Round 40 review findings (5 P1 + 1 P2 + 3 P3):
P1:
1. routes/export.py: wrap /export/merged, /export/base, /export/gguf,
/export/lora in a public-load window so backend.export_*() running
in a worker thread cannot be torn down by a concurrent workload that
sees is_export_active() == False during the pre-active gap.
2. utils/datasets/llm_assist.py: add public_load_pending_for(workload)
helper. routes/inference.py: _release_export_for now refuses 503
when export is mid-handoff.
3. models/models.py: AddScanFolderRequest.path now rejects control
characters and embedded hf_ tokens before being logged or reflected.
4. models/training.py: local_datasets and local_eval_datasets list
entries get the same control-char / embedded-token validators that
model_name / hf_dataset already have.
5. models/training.py: format_type joins the validator list (copied
into training_kwargs and into trainer log lines).
6. models/export.py: _validate_save_directory now rejects embedded hf_
tokens (already covered other identifier fields).
P2:
7. images-page.tsx:162: defer the mount fetchAndUpdateStatus call
through setTimeout(..., 0) so it does not trip
react-hooks/set-state-in-effect on scoped lint.
P3 cleanup:
8. core/inference/diffusion.py: drop unused gguf_basename assignment.
9. core/inference/diffusion.py + routes/inference.py: drop unused
owned_names computation from the chat-release helpers; the final
sweep intentionally no longer filters by that snapshot.
784a9ed71c