Issue #2900 fix: when the operator lists the public hostname they actually serve Anthias under in CSRF_TRUSTED_ORIGINS, Django's stock check a

Today's behaviour: IIS rewrites Host upstream, no trusted origin is configured, and the same-host fallback can't bridge two genuinely differen

Pillow's UnidentifiedImageError must bubble out so the on_failure hook can write metadata.error_message — never leave a half-written staging f

A malicious image (or a misclassified scan) advertising enormous dimensions must be rejected *before* any pixel decode happens. The check read

HEIC / HEIF (case-insensitive) → WebP. RGBA so the alpha handling on the WebP write path is exercised even though HEIF sources commonly arrive

A caller that mis-routed a JPEG (or .png, .webp) through this task must not re-encode it — the row already plays. Just clear is_processing and

Source file disappeared between row creation and task pickup (cleanup raced operator, disk pressure). Fail clean so on_failure writes the erro

A row being re-uploaded after a previous failed conversion carries ``metadata.error_message``. When the new upload is a format the pipeline do

Every entry in ``NORMALIZE_IMAGE_EXTS`` produces a valid WebP output: the original is removed, the row's URI is swapped to the new ``.webp`` p

If Pillow writes some bytes to the staging file and *then* raises mid-encode (disk pressure, codec crash), the runner must clean up the partia

A re-uploaded asset whose previous attempt left an error message in metadata must clear that on success — the operator's next refresh shouldn'

The atomic ``os.replace(staging, final_uri)`` normally succeeds in <1ms, but a filesystem-full / permissions / cross-device error there would

Duplicate task fire on an already-finalised row → no-op. Same contract download_youtube_asset enforces.

Row deleted between dispatch and pickup → no-op.

Viewer has no operator BasicAuth credentials; the internal header is sufficient for this side-effect-only endpoint.

The "I have a token" button must transition Alpine state from intro → token; the token surface is the only one visible after.

A 200 response with ``valid: false`` must render the rejection message inline; the user stays on the token step (no advance to asset picker).

First-run fail-pessimistic: don't claim 'up to date' when we have never successfully checked.

A local dev bump (e.g. master tip past the last release tag) is still 'up to date' — the indicator is about being behind, not matching exactly

Dev builds without a parseable CalVer get no comparison and no pill. The remote fetch isn't even attempted in that case.

An upgrade during a GitHub outage must not reuse the previous version's verdict — that verdict was computed against the OLD installed release,

Issue #3044: _is_wayland_board() must recognise every cage board (x86, arm64, pi5), not just x86. Keying off QT_QPA_PLATFORM mirrors the Docke

The concrete regression: a Pi 5 viewer (DEVICE_TYPE=pi5, QT_QPA_PLATFORM=wayland from the Dockerfile) is now correctly classified as a Wayland

Operators paste from clipboard; trailing whitespace shouldn't flip the classification.

Pre-rebrand DB rows reference paths like ~/screenly_assets/foo.png, which after upgrade is a symlink to ~/anthias_assets/foo.png. The orp

The mid-playback respawn path passes a small budget so a persistent failure can't freeze the asset_loop for minutes — the explicit max_attempt

A permanent failure (missing binary) must NOT consume the retry budget — it raises on the first attempt with no backoff.

When every attempt fails, load_browser still raises — but only after spending the retry budget, so the fall-through to a container restart is

A fresh webview displays nothing, so the previous process's URL must not short-circuit the next view_* value comparison — with an unchanged UR

If the webview process crashed and we latched off, the next ``load_browser()`` should re-enable capability detection — the fresh process might

A board that crashes the webview on the first launches but comes up on a later one must self-heal in-process — the whole point of the spawn re

A bare GET /login/ must produce the new auth-card layout. The string assertions here would catch a broken {% extends %}, missing static refere

?next=/settings/ must round-trip into the form so the operator's original destination survives the POST.

A successful POST with a same-host `next` redirects there, not to the dashboard.

A failed login re-renders the form, and the next value must survive so the operator's destination isn't lost on a typo.

Open-redirect guard: an attacker-controlled host in `next` must NOT be honoured — the view falls back to the dashboard. Without this filter, /

pydbus refuses to coerce a Python scalar to ``GLib.Variant`` when the slot is declared ``a{sv}`` ("Expected GLib.Variant, but got str" at runt

The same-host Origin relaxation must not bypass the token check itself — a POST with a matching Origin but no ``csrfmiddlewaretoken`` body / `

Pi 4 (eglfs) rotates the whole screen via QT_QPA_EGLFS_ROTATION (set in src/anthias_viewer/__init__.py:_build_webview_env), and the QGraphicsV

x86 / arm64 / pi5 run under cage and inherit the compositor transform via wlr-randr (issue #2856 — driven from src/anthias_viewer/__init__.py)

A file the server refuses (invalid type → HTTP 200 + error toast) must not silently abort the batch: the error surfaces and the remaining vali

The top-nav tabs must reach their pages (Integrations is balena-gated and absent in the test container).

Regression guard for the rename pass that took us off Bootstrap. Scans every template for a fixed list of Bootstrap utility / component class

The deferred home.js + vendor.js bundles must execute without throwing. A console error on a fresh page load means the minifier or an import b

Curl-style clients with no Origin header (legitimate server-to-server callers, scripted operators) must still POST successfully when they carr

Unrelated edits (e.g. duration on a different asset) shouldn't interrupt the displayed asset.