diff --git a/ami/base/pagination.py b/ami/base/pagination.py
index 9ebca7b21..e3b8e6308 100644
--- a/ami/base/pagination.py
+++ b/ami/base/pagination.py
@@ -29,3 +29,15 @@ def _get_project(self):
         if hasattr(view, "get_active_project"):
             return view.get_active_project()
         return None
+
+
+class TrainingDataPagination(LimitOffsetPagination):
+    """
+    Paging for embedding rows, which are far bigger than a normal API row.
+
+    A 1024-dimension vector serialises to roughly 20 KB of JSON, so the platform default
+    of 10 is uselessly small and an unbounded limit would return hundreds of megabytes.
+    """
+
+    default_limit = 200
+    max_limit = 1000
diff --git a/ami/jobs/migrations/0024_train_classifier_job_type.py b/ami/jobs/migrations/0024_train_classifier_job_type.py
new file mode 100644
index 000000000..5434571a1
--- /dev/null
+++ b/ami/jobs/migrations/0024_train_classifier_job_type.py
@@ -0,0 +1,31 @@
+# Generated by Django 4.2.10 on 2026-09-02 13:35
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("jobs", "0023_alter_job_job_type_key"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="job",
+            name="job_type_key",
+            field=models.CharField(
+                choices=[
+                    ("ml", "ML pipeline"),
+                    ("populate_captures_collection", "Populate capture set"),
+                    ("data_storage_sync", "Data storage sync"),
+                    ("regroup_events", "Regroup sessions"),
+                    ("unknown", "Unknown"),
+                    ("data_export", "Data Export"),
+                    ("post_processing", "Post Processing"),
+                    ("train_classifier", "Train classifier"),
+                ],
+                default="unknown",
+                max_length=255,
+                verbose_name="Job Type",
+            ),
+        ),
+    ]
diff --git a/ami/jobs/migrations/0025_generate_embeddings_job_type.py b/ami/jobs/migrations/0025_generate_embeddings_job_type.py
new file mode 100644
index 000000000..5f6962190
--- /dev/null
+++ b/ami/jobs/migrations/0025_generate_embeddings_job_type.py
@@ -0,0 +1,32 @@
+# Generated by Django 4.2.10 on 2026-09-03 16:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("jobs", "0024_train_classifier_job_type"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="job",
+            name="job_type_key",
+            field=models.CharField(
+                choices=[
+                    ("ml", "ML pipeline"),
+                    ("populate_captures_collection", "Populate capture set"),
+                    ("data_storage_sync", "Data storage sync"),
+                    ("regroup_events", "Regroup sessions"),
+                    ("unknown", "Unknown"),
+                    ("data_export", "Data Export"),
+                    ("post_processing", "Post Processing"),
+                    ("train_classifier", "Train classifier"),
+                    ("generate_embeddings", "Generate embeddings"),
+                ],
+                default="unknown",
+                max_length=255,
+                verbose_name="Job Type",
+            ),
+        ),
+    ]
diff --git a/ami/jobs/migrations/0026_evaluation.py b/ami/jobs/migrations/0026_evaluation.py
new file mode 100644
index 000000000..93a4b7066
--- /dev/null
+++ b/ami/jobs/migrations/0026_evaluation.py
@@ -0,0 +1,33 @@
+# Generated by Django 4.2.10 on 2026-09-13 15:49
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("jobs", "0025_generate_embeddings_job_type"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="job",
+            name="job_type_key",
+            field=models.CharField(
+                choices=[
+                    ("ml", "ML pipeline"),
+                    ("populate_captures_collection", "Populate capture set"),
+                    ("data_storage_sync", "Data storage sync"),
+                    ("regroup_events", "Regroup sessions"),
+                    ("unknown", "Unknown"),
+                    ("data_export", "Data Export"),
+                    ("post_processing", "Post Processing"),
+                    ("train_classifier", "Train classifier"),
+                    ("generate_embeddings", "Generate embeddings"),
+                    ("evaluate_algorithm", "Evaluate algorithm"),
+                ],
+                default="unknown",
+                max_length=255,
+                verbose_name="Job Type",
+            ),
+        ),
+    ]
diff --git a/ami/jobs/models.py b/ami/jobs/models.py
index ff65f31f2..5ac917be7 100644
--- a/ami/jobs/models.py
+++ b/ami/jobs/models.py
@@ -444,6 +444,22 @@ class JobType:
     name: str
     key: str
 
+    # What a job of this type cannot run without. The API refuses to create one that is
+    # missing any of these, so a gap is a 400 when the job is made rather than a failure
+    # minutes later when it runs. ``required_params`` are keys inside ``Job.params``;
+    # ``required_fields`` are fields on the job itself.
+    required_fields: tuple[str, ...] = ()
+    required_params: tuple[str, ...] = ()
+
+    # Whether a person can start one from the UI. The rest are created by the platform:
+    # a data sync, an export, a regroup. Nothing should offer those as a choice.
+    user_creatable: bool = False
+
+    # How long a job of this type may go untouched before the stale-job check treats it as
+    # dead. A type that hands work to an external service and waits to be called back is
+    # silent on purpose, so silence is not evidence that it died; those override this.
+    stalled_after_minutes: int = 10
+
     # @TODO Consider adding custom vocabulary for job types to be used in the UI
     # verb: str = "Sync"
     # present_participle: str = "syncing"
@@ -460,6 +476,7 @@ def run(cls, job: "Job"):
 class MLJob(JobType):
     name = "ML pipeline"
     key = "ml"
+    user_creatable = True
 
     @classmethod
     def run(cls, job: "Job"):
@@ -562,7 +579,14 @@ def run(cls, job: "Job"):
             cls.process_images(job, images)
 
     @classmethod
-    def process_images(cls, job, images):
+    def process_images(cls, job, images, reprocess_all_images: bool | None = None):
+        """
+        `reprocess_all_images` defaults to the project flag. An embedding job overrides it,
+        because it must always send the existing detections: it needs the vectors for crops
+        that are already detected, not a fresh run of the detector.
+        """
+        if reprocess_all_images is None:
+            reprocess_all_images = job.project.feature_flags.reprocess_all_images
         image_count = len(images)
         # Keep track of sub-tasks for saving results, pair with batch number
         save_tasks: list[tuple[int, AsyncResult]] = []
@@ -585,7 +609,7 @@ def process_images(cls, job, images):
                     images=chunk,
                     job_id=job.pk,
                     project_id=job.project.pk,
-                    reprocess_all_images=job.project.feature_flags.reprocess_all_images,
+                    reprocess_all_images=reprocess_all_images,
                 )
                 job.logger.info(f"Processed image batch {i+1} in {time.time() - request_sent:.2f}s")
             except Exception as e:
@@ -920,6 +944,524 @@ def run(cls, job: "Job"):
         job.save()
 
 
+class GenerateEmbeddingsJob(JobType):
+    """
+    Fill in the embeddings that a classifier head needs to be retrained.
+
+    Runs the same inference pipeline as an ML job, but only over detections that a person
+    has verified and that have no embedding yet. The backbone is frozen, so an embedding
+    is computed once and reused by every later retrain.
+
+    Existing detections are sent with the request, so the detector does not run again and
+    no new detections are created. Only the vectors are new.
+    """
+
+    name = "Generate embeddings"
+    key = "generate_embeddings"
+    required_fields = ("pipeline",)
+    user_creatable = True
+
+    @classmethod
+    def run(cls, job: "Job"):
+        if not job.pipeline:
+            raise ValueError("A generate_embeddings job needs a pipeline to run the backbone.")
+        if not job.project.feature_flags.store_classification_embeddings:
+            raise ValueError(
+                f"Project '{job.project}' does not have store_classification_embeddings enabled, "
+                "so the embeddings this job produces would be thrown away."
+            )
+
+        algorithm = cls.target_algorithm(job)
+        job.progress.add_stage("Finding detections", "collect")
+        job.progress.add_stage("Computing embeddings", "process")
+        job.update_status(JobState.STARTED)
+        job.started_at = datetime.datetime.now()
+        job.finished_at = None
+        job.progress.update_stage("collect", status=JobState.STARTED, progress=0)
+        job.save()
+
+        images = cls.images_needing_embeddings(job, algorithm)
+        job.progress.add_stage_param("collect", "Algorithm", algorithm.key)
+        job.progress.add_stage_param("collect", "Captures", len(images))
+        job.progress.update_stage("collect", status=JobState.SUCCESS, progress=1, total_images=len(images))
+        job.save()
+
+        if not images:
+            job.logger.info(f"Every verified detection already has an embedding from {algorithm.key}. Nothing to do.")
+            job.progress.update_stage("process", status=JobState.SUCCESS, progress=1)
+            job.finished_at = datetime.datetime.now()
+            job.update_status(JobState.SUCCESS, save=True)
+            return
+
+        job.logger.info(f"Computing {algorithm.key} embeddings for detections in {len(images)} capture(s)")
+        before = cls.embedding_count(algorithm)
+
+        # Reuse the ML job's dispatch loop rather than a parallel copy of it: batching,
+        # progress and result saving are already handled there.
+        MLJob.process_images(job, images, reprocess_all_images=True)
+
+        created = cls.embedding_count(algorithm) - before
+        job.logger.info(f"Stored {created} new embedding(s)")
+        job.progress.add_stage_param("process", "Embeddings stored", created)
+        job.save()
+
+    @classmethod
+    def target_algorithm(cls, job: "Job"):
+        """The pipeline's trainable algorithm. That is the one whose embeddings are worth storing."""
+        candidates = list(job.pipeline.algorithms.filter(trainable=True)) if job.pipeline else []
+        key = (job.params or {}).get("algorithm_key")
+        if key:
+            match = next((a for a in candidates if a.key == key), None)
+            if not match:
+                raise ValueError(
+                    f"Algorithm '{key}' is not a trainable algorithm on pipeline '{job.pipeline}'. "
+                    f"Trainable algorithms: {[a.key for a in candidates] or 'none'}"
+                )
+            return match
+        if not candidates:
+            raise ValueError(
+                f"Pipeline '{job.pipeline}' has no algorithm marked trainable, so there is no head "
+                "whose embeddings are worth storing."
+            )
+        if len(candidates) > 1:
+            raise ValueError(
+                f"Pipeline '{job.pipeline}' has several trainable algorithms "
+                f"({[a.key for a in candidates]}). Pass algorithm_key in the job params to choose one."
+            )
+        return candidates[0]
+
+    @classmethod
+    def images_needing_embeddings(cls, job: "Job", algorithm) -> list[SourceImage]:
+        """
+        Captures holding at least one verified detection with no embedding from this algorithm.
+
+        Verified only, by decision: an embedding is ~2 KB and only a labelled crop can train
+        a head, so embedding everything would cost gigabytes to no purpose.
+        """
+        from ami.main.models import Detection
+        from ami.ml import training_data
+
+        detections = (
+            Detection.objects.filter(occurrence_id__in=training_data.verified_occurrence_ids(job.project))
+            .exclude(embeddings__algorithm=algorithm)
+            .order_by()
+        )
+        image_ids = list(detections.values_list("source_image_id", flat=True).distinct())
+        if job.limit:
+            image_ids = image_ids[: job.limit]
+        return list(SourceImage.objects.filter(pk__in=image_ids))
+
+    @classmethod
+    def embedding_count(cls, algorithm) -> int:
+        from ami.ml.models import DetectionEmbedding
+
+        return DetectionEmbedding.objects.filter(algorithm=algorithm).count()
+
+
+class EvaluateAlgorithmJob(JobType):
+    """
+    Score an algorithm against a fixed set of occurrences people have verified.
+
+    Reads predictions that already exist rather than running anything, so an algorithm that
+    has processed the set is scored in one pass with no GPU. Comparing two models means
+    scoring both on the same set, which is why the set's membership is fixed.
+    """
+
+    name = "Evaluate algorithm"
+    key = "evaluate_algorithm"
+    required_params = ("algorithm_key", "occurrence_set_id")
+    user_creatable = True
+
+    STAGE_SCORE = "score"
+
+    @classmethod
+    def run(cls, job: "Job"):
+        from ami.main.models import OccurrenceSet
+        from ami.ml import evaluation
+        from ami.ml.models import Algorithm
+
+        params = job.params or {}
+        algorithm_key = params.get("algorithm_key")
+        occurrence_set_id = params.get("occurrence_set_id")
+        if not algorithm_key or not occurrence_set_id:
+            raise ValueError("An evaluate_algorithm job needs 'algorithm_key' and 'occurrence_set_id' in its params.")
+
+        algorithm = Algorithm.objects.filter(key=algorithm_key).first()
+        if not algorithm:
+            raise ValueError(f"No algorithm with key '{algorithm_key}'.")
+        # Scoped to the project: the id comes from the job's params, which any member who
+        # can create a job may set. An unscoped lookup would score a model against another
+        # project's occurrences and, because an evaluation is stored once per algorithm and
+        # set, overwrite that project's own result.
+        occurrence_set = OccurrenceSet.objects.for_project(job.project).filter(pk=occurrence_set_id).first()
+        if not occurrence_set:
+            raise ValueError(f"No occurrence set with id {occurrence_set_id} in this project.")
+
+        job.progress.add_stage("Scoring", cls.STAGE_SCORE)
+        job.update_status(JobState.STARTED)
+        job.started_at = datetime.datetime.now()
+        job.finished_at = None
+        job.progress.update_stage(cls.STAGE_SCORE, status=JobState.STARTED, progress=0)
+        job.save()
+
+        try:
+            result = evaluation.score(occurrence_set, algorithm)
+        except evaluation.NothingToScore as e:
+            # A missing step, not a bad model. Saying so beats recording an accuracy of zero.
+            job.logger.error(str(e))
+            job.progress.update_stage(cls.STAGE_SCORE, status=JobState.FAILURE, progress=0)
+            job.finished_at = datetime.datetime.now()
+            job.result = {"error": str(e)}
+            job.update_status(JobState.FAILURE, save=True)
+            return
+
+        stored = evaluation.save_evaluation(occurrence_set, algorithm, result, job=job)
+
+        job.logger.info(
+            f"{algorithm.key} on '{occurrence_set.name}': "
+            f"{result['micro_accuracy']:.3f} overall, {result['macro_accuracy']:.3f} averaged over "
+            f"{result['species_scored']} species"
+        )
+        # Said out loud because an accuracy over a handful of species reads the same as one
+        # over all of them. A score on 6 of 749 is a fact about this set, not about the model.
+        job.logger.info(
+            f"Scored {result['species_scored']} of the {result['species_in_set']} species in the set; "
+            f"{algorithm.key} can answer for {result['species_predictable']}."
+        )
+        if result["occurrences_skipped"]:
+            job.logger.info(
+                f"{result['occurrences_skipped']} occurrence(s) were left out: their species is not one "
+                "this algorithm can predict, or it never classified them."
+            )
+        job.progress.add_stage_param(cls.STAGE_SCORE, "Accuracy", round(result["micro_accuracy"], 3))
+        job.progress.add_stage_param(cls.STAGE_SCORE, "Averaged over species", round(result["macro_accuracy"], 3))
+        job.progress.add_stage_param(cls.STAGE_SCORE, "Occurrences scored", result["occurrences_scored"])
+        job.progress.add_stage_param(
+            cls.STAGE_SCORE, "Species", f"{result['species_scored']} of {result['species_in_set']} in set"
+        )
+        job.progress.add_stage_param(cls.STAGE_SCORE, "Species the model knows", result["species_predictable"])
+        job.progress.update_stage(cls.STAGE_SCORE, status=JobState.SUCCESS, progress=1)
+        job.result = {"evaluation_id": stored.pk, "micro_accuracy": result["micro_accuracy"]}
+        job.finished_at = datetime.datetime.now()
+        job.update_status(JobState.SUCCESS, save=True)
+        job.save()
+
+
+class TrainClassifierJob(JobType):
+    """
+    Retrain a classifier head from the species people have verified in this project.
+
+    Antenna prepares the training set and hands the processing service a URL to it, rather
+    than posting the rows: a project with a few hundred thousand verified labels runs to
+    hundreds of megabytes, which is fragile to send in one request and has to start over if
+    the connection drops.
+
+    The job does not wait for training to finish. It dispatches and leaves the job STARTED;
+    the service reports back through the job's result endpoint. Waiting inline would hit the
+    sub-task timeout on anything but a toy dataset.
+    """
+
+    name = "Train classifier"
+    key = "train_classifier"
+    required_params = ("algorithm_key",)
+    user_creatable = True
+
+    # This job dispatches and then waits for the service to report back, writing nothing to
+    # its own row in between, so the default threshold reads a healthy run as a dead one.
+    # Matched to the life of the callback token: once that expires Antenna refuses the
+    # callback anyway, so a job still waiting past it can never finish.
+    stalled_after_minutes = 24 * 60
+
+    STAGE_PREPARE = "prepare"
+    STAGE_DISPATCH = "dispatch"
+    STAGE_TRAIN = "train"
+
+    @classmethod
+    def run(cls, job: "Job"):
+        from ami.ml.models import Algorithm
+        from ami.ml.models.processing_service import ProcessingService
+        from ami.ml.training_dataset import NotEnoughVerifiedData, build_training_dataset
+
+        params = job.params or {}
+        algorithm_key = params.get("algorithm_key")
+        if not algorithm_key:
+            raise ValueError("A train_classifier job needs an 'algorithm_key' in its params.")
+
+        algorithm = Algorithm.objects.filter(key=algorithm_key).first()
+        if not algorithm:
+            raise ValueError(f"No algorithm with key '{algorithm_key}'.")
+        if not algorithm.trainable:
+            raise ValueError(
+                f"Algorithm '{algorithm_key}' is not marked trainable by its processing service. "
+                "Re-register the pipelines if the service has since been updated."
+            )
+
+        job.progress.add_stage("Preparing training set", cls.STAGE_PREPARE)
+        job.progress.add_stage("Sending to processing service", cls.STAGE_DISPATCH)
+        job.progress.add_stage("Training", cls.STAGE_TRAIN)
+        job.update_status(JobState.STARTED)
+        job.started_at = datetime.datetime.now()
+        job.finished_at = None
+        job.progress.update_stage(cls.STAGE_PREPARE, status=JobState.STARTED, progress=0)
+        job.save()
+
+        taxa_list = cls.target_taxa_list(job)
+        # The algorithm's training_config holds the defaults the service published; a job
+        # may override any of them for one run.
+        config = algorithm.training_config
+        try:
+            dataset = build_training_dataset(
+                project=job.project,
+                algorithm=algorithm,
+                min_per_species=params.get("min_per_species", config.min_per_species),
+                test_fraction=params.get("test_fraction", config.test_fraction),
+                split_salt=params.get("split_salt", config.split_salt),
+                taxa_list=taxa_list,
+                job=job,
+            )
+        except NotEnoughVerifiedData as e:
+            # A data problem, not a crash. Say so plainly rather than failing with a traceback.
+            job.logger.error(str(e))
+            job.progress.update_stage(cls.STAGE_PREPARE, status=JobState.FAILURE, progress=0)
+            job.finished_at = datetime.datetime.now()
+            job.result = {"error": str(e)}
+            job.update_status(JobState.FAILURE, save=True)
+            return
+
+        meta = dataset["metadata"]
+        job.logger.info(
+            f"Training set: {meta['rows']} verified crops over {len(meta['classes'])} species "
+            f"({meta['train']} train / {meta['test']} held out)"
+        )
+        if meta.get("taxa_list"):
+            job.logger.info(
+                f"Species list comes from taxa list '{meta['taxa_list']['name']}' " f"({len(meta['classes'])} species)"
+            )
+            without_data = meta.get("classes_without_verified_data") or []
+            if without_data:
+                job.logger.info(
+                    f"{len(without_data)} species in the list have no verified crops yet. They keep "
+                    "whatever the current head already knows."
+                )
+        if meta.get("dropped_species"):
+            job.logger.warning(
+                f"{len(meta['dropped_species'])} verified species are not in the taxa list and were "
+                f"left out: {', '.join(meta['dropped_species'][:5])}"
+                f"{' ...' if len(meta['dropped_species']) > 5 else ''}"
+            )
+        if meta["verified_detections_without_embedding"]:
+            job.logger.warning(
+                f"{meta['verified_detections_without_embedding']} verified detection(s) have no embedding "
+                "from this algorithm and were left out. Re-run the pipeline over them to include them."
+            )
+        job.progress.add_stage_param(cls.STAGE_PREPARE, "Rows", meta["rows"])
+        job.progress.add_stage_param(cls.STAGE_PREPARE, "Species", len(meta["classes"]))
+        job.progress.add_stage_param(cls.STAGE_PREPARE, "Dataset", dataset["url"])
+        job.progress.update_stage(cls.STAGE_PREPARE, status=JobState.SUCCESS, progress=1)
+        job.save()
+
+        service = (
+            ProcessingService.objects.filter(
+                projects=job.project,
+                pipelines__algorithms=algorithm,
+                endpoint_url__isnull=False,
+            )
+            .exclude(endpoint_url="")
+            .distinct()
+            .first()
+        )
+        if not service:
+            # Pull-mode workers register with a null endpoint_url, so there is nothing to
+            # send a training request to. Supporting them means routing this through the
+            # task queue instead.
+            raise ValueError(
+                f"No push-mode processing service in this project serves '{algorithm_key}'. "
+                "Training cannot be dispatched to a pull-mode worker."
+            )
+
+        job.progress.update_stage(cls.STAGE_DISPATCH, status=JobState.STARTED, progress=0)
+        job.save()
+        cls.dispatch(job=job, service=service, algorithm=algorithm, dataset=dataset)
+
+    @classmethod
+    def target_taxa_list(cls, job: "Job"):
+        """
+        Which taxa list sets the head's species.
+
+        A job may name one; otherwise the project's default is used. Without either, the
+        class list falls back to whatever has been verified.
+        """
+        from ami.main.models import TaxaList
+
+        taxa_list_id = (job.params or {}).get("taxa_list_id")
+        if taxa_list_id:
+            # Scoped for the same reason as the evaluation set above.
+            taxa_list = TaxaList.objects.for_project(job.project).filter(pk=taxa_list_id).first()
+            if not taxa_list:
+                raise ValueError(f"No taxa list with id {taxa_list_id} in this project.")
+            return taxa_list
+        return job.project.default_taxa_list
+
+    @classmethod
+    def dispatch(cls, job: "Job", service, algorithm, dataset: dict) -> None:
+        """Hand the service the dataset URL and leave the job running until it reports back."""
+        from ami.ml.training_dispatch import send_training_request
+
+        response = send_training_request(job=job, service=service, algorithm=algorithm, dataset=dataset)
+
+        # The service posts its callback before returning from /train, so a fast run is
+        # already finished by the time this line is reached. Writing this copy's progress
+        # would put the training stage back to "started" on a job that is done.
+        job.refresh_from_db()
+        if job.status in JobState.final_states():
+            job.logger.info(f"{service.name} already reported its result.")
+            return
+
+        job.progress.update_stage(cls.STAGE_DISPATCH, status=JobState.SUCCESS, progress=1)
+        job.progress.update_stage(cls.STAGE_TRAIN, status=JobState.STARTED, progress=0)
+        job.logger.info(f"Training request accepted by {service.name}. Waiting for it to report back.")
+        job.save(update_fields=["progress", "updated_at"])
+
+        if response is None:
+            # The service accepted the work and will post to the job's training-result
+            # endpoint when it finishes. Leaving the job STARTED is the point: a real
+            # training set outlasts the request that started it.
+            job.logger.info("Waiting for the service to report back.")
+            return
+
+        if response is not None:
+            # Answered inline, which small datasets do. Record it now rather than waiting
+            # for a callback that has already been overtaken.
+            cls.record_result(
+                job=job,
+                payload={
+                    "result": response,
+                    "dataset": dataset["metadata"],
+                    # Kept alongside the metadata so the registered version can point at the
+                    # exact file it was fitted on, not just describe it.
+                    "dataset_url": dataset["url"],
+                },
+            )
+
+    @classmethod
+    def record_result(cls, job: "Job", payload: dict) -> None:
+        """Store what the service reported, register the new version, and finish the job."""
+        # A service posts its callback before returning from /train, so a fast run reports
+        # twice: once through the callback and once inline. Without this guard each retrain
+        # registered two algorithm versions. Re-read first, because the inline caller holds
+        # a copy from before the callback landed.
+        job.refresh_from_db(fields=["status", "result"])
+        if job.status in JobState.final_states():
+            job.logger.info("A training result is already recorded for this job; ignoring a duplicate.")
+            return
+
+        result = payload.get("result") or {}
+        job.result = payload
+
+        # A result can arrive through the callback on a job whose stages were never set up,
+        # for instance after a restart. Make sure the stage exists before reporting into it.
+        if not any(stage.key == cls.STAGE_TRAIN for stage in job.progress.stages):
+            job.progress.add_stage("Training", cls.STAGE_TRAIN)
+        # A service that is reporting back plainly received the request, and the callback
+        # can arrive before the dispatching code closes that stage.
+        if any(stage.key == cls.STAGE_DISPATCH for stage in job.progress.stages):
+            job.progress.update_stage(cls.STAGE_DISPATCH, status=JobState.SUCCESS, progress=1)
+
+        for warning in result.get("warnings", []):
+            job.logger.warning(warning)
+
+        candidate = result.get("candidate_metrics") or {}
+        incumbent = result.get("incumbent_metrics") or {}
+        job.progress.add_stage_param(cls.STAGE_TRAIN, "New head top-1", candidate.get("top1"))
+        job.progress.add_stage_param(cls.STAGE_TRAIN, "Current head top-1", incumbent.get("top1"))
+        job.progress.add_stage_param(cls.STAGE_TRAIN, "Better", result.get("promote"))
+        job.logger.info(result.get("reason", "Training finished."))
+
+        new_version = cls.register_new_version(job=job, payload=payload)
+        if new_version:
+            from ami.ml.models.training_set import attach_algorithm
+
+            job.progress.add_stage_param(cls.STAGE_TRAIN, "New version", new_version.key)
+            job.logger.info(f"Registered {new_version} as version {new_version.version}")
+            # The occurrences were recorded when the set was built, before this version
+            # existed. Point them at it now.
+            linked = attach_algorithm(job=job, algorithm=new_version)
+            job.logger.info(f"Linked {linked} occurrence(s) to {new_version.key}")
+
+        job.progress.update_stage(cls.STAGE_TRAIN, status=JobState.SUCCESS, progress=1)
+        job.finished_at = datetime.datetime.now()
+        job.update_status(JobState.SUCCESS, save=True)
+        job.save()
+
+    @classmethod
+    def register_new_version(cls, job: "Job", payload: dict):
+        """
+        Record the trained head as a new version of the algorithm it was trained from.
+
+        A Classification points at an Algorithm row, so a version that changed in place
+        would make past predictions untraceable. Each retrain therefore gets its own row:
+        same name, next version number, and a new key, because key is unique on its own.
+        """
+        from ami.ml.models import Algorithm, AlgorithmCategoryMap
+        from ami.ml.schemas import AlgorithmTrainingInfo
+
+        result = payload.get("result") or {}
+        dataset = payload.get("dataset") or {}
+        parent_key = (job.params or {}).get("algorithm_key")
+        parent = Algorithm.objects.filter(key=parent_key).first()
+        if not parent:
+            job.logger.warning(f"Cannot register a new version: no algorithm with key '{parent_key}'.")
+            return None
+
+        labels = result.get("labels") or []
+        if not labels:
+            job.logger.warning("The service returned no class list, so no new version was registered.")
+            return None
+
+        trained_at = result.get("trained_at") or ""
+        stamp = str(trained_at).replace(":", "").replace("-", "").replace(".", "")[:15] or f"job{job.pk}"
+        version = (
+            Algorithm.objects.filter(name=parent.name).order_by("-version").values_list("version", flat=True).first()
+            or parent.version
+        ) + 1
+
+        category_map = AlgorithmCategoryMap.objects.create(
+            labels=labels,
+            data=[{"label": label, "index": i} for i, label in enumerate(labels)],
+            version=stamp,
+            description=(
+                f"Retrained from {dataset.get('rows', len(labels))} verified crops in "
+                f"project '{job.project.name}' by job #{job.pk}."
+            ),
+        )
+
+        return Algorithm.objects.create(
+            name=parent.name,
+            key=f"{parent.key}-v{version}-{stamp}",
+            # Where the weights are kept. Empty when the service did not upload them, in
+            # which case the head exists only on that service's own disk.
+            uri=result.get("head_url") or "",
+            version=version,
+            version_name=str(trained_at) or stamp,
+            task_type=parent.task_type,
+            description=parent.description,
+            trainable=parent.trainable,
+            training_config=parent.training_config,
+            category_map=category_map,
+            training_info=AlgorithmTrainingInfo(
+                trained_at=trained_at or None,
+                dataset_url=payload.get("dataset_url") or dataset.get("url"),
+                dataset_rows=(result.get("rows") or {}).get("kept"),
+                dataset_classes=len(labels),
+                metrics=result.get("candidate_metrics") or {},
+                previous_metrics=result.get("incumbent_metrics") or {},
+                parent_algorithm_key=parent.key,
+                job_id=job.pk,
+                warnings=result.get("warnings") or [],
+            ),
+        )
+
+
 class RegroupEventsJob(JobType):
     """
     Regroup a deployment's captures into Events using the project's
@@ -985,6 +1527,9 @@ def run(cls, job: "Job"):
     UnknownJobType,
     DataExportJob,
     PostProcessingJob,
+    TrainClassifierJob,
+    GenerateEmbeddingsJob,
+    EvaluateAlgorithmJob,
 ]
 
 
@@ -1021,7 +1566,8 @@ class Job(BaseModel):
     # Redis SREM-driven progress save, so this is effectively "no progress for
     # N minutes". 10 is conservative; raise if legitimate long-running jobs get
     # reaped.
-    STALLED_JOBS_MAX_MINUTES = 10
+    # The default deadline, owned by JobType so a job type can set its own.
+    STALLED_JOBS_MAX_MINUTES = JobType.stalled_after_minutes
     # Zombie-stream reaper: age threshold above which a NATS stream for a job
     # in a terminal state (or missing from Django) is considered safe to drop.
     # Kept well above :attr:`STALLED_JOBS_MAX_MINUTES` so newly-dispatched jobs
diff --git a/ami/jobs/serializers.py b/ami/jobs/serializers.py
index f53199e73..979ba062f 100644
--- a/ami/jobs/serializers.py
+++ b/ami/jobs/serializers.py
@@ -14,7 +14,16 @@
 from ami.ml.schemas import PipelineProcessingTask, PipelineTaskResult, ProcessingServiceClientInfo
 from ami.ml.serializers import PipelineNestedSerializer
 
-from .models import JOB_LOGS_DEFAULT_LIMIT, Job, JobProgress, MLJob, _legacy_logs_shape, serialize_job_logs
+from .models import (
+    JOB_LOGS_DEFAULT_LIMIT,
+    VALID_JOB_TYPES,
+    Job,
+    JobProgress,
+    MLJob,
+    _legacy_logs_shape,
+    get_job_type_by_key,
+    serialize_job_logs,
+)
 from .schemas import QueuedTaskAcknowledgment
 
 
@@ -52,9 +61,12 @@ class JobListSerializer(DefaultSerializer):
     progress = SchemaField(schema=JobProgress, read_only=True)
     logs = serializers.SerializerMethodField()
     job_type = JobTypeSerializer(read_only=True)
-    # All jobs created from the Jobs UI are ML jobs (datasync, etc. are created for the user)
-    # @TODO Remove this when the UI is updated pass a job type. This should be a required field.
+    # Defaulted rather than required: an API client written before job types were
+    # selectable still means an ML job.
     job_type_key = serializers.SlugField(write_only=True, default=MLJob.key)
+    # Free-form, and read by the job type that consumes it. A train_classifier job
+    # carries its algorithm_key here; an ML job ignores it entirely.
+    params = serializers.JSONField(required=False, allow_null=True)
 
     project_id = serializers.PrimaryKeyRelatedField(
         label="Project",
@@ -129,6 +141,7 @@ class Meta:
             "logs",
             "job_type",
             "job_type_key",
+            "params",
             "data_export",
             "dispatch_mode",
             # "duration",
@@ -148,6 +161,42 @@ class Meta:
             "dispatch_mode",
         ]
 
+    def validate_job_type_key(self, value):
+        job_type = get_job_type_by_key(value)
+        if not job_type:
+            known = sorted(t.key for t in VALID_JOB_TYPES)
+            raise serializers.ValidationError(f"Unknown job type '{value}'. Known types: {known}")
+        return value
+
+    def validate(self, attrs):
+        """
+        Refuse a job that could never run.
+
+        Each job type says what it cannot run without. Checking here means a missing
+        pipeline or algorithm is reported while the person is still looking at the form,
+        rather than as a failed job minutes later.
+        """
+        attrs = super().validate(attrs)
+        job_type = get_job_type_by_key(attrs.get("job_type_key", MLJob.key))
+        if not job_type:
+            return attrs
+
+        missing_fields = [name for name in job_type.required_fields if not attrs.get(name)]
+        if missing_fields:
+            raise serializers.ValidationError(
+                # Plural, so the message does not have to choose between "a" and "an":
+                # two of the four job type names start with a vowel sound.
+                {f"{name}_id": f"{job_type.name} jobs need a {name}." for name in missing_fields}
+            )
+
+        params = attrs.get("params") or {}
+        missing_params = [name for name in job_type.required_params if not params.get(name)]
+        if missing_params:
+            raise serializers.ValidationError(
+                {"params": f"{job_type.name} jobs need {', '.join(missing_params)} in their params."}
+            )
+        return attrs
+
     @extend_schema_field(
         {
             "type": "object",
diff --git a/ami/jobs/tasks.py b/ami/jobs/tasks.py
index b00213ebb..f0a9214f9 100644
--- a/ami/jobs/tasks.py
+++ b/ami/jobs/tasks.py
@@ -988,7 +988,7 @@ def check_stale_jobs(minutes: int | None = None, dry_run: bool = False) -> list[
     from celery.result import AsyncResult
     from django.db import transaction
 
-    from ami.jobs.models import Job, JobDispatchMode, JobState
+    from ami.jobs.models import Job, JobDispatchMode, JobState, get_job_type_by_key
 
     if minutes is None:
         minutes = Job.STALLED_JOBS_MAX_MINUTES
@@ -1014,6 +1014,17 @@ def check_stale_jobs(minutes: int | None = None, dry_run: bool = False) -> list[
                 # Another concurrent run already handled this job.
                 continue
 
+            # Each job type says how long one of its jobs may go untouched. A type that
+            # hands work to an external service and waits to be called back writes nothing
+            # to its own row meanwhile, so silence is not evidence that it died. Candidates
+            # are gathered above at the default, then each is judged by its own deadline.
+            # Looked up rather than read off the job so an unrecognised job_type_key leaves
+            # that one job alone instead of raising and stopping the whole sweep.
+            job_type = get_job_type_by_key(job.job_type_key)
+            limit = job_type.stalled_after_minutes if job_type else minutes
+            if job.updated_at > datetime.datetime.now() - datetime.timedelta(minutes=limit):
+                continue
+
             celery_state = None
             if job.task_id:
                 try:
diff --git a/ami/jobs/tests/test_jobs.py b/ami/jobs/tests/test_jobs.py
index 00b7934a7..f57a8cbbf 100644
--- a/ami/jobs/tests/test_jobs.py
+++ b/ami/jobs/tests/test_jobs.py
@@ -10,6 +10,7 @@
 from ami.base.serializers import reverse_with_params
 from ami.jobs.models import (
     DataStorageSyncJob,
+    EvaluateAlgorithmJob,
     Job,
     JobDispatchMode,
     JobLog,
@@ -18,9 +19,10 @@
     MLJob,
     RegroupEventsJob,
     SourceImageCollectionPopulateJob,
+    TrainClassifierJob,
 )
-from ami.main.models import Deployment, Event, Project, SourceImage, SourceImageCollection
-from ami.ml.models import Pipeline
+from ami.main.models import Deployment, Event, OccurrenceSet, Project, SourceImage, SourceImageCollection, TaxaList
+from ami.ml.models import Algorithm, Pipeline
 from ami.ml.models.processing_service import ProcessingService
 from ami.ml.orchestration.jobs import queue_images_to_nats
 from ami.tests.fixtures.main import create_captures
@@ -328,6 +330,61 @@ def test_create_job(self):
         # progress = JobProgress(**data["progress"])
         # self.assertEqual(progress.summary.status, JobState.CREATED)
 
+    def test_creating_a_job_of_an_unknown_type_is_refused(self):
+        jobs_create_url = reverse_with_params("api:job-list", params={"project_id": self.project.pk})
+        self.client.force_authenticate(user=self.user)
+
+        resp = self.client.post(
+            jobs_create_url,
+            {"project_id": self.project.pk, "name": "Nonsense", "delay": 0, "job_type_key": "not-a-job-type"},
+        )
+
+        self.assertEqual(resp.status_code, 400)
+        self.assertIn("job_type_key", resp.json())
+
+    def test_a_job_missing_what_its_type_needs_is_refused(self):
+        """
+        The gap is reported while the form is still open, rather than as a job that fails
+        minutes later for want of an algorithm.
+        """
+        jobs_create_url = reverse_with_params("api:job-list", params={"project_id": self.project.pk})
+        self.client.force_authenticate(user=self.user)
+
+        resp = self.client.post(
+            jobs_create_url,
+            {
+                "project_id": self.project.pk,
+                "name": "Evaluate nothing in particular",
+                "delay": 0,
+                "job_type_key": EvaluateAlgorithmJob.key,
+            },
+            format="json",
+        )
+
+        self.assertEqual(resp.status_code, 400)
+        self.assertIn("params", resp.json())
+
+    def test_a_job_carrying_what_its_type_needs_is_created(self):
+        jobs_create_url = reverse_with_params("api:job-list", params={"project_id": self.project.pk})
+        self.client.force_authenticate(user=self.user)
+
+        resp = self.client.post(
+            jobs_create_url,
+            {
+                "project_id": self.project.pk,
+                "name": "Evaluate a head",
+                "delay": 0,
+                "job_type_key": EvaluateAlgorithmJob.key,
+                "params": {"algorithm_key": "some-head", "occurrence_set_id": 1},
+            },
+            format="json",
+        )
+
+        self.assertEqual(resp.status_code, 201)
+        job = Job.objects.get(pk=resp.json()["id"])
+        self.assertEqual(job.job_type_key, EvaluateAlgorithmJob.key)
+        self.assertEqual(job.params["algorithm_key"], "some-head")
+
     def test_run_job(self):
         data = self._create_job("Test run job", start_now=False)
 
@@ -1744,3 +1801,115 @@ def test_browsable_page_renders_number_input(self):
         html = response.content.decode()
         self.assertNotIn('<select name="source_image_single"', html)
         self.assertIn('<input type="number" name="source_image_single"', html)
+
+
+class TestRetrainingJobPermissions(APITestCase):
+    """
+    Who may run a retrain, an evaluation, or an embedding run.
+
+    Job.check_custom_permission builds the codename from the job type key, so a type with
+    no matching permission on Project is runnable by nobody but a superuser. All three of
+    these were in that state: even a project manager could create such a job and then not
+    start it.
+    """
+
+    RETRAINING_JOB_PERMISSIONS = (
+        "run_generate_embeddings_job",
+        "run_train_classifier_job",
+        "run_evaluate_algorithm_job",
+    )
+
+    def setUp(self):
+        from ami.users.roles import BasicMember, Identifier, MLDataManager, ProjectManager
+
+        self.project = Project.objects.create(name="Retraining Permissions Project")
+        self.superuser = User.objects.create_user(email="rp-super@insectai.org", is_superuser=True, is_staff=True)
+        self.project_manager = User.objects.create_user(email="rp-manager@insectai.org")
+        self.ml_data_manager = User.objects.create_user(email="rp-mldata@insectai.org")
+        self.identifier = User.objects.create_user(email="rp-identifier@insectai.org")
+        self.basic_member = User.objects.create_user(email="rp-basic@insectai.org")
+        self.outsider = User.objects.create_user(email="rp-outsider@insectai.org")
+
+        ProjectManager.assign_user(self.project_manager, self.project)
+        MLDataManager.assign_user(self.ml_data_manager, self.project)
+        Identifier.assign_user(self.identifier, self.project)
+        BasicMember.assign_user(self.basic_member, self.project)
+
+    def _may_run(self, user) -> set:
+        # Re-read the user so guardian's permission cache reflects the role assignment.
+        user = User.objects.get(pk=user.pk)
+        return {perm for perm in self.RETRAINING_JOB_PERMISSIONS if user.has_perm(perm, self.project)}
+
+    def test_an_ml_data_manager_may_run_all_three(self):
+        self.assertEqual(self._may_run(self.ml_data_manager), set(self.RETRAINING_JOB_PERMISSIONS))
+
+    def test_a_project_manager_may_run_all_three(self):
+        """ProjectManager inherits MLDataManager's permissions, but guardian rows are per
+        group, so this is not implied by the test above."""
+        self.assertEqual(self._may_run(self.project_manager), set(self.RETRAINING_JOB_PERMISSIONS))
+
+    def test_a_superuser_may_run_all_three(self):
+        self.assertEqual(self._may_run(self.superuser), set(self.RETRAINING_JOB_PERMISSIONS))
+
+    def test_an_identifier_may_not(self):
+        self.assertEqual(self._may_run(self.identifier), set())
+
+    def test_a_basic_member_may_not(self):
+        self.assertEqual(self._may_run(self.basic_member), set())
+
+    def test_a_non_member_may_not(self):
+        self.assertEqual(self._may_run(self.outsider), set())
+
+
+class TestJobsScopeWhatTheyAreGiven(TestCase):
+    """
+    A job must only reach the evaluation sets and taxa lists its own project may use.
+
+    Both are named by id in the job's params, which any member who can create a job can
+    set. Without scoping, a job in one project can read another project's private set --
+    and save_evaluation stores one row per (algorithm, occurrence set), so it overwrites
+    the other project's stored result rather than only reading it.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Scoping Project")
+        self.other_project = Project.objects.create(name="Someone Else's Project")
+
+        self.own_set = OccurrenceSet.objects.create(name="Our blind set")
+        self.own_set.projects.add(self.project)
+        self.global_set = OccurrenceSet.objects.create(name="Platform-wide blind set")
+        self.their_set = OccurrenceSet.objects.create(name="Their private blind set")
+        self.their_set.projects.add(self.other_project)
+
+        # A real algorithm, so the evaluate job reaches the occurrence-set lookup instead
+        # of failing earlier on an unknown key.
+        self.algorithm = Algorithm.objects.create(name="Scoped model", key="scoped-model")
+
+        self.own_list = TaxaList.objects.create(name="Our species")
+        self.own_list.projects.add(self.project)
+        self.their_list = TaxaList.objects.create(name="Their species")
+        self.their_list.projects.add(self.other_project)
+
+    def _job(self, job_type, **params):
+        return Job.objects.create(project=self.project, name="Scoping", job_type_key=job_type.key, params=params)
+
+    def test_an_evaluate_job_refuses_another_projects_set(self):
+        job = self._job(
+            EvaluateAlgorithmJob,
+            algorithm_key=self.algorithm.key,
+            occurrence_set_id=self.their_set.pk,
+        )
+
+        with self.assertRaises(ValueError):
+            EvaluateAlgorithmJob.run(job)
+
+    def test_a_train_job_refuses_another_projects_taxa_list(self):
+        job = self._job(TrainClassifierJob, algorithm_key=self.algorithm.key, taxa_list_id=self.their_list.pk)
+
+        with self.assertRaises(ValueError):
+            TrainClassifierJob.target_taxa_list(job)
+
+    def test_a_train_job_accepts_its_own_taxa_list(self):
+        job = self._job(TrainClassifierJob, algorithm_key=self.algorithm.key, taxa_list_id=self.own_list.pk)
+
+        self.assertEqual(TrainClassifierJob.target_taxa_list(job), self.own_list)
diff --git a/ami/jobs/tests/test_update_stale_jobs.py b/ami/jobs/tests/test_update_stale_jobs.py
index a64c18e68..260e57369 100644
--- a/ami/jobs/tests/test_update_stale_jobs.py
+++ b/ami/jobs/tests/test_update_stale_jobs.py
@@ -4,7 +4,7 @@
 from django.test import TestCase
 from django.utils import timezone
 
-from ami.jobs.models import Job, JobDispatchMode, JobState
+from ami.jobs.models import Job, JobDispatchMode, JobState, MLJob, TrainClassifierJob
 from ami.jobs.tasks import check_stale_jobs
 from ami.main.models import Project
 
@@ -13,11 +13,12 @@ class CheckStaleJobsTest(TestCase):
     def setUp(self):
         self.project = Project.objects.create(name="Stale jobs test project")
 
-    def _create_job(self, status=JobState.STARTED, minutes_ago=120, task_id=None):
+    def _create_job(self, status=JobState.STARTED, minutes_ago=120, task_id=None, job_type=None):
         job = Job.objects.create(
             project=self.project,
             name=f"Test job {status}",
             status=status,
+            job_type_key=(job_type or MLJob).key,
         )
         Job.objects.filter(pk=job.pk).update(
             updated_at=timezone.now() - timedelta(minutes=minutes_ago),
@@ -139,3 +140,62 @@ def test_skips_created_but_unstarted_jobs(self, mock_cleanup):
         job.refresh_from_db()
         self.assertEqual(job.status, JobState.CREATED.value)
         mock_cleanup.assert_not_called()
+
+
+class JobTypesThatWaitForACallbackTest(TestCase):
+    """
+    A training job goes quiet on purpose.
+
+    It hands the work to a processing service and waits to be called back, so nothing
+    touches it in the meantime: its progress messages go to the log table, not to the job
+    row. The stale-job check reads that silence as a dead job and finishes it with no head
+    registered, and the real callback is then refused because the job is already in a final
+    state. Any run longer than the ordinary threshold died this way.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Callback waiting project")
+
+    def _job(self, job_type, minutes_ago):
+        job = Job.objects.create(
+            project=self.project,
+            name="Waiting",
+            status=JobState.STARTED,
+            job_type_key=job_type.key,
+        )
+        Job.objects.filter(pk=job.pk).update(updated_at=timezone.now() - timedelta(minutes=minutes_ago))
+        job.refresh_from_db()
+        return job
+
+    @patch("ami.jobs.tasks.cleanup_async_job_if_needed")
+    def test_a_training_job_is_left_alone_while_its_callback_can_still_arrive(self, mock_cleanup):
+        job = self._job(TrainClassifierJob, minutes_ago=120)
+
+        results = check_stale_jobs()
+
+        self.assertEqual(results, [])
+        job.refresh_from_db()
+        self.assertEqual(job.status, JobState.STARTED.value)
+        mock_cleanup.assert_not_called()
+
+    @patch("ami.jobs.tasks.cleanup_async_job_if_needed")
+    def test_a_training_job_is_revoked_once_its_callback_can_no_longer_arrive(self, mock_cleanup):
+        """The token authorising the callback expires, so past that the job cannot finish."""
+        job = self._job(TrainClassifierJob, minutes_ago=TrainClassifierJob.stalled_after_minutes + 60)
+
+        results = check_stale_jobs()
+
+        self.assertEqual([r["action"] for r in results], ["revoked"])
+        job.refresh_from_db()
+        self.assertEqual(job.status, JobState.REVOKED.value)
+
+    @patch("ami.jobs.tasks.cleanup_async_job_if_needed")
+    def test_an_ordinary_job_still_goes_at_the_usual_threshold(self, mock_cleanup):
+        """The longer wait is only for job types that say they wait for a callback."""
+        job = self._job(MLJob, minutes_ago=120)
+
+        results = check_stale_jobs()
+
+        self.assertEqual([r["action"] for r in results], ["revoked"])
+        job.refresh_from_db()
+        self.assertEqual(job.status, JobState.REVOKED.value)
diff --git a/ami/jobs/views.py b/ami/jobs/views.py
index 380d9f959..af8b54b04 100644
--- a/ami/jobs/views.py
+++ b/ami/jobs/views.py
@@ -7,6 +7,7 @@
 from django.core.cache import cache
 from django.db.models import Q
 from django.db.models.query import QuerySet
+from django.http import Http404
 from django.utils import timezone
 from django_filters import rest_framework as filters
 from drf_spectacular.utils import extend_schema, extend_schema_view
@@ -14,6 +15,8 @@
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied, ValidationError
 from rest_framework.filters import BaseFilterBackend
+from rest_framework.parsers import MultiPartParser
+from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 
 from ami.base.filters import RelatedIdFilter
@@ -300,8 +303,6 @@ def perform_create(self, serializer):
         """
         If the ``start_now`` parameter is passed, enqueue the job immediately.
         """
-        # All jobs created from the Jobs UI are ML jobs.
-        # @TODO Remove this when the UI is updated pass a job type
         # Get an instance for the model without saving
         obj = serializer.Meta.model(**serializer.validated_data)
         # Check permissions before saving
@@ -484,11 +485,109 @@ async def get_tasks():
             job.logger.debug(fetch_msg)
         return Response({"tasks": tasks})
 
+    def _job_for_callback(self, pk, request) -> Job:
+        """
+        The job a processing service is reporting about, if its token proves it may.
+
+        get_object() applies project visibility, which an unauthenticated service fails,
+        so the job is looked up directly and the signed token is what authorises the call.
+        """
+        from ami.ml.training_dispatch import verify_callback_token
+
+        job = Job.objects.filter(pk=pk).first()
+        if not job:
+            raise Http404("Job not found.")
+
+        token = request.headers.get("Authorization", "").removeprefix("Token ").strip()
+        if not verify_callback_token(token, job):
+            raise PermissionDenied("Invalid or expired training callback token.")
+        return job
+
     @extend_schema(
         request=MLJobResultsRequestSerializer,
         responses={200: MLJobResultsResponseSerializer},
         parameters=[project_id_doc_param],
     )
+    @extend_schema(exclude=True)
+    @action(
+        detail=True,
+        methods=["post"],
+        url_path="training-result",
+        name="training-result",
+        # A processing service has no Antenna account. It proves itself with the signed
+        # token Antenna issued when it dispatched the job, checked below.
+        permission_classes=[AllowAny],
+        authentication_classes=[],
+    )
+    def training_result(self, request, pk=None):
+        """
+        Receive the outcome of a retraining run from a processing service.
+
+        Training can outlast the request that started it, so the service reports back here
+        instead of holding the connection open.
+        """
+        from ami.jobs.models import TrainClassifierJob
+
+        job = self._job_for_callback(pk, request)
+
+        if job.job_type_key != TrainClassifierJob.key:
+            raise ValidationError(f"Job #{job.pk} is not a training job.")
+
+        if job.status in JobState.final_states():
+            # The service answered inline and the result is already recorded, or a retry
+            # arrived late. Either way the first answer stands.
+            logger.info("Ignoring a training result for job %s, which already finished", job.pk)
+            return Response({"status": "already recorded"})
+
+        TrainClassifierJob.record_result(job=job, payload=request.data)
+        logger.info("Recorded a training result for job %s", job.pk)
+        return Response({"status": "recorded"})
+
+    @extend_schema(exclude=True)
+    @action(
+        detail=True,
+        methods=["post"],
+        url_path="training-head",
+        name="training-head",
+        # Same token as the result callback: a processing service has no Antenna account.
+        permission_classes=[AllowAny],
+        authentication_classes=[],
+        parser_classes=[MultiPartParser],
+    )
+    def training_head(self, request, pk=None):
+        """
+        Receive the head a retraining run produced, so Antenna keeps a copy of the weights.
+
+        Without this the head exists only on the service's disk, under a cache directory,
+        and Antenna records that a version exists without being able to say where it is.
+        """
+        from ami.jobs.models import TrainClassifierJob
+        from ami.ml.trained_head import HeadTooLarge, store
+
+        job = self._job_for_callback(pk, request)
+
+        if job.job_type_key != TrainClassifierJob.key:
+            raise ValidationError(f"Job #{job.pk} is not a training job.")
+
+        if job.status in JobState.final_states():
+            # The token stays valid for 24 hours and the head is stored at a path fixed by
+            # the job, so without this the weights a registered version points at could be
+            # replaced for a day after the run ended. A service uploads before it reports
+            # its result, so a run that is still going is unaffected.
+            raise ValidationError(f"Job #{job.pk} has already finished; its head can no longer be replaced.")
+
+        if not request.FILES:
+            raise ValidationError("No head files were uploaded.")
+
+        algorithm_key = (job.params or {}).get("algorithm_key") or "head"
+        try:
+            stored = store(algorithm_key=algorithm_key, job_id=job.pk, files=request.FILES)
+        except HeadTooLarge as e:
+            raise ValidationError(str(e))
+
+        job.logger.info(f"Stored the retrained head: {', '.join(item['path'] for item in stored.values())}")
+        return Response({"files": stored})
+
     @action(detail=True, methods=["post"], name="result")
     def result(self, request, pk=None):
         """
diff --git a/ami/main/api/serializers.py b/ami/main/api/serializers.py
index 962c802af..80d335de5 100644
--- a/ami/main/api/serializers.py
+++ b/ami/main/api/serializers.py
@@ -26,6 +26,7 @@
     Event,
     Identification,
     Occurrence,
+    OccurrenceSet,
     Page,
     Project,
     ProjectSettingsMixin,
@@ -644,6 +645,7 @@ def get_image_url(self, obj) -> str | None:
 class TaxonListSerializer(DefaultSerializer):
     # latest_detection = DetectionNestedSerializer(read_only=True)
     occurrences = serializers.SerializerMethodField()
+    training_crops_ready = serializers.SerializerMethodField()
     parents = TaxonParentSerializer(many=True, read_only=True, source="parents_json")
     parent_id = serializers.PrimaryKeyRelatedField(queryset=Taxon.objects.all(), source="parent")
     tags = serializers.SerializerMethodField()
@@ -676,6 +678,7 @@ class Meta:
             "details",
             "occurrences_count",
             "verified_count",
+            "training_crops_ready",
             "occurrences",
             "example_occurrence",
             "best_scoring_occurrence_id",
@@ -688,6 +691,15 @@ class Meta:
             "updated_at",
         ]
 
+    def get_training_crops_ready(self, obj) -> int | None:
+        """
+        Verified crops of this species, which is what a head can be trained on.
+
+        Null when the caller did not ask for it: counting is opt-in, and a zero would read
+        as a species with nothing to train on.
+        """
+        return getattr(obj, "training_crops_count", None)
+
     def get_occurrences(self, obj):
         """
         Return URL to the occurrences endpoint filtered by this taxon.
@@ -708,6 +720,7 @@ class TaxaListSerializer(DefaultSerializer):
     taxa = serializers.SerializerMethodField()
     taxa_count = serializers.SerializerMethodField()
     projects = serializers.SerializerMethodField()
+    best_model = serializers.SerializerMethodField()
 
     class Meta:
         model = TaxaList
@@ -718,10 +731,29 @@ class Meta:
             "taxa",
             "taxa_count",
             "projects",
+            "best_model",
             "created_at",
             "updated_at",
         ]
 
+    def get_best_model(self, obj) -> dict | None:
+        """
+        The algorithm scoring highest on this list's species, or null if none has been scored.
+
+        Read from the annotations the viewset attaches, so a page of lists costs one query
+        rather than one per list.
+        """
+        algorithm_id = getattr(obj, "best_algorithm_id", None)
+        if algorithm_id is None:
+            return None
+        return {
+            "id": algorithm_id,
+            "name": obj.best_algorithm_name,
+            "accuracy": obj.best_micro_accuracy,
+            "accuracy_by_species": obj.best_macro_accuracy,
+            "occurrence_set": obj.best_occurrence_set_name,
+        }
+
     def get_taxa(self, obj):
         """
         Return URL to the taxa endpoint filtered by this taxalist.
@@ -770,6 +802,27 @@ def get_projects(self, obj):
         return sorted(project.pk for project in obj.projects.all())
 
 
+class OccurrenceSetSerializer(DefaultSerializer):
+    """The evaluation sets a project can score a model against."""
+
+    occurrences_count = serializers.SerializerMethodField()
+
+    class Meta:
+        model = OccurrenceSet
+        fields = [
+            "id",
+            "details",
+            "name",
+            "description",
+            "occurrences_count",
+            "created_at",
+            "updated_at",
+        ]
+
+    def get_occurrences_count(self, obj) -> int:
+        return getattr(obj, "annotated_occurrences_count", None) or obj.occurrences.count()
+
+
 class TaxaListTaxonInputSerializer(serializers.Serializer):
     """Serializer for adding a taxon to a taxa list."""
 
@@ -1020,6 +1073,8 @@ class Meta:
 
 
 class TaxonSerializer(DefaultSerializer):
+    training_crops_ready = serializers.SerializerMethodField()
+    algorithm_performance = serializers.SerializerMethodField()
     # latest_detection = DetectionNestedSerializer(read_only=True)
     occurrences = TaxonOccurrenceNestedSerializer(many=True, read_only=True, source="example_occurrences")
     parent = TaxonNoParentNestedSerializer(read_only=True)
@@ -1061,8 +1116,31 @@ class Meta:
             "cover_image_credit",
             "summary_data",
             "common_name_en",
+            "training_crops_ready",
+            "algorithm_performance",
         ]
 
+    def get_training_crops_ready(self, obj) -> int | None:
+        """
+        Verified crops of this species, which is what a head can be trained on.
+
+        Null when the caller did not ask for it: counting is opt-in, and a zero would read
+        as a species with nothing to train on.
+        """
+        return getattr(obj, "training_crops_count", None)
+
+    def get_algorithm_performance(self, obj) -> list[dict]:
+        """
+        How each scored algorithm has done on this species. Empty until one is evaluated.
+
+        Scoped to the project being viewed: a taxon is shared across the platform but an
+        evaluation set is not, so without this the page reports another project's numbers.
+        """
+        from ami.ml import reporting
+
+        project = reporting.project_for(self.context.get("request"))
+        return reporting.performance_for_taxon(obj, project=project)
+
 
 class CaptureOccurrenceSerializer(DefaultSerializer):
     determination = TaxonNoParentNestedSerializer(read_only=True)
diff --git a/ami/main/api/views.py b/ami/main/api/views.py
index fdc72c963..885c01ca9 100644
--- a/ami/main/api/views.py
+++ b/ami/main/api/views.py
@@ -36,6 +36,7 @@
 from ami.main.api.serializers import TagSerializer
 from ami.main.models_future.identifications import create_identifications_batch, resolve_occurrences
 from ami.main.models_future.occurrence import model_agreement_for_project, top_identifiers_for_project
+from ami.ml import reporting
 from ami.ml.models.algorithm import Algorithm
 from ami.ml.serializers import AlgorithmSerializer
 from ami.utils.requests import get_default_classification_threshold
@@ -49,6 +50,7 @@
     Event,
     Identification,
     Occurrence,
+    OccurrenceSet,
     Page,
     Project,
     ProjectQuerySet,
@@ -84,6 +86,7 @@
     ModelAgreementSerializer,
     OccurrenceListSerializer,
     OccurrenceSerializer,
+    OccurrenceSetSerializer,
     PageListSerializer,
     PageSerializer,
     ProjectListSerializer,
@@ -953,6 +956,29 @@ class CaptureSetChoicesPagination(LimitOffsetPaginationWithPermissions):
     max_limit = 100
 
 
+class OccurrenceSetViewSet(DefaultViewSet, ProjectMixin):
+    """
+    API endpoint listing the fixed occurrence sets a model can be scored against.
+
+    Read-only: membership is built deliberately, not edited in passing, because two models
+    can only be compared if they were scored on exactly the same occurrences.
+    """
+
+    queryset = OccurrenceSet.objects.all()
+    serializer_class = OccurrenceSetSerializer
+    http_method_names = ["get", "head", "options"]
+    ordering_fields = ["name", "created_at", "updated_at"]
+    search_fields = ["name"]
+    # Scoping is the whole point of the queryset below, so without a project there is
+    # nothing sensible to return: it would list every set on the platform.
+    require_project = True
+
+    def get_queryset(self) -> QuerySet["OccurrenceSet"]:
+        qs = super().get_queryset().annotate(annotated_occurrences_count=models.Count("occurrences"))
+        # A set with no project is global, so it is offered everywhere.
+        return qs.for_project(self.get_active_project())
+
+
 class SourceImageCollectionViewSet(DefaultViewSet, ProjectMixin):
     """
     Endpoint for viewing capture sets or samples of captures.
@@ -2023,7 +2049,8 @@ def get_taxa_observed(
 
         The sparse verification rollup (``verified_count`` / ``agreed_*``) is the same on
         either path — a Python pass over the verified subset applied as ``CASE``
-        annotations, see :meth:`TaxonQuerySet.with_verification_counts`.
+        annotations, see :meth:`TaxonQuerySet.with_verification_counts`. ``training_crops_count``
+        is annotated the same way, see :meth:`TaxonQuerySet.with_training_crop_counts`.
         """
         request = self.request
         use_aggregation = "collection" in request.query_params
@@ -2079,6 +2106,8 @@ def get_taxa_observed(
             verified_counts=verified_counts,
         )
 
+        qs = self.annotate_training_crop_counts(qs, project, occurrence_filters=direct_filters)
+
         return self.annotate_example_occurrences(
             qs,
             project,
@@ -2088,6 +2117,30 @@ def get_taxa_observed(
             apply_default_taxa_filter=apply_default_taxa_filter,
         )
 
+    def annotate_training_crop_counts(
+        self,
+        qs: QuerySet,
+        project: Project,
+        *,
+        occurrence_filters: models.Q,
+    ) -> QuerySet:
+        """Add the ``training_crops_count`` annotation behind the ``with_training_crop_counts``
+        opt-in param.
+
+        One aggregate over the verified detections, but it grows with the project rather
+        than the page, and only the species table shows the column — so it runs when the
+        client asks for it. When off the count is annotated NULL so the serialized shape
+        stays stable and an uncomputed count cannot be read as "no crops".
+        """
+        include_counts = SingleParamSerializer[bool].clean(
+            param_name="with_training_crop_counts",
+            field=serializers.BooleanField(required=False, default=False),
+            data=self.request.query_params,
+        )
+        if not include_counts:
+            return qs.annotate(training_crops_count=models.Value(None, output_field=models.IntegerField()))
+        return qs.with_training_crop_counts(project, occurrence_filters=occurrence_filters)
+
     def annotate_example_occurrences(
         self,
         qs: QuerySet,
@@ -2221,6 +2274,7 @@ def get_queryset(self):
         # database once per row.
         qs = qs.prefetch_related("projects")
         project = self.get_active_project()
+        qs = reporting.annotate_best_model(qs, project=project)
         if project:
             return qs.filter(projects=project)
         return qs
diff --git a/ami/main/migrations/0096_project_default_taxa_list.py b/ami/main/migrations/0096_project_default_taxa_list.py
new file mode 100644
index 000000000..d39be1d93
--- /dev/null
+++ b/ami/main/migrations/0096_project_default_taxa_list.py
@@ -0,0 +1,25 @@
+# Generated by Django 4.2.10 on 2026-09-13 10:11
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0095_grant_sync_deployment_to_mldatamanager"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="project",
+            name="default_taxa_list",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="The species this project expects to see. Used as the class list when retraining a classifier head, so the head covers the region rather than only the species someone happened to verify.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="default_for_projects",
+                to="main.taxalist",
+            ),
+        ),
+    ]
diff --git a/ami/main/migrations/0097_evaluation.py b/ami/main/migrations/0097_evaluation.py
new file mode 100644
index 000000000..d7425f47d
--- /dev/null
+++ b/ami/main/migrations/0097_evaluation.py
@@ -0,0 +1,38 @@
+# Generated by Django 4.2.10 on 2026-09-17 16:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0096_project_default_taxa_list"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OccurrenceSet",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("name", models.CharField(max_length=255)),
+                ("description", models.TextField(blank=True)),
+                (
+                    "occurrences",
+                    models.ManyToManyField(blank=True, related_name="evaluation_sets", to="main.occurrence"),
+                ),
+                (
+                    "projects",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="Projects this set belongs to. A set with none is available everywhere.",
+                        related_name="occurrence_sets",
+                        to="main.project",
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ["name"],
+            },
+        ),
+    ]
diff --git a/ami/main/migrations/0098_job_permissions_for_retraining.py b/ami/main/migrations/0098_job_permissions_for_retraining.py
new file mode 100644
index 000000000..e8aac555e
--- /dev/null
+++ b/ami/main/migrations/0098_job_permissions_for_retraining.py
@@ -0,0 +1,76 @@
+# Generated by Django 4.2.10 on 2026-09-23 12:33
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0097_evaluation"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="project",
+            options={
+                "ordering": ["-priority", "created_at"],
+                "permissions": [
+                    ("create_identification", "Can create identifications"),
+                    ("update_identification", "Can update identifications"),
+                    ("delete_identification", "Can delete identifications"),
+                    ("create_job", "Can create a job"),
+                    ("update_job", "Can update a job"),
+                    ("run_ml_job", "Can run/retry/cancel ML jobs"),
+                    ("run_populate_captures_collection_job", "Can run/retry/cancel Populate Collection jobs"),
+                    ("run_data_storage_sync_job", "Can run/retry/cancel Data Storage Sync jobs"),
+                    ("run_regroup_events_job", "Can run/retry/cancel Regroup Events jobs"),
+                    ("run_data_export_job", "Can run/retry/cancel Data Export jobs"),
+                    ("run_single_image_ml_job", "Can process a single capture"),
+                    ("run_post_processing_job", "Can run/retry/cancel Post-Processing jobs"),
+                    ("run_generate_embeddings_job", "Can run/retry/cancel Generate Embeddings jobs"),
+                    ("run_train_classifier_job", "Can run/retry/cancel Train Classifier jobs"),
+                    ("run_evaluate_algorithm_job", "Can run/retry/cancel Evaluate Algorithm jobs"),
+                    ("delete_job", "Can delete a job"),
+                    ("create_deployment", "Can create a deployment"),
+                    ("delete_deployment", "Can delete a deployment"),
+                    ("update_deployment", "Can update a deployment"),
+                    ("sync_deployment", "Can sync images to a deployment"),
+                    ("regroup_sessions_deployment", "Can regroup deployment captures into sessions"),
+                    ("create_sourceimagecollection", "Can create a collection"),
+                    ("update_sourceimagecollection", "Can update a collection"),
+                    ("delete_sourceimagecollection", "Can delete a collection"),
+                    ("populate_sourceimagecollection", "Can populate a collection"),
+                    ("create_sourceimage", "Can create a source image"),
+                    ("update_sourceimage", "Can update a source image"),
+                    ("delete_sourceimage", "Can delete a source image"),
+                    ("star_sourceimage", "Can star a source image"),
+                    ("create_sourceimageupload", "Can create a source image upload"),
+                    ("update_sourceimageupload", "Can update a source image upload"),
+                    ("delete_sourceimageupload", "Can delete a source image upload"),
+                    ("create_s3storagesource", "Can create storage"),
+                    ("delete_s3storagesource", "Can delete storage"),
+                    ("update_s3storagesource", "Can update storage"),
+                    ("test_s3storagesource", "Can test storage connection"),
+                    ("create_site", "Can create a site"),
+                    ("delete_site", "Can delete a site"),
+                    ("update_site", "Can update a site"),
+                    ("create_device", "Can create a device"),
+                    ("delete_device", "Can delete a device"),
+                    ("update_device", "Can update a device"),
+                    ("view_userprojectmembership", "Can view project members"),
+                    ("create_userprojectmembership", "Can add a user to the project"),
+                    ("update_userprojectmembership", "Can update a user's project membership and role in the project"),
+                    ("delete_userprojectmembership", "Can remove a user from the project"),
+                    ("create_dataexport", "Can create a data export"),
+                    ("update_dataexport", "Can update a data export"),
+                    ("delete_dataexport", "Can delete a data export"),
+                    ("create_projectpipelineconfig", "Can register pipelines for the project"),
+                    ("update_projectpipelineconfig", "Can update pipeline configurations"),
+                    ("delete_projectpipelineconfig", "Can remove pipelines from the project"),
+                    ("create_taxalist", "Can create a taxa list"),
+                    ("update_taxalist", "Can update a taxa list"),
+                    ("delete_taxalist", "Can delete a taxa list"),
+                    ("view_private_data", "Can view private data"),
+                ],
+            },
+        ),
+    ]
diff --git a/ami/main/migrations/0099_grant_retraining_job_permissions.py b/ami/main/migrations/0099_grant_retraining_job_permissions.py
new file mode 100644
index 000000000..aad54d058
--- /dev/null
+++ b/ami/main/migrations/0099_grant_retraining_job_permissions.py
@@ -0,0 +1,118 @@
+"""
+Grant the new retraining job permissions to existing projects' role groups.
+
+``Job.check_custom_permission`` builds its codename from the job type key, so
+``train_classifier``, ``evaluate_algorithm`` and ``generate_embeddings`` each need a
+``run_<key>_job`` permission or ``has_perm`` matches nothing and only superusers can run
+them. The permissions are declared in ``0098``; this grants them.
+
+Both roles are backfilled, unlike ``0095``: that migration closed a gap where
+``ProjectManager`` already held the permission, whereas these three are new to everyone.
+``ProjectManager`` inherits ``MLDataManager``'s permission set, but the guardian rows are
+per group, so each needs its own.
+
+Permissions here are guardian **object-level** grants on each project, which is what
+``has_perm("run_train_classifier_job", project)`` reads. Adding only to
+``group.permissions`` would not appear in ``get_perms`` and the jobs would stay
+unrunnable.
+
+New projects pick this up through ``create_roles_for_project``. The ``post_migrate``
+signal re-syncs every project's role permissions anyway, so this is belt-and-suspenders;
+it is kept so the grant is explicit rather than a side effect.
+"""
+
+from django.db import migrations
+from django.db.models import Q
+
+CODENAMES = (
+    "run_generate_embeddings_job",
+    "run_train_classifier_job",
+    "run_evaluate_algorithm_job",
+)
+
+# ProjectManager inherits MLDataManager's permissions, but guardian rows are per group.
+ROLE_GROUP_SUFFIXES = ("_MLDataManager", "_ProjectManager")
+
+
+def _permissions(apps):
+    Permission = apps.get_model("auth", "Permission")
+    ContentType = apps.get_model("contenttypes", "ContentType")
+    try:
+        project_ct = ContentType.objects.get(app_label="main", model="project")
+    except ContentType.DoesNotExist:
+        return [], None
+    perms = list(Permission.objects.filter(codename__in=CODENAMES, content_type=project_ct))
+    return perms, project_ct
+
+
+def _project_pk_from_group(group):
+    # Group names are "{project_pk}_{project_name}_{RoleName}"; the pk is the immutable
+    # leading segment (the name itself can contain underscores).
+    try:
+        return int(group.name.split("_", 1)[0])
+    except (ValueError, IndexError):
+        return None
+
+
+def _role_groups(Group):
+    query = Q()
+    for suffix in ROLE_GROUP_SUFFIXES:
+        query |= Q(name__endswith=suffix)
+    return Group.objects.filter(query)
+
+
+def grant(apps, schema_editor):
+    Group = apps.get_model("auth", "Group")
+    GroupObjectPermission = apps.get_model("guardian", "GroupObjectPermission")
+
+    perms, project_ct = _permissions(apps)
+    if not perms:
+        return
+
+    for group in _role_groups(Group):
+        project_pk = _project_pk_from_group(group)
+        if project_pk is None:
+            continue
+        for perm in perms:
+            # Global add for parity with create_roles_for_project; the object-level row
+            # below is what has_perm(perm, project) actually reads.
+            group.permissions.add(perm)
+            GroupObjectPermission.objects.get_or_create(
+                permission=perm,
+                content_type=project_ct,
+                object_pk=str(project_pk),
+                group=group,
+            )
+
+
+def revoke(apps, schema_editor):
+    Group = apps.get_model("auth", "Group")
+    GroupObjectPermission = apps.get_model("guardian", "GroupObjectPermission")
+
+    perms, project_ct = _permissions(apps)
+    if not perms:
+        return
+
+    for group in _role_groups(Group):
+        project_pk = _project_pk_from_group(group)
+        if project_pk is None:
+            continue
+        for perm in perms:
+            group.permissions.remove(perm)
+            GroupObjectPermission.objects.filter(
+                permission=perm,
+                content_type=project_ct,
+                object_pk=str(project_pk),
+                group=group,
+            ).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0098_job_permissions_for_retraining"),
+        ("guardian", "0002_generic_permissions_index"),
+    ]
+
+    operations = [
+        migrations.RunPython(grant, revoke),
+    ]
diff --git a/ami/main/models.py b/ami/main/models.py
index 9943c111a..b4166ebe3 100644
--- a/ami/main/models.py
+++ b/ami/main/models.py
@@ -279,6 +279,10 @@ class ProjectFeatureFlags(pydantic.BaseModel):
     # Feature flag for jobs to reprocess all images in the project, even if already processed
     reprocess_all_images: bool = False
     async_pipeline_workers: bool = True  # Whether to use async pipeline workers that pull tasks from a queue
+    # Whether to save the feature vectors returned with classifications, for retraining
+    # classifier heads from verified labels. Off by default: a stored vector costs about
+    # 5 KB once the vector index is counted, so this is opt-in per project.
+    store_classification_embeddings: bool = False
 
 
 def get_default_feature_flags() -> ProjectFeatureFlags:
@@ -309,6 +313,18 @@ class Project(ProjectSettingsMixin, BaseModel):
         null=False,
         blank=True,
     )
+    default_taxa_list = models.ForeignKey(
+        "TaxaList",
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="default_for_projects",
+        help_text=(
+            "The species this project expects to see. Used as the class list when retraining "
+            "a classifier head, so the head covers the region rather than only the species "
+            "someone happened to verify."
+        ),
+    )
 
     active = models.BooleanField(default=True)
     priority = models.IntegerField(default=1)
@@ -452,6 +468,9 @@ class Permissions:
         RUN_REGROUP_EVENTS_JOB = "run_regroup_events_job"
         RUN_DATA_EXPORT_JOB = "run_data_export_job"
         RUN_POST_PROCESSING_JOB = "run_post_processing_job"
+        RUN_GENERATE_EMBEDDINGS_JOB = "run_generate_embeddings_job"
+        RUN_TRAIN_CLASSIFIER_JOB = "run_train_classifier_job"
+        RUN_EVALUATE_ALGORITHM_JOB = "run_evaluate_algorithm_job"
         DELETE_JOB = "delete_job"
 
         # Deployment permissions
@@ -535,6 +554,9 @@ class Meta:
             ("run_data_export_job", "Can run/retry/cancel Data Export jobs"),
             ("run_single_image_ml_job", "Can process a single capture"),
             ("run_post_processing_job", "Can run/retry/cancel Post-Processing jobs"),
+            ("run_generate_embeddings_job", "Can run/retry/cancel Generate Embeddings jobs"),
+            ("run_train_classifier_job", "Can run/retry/cancel Train Classifier jobs"),
+            ("run_evaluate_algorithm_job", "Can run/retry/cancel Evaluate Algorithm jobs"),
             ("delete_job", "Can delete a job"),
             # Deployment permissions
             ("create_deployment", "Can create a deployment"),
@@ -4128,6 +4150,41 @@ def with_verification_counts(
 
         return qs
 
+    def with_training_crop_counts(
+        self,
+        project: Project,
+        *,
+        occurrence_filters: models.Q,
+    ):
+        """Annotate ``training_crops_count``: verified crops a classifier head can be fit on.
+
+        Counted against the exact determination, without the hierarchical rollup
+        :meth:`with_verification_counts` does — a head is fit on the label itself, so a crop
+        verified as a species is not training data for its genus. Crops still need an
+        embedding from the chosen feature extractor before a job can use them; this is the
+        upper bound, not the row count of the next training set.
+
+        The project's default filters are deliberately not applied, so that this matches what
+        a retrain would actually use (``ami.ml.training_data``). The score threshold hides
+        predictions the model was unsure about, but these rows are human answers — and a
+        person correcting a low-confidence prediction is the most useful crop there is, so
+        filtering on the model's confidence would hide exactly the data worth training on.
+        """
+        verified_occurrences = (
+            Occurrence.objects.filter(occurrence_filters)
+            .filter(determination_id__isnull=False)
+            .filter(Exists(Identification.objects.filter(occurrence=OuterRef("pk"), withdrawn=False)))
+        )
+        crop_counts = {
+            row["occurrence__determination_id"]: row["crops"]
+            for row in (
+                Detection.objects.filter(occurrence__in=verified_occurrences)
+                .values("occurrence__determination_id")
+                .annotate(crops=models.Count("pk"))
+            )
+        }
+        return self.annotate(training_crops_count=_case_from_map(crop_counts, 0, models.IntegerField()))
+
     def with_example_occurrence_ids(
         self,
         project: Project,
@@ -4728,6 +4785,10 @@ def save(self, update_calculated_fields=True, *args, **kwargs):
 
 
 class TaxaListQuerySet(BaseQuerySet):
+    def for_project(self, project) -> models.QuerySet:
+        """Lists this project can use: its own, plus any that belong to no project."""
+        return self.filter(models.Q(projects=project) | models.Q(projects__isnull=True)).distinct()
+
     def get_or_create_for_project(
         self, name: str, project: "Project | None" = None, **defaults
     ) -> tuple["TaxaList", bool]:
@@ -4872,6 +4933,57 @@ def html(self) -> str:
 ]
 
 
+class OccurrenceSetQuerySet(BaseQuerySet):
+    def for_project(self, project) -> models.QuerySet:
+        """Sets this project can use: its own, plus any that belong to no project."""
+        return self.filter(models.Q(projects=project) | models.Q(projects__isnull=True)).distinct()
+
+    def visible_for_user(self, user) -> models.QuerySet:
+        """
+        Global sets stay visible; project sets follow their project.
+
+        The inherited filter keeps a row only if it reaches a non-draft project, which a
+        set belonging to no project never does. Without this a global set is hidden from
+        everyone but a superuser, which is the opposite of what global means. Only a set's
+        name and size are exposed, never the occurrences inside it.
+        """
+        visible = super().visible_for_user(user)
+        return self.filter(models.Q(pk__in=visible.values("pk")) | models.Q(projects__isnull=True)).distinct()
+
+
+class OccurrenceSet(BaseModel):
+    """
+    A fixed list of occurrences to score models against.
+
+    Two models can only be compared if they were scored on the same occurrences, so the
+    membership is stored rather than re-sampled. A set with no projects is global, which is
+    how one set compares models across the platform; that follows how TaxaList already
+    treats a list with no project.
+    """
+
+    name = models.CharField(max_length=255)
+    description = models.TextField(blank=True)
+    occurrences = models.ManyToManyField("main.Occurrence", related_name="evaluation_sets", blank=True)
+    projects = models.ManyToManyField(
+        "main.Project",
+        related_name="occurrence_sets",
+        blank=True,
+        help_text="Projects this set belongs to. A set with none is available everywhere.",
+    )
+
+    objects = OccurrenceSetQuerySet.as_manager()
+
+    class Meta:
+        ordering = ["name"]
+
+    def __str__(self) -> str:
+        return f"{self.name} ({self.occurrences.count()} occurrences)"
+
+    @property
+    def is_global(self) -> bool:
+        return not self.projects.exists()
+
+
 class SourceImageCollectionQuerySet(BaseQuerySet):
     def with_source_images_count(self):
         return self.annotate(
diff --git a/ami/main/tests.py b/ami/main/tests.py
index aab6d943d..8838e59f4 100644
--- a/ami/main/tests.py
+++ b/ami/main/tests.py
@@ -6587,8 +6587,8 @@ def setUp(self):
         self.itea_occ = Occurrence.objects.get(project=self.project, determination=self.itea)
         self.list_url = f"/api/v2/taxa/?project_id={self.project.pk}&limit=1000"
 
-    def _detail(self, taxon):
-        res = self.client.get(f"/api/v2/taxa/{taxon.pk}/?project_id={self.project.pk}")
+    def _detail(self, taxon, params=""):
+        res = self.client.get(f"/api/v2/taxa/{taxon.pk}/?project_id={self.project.pk}{params}")
         self.assertEqual(res.status_code, status.HTTP_200_OK)
         return res.json()
 
@@ -6618,6 +6618,76 @@ def test_list_field_values(self):
         self.assertEqual(rows["Vanessa atalanta"]["verified_count"], 1)
         self.assertEqual(rows["Vanessa itea"]["verified_count"], 0)
 
+    # --- training_crops_ready (verified crops, no rollup) ---
+
+    def test_training_crops_ready_is_null_unless_asked_for(self):
+        """Counting is opt-in, and a zero would read as a species with nothing to train on."""
+        self.assertIsNone(self._detail(self.cardui)["training_crops_ready"])
+
+    def test_training_crops_ready_counts_crops_not_occurrences(self):
+        """A second frame of the same insect is a second crop a head can be fit on."""
+        first_detection = self.occ_pred.detections.first()
+        assert first_detection is not None
+        Detection.objects.create(
+            source_image=first_detection.source_image,
+            occurrence=self.occ_pred,
+            timestamp=first_detection.timestamp,
+            bbox=[0.3, 0.3, 0.4, 0.4],
+            path="detections/second_frame.jpg",
+        )
+
+        detail = self._detail(self.cardui, "&with_training_crop_counts=true")
+        self.assertEqual(detail["verified_count"], 2)
+        self.assertEqual(detail["training_crops_ready"], 3)
+
+    def test_training_crops_ready_ignores_the_project_score_threshold(self):
+        """
+        The count must match what a retrain would actually use.
+
+        The score threshold hides predictions the model was unsure about, but these rows
+        are human answers. Someone correcting a low-confidence prediction is the most
+        useful crop there is, so filtering on the model's confidence would hide exactly
+        the data worth training on — and make the column disagree with the training set.
+        """
+        self.project.default_filters_score_threshold = 0.5
+        self.project.save()
+        Occurrence.objects.filter(pk=self.occ_pred.pk).update(determination_score=0.1)
+
+        detail = self._detail(self.cardui, "&with_training_crop_counts=true")
+
+        self.assertEqual(detail["training_crops_ready"], 2)
+
+    def test_training_crops_ready_does_not_roll_up_to_ancestors(self):
+        """A head is fit on the label itself, so species crops are not genus training data."""
+        for ancestor in (self.genus, self.family, self.order):
+            row = self._detail(ancestor, "&with_training_crop_counts=true")
+            self.assertEqual(row["training_crops_ready"], 0, ancestor.name)
+
+    def test_training_crops_ready_in_list(self):
+        rows = self._list_by_name(self.list_url + "&with_training_crop_counts=true")
+        self.assertEqual(rows["Vanessa cardui"]["training_crops_ready"], 2)
+        self.assertEqual(rows["Vanessa atalanta"]["training_crops_ready"], 1)
+        self.assertEqual(rows["Vanessa itea"]["training_crops_ready"], 0)
+
+    def test_training_crops_ready_does_not_scale_with_page_size(self):
+        """One aggregate for the page, not one query per row."""
+
+        from django.core.cache import caches
+
+        def query_count(limit: int) -> int:
+            # Cold cache on both runs, or a warm one hides the scaling.
+            caches["default"].clear()
+            with CaptureQueriesContext(connection) as ctx:
+                res = self.client.get(
+                    f"/api/v2/taxa/?project_id={self.project.pk}&limit={limit}&with_training_crop_counts=true"
+                )
+            self.assertEqual(res.status_code, status.HTTP_200_OK)
+            return len(ctx.captured_queries)
+
+        small = query_count(limit=1)
+        large = query_count(limit=1000)
+        self.assertLessEqual(large, small, f"Query count grew with page size: {small} -> {large}")
+
     # --- verified=true|false filter ---
 
     def test_verified_filter_true_false_complement(self):
diff --git a/ami/ml/evaluation.py b/ami/ml/evaluation.py
new file mode 100644
index 000000000..25192013f
--- /dev/null
+++ b/ami/ml/evaluation.py
@@ -0,0 +1,219 @@
+"""
+Score an algorithm against a fixed set of occurrences people have verified.
+
+The comparison is between what a person said and what the algorithm predicted, both of
+which are already in the database. No images are opened and no model runs: an algorithm
+that has processed the set can be scored in a single pass over its classifications.
+
+An algorithm is only asked about species it can actually predict. Its category map is the
+list of answers available to it, so an occurrence of anything else is left out rather than
+counted wrong — otherwise a regional head looks bad for not knowing a species nobody
+trained it on.
+"""
+
+import collections
+import logging
+import typing
+
+from django.db.models import Exists, OuterRef, Q, QuerySet
+
+from ami.main.models import Classification, Identification, Occurrence, OccurrenceSet, Taxon
+from ami.ml.models.algorithm import Algorithm
+
+logger = logging.getLogger(__name__)
+
+
+class NothingToScore(Exception):
+    """The set holds no occurrence this algorithm was asked about."""
+
+
+def predictable_taxon_ids(algorithm: Algorithm) -> set[int]:
+    """
+    The taxa this algorithm can answer with, as ids.
+
+    Resolved to taxa rather than compared as strings. A category map label is the name the
+    model was trained under, which is not always the name the taxon is stored under here,
+    so comparing the two as text silently drops every species whose spelling or authorship
+    differs and makes the model look like it was never asked about them.
+
+    The lookup matches AlgorithmCategoryMap.with_taxa so the two cannot disagree about
+    which label means which taxon: by name, or by any name the taxon is also known as.
+    """
+    if not algorithm.category_map:
+        return set()
+    labels = [str(label) for label in (algorithm.category_map.labels or [])]
+    if not labels:
+        return set()
+    return set(
+        Taxon.objects.filter(
+            Q(name__in=labels) | Q(search_names__overlap=labels),
+            active=True,
+        ).values_list("pk", flat=True)
+    )
+
+
+def occurrences_to_score(occurrence_set: OccurrenceSet, algorithm: Algorithm) -> QuerySet[Occurrence]:
+    """
+    Occurrences in the set that a person has identified.
+
+    The filter is on the identification rather than on determination being set, because
+    update_occurrence_determination falls back to the top prediction when nobody has
+    identified an occurrence. Filtering on determination alone therefore scores an
+    algorithm against its own guess, which reads as perfect accuracy.
+
+    Truth is still read off determination: for an identified occurrence that is the
+    identification's taxon, and it is how the rest of the platform counts a verification
+    (see verified_taxon_counts).
+    """
+    return (
+        occurrence_set.occurrences.filter(
+            Exists(Identification.objects.filter(occurrence=OuterRef("pk"), withdrawn=False)),
+            determination__isnull=False,
+        )
+        .select_related("determination")
+        .order_by("pk")
+    )
+
+
+def predictions_for(occurrence_ids: list[int], algorithm: Algorithm) -> dict[int, int]:
+    """
+    This algorithm's latest prediction per occurrence, as occurrence id to taxon id.
+
+    One query rather than one per occurrence: an evaluation set runs to thousands of rows.
+    Ordered by score so the strongest classification on a detection wins.
+    """
+    rows = (
+        Classification.objects.filter(
+            algorithm=algorithm,
+            detection__occurrence_id__in=occurrence_ids,
+            taxon__isnull=False,
+        )
+        .order_by("detection__occurrence_id", "-score")
+        .values_list("detection__occurrence_id", "taxon_id")
+    )
+    best: dict[int, int] = {}
+    for occurrence_id, taxon_id in rows:
+        best.setdefault(occurrence_id, taxon_id)
+    return best
+
+
+def score(occurrence_set: OccurrenceSet, algorithm: Algorithm) -> dict[str, typing.Any]:
+    """
+    Compare an algorithm's predictions against what people verified.
+
+    Returns overall accuracy, a per-species breakdown, and how much of the set was left
+    out. Raises NothingToScore when the algorithm has never run on the set, so that reads
+    as a missing step rather than an accuracy of zero.
+    """
+    answerable = predictable_taxon_ids(algorithm)
+    if not answerable:
+        raise NothingToScore(
+            f"Algorithm '{algorithm.key}' has no category map whose labels match a taxon here, "
+            "so there is no way to know which species it was asked about."
+        )
+
+    occurrences = list(occurrences_to_score(occurrence_set, algorithm))
+    if not occurrences:
+        raise NothingToScore(f"'{occurrence_set.name}' holds no verified occurrence to score.")
+
+    predictions = predictions_for([o.pk for o in occurrences], algorithm)
+    if not predictions:
+        raise NothingToScore(
+            f"Algorithm '{algorithm.key}' has not classified anything in '{occurrence_set.name}'. "
+            "Run it over the set first, then evaluate."
+        )
+
+    per_taxon: dict[int, dict[str, typing.Any]] = collections.defaultdict(
+        lambda: {"scored": 0, "correct": 0, "taxon": None}
+    )
+    scored = 0
+    correct = 0
+    skipped = 0
+
+    for occurrence in occurrences:
+        truth = occurrence.determination
+        if truth.pk not in answerable:
+            skipped += 1
+            continue
+        predicted = predictions.get(occurrence.pk)
+        if predicted is None:
+            skipped += 1
+            continue
+
+        bucket = per_taxon[truth.pk]
+        bucket["taxon"] = truth
+        bucket["scored"] += 1
+        scored += 1
+        if predicted == truth.pk:
+            bucket["correct"] += 1
+            correct += 1
+
+    if not scored:
+        raise NothingToScore(f"None of the species in '{occurrence_set.name}' are ones '{algorithm.key}' can predict.")
+
+    accuracies = [b["correct"] / b["scored"] for b in per_taxon.values() if b["scored"]]
+    # The denominators an accuracy has to be read against. A head that answers for 749
+    # species can score 1.00 on the six of them this set happens to contain, and without
+    # these two numbers nothing on the page says so.
+    species_in_set = len({occurrence.determination_id for occurrence in occurrences})
+    return {
+        "micro_accuracy": correct / scored,
+        "macro_accuracy": sum(accuracies) / len(accuracies),
+        "occurrences_scored": scored,
+        "occurrences_skipped": skipped,
+        "species_scored": len(per_taxon),
+        "species_in_set": species_in_set,
+        "species_predictable": len(answerable),
+        "per_taxon": [
+            {
+                "taxon": bucket["taxon"],
+                "accuracy": bucket["correct"] / bucket["scored"],
+                "occurrences_scored": bucket["scored"],
+                "correct": bucket["correct"],
+            }
+            for bucket in per_taxon.values()
+            if bucket["scored"]
+        ],
+    }
+
+
+def save_evaluation(occurrence_set: OccurrenceSet, algorithm: Algorithm, result: dict, job=None):
+    """
+    Store a score, replacing any earlier one for the same algorithm and set.
+
+    Replaced rather than appended: the pair is unique, and a second run over the same set
+    is a correction, not a new fact.
+    """
+    from ami.ml.models.evaluation import AlgorithmEvaluation, TaxonEvaluation
+
+    evaluation, _ = AlgorithmEvaluation.objects.update_or_create(
+        algorithm=algorithm,
+        occurrence_set=occurrence_set,
+        defaults={
+            "job": job,
+            "micro_accuracy": result["micro_accuracy"],
+            "macro_accuracy": result["macro_accuracy"],
+            "occurrences_scored": result["occurrences_scored"],
+            "occurrences_skipped": result["occurrences_skipped"],
+            "species_scored": result["species_scored"],
+        },
+    )
+    evaluation.taxa.all().delete()
+    TaxonEvaluation.objects.bulk_create(
+        [
+            TaxonEvaluation(
+                evaluation=evaluation,
+                taxon=row["taxon"],
+                accuracy=row["accuracy"],
+                occurrences_scored=row["occurrences_scored"],
+                correct=row["correct"],
+            )
+            for row in result["per_taxon"]
+        ],
+        batch_size=500,
+    )
+    logger.info(
+        f"Scored {algorithm.key} on '{occurrence_set.name}': "
+        f"{result['micro_accuracy']:.3f} over {result['occurrences_scored']} occurrences"
+    )
+    return evaluation
diff --git a/ami/ml/management/commands/export_verified_training_data.py b/ami/ml/management/commands/export_verified_training_data.py
new file mode 100644
index 000000000..afb5903e9
--- /dev/null
+++ b/ami/ml/management/commands/export_verified_training_data.py
@@ -0,0 +1,120 @@
+"""
+Write a classifier-head training set to a local file, for inspection.
+
+The same set a training job would send to a processing service, saved somewhere you can
+open it. It builds the set through ami.ml.training_dataset so the two cannot drift apart:
+a file exported here holds exactly what a retrain would have used.
+
+Usage:
+    python manage.py export_verified_training_data --project 3 --algorithm bioclip-2-5-nf-749
+"""
+
+import json
+import pathlib
+
+from django.core.files.storage import default_storage
+from django.core.management.base import BaseCommand, CommandError
+
+from ami.main.models import Project, TaxaList
+from ami.ml import training_data, training_dataset
+from ami.ml.models import Algorithm
+
+
+class Command(BaseCommand):
+    help = "Export human-verified detections and their embeddings as a classifier training set"
+
+    def add_arguments(self, parser):
+        parser.add_argument("--project", type=int, required=True, help="Project ID to export from")
+        parser.add_argument(
+            "--algorithm",
+            type=str,
+            required=True,
+            help=(
+                "Key of the algorithm whose embeddings to use. Vectors from different "
+                "algorithms are in different spaces and must never be mixed."
+            ),
+        )
+        parser.add_argument("--output", type=str, default="verified_training_data", help="Output path, without suffix")
+        parser.add_argument(
+            "--taxa-list",
+            type=int,
+            default=None,
+            help="Taxa list to use as the species list. Defaults to the project's own default.",
+        )
+        parser.add_argument(
+            "--test-fraction",
+            type=float,
+            default=training_data.DEFAULT_TEST_FRACTION,
+            help="Share of occurrences held out for evaluation",
+        )
+        parser.add_argument(
+            "--split-salt",
+            type=str,
+            default=training_data.DEFAULT_SPLIT_SALT,
+            help="Changing this reshuffles the split. Keep it fixed to keep an eval set comparable.",
+        )
+        parser.add_argument(
+            "--min-per-species",
+            type=int,
+            default=2,
+            help="Drop species with fewer verified crops than this. Ignored when a taxa list sets the species.",
+        )
+
+    def handle(self, *args, **options):
+        project = Project.objects.filter(pk=options["project"]).first()
+        if not project:
+            raise CommandError(f"No project with id {options['project']}")
+
+        algorithm = Algorithm.objects.filter(key=options["algorithm"]).first()
+        if not algorithm:
+            known = list(Algorithm.objects.values_list("key", flat=True)[:20])
+            raise CommandError(f"No algorithm with key '{options['algorithm']}'. Known keys: {known}")
+
+        taxa_list = None
+        if options["taxa_list"]:
+            taxa_list = TaxaList.objects.filter(pk=options["taxa_list"]).first()
+            if not taxa_list:
+                raise CommandError(f"No taxa list with id {options['taxa_list']}")
+
+        try:
+            result = training_dataset.build_training_dataset(
+                project=project,
+                algorithm=algorithm,
+                min_per_species=options["min_per_species"],
+                split_salt=options["split_salt"],
+                test_fraction=options["test_fraction"],
+                taxa_list=taxa_list,
+            )
+        except training_dataset.NotEnoughVerifiedData as e:
+            raise CommandError(str(e))
+
+        meta = result["metadata"]
+        out = pathlib.Path(options["output"])
+        with default_storage.open(result["path"], "rb") as stored:
+            out.with_suffix(".npz").write_bytes(stored.read())
+        out.with_suffix(".json").write_text(json.dumps(meta, indent=2))
+
+        if meta["taxa_list"]:
+            self.stdout.write(f"Species list from taxa list '{meta['taxa_list']['name']}'")
+        if meta["classes_without_verified_data"]:
+            self.stdout.write(
+                f"{len(meta['classes_without_verified_data'])} species in the list have no verified crops yet"
+            )
+        if meta["dropped_species"]:
+            self.stdout.write(
+                self.style.WARNING(f"{len(meta['dropped_species'])} verified species were left out of the set")
+            )
+        if meta["verified_detections_without_embedding"]:
+            self.stdout.write(
+                self.style.WARNING(
+                    f"{meta['verified_detections_without_embedding']} verified detection(s) have no embedding "
+                    "from this algorithm. Run a generate_embeddings job to include them."
+                )
+            )
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                f"Wrote {meta['rows']} rows over {len(meta['classes'])} species "
+                f"(train {meta['train']} / test {meta['test']}) to {out.with_suffix('.npz')}"
+            )
+        )
diff --git a/ami/ml/migrations/0029_detectionembedding_and_more.py b/ami/ml/migrations/0029_detectionembedding_and_more.py
new file mode 100644
index 000000000..6ab708148
--- /dev/null
+++ b/ami/ml/migrations/0029_detectionembedding_and_more.py
@@ -0,0 +1,53 @@
+# Generated by Django 4.2.10 on 2026-09-01 20:26
+
+import django.db.models.deletion
+import pgvector.django.halfvec
+from django.db import migrations, models
+from pgvector.django import VectorExtension
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0095_grant_sync_deployment_to_mldatamanager"),
+        ("ml", "0028_normalize_empty_endpoint_url_to_null"),
+    ]
+
+    operations = [
+        # Must run before the table is created. makemigrations does not add this, so it
+        # is written in by hand. Needs a database user with permission to create an
+        # extension; the local compose user is the database owner, so it can.
+        VectorExtension(),
+        migrations.CreateModel(
+            name="DetectionEmbedding",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "vector",
+                    pgvector.django.halfvec.HalfVectorField(dimensions=1024),
+                ),
+                (
+                    "algorithm",
+                    models.ForeignKey(
+                        help_text="The algorithm whose backbone produced this vector. Vectors from different algorithms live in different spaces and must never be compared to each other.",
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="embeddings",
+                        to="ml.algorithm",
+                    ),
+                ),
+                (
+                    "detection",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, related_name="embeddings", to="main.detection"
+                    ),
+                ),
+            ],
+        ),
+        migrations.AddConstraint(
+            model_name="detectionembedding",
+            constraint=models.UniqueConstraint(
+                fields=("detection", "algorithm"), name="unique_embedding_per_detection_and_algorithm"
+            ),
+        ),
+    ]
diff --git a/ami/ml/migrations/0030_algorithm_trainable.py b/ami/ml/migrations/0030_algorithm_trainable.py
new file mode 100644
index 000000000..3dc91a747
--- /dev/null
+++ b/ami/ml/migrations/0030_algorithm_trainable.py
@@ -0,0 +1,20 @@
+# Generated by Django 4.2.10 on 2026-09-02 13:29
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("ml", "0029_detectionembedding_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="algorithm",
+            name="trainable",
+            field=models.BooleanField(
+                default=False,
+                help_text="Whether the processing service reports that this algorithm can be retrained. Mirrored from the service's /info response so the UI does not have to ask it.",
+            ),
+        ),
+    ]
diff --git a/ami/ml/migrations/0031_algorithm_training_fields.py b/ami/ml/migrations/0031_algorithm_training_fields.py
new file mode 100644
index 000000000..cc2fdc55b
--- /dev/null
+++ b/ami/ml/migrations/0031_algorithm_training_fields.py
@@ -0,0 +1,36 @@
+# Generated by Django 4.2.10 on 2026-09-03 17:05
+
+import ami.ml.schemas
+from django.db import migrations
+import django_pydantic_field.fields
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("ml", "0030_algorithm_trainable"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="algorithm",
+            name="training_config",
+            field=django_pydantic_field.fields.PydanticSchemaField(
+                blank=True,
+                config=None,
+                default=ami.ml.schemas.AlgorithmTrainingConfig,
+                help_text="Settings used when retraining this algorithm.",
+                schema=ami.ml.schemas.AlgorithmTrainingConfig,
+            ),
+        ),
+        migrations.AddField(
+            model_name="algorithm",
+            name="training_info",
+            field=django_pydantic_field.fields.PydanticSchemaField(
+                blank=True,
+                config=None,
+                default=ami.ml.schemas.AlgorithmTrainingInfo,
+                help_text="Where this version's weights came from. Empty on a version that was never retrained.",
+                schema=ami.ml.schemas.AlgorithmTrainingInfo,
+            ),
+        ),
+    ]
diff --git a/ami/ml/migrations/0032_training_set_membership.py b/ami/ml/migrations/0032_training_set_membership.py
new file mode 100644
index 000000000..87a0021c6
--- /dev/null
+++ b/ami/ml/migrations/0032_training_set_membership.py
@@ -0,0 +1,58 @@
+# Generated by Django 4.2.10 on 2026-09-10 14:31
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("main", "0095_grant_sync_deployment_to_mldatamanager"),
+        ("jobs", "0025_generate_embeddings_job_type"),
+        ("ml", "0031_algorithm_training_fields"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="TrainingSetMembership",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "algorithm",
+                    models.ForeignKey(
+                        blank=True,
+                        help_text="The algorithm version this occurrence helped produce. Filled in after training finishes, because the version does not exist while the training set is built.",
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="training_occurrences",
+                        to="ml.algorithm",
+                    ),
+                ),
+                (
+                    "job",
+                    models.ForeignKey(
+                        help_text="The training job that collected this occurrence.",
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="training_set_members",
+                        to="jobs.job",
+                    ),
+                ),
+                (
+                    "occurrence",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, related_name="training_uses", to="main.occurrence"
+                    ),
+                ),
+            ],
+            options={
+                "indexes": [models.Index(fields=["occurrence"], name="training_use_occurrence_idx")],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="trainingsetmembership",
+            constraint=models.UniqueConstraint(
+                fields=("occurrence", "job"), name="unique_training_use_per_occurrence_and_job"
+            ),
+        ),
+    ]
diff --git a/ami/ml/migrations/0033_evaluation.py b/ami/ml/migrations/0033_evaluation.py
new file mode 100644
index 000000000..0bc2ed475
--- /dev/null
+++ b/ami/ml/migrations/0033_evaluation.py
@@ -0,0 +1,109 @@
+# Generated by Django 4.2.10 on 2026-09-17 16:20
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("jobs", "0026_evaluation"),
+        ("main", "0097_evaluation"),
+        ("ml", "0032_training_set_membership"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="AlgorithmEvaluation",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "micro_accuracy",
+                    models.FloatField(help_text="Share of occurrences the algorithm named correctly.", null=True),
+                ),
+                (
+                    "macro_accuracy",
+                    models.FloatField(
+                        help_text="Mean of the per-species accuracies. Trap data is long-tailed, so this says far more than the plain share about whether rare species are handled.",
+                        null=True,
+                    ),
+                ),
+                ("occurrences_scored", models.PositiveIntegerField(default=0)),
+                (
+                    "occurrences_skipped",
+                    models.PositiveIntegerField(
+                        default=0,
+                        help_text="In the set but not scored, because the species is outside what this algorithm can predict. Scoring those would punish it for a question it was never asked.",
+                    ),
+                ),
+                ("species_scored", models.PositiveIntegerField(default=0)),
+                (
+                    "algorithm",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, related_name="evaluations", to="ml.algorithm"
+                    ),
+                ),
+                (
+                    "job",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="evaluations",
+                        to="jobs.job",
+                    ),
+                ),
+                (
+                    "occurrence_set",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="evaluations",
+                        to="main.occurrenceset",
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ["-created_at"],
+            },
+        ),
+        migrations.CreateModel(
+            name="TaxonEvaluation",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "accuracy",
+                    models.FloatField(help_text="Share of this species' occurrences the algorithm named correctly."),
+                ),
+                ("occurrences_scored", models.PositiveIntegerField(default=0)),
+                ("correct", models.PositiveIntegerField(default=0)),
+                (
+                    "evaluation",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, related_name="taxa", to="ml.algorithmevaluation"
+                    ),
+                ),
+                (
+                    "taxon",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, related_name="evaluations", to="main.taxon"
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ["-occurrences_scored", "taxon__name"],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="taxonevaluation",
+            constraint=models.UniqueConstraint(fields=("evaluation", "taxon"), name="unique_taxon_per_evaluation"),
+        ),
+        migrations.AddConstraint(
+            model_name="algorithmevaluation",
+            constraint=models.UniqueConstraint(
+                fields=("algorithm", "occurrence_set"), name="unique_evaluation_per_algorithm_and_set"
+            ),
+        ),
+    ]
diff --git a/ami/ml/models/__init__.py b/ami/ml/models/__init__.py
index 5000c7f53..43a6bce6b 100644
--- a/ami/ml/models/__init__.py
+++ b/ami/ml/models/__init__.py
@@ -1,12 +1,19 @@
 from ami.ml.models.algorithm import Algorithm, AlgorithmCategoryMap
+from ami.ml.models.embedding import DetectionEmbedding
+from ami.ml.models.evaluation import AlgorithmEvaluation, TaxonEvaluation
 from ami.ml.models.pipeline import Pipeline
 from ami.ml.models.processing_service import ProcessingService
 from ami.ml.models.project_pipeline_config import ProjectPipelineConfig
+from ami.ml.models.training_set import TrainingSetMembership
 
 __all__ = [
     "Algorithm",
     "AlgorithmCategoryMap",
+    "AlgorithmEvaluation",
+    "DetectionEmbedding",
     "Pipeline",
     "ProcessingService",
     "ProjectPipelineConfig",
+    "TaxonEvaluation",
+    "TrainingSetMembership",
 ]
diff --git a/ami/ml/models/algorithm.py b/ami/ml/models/algorithm.py
index 605f90861..9df7a8fc1 100644
--- a/ami/ml/models/algorithm.py
+++ b/ami/ml/models/algorithm.py
@@ -12,8 +12,10 @@
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 from django.utils.text import slugify
+from django_pydantic_field import SchemaField
 
 from ami.base.models import BaseModel, BaseQuerySet
+from ami.ml.schemas import AlgorithmTrainingConfig, AlgorithmTrainingInfo
 
 
 @typing.final
@@ -249,6 +251,32 @@ class Algorithm(BaseModel):
         help_text=("A URI to the weights or model details. Could be a public web URL or object store path."),
     )
 
+    trainable = models.BooleanField(
+        default=False,
+        help_text=(
+            "Whether the processing service reports that this algorithm can be retrained. "
+            "Mirrored from the service's /info response so the UI does not have to ask it."
+        ),
+    )
+    # Seeded from the service on first registration, then owned here so an admin's edits
+    # are not overwritten every time /info is read.
+    training_config = SchemaField(
+        AlgorithmTrainingConfig,
+        default=AlgorithmTrainingConfig,
+        null=False,
+        blank=True,
+        help_text="Settings used when retraining this algorithm.",
+    )
+    # Written by the training job. Every retrain creates a new version, so this records
+    # where one particular set of weights came from.
+    training_info = SchemaField(
+        AlgorithmTrainingInfo,
+        default=AlgorithmTrainingInfo,
+        null=False,
+        blank=True,
+        help_text="Where this version's weights came from. Empty on a version that was never retrained.",
+    )
+
     category_map = models.ForeignKey(
         AlgorithmCategoryMap,
         on_delete=models.CASCADE,
diff --git a/ami/ml/models/embedding.py b/ami/ml/models/embedding.py
new file mode 100644
index 000000000..7aafc29a7
--- /dev/null
+++ b/ami/ml/models/embedding.py
@@ -0,0 +1,60 @@
+import logging
+
+from django.db import models
+from pgvector.django import HalfVectorField
+
+from ami.base.models import BaseModel
+
+logger = logging.getLogger(__name__)
+
+# Width of the vectors this table holds. BioCLIP 2.5 (ViT-H/14) emits 1024 dimensions.
+# pgvector needs a fixed width per column in order to index it, so a backbone with a
+# different width (BioCLIP 2 ViT-L/14 is 768) needs its own column or its own table.
+EMBEDDING_DIMENSIONS = 1024
+
+
+class DetectionEmbedding(BaseModel):
+    """
+    The feature vector a classifier's backbone produced for one detection crop.
+
+    The backbone is frozen, so a crop's embedding never changes. Storing it lets a
+    classifier head be retrained from verified labels without re-running the backbone.
+
+    Kept off Detection deliberately: the vector is ~2 KB, Detection is scanned constantly
+    by the list views, and Postgres would TOAST a column that wide anyway.
+    """
+
+    project_accessor = "detection__source_image__project"
+
+    detection = models.ForeignKey(
+        "main.Detection",
+        on_delete=models.CASCADE,
+        related_name="embeddings",
+    )
+    algorithm = models.ForeignKey(
+        "ml.Algorithm",
+        on_delete=models.CASCADE,
+        related_name="embeddings",
+        help_text=(
+            "The algorithm whose backbone produced this vector. Vectors from different "
+            "algorithms live in different spaces and must never be compared to each other."
+        ),
+    )
+    # halfvec (2 bytes/dim) rather than vector (4). Measured at 20k rows, a row plus its
+    # share of the HNSW index costs ~5 KB; float32 would roughly double that.
+    vector = HalfVectorField(dimensions=EMBEDDING_DIMENSIONS)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["detection", "algorithm"],
+                name="unique_embedding_per_detection_and_algorithm",
+            )
+        ]
+        # Deliberately no vector index. These are read in bulk to train a head, never
+        # searched by nearest neighbour, and an HNSW index measured at roughly the size of
+        # the rows themselves (45 MB against 54 MB at 20k rows). Add one if similarity
+        # search is ever wanted; it can be built on the existing data.
+
+    def __str__(self) -> str:
+        return f"Embedding of Detection #{self.detection_id} by {self.algorithm}"
diff --git a/ami/ml/models/evaluation.py b/ami/ml/models/evaluation.py
new file mode 100644
index 000000000..1466e4f3e
--- /dev/null
+++ b/ami/ml/models/evaluation.py
@@ -0,0 +1,80 @@
+import logging
+
+from django.db import models
+
+from ami.base.models import BaseModel
+
+logger = logging.getLogger(__name__)
+
+
+class AlgorithmEvaluation(BaseModel):
+    """
+    How one algorithm scored against one occurrence set.
+
+    Scores are stored rather than computed on demand because every view that shows them —
+    the best model for a taxa list, a species' performance across algorithms — would
+    otherwise recompute the same thing for every row.
+    """
+
+    # Reached through the set it scored. Without this, visible_for_user() leaves these
+    # rows unfiltered, because the base class treats "no project relation" as public.
+    project_accessor = "occurrence_set__projects"
+
+    algorithm = models.ForeignKey("ml.Algorithm", on_delete=models.CASCADE, related_name="evaluations")
+    occurrence_set = models.ForeignKey("main.OccurrenceSet", on_delete=models.CASCADE, related_name="evaluations")
+    job = models.ForeignKey("jobs.Job", on_delete=models.SET_NULL, null=True, blank=True, related_name="evaluations")
+
+    micro_accuracy = models.FloatField(null=True, help_text="Share of occurrences the algorithm named correctly.")
+    macro_accuracy = models.FloatField(
+        null=True,
+        help_text=(
+            "Mean of the per-species accuracies. Trap data is long-tailed, so this says "
+            "far more than the plain share about whether rare species are handled."
+        ),
+    )
+    occurrences_scored = models.PositiveIntegerField(default=0)
+    occurrences_skipped = models.PositiveIntegerField(
+        default=0,
+        help_text=(
+            "In the set but not scored, because the species is outside what this algorithm "
+            "can predict. Scoring those would punish it for a question it was never asked."
+        ),
+    )
+    species_scored = models.PositiveIntegerField(default=0)
+
+    class Meta:
+        ordering = ["-created_at"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["algorithm", "occurrence_set"],
+                name="unique_evaluation_per_algorithm_and_set",
+            )
+        ]
+
+    def __str__(self) -> str:
+        return f"{self.algorithm} on {self.occurrence_set}: {self.micro_accuracy}"
+
+
+class TaxonEvaluation(BaseModel):
+    """
+    How one algorithm did on one species, within one evaluation.
+
+    The per-species breakdown the taxon page shows. Kept as rows rather than a blob so it
+    can be queried the other way round: every algorithm's score for a given species.
+    """
+
+    project_accessor = "evaluation__occurrence_set__projects"
+
+    evaluation = models.ForeignKey(AlgorithmEvaluation, on_delete=models.CASCADE, related_name="taxa")
+    taxon = models.ForeignKey("main.Taxon", on_delete=models.CASCADE, related_name="evaluations")
+
+    accuracy = models.FloatField(help_text="Share of this species' occurrences the algorithm named correctly.")
+    occurrences_scored = models.PositiveIntegerField(default=0)
+    correct = models.PositiveIntegerField(default=0)
+
+    class Meta:
+        ordering = ["-occurrences_scored", "taxon__name"]
+        constraints = [models.UniqueConstraint(fields=["evaluation", "taxon"], name="unique_taxon_per_evaluation")]
+
+    def __str__(self) -> str:
+        return f"{self.taxon}: {self.accuracy}"
diff --git a/ami/ml/models/pipeline.py b/ami/ml/models/pipeline.py
index 8ebaf6d6d..4680ec514 100644
--- a/ami/ml/models/pipeline.py
+++ b/ami/ml/models/pipeline.py
@@ -40,9 +40,11 @@
 )
 from ami.ml.exceptions import PipelineNotConfigured
 from ami.ml.models.algorithm import Algorithm, AlgorithmCategoryMap
+from ami.ml.models.embedding import EMBEDDING_DIMENSIONS, DetectionEmbedding
 from ami.ml.schemas import (
     AlgorithmConfigResponse,
     AlgorithmReference,
+    AlgorithmTrainingConfig,
     ClassificationResponse,
     DetectionRequest,
     DetectionResponse,
@@ -461,6 +463,9 @@ def get_or_create_algorithm_and_category_map(
             "version_name": algorithm_config.version_name,
             "uri": algorithm_config.uri,
             "category_map": None,
+            # Seeded once. Deliberately not in fields_to_update below: an admin who tunes
+            # these settings must not have them reset the next time /info is read.
+            "training_config": algorithm_config.training_config or AlgorithmTrainingConfig(),
         },
     )
     if _created:
@@ -502,8 +507,16 @@ def get_or_create_algorithm_and_category_map(
     # These are fields that we have added to the API since the algorithm was first created
     fields_to_update = {
         "task_type": algorithm_config.task_type,
-        "uri": algorithm_config.uri,
+        "trainable": algorithm_config.trainable,
     }
+    if algorithm_config.uri:
+        # Only when the service names one. A head Antenna retrained has its weights
+        # stored by Antenna, and the service reports no uri for it, so overwriting
+        # unconditionally would erase the only record of where they are.
+        fields_to_update["uri"] = algorithm_config.uri
+    if algorithm_config.training_info:
+        # A fact about where these weights came from, so the service always wins.
+        fields_to_update["training_info"] = algorithm_config.training_info
     for field in fields_to_update:
         new_value = fields_to_update[field]
         if getattr(algo, field) != new_value:
@@ -901,6 +914,66 @@ def create_classifications(
     return existing_classifications + new_classifications
 
 
+def create_detection_embeddings(
+    detections: list[Detection],
+    detection_responses: list[DetectionResponse],
+    algorithms_known: dict[str, Algorithm],
+    logger: logging.Logger = logger,
+) -> int:
+    """
+    Save the feature vectors a processing service returned with its classifications.
+
+    Returns the number offered to the database. Existing rows are ignored rather than
+    raised on, so re-running a pipeline over the same detections stays safe.
+    """
+    to_create: list[DetectionEmbedding] = []
+    seen: set[tuple[int, int]] = set()
+    wrong_size = 0
+
+    for detection, detection_resp in zip(detections, detection_responses):
+        if not detection.pk:
+            # A detection that failed to save has nothing to attach an embedding to.
+            continue
+        for classification_resp in detection_resp.classifications:
+            features = classification_resp.features
+            if not features:
+                continue
+            algorithm = algorithms_known.get(classification_resp.algorithm.key)
+            if not algorithm:
+                # create_classification already raises on unknown algorithms; skip quietly.
+                continue
+            if len(features) != EMBEDDING_DIMENSIONS:
+                wrong_size += 1
+                continue
+            # One vector per (detection, algorithm). A pipeline that returns several
+            # classifications from the same algorithm sends the same vector each time.
+            key = (detection.pk, algorithm.pk)
+            if key in seen:
+                continue
+            seen.add(key)
+            to_create.append(
+                DetectionEmbedding(
+                    detection=detection,
+                    algorithm=algorithm,
+                    vector=features,
+                )
+            )
+
+    if wrong_size:
+        logger.warning(
+            f"Skipped {wrong_size} feature vector(s) that were not {EMBEDDING_DIMENSIONS} dimensions. "
+            "DetectionEmbedding.vector has a fixed width, so a backbone of a different width "
+            "needs its own column or table."
+        )
+
+    if not to_create:
+        return 0
+
+    DetectionEmbedding.objects.bulk_create(to_create, batch_size=500, ignore_conflicts=True)
+    logger.info(f"Saved {len(to_create)} detection embedding(s), ignoring any that already existed")
+    return len(to_create)
+
+
 def create_and_update_occurrences_for_detections(
     detections: list[Detection],
     logger: logging.Logger = logger,
@@ -1084,6 +1157,17 @@ def save_results(
         logger=job_logger,
     )
 
+    # Opt-in per project: a stored vector costs roughly 5 KB once the vector index is
+    # counted, so this is only worth paying for on projects that will retrain a head.
+    project = next((image.project for image in source_images if image.project_id), None)
+    if project and project.feature_flags.store_classification_embeddings:
+        create_detection_embeddings(
+            detections=detections,
+            detection_responses=results.detections,
+            algorithms_known=algorithms_known,
+            logger=job_logger,
+        )
+
     # Create a new occurrence for each detection (no tracking yet)
     # @TODO remove when we implement tracking!
     create_and_update_occurrences_for_detections(
diff --git a/ami/ml/models/training_set.py b/ami/ml/models/training_set.py
new file mode 100644
index 000000000..ae07a0532
--- /dev/null
+++ b/ami/ml/models/training_set.py
@@ -0,0 +1,112 @@
+import logging
+
+from django.db import models
+
+from ami.base.models import BaseModel
+
+logger = logging.getLogger(__name__)
+
+
+class TrainingSetMembership(BaseModel):
+    """
+    Records that an occurrence's crops went into one training run.
+
+    An evaluation set is only honest if it holds nothing the model learned from, and a
+    person verifying occurrences has no way to know which of them a past retrain already
+    consumed. Writing it down at the moment the training set is built is the only reliable
+    way to tell the two apart later.
+
+    Kept as its own table rather than a flag on Occurrence: the same occurrence is used by
+    every later retrain, so this is a list, not a yes or no.
+    """
+
+    project_accessor = "occurrence__project"
+
+    occurrence = models.ForeignKey(
+        "main.Occurrence",
+        on_delete=models.CASCADE,
+        related_name="training_uses",
+    )
+    job = models.ForeignKey(
+        "jobs.Job",
+        on_delete=models.CASCADE,
+        related_name="training_set_members",
+        help_text="The training job that collected this occurrence.",
+    )
+    algorithm = models.ForeignKey(
+        "ml.Algorithm",
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="training_occurrences",
+        help_text=(
+            "The algorithm version this occurrence helped produce. Filled in after training "
+            "finishes, because the version does not exist while the training set is built."
+        ),
+    )
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["occurrence", "job"],
+                name="unique_training_use_per_occurrence_and_job",
+            )
+        ]
+        indexes = [
+            # The evaluation-set query is "occurrences never used for training", which reads
+            # this column and nothing else.
+            models.Index(fields=["occurrence"], name="training_use_occurrence_idx"),
+        ]
+
+    def __str__(self) -> str:
+        return f"Occurrence #{self.occurrence_id} used by job #{self.job_id}"
+
+
+def record_training_set(occurrence_ids: list[int], job) -> int:
+    """
+    Write down which occurrences a training run used.
+
+    Ignores rows that already exist, so re-running a job does not fail and does not
+    double-count.
+    """
+    memberships = [TrainingSetMembership(occurrence_id=pk, job=job) for pk in set(occurrence_ids)]
+    if not memberships:
+        return 0
+    TrainingSetMembership.objects.bulk_create(memberships, batch_size=1000, ignore_conflicts=True)
+    logger.info(f"Recorded {len(memberships)} occurrence(s) as used by training job #{job.pk}")
+    return len(memberships)
+
+
+def attach_algorithm(job, algorithm) -> int:
+    """Point this job's records at the version it produced, once that version exists."""
+    return TrainingSetMembership.objects.filter(job=job, algorithm__isnull=True).update(algorithm=algorithm)
+
+
+def occurrence_ids_used_for_training(project=None) -> models.QuerySet:
+    """Occurrences that any training run has already consumed."""
+    rows = TrainingSetMembership.objects.all()
+    if project:
+        rows = rows.filter(occurrence__project=project)
+    return rows.order_by().values_list("occurrence_id", flat=True).distinct()
+
+
+def occurrences_safe_to_evaluate_on(project=None) -> models.QuerySet:
+    """
+    Verified occurrences no training run has used.
+
+    This is the pool an evaluation set is drawn from. Scoring a model on data it learned
+    from reports a number that means nothing.
+    """
+    from ami.main.models import Occurrence
+    from ami.ml import training_data
+
+    verified = training_data.verified_occurrence_ids(project) if project else None
+    occurrences = Occurrence.objects.filter(determination__isnull=False)
+    if project:
+        occurrences = occurrences.filter(project=project, pk__in=verified)
+    # Materialising the used ids follows the guidance in CLAUDE.md for anti-joins. Measured
+    # locally (3,193 occurrences, 219 used): 1.3 ms against 15.3 ms for
+    # `.exclude(training_uses__isnull=False)`. Not measured at production scale, where a
+    # large id list may well turn the trade-off around.
+    used = list(occurrence_ids_used_for_training(project))
+    return occurrences.exclude(pk__in=used)
diff --git a/ami/ml/reporting.py b/ami/ml/reporting.py
new file mode 100644
index 000000000..12089476c
--- /dev/null
+++ b/ami/ml/reporting.py
@@ -0,0 +1,141 @@
+"""
+The numbers the model-performance views read.
+
+Each of these answers one question a screen asks, in a single query. They are kept apart
+from the models so a view can ask for them without pulling in the training machinery, and
+so the same number means the same thing everywhere it is shown.
+"""
+
+import typing
+
+from django.db import models
+
+from ami.main.models import OccurrenceSet, Project, TaxaList, Taxon
+from ami.ml.models.algorithm import Algorithm
+from ami.ml.models.evaluation import AlgorithmEvaluation, TaxonEvaluation
+
+DEFAULT_EVALUATION_LIMIT = 5
+
+
+def visible_sets(project: Project | None) -> models.QuerySet:
+    """
+    The evaluation sets a project may be shown: its own, plus the global ones.
+
+    Taxa and algorithms are shared across the platform but evaluation sets are not, so
+    every read below has to be scoped or it reports another project's numbers. Without a
+    project that means the global sets alone: an unscoped read would answer with every
+    project's set names and scores, and this is reachable without naming one.
+    """
+    if project is None:
+        return OccurrenceSet.objects.filter(projects__isnull=True)
+    return OccurrenceSet.objects.for_project(project)
+
+
+def project_for(request) -> Project | None:
+    """
+    The project a request is asking about, if the caller may see it.
+
+    get_active_project loads a project by id alone, so a caller can name a draft project
+    they are not a member of and have it scoped to. Anything that scopes by project has to
+    check visibility itself until that helper does.
+    """
+    from ami.base.views import get_active_project
+
+    if request is None:
+        return None
+    project = get_active_project(request=request, required=False)
+    if project is None:
+        return None
+    return Project.objects.visible_for_user(request.user).filter(pk=project.pk).first()
+
+
+# How "best" is decided, in one place so the single-list lookup and the list page cannot
+# drift. Ranked on the per-species average rather than the plain share: trap data is
+# long-tailed, so a model that only handles the common species would otherwise win.
+BEST_MODEL_ORDERING = ("-macro_accuracy", "-micro_accuracy")
+
+
+def best_evaluation_for_taxa_list(taxa_list: TaxaList, project: Project | None = None) -> AlgorithmEvaluation | None:
+    """The algorithm that scores highest on the species in this list."""
+    # No .distinct(): the join repeats an evaluation once per species it scored in the list,
+    # which cannot change which row sorts first.
+    rows = AlgorithmEvaluation.objects.filter(taxa__taxon__lists=taxa_list, occurrence_set__in=visible_sets(project))
+    return rows.select_related("algorithm", "occurrence_set").order_by(*BEST_MODEL_ORDERING).first()
+
+
+def annotate_best_model(taxa_lists: models.QuerySet, project: Project | None = None) -> models.QuerySet:
+    """
+    Attach each list's best-scoring evaluation, for a page of lists.
+
+    Correlated subqueries rather than a lookup per row: every list on the page renders its
+    best model, so a per-row lookup costs one query each.
+    """
+    best = AlgorithmEvaluation.objects.filter(taxa__taxon__lists=models.OuterRef("pk"))
+    best = best.filter(occurrence_set__in=visible_sets(project)).order_by(*BEST_MODEL_ORDERING)
+    return taxa_lists.annotate(
+        best_algorithm_id=models.Subquery(best.values("algorithm_id")[:1]),
+        best_algorithm_name=models.Subquery(best.values("algorithm__name")[:1]),
+        best_micro_accuracy=models.Subquery(best.values("micro_accuracy")[:1]),
+        best_macro_accuracy=models.Subquery(best.values("macro_accuracy")[:1]),
+        best_occurrence_set_name=models.Subquery(best.values("occurrence_set__name")[:1]),
+    )
+
+
+def performance_for_taxon(taxon: Taxon, project: Project | None = None) -> list[dict[str, typing.Any]]:
+    """
+    How each algorithm has done on one species.
+
+    The breakdown the taxon page shows: one row per algorithm that has been scored on a set
+    containing this species.
+    """
+    rows = TaxonEvaluation.objects.filter(taxon=taxon, evaluation__occurrence_set__in=visible_sets(project))
+    rows = rows.select_related("evaluation__algorithm", "evaluation__occurrence_set").order_by("-accuracy")
+    return [
+        {
+            "algorithm": {
+                "id": row.evaluation.algorithm_id,
+                "name": row.evaluation.algorithm.name,
+                "key": row.evaluation.algorithm.key,
+                "version": row.evaluation.algorithm.version,
+            },
+            "occurrence_set": {
+                "id": row.evaluation.occurrence_set_id,
+                "name": row.evaluation.occurrence_set.name,
+            },
+            "accuracy": row.accuracy,
+            "occurrences_scored": row.occurrences_scored,
+            "correct": row.correct,
+            "overall_accuracy": row.evaluation.micro_accuracy,
+            "overall_accuracy_by_species": row.evaluation.macro_accuracy,
+        }
+        for row in rows
+    ]
+
+
+def latest_evaluations(
+    algorithm: Algorithm, limit: int = DEFAULT_EVALUATION_LIMIT, project: Project | None = None
+) -> list[dict[str, typing.Any]]:
+    """
+    What this algorithm has scored, most recent first. Shown on its details panel.
+
+    Read through the related manager without filtering or reordering, so a list view that
+    prefetched the evaluations is served from that cache instead of one query per row.
+    """
+    rows = sorted(algorithm.evaluations.all(), key=lambda row: row.created_at, reverse=True)
+    # Filtered in Python, not SQL, to keep using the prefetched cache above.
+    allowed = set(visible_sets(project).values_list("pk", flat=True))
+    rows = [row for row in rows if row.occurrence_set_id in allowed]
+    rows = rows[:limit]
+    return [
+        {
+            "id": row.pk,
+            "occurrence_set": {"id": row.occurrence_set_id, "name": row.occurrence_set.name},
+            "accuracy": row.micro_accuracy,
+            "accuracy_by_species": row.macro_accuracy,
+            "occurrences_scored": row.occurrences_scored,
+            "occurrences_skipped": row.occurrences_skipped,
+            "species_scored": row.species_scored,
+            "created_at": row.created_at,
+        }
+        for row in rows
+    ]
diff --git a/ami/ml/schemas.py b/ami/ml/schemas.py
index 9322e4116..8f536e8d3 100644
--- a/ami/ml/schemas.py
+++ b/ami/ml/schemas.py
@@ -92,6 +92,69 @@ class AlgorithmCategoryMapResponse(pydantic.BaseModel):
     )
 
 
+class AlgorithmTrainingConfig(pydantic.BaseModel):
+    """
+    How to retrain an algorithm. Declared by the processing service, editable afterwards.
+
+    Split across two sides on purpose: Antenna reads the dataset settings when it builds
+    the training set, and passes the rest to the service, which owns the fitting.
+    """
+
+    # Dataset settings, used by Antenna.
+    min_per_species: int = pydantic.Field(
+        default=2,
+        description="Drop species with fewer verified crops than this. One example cannot be evaluated.",
+    )
+    test_fraction: float = pydantic.Field(default=0.2, description="Share of occurrences held out for evaluation.")
+    split_salt: str = pydantic.Field(
+        default="antenna-head-v1",
+        description="Changing this reshuffles the held-out set, which makes old and new heads incomparable.",
+    )
+
+    # Fitting settings, used by the processing service.
+    head_type: str = pydantic.Field(
+        default="linear",
+        description="Shape of the head to fit, e.g. 'linear' or 'mlp1'.",
+        examples=["linear", "mlp1"],
+    )
+    epochs: int = 300
+    learning_rate: float = 0.01
+    weight_decay: float = 1e-4
+    min_improvement: float = pydantic.Field(
+        default=0.0,
+        description="A new head must beat the current one by more than this to be worth swapping in.",
+    )
+
+    class Config:
+        extra = "allow"
+
+
+class AlgorithmTrainingInfo(pydantic.BaseModel):
+    """
+    What actually happened when this version was trained. Written by the service, read-only.
+
+    Every retrain produces a new algorithm version, so this is the record of where a
+    particular set of weights came from.
+    """
+
+    trained_at: datetime.datetime | None = None
+    dataset_url: str | None = pydantic.Field(default=None, description="The exact training set this was fitted on.")
+    dataset_rows: int | None = None
+    dataset_classes: int | None = None
+    metrics: dict = pydantic.Field(default_factory=dict, description="Scores on the held-out split.")
+    previous_metrics: dict = pydantic.Field(
+        default_factory=dict, description="What the version it was compared against scored on the same rows."
+    )
+    parent_algorithm_key: str | None = pydantic.Field(
+        default=None, description="The version this one was trained to beat."
+    )
+    job_id: int | None = None
+    warnings: list[str] = pydantic.Field(default_factory=list)
+
+    class Config:
+        extra = "allow"
+
+
 class AlgorithmConfigResponse(pydantic.BaseModel):
     name: str
     key: str = pydantic.Field(
@@ -115,6 +178,22 @@ class AlgorithmConfigResponse(pydantic.BaseModel):
         default=None,
         description="A URI to the weight or model details, could be a public web URL or object store path.",
     )
+    trainable: bool = pydantic.Field(
+        default=False,
+        description=(
+            "Whether this algorithm can be retrained from labelled data. A service usually hosts "
+            "several algorithms and only some of them, typically a classifier head over a frozen "
+            "backbone, are cheap enough to retrain."
+        ),
+    )
+    training_config: AlgorithmTrainingConfig | None = pydantic.Field(
+        default=None,
+        description="The service's default retraining settings. Antenna seeds its own copy from this.",
+    )
+    training_info: AlgorithmTrainingInfo | None = pydantic.Field(
+        default=None,
+        description="Where this version's weights came from. Only set on a version that was retrained.",
+    )
     category_map: AlgorithmCategoryMapResponse | None = None
 
     class Config:
@@ -133,6 +212,14 @@ class ClassificationResponse(pydantic.BaseModel):
     )
     scores: list[float] = []
     logits: list[float] | None = None
+    features: list[float] | None = pydantic.Field(
+        default=None,
+        description=(
+            "The embedding the model's backbone produced for this crop, taken before the "
+            "classification head. Optional, and only useful if every value comes from the "
+            "same backbone."
+        ),
+    )
     inference_time: float | None = None
     algorithm: AlgorithmReference
     terminal: bool = True
diff --git a/ami/ml/serializers.py b/ami/ml/serializers.py
index e7e9e6aaf..d904de271 100644
--- a/ami/ml/serializers.py
+++ b/ami/ml/serializers.py
@@ -2,12 +2,13 @@
 from rest_framework import serializers
 
 from ami.main.api.serializers import DefaultSerializer, MinimalNestedModelSerializer
+from ami.ml import training_data
 
 from .models.algorithm import Algorithm, AlgorithmCategoryMap
 from .models.pipeline import Pipeline, PipelineStage
 from .models.processing_service import ProcessingService
 from .models.project_pipeline_config import ProjectPipelineConfig
-from .schemas import PipelineConfigResponse
+from .schemas import AlgorithmTrainingConfig, AlgorithmTrainingInfo, PipelineConfigResponse
 
 
 class AlgorithmCategoryMapSerializer(DefaultSerializer):
@@ -30,6 +31,11 @@ class Meta:
 
 class AlgorithmSerializer(DefaultSerializer):
     category_map = MinimalCategoryMapNestedSerializer(read_only=True, source="category_map_id")
+    # Pydantic-backed model fields have to be declared, the way the job serializers do.
+    # A bare name in Meta.fields raises ImproperlyConfigured at import time.
+    training_config = SchemaField(schema=AlgorithmTrainingConfig, required=False)
+    training_info = SchemaField(schema=AlgorithmTrainingInfo, read_only=True)
+    evaluations = serializers.SerializerMethodField()
 
     class Meta:
         model = Algorithm
@@ -43,12 +49,30 @@ class Meta:
             "version",
             "version_name",
             "task_type",
+            "trainable",
+            "training_config",
+            "training_info",
+            "evaluations",
             "category_map",
             "category_count",
             "created_at",
             "updated_at",
         ]
 
+    def get_evaluations(self, obj) -> list[dict]:
+        """
+        How this algorithm has scored on each evaluation set. Empty until one is scored.
+
+        Scoped to the project being viewed: an algorithm is shared across the platform but
+        an evaluation set is not.
+        """
+        from ami.ml import reporting
+
+        # .get(): this serializer is nested inside other responses, which do not always
+        # carry a request. Without one there is no project, so only the global sets show.
+        project = reporting.project_for(self.context.get("request"))
+        return reporting.latest_evaluations(obj, project=project)
+
 
 class AlgorithmNestedSerializer(DefaultSerializer):
     class Meta:
@@ -168,3 +192,20 @@ def get_projects(self, obj):
 class PipelineRegistrationSerializer(serializers.Serializer):
     processing_service_name = serializers.CharField()
     pipelines = SchemaField(schema=list[PipelineConfigResponse], default=[])
+
+
+class TrainingDataRowSerializer(serializers.Serializer):
+    """
+    One verified crop: its human label and the embedding to train on.
+
+    Not a ModelSerializer — the useful fields live on the related occurrence and on the
+    pgvector column, and the split is computed, so building the dict directly is clearer.
+    """
+
+    def to_representation(self, instance):
+        return training_data.row_as_dict(
+            instance,
+            salt=self.context.get("split_salt", training_data.DEFAULT_SPLIT_SALT),
+            test_fraction=self.context.get("test_fraction", training_data.DEFAULT_TEST_FRACTION),
+            include_features=self.context.get("include_features", True),
+        )
diff --git a/ami/ml/tests.py b/ami/ml/tests.py
index bd92bb02f..8c1a80381 100644
--- a/ami/ml/tests.py
+++ b/ami/ml/tests.py
@@ -1,9 +1,15 @@
 import concurrent.futures
 import datetime
+import io
+import json
 import pathlib
 import unittest
+import unittest.mock
 import uuid
 
+import numpy as np
+from django.core.files.storage import default_storage
+from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import TestCase
 from rest_framework.test import APIRequestFactory, APITestCase
 
@@ -15,14 +21,27 @@
     Event,
     Identification,
     Occurrence,
+    OccurrenceSet,
     Project,
     SourceImage,
     SourceImageCollection,
+    TaxaList,
     Taxon,
     TaxonRank,
     group_images_into_events,
+    update_occurrence_determination,
 )
-from ami.ml.models import Algorithm, Pipeline, ProcessingService
+from ami.ml import reporting, training_data
+from ami.ml.models import (
+    Algorithm,
+    AlgorithmCategoryMap,
+    AlgorithmEvaluation,
+    DetectionEmbedding,
+    Pipeline,
+    ProcessingService,
+    TaxonEvaluation,
+)
+from ami.ml.models.embedding import EMBEDDING_DIMENSIONS
 from ami.ml.models.pipeline import collect_images, get_or_create_algorithm_and_category_map, save_results
 from ami.ml.post_processing.small_size_filter import SmallSizeFilterTask
 from ami.ml.schemas import (
@@ -2288,3 +2307,2217 @@ def test_used_lookup_is_deduplicated_in_the_database(self):
             len(list(lookup.order_by().distinct())), 1, "Deduplicating collapses them to the one algorithm"
         )
         self.assertIn("Chatty Masked Classifier", self._choice_names(self.project.pk))
+
+
+class TestDetectionEmbeddings(TestCase):
+    """
+    Feature vectors returned with a classification are stored as DetectionEmbedding rows,
+    so that a classifier head can be retrained from verified labels later without running
+    the backbone over every crop again.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Embedding Test Project")
+        self.test_images = [
+            SourceImage.objects.create(path="embed1-20240101000000.jpg", project=self.project),
+            SourceImage.objects.create(path="embed2-20240101001000.jpg", project=self.project),
+        ]
+        self.pipeline = Pipeline.objects.create(name="Embedding Test Pipeline")
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.pipeline.algorithms.set(
+            [
+                self.algorithms["random-detector"],
+                self.algorithms["random-species-classifier"],
+            ]
+        )
+
+    def _results(self, features: list[float] | None) -> PipelineResultsResponse:
+        detector = ALGORITHM_CHOICES["random-detector"]
+        classifier = ALGORITHM_CHOICES["random-species-classifier"]
+        assert classifier.category_map
+        return PipelineResultsResponse(
+            pipeline=self.pipeline.slug,
+            total_time=0.01,
+            source_images=[SourceImageResponse(id=image.pk, url=image.path) for image in self.test_images],
+            detections=[
+                DetectionResponse(
+                    source_image_id=image.pk,
+                    bbox=BoundingBox(x1=0.0, y1=0.0, x2=1.0, y2=1.0),
+                    algorithm=AlgorithmReference(name=detector.name, key=detector.key),
+                    timestamp=datetime.datetime.now(),
+                    classifications=[
+                        ClassificationResponse(
+                            classification=classifier.category_map.labels[0],
+                            labels=classifier.category_map.labels,
+                            scores=[0.77],
+                            features=features,
+                            algorithm=AlgorithmReference(name=classifier.name, key=classifier.key),
+                            timestamp=datetime.datetime.now(),
+                            terminal=True,
+                        ),
+                    ],
+                )
+                for image in self.test_images
+            ],
+        )
+
+    def _enable_flag(self):
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+
+    def test_embeddings_are_not_saved_when_the_flag_is_off(self):
+        save_results(self._results(features=[0.5] * EMBEDDING_DIMENSIONS))
+        self.assertEqual(DetectionEmbedding.objects.count(), 0, "Storing embeddings must be opt-in")
+
+    def test_embeddings_are_saved_when_the_flag_is_on(self):
+        self._enable_flag()
+        save_results(self._results(features=[0.5] * EMBEDDING_DIMENSIONS))
+
+        self.assertEqual(DetectionEmbedding.objects.count(), len(self.test_images))
+        embedding = DetectionEmbedding.objects.first()
+        assert embedding
+        self.assertEqual(embedding.algorithm, self.algorithms["random-species-classifier"])
+        self.assertEqual(len(embedding.vector.to_list()), EMBEDDING_DIMENSIONS)
+
+    def test_a_classification_without_features_stores_nothing(self):
+        self._enable_flag()
+        save_results(self._results(features=None))
+        self.assertEqual(DetectionEmbedding.objects.count(), 0)
+
+    def test_a_vector_of_the_wrong_width_is_skipped_not_fatal(self):
+        """A backbone of a different width must not break the job."""
+        self._enable_flag()
+        save_results(self._results(features=[0.5] * 768))
+        self.assertEqual(DetectionEmbedding.objects.count(), 0)
+        self.assertEqual(
+            Classification.objects.filter(detection__source_image__project=self.project).count(),
+            len(self.test_images),
+            "Classifications are still saved",
+        )
+
+    def test_reprocessing_the_same_detections_does_not_raise(self):
+        """
+        The unique constraint on (detection, algorithm) must be ignored, not raised,
+        so re-running a pipeline over processed captures stays safe.
+        """
+        self._enable_flag()
+        results = self._results(features=[0.5] * EMBEDDING_DIMENSIONS)
+        save_results(results)
+        self.project.feature_flags.reprocess_all_images = True
+        self.project.save()
+        save_results(results)
+        self.assertEqual(DetectionEmbedding.objects.count(), len(self.test_images), "No duplicate embeddings")
+
+    def test_nearest_neighbour_search_finds_the_closest_vector(self):
+        """The point of storing these: find similar crops without leaving the database."""
+        from pgvector.django import CosineDistance
+
+        self._enable_flag()
+        save_results(self._results(features=[0.5] * EMBEDDING_DIMENSIONS))
+
+        near = [0.5] * EMBEDDING_DIMENSIONS
+        far = [0.5] * (EMBEDDING_DIMENSIONS - 1) + [-40.0]
+        # Constrained to one algorithm: vectors from different backbones are not comparable.
+        results = (
+            DetectionEmbedding.objects.filter(algorithm=self.algorithms["random-species-classifier"])
+            .annotate(near=CosineDistance("vector", near))
+            .annotate(far=CosineDistance("vector", far))
+            .first()
+        )
+        assert results
+        self.assertLess(results.near, results.far, "An identical vector must be closer than a different one")
+
+
+class TestExportVerifiedTrainingData(TestCase):
+    """
+    The export command turns what people verified in the UI into a training set for a
+    classifier head: embeddings in, labels from the human identifications.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Export Test Project")
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+
+        self.user = User.objects.create_user(email="verifier@example.com", password="testpass123")
+        self.images = [
+            SourceImage.objects.create(path=f"export{i}-2024010100{i:02d}00.jpg", project=self.project)
+            for i in range(20)
+        ]
+        self.pipeline = Pipeline.objects.create(name="Export Test Pipeline")
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.classifier = self.algorithms["random-species-classifier"]
+        self.pipeline.algorithms.set([self.algorithms["random-detector"], self.classifier])
+
+        save_results(self._results())
+        self.taxa = [
+            Taxon.objects.create(name="Testus unus", rank=TaxonRank.SPECIES.name),
+            Taxon.objects.create(name="Testus duo", rank=TaxonRank.SPECIES.name),
+        ]
+
+    def _results(self) -> PipelineResultsResponse:
+        detector = ALGORITHM_CHOICES["random-detector"]
+        classifier = ALGORITHM_CHOICES["random-species-classifier"]
+        assert classifier.category_map
+        return PipelineResultsResponse(
+            pipeline=self.pipeline.slug,
+            total_time=0.01,
+            source_images=[SourceImageResponse(id=image.pk, url=image.path) for image in self.images],
+            detections=[
+                DetectionResponse(
+                    source_image_id=image.pk,
+                    bbox=BoundingBox(x1=0.0, y1=0.0, x2=1.0, y2=1.0),
+                    algorithm=AlgorithmReference(name=detector.name, key=detector.key),
+                    timestamp=datetime.datetime.now(),
+                    classifications=[
+                        ClassificationResponse(
+                            classification=classifier.category_map.labels[0],
+                            labels=classifier.category_map.labels,
+                            scores=[0.5],
+                            # A different vector per image, so the classes are separable.
+                            features=[float(i)] * EMBEDDING_DIMENSIONS,
+                            algorithm=AlgorithmReference(name=classifier.name, key=classifier.key),
+                            timestamp=datetime.datetime.now(),
+                            terminal=True,
+                        ),
+                    ],
+                )
+                for i, image in enumerate(self.images)
+            ],
+        )
+
+    def _verify_all(self):
+        """A human confirms a species for every occurrence, alternating between two taxa."""
+        for i, occurrence in enumerate(Occurrence.objects.filter(project=self.project).order_by("pk")):
+            Identification.objects.create(
+                occurrence=occurrence,
+                taxon=self.taxa[i % len(self.taxa)],
+                user=self.user,
+            )
+
+    def _run_export(self, **kwargs) -> dict:
+        import tempfile
+
+        from django.core.management import call_command
+
+        with tempfile.TemporaryDirectory() as tmp:
+            out = pathlib.Path(tmp) / "export"
+            call_command(
+                "export_verified_training_data",
+                project=self.project.pk,
+                algorithm=self.classifier.key,
+                output=str(out),
+                test_fraction=0.5,
+                stdout=io.StringIO(),
+                **kwargs,
+            )
+            data = np.load(out.with_suffix(".npz"))
+            meta = json.loads(out.with_suffix(".json").read_text())
+            return {"npz": {k: data[k] for k in data.files}, "meta": meta}
+
+    def test_export_requires_something_verified(self):
+        from django.core.management import call_command
+        from django.core.management.base import CommandError
+
+        with self.assertRaises(CommandError):
+            call_command(
+                "export_verified_training_data",
+                project=self.project.pk,
+                algorithm=self.classifier.key,
+                stdout=io.StringIO(),
+            )
+
+    def test_export_pairs_embeddings_with_human_labels(self):
+        self._verify_all()
+        result = self._run_export(min_per_species=1)
+
+        self.assertEqual(result["npz"]["features"].shape, (len(self.images), EMBEDDING_DIMENSIONS))
+        self.assertEqual(sorted(result["meta"]["classes"]), ["Testus duo", "Testus unus"])
+        self.assertEqual(result["meta"]["rows"], len(self.images))
+        self.assertEqual(result["meta"]["algorithm"]["key"], self.classifier.key)
+
+    def test_a_withdrawn_identification_is_not_exported(self):
+        self._verify_all()
+        Identification.objects.all().update(withdrawn=True)
+
+        from django.core.management import call_command
+        from django.core.management.base import CommandError
+
+        with self.assertRaises(CommandError):
+            call_command(
+                "export_verified_training_data",
+                project=self.project.pk,
+                algorithm=self.classifier.key,
+                stdout=io.StringIO(),
+            )
+
+    def test_the_split_is_stable_across_runs(self):
+        """An eval set that moves between runs cannot be used to compare two heads."""
+        self._verify_all()
+        first = self._run_export(min_per_species=1)
+        second = self._run_export(min_per_species=1)
+        self.assertTrue((first["npz"]["split"] == second["npz"]["split"]).all())
+        self.assertEqual(first["meta"]["settings"]["split_grouped_by"], "occurrence")
+
+    def test_rare_species_are_dropped(self):
+        self._verify_all()
+        # Give one occurrence a species nothing else has.
+        rare = Taxon.objects.create(name="Testus rarus", rank=TaxonRank.SPECIES.name)
+        occurrence = Occurrence.objects.filter(project=self.project).order_by("pk").first()
+        assert occurrence
+        Identification.objects.create(occurrence=occurrence, taxon=rare, user=self.user)
+
+        result = self._run_export(min_per_species=2)
+        self.assertNotIn("Testus rarus", result["meta"]["classes"])
+
+
+class TestTrainingDataAPI(APITestCase):
+    """
+    The endpoint a trainer pulls from: verified labels paired with their embeddings.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Training API Project")
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+        self.user = User.objects.create_user(email="trainer@example.com", password="testpass123")
+        self.project.members.add(self.user)
+
+        self.images = [
+            SourceImage.objects.create(path=f"train{i}-2024010100{i:02d}00.jpg", project=self.project)
+            for i in range(4)
+        ]
+        self.pipeline = Pipeline.objects.create(name="Training API Pipeline")
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.classifier = self.algorithms["random-species-classifier"]
+        self.pipeline.algorithms.set([self.algorithms["random-detector"], self.classifier])
+
+        detector = ALGORITHM_CHOICES["random-detector"]
+        classifier = ALGORITHM_CHOICES["random-species-classifier"]
+        assert classifier.category_map
+        save_results(
+            PipelineResultsResponse(
+                pipeline=self.pipeline.slug,
+                total_time=0.01,
+                source_images=[SourceImageResponse(id=i.pk, url=i.path) for i in self.images],
+                detections=[
+                    DetectionResponse(
+                        source_image_id=image.pk,
+                        bbox=BoundingBox(x1=0.0, y1=0.0, x2=1.0, y2=1.0),
+                        algorithm=AlgorithmReference(name=detector.name, key=detector.key),
+                        timestamp=datetime.datetime.now(),
+                        classifications=[
+                            ClassificationResponse(
+                                classification=classifier.category_map.labels[0],
+                                labels=classifier.category_map.labels,
+                                scores=[0.5],
+                                features=[float(i)] * EMBEDDING_DIMENSIONS,
+                                algorithm=AlgorithmReference(name=classifier.name, key=classifier.key),
+                                timestamp=datetime.datetime.now(),
+                                terminal=True,
+                            )
+                        ],
+                    )
+                    for i, image in enumerate(self.images)
+                ],
+            )
+        )
+        self.taxon = Taxon.objects.create(name="Trainicus testus", rank=TaxonRank.SPECIES.name)
+        for occurrence in Occurrence.objects.filter(project=self.project):
+            Identification.objects.create(occurrence=occurrence, taxon=self.taxon, user=self.user)
+
+        self.url = reverse_with_params("api:training-data-list")
+        self.summary_url = reverse_with_params("api:training-data-summary")
+        self.params = {"project_id": self.project.pk, "algorithm": self.classifier.key}
+
+    def test_anonymous_users_get_nothing(self):
+        response = self.client.get(self.url, self.params)
+        self.assertEqual(response.status_code, 401)
+
+    def test_rows_carry_the_human_label_and_the_embedding(self):
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, self.params)
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["count"], len(self.images))
+        row = response.json()["results"][0]
+        self.assertEqual(row["label"], self.taxon.name)
+        self.assertEqual(len(row["features"]), EMBEDDING_DIMENSIONS)
+        self.assertIn(row["split"], ("train", "test"))
+
+    def test_features_can_be_left_out(self):
+        """Callers deciding whether a retrain is worth it should not pull megabytes."""
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {**self.params, "include_features": "false"})
+        self.assertEqual(response.status_code, 200)
+        self.assertNotIn("features", response.json()["results"][0])
+
+    def test_algorithm_is_required(self):
+        """Mixing backbones would produce a meaningless training set, so it cannot be omitted."""
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {"project_id": self.project.pk})
+        self.assertEqual(response.status_code, 400)
+
+    def test_unknown_algorithm_is_404(self):
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {**self.params, "algorithm": "does-not-exist"})
+        self.assertEqual(response.status_code, 404)
+
+    def test_project_is_required(self):
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {"algorithm": self.classifier.key})
+        self.assertEqual(response.status_code, 400)
+
+    def test_unverified_occurrences_are_not_returned(self):
+        self.client.force_authenticate(user=self.user)
+        Identification.objects.all().update(withdrawn=True)
+        response = self.client.get(self.url, self.params)
+        self.assertEqual(response.json()["count"], 0)
+
+    def test_summary_reports_counts_without_sending_vectors(self):
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.summary_url, self.params)
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertEqual(body["rows"], len(self.images))
+        self.assertEqual(body["counts"][self.taxon.name], len(self.images))
+        self.assertEqual(body["dimensions"], EMBEDDING_DIMENSIONS)
+        self.assertEqual(body["train"] + body["test"], len(self.images))
+        self.assertEqual(body["settings"]["split_grouped_by"], "occurrence")
+
+    def test_the_split_matches_the_export_command(self):
+        """The API and the export must not disagree about what is held out."""
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {**self.params, "include_features": "false"})
+        for row in response.json()["results"]:
+            self.assertEqual(row["split"], training_data.split_for(row["occurrence_id"]))
+
+
+class TestTrainableFlag(TestCase):
+    """A service declares which of its algorithms can be retrained; Antenna mirrors that."""
+
+    def test_trainable_is_mirrored_from_the_service_config(self):
+        config = ALGORITHM_CHOICES["random-species-classifier"].copy(update={"trainable": True})
+        algorithm = get_or_create_algorithm_and_category_map(config)
+        self.assertTrue(algorithm.trainable)
+
+    def test_algorithms_are_not_trainable_by_default(self):
+        algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-detector"])
+        self.assertFalse(algorithm.trainable)
+
+    def test_the_flag_follows_the_service_when_it_changes(self):
+        """A service that gains training support must not need its algorithm deleted."""
+        key = "random-species-classifier"
+        get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES[key])
+        updated = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES[key].copy(update={"trainable": True}))
+        self.assertTrue(updated.trainable)
+
+
+class TestTrainingDatasetAndJob(TestCase):
+    """
+    Antenna prepares the training set as a file and hands the service a URL to it.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Training Job Project")
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+        self.user = User.objects.create_user(email="trainjob@example.com", password="testpass123")
+
+        self.images = [
+            SourceImage.objects.create(path=f"tj{i}-2024010100{i:02d}00.jpg", project=self.project) for i in range(12)
+        ]
+        self.pipeline = Pipeline.objects.create(name="Training Job Pipeline")
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.classifier = self.algorithms["random-species-classifier"]
+        self.classifier.trainable = True
+        # Half in, half out. The held-out split is a hash of the occurrence id, so the
+        # default 0.2 can leave no rows on one side and make the build refuse.
+        self.classifier.training_config.test_fraction = 0.5
+        self.classifier.save()
+        self.pipeline.algorithms.set([self.algorithms["random-detector"], self.classifier])
+
+        detector = ALGORITHM_CHOICES["random-detector"]
+        classifier = ALGORITHM_CHOICES["random-species-classifier"]
+        assert classifier.category_map
+        save_results(
+            PipelineResultsResponse(
+                pipeline=self.pipeline.slug,
+                total_time=0.01,
+                source_images=[SourceImageResponse(id=i.pk, url=i.path) for i in self.images],
+                detections=[
+                    DetectionResponse(
+                        source_image_id=image.pk,
+                        bbox=BoundingBox(x1=0.0, y1=0.0, x2=1.0, y2=1.0),
+                        algorithm=AlgorithmReference(name=detector.name, key=detector.key),
+                        timestamp=datetime.datetime.now(),
+                        classifications=[
+                            ClassificationResponse(
+                                classification=classifier.category_map.labels[0],
+                                labels=classifier.category_map.labels,
+                                scores=[0.5],
+                                features=[float(i)] * EMBEDDING_DIMENSIONS,
+                                algorithm=AlgorithmReference(name=classifier.name, key=classifier.key),
+                                timestamp=datetime.datetime.now(),
+                                terminal=True,
+                            )
+                        ],
+                    )
+                    for i, image in enumerate(self.images)
+                ],
+            )
+        )
+        self.taxa = [
+            Taxon.objects.create(name="Datasetus unus", rank=TaxonRank.SPECIES.name),
+            Taxon.objects.create(name="Datasetus duo", rank=TaxonRank.SPECIES.name),
+        ]
+
+    def _verify_all(self):
+        for i, occurrence in enumerate(Occurrence.objects.filter(project=self.project).order_by("pk")):
+            Identification.objects.create(occurrence=occurrence, taxon=self.taxa[i % 2], user=self.user)
+
+    def test_dataset_holds_the_embeddings_and_the_human_labels(self):
+        from ami.ml.training_dataset import build_training_dataset
+
+        self._verify_all()
+        result = build_training_dataset(
+            project=self.project, algorithm=self.classifier, min_per_species=1, test_fraction=0.5
+        )
+
+        with default_storage.open(result["path"], "rb") as f:
+            archive = np.load(f, allow_pickle=True)
+            features = archive["features"]
+            classes = [str(c) for c in archive["classes"]]
+            metadata = json.loads(str(archive["metadata"]))
+
+        self.assertEqual(features.shape, (len(self.images), EMBEDDING_DIMENSIONS))
+        self.assertEqual(sorted(classes), sorted(t.name for t in self.taxa))
+        self.assertEqual(metadata["rows"], len(self.images))
+        self.assertEqual(metadata["train"] + metadata["test"], len(self.images))
+        default_storage.delete(result["path"])
+
+    def test_vectors_are_stored_as_float16(self):
+        """float16 is what Postgres holds, so anything wider ships bytes that carry nothing."""
+        from ami.ml.training_dataset import build_training_dataset
+
+        self._verify_all()
+        result = build_training_dataset(
+            project=self.project, algorithm=self.classifier, min_per_species=1, test_fraction=0.5
+        )
+        with default_storage.open(result["path"], "rb") as f:
+            self.assertEqual(np.load(f, allow_pickle=True)["features"].dtype, np.float16)
+        default_storage.delete(result["path"])
+
+    def test_the_dataset_names_the_url_it_was_written_to(self):
+        """
+        The version a retrain produces has to name the exact set it was fitted on.
+
+        The service echoes this metadata back in its result, and that is where
+        ``Algorithm.training_info.dataset_url`` comes from, so a missing url leaves every
+        retrained version with no record of its training data.
+        """
+        from ami.ml.training_dataset import build_training_dataset
+
+        self._verify_all()
+        result = build_training_dataset(
+            project=self.project, algorithm=self.classifier, min_per_species=1, test_fraction=0.5
+        )
+
+        with default_storage.open(result["path"], "rb") as f:
+            metadata = json.loads(str(np.load(f, allow_pickle=True)["metadata"]))
+
+        self.assertEqual(metadata["url"], result["url"])
+        self.assertIn(result["path"], metadata["url"])
+        default_storage.delete(result["path"])
+
+    def test_nothing_verified_means_no_file_is_written(self):
+        from ami.ml.training_dataset import NotEnoughVerifiedData, build_training_dataset
+
+        with self.assertRaises(NotEnoughVerifiedData):
+            build_training_dataset(project=self.project, algorithm=self.classifier)
+
+    def test_the_job_fails_cleanly_when_there_is_nothing_to_train_on(self):
+        """A data problem should read as a message, not a traceback."""
+        from ami.jobs.models import Job, JobState, TrainClassifierJob
+
+        job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.classifier.key},
+        )
+        job.run()
+        job.refresh_from_db()
+        self.assertEqual(job.status, JobState.FAILURE.name)
+        self.assertIn("error", job.result)
+
+    def test_the_job_refuses_an_algorithm_the_service_cannot_train(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self._verify_all()
+        job = Job.objects.create(
+            project=self.project,
+            name="Retrain a detector",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.algorithms["random-detector"].key},
+        )
+        with self.assertRaises(ValueError):
+            job.run()
+
+    def test_the_job_refuses_when_only_a_pull_worker_serves_the_algorithm(self):
+        """Antenna cannot POST to a worker with no endpoint, so it must say so, not hang."""
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self._verify_all()
+        self.project.processing_services.clear()
+        worker = ProcessingService.objects.create(name="Pull worker", endpoint_url=None)
+        worker.projects.add(self.project)
+        worker.pipelines.add(self.pipeline)
+
+        job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.classifier.key, "min_per_species": 1},
+        )
+        with self.assertRaises(ValueError) as ctx:
+            job.run()
+        self.assertIn("pull-mode", str(ctx.exception).lower())
+
+
+class TestAbsoluteMediaURL(TestCase):
+    def test_an_absolute_url_is_left_alone(self):
+        """In production MEDIA_URL is already an S3 URL."""
+        from ami.ml.training_dispatch import absolute_media_url
+
+        url = "https://bucket.s3.amazonaws.com/uploads/training/set.npz"
+        self.assertEqual(absolute_media_url(url), url)
+
+    def test_a_relative_path_gets_a_base(self):
+        from ami.ml.training_dispatch import absolute_media_url
+
+        self.assertEqual(
+            absolute_media_url("/media/training/set.npz", "http://antenna:8000"),
+            "http://antenna:8000/media/training/set.npz",
+        )
+
+
+class TestTheCallbackTargetIsNotClientSupplied(TestCase):
+    """
+    Where the service reports back is Antenna's to decide, not the request body's.
+
+    A job's params are free JSON and any member who can create a job may set them, so a
+    params-supplied callback would send the signed token to a host of their choosing. That
+    token also unlocks the head upload, which writes into Antenna's own storage.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+        from ami.ml.models.processing_service import ProcessingService
+
+        self.project = Project.objects.create(name="Callback Target Project")
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.service = ProcessingService.objects.create(name="Somewhere", endpoint_url="http://service.example")
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={
+                "algorithm_key": self.algorithm.key,
+                "callback_url": "http://attacker.example/collect",
+                "media_base_url": "http://attacker.example",
+            },
+        )
+
+    def _dispatch(self) -> dict:
+        """Send a training request and return the payload the service would have seen."""
+        from unittest import mock
+
+        from ami.ml import training_dispatch
+
+        sent = {}
+
+        class Reply:
+            ok = True
+
+            def json(self):
+                return {}
+
+        class Session:
+            def post(self, endpoint, json=None, timeout=None):
+                sent.update(json or {})
+                return Reply()
+
+        with mock.patch.object(training_dispatch, "create_session", return_value=Session()):
+            training_dispatch.send_training_request(
+                job=self.job,
+                service=self.service,
+                algorithm=self.algorithm,
+                dataset={"url": "/media/training/set.npz", "path": "training/set.npz"},
+            )
+        return sent
+
+    def test_a_callback_url_in_the_params_is_ignored(self):
+        payload = self._dispatch()
+
+        self.assertNotIn("attacker.example", payload["callback_url"])
+        self.assertIn(f"/jobs/{self.job.pk}/training-result/", payload["callback_url"])
+
+    def test_a_head_upload_url_in_the_params_is_ignored(self):
+        payload = self._dispatch()
+
+        self.assertNotIn("attacker.example", payload["head_upload_url"])
+        self.assertIn(f"/jobs/{self.job.pk}/training-head/", payload["head_upload_url"])
+
+    def test_the_dataset_url_is_not_taken_from_the_params_either(self):
+        """It is only a download, but it is still the request body choosing a host."""
+        payload = self._dispatch()
+
+        self.assertNotIn("attacker.example", payload["dataset_url"])
+
+
+class TestGenerateEmbeddingsJob(TestCase):
+    """
+    The job that fills in embeddings for verified crops, so a head can be retrained
+    without running the backbone over the same image twice.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Embedding Job Project")
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+        self.user = User.objects.create_user(email="embedder@example.com", password="testpass123")
+        self.images = [
+            SourceImage.objects.create(path=f"ej{i}-2024010100{i:02d}00.jpg", project=self.project) for i in range(3)
+        ]
+        self.pipeline = Pipeline.objects.create(name="Embedding Job Pipeline")
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.classifier = self.algorithms["random-species-classifier"]
+        self.classifier.trainable = True
+        self.classifier.save()
+        self.detector = self.algorithms["random-detector"]
+        self.pipeline.algorithms.set([self.detector, self.classifier])
+        self.taxon = Taxon.objects.create(name="Embeddicus testus", rank=TaxonRank.SPECIES.name)
+
+    def _job(self, **params):
+        from ami.jobs.models import GenerateEmbeddingsJob, Job
+
+        return Job.objects.create(
+            project=self.project,
+            name="Generate embeddings",
+            job_type_key=GenerateEmbeddingsJob.key,
+            pipeline=self.pipeline,
+            params=params or None,
+        )
+
+    def _detections_with_occurrences(self, verified: bool):
+        for image in self.images:
+            detection = Detection.objects.create(
+                source_image=image, bbox=[0, 0, 10, 10], detection_algorithm=self.detector
+            )
+            occurrence = detection.associate_new_occurrence()
+            if verified:
+                Identification.objects.create(occurrence=occurrence, taxon=self.taxon, user=self.user)
+
+    def test_it_refuses_when_the_project_would_discard_the_result(self):
+        """Running the backbone to throw the vectors away is pure waste."""
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        self.project.feature_flags.store_classification_embeddings = False
+        self.project.save()
+        with self.assertRaises(ValueError) as ctx:
+            GenerateEmbeddingsJob.run(self._job())
+        self.assertIn("store_classification_embeddings", str(ctx.exception))
+
+    def test_it_refuses_a_pipeline_with_no_trainable_algorithm(self):
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        self.classifier.trainable = False
+        self.classifier.save()
+        with self.assertRaises(ValueError) as ctx:
+            GenerateEmbeddingsJob.run(self._job())
+        self.assertIn("trainable", str(ctx.exception))
+
+    def test_it_targets_the_trainable_algorithm(self):
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        self.assertEqual(GenerateEmbeddingsJob.target_algorithm(self._job()), self.classifier)
+
+    def test_an_unknown_algorithm_key_is_rejected(self):
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        with self.assertRaises(ValueError):
+            GenerateEmbeddingsJob.target_algorithm(self._job(algorithm_key="not-on-this-pipeline"))
+
+    def test_only_verified_detections_are_collected(self):
+        """Embedding everything would cost gigabytes; only a labelled crop can train a head."""
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        self._detections_with_occurrences(verified=False)
+        job = self._job()
+        self.assertEqual(GenerateEmbeddingsJob.images_needing_embeddings(job, self.classifier), [])
+
+        self._detections_with_occurrences(verified=True)
+        images = GenerateEmbeddingsJob.images_needing_embeddings(job, self.classifier)
+        self.assertEqual(len(images), len(self.images))
+
+    def test_detections_that_already_have_an_embedding_are_skipped(self):
+        """The whole point is not to compute the same vector twice."""
+        from ami.jobs.models import GenerateEmbeddingsJob
+
+        self._detections_with_occurrences(verified=True)
+        job = self._job()
+        for detection in Detection.objects.filter(source_image__project=self.project):
+            DetectionEmbedding.objects.create(
+                detection=detection, algorithm=self.classifier, vector=[0.1] * EMBEDDING_DIMENSIONS
+            )
+        self.assertEqual(GenerateEmbeddingsJob.images_needing_embeddings(job, self.classifier), [])
+
+    def test_nothing_to_do_finishes_successfully(self):
+        from ami.jobs.models import GenerateEmbeddingsJob, JobState
+
+        job = self._job()
+        GenerateEmbeddingsJob.run(job)
+        job.refresh_from_db()
+        self.assertEqual(job.status, JobState.SUCCESS.name)
+
+
+class TestAlgorithmVersioning(TestCase):
+    """
+    Every retrain produces a new algorithm version, so a prediction can always be traced
+    back to the exact weights that made it.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self.project = Project.objects.create(name="Versioning Project")
+        self.parent = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.parent.trainable = True
+        self.parent.save()
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.parent.key},
+        )
+        self.payload = {
+            "result": {
+                "labels": ["Alpha one", "Beta two", "Gamma three"],
+                "rows": {"total": 30, "kept": 30, "train": 24, "test": 6},
+                "candidate_metrics": {"top1": 0.9, "macro_recall": 0.88, "n": 6},
+                "incumbent_metrics": {"top1": 0.7, "n": 6},
+                "trained_at": "2026-09-03T21:08:03",
+                "warnings": ["only 6 held-out rows"],
+                "promote": True,
+            },
+            "dataset": {"rows": 30},
+            "dataset_url": "/media/training/set-job-1.npz",
+        }
+
+    def _register(self):
+        from ami.jobs.models import TrainClassifierJob
+
+        return TrainClassifierJob.register_new_version(job=self.job, payload=self.payload)
+
+    def test_a_retrain_creates_a_new_row_not_an_edit(self):
+        """A Classification points at an Algorithm row, so a version must never change in place."""
+        before = Algorithm.objects.count()
+        new = self._register()
+        assert new
+        self.assertEqual(Algorithm.objects.count(), before + 1)
+        self.assertNotEqual(new.pk, self.parent.pk)
+        self.parent.refresh_from_db()
+        self.assertEqual(self.parent.version, 1)
+
+    def test_the_new_version_keeps_the_name_and_bumps_the_number(self):
+        new = self._register()
+        assert new
+        self.assertEqual(new.name, self.parent.name)
+        self.assertEqual(new.version, self.parent.version + 1)
+        self.assertNotEqual(new.key, self.parent.key)
+
+    def test_versions_keep_incrementing(self):
+        first = self._register()
+        second = self._register()
+        assert first and second
+        self.assertEqual(second.version, first.version + 1)
+
+    def test_provenance_is_recorded(self):
+        new = self._register()
+        assert new
+        info = new.training_info
+        self.assertEqual(info.dataset_url, "/media/training/set-job-1.npz")
+        self.assertEqual(info.dataset_classes, 3)
+        self.assertEqual(info.dataset_rows, 30)
+        self.assertEqual(info.metrics["top1"], 0.9)
+        self.assertEqual(info.previous_metrics["top1"], 0.7)
+        self.assertEqual(info.parent_algorithm_key, self.parent.key)
+        self.assertEqual(info.job_id, self.job.pk)
+        self.assertEqual(info.warnings, ["only 6 held-out rows"])
+
+    def test_the_new_version_carries_its_own_class_list(self):
+        """The retrained head predicts a different set of species than its parent."""
+        new = self._register()
+        assert new
+        assert new.category_map
+        self.assertEqual(new.category_map.labels, ["Alpha one", "Beta two", "Gamma three"])
+        self.assertNotEqual(new.category_map_id, self.parent.category_map_id)
+
+    def test_no_class_list_means_no_version(self):
+        """Registering a head that cannot say what it predicts would be untraceable."""
+        self.payload["result"]["labels"] = []
+        self.assertIsNone(self._register())
+
+    def test_an_unknown_parent_means_no_version(self):
+        self.job.params = {"algorithm_key": "does-not-exist"}
+        self.job.save()
+        self.assertIsNone(self._register())
+
+
+class TestAlgorithmTrainingConfig(TestCase):
+    """Settings are seeded from the service once, then owned by Antenna."""
+
+    def test_config_is_seeded_from_the_service(self):
+        from ami.ml.schemas import AlgorithmTrainingConfig
+
+        # A key nothing else registers, so this exercises the create path rather than
+        # finding an algorithm some other fixture already made.
+        config = ALGORITHM_CHOICES["random-species-classifier"].copy(
+            update={
+                # Unique name as well as key: Algorithm is unique on (name, version) too.
+                "name": "Seeded Config Classifier",
+                "key": "seeded-config-classifier",
+                "training_config": AlgorithmTrainingConfig(head_type="mlp1", epochs=50),
+            }
+        )
+        algorithm = get_or_create_algorithm_and_category_map(config)
+        self.assertEqual(algorithm.training_config.head_type, "mlp1")
+        self.assertEqual(algorithm.training_config.epochs, 50)
+
+    def test_re_registering_does_not_overwrite_an_edited_config(self):
+        """An admin who tunes these must not have them reset on the next /info read."""
+        from ami.ml.schemas import AlgorithmTrainingConfig
+
+        base = ALGORITHM_CHOICES["random-species-classifier"].copy(
+            update={"name": "Edited Config Classifier", "key": "edited-config-classifier"}
+        )
+        algorithm = get_or_create_algorithm_and_category_map(base)
+        algorithm.training_config = AlgorithmTrainingConfig(head_type="mlp1", epochs=999)
+        algorithm.save()
+
+        again = get_or_create_algorithm_and_category_map(
+            base.copy(update={"training_config": AlgorithmTrainingConfig(epochs=300)})
+        )
+        self.assertEqual(again.training_config.epochs, 999)
+
+    def test_defaults_exist_without_the_service_sending_any(self):
+        algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-detector"])
+        self.assertEqual(algorithm.training_config.min_per_species, 2)
+        self.assertEqual(algorithm.training_info.trained_at, None)
+
+
+class TestTrainingSetMembership(TestCase):
+    """
+    Which occurrences a training run consumed, so an evaluation set can avoid them.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self.project = Project.objects.create(name="Training Set Membership Project")
+        self.user = User.objects.create_user(email="membership@example.com", password="testpass123")
+        self.taxon = Taxon.objects.create(name="Memberus testus", rank=TaxonRank.SPECIES.name)
+        self.images = [
+            SourceImage.objects.create(path=f"tsm{i}-2024010100{i:02d}00.jpg", project=self.project) for i in range(4)
+        ]
+        self.occurrences = []
+        for image in self.images:
+            detection = Detection.objects.create(source_image=image, bbox=[0, 0, 10, 10])
+            occurrence = detection.associate_new_occurrence()
+            Identification.objects.create(occurrence=occurrence, taxon=self.taxon, user=self.user)
+            self.occurrences.append(occurrence)
+
+        self.job = Job.objects.create(project=self.project, name="Retrain", job_type_key=TrainClassifierJob.key)
+
+    def test_recording_writes_one_row_per_occurrence(self):
+        from ami.ml.models.training_set import TrainingSetMembership, record_training_set
+
+        record_training_set([o.pk for o in self.occurrences], job=self.job)
+        self.assertEqual(TrainingSetMembership.objects.filter(job=self.job).count(), len(self.occurrences))
+
+    def test_recording_twice_does_not_duplicate(self):
+        """A retried job must not double-count what it consumed."""
+        from ami.ml.models.training_set import TrainingSetMembership, record_training_set
+
+        ids = [o.pk for o in self.occurrences]
+        record_training_set(ids, job=self.job)
+        record_training_set(ids, job=self.job)
+        self.assertEqual(TrainingSetMembership.objects.filter(job=self.job).count(), len(ids))
+
+    def test_the_version_is_attached_after_training(self):
+        """The version does not exist while the set is built, so it is linked afterwards."""
+        from ami.ml.models.training_set import TrainingSetMembership, attach_algorithm, record_training_set
+
+        algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        record_training_set([o.pk for o in self.occurrences], job=self.job)
+        self.assertEqual(TrainingSetMembership.objects.filter(algorithm__isnull=True).count(), len(self.occurrences))
+
+        linked = attach_algorithm(job=self.job, algorithm=algorithm)
+        self.assertEqual(linked, len(self.occurrences))
+        self.assertEqual(TrainingSetMembership.objects.filter(algorithm=algorithm).count(), len(self.occurrences))
+
+    def test_used_occurrences_are_excluded_from_the_evaluation_pool(self):
+        """Scoring a model on what it learned from reports a number that means nothing."""
+        from ami.ml.models.training_set import occurrences_safe_to_evaluate_on, record_training_set
+
+        pool = occurrences_safe_to_evaluate_on(self.project)
+        self.assertEqual(pool.count(), len(self.occurrences))
+
+        record_training_set([self.occurrences[0].pk, self.occurrences[1].pk], job=self.job)
+        pool = occurrences_safe_to_evaluate_on(self.project)
+        self.assertEqual(pool.count(), len(self.occurrences) - 2)
+        self.assertNotIn(self.occurrences[0], pool)
+
+    def test_an_unverified_occurrence_is_not_in_the_pool(self):
+        from ami.ml.models.training_set import occurrences_safe_to_evaluate_on
+
+        image = SourceImage.objects.create(path="tsm-extra-20240101010000.jpg", project=self.project)
+        detection = Detection.objects.create(source_image=image, bbox=[0, 0, 10, 10])
+        unverified = detection.associate_new_occurrence()
+
+        self.assertNotIn(unverified, occurrences_safe_to_evaluate_on(self.project))
+
+
+class TestTaxaListDecidesTheClassList(TestCase):
+    """
+    A project's taxa list sets which species a retrained head can predict. The verified
+    crops only decide how well it predicts each one.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Taxa List Training Project")
+        self.project.feature_flags.store_classification_embeddings = True
+        self.project.save()
+        self.user = User.objects.create_user(email="taxalist@example.com", password="testpass123")
+
+        self.algorithms = {
+            key: get_or_create_algorithm_and_category_map(val) for key, val in ALGORITHM_CHOICES.items()
+        }
+        self.classifier = self.algorithms["random-species-classifier"]
+        self.classifier.trainable = True
+        self.classifier.save()
+        self.pipeline = Pipeline.objects.create(name="Taxa List Pipeline")
+        self.pipeline.algorithms.set([self.algorithms["random-detector"], self.classifier])
+
+        self.verified_taxa = [
+            Taxon.objects.create(name=f"Verifiedus {n}", rank=TaxonRank.SPECIES.name) for n in ("alpha", "beta")
+        ]
+        self.unverified_taxa = [
+            Taxon.objects.create(name=f"Unverifiedus {n}", rank=TaxonRank.SPECIES.name) for n in ("gamma", "delta")
+        ]
+
+        # Twenty crops, split between the two verified species, each with an embedding.
+        # The held-out split is a hash of the occurrence id, so a small set can land
+        # entirely on one side and make the build refuse. Twenty makes that vanishingly rare.
+        self.images = [
+            SourceImage.objects.create(path=f"tl{i}-2024010100{i:02d}00.jpg", project=self.project) for i in range(20)
+        ]
+        for i, image in enumerate(self.images):
+            detection = Detection.objects.create(source_image=image, bbox=[0, 0, 10, 10])
+            occurrence = detection.associate_new_occurrence()
+            Identification.objects.create(occurrence=occurrence, taxon=self.verified_taxa[i % 2], user=self.user)
+            DetectionEmbedding.objects.create(
+                detection=detection, algorithm=self.classifier, vector=[float(i)] * EMBEDDING_DIMENSIONS
+            )
+
+    def _taxa_list(self, taxa):
+        taxa_list, _ = TaxaList.objects.get_or_create_for_project(name="Region list", project=self.project)
+        taxa_list.taxa.set(taxa)
+        return taxa_list
+
+    def _build(self, **kwargs):
+        from ami.ml.training_dataset import build_training_dataset
+
+        return build_training_dataset(project=self.project, algorithm=self.classifier, test_fraction=0.5, **kwargs)
+
+    def test_without_a_taxa_list_the_classes_come_from_what_was_verified(self):
+        result = self._build(min_per_species=1)
+        self.assertEqual(sorted(result["metadata"]["classes"]), sorted(t.name for t in self.verified_taxa))
+        self.assertIsNone(result["metadata"]["taxa_list"])
+        default_storage.delete(result["path"])
+
+    def test_the_taxa_list_sets_the_classes(self):
+        """This is what stops a head shrinking to whatever someone happened to verify."""
+        taxa_list = self._taxa_list(self.verified_taxa + self.unverified_taxa)
+        result = self._build(taxa_list=taxa_list, min_per_species=1)
+
+        meta = result["metadata"]
+        self.assertEqual(len(meta["classes"]), 4)
+        self.assertEqual(meta["taxa_list"]["name"], taxa_list.name)
+        default_storage.delete(result["path"])
+
+    def test_species_in_the_list_with_no_crops_are_kept_and_reported(self):
+        taxa_list = self._taxa_list(self.verified_taxa + self.unverified_taxa)
+        result = self._build(taxa_list=taxa_list, min_per_species=1)
+
+        meta = result["metadata"]
+        self.assertEqual(sorted(meta["classes_without_verified_data"]), sorted(t.name for t in self.unverified_taxa))
+        for taxon in self.unverified_taxa:
+            self.assertEqual(meta["counts"][taxon.name], 0)
+        default_storage.delete(result["path"])
+
+    def test_verified_species_outside_the_list_are_dropped_and_reported(self):
+        taxa_list = self._taxa_list([self.verified_taxa[0]] + self.unverified_taxa)
+        result = self._build(taxa_list=taxa_list, min_per_species=1)
+
+        meta = result["metadata"]
+        self.assertIn(self.verified_taxa[1].name, meta["dropped_species"])
+        self.assertNotIn(self.verified_taxa[1].name, meta["classes"])
+        default_storage.delete(result["path"])
+
+    def test_the_project_default_is_used_when_none_is_passed(self):
+        taxa_list = self._taxa_list(self.verified_taxa + self.unverified_taxa)
+        self.project.default_taxa_list = taxa_list
+        self.project.save()
+
+        result = self._build(min_per_species=1)
+        self.assertEqual(len(result["metadata"]["classes"]), 4)
+        default_storage.delete(result["path"])
+
+    def test_an_empty_taxa_list_is_refused(self):
+        from ami.ml.training_dataset import NotEnoughVerifiedData
+
+        with self.assertRaises(NotEnoughVerifiedData):
+            self._build(taxa_list=self._taxa_list([]), min_per_species=1)
+
+    def test_the_job_prefers_its_own_taxa_list_over_the_project_default(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        project_default = self._taxa_list(self.verified_taxa)
+        self.project.default_taxa_list = project_default
+        self.project.save()
+
+        chosen, _ = TaxaList.objects.get_or_create_for_project(name="Chosen list", project=self.project)
+        chosen.taxa.set(self.unverified_taxa)
+
+        job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.classifier.key, "taxa_list_id": chosen.pk},
+        )
+        self.assertEqual(TrainClassifierJob.target_taxa_list(job), chosen)
+
+    def test_an_unknown_taxa_list_id_is_refused(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.classifier.key, "taxa_list_id": 999999},
+        )
+        with self.assertRaises(ValueError):
+            TrainClassifierJob.target_taxa_list(job)
+
+
+class TestTrainingCallback(APITestCase):
+    """
+    Training can outlast the request that started it, so the service reports back to a
+    callback instead of holding the connection open.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self.project = Project.objects.create(name="Callback Project")
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.algorithm.trainable = True
+        self.algorithm.save()
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.algorithm.key, "media_base_url": "http://antenna:8000"},
+        )
+        self.url = f"/api/v2/jobs/{self.job.pk}/training-result/"
+        self.payload = {
+            "result": {
+                "labels": ["Alpha one", "Beta two"],
+                "rows": {"total": 10, "kept": 10, "train": 8, "test": 2},
+                "candidate_metrics": {"top1": 0.9, "n": 2},
+                "incumbent_metrics": {"top1": 0.5, "n": 2},
+                "trained_at": "2026-09-13T15:00:00",
+                "warnings": [],
+                "promote": True,
+            },
+            "dataset": {"rows": 10},
+            "dataset_url": "/media/training/x.npz",
+        }
+
+    def _token(self):
+        from ami.ml.training_dispatch import make_callback_token
+
+        return make_callback_token(self.job)
+
+    def _post(self, token=None):
+        headers = {"HTTP_AUTHORIZATION": f"Token {token}"} if token else {}
+        return self.client.post(self.url, self.payload, format="json", **headers)
+
+    def test_a_valid_token_records_the_result(self):
+        from ami.jobs.models import JobState
+
+        response = self._post(self._token())
+        self.assertEqual(response.status_code, 200)
+        self.job.refresh_from_db()
+        self.assertEqual(self.job.status, JobState.SUCCESS.name)
+        self.assertEqual(self.job.result["result"]["candidate_metrics"]["top1"], 0.9)
+
+    def test_no_token_is_refused(self):
+        """The service has no Antenna account, so the token is the only thing authorising it."""
+        self.assertEqual(self._post().status_code, 403)
+
+    def test_a_forged_token_is_refused(self):
+        self.assertEqual(self._post("not-a-real-token").status_code, 403)
+
+    def test_another_jobs_token_is_refused(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+        from ami.ml.training_dispatch import make_callback_token
+
+        other = Job.objects.create(project=self.project, name="Other", job_type_key=TrainClassifierJob.key)
+        self.assertEqual(self._post(make_callback_token(other)).status_code, 403)
+
+    def test_a_second_result_does_not_overwrite_the_first(self):
+        """A retry or a late answer must not undo what already landed."""
+        self._post(self._token())
+        self.payload["result"]["candidate_metrics"]["top1"] = 0.1
+        response = self._post(self._token())
+
+        self.assertEqual(response.status_code, 200)
+        self.job.refresh_from_db()
+        self.assertEqual(self.job.result["result"]["candidate_metrics"]["top1"], 0.9)
+
+    def test_a_result_for_a_non_training_job_is_refused(self):
+        from ami.jobs.models import Job, MLJob
+        from ami.ml.training_dispatch import make_callback_token
+
+        other = Job.objects.create(project=self.project, name="ML", job_type_key=MLJob.key)
+        response = self.client.post(
+            f"/api/v2/jobs/{other.pk}/training-result/",
+            self.payload,
+            format="json",
+            headers={"authorization": f"Token {make_callback_token(other)}"},
+        )
+        self.assertEqual(response.status_code, 400)
+
+    def test_the_callback_url_points_at_this_job(self):
+        """
+        Built from the configured base, not from the job's params.
+
+        This job carries a media_base_url in its params, left over from when that could
+        override the callback target. It must have no effect: the params are client input
+        and this URL receives the signed token.
+        """
+        from django.conf import settings
+
+        from ami.ml.training_dispatch import callback_url_for
+
+        expected = f"{settings.EXTERNAL_BASE_URL.rstrip('/')}/api/v2/jobs/{self.job.pk}/training-result/"
+        self.assertEqual(callback_url_for(self.job), expected)
+        self.assertNotIn("antenna:8000", callback_url_for(self.job))
+
+
+class TestAlgorithmUriIsNotErasedByInfo(TestCase):
+    """
+    Reading /info must not wipe the location of a head Antenna stored itself.
+
+    A retrained head's weights are uploaded to Antenna, and the service reports no uri for
+    it, so overwriting the field unconditionally left the only record of where the weights
+    are pointing nowhere. Caught end to end, not by a unit test: the sync runs after
+    training, when the service registers the head as a new pipeline.
+    """
+
+    def _config(self, key: str, uri: str | None):
+        from ami.ml.schemas import AlgorithmCategoryMapResponse, AlgorithmConfigResponse
+
+        return AlgorithmConfigResponse(
+            name=key,
+            key=key,
+            version=1,
+            uri=uri,
+            category_map=AlgorithmCategoryMapResponse(data=[], labels=[], version="v1", uri=None),
+        )
+
+    def test_a_service_reporting_no_uri_leaves_a_stored_one_alone(self):
+        algorithm = get_or_create_algorithm_and_category_map(self._config("kept-uri", uri=None))
+        algorithm.uri = "/media/algorithms/kept-uri/head.npz"
+        algorithm.save()
+
+        get_or_create_algorithm_and_category_map(self._config("kept-uri", uri=None))
+
+        algorithm.refresh_from_db()
+        self.assertEqual(algorithm.uri, "/media/algorithms/kept-uri/head.npz")
+
+    def test_a_service_that_names_a_uri_still_wins(self):
+        """A published head's location is the service's to report, and may move."""
+        algorithm = get_or_create_algorithm_and_category_map(self._config("moved-uri", uri="https://hub/old"))
+
+        get_or_create_algorithm_and_category_map(self._config("moved-uri", uri="https://hub/new"))
+
+        algorithm.refresh_from_db()
+        self.assertEqual(algorithm.uri, "https://hub/new")
+
+
+class TestTrainingHeadUpload(APITestCase):
+    """
+    A retrained head is uploaded here so Antenna keeps a copy of the weights.
+
+    Without it the head lives only on the service's disk, under a cache directory, and a
+    rebuild loses it while Antenna still reports the version as existing.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self.project = Project.objects.create(name="Head Upload Project")
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.algorithm.key, "media_base_url": "http://antenna:8000"},
+        )
+        self.url = f"/api/v2/jobs/{self.job.pk}/training-head/"
+        self.stored_paths: list[str] = []
+
+    def tearDown(self):
+        for path in self.stored_paths:
+            if default_storage.exists(path):
+                default_storage.delete(path)
+
+    def _token(self):
+        from ami.ml.training_dispatch import make_callback_token
+
+        return make_callback_token(self.job)
+
+    def _files(self, head=b"weights", labels=b'{"labels": []}'):
+        return {
+            "head": SimpleUploadedFile("head.npz", head),
+            "labels": SimpleUploadedFile("head.label_map.json", labels),
+        }
+
+    def _post(self, token=None, files=None):
+        headers = {"HTTP_AUTHORIZATION": f"Token {token}"} if token else {}
+        response = self.client.post(self.url, files if files is not None else self._files(), **headers)
+        if response.status_code == 200:
+            self.stored_paths += [item["path"] for item in response.json()["files"].values()]
+        return response
+
+    def test_a_valid_token_stores_the_head(self):
+        response = self._post(self._token())
+
+        self.assertEqual(response.status_code, 200)
+        stored = response.json()["files"]
+        self.assertEqual(sorted(stored), ["head", "labels"])
+        for item in stored.values():
+            self.assertTrue(default_storage.exists(item["path"]), item["path"])
+
+    def test_the_stored_head_holds_what_was_uploaded(self):
+        response = self._post(self._token(), files=self._files(head=b"the real weights"))
+
+        path = response.json()["files"]["head"]["path"]
+        with default_storage.open(path, "rb") as f:
+            self.assertEqual(f.read(), b"the real weights")
+
+    def test_no_token_is_refused(self):
+        self.assertEqual(self._post().status_code, 403)
+
+    def test_a_forged_token_is_refused(self):
+        self.assertEqual(self._post("not-a-real-token").status_code, 403)
+
+    def test_another_jobs_token_is_refused(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+        from ami.ml.training_dispatch import make_callback_token
+
+        other = Job.objects.create(project=self.project, name="Other", job_type_key=TrainClassifierJob.key)
+        self.assertEqual(self._post(make_callback_token(other)).status_code, 403)
+
+    def test_an_upload_for_a_non_training_job_is_refused(self):
+        from ami.jobs.models import Job, MLJob
+        from ami.ml.training_dispatch import make_callback_token
+
+        other = Job.objects.create(project=self.project, name="ML", job_type_key=MLJob.key)
+        response = self.client.post(
+            f"/api/v2/jobs/{other.pk}/training-head/",
+            self._files(),
+            headers={"authorization": f"Token {make_callback_token(other)}"},
+        )
+        self.assertEqual(response.status_code, 400)
+
+    def test_an_upload_with_no_files_is_refused(self):
+        self.assertEqual(self._post(self._token(), files={}).status_code, 400)
+
+    def test_a_head_cannot_be_uploaded_once_the_job_has_finished(self):
+        """
+        The callback token stays valid for 24 hours and the head is stored at a path fixed
+        by the job, so without this the weights a registered version points at could be
+        replaced for a day after the run ended. The result callback beside it already
+        refuses a finished job; this is the same guard.
+        """
+        from ami.jobs.models import JobState
+
+        self.job.status = JobState.SUCCESS.value
+        self.job.save()
+
+        response = self._post(self._token())
+
+        self.assertEqual(response.status_code, 400)
+
+    def test_a_head_is_still_accepted_while_the_job_is_running(self):
+        """A service uploads before it reports, so a normal run is unaffected."""
+        from ami.jobs.models import JobState
+
+        self.job.status = JobState.STARTED.value
+        self.job.save()
+
+        self.assertEqual(self._post(self._token()).status_code, 200)
+
+    def test_an_oversized_head_is_refused(self):
+        """The cap is well clear of a real head; it stops a wrong upload filling the bucket."""
+        from ami.ml.trained_head import MAX_HEAD_BYTES
+
+        oversized = {"head": SimpleUploadedFile("head.npz", b"x" * (MAX_HEAD_BYTES + 1))}
+
+        self.assertEqual(self._post(self._token(), files=oversized).status_code, 400)
+
+    def test_re_running_the_same_job_replaces_its_head(self):
+        """A retry must not leave a second copy behind."""
+        first = self._post(self._token()).json()["files"]["head"]["path"]
+        second = self._post(self._token(), files=self._files(head=b"second run")).json()["files"]["head"]["path"]
+
+        self.assertEqual(first, second)
+        with default_storage.open(second, "rb") as f:
+            self.assertEqual(f.read(), b"second run")
+
+
+class TestTrainingDataPermissions(APITestCase):
+    """
+    Verified labels are project data, so reading them needs membership of that project,
+    not merely an account.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Permissions Project")
+        self.member = User.objects.create_user(email="member@example.com", password="testpass123")
+        self.outsider = User.objects.create_user(email="outsider@example.com", password="testpass123")
+        self.superuser = User.objects.create_superuser(email="super@example.com", password="testpass123")
+        self.project.members.add(self.member)
+
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.url = reverse_with_params("api:training-data-list")
+        self.params = {"project_id": self.project.pk, "algorithm": self.algorithm.key}
+
+    def _status_for(self, user):
+        self.client.force_authenticate(user=user)
+        return self.client.get(self.url, self.params).status_code
+
+    def test_a_member_can_read_the_training_data(self):
+        self.assertEqual(self._status_for(self.member), 200)
+
+    def test_a_superuser_can_read_the_training_data(self):
+        self.assertEqual(self._status_for(self.superuser), 200)
+
+    def test_anonymous_cannot(self):
+        self.client.force_authenticate(user=None)
+        self.assertIn(self.client.get(self.url, self.params).status_code, (401, 403))
+
+    def test_an_outsider_can_read_a_public_project(self):
+        """Antenna publishes non-draft projects, and these labels are that project's data."""
+        self.assertEqual(self._status_for(self.outsider), 200)
+
+    def test_an_outsider_cannot_read_a_draft_project(self):
+        """A draft project is private, so its verified labels are too."""
+        self.project.draft = True
+        self.project.save()
+        self.assertEqual(self._status_for(self.outsider), 403)
+
+    def test_a_member_can_still_read_their_draft_project(self):
+        self.project.draft = True
+        self.project.save()
+        self.assertEqual(self._status_for(self.member), 200)
+
+
+class TestTrainingConfigIsUsed(TestCase):
+    """
+    Settings published by the service and stored on the algorithm actually drive a run.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+        from ami.ml.schemas import AlgorithmTrainingConfig
+
+        self.project = Project.objects.create(name="Config Project")
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.algorithm.trainable = True
+        self.algorithm.training_config = AlgorithmTrainingConfig(
+            min_per_species=7, test_fraction=0.4, split_salt="from-config", head_type="mlp1", epochs=42
+        )
+        self.algorithm.save()
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.algorithm.key},
+        )
+
+    def _payload(self):
+        from ami.ml.training_dispatch import send_training_request
+
+        captured = {}
+
+        class FakeResponse:
+            ok = True
+
+            def json(self):
+                return {"labels": []}
+
+        def fake_post(url, json=None, timeout=None):
+            captured.update(json)
+            return FakeResponse()
+
+        with unittest.mock.patch("ami.ml.training_dispatch.create_session") as session:
+            session.return_value.post = fake_post
+            send_training_request(
+                job=self.job,
+                service=unittest.mock.Mock(endpoint_url="http://service:2000", name="svc"),
+                algorithm=self.algorithm,
+                dataset={"url": "/media/training/x.npz"},
+            )
+        return captured
+
+    def test_the_fitting_settings_reach_the_service(self):
+        payload = self._payload()
+        self.assertEqual(payload["head_type"], "mlp1")
+        self.assertEqual(payload["epochs"], 42)
+        self.assertEqual(payload["min_per_species"], 7)
+
+    def test_a_job_can_override_the_config_for_one_run(self):
+        self.job.params = {**self.job.params, "epochs": 5, "head_type": "linear"}
+        self.job.save()
+
+        payload = self._payload()
+        self.assertEqual(payload["epochs"], 5)
+        self.assertEqual(payload["head_type"], "linear")
+        # Not overridden, so it still comes from the config.
+        self.assertEqual(payload["min_per_species"], 7)
+
+
+class TestTrainingResultIsRecordedOnce(TestCase):
+    """
+    A service posts its callback before returning from /train, so a fast run reports twice.
+    Only the first report may count, or each retrain registers two algorithm versions.
+    """
+
+    def setUp(self):
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        self.project = Project.objects.create(name="Duplicate Result Project")
+        self.parent = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.parent.trainable = True
+        self.parent.save()
+        self.job = Job.objects.create(
+            project=self.project,
+            name="Retrain",
+            job_type_key=TrainClassifierJob.key,
+            params={"algorithm_key": self.parent.key},
+        )
+        self.payload = {
+            "result": {
+                "labels": ["Alpha one", "Beta two"],
+                "rows": {"total": 10, "kept": 10, "train": 8, "test": 2},
+                "candidate_metrics": {"top1": 0.9, "n": 2},
+                "incumbent_metrics": {"top1": 0.5, "n": 2},
+                "trained_at": "2026-09-13T19:00:00",
+                "warnings": [],
+                "promote": True,
+            },
+            "dataset": {"rows": 10},
+            "dataset_url": "/media/training/x.npz",
+        }
+
+    def test_reporting_twice_registers_one_version(self):
+        from ami.jobs.models import TrainClassifierJob
+
+        before = Algorithm.objects.filter(name=self.parent.name).count()
+        TrainClassifierJob.record_result(job=self.job, payload=self.payload)
+        TrainClassifierJob.record_result(job=self.job, payload=self.payload)
+
+        self.assertEqual(Algorithm.objects.filter(name=self.parent.name).count(), before + 1)
+
+    def test_a_stale_copy_of_the_job_cannot_report_again(self):
+        """The inline caller holds a copy from before the callback landed."""
+        from ami.jobs.models import Job, TrainClassifierJob
+
+        stale = Job.objects.get(pk=self.job.pk)
+        TrainClassifierJob.record_result(job=self.job, payload=self.payload)
+
+        before = Algorithm.objects.filter(name=self.parent.name).count()
+        TrainClassifierJob.record_result(job=stale, payload=self.payload)
+        self.assertEqual(Algorithm.objects.filter(name=self.parent.name).count(), before)
+
+    def test_the_first_result_is_the_one_kept(self):
+        from ami.jobs.models import TrainClassifierJob
+
+        TrainClassifierJob.record_result(job=self.job, payload=self.payload)
+        second = {**self.payload, "result": {**self.payload["result"], "candidate_metrics": {"top1": 0.1}}}
+        TrainClassifierJob.record_result(job=self.job, payload=second)
+
+        self.job.refresh_from_db()
+        self.assertEqual(self.job.result["result"]["candidate_metrics"]["top1"], 0.9)
+
+
+class TestOccurrenceSetAPI(APITestCase):
+    """
+    The endpoint the evaluation-set picker reads.
+
+    A set is either one project's or global, so what this returns decides which sets a
+    person can score a model against.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Set Project")
+        self.other_project = Project.objects.create(name="Someone Else's Project")
+        self.user = User.objects.create_user(email="sets@example.com", password="testpass123")
+        self.project.members.add(self.user)
+
+        self.own = OccurrenceSet.objects.create(name="This project's blind set")
+        self.own.projects.add(self.project)
+        self.global_set = OccurrenceSet.objects.create(name="Platform-wide blind set")
+        self.theirs = OccurrenceSet.objects.create(name="Another project's blind set")
+        self.theirs.projects.add(self.other_project)
+
+        self.url = reverse_with_params("api:occurrenceset-list")
+
+    def _names(self, response):
+        return sorted(item["name"] for item in response.json()["results"])
+
+    def test_a_project_sees_its_own_sets_and_the_global_ones(self):
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {"project_id": self.project.pk})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(self._names(response), sorted([self.own.name, self.global_set.name]))
+
+    def test_another_project_s_set_is_not_offered(self):
+        """Scoring against a set from another project would compare models on data
+        this project cannot see."""
+        self.client.force_authenticate(user=self.user)
+        response = self.client.get(self.url, {"project_id": self.project.pk})
+
+        self.assertNotIn(self.theirs.name, self._names(response))
+
+    def test_listing_without_a_project_is_refused(self):
+        """Without a project the queryset has nothing to scope to, so it would return
+        every set on the platform."""
+        self.client.force_authenticate(user=self.user)
+
+        self.assertEqual(self.client.get(self.url).status_code, 400)
+
+    def test_the_sets_are_read_only(self):
+        """Membership is built deliberately: two models can only be compared if they were
+        scored on exactly the same occurrences."""
+        self.client.force_authenticate(user=self.user)
+        response = self.client.post(self.url, {"name": "Made up in passing"}, format="json")
+
+        # 405 if the method is refused first, 403 if the permission check gets there
+        # first. Either way the endpoint will not create one.
+        self.assertIn(response.status_code, (403, 405))
+
+    def test_a_draft_project_s_sets_are_hidden_from_outsiders(self):
+        """A draft project is not published, so neither is what it scores models on."""
+        draft = Project.objects.create(name="Unpublished Project", draft=True)
+        secret = OccurrenceSet.objects.create(name="Draft project's set")
+        secret.projects.add(draft)
+
+        self.client.force_authenticate(user=None)
+        response = self.client.get(self.url, {"project_id": draft.pk})
+
+        self.assertNotIn(secret.name, self._names(response))
+
+    def test_a_global_set_is_offered_to_anonymous_readers_too(self):
+        """Global means every project, and Antenna publishes non-draft projects."""
+        self.client.force_authenticate(user=None)
+        response = self.client.get(self.url, {"project_id": self.project.pk})
+
+        self.assertIn(self.global_set.name, self._names(response))
+
+
+class TestAlgorithmEvaluation(TestCase):
+    """
+    Scoring an algorithm against a fixed set of verified occurrences, so two models can be
+    compared on identical data.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Evaluation Project")
+        self.user = User.objects.create_user(email="evaluator@example.com", password="testpass123")
+        self.taxa = [Taxon.objects.create(name=f"Evaluus {n}", rank=TaxonRank.SPECIES.name) for n in ("alpha", "beta")]
+        self.outsider_taxon = Taxon.objects.create(name="Outsideus ignotus", rank=TaxonRank.SPECIES.name)
+
+        self.algorithm = get_or_create_algorithm_and_category_map(ALGORITHM_CHOICES["random-species-classifier"])
+        self.category_map = AlgorithmCategoryMap.objects.create(
+            labels=[t.name for t in self.taxa],
+            data=[{"index": i, "label": t.name} for i, t in enumerate(self.taxa)],
+            version="eval-test",
+        )
+        self.algorithm.category_map = self.category_map
+        self.algorithm.save()
+
+        self.occurrence_set = OccurrenceSet.objects.create(name="Blind set")
+        self.occurrence_set.projects.add(self.project)
+
+    def _occurrence(self, truth, predicted=None, index=0):
+        """One verified occurrence, optionally with a prediction from the algorithm."""
+        image = SourceImage.objects.create(
+            path=f"ev{index}-{truth.pk}-2024010100{index:02d}00.jpg", project=self.project
+        )
+        detection = Detection.objects.create(source_image=image, bbox=[0, 0, 10, 10])
+        occurrence = detection.associate_new_occurrence()
+        Identification.objects.create(occurrence=occurrence, taxon=truth, user=self.user)
+        if predicted:
+            Classification.objects.create(
+                detection=detection,
+                taxon=predicted,
+                algorithm=self.algorithm,
+                score=0.9,
+                timestamp=datetime.datetime.now(),
+                category_map=self.category_map,
+            )
+        self.occurrence_set.occurrences.add(occurrence)
+        return occurrence
+
+    def test_a_perfect_run_scores_one(self):
+        from ami.ml import evaluation
+
+        for i, taxon in enumerate(self.taxa):
+            self._occurrence(truth=taxon, predicted=taxon, index=i)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["micro_accuracy"], 1.0)
+        self.assertEqual(result["occurrences_scored"], 2)
+
+    def test_a_wrong_prediction_lowers_the_score(self):
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        self._occurrence(truth=self.taxa[1], predicted=self.taxa[0], index=1)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["micro_accuracy"], 0.5)
+
+    def _unverified_occurrence(self, predicted, index=0):
+        """One occurrence nobody has identified, carrying only this algorithm's prediction."""
+        image = SourceImage.objects.create(
+            path=f"un{index}-{predicted.pk}-2024010200{index:02d}00.jpg", project=self.project
+        )
+        detection = Detection.objects.create(source_image=image, bbox=[0, 0, 10, 10])
+        occurrence = detection.associate_new_occurrence()
+        Classification.objects.create(
+            detection=detection,
+            taxon=predicted,
+            algorithm=self.algorithm,
+            score=0.9,
+            timestamp=datetime.datetime.now(),
+            category_map=self.category_map,
+        )
+        # What Pipeline.save_results does for every detection it classifies
+        # (ami/ml/models/pipeline.py). Without it the fallback never runs and the
+        # occurrence would be skipped for having no determination at all.
+        update_occurrence_determination(occurrence)
+        self.occurrence_set.occurrences.add(occurrence)
+        return occurrence
+
+    def test_an_occurrence_nobody_identified_is_not_scored(self):
+        """
+        Without an identification the determination is the algorithm's own prediction, so
+        scoring it would compare the algorithm against itself and always agree.
+        """
+        from ami.ml import evaluation
+
+        unverified = self._unverified_occurrence(predicted=self.taxa[0], index=0)
+        self._occurrence(truth=self.taxa[1], predicted=self.taxa[0], index=1)
+
+        unverified.refresh_from_db()
+        self.assertEqual(unverified.determination, self.taxa[0], "determination should fall back to the prediction")
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["occurrences_scored"], 1, "only the identified occurrence counts")
+        self.assertEqual(result["micro_accuracy"], 0.0, "the one real comparison is wrong")
+
+    def test_a_withdrawn_identification_does_not_count_as_verification(self):
+        """Withdrawing an identification takes the occurrence back out of the scored set."""
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        withdrawn = self._occurrence(truth=self.taxa[1], predicted=self.taxa[1], index=1)
+        withdrawn.identifications.update(withdrawn=True)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["occurrences_scored"], 1)
+
+    def test_a_label_matching_an_alternate_name_is_still_scored(self):
+        """
+        A category map label is the name the model was trained under. Matching it as text
+        against the stored name drops the species; matching by taxon does not.
+        """
+        from ami.ml import evaluation
+
+        renamed = Taxon.objects.create(
+            name="Evaluus gamma",
+            rank=TaxonRank.SPECIES.name,
+            search_names=["Evaluus gamma", "Evaluus gamma Smith, 1899"],
+        )
+        self.category_map.labels = [*self.category_map.labels, "Evaluus gamma Smith, 1899"]
+        self.category_map.data = [{"index": i, "label": label} for i, label in enumerate(self.category_map.labels)]
+        self.category_map.save()
+
+        self.assertIn(renamed.pk, evaluation.predictable_taxon_ids(self.algorithm))
+
+        self._occurrence(truth=renamed, predicted=renamed, index=5)
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["occurrences_scored"], 1, "the renamed species is answerable, not skipped")
+        self.assertEqual(result["occurrences_skipped"], 0)
+
+    def test_the_score_reports_what_it_was_measured_over(self):
+        """An accuracy over a few species reads the same as one over all of them."""
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        self._occurrence(truth=self.outsider_taxon, predicted=self.taxa[0], index=1)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["species_scored"], 1)
+        self.assertEqual(result["species_in_set"], 2, "both identified species count toward the set")
+        self.assertEqual(result["species_predictable"], 2, "the two taxa in the category map")
+
+    def test_species_the_algorithm_cannot_predict_are_left_out(self):
+        """Counting those wrong would punish a regional head for a question nobody asked it."""
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        self._occurrence(truth=self.outsider_taxon, predicted=self.taxa[0], index=1)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["occurrences_scored"], 1)
+        self.assertEqual(result["occurrences_skipped"], 1)
+        self.assertEqual(result["micro_accuracy"], 1.0)
+
+    def test_the_per_species_average_differs_from_the_plain_share(self):
+        """Long-tailed data: one common species must not hide failure on a rare one."""
+        from ami.ml import evaluation
+
+        for i in range(4):
+            self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=i)
+        self._occurrence(truth=self.taxa[1], predicted=self.taxa[0], index=9)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        self.assertEqual(result["micro_accuracy"], 0.8)
+        self.assertEqual(result["macro_accuracy"], 0.5)
+
+    def test_an_algorithm_that_never_ran_says_so(self):
+        """A missing step should read as a missing step, not an accuracy of zero."""
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=None, index=0)
+        with self.assertRaises(evaluation.NothingToScore):
+            evaluation.score(self.occurrence_set, self.algorithm)
+
+    def test_results_are_stored_per_species(self):
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        self._occurrence(truth=self.taxa[1], predicted=self.taxa[0], index=1)
+
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        stored = evaluation.save_evaluation(self.occurrence_set, self.algorithm, result)
+
+        self.assertEqual(stored.micro_accuracy, 0.5)
+        self.assertEqual(stored.taxa.count(), 2)
+        self.assertEqual(stored.taxa.get(taxon=self.taxa[0]).accuracy, 1.0)
+        self.assertEqual(stored.taxa.get(taxon=self.taxa[1]).accuracy, 0.0)
+
+    def test_scoring_again_replaces_the_earlier_result(self):
+        """A second run over the same set is a correction, not a new fact."""
+        from ami.ml import evaluation
+
+        self._occurrence(truth=self.taxa[0], predicted=self.taxa[0], index=0)
+        result = evaluation.score(self.occurrence_set, self.algorithm)
+        evaluation.save_evaluation(self.occurrence_set, self.algorithm, result)
+        evaluation.save_evaluation(self.occurrence_set, self.algorithm, result)
+
+        self.assertEqual(
+            AlgorithmEvaluation.objects.filter(algorithm=self.algorithm, occurrence_set=self.occurrence_set).count(),
+            1,
+        )
+
+    def test_a_set_with_no_project_is_global(self):
+        """One set can compare models across projects."""
+        shared = OccurrenceSet.objects.create(name="Shared across projects")
+        self.assertTrue(shared.is_global)
+        self.assertFalse(self.occurrence_set.is_global)
+        self.assertIn(shared, OccurrenceSet.objects.for_project(self.project))
+
+
+class TestEvaluationsAreNotExposedAcrossProjects(TestCase):
+    """
+    An evaluation names the set it ran on and how the model scored. Sets belong to
+    projects, so those names and numbers are project data.
+
+    Scoping by project only helps when a project is named and when the caller may see it.
+    Neither held: with no project the read was unfiltered, and a named project was loaded
+    by id without checking the caller could see it, so a draft project's id worked.
+    """
+
+    def setUp(self):
+        self.user = User.objects.create_user(email="outsider@example.com", password="testpass123")
+        self.algorithm = Algorithm.objects.create(name="Shared model", key="shared-model")
+
+        self.taxon = Taxon.objects.create(name="Exposus taxon", rank=TaxonRank.SPECIES.name)
+
+        self.global_set = OccurrenceSet.objects.create(name="Platform-wide set")
+        self.their_project = Project.objects.create(name="Someone Else's Project", draft=True)
+        self.their_set = OccurrenceSet.objects.create(name="Their private set")
+        self.their_set.projects.add(self.their_project)
+
+        for occurrence_set in (self.global_set, self.their_set):
+            evaluation = AlgorithmEvaluation.objects.create(
+                algorithm=self.algorithm,
+                occurrence_set=occurrence_set,
+                micro_accuracy=0.9,
+                macro_accuracy=0.9,
+                occurrences_scored=10,
+                species_scored=1,
+            )
+            TaxonEvaluation.objects.create(
+                evaluation=evaluation, taxon=self.taxon, accuracy=0.9, occurrences_scored=10, correct=9
+            )
+
+    def _request_naming(self, project):
+        """A DRF request, since get_active_project reads request.data."""
+        from rest_framework.request import Request
+
+        request = Request(APIRequestFactory().get("/", {"project_id": project.pk}))
+        request.user = self.user
+        return request
+
+    def test_without_a_project_only_the_global_sets_are_shown(self):
+        """No project named must mean the platform-wide sets, not every project's."""
+        names = [row["occurrence_set"]["name"] for row in reporting.latest_evaluations(self.algorithm)]
+
+        self.assertIn(self.global_set.name, names)
+        self.assertNotIn(self.their_set.name, names)
+
+    def test_a_taxon_without_a_project_shows_only_the_global_sets(self):
+        names = [row["occurrence_set"]["name"] for row in reporting.performance_for_taxon(self.taxon)]
+
+        self.assertIn(self.global_set.name, names)
+        self.assertNotIn(self.their_set.name, names)
+
+    def test_a_project_the_caller_cannot_see_is_not_used(self):
+        """A draft project's id is loaded by the helper without a visibility check."""
+        request = self._request_naming(self.their_project)
+
+        project = reporting.project_for(request)
+
+        self.assertIsNone(project)
+
+    def test_a_project_the_caller_can_see_is_used(self):
+        self.their_project.members.add(self.user)
+
+        self.assertEqual(reporting.project_for(self._request_naming(self.their_project)), self.their_project)
+
+    def test_no_request_means_no_project(self):
+        """This serializer is nested in responses that do not carry a request."""
+        self.assertIsNone(reporting.project_for(None))
+
+
+class TestTaxaListQueryCount(APITestCase):
+    """
+    Guard against an N+1 on the taxa-lists page.
+
+    best_model is a per-row lookup, which is the shape that silently turns a page of lists
+    into one query each. A multi-row fixture is the only way to see it: with a single list
+    an N+1 and a flat query look identical.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Query Count Project")
+        self.user = User.objects.create_user(email="qcount-lists@example.com", password="testpass123")
+        self.project.members.add(self.user)
+        self.client.force_authenticate(user=self.user)
+
+        self.taxon = Taxon.objects.create(name="Countus communis", rank=TaxonRank.SPECIES.name)
+        algorithm = Algorithm.objects.create(name="Scored model", key="scored-model")
+        occurrence_set = OccurrenceSet.objects.create(name="Query count set")
+        evaluation = AlgorithmEvaluation.objects.create(
+            algorithm=algorithm,
+            occurrence_set=occurrence_set,
+            micro_accuracy=0.9,
+            macro_accuracy=0.9,
+            occurrences_scored=10,
+            species_scored=1,
+        )
+        TaxonEvaluation.objects.create(
+            evaluation=evaluation, taxon=self.taxon, accuracy=0.9, occurrences_scored=10, correct=9
+        )
+        self._add_list("First list")
+
+    def _add_list(self, name: str) -> None:
+        taxa_list = TaxaList.objects.create(name=name)
+        taxa_list.taxa.set([self.taxon])
+        taxa_list.projects.add(self.project)
+
+    def _evaluation_queries(self) -> int:
+        """How many times a page of lists asks the evaluation tables anything."""
+        from django.core.cache import caches
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        url = f"/api/v2/taxa/lists/?project_id={self.project.pk}&limit=100"
+        # A warm cachalot cache hides query-scaling regressions, so start cold.
+        caches["default"].clear()
+        with CaptureQueriesContext(connection) as ctx:
+            response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        return len([q for q in ctx.captured_queries if "algorithmevaluation" in q["sql"].lower()])
+
+    def test_the_endpoint_reports_the_best_model(self):
+        """
+        Guards the other half of the annotation: read from a field the viewset forgot to
+        attach, best_model would quietly go null with the query count still flat.
+        """
+        response = self.client.get(f"/api/v2/taxa/lists/?project_id={self.project.pk}")
+        best = response.json()["results"][0]["best_model"]
+
+        self.assertIsNotNone(best, "best_model is null; the viewset is not annotating it")
+        self.assertEqual(best["name"], "Scored model")
+        self.assertAlmostEqual(best["accuracy_by_species"], 0.9)
+        self.assertEqual(best["occurrence_set"], "Query count set")
+
+    def test_best_model_does_not_query_once_per_taxa_list(self):
+        one_list = self._evaluation_queries()
+
+        for n in range(5):
+            self._add_list(f"List {n}")
+
+        six_lists = self._evaluation_queries()
+
+        self.assertEqual(
+            six_lists,
+            one_list,
+            f"Evaluation queries grew with the number of taxa lists: {one_list} -> {six_lists} "
+            "(best_model is being looked up per row)",
+        )
+
+
+class TestPerformanceReporting(TestCase):
+    """
+    The numbers the model-performance screens read: the best model for a taxa list, and how
+    each algorithm has done on one species.
+    """
+
+    def setUp(self):
+        self.project = Project.objects.create(name="Reporting Project")
+        self.user = User.objects.create_user(email="reporter@example.com", password="testpass123")
+        self.common = Taxon.objects.create(name="Reportus communis", rank=TaxonRank.SPECIES.name)
+        self.rare = Taxon.objects.create(name="Reportus rarus", rank=TaxonRank.SPECIES.name)
+        self.taxa_list = TaxaList.objects.create(name="Reporting list")
+        self.taxa_list.taxa.set([self.common, self.rare])
+        self.taxa_list.projects.add(self.project)
+        self.occurrence_set = OccurrenceSet.objects.create(name="Reporting set")
+
+    def _algorithm(self, key: str) -> Algorithm:
+        return Algorithm.objects.create(name=key, key=key)
+
+    def _evaluation(self, algorithm: Algorithm, micro: float, macro: float, per_taxon: dict) -> AlgorithmEvaluation:
+        evaluation = AlgorithmEvaluation.objects.create(
+            algorithm=algorithm,
+            occurrence_set=self.occurrence_set,
+            micro_accuracy=micro,
+            macro_accuracy=macro,
+            occurrences_scored=sum(scored for _, scored in per_taxon.values()),
+            species_scored=len(per_taxon),
+        )
+        for taxon, (correct, scored) in per_taxon.items():
+            TaxonEvaluation.objects.create(
+                evaluation=evaluation,
+                taxon=taxon,
+                accuracy=correct / scored,
+                occurrences_scored=scored,
+                correct=correct,
+            )
+        return evaluation
+
+    def _other_project_evaluation(self):
+        """An evaluation belonging to a different, private project, scoring the same taxa."""
+        other = Project.objects.create(name="Someone Else's Project", draft=True)
+        their_set = OccurrenceSet.objects.create(name="Their private blind set")
+        their_set.projects.add(other)
+        algorithm = self._algorithm("their-model")
+        evaluation = AlgorithmEvaluation.objects.create(
+            algorithm=algorithm,
+            occurrence_set=their_set,
+            micro_accuracy=0.99,
+            macro_accuracy=0.99,
+            occurrences_scored=50,
+            species_scored=2,
+        )
+        for taxon in (self.common, self.rare):
+            TaxonEvaluation.objects.create(
+                evaluation=evaluation, taxon=taxon, accuracy=0.99, occurrences_scored=25, correct=24
+            )
+        return evaluation
+
+    def test_a_species_does_not_show_another_project_s_evaluations(self):
+        """
+        Taxa are shared across projects, evaluation sets are not.
+
+        Without scoping, a species page lists every evaluation that happened to score that
+        taxon anywhere on the platform, exposing another project's set name and numbers.
+        """
+        self._other_project_evaluation()
+        mine = self._evaluation(self._algorithm("my-model"), micro=0.5, macro=0.5, per_taxon={self.common: (5, 10)})
+
+        rows = reporting.performance_for_taxon(self.common, project=self.project)
+
+        self.assertEqual([r["algorithm"]["id"] for r in rows], [mine.algorithm_id])
+
+    def test_a_taxa_list_s_best_model_ignores_another_project_s_evaluation(self):
+        """Their model scores higher, but it was never scored on anything this project can see."""
+        self._other_project_evaluation()
+        mine = self._evaluation(self._algorithm("my-model"), micro=0.5, macro=0.5, per_taxon={self.common: (5, 10)})
+
+        best = reporting.best_evaluation_for_taxa_list(self.taxa_list, project=self.project)
+
+        self.assertEqual(best, mine)
+
+    def test_an_algorithm_panel_shows_only_sets_this_project_can_see(self):
+        theirs = self._other_project_evaluation()
+
+        rows = reporting.latest_evaluations(theirs.algorithm, project=self.project)
+
+        self.assertEqual(rows, [])
+
+    def test_a_global_set_is_visible_to_every_project(self):
+        """A set with no project is the platform-wide benchmark, so it must not be filtered out."""
+        mine = self._evaluation(self._algorithm("my-model"), micro=0.5, macro=0.5, per_taxon={self.common: (5, 10)})
+
+        rows = reporting.performance_for_taxon(self.common, project=self.project)
+
+        # self.occurrence_set belongs to no project, so it is global.
+        self.assertEqual([r["algorithm"]["id"] for r in rows], [mine.algorithm_id])
+
+    def test_the_best_model_is_the_one_that_handles_the_rare_species(self):
+        """Ranked on the per-species average, or a model that only knows the common one wins."""
+        from ami.ml import reporting
+
+        self._evaluation(self._algorithm("common-only"), micro=0.9, macro=0.5, per_taxon={self.common: (9, 10)})
+        even = self._evaluation(
+            self._algorithm("handles-both"),
+            micro=0.8,
+            macro=0.8,
+            per_taxon={self.common: (8, 10), self.rare: (8, 10)},
+        )
+
+        self.assertEqual(reporting.best_evaluation_for_taxa_list(self.taxa_list), even)
+
+    def test_a_list_nothing_has_been_scored_on_has_no_best_model(self):
+        from ami.ml import reporting
+
+        self.assertIsNone(reporting.best_evaluation_for_taxa_list(self.taxa_list))
+
+    def test_a_species_lists_every_algorithm_scored_on_it(self):
+        from ami.ml import reporting
+
+        self._evaluation(self._algorithm("first"), micro=1.0, macro=1.0, per_taxon={self.rare: (2, 2)})
+        self._evaluation(self._algorithm("second"), micro=0.5, macro=0.5, per_taxon={self.rare: (1, 2)})
+
+        rows = reporting.performance_for_taxon(self.rare)
+        self.assertEqual([row["algorithm"]["key"] for row in rows], ["first", "second"])
+        self.assertEqual([row["accuracy"] for row in rows], [1.0, 0.5])
+        self.assertEqual(rows[0]["occurrence_set"]["name"], self.occurrence_set.name)
+
+    def test_a_species_nothing_has_been_scored_on_lists_nothing(self):
+        from ami.ml import reporting
+
+        self.assertEqual(reporting.performance_for_taxon(self.common), [])
+
+    def test_an_algorithm_lists_its_own_scores(self):
+        from ami.ml import reporting
+
+        algorithm = self._algorithm("scored-twice")
+        self._evaluation(algorithm, micro=1.0, macro=1.0, per_taxon={self.common: (2, 2)})
+        other_set = OccurrenceSet.objects.create(name="Second set")
+        AlgorithmEvaluation.objects.create(
+            algorithm=algorithm,
+            occurrence_set=other_set,
+            micro_accuracy=0.5,
+            macro_accuracy=0.5,
+            occurrences_scored=2,
+            species_scored=1,
+        )
+
+        rows = reporting.latest_evaluations(algorithm)
+        self.assertEqual({row["occurrence_set"]["name"] for row in rows}, {"Reporting set", "Second set"})
+        self.assertEqual(len(reporting.latest_evaluations(algorithm, limit=1)), 1)
+
+    def test_the_algorithms_list_does_not_query_per_row(self):
+        """Evaluations are prefetched: adding scored algorithms must not add queries."""
+        from django.core.cache import caches
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from ami.ml.models import Pipeline, ProcessingService, ProjectPipelineConfig
+
+        service = ProcessingService.objects.create(name="Reporting service", endpoint_url="http://example.com")
+        service.projects.add(self.project)
+        pipeline = Pipeline.objects.create(name="Reporting pipeline", slug="reporting-pipeline")
+        pipeline.projects.add(self.project)
+        ProjectPipelineConfig.objects.update_or_create(
+            project=self.project, pipeline=pipeline, defaults={"enabled": True}
+        )
+
+        self.client.force_login(self.user)
+        url = f"/api/v2/ml/algorithms/?project_id={self.project.pk}"
+
+        def query_count() -> int:
+            # Cold cache on both runs, or a warm one hides the scaling.
+            caches["default"].clear()
+            with CaptureQueriesContext(connection) as ctx:
+                res = self.client.get(url)
+            self.assertEqual(res.status_code, 200)
+            return len(ctx.captured_queries)
+
+        for index in range(2):
+            algorithm = self._algorithm(f"listed-{index}")
+            pipeline.algorithms.add(algorithm)
+            self._evaluation(algorithm, micro=1.0, macro=1.0, per_taxon={self.common: (1, 1)})
+        two_algorithms = query_count()
+
+        for index in range(2, 6):
+            algorithm = self._algorithm(f"listed-{index}")
+            pipeline.algorithms.add(algorithm)
+            self._evaluation(algorithm, micro=1.0, macro=1.0, per_taxon={self.common: (1, 1)})
+        six_algorithms = query_count()
+
+        self.assertLessEqual(six_algorithms, two_algorithms)
diff --git a/ami/ml/trained_head.py b/ami/ml/trained_head.py
new file mode 100644
index 000000000..075a5dc8f
--- /dev/null
+++ b/ami/ml/trained_head.py
@@ -0,0 +1,64 @@
+"""
+Keep a copy of the head a processing service produced.
+
+A retrained head only ever existed on the service's own disk, under a cache directory, so
+a container rebuild or a cleared cache lost it. Antenna recorded that a version existed
+but not where its weights were, which makes promoting one later meaningless: the artifact
+being promoted may be gone.
+
+The service uploads the head here rather than to storage directly. It holds no storage
+credentials — it fetches everything over plain URLs — and a presigned upload would only
+work where the storage backend is S3, not against the local filesystem. Going through
+Antenna works the same in both, and reuses the signed token the service already has.
+
+This is the opposite direction to ami/ml/training_dataset.py, which hands the service a
+URL rather than the bytes. A training set runs to hundreds of megabytes; a head is a
+single small matrix, so the cost of passing it through is not worth avoiding.
+"""
+
+import logging
+import typing
+
+from django.core.files.storage import default_storage
+from django.utils.text import slugify
+
+logger = logging.getLogger(__name__)
+
+HEAD_DIRECTORY = "algorithms"
+
+# A head is one Linear layer: 72 KB over 17 species, about 3 MB over 749. The cap is well
+# clear of that and only exists so a wrong or hostile upload cannot fill the bucket.
+MAX_HEAD_BYTES = 64 * 1024 * 1024
+
+
+class HeadTooLarge(Exception):
+    """The upload is larger than any head this could reasonably be."""
+
+
+def head_path(algorithm_key: str, job_id: int, filename: str) -> str:
+    """Where one job's head is kept. Deterministic, so a re-run replaces its own file."""
+    return f"{HEAD_DIRECTORY}/{slugify(algorithm_key)}-job-{job_id}/{filename}"
+
+
+def store(algorithm_key: str, job_id: int, files: dict) -> dict[str, typing.Any]:
+    """
+    Save the uploaded head files and return where they landed.
+
+    Returns the storage path and URL of each file, keyed by the name it was uploaded
+    under, so the caller can record the head's location against the algorithm version.
+    """
+    stored = {}
+    for name, uploaded in files.items():
+        if uploaded.size > MAX_HEAD_BYTES:
+            raise HeadTooLarge(f"'{name}' is {uploaded.size} bytes; the limit is {MAX_HEAD_BYTES}.")
+
+        path = head_path(algorithm_key, job_id, uploaded.name)
+        if default_storage.exists(path):
+            # A re-run of the same job replaces its head instead of piling up copies,
+            # matching how the training set is written.
+            default_storage.delete(path)
+        saved_path = default_storage.save(path, uploaded)
+        stored[name] = {"path": saved_path, "url": default_storage.url(saved_path)}
+        logger.info(f"Stored '{name}' for job {job_id} at {saved_path}")
+
+    return stored
diff --git a/ami/ml/training_data.py b/ami/ml/training_data.py
new file mode 100644
index 000000000..50d64b86b
--- /dev/null
+++ b/ami/ml/training_data.py
@@ -0,0 +1,122 @@
+"""
+Building a classifier-head training set out of what people verified in the UI.
+
+Shared by the export management command and the training-data API so both agree on what
+counts as a label and which rows land in the test split.
+"""
+
+import hashlib
+import typing
+
+from django.db.models import QuerySet
+
+from ami.main.models import Identification, Project
+from ami.ml.models.algorithm import Algorithm
+from ami.ml.models.embedding import DetectionEmbedding
+
+DEFAULT_SPLIT_SALT = "antenna-head-v1"
+DEFAULT_TEST_FRACTION = 0.2
+
+# The two sides of the split. Named so the API, the dataset builder and the export
+# cannot drift apart on spelling.
+SPLIT_TRAIN = "train"
+SPLIT_TEST = "test"
+SPLITS = (SPLIT_TRAIN, SPLIT_TEST)
+
+
+def split_for(
+    occurrence_id: int,
+    salt: str = DEFAULT_SPLIT_SALT,
+    test_fraction: float = DEFAULT_TEST_FRACTION,
+) -> str:
+    """
+    Assign an occurrence to "train" or "test", the same way every time.
+
+    Grouped by occurrence, not detection: an occurrence is one insect across several
+    frames, so a detection-level split puts near-identical crops on both sides and
+    overstates accuracy. Hash-based, not random, so the test set does not move when new
+    data arrives — an eval set that drifts cannot compare two heads.
+    """
+    digest = hashlib.sha256(f"{salt}:{occurrence_id}".encode()).hexdigest()
+    return SPLIT_TEST if (int(digest[:8], 16) / 0xFFFFFFFF) < test_fraction else SPLIT_TRAIN
+
+
+def verified_occurrence_ids(project: Project) -> QuerySet:
+    """Occurrences a person has identified and not taken back."""
+    return (
+        Identification.objects.filter(
+            withdrawn=False,
+            occurrence__project=project,
+            occurrence__determination__isnull=False,
+        )
+        .order_by()
+        .values_list("occurrence_id", flat=True)
+        .distinct()
+    )
+
+
+def verified_training_rows(project: Project, algorithm: Algorithm) -> QuerySet[DetectionEmbedding]:
+    """
+    Embeddings whose detection sits under a verified occurrence.
+
+    Constrained to one algorithm on purpose: vectors from different backbones are in
+    different spaces and must never be mixed into one training set.
+    """
+    return (
+        DetectionEmbedding.objects.filter(
+            algorithm=algorithm,
+            detection__occurrence_id__in=verified_occurrence_ids(project),
+            detection__occurrence__determination__isnull=False,
+        )
+        .select_related("detection__occurrence__determination")
+        .order_by("pk")
+    )
+
+
+def count_missing_embeddings(project: Project, algorithm: Algorithm) -> int:
+    """Verified detections this algorithm has never embedded. They need a pipeline re-run."""
+    from ami.main.models import Detection
+
+    return (
+        Detection.objects.filter(occurrence_id__in=verified_occurrence_ids(project))
+        .exclude(embeddings__algorithm=algorithm)
+        .count()
+    )
+
+
+def label_counts(project: Project, algorithm: Algorithm) -> dict[str, int]:
+    """Verified crops per species, for the chosen algorithm."""
+    from django.db.models import Count
+
+    rows = (
+        verified_training_rows(project, algorithm)
+        .order_by()
+        .values("detection__occurrence__determination__name")
+        .annotate(n=Count("pk"))
+    )
+    return {r["detection__occurrence__determination__name"]: r["n"] for r in rows}
+
+
+def species_with_enough_examples(counts: dict[str, int], minimum: int) -> set[str]:
+    """A class with a single example cannot be both trained on and evaluated."""
+    return {name for name, n in counts.items() if name and n >= minimum}
+
+
+def row_as_dict(
+    embedding: DetectionEmbedding,
+    salt: str = DEFAULT_SPLIT_SALT,
+    test_fraction: float = DEFAULT_TEST_FRACTION,
+    include_features: bool = True,
+) -> dict[str, typing.Any]:
+    """One training row, in the shape the training-data API returns."""
+    occurrence = embedding.detection.occurrence
+    row = {
+        "detection_id": embedding.detection_id,
+        "occurrence_id": occurrence.pk if occurrence else None,
+        "label": occurrence.determination.name if occurrence and occurrence.determination else None,
+        "label_id": occurrence.determination_id if occurrence else None,
+        "split": split_for(occurrence.pk, salt, test_fraction) if occurrence else None,
+    }
+    if include_features:
+        row["features"] = embedding.vector.to_list()
+    return row
diff --git a/ami/ml/training_dataset.py b/ami/ml/training_dataset.py
new file mode 100644
index 000000000..779f8baff
--- /dev/null
+++ b/ami/ml/training_dataset.py
@@ -0,0 +1,211 @@
+"""
+Write a classifier-head training set to storage, for a processing service to collect.
+
+The service is handed a URL rather than the rows themselves. A project with a few hundred
+thousand verified labels is hundreds of megabytes; that is fragile to send in one request
+and has to start over if the connection drops. A file in storage is small to hand over,
+cheap to retry, and the service already downloads capture images from the same place.
+"""
+
+import json
+import logging
+import pathlib
+import tempfile
+import typing
+
+import numpy as np
+from django.conf import settings
+from django.core.files.storage import default_storage
+from django.utils.text import slugify
+
+from ami.main.models import Project
+from ami.ml import training_data
+from ami.ml.models.algorithm import Algorithm
+from ami.ml.models.embedding import EMBEDDING_DIMENSIONS
+from ami.ml.models.training_set import record_training_set
+
+logger = logging.getLogger(__name__)
+
+# Vectors are written as float16 because that is exactly what Postgres stores (halfvec),
+# so nothing is lost. Measured on 10k rows: npz float16 is 21 MB against 227 MB of JSON,
+# and 1.1s to build against 29s.
+DATASET_DTYPE = np.float16
+
+DATASET_DIRECTORY = "training"
+
+# Rows are pulled from the database in batches so a large project does not have to fit
+# every vector in memory at once.
+FETCH_BATCH_SIZE = 2000
+
+
+class NotEnoughVerifiedData(Exception):
+    """The project does not hold enough verified labels to train and evaluate on."""
+
+
+def build_training_dataset(
+    project: Project,
+    algorithm: Algorithm,
+    min_per_species: int = 2,
+    split_salt: str = training_data.DEFAULT_SPLIT_SALT,
+    test_fraction: float = training_data.DEFAULT_TEST_FRACTION,
+    taxa_list=None,
+    job=None,
+) -> dict[str, typing.Any]:
+    """
+    Collect verified labels and their embeddings, and save them as one npz file.
+
+    Returns the storage path, the URL a service can fetch, and the metadata describing
+    what went in. Raises NotEnoughVerifiedData rather than writing a file nothing can be
+    trained on.
+    """
+    counts = training_data.label_counts(project, algorithm)
+    taxa_list = taxa_list or project.default_taxa_list
+
+    if taxa_list:
+        # The taxa list decides what the head can predict; the verified crops only decide
+        # how well it predicts each one. Without this the head shrinks to whatever happened
+        # to be verified, which silently narrows the pipeline.
+        classes = sorted(taxa_list.taxa.exclude(name="").values_list("name", flat=True))
+        if not classes:
+            raise NotEnoughVerifiedData(f"Taxa list '{taxa_list}' is empty, so there is nothing to train.")
+        keep = set(classes)
+        outside = sorted(name for name in counts if name and name not in keep)
+    else:
+        keep = training_data.species_with_enough_examples(counts, min_per_species)
+        if not keep:
+            raise NotEnoughVerifiedData(
+                f"No species in '{project.name}' has at least {min_per_species} verified crops with an "
+                f"embedding from {algorithm.key}. Verify more occurrences, or re-run the pipeline so the "
+                "verified detections get embeddings."
+            )
+        classes = sorted(keep)
+        outside = sorted(set(counts) - keep)
+
+    class_index = {name: i for i, name in enumerate(classes)}
+
+    rows = training_data.verified_training_rows(project, algorithm)
+    total = rows.count()
+
+    features = np.zeros((total, EMBEDDING_DIMENSIONS), dtype=DATASET_DTYPE)
+    labels = np.zeros(total, dtype=np.int64)
+    detection_ids = np.zeros(total, dtype=np.int64)
+    occurrence_ids = np.zeros(total, dtype=np.int64)
+    splits: list[str] = []
+
+    kept = 0
+    for embedding in rows.iterator(chunk_size=FETCH_BATCH_SIZE):
+        occurrence = embedding.detection.occurrence
+        if not occurrence or not occurrence.determination:
+            continue
+        name = occurrence.determination.name
+        if name not in class_index:
+            continue
+        features[kept] = np.asarray(embedding.vector.to_list(), dtype=DATASET_DTYPE)
+        labels[kept] = class_index[name]
+        detection_ids[kept] = embedding.detection_id
+        occurrence_ids[kept] = occurrence.pk
+        splits.append(training_data.split_for(occurrence.pk, split_salt, test_fraction))
+        kept += 1
+
+    if not kept:
+        raise NotEnoughVerifiedData("No verified detection has an embedding from this algorithm yet.")
+
+    features = features[:kept]
+    labels = labels[:kept]
+    detection_ids = detection_ids[:kept]
+    occurrence_ids = occurrence_ids[:kept]
+    split_array = np.array(splits)
+
+    n_train = int((split_array == "train").sum())
+    n_test = int((split_array == "test").sum())
+    if not n_train or not n_test:
+        raise NotEnoughVerifiedData(
+            f"The split left {n_train} training and {n_test} held-out rows. Both sides need rows "
+            "before a new head can be compared against the current one."
+        )
+
+    file_path = dataset_path(project, algorithm, job.pk if job else None)
+    metadata = {
+        # The file records where it was written. A retrain is only auditable if the
+        # version it produced can name the exact set it was fitted on, and the service
+        # echoes this metadata back in its result.
+        "url": f"{settings.MEDIA_URL}{file_path}",
+        "project": {"id": project.pk, "name": project.name},
+        "algorithm": {"key": algorithm.key, "name": algorithm.name, "version": algorithm.version},
+        "dimensions": EMBEDDING_DIMENSIONS,
+        "dtype": np.dtype(DATASET_DTYPE).name,
+        "classes": classes,
+        # .get(): with a taxa list, a class can legitimately have no verified crops yet.
+        "counts": {name: counts.get(name, 0) for name in classes},
+        "taxa_list": {"id": taxa_list.pk, "name": taxa_list.name} if taxa_list else None,
+        "classes_without_verified_data": sorted(name for name in classes if not counts.get(name)),
+        "dropped_species": outside,
+        "rows": kept,
+        "train": n_train,
+        "test": n_test,
+        "verified_detections_without_embedding": training_data.count_missing_embeddings(project, algorithm),
+        "settings": {
+            "min_per_species": min_per_species,
+            "split_salt": split_salt,
+            "test_fraction": test_fraction,
+            "split_grouped_by": "occurrence",
+        },
+    }
+
+    file_path = _save(
+        file_path=file_path,
+        arrays={
+            "features": features,
+            "labels": labels,
+            "detection_ids": detection_ids,
+            "occurrence_ids": occurrence_ids,
+            "split": split_array,
+            "classes": np.array(classes),
+        },
+        metadata=metadata,
+    )
+
+    if job:
+        # Written here rather than after training, because this is the moment the set is
+        # decided. A run that fails later still consumed these occurrences.
+        record_training_set(occurrence_ids=[int(pk) for pk in occurrence_ids[:kept]], job=job)
+
+    file_url = metadata["url"]
+    logger.info(f"Wrote training dataset with {kept} rows over {len(classes)} species to {file_path}")
+    return {"path": file_path, "url": file_url, "metadata": metadata}
+
+
+def dataset_path(project: Project, algorithm: Algorithm, job_id: int | None) -> str:
+    """Where this project's training set for this algorithm is written."""
+    stem = f"{slugify(project.name)}-{slugify(algorithm.key)}"
+    suffix = f"job-{job_id}" if job_id else "manual"
+    return f"{DATASET_DIRECTORY}/{stem}-{suffix}.npz"
+
+
+def _save(
+    file_path: str,
+    arrays: dict[str, np.ndarray],
+    metadata: dict[str, typing.Any],
+) -> str:
+    """
+    Write the npz to storage and return its path.
+
+    default_storage is the local filesystem in development and the project's S3 bucket in
+    production, so this follows wherever captures already live without a special case.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        local = pathlib.Path(tmp) / "dataset.npz"
+        # Uncompressed: embeddings are close to random, so compression buys about 10 per
+        # cent for real CPU. Metadata rides inside the archive so the file is self-describing.
+        np.savez(local, metadata=np.array(json.dumps(metadata)), **arrays)
+        if default_storage.exists(file_path):
+            # A re-run of the same job replaces its dataset instead of piling up copies.
+            default_storage.delete(file_path)
+        with open(local, "rb") as f:
+            saved_path = default_storage.save(file_path, f)
+
+    if saved_path != file_path:
+        # The metadata inside the archive records the URL it was written to, so a rename
+        # by the storage backend would leave the file describing somewhere it is not.
+        logger.warning(f"Storage wrote the training set to {saved_path}, not {file_path}.")
+    return saved_path
diff --git a/ami/ml/training_dispatch.py b/ami/ml/training_dispatch.py
new file mode 100644
index 000000000..f22f81e44
--- /dev/null
+++ b/ami/ml/training_dispatch.py
@@ -0,0 +1,141 @@
+"""
+Hand a training request to a processing service.
+
+Antenna sends a URL, not the rows. See ami/ml/training_dataset.py for why.
+"""
+
+import logging
+import typing
+from urllib.parse import urljoin
+
+from django.conf import settings
+from django.core import signing
+from django.urls import reverse
+
+from ami.utils.requests import create_session, extract_error_message_from_response
+
+logger = logging.getLogger(__name__)
+
+# How long to wait for the service to acknowledge the request. This is not how long
+# training takes: a service that answers within this window returns its result inline,
+# and one that does not is expected to report back through the job's result endpoint.
+DISPATCH_TIMEOUT_SECONDS = 600
+
+
+# A processing service has no Antenna account, so the callback is authorised by a signed
+# token instead. Nothing is stored: the signature carries the job id and Django's secret
+# key proves Antenna issued it.
+CALLBACK_SALT = "ami.ml.training.callback"
+CALLBACK_MAX_AGE_SECONDS = 60 * 60 * 24
+
+
+def make_callback_token(job) -> str:
+    """A token only Antenna could have produced, tied to this one job."""
+    return signing.dumps({"job_id": job.pk}, salt=CALLBACK_SALT)
+
+
+def verify_callback_token(token: str, job) -> bool:
+    """True when the token is Antenna's, unexpired, and for this job."""
+    if not token:
+        return False
+    try:
+        payload = signing.loads(token, salt=CALLBACK_SALT, max_age=CALLBACK_MAX_AGE_SECONDS)
+    except signing.BadSignature:
+        return False
+    return payload.get("job_id") == job.pk
+
+
+def _callback_base(job) -> str:
+    """
+    Where the service can reach this Antenna.
+
+    Deliberately not taken from the job's params. Params are free JSON that any member who
+    can create a job may set, and this base decides where the signed callback token is
+    sent -- a token that also unlocks the head upload. A per-deployment override belongs
+    in settings, not in a request body.
+    """
+    base = getattr(settings, "EXTERNAL_BASE_URL", "")
+    if not base:
+        raise ValueError(
+            "No base URL is configured, so the processing service has no way to report back. " "Set EXTERNAL_BASE_URL."
+        )
+    return base
+
+
+def callback_url_for(job) -> str:
+    """Where the service should post its result when training finishes."""
+    # reverse(), so the path follows the router rather than a copy of it here.
+    path = reverse("api:job-training-result", args=[job.pk])
+    return urljoin(_callback_base(job).rstrip("/") + "/", path.lstrip("/"))
+
+
+def head_upload_url_for(job) -> str:
+    """Where the service should upload the head it produced, so Antenna keeps a copy."""
+    path = reverse("api:job-training-head", args=[job.pk])
+    return urljoin(_callback_base(job).rstrip("/") + "/", path.lstrip("/"))
+
+
+def absolute_media_url(url: str, base_url: str | None = None) -> str:
+    """
+    Turn a stored file's URL into one a processing service can fetch.
+
+    In production MEDIA_URL is already an absolute S3 URL and this is a no-op. Locally it is
+    the relative /media/ path, so it needs a base in front.
+    """
+    if url.startswith("http://") or url.startswith("https://"):
+        return url
+    base = base_url or getattr(settings, "EXTERNAL_BASE_URL", "")
+    if not base:
+        raise ValueError(
+            "The training set is stored at a relative URL and no base URL is configured, so the "
+            "processing service has no way to download it. Set EXTERNAL_BASE_URL."
+        )
+    return urljoin(base.rstrip("/") + "/", url.lstrip("/"))
+
+
+def send_training_request(job, service, algorithm, dataset: dict) -> dict | None:
+    """
+    Ask a processing service to retrain a head.
+
+    Returns the service's result if it answered inline, or None if it accepted the work and
+    will report back later. Raises if the service refused the request.
+    """
+    endpoint = urljoin(service.endpoint_url.rstrip("/") + "/", "train")
+    params = job.params or {}
+    config = algorithm.training_config
+    payload: dict[str, typing.Any] = {
+        "dataset_url": absolute_media_url(dataset["url"]),
+        "algorithm_key": algorithm.key,
+        "job_id": job.pk,
+        "name": f"{algorithm.key}-job-{job.pk}",
+        "min_per_species": params.get("min_per_species", config.min_per_species),
+        # The fitting settings the service published, so an admin can tune them in Antenna
+        # without redeploying the service.
+        "min_improvement": params.get("min_improvement", config.min_improvement),
+        "head_type": params.get("head_type", config.head_type),
+        "epochs": params.get("epochs", config.epochs),
+        "learning_rate": params.get("learning_rate", config.learning_rate),
+        "weight_decay": params.get("weight_decay", config.weight_decay),
+    }
+
+    # Always sent: a service that finishes after the request times out reports back here
+    # instead, which is the only way a real training set can work.
+    payload["callback_url"] = callback_url_for(job)
+    payload["callback_token"] = make_callback_token(job)
+    # The head itself comes back here. A service that does not support the upload simply
+    # ignores this, and the version is registered without a stored copy as before.
+    payload["head_upload_url"] = head_upload_url_for(job)
+
+    job.logger.info(f"Sending training request to {endpoint} for {algorithm.key}")
+    session = create_session()
+    response = session.post(endpoint, json=payload, timeout=DISPATCH_TIMEOUT_SECONDS)
+
+    if not response.ok:
+        message = extract_error_message_from_response(response)
+        raise ValueError(f"The processing service refused the training request: {message}")
+
+    try:
+        return response.json()
+    except ValueError:
+        # Accepted, but nothing useful in the body. The service will report back.
+        return None
diff --git a/ami/ml/views.py b/ami/ml/views.py
index 63e460af6..4399676b2 100644
--- a/ami/ml/views.py
+++ b/ami/ml/views.py
@@ -3,22 +3,29 @@
 from django.db import transaction
 from django.db.models import Prefetch
 from django.db.models.query import QuerySet
+from django.http import Http404
 from django.utils.text import slugify
 from drf_spectacular.utils import extend_schema
 from rest_framework import exceptions as api_exceptions
-from rest_framework import mixins, status, viewsets
+from rest_framework import mixins, serializers, status, viewsets
 from rest_framework.decorators import action
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 
+from ami.base.pagination import TrainingDataPagination
 from ami.base.permissions import ProjectPipelineConfigPermission
+from ami.base.serializers import SingleParamSerializer
 from ami.base.views import ProjectMixin
 from ami.main.api.schemas import project_id_doc_param
 from ami.main.api.views import DefaultViewSet
 from ami.main.models import Project, SourceImage
+from ami.ml import training_data
 from ami.ml.schemas import PipelineRegistrationResponse
 
 from .models.algorithm import Algorithm, AlgorithmCategoryMap
+from .models.embedding import EMBEDDING_DIMENSIONS, DetectionEmbedding
+from .models.evaluation import AlgorithmEvaluation
 from .models.pipeline import Pipeline
 from .models.processing_service import ProcessingService
 from .models.project_pipeline_config import ProjectPipelineConfig
@@ -28,6 +35,7 @@
     PipelineRegistrationSerializer,
     PipelineSerializer,
     ProcessingServiceSerializer,
+    TrainingDataRowSerializer,
 )
 
 logger = logging.getLogger(__name__)
@@ -40,7 +48,9 @@ class AlgorithmViewSet(DefaultViewSet, ProjectMixin):
 
     queryset = Algorithm.objects.all()
     serializer_class = AlgorithmSerializer
-    filterset_fields = ["name", "version"]
+    # ``trainable`` is filterable so a form that starts a retrain can offer only the heads
+    # a service will actually accept.
+    filterset_fields = ["name", "version", "trainable"]
     ordering_fields = [
         "id",
         "created_at",
@@ -56,6 +66,9 @@ class AlgorithmViewSet(DefaultViewSet, ProjectMixin):
     def get_queryset(self) -> QuerySet["Algorithm"]:
         qs: QuerySet["Algorithm"] = super().get_queryset()
         qs = qs.with_category_count()  # type: ignore[union-attr] # Custom queryset method
+        qs = qs.prefetch_related(
+            Prefetch("evaluations", queryset=AlgorithmEvaluation.objects.select_related("occurrence_set"))
+        )
         # Only scope the list by project. Detail stays unscoped so links from historical
         # classifications whose pipeline is no longer enabled still resolve.
         if getattr(self, "action", None) == "list":
@@ -298,3 +311,146 @@ def create(self, request, *args, **kwargs):
         processing_service.mark_seen(live=True)
 
         return Response(response.dict(), status=status.HTTP_201_CREATED)
+
+
+class TrainingDataViewSet(ProjectMixin, mixins.ListModelMixin, viewsets.GenericViewSet):
+    """
+    Verified detections and their embeddings, for retraining a classifier head.
+
+    A head is trained on embeddings, not pixels, and the backbone that produced them is
+    frozen. So a trainer can pull this and fit a new head without touching the images.
+
+    Requires `project_id` and `algorithm` (an algorithm key). Constraining to one
+    algorithm is not optional: vectors from different backbones are in different spaces.
+
+    GET /api/v2/ml/training-data/?project_id=3&algorithm=<key>
+    GET /api/v2/ml/training-data/summary/?project_id=3&algorithm=<key>
+    """
+
+    queryset = DetectionEmbedding.objects.none()
+    serializer_class = TrainingDataRowSerializer
+    require_project = True
+    # Membership is enforced in get_queryset() via Project.objects.visible_for_user():
+    # ObjectPermission maps a "list" action on a Project to check_custom_permission, which
+    # denies members, and IsAuthenticated alone would let any account read any project's
+    # verified labels.
+    permission_classes = [IsAuthenticated]
+    filter_backends: list = []
+    pagination_class = TrainingDataPagination
+
+    def _get_visible_project(self) -> Project:
+        """
+        The requested project, if this user is allowed to see it.
+
+        Verified labels are project data, so an account that cannot see the project must
+        not be able to read them.
+        """
+        project = self.get_active_project()
+        if not project:
+            raise Http404("Project not found.")
+        visible = Project.objects.visible_for_user(self.request.user).filter(pk=project.pk).exists()
+        if not visible:
+            raise api_exceptions.PermissionDenied("You do not have access to this project.")
+        return project
+
+    def _get_algorithm(self) -> Algorithm:
+        key = SingleParamSerializer[str].clean(
+            "algorithm",
+            serializers.CharField(
+                required=True,
+                help_text="Key of the algorithm whose embeddings to train on.",
+            ),
+            self.request.query_params,
+        )
+        algorithm = Algorithm.objects.filter(key=key).first()
+        if not algorithm:
+            raise api_exceptions.NotFound(f"No algorithm with key '{key}'.")
+        return algorithm
+
+    def _get_split_settings(self) -> tuple[str, float]:
+        salt = SingleParamSerializer[str].clean(
+            "split_salt",
+            serializers.CharField(required=False, default=training_data.DEFAULT_SPLIT_SALT),
+            self.request.query_params,
+        )
+        fraction = SingleParamSerializer[float].clean(
+            "test_fraction",
+            serializers.FloatField(
+                required=False,
+                default=training_data.DEFAULT_TEST_FRACTION,
+                min_value=0,
+                max_value=0.99,
+            ),
+            self.request.query_params,
+        )
+        return salt, fraction
+
+    def get_queryset(self) -> QuerySet[DetectionEmbedding]:
+        project = self._get_visible_project()
+        qs = training_data.verified_training_rows(project, self._get_algorithm())
+
+        self._split_filter = SingleParamSerializer[str].clean(
+            "split",
+            serializers.ChoiceField(choices=list(training_data.SPLITS), required=False, allow_null=True, default=None),
+            self.request.query_params,
+        )
+        return qs
+
+    def get_serializer_context(self):
+        context = super().get_serializer_context()
+        salt, fraction = self._get_split_settings()
+        context["split_salt"] = salt
+        context["test_fraction"] = fraction
+        # Not url_boolean_param: it returns `value or default`, so a default of True can
+        # never be turned off.
+        context["include_features"] = SingleParamSerializer[bool].clean(
+            "include_features",
+            serializers.BooleanField(required=False, default=True),
+            self.request.query_params,
+        )
+        return context
+
+    @extend_schema(parameters=[project_id_doc_param])
+    def list(self, request, *args, **kwargs):
+        response = super().list(request, *args, **kwargs)
+        split = getattr(self, "_split_filter", None)
+        if split:
+            # Filtering by split in Python rather than SQL: the assignment is a hash of the
+            # occurrence id, which Postgres cannot compute. Callers that need whole splits
+            # should page through everything and group client-side.
+            results = [row for row in response.data["results"] if row["split"] == split]
+            response.data["results"] = results
+        return response
+
+    @extend_schema(parameters=[project_id_doc_param])
+    @action(detail=False, methods=["get"])
+    def summary(self, request, *args, **kwargs):
+        """Counts only. Cheap enough to poll before deciding whether a retrain is worth it."""
+        project = self._get_visible_project()
+        algorithm = self._get_algorithm()
+        salt, fraction = self._get_split_settings()
+
+        counts = training_data.label_counts(project, algorithm)
+        rows = training_data.verified_training_rows(project, algorithm)
+        splits = {name: 0 for name in training_data.SPLITS}
+        for occurrence_id in rows.values_list("detection__occurrence_id", flat=True):
+            splits[training_data.split_for(occurrence_id, salt, fraction)] += 1
+
+        return Response(
+            {
+                "project": {"id": project.pk, "name": project.name},
+                "algorithm": {"key": algorithm.key, "name": algorithm.name, "version": algorithm.version},
+                "dimensions": EMBEDDING_DIMENSIONS,
+                "rows": sum(counts.values()),
+                "classes": len(counts),
+                "counts": dict(sorted(counts.items(), key=lambda kv: -kv[1])),
+                "train": splits[training_data.SPLIT_TRAIN],
+                "test": splits[training_data.SPLIT_TEST],
+                "verified_detections_without_embedding": training_data.count_missing_embeddings(project, algorithm),
+                "settings": {
+                    "split_salt": salt,
+                    "test_fraction": fraction,
+                    "split_grouped_by": "occurrence",
+                },
+            }
+        )
diff --git a/ami/users/roles.py b/ami/users/roles.py
index 718146e41..c3cf18091 100644
--- a/ami/users/roles.py
+++ b/ami/users/roles.py
@@ -146,6 +146,11 @@ class MLDataManager(Role):
         Project.Permissions.SYNC_DEPLOYMENT,
         Project.Permissions.RUN_REGROUP_EVENTS_JOB,
         Project.Permissions.RUN_DATA_EXPORT_JOB,
+        # Retraining a head and scoring one are ML data work, so they sit with the
+        # other run_*_job permissions this role already holds.
+        Project.Permissions.RUN_GENERATE_EMBEDDINGS_JOB,
+        Project.Permissions.RUN_TRAIN_CLASSIFIER_JOB,
+        Project.Permissions.RUN_EVALUATE_ALGORITHM_JOB,
         Project.Permissions.DELETE_OCCURRENCES,
         Project.Permissions.CREATE_PROJECT_PIPELINE_CONFIG,
         Project.Permissions.UPDATE_PROJECT_PIPELINE_CONFIG,
diff --git a/compose/local/minio/nginx.conf b/compose/local/minio/nginx.conf
index 8f1c97387..1c90ecc9e 100644
--- a/compose/local/minio/nginx.conf
+++ b/compose/local/minio/nginx.conf
@@ -9,6 +9,10 @@ http {
         listen 9000 default;
         server_name _;
 
+        # Real trap captures run to several MB. nginx defaults to a 1 MB body limit, so
+        # without this it rejects them with 413 before they reach MinIO.
+        client_max_body_size 0;
+
         location / {
             # Set Host header to mitigate MinIO's signature discrepancy issue
             # e.g. "SignatureDoesNotMatch: The request signature we calculated
diff --git a/compose/local/postgres/Dockerfile b/compose/local/postgres/Dockerfile
index 5f864a4a0..fe2f457da 100644
--- a/compose/local/postgres/Dockerfile
+++ b/compose/local/postgres/Dockerfile
@@ -1,6 +1,17 @@
 FROM postgres:16
 # FROM esgn/pgtuned:latest
 
+# pgvector, required by ami.ml.models.DetectionEmbedding.
+#
+# Installed into the stock image rather than switching the base to
+# pgvector/pgvector:pg16. That image is built on Debian 12 (glibc 2.36) while
+# postgres:16 is on Debian 13 (glibc 2.41), so swapping it under an existing PGDATA
+# volume makes Postgres report a collation version mismatch and would need a full
+# REINDEX. Same extension version (0.8.6) either way.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-16-pgvector \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY ./compose/local/postgres/maintenance /usr/local/bin/maintenance
 RUN chmod +x /usr/local/bin/maintenance/*
 RUN mv /usr/local/bin/maintenance/* /usr/local/bin \
diff --git a/config/api_router.py b/config/api_router.py
index 56a01c591..1c075cd36 100644
--- a/config/api_router.py
+++ b/config/api_router.py
@@ -41,6 +41,7 @@
 router.register(r"detections", views.DetectionViewSet)
 # Register before r"occurrences" — see docs/claude/reference/api-stats-pattern.md (guarded by regression test).
 router.register(r"occurrences/stats", views.OccurrenceStatsViewSet, basename="occurrence-stats")
+router.register(r"occurrences/sets", views.OccurrenceSetViewSet)
 router.register(r"occurrences", views.OccurrenceViewSet)
 router.register(r"taxa/lists", views.TaxaListViewSet)
 # NESTED: /taxa/lists/{taxalist_id}/taxa/
@@ -56,6 +57,7 @@
 router.register(r"ml/labels", ml_views.AlgorithmCategoryMapViewSet)
 router.register(r"ml/pipelines", ml_views.PipelineViewSet)
 router.register(r"ml/processing_services", ml_views.ProcessingServiceViewSet)
+router.register(r"ml/training-data", ml_views.TrainingDataViewSet, basename="training-data")
 router.register(r"classifications", views.ClassificationViewSet)
 router.register(r"identifications", views.IdentificationViewSet)
 router.register(r"jobs", job_views.JobViewSet)
diff --git a/processing_services/minimal/api/pipelines.py b/processing_services/minimal/api/pipelines.py
index 975674b6a..5ce29e51f 100644
--- a/processing_services/minimal/api/pipelines.py
+++ b/processing_services/minimal/api/pipelines.py
@@ -1,4 +1,5 @@
 import datetime
+import hashlib
 import logging
 import math
 import random
@@ -109,6 +110,23 @@ def make_random_detection(source_images: list[SourceImage]) -> list[Detection]:
     return detector_responses
 
 
+# Width of the stand-in embeddings below. Matches Antenna's DetectionEmbedding column,
+# which is sized for BioCLIP 2.5 (ViT-H/14).
+FEATURE_DIMENSIONS = 1024
+
+
+def make_fake_features(label: str, dimensions: int = FEATURE_DIMENSIONS) -> list[float]:
+    """
+    A stand-in for a backbone's output, so the embedding path can be exercised without a
+    real model. Seeded by the label, so crops of the same class land near each other and
+    nearest-neighbour search returns something meaningful.
+    """
+    seed = int(hashlib.sha256(label.encode()).hexdigest()[:8], 16)
+    centroid = random.Random(seed)
+    jitter = random.Random()
+    return [centroid.gauss(0, 1) + jitter.gauss(0, 0.15) for _ in range(dimensions)]
+
+
 def make_random_prediction(
     algorithm: AlgorithmConfigResponse,
     terminal: bool = True,
@@ -127,6 +145,7 @@ def make_random_prediction(
         labels=category_labels if len(category_labels) <= max_labels else None,
         scores=softmax,
         logits=logits,
+        features=make_fake_features(top_class),
         timestamp=datetime.datetime.now(),
         algorithm=AlgorithmReference(name=algorithm.name, key=algorithm.key),
         terminal=terminal,
@@ -146,6 +165,7 @@ def make_classifications(detections: list[Detection], type: str) -> list[Detecti
                 classification=labels[0],
                 labels=labels,
                 scores=[0.9],
+                features=make_fake_features(labels[0]),
                 timestamp=datetime.datetime.now(),
                 algorithm=AlgorithmReference(
                     name=algorithms.CONSTANT_CLASSIFIER.name, key=algorithms.CONSTANT_CLASSIFIER.key
diff --git a/processing_services/minimal/api/schemas.py b/processing_services/minimal/api/schemas.py
index b0febba1b..6d503b988 100644
--- a/processing_services/minimal/api/schemas.py
+++ b/processing_services/minimal/api/schemas.py
@@ -95,6 +95,14 @@ class ClassificationResponse(pydantic.BaseModel):
         default_factory=list,
         description="The raw logits output by the model, before any calibration or normalization.",
     )
+    features: list[float] | None = pydantic.Field(
+        default=None,
+        description=(
+            "The embedding the backbone produced for this crop, taken before the "
+            "classification head. Optional, and only useful if every value comes from "
+            "the same backbone."
+        ),
+    )
     inference_time: float | None = None
     algorithm: AlgorithmReference
     terminal: bool = True
diff --git a/requirements/base.txt b/requirements/base.txt
index be5d24b67..849214152 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -55,6 +55,7 @@ Werkzeug[watchdog]==2.3.6 # https://github.com/pallets/werkzeug
 ipdb==0.13.13  # https://github.com/gotcha/ipdb
 psycopg[binary]==3.1.9  # https://github.com/psycopg/psycopg
 # psycopg==3.1.9  # https://github.com/psycopg/psycopg # the non-binary version is needed for some platforms
+pgvector==0.4.2  # https://github.com/pgvector/pgvector-python # requires the pgvector extension in postgres
 watchfiles==0.19.0  # https://github.com/samuelcolvin/watchfiles
 
 # Testing