fix(plugin-system): unload/update race, failed-load cleanup, limits validation, schema lookup, install rollback (#653)

* fix(plugin-system): unload/update race, failed-load module cleanup, limits validation, schema lookup, install rollback, op-queue dedupe

- unload_plugin takes the per-plugin lock (5s bounded) before cleanup(),
  and an update() that finishes after its plugin was unloaded no longer
  sets the state back to ENABLED.
- A load that fails after import drops plugin_<id> and its submodules
  and forgets its manager fonts, so a fixed plugin reloads new code.
- Resource limits are validated as non-negative numbers: 400 at
  POST /plugins/limits, bad cached records ignored with one warning.
  Route docstrings note health/metrics reset and limits only change the
  web process's view.
- SchemaManager.get_schema_path resolves each search dir via
  resolve_plugin_dir (manifest id, ledmatrix-<id>) before the literal
  paths; plugins/ still before plugin-repos/. Misses cached 30s and
  logged once at DEBUG.
- install_from_url sets an existing copy aside and restores it if the
  move fails, under the per-plugin reinstall lock.
- Operation queue refuses a second pending op for a plugin and trims
  _operations with history.
- get_vegas_render_width reads display_manager.width first.
- get_logger in store/schema/health/resource/saved_repositories;
  UTF-8 reads in store_manager and state_manager.
- Docs: update_interval precedence (manifest over config) stated where
  users are told to set it in config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): build the limits 400 message from the field name, not an exception

CodeQL flagged str(e) flowing into the response. invalid_limit_field()
returns the offending field without raising, and limits_from_dict uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

web_interface/blueprints/api_v3/plugins.py

@@ -234,7 +234,13 @@ def get_plugin_health_single(plugin_id):
     })
 @api_v3.route('/plugins/health/<plugin_id>/reset', methods=['POST'])
 def reset_plugin_health(plugin_id):
-    """Reset health state for a plugin (manual recovery)"""
+    """Reset health state for a plugin (manual recovery).
+
+    This resets the web process's tracker and the persisted record. The
+    display service runs its own tracker in another process and keeps its
+    in-memory state, so its next recorded success or failure can write that
+    state back; restart the display service for a reset it will honour.
+    """
     if not api_v3.plugin_manager:
         return jsonify({'status': 'error', 'message': 'Plugin manager not initialized'}), 500
 
@@ -307,7 +313,12 @@ def get_plugin_metrics_single(plugin_id):
     })
 @api_v3.route('/plugins/metrics/<plugin_id>/reset', methods=['POST'])
 def reset_plugin_metrics(plugin_id):
-    """Reset metrics for a plugin"""
+    """Reset metrics for a plugin.
+
+    Only the web process's copy and the persisted snapshot are cleared. The
+    display service keeps accumulating in its own process and republishes
+    its totals on its next persist, so the reset does not stick while it runs.
+    """
     if not api_v3.plugin_manager:
         return jsonify({'status': 'error', 'message': 'Plugin manager not initialized'}), 500
 
@@ -326,7 +337,13 @@ def reset_plugin_metrics(plugin_id):
     })
 @api_v3.route('/plugins/limits/<plugin_id>', methods=['GET', 'POST'])
 def manage_plugin_limits(plugin_id):
-    """Get or set resource limits for a plugin"""
+    """Get or set resource limits for a plugin.
+
+    A POST updates the web process's monitor and the persisted record. The
+    display service reads persisted limits only until it has some for a
+    plugin, so a change to existing limits takes effect there after the
+    display service restarts.
+    """
     if not api_v3.plugin_manager:
         return jsonify({'status': 'error', 'message': 'Plugin manager not initialized'}), 500
 
@@ -358,14 +375,18 @@ def manage_plugin_limits(plugin_id):
     else:
         # POST - Set limits
         data = request.get_json(silent=True) or {}
-        from src.plugin_system.resource_monitor import ResourceLimits
+        from src.plugin_system.resource_monitor import invalid_limit_field, limits_from_dict
 
-        limits = ResourceLimits(
-            max_memory_mb=data.get('max_memory_mb'),
-            max_cpu_percent=data.get('max_cpu_percent'),
-            max_execution_time=data.get('max_execution_time'),
-            warning_threshold=data.get('warning_threshold', 0.8)
-        )
+        # Validate here: a string limit stored as-is made every later update
+        # of the plugin raise TypeError inside the resource monitor. The
+        # message is built from the field name, not from an exception.
+        bad = invalid_limit_field(data)
+        if bad == 'limits':
+            return jsonify({'status': 'error', 'message': 'Limits must be a JSON object'}), 400
+        if bad:
+            return jsonify({'status': 'error',
+                            'message': f'{bad} must be a non-negative number or null'}), 400
+        limits = limits_from_dict(data)
 
         api_v3.plugin_manager.resource_monitor.set_limits(plugin_id, limits)