fix(multiuser): do not let progress status of one user's session leak into another's

[lstein]

Summary

In multiuser mode, one user's generation activity leaked into other users' personal UI. The most visible symptom: when an unprivileged user generated an image to their private board, an admin's selected board would switch to that user's board and display the new image. Beyond that, other users' activity animated everyone's progress bar, busy favicon, and invoke-button spinner, cleared in-flight progress displays, and (for admins) raised other users' failure toasts.

Principle applied throughout: events may keep other users' caches fresh (and admins may observe all activity in the queue list), but personal UI — board/image selection, progress indicators, toasts — only follows the current user's own actions. Single-user mode is unaffected.

Changes

Gallery auto-switch

• onInvocationComplete now only auto-switches boards / selects the new image when the completion event belongs to the current user. Admins receive all users' completion events (needed to keep their gallery caches fresh) but no longer have their selection hijacked.

Invocation event routing

• InvocationProgressEvent is emitted only to the owner's room. It drives personal UI exclusively (global progress bar, workflow editor current-image node, image viewer progress image), and no admin UI consumes other users' progress. This also removes the previous image-stripped admin copy.
• Started/complete/error events still go to owner + admins, but via a single emit to a room list. python-socketio dedupes recipients, so an admin owner (including the system user in single-user mode) now receives exactly one copy instead of two — the duplicate delivery previously clobbered the owner's progress image with the stripped admin copy and processed completions twice.
• Another user's completion no longer clears the current user's progress indicator.

Queue status counts

• The status endpoint now returns user_pending/user_in_progress for every caller, admins included. A new fail-closed is_admin flag on get_queue_status() disables current-item redaction for admins so they keep visibility of other users' current item while gaining their own counts; user_id without the flag behaves exactly as before.
• The progress bar, busy favicon/tab title, and floating invoke button spinner prefer the per-user counts, so they only react to the user's own queue items.
• Queue status embedded in socket events never carries per-user counts; when patching the RTK cache from an event, previously-fetched per-user counts are retained instead of being nulled.

Model load events

• ModelLoadStartedEvent/ModelLoadCompleteEvent now carry the user_id whose action triggered the load (threaded from the invocation context's queue item and the prompt-expand / image-to-prompt / model-convert endpoints) and are routed to that user's room instead of broadcast to every client. Previously any user's model load forced everyone's progress bar into indeterminate mode. Install/download events remain broadcast (the model manager UI is not per-user).
• schema.ts / openapi.json regenerated for the new event field.

Terminal-status side effects

• The failure toast and progress reset on completed/failed/canceled queue items now fire only for the current user's own items. Admins previously got other users' error toasts; failures remain visible to admins in the queue list.

Testing

• New backend tests: invocation/model-load event routing (owner-only progress, single deduped emit to owner+admin, owner-only load events, installs still broadcast), admin queue-status scoping (own counts + unredacted current item).
• New frontend tests: ownership gating in onInvocationComplete (no board switch / progress clear for foreign events, caches still updated; own and single-user events unaffected), per-user count retention in queue status cache patches.
• Full suites pass: 1212 backend, 1305 frontend; ruff/tsc/eslint/prettier clean.
• Manually verified in a two-user multiuser setup: bystander and admin progress bars/favicons stay idle during another user's generation (including model-load phase), board selection no longer jumps, own-activity indicators and single-user behavior unchanged.

🤖 Generated with Claude Code