test(frontend): wiring tests for the 37 high-risk gaps (printer card and bulk actions, settings and 2FA, inventory/Spoolman/SpoolBuddy, queue, archives, finance, K-profiles, smart plugs, maintenance); fix: the archive purge uses the previewed age, a transaction can be moved to no cost center, and deleting a printer refreshes its spool assignments

CHANGELOG.md

@@ -164,6 +164,9 @@ All notable changes to Bambuddy will be documented in this file.
 - **The frontend build no longer warns about `path` and `crypto` being externalized for the STEP previewer (#2976)** — `occt-import-js`, the Emscripten build behind STEP previews, requires both modules, but only inside its `ENVIRONMENT_IS_NODE` branches; in the browser it loads its `.wasm` from the URL the preview worker passes and draws randomness from `crypto.getRandomValues`. Vite still externalized both and printed two warnings on every build. `vite.config.ts` now drops exactly those two warnings for that one package through `build.rolldownOptions.onLog`, so an externalization anywhere else, or of any other module, still shows.
 
 ### Fixed
+- **Purging archives could delete by an age that wasn't previewed** — The "Purge old archives" dialog previews what it will delete a moment after you stop typing, but the delete button took the age currently in the field. Changing the age and clicking straight away deleted archives for the new age while the button still showed the old preview's count. The button now waits until the preview matches the field, and the purge uses the previewed age.
+- **Editing a transaction to "No cost center" kept the old cost center** — Finance showed "Transaction updated", but the entry stayed booked to its previous cost center.
+- **After deleting a printer, spools still showed as loaded in it** — The spool assignment list wasn't refreshed, so the inventory kept showing spools in the deleted printer's slots for up to 30 seconds.
 - **API keys of Operators were refused on queue, archive and library routes** — A key whose owner may act only on their own rows (the built-in Operators group) got `403 API key owner does not have 'queue:update_all' permission` when it listed, edited, cancelled or deleted even its owner's own queue jobs, and the same on archives and library files. Such a key now acts on its owner's rows and not on anyone else's. Keys of owners with the `_all` permissions, and keys without an owner, reach every row as before.
 - **Statistics: Today, This Week and the other ranges used UTC days** — Near midnight they showed the wrong day's prints for anyone outside UTC: in Berlin at 01:30, "Today" showed the previous day. A day now runs from midnight to midnight in your browser's time zone, for every date filter on the Statistics page, and the date pickers allow today. API callers can name the zone with the new `tz` parameter on the date-filtered archive and statistics endpoints; without it, a date is a day in Bambuddy's own `TZ` (UTC days before).
 - **A print that failed on its first run left the archive costing only the part it printed** — With the built-in inventory, the archive took the failed run's partial cost, so a reprint was estimated, reserved and billed from that fraction. The archive now keeps the cost of one full print (as in Spoolman mode); the failed run's own cost is still recorded in the Print Log.

frontend/src/__tests__/components/AddSmartPlugModalWiring.test.tsx

@@ -0,0 +1,286 @@
+/**
+ * AddSmartPlugModal wiring: the create / update payloads per plug type,
+ * the printer link, and the Tasmota discovery scan requests.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { AddSmartPlugModal } from '../../components/AddSmartPlugModal';
+import type { SmartPlug } from '../../api/client';
+
+type Sent = { method: string; path: string; body: Record<string, unknown> | null };
+
+const PRINTERS = [
+  { id: 3, name: 'Wiring Printer A', model: 'X1C', serial_number: 'SN-TEST-A' },
+  { id: 4, name: 'Wiring Printer B', model: 'P1S', serial_number: 'SN-TEST-B' },
+];
+
+let sent: Sent[];
+
+async function record(request: Request) {
+  let body: Record<string, unknown> | null = null;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  server.use(
+    http.get('*/api/v1/printers/', () => HttpResponse.json(PRINTERS)),
+    http.get('*/api/v1/smart-plugs/', () => HttpResponse.json([])),
+    http.get('*/api/v1/settings/', () =>
+      HttpResponse.json({
+        ha_enabled: true,
+        ha_url: 'http://ha.example',
+        ha_token: 'test-token-1',
+        mqtt_broker: 'mqtt.example',
+      }),
+    ),
+    http.get('*/api/v1/smart-plugs/ha/entities', () =>
+      HttpResponse.json([
+        { entity_id: 'switch.wiring_plug', friendly_name: 'Wiring Switch', state: 'off', domain: 'switch' },
+      ]),
+    ),
+    http.get('*/api/v1/smart-plugs/ha/sensors', () => HttpResponse.json([])),
+    http.post('*/api/v1/smart-plugs/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ id: 99 });
+    }),
+    http.patch('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ id: 5 });
+    }),
+  );
+});
+
+function nameInput() {
+  return screen.getByPlaceholderText('Living Room Plug');
+}
+
+describe('AddSmartPlugModal wiring: create', () => {
+  it('Tasmota: sends ip, type, printer_id and the default automation flags, no other type fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.20');
+    await user.type(nameInput(), 'Desk Plug');
+    const printerSelect = await screen.findByDisplayValue('No printer (manual control only)');
+    await screen.findByRole('option', { name: 'Wiring Printer B' });
+    await user.selectOptions(printerSelect, '4');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('POST');
+    expect(req.path).toBe('/api/v1/smart-plugs/');
+    expect(req.body).toMatchObject({
+      name: 'Desk Plug',
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.20',
+      printer_id: 4,
+      controls_printer_power: true,
+      ha_entity_id: null,
+      mqtt_power_topic: null,
+      rest_on_url: null,
+      username: null,
+      password: null,
+    });
+  });
+
+  it('Tasmota: unlinked sends printer_id null', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.21');
+    await user.type(nameInput(), 'Loose Plug');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({ plug_type: 'tasmota', printer_id: null });
+  });
+
+  it('Tasmota without an IP sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(nameInput(), 'No IP');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    expect(await screen.findByText(/IP address is required/i)).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+
+  it('Home Assistant: sends the picked entity and no Tasmota/MQTT/REST fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'HA' }));
+    const search = await screen.findByPlaceholderText(/search/i);
+    await user.click(search);
+    await user.click(await screen.findByText('Wiring Switch'));
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      name: 'Wiring Switch',
+      plug_type: 'homeassistant',
+      ha_entity_id: 'switch.wiring_plug',
+      ip_address: null,
+      username: null,
+      password: null,
+      mqtt_power_topic: null,
+      rest_on_url: null,
+      printer_id: null,
+    });
+  });
+
+  it('switching from HA to Tasmota drops the picked HA entity from the payload', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'HA' }));
+    await user.click(await screen.findByPlaceholderText(/search/i));
+    await user.click(await screen.findByText('Wiring Switch'));
+    await user.click(screen.getByRole('button', { name: 'Tasmota' }));
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.22');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.22',
+      ha_entity_id: null,
+      ha_power_entity: null,
+    });
+  });
+
+  it('MQTT: sends only the MQTT topic fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'MQTT' }));
+    await user.type(await screen.findByPlaceholderText('zigbee2mqtt/shelly-working-room'), 'tele/wiring/SENSOR');
+    await user.type(nameInput(), 'Meter');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'mqtt',
+      mqtt_power_topic: 'tele/wiring/SENSOR',
+      mqtt_energy_topic: null,
+      ip_address: null,
+      ha_entity_id: null,
+      rest_on_url: null,
+    });
+  });
+
+  it('REST: sends the REST URLs and method only', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'REST' }));
+    const [onUrl, offUrl] = await screen.findAllByPlaceholderText('http://openhab:8080/rest/items/MyPlug');
+    await user.type(onUrl, 'http://plug.example/on');
+    await user.type(offUrl, 'http://plug.example/off');
+    await user.type(nameInput(), 'Rest Plug');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'rest',
+      rest_on_url: 'http://plug.example/on',
+      rest_off_url: 'http://plug.example/off',
+      rest_method: 'POST',
+      ip_address: null,
+      ha_entity_id: null,
+      mqtt_power_topic: null,
+      username: null,
+      password: null,
+    });
+  });
+});
+
+describe('AddSmartPlugModal wiring: edit', () => {
+  it('PATCHes the edited plug by id, keeping the saved-secret placeholder and the changed name', async () => {
+    const user = userEvent.setup();
+    const existing = {
+      id: 5,
+      name: 'Old Name',
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.30',
+      username: 'admin',
+      password: '********',
+      enabled: true,
+      printer_id: 3,
+      controls_printer_power: false,
+    } as unknown as SmartPlug;
+    render(<AddSmartPlugModal plug={existing} onClose={() => undefined} />);
+
+    const name = await screen.findByDisplayValue('Old Name');
+    await user.clear(name);
+    await user.type(name, 'New Name');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('PATCH');
+    expect(req.path).toBe('/api/v1/smart-plugs/5');
+    expect(req.body).toMatchObject({
+      name: 'New Name',
+      ip_address: '192.0.2.30',
+      username: 'admin',
+      // The write-only placeholder goes back untouched; the backend keeps the stored secret.
+      password: '********',
+      printer_id: 3,
+      controls_printer_power: false,
+    });
+  });
+});
+
+describe('AddSmartPlugModal wiring: Tasmota discovery', () => {
+  it('starts and stops the scan, and picking a found device fills IP and name', async () => {
+    server.use(
+      http.post('*/api/v1/smart-plugs/discover/scan', async ({ request }) => {
+        await record(request);
+        return HttpResponse.json({ running: true, scanned: 0, total: 254 });
+      }),
+      http.get('*/api/v1/smart-plugs/discover/status', () =>
+        HttpResponse.json({ running: true, scanned: 10, total: 254 }),
+      ),
+      http.get('*/api/v1/smart-plugs/discover/devices', () =>
+        HttpResponse.json([{ ip_address: '192.0.2.55', name: 'Found Plug', state: 'ON' }]),
+      ),
+      http.post('*/api/v1/smart-plugs/discover/stop', async ({ request }) => {
+        await record(request);
+        return HttpResponse.json({ running: false, scanned: 10, total: 254 });
+      }),
+    );
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'Discover Tasmota Devices' }));
+    await waitFor(() => expect(writes().map((w) => w.path)).toEqual(['/api/v1/smart-plugs/discover/scan']));
+
+    await user.click(await screen.findByText('Found Plug'));
+    expect(screen.getByPlaceholderText('192.168.1.100')).toHaveValue('192.0.2.55');
+    expect(nameInput()).toHaveValue('Found Plug');
+
+    await user.click(screen.getByRole('button', { name: 'Stop Scanning' }));
+    await waitFor(() =>
+      expect(writes().map((w) => w.path)).toEqual([
+        '/api/v1/smart-plugs/discover/scan',
+        '/api/v1/smart-plugs/discover/stop',
+      ]),
+    );
+  });
+});

frontend/src/__tests__/components/AssignSpoolModalWiring.test.tsx

@@ -0,0 +1,180 @@
+/**
+ * Wiring tests for AssignSpoolModal: pin the exact request payload sent
+ * when a spool is assigned to a slot (built-in and Spoolman inventory),
+ * and that the material-mismatch confirm gates the request.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { AssignSpoolModal } from '../../components/AssignSpoolModal';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getSpools: vi.fn(),
+    getAssignments: vi.fn(),
+    assignSpool: vi.fn(),
+    assignSpoolmanSlot: vi.fn(),
+    getSpoolmanInventorySpools: vi.fn(),
+    getSpoolmanSlotAssignments: vi.fn().mockResolvedValue([]),
+    getSettings: vi.fn().mockResolvedValue({}),
+    getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    refreshPrinterStatus: vi.fn().mockResolvedValue({ status: 'ok' }),
+  },
+}));
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const plaSpool = {
+  id: 41,
+  material: 'PLA',
+  subtype: 'Basic',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 1000,
+  weight_used: 0,
+  tag_uid: null,
+  tray_uuid: null,
+  slicer_filament_name: 'PLA',
+};
+
+const baseProps = {
+  isOpen: true,
+  onClose: vi.fn(),
+  printerId: 7,
+  amsId: 128,
+  trayId: 0,
+};
+
+describe('AssignSpoolModal wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSpools.mockResolvedValue([plaSpool]);
+    mocked.getAssignments.mockResolvedValue([]);
+    mocked.getSettings.mockResolvedValue({});
+    mocked.refreshPrinterStatus.mockResolvedValue({ status: 'ok' });
+    mocked.getSpoolmanSlotAssignments.mockResolvedValue([]);
+    mocked.assignSpool.mockResolvedValue({ id: 1, spool_id: 41, printer_id: 7, ams_id: 128, tray_id: 0 });
+    mocked.assignSpoolmanSlot.mockResolvedValue({});
+  });
+
+  it('built-in: sends assignSpool with the picked spool id and the opened slot (AMS-HT 128)', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'AMS-HT' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() => expect(mocked.assignSpool).toHaveBeenCalledTimes(1));
+    expect(mocked.assignSpool).toHaveBeenCalledWith({
+      spool_id: 41,
+      printer_id: 7,
+      ams_id: 128,
+      tray_id: 0,
+    });
+    expect(mocked.assignSpoolmanSlot).not.toHaveBeenCalled();
+  });
+
+  it('built-in: external slot ids (254/255) are passed through unchanged', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={255}
+        trayId={254}
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'External' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() =>
+      expect(mocked.assignSpool).toHaveBeenCalledWith({ spool_id: 41, printer_id: 7, ams_id: 255, tray_id: 254 }),
+    );
+  });
+
+  it('material mismatch: confirm dialog appears and nothing is sent until "Assign Anyway"', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={1}
+        trayId={2}
+        trayInfo={{ type: 'PETG', material: 'PETG', profile: 'PETG HF', color: 'FF0000', location: 'AMS 2 - Slot 3' }}
+      />,
+    );
+    // PLA spool is filtered out for a PETG tray; reveal it with the toggle.
+    await screen.findByText(/No spools available|show all spools/i);
+    await user.click(screen.getByLabelText(/show all spools/i));
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    expect(await screen.findByText('Material mismatch')).toBeInTheDocument();
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+
+    await user.click(screen.getByRole('button', { name: 'Assign Anyway' }));
+    await waitFor(() =>
+      expect(mocked.assignSpool).toHaveBeenCalledWith({ spool_id: 41, printer_id: 7, ams_id: 1, tray_id: 2 }),
+    );
+    expect(mocked.assignSpool).toHaveBeenCalledTimes(1);
+  });
+
+  it('material mismatch: cancelling the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={1}
+        trayId={2}
+        trayInfo={{ type: 'PETG', material: 'PETG', profile: 'PETG HF', color: 'FF0000', location: 'AMS 2 - Slot 3' }}
+      />,
+    );
+    await screen.findByText(/No spools available|show all spools/i);
+    await user.click(screen.getByLabelText(/show all spools/i));
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await screen.findByText('Material mismatch');
+    // The confirm dialog renders after the modal, so its Cancel is the last one.
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+
+    await waitFor(() => expect(screen.queryByText('Material mismatch')).not.toBeInTheDocument());
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman: sends assignSpoolmanSlot with spoolman_spool_id and the opened slot', async () => {
+    const user = userEvent.setup();
+    mocked.getSpools.mockResolvedValue([]);
+    mocked.getSpoolmanInventorySpools.mockResolvedValue([
+      { ...plaSpool, id: 900, brand: 'Spoolman Brand', archived_at: null },
+    ]);
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={2}
+        trayId={3}
+        spoolmanEnabled
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'AMS 3 - Slot 4' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Spoolman Brand/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() =>
+      expect(mocked.assignSpoolmanSlot).toHaveBeenCalledWith({
+        spoolman_spool_id: 900,
+        printer_id: 7,
+        ams_id: 2,
+        tray_id: 3,
+      }),
+    );
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/BulkEditSpoolsModalWiring.test.tsx

@@ -0,0 +1,151 @@
+/**
+ * Wiring tests for BulkEditSpoolsModal: pin the exact patch handed to
+ * onApply (which InventoryPage forwards to bulkUpdateSpools). Only ticked
+ * fields may appear, so other spools' values are never overwritten, and
+ * Spoolman mode must never emit internal-only keys.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { BulkEditSpoolsModal } from '../../components/BulkEditSpoolsModal';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getCloudStatus: vi.fn().mockResolvedValue({ is_authenticated: false }),
+      orcaCloudStatus: vi.fn().mockResolvedValue({ connected: false }),
+      getLocalPresets: vi.fn().mockResolvedValue({ filament: [] }),
+      getBuiltinFilaments: vi.fn().mockResolvedValue([]),
+      getSettings: vi.fn().mockResolvedValue({}),
+      getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    },
+  };
+});
+
+const onApply = vi.fn();
+const onClose = vi.fn();
+
+const baseProps = {
+  isOpen: true,
+  selectedCount: 3,
+  isPending: false,
+  availableLocations: [{ id: 5, name: 'Shelf A' }],
+  availableMaterials: [],
+  availableSubtypes: [],
+  availableBrands: [],
+  availableCategories: [],
+  availableMaterialNumbers: [],
+  availableSlicerFilaments: [],
+  availableSlicerFilamentNames: [],
+  onClose,
+  onApply,
+};
+
+/** The row container for a field, found via its exact label text. */
+function row(label: string): HTMLElement {
+  const lbl = screen.getByText(label, { selector: 'label' });
+  return lbl.closest('div.flex.items-start') as HTMLElement;
+}
+
+async function tickAndType(user: ReturnType<typeof userEvent.setup>, label: string, value: string) {
+  const r = row(label);
+  await user.click(within(r).getByRole('checkbox'));
+  const input = r.querySelector('textarea, input[type="text"], input[type="number"]') as HTMLElement;
+  await user.type(input, value);
+}
+
+describe('BulkEditSpoolsModal wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('only the ticked material field ends up in the patch', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    await tickAndType(user, 'Material', 'PETG-CF');
+    // Close any open dropdown so the Apply button is reachable.
+    await user.keyboard('{Escape}');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    expect(onApply).toHaveBeenCalledWith({ material: 'PETG-CF' });
+  });
+
+  it('ticked but empty fields are left out; numbers are sent as numbers', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    // Ticked, left blank -> must not blank the field on every selected spool.
+    await user.click(within(row('Brand')).getByRole('checkbox'));
+    await tickAndType(user, 'Cost per kg', '19.5');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    expect(onApply).toHaveBeenCalledWith({ cost_per_kg: 19.5 });
+  });
+
+  it('internal mode: internal-only fields are sent when ticked', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    await tickAndType(user, 'Material No.', 'MN-7');
+    await user.keyboard('{Escape}');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledWith({ material_number: 'MN-7' }));
+  });
+
+  it('Spoolman mode: patch holds only the ticked Spoolman-storable fields, no internal-only keys', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode />);
+
+    await tickAndType(user, 'Material', 'ASA');
+    await user.keyboard('{Escape}');
+    await tickAndType(user, 'Note', 'restocked');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    const patch = onApply.mock.calls[0][0] as Record<string, unknown>;
+    expect(patch).toEqual({ material: 'ASA', note: 'restocked' });
+    for (const k of ['category', 'low_stock_threshold_pct', 'material_number']) {
+      expect(patch).not.toHaveProperty(k);
+    }
+  });
+
+  it('Spoolman mode: ticking and filling EVERY offered field still yields no internal-only key', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode />);
+
+    const rows = screen.getAllByRole('checkbox').map((cb) => cb.closest('div.flex.items-start') as HTMLElement);
+    for (const r of rows) {
+      await user.click(within(r).getByRole('checkbox'));
+      const input = r.querySelector('textarea, input[type="text"], input[type="number"]') as HTMLInputElement;
+      await user.type(input, input.type === 'number' ? '5' : input.placeholder?.includes('RRGGBB') ? 'FF0000' : 'X');
+      await user.keyboard('{Escape}');
+    }
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    const patch = onApply.mock.calls[0][0] as Record<string, unknown>;
+    // Sanity: the fill reached the patch (material, note, ... are present).
+    expect(patch).toHaveProperty('material', 'X');
+    expect(patch).toHaveProperty('note', 'X');
+    for (const k of ['category', 'low_stock_threshold_pct', 'material_number']) {
+      expect(patch).not.toHaveProperty(k);
+    }
+  });
+
+  it('Cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} />);
+    await tickAndType(user, 'Note', 'x');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(onApply).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/BulkPrinterToolbarWiring.test.tsx

@@ -0,0 +1,170 @@
+/**
+ * BulkPrinterToolbar wiring: which action the toolbar reports, which state the
+ * select-by-state dropdown reports, and the permission gates on the destructive
+ * buttons (printers:control for stop/pause/resume/clear HMS,
+ * printers:clear_plate for Clear Bed).
+ *
+ * The toolbar reads printer statuses straight from the query cache, so each
+ * test seeds the cache it renders with.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { Printer } from '../../api/client';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { BulkPrinterToolbar } from '../../components/BulkPrinterToolbar';
+
+const printer = (id: number, location: string | null = null) =>
+  ({ id, name: `P${id}`, model: 'X1C', location }) as unknown as Printer;
+
+const printers = [printer(1, 'Lab'), printer(2, 'Lab'), printer(3, 'Shed')];
+
+// 1 printing, 2 paused (awaiting plate clear), 3 idle.
+function seededClient() {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  qc.setQueryData(['printerStatus', 1], { connected: true, state: 'RUNNING' });
+  qc.setQueryData(['printerStatus', 2], { connected: true, state: 'PAUSE', awaiting_plate_clear: true });
+  qc.setQueryData(['printerStatus', 3], { connected: true, state: 'IDLE' });
+  return qc;
+}
+
+function renderToolbar(selected: number[] = [1, 2]) {
+  const props = {
+    selectedIds: new Set(selected),
+    printers,
+    onClose: vi.fn(),
+    onSelectAll: vi.fn(),
+    onSelectByLocation: vi.fn(),
+    onSelectByState: vi.fn(),
+    onAction: vi.fn(),
+    actionPending: false,
+  };
+  render(
+    <QueryClientProvider client={seededClient()}>
+      <BulkPrinterToolbar {...props} />
+    </QueryClientProvider>,
+  );
+  return props;
+}
+
+const btn = (name: string) => screen.getByRole('button', { name });
+
+describe('BulkPrinterToolbar wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control', 'printers:clear_plate'];
+    vi.clearAllMocks();
+  });
+
+  it.each([
+    ['Stop', 'stop'],
+    ['Pause', 'pause'],
+    ['Resume', 'resume'],
+    ['Clear Bed', 'clearPlate'],
+  ])('clicking %s reports action %s', async (label, action) => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn(label));
+    expect(props.onAction).toHaveBeenCalledTimes(1);
+    expect(props.onAction).toHaveBeenCalledWith(action);
+  });
+
+  it('disables Stop, Pause and Resume without printers:control', async () => {
+    permissions.granted = ['printers:clear_plate'];
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Notifications']) {
+      expect(btn(label)).toBeDisabled();
+      expect(btn(label)).toHaveAttribute('title', 'You do not have permission to control printers');
+      await user.click(btn(label));
+    }
+    // Clear Bed has its own permission and stays usable.
+    expect(btn('Clear Bed')).toBeEnabled();
+    expect(props.onAction).not.toHaveBeenCalled();
+  });
+
+  it('disables Clear Bed without printers:clear_plate even with control', async () => {
+    permissions.granted = ['printers:control'];
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    expect(btn('Clear Bed')).toBeDisabled();
+    await user.click(btn('Clear Bed'));
+    expect(props.onAction).not.toHaveBeenCalled();
+    expect(btn('Stop')).toBeEnabled();
+  });
+
+  it('disables actions none of the selected printers can take', () => {
+    // Only the idle printer is selected: nothing to stop, pause, resume or clear.
+    renderToolbar([3]);
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Bed']) {
+      expect(btn(label)).toBeDisabled();
+    }
+  });
+
+  it('disables every action while one is pending', () => {
+    const props = {
+      selectedIds: new Set([1, 2]),
+      printers,
+      onClose: vi.fn(),
+      onSelectAll: vi.fn(),
+      onSelectByLocation: vi.fn(),
+      onSelectByState: vi.fn(),
+      onAction: vi.fn(),
+      actionPending: true,
+    };
+    render(
+      <QueryClientProvider client={seededClient()}>
+        <BulkPrinterToolbar {...props} />
+      </QueryClientProvider>,
+    );
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Bed']) {
+      expect(btn(label)).toBeDisabled();
+    }
+  });
+
+  it('select by state reports the picked state', async () => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn('Select by State'));
+    // Only states with printers in them are offered.
+    expect(screen.queryByRole('button', { name: /Offline/ })).toBeNull();
+    await user.click(screen.getByRole('button', { name: /Paused/ }));
+    expect(props.onSelectByState).toHaveBeenCalledTimes(1);
+    expect(props.onSelectByState).toHaveBeenCalledWith('paused');
+    // The dropdown closes after a pick.
+    await waitFor(() => expect(screen.queryByRole('button', { name: /Paused/ })).toBeNull());
+  });
+
+  it('select by location reports the picked location', async () => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn('Select by Location'));
+    await user.click(screen.getByRole('button', { name: 'Shed' }));
+    expect(props.onSelectByLocation).toHaveBeenCalledWith('Shed');
+    expect(props.onSelectByState).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/ConfigureAmsSlotModalWiring.test.tsx

@@ -0,0 +1,99 @@
+/**
+ * Wiring tests for ConfigureAmsSlotModal's "Reset Slot" path: the request
+ * must target exactly the opened slot (printer, AMS id, tray id), including
+ * AMS-HT (128+) and external (255/254) ids.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { ConfigureAmsSlotModal } from '../../components/ConfigureAmsSlotModal';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getCloudSettings: vi.fn(),
+    getKProfiles: vi.fn(),
+    configureAmsSlot: vi.fn(),
+    getCloudSettingDetail: vi.fn(),
+    saveSlotPreset: vi.fn(),
+    getSettings: vi.fn().mockResolvedValue({}),
+    getSlicerPrinterModels: vi.fn().mockResolvedValue({}),
+    updateSettings: vi.fn().mockResolvedValue({}),
+    getLocalPresets: vi.fn(),
+    getBuiltinFilaments: vi.fn(),
+    orcaCloudListProfiles: vi.fn(),
+    orcaCloudGetProfile: vi.fn(),
+    searchColors: vi.fn(),
+    getColorCatalog: vi.fn(),
+    resetAmsSlot: vi.fn(),
+    getPrinterStatus: vi.fn().mockResolvedValue({}),
+  },
+}));
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const onClose = vi.fn();
+const onSuccess = vi.fn();
+
+function props(amsId: number, trayId: number, printerId = 9) {
+  return {
+    isOpen: true,
+    onClose,
+    onSuccess,
+    printerId,
+    slotInfo: { amsId, trayId, trayType: 'PLA', trayColor: 'FFFFFF', traySubBrands: 'PLA Basic' },
+    nozzleDiameter: '0.4',
+  };
+}
+
+describe('ConfigureAmsSlotModal reset wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    Element.prototype.scrollIntoView = vi.fn();
+    mocked.getPrinterStatus.mockResolvedValue({});
+    mocked.getSettings.mockResolvedValue({});
+    mocked.getSlicerPrinterModels.mockResolvedValue({});
+    mocked.getCloudSettings.mockResolvedValue({ filament: [] });
+    mocked.getKProfiles.mockResolvedValue({ profiles: [] });
+    mocked.getLocalPresets.mockResolvedValue({ filament: [] });
+    mocked.orcaCloudListProfiles.mockResolvedValue({ filament: [], printer: [], process: [] });
+    mocked.getBuiltinFilaments.mockResolvedValue([]);
+    mocked.searchColors.mockResolvedValue([]);
+    mocked.getColorCatalog.mockResolvedValue([]);
+    mocked.resetAmsSlot.mockResolvedValue({ success: true, message: 'ok' });
+  });
+
+  it.each([
+    ['regular AMS slot', 2, 3],
+    ['AMS-HT unit', 128, 0],
+    ['external spool holder', 255, 254],
+  ])('%s: Reset Slot sends resetAmsSlot(printerId, amsId, trayId)', async (_label, amsId, trayId) => {
+    const user = userEvent.setup();
+    render(<ConfigureAmsSlotModal {...props(amsId, trayId)} />);
+
+    await user.click(await screen.findByRole('button', { name: /Reset Slot/ }));
+
+    await waitFor(() => expect(mocked.resetAmsSlot).toHaveBeenCalledTimes(1));
+    expect(mocked.resetAmsSlot).toHaveBeenCalledWith(9, amsId, trayId);
+    expect(mocked.configureAmsSlot).not.toHaveBeenCalled();
+    await waitFor(() => expect(onSuccess).toHaveBeenCalled());
+  });
+
+  it('Cancel closes without resetting or configuring', async () => {
+    const user = userEvent.setup();
+    render(<ConfigureAmsSlotModal {...props(1, 1)} />);
+    await screen.findByRole('button', { name: /Reset Slot/ });
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(mocked.resetAmsSlot).not.toHaveBeenCalled();
+    expect(mocked.configureAmsSlot).not.toHaveBeenCalled();
+  });
+
+  // NOTE: the audit item also asked to pin "reset requires confirm and is
+  // disabled while printing". Neither exists in the component today: the
+  // button calls resetAmsSlot on the first click and takes no printer-state
+  // prop. Left as todo for a product decision rather than asserted.
+  it.todo('Reset Slot asks for confirmation before sending (not implemented)');
+  it.todo('Reset Slot is disabled while the printer is printing (not implemented)');
+});

frontend/src/__tests__/components/EmailSettingsWiring.test.tsx

@@ -0,0 +1,192 @@
+/**
+ * Email settings: the SMTP save request carries the form values (and an
+ * empty password when it was not retyped, so the server keeps the stored
+ * one), and the advanced-auth toggle only calls enable/disable when its
+ * preconditions hold.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { EmailSettings } from '../../components/EmailSettings';
+
+type Captured = { method: string; path: string; body: unknown };
+
+let captured: Captured[];
+let advancedStatus: { advanced_auth_enabled: boolean; smtp_configured: boolean };
+let authEnabled: boolean;
+
+const STORED_SMTP = {
+  smtp_host: 'smtp.example',
+  smtp_port: 587,
+  smtp_username: 'mailer',
+  smtp_password: null,
+  smtp_security: 'starttls',
+  smtp_auth_enabled: true,
+  smtp_from_email: 'from@example.com',
+  smtp_from_name: 'BamBuddy',
+};
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  advancedStatus = { advanced_auth_enabled: false, smtp_configured: true };
+  authEnabled = true;
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: authEnabled, requires_setup: false })),
+    http.get('*/api/v1/auth/smtp', () => HttpResponse.json(STORED_SMTP)),
+    http.get('*/api/v1/auth/advanced-auth/status', () => HttpResponse.json(advancedStatus)),
+    http.post('*/api/v1/auth/smtp', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/smtp/test', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ success: true, message: 'sent' });
+    }),
+    http.post('*/api/v1/auth/advanced-auth/enable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'enabled', advanced_auth_enabled: true });
+    }),
+    http.post('*/api/v1/auth/advanced-auth/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'disabled', advanced_auth_enabled: false });
+    }),
+  );
+});
+
+describe('EmailSettings wiring', () => {
+  it('save sends host/port/security/from and an empty password when it was not retyped', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    const from = screen.getByDisplayValue('from@example.com');
+    await user.clear(from);
+    await user.type(from, 'printer@example.com');
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => expect(captured.filter((c) => c.path.endsWith('/auth/smtp'))).toHaveLength(1));
+    const req = captured[0];
+    expect(req.method).toBe('POST');
+    expect(req.body).toEqual({
+      smtp_host: 'smtp.example',
+      smtp_port: 587,
+      smtp_username: 'mailer',
+      smtp_password: '',
+      smtp_security: 'starttls',
+      smtp_auth_enabled: true,
+      smtp_from_email: 'printer@example.com',
+      smtp_from_name: 'BamBuddy',
+    });
+  });
+
+  it('changing security to SSL sends ssl with port 465, and a retyped password is sent', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    await user.selectOptions(screen.getByDisplayValue('STARTTLS (Port 587)'), 'ssl');
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({
+      smtp_security: 'ssl',
+      smtp_port: 465,
+      smtp_password: 'test-password-1',
+    });
+  });
+
+  it('save without a host sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await user.clear(await screen.findByDisplayValue('smtp.example'));
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    expect(await screen.findByText(/please fill in all required fields/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('send test email posts the recipient to /auth/smtp/test', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    await user.type(screen.getByPlaceholderText('test@example.com'), 'probe@example.com');
+    await user.click(screen.getByRole('button', { name: /send test email/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/auth/smtp/test',
+      body: { test_recipient: 'probe@example.com' },
+    });
+  });
+
+  it('enable advanced auth calls enable once SMTP is configured', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    // Wait for AuthProvider to report auth enabled before clicking
+    await waitFor(async () => {
+      captured = [];
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(captured.map((c) => c.path)).toContain('/api/v1/auth/advanced-auth/enable');
+    });
+    expect(captured.map((c) => c.path)).not.toContain('/api/v1/auth/advanced-auth/disable');
+  });
+
+  it('enable advanced auth sends nothing while SMTP is not configured/tested', async () => {
+    advancedStatus = { advanced_auth_enabled: false, smtp_configured: false };
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    // Click until auth status has loaded and the SMTP precondition is the one refusing
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(screen.getAllByText(/configure and test smtp settings first/i).length).toBeGreaterThan(0);
+    });
+    expect(captured).toHaveLength(0);
+  });
+
+  it('enable advanced auth sends nothing while app authentication is off', async () => {
+    authEnabled = false;
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    await user.click(screen.getByRole('button', { name: /^enable$/i }));
+
+    expect(await screen.findByText(/enable authentication first/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('disable advanced auth calls disable when it is on', async () => {
+    advancedStatus = { advanced_auth_enabled: true, smtp_configured: true };
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is enabled/i);
+    await waitFor(async () => {
+      captured = [];
+      await user.click(screen.getByRole('button', { name: /^disable$/i }));
+      expect(captured.map((c) => c.path)).toContain('/api/v1/auth/advanced-auth/disable');
+    });
+    expect(captured.map((c) => c.path)).not.toContain('/api/v1/auth/advanced-auth/enable');
+  });
+});

frontend/src/__tests__/components/ForecastPanelWiring.test.tsx

@@ -0,0 +1,289 @@
+/**
+ * Wiring tests for ForecastPanel's inventory-changing actions: add to
+ * shopping list, status changes, "received" creating spools via
+ * bulkCreateSpools, remove / clear, and per-SKU settings upserts.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { ForecastPanel } from '../../components/ForecastPanel';
+import { api } from '../../api/client';
+import type { InventorySpool, ShoppingListItem } from '../../api/client';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return {
+    ...actual,
+    useAuth: () => ({ hasPermission: () => true, hasAnyPermission: () => true, authEnabled: false, user: null }),
+  };
+});
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getSettings: vi.fn(),
+      getUiSettings: vi.fn(),
+      getAuthStatus: vi.fn(),
+      getSkuSettings: vi.fn(),
+      getAllUsageHistory: vi.fn(),
+      getShoppingList: vi.fn(),
+      addToShoppingList: vi.fn(),
+      removeFromShoppingList: vi.fn(),
+      clearShoppingList: vi.fn(),
+      updateShoppingListStatus: vi.fn(),
+      bulkCreateSpools: vi.fn(),
+      upsertSkuSettings: vi.fn(),
+      updateSettings: vi.fn(),
+    },
+  };
+});
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const spool = (id: number, over: Partial<InventorySpool> = {}): InventorySpool => ({
+  id,
+  material: 'PLA',
+  subtype: 'Matte',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 750,
+  core_weight: 250,
+  core_weight_catalog_id: null,
+  weight_used: 100,
+  slicer_filament: null,
+  slicer_filament_name: null,
+  nozzle_temp_min: null,
+  nozzle_temp_max: null,
+  note: null,
+  added_full: null,
+  last_used: null,
+  encode_time: null,
+  tag_uid: null,
+  tray_uuid: null,
+  data_origin: 'manual',
+  tag_type: null,
+  archived_at: null,
+  created_at: '2025-01-01T00:00:00Z',
+  updated_at: '2025-01-01T00:00:00Z',
+  k_profiles: [],
+  cost_per_kg: null,
+  last_scale_weight: null,
+  last_weighed_at: null,
+  weight_locked: false,
+  category: 'Active',
+  low_stock_threshold_pct: null,
+  ...over,
+});
+
+const spools = [spool(1), spool(2)];
+
+const listItem = (over: Partial<ShoppingListItem> = {}): ShoppingListItem => ({
+  id: 61,
+  material: 'PLA',
+  subtype: 'Matte',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  quantity_spools: 3,
+  note: 'cheap batch',
+  status: 'purchased',
+  purchased_at: null,
+  added_at: '2025-01-01T00:00:00Z',
+  ...over,
+});
+
+async function openShoppingList(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByRole('button', { name: /Shopping List/ }));
+  return screen.findByText('Clear all');
+}
+
+describe('ForecastPanel wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSettings.mockResolvedValue({ forecast_global_lead_time_days: 0 });
+    mocked.getUiSettings.mockResolvedValue({ forecast_global_lead_time_days: 0 });
+    mocked.getAuthStatus.mockResolvedValue({ auth_enabled: false, requires_setup: false });
+    mocked.getSkuSettings.mockResolvedValue([]);
+    mocked.getAllUsageHistory.mockResolvedValue([]);
+    mocked.getShoppingList.mockResolvedValue([listItem()]);
+    mocked.addToShoppingList.mockResolvedValue({});
+    mocked.removeFromShoppingList.mockResolvedValue({ status: 'ok' });
+    mocked.clearShoppingList.mockResolvedValue({ deleted: 1 });
+    mocked.updateShoppingListStatus.mockResolvedValue({});
+    mocked.bulkCreateSpools.mockResolvedValue([]);
+    mocked.upsertSkuSettings.mockResolvedValue({});
+    mocked.updateSettings.mockResolvedValue({});
+  });
+
+  it('marking a purchased item received creates quantity_spools spools from the item, then removes it', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    await user.click(screen.getByTitle(/Mark as received/));
+
+    await waitFor(() => expect(mocked.bulkCreateSpools).toHaveBeenCalledTimes(1));
+    expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(61, 'received');
+    const [base, qty] = mocked.bulkCreateSpools.mock.calls[0];
+    expect(qty).toBe(3);
+    expect(base).toMatchObject({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      note: 'cheap batch',
+      // average label weight of the SKU's existing spools
+      label_weight: 750,
+      weight_used: 0,
+      category: 'Stock',
+      data_origin: 'manual',
+    });
+    await waitFor(() => expect(mocked.removeFromShoppingList).toHaveBeenCalledWith(61));
+  });
+
+  it('marking a pending item purchased only updates its status (no spools created)', async () => {
+    mocked.getShoppingList.mockResolvedValue([listItem({ id: 62, status: 'pending' })]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    await user.click(screen.getByTitle('Mark as purchased'));
+
+    await waitFor(() => expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(62, 'purchased'));
+    expect(mocked.bulkCreateSpools).not.toHaveBeenCalled();
+    expect(mocked.removeFromShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('reset to pending sends status pending for that item', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByTitle('Reset to pending'));
+    await waitFor(() => expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(61, 'pending'));
+    expect(mocked.bulkCreateSpools).not.toHaveBeenCalled();
+  });
+
+  it('remove deletes exactly that item id', async () => {
+    mocked.getShoppingList.mockResolvedValue([
+      listItem({ id: 70, color_name: 'Red' }),
+      listItem({ id: 71, brand: 'Sunlu', color_name: 'Blue' }),
+    ]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    const row = screen.getByText('Sunlu PLA Matte Blue').closest('tr') as HTMLElement;
+    await user.click(within(row).getByTitle('Remove'));
+
+    await waitFor(() => expect(mocked.removeFromShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.removeFromShoppingList).toHaveBeenCalledWith(71);
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+  });
+
+  // BUG: "Clear all" wipes the whole shopping list on a single click
+  // (ForecastPanel.tsx ShoppingListPanel onClear -> api.clearShoppingList with
+  // no ConfirmModal). Every other bulk-destructive inventory action confirms.
+  it.skip('clear all asks for confirmation before deleting the shopping list', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByText('Clear all'));
+    // Nothing may be sent before the user confirms.
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('clear all sends clearShoppingList (current behaviour, no confirm)', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByText('Clear all'));
+    await waitFor(() => expect(mocked.clearShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.removeFromShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('add to shopping list sends the SKU from the row with the entered quantity and note', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+
+    await user.click(await screen.findByTitle('Add to shopping list'));
+    const qty = await screen.findByRole('spinbutton');
+    await user.clear(qty);
+    await user.type(qty, '4');
+    await user.type(screen.getByPlaceholderText(/./), 'for project X');
+    await user.click(screen.getByRole('button', { name: 'Add 4 spools' }));
+
+    await waitFor(() => expect(mocked.addToShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.addToShoppingList).toHaveBeenCalledWith({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      quantity_spools: 4,
+      note: 'for project X',
+    });
+  });
+
+  it('cancelling the add-to-list dialog sends nothing', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await user.click(await screen.findByTitle('Add to shopping list'));
+    await screen.findByText('Add to Shopping List');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Add to Shopping List')).not.toBeInTheDocument());
+    expect(mocked.addToShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('SKU lead-time override save upserts the SKU settings with the new lead time', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    mocked.getSkuSettings.mockResolvedValue([
+      {
+        id: 5, material: 'PLA', subtype: 'Matte', brand: 'Polymaker', color_name: 'Red',
+        lead_time_days: 3, safety_margin_value: 20, safety_margin_unit: 'g', alerts_snoozed: false,
+      },
+    ]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+
+    // Expand the SKU row.
+    await user.click(await screen.findByText('Polymaker PLA Matte Red'));
+    const box = (await screen.findByText('Lead Time Override')).closest('div.rounded-lg') as HTMLElement;
+    await user.click(within(box).getByRole('button'));
+    const input = within(box).getByRole('spinbutton');
+    await user.clear(input);
+    await user.type(input, '12');
+    await user.click(within(box).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mocked.upsertSkuSettings).toHaveBeenCalledTimes(1));
+    expect(mocked.upsertSkuSettings.mock.calls[0][0]).toEqual({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      lead_time_days: 12,
+      safety_margin_value: 20,
+      safety_margin_unit: 'g',
+      alerts_snoozed: false,
+    });
+  });
+
+  it('SKU lead-time edit cancelled sends nothing', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await user.click(await screen.findByText('Polymaker PLA Matte Red'));
+    const box = (await screen.findByText('Lead Time Override')).closest('div.rounded-lg') as HTMLElement;
+    await user.click(within(box).getByRole('button'));
+    await user.type(within(box).getByRole('spinbutton'), '9');
+    await user.click(within(box).getByRole('button', { name: 'Cancel' }));
+    expect(mocked.upsertSkuSettings).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/GitHubBackupSettingsWiring.test.tsx

@@ -0,0 +1,237 @@
+/**
+ * Backup settings wiring: local backup restore/delete target the clicked
+ * file and only after the confirm, "Backup Now"/"Run Now" hit their run
+ * endpoints, the connection test uses the stored token unless a new one is
+ * typed, and Clear empties the backup history.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { api, setAuthToken } from '../../api/client';
+import { GitHubBackupSettings } from '../../components/GitHubBackupSettings';
+
+type Captured = { method: string; path: string; search: string };
+let captured: Captured[];
+
+const CONFIG = {
+  id: 1,
+  provider: 'github',
+  repository_url: 'https://github.com/test/backup-repo',
+  has_token: true,
+  branch: 'main',
+  enabled: true,
+  schedule_enabled: false,
+  schedule_type: 'daily',
+  schedule_time: '02:00',
+  backup_kprofiles: true,
+  backup_cloud_profiles: false,
+  backup_spools: true,
+  backup_archives: true,
+  backup_settings: true,
+  allow_insecure_http: false,
+  last_backup_at: null,
+  last_backup_status: null,
+};
+
+const BACKUPS = [
+  { filename: 'bambuddy-backup-2026-10-01.zip', size: 1048576, created_at: '2026-10-01T03:00:00Z' },
+  { filename: 'bambuddy backup #2.zip', size: 2097152, created_at: '2026-10-02T03:00:00Z' },
+];
+
+function record(request: Request) {
+  const url = new URL(request.url);
+  captured.push({ method: request.method, path: url.pathname, search: url.search });
+}
+
+const writes = () => captured.filter((c) => c.method !== 'GET');
+
+function fileRow(filename: string): HTMLElement {
+  return screen.getByText(filename).closest('div.flex.items-center.justify-between') as HTMLElement;
+}
+
+beforeEach(() => {
+  captured = [];
+  server.use(
+    http.get('*/api/v1/github-backup/config', () => HttpResponse.json(CONFIG)),
+    http.get('*/api/v1/github-backup/status', () =>
+      HttpResponse.json({
+        configured: true,
+        enabled: true,
+        is_running: false,
+        restore_running: false,
+        progress: null,
+        last_backup_at: null,
+        last_backup_status: null,
+        next_run: null,
+      }),
+    ),
+    http.get('*/api/v1/github-backup/logs', () =>
+      HttpResponse.json([
+        {
+          id: 1, config_id: 1, started_at: '2026-10-01T09:00:00', completed_at: '2026-10-01T09:00:05',
+          status: 'success', trigger: 'manual', commit_sha: null, files_changed: 1, error_message: null,
+        },
+      ]),
+    ),
+    http.get('*/api/v1/local-backup/status', () =>
+      HttpResponse.json({
+        enabled: true, is_running: false, last_backup_at: null, last_status: null,
+        last_message: null, next_run: null, path: '/data/backups',
+      }),
+    ),
+    http.get('*/api/v1/local-backup/path-check', () => HttpResponse.json({ writable: true, path: '/data/backups', code: 'ok' })),
+    http.get('*/api/v1/local-backup/backups', () => HttpResponse.json(BACKUPS)),
+    http.post('*/api/v1/local-backup/backups/:name/restore', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'restored' });
+    }),
+    http.delete('*/api/v1/local-backup/backups/:name', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'deleted' });
+    }),
+    http.post('*/api/v1/local-backup/run', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'ok', filename: 'x.zip' });
+    }),
+    http.post('*/api/v1/github-backup/run', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'ok', files_changed: 0 });
+    }),
+    http.delete('*/api/v1/github-backup/logs', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ deleted: 1, message: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  setAuthToken(null);
+});
+
+describe('GitHubBackupSettings wiring', () => {
+  it('restore of a local backup asks first, then POSTs restore for the clicked file (URL-encoded)', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy backup #2.zip');
+    await user.click(within(fileRow('bambuddy backup #2.zip')).getByTitle('Restore'));
+    expect(writes()).toHaveLength(0);
+    await user.click(screen.getByRole('button', { name: /^restore backup$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'POST',
+      path: '/api/v1/local-backup/backups/bambuddy%20backup%20%232.zip/restore',
+    });
+  });
+
+  it('cancelling the restore confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Restore'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: /^restore backup$/i })).not.toBeInTheDocument());
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('delete of a local backup asks first, then DELETEs the clicked file; cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Delete'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Delete'));
+    // The confirm modal's button (the row button has a title, the modal's does not)
+    const confirm = screen.getAllByRole('button', { name: /^delete$/i }).find((b) => !b.hasAttribute('title'));
+    await user.click(confirm as HTMLElement);
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'DELETE',
+      path: '/api/v1/local-backup/backups/bambuddy-backup-2026-10-01.zip',
+    });
+  });
+
+  it('Run Now triggers the local backup', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /run now/i }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/local-backup/run' });
+  });
+
+  it('Backup Now triggers the Git backup', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /backup now/i }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/github-backup/run' });
+  });
+
+  it('Test with the token field blank uses the stored token', async () => {
+    const stored = vi.spyOn(api, 'testGitHubStoredConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const typed = vi.spyOn(api, 'testGitHubConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /^test$/i }));
+    await waitFor(() => expect(stored).toHaveBeenCalledTimes(1));
+    expect(typed).not.toHaveBeenCalled();
+  });
+
+  it('Test with a newly typed token tests those credentials, not the stored ones', async () => {
+    const stored = vi.spyOn(api, 'testGitHubStoredConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const typed = vi.spyOn(api, 'testGitHubConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.type(await screen.findByPlaceholderText(/enter new token to update/i), 'test-token-value-1');
+    await user.click(screen.getByRole('button', { name: /^test$/i }));
+
+    await waitFor(() => expect(typed).toHaveBeenCalledTimes(1));
+    expect(typed).toHaveBeenCalledWith('https://github.com/test/backup-repo', 'test-token-value-1', 'github');
+    expect(stored).not.toHaveBeenCalled();
+  });
+
+  it('Clear in the backup history deletes all logs (keep_last=0)', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    const history = (await screen.findByText('History')).closest('div[id="card-backup-history"]') as HTMLElement;
+    await user.click(within(history).getByRole('button', { name: /^clear$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/github-backup/logs', search: '?keep_last=0' });
+  });
+
+  it('a non-admin gets no Restore (or Download) button on local backups', async () => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: 2, username: 'operator', is_admin: false, permissions: ['settings:read', 'settings:update'] }),
+      ),
+    );
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    // Wait for the auth state to settle (admin is assumed while auth status loads)
+    await waitFor(() =>
+      expect(within(fileRow('bambuddy-backup-2026-10-01.zip')).queryByTitle('Restore')).not.toBeInTheDocument(),
+    );
+    expect(within(fileRow('bambuddy-backup-2026-10-01.zip')).queryByTitle('Download')).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/components/HMSErrorModalWiring.test.tsx

@@ -0,0 +1,147 @@
+/**
+ * HMSErrorModal wiring: the requests behind "Clear Errors" and the per-fault
+ * action buttons (Resume / Retry / Ignore ...).
+ *
+ * HMSErrorModal.test.tsx covers rendering and the clear button's visibility;
+ * this pins what is actually sent and to which printer.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+import { render } from '../utils';
+import { HMSErrorModal } from '../../components/HMSErrorModal';
+import type { HMSError } from '../../api/client';
+
+const PRINTER_ID = 42;
+
+// A 16-char hms[] fault with actions and a job id.
+const actionable: HMSError = {
+  attr: 0x07000700,
+  code: '0x20009',
+  module: 7,
+  severity: 2,
+  full_code: '0700070000020009',
+  description: 'AMS filament ran out.',
+  actions: ['IGNORE_RESUME', 'RETRY_PROBLEM_SOLVED'],
+  job_id: 'job-777',
+};
+
+// A print_error-style fault without full_code: the 8-char short code is sent.
+const shortOnly: HMSError = {
+  attr: 0x0300,
+  code: '0x400C',
+  module: 3,
+  severity: 1,
+  description: 'The task was canceled.',
+  actions: ['DBL_CHECK_RETRY'],
+};
+
+type Captured = { url: string; body: unknown };
+
+function capture() {
+  const clears: string[] = [];
+  const actions: Captured[] = [];
+  server.use(
+    http.post('/api/v1/printers/:id/hms/clear', ({ params }) => {
+      clears.push(params.id as string);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+    http.post('/api/v1/printers/:id/hms/execute-action', async ({ request, params }) => {
+      actions.push({ url: params.id as string, body: await request.json() });
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+  );
+  return { clears, actions };
+}
+
+const allow = (granted: boolean) =>
+  vi.fn().mockReturnValue(granted) as unknown as (permission: 'printers:control') => boolean;
+
+function renderModal(errors: HMSError[], granted = true) {
+  const onClose = vi.fn();
+  const hasPermission = allow(granted);
+  render(
+    <HMSErrorModal
+      printerName="Shop H2D"
+      printerId={PRINTER_ID}
+      errors={errors}
+      onClose={onClose}
+      hasPermission={hasPermission}
+    />,
+  );
+  return { onClose, hasPermission };
+}
+
+describe('HMSErrorModal wiring', () => {
+  it('Clear Errors posts hms/clear for this printer only', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { onClose } = renderModal([actionable]);
+
+    await user.click(screen.getByRole('button', { name: 'Clear Errors' }));
+
+    await waitFor(() => expect(clears).toEqual([String(PRINTER_ID)]));
+    expect(actions).toEqual([]);
+    await waitFor(() => expect(onClose).toHaveBeenCalledTimes(1));
+  });
+
+  it('an action button sends the action, the full code and the job id', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { onClose } = renderModal([actionable]);
+
+    await user.click(screen.getByRole('button', { name: 'Ignore this and Resume' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect(actions[0]).toEqual({
+      url: String(PRINTER_ID),
+      body: { action: 'IGNORE_RESUME', print_error: '0700070000020009', job_id: 'job-777' },
+    });
+    expect(clears).toEqual([]);
+    await waitFor(() => expect(onClose).toHaveBeenCalledTimes(1));
+  });
+
+  it('falls back to the 8-char short code and a null job id', async () => {
+    const user = userEvent.setup();
+    const { actions } = capture();
+    renderModal([shortOnly]);
+
+    await user.click(screen.getByRole('button', { name: 'Retry' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect(actions[0].body).toEqual({ action: 'DBL_CHECK_RETRY', print_error: '0300400C', job_id: null });
+  });
+
+  it('sends the action of the fault whose button was clicked', async () => {
+    const user = userEvent.setup();
+    const { actions } = capture();
+    renderModal([actionable]);
+
+    // Two buttons on the same fault: Retry, not Ignore.
+    await user.click(screen.getByRole('button', { name: 'Retry (problem solved)' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect((actions[0].body as { action: string }).action).toBe('RETRY_PROBLEM_SOLVED');
+  });
+
+  it('without printers:control, action and clear buttons are disabled and send nothing', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { hasPermission } = renderModal([actionable], false);
+
+    const ignore = screen.getByRole('button', { name: 'Ignore this and Resume' });
+    const clear = screen.getByRole('button', { name: 'Clear Errors' });
+    expect(ignore).toBeDisabled();
+    expect(clear).toBeDisabled();
+    expect(hasPermission).toHaveBeenCalledWith('printers:control');
+
+    await user.click(ignore);
+    await user.click(clear);
+    // Give any stray request a chance to land.
+    await new Promise((r) => setTimeout(r, 20));
+    expect(actions).toEqual([]);
+    expect(clears).toEqual([]);
+  });
+});

frontend/src/__tests__/components/KProfilesViewWiring.test.tsx

@@ -0,0 +1,385 @@
+/**
+ * KProfilesView wiring: what goes to the printer when a K-profile is added
+ * (single extruder / both extruders), edited, deleted (single and bulk) or
+ * imported, and which controls the kprofiles:* permissions disable.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { KProfilesView } from '../../components/KProfilesView';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+const PROFILES = [
+  { slot_id: 3, extruder_id: 0, nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', filament_id: 'GFA00', name: 'S Bambu PLA Basic', k_value: '0.020000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: 'PFUS-row-3' },
+  { slot_id: 5, extruder_id: 0, nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', filament_id: 'GFG99', name: 'HF Generic PETG', k_value: '0.035000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: null },
+  { slot_id: 7, extruder_id: 0, nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', filament_id: 'GFB99', name: 'S Zeta ABS', k_value: '0.040000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: null },
+];
+
+let sent: Sent[];
+let nozzleCount = 1;
+let detailFetched: string[];
+
+async function record(request: Request) {
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET' && !s.path.endsWith('/notes'));
+
+beforeEach(() => {
+  sent = [];
+  detailFetched = [];
+  nozzleCount = 1;
+  localStorage.removeItem('bambusy_kprofiles_nozzle');
+  server.use(
+    http.get('*/api/v1/printers/', () =>
+      HttpResponse.json([
+        { id: 1, name: 'Wiring X1C', model: 'X1C', is_active: true, nozzle_count: nozzleCount, supports_nozzle_flow_type: true },
+      ]),
+    ),
+    http.get('*/api/v1/printers/:id/kprofiles/', () => HttpResponse.json({ profiles: PROFILES, nozzle_diameter: '0.4' })),
+    http.get('*/api/v1/printers/:id/kprofiles/notes', () => HttpResponse.json({ notes: {} })),
+    http.get('*/api/v1/cloud/builtin-filaments', () =>
+      HttpResponse.json([{ filament_id: 'GFA00', name: 'Bambu PLA Basic' }]),
+    ),
+    http.get('*/api/v1/cloud/filament-id-map', () => HttpResponse.json({})),
+    http.get('*/api/v1/local-presets/', () => HttpResponse.json({ filament: [], printer: [], process: [] })),
+    http.get('*/api/v1/orca-cloud/profiles', () => HttpResponse.json({ filament: [], printer: [], process: [] })),
+    http.get('*/api/v1/cloud/settings', () =>
+      HttpResponse.json({
+        filament: [
+          { setting_id: 'PFUS-test-1', name: 'My Custom PLA @BBL X1C', type: 'filament', version: null, user_id: 'u1', updated_time: null, is_custom: true },
+          { setting_id: 'PFUS-test-2', name: 'Mystery PLA @BBL X1C', type: 'filament', version: null, user_id: 'u1', updated_time: null, is_custom: true },
+        ],
+        printer: [],
+        process: [],
+      }),
+    ),
+    http.get('*/api/v1/cloud/settings/:id', ({ params }) => {
+      detailFetched.push(String(params.id));
+      return HttpResponse.json(params.id === 'PFUS-test-1' ? { filament_id: 'P0000001' } : {});
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/batch', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.delete('*/api/v1/printers/:id/kprofiles/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/notes', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  vi.restoreAllMocks();
+});
+
+async function renderLoaded() {
+  const user = userEvent.setup();
+  render(<KProfilesView />);
+  await screen.findByText('S Bambu PLA Basic');
+  return user;
+}
+
+/** The edit modal's delete (trash) button sits right before its Cancel. */
+function modalTrash(): HTMLElement {
+  return screen.getByRole('button', { name: 'Cancel' }).previousElementSibling as HTMLElement;
+}
+
+function kInput(): HTMLInputElement {
+  return screen.getByText('K-Value').parentElement!.querySelector('input') as HTMLInputElement;
+}
+
+describe('KProfilesView wiring: add', () => {
+  it('a Bambu Cloud user preset is resolved via its detail and sent as one profile', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await screen.findByText('Add K-Profile');
+
+    await user.click(await screen.findByRole('button', { name: 'My Custom PLA' }));
+    const k = kInput();
+    await user.clear(k);
+    await user.type(k, '0.0251');
+    await user.tab();
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(detailFetched).toEqual(['PFUS-test-1']);
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        name: 'S My Custom PLA',
+        k_value: '0.025000',
+        filament_id: 'P0000001',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        extruder_id: 0,
+        slot_id: 0,
+      },
+    });
+  });
+
+  it('a preset with no resolvable filament id shows an error and sends nothing', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Mystery PLA' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    expect(await screen.findByText(/No Bambu filament ID for Mystery PLA/)).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+
+  it('on a dual-nozzle printer both extruders go out in one batch request', async () => {
+    nozzleCount = 2;
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Bambu PLA Basic' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('POST');
+    expect(req.path).toBe('/api/v1/printers/1/kprofiles/batch');
+    const body = req.body as Array<Record<string, unknown>>;
+    expect(body).toHaveLength(2);
+    expect(body.map((p) => p.extruder_id).sort()).toEqual([0, 1]);
+    for (const p of body) {
+      expect(p).toMatchObject({
+        name: 'S Bambu PLA Basic',
+        k_value: '0.020000',
+        filament_id: 'GFA00',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        slot_id: 0,
+      });
+    }
+  });
+
+  it('on a dual-nozzle printer with one extruder unticked, a single profile for the other is sent', async () => {
+    nozzleCount = 2;
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Bambu PLA Basic' }));
+    await user.click(screen.getByRole('checkbox', { name: 'Left' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].path).toBe('/api/v1/printers/1/kprofiles/');
+    expect(writes()[0].body).toMatchObject({ extruder_id: 0, filament_id: 'GFA00', slot_id: 0 });
+  });
+});
+
+describe('KProfilesView wiring: edit and delete one profile', () => {
+  it('edit keeps the row\'s slot_id, setting_id, extruder and nozzle', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+
+    const k = kInput();
+    await user.clear(k);
+    await user.type(k, '0.031');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        name: 'S Bambu PLA Basic',
+        k_value: '0.031000',
+        filament_id: 'GFA00',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        extruder_id: 0,
+        setting_id: 'PFUS-row-3',
+        slot_id: 3,
+      },
+    });
+  });
+
+  async function openDeleteConfirm(user: ReturnType<typeof userEvent.setup>) {
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    const cancel = screen.getByRole('button', { name: 'Cancel' });
+    await user.click(cancel.previousElementSibling as HTMLElement);
+    await screen.findByText('Delete Profile');
+  }
+
+  it('delete sends the identity of exactly that row', async () => {
+    const user = await renderLoaded();
+    await openDeleteConfirm(user);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'DELETE',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        slot_id: 3,
+        extruder_id: 0,
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        filament_id: 'GFA00',
+        setting_id: 'PFUS-row-3',
+      },
+    });
+  });
+
+  it('cancelling the delete confirm sends nothing', async () => {
+    const user = await renderLoaded();
+    await openDeleteConfirm(user);
+    await user.click(screen.getAllByRole('button', { name: 'Cancel' }).at(-1)!);
+
+    await waitFor(() => expect(screen.queryByText('Delete Profile')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('KProfilesView wiring: bulk delete', () => {
+  async function selectTwo(user: ReturnType<typeof userEvent.setup>) {
+    await user.click(screen.getByRole('button', { name: 'Select' }));
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await user.click(screen.getByText('S Zeta ABS'));
+    await user.click(screen.getByRole('button', { name: /Delete \(2\)/ }));
+    await screen.findByText('Delete Profiles');
+  }
+
+  it('deletes only the selected rows, each with its own identity', async () => {
+    const user = await renderLoaded();
+    await selectTwo(user);
+    const dialog = screen.getByText('Delete Profiles').closest('.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(2), { timeout: 3000 });
+    const bodies = writes().map((w) => {
+      expect(w.method).toBe('DELETE');
+      expect(w.path).toBe('/api/v1/printers/1/kprofiles/');
+      return w.body as Record<string, unknown>;
+    });
+    expect(bodies.map((b) => b.slot_id).sort()).toEqual([3, 7]);
+    expect(bodies.find((b) => b.slot_id === 7)).toEqual({
+      slot_id: 7,
+      extruder_id: 0,
+      nozzle_id: 'HS00-0.4',
+      nozzle_diameter: '0.4',
+      filament_id: 'GFB99',
+      setting_id: null,
+    });
+  });
+
+  it('cancelling the bulk confirm sends nothing', async () => {
+    const user = await renderLoaded();
+    await selectTwo(user);
+    const dialog = screen.getByText('Delete Profiles').closest('.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete Profiles')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('KProfilesView wiring: import', () => {
+  it('sends one new profile per complete row and skips rows missing name/k_value/filament_id', async () => {
+    let fileInput: HTMLInputElement | null = null;
+    const realCreate = document.createElement.bind(document);
+    vi.spyOn(document, 'createElement').mockImplementation(((tag: string, options?: ElementCreationOptions) => {
+      const el = realCreate(tag, options);
+      if (tag === 'input') {
+        fileInput = el as HTMLInputElement;
+        vi.spyOn(el, 'click').mockImplementation(() => undefined);
+      }
+      return el;
+    }) as typeof document.createElement);
+
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Import' }));
+    expect(fileInput).not.toBeNull();
+
+    const data = {
+      version: 1,
+      profiles: [
+        { name: 'Imported A', k_value: '0.02', filament_id: 'GFA00', nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', extruder_id: 0 },
+        { name: 'No filament', k_value: '0.03' },
+        { name: 'Imported B', k_value: '0.045', filament_id: 'GFB99' },
+      ],
+    };
+    // jsdom's File has no text(); the handler only calls that.
+    const file = { name: 'kprofiles.json', text: async () => JSON.stringify(data) };
+    const input = fileInput as unknown as HTMLInputElement;
+    Object.defineProperty(input, 'files', { value: [file] });
+    await (input.onchange as unknown as (e: { target: HTMLInputElement }) => Promise<void>)({ target: input });
+
+    await waitFor(() => expect(writes()).toHaveLength(2), { timeout: 3000 });
+    expect(writes().map((w) => w.body)).toEqual([
+      { name: 'Imported A', k_value: '0.020000', filament_id: 'GFA00', nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', extruder_id: 0, slot_id: 0 },
+      { name: 'Imported B', k_value: '0.045000', filament_id: 'GFB99', nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', extruder_id: 0, slot_id: 0 },
+    ]);
+  });
+});
+
+describe('KProfilesView wiring: permissions', () => {
+  function signInWith(permissions: string[]) {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions,
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+  }
+
+  it('read-only: add, import, select, save and delete are disabled', async () => {
+    signInWith(['kprofiles:read']);
+    const user = await renderLoaded();
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Add Profile' })).toBeDisabled());
+    expect(screen.getByRole('button', { name: 'Import' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Select' })).toBeDisabled();
+
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled();
+    expect(modalTrash()).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('kprofiles:update enables Save on an edit but not delete or add', async () => {
+    signInWith(['kprofiles:read', 'kprofiles:update']);
+    const user = await renderLoaded();
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Add Profile' })).toBeDisabled());
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    expect(screen.getByRole('button', { name: 'Save' })).not.toBeDisabled();
+    expect(modalTrash()).toBeDisabled();
+  });
+});

frontend/src/__tests__/components/LDAPSettingsWiring.test.tsx

@@ -0,0 +1,169 @@
+/**
+ * LDAP settings: the save request carries every ldap_* field including the
+ * group mapping and default group, the bind password only when it was typed,
+ * and the enable toggle / test button hit the right endpoints.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { LDAPSettings } from '../../components/LDAPSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+
+let captured: Captured[];
+let ldapStatus: { ldap_enabled: boolean; ldap_configured: boolean };
+
+const STORED = {
+  ldap_enabled: false,
+  ldap_server_url: 'ldaps://ldap.example:636',
+  ldap_bind_dn: 'cn=svc,dc=example',
+  ldap_bind_password: '',
+  ldap_search_base: 'dc=example',
+  ldap_user_filter: '(uid={username})',
+  ldap_security: 'ldaps',
+  ldap_group_mapping: '',
+  ldap_auto_provision: false,
+  ldap_default_group: '',
+};
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  ldapStatus = { ldap_enabled: false, ldap_configured: true };
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+    http.get('*/api/v1/settings/', () => HttpResponse.json(STORED)),
+    http.get('*/api/v1/auth/ldap/status', () => HttpResponse.json(ldapStatus)),
+    http.get('*/api/v1/groups/', () =>
+      HttpResponse.json([
+        { id: 1, name: 'Administrators' },
+        { id: 2, name: 'Operators' },
+      ]),
+    ),
+    http.put('*/api/v1/settings/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(STORED);
+    }),
+    http.post('*/api/v1/auth/ldap/test', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ success: true, message: 'Connected' });
+    }),
+  );
+});
+
+describe('LDAPSettings wiring', () => {
+  it('save sends all ldap_* fields with group mapping/default group and no bind password when untouched', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    const base = await screen.findByDisplayValue('dc=example');
+    await user.clear(base);
+    await user.type(base, 'ou=people,dc=example');
+
+    await user.click(screen.getByRole('button', { name: /advanced/i }));
+    await user.click(screen.getByPlaceholderText(/PrintFarm_Admins/));
+    await user.paste('{"cn=farm,dc=example":"Operators"}');
+    await user.selectOptions(screen.getByRole('combobox'), 'Operators');
+
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].method).toBe('PUT');
+    expect(captured[0].path).toBe('/api/v1/settings/');
+    expect(captured[0].body).toEqual({
+      ldap_server_url: 'ldaps://ldap.example:636',
+      ldap_bind_dn: 'cn=svc,dc=example',
+      ldap_search_base: 'ou=people,dc=example',
+      ldap_user_filter: '(uid={username})',
+      ldap_security: 'ldaps',
+      ldap_group_mapping: '{"cn=farm,dc=example":"Operators"}',
+      ldap_auto_provision: false,
+      ldap_default_group: 'Operators',
+    });
+    expect(captured[0].body).not.toHaveProperty('ldap_bind_password');
+  });
+
+  it('a typed bind password is sent with the save', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({ ldap_bind_password: 'test-password-1' });
+  });
+
+  it('save without a server URL sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await user.clear(await screen.findByDisplayValue('ldaps://ldap.example:636'));
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    expect(await screen.findByText(/ldap server url is required/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('test connection posts to /auth/ldap/test (tests the saved config, no body)', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await user.click(screen.getByRole('button', { name: /test connection/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({ method: 'POST', path: '/api/v1/auth/ldap/test', body: null });
+  });
+
+  it('enable sends only {ldap_enabled:true}', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(captured).toHaveLength(1);
+    });
+    expect(captured[0]).toEqual({ method: 'PUT', path: '/api/v1/settings/', body: { ldap_enabled: true } });
+  });
+
+  it('disable sends {ldap_enabled:false} when LDAP is on', async () => {
+    ldapStatus = { ldap_enabled: true, ldap_configured: true };
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByText(/ldap authentication is enabled/i);
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^disable$/i }));
+      expect(captured).toHaveLength(1);
+    });
+    expect(captured[0].body).toEqual({ ldap_enabled: false });
+  });
+
+  it('enable sends nothing until LDAP settings are saved', async () => {
+    ldapStatus = { ldap_enabled: false, ldap_configured: false };
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(screen.getAllByText(/save ldap settings first/i).length).toBeGreaterThan(0);
+    });
+    expect(captured).toHaveLength(0);
+  });
+});

frontend/src/__tests__/components/OIDCProviderSettingsWiring.test.tsx

@@ -0,0 +1,167 @@
+/**
+ * OIDC provider list: edit, delete, enable toggle and icon actions send
+ * their request for the provider that was clicked, the edit leaves the
+ * stored client secret alone unless one is typed, and cancelling the delete
+ * confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { OIDCProviderSettings } from '../../components/OIDCProviderSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+let captured: Captured[];
+
+function provider(id: number, name: string, extra: Record<string, unknown> = {}) {
+  return {
+    id,
+    name,
+    issuer_url: `https://${name.toLowerCase()}.idp.example`,
+    client_id: `${name.toLowerCase()}-client`,
+    scopes: 'openid email profile',
+    is_enabled: true,
+    auto_create_users: false,
+    auto_link_existing_accounts: false,
+    email_claim: 'email',
+    require_email_verified: true,
+    group_claim: 'groups',
+    group_mapping: {},
+    icon_url: `https://${name.toLowerCase()}.idp.example/icon.png`,
+    has_icon: true,
+    default_group_id: null,
+    is_autologin: false,
+    is_env_managed: false,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+    ...extra,
+  };
+}
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  server.use(
+    http.get('*/api/v1/auth/oidc/providers/all', () =>
+      HttpResponse.json([provider(7, 'Alpha'), provider(9, 'Beta')]),
+    ),
+    http.get('*/api/v1/groups/', () => HttpResponse.json([])),
+    http.put('*/api/v1/auth/oidc/providers/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(provider(9, 'Beta'));
+    }),
+    http.delete('*/api/v1/auth/oidc/providers/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'deleted' });
+    }),
+    http.delete('*/api/v1/auth/oidc/providers/:id/icon', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.post('*/api/v1/auth/oidc/providers/:id/icon/refresh', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(provider(9, 'Beta'));
+    }),
+  );
+});
+
+describe('OIDCProviderSettings wiring', () => {
+  it('editing a provider PUTs to its id without client_secret when the secret is left blank', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('edit-provider-9'));
+    const scopes = screen.getByDisplayValue('openid email profile');
+    await user.clear(scopes);
+    await user.type(scopes, 'openid email');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].method).toBe('PUT');
+    expect(captured[0].path).toBe('/api/v1/auth/oidc/providers/9');
+    expect(captured[0].body).toMatchObject({
+      name: 'Beta',
+      issuer_url: 'https://beta.idp.example',
+      client_id: 'beta-client',
+      scopes: 'openid email',
+    });
+    expect(captured[0].body).not.toHaveProperty('client_secret');
+  });
+
+  it('a typed client secret is sent with the edit', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('edit-provider-9'));
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-secret-1');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({ client_secret: 'test-secret-1' });
+  });
+
+  it('delete asks first, then DELETEs the clicked provider', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    // Second row, so a delete of "the first provider" would not pass
+    await user.click(await screen.findByTestId('delete-provider-9'));
+    expect(captured).toHaveLength(0);
+    await user.click(screen.getByRole('button', { name: /^delete$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/auth/oidc/providers/9' });
+  });
+
+  it('cancelling the delete confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('delete-provider-7'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: /^delete$/i })).not.toBeInTheDocument());
+    expect(captured).toHaveLength(0);
+  });
+
+  it('refresh icon and remove icon call the clicked provider id', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('refresh-icon-9'));
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/oidc/providers/9/icon/refresh' });
+
+    await user.click(screen.getByTestId('remove-icon-7'));
+    await waitFor(() => expect(captured).toHaveLength(2));
+    expect(captured[1]).toMatchObject({ method: 'DELETE', path: '/api/v1/auth/oidc/providers/7/icon' });
+  });
+
+  it('the enable toggle sends only {is_enabled:false} for that provider', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await screen.findByTestId('edit-provider-9');
+    // One toggle per provider, in list order
+    const toggles = screen.getAllByRole('switch');
+    await user.click(toggles[1]);
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({
+      method: 'PUT',
+      path: '/api/v1/auth/oidc/providers/9',
+      body: { is_enabled: false },
+    });
+  });
+});

frontend/src/__tests__/components/PendingUploadsPanelWiring.test.tsx

@@ -0,0 +1,199 @@
+/**
+ * Wiring tests for PendingUploadsPanel: pin the requests sent for archive
+ * (with tags/notes/project), discard, archive-all and discard-all, and that
+ * cancelling a destructive confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { PendingUploadsPanel } from '../../components/PendingUploadsPanel';
+
+const uploads = [
+  {
+    id: 11,
+    filename: 'first.gcode.3mf',
+    display_name: 'First Upload',
+    file_size: 1000,
+    source_ip: null,
+    status: 'pending',
+    tags: null,
+    notes: null,
+    project_id: null,
+    uploaded_at: '2026-05-01T10:00:00Z',
+  },
+  {
+    id: 22,
+    filename: 'second.gcode.3mf',
+    display_name: 'Second Upload',
+    file_size: 2000,
+    source_ip: null,
+    status: 'pending',
+    tags: null,
+    notes: null,
+    project_id: null,
+    uploaded_at: '2026-05-01T10:00:00Z',
+  },
+];
+
+const projects = [
+  { id: 5, name: 'Gadgets', status: 'active', parent_id: null },
+  { id: 9, name: 'Archived Proj', status: 'archived', parent_id: null },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+beforeEach(() => {
+  calls = [];
+  server.use(
+    http.get('*/api/v1/pending-uploads/', () => HttpResponse.json(uploads)),
+    http.get('*/api/v1/projects/', () => HttpResponse.json(projects)),
+    http.post('*/api/v1/pending-uploads/archive-all', ({ request }) => {
+      calls.push({ method: 'POST', path: new URL(request.url).pathname });
+      return HttpResponse.json({ archived: 2, failed: 0 });
+    }),
+    http.delete('*/api/v1/pending-uploads/discard-all', ({ request }) => {
+      calls.push({ method: 'DELETE', path: new URL(request.url).pathname });
+      return HttpResponse.json({ discarded: 2 });
+    }),
+    http.post('*/api/v1/pending-uploads/:id/archive', async ({ request }) => {
+      calls.push({
+        method: 'POST',
+        path: new URL(request.url).pathname,
+        body: await request.json(),
+      });
+      return HttpResponse.json({ id: 100, print_name: 'First Upload', filename: 'first.gcode.3mf' });
+    }),
+    http.delete('*/api/v1/pending-uploads/:id', ({ request }) => {
+      calls.push({ method: 'DELETE', path: new URL(request.url).pathname });
+      return HttpResponse.json({ success: true });
+    }),
+  );
+});
+
+/** The row card for an upload, found via its display name. */
+async function rowFor(name: string): Promise<HTMLElement> {
+  const label = await screen.findByText(name);
+  // name <p> -> div -> div.flex gap-3 -> div.flex justify-between (row header)
+  const header = label.closest('div.justify-between') as HTMLElement;
+  expect(header).not.toBeNull();
+  return header;
+}
+
+describe('PendingUploadsPanel wiring', () => {
+  it('Archive with tags, notes and a project posts them for that upload id only', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    // Expand toggle is the first (icon-only) button in the row.
+    await user.click(within(row).getAllByRole('button')[0]);
+    const card = row.parentElement as HTMLElement;
+    await user.type(within(card).getByPlaceholderText('e.g., functional, prototype, gift'), 'gift');
+    await user.type(within(card).getByPlaceholderText('Add notes about this print...'), 'for bob');
+    const select = within(card).getByRole('combobox');
+    await waitFor(() => expect(within(select).getByRole('option', { name: 'Gadgets' })).toBeInTheDocument());
+    // Archived projects are not offered as a target.
+    expect(within(select).queryByRole('option', { name: 'Archived Proj' })).toBeNull();
+    await user.selectOptions(select, '5');
+
+    await user.click(within(row).getByRole('button', { name: /Archive/ }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/pending-uploads/22/archive',
+      body: { tags: 'gift', notes: 'for bob', project_id: 5 },
+    });
+  });
+
+  it('Archive without a project omits project_id', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('First Upload');
+
+    await user.click(within(row).getByRole('button', { name: /Archive/ }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0].path).toBe('/api/v1/pending-uploads/11/archive');
+    expect(calls[0].body).toEqual({ tags: '', notes: '' });
+  });
+
+  it('Discard -> confirm sends DELETE for that upload id', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    const buttons = within(row).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]); // trash icon
+    expect(await screen.findByText('Discard Upload')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Discard' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'DELETE', path: '/api/v1/pending-uploads/22' });
+  });
+
+  it('Discard -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    const buttons = within(row).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await screen.findByText('Discard Upload');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Discard Upload')).toBeNull());
+    expect(calls).toHaveLength(0);
+  });
+
+  it('Archive All -> confirm posts archive-all', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Archive All' }));
+    const title = await screen.findByText('Archive All Uploads');
+    const dialog = title.closest('div.flex-1')?.parentElement?.parentElement as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Archive All' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'POST', path: '/api/v1/pending-uploads/archive-all' });
+  });
+
+  it('Discard All -> confirm sends DELETE discard-all', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Discard All' }));
+    const title = await screen.findByText('Discard All Uploads');
+    const dialog = title.closest('div.flex-1')?.parentElement?.parentElement as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Discard All' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'DELETE', path: '/api/v1/pending-uploads/discard-all' });
+  });
+
+  it('Discard All -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Discard All' }));
+    await screen.findByText('Discard All Uploads');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Discard All Uploads')).toBeNull());
+    expect(calls).toHaveLength(0);
+  });
+});

frontend/src/__tests__/components/PurgeArchivesModalWiring.test.tsx

@@ -0,0 +1,153 @@
+/**
+ * Wiring tests for PurgeArchivesModal: pin the requests the destructive
+ * bulk archive purge actually sends (preview query params, execute body),
+ * and that nothing is sent while the confirm button is disabled or when
+ * the modal is cancelled.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { screen, waitFor, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { PurgeArchivesModal } from '../../components/PurgeArchivesModal';
+
+interface PreviewCall {
+  days: string | null;
+  purgeStats: string | null;
+}
+
+let previewCalls: PreviewCall[];
+let executeBodies: Array<Record<string, unknown>>;
+let previewCount: number;
+
+beforeEach(() => {
+  previewCalls = [];
+  executeBodies = [];
+  previewCount = 4;
+  server.use(
+    http.get('*/api/v1/archives/purge/preview', ({ request }) => {
+      const url = new URL(request.url);
+      previewCalls.push({
+        days: url.searchParams.get('older_than_days'),
+        purgeStats: url.searchParams.get('purge_stats'),
+      });
+      return HttpResponse.json({
+        count: previewCount,
+        total_bytes: 1024,
+        sample_filenames: ['old-a.3mf'],
+        older_than_days: Number(url.searchParams.get('older_than_days')),
+      });
+    }),
+    http.post('*/api/v1/archives/purge', async ({ request }) => {
+      executeBodies.push((await request.json()) as Record<string, unknown>);
+      return HttpResponse.json({ deleted: previewCount, purge_stats: false });
+    }),
+  );
+});
+
+describe('PurgeArchivesModal wiring', () => {
+  it('previews with the initial days and executes with the same days value', async () => {
+    const user = userEvent.setup();
+    const onClose = vi.fn();
+    render(<PurgeArchivesModal onClose={onClose} initialDays={90} />);
+
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    expect(previewCalls).toEqual([{ days: '90', purgeStats: 'false' }]);
+
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 90, purge_stats: false });
+    await waitFor(() => expect(onClose).toHaveBeenCalled());
+  });
+
+  it('re-previews after the days input changes and executes with the new value', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={90} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    const input = screen.getByLabelText('Delete archives not printed in the last');
+    fireEvent.change(input, { target: { value: '30' } });
+
+    await waitFor(() =>
+      expect(previewCalls).toContainEqual({ days: '30', purgeStats: 'false' }),
+    );
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    await waitFor(() => expect(confirm).toBeEnabled());
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 30, purge_stats: false });
+  });
+
+  it('sends purge_stats=true on preview and execute when "Also remove from statistics" is ticked', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={120} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    await user.click(screen.getByRole('checkbox'));
+    await waitFor(() =>
+      expect(previewCalls).toContainEqual({ days: '120', purgeStats: 'true' }),
+    );
+
+    await user.click(await screen.findByRole('button', { name: 'Remove 4 archive(s)' }));
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 120, purge_stats: true });
+  });
+
+  it('keeps execute disabled and sends nothing when the preview matches zero archives', async () => {
+    previewCount = 0;
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={90} />);
+
+    const confirm = await screen.findByRole('button', { name: 'Remove 0 archive(s)' });
+    expect(confirm).toBeDisabled();
+    await user.click(confirm);
+    expect(executeBodies).toHaveLength(0);
+  });
+
+  it('Cancel closes the modal without executing the purge', async () => {
+    const user = userEvent.setup();
+    const onClose = vi.fn();
+    render(<PurgeArchivesModal onClose={onClose} initialDays={90} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(executeBodies).toHaveLength(0);
+  });
+
+  it('disables the purge until the preview matches the typed age', async () => {
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={365} />);
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    expect(confirm).toBeEnabled();
+
+    fireEvent.change(screen.getByLabelText('Delete archives not printed in the last'), {
+      target: { value: '1' },
+    });
+
+    expect(confirm).toBeDisabled();
+    await waitFor(() => expect(previewCalls.map((c) => c.days)).toContain('1'));
+  });
+
+  // The preview is debounced (300 ms); a click inside that window must not
+  // purge by an age the shown count wasn't made for.
+  it('never executes with a days value that has not been previewed', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={365} />);
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    fireEvent.change(screen.getByLabelText('Delete archives not printed in the last'), {
+      target: { value: '1' },
+    });
+    // Immediately, inside the debounce window.
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies.length + previewCalls.length).toBeGreaterThan(1));
+    for (const body of executeBodies) {
+      expect(previewCalls.map((c) => c.days)).toContain(String(body.older_than_days));
+    }
+  });
+});

frontend/src/__tests__/components/SkipObjectsModalWiring.test.tsx

@@ -0,0 +1,173 @@
+/**
+ * SkipObjectsModal wiring: the request it sends when objects are skipped.
+ *
+ * The printer identifies objects by their slicer object id, not by their
+ * position in the list, so picking the 1st and 3rd object must send their ids.
+ * Already-skipped objects can't be picked again, and the submit button is gated
+ * on printers:control and on the print being past layer 1.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: ['printers:control'] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { SkipObjectsModal } from '../../components/SkipObjectsModal';
+
+const PRINTER_ID = 7;
+
+// Ids deliberately unlike list positions.
+const objects = [
+  { id: 412, name: 'Bracket A', x: 10, y: 10, skipped: false },
+  { id: 518, name: 'Bracket B', x: 20, y: 20, skipped: true },
+  { id: 903, name: 'Bracket C', x: 30, y: 30, skipped: false },
+  { id: 1207, name: 'Bracket D', x: 40, y: 40, skipped: false },
+];
+
+let skipCalls: { printerId: string; body: unknown }[] = [];
+
+function setup({ layer = 12 }: { layer?: number } = {}) {
+  skipCalls = [];
+  server.use(
+    http.get(`/api/v1/printers/${PRINTER_ID}/status`, () =>
+      HttpResponse.json({ connected: true, state: 'RUNNING', layer_num: layer, cover_url: null }),
+    ),
+    http.get(`/api/v1/printers/${PRINTER_ID}/print/objects`, () =>
+      HttpResponse.json({
+        objects,
+        total: objects.length,
+        skipped_count: 1,
+        is_printing: true,
+        bbox_all: null,
+      }),
+    ),
+    http.post('/api/v1/printers/:id/print/skip-objects', async ({ request, params }) => {
+      skipCalls.push({ printerId: params.id as string, body: await request.json() });
+      return HttpResponse.json({ success: true, message: 'Skipped', skipped_objects: [] });
+    }),
+  );
+  const onClose = vi.fn();
+  render(<SkipObjectsModal printerId={PRINTER_ID} isOpen onClose={onClose} />);
+  return { onClose };
+}
+
+const row = (name: string) => screen.getByText(name).closest('button') as HTMLButtonElement;
+const submit = () => screen.getByRole('button', { name: 'Skip Selected' });
+
+describe('SkipObjectsModal wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control'];
+  });
+
+  it('skips the picked objects by their object ids', async () => {
+    const user = userEvent.setup();
+    const { onClose } = setup();
+    await screen.findByText('Bracket A');
+    await waitFor(() => expect(submit()).toBeDisabled());
+
+    await user.click(row('Bracket A'));
+    await user.click(row('Bracket C'));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+
+    // Confirm dialog: the confirm button carries the same label.
+    expect(await screen.findByText('Skip 2 selected objects? This cannot be undone.')).toBeInTheDocument();
+    const confirmButtons = screen.getAllByRole('button', { name: 'Skip Selected' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+
+    await waitFor(() => expect(skipCalls).toHaveLength(1));
+    expect(skipCalls[0].printerId).toBe(String(PRINTER_ID));
+    expect([...(skipCalls[0].body as number[])].sort((a, b) => a - b)).toEqual([412, 903]);
+    await waitFor(() => expect(onClose).toHaveBeenCalled());
+  });
+
+  it('sends nothing when the confirm is cancelled', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(row('Bracket D'));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+    expect(await screen.findByText('Are you sure you want to skip "Bracket D"? This cannot be undone.')).toBeInTheDocument();
+
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+
+    await waitFor(() => expect(screen.queryByText(/Are you sure you want to skip/)).toBeNull());
+    expect(skipCalls).toEqual([]);
+  });
+
+  it('does not let an already-skipped object be picked', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket B');
+    expect(row('Bracket B')).toBeDisabled();
+    await user.click(row('Bracket B'));
+    expect(screen.getByText('No objects selected')).toBeInTheDocument();
+    expect(submit()).toBeDisabled();
+  });
+
+  it('select all picks only the objects still printing', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(screen.getByRole('button', { name: /Select All/ }));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+    // All remaining objects selected -> the stronger warning.
+    expect(await screen.findByText(/All remaining objects are selected/)).toBeInTheDocument();
+    const confirmButtons = screen.getAllByRole('button', { name: 'Skip Selected' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+
+    await waitFor(() => expect(skipCalls).toHaveLength(1));
+    expect([...(skipCalls[0].body as number[])].sort((a, b) => a - b)).toEqual([412, 903, 1207]);
+  });
+
+  it('keeps submit disabled without printers:control', async () => {
+    permissions.granted = [];
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(row('Bracket A'));
+    expect(screen.getByText('1/3', { selector: 'footer span' })).toBeInTheDocument();
+    expect(submit()).toBeDisabled();
+    await user.click(submit());
+    expect(screen.queryByText(/Are you sure you want to skip/)).toBeNull();
+    expect(skipCalls).toEqual([]);
+  });
+
+  it('keeps submit disabled until the print is past layer 1', async () => {
+    const user = userEvent.setup();
+    setup({ layer: 1 });
+    expect(await screen.findByText('Wait for layer 2+ to skip objects (currently layer 1)')).toBeInTheDocument();
+    await user.click(row('Bracket A'));
+    expect(submit()).toBeDisabled();
+    await user.click(submit());
+    expect(skipCalls).toEqual([]);
+  });
+});

frontend/src/__tests__/components/SmartPlugCardWiring.test.tsx

@@ -0,0 +1,168 @@
+/**
+ * SmartPlugCard wiring: each control sends the request for THIS plug, and
+ * the destructive ones (power off, delete) send nothing when cancelled.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { SmartPlugCard } from '../../components/SmartPlugCard';
+import type { SmartPlug } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+function makePlug(overrides: Partial<SmartPlug> = {}): SmartPlug {
+  return {
+    id: 42,
+    name: 'Wiring Plug',
+    plug_type: 'tasmota',
+    ip_address: '192.0.2.10',
+    ha_entity_id: null,
+    printer_id: null,
+    controls_printer_power: true,
+    enabled: true,
+    auto_on: false,
+    auto_off: false,
+    auto_off_persistent: false,
+    off_delay_mode: 'time',
+    off_delay_minutes: 5,
+    off_temp_threshold: 70,
+    username: null,
+    password: null,
+    power_alert_enabled: false,
+    schedule_enabled: false,
+    schedule_on_time: null,
+    schedule_off_time: null,
+    last_state: 'ON',
+    show_in_switchbar: false,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+    ...overrides,
+  } as unknown as SmartPlug;
+}
+
+let sent: Sent[];
+
+beforeEach(() => {
+  sent = [];
+  const record = async (request: Request) => {
+    const url = new URL(request.url);
+    let body: unknown = null;
+    try {
+      body = await request.json();
+    } catch {
+      body = null;
+    }
+    sent.push({ method: request.method, path: url.pathname, body });
+  };
+  server.use(
+    http.get('*/api/v1/smart-plugs/:id/status', () =>
+      HttpResponse.json({ state: 'ON', reachable: true, device_name: null, energy: null }),
+    ),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([])),
+    http.post('*/api/v1/smart-plugs/:id/control', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, action: 'off' });
+    }),
+    http.patch('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(makePlug());
+    }),
+    http.delete('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+  );
+});
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+async function renderReady() {
+  const user = userEvent.setup();
+  render(<SmartPlugCard plug={makePlug()} onEdit={() => undefined} />);
+  // The power buttons are enabled only once the status says the plug is reachable.
+  const off = await screen.findByRole('button', { name: 'Off' });
+  await waitFor(() => expect(off).not.toBeDisabled());
+  return { user, off };
+}
+
+function toggleFor(label: string): HTMLInputElement {
+  const row = screen.getByText(label).parentElement!.parentElement!;
+  return row.querySelector('input[type="checkbox"]') as HTMLInputElement;
+}
+
+describe('SmartPlugCard wiring', () => {
+  it('Power Off: confirming sends control "off" for this plug', async () => {
+    const { user, off } = await renderReady();
+    await user.click(off);
+
+    const dialog = await screen.findByText('Turn Off Smart Plug');
+    expect(dialog).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Turn Off' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'POST', path: '/api/v1/smart-plugs/42/control', body: { action: 'off' } });
+  });
+
+  it('Power Off: cancelling sends nothing', async () => {
+    const { user, off } = await renderReady();
+    await user.click(off);
+    await screen.findByText('Turn Off Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Turn Off Smart Plug')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('Power On: confirming sends control "on"', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByRole('button', { name: 'On' }));
+    await user.click(await screen.findByRole('button', { name: 'Turn On' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'POST', path: '/api/v1/smart-plugs/42/control', body: { action: 'on' } });
+  });
+
+  it('Delete: confirming sends DELETE for this plug', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    await user.click(edit.nextElementSibling as HTMLElement);
+
+    await screen.findByText('Delete Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/smart-plugs/42' });
+  });
+
+  it('Delete: cancelling sends nothing', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    await user.click(edit.nextElementSibling as HTMLElement);
+    await screen.findByText('Delete Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete Smart Plug')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it.each([
+    ['Auto On', { auto_on: true }],
+    ['Auto Off', { auto_off: true }],
+    ['Enabled', { enabled: false }],
+  ])('toggle "%s" PATCHes only that field', async (label, expected) => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    await screen.findByText(label);
+    await user.click(toggleFor(label));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/smart-plugs/42' });
+    expect(writes()[0].body).toEqual(expected);
+  });
+});

frontend/src/__tests__/components/SpoolmanSettingsWiring.test.tsx

@@ -0,0 +1,188 @@
+/**
+ * Wiring tests for SpoolmanSettings: the auto-saved settings payload,
+ * Connect, the per-printer / all-printers AMS sync, and the two weight-sync
+ * actions (built-in and Spoolman) that overwrite stored weights and so must
+ * only fire after confirmation.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { SpoolmanSettings } from '../../components/SpoolmanSettings';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      getSettings: vi.fn().mockResolvedValue({}),
+      updateSettings: vi.fn().mockResolvedValue({}),
+      getSpoolmanSettings: vi.fn(),
+      updateSpoolmanSettings: vi.fn(),
+      getSpoolmanStatus: vi.fn(),
+      connectSpoolman: vi.fn(),
+      syncAllPrintersAms: vi.fn(),
+      syncPrinterAms: vi.fn(),
+      syncWeightsFromAms: vi.fn(),
+      syncSpoolmanAmsWeights: vi.fn(),
+      migrateSpoolmanTags: vi.fn(),
+      getPrinters: vi.fn(),
+      getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    },
+  };
+});
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const syncResult = { success: true, synced_count: 1, skipped_count: 0, skipped: [], errors: [] };
+
+function settings(enabled: boolean, url = '') {
+  return {
+    spoolman_enabled: enabled ? 'true' : 'false',
+    spoolman_url: url,
+    spoolman_sync_mode: 'auto',
+    spoolman_disable_weight_sync: 'false',
+    spoolman_report_partial_usage: 'true',
+    auto_add_unknown_rfid: 'true',
+  };
+}
+
+describe('SpoolmanSettings wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSettings.mockResolvedValue({});
+    mocked.getAuthStatus.mockResolvedValue({ auth_enabled: false });
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(false));
+    mocked.updateSpoolmanSettings.mockResolvedValue(settings(false));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: false, connected: false, url: null });
+    mocked.getPrinters.mockResolvedValue([
+      { id: 4, name: 'X1C Left' },
+      { id: 8, name: 'H2D Right' },
+    ]);
+    mocked.connectSpoolman.mockResolvedValue({ success: true, message: 'ok' });
+    mocked.syncAllPrintersAms.mockResolvedValue(syncResult);
+    mocked.syncPrinterAms.mockResolvedValue(syncResult);
+    mocked.syncWeightsFromAms.mockResolvedValue({ synced: 2, skipped: 0, printing: 0 });
+    mocked.syncSpoolmanAmsWeights.mockResolvedValue({ synced: 2, skipped: 0, printing: 0 });
+  });
+
+  it('switching to Spoolman and entering a URL auto-saves the full settings payload', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Spoolman/ }));
+    await user.type(screen.getByPlaceholderText('http://192.168.1.100:7912'), 'http://sm:7912');
+    await user.selectOptions(screen.getByDisplayValue(/auto/i), 'manual');
+
+    await waitFor(
+      () => {
+        const calls = mocked.updateSpoolmanSettings.mock.calls;
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls[calls.length - 1][0]).toEqual({
+          spoolman_enabled: 'true',
+          spoolman_url: 'http://sm:7912',
+          spoolman_sync_mode: 'manual',
+          spoolman_disable_weight_sync: 'false',
+          spoolman_report_partial_usage: 'true',
+          auto_add_unknown_rfid: 'true',
+        });
+      },
+      { timeout: 3000 },
+    );
+  });
+
+  it('switching back to Built-in auto-saves spoolman_enabled=false', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Built-in Inventory/ }));
+
+    await waitFor(
+      () =>
+        expect(mocked.updateSpoolmanSettings).toHaveBeenCalledWith(
+          expect.objectContaining({ spoolman_enabled: 'false', spoolman_url: 'http://sm:7912' }),
+        ),
+      { timeout: 3000 },
+    );
+  });
+
+  it('Connect calls connectSpoolman', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Connect/ }));
+    await waitFor(() => expect(mocked.connectSpoolman).toHaveBeenCalledTimes(1));
+    expect(mocked.updateSpoolmanSettings).not.toHaveBeenCalled();
+  });
+
+  it('Sync with "All Printers" selected calls syncAllPrintersAms, not the per-printer sync', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /^Sync$/ }));
+    await waitFor(() => expect(mocked.syncAllPrintersAms).toHaveBeenCalledTimes(1));
+    expect(mocked.syncPrinterAms).not.toHaveBeenCalled();
+  });
+
+  it('Sync with one printer selected calls syncPrinterAms(thatPrinterId)', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await screen.findByRole('option', { name: 'H2D Right' });
+    await user.selectOptions(screen.getByDisplayValue('All Printers'), '8');
+    await user.click(screen.getByRole('button', { name: /^Sync$/ }));
+
+    await waitFor(() => expect(mocked.syncPrinterAms).toHaveBeenCalledWith(8));
+    expect(mocked.syncAllPrintersAms).not.toHaveBeenCalled();
+  });
+
+  it('built-in "Sync Weights from AMS" only calls syncWeightsFromAms after confirm', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: 'Sync Weights from AMS' }));
+    expect(await screen.findByText('Sync Spool Weights from AMS')).toBeInTheDocument();
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+
+    const confirmButtons = screen.getAllByRole('button', { name: 'Sync Weights from AMS' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+    await waitFor(() => expect(mocked.syncWeightsFromAms).toHaveBeenCalledTimes(1));
+    expect(mocked.syncSpoolmanAmsWeights).not.toHaveBeenCalled();
+  });
+
+  it('built-in weight sync: cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+    await user.click(await screen.findByRole('button', { name: 'Sync Weights from AMS' }));
+    await screen.findByText('Sync Spool Weights from AMS');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Sync Spool Weights from AMS')).not.toBeInTheDocument());
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman weight sync only calls syncSpoolmanAmsWeights after confirm; cancel sends nothing', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: 'Sync Spoolman Weights from AMS' }));
+    await screen.findByText('Sync Spoolman Spool Weights from AMS');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(mocked.syncSpoolmanAmsWeights).not.toHaveBeenCalled();
+
+    await user.click(screen.getByRole('button', { name: 'Sync Spoolman Weights from AMS' }));
+    await screen.findByText('Sync Spoolman Spool Weights from AMS');
+    const confirmButtons = screen.getAllByRole('button', { name: 'Sync Spoolman Weights from AMS' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+    await waitFor(() => expect(mocked.syncSpoolmanAmsWeights).toHaveBeenCalledTimes(1));
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/SwitchbarPopoverWiring.test.tsx

@@ -0,0 +1,113 @@
+/**
+ * Sidebar switchbar: every on/off goes through a confirm modal, and the
+ * control request carries the id of the plug that was clicked.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { api } from '../../api/client';
+import type { SmartPlug, SmartPlugStatus } from '../../api/client';
+import { SwitchbarPopover } from '../../components/SwitchbarPopover';
+
+function plug(id: number, name: string, extra: Partial<SmartPlug> = {}): SmartPlug {
+  return { id, name, plug_type: 'tasmota', show_in_switchbar: true, ...extra } as unknown as SmartPlug;
+}
+
+function rowFor(name: string): HTMLElement {
+  // The row container holding the plug name and its two buttons
+  return screen.getByText(name).closest('div.flex.items-center.justify-between') as HTMLElement;
+}
+
+function confirmButton(name: 'Turn On' | 'Turn Off'): HTMLElement {
+  const btn = screen.getAllByRole('button', { name }).find((b) => !b.hasAttribute('title'));
+  if (!btn) throw new Error(`confirm button ${name} not found`);
+  return btn;
+}
+
+describe('SwitchbarPopover wiring', () => {
+  let control: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.spyOn(api, 'getSmartPlugs').mockResolvedValue([
+      plug(11, 'Plug Alpha'),
+      plug(22, 'Plug Beta'),
+      plug(33, 'Hidden Plug', { show_in_switchbar: false }),
+      plug(44, 'Meter Plug', { plug_type: 'mqtt' }),
+    ]);
+    vi.spyOn(api, 'getSmartPlugStatus').mockImplementation(async (id: number) =>
+      ({
+        state: id === 44 ? null : 'ON',
+        reachable: true,
+        device_name: null,
+        energy: { power: id === 44 ? 120 : null },
+      }) as unknown as SmartPlugStatus,
+    );
+    control = vi.spyOn(api, 'controlSmartPlug').mockResolvedValue({ success: true } as never);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('turning off the clicked plug asks first, then sends controlSmartPlug(id, "off")', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Beta');
+    const row = rowFor('Plug Beta');
+    const offBtn = within(row).getByTitle('Turn Off');
+    await waitFor(() => expect(offBtn).not.toBeDisabled());
+
+    await user.click(offBtn);
+    // Confirm modal is shown, nothing sent yet
+    expect(await screen.findByText(/are you sure you want to turn off "Plug Beta"/i)).toBeInTheDocument();
+    expect(control).not.toHaveBeenCalled();
+
+    await user.click(confirmButton('Turn Off'));
+    await waitFor(() => expect(control).toHaveBeenCalledTimes(1));
+    expect(control).toHaveBeenCalledWith(22, 'off');
+  });
+
+  it('turning on sends controlSmartPlug(id, "on") for that plug only', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    const onBtn = within(rowFor('Plug Alpha')).getByTitle('Turn On');
+    await waitFor(() => expect(onBtn).not.toBeDisabled());
+    await user.click(onBtn);
+    await user.click(confirmButton('Turn On'));
+
+    await waitFor(() => expect(control).toHaveBeenCalledWith(11, 'on'));
+    expect(control).toHaveBeenCalledTimes(1);
+  });
+
+  it('cancelling the confirm modal sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    const offBtn = within(rowFor('Plug Alpha')).getByTitle('Turn Off');
+    await waitFor(() => expect(offBtn).not.toBeDisabled());
+    await user.click(offBtn);
+    await screen.findByText(/are you sure you want to turn off "Plug Alpha"/i);
+    await user.click(screen.getByRole('button', { name: /cancel/i }));
+
+    await waitFor(() =>
+      expect(screen.queryByText(/are you sure you want to turn off/i)).not.toBeInTheDocument(),
+    );
+    expect(control).not.toHaveBeenCalled();
+  });
+
+  it('lists only switchbar plugs and gives MQTT (monitor-only) plugs no switch buttons', async () => {
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    expect(screen.queryByText('Hidden Plug')).not.toBeInTheDocument();
+    const meterRow = rowFor('Meter Plug');
+    expect(within(meterRow).queryByTitle('Turn On')).not.toBeInTheDocument();
+    expect(within(meterRow).queryByTitle('Turn Off')).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/components/TwoFactorSettingsWiring.test.tsx

@@ -0,0 +1,219 @@
+/**
+ * Account 2FA settings: each action sends the code/password the user typed
+ * to the right endpoint, a rejected code does not advance the wizard, new
+ * backup codes are shown once, and unlinking SSO targets the clicked
+ * provider.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+
+const mockUseAuth = {
+  authEnabled: true,
+  loading: false,
+  user: { id: 3, username: 'tester', email: 'tester@example.com', is_admin: false, permissions: [] },
+  hasPermission: () => true,
+};
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { TwoFactorSettings } from '../../components/TwoFactorSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+let captured: Captured[];
+let twoFaStatus: { totp_enabled: boolean; email_otp_enabled: boolean; backup_codes_remaining: number };
+let totpEnableOk: boolean;
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+const sent = (suffix: string) => captured.filter((c) => c.path.endsWith(suffix));
+
+beforeEach(() => {
+  captured = [];
+  totpEnableOk = true;
+  twoFaStatus = { totp_enabled: false, email_otp_enabled: false, backup_codes_remaining: 0 };
+  server.use(
+    http.get('*/api/v1/auth/2fa/status', () => HttpResponse.json(twoFaStatus)),
+    http.get('*/api/v1/auth/oidc/links', () =>
+      HttpResponse.json([
+        { id: 100, provider_id: 5, provider_name: 'Alpha IdP', provider_email: 'a@idp.example', created_at: '2026-01-01T00:00:00Z' },
+        { id: 101, provider_id: 8, provider_name: 'Beta IdP', provider_email: 'b@idp.example', created_at: '2026-01-01T00:00:00Z' },
+      ]),
+    ),
+    http.post('*/api/v1/auth/2fa/totp/setup', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ secret: 'TESTSECRETBASE32', qr_code_b64: 'AAAA', provisioning_uri: 'otpauth://totp/x' });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/enable', async ({ request }) => {
+      await capture(request);
+      return totpEnableOk
+        ? HttpResponse.json({ message: 'ok', backup_codes: ['AAAA1111', 'BBBB2222'] })
+        : HttpResponse.json({ detail: 'Invalid code' }, { status: 400 });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/regenerate-backup-codes', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ backup_codes: ['NEWC0DE1', 'NEWC0DE2'] });
+    }),
+    http.post('*/api/v1/auth/2fa/email/enable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'code sent', setup_token: 'setup-token-1' });
+    }),
+    http.post('*/api/v1/auth/2fa/email/enable/confirm', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/2fa/email/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.delete('*/api/v1/auth/oidc/links/:providerId', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+  );
+});
+
+describe('TwoFactorSettings wiring', () => {
+  it('TOTP setup: setup -> secret/QR -> code -> enableTOTP(code) -> backup codes', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await waitFor(() => expect(sent('/totp/setup')).toHaveLength(1));
+    expect(await screen.findByAltText('TOTP QR Code')).toHaveAttribute('src', 'data:image/png;base64,AAAA');
+
+    await user.click(screen.getByRole('button', { name: /scanned the code/i }));
+    const activate = screen.getByRole('button', { name: /^activate$/i });
+    await user.type(screen.getByPlaceholderText('000000'), '123456');
+    await user.click(activate);
+
+    await waitFor(() => expect(sent('/totp/enable')).toHaveLength(1));
+    expect(sent('/totp/enable')[0].body).toEqual({ code: '123456' });
+    expect(await screen.findByText('AAAA1111')).toBeInTheDocument();
+  });
+
+  it('a wrong TOTP code shows an error and stays on the confirm step', async () => {
+    totpEnableOk = false;
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await user.click(await screen.findByRole('button', { name: /scanned the code/i }));
+    await user.type(screen.getByPlaceholderText('000000'), '000000');
+    await user.click(screen.getByRole('button', { name: /^activate$/i }));
+
+    expect(await screen.findByText(/invalid code/i)).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /^activate$/i })).toBeInTheDocument();
+    expect(screen.queryByText(/save your backup codes/i)).not.toBeInTheDocument();
+  });
+
+  it('activate stays disabled until 6 digits are entered', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await user.click(await screen.findByRole('button', { name: /scanned the code/i }));
+    await user.type(screen.getByPlaceholderText('000000'), '12345');
+    expect(screen.getByRole('button', { name: /^activate$/i })).toBeDisabled();
+    expect(sent('/totp/enable')).toHaveLength(0);
+  });
+
+  it('disable TOTP sends the typed code to /totp/disable; cancel sends nothing', async () => {
+    twoFaStatus = { totp_enabled: true, email_otp_enabled: false, backup_codes_remaining: 5 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    // Cancel first
+    await user.click(await screen.findByRole('button', { name: /disable authenticator/i }));
+    await user.type(screen.getByPlaceholderText('000000 or XXXXXXXX'), '654321');
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(sent('/totp/disable')).toHaveLength(0);
+
+    await user.click(screen.getByRole('button', { name: /disable authenticator/i }));
+    const input = screen.getByPlaceholderText('000000 or XXXXXXXX');
+    expect(input).toHaveValue('');
+    await user.type(input, 'abcd2345');
+    await user.click(screen.getByRole('button', { name: /disable authenticator/i }));
+
+    await waitFor(() => expect(sent('/totp/disable')).toHaveLength(1));
+    // CodeInput upper-cases backup codes
+    expect(sent('/totp/disable')[0].body).toEqual({ code: 'ABCD2345' });
+  });
+
+  it('regenerate backup codes sends the code and shows the new codes once', async () => {
+    twoFaStatus = { totp_enabled: true, email_otp_enabled: false, backup_codes_remaining: 2 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /regenerate backup codes/i }));
+    await user.type(screen.getByPlaceholderText('000000 or XXXXXXXX'), '112233');
+    await user.click(screen.getByRole('button', { name: /regenerate backup codes/i }));
+
+    await waitFor(() => expect(sent('/regenerate-backup-codes')).toHaveLength(1));
+    expect(sent('/regenerate-backup-codes')[0].body).toEqual({ code: '112233' });
+    expect(await screen.findByText('NEWC0DE1')).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: /saved my codes/i }));
+    await waitFor(() => expect(screen.queryByText('NEWC0DE1')).not.toBeInTheDocument());
+  });
+
+  it('email OTP enable: request -> confirm sends {setup_token, code}', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /enable email otp/i }));
+    await waitFor(() => expect(sent('/email/enable')).toHaveLength(1));
+
+    await user.type(await screen.findByPlaceholderText('000000'), '778899');
+    await user.click(screen.getByRole('button', { name: /verify & enable/i }));
+
+    await waitFor(() => expect(sent('/email/enable/confirm')).toHaveLength(1));
+    expect(sent('/email/enable/confirm')[0].body).toEqual({ setup_token: 'setup-token-1', code: '778899' });
+  });
+
+  it('email OTP disable requires the password and sends it to /email/disable', async () => {
+    twoFaStatus = { totp_enabled: false, email_otp_enabled: true, backup_codes_remaining: 0 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /disable email otp/i }));
+    const confirm = screen.getByRole('button', { name: /disable email otp/i });
+    expect(confirm).toBeDisabled();
+
+    await user.type(screen.getByPlaceholderText(/enter your password/i), 'test-password-1');
+    await user.click(confirm);
+
+    await waitFor(() => expect(sent('/email/disable')).toHaveLength(1));
+    expect(sent('/email/disable')[0].body).toEqual({ password: 'test-password-1' });
+  });
+
+  it('unlinking an SSO account deletes the clicked provider link', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    const row = (await screen.findByText('Beta IdP')).closest('div.flex.items-center.justify-between') as HTMLElement;
+    await user.click(within(row).getByRole('button'));
+
+    await waitFor(() => expect(sent('/oidc/links/8')).toHaveLength(1));
+    expect(captured.filter((c) => c.method === 'DELETE')).toEqual([
+      { method: 'DELETE', path: '/api/v1/auth/oidc/links/8', body: null },
+    ]);
+  });
+});

frontend/src/__tests__/pages/ArchivesPageWiring.test.tsx

@@ -0,0 +1,515 @@
+/**
+ * Wiring tests for ArchivesPage: pin the exact mutation requests behind
+ * archive delete (card, list row, bulk), file removals (timelapse, source
+ * 3MF, F3D), project assignment, bulk favourite and the print-log
+ * edit / delete / clear actions -- and that cancelling each destructive
+ * confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { ArchivesPage } from '../../pages/ArchivesPage';
+import { setAuthToken } from '../../api/client';
+
+const archive = (over: Record<string, unknown>) => ({
+  id: 1,
+  filename: 'a.gcode.3mf',
+  print_name: 'Archive',
+  printer_id: 1,
+  printer_name: 'X1 Carbon',
+  print_time_seconds: 3600,
+  filament_used_grams: 10,
+  status: 'completed',
+  started_at: '2024-01-01T10:00:00Z',
+  completed_at: '2024-01-01T11:00:00Z',
+  thumbnail_path: null,
+  notes: null,
+  rating: null,
+  project_id: null,
+  project_name: null,
+  project_color: null,
+  print_count: 1,
+  tags: '',
+  created_at: '2024-01-01T09:00:00Z',
+  updated_at: '2024-01-01T11:00:00Z',
+  has_f3d: false,
+  is_favorite: false,
+  ...over,
+});
+
+const ARCHIVES = [
+  archive({ id: 1, print_name: 'Benchy', created_at: '2024-01-03T09:00:00Z' }),
+  archive({
+    id: 2,
+    print_name: 'Bracket',
+    created_at: '2024-01-02T09:00:00Z',
+    timelapse_path: 'timelapse/2.mp4',
+    source_3mf_path: 'source/2.3mf',
+    f3d_path: 'f3d/2.f3d',
+  }),
+  archive({ id: 3, print_name: 'Clip', created_at: '2024-01-01T09:00:00Z' }),
+];
+
+const LOG_ENTRIES = [
+  {
+    id: 501,
+    archive_id: 1,
+    print_name: 'Logged Print',
+    printer_name: 'X1 Carbon',
+    printer_id: 1,
+    status: 'completed',
+    started_at: '2024-01-01T10:00:00Z',
+    completed_at: '2024-01-01T11:00:00Z',
+    duration_seconds: 3600,
+    filament_type: 'PLA',
+    filament_color: '#000000',
+    filament_used_grams: 10,
+    cost: 0.4,
+    energy_kwh: null,
+    energy_cost: null,
+    failure_reason: null,
+    thumbnail_path: null,
+    created_by_id: null,
+    created_by_username: null,
+    created_at: '2024-01-01T10:00:00Z',
+  },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  search: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+let viewMode: string | null;
+
+async function capture(request: Request) {
+  const url = new URL(request.url);
+  let body: unknown;
+  if (request.method === 'PATCH' || request.method === 'POST' || request.method === 'PUT') {
+    const text = await request.text();
+    body = text ? JSON.parse(text) : undefined;
+  }
+  calls.push({ method: request.method, path: url.pathname, search: url.search, body });
+}
+
+const mutations = () => calls.filter((c) => c.method !== 'GET');
+
+beforeEach(() => {
+  calls = [];
+  viewMode = null;
+  setAuthToken(null);
+  vi.mocked(localStorage.getItem).mockImplementation((key: string) =>
+    key === 'archiveViewMode' ? viewMode : null,
+  );
+  server.use(
+    http.get('*/api/v1/archives/', () => HttpResponse.json(ARCHIVES)),
+    http.get('*/api/v1/archives/stats', () =>
+      HttpResponse.json({
+        total_archives: 3,
+        total_print_time_seconds: 0,
+        total_filament_grams: 0,
+        prints_this_week: 0,
+        prints_this_month: 0,
+      }),
+    ),
+    http.get('*/api/v1/archives/tags', () => HttpResponse.json([])),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([{ id: 1, name: 'X1 Carbon' }])),
+    http.get('*/api/v1/projects/', () =>
+      HttpResponse.json([
+        { id: 4, name: 'Gizmos', color: '#ff0000', status: 'active' },
+        { id: 8, name: 'Shelved', color: '#00ff00', status: 'archived' },
+      ]),
+    ),
+    http.get('*/api/v1/archives/:id/delete-impact', () =>
+      HttpResponse.json({ related_queue_items: 0, currently_printing: 0 }),
+    ),
+    http.get('*/api/v1/print-log/', () =>
+      HttpResponse.json({ items: LOG_ENTRIES, total: LOG_ENTRIES.length }),
+    ),
+    http.delete('*/api/v1/archives/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.delete('*/api/v1/archives/:id/timelapse', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.delete('*/api/v1/archives/:id/source', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.delete('*/api/v1/archives/:id/f3d', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.patch('*/api/v1/archives/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(ARCHIVES[0]);
+    }),
+    http.post('*/api/v1/archives/:id/favorite', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(ARCHIVES[0]);
+    }),
+    http.delete('*/api/v1/print-log/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ deleted: 1 });
+    }),
+    http.delete('*/api/v1/print-log/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok', id: 501 });
+    }),
+    http.patch('*/api/v1/print-log/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(LOG_ENTRIES[0]);
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function cardFor(id: number): Promise<HTMLElement> {
+  await screen.findByText('Benchy');
+  const el = document.querySelector<HTMLElement>(`[data-archive-id="${id}"]`);
+  expect(el).not.toBeNull();
+  return el!;
+}
+
+/** The fixed overlay of the ConfirmModal whose title is ``title``. */
+async function confirmDialog(title: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name: title });
+  return heading.closest('div.fixed') as HTMLElement;
+}
+
+async function openMenu(id: number) {
+  fireEvent.contextMenu(await cardFor(id));
+}
+
+describe('ArchivesPage wiring: single archive delete', () => {
+  it('card Delete -> confirm sends DELETE /archives/{id} for that archive only', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(2);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/2', search: '' });
+  });
+
+  it('card Delete with "also remove from Quick Stats" sends purge_stats=true', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(3);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('checkbox'));
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({
+      method: 'DELETE',
+      path: '/api/v1/archives/3',
+      search: '?purge_stats=true',
+    });
+  });
+
+  it('card Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(2);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archive' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('list row Delete -> confirm sends DELETE for that row', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const row = await cardFor(3);
+
+    await user.click(within(row).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/3' });
+  });
+
+  it('list row Delete -> cancel sends nothing', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const row = await cardFor(3);
+
+    await user.click(within(row).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archive' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('ArchivesPage wiring: file removals from the context menu', () => {
+  const cases: Array<[string, string, string]> = [
+    ['Remove Timelapse', 'Remove Timelapse', '/api/v1/archives/2/timelapse'],
+    ['Remove Source 3MF', 'Remove Source 3MF', '/api/v1/archives/2/source'],
+    ['Remove F3D', 'Remove F3D', '/api/v1/archives/2/f3d'],
+  ];
+
+  for (const [menuLabel, dialogTitle, path] of cases) {
+    it(`${menuLabel} -> confirm sends DELETE ${path}`, async () => {
+      const user = userEvent.setup();
+      render(<ArchivesPage />);
+      await openMenu(2);
+
+      await user.click(await screen.findByRole('button', { name: menuLabel }));
+      const dialog = await confirmDialog(dialogTitle);
+      await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+      await waitFor(() => expect(mutations()).toHaveLength(1));
+      expect(mutations()[0]).toMatchObject({ method: 'DELETE', path });
+    });
+
+    it(`${menuLabel} -> cancel sends nothing`, async () => {
+      const user = userEvent.setup();
+      render(<ArchivesPage />);
+      await openMenu(2);
+
+      await user.click(await screen.findByRole('button', { name: menuLabel }));
+      const dialog = await confirmDialog(dialogTitle);
+      await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+      await waitFor(() => expect(screen.queryByRole('heading', { name: dialogTitle })).toBeNull());
+      expect(mutations()).toHaveLength(0);
+    });
+  }
+
+  it('list row: Remove Timelapse -> confirm sends DELETE for that row', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(2);
+
+    await user.click(await screen.findByRole('button', { name: 'Remove Timelapse' }));
+    const dialog = await confirmDialog('Remove Timelapse');
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/2/timelapse' });
+  });
+});
+
+describe('ArchivesPage wiring: project and favourite', () => {
+  it('Add to Project -> project sends PATCH /archives/{id} with project_id', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(3);
+
+    // Click (not hover) toggles the submenu open.
+    fireEvent.click(await screen.findByRole('button', { name: 'Add to Project' }));
+    const gizmos = await screen.findByRole('button', { name: 'Gizmos' });
+    // Archived projects are not offered.
+    expect(screen.queryByRole('button', { name: 'Shelved' })).toBeNull();
+    await user.click(gizmos);
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/archives/3',
+      search: '',
+      body: { project_id: 4 },
+    });
+  });
+
+  it('Remove from Project sends PATCH with project_id null', async () => {
+    server.use(
+      http.get('*/api/v1/archives/', () =>
+        HttpResponse.json([
+          ARCHIVES[0],
+          archive({ id: 9, print_name: 'Filed', project_id: 4, project_name: 'Gizmos' }),
+        ]),
+      ),
+    );
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(9);
+
+    fireEvent.click(await screen.findByRole('button', { name: 'Add to Project' }));
+    await user.click(await screen.findByRole('button', { name: 'Remove from Project' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/archives/9', body: { project_id: null } });
+  });
+
+  it('context menu Add to Favorites posts /archives/{id}/favorite', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(1);
+
+    await user.click(await screen.findByRole('button', { name: 'Add to Favorites' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'POST', path: '/api/v1/archives/1/favorite' });
+  });
+});
+
+describe('ArchivesPage wiring: bulk selection', () => {
+  /** Select archives 1 and 3 via the context menu + selection-mode clicks. */
+  async function selectOneAndThree(user: ReturnType<typeof userEvent.setup>) {
+    render(<ArchivesPage />);
+    await openMenu(1);
+    const menu = (await screen.findByRole('button', { name: 'Add to Project' })).closest(
+      'div.fixed',
+    ) as HTMLElement;
+    await user.click(within(menu).getByRole('button', { name: 'Select' }));
+    await screen.findByText('1 selected');
+    fireEvent.click(await cardFor(3));
+    return (await screen.findByText('2 selected')).closest('div.fixed') as HTMLElement;
+  }
+
+  it('bulk Delete -> confirm sends DELETE for exactly the selected ids', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Delete' }));
+    const dialog = await confirmDialog('Delete Archives');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete 2' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'DELETE /api/v1/archives/1',
+      'DELETE /api/v1/archives/3',
+    ]);
+  });
+
+  it('bulk Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Delete' }));
+    const dialog = await confirmDialog('Delete Archives');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archives' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('bulk Favorite toggles each selected id once', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Favorite' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'POST /api/v1/archives/1/favorite',
+      'POST /api/v1/archives/3/favorite',
+    ]);
+  });
+});
+
+describe('ArchivesPage wiring: print log', () => {
+  async function openLog() {
+    render(<ArchivesPage />);
+    fireEvent.click(await screen.findByTitle('Print Log'));
+    await screen.findByText('Logged Print');
+  }
+
+  it('Clear Log -> confirm sends DELETE /print-log/', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByRole('button', { name: 'Clear Log' }));
+    const dialog = await confirmDialog('Clear Print Log');
+    await user.click(within(dialog).getByRole('button', { name: 'Clear All' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/print-log/' });
+  });
+
+  it('Clear Log -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByRole('button', { name: 'Clear Log' }));
+    const dialog = await confirmDialog('Clear Print Log');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Clear Print Log' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('row delete -> confirm sends DELETE /print-log/{id}', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Delete print log entry'));
+    const dialog = await confirmDialog('Delete print log entry');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/print-log/501' });
+  });
+
+  it('row delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Delete print log entry'));
+    const dialog = await confirmDialog('Delete print log entry');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete print log entry' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('row edit sends PATCH /print-log/{id} with only the changed fields', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Edit print log entry'));
+    const heading = await screen.findByRole('heading', { name: 'Edit print log entry' });
+    const modal = heading.parentElement as HTMLElement;
+    const [statusSelect] = within(modal).getAllByRole('combobox');
+    await user.selectOptions(statusSelect, 'failed');
+    await user.click(within(modal).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/print-log/501',
+      search: '',
+      body: { status: 'failed' },
+    });
+  });
+
+  it('row edit with nothing changed sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Edit print log entry'));
+    const heading = await screen.findByRole('heading', { name: 'Edit print log entry' });
+    await user.click(within(heading.parentElement as HTMLElement).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Edit print log entry' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});

frontend/src/__tests__/pages/FinancePageWiring.test.tsx

@@ -0,0 +1,468 @@
+/**
+ * Wiring tests for FinancePage (admin view): pin the exact billing requests
+ * -- wallet deposit / withdraw, transaction edit / delete, cost centre
+ * create / update / delete, member add / remove, manual print -- that a
+ * cancelled destructive confirm sends nothing, and that the money-moving
+ * controls are absent without cost_centers:modify.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { FinancePage } from '../../pages/FinancePage';
+import { setAuthToken } from '../../api/client';
+
+const centre = (over: Record<string, unknown>) => ({
+  id: 20,
+  name: 'Lab',
+  is_private: false,
+  owner_user_id: null,
+  is_active: true,
+  total_balance: 0,
+  total_budget: null,
+  monthly_budget: 100,
+  budget_mode: 'monthly',
+  budget_limit: 100,
+  budget_used: 0,
+  budget_available: 100,
+  can_print: true,
+  ...over,
+});
+
+const CENTRES = [
+  centre({ id: 20, name: 'Lab' }),
+  centre({ id: 21, name: 'Shop', monthly_budget: 40, budget_limit: 40, budget_available: 40 }),
+  centre({ id: 22, name: 'Alice private', is_private: true, owner_user_id: 3 }),
+];
+
+const USERS = [
+  { id: 3, username: 'alice' },
+  { id: 5, username: 'bob' },
+];
+
+const TX = {
+  id: 900,
+  user_id: 5,
+  cost_center_id: 20,
+  transaction_type: 'deposit',
+  amount: 12.5,
+  balance_after: 12.5,
+  description: 'Filament refill',
+  created_by_user_id: null,
+  print_run_id: null,
+  print_archive_id: null,
+  print_queue_id: null,
+  created_at: '2026-10-11T10:00:00',
+};
+
+interface Captured {
+  method: string;
+  path: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+async function capture(request: Request) {
+  const url = new URL(request.url);
+  const text = request.method === 'DELETE' ? '' : await request.text();
+  calls.push({ method: request.method, path: url.pathname, body: text ? JSON.parse(text) : undefined });
+}
+
+const mutations = () => calls.filter((c) => c.method !== 'GET');
+
+beforeEach(() => {
+  calls = [];
+  setAuthToken(null);
+  server.use(
+    http.get('*/api/v1/settings/ui-flags', () => HttpResponse.json({ billing_enabled: true, currency: 'USD' })),
+    http.get('*/api/v1/finance/me/balance', () =>
+      HttpResponse.json({ user_id: 1, balance: 0, currency: 'USD', updated_at: null }),
+    ),
+    http.get('*/api/v1/finance/me/transactions', () => HttpResponse.json({ items: [], total: 0 })),
+    http.get('*/api/v1/finance/transactions', () =>
+      HttpResponse.json({ items: [TX], total: 1, limit: 50, offset: 0 }),
+    ),
+    http.get('*/api/v1/finance/cost-centers/mine', () => HttpResponse.json([])),
+    http.get('*/api/v1/finance/cost-centers', () => HttpResponse.json(CENTRES)),
+    http.get('*/api/v1/finance/cost-centers/:id', ({ params }) => {
+      const id = Number(params.id);
+      const c = CENTRES.find((x) => x.id === id);
+      return HttpResponse.json({
+        ...c,
+        members: id === 20 ? [{ id: 1, cost_center_id: 20, user_id: 3, can_print: true }] : [],
+      });
+    }),
+    http.get('*/api/v1/users/slim', () => HttpResponse.json(USERS)),
+    http.post('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({});
+    }),
+    http.patch('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({});
+    }),
+    http.delete('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function openAdmin(user: ReturnType<typeof userEvent.setup>) {
+  render(<FinancePage />);
+  await user.click(await screen.findByText('Admin view'));
+  await screen.findByText('Filament refill');
+}
+
+/** The FinanceModal (or ConfirmModal) overlay whose heading is ``title``. */
+async function modal(title: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name: title });
+  return heading.closest('div.fixed') as HTMLElement;
+}
+
+/** The cost-centre table row for ``name`` (the one with an Edit button). */
+async function centreRow(name: string): Promise<HTMLElement> {
+  let row: HTMLElement | undefined;
+  await waitFor(() => {
+    row = screen
+      .getAllByText(name)
+      .map((el) => el.closest('tr') as HTMLElement | null)
+      .find((tr): tr is HTMLElement => !!tr && !!within(tr).queryByTitle('Edit'));
+    expect(row).toBeDefined();
+  });
+  return row!;
+}
+
+describe('FinancePage wiring: wallet adjustment', () => {
+  it('Deposit 10.00 to bob posts /finance/users/5/deposit with amount, description and cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    const [userSelect, typeSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    expect(typeSelect).toHaveValue('deposit');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '10.00');
+    await user.selectOptions(centreSelect, '21');
+    await user.type(within(dlg).getByPlaceholderText('Description (optional)'), 'Top up');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/users/5/deposit',
+      body: { amount: 10, description: 'Top up', cost_center_id: 21 },
+    });
+  });
+
+  it('Withdraw posts /finance/users/{id}/withdraw with no cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    const [userSelect, typeSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '3');
+    await user.selectOptions(typeSelect, 'withdraw');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '2.5');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/users/3/withdraw',
+      body: { amount: 2.5, cost_center_id: null },
+    });
+  });
+
+  it('a zero amount sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '0');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await screen.findByText('Amount must be greater than zero');
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: transactions', () => {
+  async function txRow(): Promise<HTMLElement> {
+    return (await screen.findByText('Filament refill')).closest('tr') as HTMLElement;
+  }
+
+  it('edit transaction sends PATCH /finance/transactions/{id} with the edited fields', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    const buttons = within(await txRow()).getAllByRole('button');
+    await user.click(buttons[0]); // pencil
+    const dlg = await modal('Edit Transaction');
+    const [userSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '3');
+    await user.selectOptions(centreSelect, '21');
+    const amount = within(dlg).getByRole('spinbutton');
+    await user.clear(amount);
+    await user.type(amount, '7.25');
+    const desc = within(dlg).getByRole('textbox');
+    await user.clear(desc);
+    await user.type(desc, 'Corrected');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/finance/transactions/900',
+      body: { user_id: 3, cost_center_id: 21, amount: 7.25, description: 'Corrected' },
+    });
+  });
+
+  // The backend clears the cost centre only for an explicit null
+  // (edit_transaction checks model_fields_set); a missing key keeps the old one.
+  it('moving a transaction to "No cost center" sends cost_center_id: null', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[0]);
+    const dlg = await modal('Edit Transaction');
+    const [, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(centreSelect, '');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0].body).toHaveProperty('cost_center_id', null);
+  });
+
+  it('delete transaction -> confirm sends DELETE /finance/transactions/{id}', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[1]); // trash
+    const dlg = await modal('Delete transaction');
+    await user.click(within(dlg).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/transactions/900' });
+  });
+
+  it('delete transaction -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[1]);
+    const dlg = await modal('Delete transaction');
+    await user.click(within(dlg).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete transaction' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('manual print posts /finance/transactions/manual with user and cost_center_id', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Add manual print' }));
+    const dlg = await modal('Add manual print');
+    const [userSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    await user.selectOptions(centreSelect, '21');
+    await user.type(within(dlg).getByPlaceholderText('e.g., 4.00'), '4');
+    await user.type(within(dlg).getByPlaceholderText('Description (optional)'), 'Hand print');
+    await user.click(within(dlg).getByRole('button', { name: 'Add manual print' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    const call = mutations()[0];
+    expect(call.method).toBe('POST');
+    expect(call.path).toBe('/api/v1/finance/transactions/manual');
+    expect(call.body).toMatchObject({ user_id: 5, cost_center_id: 21, amount: 4, description: 'Hand print' });
+  });
+
+  it('manual print without a cost centre sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Add manual print' }));
+    const dlg = await modal('Add manual print');
+    const [userSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    await user.type(within(dlg).getByPlaceholderText('e.g., 4.00'), '4');
+    await user.click(within(dlg).getByRole('button', { name: 'Add manual print' }));
+
+    await screen.findByText('Please select a cost center');
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: cost centres', () => {
+  it('create posts /finance/cost-centers with name and monthly budget', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Create cost center' }));
+    const dlg = await modal('Create cost center');
+    await user.type(within(dlg).getByPlaceholderText('Name'), '  Robotics ');
+    const inputs = within(dlg).getAllByRole('spinbutton');
+    await user.type(inputs[inputs.length - 1], '50');
+    await user.click(within(dlg).getByRole('button', { name: 'Create' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers',
+      body: { name: 'Robotics', total_budget: null, monthly_budget: 50, is_active: true },
+    });
+  });
+
+  it('edit sends the name and budgets PATCHes for that centre id', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await centreRow('Shop')).getByTitle('Edit'));
+    const dlg = await modal('Edit cost center');
+    const name = within(dlg).getByPlaceholderText('Name');
+    await waitFor(() => expect(name).toHaveValue('Shop'));
+    await user.clear(name);
+    await user.type(name, 'Workshop');
+    await user.selectOptions(within(dlg).getByRole('combobox'), 'total');
+    const budget = within(dlg).getByRole('spinbutton');
+    await user.clear(budget);
+    await user.type(budget, '300');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations()).toEqual([
+      { method: 'PATCH', path: '/api/v1/finance/cost-centers/21', body: { name: 'Workshop' } },
+      {
+        method: 'PATCH',
+        path: '/api/v1/finance/cost-centers/21/budgets',
+        body: { total_budget: 300, monthly_budget: null },
+      },
+    ]);
+  });
+
+  it('delete -> confirm sends DELETE for that centre; private centres offer no delete', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(within(await centreRow('Alice private')).queryByTitle('Delete')).toBeNull();
+    await user.click(within(await centreRow('Lab')).getByTitle('Delete'));
+    const dlg = (await screen.findByText('Delete cost center "Lab"?')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dlg).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/cost-centers/20' });
+  });
+
+  it('delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await centreRow('Lab')).getByTitle('Delete'));
+    const dlg = (await screen.findByText('Delete cost center "Lab"?')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dlg).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete cost center "Lab"?')).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: members', () => {
+  it('add member posts the selected centre id and the user id with can_print', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const [centreSelect, userSelect] = within(dlg).getAllByRole('combobox');
+    await waitFor(() => expect(centreSelect).toHaveValue('20'));
+    // alice (3) is already a member of Lab, so bob is the only candidate.
+    await waitFor(() => expect(userSelect).toHaveValue('5'));
+    expect(within(userSelect).queryByRole('option', { name: 'alice' })).toBeNull();
+    await user.click(within(dlg).getByRole('checkbox'));
+    await user.click(within(dlg).getByRole('button', { name: 'Add member' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers/20/members',
+      body: { user_id: 5, can_print: false },
+    });
+  });
+
+  it('add member follows a switched cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const [centreSelect, userSelect] = within(dlg).getAllByRole('combobox');
+    await waitFor(() => expect(centreSelect).toHaveValue('20'));
+    await user.selectOptions(centreSelect, '21');
+    await user.selectOptions(userSelect, '3');
+    await user.click(within(dlg).getByRole('button', { name: 'Add member' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers/21/members',
+      body: { user_id: 3, can_print: true },
+    });
+  });
+
+  it('remove member sends DELETE /finance/cost-centers/{centre}/members/{user}', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const memberRow = (await within(dlg).findByText('alice', { selector: 'td' })).closest('tr') as HTMLElement;
+    await user.click(within(memberRow).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/cost-centers/20/members/3' });
+  });
+});
+
+describe('FinancePage wiring: permission gates', () => {
+  const signInWith = (permissions: string[]) => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: 1, username: 'viewer', is_admin: false, permissions }),
+      ),
+    );
+  };
+
+  it('without cost_centers:modify there is no wallet, manual-print, members or delete control', async () => {
+    signInWith(['cost_centers:read_own', 'cost_centers:read_all', 'users:read_slim']);
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(screen.queryByRole('button', { name: 'Adjust wallet' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Add manual print' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Manage cost center members' })).toBeNull();
+    expect(screen.queryByTitle('Delete')).toBeNull();
+  });
+
+  it('with cost_centers:modify and users:read_slim the wallet controls are offered', async () => {
+    signInWith(['cost_centers:read_own', 'cost_centers:read_all', 'cost_centers:modify', 'users:read_slim']);
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(screen.getByRole('button', { name: 'Adjust wallet' })).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Add manual print' })).toBeInTheDocument();
+  });
+});

frontend/src/__tests__/pages/InventoryPageWiring.test.tsx

@@ -0,0 +1,324 @@
+/**
+ * Wiring tests for InventoryPage's inventory-changing actions in BOTH modes:
+ * per-spool delete / archive / restore / reset-counter, the bulk actions on
+ * a 3-spool selection, and "sync to scale weight". Spoolman mode must route
+ * to the *Spoolman* APIs and built-in mode to the local ones, every
+ * destructive action must wait for confirmation, and cancel sends nothing.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { render } from '../utils';
+import InventoryPageRouter from '../../pages/InventoryPage';
+import { api, spoolbuddyApi } from '../../api/client';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  const fn = () => vi.fn();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getSettings: fn(),
+      getUiSettings: fn(),
+      getSpoolmanSettings: fn(),
+      getSpools: fn(),
+      getSpoolmanInventorySpools: fn(),
+      getAssignments: fn(),
+      getSpoolmanSlotAssignments: fn(),
+      getSpoolCatalog: fn(),
+      getLocations: fn(),
+      getLocationHASensors: fn(),
+      getLocationHASensorReadings: fn(),
+      // local
+      deleteSpool: fn(),
+      archiveSpool: fn(),
+      restoreSpool: fn(),
+      resetSpoolConsumedCounter: fn(),
+      bulkDeleteSpools: fn(),
+      bulkArchiveSpools: fn(),
+      bulkRestoreSpools: fn(),
+      bulkUpdateSpools: fn(),
+      bulkResetSpoolConsumedCounter: fn(),
+      // spoolman
+      deleteSpoolmanInventorySpool: fn(),
+      archiveSpoolmanInventorySpool: fn(),
+      restoreSpoolmanInventorySpool: fn(),
+      resetSpoolmanInventorySpoolConsumedCounter: fn(),
+      bulkDeleteSpoolmanInventorySpools: fn(),
+      bulkArchiveSpoolmanInventorySpools: fn(),
+      bulkRestoreSpoolmanInventorySpools: fn(),
+      bulkUpdateSpoolmanInventorySpools: fn(),
+      bulkResetSpoolmanInventorySpoolConsumedCounter: fn(),
+      syncSpoolmanSpoolWeight: fn(),
+    },
+    spoolbuddyApi: {
+      ...actual.spoolbuddyApi,
+      updateSpoolWeight: vi.fn(),
+    },
+  };
+});
+
+const m = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+const sb = spoolbuddyApi as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const LOCAL = {
+  delete: 'deleteSpool',
+  archive: 'archiveSpool',
+  restore: 'restoreSpool',
+  reset: 'resetSpoolConsumedCounter',
+  bulkDelete: 'bulkDeleteSpools',
+  bulkArchive: 'bulkArchiveSpools',
+  bulkRestore: 'bulkRestoreSpools',
+  bulkUpdate: 'bulkUpdateSpools',
+  bulkReset: 'bulkResetSpoolConsumedCounter',
+} as const;
+const SPOOLMAN = {
+  delete: 'deleteSpoolmanInventorySpool',
+  archive: 'archiveSpoolmanInventorySpool',
+  restore: 'restoreSpoolmanInventorySpool',
+  reset: 'resetSpoolmanInventorySpoolConsumedCounter',
+  bulkDelete: 'bulkDeleteSpoolmanInventorySpools',
+  bulkArchive: 'bulkArchiveSpoolmanInventorySpools',
+  bulkRestore: 'bulkRestoreSpoolmanInventorySpools',
+  bulkUpdate: 'bulkUpdateSpoolmanInventorySpools',
+  bulkReset: 'bulkResetSpoolmanInventorySpoolConsumedCounter',
+} as const;
+const ALL_MUTATIONS = [...Object.values(LOCAL), ...Object.values(SPOOLMAN), 'syncSpoolmanSpoolWeight'];
+
+function spool(id: number, over: Record<string, unknown> = {}) {
+  return {
+    id,
+    material: 'PLA',
+    subtype: null,
+    brand: `Brand${id}`,
+    color_name: 'Red',
+    rgba: 'FF0000FF',
+    label_weight: 1000,
+    core_weight: 250,
+    weight_used: 100 * id,
+    weight_used_baseline: 0,
+    slicer_filament: null,
+    slicer_filament_name: null,
+    nozzle_temp_min: null,
+    nozzle_temp_max: null,
+    note: null,
+    added_full: null,
+    last_used: null,
+    encode_time: null,
+    tag_uid: null,
+    tray_uuid: null,
+    data_origin: null,
+    tag_type: null,
+    archived_at: null,
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z',
+    k_profiles: [],
+    cost_per_kg: null,
+    last_scale_weight: null,
+    last_weighed_at: null,
+    ...over,
+  };
+}
+
+/** Table row of the spool whose brand is unique per spool. */
+async function row(id: number): Promise<HTMLElement> {
+  // The brand also appears in filter dropdowns; take the one inside a table row.
+  return waitFor(() => {
+    const tr = screen
+      .getAllByText(`Brand${id}`)
+      .map((el) => el.closest('tbody tr'))
+      .find(Boolean);
+    expect(tr).toBeTruthy();
+    return tr as HTMLElement;
+  });
+}
+
+/** The confirm dialog is the last rendered "Cancel"-bearing dialog. */
+function lastButton(name: string | RegExp): HTMLElement {
+  const all = screen.getAllByRole('button', { name });
+  return all[all.length - 1];
+}
+
+/** A bulk-toolbar button (per-row icon buttons share the names via title). */
+function toolbarButton(name: RegExp): HTMLElement {
+  const toolbar = screen.getByText('3 selected').parentElement as HTMLElement;
+  return within(toolbar).getByRole('button', { name });
+}
+
+function expectOnlyCalled(name: string) {
+  for (const other of ALL_MUTATIONS) {
+    if (other !== name) expect(m[other], `${other} must not be called`).not.toHaveBeenCalled();
+  }
+}
+
+describe.each([
+  ['built-in', false, LOCAL],
+  ['Spoolman', true, SPOOLMAN],
+] as const)('InventoryPage wiring (%s inventory)', (_label, isSpoolman, API) => {
+  let spools: ReturnType<typeof spool>[];
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    spools = [spool(1), spool(2), spool(3)];
+    m.getSettings.mockResolvedValue({ low_stock_threshold: 20, currency: 'USD', date_format: 'system' });
+    m.getUiSettings.mockResolvedValue({ low_stock_threshold: 20, currency: 'USD', date_format: 'system' });
+    m.getSpoolmanSettings.mockResolvedValue(
+      isSpoolman
+        ? { spoolman_enabled: 'true', spoolman_url: 'http://spoolman:7912' }
+        : { spoolman_enabled: 'false', spoolman_url: '' },
+    );
+    // Only the active backend returns rows, so a row rendered before the
+    // Spoolman-mode switch settles can never be the one a test clicks.
+    m.getSpools.mockImplementation(() => Promise.resolve(isSpoolman ? [] : spools));
+    m.getSpoolmanInventorySpools.mockImplementation(() => Promise.resolve(isSpoolman ? spools : []));
+    m.getAssignments.mockResolvedValue([]);
+    m.getSpoolmanSlotAssignments.mockResolvedValue([]);
+    m.getSpoolCatalog.mockResolvedValue([]);
+    m.getLocations.mockResolvedValue([]);
+    m.getLocationHASensors.mockResolvedValue([]);
+    m.getLocationHASensorReadings.mockResolvedValue([]);
+    for (const k of [API.delete, API.archive, API.restore, API.reset]) m[k].mockResolvedValue({});
+    m[API.bulkDelete].mockResolvedValue({ deleted: 3 });
+    m[API.bulkArchive].mockResolvedValue({ archived: 3 });
+    m[API.bulkRestore].mockResolvedValue({ restored: 3 });
+    m[API.bulkUpdate].mockResolvedValue({ updated: 3 });
+    m[API.bulkReset].mockResolvedValue({ reset: 3 });
+    m.syncSpoolmanSpoolWeight.mockResolvedValue({});
+    sb.updateSpoolWeight.mockResolvedValue({});
+  });
+
+  afterEach(() => {
+    vi.mocked(localStorage.getItem).mockReset();
+  });
+
+  it('delete: confirm sends only the mode\'s delete for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Delete'));
+    await screen.findByText('Are you sure you want to delete this spool? This cannot be undone.');
+    expect(m[API.delete]).not.toHaveBeenCalled();
+
+    fireEvent.click(lastButton('Delete'));
+    await waitFor(() => expect(m[API.delete]).toHaveBeenCalledTimes(1));
+    expect(m[API.delete].mock.calls[0][0]).toBe(2);
+    expectOnlyCalled(API.delete);
+  });
+
+  it('delete: cancel sends nothing', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Delete'));
+    await screen.findByText('Are you sure you want to delete this spool? This cannot be undone.');
+    fireEvent.click(lastButton('Cancel'));
+    await waitFor(() =>
+      expect(screen.queryByText('Are you sure you want to delete this spool? This cannot be undone.')).not.toBeInTheDocument(),
+    );
+    expectOnlyCalled('__none__');
+  });
+
+  it('archive: confirm sends only the mode\'s archive for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(3)).getByTitle('Archive'));
+    await screen.findByText('Are you sure you want to archive this spool?');
+    fireEvent.click(lastButton('Archive'));
+    await waitFor(() => expect(m[API.archive]).toHaveBeenCalledTimes(1));
+    expect(m[API.archive].mock.calls[0][0]).toBe(3);
+    expectOnlyCalled(API.archive);
+  });
+
+  it('reset counter: confirm sends only the mode\'s reset for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(1)).getByTitle(/Zero the consumed-grams counter/));
+    fireEvent.click(await waitFor(() => lastButton('Reset counter')));
+    await waitFor(() => expect(m[API.reset]).toHaveBeenCalledTimes(1));
+    expect(m[API.reset].mock.calls[0][0]).toBe(1);
+    expectOnlyCalled(API.reset);
+  });
+
+  it('restore (archived spool, archived view) sends only the mode\'s restore', async () => {
+    spools = [spool(1, { archived_at: '2026-04-01T00:00:00Z' })];
+    render(<InventoryPageRouter />);
+    fireEvent.click(await screen.findByRole('button', { name: 'Archived' }));
+    fireEvent.click(within(await row(1)).getByTitle('Restore'));
+    await waitFor(() => expect(m[API.restore]).toHaveBeenCalledTimes(1));
+    expect(m[API.restore].mock.calls[0][0]).toBe(1);
+    expectOnlyCalled(API.restore);
+  });
+
+  async function selectAllThree() {
+    render(<InventoryPageRouter />);
+    for (const id of [1, 2, 3]) {
+      fireEvent.click(within(await row(id)).getByRole('checkbox', { name: 'Select row' }));
+    }
+  }
+
+  it('bulk delete on a 3-spool selection sends the 3 ids after confirm; cancel sends nothing', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Delete$/));
+    await screen.findByText('Delete selected spools');
+    fireEvent.click(lastButton('Cancel'));
+    await waitFor(() => expect(screen.queryByText('Delete selected spools')).not.toBeInTheDocument());
+    expectOnlyCalled('__none__');
+
+    fireEvent.click(toolbarButton(/^Delete$/));
+    await screen.findByText('Delete selected spools');
+    fireEvent.click(lastButton('Delete'));
+    await waitFor(() => expect(m[API.bulkDelete]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkDelete].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkDelete);
+  });
+
+  it('bulk archive on a 3-spool selection sends the 3 ids after confirm', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Archive$/));
+    await screen.findByText('Archive selected spools');
+    fireEvent.click(lastButton('Archive'));
+    await waitFor(() => expect(m[API.bulkArchive]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkArchive].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkArchive);
+  });
+
+  it('bulk reset usage on a 3-spool selection sends the 3 ids after confirm', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Reset usage$/));
+    await screen.findByText('Reset usage on selected spools');
+    fireEvent.click(lastButton('Reset counter'));
+    await waitFor(() => expect(m[API.bulkReset]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkReset].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkReset);
+  });
+
+  it('bulk edit on a 3-spool selection sends (ids, patch) with only the ticked field', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Edit$/));
+    const noteLabel = await screen.findByText('Note', { selector: 'label' });
+    const fieldRow = noteLabel.closest('div.flex.items-start') as HTMLElement;
+    fireEvent.click(within(fieldRow).getByRole('checkbox'));
+    fireEvent.change(fieldRow.querySelector('textarea') as HTMLElement, { target: { value: 'batch 7' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Apply to 3 spools' }));
+
+    await waitFor(() => expect(m[API.bulkUpdate]).toHaveBeenCalledTimes(1));
+    const [ids, patch] = m[API.bulkUpdate].mock.calls[0];
+    expect([...ids].sort()).toEqual([1, 2, 3]);
+    expect(patch).toEqual({ note: 'batch 7' });
+    expectOnlyCalled(API.bulkUpdate);
+  });
+
+  it('sync to scale weight sends (spool.id, last_scale_weight) to the mode\'s endpoint', async () => {
+    // setup.ts replaces localStorage with vi.fn stubs; feed the column config through it.
+    const columns = JSON.stringify([{ id: 'weight_check', label: 'Weight Check', visible: true }]);
+    vi.mocked(localStorage.getItem).mockImplementation((key: string) =>
+      key === 'bambuddy-inventory-columns' ? columns : null,
+    );
+    // Calculated gross = 1000-200+250 = 1050; scale 812 -> mismatch -> sync button.
+    spools = [spool(1), spool(2, { last_scale_weight: 812 })];
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Sync: trust scale weight and reset tracking'));
+
+    if (isSpoolman) {
+      await waitFor(() => expect(m.syncSpoolmanSpoolWeight).toHaveBeenCalledWith(2, 812));
+      expect(sb.updateSpoolWeight).not.toHaveBeenCalled();
+    } else {
+      await waitFor(() => expect(sb.updateSpoolWeight).toHaveBeenCalledWith(2, 812));
+      expect(m.syncSpoolmanSpoolWeight).not.toHaveBeenCalled();
+    }
+  });
+});

frontend/src/__tests__/pages/MaintenancePageWiring.test.tsx

@@ -0,0 +1,307 @@
+/**
+ * MaintenancePage wiring: which item / printer / type each control sends,
+ * the confirm on deleting maintenance types, and the permission gates.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { MaintenancePage } from '../../pages/MaintenancePage';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+function item(id: number, printerId: number, typeId: number, name: string, overrides: Record<string, unknown> = {}) {
+  return {
+    id,
+    printer_id: printerId,
+    printer_name: printerId === 1 ? 'Alpha Printer' : 'Beta Printer',
+    printer_model: 'X1C',
+    maintenance_type_id: typeId,
+    maintenance_type_name: name,
+    maintenance_type_icon: null,
+    maintenance_type_wiki_url: 'https://wiki.example/doc',
+    enabled: true,
+    interval_hours: 100,
+    interval_type: 'hours',
+    current_hours: 50,
+    hours_since_maintenance: 50,
+    hours_until_due: 50,
+    days_since_maintenance: null,
+    days_until_due: null,
+    is_due: false,
+    is_warning: false,
+    last_performed_at: null,
+    ...overrides,
+  };
+}
+
+const OVERVIEW = [
+  {
+    printer_id: 1,
+    printer_name: 'Alpha Printer',
+    printer_model: 'X1C',
+    total_print_hours: 10.4,
+    due_count: 0,
+    warning_count: 0,
+    maintenance_items: [item(11, 1, 1, 'Nozzle Task')],
+  },
+  {
+    printer_id: 2,
+    printer_name: 'Beta Printer',
+    printer_model: 'X1C',
+    total_print_hours: 250.2,
+    due_count: 0,
+    warning_count: 0,
+    maintenance_items: [item(21, 2, 1, 'Nozzle Task')],
+  },
+];
+
+const TYPES = [
+  { id: 1, name: 'Clean Nozzle', description: null, default_interval_hours: 100, interval_type: 'hours', icon: null, wiki_url: null, is_system: true, created_at: '2026-01-01T00:00:00Z' },
+  { id: 7, name: 'Custom Belt Check', description: null, default_interval_hours: 300, interval_type: 'hours', icon: null, wiki_url: null, is_system: false, created_at: '2026-01-01T00:00:00Z' },
+];
+
+let sent: Sent[];
+
+async function record(request: Request) {
+  const url = new URL(request.url);
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: url.pathname, search: url.search, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  server.use(
+    http.get('*/api/v1/maintenance/overview', () => HttpResponse.json(OVERVIEW)),
+    http.get('*/api/v1/maintenance/types', () => HttpResponse.json(TYPES)),
+    http.post('*/api/v1/maintenance/items/:id/perform', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(item(21, 2, 1, 'Clean Nozzle'));
+    }),
+    http.patch('*/api/v1/maintenance/items/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(item(21, 2, 1, 'Clean Nozzle'));
+    }),
+    http.patch('*/api/v1/maintenance/printers/:id/hours', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ printer_id: 2, total_hours: 123, archive_hours: 0, offset_hours: 123 });
+    }),
+    http.delete('*/api/v1/maintenance/types/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ status: 'deleted' });
+    }),
+    http.post('*/api/v1/maintenance/types/restore-defaults', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ restored: 1 });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  vi.restoreAllMocks();
+});
+
+/** The printer card whose heading is `name`. */
+async function printerCard(name: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name });
+  let el: HTMLElement | null = heading;
+  while (el && !within(el).queryByText('Total Print Time')) el = el.parentElement;
+  // `el` is the card header; its parent is the card, which also holds the expanded items.
+  return el!.parentElement!;
+}
+
+async function openSettings(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByRole('button', { name: 'Settings' }));
+}
+
+function typeTile(name: string): HTMLElement {
+  return screen.getByText(name).closest('.rounded-xl') as HTMLElement;
+}
+
+describe('MaintenancePage wiring: status tab', () => {
+  it('Reset on a task sends performMaintenance for that printer\'s item only', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    await user.click(await within(beta).findByRole('button', { name: 'Reset' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/maintenance/items/21/perform' });
+    expect(await screen.findByText('Maintenance marked as complete')).toBeInTheDocument();
+  });
+
+  it('the item toggle PATCHes { enabled } for that item', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const alpha = await printerCard('Alpha Printer');
+    await user.click(within(alpha).getByRole('button', { name: /expand/i }));
+    await user.click(await within(alpha).findByRole('switch'));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'PATCH', path: '/api/v1/maintenance/items/11', search: '', body: { enabled: false } });
+  });
+
+  it('editing print hours sends setPrinterHours for that printer', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByText('Total Print Time'));
+    const input = within(beta).getByRole('spinbutton');
+    expect(input).toHaveValue(250);
+    await user.clear(input);
+    await user.type(input, '123');
+    await user.click(within(beta).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'PATCH',
+      path: '/api/v1/maintenance/printers/2/hours',
+      search: '?total_hours=123',
+    });
+  });
+
+  it('cancelling the hours edit sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByText('Total Print Time'));
+    await user.type(within(beta).getByRole('spinbutton'), '9');
+    await user.click(within(beta).getByRole('button', { name: 'Cancel' }));
+
+    expect(within(beta).queryByRole('spinbutton')).not.toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('MaintenancePage wiring: settings tab', () => {
+  it('deleting a default type asks first; confirming sends DELETE for that type', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    await user.click(within(tile).getByRole('button'));
+    expect(await screen.findByText('Delete default maintenance task?')).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/maintenance/types/1' });
+  });
+
+  it('cancelling the default-type delete sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    await user.click(within(tile).getByRole('button'));
+    await screen.findByText('Delete default maintenance task?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete default maintenance task?')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('a custom type is deleted only after the browser confirm says yes', async () => {
+    const confirmSpy = vi.spyOn(window, 'confirm').mockReturnValue(false);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Custom Belt Check'));
+    const trash = within(tile).getAllByRole('button').at(-1)!;
+    await user.click(trash);
+    expect(confirmSpy).toHaveBeenCalledTimes(1);
+    expect(writes()).toEqual([]);
+
+    confirmSpy.mockReturnValue(true);
+    await user.click(trash);
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/maintenance/types/7' });
+  });
+
+  it('Restore Default Tasks sends the restore request', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    await user.click(await screen.findByRole('button', { name: 'Restore Default Tasks' }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/maintenance/types/restore-defaults' });
+  });
+});
+
+describe('MaintenancePage wiring: permissions', () => {
+  function signInWith(permissions: string[]) {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions,
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+  }
+
+  it('a read-only user gets disabled controls and nothing is sent', async () => {
+    signInWith(['maintenance:read']);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await waitFor(() =>
+      expect(within(beta).getByTitle('You do not have permission to edit print hours')).toBeInTheDocument(),
+    );
+    await user.click(within(beta).getByText('Total Print Time'));
+    expect(within(beta).queryByRole('spinbutton')).not.toBeInTheDocument();
+
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    expect(await within(beta).findByRole('button', { name: 'Reset' })).toBeDisabled();
+    expect(within(beta).getByRole('switch')).toBeDisabled();
+
+    await openSettings(user);
+    expect(await screen.findByRole('button', { name: 'Restore Default Tasks' })).toBeDisabled();
+    const tile = typeTile('Clean Nozzle');
+    expect(within(tile).getByRole('button')).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('maintenance:update enables Reset but not the type delete', async () => {
+    signInWith(['maintenance:read', 'maintenance:update']);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    await waitFor(() => expect(within(beta).getByRole('button', { name: 'Reset' })).not.toBeDisabled());
+
+    await openSettings(user);
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    expect(within(tile).getByRole('button')).toBeDisabled();
+  });
+});

frontend/src/__tests__/pages/PrintersPageAmsSlotActionsWiring.test.tsx

@@ -0,0 +1,448 @@
+/**
+ * AMS slot / unit action wiring on the printer card.
+ *
+ * - "Re-read RFID" posts the refresh for the hovered slot's (amsId, slotId),
+ *   including an AMS-HT (unit id 128+); the external holder offers no re-read.
+ * - "Unassign" routes by inventory mode: the built-in inventory deletes the
+ *   (printer, ams, tray) assignment, Spoolman mode deletes the Spoolman slot
+ *   assignment by spool id. Neither may hit the other's endpoint.
+ * - AMS Filament Backup toggle, stop drying, and the AMS friendly-name editor
+ *   (save / clear, keyed by the unit's serial).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse, type JsonBodyType } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 5;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'AMS X1C',
+  ip_address: '192.0.2.105',
+  serial_number: '00M09A350100005',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+// No tray_uuid / tag_uid: a third-party spool, so Unassign is offered.
+const baseTray = {
+  tray_color: 'FF0000FF',
+  tray_type: 'PLA',
+  tray_sub_brands: 'PLA Basic',
+  tray_id_name: '',
+  tray_info_idx: 'GFL99',
+  remain: 80,
+  k: 0.02,
+  cali_idx: null,
+  tag_uid: null,
+  tray_uuid: null,
+  nozzle_temp_min: 190,
+  nozzle_temp_max: 230,
+  drying_temp: null,
+  drying_time: null,
+  state: 11,
+};
+
+const amsUnit = (extra: Record<string, unknown> = {}) => ({
+  id: 0,
+  humidity: 30,
+  temp: 25,
+  is_ams_ht: false,
+  serial_number: 'AMS0SERIAL',
+  sw_ver: '1.0.0',
+  dry_time: 0,
+  dry_status: 0,
+  dry_sub_status: 0,
+  dry_sf_reason: [],
+  module_type: 'ams',
+  tray: [0, 1, 2, 3].map((id) => ({ id, ...baseTray })),
+  ...extra,
+});
+
+const htUnit = {
+  id: 128,
+  humidity: 20,
+  temp: 30,
+  is_ams_ht: true,
+  serial_number: 'HT128SERIAL',
+  sw_ver: '1.0.0',
+  dry_time: 0,
+  dry_status: 0,
+  dry_sub_status: 0,
+  dry_sf_reason: [],
+  module_type: 'n3s',
+  tray: [{ id: 0, ...baseTray, tray_type: 'PETG' }],
+};
+
+const statusWith = (ams: unknown[], extra: Record<string, unknown> = {}) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  vt_tray: [],
+  ams,
+  ...extra,
+});
+
+const inventorySpool = {
+  id: 77,
+  material: 'PLA',
+  subtype: 'Basic',
+  brand: 'Generic',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 1000,
+  weight_used: 200,
+};
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+interface SetupOptions {
+  status: JsonBodyType;
+  spoolman?: boolean;
+  amsLabels?: Record<number, string>;
+}
+
+function setup({ status, spoolman = false, amsLabels = {} }: SetupOptions) {
+  const sent: Sent[] = [];
+  const record =
+    (response: JsonBodyType = { success: true, message: 'ok', status: 'ok' }) =>
+    async ({ request }: { request: Request }) => {
+      const url = new URL(request.url);
+      const text = await request.text();
+      sent.push({ method: request.method, path: url.pathname, search: url.search, body: text ? JSON.parse(text) : null });
+      return HttpResponse.json(response);
+    };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(status)),
+    http.get('/api/v1/printers/:id/ams-labels', () => HttpResponse.json(amsLabels)),
+    http.get('/api/v1/spoolman/status', () =>
+      HttpResponse.json({ enabled: spoolman, connected: spoolman, url: spoolman ? 'http://spoolman' : null })
+    ),
+    // Built-in inventory: slot 1 of AMS 0 holds spool 77.
+    http.get('/api/v1/inventory/assignments', () =>
+      HttpResponse.json(
+        spoolman
+          ? []
+          : [
+              {
+                id: 1,
+                spool_id: 77,
+                printer_id: PRINTER_ID,
+                printer_name: 'AMS X1C',
+                ams_id: 0,
+                tray_id: 1,
+                fingerprint_color: null,
+                fingerprint_type: null,
+                spool: inventorySpool,
+                configured: true,
+                created_at: '2024-01-01T00:00:00Z',
+              },
+            ]
+      )
+    ),
+    // Spoolman: slot 1 of AMS 0 holds Spoolman spool 55.
+    http.get('/api/v1/spoolman/inventory/slot-assignments/all', () =>
+      HttpResponse.json(
+        spoolman
+          ? [{ printer_id: PRINTER_ID, printer_name: 'AMS X1C', ams_id: 0, tray_id: 1, spoolman_spool_id: 55, ams_label: null }]
+          : []
+      )
+    ),
+    http.get('/api/v1/spoolman/inventory/spools', () =>
+      HttpResponse.json(spoolman ? [{ ...inventorySpool, id: 55 }] : [])
+    ),
+    http.post('/api/v1/printers/:id/ams/:amsId/slot/:slotId/refresh', record()),
+    http.delete('/api/v1/inventory/assignments/:pid/:aid/:tid', record({ status: 'ok' })),
+    http.delete('/api/v1/spoolman/inventory/slot-assignments/:id', record({ ...inventorySpool, id: 55 })),
+    http.post('/api/v1/printers/:id/ams-backup', record({ success: true, ams_filament_backup: true })),
+    http.post('/api/v1/printers/:id/drying/stop', record({ status: 'ok', ams_id: 0 })),
+    http.put('/api/v1/printers/:id/ams-labels/:amsId', record({ ams_id: 0, label: 'x' })),
+    http.delete('/api/v1/printers/:id/ams-labels/:amsId', record({ success: true })),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+async function slots() {
+  await waitFor(() => expect(screen.getAllByTestId('filament-slot').length).toBeGreaterThan(0));
+  return screen.getAllByTestId('filament-slot');
+}
+
+/** Hover a slot and wait for its portaled card to show the given action. */
+async function hover(slot: Element, action: string) {
+  fireEvent.mouseEnter(slot);
+  return screen.findByRole('button', { name: action });
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 50));
+
+describe('AMS slot: Re-read RFID', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('posts refresh for the hovered regular-AMS slot (ams 0, slot 2)', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    await user.click(await hover((await slots())[2], 'Re-read RFID'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams/0/slot/2/refresh`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('posts refresh for an AMS-HT with its unit id 128', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([htUnit]) });
+
+    await user.click(await hover((await slots())[0], 'Re-read RFID'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams/128/slot/0/refresh`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('the external spool holder offers no RFID re-read', async () => {
+    setup({
+      status: statusWith([], { vt_tray: [{ id: 254, ...baseTray, tray_color: 'FFFFFFFF' }] }),
+    });
+    const [ext] = await slots();
+    // Load is the external slot's first action; wait for it, then check.
+    await hover(ext, 'Load');
+    expect(screen.queryByRole('button', { name: 'Re-read RFID' })).toBeNull();
+  });
+
+  it('without printers:ams_rfid the re-read is disabled and sends nothing', async () => {
+    permissions.denied = new Set(['printers:ams_rfid']);
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const button = await hover((await slots())[0], 'Re-read RFID');
+    expect(button).toBeDisabled();
+    expect(button).toHaveAttribute('title', 'You do not have permission to re-read AMS RFID');
+    await user.click(button);
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('is disabled while the printer is RUNNING', async () => {
+    const sent = setup({ status: statusWith([amsUnit()], { state: 'RUNNING' }) });
+    const button = await hover((await slots())[0], 'Re-read RFID');
+    expect(button).toBeDisabled();
+    await settle();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('AMS slot: Unassign routes by inventory mode', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('built-in inventory: DELETE /inventory/assignments/{printer}/{ams}/{tray}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    await user.click(await hover((await slots())[1], 'Unassign'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'DELETE', path: `/api/v1/inventory/assignments/${PRINTER_ID}/0/1`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('Spoolman mode: DELETE /spoolman/inventory/slot-assignments/{spoolmanSpoolId}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), spoolman: true });
+
+    await user.click(await hover((await slots())[1], 'Unassign'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'DELETE', path: '/api/v1/spoolman/inventory/slot-assignments/55', search: '', body: null },
+      ])
+    );
+  });
+
+  it('an unassigned slot offers no Unassign', async () => {
+    setup({ status: statusWith([amsUnit()]) });
+    await hover((await slots())[2], 'Re-read RFID');
+    expect(screen.queryByRole('button', { name: 'Unassign' })).toBeNull();
+  });
+});
+
+describe('AMS unit: backup, drying, friendly name', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('AMS Filament Backup toggle POSTs ams-backup?enabled=true when off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: false }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is OFF. Click to enable.'));
+    await user.click(await screen.findByRole('switch'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams-backup`, search: '?enabled=true', body: null },
+      ])
+    );
+  });
+
+  it('AMS Filament Backup toggle POSTs enabled=false when on', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: true }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is ON. Click to disable.'));
+    await user.click(await screen.findByRole('switch'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0].search).toBe('?enabled=false');
+  });
+
+  it('AMS Filament Backup switch is disabled without printers:control', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: false }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is OFF. Click to enable.'));
+    const toggle = await screen.findByRole('switch');
+    expect(toggle).toBeDisabled();
+    await user.click(toggle);
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('Stop Drying on a drying AMS 2 Pro POSTs drying/stop with its ams id', async () => {
+    const user = userEvent.setup();
+    const sent = setup({
+      status: statusWith([amsUnit({ id: 1, module_type: 'n3f', dry_time: 120, serial_number: 'N3F1' })], {
+        supports_drying: true,
+      }),
+    });
+
+    const [stop] = await screen.findAllByTitle('Stop Drying');
+    await user.click(stop);
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/drying/stop`, search: '?ams_id=1', body: null },
+      ])
+    );
+  });
+
+  async function openNameCard() {
+    // The unit label ("AMS-A" style, or the saved friendly name) is the hover trigger.
+    const label = await screen.findByText(/^(AMS[- ]?A|Left box)$/);
+    fireEvent.mouseEnter(label.parentElement!);
+    return (await screen.findByText('AMS0SERIAL')).closest('div.w-52') as HTMLElement;
+  }
+
+  it('saving a friendly name PUTs the trimmed label with the unit serial', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const card = await openNameCard();
+    await user.type(within(card).getByPlaceholderText('e.g. AMS Friendly Name'), '  Left box  ');
+    await user.click(within(card).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        {
+          method: 'PUT',
+          path: `/api/v1/printers/${PRINTER_ID}/ams-labels/0`,
+          search: '',
+          body: { label: 'Left box', ams_serial: 'AMS0SERIAL' },
+        },
+      ])
+    );
+  });
+
+  it('Clear DELETEs the label for that unit serial', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), amsLabels: { 0: 'Left box' } });
+
+    const card = await openNameCard();
+    await user.click(within(card).getByRole('button', { name: 'Clear' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        {
+          method: 'DELETE',
+          path: `/api/v1/printers/${PRINTER_ID}/ams-labels/0`,
+          search: '?ams_serial=AMS0SERIAL',
+          body: null,
+        },
+      ])
+    );
+  });
+
+  it('saving an emptied name DELETEs instead of saving a blank label', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), amsLabels: { 0: 'Left box' } });
+
+    const card = await openNameCard();
+    const input = within(card).getByPlaceholderText('e.g. AMS Friendly Name');
+    await user.clear(input);
+    await user.type(input, '   ');
+    await user.click(within(card).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({ method: 'DELETE', search: '?ams_serial=AMS0SERIAL' });
+  });
+
+  it('without printers:update the name field is read-only and has no Save', async () => {
+    permissions.denied = new Set(['printers:update']);
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const card = await openNameCard();
+    expect(within(card).getByRole('textbox')).toBeDisabled();
+    expect(within(card).queryByRole('button', { name: 'Save' })).toBeNull();
+    await settle();
+    expect(sent).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/PrintersPageBulkActionsWiring.test.tsx

@@ -0,0 +1,272 @@
+/**
+ * PrintersPage bulk actions: the requests go to exactly the selected printers.
+ *
+ * Three printers, all of which could take a Stop. Selecting two of them (by
+ * clicking cards, by state, or by location) and confirming must stop those two
+ * and never the third; cancelling the confirm must stop nothing. Bulk selection
+ * needs printers:control, Clear Bed needs printers:clear_plate.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const basePrinter = {
+  ip_address: '192.0.2.100',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const printers = [
+  { ...basePrinter, id: 11, name: 'Alpha', serial_number: '01P00A000000011', location: 'Lab' },
+  { ...basePrinter, id: 12, name: 'Bravo', serial_number: '01P00A000000012', location: 'Lab' },
+  { ...basePrinter, id: 13, name: 'Charlie', serial_number: '01P00A000000013', location: 'Shed' },
+];
+
+// 11 printing, 12 paused, 13 printing: every one of them is stoppable.
+const defaultStates: Record<string, string> = { '11': 'RUNNING', '12': 'PAUSE', '13': 'RUNNING' };
+let states: Record<string, string> = { ...defaultStates };
+
+let calls: { action: string; id: string }[] = [];
+
+function renderPage() {
+  calls = [];
+  const record = (action: string) => ({ params }: { params: Record<string, string | readonly string[] | undefined> }) => {
+    calls.push({ action, id: params.id as string });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json(printers)),
+    http.get('/api/v1/printers/:id/status', ({ params }) =>
+      HttpResponse.json({
+        connected: true,
+        state: states[params.id as string],
+        progress: 40,
+        layer_num: 10,
+        total_layers: 100,
+        temperatures: { nozzle: 220, bed: 60, chamber: 30 },
+        remaining_time: 600,
+        filename: 'part.gcode',
+        wifi_signal: -40,
+        speed_level: 2,
+        vt_tray: [],
+        ams: [],
+        awaiting_plate_clear: params.id === '12',
+      }),
+    ),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.post('/api/v1/printers/:id/print/stop', record('stop')),
+    http.post('/api/v1/printers/:id/print/pause', record('pause')),
+    http.post('/api/v1/printers/:id/print/resume', record('resume')),
+    http.post('/api/v1/printers/:id/clear-plate', record('clearPlate')),
+    http.post('/api/v1/printers/:id/hms/clear', record('clearHMS')),
+  );
+  render(<PrintersPage />);
+}
+
+const card = (id: number) => document.getElementById(`printer-card-${id}`) as HTMLElement;
+
+async function waitForCards() {
+  await waitFor(() => {
+    for (const p of printers) expect(card(p.id)).not.toBeNull();
+  });
+  // Every card's status must be in the cache before bulk enablement is read.
+  await waitFor(() => {
+    for (const p of printers) expect(card(p.id).textContent).toContain('Connected');
+  });
+}
+
+async function enterSelectionMode(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(screen.getAllByTitle('Select')[0]);
+  await waitFor(() => expect(card(11).querySelector('div.absolute.inset-0.z-20')).not.toBeNull());
+}
+
+async function clickCard(user: ReturnType<typeof userEvent.setup>, id: number) {
+  await user.click(card(id).querySelector('div.absolute.inset-0.z-20') as HTMLElement);
+}
+
+const toolbar = () => screen.getByText(/^\d+ selected$/).closest('div.fixed') as HTMLElement;
+
+async function stopAndConfirm(user: ReturnType<typeof userEvent.setup>, expectedCount: number) {
+  const stop = within(toolbar()).getByRole('button', { name: 'Stop' });
+  await waitFor(() => expect(stop).toBeEnabled());
+  await user.click(stop);
+  expect(await screen.findByText(`Stop ${expectedCount} Prints`)).toBeInTheDocument();
+  await user.click(screen.getByRole('button', { name: 'Stop All' }));
+}
+
+const stoppedIds = () => calls.filter((c) => c.action === 'stop').map((c) => c.id).sort();
+
+describe('PrintersPage bulk actions wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control', 'printers:clear_plate'];
+    states = { ...defaultStates };
+  });
+
+  it('stops exactly the two selected printers, not the third', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+    expect(within(toolbar()).getByText('2 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 2);
+
+    await waitFor(() => expect(stoppedIds()).toEqual(['11', '12']));
+    // Settle, then make sure the unselected printer was never touched.
+    await screen.findByText('Stop completed on 2 printer(s)');
+    expect(calls.every((c) => c.id !== '13')).toBe(true);
+    expect(calls.every((c) => c.action === 'stop')).toBe(true);
+  });
+
+  it('skips a selected printer that has nothing to stop', async () => {
+    states = { ...defaultStates, '12': 'IDLE' };
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+
+    await stopAndConfirm(user, 2);
+    await waitFor(() => expect(stoppedIds()).toEqual(['11']));
+    await screen.findByText('Stop completed on 1 printer(s)');
+    expect(calls).toHaveLength(1);
+  });
+
+  it('cancelling the bulk stop confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 13);
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Stop' }));
+    expect(await screen.findByText('Stop 2 Prints')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Stop 2 Prints')).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(calls).toEqual([]);
+  });
+
+  it('pause goes only to the selected printers that are printing', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12); // paused: not applicable for pause
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Pause' }));
+    await user.click(await screen.findByRole('button', { name: 'Pause All' }));
+
+    await waitFor(() => expect(calls).toEqual([{ action: 'pause', id: '11' }]));
+  });
+
+  it('select by state picks only printers in that state', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+
+    await user.click(within(toolbar()).getByRole('button', { name: /Select by State/ }));
+    await user.click(within(toolbar()).getByRole('button', { name: /^Printing/ }));
+    expect(within(toolbar()).getByText('2 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 2);
+    await waitFor(() => expect(stoppedIds()).toEqual(['11', '13']));
+    await screen.findByText('Stop completed on 2 printer(s)');
+    expect(calls.some((c) => c.id === '12')).toBe(false);
+  });
+
+  it('select by location picks only printers at that location', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+
+    await user.click(within(toolbar()).getByRole('button', { name: /Select by Location/ }));
+    await user.click(within(toolbar()).getByRole('button', { name: 'Shed' }));
+    expect(within(toolbar()).getByText('1 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 1);
+    await waitFor(() => expect(stoppedIds()).toEqual(['13']));
+    await screen.findByText('Stop completed on 1 printer(s)');
+    expect(calls).toHaveLength(1);
+  });
+
+  it('clear bed goes only to selected printers awaiting a plate clear', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Clear Bed' }));
+    await user.click(await screen.findByRole('button', { name: 'Clear All' }));
+
+    await waitFor(() => expect(calls).toEqual([{ action: 'clearPlate', id: '12' }]));
+  });
+
+  it('bulk selection is unavailable without printers:control', async () => {
+    permissions.granted = ['printers:clear_plate'];
+    renderPage();
+    await waitForCards();
+    for (const b of screen.getAllByTitle('Select')) expect(b).toBeDisabled();
+    expect(screen.queryByText(/^\d+ selected$/)).toBeNull();
+  });
+
+  it('Clear Bed is disabled without printers:clear_plate', async () => {
+    permissions.granted = ['printers:control'];
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 12);
+
+    const clearBed = within(toolbar()).getByRole('button', { name: 'Clear Bed' });
+    expect(clearBed).toBeDisabled();
+    await user.click(clearBed);
+    expect(screen.queryByText(/Clear \d+ Print Beds/)).toBeNull();
+    expect(calls).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/PrintersPageDeletePowerWiring.test.tsx

@@ -0,0 +1,410 @@
+/**
+ * Printer card wiring for the destructive / out-of-service actions:
+ * delete printer (with or without its archives), smart-plug power off and
+ * auto-off, maintenance mode and the plate-detection toggle.
+ *
+ * Every test asserts the request that actually leaves the browser, and the
+ * destructive ones also pin that cancelling sends nothing.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { QueryClient } from '@tanstack/react-query';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 4;
+const PLUG_ID = 42;
+
+const basePrinter = {
+  id: PRINTER_ID,
+  name: 'Garage P1S',
+  ip_address: '192.0.2.104',
+  serial_number: '01P00A000000004',
+  access_code: '12345678',
+  model: 'P1S',
+  enabled: true,
+  is_active: true,
+  plate_detection_enabled: false,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusFor = (state: string) => ({
+  connected: true,
+  state,
+  progress: state === 'RUNNING' ? 40 : 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -40,
+  speed_level: 2,
+  vt_tray: [],
+  ams: [],
+});
+
+const smartPlug = {
+  id: PLUG_ID,
+  name: 'Printer Plug',
+  plug_type: 'tasmota',
+  ip_address: '192.0.2.50',
+  ha_entity_id: null,
+  enabled: true,
+  printer_id: PRINTER_ID,
+  auto_on: false,
+  auto_off: false,
+  auto_off_executed: false,
+};
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+interface SetupOptions {
+  state?: string;
+  printer?: Partial<typeof basePrinter>;
+  withPlug?: boolean;
+}
+
+function setup({ state = 'IDLE', printer = {}, withPlug = false }: SetupOptions = {}) {
+  const sent: Sent[] = [];
+  let assignmentFetches = 0;
+  const record = async ({ request }: { request: Request }) => {
+    const url = new URL(request.url);
+    const text = await request.text();
+    sent.push({
+      method: request.method,
+      path: url.pathname,
+      search: url.search,
+      body: text ? JSON.parse(text) : null,
+    });
+    return HttpResponse.json({ success: true, status: 'deleted', archives_deleted: true, action: 'off' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([{ ...basePrinter, ...printer }])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusFor(state))),
+    http.get('/api/v1/smart-plugs/by-printer/:id', () => HttpResponse.json(withPlug ? smartPlug : null)),
+    http.get('/api/v1/smart-plugs/:id/status', () =>
+      HttpResponse.json({ state: 'ON', reachable: true, device_name: 'Plug', energy: { power: 120 } })
+    ),
+    http.get('/api/v1/inventory/assignments', () => {
+      assignmentFetches += 1;
+      return HttpResponse.json([]);
+    }),
+    http.delete('/api/v1/printers/:id', record),
+    http.patch('/api/v1/printers/:id', record),
+    http.post('/api/v1/smart-plugs/:id/control', record),
+    http.patch('/api/v1/smart-plugs/:id', record),
+  );
+  render(<PrintersPage />);
+  return { sent, assignmentFetches: () => assignmentFetches };
+}
+
+/** Opens the card's 3-dot overflow menu. */
+async function openMenu(user: ReturnType<typeof userEvent.setup>) {
+  // The trigger's title is t('common.more', 'More'); match loosely so the
+  // label wording does not matter, but it must be the card's More button.
+  await screen.findByText('Garage P1S');
+  const trigger = (await screen.findAllByTitle(/more/i)).find((el) => el.tagName === 'BUTTON');
+  expect(trigger).toBeDefined();
+  await user.click(trigger!);
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 50));
+
+describe('PrintersPage delete printer wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('confirm with "Delete print archives" checked sends DELETE ?delete_archives=true', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const heading = await screen.findByText('Delete Printer');
+    const dialog = heading.closest('div.fixed') as HTMLElement;
+    expect(within(dialog).getByRole('checkbox')).toBeChecked();
+    expect(sent).toEqual([]);
+
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'DELETE',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      search: '?delete_archives=true',
+    });
+  });
+
+  it('confirm with the archives box unchecked sends delete_archives=false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('checkbox'));
+    expect(within(dialog).getByRole('checkbox')).not.toBeChecked();
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'DELETE',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      search: '?delete_archives=false',
+    });
+  });
+
+  it('cancel sends nothing and resets the archives box for next time', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    let dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('checkbox'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Delete Printer')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    expect(within(dialog).getByRole('checkbox')).toBeChecked();
+  });
+
+  it('without printers:delete the menu entry opens nothing and sends nothing', async () => {
+    permissions.denied = new Set(['printers:delete']);
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    const entry = await screen.findByRole('button', { name: 'Delete' });
+    expect(entry).toHaveAttribute('title', 'You do not have permission to delete printers');
+    await user.click(entry);
+    await settle();
+    expect(screen.queryByText('Delete Printer')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+
+  // The backend drops the deleted printer's slot assignments; a cached list
+  // would keep showing spools as assigned to a printer that no longer exists.
+  it('a successful delete refetches the spool assignments', async () => {
+    const user = userEvent.setup();
+    const { sent, assignmentFetches } = setup();
+
+    await waitFor(() => expect(assignmentFetches()).toBeGreaterThan(0));
+    await settle();
+    const before = assignmentFetches();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+
+    await waitFor(() => expect(assignmentFetches()).toBeGreaterThan(before));
+  });
+
+  it('a successful delete also refreshes the Spoolman slot assignments', async () => {
+    const invalidate = vi.spyOn(QueryClient.prototype, 'invalidateQueries');
+    try {
+      const user = userEvent.setup();
+      const { sent } = setup();
+
+      await openMenu(user);
+      await user.click(await screen.findByRole('button', { name: 'Delete' }));
+      const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+      await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+      await waitFor(() => expect(sent).toHaveLength(1));
+
+      await waitFor(() =>
+        expect(invalidate).toHaveBeenCalledWith({ queryKey: ['spoolman-slot-assignments'] })
+      );
+    } finally {
+      invalidate.mockRestore();
+    }
+  });
+});
+
+describe('PrintersPage smart plug power wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('power off while RUNNING shows the printing warning; confirm POSTs action=off to the plug', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await user.click(await screen.findByTitle('Turn off'));
+    expect(await screen.findByText(/"Garage P1S" is currently printing!/)).toBeInTheDocument();
+    expect(sent).toEqual([]);
+
+    await user.click(screen.getByRole('button', { name: 'Power Off' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'POST',
+      path: `/api/v1/smart-plugs/${PLUG_ID}/control`,
+      body: { action: 'off' },
+    });
+  });
+
+  it('power off -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await user.click(await screen.findByTitle('Turn off'));
+    await screen.findByText('Power Off Printer');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Power Off Printer')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('auto-off toggle PATCHes the plug with the flipped auto_off', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ withPlug: true });
+
+    await user.click(await screen.findByTitle('Auto power-off after print'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/smart-plugs/${PLUG_ID}`,
+      body: { auto_off: true },
+    });
+  });
+
+  it('without smart_plugs:control the power and auto-off buttons are disabled', async () => {
+    permissions.denied = new Set(['smart_plugs:control']);
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await screen.findByText('Printer Plug');
+    const buttons = screen.getAllByTitle('You do not have permission to control smart plugs');
+    expect(buttons).toHaveLength(2);
+    for (const b of buttons) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await settle();
+    expect(screen.queryByText('Power Off Printer')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage maintenance mode and plate detection wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('entering maintenance on an idle printer PATCHes {is_active:false}', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: false },
+    });
+  });
+
+  it('entering maintenance mid-print asks first; cancel sends nothing, confirm sends is_active:false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING' });
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    await screen.findByText('Enter maintenance mode mid-print?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Enter maintenance mode mid-print?')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    const title = await screen.findByText('Enter maintenance mode mid-print?');
+    const modal = title.closest('[role="dialog"]') ?? title.parentElement!.parentElement!.parentElement!;
+    const confirm = within(modal as HTMLElement)
+      .getAllByRole('button', { name: 'Enter maintenance mode' })
+      .at(-1)!;
+    await user.click(confirm);
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: false },
+    });
+  });
+
+  it('exiting maintenance PATCHes {is_active:true}', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { is_active: false } });
+
+    await user.click(await screen.findByRole('button', { name: 'Exit maintenance' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: true },
+    });
+  });
+
+  it('plate-detection toggle PATCHes the inverse of the current setting', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { plate_detection_enabled: false } });
+
+    await user.click(await screen.findByTitle('Plate check disabled - Click to enable'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { plate_detection_enabled: true },
+    });
+  });
+
+  it('plate-detection toggle on an enabled printer sends plate_detection_enabled:false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { plate_detection_enabled: true } });
+
+    await user.click(await screen.findByTitle('Plate check enabled - Click to disable'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({ body: { plate_detection_enabled: false } });
+  });
+});

frontend/src/__tests__/pages/PrintersPageFirmwareModalWiring.test.tsx

@@ -0,0 +1,242 @@
+/**
+ * Printer card -> firmware modal wiring (inline FirmwareUpdateModal in PrintersPage).
+ *
+ * Pins: the version the user picks is the version that is prepared and
+ * uploaded to the printer's SD card, the upload status poll is shown (progress
+ * and error), the Upload button only exists when the backend's prepare check
+ * says it can proceed, and firmware:update gates both the prepare check and
+ * the upload.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 5;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Garage X1C',
+  ip_address: '192.0.2.100',
+  serial_number: '01P00A000000005',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  location: null,
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const firmwareInfo = {
+  printer_id: PRINTER_ID,
+  printer_name: 'Garage X1C',
+  model: 'X1C',
+  current_version: '01.07.00.00',
+  latest_version: '01.08.00.00',
+  update_available: true,
+  download_url: null,
+  release_notes: 'Latest notes',
+  available_versions: [
+    { version: '01.08.00.00', file_available: true, download_url: null, release_notes: 'v8', release_time: null },
+    { version: '01.07.00.00', file_available: true, download_url: null, release_notes: 'v7', release_time: null },
+    { version: '01.06.00.00', file_available: true, download_url: null, release_notes: 'v6', release_time: null },
+    { version: '01.05.00.00', file_available: false, download_url: null, release_notes: null, release_time: null },
+  ],
+};
+
+const prepareOk = {
+  can_proceed: true,
+  sd_card_present: true,
+  sd_card_free_space: 1e9,
+  firmware_size: 1e8,
+  space_sufficient: true,
+  update_available: true,
+  current_version: '01.07.00.00',
+  latest_version: '01.08.00.00',
+  target_version: null,
+  firmware_filename: 'fw.bin',
+  errors: [] as string[],
+};
+
+let prepareVersions: (string | null)[] = [];
+let uploadVersions: (string | null)[] = [];
+let statusPolls = 0;
+
+function renderPage({
+  state = 'IDLE',
+  prepare = prepareOk,
+  statuses = [] as object[],
+}: { state?: string; prepare?: typeof prepareOk; statuses?: object[] } = {}) {
+  prepareVersions = [];
+  uploadVersions = [];
+  statusPolls = 0;
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/printers/:id/status', () =>
+      HttpResponse.json({
+        connected: true,
+        state,
+        progress: state === 'RUNNING' ? 40 : 0,
+        layer_num: state === 'RUNNING' ? 10 : 0,
+        total_layers: 100,
+        temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+        remaining_time: 0,
+        wifi_signal: -40,
+        speed_level: 2,
+        vt_tray: [],
+        ams: [],
+        firmware_version: '01.07.00.00',
+      }),
+    ),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}`, () => HttpResponse.json(firmwareInfo)),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}/prepare`, ({ request }) => {
+      prepareVersions.push(new URL(request.url).searchParams.get('version'));
+      return HttpResponse.json(prepare);
+    }),
+    http.post('/api/v1/firmware/updates/:id/upload', ({ request, params }) => {
+      expect(params.id).toBe(String(PRINTER_ID));
+      uploadVersions.push(new URL(request.url).searchParams.get('version'));
+      return HttpResponse.json({ started: true, message: 'started' });
+    }),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}/upload/status`, () => {
+      const s = statuses[Math.min(statusPolls, statuses.length - 1)];
+      statusPolls += 1;
+      return HttpResponse.json(s);
+    }),
+  );
+  render(<PrintersPage />);
+}
+
+async function openModal() {
+  const user = userEvent.setup();
+  const badge = await screen.findByTitle(/Firmware update available/i);
+  await user.click(badge);
+  await screen.findByText('Firmware Update');
+  return user;
+}
+
+// The version list rows are buttons; the "Current:" line shows the same text in a plain span.
+const versionRow = (v: string) => {
+  const rows = screen
+    .getAllByText(v, { selector: 'span.font-mono' })
+    .map((el) => el.closest('button'))
+    .filter((b): b is HTMLButtonElement => b !== null);
+  expect(rows).toHaveLength(1);
+  return rows[0];
+};
+
+describe('PrintersPage firmware modal wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['firmware:read', 'firmware:update', 'printers:control'];
+  });
+
+  it('uploads the version the user picked, not the latest', async () => {
+    renderPage({
+      statuses: [{ status: 'complete', progress: 100, message: 'Done', error: null, firmware_filename: 'fw.bin', firmware_version: '01.06.00.00' }],
+    });
+    const user = await openModal();
+
+    // Latest is pre-selected and prepared first.
+    await waitFor(() => expect(prepareVersions).toContain('01.08.00.00'));
+
+    await user.click(versionRow('01.06.00.00'));
+    await waitFor(() => expect(prepareVersions).toContain('01.06.00.00'));
+
+    const upload = await screen.findByRole('button', { name: /Upload Firmware/ });
+    await user.click(upload);
+
+    await waitFor(() => expect(uploadVersions).toEqual(['01.06.00.00']));
+    expect(await screen.findByText('Firmware uploaded to SD card!', {}, { timeout: 5000 })).toBeInTheDocument();
+  }, 10000);
+
+  it('shows polled progress and then the upload error', async () => {
+    renderPage({
+      statuses: [
+        { status: 'uploading', progress: 45, message: 'Uploading to SD card', error: null, firmware_filename: 'fw.bin', firmware_version: '01.08.00.00' },
+        { status: 'error', progress: 45, message: 'Upload failed', error: 'FTP connection reset', firmware_filename: 'fw.bin', firmware_version: '01.08.00.00' },
+      ],
+    });
+    const user = await openModal();
+    await user.click(await screen.findByRole('button', { name: /Upload Firmware/ }));
+    await waitFor(() => expect(uploadVersions).toEqual(['01.08.00.00']));
+
+    expect(await screen.findByText('45%', {}, { timeout: 5000 })).toBeInTheDocument();
+    expect(await screen.findByText('FTP connection reset', {}, { timeout: 5000 })).toBeInTheDocument();
+    // After an error the poll stops.
+    const polls = statusPolls;
+    await new Promise((r) => setTimeout(r, 2300));
+    expect(statusPolls).toBe(polls);
+  }, 15000);
+
+  it('offers no upload when the prepare check refuses, and shows why', async () => {
+    renderPage({ prepare: { ...prepareOk, can_proceed: false, sd_card_present: false, errors: ['No SD card inserted'] } });
+    await openModal();
+    expect(await screen.findByText('No SD card inserted')).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+    expect(uploadVersions).toEqual([]);
+  });
+
+  it('without firmware:update, versions are locked, nothing is prepared and there is no upload', async () => {
+    permissions.granted = ['firmware:read', 'printers:control'];
+    renderPage();
+    await openModal();
+    const dialog = screen.getByText('Firmware Update').closest('div.fixed') as HTMLElement;
+    expect(versionRow('01.06.00.00')).toBeDisabled();
+    expect(within(dialog).queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+    await new Promise((r) => setTimeout(r, 50));
+    expect(prepareVersions).toEqual([]);
+    expect(uploadVersions).toEqual([]);
+  });
+
+  it('does not offer the installed version or one without a file', async () => {
+    renderPage();
+    await openModal();
+    expect(versionRow('01.07.00.00')).toBeDisabled();
+    expect(versionRow('01.05.00.00')).toBeDisabled();
+    expect(versionRow('01.06.00.00')).toBeEnabled();
+  });
+
+  // BUG (suspected, needs a product decision): neither the modal nor the
+  // backend prepare/upload routes look at the print state, so firmware can be
+  // pushed over FTP to the SD card of a printer that is mid-print. The audit
+  // item expects the Upload button to be unavailable while printing.
+  it.skip('offers no upload while the printer is printing', async () => {
+    renderPage({ state: 'RUNNING' });
+    await openModal();
+    await waitFor(() => expect(prepareVersions.length).toBeGreaterThan(0));
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+  });
+});

frontend/src/__tests__/pages/PrintersPageMachineControlsWiring.test.tsx

@@ -0,0 +1,329 @@
+/**
+ * Machine-control wiring on the printer card: bed / chamber temperature,
+ * fan speeds, airduct mode, chamber light, XY / extruder jog, homing and the
+ * H2D left/right extruder selection.
+ *
+ * Bed jog, nozzle temperature and print speed are covered elsewhere; these
+ * tests pin what reaches the wire for the rest.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 3;
+
+const printerFor = (model: string, extra: Record<string, unknown> = {}) => ({
+  id: PRINTER_ID,
+  name: `Test ${model}`,
+  ip_address: '192.0.2.103',
+  serial_number: '00M09A350100003',
+  access_code: '12345678',
+  model,
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+  ...extra,
+});
+
+const idleStatus = (extra: Record<string, unknown> = {}) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  chamber_light: false,
+  cooling_fan_speed: 0,
+  big_fan1_speed: 0,
+  big_fan2_speed: 0,
+  vt_tray: [],
+  ams: [],
+  ...extra,
+});
+
+type Sent = { path: string; params: Record<string, string> };
+
+function setup(model: string, statusExtra: Record<string, unknown> = {}, printerExtra: Record<string, unknown> = {}) {
+  const sent: Sent[] = [];
+  const record = ({ request }: { request: Request }) => {
+    const url = new URL(request.url);
+    sent.push({
+      path: url.pathname.replace(`/api/v1/printers/${PRINTER_ID}/`, ''),
+      params: Object.fromEntries(url.searchParams.entries()),
+    });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([printerFor(model, printerExtra)])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(idleStatus(statusExtra))),
+    http.post('/api/v1/printers/:id/temperature/bed', record),
+    http.post('/api/v1/printers/:id/temperature/chamber', record),
+    http.post('/api/v1/printers/:id/temperature/nozzle', record),
+    http.post('/api/v1/printers/:id/fan-speed', record),
+    http.post('/api/v1/printers/:id/airduct-mode', record),
+    http.post('/api/v1/printers/:id/chamber-light', record),
+    http.post('/api/v1/printers/:id/xy-jog', record),
+    http.post('/api/v1/printers/:id/extruder-jog', record),
+    http.post('/api/v1/printers/:id/home-axes', record),
+    http.post('/api/v1/printers/:id/bed-jog', record),
+    http.post('/api/v1/printers/:id/select-extruder', record),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+/** Popover container from its title text (title div's parent). */
+async function popover(title: string) {
+  return (await screen.findByText(title)).parentElement as HTMLElement;
+}
+
+async function submitCustom(user: ReturnType<typeof userEvent.setup>, title: string, value: string) {
+  const pop = await popover(title);
+  await user.type(within(pop).getByPlaceholderText('Custom'), value);
+  await user.click(within(pop).getByRole('button', { name: 'Set' }));
+}
+
+describe('PrintersPage machine controls: temperatures', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('bed popover: custom 60 -> POST temperature/bed?target=60 for this printer', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click((await screen.findByText('Bed')).parentElement!);
+    await submitCustom(user, 'Set Bed Temperature', '60');
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'temperature/bed', params: { target: '60' } }]));
+  });
+
+  it('chamber popover on a printer with a chamber heater -> POST temperature/chamber', async () => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', { supports_chamber_heater: true });
+
+    await user.click((await screen.findByText('Chamber')).parentElement!);
+    await submitCustom(user, 'Set Chamber Temperature', '45');
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'temperature/chamber', params: { target: '45' } }]));
+  });
+
+  it('chamber reading on a sensor-only printer opens no temperature control', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { supports_chamber_heater: false });
+
+    await user.click((await screen.findByText('Chamber')).parentElement!);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByText('Set Chamber Temperature')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+
+  it('without printers:control the bed card opens no popover', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click((await screen.findByText('Bed')).parentElement!);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByText('Set Bed Temperature')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage machine controls: fans', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it.each([
+    ['Part Cooling Fan', 'part', '70'],
+    ['Auxiliary Fan', 'aux', '30'],
+    ['Chamber Fan', 'chamber', '55'],
+  ])('%s -> POST fan-speed?fan=%s', async (label, fan, speed) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle(label));
+    await submitCustom(user, `Set ${label} Speed`, speed);
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'fan-speed', params: { fan, speed } }]));
+  });
+});
+
+describe('PrintersPage machine controls: light and airduct', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('chamber light toggle sends on=true when the light is off', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: false });
+
+    await user.click(await screen.findByTitle('Turn on chamber light'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'chamber-light', params: { on: 'true' } }]));
+  });
+
+  it('chamber light toggle sends on=false when the light is on', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: true });
+
+    await user.click(await screen.findByTitle('Turn off chamber light'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'chamber-light', params: { on: 'false' } }]));
+  });
+
+  it('chamber light is disabled without printers:control and sends nothing', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: false });
+
+    await screen.findByText('Test X1C');
+    await waitFor(() => expect(screen.getByText('Bed')).toBeInTheDocument());
+    expect(screen.queryByTitle('Turn on chamber light')).toBeNull();
+    const gated = screen
+      .getAllByTitle('You do not have permission to control printers')
+      .filter((el) => el.tagName === 'BUTTON');
+    expect(gated.length).toBeGreaterThan(0);
+    for (const b of gated) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it.each([
+    ['Heating', 'heating', 0],
+    ['Cooling', 'cooling', 1],
+  ])('airduct menu %s -> POST airduct-mode?mode=%s', async (label, mode, current) => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', { airduct_mode: current });
+
+    await user.click(await screen.findByTitle(/^Airduct Mode: /));
+    await user.click(await screen.findByRole('button', { name: label }));
+    await waitFor(() => expect(sent).toEqual([{ path: 'airduct-mode', params: { mode } }]));
+  });
+});
+
+describe('PrintersPage machine controls: movement', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it.each([
+    ['Move Y forward', { x: '0', y: '10' }],
+    ['Move Y back', { x: '0', y: '-10' }],
+    ['Move X left', { x: '-10', y: '0' }],
+    ['Move X right', { x: '10', y: '0' }],
+  ])('%s -> POST xy-jog with the signed default 10 mm step', async (label, params) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText(label));
+    await waitFor(() => expect(sent).toEqual([{ path: 'xy-jog', params }]));
+  });
+
+  it('XY jog uses the selected step size', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByRole('button', { name: '50' }));
+    await user.click(screen.getByLabelText('Move X left'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'xy-jog', params: { x: '-50', y: '0' } }]));
+  });
+
+  it.each([
+    ['Retract filament', '-10'],
+    ['Extrude filament', '10'],
+  ])('%s -> POST extruder-jog?distance=%s', async (label, distance) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText(label));
+    await waitFor(() => expect(sent).toEqual([{ path: 'extruder-jog', params: { distance } }]));
+  });
+
+  it('Auto Home -> POST home-axes?axes=all', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText('Auto Home'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'home-axes', params: { axes: 'all' } }]));
+  });
+
+  it('movement controls are not reachable while printing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { state: 'RUNNING' });
+    const trigger = await screen.findByTitle('Disabled while printing');
+    expect(trigger).toBeDisabled();
+    await user.click(trigger);
+    expect(screen.queryByLabelText('Move X left')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage machine controls: H2D extruder selection', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  const dualStatus = (active: number) => ({
+    temperatures: { nozzle: 25, nozzle_2: 25, bed: 25, chamber: 25 },
+    active_extruder: active,
+  });
+
+  it.each([
+    ['Left', '1', 0],
+    ['Right', '0', 1],
+  ])('selecting %s -> POST select-extruder?extruder=%s', async (label, extruder, active) => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', dualStatus(active), { nozzle_count: 2 });
+
+    const card = await screen.findByTitle(/^Active: /);
+    fireEvent.click(card);
+    const pop = await popover('Set Nozzle Selection');
+    await user.click(within(pop).getByRole('button', { name: label }));
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'select-extruder', params: { extruder } }]));
+  });
+});

frontend/src/__tests__/pages/PrintersPagePlateCheckWiring.test.tsx

@@ -0,0 +1,374 @@
+/**
+ * Build-plate check wiring on the printer card.
+ *
+ * Opening the check turns the chamber light on when it is off (the camera
+ * needs it), then asks the backend for a check with the debug image. Closing
+ * the result (X, Close or Escape) must turn the light back off -- but only if
+ * the check was what turned it on. A failed check must restore the light too.
+ * From the result modal: calibrate, delete a reference and save the ROI all
+ * name THIS printer.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 9;
+// Opening with the light off waits 2.5 s for the camera before checking.
+const LIGHT_WAIT = { timeout: 6000 };
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Plate X1C',
+  ip_address: '192.0.2.109',
+  serial_number: '00M09A350100009',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  plate_detection_enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusWithLight = (on: boolean) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  chamber_light: on,
+  vt_tray: [],
+  ams: [],
+});
+
+const emptyResult = {
+  is_empty: true,
+  confidence: 0.93,
+  difference_percent: 1.2,
+  message: 'Plate is empty',
+  has_debug_image: false,
+  needs_calibration: false,
+  failure_reason: null,
+  reference_count: 2,
+  max_references: 5,
+  roi: { x: 0.1, y: 0.2, w: 0.6, h: 0.5 },
+};
+
+type Sent = { method: string; path: string; params: Record<string, string>; body: unknown };
+
+interface SetupOptions {
+  lightOn?: boolean;
+  checkResult?: Record<string, unknown>;
+  checkStatus?: number;
+}
+
+function setup({ lightOn = false, checkResult = emptyResult, checkStatus = 200 }: SetupOptions = {}) {
+  const sent: Sent[] = [];
+  const log = async (request: Request) => {
+    const url = new URL(request.url);
+    const text = request.method === 'GET' ? '' : await request.text();
+    sent.push({
+      method: request.method,
+      path: url.pathname.replace(`/api/v1/printers/${PRINTER_ID}`, ''),
+      params: Object.fromEntries(url.searchParams.entries()),
+      body: text ? JSON.parse(text) : null,
+    });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusWithLight(lightOn))),
+    http.post('/api/v1/printers/:id/chamber-light', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+    http.get('/api/v1/printers/:id/camera/check-plate', async ({ request }) => {
+      await log(request);
+      if (checkStatus !== 200) {
+        return HttpResponse.json({ detail: 'Camera unreachable' }, { status: checkStatus });
+      }
+      return HttpResponse.json(checkResult);
+    }),
+    http.get('/api/v1/printers/:id/camera/plate-detection/references', () =>
+      HttpResponse.json({
+        references: [
+          { index: 0, label: 'Textured', timestamp: '2024-01-01T00:00:00Z', has_image: true, thumbnail_url: '' },
+          { index: 3, label: 'Smooth', timestamp: '2024-01-02T00:00:00Z', has_image: true, thumbnail_url: '' },
+        ],
+        max_references: 5,
+      })
+    ),
+    http.get('/api/v1/printers/:id/camera/plate-detection/references/:index/thumbnail', () =>
+      new HttpResponse(null, { status: 204 })
+    ),
+    http.post('/api/v1/printers/:id/camera/plate-detection/calibrate', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'Calibrated', index: 2 });
+    }),
+    http.delete('/api/v1/printers/:id/camera/plate-detection/references/:index', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'Deleted' });
+    }),
+    http.patch('/api/v1/printers/:id', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json(mockPrinter);
+    }),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+const light = (on: boolean) => ({ method: 'POST', path: '/chamber-light', params: { on: String(on) }, body: null });
+const check = { method: 'GET', path: '/camera/check-plate', params: { include_debug_image: 'true' }, body: null };
+
+async function openCheck(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByTitle('Manage plate detection calibration'));
+}
+
+function modal() {
+  return screen.getByText('Build Plate Check').closest('div.max-w-lg') as HTMLElement;
+}
+
+describe('PrintersPage plate check: chamber light handling', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('light off: turns it on, then checks with the debug image; X turns it back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check', {}, LIGHT_WAIT);
+    expect(sent).toEqual([light(true), check]);
+
+    // The header X is the first button in the modal.
+    await user.click(within(modal()).getAllByRole('button')[0]);
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+  });
+
+  it('light off: Escape closes the result and turns the light back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check', {}, LIGHT_WAIT);
+    fireEvent.keyDown(window, { key: 'Escape' });
+
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+  });
+
+  it('light already on: no chamber-light request on open or on close', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check');
+    await user.click(within(modal()).getByRole('button', { name: 'Close' }));
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+
+  it('check failure (500): error toast, no modal, and the light it turned on goes back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false, checkStatus: 500 });
+
+    await openCheck(user);
+    expect(await screen.findByText('Camera unreachable', {}, LIGHT_WAIT)).toBeInTheDocument();
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+    expect(screen.queryByText('Build Plate Check')).toBeNull();
+  });
+
+  it('check failure with the light already on sends no chamber-light request', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true, checkStatus: 500 });
+
+    await openCheck(user);
+    expect(await screen.findByText('Camera unreachable')).toBeInTheDocument();
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+
+  it('without printers:update the check button is disabled and sends nothing', async () => {
+    permissions.denied = new Set(['printers:update']);
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+
+    const buttons = (await screen.findAllByTitle('You do not have permission to update printers')).filter(
+      (el) => el.tagName === 'BUTTON'
+    );
+    expect(buttons.length).toBeGreaterThanOrEqual(2);
+    for (const b of buttons) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage plate check: result rendering', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('empty plate shows the empty verdict', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true });
+    await openCheck(user);
+    expect(await screen.findByText('Plate appears empty')).toBeInTheDocument();
+    expect(screen.queryByText('Objects detected on plate')).toBeNull();
+  });
+
+  it('occupied plate shows objects detected', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, is_empty: false } });
+    await openCheck(user);
+    expect(await screen.findByText('Objects detected on plate')).toBeInTheDocument();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+
+  it('failure_reason shows the could-not-run text instead of a verdict', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, failure_reason: 'no_camera_frame' } });
+    await openCheck(user);
+    expect(await screen.findByText('Plate check could not run')).toBeInTheDocument();
+    expect(screen.getByText('no camera image')).toBeInTheDocument();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+
+  it('needs_calibration shows the calibration prompt and no ROI editor', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, needs_calibration: true } });
+    await openCheck(user);
+    expect(await screen.findByText('Calibration Required')).toBeInTheDocument();
+    expect(screen.queryByText('Detection Area (ROI)')).toBeNull();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+});
+
+describe('PrintersPage plate check: calibrate, references, ROI', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('Calibrate Empty Plate -> POST calibrate for this printer, then re-checks', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true, checkResult: { ...emptyResult, needs_calibration: true } });
+    await openCheck(user);
+    await screen.findByText('Calibration Required');
+
+    await user.click(screen.getByRole('button', { name: 'Calibrate Empty Plate' }));
+    // The card never passes a label, so the request carries none.
+    await waitFor(() =>
+      expect(sent).toEqual([
+        check,
+        { method: 'POST', path: '/camera/plate-detection/calibrate', params: {}, body: null },
+        check,
+      ])
+    );
+  });
+
+  it('Add Reference on a calibrated printer also POSTs calibrate', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await user.click(await screen.findByRole('button', { name: /^Add Reference/ }));
+    await waitFor(() =>
+      expect(sent.filter((s) => s.path === '/camera/plate-detection/calibrate')).toHaveLength(1)
+    );
+  });
+
+  it('deleting a reference DELETEs that reference index for this printer, then re-checks', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+
+    // Second saved reference has index 3 (indices are not positions).
+    const deletes = await screen.findAllByTitle('Delete reference');
+    expect(deletes).toHaveLength(2);
+    await user.click(deletes[1]);
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        check,
+        { method: 'DELETE', path: '/camera/plate-detection/references/3', params: {}, body: null },
+        check,
+      ])
+    );
+  });
+
+  it('Save ROI -> PATCH /printers/{id} {plate_detection_roi}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await screen.findByText('Detection Area (ROI)');
+
+    await user.click(within(modal()).getByRole('button', { name: 'Edit' }));
+    const sliders = within(modal()).getAllByRole('slider');
+    fireEvent.change(sliders[0], { target: { value: '0.25' } });
+    await user.click(within(modal()).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() =>
+      expect(sent).toContainEqual({
+        method: 'PATCH',
+        path: '',
+        params: {},
+        body: { plate_detection_roi: { x: 0.25, y: 0.2, w: 0.6, h: 0.5 } },
+      })
+    );
+    // and then re-checks with the new area
+    await waitFor(() => expect(sent.at(-1)).toEqual(check));
+  });
+
+  it('cancelling the ROI edit sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await screen.findByText('Detection Area (ROI)');
+
+    await user.click(within(modal()).getByRole('button', { name: 'Edit' }));
+    await user.click(within(modal()).getByRole('button', { name: 'Cancel' }));
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+});

frontend/src/__tests__/pages/PrintersPagePrintControlWiring.test.tsx

@@ -0,0 +1,191 @@
+/**
+ * Print control wiring on the printer card: Stop / Pause / Resume.
+ *
+ * Each button opens a confirm dialog; only confirming may reach the printer,
+ * and the request must name the card's own printer id. Without
+ * `printers:control` the buttons are disabled and nothing can be sent.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 7;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Workshop X1C',
+  ip_address: '192.0.2.100',
+  serial_number: '00M09A350100007',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusFor = (state: string) => ({
+  connected: true,
+  state,
+  progress: 40,
+  layer_num: 10,
+  total_layers: 100,
+  temperatures: { nozzle: 220, bed: 60, chamber: 30 },
+  remaining_time: 600,
+  filename: 'part.gcode',
+  wifi_signal: -40,
+  speed_level: 2,
+  vt_tray: [],
+  ams: [],
+});
+
+type Sent = { method: string; path: string };
+
+function setup(state: string): Sent[] {
+  const sent: Sent[] = [];
+  const record = ({ request }: { request: Request }) => {
+    sent.push({ method: request.method, path: new URL(request.url).pathname });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusFor(state))),
+    http.post('/api/v1/printers/:id/print/stop', record),
+    http.post('/api/v1/printers/:id/print/pause', record),
+    http.post('/api/v1/printers/:id/print/resume', record),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+async function controlButton(label: 'Stop' | 'Pause' | 'Resume') {
+  return (await screen.findByRole('button', { name: label })) as HTMLButtonElement;
+}
+
+describe('PrintersPage print control wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('Stop -> confirm sends POST /printers/{id}/print/stop for this printer only', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Stop'));
+    // Nothing goes out before the operator confirms.
+    expect(sent).toEqual([]);
+    await user.click(await screen.findByRole('button', { name: 'Stop Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/stop` }])
+    );
+  });
+
+  it('Stop -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Stop'));
+    await user.click(await screen.findByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: 'Stop Print' })).toBeNull());
+    // Give any stray mutation a tick to fire.
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it('Pause on a RUNNING printer -> confirm sends /print/pause', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    expect(screen.queryByRole('button', { name: 'Resume' })).toBeNull();
+    await user.click(await controlButton('Pause'));
+    await user.click(await screen.findByRole('button', { name: 'Pause Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/pause` }])
+    );
+  });
+
+  it('Pause -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Pause'));
+    await user.click(await screen.findByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByRole('button', { name: 'Pause Print' })).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it('Resume on a PAUSE printer -> confirm sends /print/resume', async () => {
+    const user = userEvent.setup();
+    const sent = setup('PAUSE');
+
+    await user.click(await controlButton('Resume'));
+    expect(screen.queryByRole('button', { name: 'Pause' })).toBeNull();
+    await user.click(await screen.findByRole('button', { name: 'Resume Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/resume` }])
+    );
+  });
+
+  it('Stop and Pause are disabled on an IDLE printer', async () => {
+    setup('IDLE');
+    expect(await controlButton('Stop')).toBeDisabled();
+    expect(await controlButton('Pause')).toBeDisabled();
+  });
+
+  it('without printers:control the buttons are disabled and clicking sends nothing', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    // Disabled buttons carry the permission hint as title, which becomes the
+    // accessible description, not the name.
+    const stop = await controlButton('Stop');
+    const pause = await controlButton('Pause');
+    expect(stop).toBeDisabled();
+    expect(pause).toBeDisabled();
+    expect(stop).toHaveAttribute('title', 'You do not have permission to control printers');
+
+    await user.click(stop);
+    await user.click(pause);
+    expect(screen.queryByRole('button', { name: 'Stop Print' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Pause Print' })).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/ProfilesPageWiring.test.tsx

@@ -0,0 +1,308 @@
+/**
+ * ProfilesPage wiring (Bambu Cloud tab): preset create / edit / delete write
+ * to the user's Bambu Cloud account, so pin exactly what each one sends, and
+ * the cloud sign-in / token / logout requests.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { ProfilesPage } from '../../pages/ProfilesPage';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+const USER_PRESET = {
+  setting_id: 'PFUS-wiring-1',
+  name: 'My Wiring PLA @BBL X1C',
+  type: 'filament',
+  version: null,
+  user_id: 'u1',
+  updated_time: null,
+  is_custom: true,
+};
+const BUILTIN_PRESET = {
+  setting_id: 'GFSA00',
+  name: 'Bambu PLA Basic @BBL X1C',
+  type: 'filament',
+  version: null,
+  user_id: null,
+  updated_time: null,
+  is_custom: false,
+};
+
+let sent: Sent[];
+let authenticated: boolean;
+
+async function record(request: Request) {
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  authenticated = true;
+  server.use(
+    http.get('*/api/v1/cloud/status', () =>
+      HttpResponse.json(
+        authenticated
+          ? { is_authenticated: true, email: 'user@example.com', region: 'global' }
+          : { is_authenticated: false, email: null },
+      ),
+    ),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([])),
+    http.get('*/api/v1/cloud/settings', () =>
+      HttpResponse.json({ filament: [USER_PRESET, BUILTIN_PRESET], printer: [], process: [] }),
+    ),
+    http.get('*/api/v1/cloud/settings/:id', ({ params }) =>
+      HttpResponse.json({
+        setting_id: params.id,
+        name: params.id === USER_PRESET.setting_id ? USER_PRESET.name : BUILTIN_PRESET.name,
+        base_id: 'GFSA00',
+        setting: { inherits: BUILTIN_PRESET.name, nozzle_temperature: ['220'] },
+      }),
+    ),
+    http.get('*/api/v1/cloud/fields/:type', () =>
+      HttpResponse.json({ version: '1', description: '', fields: [] }),
+    ),
+    http.post('*/api/v1/cloud/settings', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ setting_id: 'PFUS-new' });
+    }),
+    http.put('*/api/v1/cloud/settings/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ setting_id: USER_PRESET.setting_id });
+    }),
+    http.delete('*/api/v1/cloud/settings/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true });
+    }),
+    http.post('*/api/v1/cloud/login', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({
+        success: false,
+        needs_verification: true,
+        verification_type: 'email',
+        tfa_key: null,
+        message: 'Code sent',
+      });
+    }),
+    http.post('*/api/v1/cloud/verify', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, needs_verification: false, message: 'ok' });
+    }),
+    http.post('*/api/v1/cloud/token', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ is_authenticated: true, email: 'user@example.com' });
+    }),
+    http.post('*/api/v1/cloud/logout', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function openUserPreset(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByText(USER_PRESET.name));
+  // The detail modal's Edit is enabled once the detail has loaded.
+  const edit = await screen.findByRole('button', { name: 'Edit' });
+  await waitFor(() => expect(edit).not.toBeDisabled());
+  return edit;
+}
+
+describe('ProfilesPage wiring: cloud presets', () => {
+  it('New Preset -> Create sends createCloudSetting with type, name, base_id and the settings', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'New Preset' }));
+    await screen.findByText('Create New Preset');
+    const baseSelect = screen.getByText('Base Preset').parentElement!.querySelector('select')!;
+    await user.selectOptions(baseSelect, 'GFSA00');
+    await user.type(screen.getByText('Preset Name').parentElement!.querySelector('input')!, 'Wiring PLA Fast');
+    const create = screen.getByRole('button', { name: 'Create' });
+    await waitFor(() => expect(create).not.toBeDisabled());
+    await user.click(create);
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/settings',
+      body: {
+        type: 'filament',
+        name: 'Wiring PLA Fast',
+        base_id: 'GFSA00',
+        setting: { inherits: BUILTIN_PRESET.name, filament_settings_id: '"Wiring PLA Fast"' },
+      },
+    });
+  });
+
+  it('Create stays disabled without a base preset, so nothing is sent', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'New Preset' }));
+    await screen.findByText('Create New Preset');
+    await user.type(screen.getByText('Preset Name').parentElement!.querySelector('input')!, 'No Base');
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('Edit -> Save sends updateCloudSetting(setting_id, { name, setting })', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await openUserPreset(user));
+    const nameInput = await screen.findByDisplayValue(USER_PRESET.name);
+    await user.clear(nameInput);
+    await user.type(nameInput, 'Renamed Wiring PLA');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'PUT',
+      path: '/api/v1/cloud/settings/PFUS-wiring-1',
+      body: {
+        name: 'Renamed Wiring PLA',
+        setting: { inherits: BUILTIN_PRESET.name, nozzle_temperature: ['220'] },
+      },
+    });
+  });
+
+  it('Delete -> confirm sends deleteCloudSetting for that preset', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    const edit = await openUserPreset(user);
+    await user.click(edit.nextElementSibling as HTMLElement);
+    expect(await screen.findByText('Delete this preset?')).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/cloud/settings/PFUS-wiring-1' });
+  });
+
+  it('Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    const edit = await openUserPreset(user);
+    await user.click(edit.nextElementSibling as HTMLElement);
+    await screen.findByText('Delete this preset?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete this preset?')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('built-in presets offer no edit or delete', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByText(BUILTIN_PRESET.name));
+    await screen.findByRole('button', { name: 'Close' });
+    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument();
+  });
+});
+
+describe('ProfilesPage wiring: cloud sign-in', () => {
+  it('login then verify send the credentials, the code and the region', async () => {
+    authenticated = false;
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.type(await screen.findByPlaceholderText('your@email.com'), 'user@example.com');
+    await user.type(screen.getByPlaceholderText('••••••••'), 'test-password-1');
+    await user.selectOptions(screen.getByRole('combobox'), 'china');
+    await user.click(screen.getByRole('button', { name: 'Login' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/login',
+      body: { email: 'user@example.com', password: 'test-password-1', region: 'china' },
+    });
+
+    await user.type(await screen.findByPlaceholderText('000000'), '123456');
+    await user.click(screen.getByRole('button', { name: 'Verify' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(2));
+    expect(writes()[1]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/verify',
+      body: { email: 'user@example.com', code: '123456', region: 'china' },
+    });
+  });
+
+  it('the token route sends cloudSetToken with the token and region', async () => {
+    authenticated = false;
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'Use access token instead' }));
+    await user.type(await screen.findByPlaceholderText('eyJ...'), 'test-token-1');
+    await user.click(screen.getByRole('button', { name: 'Set Token' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/token',
+      body: { access_token: 'test-token-1', region: 'global' },
+    });
+  });
+
+  it('Logout sends cloudLogout', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'Logout' }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/cloud/logout' });
+  });
+});
+
+describe('ProfilesPage wiring: permissions', () => {
+  it('without cloud:auth, New Preset, Logout, Edit and Delete are disabled', async () => {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions: ['cloud:read'],
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'New Preset' })).toBeDisabled());
+    expect(screen.getByRole('button', { name: 'Logout' })).toBeDisabled();
+
+    await user.click(screen.getByText(USER_PRESET.name));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    expect(edit).toBeDisabled();
+    expect(edit.nextElementSibling).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/QueuePageWiring.test.tsx

@@ -0,0 +1,490 @@
+/**
+ * Wiring tests for QueuePage: pin the exact requests behind the row and
+ * bulk actions (stop / cancel / remove / start / clear history / group /
+ * ungroup / resume after failure), that cancelling a destructive confirm
+ * sends nothing, and the permission gates in front of them.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { QueuePage } from '../../pages/QueuePage';
+import { setAuthToken } from '../../api/client';
+
+const baseItem = {
+  id: 1,
+  printer_id: 1,
+  archive_id: 1,
+  position: 1,
+  status: 'pending',
+  scheduled_time: null,
+  require_previous_success: false,
+  auto_off_after: false,
+  manual_start: false,
+  ams_mapping: null,
+  plate_id: null,
+  bed_levelling: 'on',
+  flow_cali: 'off',
+  vibration_cali: true,
+  layer_inspect: false,
+  timelapse: false,
+  use_ams: true,
+  started_at: null,
+  completed_at: null,
+  error_message: null,
+  created_at: '2024-01-01T00:00:00Z',
+  archive_name: 'Pending Job',
+  archive_thumbnail: null,
+  printer_name: 'Test Printer',
+  print_time_seconds: 3600,
+  batch_id: null as number | null,
+  batch_name: null as string | null,
+  created_by_id: null as number | null,
+};
+
+const pendingA = { ...baseItem, id: 11, position: 1, archive_name: 'Pending A' };
+const pendingB = { ...baseItem, id: 12, position: 2, archive_name: 'Pending B' };
+const pendingC = { ...baseItem, id: 13, position: 3, archive_name: 'Pending C' };
+const printing = {
+  ...baseItem,
+  id: 21,
+  position: 0,
+  status: 'printing',
+  started_at: '2024-01-01T10:00:00Z',
+  archive_name: 'Running Job',
+};
+const completedA = {
+  ...baseItem,
+  id: 31,
+  status: 'completed',
+  completed_at: '2024-01-01T09:00:00Z',
+  archive_name: 'Done A',
+};
+const completedB = { ...completedA, id: 32, archive_name: 'Done B' };
+
+const printers = [
+  {
+    id: 1,
+    name: 'Test Printer',
+    ip_address: '192.0.2.100',
+    serial_number: 'TESTSERIAL0001',
+    access_code: '12345678',
+    model: 'X1C',
+    enabled: true,
+    created_at: '2024-01-01T00:00:00Z',
+  },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  search: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+const capture = async (request: Request) => {
+  const url = new URL(request.url);
+  let body: unknown;
+  if (request.method !== 'GET' && request.method !== 'DELETE') {
+    const text = await request.text();
+    body = text ? JSON.parse(text) : undefined;
+  }
+  calls.push({ method: request.method, path: url.pathname, search: url.search, body });
+};
+
+const mutationCalls = () => calls.filter((c) => c.method !== 'GET');
+
+function useQueue(items: unknown[]) {
+  server.use(http.get('*/api/v1/queue/', () => HttpResponse.json(items)));
+}
+
+beforeEach(() => {
+  calls = [];
+  vi.mocked(localStorage.getItem).mockImplementation((key: string) => {
+    if (key === 'queue.historyCollapsed') return 'false';
+    if (key === 'queue.viewMode') return 'list';
+    return null;
+  });
+  server.use(
+    http.get('*/api/v1/queue/', () => HttpResponse.json([pendingA, printing, completedA])),
+    http.get('*/api/v1/printers/', () => HttpResponse.json(printers)),
+    http.delete('*/api/v1/queue/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok', deleted: true });
+    }),
+    http.post('*/api/v1/queue/batches/:id/ungroup', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ ungrouped_count: 2, message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/batches', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ id: 77, name: 'x', status: 'pending' });
+    }),
+    http.post('*/api/v1/queue/printer/:pid/resume', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ acknowledged: 1, restored: 2 });
+    }),
+    http.post('*/api/v1/queue/:id/cancel', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/:id/stop', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/:id/start', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ ...pendingA, manual_start: false });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+/** Selection checkbox of the pending row showing ``name``. */
+function selectBoxFor(name: string): HTMLElement {
+  let el: HTMLElement | null = screen.getByText(name);
+  while (el) {
+    const boxes = el.querySelectorAll<HTMLElement>('button.w-6.h-6.rounded.border');
+    if (boxes.length === 1) return boxes[0];
+    if (boxes.length > 1) break;
+    el = el.parentElement;
+  }
+  throw new Error(`no selection box for ${name}`);
+}
+
+/** The dialog card wrapping a ConfirmModal title. */
+function dialogOf(title: HTMLElement): HTMLElement {
+  return title.closest('div.fixed') as HTMLElement;
+}
+
+describe('QueuePage wiring: row actions', () => {
+  it('Stop on a printing item -> confirm -> POST /queue/{id}/stop for that item', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await user.click(screen.getByTitle('Stop Print'));
+    const dialog = dialogOf(await screen.findByText(/stop the current print "Running Job"/));
+    await user.click(within(dialog).getByRole('button', { name: 'Stop Print' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/21/stop' });
+  });
+
+  it('Stop -> cancel the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await user.click(screen.getByTitle('Stop Print'));
+    const dialog = dialogOf(await screen.findByText(/stop the current print "Running Job"/));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/stop the current print/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Cancel on a pending item -> confirm -> POST /queue/{id}/cancel', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Cancel'));
+    const dialog = dialogOf(await screen.findByText('Are you sure you want to cancel "Pending A"?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel Print' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/11/cancel' });
+  });
+
+  it('Cancel on a pending item -> dismiss the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Cancel'));
+    const dialog = dialogOf(await screen.findByText('Are you sure you want to cancel "Pending A"?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/want to cancel "Pending A"/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Remove on a history item -> confirm -> DELETE /queue/{id}', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await user.click(screen.getByTitle('Remove'));
+    const dialog = dialogOf(await screen.findByText(/remove "Done A" from the queue history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/queue/31' });
+  });
+
+  it('Remove -> cancel the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await user.click(screen.getByTitle('Remove'));
+    const dialog = dialogOf(await screen.findByText(/remove "Done A" from the queue history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/from the queue history/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Clear History -> confirm deletes every history item, nothing else', async () => {
+    useQueue([pendingA, completedA, completedB]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done B');
+
+    await user.click(screen.getByRole('button', { name: /clear history/i }));
+    const dialog = dialogOf(await screen.findByText(/remove all 2 item\(s\) from the history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Clear History' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(2));
+    expect(mutationCalls().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'DELETE /api/v1/queue/31',
+      'DELETE /api/v1/queue/32',
+    ]);
+  });
+
+  it('Start Print on a staged item -> POST /queue/{id}/start without skipping the filament check', async () => {
+    useQueue([{ ...pendingA, manual_start: true }]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Start Print'));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({
+      method: 'POST',
+      path: '/api/v1/queue/11/start',
+      search: '',
+    });
+  });
+});
+
+describe('QueuePage wiring: batches', () => {
+  it('Group as batch sends createBatch with the typed name and exactly the selected ids', async () => {
+    useQueue([pendingA, pendingB, pendingC]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending C');
+
+    await user.click(selectBoxFor('Pending A'));
+    await user.click(selectBoxFor('Pending C'));
+    await user.click(await screen.findByTitle('Group as batch…'));
+
+    const input = await screen.findByPlaceholderText(/./, { selector: 'input[maxlength="120"]' });
+    await user.clear(input);
+    await user.type(input, 'Weekend run');
+    await user.click(screen.getByRole('button', { name: 'Create batch' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    const call = mutationCalls()[0];
+    expect(call).toMatchObject({ method: 'POST', path: '/api/v1/queue/batches' });
+    expect(call.body).toEqual({ name: 'Weekend run', item_ids: [11, 13] });
+  });
+
+  it('Group as batch is not offered for a single selected item', async () => {
+    useQueue([pendingA, pendingB]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending B');
+
+    await user.click(selectBoxFor('Pending A'));
+    await screen.findByText('1 selected');
+    expect(screen.queryByTitle('Group as batch…')).toBeNull();
+  });
+
+  it('Ungroup -> confirm -> POST /queue/batches/{id}/ungroup', async () => {
+    useQueue([
+      { ...pendingA, batch_id: 55, batch_name: 'Grouped' },
+      { ...pendingB, batch_id: 55, batch_name: 'Grouped' },
+    ]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Grouped');
+
+    await user.click(screen.getByTitle('Ungroup'));
+    const dialog = dialogOf(await screen.findByText('Ungroup batch?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Ungroup' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/batches/55/ungroup' });
+  });
+
+  it('Ungroup -> cancel sends nothing', async () => {
+    useQueue([
+      { ...pendingA, batch_id: 55, batch_name: 'Grouped' },
+      { ...pendingB, batch_id: 55, batch_name: 'Grouped' },
+    ]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Grouped');
+
+    await user.click(screen.getByTitle('Ungroup'));
+    const dialog = dialogOf(await screen.findByText('Ungroup batch?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Ungroup batch?')).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+});
+
+describe('QueuePage wiring: resume after failure', () => {
+  const skipped = (id: number, printerId: number, printerName: string) => ({
+    ...baseItem,
+    id,
+    printer_id: printerId,
+    printer_name: printerName,
+    status: 'skipped',
+    error_message: 'Previous print failed or was aborted',
+    archive_name: `Skipped ${id}`,
+  });
+
+  it('Resume after failure -> confirm -> POST /queue/printer/{printerId}/resume for that printer', async () => {
+    useQueue([pendingA, skipped(41, 1, 'Alpha'), skipped(42, 7, 'Bravo'), skipped(43, 7, 'Bravo')]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+
+    const banner = (await screen.findByText(/Bravo is blocked by a previous-print failure/)).closest(
+      'div.rounded-lg',
+    ) as HTMLElement;
+    await user.click(within(banner).getByRole('button', { name: /Resume after failure/ }));
+    const dialog = dialogOf(await screen.findByText('Resume queue after failure?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Resume after failure' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/printer/7/resume' });
+  });
+
+  it('Resume after failure -> cancel sends nothing', async () => {
+    useQueue([pendingA, skipped(42, 7, 'Bravo')]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+
+    await user.click(await screen.findByRole('button', { name: /Resume after failure/ }));
+    const dialog = dialogOf(await screen.findByText('Resume queue after failure?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Resume queue after failure?')).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+});
+
+describe('QueuePage wiring: permission gates', () => {
+  const signInWith = (permissions: string[], userId = 7) => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () =>
+        HttpResponse.json({ auth_enabled: true, requires_setup: false }),
+      ),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: userId, username: 'member', is_admin: false, permissions }),
+      ),
+    );
+  };
+
+  it('Clear History is disabled without queue:delete_all and sends nothing when clicked', async () => {
+    signInWith(['queue:read', 'queue:delete_own']);
+    useQueue([completedA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    const clear = screen.getByRole('button', { name: /clear history/i });
+    expect(clear).toBeDisabled();
+    await user.click(clear);
+    expect(screen.queryByText(/from the history\?/)).toBeNull();
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Clear History is enabled with queue:delete_all', async () => {
+    signInWith(['queue:read', 'queue:delete_all']);
+    useQueue([completedA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await waitFor(() => expect(screen.getByRole('button', { name: /clear history/i })).toBeEnabled());
+  });
+
+  it("Stop is disabled on someone else's print without queue:update_all", async () => {
+    signInWith(['queue:read', 'queue:update_own'], 7);
+    useQueue([{ ...printing, created_by_id: 99 }]);
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    const stop = await screen.findByTitle('You do not have permission to stop prints');
+    expect(stop).toBeDisabled();
+  });
+
+  it('Stop stays enabled on the user\'s own print with queue:update_own', async () => {
+    signInWith(['queue:read', 'queue:update_own'], 7);
+    useQueue([{ ...printing, created_by_id: 7 }]);
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await waitFor(() => expect(screen.getByTitle('Stop Print')).toBeEnabled());
+  });
+
+  it('Reorder arrows are hidden without queue:reorder and shown with it', async () => {
+    signInWith(['queue:read']);
+    useQueue([pendingA, pendingB]);
+    const { unmount } = render(<QueuePage />);
+    await screen.findByText('Pending B');
+    expect(screen.queryByTitle('Move Down')).toBeNull();
+    unmount();
+
+    signInWith(['queue:read', 'queue:reorder']);
+    render(<QueuePage />);
+    await screen.findByText('Pending B');
+    await waitFor(() => expect(screen.getAllByTitle('Move Down')).toHaveLength(2));
+  });
+
+  it('Resume-after-failure banner is hidden without queue:update_all', async () => {
+    signInWith(['queue:read', 'queue:update_own']);
+    useQueue([
+      pendingA,
+      { ...baseItem, id: 42, status: 'skipped', error_message: 'Previous print failed or was aborted' },
+    ]);
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+    expect(screen.queryByRole('button', { name: /Resume after failure/ })).toBeNull();
+  });
+
+  it('Bulk edit disables auto power off without printers:control', async () => {
+    signInWith(['queue:read', 'queue:update_all']);
+    useQueue([pendingA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByText('Select All'));
+    await user.click(await screen.findByTitle('Edit Selected'));
+    const row = (await screen.findByText('Auto power off after print')).closest('div') as HTMLElement;
+    for (const btn of within(row).getAllByRole('button')) {
+      expect(btn).toBeDisabled();
+    }
+  });
+});

frontend/src/__tests__/pages/SettingsPageUsersWiring.test.tsx

@@ -0,0 +1,280 @@
+/**
+ * Settings > Users: user and group management and "disable authentication"
+ * send the request for the row/choice that was clicked, cancelling a
+ * destructive dialog sends nothing, and buttons follow the permissions.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { setAuthToken } from '../../api/client';
+import { SettingsPage } from '../../pages/SettingsPage';
+
+type Captured = { method: string; path: string; search: string; body: unknown };
+let captured: Captured[];
+let mePermissions: string[];
+let meIsAdmin: boolean;
+let itemCounts: { archives: number; queue_items: number; library_files: number };
+
+const USERS = [
+  { id: 1, username: 'admin', email: null, role: 'admin', is_admin: true, is_active: true, auth_source: 'local', groups: [{ id: 1, name: 'Administrators' }], created_at: '2026-01-01T00:00:00Z' },
+  { id: 2, username: 'alice', email: 'alice@example.com', role: 'user', is_admin: false, is_active: true, auth_source: 'local', groups: [{ id: 4, name: 'Farm crew' }], created_at: '2026-01-01T00:00:00Z' },
+  { id: 3, username: 'bob', email: null, role: 'user', is_admin: false, is_active: true, auth_source: 'local', groups: [], created_at: '2026-01-01T00:00:00Z' },
+];
+
+const GROUPS = [
+  { id: 1, name: 'Administrators', description: null, is_system: true, permissions: [], user_count: 1, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+  { id: 4, name: 'Farm crew', description: null, is_system: false, permissions: [], user_count: 1, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+  { id: 6, name: 'Night shift', description: null, is_system: false, permissions: [], user_count: 0, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+];
+
+async function capture(request: Request) {
+  const text = await request.text();
+  const url = new URL(request.url);
+  captured.push({ method: request.method, path: url.pathname, search: url.search, body: text ? JSON.parse(text) : null });
+}
+
+const writes = () => captured.filter((c) => c.method !== 'GET');
+
+function userRow(username: string): HTMLElement {
+  const name = screen
+    .getAllByText(username)
+    .find((el) => el.tagName === 'P' && el.className.includes('truncate') && el.closest('div.py-3'));
+  if (!name) throw new Error(`user row ${username} not found`);
+  return name.closest('div.py-3') as HTMLElement;
+}
+
+function groupRow(name: string): HTMLElement {
+  const label = screen
+    .getAllByText(name)
+    .find((el) => el.tagName === 'SPAN' && el.className === 'text-white font-medium' && el.closest('div.py-3'));
+  if (!label) throw new Error(`group row ${name} not found`);
+  return label.closest('div.py-3') as HTMLElement;
+}
+
+async function openUsersTab() {
+  window.history.replaceState({}, '', '/settings?tab=users');
+  render(<SettingsPage />);
+  await screen.findByText('alice');
+}
+
+beforeEach(() => {
+  captured = [];
+  meIsAdmin = true;
+  mePermissions = ['settings:read', 'users:read', 'users:create', 'users:update', 'users:delete', 'groups:read', 'groups:delete'];
+  itemCounts = { archives: 2, queue_items: 0, library_files: 1 };
+  setAuthToken('test-token', 'session');
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+    http.get('*/api/v1/auth/me', () =>
+      HttpResponse.json({ ...USERS[0], is_admin: meIsAdmin, permissions: mePermissions }),
+    ),
+    http.get('*/api/v1/users/', () => HttpResponse.json(USERS)),
+    http.get('*/api/v1/groups/', () => HttpResponse.json(GROUPS)),
+    http.get('*/api/v1/users/:id/items-count', () => HttpResponse.json(itemCounts)),
+    http.post('*/api/v1/users/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(USERS[2]);
+    }),
+    http.patch('*/api/v1/users/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(USERS[1]);
+    }),
+    http.delete('*/api/v1/users/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.delete('*/api/v1/groups/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.post('*/api/v1/auth/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok', auth_enabled: false });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  window.history.replaceState({}, '', '/');
+});
+
+describe('SettingsPage users & groups wiring', () => {
+  it('create user sends username, password and the ticked group ids', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(screen.getByRole('button', { name: /add user/i }));
+    await user.type(screen.getByPlaceholderText('Enter username'), 'carol');
+    await user.type(screen.getByPlaceholderText('Enter password'), 'Test-password-1');
+    await user.type(screen.getByPlaceholderText('Confirm password'), 'Test-password-1');
+    const modal = screen.getByPlaceholderText('Enter username').closest('div.space-y-3') as HTMLElement;
+    await user.click(within(modal).getByRole('checkbox', { name: /night shift/i }));
+    await user.click(screen.getByRole('button', { name: /create user/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/users/' });
+    expect(writes()[0].body).toEqual({
+      username: 'carol',
+      password: 'Test-password-1',
+      role: 'user',
+      group_ids: [6],
+    });
+  });
+
+  it('create user is blocked while the passwords differ', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(screen.getByRole('button', { name: /add user/i }));
+    await user.type(screen.getByPlaceholderText('Enter username'), 'carol');
+    await user.type(screen.getByPlaceholderText('Enter password'), 'Test-password-1');
+    await user.type(screen.getByPlaceholderText('Confirm password'), 'Test-password-2');
+    const create = screen.getByRole('button', { name: /create user/i });
+    expect(create).toBeDisabled();
+    await user.click(create);
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('edit user PATCHes that user without a password when it is left blank', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const [editBtn] = within(userRow('alice')).getAllByRole('button');
+    await user.click(editBtn);
+    const name = await screen.findByDisplayValue('alice');
+    await user.clear(name);
+    await user.type(name, 'alice2');
+    await user.click(screen.getByRole('button', { name: /save changes/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/users/2' });
+    expect(writes()[0].body).toEqual({
+      username: 'alice2',
+      email: 'alice@example.com',
+      role: 'user',
+      group_ids: [4],
+    });
+    expect(writes()[0].body).not.toHaveProperty('password');
+  });
+
+  it('delete user with items: "delete items" choice sends delete_items=true for that user', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('bob')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await user.click(await screen.findByRole('button', { name: /delete user and their items/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/users/3', search: '?delete_items=true' });
+  });
+
+  it('delete user with items: "keep items" choice sends delete_items=false', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('alice')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await user.click(await screen.findByRole('button', { name: /keep items/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/users/2', search: '?delete_items=false' });
+  });
+
+  it('cancelling the delete-user dialog sends nothing', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('bob')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await screen.findByRole('button', { name: /delete user and their items/i });
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() =>
+      expect(screen.queryByRole('button', { name: /delete user and their items/i })).not.toBeInTheDocument(),
+    );
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('the signed-in user has no delete button on their own row', async () => {
+    await openUsersTab();
+    // Only the edit button
+    expect(within(userRow('admin')).getAllByRole('button')).toHaveLength(1);
+  });
+
+  it('delete group asks first, then DELETEs that group; cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    // System groups: edit only, no delete button
+    expect(within(groupRow('Administrators')).getAllByRole('button')).toHaveLength(1);
+    const deleteNightShift = () => {
+      const buttons = within(groupRow('Night shift')).getAllByRole('button');
+      expect(buttons).toHaveLength(2);
+      return buttons[1];
+    };
+
+    await user.click(deleteNightShift());
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(deleteNightShift());
+    await user.click(screen.getByRole('button', { name: /^delete group$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/groups/6' });
+  });
+
+  it('disable authentication asks first; cancel sends nothing, confirm POSTs /auth/disable', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(await screen.findByRole('button', { name: /^disable$/i }));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(screen.getByRole('button', { name: /^disable$/i }));
+    await user.click(screen.getByRole('button', { name: /^disable authentication$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/disable' });
+  });
+
+  it('reset password (advanced auth) POSTs {user_id} of the user being edited', async () => {
+    server.use(
+      http.get('*/api/v1/auth/advanced-auth/status', () =>
+        HttpResponse.json({ advanced_auth_enabled: true, smtp_configured: true, local_login_enabled: true, autologin_provider_id: null }),
+      ),
+      http.post('*/api/v1/auth/reset-password', async ({ request }) => {
+        await capture(request);
+        return HttpResponse.json({ message: 'sent' });
+      }),
+    );
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const [editBtn] = within(userRow('alice')).getAllByRole('button');
+    await user.click(editBtn);
+    await user.click(await screen.findByRole('button', { name: /reset password/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/reset-password', body: { user_id: 2 } });
+  });
+
+  it('without create/delete permissions there is no add-user, delete-user, delete-group or disable-auth button', async () => {
+    meIsAdmin = false;
+    mePermissions = ['settings:read', 'users:read', 'users:update', 'groups:read'];
+    await openUsersTab();
+
+    expect(screen.queryByRole('button', { name: /add user/i })).not.toBeInTheDocument();
+    // Edit only
+    expect(within(userRow('bob')).getAllByRole('button')).toHaveLength(1);
+    expect(within(groupRow('Night shift')).queryAllByRole('button')).toHaveLength(0);
+    expect(screen.queryByRole('button', { name: /^disable$/i })).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/pages/SetupPageWiring.test.tsx

@@ -0,0 +1,104 @@
+/**
+ * First-run setup: the request that creates the admin account (or turns
+ * authentication off) is exactly what the form says, and invalid input
+ * sends nothing.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { api } from '../../api/client';
+import { SetupPage } from '../../pages/SetupPage';
+
+describe('SetupPage wiring', () => {
+  let setup: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    setup = vi
+      .spyOn(api, 'setupAuth')
+      .mockResolvedValue({ auth_enabled: true, admin_created: true } as never);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('with auth enabled sends auth_enabled:true plus the typed admin credentials', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.type(screen.getByLabelText(/admin password/i), 'test-password-1');
+    await user.type(screen.getByLabelText(/^confirm password/i), 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: true,
+      admin_username: 'admin-test',
+      admin_password: 'test-password-1',
+    });
+  });
+
+  it('mismatched passwords send nothing and show an error', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.type(screen.getByLabelText(/admin password/i), 'test-password-1');
+    await user.type(screen.getByLabelText(/^confirm password/i), 'test-password-2');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    expect(await screen.findByText(/passwords do not match/i)).toBeInTheDocument();
+    expect(setup).not.toHaveBeenCalled();
+  });
+
+  it('a username without a password sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    expect(await screen.findByText(/please enter both admin username and password/i)).toBeInTheDocument();
+    expect(setup).not.toHaveBeenCalled();
+  });
+
+  it('enabled with both fields empty sends auth_enabled:true and no credentials (use existing admins)', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: true,
+      admin_username: '',
+      admin_password: '',
+    });
+  });
+
+  it('skipping auth sends auth_enabled:false and never the typed credentials', async () => {
+    setup.mockResolvedValue({ auth_enabled: false, admin_created: false } as never);
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    // Type credentials, then untick: they must not leave the browser
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: false,
+      admin_username: undefined,
+      admin_password: undefined,
+    });
+  });
+});

frontend/src/__tests__/pages/SpoolBuddyAmsPageWiring.test.tsx

@@ -0,0 +1,211 @@
+/**
+ * Wiring tests for SpoolBuddyAmsPage slot actions: Unassign (built-in
+ * inventory), Unassign (Spoolman slot-only assignment) and Unlink (Spoolman
+ * tag link) must each call their own API with the picked slot's ids.
+ * Harness mirrors SpoolBuddyAmsPage.test.tsx.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, render } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter, Route, Routes, Outlet } from 'react-router-dom';
+import { ToastProvider } from '../../contexts/ToastContext';
+import { SpoolBuddyAmsPage } from '../../pages/spoolbuddy/SpoolBuddyAmsPage';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => ({ hasPermission: () => true }) };
+});
+vi.mock('../../components/AssignSpoolModal', () => ({ AssignSpoolModal: () => null }));
+vi.mock('../../components/LinkSpoolModal', () => ({ LinkSpoolModal: () => null }));
+vi.mock('../../components/ConfigureAmsSlotModal', () => ({ ConfigureAmsSlotModal: () => null }));
+
+const mutations = {
+  unassignSpool: vi.fn(),
+  unassignSpoolmanSlot: vi.fn(),
+  unlinkSpool: vi.fn(),
+};
+let apiResponses: Record<string, unknown> = {};
+let spoolmanStatusValue = { enabled: false, connected: false };
+
+vi.mock('../../api/client', () => ({
+  api: new Proxy({} as Record<string, unknown>, {
+    get: (_t, p: string) => {
+      if (p === 'getSpoolmanStatus') return () => Promise.resolve(spoolmanStatusValue);
+      if (p in mutations) return mutations[p as keyof typeof mutations];
+      if (p in apiResponses) return () => Promise.resolve(apiResponses[p]);
+      return () => Promise.resolve(null);
+    },
+  }),
+}));
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: string | Record<string, unknown>) =>
+      typeof fallback === 'string' ? fallback : key,
+    i18n: { language: 'en', changeLanguage: vi.fn() },
+  }),
+}));
+
+vi.mock('../../contexts/ToastContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/ToastContext')>();
+  return { ...actual, useToast: () => ({ showToast: vi.fn() }) };
+});
+
+const outletContext = {
+  selectedPrinterId: 3,
+  setSelectedPrinterId: vi.fn(),
+  sbState: {
+    weight: null, weightStable: false, rawAdc: null, matchedSpool: null, unknownTagUid: null,
+    unknownTrayUuid: null, deviceOnline: true, deviceId: 'dev-1', remainingWeight: null, netWeight: null,
+  },
+  setAlert: vi.fn(),
+  displayBrightness: 100,
+  setDisplayBrightness: vi.fn(),
+  displayBlankTimeout: 0,
+  setDisplayBlankTimeout: vi.fn(),
+};
+
+function renderPage() {
+  function Wrapper() {
+    return <Outlet context={outletContext} />;
+  }
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: 0 } } });
+  return render(
+    <ToastProvider>
+      <QueryClientProvider client={qc}>
+        <MemoryRouter initialEntries={['/spoolbuddy/ams']}>
+          <Routes>
+            <Route element={<Wrapper />}>
+              <Route path="spoolbuddy/ams" element={<SpoolBuddyAmsPage />} />
+            </Route>
+          </Routes>
+        </MemoryRouter>
+      </QueryClientProvider>
+    </ToastProvider>,
+  );
+}
+
+// Third slot is a non-RFID PLA spool (no tray_uuid), so Assign/Unassign are offered.
+function printerStatus() {
+  const blank = { tray_type: '' };
+  return {
+    connected: true,
+    state: 'IDLE',
+    ams: [{
+      id: 1, humidity: 30, temp: 25,
+      tray: [
+        { id: 0, ...blank },
+        { id: 1, ...blank },
+        { id: 2, tray_type: 'PLA', tray_color: '00FF00FF', tray_sub_brands: 'PLA Basic', remain: 50 },
+        { id: 3, ...blank },
+      ],
+    }],
+    vt_tray: [],
+    tray_now: 255,
+    active_extruder: 0,
+  };
+}
+
+async function openSlot(n: number) {
+  const slots = await screen.findAllByTestId('ams-slot');
+  fireEvent.click(slots[n - 1]);
+}
+
+describe('SpoolBuddyAmsPage slot-action wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mutations.unassignSpool.mockResolvedValue({ success: true });
+    mutations.unassignSpoolmanSlot.mockResolvedValue({ success: true });
+    mutations.unlinkSpool.mockResolvedValue({ success: true, message: 'ok' });
+    spoolmanStatusValue = { enabled: false, connected: false };
+    apiResponses = {
+      getPrinterStatus: printerStatus(),
+      getPrinter: { id: 3, name: 'P', serial_number: 'SN3', nozzle_count: 1 },
+      getSlotPresets: {},
+      getSettings: {},
+      getLinkedSpools: { linked: {} },
+      getAssignments: [],
+      getSpoolmanSlotAssignments: [],
+      getSpoolmanInventorySpools: [],
+    };
+  });
+
+  it('built-in: Unassign sends unassignSpool(printerId, amsId, trayId) of the picked slot', async () => {
+    apiResponses.getAssignments = [
+      {
+        id: 77, spool_id: 12, printer_id: 3, ams_id: 1, tray_id: 2,
+        spool: { id: 12, material: 'PLA', label_weight: 1000, weight_used: 100, rgba: '00FF00FF' },
+      },
+    ];
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove inventory spool from this slot'));
+
+    await waitFor(() => expect(mutations.unassignSpool).toHaveBeenCalledTimes(1));
+    expect(mutations.unassignSpool).toHaveBeenCalledWith(3, 1, 2);
+    expect(mutations.unassignSpoolmanSlot).not.toHaveBeenCalled();
+    expect(mutations.unlinkSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman slot-only assignment: Unassign sends unassignSpoolmanSlot(spoolmanSpoolId)', async () => {
+    spoolmanStatusValue = { enabled: true, connected: true };
+    apiResponses.getSpoolmanSlotAssignments = [
+      { printer_id: 3, ams_id: 1, tray_id: 2, spoolman_spool_id: 555 },
+    ];
+    apiResponses.getSpoolmanInventorySpools = [
+      { id: 555, material: 'PLA', label_weight: 1000, weight_used: 200 },
+    ];
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove inventory spool from this slot'));
+
+    await waitFor(() => expect(mutations.unassignSpoolmanSlot).toHaveBeenCalledTimes(1));
+    expect(mutations.unassignSpoolmanSlot).toHaveBeenCalledWith(555);
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+    expect(mutations.unlinkSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman tag-linked spool: Unlink sends unlinkSpool(spoolId) only', async () => {
+    spoolmanStatusValue = { enabled: true, connected: true };
+    const status = printerStatus();
+    (status.ams[0].tray[2] as Record<string, unknown>).tray_uuid = 'AABBCCDDEEFF00112233445566778899';
+    apiResponses.getPrinterStatus = status;
+    apiResponses.getLinkedSpools = {
+      linked: {
+        AABBCCDDEEFF00112233445566778899: {
+          id: 314, material: 'PLA', color_name: 'Green', rgba: '00FF00FF',
+          remaining_weight: 500, filament_weight: 1000,
+        },
+      },
+    };
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove Spoolman link from this slot'));
+
+    await waitFor(() => expect(mutations.unlinkSpool).toHaveBeenCalledTimes(1));
+    expect(mutations.unlinkSpool).toHaveBeenCalledWith(314);
+    expect(mutations.unassignSpoolmanSlot).not.toHaveBeenCalled();
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+  });
+
+  it('closing the picker without choosing an action sends nothing', async () => {
+    apiResponses.getAssignments = [
+      { id: 77, spool_id: 12, printer_id: 3, ams_id: 1, tray_id: 2, spool: { id: 12, material: 'PLA' } },
+    ];
+    renderPage();
+    await openSlot(3);
+    await screen.findByText('Remove inventory spool from this slot');
+
+    // Backdrop click closes the picker.
+    const backdrop = document.querySelector('.fixed.inset-0.z-50 > .absolute.inset-0') as HTMLElement;
+    fireEvent.click(backdrop);
+
+    await waitFor(() =>
+      expect(screen.queryByText('Remove inventory spool from this slot')).not.toBeInTheDocument(),
+    );
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/pages/SpoolBuddyWriteTagPageWiring.test.tsx

@@ -0,0 +1,211 @@
+/**
+ * Wiring tests for SpoolBuddyWriteTagPage: the write request targets the
+ * picked spool on the online device, untag clears the tag on the right
+ * backend, and "create N spools" goes through the bulk endpoint with K-profiles
+ * saved per created spool -- in both built-in and Spoolman inventory modes.
+ * Harness mirrors SpoolBuddyWriteTagPage.test.tsx.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, render } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter, Route, Routes, Outlet } from 'react-router-dom';
+import { ToastProvider } from '../../contexts/ToastContext';
+import { SpoolBuddyWriteTagPage } from '../../pages/spoolbuddy/SpoolBuddyWriteTagPage';
+import { api, spoolbuddyApi } from '../../api/client';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => ({ hasPermission: () => true }) };
+});
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getSpools: vi.fn(),
+    createSpool: vi.fn(),
+    bulkCreateSpools: vi.fn(),
+    saveSpoolKProfiles: vi.fn(),
+    linkTagToSpool: vi.fn(),
+    getSpoolmanSettings: vi.fn(),
+    getSpoolmanInventorySpools: vi.fn(),
+    createSpoolmanInventorySpool: vi.fn(),
+    bulkCreateSpoolmanInventorySpools: vi.fn(),
+    saveSpoolmanKProfiles: vi.fn(),
+    linkTagToSpoolmanSpool: vi.fn(),
+    getSpoolCatalog: vi.fn().mockResolvedValue([]),
+    getColorCatalog: vi.fn().mockResolvedValue([]),
+    getLocalPresets: vi.fn().mockResolvedValue({ filament: [] }),
+    getBuiltinFilaments: vi.fn().mockResolvedValue([]),
+    getPrinters: vi.fn().mockResolvedValue([]),
+    getCloudStatus: vi.fn().mockResolvedValue({ is_authenticated: false }),
+    orcaCloudStatus: vi.fn().mockResolvedValue({ connected: false }),
+  },
+  spoolbuddyApi: {
+    getDevices: vi.fn(),
+    writeTag: vi.fn(),
+    cancelWrite: vi.fn(),
+  },
+}));
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: unknown) => (typeof fallback === 'string' ? fallback : key),
+    i18n: { language: 'en', changeLanguage: vi.fn() },
+  }),
+}));
+
+const mApi = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+const mSb = spoolbuddyApi as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const outletContext = {
+  selectedPrinterId: null,
+  setSelectedPrinterId: vi.fn(),
+  sbState: {
+    weight: null, weightStable: false, rawAdc: null, matchedSpool: null, unknownTagUid: null,
+    deviceOnline: true, deviceId: 'sb-1', remainingWeight: null, netWeight: null,
+  },
+  setAlert: vi.fn(),
+  displayBrightness: 100,
+  setDisplayBrightness: vi.fn(),
+  displayBlankTimeout: 0,
+  setDisplayBlankTimeout: vi.fn(),
+};
+
+function renderPage() {
+  function OutletWrapper() {
+    return <Outlet context={outletContext} />;
+  }
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: 0 } } });
+  return render(
+    <QueryClientProvider client={qc}>
+      <ToastProvider>
+        <MemoryRouter initialEntries={['/spoolbuddy/write-tag']}>
+          <Routes>
+            <Route element={<OutletWrapper />}>
+              <Route path="spoolbuddy/write-tag" element={<SpoolBuddyWriteTagPage />} />
+            </Route>
+          </Routes>
+        </MemoryRouter>
+      </ToastProvider>
+    </QueryClientProvider>,
+  );
+}
+
+function spoolmanMode(on: boolean) {
+  mApi.getSpoolmanSettings.mockResolvedValue({
+    spoolman_enabled: on ? 'true' : 'false',
+    spoolman_url: on ? 'http://spoolman.test' : '',
+  });
+}
+
+const untagged = { id: 31, material: 'PETG', brand: 'Acme', label_weight: 1000, weight_used: 0, tag_uid: null, tray_uuid: null, archived_at: null, rgba: '00FF00FF' };
+const tagged = { id: 32, material: 'ABS', brand: 'Zeta', label_weight: 1000, weight_used: 0, tag_uid: '04AABBCCDD', tray_uuid: null, archived_at: null, rgba: '0000FFFF' };
+
+async function openQuickAddFormWithQuantity(qty: number) {
+  fireEvent.click(screen.getByText('New Spool'));
+  await waitFor(() => expect(screen.getByText('Create Spool')).toBeDefined());
+  const material = screen.getAllByRole('combobox').find((el) => el.querySelector('option[value="PLA"]'));
+  fireEvent.change(material!, { target: { value: 'PLA' } });
+  fireEvent.click(screen.getByText('Full'));
+  await waitFor(() => expect(screen.getByText('Quick Add')).toBeDefined());
+  const quickAddToggle = screen.getByText('Quick Add').parentElement?.querySelector('button');
+  fireEvent.click(quickAddToggle as HTMLElement);
+  const qtyLabel = await screen.findByText('inventory.quantity');
+  const qtyInput = qtyLabel.parentElement!.querySelector('input') as HTMLInputElement;
+  fireEvent.change(qtyInput, { target: { value: String(qty) } });
+}
+
+describe.each([
+  ['built-in', false],
+  ['Spoolman', true],
+])('SpoolBuddyWriteTagPage wiring (%s inventory)', (_label, isSpoolman) => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    spoolmanMode(isSpoolman);
+    const list = [untagged, tagged];
+    mApi.getSpools.mockResolvedValue(list);
+    mApi.getSpoolmanInventorySpools.mockResolvedValue(list);
+    mSb.getDevices.mockResolvedValue([{ device_id: 'sb-1', hostname: 'sb-1.local' }]);
+    mSb.writeTag.mockResolvedValue({ status: 'queued' });
+    mSb.cancelWrite.mockResolvedValue({ status: 'ok' });
+    mApi.linkTagToSpool.mockResolvedValue({});
+    mApi.linkTagToSpoolmanSpool.mockResolvedValue({});
+    mApi.saveSpoolKProfiles.mockResolvedValue([]);
+    mApi.saveSpoolmanKProfiles.mockResolvedValue([]);
+    mApi.bulkCreateSpools.mockResolvedValue([{ id: 501 }, { id: 502 }, { id: 503 }]);
+    mApi.bulkCreateSpoolmanInventorySpools.mockResolvedValue({ created: [{ id: 601 }, { id: 602 }, { id: 603 }], failed: [] });
+    mApi.createSpool.mockResolvedValue({ id: 700, material: 'PLA' });
+    mApi.createSpoolmanInventorySpool.mockResolvedValue({ id: 800, material: 'PLA' });
+  });
+
+  it('Write Tag queues writeTag(deviceId, selectedSpoolId); Cancel sends cancelWrite(deviceId)', async () => {
+    renderPage();
+    fireEvent.click(await screen.findByText('#31'));
+    await waitFor(() => expect((screen.getByText('Write Tag') as HTMLButtonElement).disabled).toBe(false));
+    fireEvent.click(screen.getByText('Write Tag'));
+
+    await waitFor(() => expect(mSb.writeTag).toHaveBeenCalledTimes(1));
+    expect(mSb.writeTag).toHaveBeenCalledWith('sb-1', 31);
+
+    fireEvent.click(await screen.findByText('Cancel'));
+    await waitFor(() => expect(mSb.cancelWrite).toHaveBeenCalledWith('sb-1'));
+  });
+
+  it('Untag on the Replace tab clears the tag via the active backend only', async () => {
+    renderPage();
+    fireEvent.click(screen.getByText('Replace Tag'));
+    fireEvent.click(await screen.findByText('#32'));
+    fireEvent.click(await screen.findByText('Untag Selected Spool'));
+
+    if (isSpoolman) {
+      await waitFor(() =>
+        expect(mApi.linkTagToSpoolmanSpool).toHaveBeenCalledWith(32, { tag_uid: '', tray_uuid: '' }),
+      );
+      expect(mApi.linkTagToSpool).not.toHaveBeenCalled();
+    } else {
+      await waitFor(() =>
+        expect(mApi.linkTagToSpool).toHaveBeenCalledWith(32, { tag_uid: '', tray_uuid: '', data_origin: 'manual' }),
+      );
+      expect(mApi.linkTagToSpoolmanSpool).not.toHaveBeenCalled();
+    }
+    expect(mSb.writeTag).not.toHaveBeenCalled();
+  });
+
+  it('Create with quantity 3 uses the bulk endpoint with N=3 and saves K-profiles for every created spool', async () => {
+    renderPage();
+    await openQuickAddFormWithQuantity(3);
+    fireEvent.click(screen.getAllByText('Create Spool').at(-1)!);
+
+    const bulk = isSpoolman ? mApi.bulkCreateSpoolmanInventorySpools : mApi.bulkCreateSpools;
+    const otherBulk = isSpoolman ? mApi.bulkCreateSpools : mApi.bulkCreateSpoolmanInventorySpools;
+    const saveK = isSpoolman ? mApi.saveSpoolmanKProfiles : mApi.saveSpoolKProfiles;
+    const otherSaveK = isSpoolman ? mApi.saveSpoolKProfiles : mApi.saveSpoolmanKProfiles;
+
+    await waitFor(() => expect(bulk).toHaveBeenCalledTimes(1));
+    const [payload, qty] = bulk.mock.calls[0];
+    expect(qty).toBe(3);
+    expect(payload).toMatchObject({ material: 'PLA', tag_uid: null, tray_uuid: null });
+    expect(otherBulk).not.toHaveBeenCalled();
+    expect(mApi.createSpool).not.toHaveBeenCalled();
+    expect(mApi.createSpoolmanInventorySpool).not.toHaveBeenCalled();
+
+    const ids = isSpoolman ? [601, 602, 603] : [501, 502, 503];
+    await waitFor(() => expect(saveK).toHaveBeenCalledTimes(3));
+    expect(saveK.mock.calls.map((c) => c[0])).toEqual(ids);
+    // No PA profile picked -> each spool's K-profiles are saved as empty.
+    for (const c of saveK.mock.calls) expect(c[1]).toEqual([]);
+    expect(otherSaveK).not.toHaveBeenCalled();
+  });
+
+  it('Create with quantity 1 uses the single-create endpoint', async () => {
+    renderPage();
+    await openQuickAddFormWithQuantity(1);
+    fireEvent.click(screen.getAllByText('Create Spool').at(-1)!);
+
+    const single = isSpoolman ? mApi.createSpoolmanInventorySpool : mApi.createSpool;
+    await waitFor(() => expect(single).toHaveBeenCalledTimes(1));
+    expect(mApi.bulkCreateSpools).not.toHaveBeenCalled();
+    expect(mApi.bulkCreateSpoolmanInventorySpools).not.toHaveBeenCalled();
+    const saveK = isSpoolman ? mApi.saveSpoolmanKProfiles : mApi.saveSpoolKProfiles;
+    await waitFor(() => expect(saveK).toHaveBeenCalledWith(isSpoolman ? 800 : 700, []));
+  });
+});

frontend/src/components/PurgeArchivesModal.tsx

@@ -38,7 +38,8 @@ export function PurgeArchivesModal({ onClose, initialDays }: PurgeArchivesModalP
   });
 
   const purgeMutation = useMutation({
-    mutationFn: () => api.executeArchivePurge(days, purgeStats),
+    // The age the shown preview was made for, never one still being typed.
+    mutationFn: () => api.executeArchivePurge(debouncedDays, purgeStats),
     onSuccess: (res) => {
       showToast(t('archivePurge.toast.success', { count: res.deleted }), 'success');
       queryClient.invalidateQueries({ queryKey: ['archives'] });
@@ -59,7 +60,8 @@ export function PurgeArchivesModal({ onClose, initialDays }: PurgeArchivesModalP
   const preview = previewQuery.data;
   const count = preview?.count ?? 0;
   const totalBytes = preview?.total_bytes ?? 0;
-  const canConfirm = count > 0 && !purgeMutation.isPending;
+  // Only once the preview matches the field: the button shows its count.
+  const canConfirm = count > 0 && days === debouncedDays && !previewQuery.isFetching && !purgeMutation.isPending;
 
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">

frontend/src/pages/FinancePage.tsx

@@ -500,7 +500,8 @@ export function FinancePage() {
       transactionId: selectedEditTransactionId,
       data: {
         user_id: editTransactionUserId || undefined,
-        cost_center_id: editTransactionCostCenterId || undefined,
+        // null moves it to no cost center; left out, the backend keeps the old one.
+        cost_center_id: editTransactionCostCenterId || null,
         amount: amount ?? undefined,
         description: editTransactionDescription || undefined,
       },

frontend/src/pages/PrintersPage.tsx

@@ -2684,6 +2684,10 @@ function PrinterCard({
       queryClient.invalidateQueries({ queryKey: ['virtual-printers'] });
       queryClient.invalidateQueries({ queryKey: ['api-keys'] });
       queryClient.invalidateQueries({ queryKey: ['smart-plugs'] });
+      // Its slot assignments went with it, in both inventory modes; spools
+      // would read as still loaded.
+      queryClient.invalidateQueries({ queryKey: ['spool-assignments'] });
+      queryClient.invalidateQueries({ queryKey: ['spoolman-slot-assignments'] });
       // Obico's printer list lost it; a cached copy would save it back.
       queryClient.invalidateQueries({ queryKey: ['settings'] });
     },