Every one of these was found in the pre-event audit, verified against source, and
survives to production on the current main. Grouped by what actually goes wrong.
PHOTOS DISAPPEAR
* compression.rs no longer soft-deletes on a failed derivative. The guest got a
201, watched the card appear, then watched it vanish — the row left v_feed,
find_visible_media and BOTH keepsakes, while its bytes sat on disk for 14 days
waiting for a cleanup nothing announced. No screen anywhere lists compression
failures, so recovery meant hand-written SQL that also had to re-add the
refunded quota. Now it does exactly what the ENOSPC arm beside it already did
and documented as correct: keep the row, serve the original, retry on the next
boot (bounded by derivative_attempts). `upload-deleted` is no longer emitted;
`upload-processed` is, so the card re-renders instead of sitting on a
placeholder.
* A 413 is now a reversible lock, so the blob survives. The quota moves — free
disk falls, uploader count rises — so a guest goes over it having done nothing,
and treating that as permanent meant a 400 MB video was pushed across cellular
in full and THEN deleted from IndexedDB. Gone on both sides, and unrecoverable
for an in-app camera capture that exists nowhere else.
* quota_limit_bytes gained a floor and a stable divisor. The ceiling used to
decrease monotonically all evening; it now settles at max(uploaders,
estimated_guest_count) — a config key that was seeded, validated in the admin
whitelist, and read by no code at all. The floor is clamped to what the disk
can actually back, so a full volume still yields zero rather than handing out
an allowance it cannot honour.
* Because that floor gives up the aggregate guarantee the formula used to imply,
uploads now check a hard 10 GB reserve first, independent of every quota
toggle. postgres_data, media_data and exports_data share one filesystem: the
end state was not a degraded feature, it was Postgres unable to write WAL.
THE ARCHIVE DISAPPEARS
* prune_superseded_archives runs only after the new generation lands. It ran
before the preflight, reasoning the old archive was already unreachable — true
of reachability, false of recoverability. An epoch is a value that can be
rolled back; deleted bytes cannot. Any failed rebuild left the event with NO
keepsake at all.
* The export preflight reserves the same 10 GB. `free < needed` authorised an
export sized at exactly free, which ran for half an hour and landed the box at
zero with the keepsake still unfinished.
THE APP DIES
* The feed reconcile re-reads the id set after its awaits instead of reusing one
captured up to three round-trips earlier. The new-upload SSE handler prepends
during exactly that window, so the row was both already present and absent from
the stale set — prepended twice, and a duplicate key in a keyed {#each} throws
in production, not just dev. The SSE handler and loadMore now dedupe too.
* Added routes/+error.svelte. Without it any uncaught error fell through to
SvelteKit's unstyled English 500 with no reload control — inside a chromeless
standalone PWA with no URL bar, for the rest of the evening.
THE OPERATOR IS LOCKED OUT
* admin_login verifies the password BEFORE charging the rate bucket, and a
correct password is never throttled. The old order made this a denial of
service against its own operator: every guest shares one NAT IP, the check ran
first, so five requests a minute from any phone in the room kept the bucket
full — and the escape hatch needed the admin session being blocked. A generous
separate ceiling still bounds bcrypt CPU.
THE PROJECTOR DIES
* The preload budget is now strictly inside the dwell. At the 3s option the 4s
budget could never land a commit on a slow uplink, so the wall froze on one
photo while the queue drained silently behind it.
* The wake lock retries every 30s while visible, and the page says so on screen
when the browser has no wake lock API. visibilitychange was the only retry
trigger and a kiosk never changes visibility, so one refusal — iOS in Low Power
Mode, say — was permanent.
* Caddy: /api/v1/upload/*/display joins the cacheable carve-out. The backend set
max-age=300 on it and the blanket no-store silently replaced it, so a projector
re-fetched a full-size JPEG per slide, ~2-4 GB over an evening on the uplink
the guests are uploading over.
Also removes Upload::soft_delete, now unreferenced and an unscoped footgun next
to soft_delete_in_event.
Verified: 146/146 backend tests against a live Postgres, clippy clean, 51/51
vitest, svelte-check 0 errors, eslint clean, vite build, caddy validate, compose
YAML parse.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
3.7 KiB
TypeScript
103 lines
3.7 KiB
TypeScript
// Thin wrapper around the Screen Wake Lock API. Held by the diashow page so a phone
|
|
// driving a projector doesn't sleep. No-op on unsupported browsers (Firefox, older
|
|
// Safari).
|
|
//
|
|
// Wake locks die when the document goes hidden; the page re-acquires on visible to
|
|
// keep the screen on across short interruptions.
|
|
|
|
interface SentinelLike {
|
|
release: () => Promise<void>;
|
|
// WakeLockSentinel is an EventTarget; it fires `release` when the lock ends — including
|
|
// when the OS drops it because the tab was hidden.
|
|
addEventListener?: (type: 'release', listener: () => void) => void;
|
|
}
|
|
|
|
type WakeLock = { request: (t: string) => Promise<SentinelLike> };
|
|
|
|
let sentinel: SentinelLike | null = null;
|
|
let visibilityHandler: (() => void) | null = null;
|
|
let retryTimer: ReturnType<typeof setInterval> | null = null;
|
|
|
|
/**
|
|
* How often to retry while visible and lock-less.
|
|
*
|
|
* `visibilitychange` was the ONLY retry trigger, and a kiosk never changes visibility: the
|
|
* projector tab is opened once and left alone for eight hours. So a single refusal at startup
|
|
* was permanent. Refusal is not exotic either — iOS declines Screen Wake Lock outright in Low
|
|
* Power Mode, which is exactly the state a tablet that has been sitting on a table all
|
|
* afternoon is in. The symptom is the screen sleeping mid-party and someone having to walk
|
|
* over and tap it, repeatedly.
|
|
*/
|
|
const RETRY_INTERVAL_MS = 30_000;
|
|
|
|
async function request(wakeLock: WakeLock): Promise<void> {
|
|
try {
|
|
sentinel = await wakeLock.request('screen');
|
|
// The OS auto-releases the lock when the tab is hidden. Without clearing our handle
|
|
// on that event, the visibility handler's `sentinel === null` guard would never be
|
|
// true and the lock would never be re-acquired — the screen could then sleep after
|
|
// the first time the tab lost focus. Null it on release so re-acquire can fire.
|
|
sentinel.addEventListener?.('release', () => {
|
|
sentinel = null;
|
|
});
|
|
} catch {
|
|
// User denied, or already released — nothing useful to do.
|
|
sentinel = null;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Acquire the screen wake lock, and keep trying.
|
|
*
|
|
* Returns whether the API exists at all, so the caller can tell "the browser cannot do this,
|
|
* warn the operator" (Firefox, Safari < 16.4, most TV browsers) apart from "asked for, may
|
|
* still arrive". It deliberately does NOT report whether the first request succeeded — that
|
|
* answer goes stale immediately, and the retry loop below is what actually matters.
|
|
*/
|
|
export async function acquireWakeLock(): Promise<boolean> {
|
|
const wakeLock = (navigator as Navigator & { wakeLock?: WakeLock }).wakeLock;
|
|
if (!wakeLock) return false;
|
|
await request(wakeLock);
|
|
|
|
// Re-acquire when the page becomes visible again (the OS releases the lock
|
|
// while the tab is hidden).
|
|
if (!visibilityHandler) {
|
|
visibilityHandler = () => {
|
|
if (document.visibilityState === 'visible' && sentinel === null) {
|
|
void request(wakeLock);
|
|
}
|
|
};
|
|
document.addEventListener('visibilitychange', visibilityHandler);
|
|
}
|
|
|
|
// The kiosk case: visible, no lock, and no visibility change ever coming. Cheap enough to
|
|
// run all evening — it does nothing at all once a lock is held.
|
|
if (!retryTimer) {
|
|
retryTimer = setInterval(() => {
|
|
if (document.visibilityState === 'visible' && sentinel === null) {
|
|
void request(wakeLock);
|
|
}
|
|
}, RETRY_INTERVAL_MS);
|
|
}
|
|
return true;
|
|
}
|
|
|
|
export async function releaseWakeLock(): Promise<void> {
|
|
if (sentinel) {
|
|
try {
|
|
await sentinel.release();
|
|
} catch {
|
|
// ignore — release after release is fine
|
|
}
|
|
sentinel = null;
|
|
}
|
|
if (visibilityHandler) {
|
|
document.removeEventListener('visibilitychange', visibilityHandler);
|
|
visibilityHandler = null;
|
|
}
|
|
if (retryTimer) {
|
|
clearInterval(retryTimer);
|
|
retryTimer = null;
|
|
}
|
|
}
|