Operator opted out of validation; matches sweep behavior of not touching is_reachable / last_reachability_check.

A row with a mimetype neither image nor video that's stuck past the threshold has no clear re-dispatch path. Clear the flag and surface an err

A second beat tick that fires while the reconciler is running must be a no-op. Mirrors ``revalidate_asset_urls`` behaviour: only one sweep at

The ``finally`` block must release our token so the next beat tick can run.

Same recovery path applies to image-mimetype rows.

An ``is_processing=True`` video row older than the threshold is re-dispatched through ``dispatch_normalize_video`` — recovers rows whose worke

``is_processing=False`` rows aren't the reconciler's business, regardless of any stale ``processing_started_at`` left in metadata from a previ

A row whose ``processing_started_at`` is younger than the threshold belongs to an in-flight task — leave it alone.

Legacy / backup-restored rows have no ``metadata.processing_started_at``. The first sweep stamps it so the next sweep can apply the age thresh

A non-parseable ``processing_started_at`` (e.g. from a hand-edited backup) must follow the same "stamp on first sight" recovery path — never r

A naive (no tzinfo) ISO-8601 string in ``metadata.processing_started_at`` could come from a hand-edited backup. Comparing it against the tz-aw

A malicious tarball with a `..` member must not write outside $HOME. The required top-level entries are still present, so recover() proceeds,

Even past the 1h guard, a referenced file must survive.

The extension is the caller's responsibility — pass through verbatim. Allows webm/mkv/avi to land with their real container so ffprobe identif

The local destination lives under settings['assetdir'] so cleanup() recognises the downloaded file as referenced and doesn't sweep it as an or

A slow first-boot supervisor must not block the endpoint.

The splash docstring promises 'updates if IPs change during the splash's display window' (e.g. DHCP renewal mid-splash). Honoring that require

At a 2s poll cadence, host_agent.set_ip_addresses can take longer than one poll interval (its internal probe is a 10x1s tenacity retry). SETNX

host_agent's first run on a still-coming-up network can write ``'[]'`` into the cache. If we treated that as a hit and returned '' without pub

Garbage in the cache (e.g. a partial write or a stray byte from another producer) must not crash the resolver.

If the publish fails (Redis flake), the debounce key would otherwise pin us out of refreshing for the whole TTL — even though no refresh actua

Empty cache: return '' and ask host_agent to populate. The next poll picks it up. Don't block waiting for completion.

Redis flake during cache read must not 500 the splash poll. The polling endpoint is on a 2s loop — degrading to '' lets the JS keep polling un

Redis can flake between the get() and the SETNX. Without a guard around SETNX, the polling endpoint would 500 — same 500 we'd already prevente

Retry failed must re-run only the failed row, not the whole queue. Tracked via the request count keyed by asset_id.

A second-attempt failure must NOT latch the new angle — otherwise we'd silently give up on rotation.

Sentinel -1 (set by load_browser when the boot apply failed) must trigger a retry. On success the latch advances to the real angle so subseque

Linuxfb rotation is applied synchronously at QPA init via QT_QPA_PLATFORM, so there's no analogous failure mode — the retry helper must short-

Cheap early-return when rotation is already where it should be — otherwise asset_loop would push wlr-randr on every tick.

A symlink inside assetdir pointing outside it must not be served. realpath resolves the link before the startswith check.

``Origin: http://anthias.local:8080`` posting to a server on ``Host: anthias.local:8000`` is a cross-origin request even though the host match

The user-reported case in #2867. Browser advertises an ``https://device`` Origin (TLS terminated at a proxy / HSTS leftover / browser HTTPS-Fi

Migrate button must be disabled when nothing is selected — the backend would 400 on an empty selection too, but UX-wise the button shouldn't e

The hourly Celery task is a thin wrapper over anthias_server.lib.telemetry.

One respawn-and-retry, then give up: if the freshly spawned webview dies mid-call too, the error escapes so the container restart remains the

Current contract: ``set_board_subtype`` propagates exceptions from ``rdb.set``. host_agent is a systemd unit with restart-on- failure, so a tr

Distinguishes "ran but didn't recognise" (empty string) from "never ran" (key missing). The server-side reader treats both identically, but th

When a known SBC is detected, the resolved key is the payload written to ``host:board_subtype``.

libcec can spew kilobytes of diagnostic output; the toast / API body must not carry an unbounded blob.

The ERROR: sentinel branch must apply the same length cap + last-line trim as the unexpected-stdout fallback; a hostile or chatty libcec build