phase: 122_image_documents

**Phase 122 (image documents) — final verification pass: all green. No code changes were needed; defects found: none.**

**Verified (implementation already complete in working tree, reviewed end-to-end):**
- Toggle (`BOR_IMAGES`/`BOR_IMAGE_EXTENSIONS`/`BOR_IMAGE_DIR`, off by default) + `GET /api/config` `images` flag
- Ingest: bytes digest, `image_dir` persistent copy, `content = summary = vision description` (chat-model call; only text embedded), fail-soft skip + `images_failed` counter
- Serve/display: `/api/documents/{id}/image` route (404 matrix), viewer `<img>` + description, Sources 48px lazy thumbnails, chat inline source figure (alt = summary), agent `read` marker
- Prune guard: images-off syncs never prune `is_image` docs

**Test / lint / coverage (exact commands & outcomes):**
- `uv run pytest` → exit 0 (green; note: pytest 9.1.1 `-q` omits the final count line in output — exit code authoritative)
- `uv run pytest --cov=app --cov-report=term-missing` → **2715 passed, exit 0, TOTAL 99%** (>90% gate)
- `uv run ruff check . && uv run pyright` → "All checks passed!" / "0 errors, 0 warnings, 0 informations"
- `uv run pytest tests/e2e/test_image_documents.py -v --no-cov` → **4 passed, exit 0** (isolation)

**Completion criteria:** (1) images=true → described/embedded/displayed docs: ✅ (E2E + integration) · (2) images=false byte-identical + image docs survive sync: ✅ (E2E negative app + unit/integration) · (3) viewer + chat rendering with alt text; failed description skips + logs, sync completes: ✅ · (4) test/lint/coverage gates: ✅ · (5) commit + phase move: deferred to harness per this pass's rules (working tree left uncommitted).

**Notable deviation (pre-existing, documented in code):** image route uses `require_user` (phase-79 posture, same gate as the document content endpoint) rather than the phase text's "public" parenthetical — matches the endpoint it mirrors.

**Next pending phase:** `123_chat_image_questions`.

alembic/versions/0022_documents_image.py

@@ -0,0 +1,54 @@
+"""documents image columns: is_image + image_path (phase 122, task 02)
+
+Revision ID: 0022
+Revises: 0021
+Create Date: 2026-09-24
+
+Phase 122 (standalone images become first-class documents — task 02,
+storage only):
+
+* ``documents.is_image`` — BOOLEAN NOT NULL, server default
+  ``false``: True iff the doc is a standalone image (LOCKED A3) whose
+  ``content``/``summary`` is the CHAT model's vision description — the
+  ONLY embedded text (the embedding model never sees pixels). The
+  server default makes EVERY pre-phase-122 row a text doc without a
+  backfill.
+* ``documents.image_path`` — TEXT NULLABLE: the absolute path of the
+  image's persistent copy in ``settings.image_dir`` (``<doc-id>.<ext>``
+  — the copy must outlive the source file: uploads are replaced on
+  every upload, git checkouts are re-cloned). NULL for text docs.
+
+One additive, fully reversible migration (A13); no other schema
+change. The walk filter, the binary index path, and the prune guard
+are importer code (task 02) — this revision only carries the columns.
+"""
+from __future__ import annotations
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "0022"
+down_revision = "0021"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "documents",
+        sa.Column(
+            "is_image",
+            sa.Boolean(),
+            server_default=sa.text("false"),
+            nullable=False,
+        ),
+    )
+    op.add_column("documents", sa.Column("image_path", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    # Both columns are the only 0022 artefacts — dropping them leaves
+    # 0021's schema byte-identical (A13, fully reversible).
+    op.drop_column("documents", "image_path")
+    op.drop_column("documents", "is_image")