phase: 122_image_documents

**Phase 122 (image documents) — final verification pass: all green. No code changes were needed; defects found: none.**

**Verified (implementation already complete in working tree, reviewed end-to-end):**
- Toggle (`BOR_IMAGES`/`BOR_IMAGE_EXTENSIONS`/`BOR_IMAGE_DIR`, off by default) + `GET /api/config` `images` flag
- Ingest: bytes digest, `image_dir` persistent copy, `content = summary = vision description` (chat-model call; only text embedded), fail-soft skip + `images_failed` counter
- Serve/display: `/api/documents/{id}/image` route (404 matrix), viewer `<img>` + description, Sources 48px lazy thumbnails, chat inline source figure (alt = summary), agent `read` marker
- Prune guard: images-off syncs never prune `is_image` docs

**Test / lint / coverage (exact commands & outcomes):**
- `uv run pytest` → exit 0 (green; note: pytest 9.1.1 `-q` omits the final count line in output — exit code authoritative)
- `uv run pytest --cov=app --cov-report=term-missing` → **2715 passed, exit 0, TOTAL 99%** (>90% gate)
- `uv run ruff check . && uv run pyright` → "All checks passed!" / "0 errors, 0 warnings, 0 informations"
- `uv run pytest tests/e2e/test_image_documents.py -v --no-cov` → **4 passed, exit 0** (isolation)

**Completion criteria:** (1) images=true → described/embedded/displayed docs: ✅ (E2E + integration) · (2) images=false byte-identical + image docs survive sync: ✅ (E2E negative app + unit/integration) · (3) viewer + chat rendering with alt text; failed description skips + logs, sync completes: ✅ · (4) test/lint/coverage gates: ✅ · (5) commit + phase move: deferred to harness per this pass's rules (working tree left uncommitted).

**Notable deviation (pre-existing, documented in code):** image route uses `require_user` (phase-79 posture, same gate as the document content endpoint) rather than the phase text's "public" parenthetical — matches the endpoint it mirrors.

**Next pending phase:** `123_chat_image_questions`.

app/models.py

@@ -139,6 +139,29 @@ class Document(Base):
     #: failed, and until the phase-118 backfill stores one on the next
     #: sync.
     summary: Mapped[str | None] = mapped_column(Text, default=None)
+    #: True iff this document is a standalone image (phase 122,
+    #: LOCKED A3): ``content`` (and ``summary``) is the CHAT model's
+    #: vision description of the image — the ONLY embedded text (the
+    #: embedding model never sees pixels), and the image bytes
+    #: themselves live at :py:attr:`image_path` (served by the document
+    #: image route, task 04). ``False`` for every text document,
+    #: including all pre-phase-122 rows (the server default keeps them
+    #: valid without a backfill). An ``is_image`` doc is INVISIBLE to
+    #: an images-off walk, not a deleted file — the importer's prune
+    #: guard (the phase-122 derived decision) protects it while the
+    #: toggle is off.
+    is_image: Mapped[bool] = mapped_column(
+        Boolean, default=False, server_default=text("false"), nullable=False
+    )
+    #: Absolute path of the image's PERSISTENT copy in
+    #: ``settings.image_dir`` (phase 122) — the importer copies each
+    #: ingested image there (``<doc-id>.<ext>``) because the source
+    #: file is disposable: uploads are replaced on every upload, git
+    #: checkouts are re-cloned, local dirs are user-edited. The copy is
+    #: written only when the doc is new or its hash changes, deleted on
+    #: a content change (the stale copy) and on prune. NULL for text
+    #: documents.
+    image_path: Mapped[str | None] = mapped_column(Text, default=None)
 
     chunks: Mapped[list[Chunk]] = relationship(
         back_populates="document", cascade="all, delete-orphan"