Re-enabling already-enabled assets must report the matched count, not 0 — the count comes from a matched-rows count(), not update()'s changed-

Only the ids in the POST flip — an unselected row is untouched.

Stale ids that match nothing return an info toast (not a silent no-toast 2xx) so the client's success gate keeps the selection.

A hand-built ``"a, b"`` CSV (spaces after commas) must still match every row — _bulk_ids strips each segment (Copilot review of #3048).

apply_duration on with a blank duration must NOT zero out every asset — it toasts and changes nothing (Copilot review of #3048).

apply_time on with both fields empty removes the window.

A duration-only edit on a mixed selection (2 webpages + 1 video) skips the video, so the success toast must report 2 updated, not 3 (Copilot r

Duration is applied to images/webpages but never videos — the video's duration is owned by the probe task (mirrors assets_update).

Bulk update must write the whole selection in one UPDATE, not one per row (Copilot review of #3048) — proven by counting UPDATE statements aga

The duration update must exclude video rows at the SQL level so it can't race with / clobber the probe_video_duration task. Set the video's st

Only one endpoint set — reject and leave everything untouched.

bulk_update with non-empty but unmatched ids returns an info toast (not a silent no-toast 2xx) so the client keeps the selection and the modal

Regression for #2821: the form-post view must publish the same bare ``next``/``previous`` token the viewer's command dispatch table keys on (s

RTMP is well-formed but Qt6's QMediaPlayer can't open it, so the Add modal must reject rtmp:// rather than create an asset that renders black.

An HTTP-delivered HLS manifest (.m3u8) is a live stream, not a downloadable file or a web page — it must classify as streaming.

Pasting an RTSP URL into the Add modal must classify it as mimetype='streaming' (not 'webpage'), otherwise the viewer hands it to QtWebEngine

Pasting a YouTube URL into the Add modal must NOT classify it as a webpage (the iframe embed is blocked by YouTube). The row is created as is_

youtu.be short URLs are recognised the same as full URLs.

Regression for GH #2908: deleting an uploaded asset from the UI form-post route must also remove the binary on disk. Before the fix, ``assets_

The form-level handler clamps (rather than 400s) for friendlier UX — the strict validation lives on the v2 API. 86400 (24h) is the cap shared

Both endpoints cleared = deliberate "play all day" reset.

An empty ``refresh_interval_s`` from the edit form means the operator cleared the field, which the AC for #2813 specifies must disable auto-re

allowInput lets the operator type anything into the time fields — junk must come back as an error toast, never a 500, and must not half-save t

The Start / End availability pickers post 'm/d/Y h:i K' under the default 12-hour clock + mm/dd/yyyy date format.

Regression for issue #2988: every clock format the Play from / Play until pickers can post must parse and persist.

Only one endpoint set is a validation error (mirrors the v2 API's _validate_time_window) — it must NOT silently wipe an existing window.

The webpage auto-refresh field on the edit modal — feature #2813 — POSTs ``refresh_interval_s`` alongside the rest of the form. The handler mu

The worst-case mimetypes-DB / filename combination: the host doesn't know ``image/heic`` AND the browser sent the file without a usable filena

Defensive against hosts whose mimetypes DB doesn't carry image/heic. The browser's Content-Type ride-along (or the extension fallback) must st

HEIC / HEIF / TIFF uploads route through the image normalisation task so the viewer only ever has to render formats it already supports. Other

JPEG / PNG / WebP uploads land ready-to-play — no Celery hop.

If the operator renames a HEIC to ``photo.jpg`` and uploads, ``mimetypes.guess_type('photo.jpg')`` returns ``image/jpeg`` and the file would o

guess_type returns None/non-image/video — endpoint should bail with the 'Invalid file type' message.

Video uploads return immediately with is_processing=True and enqueue ``normalize_video_asset`` so ffprobe + (potential) transcode don't block

When ``settings['auth_backend'] == ''`` (auth disabled), the documented contract is "API is fully open". DRF's stock auth classes would violat

Dashboard polls htmx fragments every 5s; if the session expires mid-poll we'd otherwise serialize the partial URL into next, dumping the opera

A POST/PUT/PATCH/DELETE that 401s would otherwise produce a ?next=/some/write/endpoint that the post-login GET redirect bounces back to → 405.

A view with extra positional args (e.g. URL captures passed positionally, or a DRF method with ``self`` plus a path parameter) must still reso

Calls with positional args that don't include a Request object raise — the decorator can't know which side to redirect.

settings['auth_backend'] == '' is the NoAuth equivalent — the wrapped view runs unconditionally so devices on the default un-authenticated con

When auth is enabled and request.user is anonymous, the decorator should bounce the caller to /login with ?next= filled in.

End-to-end: two endpoint hits within the debounce window result in exactly one enqueue. This is the failure mode that a timestamp-based check

The DEPRECATED Basic-auth log must fire at most once per (user, client_ip, path) within the throttle window — a polling Anthias-CLI hitting th

Pre-2826 callers that send Authorization: Basic must keep working; we deliberately retained DRF's BasicAuthentication. Pin the explicit succe

Wrong Basic-auth credentials must produce a deterministic 401 with a WWW-Authenticate challenge — not a 302 (which would indicate ``@authorize

On eglfs the screen blanks by the loop painting BLACK_SCREEN, so blank_display() flips the state but must not invoke wlr-randr.

package.json must not reintroduce bootstrap — the SCSS layer no longer relies on it (every component lives under `.app-*`), and pulling Bootst

Pi boards (linuxfb) get the rotation baked into QT_QPA_PLATFORM so the Qt plugin rotates the framebuffer for free.

Dialling back to 0° after a rotated launch must drop a stale QT_QPA_EGLFS_ROTATION so the respawned webview un-rotates.

Default orientation must not set QT_QPA_EGLFS_ROTATION at all.

Issue #3044: on Pi 5 the rotation must NOT be appended as a ``:rotation=N`` option — the Qt wayland plugin ignores it (that's a linuxfb-only o

x86 runs Qt wayland under cage; rotation goes through wlr-randr, NOT through the QPA plugin which has no rotation= option.

Default-orientation displays should stay on the existing QT_QPA_PLATFORM string so we don't change behavior for the 99% case who never touches

An operator who set QT_QPA_PLATFORM=linuxfb:fb=/dev/fb1 must keep that option through a rotation change — Copilot review of #2882 flagged that