Keep QuPath image identity and result coordinates tied to the image used at run start #16

Failure mechanism

The run captures only the text of an image chooser, not an immutable image identity. In run(), imageChoiceAtRun records strings such as Current image: slide A. But imageSources() supplies a closure for that choice which evaluates qupath.imageData.server when called, and selectionMask() similarly reads live qupath.imageData and live selected annotations.

After processing, openImageFor() checks only whether the recorded choice starts with Current image, then returns QuPath's currently open imageData. placePoints and placeShapes write annotations into that image's hierarchy with the run's saved coordinate offset.

Impact

If a researcher starts a long image-analysis run on slide A and opens slide B before the worker finishes, output coordinates from A can be placed on B without checking the image identity. Changing the active image during input preparation can also change which server is exported after the form has been submitted. The plugin's Run button is disabled, but QuPath itself remains usable.

Recommended fix

Snapshot the source ImageData / stable image identity and selection/area at run start on the FX thread, then carry them with that run. Resolve and export against the snapshot. On completion, write results to the original image only if it can be safely accessed; otherwise preserve outputs and report clearly that annotations were not imported. Never treat a chooser-label prefix as proof that an output belongs to the current slide.

Acceptance criteria

• Start run on A, switch to B before completion: no annotation originating from A appears in B.
• Source export and selected ROI mask consistently use the image/selection captured for the run.
• Repeated runs and change of app/tool while running cannot rebind output metadata to another tool.
• Regression GUI test with delayed Playground tool, slide switch and explicit coordinate checks.

Priority: P1 — risk of silently placing scientific annotations on the wrong tissue image. Source-traced; not executed against a running QuPath GUI in this audit.