phase: 122_image_documents

**Phase 122 (image documents) — final verification pass: all green. No code changes were needed; defects found: none.**

**Verified (implementation already complete in working tree, reviewed end-to-end):**
- Toggle (`BOR_IMAGES`/`BOR_IMAGE_EXTENSIONS`/`BOR_IMAGE_DIR`, off by default) + `GET /api/config` `images` flag
- Ingest: bytes digest, `image_dir` persistent copy, `content = summary = vision description` (chat-model call; only text embedded), fail-soft skip + `images_failed` counter
- Serve/display: `/api/documents/{id}/image` route (404 matrix), viewer `<img>` + description, Sources 48px lazy thumbnails, chat inline source figure (alt = summary), agent `read` marker
- Prune guard: images-off syncs never prune `is_image` docs

**Test / lint / coverage (exact commands & outcomes):**
- `uv run pytest` → exit 0 (green; note: pytest 9.1.1 `-q` omits the final count line in output — exit code authoritative)
- `uv run pytest --cov=app --cov-report=term-missing` → **2715 passed, exit 0, TOTAL 99%** (>90% gate)
- `uv run ruff check . && uv run pyright` → "All checks passed!" / "0 errors, 0 warnings, 0 informations"
- `uv run pytest tests/e2e/test_image_documents.py -v --no-cov` → **4 passed, exit 0** (isolation)

**Completion criteria:** (1) images=true → described/embedded/displayed docs: ✅ (E2E + integration) · (2) images=false byte-identical + image docs survive sync: ✅ (E2E negative app + unit/integration) · (3) viewer + chat rendering with alt text; failed description skips + logs, sync completes: ✅ · (4) test/lint/coverage gates: ✅ · (5) commit + phase move: deferred to harness per this pass's rules (working tree left uncommitted).

**Notable deviation (pre-existing, documented in code):** image route uses `require_user` (phase-79 posture, same gate as the document content endpoint) rather than the phase text's "public" parenthetical — matches the endpoint it mirrors.

**Next pending phase:** `123_chat_image_questions`.

tests/e2e/test_configurable_brand.py

@@ -149,27 +149,29 @@ def test_api_config_serves_both_names(testy_server: str, app_server: str) -> Non
     # "Save as doc" gating; both instances run with BOR_DOCS_REPO
     # empty, so it is the inert false here. Phase 62 (task 01): the
     # endpoint grew with the UI-customization keys; phase 91
-    # (task 03) deleted the retired CSS-file theming's ``theme`` key —
-    # the five keys below are the entire contract (this suite's
-    # instances carry no UI-customization overrides, so the string
-    # keys are their defaults).
+    # (task 03) deleted the retired CSS-file theming's ``theme`` key;
+    # phase 122 (task 01) added the ``images`` flag (inert false here
+    # — neither instance sets BOR_IMAGES) — the six keys below are
+    # the entire contract (this suite's instances carry no
+    # UI-customization overrides, so the string keys are their
+    # defaults).
     assert set(body) == {
         "app_name", "version", "docs_repo_configured",
-        "input_placeholder", "footer_text",
+        "images", "input_placeholder", "footer_text",
     }
     assert body["app_name"] == TESTY_NAME
     assert body["docs_repo_configured"] is False
+    assert body["images"] is False
 
     # The shared conftest instance keeps the default (the other
     # suites' title/label contract rides on it) — and its key set
-    # tracks the endpoint contract (five keys after phase 91,
-    # task 03).
+    # tracks the endpoint contract (six keys after phase 122, task 01).
     r2 = httpx.get(f"{app_server}/api/config", timeout=5)
     assert r2.status_code == 200
     r2_body = r2.json()
     assert set(r2_body) == {
         "app_name", "version", "docs_repo_configured",
-        "input_placeholder", "footer_text",
+        "images", "input_placeholder", "footer_text",
     }
     assert r2_body["app_name"] == DEFAULT_NAME