Reconcile lost upload responses without replaying frame writes
This commit is contained in:
@@ -25,3 +25,19 @@
|
||||
The API cannot set coverId. Restoration guarantees a requested image switch when
|
||||
confirmed, not arbitrary cover metadata restoration. Physical screen refresh has
|
||||
no documented pixel telemetry; visual owner observation supplements cloud synced.
|
||||
|
||||
### Upload response reconciliation
|
||||
|
||||
Before an upload, the service persists its asset ID, exact SHA256/size, filename,
|
||||
existing gallery IDs and timestamp. When the response is lost, read-only queries
|
||||
look for one new image in the upload time window; only an exact downloaded-byte
|
||||
match identifies it. Ambiguous, missing or altered content remains locked for
|
||||
manual review. No upload or switch is replayed by reconciliation.
|
||||
|
||||
A proven upload completes the display only when the device reports that exact
|
||||
image and `synced=true`. If a normal display remains on its previous synced
|
||||
image beyond the sync timeout plus five minutes, two observations at least one
|
||||
minute apart record `DISPLAY_NOT_CONFIRMED` and unblock future scheduled work.
|
||||
Temporary overrides retain their restore behavior and are not automatically
|
||||
closed as failed. Legacy operations without durable upload evidence require
|
||||
manual acknowledgement; absence from the gallery alone never proves failure.
|
||||
|
||||
Reference in New Issue
Block a user