fix: defer background cleanup until pending display is confirmed

.env.example

@@ -28,5 +28,4 @@ SYNOLOGY_PHOTOS_CERT_SHA256=
 
 # Build-only mirror hosts; official defaults work outside mainland China.
 # For mainland NAS builds: source ./deploy/build-cn.env before build-verify.sh.
-DEBIAN_MIRROR=deb.debian.org
+ALPINE_MIRROR=dl-cdn.alpinelinux.org
-DEBIAN_SECURITY_MIRROR=deb.debian.org

.github/workflows/verify.yml

@@ -15,8 +15,7 @@ jobs:
       DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
       CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
       CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
-      DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
+      ALPINE_MIRROR: ${{ vars.ALPINE_MIRROR }}
-      DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
       - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5

.gitignore

@@ -16,8 +16,6 @@ dist/
 
 .mypy_cache/
 
-build-cache/debs/*
-!build-cache/debs/.gitkeep
 build-cache/wheels/*
 !build-cache/wheels/.gitkeep
 

Dockerfile

@@ -1,36 +1,24 @@
-ARG PYTHON_BASE=python:3.14.5-slim-bookworm@sha256:ec58d916f9e24a6035cab2bdf07f6206c4cc092a16613c60597534711332d9d6
+ARG PYTHON_BASE=python:3.14.8-alpine3.24@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
 FROM ${PYTHON_BASE} AS prepared
-ARG DEBIAN_MIRROR=deb.debian.org
+ARG ALPINE_MIRROR=dl-cdn.alpinelinux.org
-ARG DEBIAN_SECURITY_MIRROR=deb.debian.org
 ARG TARGETARCH
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 TZ=Asia/Shanghai \
     DATA_DIR=/data CONFIG_DIR=/config
 WORKDIR /app
-# CJK fonts intentionally retained for readable Chinese rendering.
+# Preserve the existing FONT_PATH contract for deployments and Chinese rendering.
-RUN --mount=type=cache,id=frameflow-bookworm-apt-${TARGETARCH},target=/var/cache/apt,sharing=locked \
+RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|https://${ALPINE_MIRROR}/alpine|g" /etc/apk/repositories \
-    --mount=type=cache,id=frameflow-bookworm-lists-${TARGETARCH},target=/var/lib/apt/lists,sharing=locked \
+    && apk upgrade --no-cache \
-    --mount=type=bind,source=build-cache/debs,target=/build-debs,readonly \
+    && apk add --no-cache font-noto-cjk tzdata \
-    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && mkdir -p /usr/share/fonts/opentype/noto \
-    && printf 'Binary::apt::APT::Keep-Downloaded-Packages "true";\n' > /etc/apt/apt.conf.d/keep-cache \
+    && ln -s /usr/share/fonts/noto/NotoSansCJK-Regular.ttc /usr/share/fonts/opentype/noto/NotoSansCJK-Regular.ttc \
-    && sed -i "s|http://deb.debian.org/debian-security|https://${DEBIAN_SECURITY_MIRROR}/debian-security|g; s|http://deb.debian.org/debian|https://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
+    && addgroup -g 10333 frameflow && adduser -D -H -u 10333 -G frameflow frameflow \
-    && apt-get -o Acquire::Retries=3 -o Acquire::https::Timeout=60 update \
-    && apt-get -y --no-install-recommends upgrade \
-    && if [ -f /build-debs/fonts-noto-cjk.deb ]; then \
-         font_version=$(apt-cache policy fonts-noto-cjk | awk '$1=="Candidate:" {print $2}'); \
-         font_sha=$(apt-cache show "fonts-noto-cjk=$font_version" | awk '$1=="SHA256:" {print $2;exit}'); \
-         test -n "$font_sha"; \
-         echo "$font_sha  /build-debs/fonts-noto-cjk.deb" | sha256sum -c -; \
-         apt-get install -y --no-install-recommends tzdata; \
-         dpkg -i /build-debs/fonts-noto-cjk.deb; \
-       else apt-get install -y --no-install-recommends fonts-noto-cjk tzdata; fi \
-    && groupadd --gid 10333 frameflow && useradd --uid 10333 --gid 10333 --no-create-home frameflow \
     && mkdir -p /data/images /data/generated /data/cache /config \
     && chown -R 10333:10333 /data /config
 COPY requirements.lock ./
 COPY scripts/ci-install.py /build-tools/install.py
 ARG DOCKER_PIP_INDEX_URL=https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple
 ARG DOCKER_PIP_FALLBACK_INDEX_URL=https://pypi.org/simple
-RUN --mount=type=cache,id=frameflow-pip-py314-${TARGETARCH},target=/root/.cache/pip,sharing=locked \
+RUN --mount=type=cache,id=frameflow-pip-py314-musl-${TARGETARCH},target=/root/.cache/pip,sharing=locked \
     --mount=type=bind,source=build-cache/wheels,target=/build-wheels,readonly \
     if [ -f /build-wheels/SHA256SUMS ]; then \
       (cd /build-wheels && sha256sum -c SHA256SUMS) \
@@ -55,6 +43,7 @@ WORKDIR /app
 ARG BUILD_COMMIT=development
 ARG BUILD_TIME=unknown
 ENV BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
+LABEL org.opencontainers.image.title="PIGWay Frame Flow" org.opencontainers.image.version="0.1.23" org.opencontainers.image.revision=$BUILD_COMMIT
 USER 10333:10333
 EXPOSE 18787
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \

NOTICE.md

@@ -21,7 +21,8 @@ for endpoint coverage. Their source code was not incorporated into runtime.
 
 FastAPI, Starlette, Uvicorn, Requests, croniter, PyYAML, Pydantic and their transitive
 dependencies retain their respective upstream licenses. Pillow uses its upstream
-HPND license. Debian Noto CJK fonts retain their font package license.
+HPND license. Noto CJK fonts use SIL OFL 1.1; the license is included in
+`vendor/noto-cjk-OFL-1.1.txt`, with copyright notices retained in font metadata.
 Development dependencies (pytest, Ruff, mypy, pip-audit, HTTPX2, Playwright) retain
 their upstream licenses and are not shipped in the runtime image.
 

RELEASE_NOTES.md

@@ -1,9 +1,7 @@
-# pigway-frame-flow v0.1.20
+# pigway-frame-flow v0.1.23
 
-统一开源许可证、贡献和安全反馈入口；完善当前版本的文档导航、源码分发和校验和。插件 ZIP 携带许可证。运行功能边界保持项目首页所述。
+- 自动调度、自动重试和后台清理在同一设备已有图片等待同步时排队，避免 /upload 激活新图或删除操作更新云端计数，干扰尚未确认的目标。等待沿用现有同步超时；保留用户手动切换与优先级行为。
+- 在操作回执中保留最多 12 条设备读回状态及受限错误字段，记录实际图片、同步、在线和心跳，供定位未确认原因；不保存原始异常、URL 或凭据。采样不延长同步超时，原始上传证据保留。
+- 沿用安全基础镜像、完整构建和固定镜像 ID 的预构建验收流程；不重发不确定的设备写入。
 
-本轮 585 项 Python 测试通过。源码语法、文档入口、打包和校验和检查通过；生产运行状态以实际部署验收为准。
+验证：601 项测试、Ruff、格式和 mypy 通过。历史设备物理刷新状态无法从缺失的原始采样追溯，不能将此版本描述为已修复所有网络或设备故障。
-
-Ruff、格式、mypy、25 项锁定依赖的漏洞检查通过；AMD64 Docker 构建和两轮隔离启动/重启只读冒烟验证通过。
-
-Docker 构建增加发行版安全更新，清除可修复系统包告警；仍有上游未修复包级告警，分析及默认部署边界见 [安全说明](SECURITY.md)，不宣称映像零漏洞。

SECURITY.md

@@ -14,12 +14,8 @@ A useful private report includes the affected version, deployment mode, required
 permissions, impact, and minimal steps using mock data. Do not test on another
 person's deployment or write to real frames without explicit authorization.
 
-## 当前容器基础系统扫描
+## 当前容器映像检查
 
-2026-10-18 使用 Trivy 0.76.0 扫描当前映像。在构建阶段应用 Debian 安全更新后，可修复的 HIGH/CRITICAL 项已清除；仍有 63 条发行版包级告警，合并为 16 个 CVE，当前 Bookworm 无可用修复版本。不能将 Python 依赖检查通过描述为整个映像零漏洞。
+v0.1.21 使用官方 Python Alpine 3.24 基础映像并固定摘要，构建时应用 APK 安全更新。2026-10-18 使用 Trivy 0.76.0 扫描构建的 Linux AMD64 映像，涵盖操作系统和 Python 包、全部严重级别，未检出已知漏洞；未配置漏洞忽略规则。该结果是当日漏洞库快照，不是未来无漏洞的保证，也不代表旧运行容器已升级。
 
-- [CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853) 针对 MiniZip；Debian 明确 Bookworm 的 zlib 未构建相应代码，本映像也未安装 MiniZip。
+基础映像更新后须重新构建并复扫。默认非 root、只读根目录、清空 capabilities 和 no-new-privileges 的部署限制继续保留。中文字体、第三方许可证和依赖元数据均保留；不以删除包清单掩盖告警。
-- [CVE-2025-7458](https://security-tracker.debian.org/tracker/CVE-2025-7458) 需要攻击者执行特制 SQL；Frame Flow 不接受任意 SQL 或上传外部 SQLite 数据库。FTS5 相关 [CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)、[CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824) 的匹配查询也未被应用使用。此结论不适用于自行替换数据库或修改服务 SQL 的部署。
-- 其他告警涉及挂载/命名空间工具、systemd-homed、ACL、ncurses、Perl/LZH CLI 及 DTLS；应用未调用这些路径。默认 UID/GID 10333、只读根目录、清空 capabilities、禁提权和独立数据卷仍是必要边界。
-
-本轮未发现这些遗留项在默认应用路径中的可达利用入口，不将该判断扩展为基础系统已修复。后续基础映像更新仍须复扫；不得为消除扫描数字而混装其他 Debian 发行版包或删除许可声明。

SHA256SUMS

@@ -1,57 +1,55 @@
 c2792b2c75880ff09822804632b1b3b6dd6190b38841b8c3567bb1b7e7b59a8c  .dockerignore
-fe4b8e57c14d6f4df261de0ec274f33153def558227a47f38c3f91d5cfc77f80  .env.example
+d20031a8e861a0f3e19b7750ddb53bc84c480c469c44a70ecdf8261ec05431c0  .env.example
 0c7f4585d62a8d35bfc22e0bebdf7a479a179122b2b092bfe434e3038cddd3d5  .gitattributes
 b45d35d737f119a70bf40cb1f9626ff80772ed7913cb35f6e9b870d6ada01a15  .github/workflows/community.yml
-c93afa220096b0a3a27115e74617db9dbe97e98c6a3735a0abfb528cdca7e668  .github/workflows/verify.yml
+d3ad09bdc5dc60c41a774e1cad43f3e3f8ae5c851303ae6ec2aac030392a2939  .github/workflows/verify.yml
-342242379194ca16021542722407a42858f22685293d16162d0e6fe004cbd62c  .gitignore
+3931cc314019760a582e0914e2d9c0f3b862a004d0a30d374900edcad5f599e5  .gitignore
 4b4ed4926a350cbeb71436541b4566e4ba7d2494ac95236b88827a9f5dd171c2  CONTRIBUTING.md
-6588694aee24d5e662061be78027a049f6726d50dd99ef00a60fba05051ef299  Dockerfile
+c6fc984a1ca46cbd3e06de4591e41d21e4eb592416385d4000ade8fd570aad0c  Dockerfile
 6eb7728e6e73f9568ca6fd5ad6383d13ffc638f2870fefa2d86f72f39685c0fc  LICENSE
-ef0d1ecd6427325fc92324032fbf7b880624a68629acbaf430cd8be80c73b698  NOTICE.md
+250a2bcec248b074786d90e0329874628d70d5a0fe3b4fba47c8c57d4f84dcce  NOTICE.md
 26ad0d9063c0ee843f0f532604b8fd66e8b39fd72d129595ed078677c0d6d13c  README.md
 ee00cb267b38485f1e574d610f0a57b51d4ae575731a18e57d06a7c43dc0a8b0  README.zh-CN.md
-3c0ab38958a3bdb17ee95b5642c2ee691affc3da44252a5c4a3048ebf7860fe4  RELEASE_NOTES.md
+5ec5770a6e0202d981c5719de8cb09fefbd5d0a79b537d949b91ec67c8bce72b  RELEASE_NOTES.md
-d1233db9c8da6d391028e1e515813cd45ce8d8f97e48087daa325a61789987bc  SECURITY.md
+6a0c85c8d52a2d4a3b779dce306a93c4efc4dfe3ab3b23e4a6a3bb7c55079910  SECURITY.md
-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  build-cache/debs/.gitkeep
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  build-cache/wheels/.gitkeep
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  config/.gitkeep
-a897bf4a9f95f3e7b96b286a4bf7d124bb4a50fd47a16c6a3d9fbb70bce47f15  deploy/Dockerfile.runtime-update
+dff739157875c8a70235c4994df868afc6824e0d3861b2716ac28014bb38144f  deploy/build-cn.env
-4cc0b0813f527ac0ca311993f791005de5c8e89e6810ecbf5cf058e58e2fe572  deploy/build-cn.env
 3683a3cfb63f08cc9e6144162117ab68c607d38bdeaae0e82cb418e812a450f2  deploy/compose.ubuntu-photos-api.yml
 d68d727e01c592c098fde71a900bcdd234a9ca6610d0799019a6f585983b4494  deploy/devices.yml.example
 fd53125a5359dcae1d81e95b8447aac755270f9aeb354d3e1140d7fccb57c42e  deploy/docker-compose.photos.yml
 4464545a9d91bbc9fff9cd9941db63f44fa61120caca426687d1ed06635cc3e6  deploy/organized-photos-source.json
-582dae3db4a08192d714e81e5e8234b170b4ac4231faf251b2c26eeec54f0942  docker-compose.yml
+f78d6c3d40e6c5246601bb99c2b46eef91e883a8f83841d85c925394708af0c0  docker-compose.yml
 30d3e705870ebb012ce122bd7d8f95192d86664c4d2bb45a3169c86988fbaf72  docs/AUTOMATIC_COLLAGE.md
-6b602b686db5b25060f91cfecf05a840a09ee5b2a6d5099636cb3f47880a4a4d  docs/BUILDING.md
+e897b531b5ec4c2411fb11c4ea38808a6305e066782fe6112953f1cf63cef78f  docs/BUILDING.md
-c14983d5c65775ad80244fcbb77fe5c0c4a413cc27945b7184bbc923a53d38a8  docs/EXTENSIONS.md
+d9f07164c75c757e85f4ace2b55deaf82b8b904216c5222be6c0e3ab7b28cb36  docs/EXTENSIONS.md
 1d8c5f79eff3115b1cd13d8f63fff1332b80d1fe1bec6b0f2713b5f80b0cbf67  docs/KOKONNA_RECOVERY.md
-3b4d24d633dea8474a6a7b8868c5afdd37a5205df32356d3967cf838bcafdba9  docs/NAS.md
+0fe1896a53cef4cfd2e380a0b979eceda493733082a9b56c3d7e89e7f62a65b3  docs/NAS.md
 3280bddcbe2d2721bb7efeb0eb2ec03d9d5ef867c69f3e70066b69f1ad5926e2  docs/PHOTO_SOURCES.md
 edf44436fd044561539c48480c481e66c1a38164f51ba5226cde04c756f7bacb  docs/PHOTO_SOURCE_CONNECTIONS.md
 4b00d08eb5a2425b205af13b87f9be04dd6870a734b42463a3e075658039dac9  docs/PUBLICATION.md
 5fe4641e75e0746929f71256c6ff11116c777cca8d4288ccc2d7aee91bd7a6ac  docs/README.md
 5eb19e7e4ed1ceddbdf388fd55697e40f1b7ecd9a4fbdf8ab485132cc684dcb2  docs/REAL_DEVICE_TEST.md
 bfc38b889fa966031e195c3131db1d4a713e0dc35c644e3047c7ed94f2354700  docs/RESEARCH.md
-6772ddfd79b28bb52ce469e40188f8781f66275bdf4b84861f81c32a87aea6eb  docs/SYNOLOGY_PHOTOS_API.md
+fac36f986e1a7a331d3669aa8e2013e6c0ea7a99c16a61ba3ff573e836aa87e1  docs/SYNOLOGY_PHOTOS_API.md
 ac0481196e593ff9cca2e5133ff41fb3614268e6a10728a0deca3ad3bfb80b34  docs/integrations/TICKTAR.md
-757a4d87aec789054dc5268d314cd218f6d7cab49082cfacef55f9860d2362b0  docs/openapi.json
+1794e3b09fa4eb9fb59cd18f729f49d6387885fc97a0b4f227e825cc49603554  docs/openapi.json
 54bf7061e0626900ce35e19e81efc5c32c8fd6a0438bdad68f494e1ce81616d4  docs/research/KOKONNA_ACCOUNT_CAPABILITIES.md
 a07cbe71571c6e2d5a1b94897bd63321c74675c05d15438c4964eef39db0fd76  docs/research/KOKONNA_CONTENT_SUBSCRIPTIONS.md
 ec53d587b855be84283c50f8fb45be62a4c1caba78b28d436a8260fd171943a2  docs/research/KOKONNA_LOCAL_CONTROL.md
 2a68fe95ba4afc24aec6abd3e6ab24a360eb6bc3005ab0fefd696190915d76c1  docs/research/KOKONNA_WIDGET_CATALOG.json
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/__init__.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/api/__init__.py
-632e8be140d1c206388b84e6e08039fc42d6449e83ea23b58d7a57c3404a8747  pigway_frame_flow/api/app.py
+f28c2277b30d583fb7702e425ca99fe229c7e7bdc45b6142fc1bfe2e989440a6  pigway_frame_flow/api/app.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/core/__init__.py
 fbadf6beaf25b9670dcbf125ec9d192188cf9e076ee4d4a0b5decdaf3834417c  pigway_frame_flow/core/accounts.py
 818e8fb29d22c13159a6cb22bcbc6b9e211a8a1301588126eb192ac4ed71441b  pigway_frame_flow/core/auth.py
 8f2220fa90b0dc2e45df2023dc5ac695efe55361644ef266829553c99151949b  pigway_frame_flow/core/registry.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/display/__init__.py
 81effa34d6c452579cfa65781909f7c5a9e8ddad136e4c47ee0704939851879a  pigway_frame_flow/display/cloud_library.py
-558d2e2111e3dea1917eaa4f81d7c2dac3b47af3eda1cdc9426af4bf9bc570dd  pigway_frame_flow/display/recovery.py
+5e7e272e671a6d01d9b677416c77967ca488b4e2aa559f4211cf0de4ba1e88bc  pigway_frame_flow/display/recovery.py
 e1e4ae3ba321ae7282c5a4e061c52f24d2a6a6e3d4637e69e4b1fbd05004f5f6  pigway_frame_flow/display/retention.py
-1ee9ee8745dc497dadcc20e5e238c78f6c228f7f8a4ed310ced32f9be55b512e  pigway_frame_flow/display/service.py
+6b09243081d53fb6c8a780d77e064f0685267c61e05f514262c8514ee3a36fda  pigway_frame_flow/display/service.py
 0975b24488be19f24e768c4c76d9f3c0348417c1351c4e410897da00f7be6656  pigway_frame_flow/display/upload_reconciliation.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/drivers/__init__.py
 9a8386ef368a6df7fd8cb23bcc442c28e784729a5ce4a78911ad86245d5c5794  pigway_frame_flow/drivers/base.py
@@ -84,7 +82,7 @@ a518965aa4db9abeb60865c315229c3053c8e9edd26d80f24dc0af0528bad9e6  pigway_frame_f
 2a68fe95ba4afc24aec6abd3e6ab24a360eb6bc3005ab0fefd696190915d76c1  pigway_frame_flow/integrations/kokonna_official/widget_catalog.json
 aea594fb4e4c9a6e2094d4d7973eb627ac02fb632811b2d1a558a0ee1cd12e77  pigway_frame_flow/integrations/kokonna_official/widgets.py
 1fe53f4bfb407b8db774fe730131ecf1213e16d752a3506c4c56b46365ea14e8  pigway_frame_flow/main.py
-fb41e20b181815a62e213a1d179f6479b155586fc7000c0a103737ddc16b1c83  pigway_frame_flow/models.py
+c3fbe6af9d22989f1dc2fa980f64cf51672d7d45c28c5c8e88ba121a9709b578  pigway_frame_flow/models.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  pigway_frame_flow/providers/__init__.py
 b7a6cb8eb40d8dedfbce18777f8fbd433a174f14bcdadf498bd834132aa568fd  pigway_frame_flow/providers/cloud_drives.py
 58b070f0c814d639a4a912d079479d751d459816d59f2199d0be03e4d573ec3b  pigway_frame_flow/providers/external.py
@@ -122,12 +120,12 @@ c43faa235848bec6370d7a3d8a7b3475cbd8eb4a6e494518dfaf160ca8f77bfa  pigway_frame_f
 d7d55b06ead173b4c23a277fa39800cadfc18f1163c500e8617cfc1f4ee0dea9  pigway_frame_flow/web/extensions.js
 fe19e508ad60fab0ab4ca61f5d966f8340143e89f1572de00e78b3f1fed8384b  pigway_frame_flow/web/features.js
 3c4e3be6321d40547d45724fc3c54af090ebbbc2a41dec717966596577c72c5d  pigway_frame_flow/web/i18n.js
-0ff0e5c80f6cfb3dc71a63813e01fd8cde5355b0f135a4fbb2781d43383a569f  pigway_frame_flow/web/index.html
+2086605c67bb818b5cabae20ea4d9ccecb17e350c59cdb0d0f2ba1b70f7c8601  pigway_frame_flow/web/index.html
 0609e796b5ca8346405b1bb6e65ac9f88ee163f7a93024d96d54d4e6ab96ba41  pigway_frame_flow/web/style.css
 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  pigway_frame_flow/web/swagger-LICENSE
 050bc415ee7048dcd881682678f720264e7da5e373f7461d7c58c755305255f7  pigway_frame_flow/web/swagger-ui-bundle.js
 1ac324f7dcd27e4b9386b4bd6421271ec147e922a22c05ba24b11515e9aa6321  pigway_frame_flow/web/swagger-ui.css
-a363adb54463d0345cd4e8d0ebe6cac758856e8c0e1d4da49468ddee1ca1aec6  pyproject.toml
+97aaf8a332dcf472b8933b0a39aa329865133171e828892d932d29694e011ea5  pyproject.toml
 d34ac82e4c3feacd38546aa2f0a4491ab17ddbf3ad8f489375783166d78923f0  requirements.lock
 ae264ad19391bb2515def85963f39458cfa75a8611ff54e5329106c35bd8cc6e  scripts/build-verify.sh
 43e8345ac5f29c2a5d1fa751c0e7c963b00b5391817393541e72c52919f0f2b4  scripts/check-compose-remote.py
@@ -138,9 +136,9 @@ a11e660a0343f2631c1a3dd0aa28471db827fb1f43d1af4217f51209aa3afe32  scripts/create
 cdabf30144ea089ae8e64228f6762951f53d4fe8c191673fb5676331d249473d  scripts/migrate-photos-api.py
 80813607835c19d321085fac4cabb17d865d98ed62a09b7f45195ac48bec94a8  scripts/package-nas.py
 b0b877cfbb2bdf830e2e41097c2057538bb9d0b61a3c39952fe505d910cd5c29  scripts/persistence-check.py
-3213ef2c17dbcf7423b04440794b842c691dc65616d56c1e1a85dd286ee34ada  scripts/production-deploy.py
+b7247c5590fe17ae461311f2fbdbeda0daa8a34c0804cef22a314c7ff8f4c389  scripts/production-deploy.py
 11627ecbd8a3be01aa079bdf6166b4368e670f5ad4a165b5971754b8187bbc2c  scripts/run_local.py
-0fe19e94ffa4e9ff56d4f4a079b19f74991b35f0e18679ac793e8de38ecc3833  scripts/server-release.py
+68fc95bb91e5529135a669a33450120465109222a4ce9bd7c3e2842c814626f5  scripts/server-release.py
 1fc16c43485a60a05012322cb1e4a219309dbd7e11f002f510602beea743ce30  scripts/smoke-test.py
 1236d3b2d27559cbe73a27dcf56248ef3c60404c6fb21453caa7225570d4ac45  scripts/ui-audit-regressions.cjs
 57a79a534a71442f5e3a70ed9ff96f426007d9f6dd0bb9b1f5d79eac773d2254  scripts/ui-auto-collage.cjs
@@ -209,10 +207,10 @@ f14bad45534041ff0b7dead21d2952ec9d6c60e9f718ab5393bdf5a47b2a6d3e  tests/test_pho
 ab773ca6868ec007786e7142d5425663a5c8da35b9aa90837ac8e46b51e51507  tests/test_production_bootstrap.py
 fee152c5f6eaeda712d38cf88a79213f5e885ba323eb15dfa5a12cf4c88028c3  tests/test_production_deploy.py
 f0601f5ed89e8a14a4584a9683611aa7510a964f50a642348b8ab6c62df72278  tests/test_publication_security.py
-0ed189d3469097aa7538325d418425e0c7a3ccc8a285bcf4c2ac10658af4b0df  tests/test_recovery.py
+915992a2ef9aeb8ae5c688d5dd50c6acd37ba726eb5aff1a0df991ffe374d94e  tests/test_recovery.py
-072e8ca2fa68ca73fb078b107ced96ea683652410b286017db883c97608d78f6  tests/test_retention.py
+e0a426eed6f1b6f59207b4de7d8286b6852550bfa28ad30e20f7e911ad9865ee  tests/test_retention.py
 ab2cd30163453fe571b55c30cb26dc047a104a536ec01d2c64aa2bc91996ba11  tests/test_scheduler.py
-5f25f608f13f96b245d6963c02a98add679c6e7d70d398ebb5c3c49b38fbeda8  tests/test_server_release.py
+0cccc08adf35a06dbf704eb5c35966bc1c3de0ce39d3014efd7ca751253ce79f  tests/test_server_release.py
 a7ae1b4a64bfcbcf2b7ff795b30ba91db24ee2ad7544073dca2bf43d021cd266  tests/test_smoke_dependencies.py
 2624fb6ca01f32d93499d7d771144dcaa2850e5f77b2ac3b7b566891b5e9d283  tests/test_synology_photos.py
 ca98469f6a6b8b49c36a00657ea1a81775c3496e1fbdd5e38eb4d5298b5936b4  tests/test_synology_photos_api.py
@@ -224,5 +222,6 @@ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  vendor/__init_
 4cae8606769fdb590c427bc1716a871017bf22d91aabf8a52513bf126cfb847f  vendor/guooscar_kokonna.py
 63c7a2f1a6adf98e7fb83a83ae2d6a2dddcecd7bce4d7de25dd6f26bd496019f  vendor/guooscar_protocol.py
 e5f5b7a5955f2438da131859a08c9d78cda3718ada8a9365a74cbbb9ac5e7853  vendor/metadata.json
+6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2  vendor/noto-cjk-OFL-1.1.txt
 e8cf7d54ea46c19aba793983889b7f7425e1ebfcaaccec764a7db091646e203c  vendor/paho-mqtt-EDL-1.0.txt
 57938f47d5f05f7de119b17fcecd4509c5d13644c8d5f43db30e45684d09d07e  vendor/swagger-metadata.json

deploy/Dockerfile.runtime-update

@@ -1,33 +0,0 @@
-# Reuse a reviewed image only when the locked Python dependencies are identical.
-# For a fresh installation use the repository's main Dockerfile instead.
-ARG BASE_IMAGE
-FROM ${BASE_IMAGE} AS prepared
-# Cleanup runs only in the disposable preparation stage.
-USER 0
-COPY requirements.lock /app/requirements.expected.lock
-RUN python -c "from pathlib import Path; assert Path('/app/requirements.lock').read_bytes() == Path('/app/requirements.expected.lock').read_bytes(), 'Dependency lock changed; use the full Dockerfile'"
-COPY pigway_frame_flow /app/pigway_frame_flow
-COPY vendor /app/vendor
-COPY LICENSE NOTICE.md /app/
-# Publish only the cleaned filesystem, without retaining build-stage layers.
-RUN rm -rf /usr/local/lib/python*/site-packages/pip \
-      /usr/local/lib/python*/site-packages/pip-*.dist-info \
-      /usr/local/lib/python*/ensurepip \
-    && rm -f /usr/local/bin/pip /usr/local/bin/pip[0-9]* \
-    && find / -name .DS_Store -type f -delete
-
-FROM scratch
-COPY --from=prepared / /
-ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin LANG=C.UTF-8
-ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 TZ=Asia/Shanghai \
-    DATA_DIR=/data CONFIG_DIR=/config
-WORKDIR /app
-USER 10333:10333
-EXPOSE 18787
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:18787/health',timeout=3)"
-CMD ["python", "-m", "uvicorn", "pigway_frame_flow.main:app", "--host", "0.0.0.0", "--port", "18787", "--workers", "1", "--no-access-log"]
-ARG BUILD_COMMIT
-ARG BUILD_TIME
-ENV BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
-LABEL org.opencontainers.image.title="PIGWay Frame Flow" org.opencontainers.image.version="0.1.19" org.opencontainers.image.revision=$BUILD_COMMIT

deploy/build-cn.env

@@ -1,5 +1,3 @@
-# Shared mainland-China build profile; source this file before Compose builds.
+# Shared mainland-China build profile; source before Compose builds.
-# Nonempty environment / Gitea repository variables override these defaults.
+ALPINE_MIRROR=${ALPINE_MIRROR:-mirrors.tuna.tsinghua.edu.cn}
-DEBIAN_MIRROR=${DEBIAN_MIRROR:-mirrors.tuna.tsinghua.edu.cn}
+export ALPINE_MIRROR
-DEBIAN_SECURITY_MIRROR=${DEBIAN_SECURITY_MIRROR:-mirrors.tuna.tsinghua.edu.cn}
-export DEBIAN_MIRROR DEBIAN_SECURITY_MIRROR

docker-compose.yml

@@ -7,8 +7,7 @@ services:
     build:
       context: .
       args:
-        DEBIAN_MIRROR: ${DEBIAN_MIRROR:-deb.debian.org}
+        ALPINE_MIRROR: ${ALPINE_MIRROR:-dl-cdn.alpinelinux.org}
-        DEBIAN_SECURITY_MIRROR: ${DEBIAN_SECURITY_MIRROR:-deb.debian.org}
         DOCKER_PIP_INDEX_URL: ${DOCKER_PIP_INDEX_URL:-https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple}
         DOCKER_PIP_FALLBACK_INDEX_URL: ${DOCKER_PIP_FALLBACK_INDEX_URL:-https://pypi.org/simple}
         BUILD_COMMIT: ${BUILD_COMMIT:-development}

docs/BUILDING.md

@@ -2,50 +2,30 @@
 
 ### Build networking and cache
 
-The Dockerfile retains the pinned Python base, locked Python dependencies,
+The runtime uses an official Python 3.14 Alpine 3.24 image pinned by digest,
-`fonts-noto-cjk`, Debian repository signature checks, and offline artifact
+locked Python dependencies, and `font-noto-cjk` for Chinese rendering. APK
-SHA256 verification. Production uses `scripts/build-verify.sh`; CI uses `scripts/ci-compose-verify.py`.
+repository signatures and offline wheel SHA256 checks remain enabled.
-Both build the same Dockerfile with BuildKit and retain `docker compose build --pull`.
+Production uses `scripts/build-verify.sh`; CI uses `scripts/ci-compose-verify.py`.
+Both build the same Dockerfile with BuildKit and `docker compose build --pull`.
 
-APT mirror hosts are configurable through `DEBIAN_MIRROR` and
+`ALPINE_MIRROR` accepts a mirror host (without scheme or path), defaulting to
-`DEBIAN_SECURITY_MIRROR` (hosts only, without scheme or path). Defaults are
+`dl-cdn.alpinelinux.org`. For mainland-China builds:
-`deb.debian.org`; HTTPS is used for both Debian and security repositories.
-For mainland-China NAS builds, use the shared profile:
 
 ```sh
 . ./deploy/build-cn.env
 ./scripts/build-verify.sh
 ```
 
-CI loads this same profile, using Tsinghua TUNA for both repositories unless
+CI uses this profile; the Gitea `ALPINE_MIRROR` repository variable can override
-Gitea repository variables `DEBIAN_MIRROR` / `DEBIAN_SECURITY_MIRROR` override
+it. APK upgrades available packages during a fresh dependency-layer build.
-it. Production may also set the two hosts directly in `.env` when calling the
+Use `docker compose build --pull --no-cache` to refresh OS packages explicitly.
-build script without the profile. An alternate mainland mirror is
-`mirrors.ustc.edu.cn`; availability and throughput depend on the Runner network.
-No fallback disables signature verification or removes packages.
 
-Layer order stays: pinned base → APT/font dependencies → `requirements.lock`
+Layer order is pinned base → APK/fonts → requirements → Python dependencies
-→ pip dependencies → application/vendor source → build metadata.
+→ application source → metadata. BuildKit caches pip downloads separately for
-A source-only change therefore reuses the APT and pip layers, provided the
+musl and architecture. Optional `build-cache/wheels/` must contain compatible
-same builder, base digest, mirror arguments, and optional offline artifacts
+musllinux wheels and their SHA256 manifest; empty-cache builds work normally.
-are used. Changing the lockfile rebuilds pip and later layers, not APT.
+Do not reuse Debian/manylinux wheels on Alpine. Caches are disposable builder
-Changing the mirror or APT instructions rebuilds APT and later layers.
+resources and are not runtime mounts or dependencies.
-
-Previously an APT layer miss redownloaded indexes/packages, and pip used
-`--no-cache-dir`. Now locked BuildKit mounts retain APT indexes, downloaded
-`.deb` files, and pip downloads/wheels outside the final image. Debian's
-`docker-clean` hook is disabled so it cannot discard cached packages.
-Re-executed APT steps still run `apt-get update` and validate repository
-signatures; cached packages and pip artifacts can avoid repeat large downloads.
-The initial build after this Dockerfile change will miss dependency layers;
-subsequent builds benefit. No measured speedup is claimed before CI completes.
-
-Caches belong to the Docker builder, not the ephemeral CI workspace. Keep the
-NAS Runner's builder storage across jobs; removing the builder, pruning caches,
-or using a fresh Docker daemon loses the benefit. Cache mounts are disposable:
-an empty cache still builds correctly. `--pull` remains enabled; a pinned base
-digest check alone does not invalidate dependency layers. To deliberately
-refresh installed APT versions, use `docker compose build --pull --no-cache`.
 
 ### CI with a host Docker socket
 
@@ -94,10 +74,14 @@ certificate environment settings, and proxy settings remain in effect.
 These `CI_PIP_*` settings apply only to the Job's pip install. They are not
 passed into Docker build arguments or persisted into the production image.
 The Dockerfile keeps its own cached/offline dependency installation and logs
-the Docker pip index host for online installs. Debian mirror variables affect
+the Docker pip index host for online installs. The Alpine mirror variable affects
-APT only and are loaded later in the Docker verification step.
+APK only and are loaded later in the Docker verification step.
 
 If dependency installation fails, the always() cleanup step still executes.
 It skips the Python/PyYAML cleanup script when no CI Compose manifest exists,
 as no Docker verification resources have been created at that point.
 
+
+### Verified prebuilt production image
+
+When the production host cannot reach the registry, build the complete Dockerfile in a trusted build environment and transfer it with `docker image save` / `docker image load`. Supply the immutable `sha256:` image ID privately as `FRAME_FLOW_PREBUILT_IMAGE_ID` to `scripts/server-release.py`. The expected version/commit tag must already exist. The script checks the ID, version and revision labels, then verifies runtime source and license hashes in an isolated container without production mounts before switching the service. Existing storage checks, backups, post-deployment verification and rollback remain in effect.

docs/EXTENSIONS.md

@@ -81,7 +81,7 @@ A failed mirror installation retries the same locked requirements against the
 fallback, without extra indexes, version downgrades, or disabling build isolation.
 Logs show index hosts and redact URL credentials/query parameters.
 
-APT/font layers remain cached when Python dependencies change. The Python layer
+APK/font layers remain cached when Python dependencies change. The Python layer
 changes only when the lock, installer, base image, or mirror arguments change;
 application source changes reuse it. BuildKit pip cache survives layer misses.
 An explicitly supplied, checksum-verified offline wheel directory still takes

docs/NAS.md

@@ -128,23 +128,19 @@ all uncompressed rootfs diff IDs before loading. With the verified local tag loa
 
 ```sh
 sudo env DOCKER_BUILDKIT=1 /usr/local/bin/docker compose build \
-  --build-arg PYTHON_BASE=python:3.14.5-slim-bookworm
+  --build-arg PYTHON_BASE=python:3.14.8-alpine3.24
 ```
 
 This per-build override does not change global registry or network configuration.
 
-A slow Debian CDN can be overridden only for this build, retaining APT GPG
+A slow Alpine CDN can be overridden for this build, retaining APK signature
 verification and changing no NAS system settings:
 
 ```sh
-sudo /usr/local/bin/docker compose build --build-arg DEBIAN_MIRROR=mirrors.aliyun.com
+sudo /usr/local/bin/docker compose build --build-arg ALPINE_MIRROR=mirrors.tuna.tsinghua.edu.cn
 ```
 
-Optional `build-cache/debs/fonts-noto-cjk.deb` avoids a slow build-network download.
+Optional `build-cache/wheels/` can hold all locked Linux AMD64/Python 3.14 musllinux wheels
-Dockerfile verifies it against SHA-256 from the GPG-authenticated APT index before use.
-The cache is not a runtime mount or committed dependency, and empty-cache builds work.
-
-Optional `build-cache/wheels/` can hold all 24 Linux AMD64/Python 3.14 wheels
 and `SHA256SUMS`, verified against official PyPI release metadata. Builds verify
 the manifest and use pip `--no-index`; incomplete caches fail explicitly.
 Build commit/time are set after dependency installation to preserve build cache.

docs/SYNOLOGY_PHOTOS_API.md

@@ -35,7 +35,7 @@
 FRAME_FLOW_IMAGE='<已验证的镜像标签>' docker compose -f deploy/compose.ubuntu-photos-api.yml config --quiet
 ```
 
-完整构建使用根目录 Dockerfile。若使用 `deploy/Dockerfile.runtime-update`，必须指定已审核的基础镜像，构建步骤会检查依赖锁与基础镜像相同；不相同时必须完整构建。本次依赖未新增，已比对现有 0.1.8 基础镜像的锁文件。
+发布统一使用根目录 Dockerfile 完整构建，包含固定基础映像、系统安全更新和锁定依赖，避免继承旧映像中的系统漏洞。
 
 ## 旧来源转换与恢复
 

docs/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "PIGWay Frame Flow API",
-    "version": "0.1.19"
+    "version": "0.1.23"
   },
   "paths": {
     "/api/v1/devices/{device_id}/widgets/selection": {
@@ -15227,7 +15227,7 @@
           "version": {
             "type": "string",
             "title": "Version",
-            "default": "0.1.19"
+            "default": "0.1.23"
           }
         },
         "type": "object",
@@ -17490,7 +17490,7 @@
           "version": {
             "type": "string",
             "title": "Version",
-            "default": "0.1.19"
+            "default": "0.1.23"
           },
           "api_version": {
             "type": "string",

pigway_frame_flow/api/app.py

@@ -126,7 +126,7 @@ def create_app(settings=None, start_worker=True):
     app = FastAPI(
         title="PIGWay Frame Flow API",
         docs_url=None,
-        version="0.1.20",
+        version="0.1.23",
         lifespan=lifespan,
         responses=error_responses,
     )
@@ -1040,7 +1040,7 @@ def create_app(settings=None, start_worker=True):
                     supports_upload=True,
                 ),
             ],
-            version="0.1.20",
+            version="0.1.23",
             mock=settings.mock,
             write_enabled=settings.write_enabled,
             api_key_configured=bool(settings.api_key)

pigway_frame_flow/display/recovery.py

@@ -1,8 +1,10 @@
 """Durable, read-only recovery progress for writes with uncertain outcomes."""
 
+import json
 from datetime import UTC, datetime
 from uuid import uuid4
 
+from pigway_frame_flow.errors import ErrorCode
 from pigway_frame_flow.storage.database import encode, now_iso
 
 
@@ -71,3 +73,92 @@ class RecoveryMonitor:
         if row:
             row["requires_manual_review"] = row["state"] == "manual_review"
         return row
+
+    def observe_device(self, op, *, device=None, error=None):
+        row = self.db.one("SELECT result FROM operations WHERE id=?", (op["id"],))
+        result = json.loads(row["result"] or "{}")
+        observation = {"checked_at": now_iso()}
+        if device is not None:
+            observation.update(
+                image_id=device.current_content.id,
+                synced=device.current_content.synced,
+                online=device.status == "online",
+                heartbeat=device.last_seen_at,
+            )
+        else:
+            observation["read_error"] = {
+                "code": error.code,
+                **{
+                    k: v
+                    for k, v in error.details.items()
+                    if k
+                    in ("transport_error", "http_status", "attempts", "retry_exhausted")
+                },
+            }
+        samples = result.get("sync_observations", [])
+        if samples:
+            old = samples[-1]
+            changed = {k: v for k, v in old.items() if k != "checked_at"} != {
+                k: v for k, v in observation.items() if k != "checked_at"
+            }
+            if (
+                not changed
+                and (
+                    datetime.now(UTC) - datetime.fromisoformat(old["checked_at"])
+                ).total_seconds()
+                < 60
+            ):
+                return observation
+        samples.append(observation)
+        result["sync_observations"] = (
+            [samples[0], *samples[-11:]] if len(samples) > 12 else samples
+        )
+        # Evidence must not reset updated_at: that is the sync timeout's clock.
+        self.db.execute(
+            "UPDATE operations SET result=? WHERE id=?", (encode(result), op["id"])
+        )
+        return observation
+
+    def close_superseded_displays(self):
+        for op in self.db.all(
+            "SELECT * FROM operations WHERE action='display' AND write_started=1 "
+            "AND status IN ('SYNCING','UNKNOWN')"
+        ):
+            result = json.loads(op["result"] or "{}")
+            if not result.get("image_id") or json.loads(op["payload"]).get(
+                "options", {}
+            ).get("restore_previous"):
+                continue
+            newer = self.db.one(
+                "SELECT id,result FROM operations WHERE device_id=? AND action='display' "
+                "AND status='COMPLETED' AND write_started=1 AND created_at>? "
+                "AND COALESCE(json_extract(payload,'$.options.restore_previous'),0)=0 "
+                "AND json_extract(result,'$.image_id') IS NOT NULL "
+                "ORDER BY created_at DESC LIMIT 1",
+                (op["device_id"], op["created_at"]),
+            )
+            if (
+                not newer
+                or json.loads(newer["result"])["image_id"] == result["image_id"]
+            ):
+                continue
+            # A later confirmed permanent display ends this attempt, but cannot
+            # prove whether the earlier image was ever shown. Never replay it.
+            self.service.update(
+                op["id"],
+                "FAILED",
+                error={
+                    "code": ErrorCode.DISPLAY_NOT_CONFIRMED,
+                    "message": "Superseded by a later confirmed display; earlier display unconfirmed",
+                    "request_id": op["request_id"],
+                    "details": {
+                        "superseded_by_operation_id": newer["id"],
+                        "previous_error": json.loads(op["error"] or "null"),
+                    },
+                },
+            )
+            self.db.history(op, "DISPLAY_NOT_CONFIRMED")
+            self.db.event(
+                "operation.failed",
+                {"operation_id": op["id"], "code": ErrorCode.DISPLAY_NOT_CONFIRMED},
+            )

pigway_frame_flow/display/service.py

@@ -174,7 +174,7 @@ class DisplayService:
         if result:
             row = self.db.one("SELECT result FROM operations WHERE id=?", (id,))
             previous = json.loads(row["result"]) if row and row["result"] else {}
-            for key in ("photo_attempts", "upload_intent"):
+            for key in ("photo_attempts", "upload_intent", "sync_observations"):
                 if key in previous:
                     result = {**result, key: previous[key]}
         self.db.execute(
@@ -518,6 +518,25 @@ class DisplayService:
                 ) and self.blocked(op["device_id"]):
                     continue
                 payload = json.loads(op["payload"])
+                if (
+                    op["action"] in ("display", "delete", "restore")
+                    and op["client_id"]
+                    in ("scheduler", "scheduler-retry", "cloud-library", "retention")
+                    and self.db.one(
+                        "SELECT id FROM operations WHERE device_id=? AND action='display' "
+                        "AND status='SYNCING' AND write_started=1 AND updated_at>? LIMIT 1",
+                        (
+                            op["device_id"],
+                            (
+                                datetime.now(UTC)
+                                - timedelta(seconds=self.settings.sync_timeout)
+                            ).isoformat(),
+                        ),
+                    )
+                ):
+                    # Both upload and deletion update the cloud frame counter.
+                    # Automatic writes must not invalidate a pending display ack.
+                    continue
                 if op["action"] == "display":
                     priority = payload["options"]["priority"]
                     top = self.top(op["device_id"])
@@ -823,6 +842,7 @@ class DisplayService:
             try:
                 driver = self.registry.get(op["device_id"])
                 device = driver.device(refresh=True)
+                self.recovery.observe_device(op, device=device)
                 if intent:
                     expected = self.upload_reconciliation.check(op, driver, device)
                     if (
@@ -850,7 +870,8 @@ class DisplayService:
                         if device.current_content.id == expected
                         else "target_mismatch",
                     )
-            except FlowError:
+            except FlowError as exc:
+                self.recovery.observe_device(op, error=exc)
                 self.recovery.observe(op, "read_unavailable")
             except Exception:
                 # Bad vendor metadata for one operation must not stop the worker.
@@ -858,6 +879,7 @@ class DisplayService:
         for op in self.db.all("SELECT * FROM operations WHERE status='SYNCING'"):
             try:
                 device = self.registry.get(op["device_id"]).device()
+                observation = self.recovery.observe_device(op, device=device)
                 target = json.loads(op["result"])["image_id"]
                 if (
                     device.current_content.id == target
@@ -878,11 +900,13 @@ class DisplayService:
                             "code": E.WRITE_RESULT_UNKNOWN,
                             "message": "Frame refresh was not confirmed",
                             "request_id": op["request_id"],
-                            "details": {},
+                            "details": {"last_device_observation": observation},
                         },
                     )
-            except FlowError:
+            except FlowError as exc:
-                pass
+                self.recovery.observe_device(op, error=exc)
+
+        self.recovery.close_superseded_displays()
 
     def expire(self):
         if not self.settings.mock and not self.settings.write_enabled:

pigway_frame_flow/models.py

@@ -366,7 +366,7 @@ class SettingsView(BaseModel):
 
 class Health(BaseModel):
     status: str
-    version: str = "0.1.20"
+    version: str = "0.1.23"
 
 
 class Readiness(BaseModel):
@@ -397,7 +397,7 @@ class RestoreRequest(StrictModel):
 
 class Version(BaseModel):
     product: str = "PIGWay Frame Flow"
-    version: str = "0.1.20"
+    version: str = "0.1.23"
     api_version: str = "v1"
     commit: str = "development"
     build_time: str = "unknown"

pigway_frame_flow/web/index.html

@@ -1,3 +1,3 @@
 <!doctype html>
 <html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><title>PIGWay Frame Flow</title><link rel="stylesheet" href="/ui/style.css"></head>
-<body><aside class="sidebar"><a class="brand" href="/"><span>PIGWay Frame Flow<small>Smart Frame Automation</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.19</small></div></aside><div class="workspace"><header><div><span class="eyebrow">PIGWay Frame Flow</span><h1 id="page-title"></h1></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=photo-quality-v0117"></script><script src="/ui/features.js?v=photo-quality-v0117"></script><script src="/ui/extensions.js?v=photo-quality-v0117"></script><script src="/ui/app.js?v=photo-quality-v0117"></script></body></html>
+<body><aside class="sidebar"><a class="brand" href="/"><span>PIGWay Frame Flow<small>Smart Frame Automation</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.23</small></div></aside><div class="workspace"><header><div><span class="eyebrow">PIGWay Frame Flow</span><h1 id="page-title"></h1></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=0.1.23"></script><script src="/ui/features.js?v=0.1.23"></script><script src="/ui/extensions.js?v=0.1.23"></script><script src="/ui/app.js?v=0.1.23"></script></body></html>

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pigway-frame-flow"
-version = "0.1.20"
+version = "0.1.23"
 readme = "README.md"
 license = {file = "LICENSE"}
 requires-python = ">=3.14,<3.15"

scripts/production-deploy.py

@@ -375,9 +375,7 @@ class Deploy:
                 "DOCKER_PIP_FALLBACK_INDEX_URL"
             )
             or "https://pypi.org/simple",
-            "DEBIAN_MIRROR": self.env.get("DEBIAN_MIRROR") or "deb.debian.org",
+            "ALPINE_MIRROR": self.env.get("ALPINE_MIRROR") or "dl-cdn.alpinelinux.org",
-            "DEBIAN_SECURITY_MIRROR": self.env.get("DEBIAN_SECURITY_MIRROR")
-            or "deb.debian.org",
             "BUILD_COMMIT": commit,
             "BUILD_TIME": now,
         }.items():

scripts/server-release.py

@@ -10,6 +10,7 @@ import shutil
 import sqlite3
 import subprocess
 import time
+import tomllib
 import urllib.request
 from pathlib import Path
 
@@ -126,6 +127,48 @@ def main():
         release(lock)
 
 
+def verify_prebuilt_image(image, commit, version, hashes):
+    expected = os.getenv("FRAME_FLOW_PREBUILT_IMAGE_ID", "")
+    if not expected:
+        return False
+    assert re.fullmatch(r"sha256:[0-9a-f]{64}", expected), "Require immutable image ID"
+    metadata = json.loads(run("docker", "image", "inspect", image))[0]
+    assert metadata["Id"] == expected, "Prebuilt image ID mismatch"
+    labels = metadata["Config"].get("Labels") or {}
+    assert labels.get("org.opencontainers.image.revision") == commit
+    assert labels.get("org.opencontainers.image.version") == version
+    project = {
+        n: h
+        for n, h in hashes.items()
+        if n.startswith(("pigway_frame_flow/", "vendor/"))
+        or n in {"requirements.lock", "LICENSE", "NOTICE.md"}
+    }
+    # Validate the artifact before it can access production config or data.
+    code = "import hashlib,json,pathlib,sys; h=json.load(sys.stdin); assert h and all(hashlib.sha256((pathlib.Path('/app')/n).read_bytes()).hexdigest()==v for n,v in h.items())"
+    subprocess.run(
+        [
+            "docker",
+            "run",
+            "--rm",
+            "-i",
+            "--network=none",
+            "--read-only",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges",
+            "--user=10333:10333",
+            "--entrypoint=python",
+            expected,
+            "-c",
+            code,
+        ],
+        input=json.dumps(project),
+        text=True,
+        check=True,
+        timeout=60,
+    )
+    return True
+
+
 def release(lock):
     ctx = Path(__file__).resolve().parent.parent
     assert ctx.parent == ROOT / "migration-inbox"
@@ -139,9 +182,6 @@ def release(lock):
     before = inspect()
     old_env = dict(s.split("=", 1) for s in before["Config"]["Env"])
     verify_runtime(old_env["BUILD_COMMIT"])
-    assert run("docker", "exec", CONTAINER, "cat", "/app/requirements.lock") == (
-        (ctx / "requirements.lock").read_text().strip()
-    ), "Dependencies differ; full build required"
     stamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
     backup = RECOVERY / ("release-" + stamp + "-" + commit[:12])
     backup.mkdir(mode=0o700)
@@ -153,29 +193,27 @@ def release(lock):
         with sqlite3.connect(backup / "frameflow.before.db") as dst:
             src.backup(dst)
             assert dst.execute("pragma quick_check").fetchone()[0] == "ok"
-    base = "pigway-frame-flow:release-base-" + commit[:12]
+    version = tomllib.loads((ctx / "pyproject.toml").read_text())["project"]["version"]
-    run("docker", "image", "tag", before["Image"], base)
+    assert re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version)
-    image = "pigway-frame-flow:0.1.19-" + commit[:12]
+    image = "pigway-frame-flow:" + version + "-" + commit[:12]
-    try:
+    if not verify_prebuilt_image(image, commit, version, hashes):
+        # A source-only overlay would retain vulnerable packages from the old image.
         run(
             "docker",
             "build",
-            "--pull=false",
+            "--pull",
-            "--network=none",
             "-f",
-            str(ctx / "deploy/Dockerfile.runtime-update"),
+            str(ctx / "Dockerfile"),
-            "--build-arg",
-            "BASE_IMAGE=" + base,
             "--build-arg",
             "BUILD_COMMIT=" + commit,
             "--build-arg",
             "BUILD_TIME=" + stamp,
+            "--build-arg",
+            "ALPINE_MIRROR=" + os.getenv("ALPINE_MIRROR", "dl-cdn.alpinelinux.org"),
             "-t",
             image,
             str(ctx),
         )
-    finally:
-        run("docker", "image", "rm", base)
     compose = json.loads((APP / "compose.json").read_text())
     service = compose["services"][CONTAINER]
     service["image"] = image

tests/test_recovery.py

@@ -1,5 +1,6 @@
 from datetime import UTC, datetime, timedelta
 
+import pytest
 from test_display import submit
 
 from pigway_frame_flow.display.service import DisplayService
@@ -60,7 +61,9 @@ def test_persistent_block_escalates_once_survives_restart_and_preserves_evidence
         == 1
     )
     assert service.operation(operation)["recovery"]["checks"] == 3
-    assert service.operation(operation)["result"] == original["result"]
+    current_result = service.operation(operation)["result"]
+    assert current_result.pop("sync_observations")
+    assert current_result == original["result"]
     service.reconcile(operation, acknowledge=True)
     assert service.operation(operation)["recovery"]["state"] == "resolved"
     assert not service.operation(operation)["recovery"]["requires_manual_review"]
@@ -107,3 +110,184 @@ def test_malformed_reconciliation_does_not_abort_other_background_work(
     assert op["recovery"]["reason"] == "reconciliation_error"
     assert "private" not in str(op["recovery"])
     assert service.blocked("living-room")
+
+
+@pytest.mark.parametrize("status", ["SYNCING", "UNKNOWN"])
+def test_later_confirmed_display_closes_earlier_syncing_attempt_without_replay(
+    service, status
+):
+    first = submit(service)
+    service.process_one()
+    assert service.operation(first)["status"] == "SYNCING"
+    second = submit(service)
+    service.process_one()
+    driver = service.registry.get("living-room")
+    uploads = driver.client.uploads
+    previous_error = {"code": "WRITE_RESULT_UNKNOWN", "message": "Refresh unconfirmed"}
+    if status == "UNKNOWN":
+        service.update(first, status, error=previous_error)
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    old = service.operation(first)
+    assert old["status"] == "FAILED"
+    assert old["error"]["code"] == "DISPLAY_NOT_CONFIRMED"
+    assert old["error"]["details"]["superseded_by_operation_id"] == second
+    if status == "UNKNOWN":
+        assert old["error"]["details"]["previous_error"] == previous_error
+    assert driver.client.uploads == uploads
+    assert not service.blocked("living-room")
+    service.sync()
+    assert (
+        len(
+            service.db.all(
+                "SELECT * FROM history WHERE operation_id=? AND result='DISPLAY_NOT_CONFIRMED'",
+                (first,),
+            )
+        )
+        == 1
+    )
+
+
+def test_unconfirmed_later_display_does_not_close_old_attempt(service):
+    first = submit(service)
+    service.process_one()
+    second = submit(service)
+    service.process_one()
+    service.recovery.close_superseded_displays()
+    assert service.operation(first)["status"] == "SYNCING"
+    assert service.operation(second)["status"] == "SYNCING"
+
+
+def test_confirmed_temporary_override_does_not_close_earlier_display(service):
+    first = submit(service)
+    service.process_one()
+    second = submit(service, 60, True)
+    service.process_one()
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    assert service.operation(first)["status"] == "SYNCING"
+
+
+@pytest.mark.parametrize("client_id", ["scheduler", "scheduler-retry"])
+def test_automatic_upload_waits_for_prior_sync_confirmation(service, client_id):
+    first = submit(service)
+    service.process_one()
+    payload = service.db.one("SELECT payload FROM operations WHERE id=?", (first,))[
+        "payload"
+    ]
+    import json
+
+    second = service.submit(
+        "display", json.loads(payload), "living-room", client_id, "fixture"
+    )
+    uploads = service.registry.get("living-room").client.uploads
+    service.process_one()
+    assert service.operation(second)["status"] == "QUEUED"
+    assert service.registry.get("living-room").client.uploads == uploads
+    service.sync()
+    assert service.operation(first)["status"] == "COMPLETED"
+    service.process_one()
+    service.sync()
+    assert service.operation(second)["status"] == "COMPLETED"
+    assert service.registry.get("living-room").client.uploads == uploads + 1
+
+
+def test_device_evidence_is_bounded_and_does_not_extend_sync_timeout(service):
+    first = submit(service)
+    service.process_one()
+    op = service.db.one("SELECT * FROM operations WHERE id=?", (first,))
+    before = service.operation(first)["updated_at"]
+    device = service.registry.get("living-room").device()
+    for i in range(20):
+        sample = device.model_copy(
+            update={
+                "current_content": device.current_content.model_copy(
+                    update={"id": 1000 + i}
+                )
+            }
+        )
+        service.recovery.observe_device(op, device=sample)
+    result = service.operation(first)
+    samples = result["result"]["sync_observations"]
+    assert len(samples) == 12
+    assert samples[0]["image_id"] == 1000 and samples[-1]["image_id"] == 1019
+    assert result["updated_at"] == before
+    service.update(first, "UNKNOWN", {"image_id": 7})
+    assert service.operation(first)["result"]["sync_observations"] == samples
+
+
+def test_device_read_failure_evidence_never_copies_raw_error_details(service):
+    first = submit(service)
+    service.process_one()
+    op = service.db.one("SELECT * FROM operations WHERE id=?", (first,))
+    service.recovery.observe_device(
+        op,
+        error=FlowError(
+            ErrorCode.CLOUD_UNAVAILABLE,
+            "unavailable",
+            details={
+                "transport_error": "read_timeout",
+                "url": "private-url-must-not-be-stored",
+            },
+        ),
+    )
+    sample = service.operation(first)["result"]["sync_observations"][-1]
+    assert sample["read_error"]["transport_error"] == "read_timeout"
+    assert "private-url" not in str(sample)
+
+
+def test_sync_timeout_includes_observed_device_state(service):
+    first = submit(service)
+    service.process_one()
+    service.registry.get("living-room").client.synced = False
+    service.registry.get("living-room").invalidate()
+    service.settings.sync_timeout = 0
+    service.sync()
+    op = service.operation(first)
+    assert op["status"] == "UNKNOWN"
+    assert op["error"]["details"]["last_device_observation"]["synced"] is False
+
+
+def test_automatic_wait_does_not_extend_past_sync_timeout(service):
+    import json
+
+    first = submit(service)
+    service.process_one()
+    payload = service.db.one("SELECT payload FROM operations WHERE id=?", (first,))[
+        "payload"
+    ]
+    service.db.execute(
+        "UPDATE operations SET updated_at=? WHERE id=?",
+        (
+            (
+                datetime.now(UTC) - timedelta(seconds=service.settings.sync_timeout + 1)
+            ).isoformat(),
+            first,
+        ),
+    )
+    second = service.submit(
+        "display", json.loads(payload), "living-room", "scheduler", "fixture"
+    )
+    service.process_one()
+    assert service.operation(second)["status"] == "SYNCING"
+
+
+def test_automatic_cleanup_waits_for_display_confirmation(service, monkeypatch):
+    first = submit(service)
+    service.process_one()
+    monkeypatch.setattr(service.cloud_library, "eligible", lambda *args: True)
+    cleanup = service.submit(
+        "delete",
+        {"image_id": 1, "cloud_cleanup": True},
+        "living-room",
+        "cloud-library",
+        "fixture-cleanup",
+    )
+    service.process_one()
+    assert service.operation(cleanup)["status"] == "QUEUED"
+    assert 1 in [x.image_id for x in service.registry.get("living-room").images()]
+    service.sync()
+    service.process_one()
+    assert service.operation(first)["status"] == "COMPLETED"
+    assert service.operation(cleanup)["status"] == "COMPLETED"
+    assert 1 not in [x.image_id for x in service.registry.get("living-room").images()]

tests/test_retention.py

@@ -37,6 +37,8 @@ def due(service, image_id):
         "UPDATE image_retention SET expires_at=? WHERE image_id=?",
         ((datetime.now(UTC) - timedelta(days=1)).isoformat(), image_id),
     )
+    # Complete the upload before simulating expiry days later and switching away.
+    service.sync()
     # The test driver switches to a different image, not a real device.
     driver = service.registry.get("living-room")
     driver.display(1)

tests/test_server_release.py

@@ -92,3 +92,53 @@ def test_release_rejects_wrong_storage_uuid(release_tool, monkeypatch):
     monkeypatch.setattr(release_tool, "run", lambda *args: "different-storage-uuid")
     with pytest.raises(AssertionError):
         release_tool.main()
+
+
+@pytest.mark.parametrize("invalid", [None, "id", "commit", "version", "content"])
+def test_prebuilt_image_is_bound_to_source_before_deployment(
+    release_tool, monkeypatch, invalid
+):
+    import json
+    import subprocess
+
+    digest = "sha256:" + "a" * 64
+    monkeypatch.setenv("FRAME_FLOW_PREBUILT_IMAGE_ID", digest)
+    metadata = {
+        "Id": digest,
+        "Config": {
+            "Labels": {
+                "org.opencontainers.image.revision": "fixture-commit",
+                "org.opencontainers.image.version": "0.1.22",
+            }
+        },
+    }
+    if invalid == "id":
+        metadata["Id"] = "sha256:" + "b" * 64
+    if invalid == "commit":
+        metadata["Config"]["Labels"]["org.opencontainers.image.revision"] = "wrong"
+    if invalid == "version":
+        metadata["Config"]["Labels"]["org.opencontainers.image.version"] = "wrong"
+    monkeypatch.setattr(release_tool, "run", lambda *args: json.dumps([metadata]))
+    calls = []
+
+    def isolated(command, **kwargs):
+        calls.append(command)
+        assert "--network=none" in command and "--read-only" in command
+        assert "--cap-drop=ALL" in command and "--user=10333:10333" in command
+        assert "-v" not in command and "--mount" not in command
+        assert json.loads(kwargs["input"]) == {"LICENSE": "fixture-hash"}
+        if invalid == "content":
+            raise subprocess.CalledProcessError(1, command)
+
+    monkeypatch.setattr(release_tool.subprocess, "run", isolated)
+    if invalid:
+        with pytest.raises((AssertionError, subprocess.CalledProcessError)):
+            release_tool.verify_prebuilt_image(
+                "fixture-image", "fixture-commit", "0.1.22", {"LICENSE": "fixture-hash"}
+            )
+    else:
+        assert release_tool.verify_prebuilt_image(
+            "fixture-image", "fixture-commit", "0.1.22", {"LICENSE": "fixture-hash"}
+        )
+    if invalid in ("id", "commit", "version"):
+        assert not calls

vendor/noto-cjk-OFL-1.1.txt

@@ -0,0 +1,92 @@
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.