Multi-line reason on the ERROR: branch — we keep only the last non-empty line so the toast stays one row tall.

When stdout is empty and stderr has content (interpreter crash, libcec writing to stderr), the last line of stderr is what reaches the toast —

Last-resort fallback: subprocess exits non-zero with no stderr and no stdout. Still has to report something — surface the returncode.

No 'OK' / 'ERROR:' sentinel — the helper still has to return something actionable. With non-empty stdout and a clean exit, that becomes the ra

Direct test of the failure-state contract: error message persisted, is_processing cleared, prior metadata preserved, and the row disabled so t

Mirrors set_board_subtype: "unknown RAM" is the empty string, distinguishable from "key never set" but treated identically by the server-side

A successful detect publishes the integer as a string — redis-py serialises bytes/str natively; integers go through ``str(int)`` for round-tri

A hand-edited anthias.conf could leave an out-of-range rotation on disk. The endpoint must clamp on read so clients only ever see {0, 90, 180,

A stale form (or direct curl) against a non-CEC device must short-circuit before the 10 s libcec subprocess ever runs.

Failed CEC commands must reach the operator via a flash message (the feedback loop called out in issue #2575).

End-to-end: change a setting, save, reload, see the new value in the input. Catches form-handler regressions where save returns 200 but the va

The Settings page must surface the entry point — otherwise the operator has no way to discover the wizard.

Settings must render top-to-bottom on the marketing viewport without any 5xx body — also the source of the ``settings@Nx.png`` capture.

Player name is the simplest free-text setting — save, reload, value sticks, then restore.

The save handler catches ValueError and surfaces it via messages instead of 500ing — exercise the except branch.

Issue #2856 — form path mirrors the v2 PATCH validation.

A dead session bus (Disconnected) is not respawn-worthy — the container restart has to bring up a whole fresh bus.

The armv7 init crash can strike between the D-Bus handshake (which made load_browser() return) and setup()'s bus.get — the name is released ag

The token input defaults to ``type=password`` so the value doesn't sit on screen for a passerby, but the operator must be able to reveal it on

With shuffle on and membership unchanged, the cap-driven refresh must still surface DB-driven field edits (e.g. duration) on the next play-thr

Regression for #2821: clicking Next / Previous on the home page must publish the bare ``next`` / ``previous`` token on the ``anthias.viewer``

A ``reload`` can arrive during the pre-Scheduler wait window (``wait_for_server`` etc.) — must not AttributeError.

Empty playlist → no displayed asset → no DB hit, no skip.

A transient DB failure must not interrupt the asset loop — we just leave the rotation alone for this tick.

Toggling is_enabled off on the displayed asset must skip.

Deleting the currently-displayed asset must set the skip event.

Pinned: a viewer rotating past an unreachable asset every few seconds would otherwise enqueue a Celery task on every rotation, each one no-opi

A missing AnthiasViewer binary raises WebviewBinaryMissingError (permanent), which the retry loop must short-circuit on.

A process that exits before the handshake surfaces as a WebviewLaunchError (a RuntimeError subclass) and does NOT terminate (it's already dead

When the handshake never arrives, the half-started process is torn down (terminate) before the error is raised — otherwise a retry would leak

Build-artifact check, integration-only because the unit job runs before bin/prepare_test_environment.sh (which is what invokes `bun run build`

Pinned regression: the prior render called ``ipaddress.ip_address(get_node_ip())`` and 500'd on 'Unknown'. The view now does no IP work at all

The splash relies on the JS poll to populate IPs. If the script tag goes missing (template refactor, CSP, etc.), the page would forever show '

Template-only check: the splash points at dist/js/splash.js rather than carrying its old inline IIFE. A template refactor that dropped the <sc

Belt-and-suspenders: assert the splash view module no longer carries get_node_ip in its namespace. A future refactor that re-imports it (and m

A .tmp older than 1h is an abandoned upload and gets swept.

Old sidecars from abandoned downloads should not pile up.

A disallowed ?mime= must not be honoured (XSS prevention).

stop must flip the module-level loop_is_stopped that start_loop reads (the old setattr(__main__, ...) wrote a dead namespace).

The ``subscriber_loop`` orchestration must call ``set_board_subtype`` *and* ``set_total_mem_kb`` before flipping ``host_agent_ready`` — otherw

run() should call subscribe(), set the readiness flag, and consume. We fake _consume to raise once it's called so the outer while loop exits

Local URIs short-circuit url_fails and check the filesystem.

A second beat tick that fires while a sweep is running must be a no-op. Without the lock, two workers would race on the same asset rows; in pr

Pathological: TTL expires while sweep A is still running, sweep B acquires the (now-free) lock with a fresh token, then sweep A finishes and h

The finally clause must release the lock so the next beat tick can run.