The celery task body must short-circuit on a row that's already cleared is_processing — duplicate dispatch can't re-convert and stomp on opera

A subsequent non-recipe failure must clear any stale ``error_recipe`` / ``error_handbrake`` from a previous run, otherwise the modal would sho

on_failure called with empty args (e.g. a queueing crash before the task body ran) must not raise.

``UnsupportedVideoCodecError`` is the gate's user-facing exception. on_failure must: * write the bare message into ``metadata.error_message``

The custom Task.on_failure path must persist the error message and clear is_processing — operator must never see a row stuck forever in 'Proce

Both normalisation tasks have ``autoretry_for=(OSError,)`` so a transient disk hiccup is retried automatically. Several OSError subclasses are

Intermediate hops that leave is_processing=True (e.g. the YouTube task before chaining into normalize_video) call ``_notify(..., reload_viewer

Redis flake during the viewer reload publish must not block the browser-side notify (or vice-versa). Both are best-effort.

No Asset row references it and it's older than the 1h guard.

Catches the bug from the issue: string compare would put 10 before 5; packaging.version must compare numerically.

A mismatched-password PATCH is operator input validation, not a server bug. It must return 400 with the operator-friendly message AND be logge

45 isn't one of the four supported angles — serializer must 400 rather than passing it through to the viewer (where neither the Qt linuxfb plu

The 64-bit Qt6 Pi 3 board (``pi3-64``) runs the same VideoCore IV silicon as the 32-bit ``pi3`` — H.264-only HW decode, no HEVC. The gate must

With shuffle off, an admin reordering assets via play_order should take effect on the next refresh — the membership-equality fast path is shuf

play on a blanked display implies unblank: power back on, clear the blank, resume — never leave display_blanked set.

An asset with a play_time window can transition active state without crossing a start/end boundary — the deadline must include a 60s cap so th

Two active assets: deadline is the earlier end_date because that's when the first one drops out of the active set.

If the soonest future boundary is an *inactive* asset's start_date (not the active one's end_date), deadline must point at it so the viewer re

A malformed / stale token is treated like no token at all — same 403, no timing-leak distinction.

No token → 403. The endpoint must never serve an unauthenticated request because it discloses asset URIs (which can include credentials inline

Active assets are surfaced, an asset whose start_date is in the future is filtered out (Asset.is_active() will return False for it).

With shuffle on, asset membership stays the same but order is shuffled. With many assets, repeated requests should produce at least one non-so

End-to-end-ish: simulate a HEIC upload and verify prepare_asset stamps is_processing=True and stashes the pending flag the view dispatches on.

Common JPEG / PNG / WebP uploads land ready-to-play — never enqueue a normalisation task for them.

A webpage / RTSP / HTTP video URL must not get flagged for normalisation — only locally-uploaded files do.

An image asset previews via /assets/<id>/preview inside the modal; the Done button drops the Alpine state again.

ffprobe missing → keep the seeded duration, still clear the processing flag so the row leaves the placeholder state.

Stale asset_id (deleted between enqueue and run) — task must not crash. Nothing to assert beyond a clean return.

Happy path: ffprobe returns a length, the row gets it and is flipped out of is_processing.

When the operator changes rotation in Settings, the viewer calls MediaPlayerProxy.reset() so the next play() rebuilds VLC with the new transfo

The task must SETNX the cooldown lock before probing — that gate is what prevents concurrent ffprobe calls for the same asset across workers.

SETNX cooldown gate: if the per-asset lock is already held (someone else just probed within RECHECK_COOLDOWN_S), this task must no-op without

No lock held → SETNX succeeds → probe runs.