.basedpyright/baseline.json

@@ -138,14 +138,6 @@
                     "endColumn": 44,
                     "lineCount": 1
                 }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 47,
-                    "endColumn": 52,
-                    "lineCount": 1
-                }
             }
         ],
         "./backend/app/api/routes/auth.py": [
@@ -387,22 +379,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 29,
-                    "endColumn": 119,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 29,
-                    "endColumn": 117,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -493,38 +469,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 54,
-                    "endColumn": 59,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 34,
-                    "endColumn": 39,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 47,
-                    "endColumn": 52,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 53,
-                    "endColumn": 58,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -557,14 +501,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 69,
-                    "endColumn": 74,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -581,30 +517,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 65,
-                    "endColumn": 70,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 72,
-                    "endColumn": 77,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 100,
-                    "endColumn": 105,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -629,22 +541,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 57,
-                    "endColumn": 62,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 64,
-                    "endColumn": 69,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportOptionalCall",
                 "range": {
@@ -669,14 +565,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 54,
-                    "endColumn": 59,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportOptionalMemberAccess",
                 "range": {
@@ -827,14 +715,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 70,
-                    "endColumn": 75,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -853,14 +733,6 @@
             }
         ],
         "./backend/app/api/routes/manyfold.py": [
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 58,
-                    "endColumn": 62,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {
@@ -1031,22 +903,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 48,
-                    "endColumn": 52,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 39,
-                    "endColumn": 43,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportArgumentType",
                 "range": {

CHANGELOG.md

@@ -164,6 +164,29 @@ All notable changes to Bambuddy will be documented in this file.
 - **The frontend build no longer warns about `path` and `crypto` being externalized for the STEP previewer (#2976)** — `occt-import-js`, the Emscripten build behind STEP previews, requires both modules, but only inside its `ENVIRONMENT_IS_NODE` branches; in the browser it loads its `.wasm` from the URL the preview worker passes and draws randomness from `crypto.getRandomValues`. Vite still externalized both and printed two warnings on every build. `vite.config.ts` now drops exactly those two warnings for that one package through `build.rolldownOptions.onLog`, so an externalization anywhere else, or of any other module, still shows.
 
 ### Fixed
+- **Purging archives could delete by an age that wasn't previewed** — The "Purge old archives" dialog previews what it will delete a moment after you stop typing, but the delete button took the age currently in the field. Changing the age and clicking straight away deleted archives for the new age while the button still showed the old preview's count. The button now waits until the preview matches the field, and the purge uses the previewed age.
+- **Editing a transaction to "No cost center" kept the old cost center** — Finance showed "Transaction updated", but the entry stayed booked to its previous cost center.
+- **After deleting a printer, spools still showed as loaded in it** — The spool assignment list wasn't refreshed, so the inventory kept showing spools in the deleted printer's slots for up to 30 seconds.
+- **API keys of Operators were refused on queue, archive and library routes** — A key whose owner may act only on their own rows (the built-in Operators group) got `403 API key owner does not have 'queue:update_all' permission` when it listed, edited, cancelled or deleted even its owner's own queue jobs, and the same on archives and library files. Such a key now acts on its owner's rows and not on anyone else's. Keys of owners with the `_all` permissions, and keys without an owner, reach every row as before.
+- **Statistics: Today, This Week and the other ranges used UTC days** — Near midnight they showed the wrong day's prints for anyone outside UTC: in Berlin at 01:30, "Today" showed the previous day. A day now runs from midnight to midnight in your browser's time zone, for every date filter on the Statistics page, and the date pickers allow today. API callers can name the zone with the new `tz` parameter on the date-filtered archive and statistics endpoints; without it, a date is a day in Bambuddy's own `TZ` (UTC days before).
+- **A print that failed on its first run left the archive costing only the part it printed** — With the built-in inventory, the archive took the failed run's partial cost, so a reprint was estimated, reserved and billed from that fraction. The archive now keeps the cost of one full print (as in Spoolman mode); the failed run's own cost is still recorded in the Print Log.
+- **Spoolman: a very short print could end with its estimated cost instead of the real one** — The cost estimate made at print start could still be waiting on Spoolman when the print ended, and then wrote over the real cost. Completion now stops it first.
+- **After a 2FA or SSO login, LDAP and OIDC users were offered "Change Password"** — The login answered as if they were local users, until the page was reloaded.
+- **The same printer fault could be listed twice** — A fault the printer reported both as a print error and in its HMS list was not recognised as the same one.
+- **H2D: a refused manual filament load could show the wrong active tray later** — Its target slot was remembered until something cleared it, so a print loading the same slot number on another AMS much later was shown as that slot. It is now forgotten after two minutes.
+- **K-profiles: a printer refusing the re-applied profile after an RFID read was not in the logs** — Only the "applied" line was, which made wrong pressure-advance prints hard to diagnose.
+- **K-profiles: opening several pages at once could fetch the cloud filament names many times** — Each one fetched every custom preset from Bambu Cloud while holding a database connection; they now share one fetch.
+- **Library API: changing a file's folder could move it into or out of an external folder without moving the file** — The file then showed in a folder it was not in. That change is now refused with a pointer to the move endpoint, which moves the file itself.
+- **Slicing: a slow progress answer was reported as "Slicer sidecar unreachable"** — It now says the sidecar did not answer in time.
+- **Printer card: the cooling/heating mode switched on the printer showed the old mode** — The live updates did not carry it, so the card caught up only with its next refresh.
+- **Printer card: an H2C rack slot's material label disappeared** — The live updates replaced the rack without each slot's filament type, so the label fell back to the filament ID or went blank until the next refresh.
+- **Git backup: a print running when the backup was made came back as a failed print** — Restored as still printing, the archive was closed on the next printer reconnect as if the print had just failed, with a failure notification and a Print Log entry. It is now restored as cancelled ("No status update received"), the way Bambuddy closes a print it lost track of; an archive this instance still has keeps its own status on overwrite.
+- **Git backup: spools came back as never used** — When each spool was last used was not in the backup. It is now backed up and restored (an older backup leaves the value already there).
+- **File manager: a slow folder listing showed as "printer unavailable"** — Listing a large folder (such as the camera recordings) on a slow SD card can outlast the wait, and was reported like an unreachable printer; every refresh also started another listing while the last one still ran. It now says the listing is taking too long, and a refresh waits for the listing already running.
+- **Printer files from the evening could be dated a year back** — File times on the printer carry no year, and the year was taken from the host's local clock while printers report UTC. On a host behind UTC, files written in the evening were dated a year back, so their camera recordings were not matched to their prints.
+- **SpoolBuddy: writing a sticker could break a Bambu spool's AMS link in Spoolman mode** — A Bambu spool created from the AMS is linked by its RFID tray ID; it was listed as untagged on the Write Tag page, and a sticker written to it replaced that link in Spoolman, so the next AMS sync created a duplicate spool. It is no longer listed as untagged, and on a Spoolman that does not also keep the tray ID as a native tag (before 0.27) the write is refused with the reason.
+- **SpoolBuddy: Write Tag warned "color_name not set" for every Spoolman spool** — The warning looked at a Spoolman field that is never filled; Bambuddy keeps the colour name with the spool. It now warns only when the name is missing, and says the tag then carries the subtype instead.
+- **SpoolBuddy: an update reported success after installing its dependencies timed out** — The device was restarted while the install could still be running. A timeout now stops the update with an error (and the time allowed went from 2 to 5 minutes); a failed install still completes, and its output is now in the log.
 - **Virtual printer: a late slicer update could rewrite a queue job already being sent** — The slicer's print options can reach a virtual printer seconds after the job was queued. If the scheduler had already started sending the job, its AMS mapping and options were still rewritten, so the queue entry -- and the spool charged from it -- could differ from what the printer printed. Such a job is now left as it was sent.
 - **Backup restore: the virtual printers kept running during the restore** — The step meant to stop them did nothing, so their FTP, MQTT and discovery services stayed up while files were replaced. They are now stopped, and start again with the restart a restore asks for.
 - **API: the legacy virtual printer settings route answered 200 for settings it no longer applies** — `PUT /settings/virtual-printer` saved enabled, access code, mode, model, target printer and remote interface to settings nothing reads (each virtual printer keeps its own). It now refuses them with a pointer to `PUT /virtual-printers/{id}`; the archive name source and Tailscale switch still work there.

backend/app/api/routes/archives.py

@@ -5,7 +5,7 @@ import logging
 import re as _re
 import zipfile
 from collections import defaultdict
-from datetime import date, datetime, time, timedelta, timezone
+from datetime import date, datetime, timedelta, timezone
 from html import escape as html_escape
 from pathlib import Path
 
@@ -60,7 +60,7 @@ from backend.app.services.print_storage import (
 from backend.app.services.printer_media import VIDEO_SUFFIXES, match_ipcam_chunks
 from backend.app.utils.archive_paths import archive_photos_dir, find_archive_photo
 from backend.app.utils.http import build_content_disposition, download_error_response, safe_download_filename
-from backend.app.utils.local_time import to_naive_utc
+from backend.app.utils.local_time import day_zone, local_date_end, local_date_start, to_naive_utc
 from backend.app.utils.threemf_tools import (
     default_plate_gcode_name,
     expand_to_project_slots,
@@ -192,7 +192,7 @@ def _visible_archive_clauses(user, can_read_all: bool, printer_scope: PrinterSco
 
 def _ensure_archive_visible(
     archive: PrintArchive | None,
-    user: User | None,
+    user: User | ApiKeyActor | None,
     can_read_all: bool,
     printer_scope: PrinterScope,
 ) -> PrintArchive:
@@ -437,10 +437,13 @@ async def list_archives(
     project_id: int | None = None,
     date_from: date | None = Query(None),
     date_to: date | None = Query(None),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     limit: int = 50,
     offset: int = 0,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -461,6 +464,7 @@ async def list_archives(
         offset=offset,
         visible_to_user_id=visible_to_user_id,
         printer_scope=printer_scope,
+        day_zone=day_zone(tz),
     )
 
     # Get sets of duplicate hashes and duplicate (name, hash) pairs (efficient single queries),
@@ -567,7 +571,7 @@ async def list_archives(
 @router.get("/last-per-printer", response_model=list[ArchiveResponse])
 async def list_last_archive_per_printer(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -626,7 +630,7 @@ async def list_last_archive_per_printer(
 @router.get("/no-3mf-warning")
 async def no_3mf_warning(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -732,11 +736,14 @@ async def no_3mf_warning(
 async def list_archives_slim(
     date_from: date | None = Query(None),
     date_to: date | None = Query(None),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     created_by_id: int | None = Query(None, description="Filter by user who created the print (-1 for no user)"),
     limit: int = Query(default=10000, le=50000),
     offset: int = 0,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -767,10 +774,10 @@ async def list_archives_slim(
         created_by_id = current_user.id
     filters = []
     if date_from:
-        dt_from = datetime.combine(date_from, time.min, tzinfo=timezone.utc)
+        dt_from = local_date_start(date_from, day_zone(tz))
         filters.append(PrintLogEntry.created_at >= dt_from)
     if date_to:
-        dt_to = datetime.combine(date_to, time.max, tzinfo=timezone.utc)
+        dt_to = local_date_end(date_to, day_zone(tz))
         filters.append(PrintLogEntry.created_at <= dt_to)
     _apply_run_user_filter(filters, created_by_id)
     if (clause := printer_scope.where(PrintLogEntry.printer_id)) is not None:
@@ -853,7 +860,7 @@ async def search_archives(
     limit: int = 50,
     offset: int = 0,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1028,11 +1035,14 @@ async def analyze_failures(
     days: int | None = None,
     date_from: date | None = Query(None),
     date_to: date | None = Query(None),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     printer_id: int | None = None,
     project_id: int | None = None,
     created_by_id: int | None = Query(None, description="Filter by user who created the print (-1 for no user)"),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1066,6 +1076,7 @@ async def analyze_failures(
         project_id=project_id,
         created_by_id=created_by_id,
         printer_scope=printer_scope,
+        day_zone=day_zone(tz),
     )
 
 
@@ -1073,7 +1084,7 @@ async def analyze_failures(
 async def compare_archives(
     archive_ids: str = Query(..., description="Comma-separated archive IDs (2-5)"),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1140,10 +1151,13 @@ async def export_archives(
     status: str | None = None,
     date_from: str | None = Query(None, description="Start date (ISO format)"),
     date_to: str | None = Query(None, description="End date (ISO format)"),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     search: str | None = None,
     db: AsyncSession = Depends(get_db),
     printer_scope: PrinterScope = RequestPrinterScope,
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1176,7 +1190,11 @@ async def export_archives(
     date_to_dt = None
     if date_from:
         try:
-            date_from_dt = to_naive_utc(datetime.fromisoformat(date_from))
+            # A date on its own is a local calendar day (DB-C12).
+            if len(date_from) == 10:
+                date_from_dt = to_naive_utc(local_date_start(date.fromisoformat(date_from), day_zone(tz)))
+            else:
+                date_from_dt = to_naive_utc(datetime.fromisoformat(date_from))
         except (ValueError, OverflowError):
             raise HTTPException(400, "Invalid date_from format")
     if date_to:
@@ -1184,7 +1202,7 @@ async def export_archives(
             # A date on its own ends with that day, as every other date filter
             # here reads it; read as midnight it left out the whole day.
             if len(date_to) == 10:
-                date_to_dt = datetime.combine(date.fromisoformat(date_to), time.max)
+                date_to_dt = to_naive_utc(local_date_end(date.fromisoformat(date_to), day_zone(tz)))
             else:
                 date_to_dt = to_naive_utc(datetime.fromisoformat(date_to))
         except (ValueError, OverflowError):
@@ -1260,6 +1278,9 @@ async def export_stats(
 async def get_archive_stats(
     date_from: date | None = Query(None, description="Start date (inclusive), YYYY-MM-DD"),
     date_to: date | None = Query(None, description="End date (inclusive), YYYY-MM-DD"),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     created_by_id: int | None = Query(None, description="Filter by user who created the print (-1 for no user)"),
     db: AsyncSession = Depends(get_db),
     current_user: User | None = RequirePermissionIfAuthEnabled(Permission.STATS_READ),
@@ -1280,10 +1301,10 @@ async def get_archive_stats(
     # Build date filter conditions scoped to PrintLogEntry (event-time).
     base_conditions = []
     if date_from:
-        dt_from = datetime.combine(date_from, time.min, tzinfo=timezone.utc)
+        dt_from = local_date_start(date_from, day_zone(tz))
         base_conditions.append(PrintLogEntry.created_at >= dt_from)
     if date_to:
-        dt_to = datetime.combine(date_to, time.max, tzinfo=timezone.utc)
+        dt_to = local_date_end(date_to, day_zone(tz))
         base_conditions.append(PrintLogEntry.created_at <= dt_to)
     _apply_run_user_filter(base_conditions, created_by_id)
     # Only prints on printers the caller may see (#1727)
@@ -1479,8 +1500,8 @@ async def get_archive_stats(
     elif energy_tracking_mode == "total":
         # Total consumption mode with a date filter (#941): use hourly snapshots
         # to compute per-plug (endpoint - baseline) deltas.
-        dt_from = datetime.combine(date_from, time.min, tzinfo=timezone.utc) if date_from else None
-        dt_to = datetime.combine(date_to, time.max, tzinfo=timezone.utc) if date_to else None
+        dt_from = local_date_start(date_from, day_zone(tz)) if date_from else None
+        dt_to = local_date_end(date_to, day_zone(tz)) if date_to else None
         total_energy_kwh, energy_data_warming_up = await _sum_snapshot_deltas(db, dt_from=dt_from, dt_to=dt_to)
         costed = await snapshot_cost(db, fallback_price=energy_cost_per_kwh, dt_from=dt_from, dt_to=dt_to)
         total_energy_cost = cost_at_average_price(total_energy_kwh, costed.kwh, costed.cost, energy_cost_per_kwh)
@@ -1650,7 +1671,7 @@ async def _sum_snapshot_deltas(
 @router.get("/tags")
 async def get_all_tags(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1782,7 +1803,7 @@ async def delete_tag(
 async def get_archive(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1812,7 +1833,7 @@ async def get_archive(
 async def get_archive_delete_impact(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1842,7 +1863,7 @@ async def get_archive_delete_impact(
 async def list_archive_runs(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1875,7 +1896,7 @@ async def find_similar_archives(
     archive_id: int,
     limit: int = 10,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -1909,7 +1930,7 @@ async def update_archive(
     archive_id: int,
     update_data: ArchiveUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -2068,7 +2089,7 @@ async def update_archive(
 async def toggle_favorite(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -2266,7 +2287,7 @@ async def recalculate_all_costs(
 async def get_archive_duplicates(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2337,7 +2358,7 @@ async def delete_archive(
         ),
     ),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,
@@ -2407,7 +2428,7 @@ async def download_archive(
     archive_id: int,
     inline: bool = False,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2440,7 +2461,7 @@ async def download_archive_with_filename(
     archive_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2468,7 +2489,7 @@ async def download_archive_with_filename(
 async def create_archive_slicer_token(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2531,7 +2552,7 @@ async def download_archive_for_slicer(
 async def get_thumbnail(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2570,7 +2591,7 @@ async def get_thumbnail(
 @router.get("/{archive_id}/printer-media")
 async def get_archive_printer_media(
     archive_id: int,
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2715,7 +2736,7 @@ async def get_archive_printer_media(
 @router.post("/{archive_id}/media-download-token")
 async def create_archive_media_download_token(
     archive_id: int,
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(Permission.ARCHIVES_READ_ALL, Permission.ARCHIVES_READ_OWN)
     ),
     printer_scope: PrinterScope = RequestPrinterScope,
@@ -2771,7 +2792,7 @@ async def download_archive_media_with_token(
 async def get_timelapse(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -2817,7 +2838,7 @@ async def get_timelapse(
 async def delete_timelapse(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,
@@ -3280,7 +3301,7 @@ async def upload_timelapse(
 async def get_timelapse_info(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -3317,7 +3338,7 @@ async def get_timelapse_thumbnails(
     count: int = Query(10, ge=1, le=30),
     width: int = Query(160, ge=80, le=320),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -3475,7 +3496,7 @@ async def upload_photo(
     archive_id: int,
     file: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -3523,7 +3544,7 @@ async def get_photo(
     archive_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -3575,7 +3596,7 @@ async def delete_photo(
     archive_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,
@@ -3860,7 +3881,7 @@ async def get_qrcode(
     request: Request,
     size: int = 200,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -3923,7 +3944,7 @@ async def get_qrcode(
 async def get_archive_capabilities(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -4151,7 +4172,7 @@ async def get_gcode(
     archive_id: int,
     plate: int | None = None,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -4209,7 +4230,7 @@ async def get_gcode(
 async def get_plate_preview(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -4436,7 +4457,7 @@ async def upload_archives_bulk(
 async def get_archive_plates(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -4758,7 +4779,7 @@ async def get_plate_thumbnail(
     archive_id: int,
     plate_index: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -4845,7 +4866,7 @@ async def get_filament_requirements(
     request_id: str | None = None,
     full_slots: bool = False,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5159,7 +5180,7 @@ async def reprint_archive(
 async def get_project_page(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5190,7 +5211,7 @@ async def update_project_page(
     archive_id: int,
     update_data: dict,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -5225,7 +5246,7 @@ async def get_project_image(
     archive_id: int,
     image_path: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5319,7 +5340,7 @@ async def upload_source_3mf(
     archive_id: int,
     file: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -5371,7 +5392,7 @@ async def upload_source_3mf(
 async def download_source_3mf(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5406,7 +5427,7 @@ async def download_source_3mf_for_slicer(
     archive_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5437,7 +5458,7 @@ async def download_source_3mf_for_slicer(
 async def create_source_slicer_token(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5592,7 +5613,7 @@ async def upload_source_3mf_by_name(
 async def delete_source_3mf(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,
@@ -5630,7 +5651,7 @@ async def upload_f3d(
     archive_id: int,
     file: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,
@@ -5682,7 +5703,7 @@ async def upload_f3d(
 async def download_f3d(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -5716,7 +5737,7 @@ async def download_f3d(
 async def delete_f3d(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,

backend/app/api/routes/cloud.py

@@ -15,6 +15,7 @@ from fastapi.security import HTTPAuthorizationCredentials
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from backend.app.core import database
 from backend.app.core.auth import (
     RequirePermissionIfAuthEnabled,
     _user_from_api_key,
@@ -24,6 +25,7 @@ from backend.app.core.auth import (
 )
 from backend.app.core.database import get_db
 from backend.app.core.permissions import Permission
+from backend.app.core.tasks import spawn_background_task
 from backend.app.models.api_key import APIKey
 from backend.app.models.settings import Settings
 from backend.app.models.user import User
@@ -184,6 +186,8 @@ router = APIRouter(prefix="/cloud", tags=["cloud"], dependencies=[Depends(_cloud
 def _forget_account_presets(account: int | None) -> None:
     """Drop what was read with an account's cloud token, once that token changes."""
     _filament_id_name_cache.pop(account, None)
+    # A build still running reads with the old token; it must not be joined.
+    _filament_id_map_inflight.pop(account, None)
     for key in [key for key in _filament_cache if key[0] == account]:
         del _filament_cache[key]
 
@@ -191,6 +195,7 @@ def _forget_account_presets(account: int | None) -> None:
 def forget_all_cloud_presets() -> None:
     """Drop every account's cached presets (the user table was replaced)."""
     _filament_id_name_cache.clear()
+    _filament_id_map_inflight.clear()
     _filament_cache.clear()
 
 
@@ -1303,11 +1308,12 @@ async def get_builtin_filaments(
 # cloud account: the user whose token read it, or None for the global token
 # used when auth is off. Value: (time read, mapping).
 _filament_id_name_cache: dict[int | None, tuple[float, dict[str, str]]] = {}
+# Builds still running, by account (RC-C11).
+_filament_id_map_inflight: dict[int | None, asyncio.Future] = {}
 
 
 @router.get("/filament-id-map")
 async def get_filament_id_map(
-    db: AsyncSession = Depends(get_db),
     current_user: User | None = cloud_caller(Permission.FILAMENTS_READ),
 ):
     """
@@ -1326,7 +1332,36 @@ async def get_filament_id_map(
     if cached and time.time() - cached[0] < FILAMENT_CACHE_TTL:
         return cached[1]
 
-    cloud = await build_authenticated_cloud(db, current_user)
+    # One build per account at a time: when the cache expired, every K-profile
+    # view asked at once and each ran the full 1 + N fetch (RC-C11). Registered
+    # before anything is awaited, so callers arriving together all join it.
+    running = _filament_id_map_inflight.get(account)
+    if running is None or running.done():
+        running = spawn_background_task(_build_filament_id_map(current_user, account), name="cloud-filament-id-map")
+        _filament_id_map_inflight[account] = running
+
+        def _forget(done: asyncio.Future, account: int | None = account) -> None:
+            if _filament_id_map_inflight.get(account) is done:
+                del _filament_id_map_inflight[account]
+
+        running.add_done_callback(_forget)
+    try:
+        # shield: a caller that goes away must not cancel the build others joined.
+        return dict(await asyncio.shield(running))
+    except Exception:
+        return cached[1] if cached else {}
+
+
+async def _build_filament_id_map(user: User | None, account: int | None) -> dict[str, str]:
+    """Fetch an account's custom presets and map their filament ids to names.
+
+    Reads the stored token in a session of its own, closed before the Bambu
+    Cloud round-trips: no request holds a database connection across them.
+    """
+    import time
+
+    async with database.async_session() as db:
+        cloud = await build_authenticated_cloud(db, user)
     if cloud is None or not cloud.is_authenticated:
         if cloud is not None:
             await cloud.close()
@@ -1355,10 +1390,11 @@ async def get_filament_id_map(
             except Exception:
                 pass
 
-        _filament_id_name_cache[account] = (time.time(), result)
+        # Not when the account signed out meanwhile: its build was dropped,
+        # and this map was read with the token that is gone.
+        if _filament_id_map_inflight.get(account) is asyncio.current_task():
+            _filament_id_name_cache[account] = (time.time(), result)
         return result
-    except Exception:
-        return cached[1] if cached else {}
     finally:
         await cloud.close()
 

backend/app/api/routes/inventory.py

@@ -1,6 +1,6 @@
 import json
 import logging
-from datetime import date, datetime, time, timezone
+from datetime import date, datetime, timezone
 
 import httpx
 from fastapi import APIRouter, Depends, File, HTTPException, Query, UploadFile
@@ -95,6 +95,7 @@ from backend.app.utils.filament_ids import (
     normalize_slicer_filament,
 )
 from backend.app.utils.filament_types import is_material_name, nozzle_temp_range, printer_filament_type
+from backend.app.utils.local_time import day_zone, local_date_end, local_date_start
 from backend.app.utils.natural_sort import natural_sort_key
 from backend.app.utils.tag_normalization import normalize_tag_uid, normalize_tray_uuid
 
@@ -1427,7 +1428,6 @@ async def export_spools_csv(
     _: User | None = RequirePermissionIfAuthEnabled(Permission.INVENTORY_READ),
 ):
     """Export the active inventory as CSV (same schema the importer accepts)."""
-    from datetime import datetime, timezone
 
     query = (
         select(Spool)
@@ -1738,7 +1738,6 @@ async def archive_spool(
     _: User | None = RequirePermissionIfAuthEnabled(Permission.INVENTORY_UPDATE),
 ):
     """Soft-delete a spool by setting archived_at."""
-    from datetime import datetime, timezone
 
     result = await db.execute(select(Spool).where(Spool.id == spool_id))
     spool = result.scalar_one_or_none()
@@ -1915,7 +1914,6 @@ async def bulk_archive_spools(
     _: User | None = RequirePermissionIfAuthEnabled(Permission.INVENTORY_UPDATE),
 ):
     """Soft-archive every listed spool (sets archived_at). Already-archived spools are left alone and counted in already_archived."""
-    from datetime import datetime, timezone
 
     result = await db.execute(select(Spool).where(Spool.id.in_(payload.ids)))
     spools = list(result.scalars().all())
@@ -2618,6 +2616,9 @@ async def get_spool_usage_history(
 async def get_supplier_stats(
     date_from: date | None = Query(None, description="Start date (inclusive), YYYY-MM-DD"),
     date_to: date | None = Query(None, description="End date (inclusive), YYYY-MM-DD"),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     db: AsyncSession = Depends(get_db),
     _: User | None = RequirePermissionIfAuthEnabled(Permission.INVENTORY_READ),
 ):
@@ -2638,9 +2639,9 @@ async def get_supplier_stats(
     purchase_link = (SpoolSupplier.spool_id == Spool.id) & SpoolSupplier.is_purchase_source.is_(True)
     usage_window = []
     if date_from:
-        usage_window.append(SpoolUsageHistory.created_at >= datetime.combine(date_from, time.min, tzinfo=timezone.utc))
+        usage_window.append(SpoolUsageHistory.created_at >= local_date_start(date_from, day_zone(tz)))
     if date_to:
-        usage_window.append(SpoolUsageHistory.created_at <= datetime.combine(date_to, time.max, tzinfo=timezone.utc))
+        usage_window.append(SpoolUsageHistory.created_at <= local_date_end(date_to, day_zone(tz)))
 
     remaining = Spool.label_weight - Spool.weight_used
     inventory_rows = await db.execute(
@@ -2706,6 +2707,9 @@ async def get_supplier_stats(
 async def get_material_number_stats(
     date_from: date | None = Query(None),
     date_to: date | None = Query(None),
+    tz: str | None = Query(
+        None, max_length=64, description="IANA zone the dates are calendar days in; the server's when omitted"
+    ),
     db: AsyncSession = Depends(get_db),
     _: User | None = RequirePermissionIfAuthEnabled(Permission.INVENTORY_READ),
 ):
@@ -2730,11 +2734,13 @@ async def get_material_number_stats(
     # validator, so NULL is the only "unset" state to exclude here.
     has_number = Spool.material_number.is_not(None)
 
-    usage_filters = [has_number]
+    from sqlalchemy import ColumnElement
+
+    usage_filters: list[ColumnElement[bool]] = [has_number]
     if date_from:
-        usage_filters.append(SpoolUsageHistory.created_at >= datetime.combine(date_from, time.min, tzinfo=timezone.utc))
+        usage_filters.append(SpoolUsageHistory.created_at >= local_date_start(date_from, day_zone(tz)))
     if date_to:
-        usage_filters.append(SpoolUsageHistory.created_at <= datetime.combine(date_to, time.max, tzinfo=timezone.utc))
+        usage_filters.append(SpoolUsageHistory.created_at <= local_date_end(date_to, day_zone(tz)))
 
     # Clamped PER SPOOL, like every other remaining-weight computation in the
     # codebase: a spool whose weight_used overshot its label_weight holds 0 g,
@@ -3142,7 +3148,6 @@ async def update_shopping_list_status(
     ),
 ):
     """Update the purchase status of a shopping list item."""
-    from datetime import datetime, timezone
 
     from backend.app.models.shopping_list import ShoppingListItem
 

backend/app/api/routes/library.py

@@ -139,7 +139,7 @@ _PROJECT_SETTINGS_PATH = "Metadata/project_settings.config"
 
 def _ensure_library_file_visible(
     library_file: LibraryFile | None,
-    user: User | None,
+    user: User | ApiKeyActor | None,
     can_read_all: bool,
 ) -> LibraryFile:
     """Per-file visibility gate for ownership-scoped LIBRARY reads (#1726-adjacent).
@@ -184,7 +184,7 @@ def _archive_link(archive_id: int | None, archives: dict[int, str | None]) -> di
     return {"archive_id": archive_id, "archive_name": archives[archive_id]}
 
 
-def _own_files_filter(user: User | None) -> list:
+def _own_files_filter(user: User | ApiKeyActor | None) -> list:
     """Extra WHERE terms that count only ``user``'s files, for a read_own user.
 
     Folder file counts and activity times must not reveal files the user
@@ -195,7 +195,7 @@ def _own_files_filter(user: User | None) -> list:
     return [LibraryFile.created_by_id == user.id]
 
 
-async def _load_index(db: AsyncSession, user: User | None) -> FolderIndex:
+async def _load_index(db: AsyncSession, user: User | ApiKeyActor | None) -> FolderIndex:
     """The folder index a response for ``user`` needs (#3201).
 
     Who owns which file is needed only to decide what a read_own user sees
@@ -208,7 +208,7 @@ async def _load_index(db: AsyncSession, user: User | None) -> FolderIndex:
     return await load_folder_index(db, with_files=needs_files)
 
 
-def _folder_access_fields(index: FolderIndex, folder: LibraryFolder, user: User | None) -> dict:
+def _folder_access_fields(index: FolderIndex, folder: LibraryFolder, user: User | ApiKeyActor | None) -> dict:
     """The ownership fields of a folder response, for the user asking (#3201)."""
     return {
         "created_by_id": folder.created_by_id,
@@ -1022,7 +1022,7 @@ async def _backfill_external_thumbnails(folder_ids: list[int]) -> None:
 async def list_folders(
     response: Response,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -1142,7 +1142,7 @@ async def list_folders(
 async def get_folders_by_project(
     project_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -1210,7 +1210,7 @@ async def get_folders_by_project(
 async def get_folders_by_archive(
     archive_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -1340,7 +1340,7 @@ async def create_folder(
 async def get_folder(
     folder_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -1409,7 +1409,7 @@ _README_PREFERRED_STEMS = ("readme", "description")
 async def get_folder_readme(
     folder_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -1470,7 +1470,7 @@ async def update_folder(
     folder_id: int,
     data: FolderUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -1593,7 +1593,7 @@ async def update_folder(
 async def delete_folder(
     folder_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -2272,7 +2272,7 @@ async def list_files(
     recursive: bool = False,
     tag_ids: list[int] = Query(default_factory=list),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -2931,7 +2931,7 @@ async def extract_zip_file(
 async def batch_generate_stl_thumbnails(
     request: BatchThumbnailRequest,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -3400,7 +3400,7 @@ async def add_files_to_queue(
 async def get_library_file_plates(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -3693,7 +3693,7 @@ async def get_library_file_plate_thumbnail(
     file_id: int,
     plate_index: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -3781,7 +3781,7 @@ async def get_library_file_filament_requirements(
     request_id: str | None = None,
     full_slots: bool = False,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5350,7 +5350,7 @@ async def print_library_file(
 async def get_file(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5449,7 +5449,7 @@ async def update_file(
     file_id: int,
     data: FileUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -5483,12 +5483,21 @@ async def update_file(
         # and _without_print_name strips the embedded 3MF Title on import (#1489).
 
     if data.folder_id is not None:
-        if data.folder_id == 0:
-            file.folder_id = None
-        else:
+        target_folder = None
+        if data.folder_id != 0:
             # library:update_all moves into any folder, as before (#3201).
-            await get_writable_folder(db, data.folder_id, None if can_modify_all else user)
-            file.folder_id = data.folder_id
+            target_folder = await get_writable_folder(db, data.folder_id, None if can_modify_all else user)
+        # Into or out of an external folder the bytes have to move too, and a
+        # read-only one refuses them: that is the move route's work. Here only
+        # folder_id changed, so the file showed in a folder its bytes were not
+        # in (F8).
+        unchanged = (target_folder.id if target_folder is not None else None) == file.folder_id
+        if not unchanged and (file.is_external or (target_folder is not None and target_folder.is_external)):
+            raise HTTPException(
+                status_code=400,
+                detail="Move a file into or out of an external folder with POST /api/v1/library/files/move",
+            )
+        file.folder_id = target_folder.id if target_folder is not None else None
 
     if data.project_id is not None:
         if data.project_id == 0:
@@ -5520,7 +5529,7 @@ async def update_file(
 async def delete_file(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -5578,7 +5587,7 @@ async def delete_file(
 async def download_file(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5605,7 +5614,7 @@ async def download_file(
 async def create_library_slicer_token(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5667,7 +5676,7 @@ async def download_library_file_for_slicer(
 async def get_thumbnail(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5708,7 +5717,7 @@ async def upload_preview_thumbnail(
     file_id: int,
     thumbnail: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -5809,7 +5818,7 @@ async def upload_file_photo(
     file_id: int,
     file: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -5865,7 +5874,7 @@ async def get_file_photo(
     file_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -5898,7 +5907,7 @@ async def delete_file_photo(
     file_id: int,
     filename: str,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -5944,7 +5953,7 @@ async def get_gcode(
     file_id: int,
     plate: int | None = None,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -6007,7 +6016,7 @@ async def get_gcode(
 async def move_files(
     data: FileMoveRequest,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -6113,7 +6122,7 @@ async def move_files(
 async def bulk_delete(
     data: BulkDeleteRequest,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -6213,7 +6222,7 @@ async def bulk_delete(
 @router.get("/stats")
 async def get_library_stats(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,

backend/app/api/routes/library_tags.py

@@ -35,7 +35,7 @@ from sqlalchemy import delete, distinct, func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from backend.app.core.auth import require_ownership_permission, require_permission_if_auth_enabled
+from backend.app.core.auth import ApiKeyActor, require_ownership_permission, require_permission_if_auth_enabled
 from backend.app.core.database import get_db
 from backend.app.core.permissions import Permission
 from backend.app.models.library import LibraryFile, LibraryFileTag, LibraryTag
@@ -68,7 +68,7 @@ def _name_key(name: str) -> str:
 @router.get("/", response_model=list[TagResponse])
 async def list_tags(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -209,7 +209,7 @@ async def delete_tag(
 async def bulk_assign(
     payload: TagBulkAssignRequest,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,

backend/app/api/routes/library_trash.py

@@ -20,7 +20,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from backend.app.core.auth import require_ownership_permission, require_permission_if_auth_enabled
+from backend.app.core.auth import ApiKeyActor, require_ownership_permission, require_permission_if_auth_enabled
 from backend.app.core.database import get_db
 from backend.app.core.permissions import Permission
 from backend.app.models.library import LibraryFile, LibraryFolder
@@ -90,7 +90,7 @@ async def list_trash(
     limit: int = Query(default=100, ge=1, le=500),
     offset: int = Query(default=0, ge=0),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -153,7 +153,7 @@ async def list_trash(
 async def _load_trashed_file(
     db: AsyncSession,
     file_id: int,
-    user: User | None,
+    user: User | ApiKeyActor | None,
     can_modify_all: bool,
 ) -> LibraryFile:
     """Fetch a trashed file, enforcing ownership for non-admins."""
@@ -176,7 +176,7 @@ async def _load_trashed_file(
 async def restore_from_trash(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -193,7 +193,7 @@ async def restore_from_trash(
 async def hard_delete_from_trash(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,
@@ -210,7 +210,7 @@ async def hard_delete_from_trash(
 @router.delete("/trash", response_model=EmptyTrashResponse)
 async def empty_trash(
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_DELETE_ALL,
             Permission.LIBRARY_DELETE_OWN,

backend/app/api/routes/library_variants.py

@@ -43,7 +43,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from backend.app.core.auth import require_ownership_permission
+from backend.app.core.auth import ApiKeyActor, require_ownership_permission
 from backend.app.core.database import get_db
 from backend.app.core.permissions import Permission
 from backend.app.models.library import FileVariantGroup, LibraryFile
@@ -97,7 +97,7 @@ def resolve_variant_model(lib_file: LibraryFile, explicit: str | None = None) ->
 async def _load_files(
     db: AsyncSession,
     file_ids: list[int],
-    user: User | None,
+    user: User | ApiKeyActor | None,
     can_access_all: bool,
 ) -> dict[int, LibraryFile]:
     """Fetch the caller's visible, untrashed files by id."""
@@ -187,7 +187,7 @@ async def _dissolve_if_too_small(db: AsyncSession, group: FileVariantGroup) -> b
 async def create_variant_group(
     payload: VariantGroupCreate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -242,7 +242,7 @@ async def create_variant_group(
 async def get_group_for_file(
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -269,7 +269,7 @@ async def get_group_for_file(
 async def get_variant_group(
     group_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -284,7 +284,7 @@ async def update_variant_group(
     group_id: int,
     payload: VariantGroupUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -324,7 +324,7 @@ async def add_variant_group_member(
     payload: VariantGroupMemberRequest,
     group_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -380,7 +380,7 @@ async def remove_variant_group_member(
     group_id: int,
     file_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,
@@ -407,7 +407,7 @@ async def remove_variant_group_member(
 async def delete_variant_group(
     group_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_UPDATE_ALL,
             Permission.LIBRARY_UPDATE_OWN,

backend/app/api/routes/mfa.py

@@ -68,7 +68,6 @@ from backend.app.schemas.auth import (
     EmailOTPDisableRequest,
     EmailOTPEnableConfirmRequest,
     EmailOTPSendRequest,
-    GroupBrief,
     LoginResponse,
     OIDCAuthorizeResponse,
     OIDCExchangeRequest,
@@ -197,17 +196,12 @@ router = APIRouter(prefix="/auth", tags=["2fa", "oidc"])
 # Helper: user response
 # ---------------------------------------------------------------------------
 def _user_to_response(user: User) -> UserResponse:
-    return UserResponse(
-        id=user.id,
-        username=user.username,
-        email=user.email,
-        role=user.role,
-        is_active=user.is_active,
-        is_admin=user.is_admin,
-        groups=[GroupBrief(id=g.id, name=g.name) for g in user.groups],
-        permissions=sorted(user.get_permissions()),
-        created_at=user.created_at.isoformat(),
-    )
+    # The auth routes' builder, not a copy: the copy here left out
+    # ``auth_source``, so a 2FA or OIDC login reported LDAP and OIDC users as
+    # local and the page offered them "Change Password" (PC-C9).
+    from backend.app.api.routes.auth import _user_to_response as build
+
+    return build(user)
 
 
 # ---------------------------------------------------------------------------

backend/app/api/routes/pending_uploads.py

@@ -8,7 +8,7 @@ from pydantic import BaseModel
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from backend.app.core.auth import RequirePermissionIfAuthEnabled, require_ownership_permission
+from backend.app.core.auth import ApiKeyActor, RequirePermissionIfAuthEnabled, require_ownership_permission
 from backend.app.core.database import get_db
 from backend.app.core.permissions import Permission
 from backend.app.models.pending_upload import PendingUpload
@@ -92,7 +92,7 @@ async def _augment_with_display_name(
 @router.get("/", response_model=list[PendingUploadResponse])
 async def list_pending_uploads(
     db: AsyncSession = Depends(get_db),
-    _: tuple[User | None, bool] = Depends(
+    _: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -110,7 +110,7 @@ async def list_pending_uploads(
 @router.get("/count")
 async def get_pending_count(
     db: AsyncSession = Depends(get_db),
-    _: tuple[User | None, bool] = Depends(
+    _: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -219,7 +219,7 @@ async def discard_all_pending(
 async def get_pending_upload(
     upload_id: int,
     db: AsyncSession = Depends(get_db),
-    _: tuple[User | None, bool] = Depends(
+    _: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,

backend/app/api/routes/print_log.py

@@ -7,6 +7,7 @@ from sqlalchemy import delete, func, nullslast, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from backend.app.core.auth import (
+    ApiKeyActor,
     MediaOrRequestPrinterScope,
     RequestPrinterScope,
     RequirePermissionIfAuthEnabled,
@@ -64,7 +65,7 @@ async def get_print_log(
     sort_by: str = Query(default="date"),
     sort_dir: str = Query(default="desc", pattern="^(asc|desc)$"),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -145,7 +146,7 @@ async def get_print_log(
 async def get_print_log_thumbnail(
     entry_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_media_token_ownership(
             Permission.ARCHIVES_READ_ALL,
             Permission.ARCHIVES_READ_OWN,
@@ -213,7 +214,7 @@ async def clear_print_log(
 async def delete_print_log_entry(
     entry_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_DELETE_ALL,
             Permission.ARCHIVES_DELETE_OWN,
@@ -285,7 +286,7 @@ async def update_print_log_entry(
     entry_id: int,
     update: PrintLogEntryUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.ARCHIVES_UPDATE_ALL,
             Permission.ARCHIVES_UPDATE_OWN,

backend/app/api/routes/print_queue.py

@@ -684,7 +684,7 @@ async def list_queue(
         None, description="Filter by target model (also includes model-based items when combined with printer_id)"
     ),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -1306,11 +1306,25 @@ async def add_to_queue(
     return _enrich_response(item)
 
 
+def _releases_model_job(item: PrintQueueItem, update_data: dict) -> bool:
+    """Whether an edit lets the scheduler dispatch ``item`` as an "any printer
+    of a model" job: it starts a waiting one, or takes the printer off one that
+    keeps its model. The scheduler then picks from its creator's printers,
+    which a limited key may not reach (see ``ensure_model_target_allowed``).
+    """
+    if update_data.get("printer_id", item.printer_id) is not None:
+        return False
+    if not update_data.get("target_model", item.target_model):
+        return False
+    starts = bool(item.manual_start) and "manual_start" in update_data and not update_data["manual_start"]
+    return starts or item.printer_id is not None
+
+
 @router.patch("/bulk", response_model=PrintQueueBulkUpdateResponse)
 async def bulk_update_queue_items(
     data: PrintQueueBulkUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_UPDATE_ALL,
             Permission.QUEUE_UPDATE_OWN,
@@ -1376,6 +1390,12 @@ async def bulk_update_queue_items(
         ):
             skipped_count += 1
             continue
+        if _releases_model_job(item, update_data):
+            try:
+                ensure_model_target_allowed(user, printer_scope)
+            except HTTPException:
+                skipped_count += 1
+                continue
 
         item_update_data = update_data.copy()
         rebinds = "printer_id" in item_update_data and item_update_data["printer_id"] != item.printer_id
@@ -1855,7 +1875,7 @@ async def list_batches(
     external_source: str | None = Query(None, description="Filter by the integration that created the batch"),
     external_ref: str | None = Query(None, description="Filter by the external record the batch fulfils"),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -1917,7 +1937,7 @@ async def list_batches(
 async def get_batch(
     batch_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -2065,7 +2085,7 @@ async def _build_batch_response(
 async def get_queue_item(
     item_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_READ_ALL,
             Permission.QUEUE_READ_OWN,
@@ -2105,7 +2125,7 @@ async def update_queue_item(
     item_id: int,
     data: PrintQueueItemUpdate,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_UPDATE_ALL,
             Permission.QUEUE_UPDATE_OWN,
@@ -2156,6 +2176,8 @@ async def update_queue_item(
         and not may_start_queue_item(user, can_modify_all, item.created_by_id)
     ):
         raise HTTPException(403, _AWAITING_REVIEW)
+    if _releases_model_job(item, update_data):
+        ensure_model_target_allowed(user, printer_scope)
 
     # Normalize target_model if being updated (see add_to_queue for why the
     # code map has to run first).
@@ -2303,7 +2325,7 @@ async def update_queue_item(
 async def delete_queue_item(
     item_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_DELETE_ALL,
             Permission.QUEUE_DELETE_OWN,
@@ -2502,7 +2524,7 @@ async def resume_model_queue_after_failure(
 async def cancel_queue_item(
     item_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_UPDATE_ALL,
             Permission.QUEUE_UPDATE_OWN,
@@ -2551,7 +2573,7 @@ async def cancel_queue_item(
 async def stop_queue_item(
     item_id: int,
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_UPDATE_ALL,
             Permission.QUEUE_UPDATE_OWN,
@@ -2685,7 +2707,7 @@ async def start_queue_item(
     item_id: int,
     skip_filament_check: bool = Query(default=False),
     db: AsyncSession = Depends(get_db),
-    auth_result: tuple[User | None, bool] = Depends(
+    auth_result: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.QUEUE_UPDATE_ALL,
             Permission.QUEUE_UPDATE_OWN,
@@ -2737,6 +2759,10 @@ async def start_queue_item(
             raise HTTPException(403, "You can only start your own queue items")
     if not may_start_queue_item(user, can_modify_all, item.created_by_id):
         raise HTTPException(403, _AWAITING_REVIEW)
+    if item.printer_id is None and item.target_model:
+        # The scheduler picks from the creator's printers, which a limited key
+        # may not reach (and claiming an unowned job makes the owner creator).
+        ensure_model_target_allowed(user, printer_scope)
 
     if item.status != "pending":
         raise HTTPException(400, f"Can only start pending items, current status: '{item.status}'")

backend/app/api/routes/printers.py

@@ -1658,7 +1658,10 @@ async def list_printer_files(
     return {
         "path": path,
         "files": files,
-        "warnings": [] if listing.available else ["printer_unavailable"],
+        # Slow is not gone: a large folder on a slow card can outlast the wait (TO-C13).
+        "warnings": (
+            [] if listing.available else ["listing_timed_out"] if listing.timed_out else ["printer_unavailable"]
+        ),
     }
 
 

backend/app/api/routes/slice_jobs.py

@@ -7,7 +7,7 @@ status flips to `completed` or `failed`.
 
 from fastapi import APIRouter, Depends, HTTPException
 
-from backend.app.core.auth import require_ownership_permission
+from backend.app.core.auth import ApiKeyActor, require_ownership_permission
 from backend.app.core.permissions import Permission
 from backend.app.models.user import User
 from backend.app.services.slice_dispatch import slice_dispatch
@@ -22,7 +22,7 @@ async def get_slice_job(
     # the resulting library_file_id / archive_id. Gate on the library read
     # permission family (own/all) and then scope per-row: a READ_OWN caller may
     # only poll jobs they started (SliceJob.owner_id).
-    auth: tuple[User | None, bool] = Depends(
+    auth: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -33,10 +33,10 @@ async def get_slice_job(
     job = slice_dispatch.get(job_id)
     if job is None:
         raise HTTPException(status_code=404, detail="Slice job not found or expired")
-    # Per-row scoping. Jobs started by API-key / auth-disabled callers have
-    # owner_id=None and are visible only to READ_ALL pollers (fail-closed,
-    # mirrors the library ownerless-row rule). 404 not 403 to avoid job-id
-    # enumeration.
+    # Per-row scoping. Jobs recorded without an owner (auth off, a key without
+    # an owner, an archive slice through a key) are visible only to READ_ALL
+    # pollers (fail-closed, mirrors the library ownerless-row rule). 404 not
+    # 403 to avoid job-id enumeration.
     if not can_read_all and (user is None or job.owner_id != user.id):
         raise HTTPException(status_code=404, detail="Slice job not found or expired")
     body: dict = {

backend/app/api/routes/slicer_presets.py

@@ -27,6 +27,7 @@ from backend.app.api.routes.orca_cloud import (
     _load_credentials as _load_orca_credentials,
 )
 from backend.app.core.auth import (
+    ApiKeyActor,
     RequestPrinterScope,
     RequirePermissionIfAuthEnabled,
     is_auth_enabled,
@@ -818,7 +819,7 @@ async def list_loaded_spools(
 async def get_preview_slice_progress(
     request_id: str,
     db: AsyncSession = Depends(get_db),
-    _: tuple[User | None, bool] = Depends(
+    _: tuple[User | ApiKeyActor | None, bool] = Depends(
         require_ownership_permission(
             Permission.LIBRARY_READ_ALL,
             Permission.LIBRARY_READ_OWN,
@@ -848,6 +849,10 @@ async def get_preview_slice_progress(
     try:
         async with httpx.AsyncClient(timeout=5.0) as client:
             response = await client.get(url)
+    except httpx.TimeoutException:
+        # Busy, not gone: a heavy slice can hold the progress answer past 5 s
+        # (TO-C14). Still 503, so the poller keeps trying.
+        raise HTTPException(status_code=503, detail="Slicer sidecar did not answer in time") from None
     except httpx.RequestError:
         # Sidecar unreachable: surface as 503 instead of 500 so the
         # frontend's poller can keep trying without flagging a hard error.

backend/app/api/routes/spoolbuddy.py

@@ -4,6 +4,7 @@ import asyncio
 import contextlib
 import json
 import logging
+import re
 import time
 from datetime import datetime, timedelta, timezone
 from urllib.parse import urlparse
@@ -708,19 +709,36 @@ async def nfc_write_tag(
                 detail="Spoolman spool has no material set — cannot encode NFC tag",
             )
 
+        # A Bambu spool created from the AMS is linked by its tray UUID in
+        # extra.tag; a sticker would replace it there, and the next AMS sync,
+        # no longer finding the spool, would create a duplicate (SM-C5). Not
+        # when Spoolman also keeps that UUID as a native tag (0.27+): the sync
+        # finds the spool by it first, and the sticker leaves it alone.
+        from backend.app.api.routes._spoolman_helpers import _extract_extra_str
+
+        extra_tag = _extract_extra_str(sm_spool.get("extra") or {}, "tag").strip().upper()
+        native_uids = {str(t.get("uid", "")).upper() for t in sm_spool.get("tags") or [] if isinstance(t, dict)}
+        if re.fullmatch(r"[0-9A-F]{32}", extra_tag) and extra_tag not in native_uids:
+            raise HTTPException(
+                status_code=409,
+                detail="This spool is linked to its Bambu RFID tag through the AMS; "
+                "a sticker would replace that link in Spoolman",
+            )
+
         ndef_data = encode_opentag3d_from_mapped(mapped)
         data_origin = "spoolman"
 
         # Warn when fields that drive NFC content are absent in Spoolman.
-        # color_name specifically must check the raw filament field, not the
-        # mapped value — _map_spoolman_spool falls back to the filament's
-        # subtype when color_name is unset (so LinkSpoolModal stops showing
-        # "Unknown color"), but the NFC tag should still warn when Spoolman
-        # has no genuine color_name on file. Without this, the fallback
-        # silently masks a real missing-data condition.
-        raw_filament: dict = sm_spool.get("filament") or {}
-        if not raw_filament.get("color_name"):
-            nfc_warnings.append("color_name not set in Spoolman — tag encodes empty color name")
+        # The colour name is read the way the tag gets it: from the spool's
+        # extra (where Bambuddy keeps it -- Spoolman's filament has no such
+        # field, so checking that warned on every spool, SM-C6), else the
+        # subtype stands in for it.
+        if mapped.get("color_name") is None:
+            nfc_warnings.append("color_name not set in Spoolman — tag encodes an empty color name")
+        elif mapped.get("color_name_is_synthesized"):
+            nfc_warnings.append(
+                f"color_name not set in Spoolman — tag encodes the subtype ({mapped['color_name']}) as its color name"
+            )
         if not mapped.get("nozzle_temp_min"):
             nfc_warnings.append("nozzle_temp_min not set in Spoolman — tag encodes 0 °C")
         if not mapped.get("subtype"):

backend/app/core/auth.py

@@ -153,11 +153,11 @@ _APIKEY_SCOPE_BY_PERMISSION: dict[Permission, str | tuple[str, ...]] = {
     # can_manage_library — file-manager scope (upload/rename/delete library
     # entries + MakerWorld import which downloads files into the library).
     # OWN and ALL ownership variants map to the same scope so the
-    # `require_ownership_permission` checker (which gates on `all_perm`)
-    # passes the API key through. This matches `can_queue` and the
-    # archives/inventory scopes — API keys have no per-row ownership identity
-    # (line 1663), so splitting OWN/ALL across allowlist/denylist made the
-    # whole library curation surface unreachable for API keys (#1832).
+    # `require_ownership_permission` checker passes the API key through and
+    # lets its owner's OWN/ALL permission decide the rows. This matches
+    # `can_queue` and the archives/inventory scopes; splitting OWN/ALL across
+    # allowlist/denylist made the whole library curation surface unreachable
+    # for API keys (#1832).
     # LIBRARY_PURGE stays admin-only as a genuinely destructive op that
     # bypasses the soft-delete window.
     Permission.LIBRARY_UPLOAD: "can_manage_library",
@@ -193,10 +193,9 @@ _APIKEY_SCOPE_BY_PERMISSION: dict[Permission, str | tuple[str, ...]] = {
     # can_manage_archives — print-history curation. Carved out of the admin
     # denylist so automations can prune old prints via API key (#1888): the
     # archive delete/update routes gate on
-    # ``require_ownership_permission(ARCHIVES_*_ALL, ARCHIVES_*_OWN)``, which
-    # resolves the ALL permission for API keys (no per-row ownership identity,
-    # same as can_queue / can_manage_library), so OWN and ALL map to the same
-    # scope. ARCHIVES_PURGE stays admin-only (see denylist) as a genuinely
+    # ``require_ownership_permission(ARCHIVES_*_ALL, ARCHIVES_*_OWN)``, where
+    # the key's owner's OWN/ALL permission decides the rows (same as can_queue
+    # / can_manage_library), so OWN and ALL map to the same scope. ARCHIVES_PURGE stays admin-only (see denylist) as a genuinely
     # destructive op that drops the stats contribution, mirroring LIBRARY_PURGE.
     # ARCHIVES_REPRINT_* stays under can_queue (it enqueues a print).
     Permission.ARCHIVES_CREATE: "can_manage_archives",
@@ -2171,9 +2170,11 @@ async def validated_api_key_from_request(
     """Return the validated API key carried by a request, if any.
 
     Permission dependencies intentionally return ``None`` for API-key callers so
-    routes do not mistake a key for a user identity. Printer-bound routes still
-    need the key row to enforce ``printer_ids`` after the normal scope/owner
-    permission gate has run. This helper recognizes both supported transports.
+    routes do not mistake a key for a user identity (the ownership dependency
+    returns an ``ApiKeyActor`` for a key whose owner may act on own rows only).
+    Printer-bound routes still need the key row to enforce ``printer_ids`` after
+    the normal scope/owner permission gate has run. This helper recognizes both
+    supported transports.
     """
 
     candidate = x_api_key
@@ -2249,7 +2250,7 @@ async def get_printer_scope_if_auth_enabled(
 RequestPrinterScope = Depends(get_printer_scope_if_auth_enabled)
 
 
-def queue_review_required_for(user: User | None) -> bool:
+def queue_review_required_for(user: User | ApiKeyActor | None) -> bool:
     """Whether jobs ``user`` queues must wait for someone to start them (#1620).
 
     None is auth-off or a legacy ownerless API key, neither of which has a
@@ -2263,7 +2264,7 @@ def queue_review_required_for(user: User | None) -> bool:
     )
 
 
-def may_start_queue_item(user: User | None, can_modify_all: bool, created_by_id: int | None) -> bool:
+def may_start_queue_item(user: User | ApiKeyActor | None, can_modify_all: bool, created_by_id: int | None) -> bool:
     """Whether the caller may start a waiting queue item (#1620).
 
     ``can_modify_all`` is what ``require_ownership_permission`` answered for
@@ -2789,14 +2790,15 @@ def require_ownership_permission(
     - User with ``all_permission`` can modify any item
     - User with ``own_permission`` can only modify items where created_by_id == user.id
     - Ownerless items (created_by_id = null) require ``all_permission``
-    - API keys (via X-API-Key header or Bearer bb_xxx) must satisfy the
-      ``all_permission``'s API-key scope flag (e.g. ``can_queue`` for
-      ``QUEUE_UPDATE_ALL``) and then receive ``can_modify_all=True``.
-      OWN/ALL ownership pairs map to the same scope flag in
-      ``_APIKEY_SCOPE_BY_PERMISSION`` so checking ``all_permission`` is the
-      correct gate; API keys have no per-row ownership identity. Pre-
-      GHSA-r2qv-8222-hqg3 fix this returned ``(None, True)`` for any valid
-      key with no scope check — see ``core/auth.py`` allowlist commentary.
+    - API keys (via X-API-Key header or Bearer bb_xxx) act as their owner:
+      a key whose owner holds ``all_permission`` gets ``(None, True)``; a key
+      whose owner holds only ``own_permission`` gets ``(ApiKeyActor, False)``,
+      so the route's per-row check compares rows against the owner's id.
+      Either way the key needs the permission's scope flag (OWN and ALL map
+      to the same one). A legacy key without an owner owns nothing and still
+      needs ``all_permission``. Pre-GHSA-r2qv-8222-hqg3 this returned
+      ``(None, True)`` for any valid key with no scope check — see
+      ``core/auth.py`` allowlist commentary.
 
     Returns:
         A dependency function that returns (user, can_modify_all).
@@ -2806,10 +2808,22 @@ def require_ownership_permission(
     all_perm = all_permission.value if isinstance(all_permission, Permission) else all_permission
     own_perm = own_permission.value if isinstance(own_permission, Permission) else own_permission
 
+    async def _api_key_ownership(db: AsyncSession, api_key: APIKey) -> tuple[ApiKeyActor | None, bool]:
+        owner = await resolve_apikey_owner(db, api_key)
+        if owner is None:
+            # A legacy key without an owner has no id to own rows by.
+            _check_apikey_permissions(api_key, [all_perm])
+            return None, True
+        _check_apikey_permissions(api_key, [all_perm, own_perm], owner=owner, require_any=True)
+        actor = ApiKeyActor(api_key, owner)
+        if actor.has_permission(all_perm):
+            return None, True
+        return actor, False
+
     async def checker(
         credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)] = None,
         x_api_key: Annotated[str | None, Header(alias="X-API-Key")] = None,
-    ) -> tuple[User | None, bool]:
+    ) -> tuple[User | ApiKeyActor | None, bool]:
         """Returns (user, can_modify_all).
 
         - can_modify_all=True: user can modify any item
@@ -2823,17 +2837,11 @@ def require_ownership_permission(
             # GHSA-r2qv-8222-hqg3: previously API keys received (None, True)
             # unconditionally on ownership-modify routes — a "queue-only" key
             # could delete any user's archives, library files, queue items.
-            # OWN and ALL ownership perms both map to the same scope flag
-            # (e.g. both QUEUE_UPDATE_OWN and QUEUE_UPDATE_ALL → can_queue),
-            # so checking ``all_perm`` against the api_key's scope is the
-            # correct gate. API keys don't have per-row ownership identity, so
-            # on pass we keep can_modify_all=True (preserves prior intent,
-            # narrows access to keys with the right scope flag).
+            # A key now passes only with the scope flag, and acts as its owner.
             if x_api_key:
                 api_key = await _validate_api_key(db, x_api_key)
                 if api_key:
-                    await authorize_api_key(db, api_key, [all_perm])
-                    return None, True
+                    return await _api_key_ownership(db, api_key)
 
             # Check for Bearer token (could be JWT or API key)
             if credentials is not None:
@@ -2842,8 +2850,7 @@ def require_ownership_permission(
                 if token.startswith("bb_"):
                     api_key = await _validate_api_key(db, token)
                     if api_key:
-                        await authorize_api_key(db, api_key, [all_perm])
-                        return None, True
+                        return await _api_key_ownership(db, api_key)
                     raise HTTPException(
                         status_code=status.HTTP_401_UNAUTHORIZED,
                         detail="Invalid API key",
@@ -2985,9 +2992,9 @@ def require_media_token_ownership(
     token holder.
 
     Header callers are delegated to :func:`require_ownership_permission`
-    unchanged -- including its API-key rule, where a key satisfying the ALL
-    permission's scope flag gets ``can_read_all=True`` because keys have no
-    per-row identity.
+    unchanged -- including its API-key rule, where a key acts as its owner: its
+    owner's ALL permission gives ``can_read_all=True``, the OWN one an
+    ``ApiKeyActor`` limited to the owner's rows.
     """
     all_perm = all_permission.value if isinstance(all_permission, Permission) else all_permission
     own_perm = own_permission.value if isinstance(own_permission, Permission) else own_permission
@@ -2997,7 +3004,7 @@ def require_media_token_ownership(
         token: str | None = None,
         credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)] = None,
         x_api_key: Annotated[str | None, Header(alias="X-API-Key")] = None,
-    ) -> tuple[User | None, bool]:
+    ) -> tuple[User | ApiKeyActor | None, bool]:
         async with async_session() as db:
             if not await is_auth_enabled(db):
                 return None, True  # Auth disabled, allow all

backend/app/core/printer_scope.py

@@ -86,14 +86,18 @@ ALL_PRINTERS = PrinterScope()
 
 
 def ensure_model_target_allowed(user, scope: PrinterScope) -> None:
-    """Refuse an "any printer of a model" job from a limited caller with no user.
+    """Refuse an "any printer of a model" job from a limited caller that is no user.
 
     The scheduler keeps such a job within its *creator's* scope, but a job
-    queued through an API key records no creator, so a key limited to certain
-    printers could otherwise reach the rest of the fleet through it. Users are
-    unaffected: their jobs carry their id.
+    queued through an API key records no creator, or its owner as creator, and
+    a key may be limited to fewer printers than its owner, so a limited key
+    could otherwise reach the rest of the fleet through it. A key comes as
+    ``None`` or as its ``ApiKeyActor``. Users are unaffected: their jobs carry
+    their id.
     """
-    if user is None and not scope.is_unrestricted:
+    from backend.app.core.auth import ApiKeyActor
+
+    if (user is None or isinstance(user, ApiKeyActor)) and not scope.is_unrestricted:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="A caller limited to certain printers must queue to a specific printer, not to any printer of a model",

backend/app/main.py

@@ -107,6 +107,7 @@ from backend.app.services.ams_assignment_lock import get_ams_assignment_lock
 from backend.app.services.archive import ArchiveService, peek_plate_index_in_3mf, swap_plate_suffix
 from backend.app.services.archive_cost_estimate import (
     schedule_archive_cost_estimate as _schedule_archive_cost_estimate,
+    settle_archive_cost_estimate as _settle_archive_cost_estimate,
 )
 from backend.app.services.archive_purge import archive_purge_service
 from backend.app.services.bambu_ftp import (
@@ -2061,6 +2062,9 @@ async def on_printer_status_change(printer_id: int, state: PrinterState):
         state.firmware_version,
         state.developer_mode,
         tuple(state.print_ams_mapping) if isinstance(state.print_ams_mapping, list) else None,
+        # Cooling/heating, switched on the printer's screen too: on an idle
+        # printer nothing else moves the key (PSF-4).
+        state.airduct_mode,
     )
     status_key = f"{status_key}:{machine_key}"
 
@@ -8432,6 +8436,10 @@ async def _close_out_print(printer_id: int, data: dict):
     if archive_id:
         notify_plate_id = _print_plate_ids.pop(archive_id, None)
 
+    # The start estimate must not outlive the real cost written below (COST-4).
+    if archive_id:
+        await _settle_archive_cost_estimate(archive_id)
+
     # Internal inventory: track AMS remain% deltas (skip if Spoolman handles usage)
     try:
         async with async_session() as db:

backend/app/services/archive.py

@@ -7,7 +7,7 @@ import re
 import shutil
 import zipfile
 from collections.abc import Sequence
-from datetime import date, datetime, time, timezone
+from datetime import date, datetime, timezone, tzinfo
 from pathlib import Path
 from typing import Any
 
@@ -25,6 +25,7 @@ from backend.app.models.printer import Printer
 from backend.app.utils.archive_paths import archive_dir as resolve_archive_dir
 from backend.app.utils.ffmpeg_output import NO_FFMPEG_OUTPUT, summarize_ffmpeg_stderr
 from backend.app.utils.filename import clean_display_name
+from backend.app.utils.local_time import local_date_end, local_date_start
 from backend.app.utils.safe_path import PathTraversalError, assert_under, safe_join_under
 from backend.app.utils.threemf_tools import bed_temperature_from_config, used_filament_indexes
 
@@ -1650,6 +1651,7 @@ class ArchiveService:
         offset: int = 0,
         visible_to_user_id: int | None = None,
         printer_scope: PrinterScope | None = None,
+        day_zone: tzinfo | None = None,
     ) -> list[PrintArchive]:
         """List archives with optional filtering.
 
@@ -1676,11 +1678,11 @@ class ArchiveService:
             query = query.where(PrintArchive.project_id == project_id)
 
         if date_from:
-            dt_from = datetime.combine(date_from, time.min, tzinfo=timezone.utc)
+            dt_from = local_date_start(date_from, day_zone)
             query = query.where(PrintArchive.created_at >= dt_from)
 
         if date_to:
-            dt_to = datetime.combine(date_to, time.max, tzinfo=timezone.utc)
+            dt_to = local_date_end(date_to, day_zone)
             query = query.where(PrintArchive.created_at <= dt_to)
 
         if visible_to_user_id is not None:

backend/app/services/archive_cost_estimate.py

@@ -26,6 +26,7 @@ Strictly best-effort. Nothing here may fail a print start.
 """
 
 import asyncio
+import contextlib
 import json
 import logging
 
@@ -183,10 +184,38 @@ def schedule_archive_cost_estimate(
             await estimate_archive_cost_at_start(db, printer_id, archive_id, printer_manager, mapping, plate_id)
 
     try:
-        return spawn_background_task(_run(), name=f"archive-cost-estimate-{archive_id}")
+        task = spawn_background_task(_run(), name=f"archive-cost-estimate-{archive_id}")
     except Exception:  # noqa: BLE001 -- an estimate must never fail a print start
         logger.warning("[COST] Archive %s: could not schedule the cost estimate", archive_id, exc_info=True)
         return None
+    _running_estimates[archive_id] = task
+
+    def _forget(done: asyncio.Task, archive_id: int = archive_id) -> None:
+        if _running_estimates.get(archive_id) is done:
+            del _running_estimates[archive_id]
+
+    task.add_done_callback(_forget)
+    return task
+
+
+# Estimates still running, by archive: completion stops its archive's before
+# writing the real cost (COST-4).
+_running_estimates: dict[int, asyncio.Task] = {}
+
+
+async def settle_archive_cost_estimate(archive_id: int) -> None:
+    """Stop the archive's start estimate, if still running, before the real cost.
+
+    Completion commits the measured cost before it marks the archive ended; an
+    estimate still waiting on Spoolman then saw a printing archive with no runs
+    logged, and wrote its figure over the real one on a very short print.
+    """
+    task = _running_estimates.pop(archive_id, None)
+    if task is None or task.done():
+        return
+    task.cancel()
+    with contextlib.suppress(asyncio.CancelledError, Exception):
+        await task
 
 
 async def estimate_archive_cost_at_start(

backend/app/services/bambu_ftp.py

@@ -12,6 +12,7 @@ from collections.abc import AsyncIterator, Awaitable, Callable
 from concurrent.futures import ThreadPoolExecutor
 from contextlib import asynccontextmanager
 from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
 from enum import Enum
 from ftplib import FTP, FTP_TLS  # nosec B402
 from io import BytesIO
@@ -250,12 +251,44 @@ class DownloadDeadlineExceeded(Exception):
     """
 
 
+def _parse_list_mtime(month: str, day: str, time_or_year: str, *, now_utc: datetime | None = None) -> datetime | None:
+    """The time of an FTP LIST entry, naive, in the printer's own basis.
+
+    "Nov 30 10:15" carries no year: it is the year the entry is not in the
+    future in. Printers report UTC (tested X1C/H2D firmware; see
+    printer_media.match_ipcam_chunks), so "now" is UTC, not the host's local
+    clock -- on a host behind UTC an evening entry read as a future one and
+    went a year back (DB-C8). A day of slack keeps firmware that reports its
+    local time, up to 14 h ahead, in this year too. "Nov 30 2024" has a year
+    and no time. None when the entry cannot be read; mtime is best-effort.
+    """
+    now_utc = now_utc or datetime.now(timezone.utc).replace(tzinfo=None)
+    try:
+        if ":" in time_or_year:
+            mtime = datetime.strptime(f"{month} {day} {now_utc.year} {time_or_year}", "%b %d %Y %H:%M")
+            if mtime > now_utc + timedelta(days=1):
+                mtime = mtime.replace(year=now_utc.year - 1)
+            return mtime
+        return datetime.strptime(f"{month} {day} {time_or_year}", "%b %d %Y")
+    except ValueError:
+        return None
+
+
 @dataclass(frozen=True)
 class FileListResult:
     """A directory listing that distinguishes empty from unreachable."""
 
     files: list[dict]
     available: bool
+    # The printer did not answer within the wait: slow, not necessarily gone
+    # (a large /ipcam on a slow card), so not reported as unavailable (TO-C13).
+    timed_out: bool = False
+
+
+# Listings still running, by printer and folder: a refresh joins the one in
+# progress instead of starting another thread, which ftplib cannot cancel and
+# which would otherwise pile up in the shared FTP pool (TO-C13).
+_inflight_listings: dict[tuple[str, str, str], tuple[asyncio.Future, threading.Event]] = {}
 
 
 class DeleteResult(Enum):
@@ -864,29 +897,7 @@ class BambuFTPClient:
 
                     # Parse modification time from FTP listing
                     # Format: "Nov 30 10:15" or "Nov 30  2024"
-                    mtime = None
-                    try:
-                        from datetime import datetime
-
-                        month = parts[5]
-                        day = parts[6]
-                        time_or_year = parts[7]
-
-                        # Determine if it's time (HH:MM) or year
-                        if ":" in time_or_year:
-                            # Recent file: "Nov 30 10:15" - assume current year
-                            year = datetime.now().year
-                            time_str = f"{month} {day} {year} {time_or_year}"
-                            mtime = datetime.strptime(time_str, "%b %d %Y %H:%M")
-                            # If parsed date is in the future, use last year
-                            if mtime > datetime.now():
-                                mtime = mtime.replace(year=year - 1)
-                        else:
-                            # Older file: "Nov 30 2024" - no time, just date
-                            time_str = f"{month} {day} {time_or_year}"
-                            mtime = datetime.strptime(time_str, "%b %d %Y")
-                    except (ValueError, IndexError):
-                        pass  # Non-critical: mtime parsing is best-effort; file entry works without it
+                    mtime = _parse_list_mtime(parts[5], parts[6], parts[7])
 
                     file_entry = {
                         "name": name,
@@ -2286,23 +2297,44 @@ async def list_files_result_async(
     """List a directory without collapsing transport failure into empty."""
 
     loop = asyncio.get_event_loop()
+    key = (ip_address, access_code, path)
+    running = _inflight_listings.get(key)
+    if running is None or running[0].done():
+        # Set once the printer has answered: only then is a timeout a slow
+        # listing rather than a printer that is not there.
+        connected = threading.Event()
+
+        def _list() -> FileListResult:
+            client = BambuFTPClient(ip_address, access_code, timeout=socket_timeout, printer_model=printer_model)
+            if not client.connect():
+                return FileListResult(files=[], available=False)
+            connected.set()
+            try:
+                return FileListResult(files=client.list_files(path, raise_on_error=True), available=True)
+            except (OSError, ftplib.Error):
+                return FileListResult(files=[], available=False)
+            finally:
+                client.disconnect()
 
-    def _list() -> FileListResult:
-        client = BambuFTPClient(ip_address, access_code, timeout=socket_timeout, printer_model=printer_model)
-        if not client.connect():
-            return FileListResult(files=[], available=False)
-        try:
-            return FileListResult(files=client.list_files(path, raise_on_error=True), available=True)
-        except (OSError, ftplib.Error):
-            return FileListResult(files=[], available=False)
-        finally:
-            client.disconnect()
+        running = (loop.run_in_executor(_ftp_executor, _list), connected)
+        _inflight_listings[key] = running
 
+        def _forget(done: asyncio.Future, key: tuple[str, str, str] = key) -> None:
+            entry = _inflight_listings.get(key)
+            if entry is not None and entry[0] is done:
+                del _inflight_listings[key]
+
+        running[0].add_done_callback(_forget)
+    future, connected = running
     try:
-        return await asyncio.wait_for(loop.run_in_executor(_ftp_executor, _list), timeout=timeout)
+        # shield: one caller giving up must not cancel the listing another
+        # caller joined.
+        result = await asyncio.wait_for(asyncio.shield(future), timeout=timeout)
     except TimeoutError:
         logger.warning("FTP list_files timed out after %ss for %s", timeout, path)
-        return FileListResult(files=[], available=False)
+        return FileListResult(files=[], available=False, timed_out=connected.is_set())
+    # Joined callers share the listing; each gets entries of its own to edit.
+    return FileListResult(files=[dict(f) for f in result.files], available=result.available)
 
 
 async def find_remote_file_async(

backend/app/services/bambu_mqtt.py

@@ -29,6 +29,11 @@ from backend.app.utils.paho_teardown import retire_paho_client
 
 logger = logging.getLogger(__name__)
 
+# How long a manual load's tray target stays a hint for an H2D's tray_now: long
+# enough for a real load to report, short enough that a refused one cannot
+# relabel a later print's load of the same slot number (FW-C7).
+PENDING_TRAY_TARGET_TTL = 120.0
+
 # AMS module name prefixes used in get_version responses.
 # The numeric suffix after '/' is the AMS unit ID as reported in push_status.
 #   "ams/<id>"  – original AMS (X1C, X1E, P1S, …)
@@ -1043,6 +1048,8 @@ class PrinterState:
     last_loaded_tray: int = -1
     # Pending load target - used to track what tray we're loading for H2D disambiguation
     pending_tray_target: int | None = None
+    # When it was set (time.monotonic): see PENDING_TRAY_TARGET_TTL.
+    pending_tray_target_at: float | None = None
     # AMS status for filament change tracking (from print.ams.ams_status field)
     # ams_status is a combined value: lower 8 bits = sub status, bits 8-15 = main status
     # Main status: 0=idle, 1=filament_change, 2=rfid_identifying, 3=assist, 4=calibration, etc.
@@ -2586,15 +2593,16 @@ class BambuMQTTClient:
                         self._dev_mode_probe_seq is not None
                         and print_data.get("sequence_id") == self._dev_mode_probe_seq
                     )
-                    if (
-                        cmd == "ams_filament_setting"
-                        and not is_dev_mode_probe
-                        and isinstance(result, str)
-                        and result.lower() != "success"
-                    ):
+                    # extrusion_cali_sel too (FW-C3): every RFID re-read
+                    # re-applies the spool's K-profile and logs "Applied PA
+                    # profile", so its refusal must reach the bundle beside it.
+                    # The printer's word, not a verdict: the extrusion_cali_*
+                    # acks are known to say "fail" for writes that applied.
+                    if not is_dev_mode_probe and isinstance(result, str) and result.lower() != "success":
                         logger.info(
-                            "[%s] ams_filament_setting refused: result=%s reason=%s ams_id=%s tray_id=%s",
+                            "[%s] %s refused: result=%s reason=%s ams_id=%s tray_id=%s",
                             self.serial_number,
+                            cmd,
                             result,
                             print_data.get("reason", ""),
                             print_data.get("ams_id"),
@@ -3377,6 +3385,19 @@ class BambuMQTTClient:
                 if self._is_dual_nozzle and 0 <= parsed_tray_now <= 3:
                     # First, check if we have a pending target that matches this slot
                     pending_target = self.state.pending_tray_target
+                    pending_at = self.state.pending_tray_target_at
+                    if (
+                        pending_target is not None
+                        and pending_at is not None
+                        and time.monotonic() - pending_at > PENDING_TRAY_TARGET_TTL
+                    ):
+                        # A load the printer refused or dropped: nothing clears
+                        # it (tray_now stays 255), and a print loading the same
+                        # slot number on another AMS long after was shown as
+                        # this target (FW-C7). Fall through to the snow field.
+                        self.state.pending_tray_target = None
+                        self.state.pending_tray_target_at = None
+                        pending_target = None
                     if pending_target is not None:
                         # Same slot rule as the snow branch below: an AMS-HT
                         # (128-135) has its one tray in slot 0.
@@ -5247,7 +5268,10 @@ class BambuMQTTClient:
                         for e in self.state.hms_errors:
                             # Extract short code from existing errors
                             e_module = (e.attr >> 16) & 0xFFFF
-                            e_error = int(e.code.replace("0x", ""), 16) if e.code else 0
+                            # The low half only: an hms[] code carries its alert
+                            # level above it (0x18061 for 0500_8061), and read
+                            # whole it never matched, listing the fault twice (M-U9).
+                            e_error = (int(e.code.replace("0x", ""), 16) & 0xFFFF) if e.code else 0
                             existing_short_codes.add(f"{e_module:04X}_{e_error:04X}")
 
                         if short_code not in existing_short_codes:
@@ -7859,6 +7883,7 @@ class BambuMQTTClient:
         # Track this load request for H2D dual-nozzle disambiguation
         # H2D reports only slot number (0-3) in tray_now, so we use our tracked value
         self.state.pending_tray_target = tray_id
+        self.state.pending_tray_target_at = time.monotonic()
         logger.info("[%s] Set pending_tray_target=%s for H2D disambiguation", self.serial_number, tray_id)
 
         return True
@@ -7965,6 +7990,7 @@ class BambuMQTTClient:
 
         # Clear tracked load request since we're unloading
         self.state.pending_tray_target = None
+        self.state.pending_tray_target_at = None
         logger.info("[%s] Cleared pending_tray_target (unload)", self.serial_number)
 
         return True

backend/app/services/failure_analysis.py

@@ -1,5 +1,5 @@
 from collections import defaultdict
-from datetime import date, datetime, time, timedelta, timezone
+from datetime import date, datetime, timedelta, timezone, tzinfo
 
 from sqlalchemy import and_, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -7,6 +7,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from backend.app.core.printer_scope import PrinterScope
 from backend.app.models.print_log import PrintLogEntry
 from backend.app.models.printer import Printer
+from backend.app.utils.local_time import local_date_end, local_date_start
 
 
 class FailureAnalysisService:
@@ -31,17 +32,22 @@ class FailureAnalysisService:
         project_id: int | None = None,
         created_by_id: int | None = None,
         printer_scope: PrinterScope | None = None,
+        day_zone: tzinfo | None = None,
     ) -> dict:
-        """Analyze failure patterns across logged print events."""
+        """Analyze failure patterns across logged print events.
+
+        ``day_zone``: the zone ``date_from``/``date_to`` are calendar days in
+        (the server's when None).
+        """
         # Build base query — separate date vs non-date filters for trend reuse
         base_filter = []
         non_date_filter = []
         if date_from or date_to:
             if date_from:
-                dt_from = datetime.combine(date_from, time.min, tzinfo=timezone.utc)
+                dt_from = local_date_start(date_from, day_zone)
                 base_filter.append(PrintLogEntry.created_at >= dt_from)
             if date_to:
-                dt_to = datetime.combine(date_to, time.max, tzinfo=timezone.utc)
+                dt_to = local_date_end(date_to, day_zone)
                 base_filter.append(PrintLogEntry.created_at <= dt_to)
             range_start = dt_from if date_from else datetime.now(timezone.utc) - timedelta(days=365)
             range_end = dt_to if date_to else datetime.now(timezone.utc)

backend/app/services/github_backup.py

@@ -812,6 +812,9 @@ class GitHubBackupService:
                 "category": s.category,
                 "low_stock_threshold_pct": s.low_stock_threshold_pct,
                 "storage_location": s.storage_location,
+                # When it was last printed with (LU-4): without it, every spool
+                # read as never used after a restore.
+                "last_used": str(s.last_used) if s.last_used else None,
                 # Last drying (#2863).
                 "last_dried_at": str(s.last_dried_at) if s.last_dried_at else None,
                 "last_dried_temp": s.last_dried_temp,

backend/app/services/github_restore.py

@@ -1413,6 +1413,15 @@ class GitHubRestoreService:
             quantity = _restored_number(entry.get("quantity"), maximum=10_000, integer=True)
             if quantity is None:
                 quantity = 1
+            # A print running when the backup was made is long over: closed
+            # here the way the stale-archive cleanup closes one. Restored as
+            # running, the next reconnect closed it as a print that had just
+            # failed, with a failure notification and a Print Log row (ST/I7).
+            status = entry.get("status") or "completed"
+            failure_reason = entry.get("failure_reason")
+            backed_up_in_flight = status in ("printing", "paused")
+            if backed_up_in_flight:
+                status, failure_reason = "cancelled", "noStatusUpdate"
             fields = {
                 "print_name": entry.get("print_name"),
                 "print_time_seconds": numbers["print_time_seconds"],
@@ -1425,7 +1434,7 @@ class GitHubRestoreService:
                 "bed_temperature": entry.get("bed_temperature"),
                 "nozzle_temperature": entry.get("nozzle_temperature"),
                 "sliced_for_model": entry.get("sliced_for_model"),
-                "status": entry.get("status") or "completed",
+                "status": status,
                 "started_at": started_at,
                 "completed_at": _parse_dt(entry.get("completed_at")),
                 "makerworld_url": entry.get("makerworld_url"),
@@ -1435,7 +1444,7 @@ class GitHubRestoreService:
                 "tags": entry.get("tags"),
                 "notes": entry.get("notes"),
                 "cost": numbers["cost"],
-                "failure_reason": entry.get("failure_reason"),
+                "failure_reason": failure_reason,
                 "quantity": quantity,
                 "energy_kwh": numbers["energy_kwh"],
                 "energy_cost": numbers["energy_cost"],
@@ -1541,6 +1550,13 @@ class GitHubRestoreService:
                         "archivesUndeleted",
                         "Archive(s) deleted since the backup are visible again — overwrite was on",
                     )
+                if backed_up_in_flight:
+                    # The local row is that same print, still running or since
+                    # ended: it knows more about its outcome than the backup's
+                    # snapshot of it mid-way. Closing it here would end a live
+                    # print's archive, or overwrite a real result.
+                    for key in ("status", "failure_reason", "completed_at"):
+                        fields.pop(key, None)
                 for key, value in fields.items():
                     setattr(existing, key, value)
                 tally.restored += 1
@@ -1689,6 +1705,9 @@ class GitHubRestoreService:
             baseline = _restored_number(entry.get("weight_used_baseline"))
             if baseline is not None:
                 fields["weight_used_baseline"] = baseline
+            # When it was last used (LU-4), same late-field rule.
+            if "last_used" in entry:
+                fields["last_used"] = _parse_dt(entry.get("last_used"))
             # Last drying (#2863), same late-field rule.
             if "last_dried_at" in entry:
                 fields["last_dried_at"] = _parse_dt(entry.get("last_dried_at"))

backend/app/services/library_folder_access.py

@@ -46,12 +46,12 @@ def owns(folder: LibraryFolder, user: User | ApiKeyActor | None) -> bool:
     return user is not None and folder.created_by_id is not None and folder.created_by_id == user.id
 
 
-def can_write_folder(folder: LibraryFolder, user: User | None) -> bool:
+def can_write_folder(folder: LibraryFolder, user: User | ApiKeyActor | None) -> bool:
     """May ``user`` put files or subfolders into ``folder``."""
     return sees_all_folders(user) or owns(folder, user) or bool(folder.shared)
 
 
-def can_rename_folder(folder: LibraryFolder, user: User | None) -> bool:
+def can_rename_folder(folder: LibraryFolder, user: User | ApiKeyActor | None) -> bool:
     if user is None or user.has_permission(Permission.LIBRARY_UPDATE_ALL.value):
         return True
     return user.has_permission(Permission.LIBRARY_UPDATE_OWN.value) and owns(folder, user)
@@ -128,7 +128,7 @@ def visible_folder_ids(index: FolderIndex, user: User | ApiKeyActor | None) -> s
     return visible
 
 
-def folder_delete_blocker(index: FolderIndex, folder: LibraryFolder, user: User | None) -> str | None:
+def folder_delete_blocker(index: FolderIndex, folder: LibraryFolder, user: User | ApiKeyActor | None) -> str | None:
     """Why ``user`` may NOT delete ``folder``, or None if they may.
 
     ``library:delete_all`` deletes anything. With ``library:delete_own`` a user
@@ -168,7 +168,7 @@ def folder_delete_blocker(index: FolderIndex, folder: LibraryFolder, user: User
     return None
 
 
-async def get_visible_folder(db: AsyncSession, folder_id: int, user: User | None) -> LibraryFolder:
+async def get_visible_folder(db: AsyncSession, folder_id: int, user: User | ApiKeyActor | None) -> LibraryFolder:
     """The folder, or 404 when it doesn't exist or ``user`` can't see it."""
     folder = (await db.execute(select(LibraryFolder).where(LibraryFolder.id == folder_id))).scalar_one_or_none()
     if folder is None:
@@ -180,7 +180,7 @@ async def get_visible_folder(db: AsyncSession, folder_id: int, user: User | None
     return folder
 
 
-async def get_writable_folder(db: AsyncSession, folder_id: int, user: User | None) -> LibraryFolder:
+async def get_writable_folder(db: AsyncSession, folder_id: int, user: User | ApiKeyActor | None) -> LibraryFolder:
     """The folder ``user`` puts something into: 404 when unseen, 403 when only seen."""
     folder = await get_visible_folder(db, folder_id, user)
     if not can_write_folder(folder, user):

backend/app/services/printer_manager.py

@@ -1818,6 +1818,9 @@ def printer_state_to_dict(
         "active_extruder": state.active_extruder,
         # Print speed mode (1=silent, 2=standard, 3=sport, 4=ludicrous)
         "speed_level": state.speed_level,
+        # Switched on the printer's screen too; REST-only, the card showed the
+        # old mode until the next poll (PSF-4).
+        "airduct_mode": state.airduct_mode,
         # H2C nozzle rack (tool-changer dock positions)
         # Map raw MQTT field names (type/diameter) to schema names (nozzle_type/nozzle_diameter)
         "nozzle_rack": [
@@ -1831,6 +1834,9 @@ def printer_state_to_dict(
                 "serial_number": n.get("serial_number", ""),
                 "filament_color": n.get("filament_color", ""),
                 "filament_id": n.get("filament_id", ""),
+                # The push replaces the whole rack: without it a slot lost its
+                # material label on every push (PSF-3).
+                "filament_type": n.get("filament_type", ""),
             }
             for n in (state.nozzle_rack or [])
         ],

backend/app/services/slice_dispatch.py

@@ -31,7 +31,7 @@ class SliceJob:
     source_id: int
     source_name: str
     # JWT user id that started the job, for per-row scoping of the polling
-    # endpoint. None for API-key / auth-disabled callers (no per-row identity);
+    # endpoint. None when no user was recorded (auth off, some API-key paths);
     # those jobs are visible only to READ_ALL pollers — see slice_jobs.py.
     owner_id: int | None = None
     status: SliceJobStatus = "pending"

backend/app/services/spoolbuddy_ssh.py

@@ -26,6 +26,8 @@ from backend.app.core.config import settings
 
 logger = logging.getLogger(__name__)
 
+PIP_INSTALL_TIMEOUT = 300
+
 SSH_USER = "spoolbuddy"
 DEFAULT_INSTALL_PATH = "/opt/bambuddy"
 
@@ -310,15 +312,32 @@ async def perform_ssh_update(device_id: str, ip_address: str, install_path: str
         # Step 4: Install dependencies
         await _update_progress("updating", "Installing dependencies...")
         venv_pip = shlex.quote(f"{install_path}/spoolbuddy/venv/bin/pip")
-        rc, _, stderr, _ = await _run_ssh_command(
+        rc, pip_output, stderr, _ = await _run_ssh_command(
             ip_address,
             f"{venv_pip} install --upgrade spidev gpiod smbus2 httpx 2>&1",
             private_key,
             known_hosts=known_hosts,
-            timeout=120,
+            # A slow Pi building wheels needs more than two minutes.
+            timeout=PIP_INSTALL_TIMEOUT,
         )
+        deps_note = ""
+        if rc == -1:
+            # Timed out here, not necessarily on the Pi: pip may still be
+            # installing, and restarting the daemon over a half-installed venv
+            # (then reporting success) is how a broken update looked fine (TO-C12).
+            await _update_progress(
+                "error",
+                "Installing dependencies timed out; the daemon was not restarted. "
+                "Run the update again once the device has finished.",
+            )
+            return
         if rc != 0:
-            logger.warning("SpoolBuddy %s: pip install returned non-zero (continuing): %s", device_id, stderr[:200])
+            # A pip error is not fatal -- the daemon may not need the upgrade --
+            # but it is said, with pip's own output (2>&1 sends it to stdout).
+            logger.warning(
+                "SpoolBuddy %s: pip install exited %s (continuing): %s", device_id, rc, (pip_output or stderr)[-500:]
+            )
+            deps_note = f" (installing dependencies failed, exit {rc}: see the Bambuddy log)"
 
         # Step 5: Restart daemon
         await _update_progress("updating", "Restarting daemon...")
@@ -350,7 +369,7 @@ async def perform_ssh_update(device_id: str, ip_address: str, install_path: str
             logger.warning("SpoolBuddy %s: kiosk restart failed (non-fatal): %s", device_id, stderr[:200])
 
         logger.info("SpoolBuddy %s: SSH update complete (branch=%s)", device_id, branch)
-        await _update_progress("complete", f"Updated to {branch}")
+        await _update_progress("complete", f"Updated to {branch}{deps_note}")
 
     except Exception:
         logger.exception("SpoolBuddy %s: SSH update failed", device_id)

backend/app/services/usage_tracker.py

@@ -1070,7 +1070,12 @@ async def on_print_complete(
                 # 100 g/$X print with a 10 g/$X/10 partial (#1378).
                 from backend.app.services.print_log import other_runs_of
 
-                if not await other_runs_of(db, archive):
+                # Nor from a run that did not finish: the archive's cost is one
+                # full print of the file -- the queue estimate, plate scaling and
+                # billing read it so -- and a failed run's partial cost already
+                # lands on its own Print Log entry. Spoolman mode never wrote it
+                # either (COST-3).
+                if status == "completed" and not await other_runs_of(db, archive):
                     archive.cost = round(total_cost, 2)
                     await db.commit()
 

backend/app/utils/local_time.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 
 import logging
 import os
-from datetime import datetime, timedelta, timezone, tzinfo
+from datetime import date, datetime, timedelta, timezone, tzinfo
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 logger = logging.getLogger(__name__)
@@ -98,6 +98,48 @@ def local_day_start(now_utc: datetime, *, days_ago: int = 0) -> datetime:
     return local_midnight.astimezone(timezone.utc)
 
 
+def day_zone(name: str | None) -> tzinfo:
+    """The zone a caller's calendar dates are in: the IANA ``name`` it sent, or
+    the server's own (``TZ``) when it sent none or one that is not a zone.
+
+    The Stats page sends the browser's zone with its dates; read in the
+    server's instead, a browser away from it saw every day shifted -- for
+    one in Tokyo on a UTC server, "Today" stayed empty until 09:00 (DB-C12).
+    """
+    if name:
+        try:
+            return ZoneInfo(name)
+        # OSError too: on some Python builds a directory name ("America")
+        # raises PermissionError instead of ZoneInfoNotFoundError.
+        except (ZoneInfoNotFoundError, ValueError, OSError):
+            logger.debug("Unknown zone %r for a date filter; using the server's", name)
+    return local_zone()
+
+
+def local_date_start(day: date, zone: tzinfo | None = None) -> datetime:
+    """The start of a calendar date in ``zone`` (the server's by default), as a UTC instant.
+
+    What a date filter means: "16 October" is the user's 16 October, not the
+    UTC one, which in Berlin starts at 02:00 (DB-C12). Built from the date
+    itself, so a DST change day is its true 23 or 25 hours.
+    """
+    try:
+        return datetime(day.year, day.month, day.day, tzinfo=zone or local_zone()).astimezone(timezone.utc)
+    except OverflowError:
+        # 0001-01-01 in a zone ahead of UTC starts before the first datetime:
+        # an open-ended range must not 500.
+        return datetime.min.replace(tzinfo=timezone.utc)
+
+
+def local_date_end(day: date, zone: tzinfo | None = None) -> datetime:
+    """The last instant of a calendar date in ``zone``, as a UTC instant."""
+    try:
+        return local_date_start(day + timedelta(days=1), zone) - timedelta(microseconds=1)
+    except OverflowError:
+        # 9999-12-31 has no next day to stop before.
+        return datetime.max.replace(tzinfo=timezone.utc)
+
+
 def next_local_hour(now_utc: datetime) -> datetime:
     """Return the next top-of-the-hour *local* time, as a UTC instant.
 

backend/tests/integration/test_api_key_own_rows.py

@@ -0,0 +1,383 @@
+"""An API key whose owner may act on their own rows only acts on those rows.
+
+The ownership routes (queue, archives, library) used to refuse such a key
+outright: they asked the owner for the ``*_all`` permission. The key now gets
+what its owner gets, its own rows and nobody else's, still narrowed to the
+key's scope flags and printers. A key whose owner holds ``*_all`` and a key
+without an owner keep reaching every row.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+import pytest
+from sqlalchemy import select
+
+from backend.app.core.auth import generate_api_key
+from backend.app.models.api_key import APIKey
+from backend.app.models.archive import PrintArchive
+from backend.app.models.group import Group
+from backend.app.models.library import LibraryFile
+from backend.app.models.print_queue import PrintQueueItem
+from backend.tests.integration import test_api_key_queue_acts_as_owner as owner_tests
+
+pytestmark = [pytest.mark.asyncio, pytest.mark.integration]
+
+world = owner_tests.world
+
+_OWN_ONLY = [
+    "queue:read_own",
+    "queue:delete_own",
+    "queue:start_unreviewed",
+    "archives:update_own",
+    "archives:delete_own",
+    "library:update_own",
+    "library:delete_own",
+]
+
+
+async def _key(db_session, owner_id: int | None, **scopes) -> dict[str, str]:
+    full_key, key_hash, key_prefix = generate_api_key()
+    flags = {
+        "can_queue": True,
+        "can_read_status": True,
+        "can_manage_archives": True,
+        "can_manage_library": True,
+        **scopes,
+    }
+    db_session.add(APIKey(name="own rows", key_hash=key_hash, key_prefix=key_prefix, user_id=owner_id, **flags))
+    await db_session.commit()
+    return {"X-API-Key": full_key}
+
+
+@pytest.fixture
+async def rows(db_session, world):
+    """The own-only owner's rows and another user's, one of each kind."""
+    await owner_tests._set(db_session, "billing_enabled", "false")
+    group = await db_session.scalar(select(Group).where(Group.name == "own-queuers"))
+    group.permissions = [*group.permissions, *_OWN_ONLY]
+    mine = await owner_tests._archive(db_session, world["owner"].id, 11)
+    theirs = await owner_tests._archive(db_session, world["other"].id, 12)
+    own_item = PrintQueueItem(
+        printer_id=world["printer"].id, archive_id=mine.id, status="pending", created_by_id=world["owner"].id
+    )
+    other_item = PrintQueueItem(
+        printer_id=world["printer"].id, archive_id=theirs.id, status="pending", created_by_id=world["other"].id
+    )
+    own_file = LibraryFile(
+        filename="mine.stl",
+        file_path="library/files/mine.stl",
+        file_type="stl",
+        file_size=1,
+        created_by_id=world["owner"].id,
+    )
+    other_file = LibraryFile(
+        filename="theirs.stl",
+        file_path="library/files/theirs.stl",
+        file_type="stl",
+        file_size=1,
+        created_by_id=world["other"].id,
+    )
+    db_session.add_all([own_item, other_item, own_file, other_file])
+    await db_session.commit()
+    return {
+        **world,
+        "mine": mine,
+        "theirs": theirs,
+        "own_item": own_item,
+        "other_item": other_item,
+        "own_file": own_file,
+        "other_file": other_file,
+    }
+
+
+class TestQueue:
+    async def test_the_owners_own_item_can_be_read_and_changed(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        item = rows["own_item"]
+
+        got = await async_client.get(f"/api/v1/queue/{item.id}", headers=key)
+        patched = await async_client.patch(f"/api/v1/queue/{item.id}", json={"manual_start": True}, headers=key)
+
+        assert got.status_code == 200, got.text
+        assert patched.status_code == 200, patched.text
+        await db_session.refresh(item)
+        assert item.manual_start is True
+
+    async def test_bulk_changes_the_owners_items_and_skips_the_rest(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        own, other = rows["own_item"], rows["other_item"]
+
+        bulk = await async_client.patch(
+            "/api/v1/queue/bulk", json={"item_ids": [own.id, other.id], "manual_start": True}, headers=key
+        )
+
+        assert bulk.status_code == 200, bulk.text
+        assert (bulk.json()["updated_count"], bulk.json()["skipped_count"]) == (1, 1)
+        await db_session.refresh(own)
+        await db_session.refresh(other)
+        assert own.manual_start is True
+        assert other.manual_start is False
+
+    async def test_the_list_holds_only_the_owners_items(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+
+        listed = await async_client.get("/api/v1/queue/", headers=key)
+
+        assert listed.status_code == 200, listed.text
+        assert [i["id"] for i in listed.json()] == [rows["own_item"].id]
+
+    async def test_another_users_item_is_neither_seen_nor_changed(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        other = rows["other_item"]
+
+        got = await async_client.get(f"/api/v1/queue/{other.id}", headers=key)
+        patched = await async_client.patch(f"/api/v1/queue/{other.id}", json={"manual_start": True}, headers=key)
+        cancelled = await async_client.post(f"/api/v1/queue/{other.id}/cancel", headers=key)
+        deleted = await async_client.delete(f"/api/v1/queue/{other.id}", headers=key)
+
+        assert got.status_code == 404
+        assert patched.status_code == 403
+        assert cancelled.status_code == 403
+        assert deleted.status_code == 403
+        await db_session.refresh(other)
+        assert (other.status, other.manual_start) == ("pending", False)
+
+    async def test_the_owners_own_item_can_be_cancelled_and_deleted(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        item_id = rows["own_item"].id
+
+        cancelled = await async_client.post(f"/api/v1/queue/{item_id}/cancel", headers=key)
+        deleted = await async_client.delete(f"/api/v1/queue/{item_id}", headers=key)
+
+        assert cancelled.status_code == 200, cancelled.text
+        assert deleted.status_code == 200, deleted.text
+        db_session.expire_all()
+        assert await db_session.get(PrintQueueItem, item_id) is None
+
+    async def test_a_key_without_the_queue_scope_is_still_refused(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id, can_queue=False)
+
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['own_item'].id}", json={"manual_start": True}, headers=key
+        )
+
+        assert patched.status_code == 403
+
+    async def test_the_owner_can_claim_and_start_a_job_without_an_owner(self, async_client, db_session, rows):
+        """As the owner's session can: a virtual-printer upload has no owner (#1670)."""
+        key = await _key(db_session, rows["owner"].id)
+        item = PrintQueueItem(
+            printer_id=rows["printer"].id, archive_id=rows["mine"].id, status="pending", manual_start=True
+        )
+        db_session.add(item)
+        await db_session.commit()
+
+        started = await async_client.post(f"/api/v1/queue/{item.id}/start", headers=key)
+
+        assert started.status_code == 200, started.text
+        await db_session.refresh(item)
+        assert (item.manual_start, item.created_by_id) == (False, rows["owner"].id)
+
+
+class TestAKeyLimitedToFewerPrinters:
+    """The scheduler sends an "any printer of a model" job to any of its
+    creator's printers, so a key limited to fewer printers than its owner may
+    neither make nor start one."""
+
+    @pytest.fixture
+    async def limited(self, db_session, rows):
+        full_key, key_hash, key_prefix = generate_api_key()
+        db_session.add(
+            APIKey(
+                name="one printer",
+                key_hash=key_hash,
+                key_prefix=key_prefix,
+                user_id=rows["owner"].id,
+                can_queue=True,
+                can_read_status=True,
+                printer_ids=[rows["printer"].id],
+            )
+        )
+        model_job = PrintQueueItem(
+            archive_id=rows["mine"].id,
+            target_model="X1C",
+            status="pending",
+            manual_start=True,
+            created_by_id=rows["owner"].id,
+        )
+        db_session.add(model_job)
+        await db_session.commit()
+        return {"key": {"X-API-Key": full_key}, "model_job": model_job}
+
+    async def test_it_cannot_start_a_model_job(self, async_client, db_session, rows, limited):
+        job = limited["model_job"]
+
+        started = await async_client.post(f"/api/v1/queue/{job.id}/start", headers=limited["key"])
+        patched = await async_client.patch(
+            f"/api/v1/queue/{job.id}", json={"manual_start": False}, headers=limited["key"]
+        )
+        bulk = await async_client.patch(
+            "/api/v1/queue/bulk", json={"item_ids": [job.id], "manual_start": False}, headers=limited["key"]
+        )
+
+        assert started.status_code == 400, started.text
+        assert "specific printer" in started.json()["detail"]
+        assert patched.status_code == 400, patched.text
+        assert "specific printer" in patched.json()["detail"]
+        assert bulk.status_code == 200, bulk.text
+        assert (bulk.json()["updated_count"], bulk.json()["skipped_count"]) == (0, 1)
+        await db_session.refresh(job)
+        assert job.manual_start is True
+
+    async def test_a_null_does_not_start_a_model_job(self, async_client, db_session, rows, limited):
+        """A null for the not-null column is dropped, so nothing starts."""
+        job = limited["model_job"]
+
+        await async_client.patch(f"/api/v1/queue/{job.id}", json={"manual_start": None}, headers=limited["key"])
+        await async_client.patch(
+            "/api/v1/queue/bulk", json={"item_ids": [job.id], "manual_start": None}, headers=limited["key"]
+        )
+
+        await db_session.refresh(job)
+        assert job.manual_start is True
+
+    async def test_it_cannot_unpin_a_job_that_keeps_its_model(self, async_client, db_session, rows, limited):
+        """A job the scheduler held on a printer keeps its model (watchdog, filament hold)."""
+        job = limited["model_job"]
+        job.printer_id = rows["printer"].id
+        job.manual_start = False
+        await db_session.commit()
+
+        patched = await async_client.patch(f"/api/v1/queue/{job.id}", json={"printer_id": None}, headers=limited["key"])
+        bulk = await async_client.patch(
+            "/api/v1/queue/bulk", json={"item_ids": [job.id], "printer_id": None}, headers=limited["key"]
+        )
+
+        assert patched.status_code == 400, patched.text
+        assert bulk.json()["skipped_count"] == 1, bulk.text
+        await db_session.refresh(job)
+        assert job.printer_id == rows["printer"].id
+
+    async def test_an_unlimited_key_can_start_it(self, async_client, db_session, rows, limited):
+        key = await _key(db_session, rows["owner"].id)
+        job = limited["model_job"]
+
+        patched = await async_client.patch(f"/api/v1/queue/{job.id}", json={"manual_start": False}, headers=key)
+
+        assert patched.status_code == 200, patched.text
+        await db_session.refresh(job)
+        assert job.manual_start is False
+
+    async def test_it_cannot_retarget_a_job_to_a_model(self, async_client, db_session, rows, limited):
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['own_item'].id}",
+            json={"printer_id": None, "target_model": "X1C"},
+            headers=limited["key"],
+        )
+
+        assert patched.status_code == 400, patched.text
+        assert "specific printer" in patched.json()["detail"]
+        await db_session.refresh(rows["own_item"])
+        assert rows["own_item"].target_model is None
+
+
+class TestArchives:
+    async def test_the_owners_archives_only(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+
+        listed = await async_client.get("/api/v1/archives/", headers=key)
+        mine = await async_client.get(f"/api/v1/archives/{rows['mine'].id}", headers=key)
+        theirs = await async_client.get(f"/api/v1/archives/{rows['theirs'].id}", headers=key)
+
+        assert listed.status_code == 200, listed.text
+        assert [a["id"] for a in listed.json()] == [rows["mine"].id]
+        assert mine.status_code == 200, mine.text
+        assert theirs.status_code == 404
+
+    async def test_only_the_owners_archive_can_be_changed(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+
+        mine = await async_client.patch(f"/api/v1/archives/{rows['mine'].id}", json={"notes": "k"}, headers=key)
+        theirs = await async_client.patch(f"/api/v1/archives/{rows['theirs'].id}", json={"notes": "k"}, headers=key)
+
+        assert mine.status_code == 200, mine.text
+        assert theirs.status_code == 403
+        theirs_row = await db_session.get(PrintArchive, rows["theirs"].id)
+        await db_session.refresh(theirs_row)
+        assert theirs_row.notes != "k"
+
+
+class TestLibrary:
+    async def test_the_owners_files_only(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+
+        listed = await async_client.get("/api/v1/library/files", headers=key)
+        mine = await async_client.get(f"/api/v1/library/files/{rows['own_file'].id}", headers=key)
+        theirs = await async_client.get(f"/api/v1/library/files/{rows['other_file'].id}", headers=key)
+
+        assert listed.status_code == 200, listed.text
+        assert [f["id"] for f in listed.json()] == [rows["own_file"].id]
+        assert mine.status_code == 200, mine.text
+        assert theirs.status_code == 404
+
+    async def test_the_trash_holds_only_the_owners_files(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        for row in (rows["own_file"], rows["other_file"]):
+            row.deleted_at = datetime.now(timezone.utc)
+        await db_session.commit()
+
+        listed = await async_client.get("/api/v1/library/trash", headers=key)
+
+        assert listed.status_code == 200, listed.text
+        assert [f["id"] for f in listed.json()["items"]] == [rows["own_file"].id]
+
+    async def test_another_users_file_is_not_deleted(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+
+        deleted = await async_client.delete(f"/api/v1/library/files/{rows['other_file'].id}", headers=key)
+
+        assert deleted.status_code == 403
+        await db_session.refresh(rows["other_file"])
+        assert rows["other_file"].deleted_at is None
+
+
+class TestKeysThatReachEveryRow:
+    async def test_an_admins_key_still_changes_another_users_item(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["admin"].id)
+
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['other_item'].id}", json={"manual_start": True}, headers=key
+        )
+
+        assert patched.status_code == 200, patched.text
+
+    async def test_a_key_without_an_owner_still_changes_any_item(self, async_client, db_session, rows):
+        key = await _key(db_session, None)
+
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['other_item'].id}", json={"manual_start": True}, headers=key
+        )
+
+        assert patched.status_code == 200, patched.text
+
+    async def test_a_deactivated_own_only_owners_key_is_refused(self, async_client, db_session, rows):
+        key = await _key(db_session, rows["owner"].id)
+        rows["owner"].is_active = False
+        await db_session.commit()
+
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['own_item'].id}", json={"manual_start": True}, headers=key
+        )
+
+        assert patched.status_code in (401, 403)
+
+    async def test_a_key_without_an_owner_still_needs_the_queue_scope(self, async_client, db_session, rows):
+        key = await _key(db_session, None, can_queue=False)
+
+        patched = await async_client.patch(
+            f"/api/v1/queue/{rows['other_item'].id}", json={"manual_start": True}, headers=key
+        )
+
+        assert patched.status_code == 403

backend/tests/integration/test_api_key_queue_acts_as_owner.py

@@ -10,6 +10,7 @@ nothing and may use no cost center.
 from __future__ import annotations
 
 from pathlib import Path
+from uuid import uuid4
 
 import pytest
 from httpx import AsyncClient
@@ -261,7 +262,8 @@ class TestSources:
 
     async def test_another_users_library_file_is_not_found(self, async_client, db_session, world):
         await _set(db_session, "billing_enabled", "false")
-        rel_path = "archive/library/files/probe_3256.gcode.3mf"
+        # Unique: the checkout's library folder is shared by every xdist worker.
+        rel_path = f"archive/library/files/probe_3256_{uuid4().hex}.gcode.3mf"
         abs_path = Path(app_settings.base_dir) / rel_path
         abs_path.parent.mkdir(parents=True, exist_ok=True)
         abs_path.write_bytes(b"probe")
@@ -314,9 +316,8 @@ class TestBatches:
 class TestAnOwnOnlyOwner:
     """An owner who may change only their own queue items.
 
-    Their key is refused at the permission gate (it needs the ``*_all``
-    permission of its owner), so it changes no other user's item, and an
-    owner's deactivation stops it.
+    Their key changes their items and no other user's item (see
+    test_api_key_own_rows.py), and an owner's deactivation stops it.
     """
 
     async def _items(self, db_session, world) -> tuple[PrintQueueItem, PrintQueueItem]:
@@ -344,7 +345,8 @@ class TestAnOwnOnlyOwner:
         deleted = await async_client.delete(f"/api/v1/queue/{other.id}", headers=key)
 
         assert patched.status_code in (403, 404)
-        assert bulk.status_code in (200, 403), bulk.text
+        assert bulk.status_code == 200, bulk.text
+        assert bulk.json()["skipped_count"] == 1
         assert deleted.status_code in (403, 404)
         await db_session.refresh(other)
         assert other.manual_start is False

backend/tests/integration/test_ftp_list_timeout_route.py

@@ -0,0 +1,27 @@
+"""The file manager says a slow listing is slow, not that the printer is gone (TO-C13)."""
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from httpx import AsyncClient
+
+from backend.app.services.bambu_ftp import FileListResult
+
+pytestmark = [pytest.mark.asyncio, pytest.mark.integration]
+
+
+@pytest.mark.parametrize(
+    ("result", "warnings"),
+    [
+        (FileListResult(files=[], available=False, timed_out=True), ["listing_timed_out"]),
+        (FileListResult(files=[], available=False), ["printer_unavailable"]),
+        (FileListResult(files=[], available=True), []),
+    ],
+)
+async def test_the_listing_warning_says_which(async_client: AsyncClient, printer_factory, result, warnings):
+    printer = await printer_factory()
+    with patch("backend.app.api.routes.printers.list_files_result_async", new=AsyncMock(return_value=result)):
+        response = await async_client.get(f"/api/v1/printers/{printer.id}/files?path=/ipcam")
+
+    assert response.status_code == 200
+    assert response.json()["warnings"] == warnings

backend/tests/integration/test_library_api.py

@@ -4,6 +4,7 @@ import io
 import tempfile
 import zipfile
 from pathlib import Path
+from uuid import uuid4
 
 import pytest
 from httpx import AsyncClient
@@ -308,6 +309,60 @@ class TestLibraryFilesAPI:
         assert len(result) == 1
         assert result[0]["id"] == other_file.id
 
+    @pytest.mark.asyncio
+    @pytest.mark.integration
+    @pytest.mark.parametrize("direction", ["into", "out of"])
+    async def test_an_edit_does_not_move_a_file_across_the_external_boundary(
+        self, async_client: AsyncClient, folder_factory, file_factory, db_session, direction
+    ):
+        """F8: the edit route only changed folder_id -- no byte move, no
+        read-only check -- so the file showed in a folder its bytes are not
+        in. Such a move goes through POST /library/files/move."""
+        internal = await folder_factory(name="Mine")
+        nas = await folder_factory(name="NAS", is_external=True, external_path="/mnt/nas")
+        if direction == "into":
+            file = await file_factory(folder_id=internal.id, filename="a.3mf", is_external=False)
+            target = nas.id
+        else:
+            file = await file_factory(folder_id=nas.id, filename="a.3mf", is_external=True)
+            target = internal.id
+
+        response = await async_client.put(f"/api/v1/library/files/{file.id}", json={"folder_id": target})
+
+        assert response.status_code == 400
+        assert "/library/files/move" in response.json()["detail"]
+        await db_session.refresh(file)
+        assert file.folder_id != target
+
+    @pytest.mark.asyncio
+    @pytest.mark.integration
+    async def test_an_external_file_sent_with_its_own_folder_is_no_move(
+        self, async_client: AsyncClient, folder_factory, file_factory
+    ):
+        nas = await folder_factory(name="NAS", is_external=True, external_path="/mnt/nas")
+        file = await file_factory(folder_id=nas.id, filename="a.3mf", is_external=True)
+
+        response = await async_client.put(
+            f"/api/v1/library/files/{file.id}", json={"folder_id": nas.id, "notes": "kept"}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    @pytest.mark.integration
+    async def test_an_edit_still_moves_a_file_between_its_own_folders(
+        self, async_client: AsyncClient, folder_factory, file_factory, db_session
+    ):
+        first = await folder_factory(name="One")
+        second = await folder_factory(name="Two")
+        file = await file_factory(folder_id=first.id, filename="a.3mf", is_external=False)
+
+        response = await async_client.put(f"/api/v1/library/files/{file.id}", json={"folder_id": second.id})
+
+        assert response.status_code == 200
+        await db_session.refresh(file)
+        assert file.folder_id == second.id
+
     @pytest.mark.asyncio
     @pytest.mark.integration
     async def test_list_files_internal_only(self, async_client: AsyncClient, folder_factory, file_factory, db_session):
@@ -695,13 +750,15 @@ class TestLibraryAddToQueueAPI:
         written: list[Path] = []
 
         async def _create(**kwargs):
-            counter = len(written) + 1
-            rel_path = kwargs.pop("file_path", f"archive/library/files/queue_probe_{counter}.gcode.3mf")
+            # A unique name: this is the checkout's real library folder, shared by
+            # every xdist worker, and a sibling's teardown deleted a same-named
+            # probe this test still needed ("File not found on disk").
+            rel_path = kwargs.pop("file_path", f"archive/library/files/queue_probe_{uuid4().hex}.gcode.3mf")
             abs_path = Path(app_settings.base_dir) / rel_path
             abs_path.parent.mkdir(parents=True, exist_ok=True)
             abs_path.write_bytes(b"probe")
             written.append(abs_path)
-            kwargs.setdefault("filename", f"queue_probe_{counter}.gcode.3mf")
+            kwargs.setdefault("filename", Path(rel_path).name)
             return await library_file_factory(file_path=rel_path, **kwargs)
 
         yield _create

backend/tests/integration/test_print_complete_end_to_end.py

@@ -164,6 +164,14 @@ async def test_a_completion_reconciled_at_reconnect_has_no_actual_duration(test_
     assert archive_data["actual_time_seconds"] is None
 
 
+async def test_completion_stops_the_start_estimate_before_writing_the_cost(test_engine, db_session, queued_print):
+    """COST-4: the background estimate must not outlive the real cost."""
+    with patch("backend.app.main._settle_archive_cost_estimate", new_callable=AsyncMock) as settle:
+        await _complete(test_engine, queued_print["printer"], "completed")
+
+    settle.assert_awaited_once_with(queued_print["archive"])
+
+
 async def test_a_failed_print(test_engine, db_session, queued_print):
     await _complete(test_engine, queued_print["printer"], "failed")
 

backend/tests/integration/test_queue_creation_attribution.py

@@ -21,6 +21,7 @@ the same NULL-is-meaningful contract on the `/start` path.
 from __future__ import annotations
 
 from pathlib import Path
+from uuid import uuid4
 
 import pytest
 from httpx import AsyncClient
@@ -69,7 +70,8 @@ async def sliced_library_file(db_session):
     route rejects rows whose file is missing from disk)."""
     from backend.app.models.library import LibraryFile
 
-    rel_path = "archive/library/files/attribution_probe.gcode.3mf"
+    # Unique: the checkout's library folder is shared by every xdist worker.
+    rel_path = f"archive/library/files/attribution_probe_{uuid4().hex}.gcode.3mf"
     abs_path = Path(app_settings.base_dir) / rel_path
     abs_path.parent.mkdir(parents=True, exist_ok=True)
     abs_path.write_bytes(b"probe")

backend/tests/integration/test_queue_review_1620.py

@@ -16,6 +16,7 @@ every way a job can be created or set going:
 from __future__ import annotations
 
 from pathlib import Path
+from uuid import uuid4
 
 import pytest
 from httpx import AsyncClient
@@ -132,7 +133,8 @@ class TestQueueing:
     async def test_library_add_to_queue_waits(self, async_client, setup, db_session):
         from backend.app.models.library import LibraryFile
 
-        rel_path = "archive/library/files/review_probe.gcode.3mf"
+        # Unique: the checkout's library folder is shared by every xdist worker.
+        rel_path = f"archive/library/files/review_probe_{uuid4().hex}.gcode.3mf"
         abs_path = Path(app_settings.base_dir) / rel_path
         abs_path.parent.mkdir(parents=True, exist_ok=True)
         abs_path.write_bytes(b"probe")

backend/tests/integration/test_spoolbuddy_write_tag_spoolman.py

@@ -0,0 +1,108 @@
+"""Writing an NFC sticker for a Spoolman spool (SM-C6, SM-C5).
+
+SM-C6: the "color_name not set" warning checked the Spoolman filament field,
+which Spoolman never fills -- Bambuddy keeps the name in the spool's extra
+-- so every write warned. A spool without a stored name gets its subtype
+encoded, not an empty name.
+
+SM-C5: a Bambu spool created from the AMS is linked by its tray UUID in
+``extra.tag``. Writing a sticker replaced it, so the next AMS sync no longer
+found the spool and created a duplicate.
+"""
+
+import json
+from datetime import datetime, timezone
+
+import pytest
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.app.models.settings import Settings
+from backend.app.models.spoolbuddy_device import SpoolBuddyDevice
+from backend.tests._fixtures.spoolman_tags import BASE_URL, FakeSpoolman
+from backend.tests.integration.test_spoolman_native_tags_3168 import TRAY_UUID, serving
+
+pytestmark = [pytest.mark.asyncio, pytest.mark.integration]
+
+WRITE = "/api/v1/spoolbuddy/nfc/write-tag"
+
+
+@pytest.fixture
+async def ready(db_session: AsyncSession):
+    db_session.add(Settings(key="spoolman_enabled", value="true"))
+    db_session.add(Settings(key="spoolman_url", value=BASE_URL))
+    db_session.add(
+        SpoolBuddyDevice(
+            device_id="sb-sticker",
+            hostname="spoolbuddy",
+            ip_address="10.0.0.9",
+            firmware_version="1.0.0",
+            has_nfc=True,
+            has_scale=True,
+            tare_offset=0,
+            calibration_factor=1.0,
+            last_seen=datetime.now(timezone.utc),
+        )
+    )
+    await db_session.commit()
+
+
+async def _write(async_client, fake: FakeSpoolman, spool_id: int):
+    with serving(fake):
+        return await async_client.post(WRITE, json={"device_id": "sb-sticker", "spool_id": spool_id})
+
+
+def _colour_warnings(response) -> list[str]:
+    return [w for w in response.json().get("warnings", []) if "color" in w.lower()]
+
+
+async def test_a_stored_colour_name_raises_no_warning(async_client, ready):
+    fake = FakeSpoolman()
+    fake.add_spool(7)["extra"]["bambu_color_name"] = json.dumps("Jade White")
+
+    response = await _write(async_client, fake, 7)
+
+    assert response.status_code == 200, response.text
+    assert _colour_warnings(response) == []
+
+
+async def test_a_missing_colour_name_says_the_subtype_is_encoded(async_client, ready):
+    fake = FakeSpoolman()
+    fake.add_spool(7)
+
+    response = await _write(async_client, fake, 7)
+
+    assert response.status_code == 200, response.text
+    [warning] = _colour_warnings(response)
+    assert "subtype" in warning
+
+
+async def test_a_spool_linked_by_its_ams_tray_uuid_is_not_overwritten(async_client, ready):
+    fake = FakeSpoolman()
+    fake.add_spool(7, extra_tag=TRAY_UUID)
+
+    response = await _write(async_client, fake, 7)
+
+    assert response.status_code == 409
+    assert "AMS" in response.json()["detail"]
+
+
+async def test_a_tray_uuid_spoolman_also_keeps_natively_is_no_reason_to_refuse(async_client, ready):
+    """Spoolman 0.27+ keeps the tray UUID as a native tag too, and the AMS
+    sync finds the spool by that first: the sticker cannot break the link."""
+    fake = FakeSpoolman()
+    fake.add_spool(7, extra_tag=TRAY_UUID, tags=[TRAY_UUID])
+
+    response = await _write(async_client, fake, 7)
+
+    assert response.status_code == 200, response.text
+
+
+async def test_a_chip_uid_in_extra_tag_is_no_reason_to_refuse(async_client, ready):
+    """The tray UUID only native, extra.tag holding a chip UID: nothing a
+    sticker overwrites links the spool to the AMS."""
+    fake = FakeSpoolman()
+    fake.add_spool(7, extra_tag="D3E68F32", tags=[TRAY_UUID])
+
+    response = await _write(async_client, fake, 7)
+
+    assert response.status_code == 200, response.text

backend/tests/integration/test_stats_local_days.py

@@ -0,0 +1,112 @@
+"""A Stats date filter takes the local calendar day (DB-C12)."""
+
+from datetime import datetime
+
+import pytest
+from httpx import AsyncClient
+
+from backend.app.models.print_log import PrintLogEntry
+
+pytestmark = [pytest.mark.asyncio, pytest.mark.integration]
+
+
+async def test_a_print_at_half_past_one_in_berlin_counts_for_that_day(
+    async_client: AsyncClient, printer_factory, db_session, monkeypatch
+):
+    monkeypatch.setenv("TZ", "Europe/Berlin")
+    printer = await printer_factory()
+    # 01:30 on 16 October in Berlin is 23:30 on the 15th in UTC.
+    db_session.add(
+        PrintLogEntry(
+            print_name="late night",
+            printer_id=printer.id,
+            status="completed",
+            created_at=datetime(2026, 10, 15, 23, 30),
+        )
+    )
+    await db_session.commit()
+
+    sixteenth = await async_client.get("/api/v1/archives/slim?date_from=2026-10-16&date_to=2026-10-16")
+    fifteenth = await async_client.get("/api/v1/archives/slim?date_from=2026-10-15&date_to=2026-10-15")
+
+    assert [r["print_name"] for r in sixteenth.json()] == ["late night"]
+    assert fifteenth.json() == []
+
+
+async def test_the_statistics_totals_take_the_local_day(
+    async_client: AsyncClient, printer_factory, db_session, monkeypatch
+):
+    monkeypatch.setenv("TZ", "Europe/Berlin")
+    printer = await printer_factory()
+    db_session.add(
+        PrintLogEntry(
+            print_name="late night", printer_id=printer.id, status="failed", created_at=datetime(2026, 10, 15, 23, 30)
+        )
+    )
+    await db_session.commit()
+
+    stats = (await async_client.get("/api/v1/archives/stats?date_from=2026-10-16&date_to=2026-10-16")).json()
+    failures = (
+        await async_client.get("/api/v1/archives/analysis/failures?date_from=2026-10-16&date_to=2026-10-16")
+    ).json()
+
+    assert stats["total_prints"] == 1
+    assert failures["total_prints"] == 1
+
+
+async def test_the_archive_list_takes_the_local_day(
+    async_client: AsyncClient, printer_factory, archive_factory, db_session, monkeypatch
+):
+    monkeypatch.setenv("TZ", "Europe/Berlin")
+    printer = await printer_factory()
+    archive = await archive_factory(printer.id, print_name="late night")
+    archive.created_at = datetime(2026, 10, 15, 23, 30)
+    await db_session.commit()
+
+    listed = (await async_client.get("/api/v1/archives/?date_from=2026-10-16&date_to=2026-10-16")).json()
+
+    assert [a["id"] for a in listed] == [archive.id]
+
+
+# The browser's own zone, sent with its dates: a browser away from the
+# server's TZ (the Docker default is Europe/Berlin) shifted every day.
+TOKYO_EARLY = datetime(2026, 10, 16, 23, 30)  # 08:30 on 17 October in Tokyo
+
+
+async def _tokyo_morning_print(printer_factory, db_session, monkeypatch):
+    monkeypatch.setenv("TZ", "UTC")
+    printer = await printer_factory()
+    db_session.add(PrintLogEntry(print_name="morning", printer_id=printer.id, status="failed", created_at=TOKYO_EARLY))
+    await db_session.commit()
+    return printer
+
+
+@pytest.mark.parametrize(
+    ("path", "count"),
+    [
+        ("/api/v1/archives/slim", lambda body: len(body)),
+        ("/api/v1/archives/stats", lambda body: body["total_prints"]),
+        ("/api/v1/archives/analysis/failures", lambda body: body["total_prints"]),
+    ],
+)
+async def test_the_dates_are_days_in_the_zone_the_caller_names(
+    async_client: AsyncClient, printer_factory, db_session, monkeypatch, path, count
+):
+    await _tokyo_morning_print(printer_factory, db_session, monkeypatch)
+
+    tokyo_17th = (await async_client.get(f"{path}?date_from=2026-10-17&date_to=2026-10-17&tz=Asia/Tokyo")).json()
+    server_17th = (await async_client.get(f"{path}?date_from=2026-10-17&date_to=2026-10-17")).json()
+
+    assert count(tokyo_17th) == 1
+    assert count(server_17th) == 0
+
+
+async def test_an_unknown_zone_falls_back_to_the_server_s(
+    async_client: AsyncClient, printer_factory, db_session, monkeypatch
+):
+    await _tokyo_morning_print(printer_factory, db_session, monkeypatch)
+
+    response = await async_client.get("/api/v1/archives/slim?date_from=2026-10-16&date_to=2026-10-16&tz=Mars/Olympus")
+
+    assert response.status_code == 200
+    assert len(response.json()) == 1

backend/tests/unit/services/test_archive_cost_estimate_3261.py

@@ -377,3 +377,41 @@ class TestRaceWithCompletion:
         await db_session.refresh(archive)
         assert archive.cost == 1.23
         ws.assert_not_awaited()
+
+
+class TestCompletionStopsTheEstimate:
+    @pytest.mark.asyncio
+    async def test_settling_cancels_a_running_estimate_before_it_writes(self):
+        """COST-4: completion commits the real cost before it marks the archive
+        ended, so an estimate still waiting on Spoolman saw "printing" and wrote
+        over it. Completion now stops the estimate first."""
+        import asyncio
+        from contextlib import asynccontextmanager
+
+        wrote: list[int] = []
+        blocked = asyncio.Event()
+
+        async def slow_estimate(*_args):
+            await blocked.wait()
+            wrote.append(1)
+
+        @asynccontextmanager
+        async def fake_session():
+            yield object()
+
+        with (
+            patch("backend.app.core.database.async_session", new=fake_session),
+            patch.object(archive_cost_estimate, "estimate_archive_cost_at_start", new=slow_estimate),
+        ):
+            task = archive_cost_estimate.schedule_archive_cost_estimate(3, 42, "pm")
+            await asyncio.sleep(0)
+            await archive_cost_estimate.settle_archive_cost_estimate(42)
+            blocked.set()
+            await asyncio.sleep(0)
+
+        assert task.cancelled()
+        assert wrote == []
+
+    @pytest.mark.asyncio
+    async def test_settling_with_nothing_running_is_harmless(self):
+        await archive_cost_estimate.settle_archive_cost_estimate(9999)

backend/tests/unit/services/test_bambu_mqtt.py

@@ -3041,6 +3041,19 @@ class TestTrayNowDualNozzleH2DPendingTarget(_H2DFixtureMixin):
         assert h2d_client.state.tray_now == 5
         assert h2d_client.state.pending_tray_target is None  # cleared
 
+    def test_a_pending_target_from_a_load_long_ago_is_not_used(self, h2d_client):
+        """FW-C7: a manual load the printer refused leaves its target pending
+        (tray_now stays 255, which keeps it). A print loading the same slot
+        number on another AMS much later was shown as that old target."""
+        import time
+
+        h2d_client.state.pending_tray_target = 5
+        h2d_client.state.pending_tray_target_at = time.monotonic() - 600
+        h2d_client._process_message(_ams_payload(1))
+
+        assert h2d_client.state.tray_now != 5
+        assert h2d_client.state.pending_tray_target is None
+
     def test_pending_target_slot_mismatch(self, h2d_client):
         """pending=5, tray_now='2' → uses raw slot, clears pending."""
         h2d_client.state.pending_tray_target = 5
@@ -5545,6 +5558,14 @@ class TestHMSUserActionFiltering:
         assert len(mqtt_client.state.hms_errors) == 1
         assert mqtt_client.state.hms_errors[0].code == "0x8061"
 
+    def test_a_fault_in_both_hms_and_print_error_is_listed_once(self, mqtt_client):
+        """M-U9: an hms[] code carries its alert level in the high half
+        (0x00018061); the dedupe read it unmasked, so it never matched
+        print_error's 0500_8061 and the card listed the fault twice."""
+        mqtt_client._update_state({"hms": [{"attr": 0x05000100, "code": 0x00018061}], "print_error": 0x0500_8061})
+
+        assert len(mqtt_client.state.hms_errors) == 1
+
 
 class TestHMSFullCode:
     """full_code is the firmware-matching key for HMS-related commands.
@@ -8474,6 +8495,29 @@ class TestAmsFilamentSettingRefusalLogging:
         assert "ams_id=0" in refusals[0]
         assert "tray_id=1" in refusals[0]
 
+    def test_a_refused_k_profile_selection_is_logged_too(self, mqtt_client, caplog):
+        """FW-C3: an RFID re-read re-applies the spool's K-profile and logs
+        "Applied PA profile"; the printer's refusal of it stayed at DEBUG, so
+        a support bundle showed only the success."""
+        caplog.set_level(logging.INFO, logger="backend.app.services.bambu_mqtt")
+
+        mqtt_client._process_message(
+            {
+                "print": {
+                    "command": "extrusion_cali_sel",
+                    "result": "fail",
+                    "reason": "cali_idx not found",
+                    "ams_id": 0,
+                    "tray_id": 2,
+                    "sequence_id": "0",
+                }
+            }
+        )
+
+        lines = [line for line in caplog.text.splitlines() if "extrusion_cali_sel refused" in line]
+        assert len(lines) == 1
+        assert "cali_idx not found" in lines[0]
+
     def test_success_stays_quiet(self, mqtt_client, caplog):
         caplog.set_level(logging.INFO, logger="backend.app.services.bambu_mqtt")
 
@@ -8530,16 +8574,6 @@ class TestAmsFilamentSettingRefusalLogging:
 
         assert len(self._refusals(caplog)) == 1
 
-    def test_extrusion_cali_sel_is_untouched(self, mqtt_client, caplog):
-        """The sibling in the same branch keeps its DEBUG-only handling; this
-        change is scoped to the write #2756 is about."""
-        caplog.set_level(logging.INFO, logger="backend.app.services.bambu_mqtt")
-
-        mqtt_client._process_message({"print": {"command": "extrusion_cali_sel", "result": "fail", "sequence_id": "0"}})
-
-        assert self._refusals(caplog) == []
-        assert "extrusion_cali_sel" not in caplog.text
-
 
 class TestDryingCycleEndReport:
     """#2863 — the cycle-end report carries what was seen of the cycle, so the

backend/tests/unit/services/test_ftp_list_mtime_year.py

@@ -0,0 +1,38 @@
+"""An FTP LIST time without a year gets the right year on any host (DB-C8).
+
+Recent entries list as "Oct 20 23:20" with no year. The year was taken from
+the host's local clock, and an entry "in the future" was moved a year back.
+Printers report these times in UTC (tested X1C/H2D firmware), so on a host
+behind UTC every evening entry -- 23:20 UTC is still 19:20 in New York -- was
+dated a year back, and its ipcam recording no longer matched its print.
+"""
+
+from datetime import datetime
+
+from backend.app.services.bambu_ftp import _parse_list_mtime
+
+
+def test_a_utc_time_later_than_the_hosts_local_clock_stays_this_year():
+    # 19:30 in New York is 23:30 UTC; the printer's entry is 23:20 UTC.
+    assert _parse_list_mtime("Oct", "20", "23:20", now_utc=datetime(2026, 10, 20, 23, 30)) == datetime(
+        2026, 10, 20, 23, 20
+    )
+
+
+def test_firmware_on_local_time_a_few_hours_ahead_stays_this_year():
+    # Some firmware lists printer-local time, up to 14 h ahead of UTC.
+    assert _parse_list_mtime("Oct", "21", "09:00", now_utc=datetime(2026, 10, 20, 20, 0)).year == 2026
+
+
+def test_a_date_months_ahead_is_last_year():
+    assert _parse_list_mtime("Dec", "30", "10:15", now_utc=datetime(2026, 1, 5, 12, 0)) == datetime(
+        2025, 12, 30, 10, 15
+    )
+
+
+def test_an_entry_with_a_year_keeps_it():
+    assert _parse_list_mtime("Nov", "30", "2024", now_utc=datetime(2026, 10, 20)) == datetime(2024, 11, 30)
+
+
+def test_garbage_is_no_time():
+    assert _parse_list_mtime("Foo", "99", "xx:yy", now_utc=datetime(2026, 10, 20)) is None

backend/tests/unit/services/test_ftp_list_timeout_state.py

@@ -0,0 +1,97 @@
+"""A slow FTP listing is reported as slow, and refreshes do not stack (TO-C13).
+
+Listing a large /ipcam on a slow SD card can take longer than the wait. That
+came back as "printer unavailable", the same as a printer that is not there,
+and the worker thread -- not cancellable -- kept running while every refresh
+started another one in the shared FTP pool.
+"""
+
+import asyncio
+import threading
+from unittest.mock import patch
+
+import pytest
+
+from backend.app.services import bambu_ftp
+
+pytestmark = pytest.mark.asyncio
+
+
+class SlowClient:
+    made = 0
+    release = threading.Event()
+
+    def __init__(self, *args, **kwargs):
+        type(self).made += 1
+
+    def connect(self):
+        return True
+
+    def list_files(self, path, raise_on_error=False):
+        type(self).release.wait(5)
+        return [{"name": "ipcam-record.1.mp4"}]
+
+    def disconnect(self):
+        pass
+
+
+@pytest.fixture
+def slow():
+    SlowClient.made = 0
+    SlowClient.release = threading.Event()
+    bambu_ftp._inflight_listings.clear()
+    with patch.object(bambu_ftp, "BambuFTPClient", SlowClient):
+        yield SlowClient
+    SlowClient.release.set()
+    bambu_ftp._inflight_listings.clear()
+
+
+async def test_a_listing_that_takes_too_long_says_so(slow):
+    result = await bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=0.1)
+
+    assert result.available is False
+    assert result.timed_out is True
+
+
+async def test_a_refresh_joins_the_listing_still_running(slow):
+    first, second = await asyncio.gather(
+        bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=0.2),
+        bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=0.2),
+    )
+    third = await bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=0.1)
+
+    assert slow.made == 1
+    assert first.timed_out and second.timed_out and third.timed_out
+
+
+async def test_once_it_finishes_a_new_listing_starts(slow):
+    slow.release.set()
+    done = await bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=2)
+    again = await bambu_ftp.list_files_result_async("10.0.0.5", "code", "/ipcam", timeout=2)
+
+    assert done.available and again.available
+    assert slow.made == 2
+
+
+class NeverConnects(SlowClient):
+    def connect(self):
+        # A printer behind a router that drops its packets: the connect blocks.
+        type(self).release.wait(5)
+        return False
+
+
+async def test_a_printer_that_never_answered_is_unavailable_not_slow():
+    """Only a listing that got through connecting is "slow"; one still
+    waiting for the printer to answer is a printer that is not there."""
+    NeverConnects.made = 0
+    NeverConnects.release = threading.Event()
+    bambu_ftp._inflight_listings.clear()
+    try:
+        with patch.object(bambu_ftp, "BambuFTPClient", NeverConnects):
+            result = await bambu_ftp.list_files_result_async("10.0.0.6", "code", "/ipcam", timeout=0.1)
+    finally:
+        NeverConnects.release.set()
+        bambu_ftp._inflight_listings.clear()
+
+    assert result.available is False
+    assert result.timed_out is False

backend/tests/unit/test_cloud_filament_id_map_single_flight.py

@@ -0,0 +1,86 @@
+"""The cloud filament-ID map is built once per account at a time, without a
+request holding a database connection (RC-C11).
+
+When the 5-minute cache expired, every K-profile view asked at once and each
+ran the full 1 + N Bambu Cloud fetch while its request held a database
+connection idle in transaction.
+"""
+
+import asyncio
+from contextlib import asynccontextmanager
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from backend.app.api.routes import cloud
+
+pytestmark = pytest.mark.asyncio
+
+
+@pytest.fixture(autouse=True)
+def _empty():
+    cloud.forget_all_cloud_presets()
+    yield
+    cloud.forget_all_cloud_presets()
+
+
+def _slow_cloud(release: asyncio.Event):
+    async def settings():
+        await release.wait()
+        return {"filament": {"private": [{"setting_id": "S1"}]}}
+
+    return SimpleNamespace(
+        is_authenticated=True,
+        get_slicer_settings=AsyncMock(side_effect=settings),
+        get_setting_detail=AsyncMock(return_value={"filament_id": "P1", "name": "Mine @Bambu Lab X1C"}),
+        close=AsyncMock(),
+    )
+
+
+@asynccontextmanager
+async def _own_session():
+    yield "own session"
+
+
+async def test_views_arriving_together_share_one_build():
+    release = asyncio.Event()
+    built: list = []
+
+    async def build(db, user):
+        # A real token read awaits the database.
+        await asyncio.sleep(0.001)
+        built.append(db)
+        return _slow_cloud(release)
+
+    user = SimpleNamespace(id=7)
+    with (
+        patch.object(cloud, "build_authenticated_cloud", new=build),
+        patch("backend.app.core.database.async_session", new=_own_session),
+    ):
+        calls = [asyncio.create_task(cloud.get_filament_id_map(current_user=user)) for _ in range(3)]
+        await asyncio.sleep(0.05)
+        release.set()
+        results = await asyncio.gather(*calls)
+
+    assert results == [{"P1": "Mine"}] * 3
+    assert built == ["own session"], "every view built the map itself, or in its request's session"
+
+
+async def test_a_build_running_when_the_account_signs_out_is_not_cached():
+    release = asyncio.Event()
+
+    async def build(db, user):
+        return _slow_cloud(release)
+
+    with (
+        patch.object(cloud, "build_authenticated_cloud", new=build),
+        patch("backend.app.core.database.async_session", new=_own_session),
+    ):
+        call = asyncio.create_task(cloud.get_filament_id_map(current_user=SimpleNamespace(id=7)))
+        await asyncio.sleep(0.05)
+        cloud._forget_account_presets(7)
+        release.set()
+        await call
+
+    assert 7 not in cloud._filament_id_name_cache

backend/tests/unit/test_cost_tracking.py

@@ -443,6 +443,72 @@ class TestCostCalculation:
         # Cost = 20g / 1000 * 20.0 = 0.40
         assert results[0]["cost"] == 0.40
 
+    async def test_a_failed_first_run_leaves_the_full_print_cost_on_the_archive(self):
+        """COST-3: an archive's cost is one full print of the file -- what the
+        queue estimate, plate scaling and billing read it as. A run that failed
+        half way charged its partial cost to its Print Log entry, and also
+        wrote it onto the archive, so a reprint was estimated and billed from
+        half a print. Spoolman mode never did."""
+        spool = _make_spool(spool_id=1, label_weight=1000, cost_per_kg=20.0)
+        assignment = _make_assignment(spool_id=1)
+        archive = _make_archive(archive_id=10)
+        archive.cost = 5.0  # the full-print estimate from print start
+
+        _active_sessions[1] = PrintSession(
+            printer_id=1,
+            print_name="Test",
+            started_at=datetime.now(timezone.utc),
+            tray_remain_start={(0, 0): 80},
+            tray_now_at_start=0,
+        )
+
+        # Failed at 50% progress
+        printer_manager = MagicMock()
+        printer_manager.get_status.return_value = SimpleNamespace(
+            raw_data={"ams": [{"id": 0, "tray": [{"id": 0, "remain": 70}]}]},
+            progress=50,
+            layer_num=25,
+            tray_now=0,
+        )
+
+        # db returns: archive, queue_item(None), assignment, spool
+        # ... and the archive again for the cost it carries
+        db = _mock_db_sequential([archive, None, assignment, spool, archive])
+
+        # 40g total, but only 50% used
+        filament_usage = [{"slot_id": 1, "used_g": 40.0, "type": "PLA", "color": "#FF0000"}]
+
+        with (
+            # Its first run: the archive's cost is the one it would take.
+            patch("backend.app.services.print_log.other_runs_of", AsyncMock(return_value=[])),
+            patch("backend.app.core.config.settings") as mock_settings,
+            patch("backend.app.api.routes.settings.get_setting", return_value="15.0"),
+            patch(
+                "backend.app.utils.threemf_tools.extract_filament_usage_from_3mf",
+                return_value=filament_usage,
+            ),
+            patch(
+                "backend.app.utils.threemf_tools.extract_layer_filament_usage_from_3mf",
+                return_value=None,  # No layer data, use linear scaling
+            ),
+        ):
+            mock_settings.base_dir = MagicMock()
+            mock_path = MagicMock()
+            mock_path.exists.return_value = True
+            mock_settings.base_dir.__truediv__ = MagicMock(return_value=mock_path)
+
+            results = await on_print_complete(
+                printer_id=1,
+                data={"status": "failed", "last_progress": 50.0},
+                printer_manager=printer_manager,
+                db=db,
+                archive_id=10,
+            )
+
+        # The run's own cost is still measured (it goes to its Print Log entry).
+        assert results[0]["cost"] == 0.40
+        assert archive.cost == 5.0
+
     async def _failed_after_firmware_reset(self, *, last_progress=0.0, last_layer_num=0, layer_usage=None):
         """A failed print whose printer already reset progress and layer to 0."""
         spool = _make_spool(spool_id=1, label_weight=1000, cost_per_kg=20.0)

backend/tests/unit/test_github_backup_spool_fields.py

@@ -76,3 +76,17 @@ async def test_collects_the_total_consumed_reset_point(db_session):
     await GitHubBackupService()._collect_spools(db_session, files)
 
     assert files["spools/inventory.json"]["spools"][0]["weight_used_baseline"] == 300
+
+
+@pytest.mark.asyncio
+async def test_collects_when_the_spool_was_last_used(db_session):
+    """LU-4: without it, every spool read as never used after a restore."""
+    from datetime import datetime
+
+    db_session.add(Spool(material="PLA", last_used=datetime(2026, 10, 18, 9, 15)))
+    await db_session.commit()
+
+    files: dict = {}
+    await GitHubBackupService()._collect_spools(db_session, files)
+
+    assert files["spools/inventory.json"]["spools"][0]["last_used"] == "2026-10-18 09:15:00"

backend/tests/unit/test_github_restore.py

@@ -888,6 +888,28 @@ class TestRestoreSpools:
         assert spool.last_dried_at == datetime(2026, 9, 1, 8, 0)
         assert spool.last_dried_temp == 55
 
+    @pytest.mark.asyncio
+    async def test_restores_when_the_spool_was_last_used(self, db_session):
+        """LU-4 -- written with str() like the drying date."""
+        tally = _CategoryTally()
+        entry = self._spool_entry(last_used="2026-10-18 09:15:00")
+
+        await _service()._restore_spools(db_session, {"spools": [entry]}, None, False, tally, {})
+        await db_session.commit()
+
+        assert (await db_session.execute(select(Spool))).scalars().one().last_used == datetime(2026, 10, 18, 9, 15)
+
+    @pytest.mark.asyncio
+    async def test_older_backup_keeps_the_live_last_used(self, db_session):
+        db_session.add(Spool(material="PLA", tag_uid="AABBCCDD", last_used=datetime(2026, 9, 1, 8, 0)))
+        await db_session.commit()
+        tally = _CategoryTally()
+
+        await _service()._restore_spools(db_session, {"spools": [self._spool_entry()]}, None, True, tally, {})
+        await db_session.commit()
+
+        assert (await db_session.execute(select(Spool))).scalars().one().last_used == datetime(2026, 9, 1, 8, 0)
+
     @pytest.mark.asyncio
     async def test_matches_existing_spool_by_tag_uid(self, db_session):
         db_session.add(Spool(material="PLA", tag_uid="AABBCCDD", color_name="Old"))
@@ -1402,6 +1424,51 @@ class TestRestoreArchives:
         entry.update(overrides)
         return entry
 
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("status", ["printing", "paused"])
+    async def test_a_print_running_when_backed_up_comes_back_closed(self, db_session, status):
+        """ST/I7: restored as running, the next reconnect closed it as a print
+        that had just failed -- a failure notification and a Print Log row.
+        It is closed here the way the stale-archive cleanup closes one."""
+        tally = _CategoryTally()
+
+        entry = self._archive_entry(status=status, completed_at=None)
+        await _service()._restore_archives(db_session, {"archives": [entry]}, False, tally, {})
+        await db_session.commit()
+
+        row = (await db_session.execute(select(PrintArchive))).scalar_one()
+        assert (row.status, row.failure_reason) == ("cancelled", "noStatusUpdate")
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize(
+        ("local_status", "local_reason"), [("printing", None), ("completed", None), ("failed", "nozzleClog")]
+    )
+    async def test_an_overwrite_keeps_what_the_local_row_knows_of_a_print_backed_up_mid_way(
+        self, db_session, local_status, local_reason
+    ):
+        """The local row is the same print, still running or since ended: the
+        backup's snapshot of it in flight has nothing better to say."""
+        db_session.add(
+            PrintArchive(
+                filename="benchy.3mf",
+                file_path="/data/benchy.3mf",
+                file_size=2048,
+                content_hash="abc123",
+                started_at=datetime(2026, 3, 1, 10, 0, 0),
+                status=local_status,
+                failure_reason=local_reason,
+            )
+        )
+        await db_session.commit()
+        tally = _CategoryTally()
+
+        entry = self._archive_entry(status="printing", completed_at=None)
+        await _service()._restore_archives(db_session, {"archives": [entry]}, True, tally, {})
+        await db_session.commit()
+
+        row = (await db_session.execute(select(PrintArchive))).scalar_one()
+        assert (row.status, row.failure_reason) == (local_status, local_reason)
+
     @pytest.mark.asyncio
     async def test_inserts_metadata_only_row_with_empty_file_path(self, db_session):
         """print_archives.file_path is NOT NULL but is not in the backup."""

backend/tests/unit/test_local_date_bounds.py

@@ -0,0 +1,53 @@
+"""A date filter means a local calendar day (DB-C12).
+
+The Stats page's Today / This Week / This Month sent UTC dates, and the
+backend turned each into a UTC day: in Berlin, "Today" at 01:30 showed the
+prints from 02:00 the day before until 01:59. A date is now a day in the
+zone the caller names (the Stats page sends the browser's), else in the
+server's TZ.
+"""
+
+from datetime import date, datetime, timezone
+
+import pytest
+
+from backend.app.utils.local_time import local_date_end, local_date_start
+
+
+@pytest.fixture
+def berlin(monkeypatch):
+    monkeypatch.setenv("TZ", "Europe/Berlin")
+
+
+def test_a_berlin_day_starts_at_its_midnight(berlin):
+    assert local_date_start(date(2026, 10, 16)) == datetime(2026, 10, 15, 22, 0, tzinfo=timezone.utc)
+
+
+def test_a_berlin_day_ends_just_before_the_next_midnight(berlin):
+    end = local_date_end(date(2026, 10, 16))
+    assert end == datetime(2026, 10, 16, 21, 59, 59, 999999, tzinfo=timezone.utc)
+
+
+def test_the_dst_change_day_is_25_hours(berlin):
+    start = local_date_start(date(2026, 10, 25))
+    end = local_date_end(date(2026, 10, 25))
+    assert (end - start).total_seconds() == pytest.approx(25 * 3600, abs=1)
+
+
+def test_without_a_tz_a_day_is_a_utc_day(monkeypatch):
+    monkeypatch.delenv("TZ", raising=False)
+    assert local_date_start(date(2026, 10, 16)) == datetime(2026, 10, 16, tzinfo=timezone.utc)
+
+
+def test_the_far_ends_of_the_calendar_do_not_overflow(berlin):
+    """An open-ended range sent as 0001-01-01 .. 9999-12-31 must not 500."""
+    assert local_date_start(date(1, 1, 1)) == datetime.min.replace(tzinfo=timezone.utc)
+    assert local_date_end(date(9999, 12, 31)) == datetime.max.replace(tzinfo=timezone.utc)
+
+
+def test_a_zone_name_that_is_a_folder_falls_back(monkeypatch):
+    from backend.app.utils.local_time import day_zone
+
+    monkeypatch.setenv("TZ", "UTC")
+    assert str(day_zone("America")) in ("UTC", "UTC+00:00")
+    assert str(day_zone("../etc/passwd")) in ("UTC", "UTC+00:00")

backend/tests/unit/test_mfa_login_response_auth_source.py

@@ -0,0 +1,31 @@
+"""A 2FA or SSO login reports the user's real auth source (PC-C9).
+
+mfa.py kept its own copy of the user-response builder, and the copy left out
+``auth_source``: after a 2FA or OIDC login the schema default "local" reached
+the page, which then offered an LDAP or OIDC user "Change Password".
+"""
+
+from datetime import datetime
+from types import SimpleNamespace
+
+import pytest
+
+from backend.app.api.routes import mfa
+
+
+@pytest.mark.parametrize("source", ["ldap", "oidc", "local"])
+def test_the_login_response_carries_the_auth_source(source):
+    user = SimpleNamespace(
+        id=3,
+        username="ana",
+        email=None,
+        role="user",
+        is_active=True,
+        is_admin=False,
+        auth_source=source,
+        groups=[],
+        get_permissions=lambda: set(),
+        created_at=datetime(2026, 10, 1),
+    )
+
+    assert mfa._user_to_response(user).auth_source == source

backend/tests/unit/test_printer_kill_switch.py

@@ -97,6 +97,7 @@ async def test_unauthorized_active_print_triggers_stop(monkeypatch):
         ams_filament_backup=False,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
         current_print=None,
         subtask_name="foreign_job",
@@ -195,6 +196,7 @@ async def test_bambuddy_authorized_print_is_not_stopped(monkeypatch):
         ams_filament_backup=False,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
         current_print=None,
         subtask_name="foreign_job",
@@ -283,6 +285,7 @@ async def test_unauthorized_print_state_is_cleared_when_print_ends(monkeypatch):
         ams_filament_backup=False,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
         current_print=None,
         subtask_name="foreign_job",
@@ -316,6 +319,7 @@ async def test_unauthorized_print_state_is_cleared_when_print_ends(monkeypatch):
         ams_filament_backup=False,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
         current_print=None,
         subtask_name="",
@@ -403,6 +407,7 @@ async def test_persisted_print_is_authorized_after_restart(monkeypatch, printer_
         ams_filament_backup=False,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
         current_print=None,
         subtask_name="owned_job",

backend/tests/unit/test_printer_manager_status_broadcast.py

@@ -95,6 +95,7 @@ def _fake_state(**overrides):
         "layer_num": None,
         "remaining_time": None,
         "speed_level": None,
+        "airduct_mode": None,
         "stg_cur": 0,  # get_derived_status_name does ``0 <= state.stg_cur < 255``
         "subtask_name": None,
         "total_layers": None,

backend/tests/unit/test_printer_offline_notification.py

@@ -73,6 +73,7 @@ def _state(connected: bool, state: str = "IDLE") -> SimpleNamespace:
         ams_filament_backup=None,
         firmware_version=None,
         developer_mode=None,
+        airduct_mode=0,
         print_ams_mapping=None,
     )
 

backend/tests/unit/test_printer_status_fields_g6.py

@@ -73,6 +73,7 @@ def _push_state(**overrides):
         "firmware_version": "01.09.00.00",
         "developer_mode": False,
         "print_ams_mapping": None,
+        "airduct_mode": 0,
     }
     fields.update(overrides)
     return SimpleNamespace(**fields)
@@ -117,6 +118,8 @@ class TestAChangeAloneIsPushed:
         [
             {"developer_mode": True},
             {"firmware_version": "01.10.00.00"},
+            # Cooling/heating switched on the printer's screen (PSF-4).
+            {"airduct_mode": 1},
             {"nozzles": [NozzleInfo(nozzle_type="stainless_steel", nozzle_diameter="0.6")]},
             {"print_ams_mapping": [0, 2]},
         ],

backend/tests/unit/test_slice_progress_timeout_detail.py

@@ -0,0 +1,44 @@
+"""A slow slice-progress answer is reported as slow, not as an unreachable sidecar (TO-C14).
+
+A heavy slice can keep the sidecar from answering its progress poll within
+5 s; httpx's ReadTimeout is a RequestError, so the proxy said "Slicer sidecar
+unreachable". The poller retries on 503 either way; the text was wrong.
+"""
+
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import httpx
+import pytest
+from fastapi import HTTPException
+
+from backend.app.api.routes import slicer_presets
+
+pytestmark = pytest.mark.asyncio
+
+
+async def _poll(error: Exception) -> HTTPException:
+    client = MagicMock()
+    client.__aenter__ = AsyncMock(return_value=client)
+    client.__aexit__ = AsyncMock(return_value=False)
+    client.get = AsyncMock(side_effect=error)
+    with (
+        patch.object(slicer_presets, "_resolve_slicer_api_url", AsyncMock(return_value="http://sidecar:3000")),
+        patch("httpx.AsyncClient", return_value=client),
+        pytest.raises(HTTPException) as raised,
+    ):
+        await slicer_presets.get_preview_slice_progress(request_id="abc", db=MagicMock(), _=(None, True))
+    return raised.value
+
+
+async def test_a_timeout_says_the_sidecar_is_busy():
+    refused = await _poll(httpx.ReadTimeout("read timed out"))
+
+    assert refused.status_code == 503
+    assert "unreachable" not in refused.detail
+    assert "did not answer in time" in refused.detail
+
+
+async def test_a_refused_connection_is_still_unreachable():
+    refused = await _poll(httpx.ConnectError("connection refused"))
+
+    assert (refused.status_code, refused.detail) == (503, "Slicer sidecar unreachable")

backend/tests/unit/test_spoolbuddy_ssh.py

@@ -717,3 +717,62 @@ async def test_perform_ssh_update_passes_str_not_bytes_to_import_known_hosts(tmp
     assert captured_args, "import_known_hosts was never called"
     for arg in captured_args:
         assert isinstance(arg, str), f"asyncssh.import_known_hosts must receive str, got {type(arg).__name__}: {arg!r}"
+
+
+async def _update_with_pip_result(tmp_path, pip_result):
+    ssh_dir = tmp_path / "spoolbuddy" / "ssh"
+    ssh_dir.mkdir(parents=True)
+    (ssh_dir / "id_ed25519").write_text("PRIVATE")
+    (ssh_dir / "id_ed25519.pub").write_text("PUBLIC")
+    calls: list[tuple[str, float]] = []
+
+    async def mock_ssh(ip, cmd, key, *, known_hosts=None, timeout=60):
+        calls.append((cmd, timeout))
+        if "pip" in cmd:
+            return pip_result
+        return 0, "ok", "", "ssh-ed25519 AAAA fakehostkey"
+
+    _, mock_ctx, mock_ws = _make_update_mocks(tmp_path)
+    with (
+        patch("backend.app.services.spoolbuddy_ssh.settings") as mock_settings,
+        patch("backend.app.services.spoolbuddy_ssh._run_ssh_command", side_effect=mock_ssh),
+        patch("backend.app.services.spoolbuddy_ssh.detect_current_branch", return_value="dev"),
+        patch("backend.app.services.spoolbuddy_ssh.asyncssh.import_known_hosts", return_value=MagicMock()),
+        patch("backend.app.core.database.async_session", return_value=mock_ctx),
+        patch("backend.app.api.routes.spoolbuddy.ws_manager", mock_ws),
+    ):
+        mock_settings.base_dir = tmp_path
+        await perform_ssh_update("sb-test", "10.0.0.1")
+    last = mock_ws.broadcast.call_args_list[-1].args[0]
+    return calls, last
+
+
+@pytest.mark.asyncio
+async def test_a_pip_timeout_stops_before_the_daemon_is_restarted(tmp_path):
+    """TO-C12: pip may still be running on the Pi; restarting the daemon over a
+    half-installed venv, and reporting success, hid that."""
+    calls, last = await _update_with_pip_result(tmp_path, (-1, "", "SSH command timed out", None))
+
+    assert last["update_status"] == "error"
+    assert "timed out" in last["update_message"]
+    assert not any("spoolbuddy.service" in cmd for cmd, _ in calls)
+
+
+@pytest.mark.asyncio
+async def test_a_failed_pip_install_completes_but_says_so(tmp_path):
+    """A pip error still restarts (the daemon may not need the upgrade), but
+    the final status names it, with pip's own output in the log."""
+    calls, last = await _update_with_pip_result(
+        tmp_path, (1, "ERROR: No matching distribution found for gpiod", "", None)
+    )
+
+    assert last["update_status"] == "complete"
+    assert "dependencies" in last["update_message"]
+    assert any("spoolbuddy.service" in cmd for cmd, _ in calls)
+
+
+@pytest.mark.asyncio
+async def test_pip_gets_time_for_a_slow_pi(tmp_path):
+    calls, _ = await _update_with_pip_result(tmp_path, (0, "ok", "", None))
+
+    assert next(timeout for cmd, timeout in calls if "pip" in cmd) >= 300

backend/tests/unit/test_spoolman_recovered_3mf_tracking.py

@@ -63,7 +63,13 @@ async def seeded(test_engine, tmp_path):
     from backend.app import main as main_module
 
     maker, printer_id, archive_id = await _seed(test_engine, tmp_path)
-    with patch.dict(main_module._active_prints, {(printer_id, DISPATCH_FILENAME): archive_id}, clear=True):
+    # Empty, not whatever a test before on this worker left: the recovery reads
+    # the printed plate from it, and a plate the 3MF has no usage for tracks
+    # nothing.
+    with (
+        patch.dict(main_module._active_prints, {(printer_id, DISPATCH_FILENAME): archive_id}, clear=True),
+        patch.dict(main_module._print_plate_ids, {}, clear=True),
+    ):
         yield maker, printer_id, archive_id
 
 

backend/tests/unit/test_status_broadcast_ams_slot_config.py

@@ -92,6 +92,7 @@ def _state(trays: list[dict], ams_extra: dict | None = None) -> SimpleNamespace:
         firmware_version=None,
         developer_mode=None,
         print_ams_mapping=None,
+        airduct_mode=0,
     )
 
 

backend/tests/unit/test_ws_status_carries_rest_fields.py

@@ -0,0 +1,27 @@
+"""The live status push carries what the printer card reads from the status (PSF-3, PSF-4).
+
+The websocket push replaces the fields it carries in the card's cached status.
+``airduct_mode`` was missing, so switching cooling/heating on the printer's
+screen showed the old mode until the next REST poll; ``nozzle_rack[]`` lacked
+``filament_type``, and since the push replaces the whole rack an H2C slot
+lost its material label on every push.
+"""
+
+import backend.app.core.database  # noqa: F401  -- model import order
+from backend.app.services.bambu_mqtt import PrinterState
+from backend.app.services.printer_manager import printer_state_to_dict
+
+
+def test_the_airduct_mode_is_pushed():
+    state = PrinterState()
+    state.airduct_mode = 1
+
+    assert printer_state_to_dict(state)["airduct_mode"] == 1
+
+
+def test_a_rack_slot_keeps_its_material():
+    state = PrinterState()
+    state.nozzle_rack = [{"id": 2, "type": "HS", "diameter": "0.4", "filament_id": "GFL99", "filament_type": "PLA"}]
+
+    [slot] = printer_state_to_dict(state)["nozzle_rack"]
+    assert slot["filament_type"] == "PLA"

frontend/src/__tests__/api/dayZone.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Calendar dates go to the server with the browser's zone (DB-C12).
+ *
+ * The server reads a date as a day in the zone it is sent with, else in its own
+ * TZ -- which, for a browser away from the server, shifted every Stats day.
+ */
+
+import { describe, it, expect, afterAll, beforeAll } from 'vitest';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+import { api } from '../../api/client';
+
+const originalTz = process.env.TZ;
+
+beforeAll(() => {
+  process.env.TZ = 'Asia/Tokyo';
+});
+
+afterAll(() => {
+  if (originalTz === undefined) delete process.env.TZ;
+  else process.env.TZ = originalTz;
+});
+
+function capture(path: string, body: unknown): URL[] {
+  const seen: URL[] = [];
+  server.use(
+    http.get(path, ({ request }) => {
+      seen.push(new URL(request.url));
+      return HttpResponse.json(body);
+    }),
+  );
+  return seen;
+}
+
+describe('date filters carry the browser zone', () => {
+  it('sends it with the dates', async () => {
+    const seen = capture('/api/v1/archives/slim', []);
+    await api.getArchivesSlim('2026-10-17', '2026-10-17');
+
+    expect(seen[0].searchParams.get('tz')).toBe('Asia/Tokyo');
+    expect(seen[0].searchParams.get('date_from')).toBe('2026-10-17');
+  });
+
+  it('sends it for the statistics totals too', async () => {
+    const seen = capture('/api/v1/archives/stats', {});
+    await api.getArchiveStats({ dateFrom: '2026-10-17', dateTo: '2026-10-17' });
+
+    expect(seen[0].searchParams.get('tz')).toBe('Asia/Tokyo');
+  });
+
+  it('leaves it out without dates', async () => {
+    const seen = capture('/api/v1/archives/slim', []);
+    await api.getArchivesSlim();
+
+    expect(seen[0].searchParams.has('tz')).toBe(false);
+  });
+});

frontend/src/__tests__/components/AddSmartPlugModalWiring.test.tsx

@@ -0,0 +1,286 @@
+/**
+ * AddSmartPlugModal wiring: the create / update payloads per plug type,
+ * the printer link, and the Tasmota discovery scan requests.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { AddSmartPlugModal } from '../../components/AddSmartPlugModal';
+import type { SmartPlug } from '../../api/client';
+
+type Sent = { method: string; path: string; body: Record<string, unknown> | null };
+
+const PRINTERS = [
+  { id: 3, name: 'Wiring Printer A', model: 'X1C', serial_number: 'SN-TEST-A' },
+  { id: 4, name: 'Wiring Printer B', model: 'P1S', serial_number: 'SN-TEST-B' },
+];
+
+let sent: Sent[];
+
+async function record(request: Request) {
+  let body: Record<string, unknown> | null = null;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  server.use(
+    http.get('*/api/v1/printers/', () => HttpResponse.json(PRINTERS)),
+    http.get('*/api/v1/smart-plugs/', () => HttpResponse.json([])),
+    http.get('*/api/v1/settings/', () =>
+      HttpResponse.json({
+        ha_enabled: true,
+        ha_url: 'http://ha.example',
+        ha_token: 'test-token-1',
+        mqtt_broker: 'mqtt.example',
+      }),
+    ),
+    http.get('*/api/v1/smart-plugs/ha/entities', () =>
+      HttpResponse.json([
+        { entity_id: 'switch.wiring_plug', friendly_name: 'Wiring Switch', state: 'off', domain: 'switch' },
+      ]),
+    ),
+    http.get('*/api/v1/smart-plugs/ha/sensors', () => HttpResponse.json([])),
+    http.post('*/api/v1/smart-plugs/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ id: 99 });
+    }),
+    http.patch('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ id: 5 });
+    }),
+  );
+});
+
+function nameInput() {
+  return screen.getByPlaceholderText('Living Room Plug');
+}
+
+describe('AddSmartPlugModal wiring: create', () => {
+  it('Tasmota: sends ip, type, printer_id and the default automation flags, no other type fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.20');
+    await user.type(nameInput(), 'Desk Plug');
+    const printerSelect = await screen.findByDisplayValue('No printer (manual control only)');
+    await screen.findByRole('option', { name: 'Wiring Printer B' });
+    await user.selectOptions(printerSelect, '4');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('POST');
+    expect(req.path).toBe('/api/v1/smart-plugs/');
+    expect(req.body).toMatchObject({
+      name: 'Desk Plug',
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.20',
+      printer_id: 4,
+      controls_printer_power: true,
+      ha_entity_id: null,
+      mqtt_power_topic: null,
+      rest_on_url: null,
+      username: null,
+      password: null,
+    });
+  });
+
+  it('Tasmota: unlinked sends printer_id null', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.21');
+    await user.type(nameInput(), 'Loose Plug');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({ plug_type: 'tasmota', printer_id: null });
+  });
+
+  it('Tasmota without an IP sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.type(nameInput(), 'No IP');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    expect(await screen.findByText(/IP address is required/i)).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+
+  it('Home Assistant: sends the picked entity and no Tasmota/MQTT/REST fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'HA' }));
+    const search = await screen.findByPlaceholderText(/search/i);
+    await user.click(search);
+    await user.click(await screen.findByText('Wiring Switch'));
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      name: 'Wiring Switch',
+      plug_type: 'homeassistant',
+      ha_entity_id: 'switch.wiring_plug',
+      ip_address: null,
+      username: null,
+      password: null,
+      mqtt_power_topic: null,
+      rest_on_url: null,
+      printer_id: null,
+    });
+  });
+
+  it('switching from HA to Tasmota drops the picked HA entity from the payload', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'HA' }));
+    await user.click(await screen.findByPlaceholderText(/search/i));
+    await user.click(await screen.findByText('Wiring Switch'));
+    await user.click(screen.getByRole('button', { name: 'Tasmota' }));
+    await user.type(screen.getByPlaceholderText('192.168.1.100'), '192.0.2.22');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.22',
+      ha_entity_id: null,
+      ha_power_entity: null,
+    });
+  });
+
+  it('MQTT: sends only the MQTT topic fields', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'MQTT' }));
+    await user.type(await screen.findByPlaceholderText('zigbee2mqtt/shelly-working-room'), 'tele/wiring/SENSOR');
+    await user.type(nameInput(), 'Meter');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'mqtt',
+      mqtt_power_topic: 'tele/wiring/SENSOR',
+      mqtt_energy_topic: null,
+      ip_address: null,
+      ha_entity_id: null,
+      rest_on_url: null,
+    });
+  });
+
+  it('REST: sends the REST URLs and method only', async () => {
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'REST' }));
+    const [onUrl, offUrl] = await screen.findAllByPlaceholderText('http://openhab:8080/rest/items/MyPlug');
+    await user.type(onUrl, 'http://plug.example/on');
+    await user.type(offUrl, 'http://plug.example/off');
+    await user.type(nameInput(), 'Rest Plug');
+    await user.click(screen.getByRole('button', { name: 'Add' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].body).toMatchObject({
+      plug_type: 'rest',
+      rest_on_url: 'http://plug.example/on',
+      rest_off_url: 'http://plug.example/off',
+      rest_method: 'POST',
+      ip_address: null,
+      ha_entity_id: null,
+      mqtt_power_topic: null,
+      username: null,
+      password: null,
+    });
+  });
+});
+
+describe('AddSmartPlugModal wiring: edit', () => {
+  it('PATCHes the edited plug by id, keeping the saved-secret placeholder and the changed name', async () => {
+    const user = userEvent.setup();
+    const existing = {
+      id: 5,
+      name: 'Old Name',
+      plug_type: 'tasmota',
+      ip_address: '192.0.2.30',
+      username: 'admin',
+      password: '********',
+      enabled: true,
+      printer_id: 3,
+      controls_printer_power: false,
+    } as unknown as SmartPlug;
+    render(<AddSmartPlugModal plug={existing} onClose={() => undefined} />);
+
+    const name = await screen.findByDisplayValue('Old Name');
+    await user.clear(name);
+    await user.type(name, 'New Name');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('PATCH');
+    expect(req.path).toBe('/api/v1/smart-plugs/5');
+    expect(req.body).toMatchObject({
+      name: 'New Name',
+      ip_address: '192.0.2.30',
+      username: 'admin',
+      // The write-only placeholder goes back untouched; the backend keeps the stored secret.
+      password: '********',
+      printer_id: 3,
+      controls_printer_power: false,
+    });
+  });
+});
+
+describe('AddSmartPlugModal wiring: Tasmota discovery', () => {
+  it('starts and stops the scan, and picking a found device fills IP and name', async () => {
+    server.use(
+      http.post('*/api/v1/smart-plugs/discover/scan', async ({ request }) => {
+        await record(request);
+        return HttpResponse.json({ running: true, scanned: 0, total: 254 });
+      }),
+      http.get('*/api/v1/smart-plugs/discover/status', () =>
+        HttpResponse.json({ running: true, scanned: 10, total: 254 }),
+      ),
+      http.get('*/api/v1/smart-plugs/discover/devices', () =>
+        HttpResponse.json([{ ip_address: '192.0.2.55', name: 'Found Plug', state: 'ON' }]),
+      ),
+      http.post('*/api/v1/smart-plugs/discover/stop', async ({ request }) => {
+        await record(request);
+        return HttpResponse.json({ running: false, scanned: 10, total: 254 });
+      }),
+    );
+    const user = userEvent.setup();
+    render(<AddSmartPlugModal onClose={() => undefined} />);
+
+    await user.click(screen.getByRole('button', { name: 'Discover Tasmota Devices' }));
+    await waitFor(() => expect(writes().map((w) => w.path)).toEqual(['/api/v1/smart-plugs/discover/scan']));
+
+    await user.click(await screen.findByText('Found Plug'));
+    expect(screen.getByPlaceholderText('192.168.1.100')).toHaveValue('192.0.2.55');
+    expect(nameInput()).toHaveValue('Found Plug');
+
+    await user.click(screen.getByRole('button', { name: 'Stop Scanning' }));
+    await waitFor(() =>
+      expect(writes().map((w) => w.path)).toEqual([
+        '/api/v1/smart-plugs/discover/scan',
+        '/api/v1/smart-plugs/discover/stop',
+      ]),
+    );
+  });
+});

frontend/src/__tests__/components/AssignSpoolModalWiring.test.tsx

@@ -0,0 +1,180 @@
+/**
+ * Wiring tests for AssignSpoolModal: pin the exact request payload sent
+ * when a spool is assigned to a slot (built-in and Spoolman inventory),
+ * and that the material-mismatch confirm gates the request.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { AssignSpoolModal } from '../../components/AssignSpoolModal';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getSpools: vi.fn(),
+    getAssignments: vi.fn(),
+    assignSpool: vi.fn(),
+    assignSpoolmanSlot: vi.fn(),
+    getSpoolmanInventorySpools: vi.fn(),
+    getSpoolmanSlotAssignments: vi.fn().mockResolvedValue([]),
+    getSettings: vi.fn().mockResolvedValue({}),
+    getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    refreshPrinterStatus: vi.fn().mockResolvedValue({ status: 'ok' }),
+  },
+}));
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const plaSpool = {
+  id: 41,
+  material: 'PLA',
+  subtype: 'Basic',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 1000,
+  weight_used: 0,
+  tag_uid: null,
+  tray_uuid: null,
+  slicer_filament_name: 'PLA',
+};
+
+const baseProps = {
+  isOpen: true,
+  onClose: vi.fn(),
+  printerId: 7,
+  amsId: 128,
+  trayId: 0,
+};
+
+describe('AssignSpoolModal wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSpools.mockResolvedValue([plaSpool]);
+    mocked.getAssignments.mockResolvedValue([]);
+    mocked.getSettings.mockResolvedValue({});
+    mocked.refreshPrinterStatus.mockResolvedValue({ status: 'ok' });
+    mocked.getSpoolmanSlotAssignments.mockResolvedValue([]);
+    mocked.assignSpool.mockResolvedValue({ id: 1, spool_id: 41, printer_id: 7, ams_id: 128, tray_id: 0 });
+    mocked.assignSpoolmanSlot.mockResolvedValue({});
+  });
+
+  it('built-in: sends assignSpool with the picked spool id and the opened slot (AMS-HT 128)', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'AMS-HT' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() => expect(mocked.assignSpool).toHaveBeenCalledTimes(1));
+    expect(mocked.assignSpool).toHaveBeenCalledWith({
+      spool_id: 41,
+      printer_id: 7,
+      ams_id: 128,
+      tray_id: 0,
+    });
+    expect(mocked.assignSpoolmanSlot).not.toHaveBeenCalled();
+  });
+
+  it('built-in: external slot ids (254/255) are passed through unchanged', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={255}
+        trayId={254}
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'External' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() =>
+      expect(mocked.assignSpool).toHaveBeenCalledWith({ spool_id: 41, printer_id: 7, ams_id: 255, tray_id: 254 }),
+    );
+  });
+
+  it('material mismatch: confirm dialog appears and nothing is sent until "Assign Anyway"', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={1}
+        trayId={2}
+        trayInfo={{ type: 'PETG', material: 'PETG', profile: 'PETG HF', color: 'FF0000', location: 'AMS 2 - Slot 3' }}
+      />,
+    );
+    // PLA spool is filtered out for a PETG tray; reveal it with the toggle.
+    await screen.findByText(/No spools available|show all spools/i);
+    await user.click(screen.getByLabelText(/show all spools/i));
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    expect(await screen.findByText('Material mismatch')).toBeInTheDocument();
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+
+    await user.click(screen.getByRole('button', { name: 'Assign Anyway' }));
+    await waitFor(() =>
+      expect(mocked.assignSpool).toHaveBeenCalledWith({ spool_id: 41, printer_id: 7, ams_id: 1, tray_id: 2 }),
+    );
+    expect(mocked.assignSpool).toHaveBeenCalledTimes(1);
+  });
+
+  it('material mismatch: cancelling the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={1}
+        trayId={2}
+        trayInfo={{ type: 'PETG', material: 'PETG', profile: 'PETG HF', color: 'FF0000', location: 'AMS 2 - Slot 3' }}
+      />,
+    );
+    await screen.findByText(/No spools available|show all spools/i);
+    await user.click(screen.getByLabelText(/show all spools/i));
+    await user.click(await screen.findByText(/Polymaker/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await screen.findByText('Material mismatch');
+    // The confirm dialog renders after the modal, so its Cancel is the last one.
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+
+    await waitFor(() => expect(screen.queryByText('Material mismatch')).not.toBeInTheDocument());
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman: sends assignSpoolmanSlot with spoolman_spool_id and the opened slot', async () => {
+    const user = userEvent.setup();
+    mocked.getSpools.mockResolvedValue([]);
+    mocked.getSpoolmanInventorySpools.mockResolvedValue([
+      { ...plaSpool, id: 900, brand: 'Spoolman Brand', archived_at: null },
+    ]);
+    render(
+      <AssignSpoolModal
+        {...baseProps}
+        amsId={2}
+        trayId={3}
+        spoolmanEnabled
+        trayInfo={{ type: 'PLA', material: 'PLA', profile: 'PLA', color: 'FF0000', location: 'AMS 3 - Slot 4' }}
+      />,
+    );
+    await user.click(await screen.findByText(/Spoolman Brand/));
+    await user.click(screen.getByRole('button', { name: /assign spool/i }));
+
+    await waitFor(() =>
+      expect(mocked.assignSpoolmanSlot).toHaveBeenCalledWith({
+        spoolman_spool_id: 900,
+        printer_id: 7,
+        ams_id: 2,
+        tray_id: 3,
+      }),
+    );
+    expect(mocked.assignSpool).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/BulkEditSpoolsModalWiring.test.tsx

@@ -0,0 +1,151 @@
+/**
+ * Wiring tests for BulkEditSpoolsModal: pin the exact patch handed to
+ * onApply (which InventoryPage forwards to bulkUpdateSpools). Only ticked
+ * fields may appear, so other spools' values are never overwritten, and
+ * Spoolman mode must never emit internal-only keys.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { BulkEditSpoolsModal } from '../../components/BulkEditSpoolsModal';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getCloudStatus: vi.fn().mockResolvedValue({ is_authenticated: false }),
+      orcaCloudStatus: vi.fn().mockResolvedValue({ connected: false }),
+      getLocalPresets: vi.fn().mockResolvedValue({ filament: [] }),
+      getBuiltinFilaments: vi.fn().mockResolvedValue([]),
+      getSettings: vi.fn().mockResolvedValue({}),
+      getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    },
+  };
+});
+
+const onApply = vi.fn();
+const onClose = vi.fn();
+
+const baseProps = {
+  isOpen: true,
+  selectedCount: 3,
+  isPending: false,
+  availableLocations: [{ id: 5, name: 'Shelf A' }],
+  availableMaterials: [],
+  availableSubtypes: [],
+  availableBrands: [],
+  availableCategories: [],
+  availableMaterialNumbers: [],
+  availableSlicerFilaments: [],
+  availableSlicerFilamentNames: [],
+  onClose,
+  onApply,
+};
+
+/** The row container for a field, found via its exact label text. */
+function row(label: string): HTMLElement {
+  const lbl = screen.getByText(label, { selector: 'label' });
+  return lbl.closest('div.flex.items-start') as HTMLElement;
+}
+
+async function tickAndType(user: ReturnType<typeof userEvent.setup>, label: string, value: string) {
+  const r = row(label);
+  await user.click(within(r).getByRole('checkbox'));
+  const input = r.querySelector('textarea, input[type="text"], input[type="number"]') as HTMLElement;
+  await user.type(input, value);
+}
+
+describe('BulkEditSpoolsModal wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('only the ticked material field ends up in the patch', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    await tickAndType(user, 'Material', 'PETG-CF');
+    // Close any open dropdown so the Apply button is reachable.
+    await user.keyboard('{Escape}');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    expect(onApply).toHaveBeenCalledWith({ material: 'PETG-CF' });
+  });
+
+  it('ticked but empty fields are left out; numbers are sent as numbers', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    // Ticked, left blank -> must not blank the field on every selected spool.
+    await user.click(within(row('Brand')).getByRole('checkbox'));
+    await tickAndType(user, 'Cost per kg', '19.5');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    expect(onApply).toHaveBeenCalledWith({ cost_per_kg: 19.5 });
+  });
+
+  it('internal mode: internal-only fields are sent when ticked', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode={false} />);
+
+    await tickAndType(user, 'Material No.', 'MN-7');
+    await user.keyboard('{Escape}');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledWith({ material_number: 'MN-7' }));
+  });
+
+  it('Spoolman mode: patch holds only the ticked Spoolman-storable fields, no internal-only keys', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode />);
+
+    await tickAndType(user, 'Material', 'ASA');
+    await user.keyboard('{Escape}');
+    await tickAndType(user, 'Note', 'restocked');
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    const patch = onApply.mock.calls[0][0] as Record<string, unknown>;
+    expect(patch).toEqual({ material: 'ASA', note: 'restocked' });
+    for (const k of ['category', 'low_stock_threshold_pct', 'material_number']) {
+      expect(patch).not.toHaveProperty(k);
+    }
+  });
+
+  it('Spoolman mode: ticking and filling EVERY offered field still yields no internal-only key', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} spoolmanMode />);
+
+    const rows = screen.getAllByRole('checkbox').map((cb) => cb.closest('div.flex.items-start') as HTMLElement);
+    for (const r of rows) {
+      await user.click(within(r).getByRole('checkbox'));
+      const input = r.querySelector('textarea, input[type="text"], input[type="number"]') as HTMLInputElement;
+      await user.type(input, input.type === 'number' ? '5' : input.placeholder?.includes('RRGGBB') ? 'FF0000' : 'X');
+      await user.keyboard('{Escape}');
+    }
+    await user.click(screen.getByRole('button', { name: /Apply to 3 spools/ }));
+
+    await waitFor(() => expect(onApply).toHaveBeenCalledTimes(1));
+    const patch = onApply.mock.calls[0][0] as Record<string, unknown>;
+    // Sanity: the fill reached the patch (material, note, ... are present).
+    expect(patch).toHaveProperty('material', 'X');
+    expect(patch).toHaveProperty('note', 'X');
+    for (const k of ['category', 'low_stock_threshold_pct', 'material_number']) {
+      expect(patch).not.toHaveProperty(k);
+    }
+  });
+
+  it('Cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<BulkEditSpoolsModal {...baseProps} />);
+    await tickAndType(user, 'Note', 'x');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(onApply).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/BulkPrinterToolbarWiring.test.tsx

@@ -0,0 +1,170 @@
+/**
+ * BulkPrinterToolbar wiring: which action the toolbar reports, which state the
+ * select-by-state dropdown reports, and the permission gates on the destructive
+ * buttons (printers:control for stop/pause/resume/clear HMS,
+ * printers:clear_plate for Clear Bed).
+ *
+ * The toolbar reads printer statuses straight from the query cache, so each
+ * test seeds the cache it renders with.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { Printer } from '../../api/client';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { BulkPrinterToolbar } from '../../components/BulkPrinterToolbar';
+
+const printer = (id: number, location: string | null = null) =>
+  ({ id, name: `P${id}`, model: 'X1C', location }) as unknown as Printer;
+
+const printers = [printer(1, 'Lab'), printer(2, 'Lab'), printer(3, 'Shed')];
+
+// 1 printing, 2 paused (awaiting plate clear), 3 idle.
+function seededClient() {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  qc.setQueryData(['printerStatus', 1], { connected: true, state: 'RUNNING' });
+  qc.setQueryData(['printerStatus', 2], { connected: true, state: 'PAUSE', awaiting_plate_clear: true });
+  qc.setQueryData(['printerStatus', 3], { connected: true, state: 'IDLE' });
+  return qc;
+}
+
+function renderToolbar(selected: number[] = [1, 2]) {
+  const props = {
+    selectedIds: new Set(selected),
+    printers,
+    onClose: vi.fn(),
+    onSelectAll: vi.fn(),
+    onSelectByLocation: vi.fn(),
+    onSelectByState: vi.fn(),
+    onAction: vi.fn(),
+    actionPending: false,
+  };
+  render(
+    <QueryClientProvider client={seededClient()}>
+      <BulkPrinterToolbar {...props} />
+    </QueryClientProvider>,
+  );
+  return props;
+}
+
+const btn = (name: string) => screen.getByRole('button', { name });
+
+describe('BulkPrinterToolbar wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control', 'printers:clear_plate'];
+    vi.clearAllMocks();
+  });
+
+  it.each([
+    ['Stop', 'stop'],
+    ['Pause', 'pause'],
+    ['Resume', 'resume'],
+    ['Clear Bed', 'clearPlate'],
+  ])('clicking %s reports action %s', async (label, action) => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn(label));
+    expect(props.onAction).toHaveBeenCalledTimes(1);
+    expect(props.onAction).toHaveBeenCalledWith(action);
+  });
+
+  it('disables Stop, Pause and Resume without printers:control', async () => {
+    permissions.granted = ['printers:clear_plate'];
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Notifications']) {
+      expect(btn(label)).toBeDisabled();
+      expect(btn(label)).toHaveAttribute('title', 'You do not have permission to control printers');
+      await user.click(btn(label));
+    }
+    // Clear Bed has its own permission and stays usable.
+    expect(btn('Clear Bed')).toBeEnabled();
+    expect(props.onAction).not.toHaveBeenCalled();
+  });
+
+  it('disables Clear Bed without printers:clear_plate even with control', async () => {
+    permissions.granted = ['printers:control'];
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    expect(btn('Clear Bed')).toBeDisabled();
+    await user.click(btn('Clear Bed'));
+    expect(props.onAction).not.toHaveBeenCalled();
+    expect(btn('Stop')).toBeEnabled();
+  });
+
+  it('disables actions none of the selected printers can take', () => {
+    // Only the idle printer is selected: nothing to stop, pause, resume or clear.
+    renderToolbar([3]);
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Bed']) {
+      expect(btn(label)).toBeDisabled();
+    }
+  });
+
+  it('disables every action while one is pending', () => {
+    const props = {
+      selectedIds: new Set([1, 2]),
+      printers,
+      onClose: vi.fn(),
+      onSelectAll: vi.fn(),
+      onSelectByLocation: vi.fn(),
+      onSelectByState: vi.fn(),
+      onAction: vi.fn(),
+      actionPending: true,
+    };
+    render(
+      <QueryClientProvider client={seededClient()}>
+        <BulkPrinterToolbar {...props} />
+      </QueryClientProvider>,
+    );
+    for (const label of ['Stop', 'Pause', 'Resume', 'Clear Bed']) {
+      expect(btn(label)).toBeDisabled();
+    }
+  });
+
+  it('select by state reports the picked state', async () => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn('Select by State'));
+    // Only states with printers in them are offered.
+    expect(screen.queryByRole('button', { name: /Offline/ })).toBeNull();
+    await user.click(screen.getByRole('button', { name: /Paused/ }));
+    expect(props.onSelectByState).toHaveBeenCalledTimes(1);
+    expect(props.onSelectByState).toHaveBeenCalledWith('paused');
+    // The dropdown closes after a pick.
+    await waitFor(() => expect(screen.queryByRole('button', { name: /Paused/ })).toBeNull());
+  });
+
+  it('select by location reports the picked location', async () => {
+    const user = userEvent.setup();
+    const props = renderToolbar();
+    await user.click(btn('Select by Location'));
+    await user.click(screen.getByRole('button', { name: 'Shed' }));
+    expect(props.onSelectByLocation).toHaveBeenCalledWith('Shed');
+    expect(props.onSelectByState).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/ConfigureAmsSlotModalWiring.test.tsx

@@ -0,0 +1,99 @@
+/**
+ * Wiring tests for ConfigureAmsSlotModal's "Reset Slot" path: the request
+ * must target exactly the opened slot (printer, AMS id, tray id), including
+ * AMS-HT (128+) and external (255/254) ids.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { ConfigureAmsSlotModal } from '../../components/ConfigureAmsSlotModal';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getCloudSettings: vi.fn(),
+    getKProfiles: vi.fn(),
+    configureAmsSlot: vi.fn(),
+    getCloudSettingDetail: vi.fn(),
+    saveSlotPreset: vi.fn(),
+    getSettings: vi.fn().mockResolvedValue({}),
+    getSlicerPrinterModels: vi.fn().mockResolvedValue({}),
+    updateSettings: vi.fn().mockResolvedValue({}),
+    getLocalPresets: vi.fn(),
+    getBuiltinFilaments: vi.fn(),
+    orcaCloudListProfiles: vi.fn(),
+    orcaCloudGetProfile: vi.fn(),
+    searchColors: vi.fn(),
+    getColorCatalog: vi.fn(),
+    resetAmsSlot: vi.fn(),
+    getPrinterStatus: vi.fn().mockResolvedValue({}),
+  },
+}));
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const onClose = vi.fn();
+const onSuccess = vi.fn();
+
+function props(amsId: number, trayId: number, printerId = 9) {
+  return {
+    isOpen: true,
+    onClose,
+    onSuccess,
+    printerId,
+    slotInfo: { amsId, trayId, trayType: 'PLA', trayColor: 'FFFFFF', traySubBrands: 'PLA Basic' },
+    nozzleDiameter: '0.4',
+  };
+}
+
+describe('ConfigureAmsSlotModal reset wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    Element.prototype.scrollIntoView = vi.fn();
+    mocked.getPrinterStatus.mockResolvedValue({});
+    mocked.getSettings.mockResolvedValue({});
+    mocked.getSlicerPrinterModels.mockResolvedValue({});
+    mocked.getCloudSettings.mockResolvedValue({ filament: [] });
+    mocked.getKProfiles.mockResolvedValue({ profiles: [] });
+    mocked.getLocalPresets.mockResolvedValue({ filament: [] });
+    mocked.orcaCloudListProfiles.mockResolvedValue({ filament: [], printer: [], process: [] });
+    mocked.getBuiltinFilaments.mockResolvedValue([]);
+    mocked.searchColors.mockResolvedValue([]);
+    mocked.getColorCatalog.mockResolvedValue([]);
+    mocked.resetAmsSlot.mockResolvedValue({ success: true, message: 'ok' });
+  });
+
+  it.each([
+    ['regular AMS slot', 2, 3],
+    ['AMS-HT unit', 128, 0],
+    ['external spool holder', 255, 254],
+  ])('%s: Reset Slot sends resetAmsSlot(printerId, amsId, trayId)', async (_label, amsId, trayId) => {
+    const user = userEvent.setup();
+    render(<ConfigureAmsSlotModal {...props(amsId, trayId)} />);
+
+    await user.click(await screen.findByRole('button', { name: /Reset Slot/ }));
+
+    await waitFor(() => expect(mocked.resetAmsSlot).toHaveBeenCalledTimes(1));
+    expect(mocked.resetAmsSlot).toHaveBeenCalledWith(9, amsId, trayId);
+    expect(mocked.configureAmsSlot).not.toHaveBeenCalled();
+    await waitFor(() => expect(onSuccess).toHaveBeenCalled());
+  });
+
+  it('Cancel closes without resetting or configuring', async () => {
+    const user = userEvent.setup();
+    render(<ConfigureAmsSlotModal {...props(1, 1)} />);
+    await screen.findByRole('button', { name: /Reset Slot/ });
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(mocked.resetAmsSlot).not.toHaveBeenCalled();
+    expect(mocked.configureAmsSlot).not.toHaveBeenCalled();
+  });
+
+  // NOTE: the audit item also asked to pin "reset requires confirm and is
+  // disabled while printing". Neither exists in the component today: the
+  // button calls resetAmsSlot on the first click and takes no printer-state
+  // prop. Left as todo for a product decision rather than asserted.
+  it.todo('Reset Slot asks for confirmation before sending (not implemented)');
+  it.todo('Reset Slot is disabled while the printer is printing (not implemented)');
+});

frontend/src/__tests__/components/EmailSettingsWiring.test.tsx

@@ -0,0 +1,192 @@
+/**
+ * Email settings: the SMTP save request carries the form values (and an
+ * empty password when it was not retyped, so the server keeps the stored
+ * one), and the advanced-auth toggle only calls enable/disable when its
+ * preconditions hold.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { EmailSettings } from '../../components/EmailSettings';
+
+type Captured = { method: string; path: string; body: unknown };
+
+let captured: Captured[];
+let advancedStatus: { advanced_auth_enabled: boolean; smtp_configured: boolean };
+let authEnabled: boolean;
+
+const STORED_SMTP = {
+  smtp_host: 'smtp.example',
+  smtp_port: 587,
+  smtp_username: 'mailer',
+  smtp_password: null,
+  smtp_security: 'starttls',
+  smtp_auth_enabled: true,
+  smtp_from_email: 'from@example.com',
+  smtp_from_name: 'BamBuddy',
+};
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  advancedStatus = { advanced_auth_enabled: false, smtp_configured: true };
+  authEnabled = true;
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: authEnabled, requires_setup: false })),
+    http.get('*/api/v1/auth/smtp', () => HttpResponse.json(STORED_SMTP)),
+    http.get('*/api/v1/auth/advanced-auth/status', () => HttpResponse.json(advancedStatus)),
+    http.post('*/api/v1/auth/smtp', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/smtp/test', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ success: true, message: 'sent' });
+    }),
+    http.post('*/api/v1/auth/advanced-auth/enable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'enabled', advanced_auth_enabled: true });
+    }),
+    http.post('*/api/v1/auth/advanced-auth/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'disabled', advanced_auth_enabled: false });
+    }),
+  );
+});
+
+describe('EmailSettings wiring', () => {
+  it('save sends host/port/security/from and an empty password when it was not retyped', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    const from = screen.getByDisplayValue('from@example.com');
+    await user.clear(from);
+    await user.type(from, 'printer@example.com');
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => expect(captured.filter((c) => c.path.endsWith('/auth/smtp'))).toHaveLength(1));
+    const req = captured[0];
+    expect(req.method).toBe('POST');
+    expect(req.body).toEqual({
+      smtp_host: 'smtp.example',
+      smtp_port: 587,
+      smtp_username: 'mailer',
+      smtp_password: '',
+      smtp_security: 'starttls',
+      smtp_auth_enabled: true,
+      smtp_from_email: 'printer@example.com',
+      smtp_from_name: 'BamBuddy',
+    });
+  });
+
+  it('changing security to SSL sends ssl with port 465, and a retyped password is sent', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    await user.selectOptions(screen.getByDisplayValue('STARTTLS (Port 587)'), 'ssl');
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({
+      smtp_security: 'ssl',
+      smtp_port: 465,
+      smtp_password: 'test-password-1',
+    });
+  });
+
+  it('save without a host sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await user.clear(await screen.findByDisplayValue('smtp.example'));
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    expect(await screen.findByText(/please fill in all required fields/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('send test email posts the recipient to /auth/smtp/test', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByDisplayValue('smtp.example');
+    await user.type(screen.getByPlaceholderText('test@example.com'), 'probe@example.com');
+    await user.click(screen.getByRole('button', { name: /send test email/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/auth/smtp/test',
+      body: { test_recipient: 'probe@example.com' },
+    });
+  });
+
+  it('enable advanced auth calls enable once SMTP is configured', async () => {
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    // Wait for AuthProvider to report auth enabled before clicking
+    await waitFor(async () => {
+      captured = [];
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(captured.map((c) => c.path)).toContain('/api/v1/auth/advanced-auth/enable');
+    });
+    expect(captured.map((c) => c.path)).not.toContain('/api/v1/auth/advanced-auth/disable');
+  });
+
+  it('enable advanced auth sends nothing while SMTP is not configured/tested', async () => {
+    advancedStatus = { advanced_auth_enabled: false, smtp_configured: false };
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    // Click until auth status has loaded and the SMTP precondition is the one refusing
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(screen.getAllByText(/configure and test smtp settings first/i).length).toBeGreaterThan(0);
+    });
+    expect(captured).toHaveLength(0);
+  });
+
+  it('enable advanced auth sends nothing while app authentication is off', async () => {
+    authEnabled = false;
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is disabled/i);
+    await user.click(screen.getByRole('button', { name: /^enable$/i }));
+
+    expect(await screen.findByText(/enable authentication first/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('disable advanced auth calls disable when it is on', async () => {
+    advancedStatus = { advanced_auth_enabled: true, smtp_configured: true };
+    const user = userEvent.setup();
+    render(<EmailSettings />);
+
+    await screen.findByText(/advanced authentication is enabled/i);
+    await waitFor(async () => {
+      captured = [];
+      await user.click(screen.getByRole('button', { name: /^disable$/i }));
+      expect(captured.map((c) => c.path)).toContain('/api/v1/auth/advanced-auth/disable');
+    });
+    expect(captured.map((c) => c.path)).not.toContain('/api/v1/auth/advanced-auth/enable');
+  });
+});

frontend/src/__tests__/components/FileManagerModal.test.tsx

@@ -438,6 +438,26 @@ describe('FileManagerModal', () => {
       expect(screen.getByText('1 selected')).toBeInTheDocument();
     });
 
+    it('says a slow listing is slow, and keeps the selection (TO-C13)', async () => {
+      render(
+        <FileManagerModal printerId={1} printerName="X1 Carbon" onClose={mockOnClose} />
+      );
+
+      fireEvent.click(await screen.findByRole('button', { name: 'Select benchy.3mf' }));
+      expect(screen.getByText('1 selected')).toBeInTheDocument();
+
+      server.use(
+        http.get('/api/v1/printers/:id/files', () =>
+          HttpResponse.json({ files: [], warnings: ['listing_timed_out'] })
+        )
+      );
+      fireEvent.click(screen.getByRole('button', { name: 'Refresh' }));
+
+      expect(await screen.findByText(/listing this folder is taking too long/)).toBeInTheDocument();
+      expect(screen.queryByText(/file service is unavailable/)).not.toBeInTheDocument();
+      expect(screen.getByText('1 selected')).toBeInTheDocument();
+    });
+
     it('drops hidden selections when the filter changes', async () => {
       render(
         <FileManagerModal printerId={1} printerName="X1 Carbon" onClose={mockOnClose} />

frontend/src/__tests__/components/ForecastPanelWiring.test.tsx

@@ -0,0 +1,289 @@
+/**
+ * Wiring tests for ForecastPanel's inventory-changing actions: add to
+ * shopping list, status changes, "received" creating spools via
+ * bulkCreateSpools, remove / clear, and per-SKU settings upserts.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { ForecastPanel } from '../../components/ForecastPanel';
+import { api } from '../../api/client';
+import type { InventorySpool, ShoppingListItem } from '../../api/client';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return {
+    ...actual,
+    useAuth: () => ({ hasPermission: () => true, hasAnyPermission: () => true, authEnabled: false, user: null }),
+  };
+});
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getSettings: vi.fn(),
+      getUiSettings: vi.fn(),
+      getAuthStatus: vi.fn(),
+      getSkuSettings: vi.fn(),
+      getAllUsageHistory: vi.fn(),
+      getShoppingList: vi.fn(),
+      addToShoppingList: vi.fn(),
+      removeFromShoppingList: vi.fn(),
+      clearShoppingList: vi.fn(),
+      updateShoppingListStatus: vi.fn(),
+      bulkCreateSpools: vi.fn(),
+      upsertSkuSettings: vi.fn(),
+      updateSettings: vi.fn(),
+    },
+  };
+});
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const spool = (id: number, over: Partial<InventorySpool> = {}): InventorySpool => ({
+  id,
+  material: 'PLA',
+  subtype: 'Matte',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 750,
+  core_weight: 250,
+  core_weight_catalog_id: null,
+  weight_used: 100,
+  slicer_filament: null,
+  slicer_filament_name: null,
+  nozzle_temp_min: null,
+  nozzle_temp_max: null,
+  note: null,
+  added_full: null,
+  last_used: null,
+  encode_time: null,
+  tag_uid: null,
+  tray_uuid: null,
+  data_origin: 'manual',
+  tag_type: null,
+  archived_at: null,
+  created_at: '2025-01-01T00:00:00Z',
+  updated_at: '2025-01-01T00:00:00Z',
+  k_profiles: [],
+  cost_per_kg: null,
+  last_scale_weight: null,
+  last_weighed_at: null,
+  weight_locked: false,
+  category: 'Active',
+  low_stock_threshold_pct: null,
+  ...over,
+});
+
+const spools = [spool(1), spool(2)];
+
+const listItem = (over: Partial<ShoppingListItem> = {}): ShoppingListItem => ({
+  id: 61,
+  material: 'PLA',
+  subtype: 'Matte',
+  brand: 'Polymaker',
+  color_name: 'Red',
+  quantity_spools: 3,
+  note: 'cheap batch',
+  status: 'purchased',
+  purchased_at: null,
+  added_at: '2025-01-01T00:00:00Z',
+  ...over,
+});
+
+async function openShoppingList(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByRole('button', { name: /Shopping List/ }));
+  return screen.findByText('Clear all');
+}
+
+describe('ForecastPanel wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSettings.mockResolvedValue({ forecast_global_lead_time_days: 0 });
+    mocked.getUiSettings.mockResolvedValue({ forecast_global_lead_time_days: 0 });
+    mocked.getAuthStatus.mockResolvedValue({ auth_enabled: false, requires_setup: false });
+    mocked.getSkuSettings.mockResolvedValue([]);
+    mocked.getAllUsageHistory.mockResolvedValue([]);
+    mocked.getShoppingList.mockResolvedValue([listItem()]);
+    mocked.addToShoppingList.mockResolvedValue({});
+    mocked.removeFromShoppingList.mockResolvedValue({ status: 'ok' });
+    mocked.clearShoppingList.mockResolvedValue({ deleted: 1 });
+    mocked.updateShoppingListStatus.mockResolvedValue({});
+    mocked.bulkCreateSpools.mockResolvedValue([]);
+    mocked.upsertSkuSettings.mockResolvedValue({});
+    mocked.updateSettings.mockResolvedValue({});
+  });
+
+  it('marking a purchased item received creates quantity_spools spools from the item, then removes it', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    await user.click(screen.getByTitle(/Mark as received/));
+
+    await waitFor(() => expect(mocked.bulkCreateSpools).toHaveBeenCalledTimes(1));
+    expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(61, 'received');
+    const [base, qty] = mocked.bulkCreateSpools.mock.calls[0];
+    expect(qty).toBe(3);
+    expect(base).toMatchObject({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      note: 'cheap batch',
+      // average label weight of the SKU's existing spools
+      label_weight: 750,
+      weight_used: 0,
+      category: 'Stock',
+      data_origin: 'manual',
+    });
+    await waitFor(() => expect(mocked.removeFromShoppingList).toHaveBeenCalledWith(61));
+  });
+
+  it('marking a pending item purchased only updates its status (no spools created)', async () => {
+    mocked.getShoppingList.mockResolvedValue([listItem({ id: 62, status: 'pending' })]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    await user.click(screen.getByTitle('Mark as purchased'));
+
+    await waitFor(() => expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(62, 'purchased'));
+    expect(mocked.bulkCreateSpools).not.toHaveBeenCalled();
+    expect(mocked.removeFromShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('reset to pending sends status pending for that item', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByTitle('Reset to pending'));
+    await waitFor(() => expect(mocked.updateShoppingListStatus).toHaveBeenCalledWith(61, 'pending'));
+    expect(mocked.bulkCreateSpools).not.toHaveBeenCalled();
+  });
+
+  it('remove deletes exactly that item id', async () => {
+    mocked.getShoppingList.mockResolvedValue([
+      listItem({ id: 70, color_name: 'Red' }),
+      listItem({ id: 71, brand: 'Sunlu', color_name: 'Blue' }),
+    ]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+
+    const row = screen.getByText('Sunlu PLA Matte Blue').closest('tr') as HTMLElement;
+    await user.click(within(row).getByTitle('Remove'));
+
+    await waitFor(() => expect(mocked.removeFromShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.removeFromShoppingList).toHaveBeenCalledWith(71);
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+  });
+
+  // BUG: "Clear all" wipes the whole shopping list on a single click
+  // (ForecastPanel.tsx ShoppingListPanel onClear -> api.clearShoppingList with
+  // no ConfirmModal). Every other bulk-destructive inventory action confirms.
+  it.skip('clear all asks for confirmation before deleting the shopping list', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByText('Clear all'));
+    // Nothing may be sent before the user confirms.
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+    expect(mocked.clearShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('clear all sends clearShoppingList (current behaviour, no confirm)', async () => {
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await openShoppingList(user);
+    await user.click(screen.getByText('Clear all'));
+    await waitFor(() => expect(mocked.clearShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.removeFromShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('add to shopping list sends the SKU from the row with the entered quantity and note', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+
+    await user.click(await screen.findByTitle('Add to shopping list'));
+    const qty = await screen.findByRole('spinbutton');
+    await user.clear(qty);
+    await user.type(qty, '4');
+    await user.type(screen.getByPlaceholderText(/./), 'for project X');
+    await user.click(screen.getByRole('button', { name: 'Add 4 spools' }));
+
+    await waitFor(() => expect(mocked.addToShoppingList).toHaveBeenCalledTimes(1));
+    expect(mocked.addToShoppingList).toHaveBeenCalledWith({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      quantity_spools: 4,
+      note: 'for project X',
+    });
+  });
+
+  it('cancelling the add-to-list dialog sends nothing', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await user.click(await screen.findByTitle('Add to shopping list'));
+    await screen.findByText('Add to Shopping List');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Add to Shopping List')).not.toBeInTheDocument());
+    expect(mocked.addToShoppingList).not.toHaveBeenCalled();
+  });
+
+  it('SKU lead-time override save upserts the SKU settings with the new lead time', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    mocked.getSkuSettings.mockResolvedValue([
+      {
+        id: 5, material: 'PLA', subtype: 'Matte', brand: 'Polymaker', color_name: 'Red',
+        lead_time_days: 3, safety_margin_value: 20, safety_margin_unit: 'g', alerts_snoozed: false,
+      },
+    ]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+
+    // Expand the SKU row.
+    await user.click(await screen.findByText('Polymaker PLA Matte Red'));
+    const box = (await screen.findByText('Lead Time Override')).closest('div.rounded-lg') as HTMLElement;
+    await user.click(within(box).getByRole('button'));
+    const input = within(box).getByRole('spinbutton');
+    await user.clear(input);
+    await user.type(input, '12');
+    await user.click(within(box).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mocked.upsertSkuSettings).toHaveBeenCalledTimes(1));
+    expect(mocked.upsertSkuSettings.mock.calls[0][0]).toEqual({
+      material: 'PLA',
+      subtype: 'Matte',
+      brand: 'Polymaker',
+      color_name: 'Red',
+      lead_time_days: 12,
+      safety_margin_value: 20,
+      safety_margin_unit: 'g',
+      alerts_snoozed: false,
+    });
+  });
+
+  it('SKU lead-time edit cancelled sends nothing', async () => {
+    mocked.getShoppingList.mockResolvedValue([]);
+    const user = userEvent.setup();
+    render(<ForecastPanel spools={spools} />);
+    await user.click(await screen.findByText('Polymaker PLA Matte Red'));
+    const box = (await screen.findByText('Lead Time Override')).closest('div.rounded-lg') as HTMLElement;
+    await user.click(within(box).getByRole('button'));
+    await user.type(within(box).getByRole('spinbutton'), '9');
+    await user.click(within(box).getByRole('button', { name: 'Cancel' }));
+    expect(mocked.upsertSkuSettings).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/GitHubBackupSettingsWiring.test.tsx

@@ -0,0 +1,237 @@
+/**
+ * Backup settings wiring: local backup restore/delete target the clicked
+ * file and only after the confirm, "Backup Now"/"Run Now" hit their run
+ * endpoints, the connection test uses the stored token unless a new one is
+ * typed, and Clear empties the backup history.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { api, setAuthToken } from '../../api/client';
+import { GitHubBackupSettings } from '../../components/GitHubBackupSettings';
+
+type Captured = { method: string; path: string; search: string };
+let captured: Captured[];
+
+const CONFIG = {
+  id: 1,
+  provider: 'github',
+  repository_url: 'https://github.com/test/backup-repo',
+  has_token: true,
+  branch: 'main',
+  enabled: true,
+  schedule_enabled: false,
+  schedule_type: 'daily',
+  schedule_time: '02:00',
+  backup_kprofiles: true,
+  backup_cloud_profiles: false,
+  backup_spools: true,
+  backup_archives: true,
+  backup_settings: true,
+  allow_insecure_http: false,
+  last_backup_at: null,
+  last_backup_status: null,
+};
+
+const BACKUPS = [
+  { filename: 'bambuddy-backup-2026-10-01.zip', size: 1048576, created_at: '2026-10-01T03:00:00Z' },
+  { filename: 'bambuddy backup #2.zip', size: 2097152, created_at: '2026-10-02T03:00:00Z' },
+];
+
+function record(request: Request) {
+  const url = new URL(request.url);
+  captured.push({ method: request.method, path: url.pathname, search: url.search });
+}
+
+const writes = () => captured.filter((c) => c.method !== 'GET');
+
+function fileRow(filename: string): HTMLElement {
+  return screen.getByText(filename).closest('div.flex.items-center.justify-between') as HTMLElement;
+}
+
+beforeEach(() => {
+  captured = [];
+  server.use(
+    http.get('*/api/v1/github-backup/config', () => HttpResponse.json(CONFIG)),
+    http.get('*/api/v1/github-backup/status', () =>
+      HttpResponse.json({
+        configured: true,
+        enabled: true,
+        is_running: false,
+        restore_running: false,
+        progress: null,
+        last_backup_at: null,
+        last_backup_status: null,
+        next_run: null,
+      }),
+    ),
+    http.get('*/api/v1/github-backup/logs', () =>
+      HttpResponse.json([
+        {
+          id: 1, config_id: 1, started_at: '2026-10-01T09:00:00', completed_at: '2026-10-01T09:00:05',
+          status: 'success', trigger: 'manual', commit_sha: null, files_changed: 1, error_message: null,
+        },
+      ]),
+    ),
+    http.get('*/api/v1/local-backup/status', () =>
+      HttpResponse.json({
+        enabled: true, is_running: false, last_backup_at: null, last_status: null,
+        last_message: null, next_run: null, path: '/data/backups',
+      }),
+    ),
+    http.get('*/api/v1/local-backup/path-check', () => HttpResponse.json({ writable: true, path: '/data/backups', code: 'ok' })),
+    http.get('*/api/v1/local-backup/backups', () => HttpResponse.json(BACKUPS)),
+    http.post('*/api/v1/local-backup/backups/:name/restore', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'restored' });
+    }),
+    http.delete('*/api/v1/local-backup/backups/:name', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'deleted' });
+    }),
+    http.post('*/api/v1/local-backup/run', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'ok', filename: 'x.zip' });
+    }),
+    http.post('*/api/v1/github-backup/run', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ success: true, message: 'ok', files_changed: 0 });
+    }),
+    http.delete('*/api/v1/github-backup/logs', ({ request }) => {
+      record(request);
+      return HttpResponse.json({ deleted: 1, message: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  setAuthToken(null);
+});
+
+describe('GitHubBackupSettings wiring', () => {
+  it('restore of a local backup asks first, then POSTs restore for the clicked file (URL-encoded)', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy backup #2.zip');
+    await user.click(within(fileRow('bambuddy backup #2.zip')).getByTitle('Restore'));
+    expect(writes()).toHaveLength(0);
+    await user.click(screen.getByRole('button', { name: /^restore backup$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'POST',
+      path: '/api/v1/local-backup/backups/bambuddy%20backup%20%232.zip/restore',
+    });
+  });
+
+  it('cancelling the restore confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Restore'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: /^restore backup$/i })).not.toBeInTheDocument());
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('delete of a local backup asks first, then DELETEs the clicked file; cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Delete'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(within(fileRow('bambuddy-backup-2026-10-01.zip')).getByTitle('Delete'));
+    // The confirm modal's button (the row button has a title, the modal's does not)
+    const confirm = screen.getAllByRole('button', { name: /^delete$/i }).find((b) => !b.hasAttribute('title'));
+    await user.click(confirm as HTMLElement);
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'DELETE',
+      path: '/api/v1/local-backup/backups/bambuddy-backup-2026-10-01.zip',
+    });
+  });
+
+  it('Run Now triggers the local backup', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /run now/i }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/local-backup/run' });
+  });
+
+  it('Backup Now triggers the Git backup', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /backup now/i }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/github-backup/run' });
+  });
+
+  it('Test with the token field blank uses the stored token', async () => {
+    const stored = vi.spyOn(api, 'testGitHubStoredConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const typed = vi.spyOn(api, 'testGitHubConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /^test$/i }));
+    await waitFor(() => expect(stored).toHaveBeenCalledTimes(1));
+    expect(typed).not.toHaveBeenCalled();
+  });
+
+  it('Test with a newly typed token tests those credentials, not the stored ones', async () => {
+    const stored = vi.spyOn(api, 'testGitHubStoredConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const typed = vi.spyOn(api, 'testGitHubConnection').mockResolvedValue({ success: true, message: 'ok', is_private: true } as never);
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    await user.type(await screen.findByPlaceholderText(/enter new token to update/i), 'test-token-value-1');
+    await user.click(screen.getByRole('button', { name: /^test$/i }));
+
+    await waitFor(() => expect(typed).toHaveBeenCalledTimes(1));
+    expect(typed).toHaveBeenCalledWith('https://github.com/test/backup-repo', 'test-token-value-1', 'github');
+    expect(stored).not.toHaveBeenCalled();
+  });
+
+  it('Clear in the backup history deletes all logs (keep_last=0)', async () => {
+    const user = userEvent.setup();
+    render(<GitHubBackupSettings />);
+
+    const history = (await screen.findByText('History')).closest('div[id="card-backup-history"]') as HTMLElement;
+    await user.click(within(history).getByRole('button', { name: /^clear$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/github-backup/logs', search: '?keep_last=0' });
+  });
+
+  it('a non-admin gets no Restore (or Download) button on local backups', async () => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: 2, username: 'operator', is_admin: false, permissions: ['settings:read', 'settings:update'] }),
+      ),
+    );
+    render(<GitHubBackupSettings />);
+
+    await screen.findByText('bambuddy-backup-2026-10-01.zip');
+    // Wait for the auth state to settle (admin is assumed while auth status loads)
+    await waitFor(() =>
+      expect(within(fileRow('bambuddy-backup-2026-10-01.zip')).queryByTitle('Restore')).not.toBeInTheDocument(),
+    );
+    expect(within(fileRow('bambuddy-backup-2026-10-01.zip')).queryByTitle('Download')).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/components/HMSErrorModalWiring.test.tsx

@@ -0,0 +1,147 @@
+/**
+ * HMSErrorModal wiring: the requests behind "Clear Errors" and the per-fault
+ * action buttons (Resume / Retry / Ignore ...).
+ *
+ * HMSErrorModal.test.tsx covers rendering and the clear button's visibility;
+ * this pins what is actually sent and to which printer.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+import { render } from '../utils';
+import { HMSErrorModal } from '../../components/HMSErrorModal';
+import type { HMSError } from '../../api/client';
+
+const PRINTER_ID = 42;
+
+// A 16-char hms[] fault with actions and a job id.
+const actionable: HMSError = {
+  attr: 0x07000700,
+  code: '0x20009',
+  module: 7,
+  severity: 2,
+  full_code: '0700070000020009',
+  description: 'AMS filament ran out.',
+  actions: ['IGNORE_RESUME', 'RETRY_PROBLEM_SOLVED'],
+  job_id: 'job-777',
+};
+
+// A print_error-style fault without full_code: the 8-char short code is sent.
+const shortOnly: HMSError = {
+  attr: 0x0300,
+  code: '0x400C',
+  module: 3,
+  severity: 1,
+  description: 'The task was canceled.',
+  actions: ['DBL_CHECK_RETRY'],
+};
+
+type Captured = { url: string; body: unknown };
+
+function capture() {
+  const clears: string[] = [];
+  const actions: Captured[] = [];
+  server.use(
+    http.post('/api/v1/printers/:id/hms/clear', ({ params }) => {
+      clears.push(params.id as string);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+    http.post('/api/v1/printers/:id/hms/execute-action', async ({ request, params }) => {
+      actions.push({ url: params.id as string, body: await request.json() });
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+  );
+  return { clears, actions };
+}
+
+const allow = (granted: boolean) =>
+  vi.fn().mockReturnValue(granted) as unknown as (permission: 'printers:control') => boolean;
+
+function renderModal(errors: HMSError[], granted = true) {
+  const onClose = vi.fn();
+  const hasPermission = allow(granted);
+  render(
+    <HMSErrorModal
+      printerName="Shop H2D"
+      printerId={PRINTER_ID}
+      errors={errors}
+      onClose={onClose}
+      hasPermission={hasPermission}
+    />,
+  );
+  return { onClose, hasPermission };
+}
+
+describe('HMSErrorModal wiring', () => {
+  it('Clear Errors posts hms/clear for this printer only', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { onClose } = renderModal([actionable]);
+
+    await user.click(screen.getByRole('button', { name: 'Clear Errors' }));
+
+    await waitFor(() => expect(clears).toEqual([String(PRINTER_ID)]));
+    expect(actions).toEqual([]);
+    await waitFor(() => expect(onClose).toHaveBeenCalledTimes(1));
+  });
+
+  it('an action button sends the action, the full code and the job id', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { onClose } = renderModal([actionable]);
+
+    await user.click(screen.getByRole('button', { name: 'Ignore this and Resume' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect(actions[0]).toEqual({
+      url: String(PRINTER_ID),
+      body: { action: 'IGNORE_RESUME', print_error: '0700070000020009', job_id: 'job-777' },
+    });
+    expect(clears).toEqual([]);
+    await waitFor(() => expect(onClose).toHaveBeenCalledTimes(1));
+  });
+
+  it('falls back to the 8-char short code and a null job id', async () => {
+    const user = userEvent.setup();
+    const { actions } = capture();
+    renderModal([shortOnly]);
+
+    await user.click(screen.getByRole('button', { name: 'Retry' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect(actions[0].body).toEqual({ action: 'DBL_CHECK_RETRY', print_error: '0300400C', job_id: null });
+  });
+
+  it('sends the action of the fault whose button was clicked', async () => {
+    const user = userEvent.setup();
+    const { actions } = capture();
+    renderModal([actionable]);
+
+    // Two buttons on the same fault: Retry, not Ignore.
+    await user.click(screen.getByRole('button', { name: 'Retry (problem solved)' }));
+
+    await waitFor(() => expect(actions).toHaveLength(1));
+    expect((actions[0].body as { action: string }).action).toBe('RETRY_PROBLEM_SOLVED');
+  });
+
+  it('without printers:control, action and clear buttons are disabled and send nothing', async () => {
+    const user = userEvent.setup();
+    const { clears, actions } = capture();
+    const { hasPermission } = renderModal([actionable], false);
+
+    const ignore = screen.getByRole('button', { name: 'Ignore this and Resume' });
+    const clear = screen.getByRole('button', { name: 'Clear Errors' });
+    expect(ignore).toBeDisabled();
+    expect(clear).toBeDisabled();
+    expect(hasPermission).toHaveBeenCalledWith('printers:control');
+
+    await user.click(ignore);
+    await user.click(clear);
+    // Give any stray request a chance to land.
+    await new Promise((r) => setTimeout(r, 20));
+    expect(actions).toEqual([]);
+    expect(clears).toEqual([]);
+  });
+});

frontend/src/__tests__/components/KProfilesViewWiring.test.tsx

@@ -0,0 +1,385 @@
+/**
+ * KProfilesView wiring: what goes to the printer when a K-profile is added
+ * (single extruder / both extruders), edited, deleted (single and bulk) or
+ * imported, and which controls the kprofiles:* permissions disable.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { KProfilesView } from '../../components/KProfilesView';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+const PROFILES = [
+  { slot_id: 3, extruder_id: 0, nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', filament_id: 'GFA00', name: 'S Bambu PLA Basic', k_value: '0.020000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: 'PFUS-row-3' },
+  { slot_id: 5, extruder_id: 0, nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', filament_id: 'GFG99', name: 'HF Generic PETG', k_value: '0.035000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: null },
+  { slot_id: 7, extruder_id: 0, nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', filament_id: 'GFB99', name: 'S Zeta ABS', k_value: '0.040000', n_coef: '0', ams_id: 0, tray_id: 0, setting_id: null },
+];
+
+let sent: Sent[];
+let nozzleCount = 1;
+let detailFetched: string[];
+
+async function record(request: Request) {
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET' && !s.path.endsWith('/notes'));
+
+beforeEach(() => {
+  sent = [];
+  detailFetched = [];
+  nozzleCount = 1;
+  localStorage.removeItem('bambusy_kprofiles_nozzle');
+  server.use(
+    http.get('*/api/v1/printers/', () =>
+      HttpResponse.json([
+        { id: 1, name: 'Wiring X1C', model: 'X1C', is_active: true, nozzle_count: nozzleCount, supports_nozzle_flow_type: true },
+      ]),
+    ),
+    http.get('*/api/v1/printers/:id/kprofiles/', () => HttpResponse.json({ profiles: PROFILES, nozzle_diameter: '0.4' })),
+    http.get('*/api/v1/printers/:id/kprofiles/notes', () => HttpResponse.json({ notes: {} })),
+    http.get('*/api/v1/cloud/builtin-filaments', () =>
+      HttpResponse.json([{ filament_id: 'GFA00', name: 'Bambu PLA Basic' }]),
+    ),
+    http.get('*/api/v1/cloud/filament-id-map', () => HttpResponse.json({})),
+    http.get('*/api/v1/local-presets/', () => HttpResponse.json({ filament: [], printer: [], process: [] })),
+    http.get('*/api/v1/orca-cloud/profiles', () => HttpResponse.json({ filament: [], printer: [], process: [] })),
+    http.get('*/api/v1/cloud/settings', () =>
+      HttpResponse.json({
+        filament: [
+          { setting_id: 'PFUS-test-1', name: 'My Custom PLA @BBL X1C', type: 'filament', version: null, user_id: 'u1', updated_time: null, is_custom: true },
+          { setting_id: 'PFUS-test-2', name: 'Mystery PLA @BBL X1C', type: 'filament', version: null, user_id: 'u1', updated_time: null, is_custom: true },
+        ],
+        printer: [],
+        process: [],
+      }),
+    ),
+    http.get('*/api/v1/cloud/settings/:id', ({ params }) => {
+      detailFetched.push(String(params.id));
+      return HttpResponse.json(params.id === 'PFUS-test-1' ? { filament_id: 'P0000001' } : {});
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/batch', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.delete('*/api/v1/printers/:id/kprofiles/', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, confirmed: true, message: 'ok' });
+    }),
+    http.post('*/api/v1/printers/:id/kprofiles/notes', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  vi.restoreAllMocks();
+});
+
+async function renderLoaded() {
+  const user = userEvent.setup();
+  render(<KProfilesView />);
+  await screen.findByText('S Bambu PLA Basic');
+  return user;
+}
+
+/** The edit modal's delete (trash) button sits right before its Cancel. */
+function modalTrash(): HTMLElement {
+  return screen.getByRole('button', { name: 'Cancel' }).previousElementSibling as HTMLElement;
+}
+
+function kInput(): HTMLInputElement {
+  return screen.getByText('K-Value').parentElement!.querySelector('input') as HTMLInputElement;
+}
+
+describe('KProfilesView wiring: add', () => {
+  it('a Bambu Cloud user preset is resolved via its detail and sent as one profile', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await screen.findByText('Add K-Profile');
+
+    await user.click(await screen.findByRole('button', { name: 'My Custom PLA' }));
+    const k = kInput();
+    await user.clear(k);
+    await user.type(k, '0.0251');
+    await user.tab();
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(detailFetched).toEqual(['PFUS-test-1']);
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        name: 'S My Custom PLA',
+        k_value: '0.025000',
+        filament_id: 'P0000001',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        extruder_id: 0,
+        slot_id: 0,
+      },
+    });
+  });
+
+  it('a preset with no resolvable filament id shows an error and sends nothing', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Mystery PLA' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    expect(await screen.findByText(/No Bambu filament ID for Mystery PLA/)).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+
+  it('on a dual-nozzle printer both extruders go out in one batch request', async () => {
+    nozzleCount = 2;
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Bambu PLA Basic' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    const req = writes()[0];
+    expect(req.method).toBe('POST');
+    expect(req.path).toBe('/api/v1/printers/1/kprofiles/batch');
+    const body = req.body as Array<Record<string, unknown>>;
+    expect(body).toHaveLength(2);
+    expect(body.map((p) => p.extruder_id).sort()).toEqual([0, 1]);
+    for (const p of body) {
+      expect(p).toMatchObject({
+        name: 'S Bambu PLA Basic',
+        k_value: '0.020000',
+        filament_id: 'GFA00',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        slot_id: 0,
+      });
+    }
+  });
+
+  it('on a dual-nozzle printer with one extruder unticked, a single profile for the other is sent', async () => {
+    nozzleCount = 2;
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Add Profile' }));
+    await user.click(await screen.findByRole('button', { name: 'Bambu PLA Basic' }));
+    await user.click(screen.getByRole('checkbox', { name: 'Left' }));
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0].path).toBe('/api/v1/printers/1/kprofiles/');
+    expect(writes()[0].body).toMatchObject({ extruder_id: 0, filament_id: 'GFA00', slot_id: 0 });
+  });
+});
+
+describe('KProfilesView wiring: edit and delete one profile', () => {
+  it('edit keeps the row\'s slot_id, setting_id, extruder and nozzle', async () => {
+    const user = await renderLoaded();
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+
+    const k = kInput();
+    await user.clear(k);
+    await user.type(k, '0.031');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        name: 'S Bambu PLA Basic',
+        k_value: '0.031000',
+        filament_id: 'GFA00',
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        extruder_id: 0,
+        setting_id: 'PFUS-row-3',
+        slot_id: 3,
+      },
+    });
+  });
+
+  async function openDeleteConfirm(user: ReturnType<typeof userEvent.setup>) {
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    const cancel = screen.getByRole('button', { name: 'Cancel' });
+    await user.click(cancel.previousElementSibling as HTMLElement);
+    await screen.findByText('Delete Profile');
+  }
+
+  it('delete sends the identity of exactly that row', async () => {
+    const user = await renderLoaded();
+    await openDeleteConfirm(user);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'DELETE',
+      path: '/api/v1/printers/1/kprofiles/',
+      body: {
+        slot_id: 3,
+        extruder_id: 0,
+        nozzle_id: 'HS00-0.4',
+        nozzle_diameter: '0.4',
+        filament_id: 'GFA00',
+        setting_id: 'PFUS-row-3',
+      },
+    });
+  });
+
+  it('cancelling the delete confirm sends nothing', async () => {
+    const user = await renderLoaded();
+    await openDeleteConfirm(user);
+    await user.click(screen.getAllByRole('button', { name: 'Cancel' }).at(-1)!);
+
+    await waitFor(() => expect(screen.queryByText('Delete Profile')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('KProfilesView wiring: bulk delete', () => {
+  async function selectTwo(user: ReturnType<typeof userEvent.setup>) {
+    await user.click(screen.getByRole('button', { name: 'Select' }));
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await user.click(screen.getByText('S Zeta ABS'));
+    await user.click(screen.getByRole('button', { name: /Delete \(2\)/ }));
+    await screen.findByText('Delete Profiles');
+  }
+
+  it('deletes only the selected rows, each with its own identity', async () => {
+    const user = await renderLoaded();
+    await selectTwo(user);
+    const dialog = screen.getByText('Delete Profiles').closest('.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(2), { timeout: 3000 });
+    const bodies = writes().map((w) => {
+      expect(w.method).toBe('DELETE');
+      expect(w.path).toBe('/api/v1/printers/1/kprofiles/');
+      return w.body as Record<string, unknown>;
+    });
+    expect(bodies.map((b) => b.slot_id).sort()).toEqual([3, 7]);
+    expect(bodies.find((b) => b.slot_id === 7)).toEqual({
+      slot_id: 7,
+      extruder_id: 0,
+      nozzle_id: 'HS00-0.4',
+      nozzle_diameter: '0.4',
+      filament_id: 'GFB99',
+      setting_id: null,
+    });
+  });
+
+  it('cancelling the bulk confirm sends nothing', async () => {
+    const user = await renderLoaded();
+    await selectTwo(user);
+    const dialog = screen.getByText('Delete Profiles').closest('.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete Profiles')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('KProfilesView wiring: import', () => {
+  it('sends one new profile per complete row and skips rows missing name/k_value/filament_id', async () => {
+    let fileInput: HTMLInputElement | null = null;
+    const realCreate = document.createElement.bind(document);
+    vi.spyOn(document, 'createElement').mockImplementation(((tag: string, options?: ElementCreationOptions) => {
+      const el = realCreate(tag, options);
+      if (tag === 'input') {
+        fileInput = el as HTMLInputElement;
+        vi.spyOn(el, 'click').mockImplementation(() => undefined);
+      }
+      return el;
+    }) as typeof document.createElement);
+
+    const user = await renderLoaded();
+    await user.click(screen.getByRole('button', { name: 'Import' }));
+    expect(fileInput).not.toBeNull();
+
+    const data = {
+      version: 1,
+      profiles: [
+        { name: 'Imported A', k_value: '0.02', filament_id: 'GFA00', nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', extruder_id: 0 },
+        { name: 'No filament', k_value: '0.03' },
+        { name: 'Imported B', k_value: '0.045', filament_id: 'GFB99' },
+      ],
+    };
+    // jsdom's File has no text(); the handler only calls that.
+    const file = { name: 'kprofiles.json', text: async () => JSON.stringify(data) };
+    const input = fileInput as unknown as HTMLInputElement;
+    Object.defineProperty(input, 'files', { value: [file] });
+    await (input.onchange as unknown as (e: { target: HTMLInputElement }) => Promise<void>)({ target: input });
+
+    await waitFor(() => expect(writes()).toHaveLength(2), { timeout: 3000 });
+    expect(writes().map((w) => w.body)).toEqual([
+      { name: 'Imported A', k_value: '0.020000', filament_id: 'GFA00', nozzle_id: 'HH00-0.4', nozzle_diameter: '0.4', extruder_id: 0, slot_id: 0 },
+      { name: 'Imported B', k_value: '0.045000', filament_id: 'GFB99', nozzle_id: 'HS00-0.4', nozzle_diameter: '0.4', extruder_id: 0, slot_id: 0 },
+    ]);
+  });
+});
+
+describe('KProfilesView wiring: permissions', () => {
+  function signInWith(permissions: string[]) {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions,
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+  }
+
+  it('read-only: add, import, select, save and delete are disabled', async () => {
+    signInWith(['kprofiles:read']);
+    const user = await renderLoaded();
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Add Profile' })).toBeDisabled());
+    expect(screen.getByRole('button', { name: 'Import' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Select' })).toBeDisabled();
+
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled();
+    expect(modalTrash()).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('kprofiles:update enables Save on an edit but not delete or add', async () => {
+    signInWith(['kprofiles:read', 'kprofiles:update']);
+    const user = await renderLoaded();
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Add Profile' })).toBeDisabled());
+    await user.click(screen.getByText('S Bambu PLA Basic'));
+    await screen.findByText('Edit K-Profile');
+    expect(screen.getByRole('button', { name: 'Save' })).not.toBeDisabled();
+    expect(modalTrash()).toBeDisabled();
+  });
+});

frontend/src/__tests__/components/LDAPSettingsWiring.test.tsx

@@ -0,0 +1,169 @@
+/**
+ * LDAP settings: the save request carries every ldap_* field including the
+ * group mapping and default group, the bind password only when it was typed,
+ * and the enable toggle / test button hit the right endpoints.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { LDAPSettings } from '../../components/LDAPSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+
+let captured: Captured[];
+let ldapStatus: { ldap_enabled: boolean; ldap_configured: boolean };
+
+const STORED = {
+  ldap_enabled: false,
+  ldap_server_url: 'ldaps://ldap.example:636',
+  ldap_bind_dn: 'cn=svc,dc=example',
+  ldap_bind_password: '',
+  ldap_search_base: 'dc=example',
+  ldap_user_filter: '(uid={username})',
+  ldap_security: 'ldaps',
+  ldap_group_mapping: '',
+  ldap_auto_provision: false,
+  ldap_default_group: '',
+};
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  ldapStatus = { ldap_enabled: false, ldap_configured: true };
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+    http.get('*/api/v1/settings/', () => HttpResponse.json(STORED)),
+    http.get('*/api/v1/auth/ldap/status', () => HttpResponse.json(ldapStatus)),
+    http.get('*/api/v1/groups/', () =>
+      HttpResponse.json([
+        { id: 1, name: 'Administrators' },
+        { id: 2, name: 'Operators' },
+      ]),
+    ),
+    http.put('*/api/v1/settings/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(STORED);
+    }),
+    http.post('*/api/v1/auth/ldap/test', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ success: true, message: 'Connected' });
+    }),
+  );
+});
+
+describe('LDAPSettings wiring', () => {
+  it('save sends all ldap_* fields with group mapping/default group and no bind password when untouched', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    const base = await screen.findByDisplayValue('dc=example');
+    await user.clear(base);
+    await user.type(base, 'ou=people,dc=example');
+
+    await user.click(screen.getByRole('button', { name: /advanced/i }));
+    await user.click(screen.getByPlaceholderText(/PrintFarm_Admins/));
+    await user.paste('{"cn=farm,dc=example":"Operators"}');
+    await user.selectOptions(screen.getByRole('combobox'), 'Operators');
+
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].method).toBe('PUT');
+    expect(captured[0].path).toBe('/api/v1/settings/');
+    expect(captured[0].body).toEqual({
+      ldap_server_url: 'ldaps://ldap.example:636',
+      ldap_bind_dn: 'cn=svc,dc=example',
+      ldap_search_base: 'ou=people,dc=example',
+      ldap_user_filter: '(uid={username})',
+      ldap_security: 'ldaps',
+      ldap_group_mapping: '{"cn=farm,dc=example":"Operators"}',
+      ldap_auto_provision: false,
+      ldap_default_group: 'Operators',
+    });
+    expect(captured[0].body).not.toHaveProperty('ldap_bind_password');
+  });
+
+  it('a typed bind password is sent with the save', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({ ldap_bind_password: 'test-password-1' });
+  });
+
+  it('save without a server URL sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await user.clear(await screen.findByDisplayValue('ldaps://ldap.example:636'));
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    expect(await screen.findByText(/ldap server url is required/i)).toBeInTheDocument();
+    expect(captured).toHaveLength(0);
+  });
+
+  it('test connection posts to /auth/ldap/test (tests the saved config, no body)', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await user.click(screen.getByRole('button', { name: /test connection/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({ method: 'POST', path: '/api/v1/auth/ldap/test', body: null });
+  });
+
+  it('enable sends only {ldap_enabled:true}', async () => {
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(captured).toHaveLength(1);
+    });
+    expect(captured[0]).toEqual({ method: 'PUT', path: '/api/v1/settings/', body: { ldap_enabled: true } });
+  });
+
+  it('disable sends {ldap_enabled:false} when LDAP is on', async () => {
+    ldapStatus = { ldap_enabled: true, ldap_configured: true };
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByText(/ldap authentication is enabled/i);
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^disable$/i }));
+      expect(captured).toHaveLength(1);
+    });
+    expect(captured[0].body).toEqual({ ldap_enabled: false });
+  });
+
+  it('enable sends nothing until LDAP settings are saved', async () => {
+    ldapStatus = { ldap_enabled: false, ldap_configured: false };
+    const user = userEvent.setup();
+    render(<LDAPSettings />);
+
+    await screen.findByDisplayValue('dc=example');
+    await waitFor(async () => {
+      await user.click(screen.getByRole('button', { name: /^enable$/i }));
+      expect(screen.getAllByText(/save ldap settings first/i).length).toBeGreaterThan(0);
+    });
+    expect(captured).toHaveLength(0);
+  });
+});

frontend/src/__tests__/components/OIDCProviderSettingsWiring.test.tsx

@@ -0,0 +1,167 @@
+/**
+ * OIDC provider list: edit, delete, enable toggle and icon actions send
+ * their request for the provider that was clicked, the edit leaves the
+ * stored client secret alone unless one is typed, and cancelling the delete
+ * confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { OIDCProviderSettings } from '../../components/OIDCProviderSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+let captured: Captured[];
+
+function provider(id: number, name: string, extra: Record<string, unknown> = {}) {
+  return {
+    id,
+    name,
+    issuer_url: `https://${name.toLowerCase()}.idp.example`,
+    client_id: `${name.toLowerCase()}-client`,
+    scopes: 'openid email profile',
+    is_enabled: true,
+    auto_create_users: false,
+    auto_link_existing_accounts: false,
+    email_claim: 'email',
+    require_email_verified: true,
+    group_claim: 'groups',
+    group_mapping: {},
+    icon_url: `https://${name.toLowerCase()}.idp.example/icon.png`,
+    has_icon: true,
+    default_group_id: null,
+    is_autologin: false,
+    is_env_managed: false,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+    ...extra,
+  };
+}
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+beforeEach(() => {
+  captured = [];
+  server.use(
+    http.get('*/api/v1/auth/oidc/providers/all', () =>
+      HttpResponse.json([provider(7, 'Alpha'), provider(9, 'Beta')]),
+    ),
+    http.get('*/api/v1/groups/', () => HttpResponse.json([])),
+    http.put('*/api/v1/auth/oidc/providers/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(provider(9, 'Beta'));
+    }),
+    http.delete('*/api/v1/auth/oidc/providers/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'deleted' });
+    }),
+    http.delete('*/api/v1/auth/oidc/providers/:id/icon', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.post('*/api/v1/auth/oidc/providers/:id/icon/refresh', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(provider(9, 'Beta'));
+    }),
+  );
+});
+
+describe('OIDCProviderSettings wiring', () => {
+  it('editing a provider PUTs to its id without client_secret when the secret is left blank', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('edit-provider-9'));
+    const scopes = screen.getByDisplayValue('openid email profile');
+    await user.clear(scopes);
+    await user.type(scopes, 'openid email');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].method).toBe('PUT');
+    expect(captured[0].path).toBe('/api/v1/auth/oidc/providers/9');
+    expect(captured[0].body).toMatchObject({
+      name: 'Beta',
+      issuer_url: 'https://beta.idp.example',
+      client_id: 'beta-client',
+      scopes: 'openid email',
+    });
+    expect(captured[0].body).not.toHaveProperty('client_secret');
+  });
+
+  it('a typed client secret is sent with the edit', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('edit-provider-9'));
+    await user.type(document.querySelector('input[type="password"]') as HTMLInputElement, 'test-secret-1');
+    await user.click(screen.getByRole('button', { name: /^save$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0].body).toMatchObject({ client_secret: 'test-secret-1' });
+  });
+
+  it('delete asks first, then DELETEs the clicked provider', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    // Second row, so a delete of "the first provider" would not pass
+    await user.click(await screen.findByTestId('delete-provider-9'));
+    expect(captured).toHaveLength(0);
+    await user.click(screen.getByRole('button', { name: /^delete$/i }));
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/auth/oidc/providers/9' });
+  });
+
+  it('cancelling the delete confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('delete-provider-7'));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: /^delete$/i })).not.toBeInTheDocument());
+    expect(captured).toHaveLength(0);
+  });
+
+  it('refresh icon and remove icon call the clicked provider id', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await user.click(await screen.findByTestId('refresh-icon-9'));
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/oidc/providers/9/icon/refresh' });
+
+    await user.click(screen.getByTestId('remove-icon-7'));
+    await waitFor(() => expect(captured).toHaveLength(2));
+    expect(captured[1]).toMatchObject({ method: 'DELETE', path: '/api/v1/auth/oidc/providers/7/icon' });
+  });
+
+  it('the enable toggle sends only {is_enabled:false} for that provider', async () => {
+    const user = userEvent.setup();
+    render(<OIDCProviderSettings />);
+
+    await screen.findByTestId('edit-provider-9');
+    // One toggle per provider, in list order
+    const toggles = screen.getAllByRole('switch');
+    await user.click(toggles[1]);
+
+    await waitFor(() => expect(captured).toHaveLength(1));
+    expect(captured[0]).toEqual({
+      method: 'PUT',
+      path: '/api/v1/auth/oidc/providers/9',
+      body: { is_enabled: false },
+    });
+  });
+});

frontend/src/__tests__/components/PendingUploadsPanelWiring.test.tsx

@@ -0,0 +1,199 @@
+/**
+ * Wiring tests for PendingUploadsPanel: pin the requests sent for archive
+ * (with tags/notes/project), discard, archive-all and discard-all, and that
+ * cancelling a destructive confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { PendingUploadsPanel } from '../../components/PendingUploadsPanel';
+
+const uploads = [
+  {
+    id: 11,
+    filename: 'first.gcode.3mf',
+    display_name: 'First Upload',
+    file_size: 1000,
+    source_ip: null,
+    status: 'pending',
+    tags: null,
+    notes: null,
+    project_id: null,
+    uploaded_at: '2026-05-01T10:00:00Z',
+  },
+  {
+    id: 22,
+    filename: 'second.gcode.3mf',
+    display_name: 'Second Upload',
+    file_size: 2000,
+    source_ip: null,
+    status: 'pending',
+    tags: null,
+    notes: null,
+    project_id: null,
+    uploaded_at: '2026-05-01T10:00:00Z',
+  },
+];
+
+const projects = [
+  { id: 5, name: 'Gadgets', status: 'active', parent_id: null },
+  { id: 9, name: 'Archived Proj', status: 'archived', parent_id: null },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+beforeEach(() => {
+  calls = [];
+  server.use(
+    http.get('*/api/v1/pending-uploads/', () => HttpResponse.json(uploads)),
+    http.get('*/api/v1/projects/', () => HttpResponse.json(projects)),
+    http.post('*/api/v1/pending-uploads/archive-all', ({ request }) => {
+      calls.push({ method: 'POST', path: new URL(request.url).pathname });
+      return HttpResponse.json({ archived: 2, failed: 0 });
+    }),
+    http.delete('*/api/v1/pending-uploads/discard-all', ({ request }) => {
+      calls.push({ method: 'DELETE', path: new URL(request.url).pathname });
+      return HttpResponse.json({ discarded: 2 });
+    }),
+    http.post('*/api/v1/pending-uploads/:id/archive', async ({ request }) => {
+      calls.push({
+        method: 'POST',
+        path: new URL(request.url).pathname,
+        body: await request.json(),
+      });
+      return HttpResponse.json({ id: 100, print_name: 'First Upload', filename: 'first.gcode.3mf' });
+    }),
+    http.delete('*/api/v1/pending-uploads/:id', ({ request }) => {
+      calls.push({ method: 'DELETE', path: new URL(request.url).pathname });
+      return HttpResponse.json({ success: true });
+    }),
+  );
+});
+
+/** The row card for an upload, found via its display name. */
+async function rowFor(name: string): Promise<HTMLElement> {
+  const label = await screen.findByText(name);
+  // name <p> -> div -> div.flex gap-3 -> div.flex justify-between (row header)
+  const header = label.closest('div.justify-between') as HTMLElement;
+  expect(header).not.toBeNull();
+  return header;
+}
+
+describe('PendingUploadsPanel wiring', () => {
+  it('Archive with tags, notes and a project posts them for that upload id only', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    // Expand toggle is the first (icon-only) button in the row.
+    await user.click(within(row).getAllByRole('button')[0]);
+    const card = row.parentElement as HTMLElement;
+    await user.type(within(card).getByPlaceholderText('e.g., functional, prototype, gift'), 'gift');
+    await user.type(within(card).getByPlaceholderText('Add notes about this print...'), 'for bob');
+    const select = within(card).getByRole('combobox');
+    await waitFor(() => expect(within(select).getByRole('option', { name: 'Gadgets' })).toBeInTheDocument());
+    // Archived projects are not offered as a target.
+    expect(within(select).queryByRole('option', { name: 'Archived Proj' })).toBeNull();
+    await user.selectOptions(select, '5');
+
+    await user.click(within(row).getByRole('button', { name: /Archive/ }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/pending-uploads/22/archive',
+      body: { tags: 'gift', notes: 'for bob', project_id: 5 },
+    });
+  });
+
+  it('Archive without a project omits project_id', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('First Upload');
+
+    await user.click(within(row).getByRole('button', { name: /Archive/ }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0].path).toBe('/api/v1/pending-uploads/11/archive');
+    expect(calls[0].body).toEqual({ tags: '', notes: '' });
+  });
+
+  it('Discard -> confirm sends DELETE for that upload id', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    const buttons = within(row).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]); // trash icon
+    expect(await screen.findByText('Discard Upload')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Discard' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'DELETE', path: '/api/v1/pending-uploads/22' });
+  });
+
+  it('Discard -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    const row = await rowFor('Second Upload');
+
+    const buttons = within(row).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await screen.findByText('Discard Upload');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Discard Upload')).toBeNull());
+    expect(calls).toHaveLength(0);
+  });
+
+  it('Archive All -> confirm posts archive-all', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Archive All' }));
+    const title = await screen.findByText('Archive All Uploads');
+    const dialog = title.closest('div.flex-1')?.parentElement?.parentElement as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Archive All' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'POST', path: '/api/v1/pending-uploads/archive-all' });
+  });
+
+  it('Discard All -> confirm sends DELETE discard-all', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Discard All' }));
+    const title = await screen.findByText('Discard All Uploads');
+    const dialog = title.closest('div.flex-1')?.parentElement?.parentElement as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Discard All' }));
+
+    await waitFor(() => expect(calls).toHaveLength(1));
+    expect(calls[0]).toEqual({ method: 'DELETE', path: '/api/v1/pending-uploads/discard-all' });
+  });
+
+  it('Discard All -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<PendingUploadsPanel />);
+    await screen.findByText('First Upload');
+
+    await user.click(screen.getByRole('button', { name: 'Discard All' }));
+    await screen.findByText('Discard All Uploads');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Discard All Uploads')).toBeNull());
+    expect(calls).toHaveLength(0);
+  });
+});

frontend/src/__tests__/components/PurgeArchivesModalWiring.test.tsx

@@ -0,0 +1,153 @@
+/**
+ * Wiring tests for PurgeArchivesModal: pin the requests the destructive
+ * bulk archive purge actually sends (preview query params, execute body),
+ * and that nothing is sent while the confirm button is disabled or when
+ * the modal is cancelled.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { screen, waitFor, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { PurgeArchivesModal } from '../../components/PurgeArchivesModal';
+
+interface PreviewCall {
+  days: string | null;
+  purgeStats: string | null;
+}
+
+let previewCalls: PreviewCall[];
+let executeBodies: Array<Record<string, unknown>>;
+let previewCount: number;
+
+beforeEach(() => {
+  previewCalls = [];
+  executeBodies = [];
+  previewCount = 4;
+  server.use(
+    http.get('*/api/v1/archives/purge/preview', ({ request }) => {
+      const url = new URL(request.url);
+      previewCalls.push({
+        days: url.searchParams.get('older_than_days'),
+        purgeStats: url.searchParams.get('purge_stats'),
+      });
+      return HttpResponse.json({
+        count: previewCount,
+        total_bytes: 1024,
+        sample_filenames: ['old-a.3mf'],
+        older_than_days: Number(url.searchParams.get('older_than_days')),
+      });
+    }),
+    http.post('*/api/v1/archives/purge', async ({ request }) => {
+      executeBodies.push((await request.json()) as Record<string, unknown>);
+      return HttpResponse.json({ deleted: previewCount, purge_stats: false });
+    }),
+  );
+});
+
+describe('PurgeArchivesModal wiring', () => {
+  it('previews with the initial days and executes with the same days value', async () => {
+    const user = userEvent.setup();
+    const onClose = vi.fn();
+    render(<PurgeArchivesModal onClose={onClose} initialDays={90} />);
+
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    expect(previewCalls).toEqual([{ days: '90', purgeStats: 'false' }]);
+
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 90, purge_stats: false });
+    await waitFor(() => expect(onClose).toHaveBeenCalled());
+  });
+
+  it('re-previews after the days input changes and executes with the new value', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={90} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    const input = screen.getByLabelText('Delete archives not printed in the last');
+    fireEvent.change(input, { target: { value: '30' } });
+
+    await waitFor(() =>
+      expect(previewCalls).toContainEqual({ days: '30', purgeStats: 'false' }),
+    );
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    await waitFor(() => expect(confirm).toBeEnabled());
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 30, purge_stats: false });
+  });
+
+  it('sends purge_stats=true on preview and execute when "Also remove from statistics" is ticked', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={120} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    await user.click(screen.getByRole('checkbox'));
+    await waitFor(() =>
+      expect(previewCalls).toContainEqual({ days: '120', purgeStats: 'true' }),
+    );
+
+    await user.click(await screen.findByRole('button', { name: 'Remove 4 archive(s)' }));
+    await waitFor(() => expect(executeBodies).toHaveLength(1));
+    expect(executeBodies[0]).toEqual({ older_than_days: 120, purge_stats: true });
+  });
+
+  it('keeps execute disabled and sends nothing when the preview matches zero archives', async () => {
+    previewCount = 0;
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={90} />);
+
+    const confirm = await screen.findByRole('button', { name: 'Remove 0 archive(s)' });
+    expect(confirm).toBeDisabled();
+    await user.click(confirm);
+    expect(executeBodies).toHaveLength(0);
+  });
+
+  it('Cancel closes the modal without executing the purge', async () => {
+    const user = userEvent.setup();
+    const onClose = vi.fn();
+    render(<PurgeArchivesModal onClose={onClose} initialDays={90} />);
+    await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenCalled();
+    expect(executeBodies).toHaveLength(0);
+  });
+
+  it('disables the purge until the preview matches the typed age', async () => {
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={365} />);
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+    expect(confirm).toBeEnabled();
+
+    fireEvent.change(screen.getByLabelText('Delete archives not printed in the last'), {
+      target: { value: '1' },
+    });
+
+    expect(confirm).toBeDisabled();
+    await waitFor(() => expect(previewCalls.map((c) => c.days)).toContain('1'));
+  });
+
+  // The preview is debounced (300 ms); a click inside that window must not
+  // purge by an age the shown count wasn't made for.
+  it('never executes with a days value that has not been previewed', async () => {
+    const user = userEvent.setup();
+    render(<PurgeArchivesModal onClose={vi.fn()} initialDays={365} />);
+    const confirm = await screen.findByRole('button', { name: 'Remove 4 archive(s)' });
+
+    fireEvent.change(screen.getByLabelText('Delete archives not printed in the last'), {
+      target: { value: '1' },
+    });
+    // Immediately, inside the debounce window.
+    await user.click(confirm);
+
+    await waitFor(() => expect(executeBodies.length + previewCalls.length).toBeGreaterThan(1));
+    for (const body of executeBodies) {
+      expect(previewCalls.map((c) => c.days)).toContain(String(body.older_than_days));
+    }
+  });
+});

frontend/src/__tests__/components/SkipObjectsModalWiring.test.tsx

@@ -0,0 +1,173 @@
+/**
+ * SkipObjectsModal wiring: the request it sends when objects are skipped.
+ *
+ * The printer identifies objects by their slicer object id, not by their
+ * position in the list, so picking the 1st and 3rd object must send their ids.
+ * Already-skipped objects can't be picked again, and the submit button is gated
+ * on printers:control and on the print being past layer 1.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: ['printers:control'] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { SkipObjectsModal } from '../../components/SkipObjectsModal';
+
+const PRINTER_ID = 7;
+
+// Ids deliberately unlike list positions.
+const objects = [
+  { id: 412, name: 'Bracket A', x: 10, y: 10, skipped: false },
+  { id: 518, name: 'Bracket B', x: 20, y: 20, skipped: true },
+  { id: 903, name: 'Bracket C', x: 30, y: 30, skipped: false },
+  { id: 1207, name: 'Bracket D', x: 40, y: 40, skipped: false },
+];
+
+let skipCalls: { printerId: string; body: unknown }[] = [];
+
+function setup({ layer = 12 }: { layer?: number } = {}) {
+  skipCalls = [];
+  server.use(
+    http.get(`/api/v1/printers/${PRINTER_ID}/status`, () =>
+      HttpResponse.json({ connected: true, state: 'RUNNING', layer_num: layer, cover_url: null }),
+    ),
+    http.get(`/api/v1/printers/${PRINTER_ID}/print/objects`, () =>
+      HttpResponse.json({
+        objects,
+        total: objects.length,
+        skipped_count: 1,
+        is_printing: true,
+        bbox_all: null,
+      }),
+    ),
+    http.post('/api/v1/printers/:id/print/skip-objects', async ({ request, params }) => {
+      skipCalls.push({ printerId: params.id as string, body: await request.json() });
+      return HttpResponse.json({ success: true, message: 'Skipped', skipped_objects: [] });
+    }),
+  );
+  const onClose = vi.fn();
+  render(<SkipObjectsModal printerId={PRINTER_ID} isOpen onClose={onClose} />);
+  return { onClose };
+}
+
+const row = (name: string) => screen.getByText(name).closest('button') as HTMLButtonElement;
+const submit = () => screen.getByRole('button', { name: 'Skip Selected' });
+
+describe('SkipObjectsModal wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control'];
+  });
+
+  it('skips the picked objects by their object ids', async () => {
+    const user = userEvent.setup();
+    const { onClose } = setup();
+    await screen.findByText('Bracket A');
+    await waitFor(() => expect(submit()).toBeDisabled());
+
+    await user.click(row('Bracket A'));
+    await user.click(row('Bracket C'));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+
+    // Confirm dialog: the confirm button carries the same label.
+    expect(await screen.findByText('Skip 2 selected objects? This cannot be undone.')).toBeInTheDocument();
+    const confirmButtons = screen.getAllByRole('button', { name: 'Skip Selected' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+
+    await waitFor(() => expect(skipCalls).toHaveLength(1));
+    expect(skipCalls[0].printerId).toBe(String(PRINTER_ID));
+    expect([...(skipCalls[0].body as number[])].sort((a, b) => a - b)).toEqual([412, 903]);
+    await waitFor(() => expect(onClose).toHaveBeenCalled());
+  });
+
+  it('sends nothing when the confirm is cancelled', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(row('Bracket D'));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+    expect(await screen.findByText('Are you sure you want to skip "Bracket D"? This cannot be undone.')).toBeInTheDocument();
+
+    const cancels = screen.getAllByRole('button', { name: 'Cancel' });
+    await user.click(cancels[cancels.length - 1]);
+
+    await waitFor(() => expect(screen.queryByText(/Are you sure you want to skip/)).toBeNull());
+    expect(skipCalls).toEqual([]);
+  });
+
+  it('does not let an already-skipped object be picked', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket B');
+    expect(row('Bracket B')).toBeDisabled();
+    await user.click(row('Bracket B'));
+    expect(screen.getByText('No objects selected')).toBeInTheDocument();
+    expect(submit()).toBeDisabled();
+  });
+
+  it('select all picks only the objects still printing', async () => {
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(screen.getByRole('button', { name: /Select All/ }));
+    await waitFor(() => expect(submit()).toBeEnabled());
+    await user.click(submit());
+    // All remaining objects selected -> the stronger warning.
+    expect(await screen.findByText(/All remaining objects are selected/)).toBeInTheDocument();
+    const confirmButtons = screen.getAllByRole('button', { name: 'Skip Selected' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+
+    await waitFor(() => expect(skipCalls).toHaveLength(1));
+    expect([...(skipCalls[0].body as number[])].sort((a, b) => a - b)).toEqual([412, 903, 1207]);
+  });
+
+  it('keeps submit disabled without printers:control', async () => {
+    permissions.granted = [];
+    const user = userEvent.setup();
+    setup();
+    await screen.findByText('Bracket A');
+    await user.click(row('Bracket A'));
+    expect(screen.getByText('1/3', { selector: 'footer span' })).toBeInTheDocument();
+    expect(submit()).toBeDisabled();
+    await user.click(submit());
+    expect(screen.queryByText(/Are you sure you want to skip/)).toBeNull();
+    expect(skipCalls).toEqual([]);
+  });
+
+  it('keeps submit disabled until the print is past layer 1', async () => {
+    const user = userEvent.setup();
+    setup({ layer: 1 });
+    expect(await screen.findByText('Wait for layer 2+ to skip objects (currently layer 1)')).toBeInTheDocument();
+    await user.click(row('Bracket A'));
+    expect(submit()).toBeDisabled();
+    await user.click(submit());
+    expect(skipCalls).toEqual([]);
+  });
+});

frontend/src/__tests__/components/SmartPlugCardWiring.test.tsx

@@ -0,0 +1,168 @@
+/**
+ * SmartPlugCard wiring: each control sends the request for THIS plug, and
+ * the destructive ones (power off, delete) send nothing when cancelled.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { SmartPlugCard } from '../../components/SmartPlugCard';
+import type { SmartPlug } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+function makePlug(overrides: Partial<SmartPlug> = {}): SmartPlug {
+  return {
+    id: 42,
+    name: 'Wiring Plug',
+    plug_type: 'tasmota',
+    ip_address: '192.0.2.10',
+    ha_entity_id: null,
+    printer_id: null,
+    controls_printer_power: true,
+    enabled: true,
+    auto_on: false,
+    auto_off: false,
+    auto_off_persistent: false,
+    off_delay_mode: 'time',
+    off_delay_minutes: 5,
+    off_temp_threshold: 70,
+    username: null,
+    password: null,
+    power_alert_enabled: false,
+    schedule_enabled: false,
+    schedule_on_time: null,
+    schedule_off_time: null,
+    last_state: 'ON',
+    show_in_switchbar: false,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+    ...overrides,
+  } as unknown as SmartPlug;
+}
+
+let sent: Sent[];
+
+beforeEach(() => {
+  sent = [];
+  const record = async (request: Request) => {
+    const url = new URL(request.url);
+    let body: unknown = null;
+    try {
+      body = await request.json();
+    } catch {
+      body = null;
+    }
+    sent.push({ method: request.method, path: url.pathname, body });
+  };
+  server.use(
+    http.get('*/api/v1/smart-plugs/:id/status', () =>
+      HttpResponse.json({ state: 'ON', reachable: true, device_name: null, energy: null }),
+    ),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([])),
+    http.post('*/api/v1/smart-plugs/:id/control', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, action: 'off' });
+    }),
+    http.patch('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(makePlug());
+    }),
+    http.delete('*/api/v1/smart-plugs/:id', async ({ request }) => {
+      await record(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+  );
+});
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+async function renderReady() {
+  const user = userEvent.setup();
+  render(<SmartPlugCard plug={makePlug()} onEdit={() => undefined} />);
+  // The power buttons are enabled only once the status says the plug is reachable.
+  const off = await screen.findByRole('button', { name: 'Off' });
+  await waitFor(() => expect(off).not.toBeDisabled());
+  return { user, off };
+}
+
+function toggleFor(label: string): HTMLInputElement {
+  const row = screen.getByText(label).parentElement!.parentElement!;
+  return row.querySelector('input[type="checkbox"]') as HTMLInputElement;
+}
+
+describe('SmartPlugCard wiring', () => {
+  it('Power Off: confirming sends control "off" for this plug', async () => {
+    const { user, off } = await renderReady();
+    await user.click(off);
+
+    const dialog = await screen.findByText('Turn Off Smart Plug');
+    expect(dialog).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Turn Off' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'POST', path: '/api/v1/smart-plugs/42/control', body: { action: 'off' } });
+  });
+
+  it('Power Off: cancelling sends nothing', async () => {
+    const { user, off } = await renderReady();
+    await user.click(off);
+    await screen.findByText('Turn Off Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Turn Off Smart Plug')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('Power On: confirming sends control "on"', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByRole('button', { name: 'On' }));
+    await user.click(await screen.findByRole('button', { name: 'Turn On' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'POST', path: '/api/v1/smart-plugs/42/control', body: { action: 'on' } });
+  });
+
+  it('Delete: confirming sends DELETE for this plug', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    await user.click(edit.nextElementSibling as HTMLElement);
+
+    await screen.findByText('Delete Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/smart-plugs/42' });
+  });
+
+  it('Delete: cancelling sends nothing', async () => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    await user.click(edit.nextElementSibling as HTMLElement);
+    await screen.findByText('Delete Smart Plug');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete Smart Plug')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it.each([
+    ['Auto On', { auto_on: true }],
+    ['Auto Off', { auto_off: true }],
+    ['Enabled', { enabled: false }],
+  ])('toggle "%s" PATCHes only that field', async (label, expected) => {
+    const { user } = await renderReady();
+    await user.click(screen.getByText('Automation Settings'));
+    await screen.findByText(label);
+    await user.click(toggleFor(label));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/smart-plugs/42' });
+    expect(writes()[0].body).toEqual(expected);
+  });
+});

frontend/src/__tests__/components/SpoolmanSettingsWiring.test.tsx

@@ -0,0 +1,188 @@
+/**
+ * Wiring tests for SpoolmanSettings: the auto-saved settings payload,
+ * Connect, the per-printer / all-printers AMS sync, and the two weight-sync
+ * actions (built-in and Spoolman) that overwrite stored weights and so must
+ * only fire after confirmation.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { SpoolmanSettings } from '../../components/SpoolmanSettings';
+import { api } from '../../api/client';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  return {
+    ...actual,
+    api: {
+      getSettings: vi.fn().mockResolvedValue({}),
+      updateSettings: vi.fn().mockResolvedValue({}),
+      getSpoolmanSettings: vi.fn(),
+      updateSpoolmanSettings: vi.fn(),
+      getSpoolmanStatus: vi.fn(),
+      connectSpoolman: vi.fn(),
+      syncAllPrintersAms: vi.fn(),
+      syncPrinterAms: vi.fn(),
+      syncWeightsFromAms: vi.fn(),
+      syncSpoolmanAmsWeights: vi.fn(),
+      migrateSpoolmanTags: vi.fn(),
+      getPrinters: vi.fn(),
+      getAuthStatus: vi.fn().mockResolvedValue({ auth_enabled: false }),
+    },
+  };
+});
+
+const mocked = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const syncResult = { success: true, synced_count: 1, skipped_count: 0, skipped: [], errors: [] };
+
+function settings(enabled: boolean, url = '') {
+  return {
+    spoolman_enabled: enabled ? 'true' : 'false',
+    spoolman_url: url,
+    spoolman_sync_mode: 'auto',
+    spoolman_disable_weight_sync: 'false',
+    spoolman_report_partial_usage: 'true',
+    auto_add_unknown_rfid: 'true',
+  };
+}
+
+describe('SpoolmanSettings wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocked.getSettings.mockResolvedValue({});
+    mocked.getAuthStatus.mockResolvedValue({ auth_enabled: false });
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(false));
+    mocked.updateSpoolmanSettings.mockResolvedValue(settings(false));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: false, connected: false, url: null });
+    mocked.getPrinters.mockResolvedValue([
+      { id: 4, name: 'X1C Left' },
+      { id: 8, name: 'H2D Right' },
+    ]);
+    mocked.connectSpoolman.mockResolvedValue({ success: true, message: 'ok' });
+    mocked.syncAllPrintersAms.mockResolvedValue(syncResult);
+    mocked.syncPrinterAms.mockResolvedValue(syncResult);
+    mocked.syncWeightsFromAms.mockResolvedValue({ synced: 2, skipped: 0, printing: 0 });
+    mocked.syncSpoolmanAmsWeights.mockResolvedValue({ synced: 2, skipped: 0, printing: 0 });
+  });
+
+  it('switching to Spoolman and entering a URL auto-saves the full settings payload', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Spoolman/ }));
+    await user.type(screen.getByPlaceholderText('http://192.168.1.100:7912'), 'http://sm:7912');
+    await user.selectOptions(screen.getByDisplayValue(/auto/i), 'manual');
+
+    await waitFor(
+      () => {
+        const calls = mocked.updateSpoolmanSettings.mock.calls;
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls[calls.length - 1][0]).toEqual({
+          spoolman_enabled: 'true',
+          spoolman_url: 'http://sm:7912',
+          spoolman_sync_mode: 'manual',
+          spoolman_disable_weight_sync: 'false',
+          spoolman_report_partial_usage: 'true',
+          auto_add_unknown_rfid: 'true',
+        });
+      },
+      { timeout: 3000 },
+    );
+  });
+
+  it('switching back to Built-in auto-saves spoolman_enabled=false', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Built-in Inventory/ }));
+
+    await waitFor(
+      () =>
+        expect(mocked.updateSpoolmanSettings).toHaveBeenCalledWith(
+          expect.objectContaining({ spoolman_enabled: 'false', spoolman_url: 'http://sm:7912' }),
+        ),
+      { timeout: 3000 },
+    );
+  });
+
+  it('Connect calls connectSpoolman', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /Connect/ }));
+    await waitFor(() => expect(mocked.connectSpoolman).toHaveBeenCalledTimes(1));
+    expect(mocked.updateSpoolmanSettings).not.toHaveBeenCalled();
+  });
+
+  it('Sync with "All Printers" selected calls syncAllPrintersAms, not the per-printer sync', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /^Sync$/ }));
+    await waitFor(() => expect(mocked.syncAllPrintersAms).toHaveBeenCalledTimes(1));
+    expect(mocked.syncPrinterAms).not.toHaveBeenCalled();
+  });
+
+  it('Sync with one printer selected calls syncPrinterAms(thatPrinterId)', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await screen.findByRole('option', { name: 'H2D Right' });
+    await user.selectOptions(screen.getByDisplayValue('All Printers'), '8');
+    await user.click(screen.getByRole('button', { name: /^Sync$/ }));
+
+    await waitFor(() => expect(mocked.syncPrinterAms).toHaveBeenCalledWith(8));
+    expect(mocked.syncAllPrintersAms).not.toHaveBeenCalled();
+  });
+
+  it('built-in "Sync Weights from AMS" only calls syncWeightsFromAms after confirm', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: 'Sync Weights from AMS' }));
+    expect(await screen.findByText('Sync Spool Weights from AMS')).toBeInTheDocument();
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+
+    const confirmButtons = screen.getAllByRole('button', { name: 'Sync Weights from AMS' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+    await waitFor(() => expect(mocked.syncWeightsFromAms).toHaveBeenCalledTimes(1));
+    expect(mocked.syncSpoolmanAmsWeights).not.toHaveBeenCalled();
+  });
+
+  it('built-in weight sync: cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+    await user.click(await screen.findByRole('button', { name: 'Sync Weights from AMS' }));
+    await screen.findByText('Sync Spool Weights from AMS');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Sync Spool Weights from AMS')).not.toBeInTheDocument());
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman weight sync only calls syncSpoolmanAmsWeights after confirm; cancel sends nothing', async () => {
+    mocked.getSpoolmanSettings.mockResolvedValue(settings(true, 'http://sm:7912'));
+    mocked.getSpoolmanStatus.mockResolvedValue({ enabled: true, connected: true, url: 'http://sm:7912' });
+    const user = userEvent.setup();
+    render(<SpoolmanSettings />);
+
+    await user.click(await screen.findByRole('button', { name: 'Sync Spoolman Weights from AMS' }));
+    await screen.findByText('Sync Spoolman Spool Weights from AMS');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(mocked.syncSpoolmanAmsWeights).not.toHaveBeenCalled();
+
+    await user.click(screen.getByRole('button', { name: 'Sync Spoolman Weights from AMS' }));
+    await screen.findByText('Sync Spoolman Spool Weights from AMS');
+    const confirmButtons = screen.getAllByRole('button', { name: 'Sync Spoolman Weights from AMS' });
+    await user.click(confirmButtons[confirmButtons.length - 1]);
+    await waitFor(() => expect(mocked.syncSpoolmanAmsWeights).toHaveBeenCalledTimes(1));
+    expect(mocked.syncWeightsFromAms).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/components/SwitchbarPopoverWiring.test.tsx

@@ -0,0 +1,113 @@
+/**
+ * Sidebar switchbar: every on/off goes through a confirm modal, and the
+ * control request carries the id of the plug that was clicked.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { api } from '../../api/client';
+import type { SmartPlug, SmartPlugStatus } from '../../api/client';
+import { SwitchbarPopover } from '../../components/SwitchbarPopover';
+
+function plug(id: number, name: string, extra: Partial<SmartPlug> = {}): SmartPlug {
+  return { id, name, plug_type: 'tasmota', show_in_switchbar: true, ...extra } as unknown as SmartPlug;
+}
+
+function rowFor(name: string): HTMLElement {
+  // The row container holding the plug name and its two buttons
+  return screen.getByText(name).closest('div.flex.items-center.justify-between') as HTMLElement;
+}
+
+function confirmButton(name: 'Turn On' | 'Turn Off'): HTMLElement {
+  const btn = screen.getAllByRole('button', { name }).find((b) => !b.hasAttribute('title'));
+  if (!btn) throw new Error(`confirm button ${name} not found`);
+  return btn;
+}
+
+describe('SwitchbarPopover wiring', () => {
+  let control: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.spyOn(api, 'getSmartPlugs').mockResolvedValue([
+      plug(11, 'Plug Alpha'),
+      plug(22, 'Plug Beta'),
+      plug(33, 'Hidden Plug', { show_in_switchbar: false }),
+      plug(44, 'Meter Plug', { plug_type: 'mqtt' }),
+    ]);
+    vi.spyOn(api, 'getSmartPlugStatus').mockImplementation(async (id: number) =>
+      ({
+        state: id === 44 ? null : 'ON',
+        reachable: true,
+        device_name: null,
+        energy: { power: id === 44 ? 120 : null },
+      }) as unknown as SmartPlugStatus,
+    );
+    control = vi.spyOn(api, 'controlSmartPlug').mockResolvedValue({ success: true } as never);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('turning off the clicked plug asks first, then sends controlSmartPlug(id, "off")', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Beta');
+    const row = rowFor('Plug Beta');
+    const offBtn = within(row).getByTitle('Turn Off');
+    await waitFor(() => expect(offBtn).not.toBeDisabled());
+
+    await user.click(offBtn);
+    // Confirm modal is shown, nothing sent yet
+    expect(await screen.findByText(/are you sure you want to turn off "Plug Beta"/i)).toBeInTheDocument();
+    expect(control).not.toHaveBeenCalled();
+
+    await user.click(confirmButton('Turn Off'));
+    await waitFor(() => expect(control).toHaveBeenCalledTimes(1));
+    expect(control).toHaveBeenCalledWith(22, 'off');
+  });
+
+  it('turning on sends controlSmartPlug(id, "on") for that plug only', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    const onBtn = within(rowFor('Plug Alpha')).getByTitle('Turn On');
+    await waitFor(() => expect(onBtn).not.toBeDisabled());
+    await user.click(onBtn);
+    await user.click(confirmButton('Turn On'));
+
+    await waitFor(() => expect(control).toHaveBeenCalledWith(11, 'on'));
+    expect(control).toHaveBeenCalledTimes(1);
+  });
+
+  it('cancelling the confirm modal sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    const offBtn = within(rowFor('Plug Alpha')).getByTitle('Turn Off');
+    await waitFor(() => expect(offBtn).not.toBeDisabled());
+    await user.click(offBtn);
+    await screen.findByText(/are you sure you want to turn off "Plug Alpha"/i);
+    await user.click(screen.getByRole('button', { name: /cancel/i }));
+
+    await waitFor(() =>
+      expect(screen.queryByText(/are you sure you want to turn off/i)).not.toBeInTheDocument(),
+    );
+    expect(control).not.toHaveBeenCalled();
+  });
+
+  it('lists only switchbar plugs and gives MQTT (monitor-only) plugs no switch buttons', async () => {
+    render(<SwitchbarPopover onClose={() => {}} />);
+
+    await screen.findByText('Plug Alpha');
+    expect(screen.queryByText('Hidden Plug')).not.toBeInTheDocument();
+    const meterRow = rowFor('Meter Plug');
+    expect(within(meterRow).queryByTitle('Turn On')).not.toBeInTheDocument();
+    expect(within(meterRow).queryByTitle('Turn Off')).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/components/TwoFactorSettingsWiring.test.tsx

@@ -0,0 +1,219 @@
+/**
+ * Account 2FA settings: each action sends the code/password the user typed
+ * to the right endpoint, a rejected code does not advance the wizard, new
+ * backup codes are shown once, and unlinking SSO targets the clicked
+ * provider.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+
+const mockUseAuth = {
+  authEnabled: true,
+  loading: false,
+  user: { id: 3, username: 'tester', email: 'tester@example.com', is_admin: false, permissions: [] },
+  hasPermission: () => true,
+};
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { TwoFactorSettings } from '../../components/TwoFactorSettings';
+
+type Captured = { method: string; path: string; body: Record<string, unknown> | null };
+let captured: Captured[];
+let twoFaStatus: { totp_enabled: boolean; email_otp_enabled: boolean; backup_codes_remaining: number };
+let totpEnableOk: boolean;
+
+async function capture(request: Request) {
+  const text = await request.text();
+  captured.push({
+    method: request.method,
+    path: new URL(request.url).pathname,
+    body: text ? JSON.parse(text) : null,
+  });
+}
+
+const sent = (suffix: string) => captured.filter((c) => c.path.endsWith(suffix));
+
+beforeEach(() => {
+  captured = [];
+  totpEnableOk = true;
+  twoFaStatus = { totp_enabled: false, email_otp_enabled: false, backup_codes_remaining: 0 };
+  server.use(
+    http.get('*/api/v1/auth/2fa/status', () => HttpResponse.json(twoFaStatus)),
+    http.get('*/api/v1/auth/oidc/links', () =>
+      HttpResponse.json([
+        { id: 100, provider_id: 5, provider_name: 'Alpha IdP', provider_email: 'a@idp.example', created_at: '2026-01-01T00:00:00Z' },
+        { id: 101, provider_id: 8, provider_name: 'Beta IdP', provider_email: 'b@idp.example', created_at: '2026-01-01T00:00:00Z' },
+      ]),
+    ),
+    http.post('*/api/v1/auth/2fa/totp/setup', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ secret: 'TESTSECRETBASE32', qr_code_b64: 'AAAA', provisioning_uri: 'otpauth://totp/x' });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/enable', async ({ request }) => {
+      await capture(request);
+      return totpEnableOk
+        ? HttpResponse.json({ message: 'ok', backup_codes: ['AAAA1111', 'BBBB2222'] })
+        : HttpResponse.json({ detail: 'Invalid code' }, { status: 400 });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/2fa/totp/regenerate-backup-codes', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ backup_codes: ['NEWC0DE1', 'NEWC0DE2'] });
+    }),
+    http.post('*/api/v1/auth/2fa/email/enable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'code sent', setup_token: 'setup-token-1' });
+    }),
+    http.post('*/api/v1/auth/2fa/email/enable/confirm', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/auth/2fa/email/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.delete('*/api/v1/auth/oidc/links/:providerId', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+  );
+});
+
+describe('TwoFactorSettings wiring', () => {
+  it('TOTP setup: setup -> secret/QR -> code -> enableTOTP(code) -> backup codes', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await waitFor(() => expect(sent('/totp/setup')).toHaveLength(1));
+    expect(await screen.findByAltText('TOTP QR Code')).toHaveAttribute('src', 'data:image/png;base64,AAAA');
+
+    await user.click(screen.getByRole('button', { name: /scanned the code/i }));
+    const activate = screen.getByRole('button', { name: /^activate$/i });
+    await user.type(screen.getByPlaceholderText('000000'), '123456');
+    await user.click(activate);
+
+    await waitFor(() => expect(sent('/totp/enable')).toHaveLength(1));
+    expect(sent('/totp/enable')[0].body).toEqual({ code: '123456' });
+    expect(await screen.findByText('AAAA1111')).toBeInTheDocument();
+  });
+
+  it('a wrong TOTP code shows an error and stays on the confirm step', async () => {
+    totpEnableOk = false;
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await user.click(await screen.findByRole('button', { name: /scanned the code/i }));
+    await user.type(screen.getByPlaceholderText('000000'), '000000');
+    await user.click(screen.getByRole('button', { name: /^activate$/i }));
+
+    expect(await screen.findByText(/invalid code/i)).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /^activate$/i })).toBeInTheDocument();
+    expect(screen.queryByText(/save your backup codes/i)).not.toBeInTheDocument();
+  });
+
+  it('activate stays disabled until 6 digits are entered', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /set up authenticator app/i }));
+    await user.click(await screen.findByRole('button', { name: /scanned the code/i }));
+    await user.type(screen.getByPlaceholderText('000000'), '12345');
+    expect(screen.getByRole('button', { name: /^activate$/i })).toBeDisabled();
+    expect(sent('/totp/enable')).toHaveLength(0);
+  });
+
+  it('disable TOTP sends the typed code to /totp/disable; cancel sends nothing', async () => {
+    twoFaStatus = { totp_enabled: true, email_otp_enabled: false, backup_codes_remaining: 5 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    // Cancel first
+    await user.click(await screen.findByRole('button', { name: /disable authenticator/i }));
+    await user.type(screen.getByPlaceholderText('000000 or XXXXXXXX'), '654321');
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(sent('/totp/disable')).toHaveLength(0);
+
+    await user.click(screen.getByRole('button', { name: /disable authenticator/i }));
+    const input = screen.getByPlaceholderText('000000 or XXXXXXXX');
+    expect(input).toHaveValue('');
+    await user.type(input, 'abcd2345');
+    await user.click(screen.getByRole('button', { name: /disable authenticator/i }));
+
+    await waitFor(() => expect(sent('/totp/disable')).toHaveLength(1));
+    // CodeInput upper-cases backup codes
+    expect(sent('/totp/disable')[0].body).toEqual({ code: 'ABCD2345' });
+  });
+
+  it('regenerate backup codes sends the code and shows the new codes once', async () => {
+    twoFaStatus = { totp_enabled: true, email_otp_enabled: false, backup_codes_remaining: 2 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /regenerate backup codes/i }));
+    await user.type(screen.getByPlaceholderText('000000 or XXXXXXXX'), '112233');
+    await user.click(screen.getByRole('button', { name: /regenerate backup codes/i }));
+
+    await waitFor(() => expect(sent('/regenerate-backup-codes')).toHaveLength(1));
+    expect(sent('/regenerate-backup-codes')[0].body).toEqual({ code: '112233' });
+    expect(await screen.findByText('NEWC0DE1')).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: /saved my codes/i }));
+    await waitFor(() => expect(screen.queryByText('NEWC0DE1')).not.toBeInTheDocument());
+  });
+
+  it('email OTP enable: request -> confirm sends {setup_token, code}', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /enable email otp/i }));
+    await waitFor(() => expect(sent('/email/enable')).toHaveLength(1));
+
+    await user.type(await screen.findByPlaceholderText('000000'), '778899');
+    await user.click(screen.getByRole('button', { name: /verify & enable/i }));
+
+    await waitFor(() => expect(sent('/email/enable/confirm')).toHaveLength(1));
+    expect(sent('/email/enable/confirm')[0].body).toEqual({ setup_token: 'setup-token-1', code: '778899' });
+  });
+
+  it('email OTP disable requires the password and sends it to /email/disable', async () => {
+    twoFaStatus = { totp_enabled: false, email_otp_enabled: true, backup_codes_remaining: 0 };
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    await user.click(await screen.findByRole('button', { name: /disable email otp/i }));
+    const confirm = screen.getByRole('button', { name: /disable email otp/i });
+    expect(confirm).toBeDisabled();
+
+    await user.type(screen.getByPlaceholderText(/enter your password/i), 'test-password-1');
+    await user.click(confirm);
+
+    await waitFor(() => expect(sent('/email/disable')).toHaveLength(1));
+    expect(sent('/email/disable')[0].body).toEqual({ password: 'test-password-1' });
+  });
+
+  it('unlinking an SSO account deletes the clicked provider link', async () => {
+    const user = userEvent.setup();
+    render(<TwoFactorSettings />);
+
+    const row = (await screen.findByText('Beta IdP')).closest('div.flex.items-center.justify-between') as HTMLElement;
+    await user.click(within(row).getByRole('button'));
+
+    await waitFor(() => expect(sent('/oidc/links/8')).toHaveLength(1));
+    expect(captured.filter((c) => c.method === 'DELETE')).toEqual([
+      { method: 'DELETE', path: '/api/v1/auth/oidc/links/8', body: null },
+    ]);
+  });
+});

frontend/src/__tests__/pages/ArchivesPageWiring.test.tsx

@@ -0,0 +1,515 @@
+/**
+ * Wiring tests for ArchivesPage: pin the exact mutation requests behind
+ * archive delete (card, list row, bulk), file removals (timelapse, source
+ * 3MF, F3D), project assignment, bulk favourite and the print-log
+ * edit / delete / clear actions -- and that cancelling each destructive
+ * confirm sends nothing.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { ArchivesPage } from '../../pages/ArchivesPage';
+import { setAuthToken } from '../../api/client';
+
+const archive = (over: Record<string, unknown>) => ({
+  id: 1,
+  filename: 'a.gcode.3mf',
+  print_name: 'Archive',
+  printer_id: 1,
+  printer_name: 'X1 Carbon',
+  print_time_seconds: 3600,
+  filament_used_grams: 10,
+  status: 'completed',
+  started_at: '2024-01-01T10:00:00Z',
+  completed_at: '2024-01-01T11:00:00Z',
+  thumbnail_path: null,
+  notes: null,
+  rating: null,
+  project_id: null,
+  project_name: null,
+  project_color: null,
+  print_count: 1,
+  tags: '',
+  created_at: '2024-01-01T09:00:00Z',
+  updated_at: '2024-01-01T11:00:00Z',
+  has_f3d: false,
+  is_favorite: false,
+  ...over,
+});
+
+const ARCHIVES = [
+  archive({ id: 1, print_name: 'Benchy', created_at: '2024-01-03T09:00:00Z' }),
+  archive({
+    id: 2,
+    print_name: 'Bracket',
+    created_at: '2024-01-02T09:00:00Z',
+    timelapse_path: 'timelapse/2.mp4',
+    source_3mf_path: 'source/2.3mf',
+    f3d_path: 'f3d/2.f3d',
+  }),
+  archive({ id: 3, print_name: 'Clip', created_at: '2024-01-01T09:00:00Z' }),
+];
+
+const LOG_ENTRIES = [
+  {
+    id: 501,
+    archive_id: 1,
+    print_name: 'Logged Print',
+    printer_name: 'X1 Carbon',
+    printer_id: 1,
+    status: 'completed',
+    started_at: '2024-01-01T10:00:00Z',
+    completed_at: '2024-01-01T11:00:00Z',
+    duration_seconds: 3600,
+    filament_type: 'PLA',
+    filament_color: '#000000',
+    filament_used_grams: 10,
+    cost: 0.4,
+    energy_kwh: null,
+    energy_cost: null,
+    failure_reason: null,
+    thumbnail_path: null,
+    created_by_id: null,
+    created_by_username: null,
+    created_at: '2024-01-01T10:00:00Z',
+  },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  search: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+let viewMode: string | null;
+
+async function capture(request: Request) {
+  const url = new URL(request.url);
+  let body: unknown;
+  if (request.method === 'PATCH' || request.method === 'POST' || request.method === 'PUT') {
+    const text = await request.text();
+    body = text ? JSON.parse(text) : undefined;
+  }
+  calls.push({ method: request.method, path: url.pathname, search: url.search, body });
+}
+
+const mutations = () => calls.filter((c) => c.method !== 'GET');
+
+beforeEach(() => {
+  calls = [];
+  viewMode = null;
+  setAuthToken(null);
+  vi.mocked(localStorage.getItem).mockImplementation((key: string) =>
+    key === 'archiveViewMode' ? viewMode : null,
+  );
+  server.use(
+    http.get('*/api/v1/archives/', () => HttpResponse.json(ARCHIVES)),
+    http.get('*/api/v1/archives/stats', () =>
+      HttpResponse.json({
+        total_archives: 3,
+        total_print_time_seconds: 0,
+        total_filament_grams: 0,
+        prints_this_week: 0,
+        prints_this_month: 0,
+      }),
+    ),
+    http.get('*/api/v1/archives/tags', () => HttpResponse.json([])),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([{ id: 1, name: 'X1 Carbon' }])),
+    http.get('*/api/v1/projects/', () =>
+      HttpResponse.json([
+        { id: 4, name: 'Gizmos', color: '#ff0000', status: 'active' },
+        { id: 8, name: 'Shelved', color: '#00ff00', status: 'archived' },
+      ]),
+    ),
+    http.get('*/api/v1/archives/:id/delete-impact', () =>
+      HttpResponse.json({ related_queue_items: 0, currently_printing: 0 }),
+    ),
+    http.get('*/api/v1/print-log/', () =>
+      HttpResponse.json({ items: LOG_ENTRIES, total: LOG_ENTRIES.length }),
+    ),
+    http.delete('*/api/v1/archives/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.delete('*/api/v1/archives/:id/timelapse', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.delete('*/api/v1/archives/:id/source', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.delete('*/api/v1/archives/:id/f3d', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+    http.patch('*/api/v1/archives/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(ARCHIVES[0]);
+    }),
+    http.post('*/api/v1/archives/:id/favorite', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(ARCHIVES[0]);
+    }),
+    http.delete('*/api/v1/print-log/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ deleted: 1 });
+    }),
+    http.delete('*/api/v1/print-log/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok', id: 501 });
+    }),
+    http.patch('*/api/v1/print-log/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(LOG_ENTRIES[0]);
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function cardFor(id: number): Promise<HTMLElement> {
+  await screen.findByText('Benchy');
+  const el = document.querySelector<HTMLElement>(`[data-archive-id="${id}"]`);
+  expect(el).not.toBeNull();
+  return el!;
+}
+
+/** The fixed overlay of the ConfirmModal whose title is ``title``. */
+async function confirmDialog(title: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name: title });
+  return heading.closest('div.fixed') as HTMLElement;
+}
+
+async function openMenu(id: number) {
+  fireEvent.contextMenu(await cardFor(id));
+}
+
+describe('ArchivesPage wiring: single archive delete', () => {
+  it('card Delete -> confirm sends DELETE /archives/{id} for that archive only', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(2);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/2', search: '' });
+  });
+
+  it('card Delete with "also remove from Quick Stats" sends purge_stats=true', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(3);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('checkbox'));
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({
+      method: 'DELETE',
+      path: '/api/v1/archives/3',
+      search: '?purge_stats=true',
+    });
+  });
+
+  it('card Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const card = await cardFor(2);
+
+    await user.click(within(card).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archive' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('list row Delete -> confirm sends DELETE for that row', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const row = await cardFor(3);
+
+    await user.click(within(row).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/3' });
+  });
+
+  it('list row Delete -> cancel sends nothing', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    const row = await cardFor(3);
+
+    await user.click(within(row).getByTitle('Delete'));
+    const dialog = await confirmDialog('Delete Archive');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archive' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('ArchivesPage wiring: file removals from the context menu', () => {
+  const cases: Array<[string, string, string]> = [
+    ['Remove Timelapse', 'Remove Timelapse', '/api/v1/archives/2/timelapse'],
+    ['Remove Source 3MF', 'Remove Source 3MF', '/api/v1/archives/2/source'],
+    ['Remove F3D', 'Remove F3D', '/api/v1/archives/2/f3d'],
+  ];
+
+  for (const [menuLabel, dialogTitle, path] of cases) {
+    it(`${menuLabel} -> confirm sends DELETE ${path}`, async () => {
+      const user = userEvent.setup();
+      render(<ArchivesPage />);
+      await openMenu(2);
+
+      await user.click(await screen.findByRole('button', { name: menuLabel }));
+      const dialog = await confirmDialog(dialogTitle);
+      await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+      await waitFor(() => expect(mutations()).toHaveLength(1));
+      expect(mutations()[0]).toMatchObject({ method: 'DELETE', path });
+    });
+
+    it(`${menuLabel} -> cancel sends nothing`, async () => {
+      const user = userEvent.setup();
+      render(<ArchivesPage />);
+      await openMenu(2);
+
+      await user.click(await screen.findByRole('button', { name: menuLabel }));
+      const dialog = await confirmDialog(dialogTitle);
+      await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+      await waitFor(() => expect(screen.queryByRole('heading', { name: dialogTitle })).toBeNull());
+      expect(mutations()).toHaveLength(0);
+    });
+  }
+
+  it('list row: Remove Timelapse -> confirm sends DELETE for that row', async () => {
+    viewMode = 'list';
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(2);
+
+    await user.click(await screen.findByRole('button', { name: 'Remove Timelapse' }));
+    const dialog = await confirmDialog('Remove Timelapse');
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/archives/2/timelapse' });
+  });
+});
+
+describe('ArchivesPage wiring: project and favourite', () => {
+  it('Add to Project -> project sends PATCH /archives/{id} with project_id', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(3);
+
+    // Click (not hover) toggles the submenu open.
+    fireEvent.click(await screen.findByRole('button', { name: 'Add to Project' }));
+    const gizmos = await screen.findByRole('button', { name: 'Gizmos' });
+    // Archived projects are not offered.
+    expect(screen.queryByRole('button', { name: 'Shelved' })).toBeNull();
+    await user.click(gizmos);
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/archives/3',
+      search: '',
+      body: { project_id: 4 },
+    });
+  });
+
+  it('Remove from Project sends PATCH with project_id null', async () => {
+    server.use(
+      http.get('*/api/v1/archives/', () =>
+        HttpResponse.json([
+          ARCHIVES[0],
+          archive({ id: 9, print_name: 'Filed', project_id: 4, project_name: 'Gizmos' }),
+        ]),
+      ),
+    );
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(9);
+
+    fireEvent.click(await screen.findByRole('button', { name: 'Add to Project' }));
+    await user.click(await screen.findByRole('button', { name: 'Remove from Project' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/archives/9', body: { project_id: null } });
+  });
+
+  it('context menu Add to Favorites posts /archives/{id}/favorite', async () => {
+    const user = userEvent.setup();
+    render(<ArchivesPage />);
+    await openMenu(1);
+
+    await user.click(await screen.findByRole('button', { name: 'Add to Favorites' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'POST', path: '/api/v1/archives/1/favorite' });
+  });
+});
+
+describe('ArchivesPage wiring: bulk selection', () => {
+  /** Select archives 1 and 3 via the context menu + selection-mode clicks. */
+  async function selectOneAndThree(user: ReturnType<typeof userEvent.setup>) {
+    render(<ArchivesPage />);
+    await openMenu(1);
+    const menu = (await screen.findByRole('button', { name: 'Add to Project' })).closest(
+      'div.fixed',
+    ) as HTMLElement;
+    await user.click(within(menu).getByRole('button', { name: 'Select' }));
+    await screen.findByText('1 selected');
+    fireEvent.click(await cardFor(3));
+    return (await screen.findByText('2 selected')).closest('div.fixed') as HTMLElement;
+  }
+
+  it('bulk Delete -> confirm sends DELETE for exactly the selected ids', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Delete' }));
+    const dialog = await confirmDialog('Delete Archives');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete 2' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'DELETE /api/v1/archives/1',
+      'DELETE /api/v1/archives/3',
+    ]);
+  });
+
+  it('bulk Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Delete' }));
+    const dialog = await confirmDialog('Delete Archives');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete Archives' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('bulk Favorite toggles each selected id once', async () => {
+    const user = userEvent.setup();
+    const toolbar = await selectOneAndThree(user);
+
+    await user.click(within(toolbar).getByRole('button', { name: 'Favorite' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'POST /api/v1/archives/1/favorite',
+      'POST /api/v1/archives/3/favorite',
+    ]);
+  });
+});
+
+describe('ArchivesPage wiring: print log', () => {
+  async function openLog() {
+    render(<ArchivesPage />);
+    fireEvent.click(await screen.findByTitle('Print Log'));
+    await screen.findByText('Logged Print');
+  }
+
+  it('Clear Log -> confirm sends DELETE /print-log/', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByRole('button', { name: 'Clear Log' }));
+    const dialog = await confirmDialog('Clear Print Log');
+    await user.click(within(dialog).getByRole('button', { name: 'Clear All' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/print-log/' });
+  });
+
+  it('Clear Log -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByRole('button', { name: 'Clear Log' }));
+    const dialog = await confirmDialog('Clear Print Log');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Clear Print Log' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('row delete -> confirm sends DELETE /print-log/{id}', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Delete print log entry'));
+    const dialog = await confirmDialog('Delete print log entry');
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/print-log/501' });
+  });
+
+  it('row delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Delete print log entry'));
+    const dialog = await confirmDialog('Delete print log entry');
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete print log entry' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('row edit sends PATCH /print-log/{id} with only the changed fields', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Edit print log entry'));
+    const heading = await screen.findByRole('heading', { name: 'Edit print log entry' });
+    const modal = heading.parentElement as HTMLElement;
+    const [statusSelect] = within(modal).getAllByRole('combobox');
+    await user.selectOptions(statusSelect, 'failed');
+    await user.click(within(modal).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/print-log/501',
+      search: '',
+      body: { status: 'failed' },
+    });
+  });
+
+  it('row edit with nothing changed sends nothing', async () => {
+    const user = userEvent.setup();
+    await openLog();
+
+    await user.click(screen.getByTitle('Edit print log entry'));
+    const heading = await screen.findByRole('heading', { name: 'Edit print log entry' });
+    await user.click(within(heading.parentElement as HTMLElement).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Edit print log entry' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});

frontend/src/__tests__/pages/FinancePageWiring.test.tsx

@@ -0,0 +1,468 @@
+/**
+ * Wiring tests for FinancePage (admin view): pin the exact billing requests
+ * -- wallet deposit / withdraw, transaction edit / delete, cost centre
+ * create / update / delete, member add / remove, manual print -- that a
+ * cancelled destructive confirm sends nothing, and that the money-moving
+ * controls are absent without cost_centers:modify.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { FinancePage } from '../../pages/FinancePage';
+import { setAuthToken } from '../../api/client';
+
+const centre = (over: Record<string, unknown>) => ({
+  id: 20,
+  name: 'Lab',
+  is_private: false,
+  owner_user_id: null,
+  is_active: true,
+  total_balance: 0,
+  total_budget: null,
+  monthly_budget: 100,
+  budget_mode: 'monthly',
+  budget_limit: 100,
+  budget_used: 0,
+  budget_available: 100,
+  can_print: true,
+  ...over,
+});
+
+const CENTRES = [
+  centre({ id: 20, name: 'Lab' }),
+  centre({ id: 21, name: 'Shop', monthly_budget: 40, budget_limit: 40, budget_available: 40 }),
+  centre({ id: 22, name: 'Alice private', is_private: true, owner_user_id: 3 }),
+];
+
+const USERS = [
+  { id: 3, username: 'alice' },
+  { id: 5, username: 'bob' },
+];
+
+const TX = {
+  id: 900,
+  user_id: 5,
+  cost_center_id: 20,
+  transaction_type: 'deposit',
+  amount: 12.5,
+  balance_after: 12.5,
+  description: 'Filament refill',
+  created_by_user_id: null,
+  print_run_id: null,
+  print_archive_id: null,
+  print_queue_id: null,
+  created_at: '2026-10-11T10:00:00',
+};
+
+interface Captured {
+  method: string;
+  path: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+async function capture(request: Request) {
+  const url = new URL(request.url);
+  const text = request.method === 'DELETE' ? '' : await request.text();
+  calls.push({ method: request.method, path: url.pathname, body: text ? JSON.parse(text) : undefined });
+}
+
+const mutations = () => calls.filter((c) => c.method !== 'GET');
+
+beforeEach(() => {
+  calls = [];
+  setAuthToken(null);
+  server.use(
+    http.get('*/api/v1/settings/ui-flags', () => HttpResponse.json({ billing_enabled: true, currency: 'USD' })),
+    http.get('*/api/v1/finance/me/balance', () =>
+      HttpResponse.json({ user_id: 1, balance: 0, currency: 'USD', updated_at: null }),
+    ),
+    http.get('*/api/v1/finance/me/transactions', () => HttpResponse.json({ items: [], total: 0 })),
+    http.get('*/api/v1/finance/transactions', () =>
+      HttpResponse.json({ items: [TX], total: 1, limit: 50, offset: 0 }),
+    ),
+    http.get('*/api/v1/finance/cost-centers/mine', () => HttpResponse.json([])),
+    http.get('*/api/v1/finance/cost-centers', () => HttpResponse.json(CENTRES)),
+    http.get('*/api/v1/finance/cost-centers/:id', ({ params }) => {
+      const id = Number(params.id);
+      const c = CENTRES.find((x) => x.id === id);
+      return HttpResponse.json({
+        ...c,
+        members: id === 20 ? [{ id: 1, cost_center_id: 20, user_id: 3, can_print: true }] : [],
+      });
+    }),
+    http.get('*/api/v1/users/slim', () => HttpResponse.json(USERS)),
+    http.post('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({});
+    }),
+    http.patch('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({});
+    }),
+    http.delete('*/api/v1/finance/*', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ status: 'ok' });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function openAdmin(user: ReturnType<typeof userEvent.setup>) {
+  render(<FinancePage />);
+  await user.click(await screen.findByText('Admin view'));
+  await screen.findByText('Filament refill');
+}
+
+/** The FinanceModal (or ConfirmModal) overlay whose heading is ``title``. */
+async function modal(title: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name: title });
+  return heading.closest('div.fixed') as HTMLElement;
+}
+
+/** The cost-centre table row for ``name`` (the one with an Edit button). */
+async function centreRow(name: string): Promise<HTMLElement> {
+  let row: HTMLElement | undefined;
+  await waitFor(() => {
+    row = screen
+      .getAllByText(name)
+      .map((el) => el.closest('tr') as HTMLElement | null)
+      .find((tr): tr is HTMLElement => !!tr && !!within(tr).queryByTitle('Edit'));
+    expect(row).toBeDefined();
+  });
+  return row!;
+}
+
+describe('FinancePage wiring: wallet adjustment', () => {
+  it('Deposit 10.00 to bob posts /finance/users/5/deposit with amount, description and cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    const [userSelect, typeSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    expect(typeSelect).toHaveValue('deposit');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '10.00');
+    await user.selectOptions(centreSelect, '21');
+    await user.type(within(dlg).getByPlaceholderText('Description (optional)'), 'Top up');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/users/5/deposit',
+      body: { amount: 10, description: 'Top up', cost_center_id: 21 },
+    });
+  });
+
+  it('Withdraw posts /finance/users/{id}/withdraw with no cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    const [userSelect, typeSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '3');
+    await user.selectOptions(typeSelect, 'withdraw');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '2.5');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/users/3/withdraw',
+      body: { amount: 2.5, cost_center_id: null },
+    });
+  });
+
+  it('a zero amount sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Adjust wallet' }));
+    const dlg = await modal('Adjust wallet');
+    await user.type(within(dlg).getByPlaceholderText('0.00'), '0');
+    await user.click(within(dlg).getByRole('button', { name: 'Apply adjustment' }));
+
+    await screen.findByText('Amount must be greater than zero');
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: transactions', () => {
+  async function txRow(): Promise<HTMLElement> {
+    return (await screen.findByText('Filament refill')).closest('tr') as HTMLElement;
+  }
+
+  it('edit transaction sends PATCH /finance/transactions/{id} with the edited fields', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    const buttons = within(await txRow()).getAllByRole('button');
+    await user.click(buttons[0]); // pencil
+    const dlg = await modal('Edit Transaction');
+    const [userSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '3');
+    await user.selectOptions(centreSelect, '21');
+    const amount = within(dlg).getByRole('spinbutton');
+    await user.clear(amount);
+    await user.type(amount, '7.25');
+    const desc = within(dlg).getByRole('textbox');
+    await user.clear(desc);
+    await user.type(desc, 'Corrected');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'PATCH',
+      path: '/api/v1/finance/transactions/900',
+      body: { user_id: 3, cost_center_id: 21, amount: 7.25, description: 'Corrected' },
+    });
+  });
+
+  // The backend clears the cost centre only for an explicit null
+  // (edit_transaction checks model_fields_set); a missing key keeps the old one.
+  it('moving a transaction to "No cost center" sends cost_center_id: null', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[0]);
+    const dlg = await modal('Edit Transaction');
+    const [, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(centreSelect, '');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0].body).toHaveProperty('cost_center_id', null);
+  });
+
+  it('delete transaction -> confirm sends DELETE /finance/transactions/{id}', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[1]); // trash
+    const dlg = await modal('Delete transaction');
+    await user.click(within(dlg).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/transactions/900' });
+  });
+
+  it('delete transaction -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await txRow()).getAllByRole('button')[1]);
+    const dlg = await modal('Delete transaction');
+    await user.click(within(dlg).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('heading', { name: 'Delete transaction' })).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+
+  it('manual print posts /finance/transactions/manual with user and cost_center_id', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Add manual print' }));
+    const dlg = await modal('Add manual print');
+    const [userSelect, centreSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    await user.selectOptions(centreSelect, '21');
+    await user.type(within(dlg).getByPlaceholderText('e.g., 4.00'), '4');
+    await user.type(within(dlg).getByPlaceholderText('Description (optional)'), 'Hand print');
+    await user.click(within(dlg).getByRole('button', { name: 'Add manual print' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    const call = mutations()[0];
+    expect(call.method).toBe('POST');
+    expect(call.path).toBe('/api/v1/finance/transactions/manual');
+    expect(call.body).toMatchObject({ user_id: 5, cost_center_id: 21, amount: 4, description: 'Hand print' });
+  });
+
+  it('manual print without a cost centre sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Add manual print' }));
+    const dlg = await modal('Add manual print');
+    const [userSelect] = within(dlg).getAllByRole('combobox');
+    await user.selectOptions(userSelect, '5');
+    await user.type(within(dlg).getByPlaceholderText('e.g., 4.00'), '4');
+    await user.click(within(dlg).getByRole('button', { name: 'Add manual print' }));
+
+    await screen.findByText('Please select a cost center');
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: cost centres', () => {
+  it('create posts /finance/cost-centers with name and monthly budget', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Create cost center' }));
+    const dlg = await modal('Create cost center');
+    await user.type(within(dlg).getByPlaceholderText('Name'), '  Robotics ');
+    const inputs = within(dlg).getAllByRole('spinbutton');
+    await user.type(inputs[inputs.length - 1], '50');
+    await user.click(within(dlg).getByRole('button', { name: 'Create' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers',
+      body: { name: 'Robotics', total_budget: null, monthly_budget: 50, is_active: true },
+    });
+  });
+
+  it('edit sends the name and budgets PATCHes for that centre id', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await centreRow('Shop')).getByTitle('Edit'));
+    const dlg = await modal('Edit cost center');
+    const name = within(dlg).getByPlaceholderText('Name');
+    await waitFor(() => expect(name).toHaveValue('Shop'));
+    await user.clear(name);
+    await user.type(name, 'Workshop');
+    await user.selectOptions(within(dlg).getByRole('combobox'), 'total');
+    const budget = within(dlg).getByRole('spinbutton');
+    await user.clear(budget);
+    await user.type(budget, '300');
+    await user.click(within(dlg).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(2));
+    expect(mutations()).toEqual([
+      { method: 'PATCH', path: '/api/v1/finance/cost-centers/21', body: { name: 'Workshop' } },
+      {
+        method: 'PATCH',
+        path: '/api/v1/finance/cost-centers/21/budgets',
+        body: { total_budget: 300, monthly_budget: null },
+      },
+    ]);
+  });
+
+  it('delete -> confirm sends DELETE for that centre; private centres offer no delete', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(within(await centreRow('Alice private')).queryByTitle('Delete')).toBeNull();
+    await user.click(within(await centreRow('Lab')).getByTitle('Delete'));
+    const dlg = (await screen.findByText('Delete cost center "Lab"?')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dlg).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/cost-centers/20' });
+  });
+
+  it('delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(within(await centreRow('Lab')).getByTitle('Delete'));
+    const dlg = (await screen.findByText('Delete cost center "Lab"?')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dlg).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete cost center "Lab"?')).toBeNull());
+    expect(mutations()).toHaveLength(0);
+  });
+});
+
+describe('FinancePage wiring: members', () => {
+  it('add member posts the selected centre id and the user id with can_print', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const [centreSelect, userSelect] = within(dlg).getAllByRole('combobox');
+    await waitFor(() => expect(centreSelect).toHaveValue('20'));
+    // alice (3) is already a member of Lab, so bob is the only candidate.
+    await waitFor(() => expect(userSelect).toHaveValue('5'));
+    expect(within(userSelect).queryByRole('option', { name: 'alice' })).toBeNull();
+    await user.click(within(dlg).getByRole('checkbox'));
+    await user.click(within(dlg).getByRole('button', { name: 'Add member' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers/20/members',
+      body: { user_id: 5, can_print: false },
+    });
+  });
+
+  it('add member follows a switched cost centre', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const [centreSelect, userSelect] = within(dlg).getAllByRole('combobox');
+    await waitFor(() => expect(centreSelect).toHaveValue('20'));
+    await user.selectOptions(centreSelect, '21');
+    await user.selectOptions(userSelect, '3');
+    await user.click(within(dlg).getByRole('button', { name: 'Add member' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/finance/cost-centers/21/members',
+      body: { user_id: 3, can_print: true },
+    });
+  });
+
+  it('remove member sends DELETE /finance/cost-centers/{centre}/members/{user}', async () => {
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    await user.click(screen.getByRole('button', { name: 'Manage cost center members' }));
+    const dlg = await modal('Manage cost center members');
+    const memberRow = (await within(dlg).findByText('alice', { selector: 'td' })).closest('tr') as HTMLElement;
+    await user.click(within(memberRow).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutations()).toHaveLength(1));
+    expect(mutations()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/finance/cost-centers/20/members/3' });
+  });
+});
+
+describe('FinancePage wiring: permission gates', () => {
+  const signInWith = (permissions: string[]) => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: 1, username: 'viewer', is_admin: false, permissions }),
+      ),
+    );
+  };
+
+  it('without cost_centers:modify there is no wallet, manual-print, members or delete control', async () => {
+    signInWith(['cost_centers:read_own', 'cost_centers:read_all', 'users:read_slim']);
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(screen.queryByRole('button', { name: 'Adjust wallet' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Add manual print' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Manage cost center members' })).toBeNull();
+    expect(screen.queryByTitle('Delete')).toBeNull();
+  });
+
+  it('with cost_centers:modify and users:read_slim the wallet controls are offered', async () => {
+    signInWith(['cost_centers:read_own', 'cost_centers:read_all', 'cost_centers:modify', 'users:read_slim']);
+    const user = userEvent.setup();
+    await openAdmin(user);
+
+    expect(screen.getByRole('button', { name: 'Adjust wallet' })).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Add manual print' })).toBeInTheDocument();
+  });
+});

frontend/src/__tests__/pages/InventoryPageWiring.test.tsx

@@ -0,0 +1,324 @@
+/**
+ * Wiring tests for InventoryPage's inventory-changing actions in BOTH modes:
+ * per-spool delete / archive / restore / reset-counter, the bulk actions on
+ * a 3-spool selection, and "sync to scale weight". Spoolman mode must route
+ * to the *Spoolman* APIs and built-in mode to the local ones, every
+ * destructive action must wait for confirmation, and cancel sends nothing.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { render } from '../utils';
+import InventoryPageRouter from '../../pages/InventoryPage';
+import { api, spoolbuddyApi } from '../../api/client';
+
+vi.mock('../../api/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../api/client')>();
+  const fn = () => vi.fn();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      getSettings: fn(),
+      getUiSettings: fn(),
+      getSpoolmanSettings: fn(),
+      getSpools: fn(),
+      getSpoolmanInventorySpools: fn(),
+      getAssignments: fn(),
+      getSpoolmanSlotAssignments: fn(),
+      getSpoolCatalog: fn(),
+      getLocations: fn(),
+      getLocationHASensors: fn(),
+      getLocationHASensorReadings: fn(),
+      // local
+      deleteSpool: fn(),
+      archiveSpool: fn(),
+      restoreSpool: fn(),
+      resetSpoolConsumedCounter: fn(),
+      bulkDeleteSpools: fn(),
+      bulkArchiveSpools: fn(),
+      bulkRestoreSpools: fn(),
+      bulkUpdateSpools: fn(),
+      bulkResetSpoolConsumedCounter: fn(),
+      // spoolman
+      deleteSpoolmanInventorySpool: fn(),
+      archiveSpoolmanInventorySpool: fn(),
+      restoreSpoolmanInventorySpool: fn(),
+      resetSpoolmanInventorySpoolConsumedCounter: fn(),
+      bulkDeleteSpoolmanInventorySpools: fn(),
+      bulkArchiveSpoolmanInventorySpools: fn(),
+      bulkRestoreSpoolmanInventorySpools: fn(),
+      bulkUpdateSpoolmanInventorySpools: fn(),
+      bulkResetSpoolmanInventorySpoolConsumedCounter: fn(),
+      syncSpoolmanSpoolWeight: fn(),
+    },
+    spoolbuddyApi: {
+      ...actual.spoolbuddyApi,
+      updateSpoolWeight: vi.fn(),
+    },
+  };
+});
+
+const m = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+const sb = spoolbuddyApi as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const LOCAL = {
+  delete: 'deleteSpool',
+  archive: 'archiveSpool',
+  restore: 'restoreSpool',
+  reset: 'resetSpoolConsumedCounter',
+  bulkDelete: 'bulkDeleteSpools',
+  bulkArchive: 'bulkArchiveSpools',
+  bulkRestore: 'bulkRestoreSpools',
+  bulkUpdate: 'bulkUpdateSpools',
+  bulkReset: 'bulkResetSpoolConsumedCounter',
+} as const;
+const SPOOLMAN = {
+  delete: 'deleteSpoolmanInventorySpool',
+  archive: 'archiveSpoolmanInventorySpool',
+  restore: 'restoreSpoolmanInventorySpool',
+  reset: 'resetSpoolmanInventorySpoolConsumedCounter',
+  bulkDelete: 'bulkDeleteSpoolmanInventorySpools',
+  bulkArchive: 'bulkArchiveSpoolmanInventorySpools',
+  bulkRestore: 'bulkRestoreSpoolmanInventorySpools',
+  bulkUpdate: 'bulkUpdateSpoolmanInventorySpools',
+  bulkReset: 'bulkResetSpoolmanInventorySpoolConsumedCounter',
+} as const;
+const ALL_MUTATIONS = [...Object.values(LOCAL), ...Object.values(SPOOLMAN), 'syncSpoolmanSpoolWeight'];
+
+function spool(id: number, over: Record<string, unknown> = {}) {
+  return {
+    id,
+    material: 'PLA',
+    subtype: null,
+    brand: `Brand${id}`,
+    color_name: 'Red',
+    rgba: 'FF0000FF',
+    label_weight: 1000,
+    core_weight: 250,
+    weight_used: 100 * id,
+    weight_used_baseline: 0,
+    slicer_filament: null,
+    slicer_filament_name: null,
+    nozzle_temp_min: null,
+    nozzle_temp_max: null,
+    note: null,
+    added_full: null,
+    last_used: null,
+    encode_time: null,
+    tag_uid: null,
+    tray_uuid: null,
+    data_origin: null,
+    tag_type: null,
+    archived_at: null,
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z',
+    k_profiles: [],
+    cost_per_kg: null,
+    last_scale_weight: null,
+    last_weighed_at: null,
+    ...over,
+  };
+}
+
+/** Table row of the spool whose brand is unique per spool. */
+async function row(id: number): Promise<HTMLElement> {
+  // The brand also appears in filter dropdowns; take the one inside a table row.
+  return waitFor(() => {
+    const tr = screen
+      .getAllByText(`Brand${id}`)
+      .map((el) => el.closest('tbody tr'))
+      .find(Boolean);
+    expect(tr).toBeTruthy();
+    return tr as HTMLElement;
+  });
+}
+
+/** The confirm dialog is the last rendered "Cancel"-bearing dialog. */
+function lastButton(name: string | RegExp): HTMLElement {
+  const all = screen.getAllByRole('button', { name });
+  return all[all.length - 1];
+}
+
+/** A bulk-toolbar button (per-row icon buttons share the names via title). */
+function toolbarButton(name: RegExp): HTMLElement {
+  const toolbar = screen.getByText('3 selected').parentElement as HTMLElement;
+  return within(toolbar).getByRole('button', { name });
+}
+
+function expectOnlyCalled(name: string) {
+  for (const other of ALL_MUTATIONS) {
+    if (other !== name) expect(m[other], `${other} must not be called`).not.toHaveBeenCalled();
+  }
+}
+
+describe.each([
+  ['built-in', false, LOCAL],
+  ['Spoolman', true, SPOOLMAN],
+] as const)('InventoryPage wiring (%s inventory)', (_label, isSpoolman, API) => {
+  let spools: ReturnType<typeof spool>[];
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    spools = [spool(1), spool(2), spool(3)];
+    m.getSettings.mockResolvedValue({ low_stock_threshold: 20, currency: 'USD', date_format: 'system' });
+    m.getUiSettings.mockResolvedValue({ low_stock_threshold: 20, currency: 'USD', date_format: 'system' });
+    m.getSpoolmanSettings.mockResolvedValue(
+      isSpoolman
+        ? { spoolman_enabled: 'true', spoolman_url: 'http://spoolman:7912' }
+        : { spoolman_enabled: 'false', spoolman_url: '' },
+    );
+    // Only the active backend returns rows, so a row rendered before the
+    // Spoolman-mode switch settles can never be the one a test clicks.
+    m.getSpools.mockImplementation(() => Promise.resolve(isSpoolman ? [] : spools));
+    m.getSpoolmanInventorySpools.mockImplementation(() => Promise.resolve(isSpoolman ? spools : []));
+    m.getAssignments.mockResolvedValue([]);
+    m.getSpoolmanSlotAssignments.mockResolvedValue([]);
+    m.getSpoolCatalog.mockResolvedValue([]);
+    m.getLocations.mockResolvedValue([]);
+    m.getLocationHASensors.mockResolvedValue([]);
+    m.getLocationHASensorReadings.mockResolvedValue([]);
+    for (const k of [API.delete, API.archive, API.restore, API.reset]) m[k].mockResolvedValue({});
+    m[API.bulkDelete].mockResolvedValue({ deleted: 3 });
+    m[API.bulkArchive].mockResolvedValue({ archived: 3 });
+    m[API.bulkRestore].mockResolvedValue({ restored: 3 });
+    m[API.bulkUpdate].mockResolvedValue({ updated: 3 });
+    m[API.bulkReset].mockResolvedValue({ reset: 3 });
+    m.syncSpoolmanSpoolWeight.mockResolvedValue({});
+    sb.updateSpoolWeight.mockResolvedValue({});
+  });
+
+  afterEach(() => {
+    vi.mocked(localStorage.getItem).mockReset();
+  });
+
+  it('delete: confirm sends only the mode\'s delete for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Delete'));
+    await screen.findByText('Are you sure you want to delete this spool? This cannot be undone.');
+    expect(m[API.delete]).not.toHaveBeenCalled();
+
+    fireEvent.click(lastButton('Delete'));
+    await waitFor(() => expect(m[API.delete]).toHaveBeenCalledTimes(1));
+    expect(m[API.delete].mock.calls[0][0]).toBe(2);
+    expectOnlyCalled(API.delete);
+  });
+
+  it('delete: cancel sends nothing', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Delete'));
+    await screen.findByText('Are you sure you want to delete this spool? This cannot be undone.');
+    fireEvent.click(lastButton('Cancel'));
+    await waitFor(() =>
+      expect(screen.queryByText('Are you sure you want to delete this spool? This cannot be undone.')).not.toBeInTheDocument(),
+    );
+    expectOnlyCalled('__none__');
+  });
+
+  it('archive: confirm sends only the mode\'s archive for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(3)).getByTitle('Archive'));
+    await screen.findByText('Are you sure you want to archive this spool?');
+    fireEvent.click(lastButton('Archive'));
+    await waitFor(() => expect(m[API.archive]).toHaveBeenCalledTimes(1));
+    expect(m[API.archive].mock.calls[0][0]).toBe(3);
+    expectOnlyCalled(API.archive);
+  });
+
+  it('reset counter: confirm sends only the mode\'s reset for that spool id', async () => {
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(1)).getByTitle(/Zero the consumed-grams counter/));
+    fireEvent.click(await waitFor(() => lastButton('Reset counter')));
+    await waitFor(() => expect(m[API.reset]).toHaveBeenCalledTimes(1));
+    expect(m[API.reset].mock.calls[0][0]).toBe(1);
+    expectOnlyCalled(API.reset);
+  });
+
+  it('restore (archived spool, archived view) sends only the mode\'s restore', async () => {
+    spools = [spool(1, { archived_at: '2026-04-01T00:00:00Z' })];
+    render(<InventoryPageRouter />);
+    fireEvent.click(await screen.findByRole('button', { name: 'Archived' }));
+    fireEvent.click(within(await row(1)).getByTitle('Restore'));
+    await waitFor(() => expect(m[API.restore]).toHaveBeenCalledTimes(1));
+    expect(m[API.restore].mock.calls[0][0]).toBe(1);
+    expectOnlyCalled(API.restore);
+  });
+
+  async function selectAllThree() {
+    render(<InventoryPageRouter />);
+    for (const id of [1, 2, 3]) {
+      fireEvent.click(within(await row(id)).getByRole('checkbox', { name: 'Select row' }));
+    }
+  }
+
+  it('bulk delete on a 3-spool selection sends the 3 ids after confirm; cancel sends nothing', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Delete$/));
+    await screen.findByText('Delete selected spools');
+    fireEvent.click(lastButton('Cancel'));
+    await waitFor(() => expect(screen.queryByText('Delete selected spools')).not.toBeInTheDocument());
+    expectOnlyCalled('__none__');
+
+    fireEvent.click(toolbarButton(/^Delete$/));
+    await screen.findByText('Delete selected spools');
+    fireEvent.click(lastButton('Delete'));
+    await waitFor(() => expect(m[API.bulkDelete]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkDelete].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkDelete);
+  });
+
+  it('bulk archive on a 3-spool selection sends the 3 ids after confirm', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Archive$/));
+    await screen.findByText('Archive selected spools');
+    fireEvent.click(lastButton('Archive'));
+    await waitFor(() => expect(m[API.bulkArchive]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkArchive].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkArchive);
+  });
+
+  it('bulk reset usage on a 3-spool selection sends the 3 ids after confirm', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Reset usage$/));
+    await screen.findByText('Reset usage on selected spools');
+    fireEvent.click(lastButton('Reset counter'));
+    await waitFor(() => expect(m[API.bulkReset]).toHaveBeenCalledTimes(1));
+    expect([...m[API.bulkReset].mock.calls[0][0]].sort()).toEqual([1, 2, 3]);
+    expectOnlyCalled(API.bulkReset);
+  });
+
+  it('bulk edit on a 3-spool selection sends (ids, patch) with only the ticked field', async () => {
+    await selectAllThree();
+    fireEvent.click(toolbarButton(/^Edit$/));
+    const noteLabel = await screen.findByText('Note', { selector: 'label' });
+    const fieldRow = noteLabel.closest('div.flex.items-start') as HTMLElement;
+    fireEvent.click(within(fieldRow).getByRole('checkbox'));
+    fireEvent.change(fieldRow.querySelector('textarea') as HTMLElement, { target: { value: 'batch 7' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Apply to 3 spools' }));
+
+    await waitFor(() => expect(m[API.bulkUpdate]).toHaveBeenCalledTimes(1));
+    const [ids, patch] = m[API.bulkUpdate].mock.calls[0];
+    expect([...ids].sort()).toEqual([1, 2, 3]);
+    expect(patch).toEqual({ note: 'batch 7' });
+    expectOnlyCalled(API.bulkUpdate);
+  });
+
+  it('sync to scale weight sends (spool.id, last_scale_weight) to the mode\'s endpoint', async () => {
+    // setup.ts replaces localStorage with vi.fn stubs; feed the column config through it.
+    const columns = JSON.stringify([{ id: 'weight_check', label: 'Weight Check', visible: true }]);
+    vi.mocked(localStorage.getItem).mockImplementation((key: string) =>
+      key === 'bambuddy-inventory-columns' ? columns : null,
+    );
+    // Calculated gross = 1000-200+250 = 1050; scale 812 -> mismatch -> sync button.
+    spools = [spool(1), spool(2, { last_scale_weight: 812 })];
+    render(<InventoryPageRouter />);
+    fireEvent.click(within(await row(2)).getByTitle('Sync: trust scale weight and reset tracking'));
+
+    if (isSpoolman) {
+      await waitFor(() => expect(m.syncSpoolmanSpoolWeight).toHaveBeenCalledWith(2, 812));
+      expect(sb.updateSpoolWeight).not.toHaveBeenCalled();
+    } else {
+      await waitFor(() => expect(sb.updateSpoolWeight).toHaveBeenCalledWith(2, 812));
+      expect(m.syncSpoolmanSpoolWeight).not.toHaveBeenCalled();
+    }
+  });
+});

frontend/src/__tests__/pages/MaintenancePageWiring.test.tsx

@@ -0,0 +1,307 @@
+/**
+ * MaintenancePage wiring: which item / printer / type each control sends,
+ * the confirm on deleting maintenance types, and the permission gates.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { MaintenancePage } from '../../pages/MaintenancePage';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+function item(id: number, printerId: number, typeId: number, name: string, overrides: Record<string, unknown> = {}) {
+  return {
+    id,
+    printer_id: printerId,
+    printer_name: printerId === 1 ? 'Alpha Printer' : 'Beta Printer',
+    printer_model: 'X1C',
+    maintenance_type_id: typeId,
+    maintenance_type_name: name,
+    maintenance_type_icon: null,
+    maintenance_type_wiki_url: 'https://wiki.example/doc',
+    enabled: true,
+    interval_hours: 100,
+    interval_type: 'hours',
+    current_hours: 50,
+    hours_since_maintenance: 50,
+    hours_until_due: 50,
+    days_since_maintenance: null,
+    days_until_due: null,
+    is_due: false,
+    is_warning: false,
+    last_performed_at: null,
+    ...overrides,
+  };
+}
+
+const OVERVIEW = [
+  {
+    printer_id: 1,
+    printer_name: 'Alpha Printer',
+    printer_model: 'X1C',
+    total_print_hours: 10.4,
+    due_count: 0,
+    warning_count: 0,
+    maintenance_items: [item(11, 1, 1, 'Nozzle Task')],
+  },
+  {
+    printer_id: 2,
+    printer_name: 'Beta Printer',
+    printer_model: 'X1C',
+    total_print_hours: 250.2,
+    due_count: 0,
+    warning_count: 0,
+    maintenance_items: [item(21, 2, 1, 'Nozzle Task')],
+  },
+];
+
+const TYPES = [
+  { id: 1, name: 'Clean Nozzle', description: null, default_interval_hours: 100, interval_type: 'hours', icon: null, wiki_url: null, is_system: true, created_at: '2026-01-01T00:00:00Z' },
+  { id: 7, name: 'Custom Belt Check', description: null, default_interval_hours: 300, interval_type: 'hours', icon: null, wiki_url: null, is_system: false, created_at: '2026-01-01T00:00:00Z' },
+];
+
+let sent: Sent[];
+
+async function record(request: Request) {
+  const url = new URL(request.url);
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: url.pathname, search: url.search, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  server.use(
+    http.get('*/api/v1/maintenance/overview', () => HttpResponse.json(OVERVIEW)),
+    http.get('*/api/v1/maintenance/types', () => HttpResponse.json(TYPES)),
+    http.post('*/api/v1/maintenance/items/:id/perform', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(item(21, 2, 1, 'Clean Nozzle'));
+    }),
+    http.patch('*/api/v1/maintenance/items/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json(item(21, 2, 1, 'Clean Nozzle'));
+    }),
+    http.patch('*/api/v1/maintenance/printers/:id/hours', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ printer_id: 2, total_hours: 123, archive_hours: 0, offset_hours: 123 });
+    }),
+    http.delete('*/api/v1/maintenance/types/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ status: 'deleted' });
+    }),
+    http.post('*/api/v1/maintenance/types/restore-defaults', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ restored: 1 });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  vi.restoreAllMocks();
+});
+
+/** The printer card whose heading is `name`. */
+async function printerCard(name: string): Promise<HTMLElement> {
+  const heading = await screen.findByRole('heading', { name });
+  let el: HTMLElement | null = heading;
+  while (el && !within(el).queryByText('Total Print Time')) el = el.parentElement;
+  // `el` is the card header; its parent is the card, which also holds the expanded items.
+  return el!.parentElement!;
+}
+
+async function openSettings(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByRole('button', { name: 'Settings' }));
+}
+
+function typeTile(name: string): HTMLElement {
+  return screen.getByText(name).closest('.rounded-xl') as HTMLElement;
+}
+
+describe('MaintenancePage wiring: status tab', () => {
+  it('Reset on a task sends performMaintenance for that printer\'s item only', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    await user.click(await within(beta).findByRole('button', { name: 'Reset' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/maintenance/items/21/perform' });
+    expect(await screen.findByText('Maintenance marked as complete')).toBeInTheDocument();
+  });
+
+  it('the item toggle PATCHes { enabled } for that item', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const alpha = await printerCard('Alpha Printer');
+    await user.click(within(alpha).getByRole('button', { name: /expand/i }));
+    await user.click(await within(alpha).findByRole('switch'));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({ method: 'PATCH', path: '/api/v1/maintenance/items/11', search: '', body: { enabled: false } });
+  });
+
+  it('editing print hours sends setPrinterHours for that printer', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByText('Total Print Time'));
+    const input = within(beta).getByRole('spinbutton');
+    expect(input).toHaveValue(250);
+    await user.clear(input);
+    await user.type(input, '123');
+    await user.click(within(beta).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({
+      method: 'PATCH',
+      path: '/api/v1/maintenance/printers/2/hours',
+      search: '?total_hours=123',
+    });
+  });
+
+  it('cancelling the hours edit sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByText('Total Print Time'));
+    await user.type(within(beta).getByRole('spinbutton'), '9');
+    await user.click(within(beta).getByRole('button', { name: 'Cancel' }));
+
+    expect(within(beta).queryByRole('spinbutton')).not.toBeInTheDocument();
+    expect(writes()).toEqual([]);
+  });
+});
+
+describe('MaintenancePage wiring: settings tab', () => {
+  it('deleting a default type asks first; confirming sends DELETE for that type', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    await user.click(within(tile).getByRole('button'));
+    expect(await screen.findByText('Delete default maintenance task?')).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/maintenance/types/1' });
+  });
+
+  it('cancelling the default-type delete sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    await user.click(within(tile).getByRole('button'));
+    await screen.findByText('Delete default maintenance task?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete default maintenance task?')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('a custom type is deleted only after the browser confirm says yes', async () => {
+    const confirmSpy = vi.spyOn(window, 'confirm').mockReturnValue(false);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    const tile = await waitFor(() => typeTile('Custom Belt Check'));
+    const trash = within(tile).getAllByRole('button').at(-1)!;
+    await user.click(trash);
+    expect(confirmSpy).toHaveBeenCalledTimes(1);
+    expect(writes()).toEqual([]);
+
+    confirmSpy.mockReturnValue(true);
+    await user.click(trash);
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/maintenance/types/7' });
+  });
+
+  it('Restore Default Tasks sends the restore request', async () => {
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+    await openSettings(user);
+
+    await user.click(await screen.findByRole('button', { name: 'Restore Default Tasks' }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/maintenance/types/restore-defaults' });
+  });
+});
+
+describe('MaintenancePage wiring: permissions', () => {
+  function signInWith(permissions: string[]) {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions,
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+  }
+
+  it('a read-only user gets disabled controls and nothing is sent', async () => {
+    signInWith(['maintenance:read']);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await waitFor(() =>
+      expect(within(beta).getByTitle('You do not have permission to edit print hours')).toBeInTheDocument(),
+    );
+    await user.click(within(beta).getByText('Total Print Time'));
+    expect(within(beta).queryByRole('spinbutton')).not.toBeInTheDocument();
+
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    expect(await within(beta).findByRole('button', { name: 'Reset' })).toBeDisabled();
+    expect(within(beta).getByRole('switch')).toBeDisabled();
+
+    await openSettings(user);
+    expect(await screen.findByRole('button', { name: 'Restore Default Tasks' })).toBeDisabled();
+    const tile = typeTile('Clean Nozzle');
+    expect(within(tile).getByRole('button')).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('maintenance:update enables Reset but not the type delete', async () => {
+    signInWith(['maintenance:read', 'maintenance:update']);
+    const user = userEvent.setup();
+    render(<MaintenancePage />);
+
+    const beta = await printerCard('Beta Printer');
+    await user.click(within(beta).getByRole('button', { name: /expand/i }));
+    await waitFor(() => expect(within(beta).getByRole('button', { name: 'Reset' })).not.toBeDisabled());
+
+    await openSettings(user);
+    const tile = await waitFor(() => typeTile('Clean Nozzle'));
+    expect(within(tile).getByRole('button')).toBeDisabled();
+  });
+});

frontend/src/__tests__/pages/PrintersPageAmsSlotActionsWiring.test.tsx

@@ -0,0 +1,448 @@
+/**
+ * AMS slot / unit action wiring on the printer card.
+ *
+ * - "Re-read RFID" posts the refresh for the hovered slot's (amsId, slotId),
+ *   including an AMS-HT (unit id 128+); the external holder offers no re-read.
+ * - "Unassign" routes by inventory mode: the built-in inventory deletes the
+ *   (printer, ams, tray) assignment, Spoolman mode deletes the Spoolman slot
+ *   assignment by spool id. Neither may hit the other's endpoint.
+ * - AMS Filament Backup toggle, stop drying, and the AMS friendly-name editor
+ *   (save / clear, keyed by the unit's serial).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse, type JsonBodyType } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 5;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'AMS X1C',
+  ip_address: '192.0.2.105',
+  serial_number: '00M09A350100005',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+// No tray_uuid / tag_uid: a third-party spool, so Unassign is offered.
+const baseTray = {
+  tray_color: 'FF0000FF',
+  tray_type: 'PLA',
+  tray_sub_brands: 'PLA Basic',
+  tray_id_name: '',
+  tray_info_idx: 'GFL99',
+  remain: 80,
+  k: 0.02,
+  cali_idx: null,
+  tag_uid: null,
+  tray_uuid: null,
+  nozzle_temp_min: 190,
+  nozzle_temp_max: 230,
+  drying_temp: null,
+  drying_time: null,
+  state: 11,
+};
+
+const amsUnit = (extra: Record<string, unknown> = {}) => ({
+  id: 0,
+  humidity: 30,
+  temp: 25,
+  is_ams_ht: false,
+  serial_number: 'AMS0SERIAL',
+  sw_ver: '1.0.0',
+  dry_time: 0,
+  dry_status: 0,
+  dry_sub_status: 0,
+  dry_sf_reason: [],
+  module_type: 'ams',
+  tray: [0, 1, 2, 3].map((id) => ({ id, ...baseTray })),
+  ...extra,
+});
+
+const htUnit = {
+  id: 128,
+  humidity: 20,
+  temp: 30,
+  is_ams_ht: true,
+  serial_number: 'HT128SERIAL',
+  sw_ver: '1.0.0',
+  dry_time: 0,
+  dry_status: 0,
+  dry_sub_status: 0,
+  dry_sf_reason: [],
+  module_type: 'n3s',
+  tray: [{ id: 0, ...baseTray, tray_type: 'PETG' }],
+};
+
+const statusWith = (ams: unknown[], extra: Record<string, unknown> = {}) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  vt_tray: [],
+  ams,
+  ...extra,
+});
+
+const inventorySpool = {
+  id: 77,
+  material: 'PLA',
+  subtype: 'Basic',
+  brand: 'Generic',
+  color_name: 'Red',
+  rgba: 'FF0000FF',
+  label_weight: 1000,
+  weight_used: 200,
+};
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+interface SetupOptions {
+  status: JsonBodyType;
+  spoolman?: boolean;
+  amsLabels?: Record<number, string>;
+}
+
+function setup({ status, spoolman = false, amsLabels = {} }: SetupOptions) {
+  const sent: Sent[] = [];
+  const record =
+    (response: JsonBodyType = { success: true, message: 'ok', status: 'ok' }) =>
+    async ({ request }: { request: Request }) => {
+      const url = new URL(request.url);
+      const text = await request.text();
+      sent.push({ method: request.method, path: url.pathname, search: url.search, body: text ? JSON.parse(text) : null });
+      return HttpResponse.json(response);
+    };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(status)),
+    http.get('/api/v1/printers/:id/ams-labels', () => HttpResponse.json(amsLabels)),
+    http.get('/api/v1/spoolman/status', () =>
+      HttpResponse.json({ enabled: spoolman, connected: spoolman, url: spoolman ? 'http://spoolman' : null })
+    ),
+    // Built-in inventory: slot 1 of AMS 0 holds spool 77.
+    http.get('/api/v1/inventory/assignments', () =>
+      HttpResponse.json(
+        spoolman
+          ? []
+          : [
+              {
+                id: 1,
+                spool_id: 77,
+                printer_id: PRINTER_ID,
+                printer_name: 'AMS X1C',
+                ams_id: 0,
+                tray_id: 1,
+                fingerprint_color: null,
+                fingerprint_type: null,
+                spool: inventorySpool,
+                configured: true,
+                created_at: '2024-01-01T00:00:00Z',
+              },
+            ]
+      )
+    ),
+    // Spoolman: slot 1 of AMS 0 holds Spoolman spool 55.
+    http.get('/api/v1/spoolman/inventory/slot-assignments/all', () =>
+      HttpResponse.json(
+        spoolman
+          ? [{ printer_id: PRINTER_ID, printer_name: 'AMS X1C', ams_id: 0, tray_id: 1, spoolman_spool_id: 55, ams_label: null }]
+          : []
+      )
+    ),
+    http.get('/api/v1/spoolman/inventory/spools', () =>
+      HttpResponse.json(spoolman ? [{ ...inventorySpool, id: 55 }] : [])
+    ),
+    http.post('/api/v1/printers/:id/ams/:amsId/slot/:slotId/refresh', record()),
+    http.delete('/api/v1/inventory/assignments/:pid/:aid/:tid', record({ status: 'ok' })),
+    http.delete('/api/v1/spoolman/inventory/slot-assignments/:id', record({ ...inventorySpool, id: 55 })),
+    http.post('/api/v1/printers/:id/ams-backup', record({ success: true, ams_filament_backup: true })),
+    http.post('/api/v1/printers/:id/drying/stop', record({ status: 'ok', ams_id: 0 })),
+    http.put('/api/v1/printers/:id/ams-labels/:amsId', record({ ams_id: 0, label: 'x' })),
+    http.delete('/api/v1/printers/:id/ams-labels/:amsId', record({ success: true })),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+async function slots() {
+  await waitFor(() => expect(screen.getAllByTestId('filament-slot').length).toBeGreaterThan(0));
+  return screen.getAllByTestId('filament-slot');
+}
+
+/** Hover a slot and wait for its portaled card to show the given action. */
+async function hover(slot: Element, action: string) {
+  fireEvent.mouseEnter(slot);
+  return screen.findByRole('button', { name: action });
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 50));
+
+describe('AMS slot: Re-read RFID', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('posts refresh for the hovered regular-AMS slot (ams 0, slot 2)', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    await user.click(await hover((await slots())[2], 'Re-read RFID'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams/0/slot/2/refresh`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('posts refresh for an AMS-HT with its unit id 128', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([htUnit]) });
+
+    await user.click(await hover((await slots())[0], 'Re-read RFID'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams/128/slot/0/refresh`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('the external spool holder offers no RFID re-read', async () => {
+    setup({
+      status: statusWith([], { vt_tray: [{ id: 254, ...baseTray, tray_color: 'FFFFFFFF' }] }),
+    });
+    const [ext] = await slots();
+    // Load is the external slot's first action; wait for it, then check.
+    await hover(ext, 'Load');
+    expect(screen.queryByRole('button', { name: 'Re-read RFID' })).toBeNull();
+  });
+
+  it('without printers:ams_rfid the re-read is disabled and sends nothing', async () => {
+    permissions.denied = new Set(['printers:ams_rfid']);
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const button = await hover((await slots())[0], 'Re-read RFID');
+    expect(button).toBeDisabled();
+    expect(button).toHaveAttribute('title', 'You do not have permission to re-read AMS RFID');
+    await user.click(button);
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('is disabled while the printer is RUNNING', async () => {
+    const sent = setup({ status: statusWith([amsUnit()], { state: 'RUNNING' }) });
+    const button = await hover((await slots())[0], 'Re-read RFID');
+    expect(button).toBeDisabled();
+    await settle();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('AMS slot: Unassign routes by inventory mode', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('built-in inventory: DELETE /inventory/assignments/{printer}/{ams}/{tray}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    await user.click(await hover((await slots())[1], 'Unassign'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'DELETE', path: `/api/v1/inventory/assignments/${PRINTER_ID}/0/1`, search: '', body: null },
+      ])
+    );
+  });
+
+  it('Spoolman mode: DELETE /spoolman/inventory/slot-assignments/{spoolmanSpoolId}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), spoolman: true });
+
+    await user.click(await hover((await slots())[1], 'Unassign'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'DELETE', path: '/api/v1/spoolman/inventory/slot-assignments/55', search: '', body: null },
+      ])
+    );
+  });
+
+  it('an unassigned slot offers no Unassign', async () => {
+    setup({ status: statusWith([amsUnit()]) });
+    await hover((await slots())[2], 'Re-read RFID');
+    expect(screen.queryByRole('button', { name: 'Unassign' })).toBeNull();
+  });
+});
+
+describe('AMS unit: backup, drying, friendly name', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('AMS Filament Backup toggle POSTs ams-backup?enabled=true when off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: false }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is OFF. Click to enable.'));
+    await user.click(await screen.findByRole('switch'));
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/ams-backup`, search: '?enabled=true', body: null },
+      ])
+    );
+  });
+
+  it('AMS Filament Backup toggle POSTs enabled=false when on', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: true }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is ON. Click to disable.'));
+    await user.click(await screen.findByRole('switch'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0].search).toBe('?enabled=false');
+  });
+
+  it('AMS Filament Backup switch is disabled without printers:control', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()], { ams_filament_backup: false }) });
+
+    await user.click(await screen.findByTitle('AMS Filament Backup is OFF. Click to enable.'));
+    const toggle = await screen.findByRole('switch');
+    expect(toggle).toBeDisabled();
+    await user.click(toggle);
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('Stop Drying on a drying AMS 2 Pro POSTs drying/stop with its ams id', async () => {
+    const user = userEvent.setup();
+    const sent = setup({
+      status: statusWith([amsUnit({ id: 1, module_type: 'n3f', dry_time: 120, serial_number: 'N3F1' })], {
+        supports_drying: true,
+      }),
+    });
+
+    const [stop] = await screen.findAllByTitle('Stop Drying');
+    await user.click(stop);
+    await waitFor(() =>
+      expect(sent).toEqual([
+        { method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/drying/stop`, search: '?ams_id=1', body: null },
+      ])
+    );
+  });
+
+  async function openNameCard() {
+    // The unit label ("AMS-A" style, or the saved friendly name) is the hover trigger.
+    const label = await screen.findByText(/^(AMS[- ]?A|Left box)$/);
+    fireEvent.mouseEnter(label.parentElement!);
+    return (await screen.findByText('AMS0SERIAL')).closest('div.w-52') as HTMLElement;
+  }
+
+  it('saving a friendly name PUTs the trimmed label with the unit serial', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const card = await openNameCard();
+    await user.type(within(card).getByPlaceholderText('e.g. AMS Friendly Name'), '  Left box  ');
+    await user.click(within(card).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        {
+          method: 'PUT',
+          path: `/api/v1/printers/${PRINTER_ID}/ams-labels/0`,
+          search: '',
+          body: { label: 'Left box', ams_serial: 'AMS0SERIAL' },
+        },
+      ])
+    );
+  });
+
+  it('Clear DELETEs the label for that unit serial', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), amsLabels: { 0: 'Left box' } });
+
+    const card = await openNameCard();
+    await user.click(within(card).getByRole('button', { name: 'Clear' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        {
+          method: 'DELETE',
+          path: `/api/v1/printers/${PRINTER_ID}/ams-labels/0`,
+          search: '?ams_serial=AMS0SERIAL',
+          body: null,
+        },
+      ])
+    );
+  });
+
+  it('saving an emptied name DELETEs instead of saving a blank label', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ status: statusWith([amsUnit()]), amsLabels: { 0: 'Left box' } });
+
+    const card = await openNameCard();
+    const input = within(card).getByPlaceholderText('e.g. AMS Friendly Name');
+    await user.clear(input);
+    await user.type(input, '   ');
+    await user.click(within(card).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({ method: 'DELETE', search: '?ams_serial=AMS0SERIAL' });
+  });
+
+  it('without printers:update the name field is read-only and has no Save', async () => {
+    permissions.denied = new Set(['printers:update']);
+    const sent = setup({ status: statusWith([amsUnit()]) });
+
+    const card = await openNameCard();
+    expect(within(card).getByRole('textbox')).toBeDisabled();
+    expect(within(card).queryByRole('button', { name: 'Save' })).toBeNull();
+    await settle();
+    expect(sent).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/PrintersPageBulkActionsWiring.test.tsx

@@ -0,0 +1,272 @@
+/**
+ * PrintersPage bulk actions: the requests go to exactly the selected printers.
+ *
+ * Three printers, all of which could take a Stop. Selecting two of them (by
+ * clicking cards, by state, or by location) and confirming must stop those two
+ * and never the third; cancelling the confirm must stop nothing. Bulk selection
+ * needs printers:control, Clear Bed needs printers:clear_plate.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const basePrinter = {
+  ip_address: '192.0.2.100',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const printers = [
+  { ...basePrinter, id: 11, name: 'Alpha', serial_number: '01P00A000000011', location: 'Lab' },
+  { ...basePrinter, id: 12, name: 'Bravo', serial_number: '01P00A000000012', location: 'Lab' },
+  { ...basePrinter, id: 13, name: 'Charlie', serial_number: '01P00A000000013', location: 'Shed' },
+];
+
+// 11 printing, 12 paused, 13 printing: every one of them is stoppable.
+const defaultStates: Record<string, string> = { '11': 'RUNNING', '12': 'PAUSE', '13': 'RUNNING' };
+let states: Record<string, string> = { ...defaultStates };
+
+let calls: { action: string; id: string }[] = [];
+
+function renderPage() {
+  calls = [];
+  const record = (action: string) => ({ params }: { params: Record<string, string | readonly string[] | undefined> }) => {
+    calls.push({ action, id: params.id as string });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json(printers)),
+    http.get('/api/v1/printers/:id/status', ({ params }) =>
+      HttpResponse.json({
+        connected: true,
+        state: states[params.id as string],
+        progress: 40,
+        layer_num: 10,
+        total_layers: 100,
+        temperatures: { nozzle: 220, bed: 60, chamber: 30 },
+        remaining_time: 600,
+        filename: 'part.gcode',
+        wifi_signal: -40,
+        speed_level: 2,
+        vt_tray: [],
+        ams: [],
+        awaiting_plate_clear: params.id === '12',
+      }),
+    ),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.post('/api/v1/printers/:id/print/stop', record('stop')),
+    http.post('/api/v1/printers/:id/print/pause', record('pause')),
+    http.post('/api/v1/printers/:id/print/resume', record('resume')),
+    http.post('/api/v1/printers/:id/clear-plate', record('clearPlate')),
+    http.post('/api/v1/printers/:id/hms/clear', record('clearHMS')),
+  );
+  render(<PrintersPage />);
+}
+
+const card = (id: number) => document.getElementById(`printer-card-${id}`) as HTMLElement;
+
+async function waitForCards() {
+  await waitFor(() => {
+    for (const p of printers) expect(card(p.id)).not.toBeNull();
+  });
+  // Every card's status must be in the cache before bulk enablement is read.
+  await waitFor(() => {
+    for (const p of printers) expect(card(p.id).textContent).toContain('Connected');
+  });
+}
+
+async function enterSelectionMode(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(screen.getAllByTitle('Select')[0]);
+  await waitFor(() => expect(card(11).querySelector('div.absolute.inset-0.z-20')).not.toBeNull());
+}
+
+async function clickCard(user: ReturnType<typeof userEvent.setup>, id: number) {
+  await user.click(card(id).querySelector('div.absolute.inset-0.z-20') as HTMLElement);
+}
+
+const toolbar = () => screen.getByText(/^\d+ selected$/).closest('div.fixed') as HTMLElement;
+
+async function stopAndConfirm(user: ReturnType<typeof userEvent.setup>, expectedCount: number) {
+  const stop = within(toolbar()).getByRole('button', { name: 'Stop' });
+  await waitFor(() => expect(stop).toBeEnabled());
+  await user.click(stop);
+  expect(await screen.findByText(`Stop ${expectedCount} Prints`)).toBeInTheDocument();
+  await user.click(screen.getByRole('button', { name: 'Stop All' }));
+}
+
+const stoppedIds = () => calls.filter((c) => c.action === 'stop').map((c) => c.id).sort();
+
+describe('PrintersPage bulk actions wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['printers:control', 'printers:clear_plate'];
+    states = { ...defaultStates };
+  });
+
+  it('stops exactly the two selected printers, not the third', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+    expect(within(toolbar()).getByText('2 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 2);
+
+    await waitFor(() => expect(stoppedIds()).toEqual(['11', '12']));
+    // Settle, then make sure the unselected printer was never touched.
+    await screen.findByText('Stop completed on 2 printer(s)');
+    expect(calls.every((c) => c.id !== '13')).toBe(true);
+    expect(calls.every((c) => c.action === 'stop')).toBe(true);
+  });
+
+  it('skips a selected printer that has nothing to stop', async () => {
+    states = { ...defaultStates, '12': 'IDLE' };
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+
+    await stopAndConfirm(user, 2);
+    await waitFor(() => expect(stoppedIds()).toEqual(['11']));
+    await screen.findByText('Stop completed on 1 printer(s)');
+    expect(calls).toHaveLength(1);
+  });
+
+  it('cancelling the bulk stop confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 13);
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Stop' }));
+    expect(await screen.findByText('Stop 2 Prints')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Stop 2 Prints')).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(calls).toEqual([]);
+  });
+
+  it('pause goes only to the selected printers that are printing', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12); // paused: not applicable for pause
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Pause' }));
+    await user.click(await screen.findByRole('button', { name: 'Pause All' }));
+
+    await waitFor(() => expect(calls).toEqual([{ action: 'pause', id: '11' }]));
+  });
+
+  it('select by state picks only printers in that state', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+
+    await user.click(within(toolbar()).getByRole('button', { name: /Select by State/ }));
+    await user.click(within(toolbar()).getByRole('button', { name: /^Printing/ }));
+    expect(within(toolbar()).getByText('2 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 2);
+    await waitFor(() => expect(stoppedIds()).toEqual(['11', '13']));
+    await screen.findByText('Stop completed on 2 printer(s)');
+    expect(calls.some((c) => c.id === '12')).toBe(false);
+  });
+
+  it('select by location picks only printers at that location', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+
+    await user.click(within(toolbar()).getByRole('button', { name: /Select by Location/ }));
+    await user.click(within(toolbar()).getByRole('button', { name: 'Shed' }));
+    expect(within(toolbar()).getByText('1 selected')).toBeInTheDocument();
+
+    await stopAndConfirm(user, 1);
+    await waitFor(() => expect(stoppedIds()).toEqual(['13']));
+    await screen.findByText('Stop completed on 1 printer(s)');
+    expect(calls).toHaveLength(1);
+  });
+
+  it('clear bed goes only to selected printers awaiting a plate clear', async () => {
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 11);
+    await clickCard(user, 12);
+
+    await user.click(within(toolbar()).getByRole('button', { name: 'Clear Bed' }));
+    await user.click(await screen.findByRole('button', { name: 'Clear All' }));
+
+    await waitFor(() => expect(calls).toEqual([{ action: 'clearPlate', id: '12' }]));
+  });
+
+  it('bulk selection is unavailable without printers:control', async () => {
+    permissions.granted = ['printers:clear_plate'];
+    renderPage();
+    await waitForCards();
+    for (const b of screen.getAllByTitle('Select')) expect(b).toBeDisabled();
+    expect(screen.queryByText(/^\d+ selected$/)).toBeNull();
+  });
+
+  it('Clear Bed is disabled without printers:clear_plate', async () => {
+    permissions.granted = ['printers:control'];
+    const user = userEvent.setup();
+    renderPage();
+    await waitForCards();
+    await enterSelectionMode(user);
+    await clickCard(user, 12);
+
+    const clearBed = within(toolbar()).getByRole('button', { name: 'Clear Bed' });
+    expect(clearBed).toBeDisabled();
+    await user.click(clearBed);
+    expect(screen.queryByText(/Clear \d+ Print Beds/)).toBeNull();
+    expect(calls).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/PrintersPageDeletePowerWiring.test.tsx

@@ -0,0 +1,410 @@
+/**
+ * Printer card wiring for the destructive / out-of-service actions:
+ * delete printer (with or without its archives), smart-plug power off and
+ * auto-off, maintenance mode and the plate-detection toggle.
+ *
+ * Every test asserts the request that actually leaves the browser, and the
+ * destructive ones also pin that cancelling sends nothing.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { QueryClient } from '@tanstack/react-query';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 4;
+const PLUG_ID = 42;
+
+const basePrinter = {
+  id: PRINTER_ID,
+  name: 'Garage P1S',
+  ip_address: '192.0.2.104',
+  serial_number: '01P00A000000004',
+  access_code: '12345678',
+  model: 'P1S',
+  enabled: true,
+  is_active: true,
+  plate_detection_enabled: false,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusFor = (state: string) => ({
+  connected: true,
+  state,
+  progress: state === 'RUNNING' ? 40 : 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -40,
+  speed_level: 2,
+  vt_tray: [],
+  ams: [],
+});
+
+const smartPlug = {
+  id: PLUG_ID,
+  name: 'Printer Plug',
+  plug_type: 'tasmota',
+  ip_address: '192.0.2.50',
+  ha_entity_id: null,
+  enabled: true,
+  printer_id: PRINTER_ID,
+  auto_on: false,
+  auto_off: false,
+  auto_off_executed: false,
+};
+
+type Sent = { method: string; path: string; search: string; body: unknown };
+
+interface SetupOptions {
+  state?: string;
+  printer?: Partial<typeof basePrinter>;
+  withPlug?: boolean;
+}
+
+function setup({ state = 'IDLE', printer = {}, withPlug = false }: SetupOptions = {}) {
+  const sent: Sent[] = [];
+  let assignmentFetches = 0;
+  const record = async ({ request }: { request: Request }) => {
+    const url = new URL(request.url);
+    const text = await request.text();
+    sent.push({
+      method: request.method,
+      path: url.pathname,
+      search: url.search,
+      body: text ? JSON.parse(text) : null,
+    });
+    return HttpResponse.json({ success: true, status: 'deleted', archives_deleted: true, action: 'off' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([{ ...basePrinter, ...printer }])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusFor(state))),
+    http.get('/api/v1/smart-plugs/by-printer/:id', () => HttpResponse.json(withPlug ? smartPlug : null)),
+    http.get('/api/v1/smart-plugs/:id/status', () =>
+      HttpResponse.json({ state: 'ON', reachable: true, device_name: 'Plug', energy: { power: 120 } })
+    ),
+    http.get('/api/v1/inventory/assignments', () => {
+      assignmentFetches += 1;
+      return HttpResponse.json([]);
+    }),
+    http.delete('/api/v1/printers/:id', record),
+    http.patch('/api/v1/printers/:id', record),
+    http.post('/api/v1/smart-plugs/:id/control', record),
+    http.patch('/api/v1/smart-plugs/:id', record),
+  );
+  render(<PrintersPage />);
+  return { sent, assignmentFetches: () => assignmentFetches };
+}
+
+/** Opens the card's 3-dot overflow menu. */
+async function openMenu(user: ReturnType<typeof userEvent.setup>) {
+  // The trigger's title is t('common.more', 'More'); match loosely so the
+  // label wording does not matter, but it must be the card's More button.
+  await screen.findByText('Garage P1S');
+  const trigger = (await screen.findAllByTitle(/more/i)).find((el) => el.tagName === 'BUTTON');
+  expect(trigger).toBeDefined();
+  await user.click(trigger!);
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 50));
+
+describe('PrintersPage delete printer wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('confirm with "Delete print archives" checked sends DELETE ?delete_archives=true', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const heading = await screen.findByText('Delete Printer');
+    const dialog = heading.closest('div.fixed') as HTMLElement;
+    expect(within(dialog).getByRole('checkbox')).toBeChecked();
+    expect(sent).toEqual([]);
+
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'DELETE',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      search: '?delete_archives=true',
+    });
+  });
+
+  it('confirm with the archives box unchecked sends delete_archives=false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('checkbox'));
+    expect(within(dialog).getByRole('checkbox')).not.toBeChecked();
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'DELETE',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      search: '?delete_archives=false',
+    });
+  });
+
+  it('cancel sends nothing and resets the archives box for next time', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    let dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('checkbox'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Delete Printer')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    expect(within(dialog).getByRole('checkbox')).toBeChecked();
+  });
+
+  it('without printers:delete the menu entry opens nothing and sends nothing', async () => {
+    permissions.denied = new Set(['printers:delete']);
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    const entry = await screen.findByRole('button', { name: 'Delete' });
+    expect(entry).toHaveAttribute('title', 'You do not have permission to delete printers');
+    await user.click(entry);
+    await settle();
+    expect(screen.queryByText('Delete Printer')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+
+  // The backend drops the deleted printer's slot assignments; a cached list
+  // would keep showing spools as assigned to a printer that no longer exists.
+  it('a successful delete refetches the spool assignments', async () => {
+    const user = userEvent.setup();
+    const { sent, assignmentFetches } = setup();
+
+    await waitFor(() => expect(assignmentFetches()).toBeGreaterThan(0));
+    await settle();
+    const before = assignmentFetches();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Delete' }));
+    const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+    await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+
+    await waitFor(() => expect(assignmentFetches()).toBeGreaterThan(before));
+  });
+
+  it('a successful delete also refreshes the Spoolman slot assignments', async () => {
+    const invalidate = vi.spyOn(QueryClient.prototype, 'invalidateQueries');
+    try {
+      const user = userEvent.setup();
+      const { sent } = setup();
+
+      await openMenu(user);
+      await user.click(await screen.findByRole('button', { name: 'Delete' }));
+      const dialog = (await screen.findByText('Delete Printer')).closest('div.fixed') as HTMLElement;
+      await user.click(within(dialog).getByRole('button', { name: 'Delete' }));
+      await waitFor(() => expect(sent).toHaveLength(1));
+
+      await waitFor(() =>
+        expect(invalidate).toHaveBeenCalledWith({ queryKey: ['spoolman-slot-assignments'] })
+      );
+    } finally {
+      invalidate.mockRestore();
+    }
+  });
+});
+
+describe('PrintersPage smart plug power wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('power off while RUNNING shows the printing warning; confirm POSTs action=off to the plug', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await user.click(await screen.findByTitle('Turn off'));
+    expect(await screen.findByText(/"Garage P1S" is currently printing!/)).toBeInTheDocument();
+    expect(sent).toEqual([]);
+
+    await user.click(screen.getByRole('button', { name: 'Power Off' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'POST',
+      path: `/api/v1/smart-plugs/${PLUG_ID}/control`,
+      body: { action: 'off' },
+    });
+  });
+
+  it('power off -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await user.click(await screen.findByTitle('Turn off'));
+    await screen.findByText('Power Off Printer');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Power Off Printer')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+  });
+
+  it('auto-off toggle PATCHes the plug with the flipped auto_off', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ withPlug: true });
+
+    await user.click(await screen.findByTitle('Auto power-off after print'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/smart-plugs/${PLUG_ID}`,
+      body: { auto_off: true },
+    });
+  });
+
+  it('without smart_plugs:control the power and auto-off buttons are disabled', async () => {
+    permissions.denied = new Set(['smart_plugs:control']);
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING', withPlug: true });
+
+    await screen.findByText('Printer Plug');
+    const buttons = screen.getAllByTitle('You do not have permission to control smart plugs');
+    expect(buttons).toHaveLength(2);
+    for (const b of buttons) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await settle();
+    expect(screen.queryByText('Power Off Printer')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage maintenance mode and plate detection wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('entering maintenance on an idle printer PATCHes {is_active:false}', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup();
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: false },
+    });
+  });
+
+  it('entering maintenance mid-print asks first; cancel sends nothing, confirm sends is_active:false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ state: 'RUNNING' });
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    await screen.findByText('Enter maintenance mode mid-print?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByText('Enter maintenance mode mid-print?')).toBeNull());
+    await settle();
+    expect(sent).toEqual([]);
+
+    await openMenu(user);
+    await user.click(await screen.findByRole('button', { name: 'Enter maintenance mode' }));
+    const title = await screen.findByText('Enter maintenance mode mid-print?');
+    const modal = title.closest('[role="dialog"]') ?? title.parentElement!.parentElement!.parentElement!;
+    const confirm = within(modal as HTMLElement)
+      .getAllByRole('button', { name: 'Enter maintenance mode' })
+      .at(-1)!;
+    await user.click(confirm);
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: false },
+    });
+  });
+
+  it('exiting maintenance PATCHes {is_active:true}', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { is_active: false } });
+
+    await user.click(await screen.findByRole('button', { name: 'Exit maintenance' }));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { is_active: true },
+    });
+  });
+
+  it('plate-detection toggle PATCHes the inverse of the current setting', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { plate_detection_enabled: false } });
+
+    await user.click(await screen.findByTitle('Plate check disabled - Click to enable'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({
+      method: 'PATCH',
+      path: `/api/v1/printers/${PRINTER_ID}`,
+      body: { plate_detection_enabled: true },
+    });
+  });
+
+  it('plate-detection toggle on an enabled printer sends plate_detection_enabled:false', async () => {
+    const user = userEvent.setup();
+    const { sent } = setup({ printer: { plate_detection_enabled: true } });
+
+    await user.click(await screen.findByTitle('Plate check enabled - Click to disable'));
+    await waitFor(() => expect(sent).toHaveLength(1));
+    expect(sent[0]).toMatchObject({ body: { plate_detection_enabled: false } });
+  });
+});

frontend/src/__tests__/pages/PrintersPageFirmwareModalWiring.test.tsx

@@ -0,0 +1,242 @@
+/**
+ * Printer card -> firmware modal wiring (inline FirmwareUpdateModal in PrintersPage).
+ *
+ * Pins: the version the user picks is the version that is prepared and
+ * uploaded to the printer's SD card, the upload status poll is shown (progress
+ * and error), the Upload button only exists when the backend's prepare check
+ * says it can proceed, and firmware:update gates both the prepare check and
+ * the upload.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { granted: [] as string[] };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => permissions.granted.includes(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 5;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Garage X1C',
+  ip_address: '192.0.2.100',
+  serial_number: '01P00A000000005',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'stainless_steel',
+  location: null,
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const firmwareInfo = {
+  printer_id: PRINTER_ID,
+  printer_name: 'Garage X1C',
+  model: 'X1C',
+  current_version: '01.07.00.00',
+  latest_version: '01.08.00.00',
+  update_available: true,
+  download_url: null,
+  release_notes: 'Latest notes',
+  available_versions: [
+    { version: '01.08.00.00', file_available: true, download_url: null, release_notes: 'v8', release_time: null },
+    { version: '01.07.00.00', file_available: true, download_url: null, release_notes: 'v7', release_time: null },
+    { version: '01.06.00.00', file_available: true, download_url: null, release_notes: 'v6', release_time: null },
+    { version: '01.05.00.00', file_available: false, download_url: null, release_notes: null, release_time: null },
+  ],
+};
+
+const prepareOk = {
+  can_proceed: true,
+  sd_card_present: true,
+  sd_card_free_space: 1e9,
+  firmware_size: 1e8,
+  space_sufficient: true,
+  update_available: true,
+  current_version: '01.07.00.00',
+  latest_version: '01.08.00.00',
+  target_version: null,
+  firmware_filename: 'fw.bin',
+  errors: [] as string[],
+};
+
+let prepareVersions: (string | null)[] = [];
+let uploadVersions: (string | null)[] = [];
+let statusPolls = 0;
+
+function renderPage({
+  state = 'IDLE',
+  prepare = prepareOk,
+  statuses = [] as object[],
+}: { state?: string; prepare?: typeof prepareOk; statuses?: object[] } = {}) {
+  prepareVersions = [];
+  uploadVersions = [];
+  statusPolls = 0;
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/printers/:id/status', () =>
+      HttpResponse.json({
+        connected: true,
+        state,
+        progress: state === 'RUNNING' ? 40 : 0,
+        layer_num: state === 'RUNNING' ? 10 : 0,
+        total_layers: 100,
+        temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+        remaining_time: 0,
+        wifi_signal: -40,
+        speed_level: 2,
+        vt_tray: [],
+        ams: [],
+        firmware_version: '01.07.00.00',
+      }),
+    ),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}`, () => HttpResponse.json(firmwareInfo)),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}/prepare`, ({ request }) => {
+      prepareVersions.push(new URL(request.url).searchParams.get('version'));
+      return HttpResponse.json(prepare);
+    }),
+    http.post('/api/v1/firmware/updates/:id/upload', ({ request, params }) => {
+      expect(params.id).toBe(String(PRINTER_ID));
+      uploadVersions.push(new URL(request.url).searchParams.get('version'));
+      return HttpResponse.json({ started: true, message: 'started' });
+    }),
+    http.get(`/api/v1/firmware/updates/${PRINTER_ID}/upload/status`, () => {
+      const s = statuses[Math.min(statusPolls, statuses.length - 1)];
+      statusPolls += 1;
+      return HttpResponse.json(s);
+    }),
+  );
+  render(<PrintersPage />);
+}
+
+async function openModal() {
+  const user = userEvent.setup();
+  const badge = await screen.findByTitle(/Firmware update available/i);
+  await user.click(badge);
+  await screen.findByText('Firmware Update');
+  return user;
+}
+
+// The version list rows are buttons; the "Current:" line shows the same text in a plain span.
+const versionRow = (v: string) => {
+  const rows = screen
+    .getAllByText(v, { selector: 'span.font-mono' })
+    .map((el) => el.closest('button'))
+    .filter((b): b is HTMLButtonElement => b !== null);
+  expect(rows).toHaveLength(1);
+  return rows[0];
+};
+
+describe('PrintersPage firmware modal wiring', () => {
+  beforeEach(() => {
+    permissions.granted = ['firmware:read', 'firmware:update', 'printers:control'];
+  });
+
+  it('uploads the version the user picked, not the latest', async () => {
+    renderPage({
+      statuses: [{ status: 'complete', progress: 100, message: 'Done', error: null, firmware_filename: 'fw.bin', firmware_version: '01.06.00.00' }],
+    });
+    const user = await openModal();
+
+    // Latest is pre-selected and prepared first.
+    await waitFor(() => expect(prepareVersions).toContain('01.08.00.00'));
+
+    await user.click(versionRow('01.06.00.00'));
+    await waitFor(() => expect(prepareVersions).toContain('01.06.00.00'));
+
+    const upload = await screen.findByRole('button', { name: /Upload Firmware/ });
+    await user.click(upload);
+
+    await waitFor(() => expect(uploadVersions).toEqual(['01.06.00.00']));
+    expect(await screen.findByText('Firmware uploaded to SD card!', {}, { timeout: 5000 })).toBeInTheDocument();
+  }, 10000);
+
+  it('shows polled progress and then the upload error', async () => {
+    renderPage({
+      statuses: [
+        { status: 'uploading', progress: 45, message: 'Uploading to SD card', error: null, firmware_filename: 'fw.bin', firmware_version: '01.08.00.00' },
+        { status: 'error', progress: 45, message: 'Upload failed', error: 'FTP connection reset', firmware_filename: 'fw.bin', firmware_version: '01.08.00.00' },
+      ],
+    });
+    const user = await openModal();
+    await user.click(await screen.findByRole('button', { name: /Upload Firmware/ }));
+    await waitFor(() => expect(uploadVersions).toEqual(['01.08.00.00']));
+
+    expect(await screen.findByText('45%', {}, { timeout: 5000 })).toBeInTheDocument();
+    expect(await screen.findByText('FTP connection reset', {}, { timeout: 5000 })).toBeInTheDocument();
+    // After an error the poll stops.
+    const polls = statusPolls;
+    await new Promise((r) => setTimeout(r, 2300));
+    expect(statusPolls).toBe(polls);
+  }, 15000);
+
+  it('offers no upload when the prepare check refuses, and shows why', async () => {
+    renderPage({ prepare: { ...prepareOk, can_proceed: false, sd_card_present: false, errors: ['No SD card inserted'] } });
+    await openModal();
+    expect(await screen.findByText('No SD card inserted')).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+    expect(uploadVersions).toEqual([]);
+  });
+
+  it('without firmware:update, versions are locked, nothing is prepared and there is no upload', async () => {
+    permissions.granted = ['firmware:read', 'printers:control'];
+    renderPage();
+    await openModal();
+    const dialog = screen.getByText('Firmware Update').closest('div.fixed') as HTMLElement;
+    expect(versionRow('01.06.00.00')).toBeDisabled();
+    expect(within(dialog).queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+    await new Promise((r) => setTimeout(r, 50));
+    expect(prepareVersions).toEqual([]);
+    expect(uploadVersions).toEqual([]);
+  });
+
+  it('does not offer the installed version or one without a file', async () => {
+    renderPage();
+    await openModal();
+    expect(versionRow('01.07.00.00')).toBeDisabled();
+    expect(versionRow('01.05.00.00')).toBeDisabled();
+    expect(versionRow('01.06.00.00')).toBeEnabled();
+  });
+
+  // BUG (suspected, needs a product decision): neither the modal nor the
+  // backend prepare/upload routes look at the print state, so firmware can be
+  // pushed over FTP to the SD card of a printer that is mid-print. The audit
+  // item expects the Upload button to be unavailable while printing.
+  it.skip('offers no upload while the printer is printing', async () => {
+    renderPage({ state: 'RUNNING' });
+    await openModal();
+    await waitFor(() => expect(prepareVersions.length).toBeGreaterThan(0));
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByRole('button', { name: /Upload Firmware/ })).toBeNull();
+  });
+});

frontend/src/__tests__/pages/PrintersPageMachineControlsWiring.test.tsx

@@ -0,0 +1,329 @@
+/**
+ * Machine-control wiring on the printer card: bed / chamber temperature,
+ * fan speeds, airduct mode, chamber light, XY / extruder jog, homing and the
+ * H2D left/right extruder selection.
+ *
+ * Bed jog, nozzle temperature and print speed are covered elsewhere; these
+ * tests pin what reaches the wire for the rest.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 3;
+
+const printerFor = (model: string, extra: Record<string, unknown> = {}) => ({
+  id: PRINTER_ID,
+  name: `Test ${model}`,
+  ip_address: '192.0.2.103',
+  serial_number: '00M09A350100003',
+  access_code: '12345678',
+  model,
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+  ...extra,
+});
+
+const idleStatus = (extra: Record<string, unknown> = {}) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  chamber_light: false,
+  cooling_fan_speed: 0,
+  big_fan1_speed: 0,
+  big_fan2_speed: 0,
+  vt_tray: [],
+  ams: [],
+  ...extra,
+});
+
+type Sent = { path: string; params: Record<string, string> };
+
+function setup(model: string, statusExtra: Record<string, unknown> = {}, printerExtra: Record<string, unknown> = {}) {
+  const sent: Sent[] = [];
+  const record = ({ request }: { request: Request }) => {
+    const url = new URL(request.url);
+    sent.push({
+      path: url.pathname.replace(`/api/v1/printers/${PRINTER_ID}/`, ''),
+      params: Object.fromEntries(url.searchParams.entries()),
+    });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([printerFor(model, printerExtra)])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(idleStatus(statusExtra))),
+    http.post('/api/v1/printers/:id/temperature/bed', record),
+    http.post('/api/v1/printers/:id/temperature/chamber', record),
+    http.post('/api/v1/printers/:id/temperature/nozzle', record),
+    http.post('/api/v1/printers/:id/fan-speed', record),
+    http.post('/api/v1/printers/:id/airduct-mode', record),
+    http.post('/api/v1/printers/:id/chamber-light', record),
+    http.post('/api/v1/printers/:id/xy-jog', record),
+    http.post('/api/v1/printers/:id/extruder-jog', record),
+    http.post('/api/v1/printers/:id/home-axes', record),
+    http.post('/api/v1/printers/:id/bed-jog', record),
+    http.post('/api/v1/printers/:id/select-extruder', record),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+/** Popover container from its title text (title div's parent). */
+async function popover(title: string) {
+  return (await screen.findByText(title)).parentElement as HTMLElement;
+}
+
+async function submitCustom(user: ReturnType<typeof userEvent.setup>, title: string, value: string) {
+  const pop = await popover(title);
+  await user.type(within(pop).getByPlaceholderText('Custom'), value);
+  await user.click(within(pop).getByRole('button', { name: 'Set' }));
+}
+
+describe('PrintersPage machine controls: temperatures', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('bed popover: custom 60 -> POST temperature/bed?target=60 for this printer', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click((await screen.findByText('Bed')).parentElement!);
+    await submitCustom(user, 'Set Bed Temperature', '60');
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'temperature/bed', params: { target: '60' } }]));
+  });
+
+  it('chamber popover on a printer with a chamber heater -> POST temperature/chamber', async () => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', { supports_chamber_heater: true });
+
+    await user.click((await screen.findByText('Chamber')).parentElement!);
+    await submitCustom(user, 'Set Chamber Temperature', '45');
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'temperature/chamber', params: { target: '45' } }]));
+  });
+
+  it('chamber reading on a sensor-only printer opens no temperature control', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { supports_chamber_heater: false });
+
+    await user.click((await screen.findByText('Chamber')).parentElement!);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByText('Set Chamber Temperature')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+
+  it('without printers:control the bed card opens no popover', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click((await screen.findByText('Bed')).parentElement!);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(screen.queryByText('Set Bed Temperature')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage machine controls: fans', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it.each([
+    ['Part Cooling Fan', 'part', '70'],
+    ['Auxiliary Fan', 'aux', '30'],
+    ['Chamber Fan', 'chamber', '55'],
+  ])('%s -> POST fan-speed?fan=%s', async (label, fan, speed) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle(label));
+    await submitCustom(user, `Set ${label} Speed`, speed);
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'fan-speed', params: { fan, speed } }]));
+  });
+});
+
+describe('PrintersPage machine controls: light and airduct', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('chamber light toggle sends on=true when the light is off', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: false });
+
+    await user.click(await screen.findByTitle('Turn on chamber light'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'chamber-light', params: { on: 'true' } }]));
+  });
+
+  it('chamber light toggle sends on=false when the light is on', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: true });
+
+    await user.click(await screen.findByTitle('Turn off chamber light'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'chamber-light', params: { on: 'false' } }]));
+  });
+
+  it('chamber light is disabled without printers:control and sends nothing', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('X1C', { chamber_light: false });
+
+    await screen.findByText('Test X1C');
+    await waitFor(() => expect(screen.getByText('Bed')).toBeInTheDocument());
+    expect(screen.queryByTitle('Turn on chamber light')).toBeNull();
+    const gated = screen
+      .getAllByTitle('You do not have permission to control printers')
+      .filter((el) => el.tagName === 'BUTTON');
+    expect(gated.length).toBeGreaterThan(0);
+    for (const b of gated) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it.each([
+    ['Heating', 'heating', 0],
+    ['Cooling', 'cooling', 1],
+  ])('airduct menu %s -> POST airduct-mode?mode=%s', async (label, mode, current) => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', { airduct_mode: current });
+
+    await user.click(await screen.findByTitle(/^Airduct Mode: /));
+    await user.click(await screen.findByRole('button', { name: label }));
+    await waitFor(() => expect(sent).toEqual([{ path: 'airduct-mode', params: { mode } }]));
+  });
+});
+
+describe('PrintersPage machine controls: movement', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it.each([
+    ['Move Y forward', { x: '0', y: '10' }],
+    ['Move Y back', { x: '0', y: '-10' }],
+    ['Move X left', { x: '-10', y: '0' }],
+    ['Move X right', { x: '10', y: '0' }],
+  ])('%s -> POST xy-jog with the signed default 10 mm step', async (label, params) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText(label));
+    await waitFor(() => expect(sent).toEqual([{ path: 'xy-jog', params }]));
+  });
+
+  it('XY jog uses the selected step size', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByRole('button', { name: '50' }));
+    await user.click(screen.getByLabelText('Move X left'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'xy-jog', params: { x: '-50', y: '0' } }]));
+  });
+
+  it.each([
+    ['Retract filament', '-10'],
+    ['Extrude filament', '10'],
+  ])('%s -> POST extruder-jog?distance=%s', async (label, distance) => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText(label));
+    await waitFor(() => expect(sent).toEqual([{ path: 'extruder-jog', params: { distance } }]));
+  });
+
+  it('Auto Home -> POST home-axes?axes=all', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C');
+
+    await user.click(await screen.findByTitle('Jog Controls'));
+    await user.click(await screen.findByLabelText('Auto Home'));
+    await waitFor(() => expect(sent).toEqual([{ path: 'home-axes', params: { axes: 'all' } }]));
+  });
+
+  it('movement controls are not reachable while printing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('X1C', { state: 'RUNNING' });
+    const trigger = await screen.findByTitle('Disabled while printing');
+    expect(trigger).toBeDisabled();
+    await user.click(trigger);
+    expect(screen.queryByLabelText('Move X left')).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage machine controls: H2D extruder selection', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  const dualStatus = (active: number) => ({
+    temperatures: { nozzle: 25, nozzle_2: 25, bed: 25, chamber: 25 },
+    active_extruder: active,
+  });
+
+  it.each([
+    ['Left', '1', 0],
+    ['Right', '0', 1],
+  ])('selecting %s -> POST select-extruder?extruder=%s', async (label, extruder, active) => {
+    const user = userEvent.setup();
+    const sent = setup('H2D', dualStatus(active), { nozzle_count: 2 });
+
+    const card = await screen.findByTitle(/^Active: /);
+    fireEvent.click(card);
+    const pop = await popover('Set Nozzle Selection');
+    await user.click(within(pop).getByRole('button', { name: label }));
+
+    await waitFor(() => expect(sent).toEqual([{ path: 'select-extruder', params: { extruder } }]));
+  });
+});

frontend/src/__tests__/pages/PrintersPagePlateCheckWiring.test.tsx

@@ -0,0 +1,374 @@
+/**
+ * Build-plate check wiring on the printer card.
+ *
+ * Opening the check turns the chamber light on when it is off (the camera
+ * needs it), then asks the backend for a check with the debug image. Closing
+ * the result (X, Close or Escape) must turn the light back off -- but only if
+ * the check was what turned it on. A failed check must restore the light too.
+ * From the result modal: calibrate, delete a reference and save the ROI all
+ * name THIS printer.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, within, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 9;
+// Opening with the light off waits 2.5 s for the camera before checking.
+const LIGHT_WAIT = { timeout: 6000 };
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Plate X1C',
+  ip_address: '192.0.2.109',
+  serial_number: '00M09A350100009',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  plate_detection_enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusWithLight = (on: boolean) => ({
+  connected: true,
+  state: 'IDLE',
+  progress: 0,
+  layer_num: 0,
+  total_layers: 0,
+  temperatures: { nozzle: 25, bed: 25, chamber: 25 },
+  remaining_time: 0,
+  filename: null,
+  wifi_signal: -50,
+  speed_level: 2,
+  chamber_light: on,
+  vt_tray: [],
+  ams: [],
+});
+
+const emptyResult = {
+  is_empty: true,
+  confidence: 0.93,
+  difference_percent: 1.2,
+  message: 'Plate is empty',
+  has_debug_image: false,
+  needs_calibration: false,
+  failure_reason: null,
+  reference_count: 2,
+  max_references: 5,
+  roi: { x: 0.1, y: 0.2, w: 0.6, h: 0.5 },
+};
+
+type Sent = { method: string; path: string; params: Record<string, string>; body: unknown };
+
+interface SetupOptions {
+  lightOn?: boolean;
+  checkResult?: Record<string, unknown>;
+  checkStatus?: number;
+}
+
+function setup({ lightOn = false, checkResult = emptyResult, checkStatus = 200 }: SetupOptions = {}) {
+  const sent: Sent[] = [];
+  const log = async (request: Request) => {
+    const url = new URL(request.url);
+    const text = request.method === 'GET' ? '' : await request.text();
+    sent.push({
+      method: request.method,
+      path: url.pathname.replace(`/api/v1/printers/${PRINTER_ID}`, ''),
+      params: Object.fromEntries(url.searchParams.entries()),
+      body: text ? JSON.parse(text) : null,
+    });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusWithLight(lightOn))),
+    http.post('/api/v1/printers/:id/chamber-light', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'ok' });
+    }),
+    http.get('/api/v1/printers/:id/camera/check-plate', async ({ request }) => {
+      await log(request);
+      if (checkStatus !== 200) {
+        return HttpResponse.json({ detail: 'Camera unreachable' }, { status: checkStatus });
+      }
+      return HttpResponse.json(checkResult);
+    }),
+    http.get('/api/v1/printers/:id/camera/plate-detection/references', () =>
+      HttpResponse.json({
+        references: [
+          { index: 0, label: 'Textured', timestamp: '2024-01-01T00:00:00Z', has_image: true, thumbnail_url: '' },
+          { index: 3, label: 'Smooth', timestamp: '2024-01-02T00:00:00Z', has_image: true, thumbnail_url: '' },
+        ],
+        max_references: 5,
+      })
+    ),
+    http.get('/api/v1/printers/:id/camera/plate-detection/references/:index/thumbnail', () =>
+      new HttpResponse(null, { status: 204 })
+    ),
+    http.post('/api/v1/printers/:id/camera/plate-detection/calibrate', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'Calibrated', index: 2 });
+    }),
+    http.delete('/api/v1/printers/:id/camera/plate-detection/references/:index', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json({ success: true, message: 'Deleted' });
+    }),
+    http.patch('/api/v1/printers/:id', async ({ request }) => {
+      await log(request);
+      return HttpResponse.json(mockPrinter);
+    }),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+const light = (on: boolean) => ({ method: 'POST', path: '/chamber-light', params: { on: String(on) }, body: null });
+const check = { method: 'GET', path: '/camera/check-plate', params: { include_debug_image: 'true' }, body: null };
+
+async function openCheck(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByTitle('Manage plate detection calibration'));
+}
+
+function modal() {
+  return screen.getByText('Build Plate Check').closest('div.max-w-lg') as HTMLElement;
+}
+
+describe('PrintersPage plate check: chamber light handling', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('light off: turns it on, then checks with the debug image; X turns it back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check', {}, LIGHT_WAIT);
+    expect(sent).toEqual([light(true), check]);
+
+    // The header X is the first button in the modal.
+    await user.click(within(modal()).getAllByRole('button')[0]);
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+  });
+
+  it('light off: Escape closes the result and turns the light back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check', {}, LIGHT_WAIT);
+    fireEvent.keyDown(window, { key: 'Escape' });
+
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+  });
+
+  it('light already on: no chamber-light request on open or on close', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+
+    await openCheck(user);
+    await screen.findByText('Build Plate Check');
+    await user.click(within(modal()).getByRole('button', { name: 'Close' }));
+    await waitFor(() => expect(screen.queryByText('Build Plate Check')).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+
+  it('check failure (500): error toast, no modal, and the light it turned on goes back off', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: false, checkStatus: 500 });
+
+    await openCheck(user);
+    expect(await screen.findByText('Camera unreachable', {}, LIGHT_WAIT)).toBeInTheDocument();
+    await waitFor(() => expect(sent).toEqual([light(true), check, light(false)]));
+    expect(screen.queryByText('Build Plate Check')).toBeNull();
+  });
+
+  it('check failure with the light already on sends no chamber-light request', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true, checkStatus: 500 });
+
+    await openCheck(user);
+    expect(await screen.findByText('Camera unreachable')).toBeInTheDocument();
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+
+  it('without printers:update the check button is disabled and sends nothing', async () => {
+    permissions.denied = new Set(['printers:update']);
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+
+    const buttons = (await screen.findAllByTitle('You do not have permission to update printers')).filter(
+      (el) => el.tagName === 'BUTTON'
+    );
+    expect(buttons.length).toBeGreaterThanOrEqual(2);
+    for (const b of buttons) {
+      expect(b).toBeDisabled();
+      await user.click(b);
+    }
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('PrintersPage plate check: result rendering', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('empty plate shows the empty verdict', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true });
+    await openCheck(user);
+    expect(await screen.findByText('Plate appears empty')).toBeInTheDocument();
+    expect(screen.queryByText('Objects detected on plate')).toBeNull();
+  });
+
+  it('occupied plate shows objects detected', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, is_empty: false } });
+    await openCheck(user);
+    expect(await screen.findByText('Objects detected on plate')).toBeInTheDocument();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+
+  it('failure_reason shows the could-not-run text instead of a verdict', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, failure_reason: 'no_camera_frame' } });
+    await openCheck(user);
+    expect(await screen.findByText('Plate check could not run')).toBeInTheDocument();
+    expect(screen.getByText('no camera image')).toBeInTheDocument();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+
+  it('needs_calibration shows the calibration prompt and no ROI editor', async () => {
+    const user = userEvent.setup();
+    setup({ lightOn: true, checkResult: { ...emptyResult, needs_calibration: true } });
+    await openCheck(user);
+    expect(await screen.findByText('Calibration Required')).toBeInTheDocument();
+    expect(screen.queryByText('Detection Area (ROI)')).toBeNull();
+    expect(screen.queryByText('Plate appears empty')).toBeNull();
+  });
+});
+
+describe('PrintersPage plate check: calibrate, references, ROI', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('Calibrate Empty Plate -> POST calibrate for this printer, then re-checks', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true, checkResult: { ...emptyResult, needs_calibration: true } });
+    await openCheck(user);
+    await screen.findByText('Calibration Required');
+
+    await user.click(screen.getByRole('button', { name: 'Calibrate Empty Plate' }));
+    // The card never passes a label, so the request carries none.
+    await waitFor(() =>
+      expect(sent).toEqual([
+        check,
+        { method: 'POST', path: '/camera/plate-detection/calibrate', params: {}, body: null },
+        check,
+      ])
+    );
+  });
+
+  it('Add Reference on a calibrated printer also POSTs calibrate', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await user.click(await screen.findByRole('button', { name: /^Add Reference/ }));
+    await waitFor(() =>
+      expect(sent.filter((s) => s.path === '/camera/plate-detection/calibrate')).toHaveLength(1)
+    );
+  });
+
+  it('deleting a reference DELETEs that reference index for this printer, then re-checks', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+
+    // Second saved reference has index 3 (indices are not positions).
+    const deletes = await screen.findAllByTitle('Delete reference');
+    expect(deletes).toHaveLength(2);
+    await user.click(deletes[1]);
+
+    await waitFor(() =>
+      expect(sent).toEqual([
+        check,
+        { method: 'DELETE', path: '/camera/plate-detection/references/3', params: {}, body: null },
+        check,
+      ])
+    );
+  });
+
+  it('Save ROI -> PATCH /printers/{id} {plate_detection_roi}', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await screen.findByText('Detection Area (ROI)');
+
+    await user.click(within(modal()).getByRole('button', { name: 'Edit' }));
+    const sliders = within(modal()).getAllByRole('slider');
+    fireEvent.change(sliders[0], { target: { value: '0.25' } });
+    await user.click(within(modal()).getByRole('button', { name: 'Save' }));
+
+    await waitFor(() =>
+      expect(sent).toContainEqual({
+        method: 'PATCH',
+        path: '',
+        params: {},
+        body: { plate_detection_roi: { x: 0.25, y: 0.2, w: 0.6, h: 0.5 } },
+      })
+    );
+    // and then re-checks with the new area
+    await waitFor(() => expect(sent.at(-1)).toEqual(check));
+  });
+
+  it('cancelling the ROI edit sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup({ lightOn: true });
+    await openCheck(user);
+    await screen.findByText('Detection Area (ROI)');
+
+    await user.click(within(modal()).getByRole('button', { name: 'Edit' }));
+    await user.click(within(modal()).getByRole('button', { name: 'Cancel' }));
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([check]);
+  });
+});

frontend/src/__tests__/pages/PrintersPagePrintControlWiring.test.tsx

@@ -0,0 +1,191 @@
+/**
+ * Print control wiring on the printer card: Stop / Pause / Resume.
+ *
+ * Each button opens a confirm dialog; only confirming may reach the printer,
+ * and the request must name the card's own printer id. Without
+ * `printers:control` the buttons are disabled and nothing can be sent.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../mocks/server';
+
+const permissions = { denied: new Set<string>() };
+
+const mockUseAuth = {
+  user: { id: 1, username: 'operator', permissions: [] as string[] },
+  authEnabled: true,
+  requiresSetup: false,
+  loading: false,
+  isAdmin: false,
+  login: vi.fn(),
+  loginWithToken: vi.fn(),
+  logout: vi.fn(),
+  refreshUser: vi.fn(),
+  refreshAuth: vi.fn(),
+  hasPermission: vi.fn((permission: string) => !permissions.denied.has(permission)),
+  hasAnyPermission: vi.fn(() => true),
+  hasAllPermissions: vi.fn(() => true),
+  canModify: vi.fn(() => true),
+};
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => mockUseAuth };
+});
+
+import { render } from '../utils';
+import { PrintersPage } from '../../pages/PrintersPage';
+
+const PRINTER_ID = 7;
+
+const mockPrinter = {
+  id: PRINTER_ID,
+  name: 'Workshop X1C',
+  ip_address: '192.0.2.100',
+  serial_number: '00M09A350100007',
+  access_code: '12345678',
+  model: 'X1C',
+  enabled: true,
+  nozzle_diameter: 0.4,
+  nozzle_type: 'hardened_steel',
+  auto_archive: true,
+  created_at: '2024-01-01T00:00:00Z',
+  updated_at: '2024-01-01T00:00:00Z',
+};
+
+const statusFor = (state: string) => ({
+  connected: true,
+  state,
+  progress: 40,
+  layer_num: 10,
+  total_layers: 100,
+  temperatures: { nozzle: 220, bed: 60, chamber: 30 },
+  remaining_time: 600,
+  filename: 'part.gcode',
+  wifi_signal: -40,
+  speed_level: 2,
+  vt_tray: [],
+  ams: [],
+});
+
+type Sent = { method: string; path: string };
+
+function setup(state: string): Sent[] {
+  const sent: Sent[] = [];
+  const record = ({ request }: { request: Request }) => {
+    sent.push({ method: request.method, path: new URL(request.url).pathname });
+    return HttpResponse.json({ success: true, message: 'ok' });
+  };
+  server.use(
+    http.get('/api/v1/printers/', () => HttpResponse.json([mockPrinter])),
+    http.get('/api/v1/queue/', () => HttpResponse.json([])),
+    http.get('/api/v1/printers/:id/status', () => HttpResponse.json(statusFor(state))),
+    http.post('/api/v1/printers/:id/print/stop', record),
+    http.post('/api/v1/printers/:id/print/pause', record),
+    http.post('/api/v1/printers/:id/print/resume', record),
+  );
+  render(<PrintersPage />);
+  return sent;
+}
+
+async function controlButton(label: 'Stop' | 'Pause' | 'Resume') {
+  return (await screen.findByRole('button', { name: label })) as HTMLButtonElement;
+}
+
+describe('PrintersPage print control wiring', () => {
+  beforeEach(() => {
+    permissions.denied = new Set();
+  });
+
+  it('Stop -> confirm sends POST /printers/{id}/print/stop for this printer only', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Stop'));
+    // Nothing goes out before the operator confirms.
+    expect(sent).toEqual([]);
+    await user.click(await screen.findByRole('button', { name: 'Stop Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/stop` }])
+    );
+  });
+
+  it('Stop -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Stop'));
+    await user.click(await screen.findByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByRole('button', { name: 'Stop Print' })).toBeNull());
+    // Give any stray mutation a tick to fire.
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it('Pause on a RUNNING printer -> confirm sends /print/pause', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    expect(screen.queryByRole('button', { name: 'Resume' })).toBeNull();
+    await user.click(await controlButton('Pause'));
+    await user.click(await screen.findByRole('button', { name: 'Pause Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/pause` }])
+    );
+  });
+
+  it('Pause -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    await user.click(await controlButton('Pause'));
+    await user.click(await screen.findByRole('button', { name: 'Cancel' }));
+    await waitFor(() => expect(screen.queryByRole('button', { name: 'Pause Print' })).toBeNull());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sent).toEqual([]);
+  });
+
+  it('Resume on a PAUSE printer -> confirm sends /print/resume', async () => {
+    const user = userEvent.setup();
+    const sent = setup('PAUSE');
+
+    await user.click(await controlButton('Resume'));
+    expect(screen.queryByRole('button', { name: 'Pause' })).toBeNull();
+    await user.click(await screen.findByRole('button', { name: 'Resume Print' }));
+
+    await waitFor(() =>
+      expect(sent).toEqual([{ method: 'POST', path: `/api/v1/printers/${PRINTER_ID}/print/resume` }])
+    );
+  });
+
+  it('Stop and Pause are disabled on an IDLE printer', async () => {
+    setup('IDLE');
+    expect(await controlButton('Stop')).toBeDisabled();
+    expect(await controlButton('Pause')).toBeDisabled();
+  });
+
+  it('without printers:control the buttons are disabled and clicking sends nothing', async () => {
+    permissions.denied = new Set(['printers:control']);
+    const user = userEvent.setup();
+    const sent = setup('RUNNING');
+
+    // Disabled buttons carry the permission hint as title, which becomes the
+    // accessible description, not the name.
+    const stop = await controlButton('Stop');
+    const pause = await controlButton('Pause');
+    expect(stop).toBeDisabled();
+    expect(pause).toBeDisabled();
+    expect(stop).toHaveAttribute('title', 'You do not have permission to control printers');
+
+    await user.click(stop);
+    await user.click(pause);
+    expect(screen.queryByRole('button', { name: 'Stop Print' })).toBeNull();
+    expect(screen.queryByRole('button', { name: 'Pause Print' })).toBeNull();
+    expect(sent).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/ProfilesPageWiring.test.tsx

@@ -0,0 +1,308 @@
+/**
+ * ProfilesPage wiring (Bambu Cloud tab): preset create / edit / delete write
+ * to the user's Bambu Cloud account, so pin exactly what each one sends, and
+ * the cloud sign-in / token / logout requests.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { ProfilesPage } from '../../pages/ProfilesPage';
+import { setAuthToken } from '../../api/client';
+
+type Sent = { method: string; path: string; body: unknown };
+
+const USER_PRESET = {
+  setting_id: 'PFUS-wiring-1',
+  name: 'My Wiring PLA @BBL X1C',
+  type: 'filament',
+  version: null,
+  user_id: 'u1',
+  updated_time: null,
+  is_custom: true,
+};
+const BUILTIN_PRESET = {
+  setting_id: 'GFSA00',
+  name: 'Bambu PLA Basic @BBL X1C',
+  type: 'filament',
+  version: null,
+  user_id: null,
+  updated_time: null,
+  is_custom: false,
+};
+
+let sent: Sent[];
+let authenticated: boolean;
+
+async function record(request: Request) {
+  let body: unknown = null;
+  try {
+    body = await request.json();
+  } catch {
+    body = null;
+  }
+  sent.push({ method: request.method, path: new URL(request.url).pathname, body });
+}
+
+const writes = () => sent.filter((s) => s.method !== 'GET');
+
+beforeEach(() => {
+  sent = [];
+  authenticated = true;
+  server.use(
+    http.get('*/api/v1/cloud/status', () =>
+      HttpResponse.json(
+        authenticated
+          ? { is_authenticated: true, email: 'user@example.com', region: 'global' }
+          : { is_authenticated: false, email: null },
+      ),
+    ),
+    http.get('*/api/v1/printers/', () => HttpResponse.json([])),
+    http.get('*/api/v1/cloud/settings', () =>
+      HttpResponse.json({ filament: [USER_PRESET, BUILTIN_PRESET], printer: [], process: [] }),
+    ),
+    http.get('*/api/v1/cloud/settings/:id', ({ params }) =>
+      HttpResponse.json({
+        setting_id: params.id,
+        name: params.id === USER_PRESET.setting_id ? USER_PRESET.name : BUILTIN_PRESET.name,
+        base_id: 'GFSA00',
+        setting: { inherits: BUILTIN_PRESET.name, nozzle_temperature: ['220'] },
+      }),
+    ),
+    http.get('*/api/v1/cloud/fields/:type', () =>
+      HttpResponse.json({ version: '1', description: '', fields: [] }),
+    ),
+    http.post('*/api/v1/cloud/settings', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ setting_id: 'PFUS-new' });
+    }),
+    http.put('*/api/v1/cloud/settings/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ setting_id: USER_PRESET.setting_id });
+    }),
+    http.delete('*/api/v1/cloud/settings/:id', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true });
+    }),
+    http.post('*/api/v1/cloud/login', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({
+        success: false,
+        needs_verification: true,
+        verification_type: 'email',
+        tfa_key: null,
+        message: 'Code sent',
+      });
+    }),
+    http.post('*/api/v1/cloud/verify', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true, needs_verification: false, message: 'ok' });
+    }),
+    http.post('*/api/v1/cloud/token', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ is_authenticated: true, email: 'user@example.com' });
+    }),
+    http.post('*/api/v1/cloud/logout', async ({ request }) => {
+      await record(request);
+      return HttpResponse.json({ success: true });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+async function openUserPreset(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByText(USER_PRESET.name));
+  // The detail modal's Edit is enabled once the detail has loaded.
+  const edit = await screen.findByRole('button', { name: 'Edit' });
+  await waitFor(() => expect(edit).not.toBeDisabled());
+  return edit;
+}
+
+describe('ProfilesPage wiring: cloud presets', () => {
+  it('New Preset -> Create sends createCloudSetting with type, name, base_id and the settings', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'New Preset' }));
+    await screen.findByText('Create New Preset');
+    const baseSelect = screen.getByText('Base Preset').parentElement!.querySelector('select')!;
+    await user.selectOptions(baseSelect, 'GFSA00');
+    await user.type(screen.getByText('Preset Name').parentElement!.querySelector('input')!, 'Wiring PLA Fast');
+    const create = screen.getByRole('button', { name: 'Create' });
+    await waitFor(() => expect(create).not.toBeDisabled());
+    await user.click(create);
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/settings',
+      body: {
+        type: 'filament',
+        name: 'Wiring PLA Fast',
+        base_id: 'GFSA00',
+        setting: { inherits: BUILTIN_PRESET.name, filament_settings_id: '"Wiring PLA Fast"' },
+      },
+    });
+  });
+
+  it('Create stays disabled without a base preset, so nothing is sent', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'New Preset' }));
+    await screen.findByText('Create New Preset');
+    await user.type(screen.getByText('Preset Name').parentElement!.querySelector('input')!, 'No Base');
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+
+  it('Edit -> Save sends updateCloudSetting(setting_id, { name, setting })', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await openUserPreset(user));
+    const nameInput = await screen.findByDisplayValue(USER_PRESET.name);
+    await user.clear(nameInput);
+    await user.type(nameInput, 'Renamed Wiring PLA');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'PUT',
+      path: '/api/v1/cloud/settings/PFUS-wiring-1',
+      body: {
+        name: 'Renamed Wiring PLA',
+        setting: { inherits: BUILTIN_PRESET.name, nozzle_temperature: ['220'] },
+      },
+    });
+  });
+
+  it('Delete -> confirm sends deleteCloudSetting for that preset', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    const edit = await openUserPreset(user);
+    await user.click(edit.nextElementSibling as HTMLElement);
+    expect(await screen.findByText('Delete this preset?')).toBeInTheDocument();
+    expect(writes()).toEqual([]);
+    await user.click(screen.getByRole('button', { name: 'Delete' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/cloud/settings/PFUS-wiring-1' });
+  });
+
+  it('Delete -> cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    const edit = await openUserPreset(user);
+    await user.click(edit.nextElementSibling as HTMLElement);
+    await screen.findByText('Delete this preset?');
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Delete this preset?')).not.toBeInTheDocument());
+    expect(writes()).toEqual([]);
+  });
+
+  it('built-in presets offer no edit or delete', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByText(BUILTIN_PRESET.name));
+    await screen.findByRole('button', { name: 'Close' });
+    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument();
+  });
+});
+
+describe('ProfilesPage wiring: cloud sign-in', () => {
+  it('login then verify send the credentials, the code and the region', async () => {
+    authenticated = false;
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.type(await screen.findByPlaceholderText('your@email.com'), 'user@example.com');
+    await user.type(screen.getByPlaceholderText('••••••••'), 'test-password-1');
+    await user.selectOptions(screen.getByRole('combobox'), 'china');
+    await user.click(screen.getByRole('button', { name: 'Login' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/login',
+      body: { email: 'user@example.com', password: 'test-password-1', region: 'china' },
+    });
+
+    await user.type(await screen.findByPlaceholderText('000000'), '123456');
+    await user.click(screen.getByRole('button', { name: 'Verify' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(2));
+    expect(writes()[1]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/verify',
+      body: { email: 'user@example.com', code: '123456', region: 'china' },
+    });
+  });
+
+  it('the token route sends cloudSetToken with the token and region', async () => {
+    authenticated = false;
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'Use access token instead' }));
+    await user.type(await screen.findByPlaceholderText('eyJ...'), 'test-token-1');
+    await user.click(screen.getByRole('button', { name: 'Set Token' }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toEqual({
+      method: 'POST',
+      path: '/api/v1/cloud/token',
+      body: { access_token: 'test-token-1', region: 'global' },
+    });
+  });
+
+  it('Logout sends cloudLogout', async () => {
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await user.click(await screen.findByRole('button', { name: 'Logout' }));
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/cloud/logout' });
+  });
+});
+
+describe('ProfilesPage wiring: permissions', () => {
+  it('without cloud:auth, New Preset, Logout, Edit and Delete are disabled', async () => {
+    setAuthToken('test-token-1', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({
+          id: 9,
+          username: 'viewer',
+          is_active: true,
+          is_admin: false,
+          groups: [],
+          permissions: ['cloud:read'],
+          created_at: '2026-01-01T00:00:00Z',
+        }),
+      ),
+    );
+    const user = userEvent.setup();
+    render(<ProfilesPage />);
+
+    await waitFor(() => expect(screen.getByRole('button', { name: 'New Preset' })).toBeDisabled());
+    expect(screen.getByRole('button', { name: 'Logout' })).toBeDisabled();
+
+    await user.click(screen.getByText(USER_PRESET.name));
+    const edit = await screen.findByRole('button', { name: 'Edit' });
+    expect(edit).toBeDisabled();
+    expect(edit.nextElementSibling).toBeDisabled();
+    expect(writes()).toEqual([]);
+  });
+});

frontend/src/__tests__/pages/QueuePageWiring.test.tsx

@@ -0,0 +1,490 @@
+/**
+ * Wiring tests for QueuePage: pin the exact requests behind the row and
+ * bulk actions (stop / cancel / remove / start / clear history / group /
+ * ungroup / resume after failure), that cancelling a destructive confirm
+ * sends nothing, and the permission gates in front of them.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { QueuePage } from '../../pages/QueuePage';
+import { setAuthToken } from '../../api/client';
+
+const baseItem = {
+  id: 1,
+  printer_id: 1,
+  archive_id: 1,
+  position: 1,
+  status: 'pending',
+  scheduled_time: null,
+  require_previous_success: false,
+  auto_off_after: false,
+  manual_start: false,
+  ams_mapping: null,
+  plate_id: null,
+  bed_levelling: 'on',
+  flow_cali: 'off',
+  vibration_cali: true,
+  layer_inspect: false,
+  timelapse: false,
+  use_ams: true,
+  started_at: null,
+  completed_at: null,
+  error_message: null,
+  created_at: '2024-01-01T00:00:00Z',
+  archive_name: 'Pending Job',
+  archive_thumbnail: null,
+  printer_name: 'Test Printer',
+  print_time_seconds: 3600,
+  batch_id: null as number | null,
+  batch_name: null as string | null,
+  created_by_id: null as number | null,
+};
+
+const pendingA = { ...baseItem, id: 11, position: 1, archive_name: 'Pending A' };
+const pendingB = { ...baseItem, id: 12, position: 2, archive_name: 'Pending B' };
+const pendingC = { ...baseItem, id: 13, position: 3, archive_name: 'Pending C' };
+const printing = {
+  ...baseItem,
+  id: 21,
+  position: 0,
+  status: 'printing',
+  started_at: '2024-01-01T10:00:00Z',
+  archive_name: 'Running Job',
+};
+const completedA = {
+  ...baseItem,
+  id: 31,
+  status: 'completed',
+  completed_at: '2024-01-01T09:00:00Z',
+  archive_name: 'Done A',
+};
+const completedB = { ...completedA, id: 32, archive_name: 'Done B' };
+
+const printers = [
+  {
+    id: 1,
+    name: 'Test Printer',
+    ip_address: '192.0.2.100',
+    serial_number: 'TESTSERIAL0001',
+    access_code: '12345678',
+    model: 'X1C',
+    enabled: true,
+    created_at: '2024-01-01T00:00:00Z',
+  },
+];
+
+interface Captured {
+  method: string;
+  path: string;
+  search: string;
+  body?: unknown;
+}
+
+let calls: Captured[];
+
+const capture = async (request: Request) => {
+  const url = new URL(request.url);
+  let body: unknown;
+  if (request.method !== 'GET' && request.method !== 'DELETE') {
+    const text = await request.text();
+    body = text ? JSON.parse(text) : undefined;
+  }
+  calls.push({ method: request.method, path: url.pathname, search: url.search, body });
+};
+
+const mutationCalls = () => calls.filter((c) => c.method !== 'GET');
+
+function useQueue(items: unknown[]) {
+  server.use(http.get('*/api/v1/queue/', () => HttpResponse.json(items)));
+}
+
+beforeEach(() => {
+  calls = [];
+  vi.mocked(localStorage.getItem).mockImplementation((key: string) => {
+    if (key === 'queue.historyCollapsed') return 'false';
+    if (key === 'queue.viewMode') return 'list';
+    return null;
+  });
+  server.use(
+    http.get('*/api/v1/queue/', () => HttpResponse.json([pendingA, printing, completedA])),
+    http.get('*/api/v1/printers/', () => HttpResponse.json(printers)),
+    http.delete('*/api/v1/queue/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok', deleted: true });
+    }),
+    http.post('*/api/v1/queue/batches/:id/ungroup', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ ungrouped_count: 2, message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/batches', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ id: 77, name: 'x', status: 'pending' });
+    }),
+    http.post('*/api/v1/queue/printer/:pid/resume', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ acknowledged: 1, restored: 2 });
+    }),
+    http.post('*/api/v1/queue/:id/cancel', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/:id/stop', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok' });
+    }),
+    http.post('*/api/v1/queue/:id/start', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ ...pendingA, manual_start: false });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+});
+
+/** Selection checkbox of the pending row showing ``name``. */
+function selectBoxFor(name: string): HTMLElement {
+  let el: HTMLElement | null = screen.getByText(name);
+  while (el) {
+    const boxes = el.querySelectorAll<HTMLElement>('button.w-6.h-6.rounded.border');
+    if (boxes.length === 1) return boxes[0];
+    if (boxes.length > 1) break;
+    el = el.parentElement;
+  }
+  throw new Error(`no selection box for ${name}`);
+}
+
+/** The dialog card wrapping a ConfirmModal title. */
+function dialogOf(title: HTMLElement): HTMLElement {
+  return title.closest('div.fixed') as HTMLElement;
+}
+
+describe('QueuePage wiring: row actions', () => {
+  it('Stop on a printing item -> confirm -> POST /queue/{id}/stop for that item', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await user.click(screen.getByTitle('Stop Print'));
+    const dialog = dialogOf(await screen.findByText(/stop the current print "Running Job"/));
+    await user.click(within(dialog).getByRole('button', { name: 'Stop Print' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/21/stop' });
+  });
+
+  it('Stop -> cancel the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await user.click(screen.getByTitle('Stop Print'));
+    const dialog = dialogOf(await screen.findByText(/stop the current print "Running Job"/));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/stop the current print/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Cancel on a pending item -> confirm -> POST /queue/{id}/cancel', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Cancel'));
+    const dialog = dialogOf(await screen.findByText('Are you sure you want to cancel "Pending A"?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel Print' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/11/cancel' });
+  });
+
+  it('Cancel on a pending item -> dismiss the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Cancel'));
+    const dialog = dialogOf(await screen.findByText('Are you sure you want to cancel "Pending A"?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/want to cancel "Pending A"/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Remove on a history item -> confirm -> DELETE /queue/{id}', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await user.click(screen.getByTitle('Remove'));
+    const dialog = dialogOf(await screen.findByText(/remove "Done A" from the queue history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/queue/31' });
+  });
+
+  it('Remove -> cancel the confirm sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await user.click(screen.getByTitle('Remove'));
+    const dialog = dialogOf(await screen.findByText(/remove "Done A" from the queue history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText(/from the queue history/)).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Clear History -> confirm deletes every history item, nothing else', async () => {
+    useQueue([pendingA, completedA, completedB]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done B');
+
+    await user.click(screen.getByRole('button', { name: /clear history/i }));
+    const dialog = dialogOf(await screen.findByText(/remove all 2 item\(s\) from the history/));
+    await user.click(within(dialog).getByRole('button', { name: 'Clear History' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(2));
+    expect(mutationCalls().map((c) => `${c.method} ${c.path}`).sort()).toEqual([
+      'DELETE /api/v1/queue/31',
+      'DELETE /api/v1/queue/32',
+    ]);
+  });
+
+  it('Start Print on a staged item -> POST /queue/{id}/start without skipping the filament check', async () => {
+    useQueue([{ ...pendingA, manual_start: true }]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByTitle('Start Print'));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({
+      method: 'POST',
+      path: '/api/v1/queue/11/start',
+      search: '',
+    });
+  });
+});
+
+describe('QueuePage wiring: batches', () => {
+  it('Group as batch sends createBatch with the typed name and exactly the selected ids', async () => {
+    useQueue([pendingA, pendingB, pendingC]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending C');
+
+    await user.click(selectBoxFor('Pending A'));
+    await user.click(selectBoxFor('Pending C'));
+    await user.click(await screen.findByTitle('Group as batch…'));
+
+    const input = await screen.findByPlaceholderText(/./, { selector: 'input[maxlength="120"]' });
+    await user.clear(input);
+    await user.type(input, 'Weekend run');
+    await user.click(screen.getByRole('button', { name: 'Create batch' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    const call = mutationCalls()[0];
+    expect(call).toMatchObject({ method: 'POST', path: '/api/v1/queue/batches' });
+    expect(call.body).toEqual({ name: 'Weekend run', item_ids: [11, 13] });
+  });
+
+  it('Group as batch is not offered for a single selected item', async () => {
+    useQueue([pendingA, pendingB]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending B');
+
+    await user.click(selectBoxFor('Pending A'));
+    await screen.findByText('1 selected');
+    expect(screen.queryByTitle('Group as batch…')).toBeNull();
+  });
+
+  it('Ungroup -> confirm -> POST /queue/batches/{id}/ungroup', async () => {
+    useQueue([
+      { ...pendingA, batch_id: 55, batch_name: 'Grouped' },
+      { ...pendingB, batch_id: 55, batch_name: 'Grouped' },
+    ]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Grouped');
+
+    await user.click(screen.getByTitle('Ungroup'));
+    const dialog = dialogOf(await screen.findByText('Ungroup batch?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Ungroup' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/batches/55/ungroup' });
+  });
+
+  it('Ungroup -> cancel sends nothing', async () => {
+    useQueue([
+      { ...pendingA, batch_id: 55, batch_name: 'Grouped' },
+      { ...pendingB, batch_id: 55, batch_name: 'Grouped' },
+    ]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Grouped');
+
+    await user.click(screen.getByTitle('Ungroup'));
+    const dialog = dialogOf(await screen.findByText('Ungroup batch?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Ungroup batch?')).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+});
+
+describe('QueuePage wiring: resume after failure', () => {
+  const skipped = (id: number, printerId: number, printerName: string) => ({
+    ...baseItem,
+    id,
+    printer_id: printerId,
+    printer_name: printerName,
+    status: 'skipped',
+    error_message: 'Previous print failed or was aborted',
+    archive_name: `Skipped ${id}`,
+  });
+
+  it('Resume after failure -> confirm -> POST /queue/printer/{printerId}/resume for that printer', async () => {
+    useQueue([pendingA, skipped(41, 1, 'Alpha'), skipped(42, 7, 'Bravo'), skipped(43, 7, 'Bravo')]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+
+    const banner = (await screen.findByText(/Bravo is blocked by a previous-print failure/)).closest(
+      'div.rounded-lg',
+    ) as HTMLElement;
+    await user.click(within(banner).getByRole('button', { name: /Resume after failure/ }));
+    const dialog = dialogOf(await screen.findByText('Resume queue after failure?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Resume after failure' }));
+
+    await waitFor(() => expect(mutationCalls()).toHaveLength(1));
+    expect(mutationCalls()[0]).toMatchObject({ method: 'POST', path: '/api/v1/queue/printer/7/resume' });
+  });
+
+  it('Resume after failure -> cancel sends nothing', async () => {
+    useQueue([pendingA, skipped(42, 7, 'Bravo')]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+
+    await user.click(await screen.findByRole('button', { name: /Resume after failure/ }));
+    const dialog = dialogOf(await screen.findByText('Resume queue after failure?'));
+    await user.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+
+    await waitFor(() => expect(screen.queryByText('Resume queue after failure?')).toBeNull());
+    expect(mutationCalls()).toHaveLength(0);
+  });
+});
+
+describe('QueuePage wiring: permission gates', () => {
+  const signInWith = (permissions: string[], userId = 7) => {
+    setAuthToken('test-token', 'session');
+    server.use(
+      http.get('*/api/v1/auth/status', () =>
+        HttpResponse.json({ auth_enabled: true, requires_setup: false }),
+      ),
+      http.get('*/api/v1/auth/me', () =>
+        HttpResponse.json({ id: userId, username: 'member', is_admin: false, permissions }),
+      ),
+    );
+  };
+
+  it('Clear History is disabled without queue:delete_all and sends nothing when clicked', async () => {
+    signInWith(['queue:read', 'queue:delete_own']);
+    useQueue([completedA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    const clear = screen.getByRole('button', { name: /clear history/i });
+    expect(clear).toBeDisabled();
+    await user.click(clear);
+    expect(screen.queryByText(/from the history\?/)).toBeNull();
+    expect(mutationCalls()).toHaveLength(0);
+  });
+
+  it('Clear History is enabled with queue:delete_all', async () => {
+    signInWith(['queue:read', 'queue:delete_all']);
+    useQueue([completedA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await user.click(await screen.findByRole('button', { name: /^History/ }));
+    await screen.findByText('Done A');
+
+    await waitFor(() => expect(screen.getByRole('button', { name: /clear history/i })).toBeEnabled());
+  });
+
+  it("Stop is disabled on someone else's print without queue:update_all", async () => {
+    signInWith(['queue:read', 'queue:update_own'], 7);
+    useQueue([{ ...printing, created_by_id: 99 }]);
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    const stop = await screen.findByTitle('You do not have permission to stop prints');
+    expect(stop).toBeDisabled();
+  });
+
+  it('Stop stays enabled on the user\'s own print with queue:update_own', async () => {
+    signInWith(['queue:read', 'queue:update_own'], 7);
+    useQueue([{ ...printing, created_by_id: 7 }]);
+    render(<QueuePage />);
+    await screen.findByText('Running Job');
+
+    await waitFor(() => expect(screen.getByTitle('Stop Print')).toBeEnabled());
+  });
+
+  it('Reorder arrows are hidden without queue:reorder and shown with it', async () => {
+    signInWith(['queue:read']);
+    useQueue([pendingA, pendingB]);
+    const { unmount } = render(<QueuePage />);
+    await screen.findByText('Pending B');
+    expect(screen.queryByTitle('Move Down')).toBeNull();
+    unmount();
+
+    signInWith(['queue:read', 'queue:reorder']);
+    render(<QueuePage />);
+    await screen.findByText('Pending B');
+    await waitFor(() => expect(screen.getAllByTitle('Move Down')).toHaveLength(2));
+  });
+
+  it('Resume-after-failure banner is hidden without queue:update_all', async () => {
+    signInWith(['queue:read', 'queue:update_own']);
+    useQueue([
+      pendingA,
+      { ...baseItem, id: 42, status: 'skipped', error_message: 'Previous print failed or was aborted' },
+    ]);
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+    expect(screen.queryByRole('button', { name: /Resume after failure/ })).toBeNull();
+  });
+
+  it('Bulk edit disables auto power off without printers:control', async () => {
+    signInWith(['queue:read', 'queue:update_all']);
+    useQueue([pendingA]);
+    const user = userEvent.setup();
+    render(<QueuePage />);
+    await screen.findByText('Pending A');
+
+    await user.click(screen.getByText('Select All'));
+    await user.click(await screen.findByTitle('Edit Selected'));
+    const row = (await screen.findByText('Auto power off after print')).closest('div') as HTMLElement;
+    for (const btn of within(row).getAllByRole('button')) {
+      expect(btn).toBeDisabled();
+    }
+  });
+});

frontend/src/__tests__/pages/SettingsPageUsersWiring.test.tsx

@@ -0,0 +1,280 @@
+/**
+ * Settings > Users: user and group management and "disable authentication"
+ * send the request for the row/choice that was clicked, cancelling a
+ * destructive dialog sends nothing, and buttons follow the permissions.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { render } from '../utils';
+import { server } from '../mocks/server';
+import { setAuthToken } from '../../api/client';
+import { SettingsPage } from '../../pages/SettingsPage';
+
+type Captured = { method: string; path: string; search: string; body: unknown };
+let captured: Captured[];
+let mePermissions: string[];
+let meIsAdmin: boolean;
+let itemCounts: { archives: number; queue_items: number; library_files: number };
+
+const USERS = [
+  { id: 1, username: 'admin', email: null, role: 'admin', is_admin: true, is_active: true, auth_source: 'local', groups: [{ id: 1, name: 'Administrators' }], created_at: '2026-01-01T00:00:00Z' },
+  { id: 2, username: 'alice', email: 'alice@example.com', role: 'user', is_admin: false, is_active: true, auth_source: 'local', groups: [{ id: 4, name: 'Farm crew' }], created_at: '2026-01-01T00:00:00Z' },
+  { id: 3, username: 'bob', email: null, role: 'user', is_admin: false, is_active: true, auth_source: 'local', groups: [], created_at: '2026-01-01T00:00:00Z' },
+];
+
+const GROUPS = [
+  { id: 1, name: 'Administrators', description: null, is_system: true, permissions: [], user_count: 1, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+  { id: 4, name: 'Farm crew', description: null, is_system: false, permissions: [], user_count: 1, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+  { id: 6, name: 'Night shift', description: null, is_system: false, permissions: [], user_count: 0, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z' },
+];
+
+async function capture(request: Request) {
+  const text = await request.text();
+  const url = new URL(request.url);
+  captured.push({ method: request.method, path: url.pathname, search: url.search, body: text ? JSON.parse(text) : null });
+}
+
+const writes = () => captured.filter((c) => c.method !== 'GET');
+
+function userRow(username: string): HTMLElement {
+  const name = screen
+    .getAllByText(username)
+    .find((el) => el.tagName === 'P' && el.className.includes('truncate') && el.closest('div.py-3'));
+  if (!name) throw new Error(`user row ${username} not found`);
+  return name.closest('div.py-3') as HTMLElement;
+}
+
+function groupRow(name: string): HTMLElement {
+  const label = screen
+    .getAllByText(name)
+    .find((el) => el.tagName === 'SPAN' && el.className === 'text-white font-medium' && el.closest('div.py-3'));
+  if (!label) throw new Error(`group row ${name} not found`);
+  return label.closest('div.py-3') as HTMLElement;
+}
+
+async function openUsersTab() {
+  window.history.replaceState({}, '', '/settings?tab=users');
+  render(<SettingsPage />);
+  await screen.findByText('alice');
+}
+
+beforeEach(() => {
+  captured = [];
+  meIsAdmin = true;
+  mePermissions = ['settings:read', 'users:read', 'users:create', 'users:update', 'users:delete', 'groups:read', 'groups:delete'];
+  itemCounts = { archives: 2, queue_items: 0, library_files: 1 };
+  setAuthToken('test-token', 'session');
+  server.use(
+    http.get('*/api/v1/auth/status', () => HttpResponse.json({ auth_enabled: true, requires_setup: false })),
+    http.get('*/api/v1/auth/me', () =>
+      HttpResponse.json({ ...USERS[0], is_admin: meIsAdmin, permissions: mePermissions }),
+    ),
+    http.get('*/api/v1/users/', () => HttpResponse.json(USERS)),
+    http.get('*/api/v1/groups/', () => HttpResponse.json(GROUPS)),
+    http.get('*/api/v1/users/:id/items-count', () => HttpResponse.json(itemCounts)),
+    http.post('*/api/v1/users/', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(USERS[2]);
+    }),
+    http.patch('*/api/v1/users/:id', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json(USERS[1]);
+    }),
+    http.delete('*/api/v1/users/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.delete('*/api/v1/groups/:id', async ({ request }) => {
+      await capture(request);
+      return new HttpResponse(null, { status: 204 });
+    }),
+    http.post('*/api/v1/auth/disable', async ({ request }) => {
+      await capture(request);
+      return HttpResponse.json({ message: 'ok', auth_enabled: false });
+    }),
+  );
+});
+
+afterEach(() => {
+  setAuthToken(null);
+  window.history.replaceState({}, '', '/');
+});
+
+describe('SettingsPage users & groups wiring', () => {
+  it('create user sends username, password and the ticked group ids', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(screen.getByRole('button', { name: /add user/i }));
+    await user.type(screen.getByPlaceholderText('Enter username'), 'carol');
+    await user.type(screen.getByPlaceholderText('Enter password'), 'Test-password-1');
+    await user.type(screen.getByPlaceholderText('Confirm password'), 'Test-password-1');
+    const modal = screen.getByPlaceholderText('Enter username').closest('div.space-y-3') as HTMLElement;
+    await user.click(within(modal).getByRole('checkbox', { name: /night shift/i }));
+    await user.click(screen.getByRole('button', { name: /create user/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/users/' });
+    expect(writes()[0].body).toEqual({
+      username: 'carol',
+      password: 'Test-password-1',
+      role: 'user',
+      group_ids: [6],
+    });
+  });
+
+  it('create user is blocked while the passwords differ', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(screen.getByRole('button', { name: /add user/i }));
+    await user.type(screen.getByPlaceholderText('Enter username'), 'carol');
+    await user.type(screen.getByPlaceholderText('Enter password'), 'Test-password-1');
+    await user.type(screen.getByPlaceholderText('Confirm password'), 'Test-password-2');
+    const create = screen.getByRole('button', { name: /create user/i });
+    expect(create).toBeDisabled();
+    await user.click(create);
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('edit user PATCHes that user without a password when it is left blank', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const [editBtn] = within(userRow('alice')).getAllByRole('button');
+    await user.click(editBtn);
+    const name = await screen.findByDisplayValue('alice');
+    await user.clear(name);
+    await user.type(name, 'alice2');
+    await user.click(screen.getByRole('button', { name: /save changes/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'PATCH', path: '/api/v1/users/2' });
+    expect(writes()[0].body).toEqual({
+      username: 'alice2',
+      email: 'alice@example.com',
+      role: 'user',
+      group_ids: [4],
+    });
+    expect(writes()[0].body).not.toHaveProperty('password');
+  });
+
+  it('delete user with items: "delete items" choice sends delete_items=true for that user', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('bob')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await user.click(await screen.findByRole('button', { name: /delete user and their items/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/users/3', search: '?delete_items=true' });
+  });
+
+  it('delete user with items: "keep items" choice sends delete_items=false', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('alice')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await user.click(await screen.findByRole('button', { name: /keep items/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/users/2', search: '?delete_items=false' });
+  });
+
+  it('cancelling the delete-user dialog sends nothing', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const buttons = within(userRow('bob')).getAllByRole('button');
+    await user.click(buttons[buttons.length - 1]);
+    await screen.findByRole('button', { name: /delete user and their items/i });
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+
+    await waitFor(() =>
+      expect(screen.queryByRole('button', { name: /delete user and their items/i })).not.toBeInTheDocument(),
+    );
+    expect(writes()).toHaveLength(0);
+  });
+
+  it('the signed-in user has no delete button on their own row', async () => {
+    await openUsersTab();
+    // Only the edit button
+    expect(within(userRow('admin')).getAllByRole('button')).toHaveLength(1);
+  });
+
+  it('delete group asks first, then DELETEs that group; cancel sends nothing', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    // System groups: edit only, no delete button
+    expect(within(groupRow('Administrators')).getAllByRole('button')).toHaveLength(1);
+    const deleteNightShift = () => {
+      const buttons = within(groupRow('Night shift')).getAllByRole('button');
+      expect(buttons).toHaveLength(2);
+      return buttons[1];
+    };
+
+    await user.click(deleteNightShift());
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(deleteNightShift());
+    await user.click(screen.getByRole('button', { name: /^delete group$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'DELETE', path: '/api/v1/groups/6' });
+  });
+
+  it('disable authentication asks first; cancel sends nothing, confirm POSTs /auth/disable', async () => {
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    await user.click(await screen.findByRole('button', { name: /^disable$/i }));
+    await user.click(screen.getByRole('button', { name: /^cancel$/i }));
+    expect(writes()).toHaveLength(0);
+
+    await user.click(screen.getByRole('button', { name: /^disable$/i }));
+    await user.click(screen.getByRole('button', { name: /^disable authentication$/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/disable' });
+  });
+
+  it('reset password (advanced auth) POSTs {user_id} of the user being edited', async () => {
+    server.use(
+      http.get('*/api/v1/auth/advanced-auth/status', () =>
+        HttpResponse.json({ advanced_auth_enabled: true, smtp_configured: true, local_login_enabled: true, autologin_provider_id: null }),
+      ),
+      http.post('*/api/v1/auth/reset-password', async ({ request }) => {
+        await capture(request);
+        return HttpResponse.json({ message: 'sent' });
+      }),
+    );
+    const user = userEvent.setup();
+    await openUsersTab();
+
+    const [editBtn] = within(userRow('alice')).getAllByRole('button');
+    await user.click(editBtn);
+    await user.click(await screen.findByRole('button', { name: /reset password/i }));
+
+    await waitFor(() => expect(writes()).toHaveLength(1));
+    expect(writes()[0]).toMatchObject({ method: 'POST', path: '/api/v1/auth/reset-password', body: { user_id: 2 } });
+  });
+
+  it('without create/delete permissions there is no add-user, delete-user, delete-group or disable-auth button', async () => {
+    meIsAdmin = false;
+    mePermissions = ['settings:read', 'users:read', 'users:update', 'groups:read'];
+    await openUsersTab();
+
+    expect(screen.queryByRole('button', { name: /add user/i })).not.toBeInTheDocument();
+    // Edit only
+    expect(within(userRow('bob')).getAllByRole('button')).toHaveLength(1);
+    expect(within(groupRow('Night shift')).queryAllByRole('button')).toHaveLength(0);
+    expect(screen.queryByRole('button', { name: /^disable$/i })).not.toBeInTheDocument();
+  });
+});

frontend/src/__tests__/pages/SetupPageWiring.test.tsx

@@ -0,0 +1,104 @@
+/**
+ * First-run setup: the request that creates the admin account (or turns
+ * authentication off) is exactly what the form says, and invalid input
+ * sends nothing.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { render } from '../utils';
+import { api } from '../../api/client';
+import { SetupPage } from '../../pages/SetupPage';
+
+describe('SetupPage wiring', () => {
+  let setup: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    setup = vi
+      .spyOn(api, 'setupAuth')
+      .mockResolvedValue({ auth_enabled: true, admin_created: true } as never);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('with auth enabled sends auth_enabled:true plus the typed admin credentials', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.type(screen.getByLabelText(/admin password/i), 'test-password-1');
+    await user.type(screen.getByLabelText(/^confirm password/i), 'test-password-1');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: true,
+      admin_username: 'admin-test',
+      admin_password: 'test-password-1',
+    });
+  });
+
+  it('mismatched passwords send nothing and show an error', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.type(screen.getByLabelText(/admin password/i), 'test-password-1');
+    await user.type(screen.getByLabelText(/^confirm password/i), 'test-password-2');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    expect(await screen.findByText(/passwords do not match/i)).toBeInTheDocument();
+    expect(setup).not.toHaveBeenCalled();
+  });
+
+  it('a username without a password sends nothing', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    expect(await screen.findByText(/please enter both admin username and password/i)).toBeInTheDocument();
+    expect(setup).not.toHaveBeenCalled();
+  });
+
+  it('enabled with both fields empty sends auth_enabled:true and no credentials (use existing admins)', async () => {
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: true,
+      admin_username: '',
+      admin_password: '',
+    });
+  });
+
+  it('skipping auth sends auth_enabled:false and never the typed credentials', async () => {
+    setup.mockResolvedValue({ auth_enabled: false, admin_created: false } as never);
+    const user = userEvent.setup();
+    render(<SetupPage />);
+
+    // Type credentials, then untick: they must not leave the browser
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.type(screen.getByLabelText(/admin username/i), 'admin-test');
+    await user.click(screen.getByLabelText(/enable authentication/i));
+    await user.click(screen.getByRole('button', { name: /complete setup/i }));
+
+    await waitFor(() => expect(setup).toHaveBeenCalledTimes(1));
+    expect(setup).toHaveBeenCalledWith({
+      auth_enabled: false,
+      admin_username: undefined,
+      admin_password: undefined,
+    });
+  });
+});

frontend/src/__tests__/pages/SpoolBuddyAmsPageWiring.test.tsx

@@ -0,0 +1,211 @@
+/**
+ * Wiring tests for SpoolBuddyAmsPage slot actions: Unassign (built-in
+ * inventory), Unassign (Spoolman slot-only assignment) and Unlink (Spoolman
+ * tag link) must each call their own API with the picked slot's ids.
+ * Harness mirrors SpoolBuddyAmsPage.test.tsx.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, render } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter, Route, Routes, Outlet } from 'react-router-dom';
+import { ToastProvider } from '../../contexts/ToastContext';
+import { SpoolBuddyAmsPage } from '../../pages/spoolbuddy/SpoolBuddyAmsPage';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => ({ hasPermission: () => true }) };
+});
+vi.mock('../../components/AssignSpoolModal', () => ({ AssignSpoolModal: () => null }));
+vi.mock('../../components/LinkSpoolModal', () => ({ LinkSpoolModal: () => null }));
+vi.mock('../../components/ConfigureAmsSlotModal', () => ({ ConfigureAmsSlotModal: () => null }));
+
+const mutations = {
+  unassignSpool: vi.fn(),
+  unassignSpoolmanSlot: vi.fn(),
+  unlinkSpool: vi.fn(),
+};
+let apiResponses: Record<string, unknown> = {};
+let spoolmanStatusValue = { enabled: false, connected: false };
+
+vi.mock('../../api/client', () => ({
+  api: new Proxy({} as Record<string, unknown>, {
+    get: (_t, p: string) => {
+      if (p === 'getSpoolmanStatus') return () => Promise.resolve(spoolmanStatusValue);
+      if (p in mutations) return mutations[p as keyof typeof mutations];
+      if (p in apiResponses) return () => Promise.resolve(apiResponses[p]);
+      return () => Promise.resolve(null);
+    },
+  }),
+}));
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: string | Record<string, unknown>) =>
+      typeof fallback === 'string' ? fallback : key,
+    i18n: { language: 'en', changeLanguage: vi.fn() },
+  }),
+}));
+
+vi.mock('../../contexts/ToastContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/ToastContext')>();
+  return { ...actual, useToast: () => ({ showToast: vi.fn() }) };
+});
+
+const outletContext = {
+  selectedPrinterId: 3,
+  setSelectedPrinterId: vi.fn(),
+  sbState: {
+    weight: null, weightStable: false, rawAdc: null, matchedSpool: null, unknownTagUid: null,
+    unknownTrayUuid: null, deviceOnline: true, deviceId: 'dev-1', remainingWeight: null, netWeight: null,
+  },
+  setAlert: vi.fn(),
+  displayBrightness: 100,
+  setDisplayBrightness: vi.fn(),
+  displayBlankTimeout: 0,
+  setDisplayBlankTimeout: vi.fn(),
+};
+
+function renderPage() {
+  function Wrapper() {
+    return <Outlet context={outletContext} />;
+  }
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: 0 } } });
+  return render(
+    <ToastProvider>
+      <QueryClientProvider client={qc}>
+        <MemoryRouter initialEntries={['/spoolbuddy/ams']}>
+          <Routes>
+            <Route element={<Wrapper />}>
+              <Route path="spoolbuddy/ams" element={<SpoolBuddyAmsPage />} />
+            </Route>
+          </Routes>
+        </MemoryRouter>
+      </QueryClientProvider>
+    </ToastProvider>,
+  );
+}
+
+// Third slot is a non-RFID PLA spool (no tray_uuid), so Assign/Unassign are offered.
+function printerStatus() {
+  const blank = { tray_type: '' };
+  return {
+    connected: true,
+    state: 'IDLE',
+    ams: [{
+      id: 1, humidity: 30, temp: 25,
+      tray: [
+        { id: 0, ...blank },
+        { id: 1, ...blank },
+        { id: 2, tray_type: 'PLA', tray_color: '00FF00FF', tray_sub_brands: 'PLA Basic', remain: 50 },
+        { id: 3, ...blank },
+      ],
+    }],
+    vt_tray: [],
+    tray_now: 255,
+    active_extruder: 0,
+  };
+}
+
+async function openSlot(n: number) {
+  const slots = await screen.findAllByTestId('ams-slot');
+  fireEvent.click(slots[n - 1]);
+}
+
+describe('SpoolBuddyAmsPage slot-action wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mutations.unassignSpool.mockResolvedValue({ success: true });
+    mutations.unassignSpoolmanSlot.mockResolvedValue({ success: true });
+    mutations.unlinkSpool.mockResolvedValue({ success: true, message: 'ok' });
+    spoolmanStatusValue = { enabled: false, connected: false };
+    apiResponses = {
+      getPrinterStatus: printerStatus(),
+      getPrinter: { id: 3, name: 'P', serial_number: 'SN3', nozzle_count: 1 },
+      getSlotPresets: {},
+      getSettings: {},
+      getLinkedSpools: { linked: {} },
+      getAssignments: [],
+      getSpoolmanSlotAssignments: [],
+      getSpoolmanInventorySpools: [],
+    };
+  });
+
+  it('built-in: Unassign sends unassignSpool(printerId, amsId, trayId) of the picked slot', async () => {
+    apiResponses.getAssignments = [
+      {
+        id: 77, spool_id: 12, printer_id: 3, ams_id: 1, tray_id: 2,
+        spool: { id: 12, material: 'PLA', label_weight: 1000, weight_used: 100, rgba: '00FF00FF' },
+      },
+    ];
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove inventory spool from this slot'));
+
+    await waitFor(() => expect(mutations.unassignSpool).toHaveBeenCalledTimes(1));
+    expect(mutations.unassignSpool).toHaveBeenCalledWith(3, 1, 2);
+    expect(mutations.unassignSpoolmanSlot).not.toHaveBeenCalled();
+    expect(mutations.unlinkSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman slot-only assignment: Unassign sends unassignSpoolmanSlot(spoolmanSpoolId)', async () => {
+    spoolmanStatusValue = { enabled: true, connected: true };
+    apiResponses.getSpoolmanSlotAssignments = [
+      { printer_id: 3, ams_id: 1, tray_id: 2, spoolman_spool_id: 555 },
+    ];
+    apiResponses.getSpoolmanInventorySpools = [
+      { id: 555, material: 'PLA', label_weight: 1000, weight_used: 200 },
+    ];
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove inventory spool from this slot'));
+
+    await waitFor(() => expect(mutations.unassignSpoolmanSlot).toHaveBeenCalledTimes(1));
+    expect(mutations.unassignSpoolmanSlot).toHaveBeenCalledWith(555);
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+    expect(mutations.unlinkSpool).not.toHaveBeenCalled();
+  });
+
+  it('Spoolman tag-linked spool: Unlink sends unlinkSpool(spoolId) only', async () => {
+    spoolmanStatusValue = { enabled: true, connected: true };
+    const status = printerStatus();
+    (status.ams[0].tray[2] as Record<string, unknown>).tray_uuid = 'AABBCCDDEEFF00112233445566778899';
+    apiResponses.getPrinterStatus = status;
+    apiResponses.getLinkedSpools = {
+      linked: {
+        AABBCCDDEEFF00112233445566778899: {
+          id: 314, material: 'PLA', color_name: 'Green', rgba: '00FF00FF',
+          remaining_weight: 500, filament_weight: 1000,
+        },
+      },
+    };
+    renderPage();
+    await openSlot(3);
+
+    fireEvent.click(await screen.findByText('Remove Spoolman link from this slot'));
+
+    await waitFor(() => expect(mutations.unlinkSpool).toHaveBeenCalledTimes(1));
+    expect(mutations.unlinkSpool).toHaveBeenCalledWith(314);
+    expect(mutations.unassignSpoolmanSlot).not.toHaveBeenCalled();
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+  });
+
+  it('closing the picker without choosing an action sends nothing', async () => {
+    apiResponses.getAssignments = [
+      { id: 77, spool_id: 12, printer_id: 3, ams_id: 1, tray_id: 2, spool: { id: 12, material: 'PLA' } },
+    ];
+    renderPage();
+    await openSlot(3);
+    await screen.findByText('Remove inventory spool from this slot');
+
+    // Backdrop click closes the picker.
+    const backdrop = document.querySelector('.fixed.inset-0.z-50 > .absolute.inset-0') as HTMLElement;
+    fireEvent.click(backdrop);
+
+    await waitFor(() =>
+      expect(screen.queryByText('Remove inventory spool from this slot')).not.toBeInTheDocument(),
+    );
+    expect(mutations.unassignSpool).not.toHaveBeenCalled();
+  });
+});

frontend/src/__tests__/pages/SpoolBuddyWriteTagPage.test.tsx

@@ -286,6 +286,36 @@ describe('SpoolBuddyWriteTagPage', () => {
     mockOutletContext.sbState.deviceOnline = false; // reset
   });
 
+  it('says why a write for a spool linked to its AMS RFID tag is refused (SM-C5)', async () => {
+    const spool = {
+      id: 98,
+      material: 'PLA',
+      label_weight: 1000,
+      weight_used: 0,
+      tag_uid: null,
+      tray_uuid: null,
+      archived_at: null,
+      rgba: 'FF0000FF',
+    };
+    vi.mocked(mockedApi.getSpools).mockResolvedValue([spool as never]);
+    vi.mocked(mockedSpoolbuddyApi.getDevices).mockResolvedValue([
+      { device_id: 'sb-test', hostname: 'sb-test.local' } as never,
+    ]);
+    vi.mocked(mockedSpoolbuddyApi.writeTag).mockRejectedValueOnce(
+      Object.assign(new Error('linked to its Bambu RFID tag'), { status: 409 }),
+    );
+
+    mockOutletContext.sbState.deviceOnline = true;
+    renderPage();
+    await waitFor(() => expect(screen.getByText('PLA')).toBeDefined());
+    fireEvent.click(screen.getByText('PLA'));
+    await waitFor(() => expect((screen.getByText('Write Tag') as HTMLButtonElement).disabled).toBe(false));
+    fireEvent.click(screen.getByText('Write Tag'));
+
+    await waitFor(() => expect(screen.getByText('spoolbuddy.writeTag.linkedToAms')).toBeDefined());
+    mockOutletContext.sbState.deviceOnline = false; // reset
+  });
+
   it('reads from internal inventory when Spoolman mode is OFF (#1439 parity baseline)', async () => {
     vi.mocked(mockedApi.getSpoolmanSettings).mockResolvedValue({
       spoolman_enabled: 'false',
@@ -365,6 +395,23 @@ describe('SpoolBuddyWriteTagPage', () => {
     mockOutletContext.sbState.deviceOnline = false;
   });
 
+  it('leaves a spool linked by its AMS tray UUID out of the untagged list (SM-C5)', async () => {
+    // A Bambu spool created from the AMS is linked by its tray UUID; listed as
+    // untagged, a sticker written to it replaced that link in Spoolman.
+    const spools = [
+      { id: 50, material: 'PLA', label_weight: 1000, weight_used: 0, tag_uid: null, tray_uuid: null, archived_at: null, rgba: 'FF0000FF' },
+      { id: 51, material: 'PLA', label_weight: 1000, weight_used: 0, tag_uid: null, tray_uuid: '9E0B0717BEE94D7887EB1D8DFD1A14F3', archived_at: null, rgba: 'FF0000FF' },
+    ];
+    vi.mocked(mockedApi.getSpools).mockResolvedValue(spools as never);
+    mockOutletContext.sbState.deviceOnline = true;
+    renderPage();
+
+    await waitFor(() => expect(screen.getByText('#50')).toBeDefined());
+    expect(screen.queryByText('#51')).toBeNull();
+
+    mockOutletContext.sbState.deviceOnline = false;
+  });
+
   describe('per-spool tare in Spoolman mode (#2908)', () => {
     beforeEach(() => {
       vi.mocked(mockedApi.getSpoolmanSettings).mockResolvedValue({

frontend/src/__tests__/pages/SpoolBuddyWriteTagPageWiring.test.tsx

@@ -0,0 +1,211 @@
+/**
+ * Wiring tests for SpoolBuddyWriteTagPage: the write request targets the
+ * picked spool on the online device, untag clears the tag on the right
+ * backend, and "create N spools" goes through the bulk endpoint with K-profiles
+ * saved per created spool -- in both built-in and Spoolman inventory modes.
+ * Harness mirrors SpoolBuddyWriteTagPage.test.tsx.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { screen, waitFor, fireEvent, render } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter, Route, Routes, Outlet } from 'react-router-dom';
+import { ToastProvider } from '../../contexts/ToastContext';
+import { SpoolBuddyWriteTagPage } from '../../pages/spoolbuddy/SpoolBuddyWriteTagPage';
+import { api, spoolbuddyApi } from '../../api/client';
+
+vi.mock('../../contexts/AuthContext', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../contexts/AuthContext')>();
+  return { ...actual, useAuth: () => ({ hasPermission: () => true }) };
+});
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getSpools: vi.fn(),
+    createSpool: vi.fn(),
+    bulkCreateSpools: vi.fn(),
+    saveSpoolKProfiles: vi.fn(),
+    linkTagToSpool: vi.fn(),
+    getSpoolmanSettings: vi.fn(),
+    getSpoolmanInventorySpools: vi.fn(),
+    createSpoolmanInventorySpool: vi.fn(),
+    bulkCreateSpoolmanInventorySpools: vi.fn(),
+    saveSpoolmanKProfiles: vi.fn(),
+    linkTagToSpoolmanSpool: vi.fn(),
+    getSpoolCatalog: vi.fn().mockResolvedValue([]),
+    getColorCatalog: vi.fn().mockResolvedValue([]),
+    getLocalPresets: vi.fn().mockResolvedValue({ filament: [] }),
+    getBuiltinFilaments: vi.fn().mockResolvedValue([]),
+    getPrinters: vi.fn().mockResolvedValue([]),
+    getCloudStatus: vi.fn().mockResolvedValue({ is_authenticated: false }),
+    orcaCloudStatus: vi.fn().mockResolvedValue({ connected: false }),
+  },
+  spoolbuddyApi: {
+    getDevices: vi.fn(),
+    writeTag: vi.fn(),
+    cancelWrite: vi.fn(),
+  },
+}));
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: unknown) => (typeof fallback === 'string' ? fallback : key),
+    i18n: { language: 'en', changeLanguage: vi.fn() },
+  }),
+}));
+
+const mApi = api as unknown as Record<string, ReturnType<typeof vi.fn>>;
+const mSb = spoolbuddyApi as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const outletContext = {
+  selectedPrinterId: null,
+  setSelectedPrinterId: vi.fn(),
+  sbState: {
+    weight: null, weightStable: false, rawAdc: null, matchedSpool: null, unknownTagUid: null,
+    deviceOnline: true, deviceId: 'sb-1', remainingWeight: null, netWeight: null,
+  },
+  setAlert: vi.fn(),
+  displayBrightness: 100,
+  setDisplayBrightness: vi.fn(),
+  displayBlankTimeout: 0,
+  setDisplayBlankTimeout: vi.fn(),
+};
+
+function renderPage() {
+  function OutletWrapper() {
+    return <Outlet context={outletContext} />;
+  }
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: 0 } } });
+  return render(
+    <QueryClientProvider client={qc}>
+      <ToastProvider>
+        <MemoryRouter initialEntries={['/spoolbuddy/write-tag']}>
+          <Routes>
+            <Route element={<OutletWrapper />}>
+              <Route path="spoolbuddy/write-tag" element={<SpoolBuddyWriteTagPage />} />
+            </Route>
+          </Routes>
+        </MemoryRouter>
+      </ToastProvider>
+    </QueryClientProvider>,
+  );
+}
+
+function spoolmanMode(on: boolean) {
+  mApi.getSpoolmanSettings.mockResolvedValue({
+    spoolman_enabled: on ? 'true' : 'false',
+    spoolman_url: on ? 'http://spoolman.test' : '',
+  });
+}
+
+const untagged = { id: 31, material: 'PETG', brand: 'Acme', label_weight: 1000, weight_used: 0, tag_uid: null, tray_uuid: null, archived_at: null, rgba: '00FF00FF' };
+const tagged = { id: 32, material: 'ABS', brand: 'Zeta', label_weight: 1000, weight_used: 0, tag_uid: '04AABBCCDD', tray_uuid: null, archived_at: null, rgba: '0000FFFF' };
+
+async function openQuickAddFormWithQuantity(qty: number) {
+  fireEvent.click(screen.getByText('New Spool'));
+  await waitFor(() => expect(screen.getByText('Create Spool')).toBeDefined());
+  const material = screen.getAllByRole('combobox').find((el) => el.querySelector('option[value="PLA"]'));
+  fireEvent.change(material!, { target: { value: 'PLA' } });
+  fireEvent.click(screen.getByText('Full'));
+  await waitFor(() => expect(screen.getByText('Quick Add')).toBeDefined());
+  const quickAddToggle = screen.getByText('Quick Add').parentElement?.querySelector('button');
+  fireEvent.click(quickAddToggle as HTMLElement);
+  const qtyLabel = await screen.findByText('inventory.quantity');
+  const qtyInput = qtyLabel.parentElement!.querySelector('input') as HTMLInputElement;
+  fireEvent.change(qtyInput, { target: { value: String(qty) } });
+}
+
+describe.each([
+  ['built-in', false],
+  ['Spoolman', true],
+])('SpoolBuddyWriteTagPage wiring (%s inventory)', (_label, isSpoolman) => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    spoolmanMode(isSpoolman);
+    const list = [untagged, tagged];
+    mApi.getSpools.mockResolvedValue(list);
+    mApi.getSpoolmanInventorySpools.mockResolvedValue(list);
+    mSb.getDevices.mockResolvedValue([{ device_id: 'sb-1', hostname: 'sb-1.local' }]);
+    mSb.writeTag.mockResolvedValue({ status: 'queued' });
+    mSb.cancelWrite.mockResolvedValue({ status: 'ok' });
+    mApi.linkTagToSpool.mockResolvedValue({});
+    mApi.linkTagToSpoolmanSpool.mockResolvedValue({});
+    mApi.saveSpoolKProfiles.mockResolvedValue([]);
+    mApi.saveSpoolmanKProfiles.mockResolvedValue([]);
+    mApi.bulkCreateSpools.mockResolvedValue([{ id: 501 }, { id: 502 }, { id: 503 }]);
+    mApi.bulkCreateSpoolmanInventorySpools.mockResolvedValue({ created: [{ id: 601 }, { id: 602 }, { id: 603 }], failed: [] });
+    mApi.createSpool.mockResolvedValue({ id: 700, material: 'PLA' });
+    mApi.createSpoolmanInventorySpool.mockResolvedValue({ id: 800, material: 'PLA' });
+  });
+
+  it('Write Tag queues writeTag(deviceId, selectedSpoolId); Cancel sends cancelWrite(deviceId)', async () => {
+    renderPage();
+    fireEvent.click(await screen.findByText('#31'));
+    await waitFor(() => expect((screen.getByText('Write Tag') as HTMLButtonElement).disabled).toBe(false));
+    fireEvent.click(screen.getByText('Write Tag'));
+
+    await waitFor(() => expect(mSb.writeTag).toHaveBeenCalledTimes(1));
+    expect(mSb.writeTag).toHaveBeenCalledWith('sb-1', 31);
+
+    fireEvent.click(await screen.findByText('Cancel'));
+    await waitFor(() => expect(mSb.cancelWrite).toHaveBeenCalledWith('sb-1'));
+  });
+
+  it('Untag on the Replace tab clears the tag via the active backend only', async () => {
+    renderPage();
+    fireEvent.click(screen.getByText('Replace Tag'));
+    fireEvent.click(await screen.findByText('#32'));
+    fireEvent.click(await screen.findByText('Untag Selected Spool'));
+
+    if (isSpoolman) {
+      await waitFor(() =>
+        expect(mApi.linkTagToSpoolmanSpool).toHaveBeenCalledWith(32, { tag_uid: '', tray_uuid: '' }),
+      );
+      expect(mApi.linkTagToSpool).not.toHaveBeenCalled();
+    } else {
+      await waitFor(() =>
+        expect(mApi.linkTagToSpool).toHaveBeenCalledWith(32, { tag_uid: '', tray_uuid: '', data_origin: 'manual' }),
+      );
+      expect(mApi.linkTagToSpoolmanSpool).not.toHaveBeenCalled();
+    }
+    expect(mSb.writeTag).not.toHaveBeenCalled();
+  });
+
+  it('Create with quantity 3 uses the bulk endpoint with N=3 and saves K-profiles for every created spool', async () => {
+    renderPage();
+    await openQuickAddFormWithQuantity(3);
+    fireEvent.click(screen.getAllByText('Create Spool').at(-1)!);
+
+    const bulk = isSpoolman ? mApi.bulkCreateSpoolmanInventorySpools : mApi.bulkCreateSpools;
+    const otherBulk = isSpoolman ? mApi.bulkCreateSpools : mApi.bulkCreateSpoolmanInventorySpools;
+    const saveK = isSpoolman ? mApi.saveSpoolmanKProfiles : mApi.saveSpoolKProfiles;
+    const otherSaveK = isSpoolman ? mApi.saveSpoolKProfiles : mApi.saveSpoolmanKProfiles;
+
+    await waitFor(() => expect(bulk).toHaveBeenCalledTimes(1));
+    const [payload, qty] = bulk.mock.calls[0];
+    expect(qty).toBe(3);
+    expect(payload).toMatchObject({ material: 'PLA', tag_uid: null, tray_uuid: null });
+    expect(otherBulk).not.toHaveBeenCalled();
+    expect(mApi.createSpool).not.toHaveBeenCalled();
+    expect(mApi.createSpoolmanInventorySpool).not.toHaveBeenCalled();
+
+    const ids = isSpoolman ? [601, 602, 603] : [501, 502, 503];
+    await waitFor(() => expect(saveK).toHaveBeenCalledTimes(3));
+    expect(saveK.mock.calls.map((c) => c[0])).toEqual(ids);
+    // No PA profile picked -> each spool's K-profiles are saved as empty.
+    for (const c of saveK.mock.calls) expect(c[1]).toEqual([]);
+    expect(otherSaveK).not.toHaveBeenCalled();
+  });
+
+  it('Create with quantity 1 uses the single-create endpoint', async () => {
+    renderPage();
+    await openQuickAddFormWithQuantity(1);
+    fireEvent.click(screen.getAllByText('Create Spool').at(-1)!);
+
+    const single = isSpoolman ? mApi.createSpoolmanInventorySpool : mApi.createSpool;
+    await waitFor(() => expect(single).toHaveBeenCalledTimes(1));
+    expect(mApi.bulkCreateSpools).not.toHaveBeenCalled();
+    expect(mApi.bulkCreateSpoolmanInventorySpools).not.toHaveBeenCalled();
+    const saveK = isSpoolman ? mApi.saveSpoolmanKProfiles : mApi.saveSpoolKProfiles;
+    await waitFor(() => expect(saveK).toHaveBeenCalledWith(isSpoolman ? 800 : 700, []));
+  });
+});