voxel_variables": ["width", "height", "num_frames"],
+        "reason": "the same LTX-2.5 VAE decode scaling as templates/ltx2/text-to-video, since this template shares its quantized pipeline resident beside the decode; the in-context reference adds to it. Bracketed by real runs on a 24 GB RTX 3090: 1344x768x129 completes, 1632x928x129 ran out of memory in the first denoise step (#1052; 1920x1088x129 also did, in decode, #1050) - the bound sits between 1344x768 and 1632x928 and the ceiling refuses the latter while passing the former"
+    },
     "cost_drivers": [
         "num_frames",
         "width",
diff --git a/workflows/templates/minimax/image-to-video.json b/workflows/templates/minimax/image-to-video.json
index d6dd7e713..341168415 100644
--- a/workflows/templates/minimax/image-to-video.json
+++ b/workflows/templates/minimax/image-to-video.json
@@ -1,6 +1,6 @@
 {
     "id": "MiniMaxH3I2V",
-    "description": "Conditioning generation on a supplied still. The same model is loaded under its 'fl2va' workflow and given only an 'image', so the picture becomes the video's first frame - the frame-conditioned form of the baseline. Also shows the acceleration that applies to any of these pipelines: a step-distillation LoRA, which composes with per-component quantization and offloading to cut the step count. The 'first_block' cache is deliberately absent - measured on the 9-step turbo schedule (and fewer steps on today's 4-step one only widens the gap), consecutive steps differ too much for it to ever skip, so it only held cache state for nothing; it only pays off on a 20-step undistilled ref2va schedule, which no shipped template runs.",
+    "description": "Conditioning generation on a supplied still. The same model is loaded under its 'fl2va' workflow and given only an 'image', so the picture becomes the video's first frame - the frame-conditioned form of the baseline. Also shows the acceleration that applies to any of these pipelines: a step-distillation LoRA, which composes with per-component quantization and offloading to cut the step count. The 'first_block' cache is deliberately absent - measured on the 9-step turbo schedule (and fewer steps on today's 4-step one only widens the gap), consecutive steps differ too much for it to ever skip, so it only held cache state for nothing; it only pays off on a 20-step undistilled ref2va schedule, which no shipped template runs. Dialogue and speaking shots (a `<d>` line) should drop the LoRA, because it digitizes voices: set lora_model_name to null, num_inference_steps 12, video_shift 12.0, audio_shift 3.0 (int4 is fine without it). The default prompt is deliberately non-dialogue.",
     "summary": "H3 video with audio from a supplied still as first frame, accelerated by a step-distillation LoRA.",
     "cost_drivers": [
         "num_frames",
@@ -13,7 +13,7 @@
         "cache"
     ],
     "variables": {
-        "prompt": "For the target video, at 0.00 seconds into the target video, <Picture 1> (from [Shot 1]) is fully referenced.\n\nintegrated_multimodal_description: [Shot 1] Cinematic, live-action macro photography with a shallow depth of field. The shot opens exactly on <Picture 1>: a translucent blown glass figure fills the frame against a dark, softly graded background, its surface catching cool rim light along every curve and throwing small caustics onto the surface beneath it. Its tentacles, until now still, begin to writhe, curling and uncurling in slow deliberate coils, the glass flexing as though molten while staying perfectly clear. The figure (S1), a deep cavernous male voice with a long tail of reverb, unhurried and very low in pitch, says <d>[English] Rise now. The old ones are listening.</d> As the words land its central mass swells and contracts once, and the caustics on the surface below ripple with it. The camera pushes in with small amplitude at slow speed toward the figure's core through the final seconds, holding the writhing tentacles at the edges of frame.\n\noverall_soundscape: A dark, near-silent room tone under a faint low-frequency hum. The tentacle movement carries a fine, dry glass-on-glass squeak and an occasional soft chime as two limbs touch. A distant, slow swell of moving air rises beneath the voice and falls away after it.\n\nnon_diegetic_music: A sustained low drone of bowed double bass and detuned synthesiser, almost subsonic, rising very slowly in intensity across the clip with no discernible melody or pulse.",
+        "prompt": "For the target video, at 0.00 seconds into the target video, <Picture 1> (from [Shot 1]) is fully referenced.\n\nintegrated_multimodal_description: [Shot 1] Cinematic, live-action macro photography with a shallow depth of field. The shot opens exactly on <Picture 1>: a translucent blown glass figure fills the frame against a dark, softly graded background, its surface catching cool rim light along every curve and throwing small caustics onto the surface beneath it. Its tentacles, until now still, begin to writhe, curling and uncurling in slow deliberate coils, the glass flexing as though molten while staying perfectly clear. The figure (S1) lets out a deep, cavernous, wordless hum with a long tail of reverb, unhurried and very low in pitch. As the hum swells its central mass swells and contracts once, and the caustics on the surface below ripple with it. The camera pushes in with small amplitude at slow speed toward the figure's core through the final seconds, holding the writhing tentacles at the edges of frame.\n\noverall_soundscape: A dark, near-silent room tone under a faint low-frequency hum. The tentacle movement carries a fine, dry glass-on-glass squeak and an occasional soft chime as two limbs touch. A distant, slow swell of moving air rises beneath the hum and falls away after it.\n\nnon_diegetic_music: A sustained low drone of bowed double bass and detuned synthesiser, almost subsonic, rising very slowly in intensity across the clip with no discernible melody or pulse.",
         "image": {
             "location": "https://pbs.twimg.com/profile_images/1961215773080211456/nILQt5Fv_400x400.jpg"
         },
diff --git a/workflows/templates/remove-object.json b/workflows/templates/remove-object.json
new file mode 100644
index 000000000..75267a223
--- /dev/null
+++ b/workflows/templates/remove-object.json
@@ -0,0 +1,31 @@
+{
+    "id": "RemoveObject",
+    "description": "Erases what a mask covers with no prompt, filling from the surroundings (remove_object, LaMa). This is the removal route: white mask pixels are erased, the rest comes back unchanged. Suits small to medium objects - a cup, a sign, a watermark; a large region comes back smeared. Raise dilate (16 to 24) for a soft edge or a shadow; use segment-and-remove to mask the object by name instead of drawing one. To put something new in the mask, use a prompted inpainter (models/z-image-inpaint or templates/inpaint) instead.",
+    "shape": "image-edit",
+    "cost": [
+        {"device": "mps", "vram_gb": 1, "minutes": 0.2}
+    ],
+    "variables": {
+        "image": "https://huggingface.co/datasets/diffusers/diffusers-images-docs/resolve/main/cup.png",
+        "mask_image": "https://raw.githubusercontent.com/dkackman/diffusers-workflow/bfb4e222473a17e13aa8bd0d9c1f47a82243bd48/docs/img/cup-object-mask.png",
+        "dilate": 8
+    },
+    "steps": [
+        {
+            "name": "erase",
+            "task": {
+                "command": "remove_object",
+                "arguments": {
+                    "image": "variable:image",
+                    "mask_image": "variable:mask_image",
+                    "dilate": "variable:dilate"
+                }
+            },
+            "result": {
+                "content_type": "image/png",
+                "embed_metadata": true,
+                "subfolder": "final"
+            }
+        }
+    ]
+}
diff --git a/workflows/templates/segment-and-inpaint.json b/workflows/templates/segment-and-inpaint.json
index 6689610f5..f0b91d3dd 100644
--- a/workflows/templates/segment-and-inpaint.json
+++ b/workflows/templates/segment-and-inpaint.json
@@ -1,6 +1,6 @@
 {
     "id": "SegmentAndInpaint",
-    "description": "Segments an input image, then inpaints the selected region with FLUX.1 Fill dev.",
+    "description": "Segments an input image, then inpaints the selected region with FLUX.1 Fill dev. It repaints the region with what the prompt names and is not the removal route: to erase the object, use templates/segment-and-remove (the prompt-free remove_object task).",
     "variables": {
         "image_url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/diffusers/cat.png",
         "segment_prompt": "cat",
diff --git a/workflows/templates/segment-and-remove.json b/workflows/templates/segment-and-remove.json
new file mode 100644
index 000000000..45aa36e54
--- /dev/null
+++ b/workflows/templates/segment-and-remove.json
@@ -0,0 +1,46 @@
+{
+    "id": "SegmentAndRemove",
+    "description": "Finds an object by name and erases it with no prompt, filling from the surroundings (segment, then remove_object). This is the removal route when there is no mask to hand: segment's mask is white on the object, which is what remove_object erases. Suits small to medium objects; a large region comes back smeared. Raise dilate (16 to 24) when the object has a soft edge or casts a shadow. If segment finds nothing, the image comes back unchanged with a warning. To replace the object with something else, use segment-and-inpaint instead.",
+    "shape": "image-edit",
+    "cost": [
+        {"device": "cuda", "name": "RTX 3090", "vram_gb": 4, "minutes": 1.2}
+    ],
+    "variables": {
+        "image": "https://huggingface.co/datasets/diffusers/diffusers-images-docs/resolve/main/cup.png",
+        "object": "cup",
+        "dilate": 8
+    },
+    "steps": [
+        {
+            "name": "mask",
+            "task": {
+                "command": "segment",
+                "arguments": {
+                    "image": "variable:image",
+                    "prompt": "variable:object"
+                }
+            },
+            "result": {
+                "content_type": "image/png",
+                "embed_metadata": true,
+                "subfolder": "intermediate"
+            }
+        },
+        {
+            "name": "erase",
+            "task": {
+                "command": "remove_object",
+                "arguments": {
+                    "image": "variable:image",
+                    "mask_image": "previous_result:mask",
+                    "dilate": "variable:dilate"
+                }
+            },
+            "result": {
+                "content_type": "image/png",
+                "embed_metadata": true,
+                "subfolder": "final"
+            }
+        }
+    ]
+}