diff --git a/client/src/components/BaseComponents/Form/GFormInput.vue b/client/src/components/BaseComponents/Form/GFormInput.vue
index 2df280c0952..d14f44de2ca 100644
--- a/client/src/components/BaseComponents/Form/GFormInput.vue
+++ b/client/src/components/BaseComponents/Form/GFormInput.vue
@@ -10,7 +10,7 @@ const emit = defineEmits<{
     (e: "keydown", event: KeyboardEvent): void;
 }>();
 
-const inputRef = ref<HTMLInputElement | null>(null);
+const inputElement = ref<HTMLInputElement | null>(null);
 
 const inputValue = computed({
     get() {
@@ -21,17 +21,15 @@ const inputValue = computed({
     },
 });
 
-function focus() {
-    inputRef.value?.focus();
-}
-
 defineExpose({
-    focus,
+    focus() {
+        inputElement.value?.focus();
+    },
 });
 </script>
 
 <template>
-    <input ref="inputRef" v-model="inputValue" class="g-form-input" @keydown="(event) => emit('keydown', event)" />
+    <input ref="inputElement" v-model="inputValue" class="g-form-input" @keydown="(event) => emit('keydown', event)" />
 </template>
 
 <style scoped lang="scss">
diff --git a/client/src/components/Collections/pairing.ts b/client/src/components/Collections/pairing.ts
index 351aab5288e..872fd2bfff1 100644
--- a/client/src/components/Collections/pairing.ts
+++ b/client/src/components/Collections/pairing.ts
@@ -3,6 +3,7 @@ import type { GenericPair } from "@/components/Collections/common/buildCollectio
 export const COMMON_FILTERS = {
     illumina: ["_1", "_2"] as [string, string],
     Rs: ["_R1", "_R2"] as [string, string],
+    Fs: ["_F", "_R"] as [string, string],
     dot12s: [".1.fastq", ".2.fastq"] as [string, string],
 };
 export type CommonFiltersType = keyof typeof COMMON_FILTERS;
@@ -16,6 +17,7 @@ export function guessInitialFilterType(elements: HasName[]): CommonFiltersType |
     let illumina = 0;
     let dot12s = 0;
     let Rs = 0;
+    let Fs = 0;
 
     //should we limit the forEach? What if there are 1000s of elements?
     elements.forEach((element) => {
@@ -23,19 +25,23 @@ export function guessInitialFilterType(elements: HasName[]): CommonFiltersType |
             dot12s++;
         } else if (element.name?.includes("_R1") || element.name?.includes("_R2")) {
             Rs++;
+        } else if (element.name?.includes("_F") || element.name?.includes("_R")) {
+            Fs++;
         } else if (element.name?.includes("_1") || element.name?.includes("_2")) {
             illumina++;
         }
     });
     // if we cannot filter don't set an initial filter and hide all the data
-    if (illumina === 0 && dot12s === 0 && Rs === 0) {
+    if (illumina === 0 && dot12s === 0 && Rs === 0 && Fs === 0) {
         return null;
-    } else if (illumina > dot12s && illumina > Rs) {
+    } else if (illumina > dot12s && illumina > Rs && illumina > Fs) {
         return "illumina";
-    } else if (dot12s > illumina && dot12s > Rs) {
+    } else if (dot12s > illumina && dot12s > Rs && dot12s > Fs) {
         return "dot12s";
-    } else if (Rs > illumina && Rs > dot12s) {
+    } else if (Rs > illumina && Rs > dot12s && Rs > Fs) {
         return "Rs";
+    } else if (Fs > illumina && Fs > dot12s && Fs > Rs) {
+        return "Fs";
     } else {
         return "illumina";
     }
diff --git a/client/src/components/Common/DelayedInput.test.ts b/client/src/components/Common/DelayedInput.test.ts
new file mode 100644
index 00000000000..44bc1c37a2d
--- /dev/null
+++ b/client/src/components/Common/DelayedInput.test.ts
@@ -0,0 +1,30 @@
+import { getLocalVue } from "@tests/vitest/helpers";
+import { mount } from "@vue/test-utils";
+import { describe, expect, it } from "vitest";
+import { nextTick } from "vue";
+
+import DelayedInput from "./DelayedInput.vue";
+
+const localVue = getLocalVue();
+
+function mountDelayedInput(props = {}) {
+    return mount(DelayedInput as object, {
+        localVue,
+        propsData: {
+            value: "test query",
+            ...props,
+        },
+    });
+}
+
+describe("DelayedInput.vue", () => {
+    it("clears search and refocuses without error", async () => {
+        const wrapper = mountDelayedInput();
+
+        await wrapper.find("button.search-clear").trigger("click");
+        await nextTick();
+
+        expect(wrapper.find("input.g-form-input").exists()).toBe(true);
+        expect((wrapper.find("input.g-form-input").element as HTMLInputElement).value).toBe("");
+    });
+});
diff --git a/client/src/components/Common/DelayedInput.vue b/client/src/components/Common/DelayedInput.vue
index 7559adbc5e9..77cc8219916 100644
--- a/client/src/components/Common/DelayedInput.vue
+++ b/client/src/components/Common/DelayedInput.vue
@@ -38,7 +38,7 @@ const queryInput = ref<string>();
 const queryTimer = ref<ReturnType<typeof setTimeout> | null>(null);
 const titleClear = ref("Clear Search (esc)");
 const titleAdvanced = ref("Toggle Advanced Search");
-const toolInput = ref<HTMLInputElement | null>(null);
+const toolInput = ref<InstanceType<typeof GFormInput> | null>(null);
 
 function clearTimer() {
     if (queryTimer.value) {
diff --git a/client/src/components/ConfigTemplates/formUtil.test.ts b/client/src/components/ConfigTemplates/formUtil.test.ts
index 25ae969ef13..cf6e9acbd24 100644
--- a/client/src/components/ConfigTemplates/formUtil.test.ts
+++ b/client/src/components/ConfigTemplates/formUtil.test.ts
@@ -2,7 +2,13 @@ import { describe, expect, it } from "vitest";
 
 import type { TemplateSecret, TemplateVariable } from "@/api/configTemplates";
 
-import { createTemplateForm, templateSecretFormEntry, templateVariableFormEntry, upgradeForm } from "./formUtil";
+import {
+    createTemplateForm,
+    formDataTypedGet,
+    templateSecretFormEntry,
+    templateVariableFormEntry,
+    upgradeForm,
+} from "./formUtil";
 import {
     GENERIC_FTP_FILE_SOURCE_TEMPLATE,
     OBJECT_STORE_INSTANCE,
@@ -98,6 +104,24 @@ describe("formUtils", () => {
             const formEntry = templateVariableFormEntry(hostVariable, "mycoolhost.org");
             expect(formEntry.value).toBe("mycoolhost.org");
         });
+        it("should render optional integer with no default as empty string", () => {
+            const optionalIntVar: TemplateVariable = {
+                name: "timeout",
+                type: "integer",
+                optional: true,
+            };
+            const formEntry = templateVariableFormEntry(optionalIntVar, undefined);
+            expect(formEntry.value).toBe("");
+        });
+        it("should render required integer with no default as 0", () => {
+            const requiredIntVar: TemplateVariable = {
+                name: "timeout",
+                type: "integer",
+                optional: false,
+            };
+            const formEntry = templateVariableFormEntry(requiredIntVar, undefined);
+            expect(formEntry.value).toBe(0);
+        });
     });
 
     describe("templateVariableFormEntry optional field", () => {
@@ -161,4 +185,34 @@ describe("formUtils", () => {
             expect(formEntry.optional).toBe(false);
         });
     });
+
+    describe("formDataTypedGet", () => {
+        it("should return undefined for an optional integer when the raw value is empty string", () => {
+            const optionalIntVar: TemplateVariable = {
+                name: "timeout",
+                type: "integer",
+                optional: true,
+            };
+            const result = formDataTypedGet(optionalIntVar, { timeout: "" });
+            expect(result).toBeUndefined();
+        });
+
+        it("should return the parsed integer when a valid string value is provided", () => {
+            const intVar: TemplateVariable = {
+                name: "timeout",
+                type: "integer",
+            };
+            const result = formDataTypedGet(intVar, { timeout: "42" });
+            expect(result).toBe(42);
+        });
+
+        it("should return undefined for integer when raw value is null", () => {
+            const intVar: TemplateVariable = {
+                name: "timeout",
+                type: "integer",
+            };
+            const result = formDataTypedGet(intVar, { timeout: null });
+            expect(result).toBeUndefined();
+        });
+    });
 });
diff --git a/client/src/components/ConfigTemplates/formUtil.ts b/client/src/components/ConfigTemplates/formUtil.ts
index a642bb3881d..f192a76c6be 100644
--- a/client/src/components/ConfigTemplates/formUtil.ts
+++ b/client/src/components/ConfigTemplates/formUtil.ts
@@ -65,7 +65,7 @@ export function templateVariableFormEntry(variable: TemplateVariable, variableVa
             ...common_fields,
         };
     } else if (variable.type == "integer") {
-        const defaultValue = variable.default ?? 0;
+        const defaultValue = variable.default ?? (variable.optional ? "" : 0);
         return {
             type: "integer",
             value: variableValue == undefined ? defaultValue : variableValue,
@@ -197,7 +197,7 @@ export function formDataTypedGet(variableDefinition: TemplateVariable, formData:
             return String(rawValue).toLowerCase() == "true";
         }
     } else if (variableType == "integer") {
-        if (rawValue == null || rawValue == undefined || typeof rawValue == "boolean") {
+        if (rawValue == null || rawValue == undefined || rawValue === "" || typeof rawValue == "boolean") {
             return undefined;
         } else {
             if (typeof rawValue == "string") {
diff --git a/client/src/components/FileSources/Instances/InstanceDropdown.test.ts b/client/src/components/FileSources/Instances/InstanceDropdown.test.ts
new file mode 100644
index 00000000000..91e0f6caa32
--- /dev/null
+++ b/client/src/components/FileSources/Instances/InstanceDropdown.test.ts
@@ -0,0 +1,97 @@
+import { getLocalVue } from "@tests/vitest/helpers";
+import { shallowMount } from "@vue/test-utils";
+import flushPromises from "flush-promises";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useServerMock } from "@/api/client/__mocks__";
+import type { UserFileSourceModel } from "@/api/fileSources";
+
+import FileSourceInstanceDropdown from "./InstanceDropdown.vue";
+import ConfigurationInstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
+
+const { toastErrorMock } = vi.hoisted(() => ({
+    toastErrorMock: vi.fn(),
+}));
+
+vi.mock("@/composables/toast", () => ({
+    Toast: {
+        error: toastErrorMock,
+    },
+}));
+
+vi.mock("@/stores/fileSourceTemplatesStore", () => ({
+    useFileSourceTemplatesStore: () => ({
+        canUpgrade: () => false,
+    }),
+}));
+
+const { server, http } = useServerMock();
+
+const FILE_SOURCE: UserFileSourceModel = {
+    uuid: "test-file-source-id",
+    name: "Test File Source",
+    description: null,
+    template_id: "simple_variable",
+    template_version: 0,
+    active: true,
+    hidden: false,
+    purged: false,
+    secrets: [],
+    type: "posix",
+    uri_root: "gxfiles://test-file-source-id",
+    variables: null,
+};
+
+describe("File Source Instance Dropdown", () => {
+    const localVue = getLocalVue(true);
+
+    beforeEach(() => {
+        server.resetHandlers();
+        toastErrorMock.mockClear();
+    });
+
+    it("emits entryRemoved when remove succeeds", async () => {
+        let requestBody: Record<string, unknown> | undefined;
+        server.use(
+            http.put("/api/file_source_instances/{uuid}", async ({ request, response }) => {
+                requestBody = (await request.json()) as Record<string, unknown>;
+                return response(200).json(FILE_SOURCE);
+            }),
+        );
+
+        const wrapper = shallowMount(FileSourceInstanceDropdown as object, {
+            localVue,
+            propsData: {
+                fileSource: FILE_SOURCE,
+            },
+        });
+
+        wrapper.findComponent(ConfigurationInstanceDropdown).vm.$emit("remove");
+        await flushPromises();
+
+        expect(requestBody).toEqual({ hidden: true });
+        expect(wrapper.emitted("entryRemoved")).toBeTruthy();
+        expect(toastErrorMock).not.toHaveBeenCalled();
+    });
+
+    it("shows toast and does not emit entryRemoved when remove fails", async () => {
+        server.use(
+            http.put("/api/file_source_instances/{uuid}", ({ response }) => {
+                return response("4XX").json({ err_code: 400, err_msg: "Unable to remove" }, { status: 400 });
+            }),
+        );
+
+        const wrapper = shallowMount(FileSourceInstanceDropdown as object, {
+            localVue,
+            propsData: {
+                fileSource: FILE_SOURCE,
+            },
+        });
+
+        wrapper.findComponent(ConfigurationInstanceDropdown).vm.$emit("remove");
+        await flushPromises();
+
+        expect(toastErrorMock).toHaveBeenCalledWith("Unable to remove", "Failed to remove instance");
+        expect(wrapper.emitted("entryRemoved")).toBeFalsy();
+    });
+});
diff --git a/client/src/components/FileSources/Instances/InstanceDropdown.vue b/client/src/components/FileSources/Instances/InstanceDropdown.vue
index 6a5135569eb..181e14a2f3f 100644
--- a/client/src/components/FileSources/Instances/InstanceDropdown.vue
+++ b/client/src/components/FileSources/Instances/InstanceDropdown.vue
@@ -3,8 +3,9 @@ import { computed } from "vue";
 
 import { GalaxyApi } from "@/api";
 import type { UserFileSourceModel } from "@/api/fileSources";
+import { Toast } from "@/composables/toast";
 import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
-import { rethrowSimple } from "@/utils/simple-error";
+import { errorMessageAsString } from "@/utils/simple-error";
 
 import InstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
 
@@ -30,7 +31,8 @@ async function onRemove() {
     });
 
     if (error) {
-        rethrowSimple(error);
+        Toast.error(errorMessageAsString(error, "Failed to remove instance."), "Failed to remove instance");
+        return;
     }
 
     emit("entryRemoved");
diff --git a/client/src/components/Libraries/LibraryEditField.vue b/client/src/components/Libraries/LibraryEditField.vue
index b81a106d617..82df974e66a 100644
--- a/client/src/components/Libraries/LibraryEditField.vue
+++ b/client/src/components/Libraries/LibraryEditField.vue
@@ -62,6 +62,9 @@ export default {
             type: Boolean,
         },
     },
+    setup() {
+        return { purify };
+    },
     data() {
         return {
             maxDescriptionLength: MAX_DESCRIPTION_LENGTH,
diff --git a/client/src/components/Libraries/LibraryFolder/LibraryFolder.vue b/client/src/components/Libraries/LibraryFolder/LibraryFolder.vue
index bc241875e0a..2c8a6ff3779 100644
--- a/client/src/components/Libraries/LibraryFolder/LibraryFolder.vue
+++ b/client/src/components/Libraries/LibraryFolder/LibraryFolder.vue
@@ -336,6 +336,9 @@ export default {
             required: false,
         },
     },
+    setup() {
+        return { purify };
+    },
     data() {
         return {
             ...initialFolderState(),
@@ -352,8 +355,6 @@ export default {
                 faTimes,
                 faUnlock,
                 faUsers,
-                // Utilities
-                purify,
                 // Data
                 currentPage: 1,
                 sortBy: "name",
@@ -405,7 +406,6 @@ export default {
         this.getFolder(this.folder_id, this.page);
     },
     methods: {
-        purify,
         getFolder(folder_id, page) {
             this.currentFolderId = folder_id;
             this.currentPage = page;
diff --git a/client/src/components/ObjectStore/Instances/InstanceDropdown.test.ts b/client/src/components/ObjectStore/Instances/InstanceDropdown.test.ts
new file mode 100644
index 00000000000..960eb791c01
--- /dev/null
+++ b/client/src/components/ObjectStore/Instances/InstanceDropdown.test.ts
@@ -0,0 +1,103 @@
+import { getLocalVue } from "@tests/vitest/helpers";
+import { shallowMount } from "@vue/test-utils";
+import flushPromises from "flush-promises";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useServerMock } from "@/api/client/__mocks__";
+
+import type { UserConcreteObjectStore } from "./types";
+
+import ObjectStoreInstanceDropdown from "./InstanceDropdown.vue";
+import ConfigurationInstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
+
+const { toastErrorMock } = vi.hoisted(() => ({
+    toastErrorMock: vi.fn(),
+}));
+
+vi.mock("@/composables/toast", () => ({
+    Toast: {
+        error: toastErrorMock,
+    },
+}));
+
+vi.mock("@/stores/objectStoreTemplatesStore", () => ({
+    useObjectStoreTemplatesStore: () => ({
+        canUpgrade: () => false,
+    }),
+}));
+
+const { server, http } = useServerMock();
+
+const OBJECT_STORE: UserConcreteObjectStore = {
+    uuid: "test-object-store-id",
+    name: "Test Object Store",
+    description: null,
+    template_id: "simple_variable",
+    template_version: 0,
+    active: true,
+    hidden: false,
+    purged: false,
+    private: false,
+    object_store_id: null,
+    device: null,
+    object_expires_after_days: null,
+    badges: [],
+    quota: { enabled: false },
+    secrets: [],
+    type: "disk",
+    variables: null,
+};
+
+describe("Object Store Instance Dropdown", () => {
+    const localVue = getLocalVue(true);
+
+    beforeEach(() => {
+        server.resetHandlers();
+        toastErrorMock.mockClear();
+    });
+
+    it("emits entryRemoved when remove succeeds", async () => {
+        let requestBody: Record<string, unknown> | undefined;
+        server.use(
+            http.put("/api/object_store_instances/{uuid}", async ({ request, response }) => {
+                requestBody = (await request.json()) as Record<string, unknown>;
+                return response(200).json(OBJECT_STORE);
+            }),
+        );
+
+        const wrapper = shallowMount(ObjectStoreInstanceDropdown as object, {
+            localVue,
+            propsData: {
+                objectStore: OBJECT_STORE,
+            },
+        });
+
+        wrapper.findComponent(ConfigurationInstanceDropdown).vm.$emit("remove");
+        await flushPromises();
+
+        expect(requestBody).toEqual({ hidden: true });
+        expect(wrapper.emitted("entryRemoved")).toBeTruthy();
+        expect(toastErrorMock).not.toHaveBeenCalled();
+    });
+
+    it("shows toast and does not emit entryRemoved when remove fails", async () => {
+        server.use(
+            http.put("/api/object_store_instances/{uuid}", ({ response }) => {
+                return response("4XX").json({ err_code: 400, err_msg: "Unable to remove" }, { status: 400 });
+            }),
+        );
+
+        const wrapper = shallowMount(ObjectStoreInstanceDropdown as object, {
+            localVue,
+            propsData: {
+                objectStore: OBJECT_STORE,
+            },
+        });
+
+        wrapper.findComponent(ConfigurationInstanceDropdown).vm.$emit("remove");
+        await flushPromises();
+
+        expect(toastErrorMock).toHaveBeenCalledWith("Unable to remove", "Failed to remove instance");
+        expect(wrapper.emitted("entryRemoved")).toBeFalsy();
+    });
+});
diff --git a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
index aef05a0d50b..4fab7668500 100644
--- a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
+++ b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
@@ -2,8 +2,9 @@
 import { computed } from "vue";
 
 import { GalaxyApi } from "@/api";
+import { Toast } from "@/composables/toast";
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
-import { rethrowSimple } from "@/utils/simple-error";
+import { errorMessageAsString } from "@/utils/simple-error";
 
 import type { UserConcreteObjectStore } from "./types";
 
@@ -29,7 +30,8 @@ async function onRemove() {
     });
 
     if (error) {
-        rethrowSimple(error);
+        Toast.error(errorMessageAsString(error, "Failed to remove instance."), "Failed to remove instance");
+        return;
     }
 
     emit("entryRemoved");
diff --git a/client/src/components/admin/DataManager/DataManagerTable.vue b/client/src/components/admin/DataManager/DataManagerTable.vue
index fd1f77e5ea6..0a00acf1bff 100644
--- a/client/src/components/admin/DataManager/DataManagerTable.vue
+++ b/client/src/components/admin/DataManager/DataManagerTable.vue
@@ -3,9 +3,7 @@
         <BBreadcrumb v-if="dataTable && !loading" id="breadcrumb" :items="breadcrumbItems" />
 
         <Alert :message="message" :variant="status" />
-
-        <Alert v-if="viewOnly" message="Not implemented" variant="dark" />
-        <Alert v-else-if="loading" message="Waiting for data" status="info" />
+        <Alert v-if="loading" message="Waiting for data" status="info" />
         <Alert
             v-else-if="dataTable && !dataTable['data'].length"
             message="There are currently no entries in this tool data table."
@@ -46,10 +44,9 @@
 <script>
 import { faSync } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
-import axios from "axios";
 import { BBreadcrumb, BCard, BCol, BContainer, BRow } from "bootstrap-vue";
 
-import { getAppRoot } from "@/onload/loadConfig";
+import { GalaxyApi } from "@/api";
 
 import Alert from "@/components/Alert.vue";
 import GButton from "@/components/BaseComponents/GButton.vue";
@@ -77,7 +74,6 @@ export default {
         return {
             faSync,
             dataTable: {},
-            viewOnly: false,
             message: "",
             status: "",
             loading: true,
@@ -102,37 +98,42 @@ export default {
             ];
         },
     },
-    created() {
-        axios
-            .get(`${getAppRoot()}data_manager/tool_data_table_info?table_name=${this.name}`)
-            .then((response) => {
-                this.dataTable = response.data.dataTable;
-                this.viewOnly = response.data.viewOnly;
-                this.message = response.data.message;
-                this.status = response.data.status;
-                this.loading = false;
-            })
-            .catch((error) => {
-                console.error(error);
-            });
+    async created() {
+        const { data, error } = await GalaxyApi().GET("/api/tool_data/{table_name}", {
+            params: { path: { table_name: this.name } },
+        });
+        if (error) {
+            this.message = error.err_msg || "Failed to load tool data table.";
+            this.status = "error";
+        } else {
+            this.dataTable = {
+                name: data.name,
+                columns: data.columns,
+                data: data.fields,
+            };
+        }
+        this.loading = false;
     },
     methods: {
         fields(columns) {
             return columns.map((elem, index) => ({ key: index.toString(), label: elem }));
         },
-        reload() {
-            axios
-                .get(`${getAppRoot()}data_manager/reload_tool_data_tables?table_name=${this.dataTableName}`)
-                .then((response) => {
-                    if (response.data.dataTable) {
-                        this.dataTable = response.data.dataTable;
-                    }
-                    this.message = response.data.message;
-                    this.status = response.data.status;
-                })
-                .catch((error) => {
-                    console.error(error);
-                });
+        async reload() {
+            const { data, error } = await GalaxyApi().GET("/api/tool_data/{table_name}/reload", {
+                params: { path: { table_name: this.dataTableName } },
+            });
+            if (error) {
+                this.message = error.err_msg || "Failed to reload tool data table.";
+                this.status = "error";
+            } else {
+                this.dataTable = {
+                    name: data.name,
+                    columns: data.columns,
+                    data: data.fields,
+                };
+                this.message = `Reloaded data table '${data.name}'.`;
+                this.status = "done";
+            }
         },
     },
 };
diff --git a/client/src/components/admin/DataTables.vue b/client/src/components/admin/DataTables.vue
index 808b5577f38..42c9d9a21dc 100644
--- a/client/src/components/admin/DataTables.vue
+++ b/client/src/components/admin/DataTables.vue
@@ -15,6 +15,7 @@
 <script>
 import axios from "axios";
 
+import { GalaxyApi } from "@/api";
 import { getAppRoot } from "@/onload/loadConfig";
 
 import Message from "../Message.vue";
@@ -77,45 +78,41 @@ export default {
 
     methods: {
         showDataManager(dataManagerTableName) {
-            axios
-                .get(`${getAppRoot()}data_manager/tool_data_table_items`, {
-                    params: {
-                        table_name: dataManagerTableName,
-                    },
+            GalaxyApi()
+                .GET("/api/tool_data/{table_name}", {
+                    params: { path: { table_name: dataManagerTableName } },
                 })
-                .then((response) => {
-                    this.message = response.data.message;
-                    this.status = response.data.status;
-
-                    if (response.data.status !== "error" && response.data.status !== "warning") {
+                .then(({ data, error }) => {
+                    if (error) {
+                        this.message = error.err_msg || "Failed to load tool data table.";
+                        this.status = "error";
+                    } else {
                         this.dataManagerTableName = dataManagerTableName;
-                        this.dataManagerColumns = response.data.data.columns;
-                        this.dataManagerItems = response.data.data.items;
+                        this.dataManagerColumns = data.columns;
+                        this.dataManagerItems = data.fields.map((row) =>
+                            Object.fromEntries(data.columns.map((col, i) => [col, row[i]])),
+                        );
                         this.currentView = "data-manager-grid";
                     }
-                })
-                .catch((error) => {
-                    console.error(error);
                 });
         },
 
         reloadDataManager(dataManagerTableName) {
-            axios
-                .get(`${getAppRoot()}data_manager/reload_tool_data_table`, {
-                    params: {
-                        table_name: dataManagerTableName,
-                    },
+            GalaxyApi()
+                .GET("/api/tool_data/{table_name}/reload", {
+                    params: { path: { table_name: dataManagerTableName } },
                 })
-                .then((response) => {
-                    this.message = response.data.message;
-                    this.status = response.data.status;
-
-                    if (response.data.status !== "error" && response.data.status !== "warning") {
-                        this.dataManagerItems = response.data.data.items;
+                .then(({ data, error }) => {
+                    if (error) {
+                        this.message = error.err_msg || "Failed to reload tool data table.";
+                        this.status = "error";
+                    } else {
+                        this.dataManagerItems = data.fields.map((row) =>
+                            Object.fromEntries(data.columns.map((col, i) => [col, row[i]])),
+                        );
+                        this.message = `Reloaded data table '${dataManagerTableName}'.`;
+                        this.status = "done";
                     }
-                })
-                .catch((error) => {
-                    console.error(error);
                 });
         },
     },
diff --git a/client/src/utils/strings.test.ts b/client/src/utils/strings.test.ts
new file mode 100644
index 00000000000..52d9c1f1c89
--- /dev/null
+++ b/client/src/utils/strings.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+
+import { capitalizeFirstLetter } from "./strings";
+
+describe("capitalizeFirstLetter", () => {
+    it("capitalizes a normal string", () => {
+        expect(capitalizeFirstLetter("google")).toBe("Google");
+    });
+
+    it("trims whitespace", () => {
+        expect(capitalizeFirstLetter("  google  ")).toBe("Google");
+    });
+
+    it("returns empty string for undefined input", () => {
+        expect(capitalizeFirstLetter(undefined)).toBe("");
+    });
+
+    it("returns empty string for null input", () => {
+        expect(capitalizeFirstLetter(null as unknown as string)).toBe("");
+    });
+
+    it("returns empty string for empty string", () => {
+        expect(capitalizeFirstLetter("")).toBe("");
+    });
+});
diff --git a/client/src/utils/strings.ts b/client/src/utils/strings.ts
index 083e1002996..80e871912c4 100644
--- a/client/src/utils/strings.ts
+++ b/client/src/utils/strings.ts
@@ -45,7 +45,10 @@ export function snakeCaseToTitleCase(str: string): string {
 /**
  * Capitalize the first letter of a string
  */
-export function capitalizeFirstLetter(str: string): string {
+export function capitalizeFirstLetter(str?: string): string {
+    if (!str) {
+        return "";
+    }
     str = str.trim();
     return str.charAt(0).toUpperCase() + str.slice(1);
 }
diff --git a/doc/source/lib/galaxy.webapps.galaxy.controllers.rst b/doc/source/lib/galaxy.webapps.galaxy.controllers.rst
index aa31d91114d..7f5c530f17a 100644
--- a/doc/source/lib/galaxy.webapps.galaxy.controllers.rst
+++ b/doc/source/lib/galaxy.webapps.galaxy.controllers.rst
@@ -57,14 +57,6 @@ galaxy.webapps.galaxy.controllers.dataset module
    :undoc-members:
    :show-inheritance:
 
-galaxy.webapps.galaxy.controllers.error module
-----------------------------------------------
-
-.. automodule:: galaxy.webapps.galaxy.controllers.error
-   :members:
-   :undoc-members:
-   :show-inheritance:
-
 galaxy.webapps.galaxy.controllers.forms module
 ----------------------------------------------
 
diff --git a/lib/galaxy/celery/tasks.py b/lib/galaxy/celery/tasks.py
index 3d3d6125c86..507fd42ccbd 100644
--- a/lib/galaxy/celery/tasks.py
+++ b/lib/galaxy/celery/tasks.py
@@ -46,6 +46,7 @@ from galaxy.model import (
     Job,
     User,
 )
+from galaxy.model.orm.now import now
 from galaxy.model.scoped_session import galaxy_scoped_session
 from galaxy.objectstore import BaseObjectStore
 from galaxy.objectstore.caching import check_caches
@@ -168,6 +169,9 @@ def purge_history_datasets(
     user = history.user
     if user:
         user.calculate_and_set_disk_usage(object_store)
+        if not request.preserve_owner_update_time:
+            user.update_time = now()
+            sa_session.commit()
     # Remove underlying dataset files from object store
     dataset_manager.purge_datasets(PurgeDatasetsTaskRequest(dataset_ids=dataset_ids))
 
diff --git a/lib/galaxy/datatypes/sequence.py b/lib/galaxy/datatypes/sequence.py
index 8fccd58e066..fed04fa3d0f 100644
--- a/lib/galaxy/datatypes/sequence.py
+++ b/lib/galaxy/datatypes/sequence.py
@@ -44,6 +44,7 @@ from galaxy.datatypes.sniff import (
 from galaxy.exceptions import InvalidFileFormatError
 from galaxy.util import (
     compression_utils,
+    iter_start_of_line,
     nice_size,
 )
 from galaxy.util.checkers import is_gzip
@@ -114,7 +115,7 @@ class Sequence(data.Text):
         data_lines = 0
         sequences = 0
         with compression_utils.get_fileobj(dataset.get_file_name()) as fh:
-            for line in fh:
+            for line in iter_start_of_line(fh, 1):
                 line = line.strip()
                 if line and line.startswith("#"):
                     # We don't count comment lines for sequence data types
@@ -376,7 +377,7 @@ class Fasta(Sequence):
         data_lines = 0
         sequences = 0
         with compression_utils.get_fileobj(dataset.get_file_name()) as fh:
-            for line in fh:
+            for line in iter_start_of_line(fh, 1):
                 if not line:
                     continue
                 elif line[0] == ">":
@@ -738,7 +739,7 @@ class BaseFastq(Sequence):
         data_lines = 0
         sequences = 0
         with compression_utils.get_fileobj(dataset.get_file_name()) as in_file:
-            for line in in_file:
+            for line in iter_start_of_line(in_file, 1):
                 if line.startswith("@") and data_lines % 4 == 0:
                     sequences += 1
                 data_lines += 1
@@ -1290,7 +1291,7 @@ class RNADotPlotMatrix(data.Data):
             coor = False
             pairs = False
             with open(filename) as handle:
-                for line in handle:
+                for line in iter_start_of_line(handle, 9):
                     line = line.strip()
                     if line:
                         if line.startswith("/sequence"):
@@ -1327,12 +1328,13 @@ class DotBracket(Sequence):
         data_lines = 0
         sequences = 0
 
-        for line in open(dataset.get_file_name()):
-            line = line.strip()
-            data_lines += 1
+        with open(dataset.get_file_name()) as fh:
+            for line in iter_start_of_line(fh, 1):
+                line = line.strip()
+                data_lines += 1
 
-            if line and line.startswith(">"):
-                sequences += 1
+                if line and line.startswith(">"):
+                    sequences += 1
 
         dataset.metadata.data_lines = data_lines
         dataset.metadata.sequences = sequences
diff --git a/lib/galaxy/jobs/__init__.py b/lib/galaxy/jobs/__init__.py
index 6943d0ec08c..7208c7471ef 100644
--- a/lib/galaxy/jobs/__init__.py
+++ b/lib/galaxy/jobs/__init__.py
@@ -1794,6 +1794,8 @@ class MinimalJobWrapper(HasResourceParameters):
         # Now that we have the object store id, check if we are over the limit
         self._pause_job_if_over_quota(job)
         self.sa_session.commit()
+        if job.state == model.Job.states.PAUSED:
+            return False
         return True
 
     def _pause_job_if_over_quota(self, job):
diff --git a/lib/galaxy/managers/_config_templates.py b/lib/galaxy/managers/_config_templates.py
index 5b5dda62af0..f3f0cef132d 100644
--- a/lib/galaxy/managers/_config_templates.py
+++ b/lib/galaxy/managers/_config_templates.py
@@ -16,6 +16,7 @@ from typing_extensions import TypedDict
 
 from galaxy.exceptions import (
     InconsistentDatabase,
+    InternalServerError,
     ObjectNotFound,
     RequestParameterInvalidException,
     RequestParameterMissingException,
@@ -277,6 +278,8 @@ def prepare_environment_from_root(
             secret_value = vault.read_secret(template_secret.vault_key) or template_secret.default
             if secret_value:
                 environment[e_name] = secret_value
+            else:
+                raise InternalServerError(f"Failed to retrieve {template_secret.vault_key} from vault")
         elif e_type == "variable":
             template_variable = cast(TemplateEnvironmentVariable, environment_entry)
             variable_value = os.environ.get(template_variable.variable)
@@ -284,6 +287,10 @@ def prepare_environment_from_root(
                 variable_value = template_variable.default
             if variable_value:
                 environment[e_name] = variable_value
+            else:
+                raise InternalServerError(
+                    f"Environment variable {template_variable.variable} not found and no default provided. Please set this variable in the environment or provide a default value in the template definition."
+                )
         else:
             raise Exception(f"Unknown environment entry type detected [{e_type}]")
 
@@ -296,8 +303,9 @@ def update_template_instance(
     payload: UpdateInstancePayload,
     template: Template,
 ):
-    validate_specified_datatypes_variables(payload.variables or {}, template)
-    validate_no_extra_variables_defined(payload.variables or {}, template)
+    if payload.variables is not None:
+        validate_specified_datatypes_variables(payload.variables, template)
+        validate_no_extra_variables_defined(payload.variables, template)
     if payload.name is not None:
         template_instance.name = payload.name
     if payload.description is not None:
diff --git a/lib/galaxy/managers/file_source_instances.py b/lib/galaxy/managers/file_source_instances.py
index 976aa25a7bd..cd23211e798 100644
--- a/lib/galaxy/managers/file_source_instances.py
+++ b/lib/galaxy/managers/file_source_instances.py
@@ -16,7 +16,9 @@ from pydantic import (
 
 from galaxy.exceptions import (
     Conflict,
+    InternalServerError,
     ItemOwnershipException,
+    MessageException,
     ObjectNotFound,
     RequestParameterInvalidException,
     RequestParameterMissingException,
@@ -643,7 +645,13 @@ class UserDefinedFileSourcesImpl(UserDefinedFileSources):
         oauth2_configuration = get_oauth2_config_or_none(template)
         oauth2_scope = None
         if oauth2_configuration is not None:
-            environment = prepare_environment_from_root(template.environment, self._app_vault, self._app_config)
+            try:
+                environment = prepare_environment_from_root(template.environment, self._app_vault, self._app_config)
+            except InternalServerError as e:
+                log.exception(
+                    f"Problem preparing environment for template {template_id} version {template_version} - Reason: {str(e)}"
+                )
+                raise MessageException("Problem with template configuration - Please contact your administrator.")
             user_details = user.config_template_details()
             oauth2_client_pair_obj, oauth2_scope = read_oauth2_info_from_configuration(
                 template.configuration, user_details, environment
diff --git a/lib/galaxy/managers/histories.py b/lib/galaxy/managers/histories.py
index 053d456e511..c357aef1af0 100644
--- a/lib/galaxy/managers/histories.py
+++ b/lib/galaxy/managers/histories.py
@@ -296,7 +296,11 @@ class HistoryManager(sharable.SharableModelManager[model.History], deletable.Pur
         if self.app.config.enable_celery_tasks:
             from galaxy.celery.tasks import purge_history_datasets
 
-            request = PurgeHistoryDatasetsTaskRequest(history_id=item.id)
+            preserve_owner_update_time = kwargs.get("preserve_owner_update_time", False)
+            request = PurgeHistoryDatasetsTaskRequest(
+                history_id=item.id,
+                preserve_owner_update_time=preserve_owner_update_time,
+            )
             user = item.user
             result = purge_history_datasets.delay(request=request, task_user_id=user.id if user else None)
         else:
diff --git a/lib/galaxy/managers/history_contents.py b/lib/galaxy/managers/history_contents.py
index 0aff65950e2..2a542d9fa3c 100644
--- a/lib/galaxy/managers/history_contents.py
+++ b/lib/galaxy/managers/history_contents.py
@@ -46,6 +46,7 @@ from galaxy.managers import (
     tools,
 )
 from galaxy.managers.job_connections import JobConnectionsManager
+from galaxy.model import batch_fetch_job_state_summaries
 from galaxy.schema import ValueFilterQueryParams
 from galaxy.schema.tasks import (
     CopyDatasetsPayload,
@@ -497,7 +498,12 @@ class HistoryContentsManager(base.SortableManager):
             .options(joinedload(component_class.annotations))
         )
         result = self._session().scalars(stmt).unique()
-        return {row.id: row for row in result}
+        id_map = {row.id: row for row in result}
+        if id_map and component_class is model.HistoryDatasetCollectionAssociation:
+            summaries = batch_fetch_job_state_summaries(self._session(), list(id_map.keys()))
+            for hdca_id, hdca in id_map.items():
+                hdca._job_state_summary = summaries.get(hdca_id)
+        return id_map
 
 
 class HistoryContentsSerializer(base.ModelSerializer, deletable.PurgableSerializerMixin):
diff --git a/lib/galaxy/managers/jobs.py b/lib/galaxy/managers/jobs.py
index 61a27c33cc7..f44b71bcd2b 100644
--- a/lib/galaxy/managers/jobs.py
+++ b/lib/galaxy/managers/jobs.py
@@ -1,3 +1,4 @@
+import hashlib
 import json
 import logging
 from collections.abc import Iterable
@@ -170,6 +171,15 @@ def safe_label_or_none(label: str) -> Optional[str]:
     return label
 
 
+def safe_label(label: str, value_index: int) -> str:
+    if len(label) <= 63:
+        return label
+    # Use a hash of the full label to avoid collisions when different keys
+    # share the same value_index (value_index resets per key).
+    label_hash = hashlib.md5(label.encode()).hexdigest()[:8]
+    return f"_i_{label_hash}_{value_index}"
+
+
 T = TypeVar("T")
 
 
@@ -794,7 +804,7 @@ class JobSearch:
         c = aliased(model.HistoryDatasetAssociation)
         d = aliased(model.JobParameter)
         e = aliased(model.HistoryDatasetAssociationHistory)
-        labeled_col = a.dataset_id.label(f"{k}_{value_index}")
+        labeled_col = a.dataset_id.label(safe_label(f"{k}_{value_index}", value_index))
         stmt = stmt.add_columns(labeled_col)
         used_ids.append(labeled_col)
         stmt = stmt.join(a, a.job_id == model.Job.id)
@@ -855,8 +865,7 @@ class JobSearch:
         value_index: int,
     ) -> "Select[tuple[int]]":
         a = aliased(model.JobToInputLibraryDatasetAssociation)
-        label = safe_label_or_none(f"{k}_{value_index}")
-        labeled_col = a.ldda_id.label(label)
+        labeled_col = a.ldda_id.label(safe_label(f"{k}_{value_index}", value_index))
         stmt = stmt.add_columns(labeled_col)
         stmt = stmt.join(a, a.job_id == model.Job.id)
         data_conditions.append(and_(a.name == k, a.ldda_id == v))
@@ -1099,7 +1108,7 @@ class JobSearch:
         # Main query `stmt` construction
         # This section joins the base job statement with the associations and then filters
         # by the HDCAs identified as equivalent in the CTEs.
-        labeled_col = a.dataset_collection_id.label(f"{k}_{value_index}")
+        labeled_col = a.dataset_collection_id.label(safe_label(f"{k}_{value_index}", value_index))
         stmt = stmt.add_columns(labeled_col)
         stmt = stmt.join(a, a.job_id == model.Job.id)
 
@@ -1425,7 +1434,7 @@ class JobSearch:
                 model.JobToInputDatasetCollectionElementAssociation,
                 name=f"job_to_input_dce_association_{k}_{value_index}",
             )
-            labeled_col = a.dataset_collection_element_id.label(f"{k}_{value_index}")
+            labeled_col = a.dataset_collection_element_id.label(safe_label(f"{k}_{value_index}", value_index))
             stmt = stmt.add_columns(labeled_col)
             stmt = stmt.join(a, a.job_id == model.Job.id)
 
@@ -1468,7 +1477,7 @@ class JobSearch:
             hda_right = safe_aliased(model.HistoryDatasetAssociation, name=f"hda_right_{k}_{value_index}")
 
             # Start joins from job → input DCE association → first-level DCE (left side)
-            labeled_col = a.dataset_collection_element_id.label(safe_label_or_none(f"{k}_{value_index}"))
+            labeled_col = a.dataset_collection_element_id.label(safe_label(f"{k}_{value_index}", value_index))
             stmt = stmt.add_columns(labeled_col)
             stmt = stmt.join(a, a.job_id == model.Job.id)
             stmt = stmt.join(dce_left, dce_left.id == a.dataset_collection_element_id)
@@ -1699,22 +1708,56 @@ def fetch_job_states(sa_session, job_source_ids, job_source_types):
         else:
             raise RequestParameterInvalidException(f"Invalid job source type {job_source_type} found.")
 
-    job_summaries = {}
-    implicit_collection_jobs_summaries = {}
+    job_summaries: dict[int, JobsSummary] = {}
+    implicit_collection_jobs_summaries: dict[int, JobsSummary] = {}
 
-    for job_id in job_ids:
-        job_summaries[job_id] = summarize_jobs_to_dict(sa_session, sa_session.get(Job, job_id))
-    for implicit_collection_jobs_id in implicit_collection_job_ids:
-        implicit_collection_jobs_summaries[implicit_collection_jobs_id] = summarize_jobs_to_dict(
-            sa_session, sa_session.get(model.ImplicitCollectionJobs, implicit_collection_jobs_id)
+    if job_ids:
+        stmt = select(Job.id, Job.state).where(Job.id.in_(job_ids))
+        for job_id, job_state in sa_session.execute(stmt):
+            job_summaries[job_id] = {
+                "populated_state": "ok",
+                "states": {job_state: 1},
+                "model": "Job",
+                "id": job_id,
+            }
+    if implicit_collection_job_ids:
+        stmt = select(ImplicitCollectionJobs.id, ImplicitCollectionJobs.populated_state).where(
+            ImplicitCollectionJobs.id.in_(implicit_collection_job_ids)
         )
+        populated_icj_ids = []
+        for icj_id, populated_state in sa_session.execute(stmt):
+            implicit_collection_jobs_summaries[icj_id] = {
+                "id": icj_id,
+                "populated_state": populated_state,
+                "model": "ImplicitCollectionJobs",
+                "states": {},
+            }
+            if populated_state == "ok":
+                populated_icj_ids.append(icj_id)
+        if populated_icj_ids:
+            join = ImplicitCollectionJobsJobAssociation.table.join(Job)
+            stmt = (
+                select(
+                    ImplicitCollectionJobsJobAssociation.table.c.implicit_collection_jobs_id,
+                    Job.state,
+                    func.count(),
+                )
+                .select_from(join)
+                .where(ImplicitCollectionJobsJobAssociation.table.c.implicit_collection_jobs_id.in_(populated_icj_ids))
+                .group_by(
+                    ImplicitCollectionJobsJobAssociation.table.c.implicit_collection_jobs_id,
+                    Job.state,
+                )
+            )
+            for icj_id, state, count in sa_session.execute(stmt):
+                implicit_collection_jobs_summaries[icj_id]["states"][state] = count
 
     rval = []
     for job_source_id, job_source_type in zip(job_source_ids, job_source_types):
         if job_source_type == "Job":
-            rval.append(job_summaries[job_source_id])
+            rval.append(job_summaries.get(job_source_id))
         elif job_source_type == "ImplicitCollectionJobs":
-            rval.append(implicit_collection_jobs_summaries[job_source_id])
+            rval.append(implicit_collection_jobs_summaries.get(job_source_id))
         else:
             invocation_state = workflow_invocation_states[job_source_id]
             invocation_job_summaries = []
diff --git a/lib/galaxy/managers/users.py b/lib/galaxy/managers/users.py
index 450aeff7620..f8a53765020 100644
--- a/lib/galaxy/managers/users.py
+++ b/lib/galaxy/managers/users.py
@@ -39,7 +39,6 @@ from galaxy.model import (
     User,
     UserAddress,
     UserQuotaUsage,
-    UserWorkflowMenuEntry,
 )
 from galaxy.model.db.user import (
     _cleanup_nonprivate_user_roles,
@@ -708,7 +707,6 @@ class UserSerializer(base.ModelSerializer, deletable.PurgableSerializerMixin):
                 "quota",
                 "quota_bytes",
                 "quota_percent",
-                "stored_workflow_menu_entries",
                 "total_disk_usage",
             ],
             include_keys_from="summary",
@@ -730,7 +728,6 @@ class UserSerializer(base.ModelSerializer, deletable.PurgableSerializerMixin):
                 "quota_percent": lambda i, k, **c: self.user_manager.quota(i),
                 "quota": lambda i, k, **c: self.user_manager.quota(i, total=True),
                 "quota_bytes": lambda i, k, **c: self.user_manager.quota_bytes(i),
-                "stored_workflow_menu_entries": lambda i, k, **c: self.serialize_workflow_menu_entries(i),
             }
         )
 
@@ -767,22 +764,6 @@ class UserSerializer(base.ModelSerializer, deletable.PurgableSerializerMixin):
             quota_bytes=quota_bytes,
         )
 
-    def serialize_workflow_menu_entries(self, user: model.User) -> list[UserWorkflowMenuEntry]:
-        stored_workflow_menu_index = {}
-        stored_workflow_menu_entries: list[UserWorkflowMenuEntry] = []
-        for menu_item in getattr(user, "stored_workflow_menu_entries", []):
-            encoded_id = self.app.security.encode_id(menu_item.stored_workflow_id)
-            if encoded_id not in stored_workflow_menu_index:
-                stored_workflow_menu_index[encoded_id] = True
-                encoded_name = util.unicodify(menu_item.stored_workflow.name)
-                stored_workflow_menu_entries.append(
-                    UserWorkflowMenuEntry(
-                        id=encoded_id,
-                        name=encoded_name,
-                    )
-                )
-        return stored_workflow_menu_entries
-
 
 class UserDeserializer(base.ModelDeserializer):
     """
diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py
index 05756dc5295..0ddec4f5861 100644
--- a/lib/galaxy/model/__init__.py
+++ b/lib/galaxy/model/__init__.py
@@ -88,6 +88,7 @@ from sqlalchemy import (
     or_,
     PrimaryKeyConstraint,
     select,
+    Select,
     String,
     Table,
     TEXT,
@@ -13015,3 +13016,65 @@ def receive_init(target, args, kwargs):
 
 
 JobStateSummary = NamedTuple("JobStateSummary", [(value, int) for value in enum_values(Job.states)] + [("all_jobs", int)])  # type: ignore[misc]  # Ref https://github.com/python/mypy/issues/848#issuecomment-255237167
+
+_ZERO_JOB_STATE_SUMMARY = JobStateSummary._make([0] * (len(Job.states) + 1))
+
+
+def batch_fetch_job_state_summaries(session, hdca_ids: list[int]) -> dict[int, "JobStateSummary"]:
+    """Batch-fetch job state summaries for multiple HDCAs in a single query.
+
+    Returns a dict mapping hdca_id to JobStateSummary for every requested ID.
+    HDCAs with no associated jobs get a zero-filled summary.
+    """
+    if not hdca_ids:
+        return {}
+
+    hdca_id_label = "hdca_id"
+    state_label = "state"
+
+    # subq1: jobs via ImplicitCollectionJobs
+    subq1 = (
+        select(
+            HistoryDatasetCollectionAssociation.id.label(hdca_id_label),
+            Job.id,
+            Job.state.label(state_label),
+        )
+        .join(ImplicitCollectionJobsJobAssociation, ImplicitCollectionJobsJobAssociation.job_id == Job.id)
+        .join(
+            ImplicitCollectionJobs,
+            ImplicitCollectionJobs.id == ImplicitCollectionJobsJobAssociation.implicit_collection_jobs_id,
+        )
+        .join(
+            HistoryDatasetCollectionAssociation,
+            HistoryDatasetCollectionAssociation.implicit_collection_jobs_id == ImplicitCollectionJobs.id,
+        )
+        .where(HistoryDatasetCollectionAssociation.id.in_(hdca_ids))
+    )
+
+    # subq2: jobs directly on HDCA
+    subq2 = (
+        select(
+            HistoryDatasetCollectionAssociation.id.label(hdca_id_label),
+            Job.id,
+            Job.state.label(state_label),
+        )
+        .join(HistoryDatasetCollectionAssociation, HistoryDatasetCollectionAssociation.job_id == Job.id)
+        .where(HistoryDatasetCollectionAssociation.id.in_(hdca_ids))
+    )
+
+    subq = subq1.union(subq2).subquery()
+
+    # Aggregate per HDCA
+    stm: Select = select(subq.c[hdca_id_label]).select_from(subq).group_by(subq.c[hdca_id_label])
+    for state in enum_values(Job.states):
+        stm = stm.add_columns(func.sum(case((subq.c[state_label] == state, 1), else_=0)).label(state))
+    stm = stm.add_columns(func.count().label("all_jobs"))
+
+    result = {int(row[0]): JobStateSummary._make(row[1:]) for row in session.execute(stm)}
+
+    # Fill in zero summaries for HDCAs with no jobs
+    for hdca_id in hdca_ids:
+        if hdca_id not in result:
+            result[hdca_id] = _ZERO_JOB_STATE_SUMMARY
+
+    return result
diff --git a/lib/galaxy/model/dataset_collections/auto_pairing.py b/lib/galaxy/model/dataset_collections/auto_pairing.py
index 351c4657e52..7433bb07e3d 100644
--- a/lib/galaxy/model/dataset_collections/auto_pairing.py
+++ b/lib/galaxy/model/dataset_collections/auto_pairing.py
@@ -20,6 +20,7 @@ T = TypeVar("T", bound=HasName)
 COMMON_FILTERS: dict[str, tuple[str, str]] = {
     "illumina": ("_1", "_2"),
     "Rs": ("_R1", "_R2"),
+    "Fs": ("_F", "_R"),
     "dot12s": (".1.fastq", ".2.fastq"),
 }
 
@@ -116,25 +117,32 @@ def guess_initial_filter_type(elements: list[T]) -> Optional[str]:
     illumina = 0
     dot12s = 0
     Rs = 0
+    Fs = 0
 
     # Iterate through elements and count occurrences of filter patterns
+    # Order matters: more specific patterns must be checked before less specific ones
+    # (_R1/_R2 before _F/_R since _R is a substring of _R1)
     for element in elements:
         if ".1.fastq" in element.name or ".2.fastq" in element.name:
             dot12s += 1
         elif "_R1" in element.name or "_R2" in element.name:
             Rs += 1
+        elif "_F" in element.name or "_R" in element.name:
+            Fs += 1
         elif "_1" in element.name or "_2" in element.name:
             illumina += 1
 
     # Determine the most likely filter type
-    if illumina == 0 and dot12s == 0 and Rs == 0:
+    if illumina == 0 and dot12s == 0 and Rs == 0 and Fs == 0:
         return None
-    elif illumina > dot12s and illumina > Rs:
+    elif illumina > dot12s and illumina > Rs and illumina > Fs:
         return "illumina"
-    elif dot12s > illumina and dot12s > Rs:
+    elif dot12s > illumina and dot12s > Rs and dot12s > Fs:
         return "dot12s"
-    elif Rs > illumina and Rs > dot12s:
+    elif Rs > illumina and Rs > dot12s and Rs > Fs:
         return "Rs"
+    elif Fs > illumina and Fs > dot12s and Fs > Rs:
+        return "Fs"
     else:
         return "illumina"
 
diff --git a/lib/galaxy/model/dataset_collections/auto_pairing_spec.yml b/lib/galaxy/model/dataset_collections/auto_pairing_spec.yml
index 8b81d649abc..f0dc8615a17 100644
--- a/lib/galaxy/model/dataset_collections/auto_pairing_spec.yml
+++ b/lib/galaxy/model/dataset_collections/auto_pairing_spec.yml
@@ -74,3 +74,35 @@
     input:
       forward: input_1.fastq.bz2
       reverse: input_2.fastq.bz2
+
+- doc: Simple _F/_R split.
+  inputs:
+  - input_F.fastq
+  - input_R.fastq
+  paired:
+    input:
+      forward: input_F.fastq
+      reverse: input_R.fastq
+
+- doc: Compressed _F/_R split (.gz).
+  inputs:
+  - ERR042228_F.fq.gz
+  - ERR042228_R.fq.gz
+  paired:
+    ERR042228:
+      forward: ERR042228_F.fq.gz
+      reverse: ERR042228_R.fq.gz
+
+- doc: Multiple _F/_R pairs with common prefixes.
+  inputs:
+  - ERR042228_F.fq.gz
+  - ERR042228_R.fq.gz
+  - ERR636028_F.fq.gz
+  - ERR636028_R.fq.gz
+  paired:
+    ERR042228:
+      forward: ERR042228_F.fq.gz
+      reverse: ERR042228_R.fq.gz
+    ERR636028:
+      forward: ERR636028_F.fq.gz
+      reverse: ERR636028_R.fq.gz
diff --git a/lib/galaxy/model/db/role.py b/lib/galaxy/model/db/role.py
index 586427a1e59..cf37ee0058f 100644
--- a/lib/galaxy/model/db/role.py
+++ b/lib/galaxy/model/db/role.py
@@ -53,8 +53,14 @@ def get_displayable_roles(session, trans_user, user_is_admin, security_agent):
     return roles
 
 
-def get_private_role_user_emails_dict(session) -> dict[int, str]:
-    """Return a mapping of private role ids to user emails."""
+def get_private_role_user_emails_dict(session, role_ids: set[int] | None = None) -> dict[int, str]:
+    """Return a mapping of private role ids to user emails.
+
+    If role_ids is provided, only return mappings for roles in that set,
+    avoiding a full table scan on large instances.
+    """
     stmt = select(UserRoleAssociation.role_id, User.email).join(Role).join(User).where(Role.type == Role.types.PRIVATE)
+    if role_ids is not None:
+        stmt = stmt.where(UserRoleAssociation.role_id.in_(role_ids))
     roleid_email_tuples = session.execute(stmt).all()
     return dict(roleid_email_tuples)
diff --git a/lib/galaxy/objectstore/_caching_base.py b/lib/galaxy/objectstore/_caching_base.py
index 7beb8c63437..9458a574349 100644
--- a/lib/galaxy/objectstore/_caching_base.py
+++ b/lib/galaxy/objectstore/_caching_base.py
@@ -356,7 +356,7 @@ class CachingConcreteObjectStore(ConcreteObjectStore):
                 try:
                     if source_file != cache_file and self.cache_updated_data:
                         # FIXME? Should this be a `move`?
-                        shutil.copy2(source_file, cache_file)
+                        shutil.copy(source_file, cache_file)
                     fix_permissions(self.config, cache_file)
                 except OSError:
                     log.exception("Trouble copying source file '%s' to cache '%s'", source_file, cache_file)
diff --git a/lib/galaxy/objectstore/rucio.py b/lib/galaxy/objectstore/rucio.py
index eb5a43e9744..5a6696f9a10 100644
--- a/lib/galaxy/objectstore/rucio.py
+++ b/lib/galaxy/objectstore/rucio.py
@@ -568,7 +568,7 @@ class RucioObjectStore(CachingConcreteObjectStore):
             try:
                 if source_file != cache_file and self.cache_updated_data:
                     try:
-                        shutil.copy2(source_file, cache_file)
+                        shutil.copy(source_file, cache_file)
                     except OSError:
                         os.makedirs(os.path.dirname(cache_file))
                         shutil.copy2(source_file, cache_file)
diff --git a/lib/galaxy/schema/tasks.py b/lib/galaxy/schema/tasks.py
index 9c198ef81a5..6ee1c2d433e 100644
--- a/lib/galaxy/schema/tasks.py
+++ b/lib/galaxy/schema/tasks.py
@@ -140,6 +140,7 @@ class PurgeDatasetsTaskRequest(Model):
 
 class PurgeHistoryDatasetsTaskRequest(Model):
     history_id: int
+    preserve_owner_update_time: bool = False
 
 
 class TaskState(str, Enum):
diff --git a/lib/galaxy/tools/data_fetch.py b/lib/galaxy/tools/data_fetch.py
index 3396daa7bbf..2c6b48c7c48 100644
--- a/lib/galaxy/tools/data_fetch.py
+++ b/lib/galaxy/tools/data_fetch.py
@@ -318,6 +318,7 @@ def _fetch_target(upload_config: "UploadConfig", target: dict[str, Any]):
             requested_transform.append({"action": "to_posix_lines"})
         source_dict["requested_transform"] = requested_transform
         effective_state = "ok"
+        stdout: Optional[str] = None
         if not deferred and not error_message:
             in_place = item.get("in_place", default_in_place)
             purge_source = item.get("purge_source", True)
@@ -410,6 +411,9 @@ def _fetch_target(upload_config: "UploadConfig", target: dict[str, Any]):
             effective_state = "deferred"
             registry = upload_config.registry
             ext = sniff.guess_ext_from_file_name(name, registry=registry, requested_ext=requested_ext)
+        info = f"uploaded {ext} file"
+        if stdout:
+            info = f"{info}\n{stdout}"
         rval = {
             "name": name,
             "dbkey": dbkey,
@@ -417,7 +421,7 @@ def _fetch_target(upload_config: "UploadConfig", target: dict[str, Any]):
             "link_data_only": link_data_only,
             "sources": sources,
             "hashes": hashes,
-            "info": f"uploaded {ext} file",
+            "info": info,
             "state": effective_state,
         }
         if path:
diff --git a/lib/galaxy/tools/parameters/basic.py b/lib/galaxy/tools/parameters/basic.py
index 1d18fe12474..4b3c46d47f9 100644
--- a/lib/galaxy/tools/parameters/basic.py
+++ b/lib/galaxy/tools/parameters/basic.py
@@ -2418,14 +2418,19 @@ class DataToolParameter(BaseDataToolParameter):
             )
 
         # add datasets
-        hda_list = util.listify(other_values.get(self.name))
+        # When rerunning a job, other_values contains the original job's input
+        # values which may be HDAs, HDCAs, DCEs, or LDDAs.  We start by
+        # collecting them so we can (a) mark the ones that are still present
+        # among the active visible datasets and (b) carry forward the rest as
+        # "keep" options so the client can pre-select them.
+        job_input_values = util.listify(other_values.get(self.name))
         # Prefetch all at once, big list of visible, non-deleted datasets.
         matches_by_hid: dict[int, list] = {}
         for hda in history.active_visible_datasets_and_roles:
             match = dataset_matcher.hda_match(hda)
             if match:
                 m = match.hda
-                hda_list = [h for h in hda_list if h != m and h != hda]
+                job_input_values = [h for h in job_input_values if h != m and h != hda]
                 if m.hid not in matches_by_hid:
                     matches_by_hid[m.hid] = []
                 matches_by_hid[m.hid].append(match)
@@ -2441,19 +2446,24 @@ class DataToolParameter(BaseDataToolParameter):
             )
             append(d["options"]["hda"], match.hda, m_name, "hda")
 
-        for hda in hda_list:
-            if hasattr(hda, "hid"):
-                if hda.deleted:
-                    hda_state = "deleted"
-                elif not hda.visible:
-                    hda_state = "hidden"
+        # Remaining job_input_values were not found among active visible
+        # datasets (e.g. hidden or deleted inputs from the original job).
+        # Route each to the correct options list by type so the client can
+        # match them by id *and* src.
+        for value in job_input_values:
+            if isinstance(value, (HistoryDatasetCollectionAssociation, HistoryDatasetAssociation)):
+                if value.deleted:
+                    state = "deleted"
+                elif not value.visible:
+                    state = "hidden"
                 else:
-                    hda_state = "unavailable"
-                append(d["options"]["hda"], hda, f"({hda_state}) {hda.name}", "hda", True)
-            elif isinstance(hda, DatasetCollectionElement):
-                append_dce(hda)
-            elif isinstance(hda, LibraryDatasetDatasetAssociation):
-                append_ldda(hda)
+                    state = "not in current history"
+                src = "hdca" if isinstance(value, HistoryDatasetCollectionAssociation) else "hda"
+                append(d["options"][src], value, f"({state}) {value.name}", src, True)
+            elif isinstance(value, DatasetCollectionElement):
+                append_dce(value)
+            elif isinstance(value, LibraryDatasetDatasetAssociation):
+                append_ldda(value)
 
         # add dataset collections
         dataset_collection_matcher = dataset_matcher_factory.dataset_collection_matcher(dataset_matcher)
diff --git a/lib/galaxy/tools/parameters/wrapped.py b/lib/galaxy/tools/parameters/wrapped.py
index 0853c3c8f2d..44f73366927 100644
--- a/lib/galaxy/tools/parameters/wrapped.py
+++ b/lib/galaxy/tools/parameters/wrapped.py
@@ -7,6 +7,7 @@ from typing import (
     Union,
 )
 
+from galaxy.exceptions import RequestParameterInvalidException
 from galaxy.tools.parameters.basic import (
     DataCollectionToolParameter,
     DataToolParameter,
@@ -201,6 +202,8 @@ def process_key(incoming_key: str, incoming_value: Any, d: dict[str, Any]):
         # Section / Conditional
         input_name = key_parts[0]
         subdict = d.get(input_name, {})
+        if not isinstance(subdict, dict):
+            raise RequestParameterInvalidException(f"Parameter '{incoming_key}' received conflicting value.")
         d[input_name] = subdict
         process_key("|".join(key_parts[1:]), incoming_value=incoming_value, d=subdict)
 
diff --git a/lib/galaxy/web/framework/base.py b/lib/galaxy/web/framework/base.py
index ffdb76a65e0..c5e710f9989 100644
--- a/lib/galaxy/web/framework/base.py
+++ b/lib/galaxy/web/framework/base.py
@@ -271,7 +271,7 @@ class WebApplication:
         try:
             body = method(trans, **kwargs)
         except Exception as e:
-            body = self.handle_controller_exception(e, trans, method, **kwargs)
+            body = self.handle_controller_exception(e, trans, method, kwargs)
             if not body:
                 trans.response.headers.pop("content-length", None)
                 raise
@@ -307,7 +307,7 @@ class WebApplication:
             # Worst case scenario
             return [smart_str(body)]
 
-    def handle_controller_exception(self, e, trans, method, **kwargs):
+    def handle_controller_exception(self, e, trans, method, kwargs):
         """
         Allow handling of exceptions raised in controller methods.
         """
diff --git a/lib/galaxy/webapps/base/api.py b/lib/galaxy/webapps/base/api.py
index 01127f21fbb..a31d3e76336 100644
--- a/lib/galaxy/webapps/base/api.py
+++ b/lib/galaxy/webapps/base/api.py
@@ -40,6 +40,7 @@ from galaxy.web.framework.base import walk_controller_modules
 
 if TYPE_CHECKING:
     from starlette.background import BackgroundTask
+    from starlette.routing import BaseRoute
     from starlette.types import (
         Receive,
         Scope,
@@ -251,6 +252,21 @@ def add_request_id_middleware(app: FastAPI):
     app.add_middleware(RawContextMiddleware, plugins=(RequestIdPlugin(force_new_uuid=True),))
 
 
+def build_route_name_index(app: FastAPI) -> dict[str, list["BaseRoute"]]:
+    """Build a name -> [route] index for O(1) route lookup.
+
+    Routes are immutable after app startup, so this index is built once
+    and reused for all subsequent requests. For most route names there
+    is exactly one candidate, making lookups O(1) instead of O(n).
+    """
+    index: dict[str, list[BaseRoute]] = {}
+    for route in app.routes:
+        name = getattr(route, "name", None)
+        if name:
+            index.setdefault(name, []).append(route)
+    return index
+
+
 def include_all_package_routers(app: FastAPI, package_name: str):
     responses: dict[Union[int, str], dict[str, Any]] = {
         "4XX": {
diff --git a/lib/galaxy/webapps/base/webapp.py b/lib/galaxy/webapps/base/webapp.py
index f39a5d58487..aea09627b0e 100644
--- a/lib/galaxy/webapps/base/webapp.py
+++ b/lib/galaxy/webapps/base/webapp.py
@@ -200,7 +200,7 @@ class WebApplication(base.WebApplication):
                 directories=paths, module_directory=galaxy_app.config.template_cache_path, collection_size=500
             )
 
-    def handle_controller_exception(self, e, trans, method, **kwargs):
+    def handle_controller_exception(self, e, trans, method, kwargs):
         if not isinstance(e, HTTPException):
             # We're still logging too much here but at least it's not logging webob.exc.HTTPFound and friends
             log.debug(f"Encountered exception in controller method: {method}", exc_info=True)
diff --git a/lib/galaxy/webapps/galaxy/api/__init__.py b/lib/galaxy/webapps/galaxy/api/__init__.py
index c8dd2645775..d95e8939f87 100644
--- a/lib/galaxy/webapps/galaxy/api/__init__.py
+++ b/lib/galaxy/webapps/galaxy/api/__init__.py
@@ -223,7 +223,7 @@ class UrlBuilder:
                 else:
                     url = str(self.request.url_for(name, **path_params))
             else:
-                url = self.request.app.url_path_for(name, **path_params)
+                url = self._url_path_for(name, **path_params)
             if query_params:
                 url = f"{url}?{urlencode(query_params)}"
             return url
@@ -233,6 +233,24 @@ class UrlBuilder:
                 path_params.update(query_params)
             return web.url_for(name, **path_params)
 
+    def _url_path_for(self, name: str, **path_params) -> str:
+        """O(1) route lookup using the app's pre-built name index.
+
+        The index is built once at startup in initialize_fast_app and maps
+        route names to their route objects, replacing Starlette's O(n)
+        linear scan with a direct dict lookup.
+        """
+        candidates = self.request.app.state.route_name_index.get(name)
+        if candidates is not None:
+            for route in candidates:
+                try:
+                    return route.url_path_for(name, **path_params)
+                except NoMatchFound:
+                    pass
+            raise NoMatchFound(name, path_params)
+        # Fallback for names not in the index (e.g. Mount sub-routes)
+        return self.request.app.url_path_for(name, **path_params)
+
 
 class GalaxyASGIRequest(GalaxyAbstractRequest):
     """Wrapper around Starlette/FastAPI Request object.
diff --git a/lib/galaxy/webapps/galaxy/controllers/authnz.py b/lib/galaxy/webapps/galaxy/controllers/authnz.py
index 01dfa4b0534..52347324416 100644
--- a/lib/galaxy/webapps/galaxy/controllers/authnz.py
+++ b/lib/galaxy/webapps/galaxy/controllers/authnz.py
@@ -57,8 +57,7 @@ class OIDC(BaseUIController):
             provider_label = trans.app.authnz_manager.oidc_backends_config.get(authnz.provider, {}).get(
                 "label", authnz.provider
             )
-            if provider_label != authnz.provider:
-                token_info["provider_label"] = provider_label
+            token_info["provider_label"] = provider_label
 
             # Try to extract expiration from id_token if available
             if authnz.extra_data and "id_token" in authnz.extra_data:
diff --git a/lib/galaxy/webapps/galaxy/controllers/data_manager.py b/lib/galaxy/webapps/galaxy/controllers/data_manager.py
index e68da6a6e86..93c134de60b 100644
--- a/lib/galaxy/webapps/galaxy/controllers/data_manager.py
+++ b/lib/galaxy/webapps/galaxy/controllers/data_manager.py
@@ -164,102 +164,3 @@ class DataManager(BaseUIController):
             "message": message,
             "status": status,
         }
-
-    @web.expose
-    @web.json
-    def tool_data_table_info(self, trans, **kwd):
-        return self.tool_data_table_info_1(trans, **kwd)
-
-    def tool_data_table_info_1(self, trans, **kwd):
-        not_is_admin = not trans.user_is_admin
-        if not_is_admin and not trans.app.config.enable_data_manager_user_view:
-            raise paste.httpexceptions.HTTPUnauthorized(
-                "This Galaxy instance is not configured to allow non-admins to view the data manager."
-            )
-        message = kwd.get("message", "")
-        status = kwd.get("status", "info")
-        data_table_name = kwd.get("table_name", None)
-        if not data_table_name:
-            return {"message": "No data table was requested.", "status": "error"}
-        data_table = trans.app.tool_data_tables.get(data_table_name, None)
-        if data_table is None:
-            return {"message": f"Invalid data table '{data_table_name}' was requested.", "status": "error"}
-        return {
-            "dataTable": {
-                "name": data_table.name,
-                "columns": data_table.get_column_name_list(),
-                "data": data_table.data,
-            },
-            "viewOnly": not_is_admin,
-            "message": message,
-            "status": status,
-        }
-
-    @web.expose
-    @web.json
-    @web.require_admin
-    def reload_tool_data_tables(self, trans, table_name=None, **kwd):
-        if table_name and isinstance(table_name, str):
-            table_name = table_name.split(",")
-        # Reload the tool data tables
-        table_names = self.app.tool_data_tables.reload_tables(table_names=table_name)
-        trans.app.queue_worker.send_control_task(
-            "reload_tool_data_tables", noop_self=True, kwargs={"table_name": table_name}
-        )
-        data = None
-        if table_names:
-            message = "Reloaded data table{} '{}'.".format("s"[len(table_names) == 1 :], ", ".join(table_names))
-            data = self.tool_data_table_info_1(trans, table_name=table_names[0], message=message, status="done")
-        else:
-            data = {"message": "No data tables have been reloaded.", "status": "error"}
-        return data
-
-    @web.expose
-    @web.json
-    @web.require_admin
-    def tool_data_table_items(self, trans, **kwd):
-        data = {"columns": [], "items": []}
-        message = kwd.get("message", "")
-        status = kwd.get("status", "info")
-        table_name = kwd.get("table_name", None)
-
-        if not table_name:
-            return {
-                "data": data,
-                "message": "No Data table name provided.",
-                "status": "warning",
-            }
-
-        data_table = trans.app.tool_data_tables.get(table_name, None)
-
-        if data_table is None:
-            return {"data": data, "message": f"Invalid Data table ({table_name}) was requested", "status": "error"}
-
-        columns = data_table.get_column_name_list()
-        rows = [dict(zip(columns, table_row)) for table_row in data_table.data]
-        data["columns"] = columns
-        data["items"] = rows
-
-        return {"data": data, "message": message, "status": status}
-
-    @web.expose
-    @web.json
-    @web.require_admin
-    def reload_tool_data_table(self, trans, **kwd):
-        table_name = kwd.get("table_name", None)
-
-        if not table_name:
-            return {
-                "message": "No data table has been reloaded.",
-                "status": "error",
-            }
-
-        redirect_url = web.url_for(
-            controller="data_manager",
-            action="tool_data_table_items",
-            table_name=table_name,
-            message=f'The data table "{table_name}" has been reloaded.',
-            status="done",
-        )
-
-        return trans.response.send_redirect(redirect_url)
diff --git a/lib/galaxy/webapps/galaxy/controllers/dataset.py b/lib/galaxy/webapps/galaxy/controllers/dataset.py
index cbc41ea6209..99465bec8c0 100644
--- a/lib/galaxy/webapps/galaxy/controllers/dataset.py
+++ b/lib/galaxy/webapps/galaxy/controllers/dataset.py
@@ -159,17 +159,8 @@ class DatasetInterface(BaseUIController, UsesAnnotations, UsesItemRatings, UsesE
             ]
             ldatatypes.sort()
 
-            private_role_emails = get_private_role_user_emails_dict(trans.sa_session)
-            role_tuples = []
-            for role in trans.app.security_agent.get_legitimate_roles(trans, data.dataset, "root"):
-                displayed_name = private_role_emails.get(role.id, role.name)
-                role_tuples.append((displayed_name, trans.security.encode_id(role.id)))
-
             data_metadata = list(data.metadata.spec.items())
             converters_collection = [(key, value.name) for key, value in data.get_converter_types().items()]
-            can_manage_dataset = trans.app.security_agent.can_manage_dataset(
-                trans.get_current_user_roles(), data.dataset
-            )
             # attribute editing
             attribute_inputs = [
                 {"name": "name", "type": "text", "label": "Name", "value": data.get_display_name()},
@@ -258,6 +249,18 @@ class DatasetInterface(BaseUIController, UsesAnnotations, UsesItemRatings, UsesE
                         {"name": "not_shareable", "type": "hidden", "label": permission_message, "readonly": True}
                     )
                 elif data.dataset.actions:
+                    can_manage_dataset = trans.app.security_agent.can_manage_dataset(
+                        trans.get_current_user_roles(), data.dataset
+                    )
+                    legitimate_roles = trans.app.security_agent.get_legitimate_roles(trans, data.dataset, "root")
+                    legitimate_role_ids = {role.id for role in legitimate_roles}
+                    private_role_emails = get_private_role_user_emails_dict(
+                        trans.sa_session, role_ids=legitimate_role_ids
+                    )
+                    role_tuples = [
+                        (private_role_emails.get(role.id, role.name), trans.security.encode_id(role.id))
+                        for role in legitimate_roles
+                    ]
                     in_roles = {}
                     for action, roles in trans.app.security_agent.get_permissions(data.dataset).items():
                         in_roles[action.action] = [trans.security.encode_id(role.id) for role in roles]
diff --git a/lib/galaxy/webapps/galaxy/controllers/error.py b/lib/galaxy/webapps/galaxy/controllers/error.py
deleted file mode 100644
index a322c6bfd44..00000000000
--- a/lib/galaxy/webapps/galaxy/controllers/error.py
+++ /dev/null
@@ -1,10 +0,0 @@
-from galaxy.webapps.base.controller import (
-    BaseUIController,
-    web,
-)
-
-
-class Error(BaseUIController):
-    @web.expose
-    def index(self, trans):
-        raise Exception("Fake error")
diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index 1682d15fda3..51c12e2de64 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -216,7 +216,7 @@ class HistoryController(BaseUIController, SharableMixin, UsesAnnotations, UsesIt
                     trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
 
             importable = history.importable
-            link_access = self.service.shareable_service.disable_link_access(trans, history_id)
+            link_access = self.service.shareable_service.disable_link_access(trans, history.id)
         return {
             "message": f"Success, requested permissions have been changed in {'all histories' if all_histories else history.name}.",
             "sharing_status_changed": importable != link_access.importable,
diff --git a/lib/galaxy/webapps/galaxy/fast_app.py b/lib/galaxy/webapps/galaxy/fast_app.py
index 07f9b2f0825..002ea22c567 100644
--- a/lib/galaxy/webapps/galaxy/fast_app.py
+++ b/lib/galaxy/webapps/galaxy/fast_app.py
@@ -16,6 +16,7 @@ from slowapi import (
 )
 from slowapi.errors import RateLimitExceeded
 from slowapi.util import get_remote_address
+from starlette.datastructures import MutableHeaders
 from starlette.middleware.cors import CORSMiddleware
 from tuspyserver import create_tus_router
 
@@ -25,6 +26,7 @@ from galaxy.webapps.base.api import (
     add_exception_handler,
     add_raw_context_middlewares,
     add_request_id_middleware,
+    build_route_name_index,
     GalaxyFileResponse,
     include_all_package_routers,
 )
@@ -126,15 +128,31 @@ class GalaxyCORSMiddleware(CORSMiddleware):
         return config_allows_origin(origin, self.config)
 
 
+class XFrameOptionsMiddleware:
+    def __init__(self, app, x_frame_options: str):
+        self.app = app
+        self.x_frame_options = x_frame_options
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        request = Request(scope)
+
+        async def send_with_header(message):
+            if message["type"] == "http.response.start":
+                if not _is_embed_request(request.url.path, str(request.url.query)):
+                    headers = MutableHeaders(scope=message)
+                    headers.append("X-Frame-Options", self.x_frame_options)
+            await send(message)
+
+        await self.app(scope, receive, send_with_header)
+
+
 def add_galaxy_middleware(app: FastAPI, gx_app):
     if x_frame_options := gx_app.config.x_frame_options:
-
-        @app.middleware("http")
-        async def add_x_frame_options(request: Request, call_next):
-            response = await call_next(request)
-            if not _is_embed_request(request.url.path, str(request.url.query)):
-                response.headers["X-Frame-Options"] = x_frame_options
-            return response
+        app.add_middleware(XFrameOptionsMiddleware, x_frame_options=x_frame_options)
 
     GalaxyFileResponse.nginx_x_accel_redirect_base = gx_app.config.nginx_x_accel_redirect_base
     GalaxyFileResponse.apache_xsendfile = gx_app.config.apache_xsendfile
@@ -237,6 +255,7 @@ def initialize_fast_app(gx_wsgi_webapp, gx_app):
     wsgi_handler = WSGIMiddleware(gx_wsgi_webapp)
     gx_app.haltables.append(("WSGI Middleware threadpool", wsgi_handler.executor.shutdown))
     include_tus(app, gx_app)
+    app.state.route_name_index = build_route_name_index(app)
     app.mount("/", wsgi_handler)  # type: ignore[arg-type]
     if gx_app.config.galaxy_url_prefix != "/":
         parent_app = FastAPI()
diff --git a/lib/galaxy/webapps/galaxy/services/tools.py b/lib/galaxy/webapps/galaxy/services/tools.py
index 7051f58e65e..2e9d73da201 100644
--- a/lib/galaxy/webapps/galaxy/services/tools.py
+++ b/lib/galaxy/webapps/galaxy/services/tools.py
@@ -227,6 +227,7 @@ class ToolsService(ServiceBase):
             request_state=request_state,
             client_secret=file_landing_payload.client_secret,
             public=file_landing_payload.public,
+            origin=file_landing_payload.origin,
         )
 
     def data_landing_to_tool_landing(
@@ -249,6 +250,7 @@ class ToolsService(ServiceBase):
             request_state=request_state,
             client_secret=data_landing_payload.client_secret,
             public=data_landing_payload.public,
+            origin=data_landing_payload.origin,
         )
 
     def inputs(
diff --git a/lib/galaxy/workflow/run_request.py b/lib/galaxy/workflow/run_request.py
index 69253111c30..ef0e63e7ec4 100644
--- a/lib/galaxy/workflow/run_request.py
+++ b/lib/galaxy/workflow/run_request.py
@@ -606,6 +606,10 @@ def workflow_run_config_to_request(
 
     replacement_dict = run_config.replacement_dict
     for name, value in replacement_dict.items():
+        if not isinstance(value, str):
+            raise exceptions.RequestParameterInvalidException(
+                f"Replacement parameter '{name}' must be a string, got {type(value).__name__}"
+            )
         add_parameter(
             name=name,
             value=value,
diff --git a/lib/galaxy_test/api/test_jobs.py b/lib/galaxy_test/api/test_jobs.py
index ff2fcdb2a04..8fd80635222 100644
--- a/lib/galaxy_test/api/test_jobs.py
+++ b/lib/galaxy_test/api/test_jobs.py
@@ -449,7 +449,7 @@ steps:
             )
             first_update_time = failed_hdca["update_time"]
             assert failed_hdca["visible"]
-            rerun_params = self._get(f"jobs/{job_id}/build_for_rerun").json()
+            rerun_params = self.dataset_populator.build_for_rerun(job_id)
             inputs = rerun_params["state_inputs"]
             inputs["rerun_remap_job_id"] = job_id
             rerun_response = self._run_detect_errors(history_id=history_id, inputs=inputs)
@@ -481,7 +481,7 @@ steps:
                 assert_ok=False,
             )
             assert failed_hdca["visible"]
-            rerun_params = self._get(f"jobs/{job_id}/build_for_rerun").json()
+            rerun_params = self.dataset_populator.build_for_rerun(job_id)
             inputs = rerun_params["state_inputs"]
             inputs["rerun_remap_job_id"] = unrelated_job_id
             before_rerun_items = self.dataset_populator.get_history_contents(history_id)
@@ -944,7 +944,7 @@ steps:
             wait_for_job=True,
             assert_ok=True,
         )
-        rerun_params = self._get(f"jobs/{run_response['jobs'][0]['id']}/build_for_rerun").json()
+        rerun_params = self.dataset_populator.build_for_rerun(run_response["jobs"][0]["id"])
         # Since we call rerun on the first (and only) job we should get the expanded input
         # which is a dataset collection element (and not the list:pair hdca that was used as input to the original
         # job).
@@ -966,12 +966,43 @@ steps:
             assert_ok=True,
         )
 
+    @skip_without_tool("multi_data_param")
+    def test_job_build_for_rerun_hdca_value_in_options(self, history_id):
+        """When rerunning a job whose input was a collection passed to a
+        ``multiple="true"`` data parameter, the collection must appear in
+        ``options.hdca`` (not ``options.hda``) so the client can match it
+        against the value's ``src: "hdca"``.
+
+        Regression test for a bug where hidden HDCAs were misclassified as
+        HDAs in the fallback options, causing the rerun form to show single-
+        dataset mode with nothing pre-selected.
+        """
+        hdca_id = self.__history_with_ok_collection(collection_type="list", history_id=history_id)
+        inputs = {
+            "f1": {"src": "hdca", "id": hdca_id},
+            "f2": {"src": "hdca", "id": hdca_id},
+        }
+        run_response = self._run("multi_data_param", history_id, inputs, wait_for_job=True, assert_ok=True)
+        job_id = run_response["jobs"][0]["id"]
+
+        # Hide the collection so it goes through the job-rerun fallback path
+        # (not found among active visible dataset collections).
+        self.dataset_populator.hide_dataset_collection(hdca_id)
+
+        rerun_params = self.dataset_populator.build_for_rerun(job_id)
+
+        # Find the f1 input definition in the form model
+        f1_input = next(i for i in rerun_params["inputs"] if i["name"] == "f1")
+        assert f1_input["value"]["values"][0]["src"] == "hdca"
+
+        # The HDCA must be in options.hdca (not options.hda)
+        hdca_option = f1_input["options"]["hdca"][0]
+        assert hdca_option["id"] == hdca_id and hdca_option["src"] == "hdca"
+
     @skip_without_tool("multiple_versions")
     def test_job_build_for_rerun_switch_version(self, history_id):
         run_response = self._run("multiple_versions", history_id, {}, tool_version="0.1").json()
-        rerun_params = self._get(
-            f"jobs/{run_response['jobs'][0]['id']}/build_for_rerun", {"tool_version": "0.2"}
-        ).json()
+        rerun_params = self.dataset_populator.build_for_rerun(run_response["jobs"][0]["id"], tool_version="0.2")
         assert rerun_params["version"] == "0.2"
 
     @skip_without_tool("collection_paired_test")
@@ -1012,7 +1043,7 @@ steps:
             assert_ok=True,
         )
         assert len(run_response["jobs"]) == 2
-        rerun_params = self._get(f"jobs/{run_response['jobs'][0]['id']}/build_for_rerun").json()
+        rerun_params = self.dataset_populator.build_for_rerun(run_response["jobs"][0]["id"])
         # Since we call rerun on the first (and only) job we should get the expanded input
         # which is a dataset collection element (and not the list:list hdca that was used as input to the original
         # job).
diff --git a/lib/galaxy_test/api/test_landing.py b/lib/galaxy_test/api/test_landing.py
index 51cf3147157..8265a66a420 100644
--- a/lib/galaxy_test/api/test_landing.py
+++ b/lib/galaxy_test/api/test_landing.py
@@ -119,6 +119,34 @@ class TestLandingApi(ApiTestCase):
         assert target["elements"]
         assert len(target["elements"]) == 1
 
+    def test_data_landing_origin(self):
+        data_landing_request_state = DataLandingRequestState(
+            targets=[
+                {
+                    "destination": {"type": "hdas"},
+                    "items": [
+                        {
+                            "src": "url",
+                            "url": "base64://eyJ0ZXN0IjogInRlc3QifQ==",  # base64 encoded {"test": "test"}
+                            "ext": "txt",
+                            "deferred": False,
+                        }
+                    ],
+                }
+            ],
+        )
+        payload = CreateDataLandingPayload(
+            request_state=data_landing_request_state,
+            public=True,
+            origin=HttpUrl("http://example.localhost/"),
+        )
+        response = self.dataset_populator.create_data_landing(payload)
+        assert response.tool_id == "__DATA_FETCH__"
+        assert str(response.origin) == "http://example.localhost/"
+
+        tool_landing = self.dataset_populator.use_tool_landing(response.uuid)
+        assert str(tool_landing.origin) == "http://example.localhost/"
+
     def test_file_landing_with_sample_sheet(self):
         """Test that sample sheet metadata is preserved through landing request creation and claiming."""
         file_landing_request_state = FileOrCollectionRequestsAdapter.validate_python(
@@ -185,6 +213,29 @@ class TestLandingApi(ApiTestCase):
         assert "sample2" in target["rows"]
         assert target["rows"]["sample2"] == [2, "treatment"]
 
+    def test_file_landing_origin(self):
+        file_landing_request_state = FileOrCollectionRequestsAdapter.validate_python(
+            [
+                {
+                    "class": "File",
+                    "location": "base64://dGVzdCBmaWxl",  # base64 encoded "test file"
+                    "filetype": "txt",
+                    "deferred": False,
+                }
+            ],
+        )
+        payload = CreateFileLandingPayload(
+            request_state=file_landing_request_state,
+            public=True,
+            origin=HttpUrl("http://example.localhost/"),
+        )
+        response = self.dataset_populator.create_file_landing(payload)
+        assert response.tool_id == "__DATA_FETCH__"
+        assert str(response.origin) == "http://example.localhost/"
+
+        tool_landing = self.dataset_populator.use_tool_landing(response.uuid)
+        assert str(tool_landing.origin) == "http://example.localhost/"
+
     def test_file_landing_with_sample_sheet_invalid_collection_type(self):
         """Test that sample sheet metadata with non-sample_sheet collection_type is rejected."""
         file_landing_request_state = FileOrCollectionRequestsAdapter.validate_python(
diff --git a/lib/galaxy_test/api/test_tools.py b/lib/galaxy_test/api/test_tools.py
index e1ec1da1aab..76bcffb62c4 100644
--- a/lib/galaxy_test/api/test_tools.py
+++ b/lib/galaxy_test/api/test_tools.py
@@ -1126,10 +1126,7 @@ class TestToolsApi(ApiTestCase, TestsTools):
             }
             response = self._run("galaxy_json_sleep", history_id, inputs, assert_ok=True)
             output = response["outputs"][0]
-            response = self._put(
-                f"histories/{history_id}/contents/datasets/{output['id']}", data={"visible": False}, json=True
-            )
-            response.raise_for_status()
+            self.dataset_populator.hide_dataset(output["id"])
             output_details = self.dataset_populator.get_history_dataset_details(history_id, dataset=output, wait=False)
             assert not output_details["visible"]
             output_details = self.dataset_populator.get_history_dataset_details(history_id, dataset=output, wait=True)
diff --git a/lib/galaxy_test/api/test_tools_upload.py b/lib/galaxy_test/api/test_tools_upload.py
index e74dc3eff08..55e3ddb1988 100644
--- a/lib/galaxy_test/api/test_tools_upload.py
+++ b/lib/galaxy_test/api/test_tools_upload.py
@@ -1020,6 +1020,12 @@ class TestToolsUpload(ApiTestCase):
         history_id, new_dataset = self._upload(f"  {url}  ")
         self.dataset_populator.get_history_dataset_details(history_id, dataset_id=new_dataset["id"], assert_ok=True)
 
+    def test_fetch_data_type_mismatch_warning(self):
+        details = self._upload_and_get_details("ATGC", api="fetch", ext="fasta")
+        assert details["state"] == "ok"
+        assert details["file_ext"] == "fasta"
+        assert "does not appear to be of that type" in details.get("misc_info", ""), details
+
     def test_upload_and_validate_invalid(self):
         path = TestDataResolver().get_filename("1.fastqsanger")
         with open(path, "rb") as fh:
diff --git a/lib/galaxy_test/api/test_workflows.py b/lib/galaxy_test/api/test_workflows.py
index f253ba5c996..a8e00fedd80 100644
--- a/lib/galaxy_test/api/test_workflows.py
+++ b/lib/galaxy_test/api/test_workflows.py
@@ -7333,6 +7333,20 @@ outer_input:
         request = self.workflow_populator.invocation_to_request(invocation_id)
         assert request["replacement_params"]["replaceme"] == "was replaced"
 
+    @skip_without_tool("cat1")
+    def test_run_with_non_string_replacement_params(self):
+        workflow = self.workflow_populator.load_workflow(name="test_for_pja_run", add_pja=True)
+        workflow_request, history_id, workflow_id = self._setup_workflow_run(workflow, inputs_by="step_index")
+        workflow_request["replacement_params"] = dumps(dict(replaceme={"nested_key": "was replaced"}))
+        run_workflow_response = self.workflow_populator.invoke_workflow_raw(
+            workflow_id, workflow_request, assert_ok=False
+        )
+        self._assert_status_code_is(run_workflow_response, 400)
+        self._assert_error_code_is(
+            run_workflow_response, error_codes.error_codes_by_name["USER_REQUEST_INVALID_PARAMETER"]
+        )
+        assert run_workflow_response.json()["err_msg"] == "Replacement parameter 'replaceme' must be a string, got dict"
+
     @skip_without_tool("hidden_param")
     def test_hidden_param_in_workflow(self):
         with self.dataset_populator.test_history() as history_id:
diff --git a/lib/galaxy_test/base/populators.py b/lib/galaxy_test/base/populators.py
index a6433888850..9fb4a4d8ae2 100644
--- a/lib/galaxy_test/base/populators.py
+++ b/lib/galaxy_test/base/populators.py
@@ -868,6 +868,11 @@ class BaseDatasetPopulator(BasePopulator):
         ]
         return active_jobs
 
+    def build_for_rerun(self, job_id: str, **kwd) -> dict[str, Any]:
+        response = self._get(f"jobs/{job_id}/build_for_rerun", kwd or None)
+        response.raise_for_status()
+        return response.json()
+
     def cancel_job(self, job_id: str) -> Response:
         return self._delete(f"jobs/{job_id}")
 
@@ -1756,12 +1761,18 @@ class BaseDatasetPopulator(BasePopulator):
         api_asserts.assert_status_code_is_ok(put_response)
         return put_response.json()
 
+    def hide_dataset(self, dataset_id: str) -> dict[str, Any]:
+        return self.update_dataset(dataset_id, {"visible": False})
+
     def update_dataset_collection(self, dataset_collection_id: str, update_payload: dict[str, Any]):
         update_url = f"dataset_collections/{dataset_collection_id}"
         put_response = self._put(update_url, update_payload, json=True)
         api_asserts.assert_status_code_is_ok(put_response)
         return put_response.json()
 
+    def hide_dataset_collection(self, dataset_collection_id: str) -> dict[str, Any]:
+        return self.update_dataset_collection(dataset_collection_id, {"visible": False})
+
     def get_histories(self):
         history_index_response = self._get("histories")
         api_asserts.assert_status_code_is(history_index_response, 200)
diff --git a/test/unit/app/managers/test_user_file_sources.py b/test/unit/app/managers/test_user_file_sources.py
index f817ab5ec39..c0aec084be3 100644
--- a/test/unit/app/managers/test_user_file_sources.py
+++ b/test/unit/app/managers/test_user_file_sources.py
@@ -6,6 +6,7 @@ from typing import (
 from unittest import SkipTest
 from uuid import uuid4
 
+import pytest
 from fs.osfs import OSFS
 
 try:
@@ -16,6 +17,8 @@ from requests.exceptions import HTTPError
 from yaml import safe_load
 
 from galaxy.exceptions import (
+    InternalServerError,
+    MessageException,
     RequestParameterInvalidException,
     RequestParameterMissingException,
 )
@@ -23,6 +26,7 @@ from galaxy.files import FileSourcesUserContext
 from galaxy.files.sources import dropbox
 from galaxy.files.templates import ConfiguredFileSourceTemplates
 from galaxy.files.templates.examples import get_example
+from galaxy.managers._config_templates import prepare_environment_from_root
 from galaxy.managers.file_source_instances import (
     CreateInstancePayload,
     FileSourceInstancesManager,
@@ -43,7 +47,12 @@ from galaxy.model import (
 )
 from galaxy.schema.schema import OAuth2State
 from galaxy.util import config_templates
-from galaxy.util.config_templates import RawTemplateConfig
+from galaxy.util.config_templates import (
+    RawTemplateConfig,
+    TemplateEnvironmentEntry,
+    TemplateEnvironmentSecret,
+    TemplateEnvironmentVariable,
+)
 from .base import BaseTestCase
 
 SIMPLE_FILE_SOURCE_NAME = "myfilesource"
@@ -480,6 +489,26 @@ class TestFileSourcesTestCase(BaseTestCase):
         assert user_file_source_showed.variables
         assert user_file_source_showed.variables["var1"] == "newval"
 
+    def test_hide_without_variables_update_on_required_variable_template(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "requiredval"},
+            secrets={},
+        )
+        user_file_source = self._create_instance(create_payload)
+
+        hide = UpdateInstancePayload(hidden=True)
+        self._modify(user_file_source, hide)
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed.hidden
+        assert user_file_source_showed.variables
+        assert user_file_source_showed.variables["var1"] == "requiredval"
+
     def test_hide(self, tmp_path):
         user_file_source = self._init_and_create_simple(tmp_path)
 
@@ -764,6 +793,35 @@ class TestFileSourcesTestCase(BaseTestCase):
         assert "Input should be a valid boolean" in status.template_settings.message
         assert status.connection is None
 
+    def test_environment_variable_missing_raises_configuration_error(self, tmp_path, monkeypatch):
+        self._init_managers(tmp_path)
+        missing_var = "GX_UNIT_TEST_SHOULD_NOT_BE_SET_XYZ123"
+        monkeypatch.delenv(missing_var, raising=False)
+        entries: list[TemplateEnvironmentEntry] = [
+            TemplateEnvironmentVariable(type="variable", name="myvar", variable=missing_var)
+        ]
+        with pytest.raises(InternalServerError) as exc_info:
+            prepare_environment_from_root(entries, self.app.vault, self.app)
+        assert missing_var in str(exc_info.value)
+
+    def test_vault_secret_missing_raises_configuration_error(self, tmp_path):
+        self._init_managers(tmp_path)
+        entries: list[TemplateEnvironmentEntry] = [
+            TemplateEnvironmentSecret(type="secret", name="mysec", vault_key="nonexistent/missing_key")
+        ]
+        with pytest.raises(InternalServerError) as exc_info:
+            prepare_environment_from_root(entries, self.app.vault, self.app)
+        assert "nonexistent/missing_key" in str(exc_info.value)
+
+    def test_oauth2_template_missing_env_raises_message_exception(self, tmp_path, monkeypatch):
+        self.init_user_in_database()
+        self._init_managers(tmp_path, safe_load(get_example("production_dropbox.yml")))
+        monkeypatch.delenv("GALAXY_DROPBOX_APP_CLIENT_ID", raising=False)
+        monkeypatch.delenv("GALAXY_DROPBOX_APP_CLIENT_SECRET", raising=False)
+        with pytest.raises(MessageException) as exc_info:
+            self.manager.template_oauth2(self.trans, "dropbox", 0)
+        assert "Please contact your administrator" in str(exc_info.value)
+
     def _init_invalid_upgrade_test_case(self, tmp_path) -> UserFileSourceModel:
         version_0 = home_directory_template(tmp_path)
         version_0["version"] = 0
diff --git a/test/unit/app/managers/test_user_object_stores.py b/test/unit/app/managers/test_user_object_stores.py
index c4b8bfa70b8..3c3959bba0a 100644
--- a/test/unit/app/managers/test_user_object_stores.py
+++ b/test/unit/app/managers/test_user_object_stores.py
@@ -1,6 +1,4 @@
-from typing import (
-    Optional,
-)
+from typing import Optional
 
 from yaml import safe_load
 
@@ -150,6 +148,26 @@ class TestUserObjectStoreTestCase(BaseTestCase):
         assert user_object_store_showed.variables
         assert user_object_store_showed.variables["var1"] == "newval"
 
+    def test_hide_without_variables_update_on_required_variable_template(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "requiredval"},
+            secrets={},
+        )
+        user_object_store = self._create_instance(create_payload)
+
+        hide = UpdateInstancePayload(hidden=True)
+        self._modify(user_object_store, hide)
+
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert user_object_store_showed.hidden
+        assert user_object_store_showed.variables
+        assert user_object_store_showed.variables["var1"] == "requiredval"
+
     def test_update_errors_on_extra_variables(self, tmp_path):
         self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
         create_payload = CreateInstancePayload(
diff --git a/test/unit/app/tools/test_data_parameters.py b/test/unit/app/tools/test_data_parameters.py
index c7dc8fb8282..f73481135f2 100644
--- a/test/unit/app/tools/test_data_parameters.py
+++ b/test/unit/app/tools/test_data_parameters.py
@@ -49,8 +49,8 @@ class TestDataToolParameter(BaseParameterTestCase):
         assert field["options"]["hda"][0]["name"] == "hda1"
 
     def test_field_display_hidden_hdas_only_if_selected(self):
-        hda1 = MockHistoryDatasetAssociation(name="hda1", id=1)
-        hda2 = MockHistoryDatasetAssociation(name="hda2", id=2)
+        hda1 = self._new_hda(name="hda1")
+        hda2 = self._new_hda(name="hda2")
         hda1.visible = False
         hda2.visible = False
         self.stub_active_datasets(hda1, hda2)
@@ -59,8 +59,8 @@ class TestDataToolParameter(BaseParameterTestCase):
         assert field["options"]["hda"][0]["name"] == "(hidden) hda2"
 
     def test_field_display_deleted_hdas_only_if_selected(self):
-        hda1 = MockHistoryDatasetAssociation(name="hda1", id=1)
-        hda2 = MockHistoryDatasetAssociation(name="hda2", id=2)
+        hda1 = self._new_hda(name="hda1")
+        hda2 = self._new_hda(name="hda2")
         hda1.visible = False
         hda2.deleted = True
         self.stub_active_datasets(hda1, hda2)
@@ -141,10 +141,13 @@ class TestDataToolParameter(BaseParameterTestCase):
         self.stub_active_datasets(hda1)
         assert hda1 == self.param.get_initial_value(self.trans, {}), hda1
 
-    def _new_hda(self):
+    def _new_hda(self, name="Test Dataset"):
         hda = model.HistoryDatasetAssociation()
         hda.visible = True
+        hda.name = name
+        hda.extension = "txt"
         hda.dataset = model.Dataset()
+        hda.dataset.state = model.Dataset.states.OK
         session = self.app.model.context
         session.add(hda)
         session.commit()
@@ -184,8 +187,8 @@ class TestDataToolParameter(BaseParameterTestCase):
 
 
 class MockHistoryDatasetAssociation:
-    """Fake HistoryDatasetAssociation stubbed out for testing matching and
-    stuff like that.
+    """Fake HistoryDatasetAssociation that stubs find_conversion_destination
+    so conversion tests can run without a datatype registry.
     """
 
     def __init__(self, test_dataset=None, name="Test Dataset", id=1):
diff --git a/test/unit/data/dataset_collections/test_type_descriptions.py b/test/unit/data/dataset_collections/test_type_descriptions.py
index 0f8d1d5ab15..a20410cc82a 100644
--- a/test/unit/data/dataset_collections/test_type_descriptions.py
+++ b/test/unit/data/dataset_collections/test_type_descriptions.py
@@ -87,11 +87,9 @@ def test_sample_sheet_acts_like_list():
 
 
 def test_effective_collection_type_paired_or_unpaired_over_paired():
-    # list:paired mapped over paired_or_unpaired should yield "list"
+    """Test effective_collection_type when paired_or_unpaired maps over paired."""
     assert c_t("list:paired").effective_collection_type("paired_or_unpaired") == "list"
-    # list:list:paired mapped over paired_or_unpaired should yield "list:list"
     assert c_t("list:list:paired").effective_collection_type("paired_or_unpaired") == "list:list"
-    # list:paired_or_unpaired mapped over paired_or_unpaired should still yield "list"
     assert c_t("list:paired_or_unpaired").effective_collection_type("paired_or_unpaired") == "list"
 
 
diff --git a/test/unit/webapps/test_make_histories_private.py b/test/unit/webapps/test_make_histories_private.py
new file mode 100644
index 00000000000..40f19faf54f
--- /dev/null
+++ b/test/unit/webapps/test_make_histories_private.py
@@ -0,0 +1,49 @@
+"""Regression tests for https://github.com/galaxyproject/galaxy/issues/22173.
+
+When make_private is called with all_histories=True, no history_id is provided.
+The bug was calling disable_link_access(trans, history_id) where history_id is None,
+instead of disable_link_access(trans, history.id).
+"""
+
+import json
+from unittest.mock import MagicMock
+
+from galaxy import model
+from galaxy.app_unittest_utils import galaxy_mock
+from galaxy.managers.users import UserManager
+from galaxy.util.unittest import TestCase
+from galaxy.webapps.galaxy.controllers.history import HistoryController
+
+
+class TestMakeHistoriesPrivateController(TestCase):
+    def setUp(self):
+        self.trans = galaxy_mock.MockTrans()
+        self.app = self.trans.app
+        self.user_manager = self.app[UserManager]
+        self.user = self.user_manager.create(email="test@example.org", username="test", password="testpass")
+        self.trans.set_user(self.user)
+
+    def test_make_all_histories_private_uses_history_id_not_history_id_param(self):
+        """Regression: disable_link_access must be called with history.id, not history_id (which is None when all_histories=True)."""
+        history1 = model.History(name="History 1", user=self.user)
+        history2 = model.History(name="History 2", user=self.user)
+        history1.importable = True
+        history2.importable = True
+        self.app.model.session.add_all([history1, history2])
+        self.app.model.session.commit()
+
+        controller = HistoryController(self.app)
+        mock_link_access = MagicMock()
+        mock_link_access.importable = False
+        controller.service = MagicMock()
+        controller.service.shareable_service.disable_link_access.return_value = mock_link_access
+
+        result = json.loads(controller.make_private(self.trans, all_histories=True))
+
+        assert "all histories" in result["message"]
+
+        calls = controller.service.shareable_service.disable_link_access.call_args_list
+        called_ids = [call.args[1] for call in calls]
+        assert history1.id in called_ids
+        assert history2.id in called_ids
+        assert None not in called_ids, "disable_link_access was called with None (the bug)"