phase: 122_image_documents

**Phase 122 (image documents) — final verification pass: all green. No code changes were needed; defects found: none.**

**Verified (implementation already complete in working tree, reviewed end-to-end):**
- Toggle (`BOR_IMAGES`/`BOR_IMAGE_EXTENSIONS`/`BOR_IMAGE_DIR`, off by default) + `GET /api/config` `images` flag
- Ingest: bytes digest, `image_dir` persistent copy, `content = summary = vision description` (chat-model call; only text embedded), fail-soft skip + `images_failed` counter
- Serve/display: `/api/documents/{id}/image` route (404 matrix), viewer `<img>` + description, Sources 48px lazy thumbnails, chat inline source figure (alt = summary), agent `read` marker
- Prune guard: images-off syncs never prune `is_image` docs

**Test / lint / coverage (exact commands & outcomes):**
- `uv run pytest` → exit 0 (green; note: pytest 9.1.1 `-q` omits the final count line in output — exit code authoritative)
- `uv run pytest --cov=app --cov-report=term-missing` → **2715 passed, exit 0, TOTAL 99%** (>90% gate)
- `uv run ruff check . && uv run pyright` → "All checks passed!" / "0 errors, 0 warnings, 0 informations"
- `uv run pytest tests/e2e/test_image_documents.py -v --no-cov` → **4 passed, exit 0** (isolation)

**Completion criteria:** (1) images=true → described/embedded/displayed docs: ✅ (E2E + integration) · (2) images=false byte-identical + image docs survive sync: ✅ (E2E negative app + unit/integration) · (3) viewer + chat rendering with alt text; failed description skips + logs, sync completes: ✅ · (4) test/lint/coverage gates: ✅ · (5) commit + phase move: deferred to harness per this pass's rules (working tree left uncommitted).

**Notable deviation (pre-existing, documented in code):** image route uses `require_user` (phase-79 posture, same gate as the document content endpoint) rather than the phase text's "public" parenthetical — matches the endpoint it mirrors.

**Next pending phase:** `123_chat_image_questions`.

frontend/assets/document.js

@@ -102,6 +102,22 @@
  * call — the phase-57 split). ONE shared core — the modal and
  * /document.html both get it (document-modal.js imports
  * renderDocument from this module — no per-surface copy).
+ *
+ * Phase 122 (task 04): image documents — when doc.is_image is true,
+ * #doc-content renders the persistent bytes FIRST (the <img> block
+ * from doc.image_url — the /api/documents/{id}/image route — alt =
+ * the summary, the WCAG alt contract; a NULL summary falls back to
+ * the title), and the description (doc.content — the ONLY readable
+ * text of the doc) follows in the EXISTING plain-content slot below
+ * (the .doc-raw path; a description is prose, not markdown). The
+ * labeled Summary panel is suppressed for the verbatim-description
+ * case (summary === content — the importer invariant; the panel
+ * would duplicate the text right below the image); an admin-edited
+ * summary (different text) still renders in its panel with the
+ * phase-57 edit affordance. An <img> load failure (the route's 404 —
+ * the row exists but the copy was lost) swaps the block for a small
+ * "Image unavailable" note (role=status): the page still shows the
+ * description. ONE shared core — page + modal both get it.
  */
 
 import { bindSharedHeaderControls, fetchIsAdmin, initSharedHeader } from "./header.js";
@@ -189,12 +205,25 @@ export function renderDocument(doc, { titleEl, metaEl, contentEl }) {
   });
 
   contentEl.replaceChildren();
+  // Phase 122 (task 04): an image document — the persistent bytes
+  // render as the <img> block FIRST; the description (= doc.content)
+  // follows in the normal content slot below (the plain-content path
+  // — the last branch in this function).
+  if (doc.is_image) {
+    contentEl.appendChild(docImageBlock(doc));
+  }
   // Phase 36: the summary panel — labeled section ABOVE the original
   // content, on BOTH surfaces (page + modal) through this one core.
   // Only a non-empty summary renders: markdown docs carry none (phase
   // 30) and the fail-soft path leaves summary NULL, so both are
-  // byte-for-byte unchanged here.
-  if (doc.summary && doc.summary.trim() !== "") {
+  // byte-for-byte unchanged here. Phase 122 (task 04): for an IMAGE
+  // doc whose summary IS the verbatim description (summary ===
+  // content — the importer invariant), the panel would duplicate the
+  // text right below the image, so it is suppressed; an admin-edited
+  // summary (different text) still renders with the phase-57 edit
+  // affordance.
+  const imageSummaryIsContent = doc.is_image && doc.summary === doc.content;
+  if (doc.summary && doc.summary.trim() !== "" && !imageSummaryIsContent) {
     const section = document.createElement("section");
     section.className = "doc-summary";
     section.setAttribute("aria-label", "Summary");
@@ -228,6 +257,40 @@ export function renderDocument(doc, { titleEl, metaEl, contentEl }) {
   }
 }
 
+/* ---------- image block (phase 122, task 04) ----------
+ * The viewer's image block for an ``is_image`` document: the
+ * document's PERSISTENT bytes (doc.image_url — the
+ * /api/documents/{id}/image route) as a block <img> (max-width 100%;
+ * the theme's surface treatment lives in .doc-image). alt = the
+ * summary (the vision description — the WCAG alt contract everywhere);
+ * a NULL summary (the fail-soft backfill corner) falls back to the
+ * title. On a load failure (the route's 404 — the row exists but the
+ * copy was lost) the block shows a small "Image unavailable."
+ * note (role=status) in its place; the description in the content
+ * slot below still renders (the doc is still readable). Properties
+ * only (src, alt) — every document-derived value is a text node /
+ * property, never innerHTML (the XSS contract, unchanged). */
+function docImageBlock(doc) {
+  const wrap = document.createElement("div");
+  wrap.className = "doc-image";
+  const img = document.createElement("img");
+  img.className = "doc-image-img";
+  img.src = doc.image_url;
+  img.alt =
+    typeof doc.summary === "string" && doc.summary.trim() !== ""
+      ? doc.summary
+      : doc.title;
+  img.addEventListener("error", () => {
+    const note = document.createElement("p");
+    note.className = "doc-image-unavailable";
+    note.setAttribute("role", "status");
+    note.textContent = "Image unavailable — the file is missing.";
+    wrap.replaceChildren(note);
+  });
+  wrap.appendChild(img);
+  return wrap;
+}
+
 /* ---------- summary editing (phase 57, task 02 — D4, admin-only) ----------
  * The .doc-summary panel is the ONE place the stored summary is edited
  * (page + modal through this core). Only an admin (docAdminReady) ever