Backstop for legacy rows / serializers that don't include the field. Don't silently freeze a playlist on an upgrade.

skip_asset_check=True means the operator opted out of any gating — display unconditionally, even if is_reachable=False.

Some CDNs serve video files as ``application/octet-stream``. Accept it — ffprobe in the chained normalize step is the real arbiter of containe

A 200 OK with no Content-Type header is a stronger signal of a misbehaving origin than evidence of a real video. Accepting it would let an HTM

A non-2xx response raises ``RemoteVideoDownloadError``. Celery routes the exception through ``_DownloadRemoteVideoTask.on_failure`` which clea

Defence in depth: even if the serializer's HEAD probe said the URL was a single file, an origin that serves an HLS manifest on GET must be rej

Row deleted between dispatch and pickup — task returns cleanly without hitting the network.

A duplicate task firing for a row whose first invocation already cleared is_processing must not re-download or stomp on operator-edited state.

When Celery declares the task failed, is_processing must flip back to False AND ``metadata.error_message`` must carry the exception class + me

The serializer is the source of truth for the destination path — it stamps ``Asset.uri`` at ``<assetdir>/<id><ext>`` before dispatching, picki

A payload that streams past ``REMOTE_VIDEO_MAX_BYTES`` raises inside the task body. The ``.part`` file must be cleaned up so a multi-GB partia

Happy path: requests streams a small payload to the row's persisted ``uri``, metadata gets stamped with ``source='remote_url'`` and ``source_u

``Content-Type: text/html`` on the GET response — most likely a 200-OK error page from a misbehaving origin. Reject rather than store the HTML

A 200 OK with an empty body almost certainly means the origin is broken; storing an empty file would just queue a row that the viewer would re

Defensive: if the row landed without a uri (e.g. a custom caller skipped the serializer's path-stamping), the task uses the recomputed destina

yt-dlp DownloadError is permanent — the task re-raises so Celery's on_failure path runs (which clears is_processing).

A sub-second clip must not slot a 0s rotation entry.

Live streams / radio uploads omit duration. Persist what we have (title) without overwriting the placeholder duration. Row stays ``is_processi

Row deleted between dispatch and pickup — task returns cleanly without invoking yt-dlp at all.

A duplicate task firing for a row whose first invocation already cleared is_processing must not re-download or stomp on operator-edited state.

When Celery declares the task failed, is_processing must flip back to False AND ``metadata.error_message`` must carry the exception type + mes

Pi 3 supports H.264 only; format_sort must request h264.

Pi 4 hardware-decodes both H.264 and HEVC, so it keeps the H.264 preference — H.264 is more widely available on YouTube and Pi 4 plays it just

Pi 5 biases yt-dlp toward HEVC — it is the hardware decode path (VideoCore VII). H.264 is accepted as a software fallback (GH #3092) but HEVC

Happy path: extract_info returns populated info; the YouTube task writes title + duration + ``metadata['source']`` / ``metadata['source_url']`

An unrecognised DEVICE_TYPE yields an empty HW codec set; the task must not crash and must fall back to the h264 preference so the download st

The output path passed to yt-dlp must be the row's persisted uri, not a fresh recomputation from settings['assetdir']. If assetdir was changed

x86 keeps the H.264 preference — HEVC via VAAPI is known to produce a black screen on x86, so biasing toward HEVC downloads would cause silent

The vanilla pointer-events drag we replaced SortableJS with must move both the visible row and the persisted play_order.

A /sys/class/drm/card?-HDMI-A-1 dir reads as 'connected' with a 1920x1080 mode → _drm_resolution() returns '1920x1080'.

The Start / End availability pickers post the full "06/15/2026 02:30 PM" shape under the default 12-hour clock — saving must succeed and land

Video duration is owned by the ffprobe pipeline; the edit form must render it disabled so the probed value can't be clobbered.

The weekday picker persists a play_days subset, and clearing both time fields resets the day-parting window to all-day.

Regression for issue #2988: with the default 12-hour clock, the Play from / Play until Flatpickr pickers post "02:30 PM"-shaped values, which

Whichever submit path fires (htmx HX-Trigger or full-page redirect + Django messages), a success toast must surface.

The two Advanced switches post hidden-false/checkbox-true pairs that _checkbox() resolves — both directions must persist.

The auto-refresh field renders for webpage assets only and lands in metadata.refresh_interval_s — feature #2813's UI path.

A device with no assets should land on a friendly empty state in the picker — not a broken table.

A device with no assets should still offer a way back to the token step — without it the operator is stranded on the picker.

Auth disabled → enable: a User row gets created with the posted credentials, and settings['auth_backend'] flips to 'auth_basic'. Credentials l

The splash page itself is unauth'd and the data is already disclosed there, so the polling endpoint is unauth'd too. This test pins the choice

Pinned regression: prior code 500'd when get_node_ip() returned 'Unknown'. New code never raises — empty cache → [].

Fresh asset, no recent recheck: SETNX succeeds → enqueue.

500.html in particular renders with no RequestContext (no context processors, no `request`). All four must render with an empty context — that

High-RAM devices never hit the cap, even for >1080p sources.

ffprobe-failed uploads (``video_width=None``) skip the resolution gate — the codec gate already collapsed to ``unknown`` and will reject them;

An upstream tag like ``nightly`` must not be cached: with a 24h TTL, caching it would pin is_up_to_date() to the fallback verdict for a day ev

``cap_to_1080p=True`` injects the ``-vf scale=1920:1080:force_original_aspect_ratio=decrease`` clause between the input and the codec argument

The codec-only rejection path passes ``cap_to_1080p=False`` (the default). Recipe must NOT include a scale clause then — we don't want to sugg

``_ffmpeg_reencode_recipe`` must round-trip any filename through ``shlex`` so a user-supplied ``upload_name`` can't break out of the recipe's

The runner reuses ``summary['duration_seconds']`` on the passthrough path so we don't shell ffprobe twice. Confirm the helper extracts ``forma

When ffprobe doesn't populate ``format.format_name`` (older ffprobe builds, malformed input), fall back to the filename extension so we still

A stripped-down container or dev box without ffprobe in PATH must not crash the normalisation task. ``sh.CommandNotFound`` is raised before an

A probe response missing audio/video streams is reported as 'none' (audio absent — passthrough OK if the rest matches) or 'unknown' (video abs

Probe errors (corrupt file, ffprobe missing) must not crash the task — they downgrade to 'unknown' so the caller falls through to transcode.

``video_fps`` is the average frame rate parsed from ffprobe's ``r_frame_rate`` rational. The envelope transcode uses it to decide when to emit

ffprobe's ``format_name`` for the QuickTime family is a synonym list (e.g. ``mov,mp4,m4a,3gp,3g2,mj2``). Operator-facing metadata should match

"Prefer dark mode" on: the Chromium switch the webview injects must darken an otherwise-white page.

Belt-and-suspenders: a malformed input must not crash a consumer. Valid IPs in the same string still pass through.

Bare-metal mode: host_agent didn't populate Redis in time.

Balena first-boot mode: supervisor responded but with no IP.

The trim is documented as a byte limit; multibyte characters in the keep window must not push the decoded string over the limit. Edge case: tr