chore: satisfy Codacy's subprocess checks on the new test runner

Codacy runs Bandit and Opengrep (its Semgrep fork). The new
subprocess.run in scripts/run_plugin_tests.py trips three patterns, on
two different lines:

  Bandit   B404 on the import, B603 on the call
  Opengrep dangerous-subprocess-use-audit          on the run( line
           dangerous-subprocess-use-tainted-env-args on the argv line

A nosemgrep applies only to its own line, so the call line and the argv
line each need one; a single comment on the call covered neither rule
fully. Suppression is the right answer here rather than a rewrite: the
interpreter is sys.executable, the arguments are a list, and no shell is
involved, so there is nothing to word-split or expand.

Matches the pair the rest of the repo already uses for this shape --
permission_utils.py, plugin_loader.py, install_dependencies_apt.py.

Codacy: 0 new issues, up to standards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9

plugin-repos/starlark-apps/manager.py

@@ -681,12 +681,18 @@ class StarlarkAppsPlugin(BasePlugin):
                 if app.is_enabled() and app.should_render(current_time):
                     self._render_app(app, force=False)
 
-    def display(self, force_clear: bool = False) -> None:
+    def display(self, force_clear: bool = False) -> bool:
         """
         Display current Starlark app.
 
         This method is called during the display rotation.
         Displays frames from the currently active app.
+
+        Returns False when there is no app to show -- which is the state of
+        every install without Pixlet, and of a fresh one before any app is
+        added. The display controller only skips a mode on a boolean False
+        (it checks isinstance(result, bool)), so returning None held a black
+        panel for the full display_duration instead of rotating on.
         """
         try:
             if force_clear:
@@ -699,20 +705,24 @@ class StarlarkAppsPlugin(BasePlugin):
             if not self.current_app:
                 # No apps available
                 self.logger.debug("No Starlark apps to display")
-                return
+                return False
 
             # Render app if needed
             if not self.current_app.frames:
                 success = self._render_app(self.current_app, force=True)
                 if not success:
                     self.logger.error(f"Failed to render app: {self.current_app.app_id}")
-                    return
+                    return False
 
-            # Display current frame
+            # Display current frame. The result is propagated: a failed frame
-            self._display_frame()
+            # update is not a displayed frame, and returning True regardless
+            # told the controller the mode had rendered, so it held the dead
+            # frame for the whole display_duration instead of rotating on.
+            return self._display_frame()
 
         except Exception as e:
             self.logger.error(f"Error displaying Starlark app: {e}")
+            return False
 
     def _select_next_app(self) -> None:
         """Select the next enabled app for display."""
@@ -835,10 +845,13 @@ class StarlarkAppsPlugin(BasePlugin):
             self.logger.error(f"Error loading frames for {app.app_id}: {e}")
             return False
 
-    def _display_frame(self) -> None:
+    def _display_frame(self) -> bool:
-        """Display the current frame of the current app."""
+        """Display the current frame of the current app.
+
+        :returns: whether a frame actually reached the display manager.
+        """
         if not self.current_app or not self.current_app.frames:
-            return
+            return False
 
         try:
             current_time = time.time()
@@ -856,8 +869,11 @@ class StarlarkAppsPlugin(BasePlugin):
                 )
                 self.current_app.last_frame_time = current_time
 
+            return True
+
         except Exception as e:
             self.logger.error(f"Error displaying frame: {e}")
+            return False
 
     def install_app(self, app_id: str, star_file_path: str, metadata: Optional[Dict[str, Any]] = None, assets_dir: Optional[str] = None) -> bool:
         """

scripts/render_plugin.py

@@ -52,10 +52,6 @@ def main() -> int:
     parser.add_argument('--height', type=int, default=32, help='Display height (default: 32)')
     parser.add_argument('--skip-update', action='store_true',
                         help='Skip calling update() (render display only)')
-    parser.add_argument('--display-mode', default=None,
-                        help='Display mode to render, for plugins that declare '
-                             'more than one in their manifest (e.g. nrl_live). '
-                             'Omitted, the plugin picks its own default.')
 
     args = parser.parse_args()
 
@@ -145,26 +141,8 @@ def main() -> int:
         except Exception as e:
             logger.warning("update() raised: %s — continuing to display()", e)
 
-    # A plugin that declares several display modes usually renders nothing
-    # useful without being told which one to draw: the scoreboards keep their
-    # state on per-mode sub-managers and their no-argument path returns False.
-    # Only pass the argument when asked for, so the many plugins whose display()
-    # takes no display_mode keep working untouched.
     try:
-        if args.display_mode:
+        plugin_instance.display(force_clear=True)
-            try:
-                plugin_instance.display(display_mode=args.display_mode,
-                                        force_clear=True)
-            except TypeError as error:
-                if ("unexpected keyword argument" not in str(error)
-                        or "display_mode" not in str(error)):
-                    raise
-                logger.warning(
-                    "%s.display() does not accept display_mode; rendering its "
-                    "default screen instead", args.plugin)
-                plugin_instance.display(force_clear=True)
-        else:
-            plugin_instance.display(force_clear=True)
         logger.debug("display() completed")
     except Exception as e:
         logger.error("Error in display(): %s", e)

scripts/run_plugin_tests.py

@@ -6,6 +6,9 @@ Discovers and runs tests for LEDMatrix plugins.
 Supports both unittest and pytest.
 """
 
+import os
+import re
+import subprocess  # nosec B404 - list-form argv only, no shell  # nosemgrep
 import sys
 import argparse
 from pathlib import Path
@@ -68,6 +71,79 @@ def _find_tests_in_dir(directory: Path) -> list:
     return sorted(set(test_files))
 
 
+def _is_script_style(path) -> bool:
+    """True when a test file is a standalone script, not a pytest module.
+
+    Most plugin tests are written as `def main()` plus an `if __name__ ==
+    "__main__"` guard and signal through an exit code. pytest collects zero
+    items from those, so handing them to pytest printed "no tests ran" and this
+    runner reported success over work it had not done -- 151 of 248 files on a
+    fully populated rig.
+    """
+    try:
+        src = Path(path).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return False
+    has_pytest_items = re.search(r"^\s*(def test_|class Test|async def test_)", src, re.M)
+    has_main_guard = "__main__" in src and "__name__" in src
+    return bool(has_main_guard and not has_pytest_items)
+
+
+def run_script_tests(test_files: list, verbose: bool = False) -> int:
+    """Run standalone test scripts, honouring the 0 pass / 2 skip / 1 fail
+    convention that ledmatrix-plugins' own runner established.
+
+    Scripts opt into skipping by printing "SKIP: <reason>" and exiting 2 --
+    a script that needs a tty or an LED matrix is not a regression.
+    """
+    env = dict(os.environ)
+    # Prepend rather than setdefault. An inherited PYTHONPATH -- a developer's
+    # shell, a tox run, another checkout -- otherwise wins outright, and the
+    # subprocess imports a different copy of the core than the one under test.
+    # That is exactly the failure ledmatrix-plugins#467 describes, and it is
+    # invisible: the tests pass or fail against a tree nobody meant to test.
+    inherited = env.get("PYTHONPATH")
+    env["PYTHONPATH"] = (f"{PROJECT_ROOT}{os.pathsep}{inherited}"
+                         if inherited else str(PROJECT_ROOT))
+    env["LEDMATRIX_CORE"] = str(PROJECT_ROOT)
+
+    passed = skipped = failed = 0
+    failures = []
+    for path in test_files:
+        try:
+            # Fixed interpreter (sys.executable) plus a test path this script
+            # discovered by globbing the repo; argument list, no shell, so
+            # nothing is word-split or expanded. Same suppression pair the
+            # rest of the repo uses for this shape (see permission_utils.py).
+            proc = subprocess.run(  # nosec B603 - no shell invoked (list-form argv)  # nosemgrep
+                [sys.executable, str(path)],  # nosemgrep
+                cwd=str(Path(path).parent),
+                capture_output=True, text=True, env=env,
+                stdin=subprocess.DEVNULL, timeout=300,
+            )
+            rc = proc.returncode
+            tail = " | ".join((proc.stdout or proc.stderr or "").strip().splitlines()[-2:])[:200]
+        except subprocess.TimeoutExpired:
+            rc, tail = 1, "timed out after 300s"
+        if rc == 0:
+            passed += 1
+            label = "pass"
+        elif rc == 2:
+            skipped += 1
+            label = "SKIP"
+        else:
+            failed += 1
+            label = "FAIL"
+            failures.append(f"{Path(path).name}: exit {rc} | {tail}")
+        if verbose or rc != 0:
+            print(f"  [{label}] {Path(path).name}" + (f" -- {tail}" if rc != 0 else ""))
+
+    print(f"\n{passed} passed, {skipped} skipped, {failed} failed (scripts)")
+    for f in failures:
+        print(f"  - {f}", file=sys.stderr)
+    return 1 if failed else 0
+
+
 def run_unittest_tests(test_files: list, verbose: bool = False) -> int:
     """
     Run tests using unittest.
@@ -186,11 +262,16 @@ def main():
             print("No test files found in plugins directory")
         return 0
     
-    print(f"Found {len(test_files)} test file(s)")
+    scripts = [f for f in test_files if _is_script_style(f)]
+    modules = [f for f in test_files if f not in scripts]
+
+    print(f"Found {len(test_files)} test file(s)"
+          + (f" -- {len(modules)} collectable, {len(scripts)} standalone script(s)"
+             if scripts else ""))
     for test_file in test_files:
         print(f"  - {test_file}")
     print()
-    
+
     # Determine runner
     runner = args.runner
     if runner == 'auto':
@@ -199,12 +280,21 @@ def main():
             runner = 'pytest'
         except ImportError:
             runner = 'unittest'
-    
+
-    # Run tests
+    # Standalone scripts cannot be collected by pytest or unittest -- run them
-    if runner == 'pytest':
+    # as the scripts they are. Doing this rather than silently collecting zero
-        return run_pytest_tests(test_files, args.verbose, args.coverage)
+    # items is the whole point: this runner used to report success having
-    else:
+    # executed nothing.
-        return run_unittest_tests(test_files, args.verbose)
+    rc = 0
+    if scripts:
+        rc |= run_script_tests(scripts, args.verbose)
+
+    if modules:
+        if runner == 'pytest':
+            rc |= run_pytest_tests(modules, args.verbose, args.coverage)
+        else:
+            rc |= run_unittest_tests(modules, args.verbose)
+    return rc
 
 
 if __name__ == '__main__':

src/display_controller.py

@@ -198,6 +198,10 @@ class DisplayController:
         # the main run loop reconciles (loads/unloads) on its own thread so
         # mutating available_modes never races with rendering.
         self._pending_plugin_reconcile = False
+        # Monotonic stamp of the last mailbox disk read; see
+        # _poll_on_demand_requests. None means "never polled", so the first
+        # call always goes through.
+        self._last_on_demand_poll: Optional[float] = None
         self.on_demand_active = False
         self.on_demand_mode: Optional[str] = None
         self.on_demand_modes: List[str] = []  # All modes for the on-demand plugin
@@ -1267,12 +1271,34 @@ class DisplayController:
         self.on_demand_schedule_override = False
         self._publish_on_demand_state()
 
+    #: Shortest gap between mailbox disk reads. This is called after every
+    #: frame -- about 125 times a second on a scrolling mode -- and the read
+    #: below is deliberately uncached, so without a floor it was 125 disk reads
+    #: per second to find nothing. An on-demand request comes from a person
+    #: clicking in the web UI, so a quarter second of latency is not
+    #: perceptible, and it cuts the read rate by 30x.
+    ON_DEMAND_POLL_INTERVAL = 0.25
+
     def _poll_on_demand_requests(self) -> None:
         """Poll cache for new on-demand requests from external controllers."""
+        now = time.monotonic()
+        if (self._last_on_demand_poll is not None
+                and now - self._last_on_demand_poll < self.ON_DEMAND_POLL_INTERVAL):
+            return
+        self._last_on_demand_poll = now
+
         try:
             # Use a long max_age (1 hour) to ensure requests aren't expired before processing
-            # The request_id check prevents duplicate processing
+            # The request_id check prevents duplicate processing.
-            request = self.cache_manager.get('display_on_demand_request', max_age=3600)
+            #
+            # memory_ttl=0 is required, not optional: this key is a mailbox the
+            # web process writes and this process reads. get() defaults the
+            # in-memory TTL to max_age, so without it the first request read was
+            # pinned in memory for the full hour and every later poll returned
+            # that stale copy -- meaning no second on-demand request was honoured
+            # for an hour, while the API still reported success.
+            request = self.cache_manager.get('display_on_demand_request',
+                                             max_age=3600, memory_ttl=0)
         except (OSError, RuntimeError, ValueError, TypeError) as err:
             logger.error("Failed to read on-demand request: %s", err, exc_info=True)
             return
@@ -1318,6 +1344,36 @@ class DisplayController:
         # Mark as processed BEFORE processing (to prevent duplicate processing)
         self.cache_manager.set('display_on_demand_processed_id', request_id, ttl=3600)
         self.on_demand_request_id = request_id
+        # Consume the mailbox entry. Leaving it on disk meant a restart replayed
+        # the previous request: the fresh controller read it, activated it and
+        # cached it, so the request the caller had just made was ignored and the
+        # panel silently showed the earlier plugin. processed_id still guards
+        # against double-processing if this delete fails.
+        try:
+            # Compare before deleting. The web process can post a newer request
+            # between the read above and this delete; an unconditional delete
+            # threw that one away and it was never processed -- the user's
+            # second click did nothing. Re-reading uncached and only deleting
+            # our own request_id means a newer request is left in the mailbox
+            # for the next poll instead.
+            #
+            # This narrows the window rather than closing it: a request landing
+            # between this re-read and the delete is still lost. Closing it
+            # properly needs an atomic claim (a rename, or a compare-and-delete
+            # primitive) that the cache layer does not currently offer, so the
+            # honest fix is a smaller window plus this note, not a bigger lock.
+            current = self.cache_manager.get('display_on_demand_request',
+                                             max_age=3600, memory_ttl=0)
+            if not current or current.get('request_id') == request_id:
+                self.cache_manager.delete('display_on_demand_request')
+            else:
+                logger.debug("Newer on-demand request %s arrived while processing "
+                             "%s; leaving it in the mailbox",
+                             current.get('request_id'), request_id)
+        except (OSError, AttributeError, KeyError) as err:
+            # Best-effort: processed_id still guards against reprocessing if the
+            # mailbox cannot be cleared.
+            logger.debug("Could not clear the on-demand request mailbox: %s", err)
         
         if action == 'start':
             logger.info("Processing on-demand start request for plugin: %s", request.get('plugin_id'))

src/display_manager.py

@@ -1453,12 +1453,30 @@ class DisplayManager:
                 if parent_dir and str(parent_dir) != '/tmp':  # nosec B108 - guard to skip /tmp for permission ops
                     ensure_directory_permissions(parent_dir, get_assets_dir_mode())
                 self._snapshot_dir_prepared = True
-            # Write atomically: temp then replace
+            # Write atomically: temp then replace. The temp name must be
-            tmp_path = f"{self._snapshot_path}.tmp"
+            # unique, not "<snapshot>.tmp": /tmp is world-writable and sticky,
-            self.image.save(tmp_path, format='PNG')
+            # and this file is written by whichever user the display service
+            # runs as while tests and tooling run as someone else. A leftover
+            # fixed-name temp owned by another user is then unopenable even by
+            # root (fs.protected_regular refuses O_CREAT on a foreign file in a
+            # sticky dir), which froze the preview and the health check's
+            # liveness proxy until somebody deleted it by hand. Same pattern as
+            # the hardware-status write above.
+            _fd, tmp_path = tempfile.mkstemp(
+                dir=str(snapshot_path_obj.parent),
+                prefix=f".{snapshot_path_obj.name}.", suffix=".tmp")
             try:
+                with os.fdopen(_fd, "wb") as _f:
+                    self.image.save(_f, format='PNG')
+                os.chmod(tmp_path, 0o644)
                 os.replace(tmp_path, self._snapshot_path)
             except Exception:
+                # Never leave the temp behind -- that is what made the failure
+                # permanent rather than transient.
+                try:
+                    os.unlink(tmp_path)
+                except OSError:
+                    pass
                 # Fallback to direct save if replace not supported
                 self.image.save(self._snapshot_path, format='PNG')
             # Set proper file permissions after saving

src/font_manager.py

@@ -96,7 +96,8 @@ class FontManager:
         self.common_fonts = {
             "press_start": "assets/fonts/PressStart2P-Regular.ttf",
             "four_by_six": "assets/fonts/4x6-font.ttf",
-            "five_by_seven": "assets/fonts/5x7.bdf"
+            "five_by_seven": "assets/fonts/5x7.bdf",
+            "tom_thumb": "assets/fonts/tom-thumb.bdf"
             # Note: cozette_bdf removed - font file not available
             # To re-enable: download cozette.bdf from https://github.com/the-moonwitch/Cozette
             # and add: "cozette_bdf": "assets/fonts/cozette.bdf"

src/plugin_system/testing/harness.py

@@ -14,6 +14,8 @@ via BoundsCheckingDisplayManager, and golden-image comparison.
 import contextlib
 import http.client
 import inspect
+import time
+from datetime import timedelta
 import socket
 import ssl
 import urllib.error
@@ -25,7 +27,7 @@ from PIL import Image, ImageChops
 
 from src.logging_config import get_logger
 from .bounds_display_manager import BoundsCheckingDisplayManager
-from .loading import load_config_defaults, load_manifest
+from .loading import load_config_defaults, load_manifest, merge_config
 from .sizes import DEFAULT_TEST_SIZES, safe_mode_filename, size_label
 
 logger = get_logger("[Plugin Harness]")
@@ -116,14 +118,23 @@ def list_modes(plugin_instance: Any, manifest: Dict[str, Any], plugin_id: str) -
 
 def _instantiate(plugin_id: str, manifest: Dict[str, Any], plugin_dir: Path,
                  config: Dict[str, Any], mock_data: Dict[str, Any],
-                 display_manager: Any) -> Any:
+                 display_manager: Any, cache_manager: Any = None) -> Any:
-    """Load and construct a plugin instance with mocked managers."""
+    """Load and construct a plugin instance with mocked managers.
+
+    Pass ``cache_manager`` to share one cache across the renders of a plugin.
+    Building a fresh one per (size, mode) made every render a cold start, so a
+    plugin that fetches per game or per player re-fetched everything N times --
+    baseball-scoreboard took 840s for nine renders where ~72s was the arithmetic
+    -- and the cache-hit path, which is what a running rig executes almost
+    always, was never exercised.
+    """
     from src.plugin_system.plugin_loader import PluginLoader
     from src.plugin_system.testing import MockCacheManager, MockPluginManager
 
-    cache_manager = MockCacheManager()
+    if cache_manager is None:
-    for key, value in (mock_data or {}).items():
+        cache_manager = MockCacheManager()
-        cache_manager.set(key, value)
+        for key, value in (mock_data or {}).items():
+            cache_manager.set(key, value)
 
     loader = PluginLoader()
     plugin_instance, _module = loader.load_plugin(
@@ -160,6 +171,107 @@ def _render_mode(plugin_instance: Any, mode: str) -> Any:
     return plugin_instance.display(force_clear=False)
 
 
+# How many extra frames to drive before believing a mode really draws nothing.
+# A scroll starts with its content off-panel, so frame 1 is legitimately blank;
+# measured across the fleet, content appears by frame 2-4 (f1-scoreboard),
+# frame 4 (ledmatrix-elections) and frame 38 at 64px (ledmatrix-leaderboard).
+EMPTY_RECHECK_FRAMES = 48
+# Seconds to advance the clock between those frames. Scroll position is usually
+# driven by elapsed time, which a frozen clock never provides.
+EMPTY_RECHECK_STEP = 0.05
+
+
+def _has_content(image) -> bool:
+    """True when any pixel is lit above the threshold."""
+    if image is None:
+        return False
+    return image.convert("L").point(
+        lambda p: 255 if p > _LIT_THRESHOLD else 0).getbbox() is not None
+
+
+def _render_mode_again(plugin_instance: Any, mode: str) -> Any:
+    """Draw one more frame WITHOUT force_clear.
+
+    _render_mode passes force_clear=True, which for a scrolling plugin means
+    "reset the scroll to the start" -- so repeating it would redraw frame 1 for
+    ever. The re-check needs the plugin to advance.
+    """
+    sig = inspect.signature(plugin_instance.display)
+    if "display_mode" in sig.parameters:
+        return plugin_instance.display(force_clear=False, display_mode=mode)
+    return plugin_instance.display(force_clear=False)
+
+
+def _settle_empty_frame(inst, mode, dm, result, freezer) -> None:
+    """Give an apparently-empty mode a few frames to draw before believing it.
+
+    One frame is not evidence: a scroll's first frame is its blank scroll-in
+    buffer. Without this, every scrolling plugin was warned about -- 60 of 76
+    warnings on a 44-plugin rig were false, which is the rate at which people
+    stop reading a warning.
+    """
+    if result.error is not None or result.display_returned is False:
+        return
+    if _has_content(result.image):
+        return
+    # The frozen clock is shared by every render in the matrix, so any time this
+    # probe borrows has to be given back -- otherwise a mode that scrolls in
+    # leaves the clock advanced and every later mode renders at the wrong
+    # instant, drifting its golden. Seen as 5 spurious f1_upcoming drifts.
+    resume_at = None
+    if freezer is not None:
+        try:
+            resume_at = freezer()
+        except (AttributeError, TypeError, ValueError):
+            # Not a freezegun factory, or a version whose factory is not
+            # callable. Only used to restore the clock, never load-bearing.
+            resume_at = None
+    try:
+        _settle_loop(inst, mode, dm, result, freezer)
+    finally:
+        if resume_at is not None:
+            try:
+                freezer.move_to(resume_at)
+            except (AttributeError, TypeError, ValueError):
+                pass
+
+
+def _settle_loop(inst, mode, dm, result, freezer) -> None:
+    tick = getattr(freezer, "tick", None) if freezer is not None else None
+    for _ in range(EMPTY_RECHECK_FRAMES):
+        if tick is not None:
+            # timedelta rather than a bare float: freezegun has accepted a
+            # number only since 1.x, and a stale pin would raise here.
+            try:
+                tick(timedelta(seconds=EMPTY_RECHECK_STEP))
+            except (AttributeError, TypeError, ValueError):
+                # Pacing is best-effort; a freezegun that will not take a
+                # timedelta just means this probe runs without advancing time.
+                pass
+        else:
+            # No frozen clock, so the real one has to do the advancing. Without
+            # this the 48 frames run in microseconds, elapsed time stays ~0, and
+            # a scroll driven by elapsed time never moves -- which is exactly
+            # the plugin this check is trying not to slander.
+            time.sleep(EMPTY_RECHECK_STEP)
+        try:
+            result.display_returned = _render_mode_again(inst, mode)
+        except Exception as e:  # noqa: BLE001
+            # Deliberately broad: this calls a plugin's display(), which can
+            # raise anything. Recorded rather than swallowed -- a mode that
+            # renders one good frame and then crashes on the next is broken,
+            # and returning silently here reported it as passing. The frame
+            # already captured stays on the result so the failure is still
+            # inspectable.
+            result.error = repr(e)
+            return
+        image = dm.get_image()
+        if _has_content(image):
+            result.image = image
+            result.overflow = dm.check_overflow()
+            return
+
+
 def _freeze(freeze_time: Optional[str]):
     """Context manager that freezes wall-clock time when freeze_time is given,
     so time-dependent plugins (clocks, countdowns) render deterministic goldens."""
@@ -193,7 +305,9 @@ def render_plugin_matrix(
     manifest = load_manifest(plugin_dir)
     # Start from config_schema.json defaults so the plugin behaves like a real
     # install; explicit caller config still wins over a schema default.
-    config = {"enabled": True, **load_config_defaults(plugin_dir), **(config or {})}
+    config = merge_config(
+        merge_config({"enabled": True}, load_config_defaults(plugin_dir)),
+        config or {})
     sizes = sizes or DEFAULT_TEST_SIZES
     results: List[RenderResult] = []
 
@@ -202,25 +316,35 @@ def render_plugin_matrix(
     # rendering a smaller one, instead of being clipped into a false pass.
     extent = (max(w for w, _ in sizes), max(h for _, h in sizes))
 
-    with _freeze(freeze_time):
+    # One cache for the whole matrix: see _instantiate. The display manager
+    # stays per-render (the bounds checking depends on that); only fetched data
+    # is shared.
+    from src.plugin_system.testing import MockCacheManager
+    cache_manager = MockCacheManager()
+    for key, value in (mock_data or {}).items():
+        cache_manager.set(key, value)
+
+    with _freeze(freeze_time) as freezer:
         for width, height in sizes:
             results.extend(_render_size(
                 plugin_id, manifest, plugin_dir, config, mock_data or {},
-                width, height, run_update, extent,
+                width, height, run_update, extent, cache_manager, freezer,
             ))
 
     return results
 
 
 def _render_size(plugin_id, manifest, plugin_dir, config, mock_data,
-                 width, height, run_update, extent) -> List[RenderResult]:
+                 width, height, run_update, extent,
+                 cache_manager=None, freezer=None) -> List[RenderResult]:
     """Render every mode at one size. A fresh instance per mode avoids state leaks."""
     results: List[RenderResult] = []
 
     # Discover modes once per size (instance build can depend on config).
     try:
         probe_dm = BoundsCheckingDisplayManager(width=width, height=height, overflow_extent=extent)
-        probe = _instantiate(plugin_id, manifest, plugin_dir, config, mock_data, probe_dm)
+        probe = _instantiate(plugin_id, manifest, plugin_dir, config, mock_data, probe_dm,
+                             cache_manager)
         modes = list_modes(probe, manifest, plugin_id)
     except Exception as e:  # noqa: BLE001 — surface any load failure as a result
         return [RenderResult(plugin_id, width, height, "<load>", error=repr(e))]
@@ -229,7 +353,8 @@ def _render_size(plugin_id, manifest, plugin_dir, config, mock_data,
         result = RenderResult(plugin_id, width, height, mode)
         dm = BoundsCheckingDisplayManager(width=width, height=height, overflow_extent=extent)
         try:
-            inst = _instantiate(plugin_id, manifest, plugin_dir, config, mock_data, dm)
+            inst = _instantiate(plugin_id, manifest, plugin_dir, config, mock_data, dm,
+                                cache_manager)
             if run_update:
                 try:
                     inst.update()
@@ -248,6 +373,9 @@ def _render_size(plugin_id, manifest, plugin_dir, config, mock_data,
                 result.display_returned = _render_mode(inst, mode)
                 result.image = dm.get_image()
                 result.overflow = dm.check_overflow()
+                # A blank first frame is not proof of a blank mode; see
+                # _settle_empty_frame.
+                _settle_empty_frame(inst, mode, dm, result, freezer)
         except Exception as e:  # noqa: BLE001 — a display crash is a real failure
             result.error = repr(e)
         results.append(result)

src/plugin_system/testing/loading.py

@@ -33,6 +33,45 @@ def load_manifest(plugin_dir: Union[str, Path]) -> Dict[str, Any]:
         return json.load(f)
 
 
+def _defaults_from_properties(properties: Dict[str, Any]) -> Dict[str, Any]:
+    """Defaults for one `properties` block, recursing into nested objects.
+
+    An object property carries its defaults on its children, not on itself, so
+    reading only the top level dropped everything nested. That is most of the
+    fleet: config organised by league, or under customization/display_options,
+    lost 2,386 defaults across 37 of 44 plugins -- soccer-scoreboard alone lost
+    539 of 565 -- and the harness rendered them with a config no install would
+    ever have.
+    """
+    defaults: Dict[str, Any] = {}
+    for key, prop in (properties or {}).items():
+        if not isinstance(prop, dict):
+            continue
+        if prop.get('type') == 'object' and isinstance(prop.get('properties'), dict):
+            nested = _defaults_from_properties(prop['properties'])
+            if nested:
+                defaults[key] = nested
+        elif 'default' in prop:
+            defaults[key] = prop['default']
+    return defaults
+
+
+def merge_config(base: Dict[str, Any], override: Dict[str, Any]) -> Dict[str, Any]:
+    """Deep-merge override onto base, without dropping sibling defaults.
+
+    A shallow merge would let `-c '{"nhl": {"enabled": true}}'` replace the whole
+    nhl subtree and silently discard every other nhl default -- the same class of
+    bug this function exists to fix.
+    """
+    merged = dict(base)
+    for key, value in (override or {}).items():
+        if isinstance(value, dict) and isinstance(merged.get(key), dict):
+            merged[key] = merge_config(merged[key], value)
+        else:
+            merged[key] = value
+    return merged
+
+
 def load_config_defaults(plugin_dir: Union[str, Path]) -> Dict[str, Any]:
     """Extract default values from a plugin's config_schema.json (empty if none)."""
     schema_path = Path(plugin_dir) / 'config_schema.json'
@@ -40,11 +79,7 @@ def load_config_defaults(plugin_dir: Union[str, Path]) -> Dict[str, Any]:
         return {}
     with open(schema_path, 'r') as f:
         schema = json.load(f)
-    defaults: Dict[str, Any] = {}
+    return _defaults_from_properties(schema.get('properties', {}))
-    for key, prop in schema.get('properties', {}).items():
-        if isinstance(prop, dict) and 'default' in prop:
-            defaults[key] = prop['default']
-    return defaults
 
 
 def load_harness_spec(plugin_dir: Union[str, Path]) -> Dict[str, Any]:

src/plugin_system/testing/visual_display_manager.py

@@ -507,7 +507,15 @@ class VisualTestDisplayManager:
     # ------------------------------------------------------------------
 
     def set_scrolling_state(self, is_scrolling: bool):
-        """Set the current scrolling state (no-op for testing)."""
+        """Set the current scrolling state (no-op for testing).
+
+        Deliberately mirrors DisplayManager.set_scrolling_state exactly. A
+        double that accepts arguments production does not lets a call pass
+        every harness run and then raise TypeError on the panel, which is the
+        one failure a safety harness exists to prevent. ``frame_hold`` arrives
+        here in the same change that adds it to DisplayManager (#523), not
+        before.
+        """
         self._scrolling_state['is_scrolling'] = is_scrolling
         if is_scrolling:
             self._scrolling_state['last_scroll_activity'] = time.time()

test/test_app_plugins_dir_resolution.py

@@ -1,52 +0,0 @@
-"""web_interface/app.py resolves plugins_dir from config at import time.
-
-`project_root` used to be assigned only inside the `else` branch (the
-relative-path case). SchemaManager and composer_bp are wired up with
-`project_root` further down the same module, so a device configured with an
-*absolute* `plugin_system.plugins_directory` (a supported value -- see
-CLAUDE.md) hit `UnboundLocalError` importing web_interface.app at all, taking
-the whole web UI down.
-
-app.py isn't imported directly by the test suite -- it has real side effects
-(managers, background state) at import time -- so this extracts the exact
-resolution block by its stable comment markers and executes it in isolation,
-the same way the rest of the suite validates generated/templated code rather
-than re-implementing it.
-"""
-from pathlib import Path
-
-APP_PY = Path(__file__).resolve().parent.parent / "web_interface/app.py"
-
-START_MARKER = "# Resolve plugin directory - handle both absolute and relative paths\n"
-END_MARKER = "\nplugin_manager = PluginManager("
-
-
-def _resolution_block() -> str:
-    src = APP_PY.read_text()
-    start = src.index(START_MARKER)
-    end = src.index(END_MARKER, start)
-    return src[start:end]
-
-
-def test_resolution_block_still_matches_expected_markers():
-    """If app.py is restructured enough that these markers move, the exec
-    below would silently test nothing -- fail loudly instead."""
-    block = _resolution_block()
-    assert "plugins_dir" in block and "os.path.isabs" in block
-
-
-def test_absolute_plugins_directory_does_not_raise_unboundlocalerror():
-    import os
-    ns = {"os": os, "Path": Path, "__file__": str(APP_PY),
-          "plugins_dir_name": "/opt/ledmatrix-plugins"}
-    exec(compile(_resolution_block(), str(APP_PY), "exec"), ns)  # noqa: S102
-    assert ns["project_root"] == APP_PY.parent.parent
-    assert ns["plugins_dir"] == Path("/opt/ledmatrix-plugins")
-
-
-def test_relative_plugins_directory_still_resolves_under_project_root():
-    import os
-    ns = {"os": os, "Path": Path, "__file__": str(APP_PY),
-          "plugins_dir_name": "plugin-repos"}
-    exec(compile(_resolution_block(), str(APP_PY), "exec"), ns)  # noqa: S102
-    assert ns["plugins_dir"] == ns["project_root"] / "plugin-repos"

test/test_composer_blueprint_registered.py

@@ -1,64 +0,0 @@
-"""composer_bp must actually be registered on the Flask app.
-
-web_interface/blueprints/composer.py defines a full blueprint -- the
-/composer/ page, /composer/api/generate, /composer/api/install, etc. -- but
-nothing in web_interface/app.py imported or registered it. pages_v3 and
-api_v3 both go through the same "import, wire managers, register_blueprint"
-sequence; composer_bp had none of the three. The routes existed and worked
-in isolation (every other composer test builds its own minimal Flask app
-and registers composer_bp directly), but in the real running app every
-composer URL -- including the page itself -- was a 404, and the frontend's
-hardcoded '/composer/api/...' fetches (composer-app.js) had nothing to
-reach.
-
-app.py has import-time side effects (it loads config, builds managers, and
-in some configurations starts background threads), so this scans the source
-text rather than importing the module -- the same approach already used for
-test_composer_js_contracts.py's structural checks.
-"""
-import re
-from pathlib import Path
-
-APP_PY = Path(__file__).resolve().parent.parent / "web_interface" / "app.py"
-
-
-def _source() -> str:
-    return APP_PY.read_text()
-
-
-def test_composer_blueprint_is_imported():
-    src = _source()
-    assert re.search(
-        r"from web_interface\.blueprints\.composer import composer_bp", src
-    ), "app.py never imports composer_bp"
-
-
-def test_composer_blueprint_is_registered_under_composer_prefix():
-    src = _source()
-    match = re.search(
-        r"app\.register_blueprint\(\s*composer_bp\s*,\s*url_prefix\s*=\s*"
-        r"['\"](?P<prefix>[^'\"]*)['\"]",
-        src,
-    )
-    assert match, "app.py never calls app.register_blueprint(composer_bp, ...)"
-    # composer.html and composer-app.js hardcode '/composer/api/...' and
-    # '/composer/api/fonts/...' -- any other prefix serves a page whose own
-    # fetches and @font-face all 404.
-    assert match.group("prefix") == "/composer"
-
-
-def test_composer_blueprint_managers_are_wired_before_registration():
-    """Registered with no managers set means every route 503s or crashes.
-
-    composer.py initialises config_manager/plugin_manager/plugins_dir/
-    project_root to None at import time specifically so app.py can set them
-    -- the same pattern api_v3 and pages_v3 use.
-    """
-    src = _source()
-    register_match = re.search(r"app\.register_blueprint\(\s*composer_bp", src)
-    assert register_match, "app.py never registers composer_bp"
-    before_registration = src[: register_match.start()]
-    for attr in ("config_manager", "plugin_manager", "plugins_dir", "project_root"):
-        assert re.search(rf"composer_bp\.{attr}\s*=", before_registration), (
-            f"composer_bp.{attr} is never set before registration"
-        )

test/test_composer_code_injection.py

@@ -1,323 +0,0 @@
-"""The composer generates Python that the plugin loader imports and executes.
-
-/api/install writes the generated manager.py into plugins_dir and the loader
-imports it, so anything the payload can splice into that source runs on the
-device. The ast.parse check in _generate_plugin_files rejects only *invalid*
-syntax -- an injected `import os` is perfectly valid and passed it.
-
-Two ways in, both confirmed against the code before it was fixed:
-
-  metadata.name = a name containing a triple-quote, a newline, then
-                  `import os; PWNED = os.getuid()`, then another triple-quote
-      -> closes the module docstring; the rest became module-level statements
-         (spelled out rather than shown literally -- writing the payload into
-         this docstring closes *this* file's docstring, which is the bug)
-
-  element x     = '0 or __import__("os").system("id")'
-      -> f-string interpolated it verbatim: x=0 or __import__("os").system("id")
-"""
-import ast
-import re
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from web_interface.blueprints import composer as C  # noqa: E402
-
-BASE_META = {"id": "test-plugin", "name": "Clock", "author": "a",
-             "version": "1.0.0", "description": "d"}
-
-#: Values that terminate a Python expression and start a new statement.
-EXPR_PAYLOADS = [
-    '0 or __import__("os").system("id")',
-    '0);import os;os.system("id");(',
-    '__import__("subprocess").run(["id"])',
-    "0 if False else exec('x=1')",
-    "1e999", "nan", "0x41", "0__0",
-]
-
-#: Values that close a string literal in the generated source.
-LITERAL_PAYLOADS = [
-    'Clock"""\nimport os; PWNED = os.getuid()\n"""',
-    "Clock'''\nimport os\n'''",
-    'Clock" + __import__("os").system("id") + "',
-    "Clock\\", "Clock\nimport os",
-]
-
-
-def _payload(**over):
-    # dataModel.configVars is the key _generate_plugin_files reads; "config_vars"
-    # was never looked at, so anything passed through it tested nothing.
-    p = {"metadata": dict(BASE_META), "elements": [],
-         "dataModel": {"configVars": over.pop("config_vars", [])}}
-    p["metadata"].update(over.pop("metadata", {}))
-    p.update(over)
-    return p
-
-
-def _generated(payload):
-    return C._generate_plugin_files(payload)["manager.py"]
-
-
-def _module_level_code(src):
-    """Statements at module level that are not the docstring/imports/classes."""
-    tree = ast.parse(src)
-    out = []
-    for node in tree.body:
-        if isinstance(node, (ast.ClassDef, ast.FunctionDef, ast.ImportFrom, ast.Import)):
-            continue
-        if isinstance(node, ast.Expr) and isinstance(node.value, ast.Constant):
-            continue  # the docstring
-        out.append(ast.unparse(node))
-    return out
-
-
-@pytest.mark.parametrize("payload", LITERAL_PAYLOADS)
-def test_a_name_that_breaks_out_of_a_literal_is_refused(payload):
-    with pytest.raises(C.ComposerInputError):
-        _generated(_payload(metadata={"name": payload}))
-
-
-#: Types with a drawing branch in manager.py.j2. An injection test using any
-#: other type proves nothing: _preprocess_elements drops it, so its values
-#: never reach the generated source and every assertion passes trivially.
-#: This test previously used "line", which has never had a branch.
-RENDERED_GEOMETRY_CASES = [
-    ("rectangle", {"x": 0, "y": 0, "width": 10, "height": 8}),
-    ("arc", {"x": 0, "y": 0, "width": 24, "height": 24}),
-    ("ellipse", {"x": 0, "y": 0, "width": 24, "height": 12}),
-    ("rounded_rectangle", {"x": 0, "y": 0, "width": 24, "height": 10}),
-    ("gauge", {"x": 0, "y": 0, "width": 32, "height": 32}),
-]
-
-
-@pytest.mark.parametrize("etype,base", RENDERED_GEOMETRY_CASES)
-@pytest.mark.parametrize("evil", EXPR_PAYLOADS)
-@pytest.mark.parametrize("field", ["x", "y", "width", "height"])
-def test_a_non_numeric_geometry_value_cannot_reach_the_source(etype, base, evil, field):
-    """width/height were interpolated raw into the generated source.
-
-    p['x2_expr'] = f"({x_expr}) + {w}" with w straight off the payload, so a
-    rectangle with width='0 or __import__("os").system("id")' produced
-
-        [0, 0, (0) + 0 or __import__("os").system("id"), (0) + 8],
-
-    in a manager.py that /api/install writes to disk and the loader imports.
-    """
-    el = {"type": etype, "id": "e1", **base}
-    el[field] = evil
-    src = _generated(_payload(elements=[el]))
-    assert "__import__" not in src, f"{etype}.{field}={evil!r} reached the generated source"
-    assert "os.system" not in src
-    assert not _module_level_code(src), \
-        f"{etype}.{field}={evil!r} produced module-level statements: {_module_level_code(src)}"
-
-
-def test_every_injection_case_uses_a_type_that_actually_renders():
-    """Guards against the whole suite quietly going vacuous again.
-
-    An element type with no template branch is dropped before generation, so
-    an injection test written against one asserts nothing and still passes.
-    """
-    used = {etype for etype, _ in RENDERED_GEOMETRY_CASES}
-    missing = used - set(C._RENDERABLE_ELEMENT_TYPES)
-    assert not missing, f"injection tests use non-rendering types: {sorted(missing)}"
-
-
-@pytest.mark.parametrize("evil", EXPR_PAYLOADS)
-@pytest.mark.parametrize("channel", ["r", "g", "b"])
-def test_a_non_numeric_colour_channel_cannot_reach_the_source(evil, channel):
-    el = {"type": "text", "id": "t1", "x": 0, "y": 0, "text": "hi",
-          "font": "press_start", "r": 255, "g": 255, "b": 255}
-    el[channel] = evil
-    src = _generated(_payload(elements=[el]))
-    assert "__import__" not in src and "os.system" not in src
-    assert not _module_level_code(src)
-
-
-def test_colour_channels_are_clamped_to_a_byte():
-    el = {"type": "text", "id": "t1", "x": 0, "y": 0, "text": "hi",
-          "font": "press_start", "r": 99999, "g": -5, "b": 128}
-    src = _generated(_payload(elements=[el]))
-    assert "(255, 0, 128)" in src, "channels were not clamped to 0-255"
-
-
-#: fillR/fillG/fillB (and outR/G/B, bgR/G/B, trackR/G/B) go through
-#: _as_fill_filter -> _as_rgb_filter, a separate path from _rgb_expr above.
-#: It used raw int() until it was found to raise ValueError on a non-numeric
-#: channel instead of clamping like every other coerced value in this module.
-@pytest.mark.parametrize("evil", EXPR_PAYLOADS)
-@pytest.mark.parametrize("channel", ["fillR", "fillG", "fillB"])
-def test_a_non_numeric_fill_channel_cannot_reach_the_source(evil, channel):
-    el = {"type": "rectangle", "id": "r1", "x": 0, "y": 0, "width": 10, "height": 8,
-          "fillR": 0, "fillG": 0, "fillB": 128}
-    el[channel] = evil
-    src = _generated(_payload(elements=[el]))
-    assert "__import__" not in src and "os.system" not in src
-    assert not _module_level_code(src)
-
-
-def test_fill_channels_are_clamped_to_a_byte():
-    el = {"type": "rectangle", "id": "r1", "x": 0, "y": 0, "width": 10, "height": 8,
-          "fillR": 99999, "fillG": -5, "fillB": 128}
-    src = _generated(_payload(elements=[el]))
-    assert "(255, 0, 128)" in src, "fill channels were not clamped to 0-255"
-
-
-def test_the_generated_module_still_has_no_top_level_statements():
-    """The clean case: a normal payload produces only imports and a class."""
-    el = {"type": "text", "id": "t1", "x": 4, "y": 4, "text": "hi",
-          "font": "press_start", "r": 1, "g": 2, "b": 3}
-    src = _generated(_payload(elements=[el]))
-    assert not _module_level_code(src)
-    assert "(1, 2, 3)" in src
-
-
-# --- config variable keys ---------------------------------------------------
-
-def _with_key(key):
-    return {"metadata": dict(BASE_META), "elements": [],
-            "dataModel": {"configVars": [{"key": key, "type": "string",
-                                          "default": "x", "label": "L"}]}}
-
-
-@pytest.mark.parametrize("key", ["class", "def", "import", "None", "True",
-                                 "lambda", "pass", "match", "case"])
-def test_a_keyword_config_key_is_named_in_the_error(key):
-    """ast.parse already rejected these, but as an unhelpful line number.
-
-    "Generated code has a syntax error: invalid syntax (line 17)" tells the
-    user nothing about which field to fix.
-    """
-    with pytest.raises(C.ComposerInputError) as exc:
-        _generated(_with_key(key))
-    assert key in str(exc.value) and "keyword" in str(exc.value).lower()
-
-
-@pytest.mark.parametrize("key", ["config", "logger", "display_manager",
-                                 "cache_manager", "plugin_id", "enabled",
-                                 "self", "update", "display"])
-def test_a_reserved_attribute_config_key_is_refused(key):
-    """These generate *valid* Python that silently clobbers plugin state.
-
-    The worst is `config`: the assignment lands right after super().__init__(),
-    so `self.config = config.get("config", "x")` replaces the plugin's config
-    dict with a string and every later self.config.get(...) fails at runtime.
-    """
-    with pytest.raises(C.ComposerInputError) as exc:
-        _generated(_with_key(key))
-    assert key in str(exc.value) and "reserved" in str(exc.value).lower()
-
-
-@pytest.mark.parametrize("key", ["brightness", "my_var", "_private", "x1",
-                                 "update_interval_seconds"])
-def test_ordinary_config_keys_are_still_accepted(key):
-    src = _generated(_with_key(key))
-    assert f"self.{key} = config.get(" in src
-
-
-def test_the_generated_config_assignment_does_not_precede_super_init():
-    """Guards the reasoning behind the reserved list, not just the list."""
-    src = _generated(_with_key("brightness"))
-    body = src.splitlines()
-    super_at = next(i for i, line in enumerate(body) if "super().__init__(" in line)
-    assign_at = next(i for i, line in enumerate(body)
-                     if "self.brightness = config.get(" in line)
-    assert assign_at > super_at, (
-        "config vars are assigned before super().__init__(); the reserved-name "
-        "list assumes they land after it")
-
-
-# --- optional keys ----------------------------------------------------------
-
-@pytest.mark.parametrize("el_type,missing", [
-    ("text", "text"), ("text", "text2"), ("clock", "format"),
-])
-def test_an_element_missing_an_optional_key_does_not_500(el_type, missing):
-    """`p` is a copy of the raw element, so an absent key stays absent.
-
-    The defaults were applied to locals only, so manager.py.j2 rendered
-    `{{ el.text | tojson }}` over a jinja2.Undefined and tojson raised
-    TypeError -- which no handler catches, making a missing key a 500 rather
-    than a validation error or a sensible default.
-    """
-    el = {"type": el_type, "id": "e1", "x": 0, "y": 0, "font": "press_start"}
-    src = _generated(_payload(elements=[el]))
-    ast.parse(src)          # must still be valid Python
-    assert "Undefined" not in src
-
-
-def test_a_clock_without_a_format_uses_the_documented_default():
-    el = {"type": "clock", "id": "c1", "x": 0, "y": 0, "font": "press_start"}
-    src = _generated(_payload(elements=[el]))
-    assert '"%H:%M"' in src, "the %H:%M default did not reach the generated source"
-
-
-#: (element type, channel key, base element) for colour channels that were
-#: interpolated raw rather than through _rgb_expr/_safe_int. Prefixed channels
-#: (emptyR/G/B, labelR/G/B) were the ones the original r/g/b test never reached.
-RAW_COLOUR_CASES = [
-    ("progress_bar", "r",      {"x": 0, "y": 0}),
-    ("progress_bar", "g",      {"x": 0, "y": 0}),
-    ("pips",         "b",      {"x": 0, "y": 0}),
-    ("pips",         "emptyR", {"x": 0, "y": 0}),
-    ("pips",         "emptyG", {"x": 0, "y": 0}),
-    ("sparkline",    "r",      {"x": 0, "y": 0}),
-    ("gauge",        "labelR", {"x": 0, "y": 0, "width": 32, "height": 32}),
-    ("gauge",        "labelB", {"x": 0, "y": 0, "width": 32, "height": 32}),
-]
-
-
-@pytest.mark.parametrize("etype,channel,base", RAW_COLOUR_CASES)
-@pytest.mark.parametrize("evil", EXPR_PAYLOADS)
-def test_a_prefixed_colour_channel_cannot_reach_the_source(etype, channel, base, evil):
-    """Five tuples were built with f"({el.get('r', 100)}, ...)" -- no coercion.
-
-    The pre-existing colour test only covered r/g/b on a text element, so the
-    prefixed channels and the four other types were never exercised.
-    """
-    el = {"type": etype, "id": "e1", **base}
-    el[channel] = evil
-    src = _generated(_payload(elements=[el]))
-    assert "__import__" not in src, f"{etype}.{channel}={evil!r} reached the source"
-    assert "os.system" not in src
-    assert not _module_level_code(src)
-
-
-@pytest.mark.parametrize("value", [float("inf"), float("-inf"), float("nan")])
-@pytest.mark.parametrize("field", ["x", "y", "width", "height"])
-def test_a_non_finite_dimension_does_not_escape_as_an_unhandled_error(field, value):
-    """json.loads accepts Infinity/NaN and Flask passes them through, so a
-    payload can hand _safe_int a non-finite float. int(inf) raises
-    OverflowError -- neither ValueError nor ComposerInputError -- so it escaped
-    both handlers and surfaced as a 500 with a traceback instead of a 422."""
-    el = {"type": "rectangle", "id": "r1", "x": 0, "y": 0, "width": 10, "height": 8}
-    el[field] = value
-    src = _generated(_payload(elements=[el]))       # must not raise
-    # A non-finite value must be replaced by the default, not spelled into the
-    # source. Word-boundary match: "info" in self.logger.info contains "inf".
-    assert not re.search(r"\b(inf|nan|Infinity|NaN)\b", src), \
-        f"{field}={value!r} leaked a non-finite literal into the source"
-    assert not _module_level_code(src)
-
-
-@pytest.mark.parametrize("bad_id", [
-    'x = __import__("os").system("id") #',
-    "x\nimport os\n_y",
-    "x[0]",
-    "",
-    "a" * 200,
-])
-def test_a_marquee_id_cannot_become_code(bad_id):
-    """data_key is spliced UNQUOTED into variable names
-    (_{{ data_key }}_text = ...), so a non-identifier id landed in the source
-    as code. ast.parse caught it, but the caller then got an opaque
-    "Generated code has a syntax error" rather than being told the id is bad."""
-    el = {"type": "marquee", "id": bad_id, "x": 0, "y": 0, "text": "hi"}
-    src = _generated(_payload(elements=[el]))       # must not raise
-    assert "__import__(" not in src
-    assert "os.system(" not in src
-    assert not _module_level_code(src)

test/test_composer_empty_block.py

@@ -1,124 +0,0 @@
-"""An element the template cannot draw must not produce an empty `if` block.
-
-manager.py.j2 wraps each element in `if width >= N:` (breakpoint) and/or
-`if int(time.time() * 2) % 2:` (blink), and the body comes from the per-type
-branches. A type with no branch contributed nothing, so the wrapper opened a
-block with no statements in it. ast.parse in _generate_plugin_files then
-failed and the caller was told only:
-
-    Generated code has a syntax error: expected an indented block after
-    'if' statement on line 49
-
-which names a line of generated source the user never sees. Confirmed against
-the code before the fix with a `group` element carrying minWidth.
-
-Two defences, both covered here: _preprocess_elements drops types the template
-has no branch for, and the template emits a `pass` fallback so a type added to
-the canvas before its branch exists degrades to a no-op instead of a broken
-plugin.
-"""
-import ast
-import re
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from web_interface.blueprints import composer as C  # noqa: E402
-
-TEMPLATE = (Path(__file__).resolve().parent.parent
-            / "web_interface/templates/v3/composer/manager.py.j2")
-
-BASE_META = {"id": "test-plugin", "name": "Clock", "author": "a",
-             "version": "1.0.0", "description": "d"}
-
-
-def generate(element):
-    return C._generate_plugin_files({
-        "metadata": BASE_META,
-        "elements": [element],
-        "dataModel": {"configVars": []},
-    })
-
-
-@pytest.mark.parametrize("wrapper", [
-    {"minWidth": 64},          # breakpoint block
-    {"blink": True},           # blink block
-    {"minWidth": 64, "blink": True},   # both, nested
-])
-@pytest.mark.parametrize("etype", ["group", "widget_9000", "section"])
-def test_undrawable_element_does_not_break_generation(etype, wrapper):
-    element = {"type": etype, "x": 0, "y": 0, "color": "#ffffff", **wrapper}
-    files = generate(element)          # must not raise ComposerInputError
-    assert "manager.py" in files
-
-
-def test_drawable_element_still_renders_inside_a_breakpoint():
-    files = generate({"type": "text", "text": "hi", "x": 0, "y": 0,
-                      "minWidth": 64, "color": "#ffffff"})
-    src = files["manager.py"]
-    assert "if width >= 64:" in src
-    assert "draw_text" in src
-
-
-def test_renderable_types_match_the_template_branches():
-    """The constant and the template must agree.
-
-    A type listed in the constant with no branch emits an empty block (the bug
-    above); a type with a branch but missing from the constant is silently
-    dropped from every generated plugin. Neither is visible without this check.
-    """
-    branches = set(re.findall(r"el\.type == '([a-z_]+)'", TEMPLATE.read_text()))
-    assert branches == set(C._RENDERABLE_ELEMENT_TYPES)
-
-
-def test_template_closes_the_branch_chain_with_a_fallback():
-    """Belt and braces: even if the constant drifts, no empty block escapes."""
-    text = TEMPLATE.read_text()
-    assert "{% else %}" in text
-    assert "pass  # element type" in text
-
-
-@pytest.mark.parametrize("wrapper", [
-    {"minWidth": 64},
-    {"blink": True},
-    {"minWidth": 64, "blink": True},
-])
-def test_dynamic_text_with_non_config_binding_does_not_break_generation(wrapper):
-    """dynamic_text only renders a body for binding.source == 'config'.
-
-    _preprocess_elements accepts any string as binding.source (it just
-    defaults a missing one to 'config'), so a 'live' or 'sensor' source --
-    anything a client sends that isn't literally 'config' -- hit the same
-    empty-if-block bug as an undrawable element type, just one level deeper:
-    the branch is taken, but its own inner `if` produced nothing.
-    """
-    element = {"type": "dynamic_text", "x": 0, "y": 0, "color": "#ffffff",
-               "binding": {"source": "live", "key": "temperature"}, **wrapper}
-    files = generate(element)          # must not raise ComposerInputError
-    assert "manager.py" in files
-    assert "non-config dynamic_text binding draws nothing" in files["manager.py"]
-
-
-def test_binding_source_cannot_break_out_of_the_comment_it_lands_in():
-    """binding.source used to be interpolated straight into a Python comment
-    (`pass  # dynamic_text binding_source "{{ el.binding_source }}" draws
-    nothing`) with no escaping. A source string carrying a newline closed the
-    comment, and text on the following line(s), indented to match, became a
-    real statement in the generated plugin -- CWE-94, and live once
-    composer_bp was registered (confirmed: this exact payload produces a
-    manager.py containing a clean, ast.parse-valid `import os` against the
-    pre-fix template). The comment is now a fixed literal that never
-    interpolates the value at all.
-    """
-    payload = "foo\n            import os\n            os.system('id')  # "
-    element = {"type": "dynamic_text", "x": 0, "y": 0, "color": "#ffffff",
-               "binding": {"source": payload, "key": "temperature"}}
-    files = generate(element)
-    src = files["manager.py"]
-    assert "import os" not in src
-    assert "os.system" not in src
-    assert "non-config dynamic_text binding draws nothing" in src
-    ast.parse(src)          # belt and braces: generate() already enforces this

test/test_composer_js_contracts.py

@@ -1,263 +0,0 @@
-"""Structural checks on the composer's JavaScript.
-
-There is no JS test runner in this repo, but three defects here are structural
-enough to assert on the parse tree, and each was a real bug:
-
-- Stroke widths inside _drawElement were left in canvas pixels while the
-  geometry around them scaled by SCALE, so at SCALE>1 every outline rendered
-  thinner than one LED pixel and the preview stopped matching the panel.
-- The `line` branch drew raw el.x0/el.y0/el.x1/el.y1, ignoring the anchor that
-  every other element type honours, so setting xAnchor moved everything except
-  lines -- and getBoundingBox had the same omission, leaving the hit box behind.
-- Four methods mutated exactly what _snapshot() serialises (metadata,
-  currentPreset) without calling it. _snapshot is the only caller of
-  _debouncedAutosave, so those changes were lost on reload and could not be
-  undone.
-"""
-import re
-from pathlib import Path
-
-import pytest
-
-tree_sitter = pytest.importorskip("tree_sitter")
-tree_sitter_javascript = pytest.importorskip("tree_sitter_javascript")
-
-JS_DIR = Path(__file__).resolve().parent.parent / "web_interface/static/v3/js/composer"
-CANVAS = JS_DIR / "composer-canvas.js"
-APP = JS_DIR / "composer-app.js"
-
-
-def _function_source(path: Path, name: str) -> str:
-    """Return the source of a top-level function declaration by name."""
-    src = path.read_bytes()
-    lang = tree_sitter.Language(tree_sitter_javascript.language())
-    tree = tree_sitter.Parser(lang).parse(src)
-    found = []
-
-    def walk(node):
-        if node.type == "function_declaration":
-            ident = node.child_by_field_name("name")
-            if ident is not None and src[ident.start_byte:ident.end_byte].decode() == name:
-                found.append(src[node.start_byte:node.end_byte].decode())
-        for c in node.children:
-            walk(c)
-
-    walk(tree.root_node)
-    assert found, f"{name} not found in {path.name}"
-    return found[0]
-
-
-def _method_source(path: Path, name: str) -> str:
-    """Return the source of a top-level object method by name."""
-    src = path.read_bytes()
-    lang = tree_sitter.Language(tree_sitter_javascript.language())
-    tree = tree_sitter.Parser(lang).parse(src)
-    found = []
-
-    def walk(node):
-        if node.type == "method_definition":
-            ident = node.child_by_field_name("name")
-            if ident is not None and src[ident.start_byte:ident.end_byte].decode() == name:
-                found.append(src[node.start_byte:node.end_byte].decode())
-        for c in node.children:
-            walk(c)
-
-    walk(tree.root_node)
-    assert found, f"{name} not found in {path.name}"
-    return found[0]
-
-
-def test_both_files_parse():
-    lang = tree_sitter.Language(tree_sitter_javascript.language())
-    parser = tree_sitter.Parser(lang)
-    for path in (CANVAS, APP):
-        tree = parser.parse(path.read_bytes())
-        errors = []
-
-        def walk(node):
-            if node.type == "ERROR" or node.is_missing:
-                errors.append(node.start_point[0] + 1)
-            for c in node.children:
-                walk(c)
-
-        walk(tree.root_node)
-        assert not errors, f"{path.name} has parse errors at lines {errors}"
-
-
-def test_element_strokes_scale_with_scale():
-    """No bare `ctx.lineWidth = 1` inside _drawElement.
-
-    Selection handles and the grid are drawn in canvas pixels deliberately and
-    live in other functions, so this is scoped to the element drawing routine.
-    """
-    body = _function_source(CANVAS, "_drawElement")
-    offenders = re.findall(r"ctx\.lineWidth\s*=\s*1\s*;", body)
-    assert not offenders, f"{len(offenders)} unscaled stroke width(s) in _drawElement"
-
-
-def test_line_branch_applies_the_anchor_offset():
-    """Scoped to _drawElement.
-
-    getBoundingBox has its own `case 'line': {` and appears first in the file,
-    so searching the whole text found *that* branch -- this assertion passed
-    with the draw branch's anchor offset removed. Verified: stripping it and
-    re-running gave 11/11 green.
-    """
-    body = _function_source(CANVAS, "_drawElement")
-    line_branch = body[body.index("case 'line': {"):]
-    line_branch = line_branch[:line_branch.index("case 'divider'")]
-    assert "ax - el.x0" in line_branch and "ay - el.y0" in line_branch, \
-        "line drawing ignores xAnchor/yAnchor"
-    assert "moveTo(el.x0 * s" not in line_branch, \
-        "line still drawn from unanchored endpoints"
-
-
-def test_line_bounding_box_applies_the_anchor_offset():
-    """The companion to the above: scoped to getBoundingBox specifically, so
-    the two tests cannot both be satisfied by the same branch."""
-    body = _function_source(CANVAS, "getBoundingBox")
-    box = body[body.index("case 'line'"):]
-    box = box[:box.index("case 'divider'")]
-    assert "ax - el.x0" in box, "line bounding box ignores the anchor"
-
-
-@pytest.mark.parametrize("method", [
-    "onBgColorChange",     # mutates metadata.bgColor
-    "setCustomSize",       # mutates currentPreset / MATRIX_W / MATRIX_H
-    "changePreset",        # mutates currentPreset / MATRIX_W / MATRIX_H
-    "applyPresetLabel",    # same, for sizes not in DISPLAY_PRESETS
-    "onColorChange",       # the one that was already fixed — keeps it fixed
-])
-def test_state_mutations_take_a_snapshot(method):
-    body = _method_source(APP, method)
-    assert "_snapshot()" in body, \
-        f"{method} changes snapshotted state without calling _snapshot()"
-    assert "isDirty = true" in body, f"{method} does not mark the design dirty"
-
-
-@pytest.mark.parametrize("method", ["changePreset", "applyPresetLabel"])
-def test_restore_path_stays_snapshot_free(method):
-    """_applyState and loadTemplate call these with {silent: true} while
-    restoring; snapshotting there would push restore steps onto the undo stack
-    and re-autosave the state just loaded."""
-    body = _method_source(APP, method)
-    assert "opts.silent" in body, f"{method} lost its silent guard"
-    snap = body.index("_snapshot()")
-    guard = body.index("!opts.silent")
-    assert guard < snap, f"{method} snapshots outside the !opts.silent guard"
-
-
-TEMPLATE_HTML = (Path(__file__).resolve().parent.parent
-                 / "web_interface/templates/v3/composer.html")
-
-#: The six toolbar buttons and the wrapper each must call.
-ALIGN_BUTTONS = ["alignLeft", "alignHCenter", "alignRight",
-                 "alignTop", "alignVCenter", "alignBottom"]
-
-
-def test_alignment_buttons_use_the_anchor_clearing_path():
-    """Two alignment implementations existed and the toolbar used the wrong one.
-
-    The legacy alignElement(dir) set el.x/el.y but left xAnchor/yAnchor in
-    place. resolveAnchor turns anchor='right' into `dim - val`, so "align left"
-    (el.x = 0) resolved to x = MATRIX_W -- the element jumped to the far right
-    edge instead. _alignElement clears the anchor first, so the stored value is
-    absolute, and it also updates el.x0/el.y0 so lines actually move.
-    """
-    html = TEMPLATE_HTML.read_text()
-    for wrapper in ALIGN_BUTTONS:
-        assert f"{wrapper}()" in html, f"toolbar does not call {wrapper}()"
-    assert not re.search(r"[^_]alignElement\(", html), \
-        "toolbar still calls the legacy alignElement()"
-
-
-def test_the_legacy_alignelement_is_gone():
-    """Leaving it in place invites the toolbar drifting back to it."""
-    src = APP.read_text()
-    assert not re.search(r"^\s{4}alignElement\(dir\)", src, re.M), \
-        "legacy alignElement(dir) still defined"
-
-
-def test_align_clears_the_anchor_and_moves_line_endpoints():
-    body = _method_source(APP, "_alignElement")
-    assert "xAnchor = null" in body and "yAnchor = null" in body, \
-        "_alignElement no longer clears the anchor, so aligning an anchored " \
-        "element resolves to the wrong edge"
-    assert "el.x0" in body and "el.y0" in body, \
-        "_alignElement no longer moves line endpoints"
-
-
-def test_align_translates_both_line_endpoints_not_just_the_start():
-    """Setting only x0 (or y0) left x1/y1 behind, so aligning a line changed
-    its shape instead of moving it -- e.g. a line from x0=20 to x1=50 aligned
-    right became x0=98, x1=50, stretching rather than translating it. Both
-    endpoints must move by the same delta."""
-    body = _method_source(APP, "_alignElement")
-    x_branch = body[body.index("if (axis === 'x')"):body.index("} else {")]
-    y_branch = body[body.index("} else {"):]
-    assert "el.x1" in x_branch, \
-        "_alignElement moves x0 but not x1 -- a line's shape changes, not its position"
-    assert "el.y1" in y_branch, \
-        "_alignElement moves y0 but not y1 -- a line's shape changes, not its position"
-
-
-def test_divider_stroke_is_centered_in_led_pixels():
-    """A 0.5 canvas-pixel offset (correct only at SCALE=1) was applied after
-    scaling instead of before it, so at SCALE>1 the stroke bled into the
-    preceding LED row/column instead of straddling its own."""
-    body = _function_source(CANVAS, "_drawElement")
-    divider_branch = body[body.index("case 'divider'"):]
-    divider_branch = divider_branch[:divider_branch.index("case 'pips'")]
-    assert "ay * s + 0.5" not in divider_branch, \
-        "divider still offsets by 0.5 canvas pixels after scaling"
-    assert "ax * s + 0.5" not in divider_branch, \
-        "divider still offsets by 0.5 canvas pixels after scaling"
-    assert "(ay + 0.5) * s" in divider_branch and "(ax + 0.5) * s" in divider_branch, \
-        "divider stroke is not centered within its LED pixel"
-
-
-def test_gauge_radii_are_clamped_to_zero():
-    """An imported design can carry a small gauge with a wide lineWidth --
-    width=1, height=1, lineWidth=3 sends a negative radius into
-    ctx.ellipse(), which throws IndexSizeError and aborts render() for every
-    element still to be drawn, not just the gauge."""
-    body = _function_source(CANVAS, "_drawElement")
-    gauge_branch = body[body.index("case 'gauge'"):]
-    assert re.search(r"Math\.max\(0,\s*rx\s*-\s*lwPx\s*/\s*2\)", gauge_branch), \
-        "gauge x-radius is not clamped to zero"
-    assert re.search(r"Math\.max\(0,\s*ry\s*-\s*lwPx\s*/\s*2\)", gauge_branch), \
-        "gauge y-radius is not clamped to zero"
-    assert "rx - lwPx / 2" not in re.sub(r"Math\.max\(0,\s*rx\s*-\s*lwPx\s*/\s*2\)", "", gauge_branch), \
-        "an unclamped gauge radius is still passed to ctx.ellipse()"
-
-
-#: ELEMENT_DEFAULTS in composer-canvas.js gives exactly these types a
-#: `binding` object; verified against that file rather than assumed.
-BOUND_TYPES = ["dynamic_text", "progress_bar", "countdown", "pips", "sparkline", "gauge"]
-
-
-def test_bound_types_constant_lists_every_bound_element_type():
-    """ELEMENT_DEFAULTS in composer-canvas.js gives dynamic_text, progress_bar,
-    countdown, pips, sparkline and gauge a `binding` object. If a type is added
-    to (or removed from) that list without updating APP's BOUND_TYPES, the
-    checks below drift out of sync silently -- this pins the two together."""
-    src = APP.read_text()
-    match = re.search(r"const BOUND_TYPES = \[([^\]]*)\];", src)
-    assert match, "BOUND_TYPES constant not found in composer-app.js"
-    declared = {t.strip().strip("'\"") for t in match.group(1).split(",") if t.strip()}
-    assert declared == set(BOUND_TYPES), \
-        f"BOUND_TYPES {declared} does not match the bound element types {set(BOUND_TYPES)}"
-
-
-@pytest.mark.parametrize("method", ["_isBound", "removeConfigVar", "_validateBeforeExport"])
-def test_binding_checks_cover_every_bound_element_type(method):
-    """Only dynamic_text and progress_bar were checked, so a countdown, pips,
-    sparkline or gauge element with an empty binding passed export validation
-    silently, and deleting a config var still used by one of them gave no
-    warning -- the plugin would read a now-missing key at runtime with no
-    indication why."""
-    body = _method_source(APP, method)
-    assert "BOUND_TYPES.includes(e.type)" in body, \
-        f"{method} does not check every bound element type via BOUND_TYPES"
-    assert "e.type === 'dynamic_text'" not in body, \
-        f"{method} still hardcodes only dynamic_text instead of BOUND_TYPES"

test/test_composer_path_containment.py

@@ -1,225 +0,0 @@
-"""A composer plugin id must never resolve outside the plugins directory.
-
-CodeQL reported sixteen high-severity py/path-injection alerts against
-web_interface/blueprints/composer.py: a request-supplied plugin_id reaching
-Path(plugins_dir) / plugin_id, which is then created, written to, deleted
-(shutil.rmtree) and read back.
-
-The id was already validated by an anchored regex, so every traversal payload
-was in fact rejected. What was missing was the guarantee living *with* the path
-building rather than in a regex several hundred lines away -- loosen that regex
-later and the traversal opens silently, with nothing at the filesystem boundary
-to catch it. _plugin_dir() closes that, and is the form static analysis can see.
-"""
-import sys
-from pathlib import Path
-from unittest.mock import MagicMock
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from web_interface.blueprints import composer as C  # noqa: E402
-
-#: Anything that has ever been used to climb out of a directory.
-TRAVERSAL = [
-    "../../etc/passwd", "..", ".", "a/../../etc", "good/../../..",
-    "/etc/passwd", "//etc/passwd", "a\\..\\..", "a%2f..%2f..",
-    "....//....//etc", "a/./../../etc", "~", "~root",
-    "plugin/../../../../../../etc/shadow",
-]
-
-#: Rejected for shape, not traversal -- but rejected all the same.
-MALFORMED = ["", "A-upper", "1-leading-digit", "-leading-dash", "has_underscore",
-             "has space", "has.dot", "a" * 64, "plugin\n", "plugin\n../../etc",
-             "\n", "plug\x00in"]
-
-
-@pytest.fixture
-def plugins_dir(tmp_path, monkeypatch):
-    base = tmp_path / "plugin-repos"
-    base.mkdir()
-    monkeypatch.setattr(C.composer_bp, "plugins_dir", str(base), raising=False)
-    return base
-
-
-@pytest.mark.parametrize("payload", TRAVERSAL)
-def test_traversal_payloads_are_refused(plugins_dir, payload):
-    assert C._plugin_dir(payload) is None
-
-
-@pytest.mark.parametrize("payload", MALFORMED)
-def test_malformed_ids_are_refused(plugins_dir, payload):
-    assert C._plugin_dir(payload) is None
-
-
-@pytest.mark.parametrize("payload", ["a", "my-plugin", "x9", "a" * 63])
-def test_valid_ids_resolve_inside_the_base(plugins_dir, payload):
-    resolved = C._plugin_dir(payload)
-    assert resolved is not None, f"{payload!r} was rejected but is valid"
-    assert resolved.parent == plugins_dir.resolve(), (
-        f"{payload!r} resolved to {resolved}, outside {plugins_dir}")
-
-
-def test_no_payload_can_escape_even_if_the_regex_is_loosened(plugins_dir, monkeypatch):
-    """The containment check must stand on its own.
-
-    This is the whole point of resolving at the filesystem boundary: if the id
-    pattern is ever relaxed, traversal must still be impossible. Replace the
-    regex with one that permits slashes and dots, then re-run the payloads.
-    """
-    import re
-    monkeypatch.setattr(C, "_PLUGIN_ID_RE", re.compile(r"\A[\w./\\~-]+\Z"))
-    import os
-    escaped = []
-    base = os.path.realpath(str(plugins_dir))
-    for payload in TRAVERSAL:
-        resolved = C._plugin_dir(payload)
-        if resolved is None:
-            continue
-        real = os.path.realpath(str(resolved))
-        if real != base and os.path.commonpath([base, real]) != base:
-            escaped.append((payload, real))
-    assert not escaped, f"these escaped the base with a loosened regex: {escaped}"
-
-
-def test_a_sibling_directory_with_a_shared_prefix_is_not_inside(tmp_path, monkeypatch):
-    """commonpath, not startswith.
-
-    "/x/plugins-evil" starts with "/x/plugins" but is a different directory, so
-    a prefix test would accept it.
-    """
-    base = tmp_path / "plugins"
-    base.mkdir()
-    (tmp_path / "plugins-evil").mkdir()
-    monkeypatch.setattr(C.composer_bp, "plugins_dir", str(base), raising=False)
-    import re
-    # Neutralise the two layers in front so this exercises the containment
-    # check itself; otherwise secure_filename rejects the payload first and a
-    # startswith regression would go unnoticed here.
-    monkeypatch.setattr(C, "_PLUGIN_ID_RE", re.compile(r"\A[\w./\\~-]+\Z"))
-    monkeypatch.setattr(C, "secure_filename", lambda v: v)
-    assert C._plugin_dir("../plugins-evil") is None
-
-
-def test_containment_still_holds_if_the_sanitiser_is_defeated(plugins_dir, monkeypatch):
-    """Each layer is tested on its own, not just the stack.
-
-    secure_filename's equality guard rejects every traversal payload before the
-    containment check sees it, so removing containment does not fail the other
-    tests -- which would make it look load-bearing when it is not. Neutralise
-    the regex *and* the sanitiser, and the realpath/commonpath check must still
-    refuse everything on its own.
-    """
-    import re
-    monkeypatch.setattr(C, "_PLUGIN_ID_RE", re.compile(r"\A[\w./\\~-]+\Z"))
-    monkeypatch.setattr(C, "secure_filename", lambda v: v)
-    import os
-    base = os.path.realpath(str(plugins_dir))
-    escaped = []
-    for payload in TRAVERSAL:
-        resolved = C._plugin_dir(payload)
-        if resolved is None:
-            continue
-        real = os.path.realpath(str(resolved))
-        # Inside the base is fine -- "...." and "~" are ordinary directory
-        # names on Linux, so they are not escapes. What must never happen is
-        # landing outside the base, or on the base itself: install() rmtrees
-        # its target, so the plugins root resolving to a "plugin" would wipe
-        # every installed plugin.
-        if real == base or os.path.commonpath([base, real]) != base:
-            escaped.append((payload, real))
-    assert not escaped, f"containment alone let these through: {escaped}"
-
-
-def test_secure_filename_never_rewrites_an_accepted_id(plugins_dir):
-    """The sanitiser must be a no-op on everything the regex accepts.
-
-    If secure_filename ever altered an accepted id, _plugin_dir would resolve
-    to a *different* plugin's directory than the caller asked for -- a silent
-    redirect, which is worse than a refusal. The guard turns that into a
-    refusal; this proves the guard never has to fire in practice.
-    """
-    import random
-    from werkzeug.utils import secure_filename
-    random.seed(1)
-    alphabet = "abcdefghijklmnopqrstuvwxyz0123456789-"
-    altered = []
-    for _ in range(2000):
-        n = random.randint(1, 63)
-        cand = random.choice("abcdefghijklmnopqrstuvwxyz") + "".join(
-            random.choice(alphabet) for _ in range(n - 1))
-        if C._PLUGIN_ID_RE.match(cand) and secure_filename(cand) != cand:
-            altered.append((cand, secure_filename(cand)))
-    assert not altered, f"secure_filename rewrote accepted ids: {altered[:5]}"
-
-
-def test_a_trailing_newline_is_not_a_valid_id():
-    r"""Python's `$` also matches before a trailing newline, so the original
-    `^...$` accepted "myplugin\n" and would have created a directory whose
-    name ends in one. \Z does not."""
-    assert C._PLUGIN_ID_RE.match("myplugin") is not None
-    assert C._PLUGIN_ID_RE.match("myplugin\n") is None
-
-
-# --- font serving -----------------------------------------------------------
-
-FONT_TRAVERSAL = [
-    "../../../etc/passwd", "../config/config.json", "..%2f..%2fetc%2fpasswd",
-    "PressStart2P-Regular.ttf/../../../etc/passwd", "/etc/passwd", "",
-    "PressStart2P-Regular.TTF",          # case differs -> not the allowlisted name
-    "PressStart2P-Regular.ttf ",         # trailing space
-]
-
-
-def test_serve_font_refuses_a_file_that_exists_but_is_not_allowlisted(monkeypatch, tmp_path):
-    """The allowlist must be what refuses it, not a missing file.
-
-    Asserting 404 on traversal payloads proves nothing here: Flask's router
-    will not match a path segment containing '/', and everything else 404s
-    simply because no such file exists. Put a real, readable file next to the
-    fonts and confirm it is still refused -- that is the allowlist working.
-    """
-    fonts = tmp_path / "assets" / "fonts"
-    fonts.mkdir(parents=True)
-    (fonts / "id_rsa.ttf").write_bytes(b"PRIVATE KEY")
-    monkeypatch.setattr(C.composer_bp, "project_root", str(tmp_path), raising=False)
-    app = __import__("flask").Flask(__name__)
-    app.register_blueprint(C.composer_bp)
-    with app.test_client() as client:
-        resp = client.get("/api/fonts/id_rsa.ttf")
-    assert resp.status_code == 404, (
-        "a readable non-allowlisted file was served; the allowlist is not gating")
-    assert b"PRIVATE KEY" not in resp.data
-
-
-@pytest.mark.parametrize("payload", FONT_TRAVERSAL)
-def test_serve_font_refuses_anything_not_allowlisted(payload, monkeypatch, tmp_path):
-    """The name reaching the filesystem must come from the allowlist constant.
-
-    _ALLOWED_FONTS gates this endpoint, so nothing here was ever exploitable.
-    Building the path from the matched constant rather than the request value
-    is what makes that provable -- and it is why CodeQL reported two
-    high-severity py/path-injection alerts on an endpoint that was already
-    safe.
-    """
-    monkeypatch.setattr(C.composer_bp, "project_root", str(tmp_path), raising=False)
-    app = C.composer_bp.name and __import__("flask").Flask(__name__)
-    app.register_blueprint(C.composer_bp)
-    with app.test_client() as client:
-        resp = client.get(f"/api/fonts/{payload}")
-    assert resp.status_code in (404, 405, 308), (
-        f"{payload!r} was not refused (status {resp.status_code})")
-
-
-def test_serve_font_still_serves_each_allowlisted_font(monkeypatch, tmp_path):
-    fonts = tmp_path / "assets" / "fonts"
-    fonts.mkdir(parents=True)
-    monkeypatch.setattr(C.composer_bp, "project_root", str(tmp_path), raising=False)
-    app = __import__("flask").Flask(__name__)
-    app.register_blueprint(C.composer_bp)
-    for name in C._ALLOWED_FONTS:
-        (fonts / name).write_bytes(b"\x00\x01ttf")
-        with app.test_client() as client:
-            resp = client.get(f"/api/fonts/{name}")
-        assert resp.status_code == 200, f"{name} should be served, got {resp.status_code}"

test/test_harness_empty_claimed.py

@@ -101,3 +101,61 @@ class TestSkippedResults:
         r = _result(None, returned=None)
         check_empty_claimed([r], strict=True)
         assert r.empty_claimed is None
+
+
+class TestSettleRecordsLaterFailures:
+    """A mode that renders one good frame and then crashes is broken.
+
+    _settle_loop re-renders a mode that came back blank, to give a scroll or an
+    animation time to put something on the panel. Swallowing an exception from
+    those later frames meant the harness reported a passing result for a mode
+    that crashes as soon as it is asked for a second frame -- exactly the kind
+    of defect the harness exists to catch.
+    """
+
+    class Boom:
+        """Renders once, then raises."""
+
+        def __init__(self):
+            self.calls = 0
+
+        def display(self, force_clear=False):
+            self.calls += 1
+            raise RuntimeError("second frame exploded")
+
+    def _settle(self, inst, dm, result):
+        from src.plugin_system.testing import harness
+        harness._settle_loop(inst, "mode", dm, result, None)
+
+    def test_the_exception_is_recorded_on_the_result(self, monkeypatch):
+        from src.plugin_system.testing import harness
+        # Keep the probe short; this test is about the error, not the pacing.
+        monkeypatch.setattr(harness, "EMPTY_RECHECK_FRAMES", 1)
+        monkeypatch.setattr(harness, "EMPTY_RECHECK_STEP", 0)
+
+        result = _result(_blank())
+        assert result.error is None
+        self._settle(self.Boom(), _FakeDM(), result)
+
+        assert result.error is not None, "a crash on a later frame was swallowed"
+        assert "second frame exploded" in result.error
+
+    def test_the_already_captured_frame_is_kept(self, monkeypatch):
+        from src.plugin_system.testing import harness
+        monkeypatch.setattr(harness, "EMPTY_RECHECK_FRAMES", 1)
+        monkeypatch.setattr(harness, "EMPTY_RECHECK_STEP", 0)
+
+        image = _blank()
+        result = _result(image)
+        self._settle(self.Boom(), _FakeDM(), result)
+        assert result.image is image, "the good frame was discarded along with the error"
+
+
+class _FakeDM:
+    """Minimal display-manager double for _settle_loop."""
+
+    def get_image(self):
+        return _blank()
+
+    def check_overflow(self):
+        return None

test/test_on_demand_mailbox.py

@@ -0,0 +1,106 @@
+"""The on-demand request mailbox: how often it is read, and how it is consumed.
+
+The mailbox is a cache key the web process writes and the display process
+reads. Two properties matter and neither is obvious from the call site:
+
+  * it is polled after every rendered frame, so an uncached read here is a
+    disk read at frame rate;
+  * consuming it must not throw away a request that arrived while the previous
+    one was being processed.
+"""
+
+from unittest.mock import MagicMock
+
+import pytest
+
+
+class TestPollingIsBounded:
+    """_poll_on_demand_requests runs ~125x/second on a scrolling mode.
+
+    The read is deliberately uncached (memory_ttl=0) because a cached one
+    pinned the first request for an hour. That makes the call a real disk read,
+    so it needs a floor -- without one it was ~125 reads per second to find
+    nothing at all.
+    """
+
+    def test_first_call_always_reads(self, test_display_controller):
+        c = test_display_controller
+        c.cache_manager.get = MagicMock(return_value=None)
+        c._poll_on_demand_requests()
+        assert c.cache_manager.get.call_count == 1
+
+    def test_immediate_second_call_does_not_read(self, test_display_controller):
+        c = test_display_controller
+        c.cache_manager.get = MagicMock(return_value=None)
+        c._poll_on_demand_requests()
+        for _ in range(50):
+            c._poll_on_demand_requests()
+        assert c.cache_manager.get.call_count == 1, "polling was not bounded"
+
+    def test_reads_again_once_the_interval_has_passed(self, test_display_controller, monkeypatch):
+        c = test_display_controller
+        c.cache_manager.get = MagicMock(return_value=None)
+        clock = {"t": 1000.0}
+        monkeypatch.setattr("src.display_controller.time.monotonic", lambda: clock["t"])
+
+        c._poll_on_demand_requests()
+        clock["t"] += c.ON_DEMAND_POLL_INTERVAL / 2
+        c._poll_on_demand_requests()
+        assert c.cache_manager.get.call_count == 1, "read before the interval elapsed"
+
+        clock["t"] += c.ON_DEMAND_POLL_INTERVAL
+        c._poll_on_demand_requests()
+        assert c.cache_manager.get.call_count == 2
+
+    def test_the_interval_is_short_enough_to_feel_instant(self, test_display_controller):
+        # A person clicking in the web UI must not notice the floor.
+        assert test_display_controller.ON_DEMAND_POLL_INTERVAL <= 0.5
+
+
+class TestMailboxIsConsumedByIdentity:
+    """Deleting whatever is in the mailbox loses a request that raced in."""
+
+    def _arrange(self, controller, first, later):
+        """Mailbox returns `first`, then `later` on the pre-delete re-read."""
+        controller.on_demand_active = False
+        controller.on_demand_request_id = None
+        controller._last_on_demand_poll = None
+        reads = iter([first, later])
+
+        def fake_get(key, *a, **kw):
+            if key == 'display_on_demand_request':
+                return next(reads, later)
+            return None  # processed-id lookup
+
+        controller.cache_manager.get = MagicMock(side_effect=fake_get)
+        controller.cache_manager.set = MagicMock()
+        controller.cache_manager.delete = MagicMock()
+        controller._activate_on_demand = MagicMock()
+
+    REQ_A = {'request_id': 'A', 'action': 'start', 'plugin_id': 'p', 'mode': 'm'}
+    REQ_B = {'request_id': 'B', 'action': 'start', 'plugin_id': 'p', 'mode': 'm'}
+
+    def test_own_request_is_deleted(self, test_display_controller):
+        c = test_display_controller
+        self._arrange(c, self.REQ_A, self.REQ_A)
+        c._poll_on_demand_requests()
+        c.cache_manager.delete.assert_called_once_with('display_on_demand_request')
+
+    def test_a_newer_request_is_left_for_the_next_poll(self, test_display_controller):
+        c = test_display_controller
+        self._arrange(c, self.REQ_A, self.REQ_B)
+        c._poll_on_demand_requests()
+        assert c.cache_manager.delete.call_count == 0, \
+            "request B was deleted without ever being processed"
+
+    def test_an_already_empty_mailbox_is_still_cleared(self, test_display_controller):
+        c = test_display_controller
+        self._arrange(c, self.REQ_A, None)
+        c._poll_on_demand_requests()
+        c.cache_manager.delete.assert_called_once_with('display_on_demand_request')
+
+    def test_the_request_is_still_processed(self, test_display_controller):
+        c = test_display_controller
+        self._arrange(c, self.REQ_A, self.REQ_B)
+        c._poll_on_demand_requests()
+        c._activate_on_demand.assert_called_once()

test/test_starlark_display_contract.py

@@ -0,0 +1,82 @@
+"""starlark-apps: display() must report what actually reached the panel.
+
+The display controller skips a mode only on a boolean False. Returning True
+after the frame update failed told it the mode had rendered, so it held a dead
+frame for the whole display_duration instead of rotating on -- the same class
+of defect as a display() that returns None.
+"""
+
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+PLUGIN_DIR = Path(__file__).resolve().parent.parent / "plugin-repos" / "starlark-apps"
+
+
+@pytest.fixture(scope="module")
+def manager_module():
+    if not PLUGIN_DIR.exists():
+        pytest.skip("starlark-apps plugin is not checked out")
+    sys.path.insert(0, str(PLUGIN_DIR))
+    try:
+        import importlib
+        spec = importlib.util.spec_from_file_location(
+            "starlark_manager_under_test", PLUGIN_DIR / "manager.py")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        return module
+    except Exception as e:  # noqa: BLE001 - optional deps (pixlet, fcntl) may be absent
+        pytest.skip(f"starlark-apps manager is not importable here: {e}")
+    finally:
+        sys.path.remove(str(PLUGIN_DIR))
+
+
+def _plugin(manager_module):
+    """A manager with __init__ bypassed -- only display paths are under test."""
+    cls = manager_module.StarlarkAppsPlugin
+    inst = cls.__new__(cls)
+    inst.logger = MagicMock()
+    inst.display_manager = MagicMock()
+    inst.current_app = None
+    return inst
+
+
+class _App:
+    def __init__(self, frames):
+        self.frames = frames
+        self.current_frame_index = 0
+        self.last_frame_time = 0.0
+        self.app_id = "app"
+
+
+class TestDisplayFramePropagates:
+    def test_a_failed_update_returns_false(self, manager_module):
+        p = _plugin(manager_module)
+        p.current_app = _App([("frame", 100)])
+        p.display_manager.update_display.side_effect = RuntimeError("panel gone")
+
+        assert p._display_frame() is False
+
+    def test_a_good_update_returns_true(self, manager_module):
+        p = _plugin(manager_module)
+        p.current_app = _App([("frame", 100)])
+
+        assert p._display_frame() is True
+
+    def test_no_frames_returns_false(self, manager_module):
+        p = _plugin(manager_module)
+        p.current_app = _App([])
+
+        assert p._display_frame() is False
+
+    def test_display_reports_the_frame_failure(self, manager_module):
+        p = _plugin(manager_module)
+        p.current_app = _App([("frame", 100)])
+        p.display_manager.update_display.side_effect = RuntimeError("panel gone")
+
+        result = p.display()
+
+        assert result is False, "display() claimed success over a failed frame update"
+        assert isinstance(result, bool), "the controller only skips on a real bool"

web_interface/app.py

@@ -83,11 +83,11 @@ plugin_system_config = config.get('plugin_system', {})
 plugins_dir_name = plugin_system_config.get('plugins_directory', 'plugin-repos')
 
 # Resolve plugin directory - handle both absolute and relative paths
-project_root = Path(__file__).parent.parent
 if os.path.isabs(plugins_dir_name):
     plugins_dir = Path(plugins_dir_name)
 else:
     # If relative, resolve relative to the project root (LEDMatrix directory)
+    project_root = Path(__file__).parent.parent
     plugins_dir = project_root / plugins_dir_name
 
 plugin_manager = PluginManager(
@@ -157,7 +157,6 @@ _health_monitor_initialized = False
 # Register blueprints
 from web_interface.blueprints.pages_v3 import pages_v3
 from web_interface.blueprints.api_v3 import api_v3
-from web_interface.blueprints.composer import composer_bp
 
 # Initialize managers in blueprints
 pages_v3.config_manager = config_manager
@@ -174,11 +173,6 @@ api_v3.operation_queue = operation_queue
 api_v3.plugin_state_manager = plugin_state_manager
 api_v3.operation_history = operation_history
 api_v3.health_monitor = health_monitor
-
-composer_bp.config_manager = config_manager
-composer_bp.plugin_manager = plugin_manager
-composer_bp.plugins_dir = plugins_dir
-composer_bp.project_root = project_root
 # Initialize cache manager for API endpoints
 from src.cache_manager import CacheManager
 api_v3.cache_manager = CacheManager()
@@ -206,7 +200,6 @@ except Exception as _hm_err:  # pragma: no cover - defensive startup guard
 app.register_blueprint(pages_v3, url_prefix='')
 app.register_blueprint(pages_v3, url_prefix='/v3', name='pages_v3_legacy')
 app.register_blueprint(api_v3, url_prefix='/api/v3')
-app.register_blueprint(composer_bp, url_prefix='/composer')
 
 # Route to serve plugin asset files (registered on main app, not blueprint, for /assets/... path)
 @app.route('/assets/plugins/<plugin_id>/uploads/<path:filename>', methods=['GET'])

web_interface/blueprints/api_v3.py

@@ -78,8 +78,11 @@ def _scrub_git_remote_url(url: str) -> str:
     return url
 
 # Will be initialized when blueprint is registered
-config_manager = None
+# NOTE: the managers live on the blueprint object (app.py sets
-plugin_manager = None
+# api_v3.config_manager / api_v3.plugin_manager). Deliberately not
+# mirrored as module globals: a bare `config_manager` used to resolve to
+# a None that was never assigned, which silently disabled the /health
+# checks and made /display/current fall back to a hardcoded 128x64.
 plugin_store_manager = None
 saved_repositories_manager = None
 cache_manager = None
@@ -1598,11 +1601,16 @@ def get_health():
         }
 
         # Check web interface service
+        # Stamp the start time before measuring against it -- reading it with a
+        # fallback of time.time() and only assigning afterwards made the very
+        # first call subtract two separate clock reads, reporting a small
+        # negative uptime.
+        if not hasattr(get_health, '_start_time'):
+            get_health._start_time = time.time()
         health_status['services']['web_interface'] = {
             'status': 'running',
-            'uptime_seconds': time.time() - (getattr(get_health, '_start_time', time.time()))
+            'uptime_seconds': time.time() - get_health._start_time
         }
-        get_health._start_time = getattr(get_health, '_start_time', time.time())
 
         # Check display service
         display_service_status = _get_display_service_status()
@@ -1613,8 +1621,8 @@ def get_health():
 
         # Check config file accessibility
         try:
-            if config_manager:
+            if api_v3.config_manager:
-                test_config = config_manager.load_config()
+                test_config = api_v3.config_manager.load_config()
                 health_status['checks']['config_file'] = {
                     'status': 'accessible',
                     'readable': True
@@ -1633,9 +1641,9 @@ def get_health():
 
         # Check plugin system
         try:
-            if plugin_manager:
+            if api_v3.plugin_manager:
                 # Try to discover plugins (lightweight check)
-                plugin_count = len(plugin_manager.get_available_plugins()) if hasattr(plugin_manager, 'get_available_plugins') else 0
+                plugin_count = len(api_v3.plugin_manager.get_available_plugins()) if hasattr(api_v3.plugin_manager, 'get_available_plugins') else 0
                 health_status['checks']['plugin_system'] = {
                     'status': 'operational',
                     'plugin_count': plugin_count
@@ -2468,8 +2476,8 @@ def get_display_current():
 
         # Get display dimensions from config
         try:
-            if config_manager:
+            if api_v3.config_manager:
-                main_config = config_manager.load_config()
+                main_config = api_v3.config_manager.load_config()
                 hardware_config = main_config.get('display', {}).get('hardware', {})
                 cols = hardware_config.get('cols', 64)
                 chain_length = hardware_config.get('chain_length', 2)

web_interface/static/v3/app.css

@@ -426,9 +426,6 @@ a, button, input, select, textarea {
     .md\:hidden { display: none; }
     .md\:block { display: block; }
     .md\:w-auto { width: auto; }
-    /* composer.html labels its toolbar buttons `hidden md:inline`, so without
-       this the label is hidden at every width and the buttons stay icon-only. */
-    .md\:inline { display: inline; }
 }
 
 @media (min-width: 1024px) {

web_interface/static/v3/js/composer/composer-canvas.js

@@ -1,817 +0,0 @@
-/**
- * ComposerCanvas — stateless LED matrix canvas renderer.
- *
- * Coordinate system: LED pixels (integers). All drawing multiplies by SCALE.
- * PIL draw.text(x,y) is top-left; canvas fillText(x,y) is baseline.
- *   → Canvas text cy = (actualY + fontSizePx) * SCALE
- *
- * Anchors: element x/y are offsets from their anchor point:
- *   xAnchor=null/'left'  → x is fixed offset from left
- *   xAnchor='center'     → x is offset from width/2
- *   xAnchor='right'      → x is offset inward from right edge
- *   yAnchor follows the same pattern with 'top'/'middle'/'bottom'
- *
- * Breakpoints: elements with minWidth > currentMatrixW are rendered at 25% opacity.
- *
- * Resize handles: drawn on selected rectangles; 8 handles (corners + edge mids).
- */
-/* eslint-disable security/detect-object-injection --
-   Every hit in this file is either an array index (this.elements[idx],
-   rawVals[i]) or a lookup on a module-private map keyed by an internal
-   element type (_HANDLE_CURSORS, ELEMENT_DEFAULTS, previewValues). None of
-   them takes an attacker-supplied property name, so none can reach a
-   prototype. Disabled per file rather than eight times inline. */
-window.ComposerCanvas = (() => {
-  'use strict';
-
-  let _canvas = null;
-  let _ctx = null;
-  let _showGrid = true;
-
-  //: Element types the canvas draws resize handles for. Exported because the
-  //: editor has to gate its resize and hover behaviour on exactly this list --
-  //: the two had drifted, so handles appeared on five shapes that could not
-  //: actually be resized.
-  const RESIZABLE_TYPES = ['rectangle', 'rounded_rectangle', 'ellipse', 'arc',
-                           'gauge', 'sparkline'];
-
-  const DISPLAY_PRESETS = [
-    { label: '64×32',   w: 64,  h: 32 },
-    { label: '128×32',  w: 128, h: 32 },
-    { label: '128×64',  w: 128, h: 64 },
-    { label: '256×32',  w: 256, h: 32 },
-    { label: '256×64',  w: 256, h: 64 },
-  ];
-
-  const FONT_MAP = {
-    press_start:   { family: "'PressStart2P', monospace", sizePx: 8,  charW: 8 },
-    four_by_six:   { family: 'monospace',                sizePx: 6,  charW: 4 },
-    five_by_seven: { family: 'monospace',                sizePx: 7,  charW: 5 },
-  };
-
-  const ELEMENT_DEFAULTS = {
-    text: {
-      text: 'Hello', font: 'press_start',
-      r: 255, g: 255, b: 255,
-      text2: '', lineSpacing: 2, textAlign: 'left',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    dynamic_text: {
-      binding: { source: 'config', key: '', format: null },
-      font: 'press_start', textAlign: 'left',
-      r: 255, g: 200, b: 100,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    clock: {
-      format: '%H:%M', font: 'press_start',
-      r: 100, g: 255, b: 100,
-      format2: '', lineSpacing: 2, textAlign: 'left',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    rectangle: {
-      width: 20, height: 8,
-      fillR: 0, fillG: 0, fillB: 128, hasFill: true,
-      outR: 255, outG: 255, outB: 255, hasOutline: true,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    ellipse: {
-      width: 24, height: 12,
-      fillR: 0, fillG: 100, fillB: 200, hasFill: true,
-      outR: 100, outG: 180, outB: 255, hasOutline: true,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    arc: {
-      width: 24, height: 24,
-      startAngle: 0, endAngle: 270, lineWidth: 2,
-      r: 255, g: 200, b: 0,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    pixel: {
-      r: 255, g: 255, b: 255,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    rounded_rectangle: {
-      width: 24, height: 10, borderRadius: 3,
-      fillR: 0, fillG: 80, fillB: 180, hasFill: true,
-      outR: 120, outG: 180, outB: 255, hasOutline: true,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    line: {
-      x0: 0, y0: 16, x1: 63, y1: 16,
-      r: 180, g: 180, b: 180, lineWidth: 1,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    divider: {
-      orientation: 'horizontal', y: 16, x: 64,
-      r: 100, g: 100, b: 100,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    progress_bar: {
-      barWidth: 60, barHeight: 6,
-      binding: { source: 'config', key: '', format: null },
-      r: 80, g: 200, b: 80,
-      bgR: 30, bgG: 30, bgB: 30, hasBg: true,
-      outR: 100, outG: 100, outB: 100, hasOutline: true,
-      previewPct: 65,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    countdown: {
-      binding: { source: 'config', key: '', format: null },
-      countdownFormat: 'dh',
-      font: 'four_by_six', textAlign: 'left',
-      r: 255, g: 180, b: 0,
-      previewText: '42d 3h',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    marquee: {
-      text: 'Scrolling text', font: 'press_start',
-      r: 255, g: 255, b: 255,
-      scrollSpeed: 1, gap: 16, direction: 'left',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    section: {
-      label: 'Section',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    pips: {
-      count: 5, filled: 3, pipSize: 4, pipSpacing: 2,
-      r: 255, g: 200, b: 0,
-      emptyR: 50, emptyG: 50, emptyB: 50, showEmpty: true,
-      binding: { source: 'config', key: '', format: null },
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    sparkline: {
-      width: 40, height: 12,
-      barCount: 8, barSpacing: 1,
-      r: 80, g: 200, b: 120,
-      bgR: 30, bgG: 30, bgB: 30, hasBg: false,
-      binding: { source: 'config', key: '', format: null },
-      previewData: '0.3,0.6,0.4,0.8,0.5,0.9,0.7,0.85',
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-    gauge: {
-      width: 32, height: 32,
-      startAngle: 135, endAngle: 45, lineWidth: 3,
-      binding: { source: 'config', key: '', format: null },
-      r: 80, g: 220, b: 80,
-      trackR: 40, trackG: 40, trackB: 40, hasTrack: true,
-      showLabel: true, font: 'four_by_six', labelR: 200, labelG: 200, labelB: 200,
-      previewPct: 65,
-      xAnchor: null, yAnchor: null, minWidth: 0, locked: false, blink: false, visible: true,
-    },
-  };
-
-  // ── Anchor resolution ────────────────────────────────────────────────
-  function resolveAnchor(val, anchor, dim) {
-    if (!anchor || anchor === 'left' || anchor === 'top') return val;
-    if (anchor === 'center' || anchor === 'middle') return Math.floor(dim / 2) + val;
-    if (anchor === 'right' || anchor === 'bottom') return dim - val;
-    return val;
-  }
-
-  function computeActualPos(el, matrixW, matrixH) {
-    const ax = resolveAnchor(el.x ?? el.x0 ?? 0, el.xAnchor, matrixW);
-    const ay = resolveAnchor(el.y ?? el.y0 ?? 0, el.yAnchor, matrixH);
-    return { x: ax, y: ay };
-  }
-
-  // ── Bounding box (LED pixel space) ──────────────────────────────────
-  function getBoundingBox(el, matrixW, matrixH) {
-    const { x: ax, y: ay } = computeActualPos(el, matrixW, matrixH);
-    const finfo = FONT_MAP[el.font] || FONT_MAP.press_start;
-
-    switch (el.type) {
-      case 'text': {
-        const t1 = el.text || '', t2 = el.text2 || '';
-        const w = Math.max(t1.length, t2.length) * finfo.charW;
-        const h = t2 ? finfo.sizePx * 2 + (el.lineSpacing ?? 2) : finfo.sizePx;
-        const bx = el.textAlign === 'center' ? ax - w / 2 : el.textAlign === 'right' ? ax - w : ax;
-        return { x: bx, y: ay, w, h };
-      }
-      case 'dynamic_text': {
-        const key = el.binding?.key || '?';
-        const w = (`{${key}}`).length * finfo.charW;
-        const bx = el.textAlign === 'center' ? ax - w / 2 : el.textAlign === 'right' ? ax - w : ax;
-        return { x: bx, y: ay, w, h: finfo.sizePx };
-      }
-      case 'clock': {
-        const t1 = el.format || '%H:%M', t2 = el.format2 || '';
-        const w = Math.max(t1.length, t2.length) * finfo.charW;
-        const h = t2 ? finfo.sizePx * 2 + (el.lineSpacing ?? 2) : finfo.sizePx;
-        const bx = el.textAlign === 'center' ? ax - w / 2 : el.textAlign === 'right' ? ax - w : ax;
-        return { x: bx, y: ay, w, h };
-      }
-      case 'countdown': {
-        const pt = el.previewText || '--d --h';
-        const w = pt.length * finfo.charW;
-        const bx = el.textAlign === 'center' ? ax - w / 2 : el.textAlign === 'right' ? ax - w : ax;
-        return { x: bx, y: ay, w, h: finfo.sizePx };
-      }
-      case 'rectangle':
-      case 'rounded_rectangle':
-      case 'ellipse':
-      case 'arc':
-        return { x: ax, y: ay, w: el.width, h: el.height };
-      case 'pixel':
-        return { x: ax, y: ay, w: 1, h: 1 };
-      case 'line': {
-        // Same anchor offset the draw path applies, or the hit box sits where
-        // the line used to be.
-        const dx = ax - el.x0, dy = ay - el.y0;
-        return {
-          x: Math.min(el.x0, el.x1) + dx, y: Math.min(el.y0, el.y1) + dy,
-          w: Math.max(1, Math.abs(el.x1 - el.x0)),
-          h: Math.max(1, Math.abs(el.y1 - el.y0)),
-        };
-      }
-      case 'divider':
-        return el.orientation === 'horizontal'
-          ? { x: 0,  y: ay, w: matrixW, h: 1 }
-          : { x: ax, y: 0,  w: 1,       h: matrixH };
-      case 'progress_bar':
-        return { x: ax, y: ay, w: el.barWidth ?? 60, h: el.barHeight ?? 6 };
-      case 'marquee': {
-        const mfinfo = FONT_MAP[el.font] || FONT_MAP.press_start;
-        return { x: 0, y: ay, w: matrixW, h: mfinfo.sizePx };
-      }
-      case 'gauge':
-        return { x: ax, y: ay, w: el.width ?? 32, h: el.height ?? 32 };
-      case 'sparkline':
-        return { x: ax, y: ay, w: el.width ?? 40, h: el.height ?? 12 };
-      case 'pips': {
-        const pc = el.count ?? 5, ps = el.pipSize ?? 4, pg = el.pipSpacing ?? 2;
-        return { x: ax, y: ay, w: pc * ps + (pc - 1) * pg, h: ps };
-      }
-      case 'section': {
-        // Was 0x0, so the element was unselectable except through the 3px
-        // hit-test padding and drew nothing at all -- a user adding one from
-        // the palette saw an empty canvas.
-        // Same font resolution as the draw case below, or the box will not
-        // match the glyphs: getBoundingBox's shared `finfo` falls back to
-        // press_start, and a section has no font of its own.
-        const sinfo = FONT_MAP[el.font] || FONT_MAP.four_by_six;
-        const label = el.label || 'Section';
-        return { x: ax, y: ay, w: label.length * sinfo.charW, h: sinfo.sizePx };
-      }
-      default:
-        return { x: ax, y: ay, w: 4, h: 4 };
-    }
-  }
-
-  // ── Resize handle support ─────────────────────────────────────────────
-  // Returns 8 handle points for a rectangle in LED pixel space
-  function _getRectHandles(el, matrixW, matrixH) {
-    const { x: ax, y: ay } = computeActualPos(el, matrixW, matrixH);
-    const w = el.width, h = el.height;
-    const cx = ax + w / 2, cy = ay + h / 2;
-    return {
-      nw: { x: ax,      y: ay      },
-      n:  { x: cx,      y: ay      },
-      ne: { x: ax + w,  y: ay      },
-      w:  { x: ax,      y: cy      },
-      e:  { x: ax + w,  y: cy      },
-      sw: { x: ax,      y: ay + h  },
-      s:  { x: cx,      y: ay + h  },
-      se: { x: ax + w,  y: ay + h  },
-    };
-  }
-
-  // Returns the handle direction under LED-space point (lx, ly), or null
-  function getResizeHandle(el, lx, ly, matrixW, matrixH) {
-    if (!RESIZABLE_TYPES.includes(el.type)) return null;
-    const handles = _getRectHandles(el, matrixW, matrixH);
-    const PAD = 4;
-    for (const [dir, pt] of Object.entries(handles)) {
-      if (Math.abs(lx - pt.x) <= PAD && Math.abs(ly - pt.y) <= PAD) return dir;
-    }
-    return null;
-  }
-
-  const _HANDLE_CURSORS = {
-    nw: 'nw-resize', n: 'n-resize', ne: 'ne-resize',
-    w: 'w-resize', e: 'e-resize',
-    sw: 'sw-resize', s: 's-resize', se: 'se-resize',
-  };
-  function getCursorForHandle(handle) {
-    return _HANDLE_CURSORS[handle] || 'crosshair';
-  }
-
-  // ── Hit test ─────────────────────────────────────────────────────────
-  function hitTest(el, lx, ly, matrixW, matrixH) {
-    const PAD = 3;
-    const bb = getBoundingBox(el, matrixW, matrixH);
-    return (
-      lx >= bb.x - PAD && lx <= bb.x + bb.w + PAD &&
-      ly >= bb.y - PAD && ly <= bb.y + bb.h + PAD
-    );
-  }
-
-  // ── Draw a single element ─────────────────────────────────────────────
-  function _drawElement(ctx, el, SCALE, matrixW, matrixH, opts = {}) {
-    const s = SCALE;
-    const { x: ax, y: ay } = computeActualPos(el, matrixW, matrixH);
-    const belowBreakpoint = el.minWidth > 0 && matrixW < el.minWidth;
-    const hidden = el.visible === false;
-
-    ctx.save();
-    if (hidden) ctx.globalAlpha = 0.12;
-    else if (belowBreakpoint) ctx.globalAlpha = 0.25;
-
-    // Blink animation: when blinkOff, fully hide blinking elements
-    if (el.blink) {
-      if (opts.blinkOff) { ctx.restore(); return; }
-      ctx.globalAlpha *= 0.55;
-    }
-
-    // Helper: compute draw X for text alignment
-    // biome-ignore lint/correctness/useQwikValidLexicalScope: not Qwik -- this is an Alpine.js component, and the rule is about Qwik's $() serialization boundary, which does not exist here.
-    const _textX = (text, finfo) => {
-      const tw = text.length * finfo.charW * s;
-      if (el.textAlign === 'center') return ax * s - tw / 2;
-      if (el.textAlign === 'right')  return ax * s - tw;
-      return ax * s;
-    };
-
-    try {
-      switch (el.type) {
-        case 'section': {
-          // A design-time label: it marks a region for the author and is not
-          // emitted into the generated plugin. There was no case here at all,
-          // so adding "Section Label" from the palette drew nothing and left
-          // the user with an apparently broken control.
-          const sfinfo = FONT_MAP[el.font] || FONT_MAP.four_by_six;
-          ctx.font = `${sfinfo.sizePx * s}px ${sfinfo.family}`;
-          ctx.fillStyle = `rgba(${el.r ?? 120},${el.g ?? 120},${el.b ?? 120},0.85)`;
-          ctx.textBaseline = 'top';
-          ctx.fillText(el.label || 'Section', ax * s, ay * s);
-          break;
-        }
-        case 'text':
-        case 'dynamic_text':
-        case 'clock': {
-          const finfo = FONT_MAP[el.font] || FONT_MAP.press_start;
-          const key = el.binding?.key || '?';
-          const pv = opts.previewValues?.[key];
-          // Substitute {variable} tokens in text using previewValues
-          // biome-ignore lint/correctness/useQwikValidLexicalScope: not Qwik -- this is an Alpine.js component, and the rule is about Qwik's $() serialization boundary, which does not exist here.
-          const _subVars = str => (str || '').replace(/\{(\w+)\}/g, (_, k) => {
-            const v = opts.previewValues?.[k];
-            return v !== undefined && v !== '' ? String(v) : `{${k}}`;
-          });
-          const displayText =
-            el.type === 'text'    ? _subVars(el.text || '')
-            : el.type === 'clock' ? (el.format || '%H:%M')
-            : (pv !== undefined && pv !== '' ? String(pv) : `{${key}}`);
-          ctx.font = `${finfo.sizePx * s}px ${finfo.family}`;
-          ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.fillText(displayText, _textX(displayText, finfo), (ay + finfo.sizePx) * s);
-          // Second line (text and clock)
-          if (el.type === 'text' && el.text2) {
-            const t2 = _subVars(el.text2);
-            const y2 = ay + finfo.sizePx + (el.lineSpacing ?? 2);
-            ctx.fillText(t2, _textX(t2, finfo), (y2 + finfo.sizePx) * s);
-          }
-          if (el.type === 'clock' && el.format2) {
-            const y2 = ay + finfo.sizePx + (el.lineSpacing ?? 2);
-            ctx.fillText(el.format2, _textX(el.format2, finfo), (y2 + finfo.sizePx) * s);
-          }
-          break;
-        }
-
-        case 'countdown': {
-          const finfo = FONT_MAP[el.font] || FONT_MAP.press_start;
-          const t = el.previewText || '--d --h';
-          ctx.font = `${finfo.sizePx * s}px ${finfo.family}`;
-          ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.fillText(t, _textX(t, finfo), (ay + finfo.sizePx) * s);
-          break;
-        }
-
-        case 'rectangle': {
-          const rx = ax * s, ry = ay * s;
-          const rw = el.width * s, rh = el.height * s;
-          if (el.hasFill) {
-            ctx.fillStyle = `rgb(${el.fillR},${el.fillG},${el.fillB})`;
-            ctx.fillRect(rx, ry, rw, rh);
-          }
-          if (el.hasOutline) {
-            ctx.strokeStyle = `rgb(${el.outR},${el.outG},${el.outB})`;
-            // 1 LED pixel, not 1 canvas pixel: at SCALE>1 an unscaled stroke
-            // renders thinner than the geometry it outlines.
-            ctx.lineWidth = s;
-            ctx.strokeRect(rx, ry, rw, rh);
-          }
-          break;
-        }
-
-        case 'ellipse': {
-          const cx = (ax + el.width / 2) * s;
-          const cy = (ay + el.height / 2) * s;
-          const lwPx = s;  // 1 LED pixel
-          // Inset by half the stroke, which straddles the path, so the outline
-          // stays within the element's bounds.
-          const rx = Math.max(0, (el.width / 2) * s - (el.hasOutline ? lwPx / 2 : 0));
-          const ry = Math.max(0, (el.height / 2) * s - (el.hasOutline ? lwPx / 2 : 0));
-          ctx.beginPath();
-          ctx.ellipse(cx, cy, rx, ry, 0, 0, Math.PI * 2);
-          if (el.hasFill) {
-            ctx.fillStyle = `rgb(${el.fillR},${el.fillG},${el.fillB})`;
-            ctx.fill();
-          }
-          if (el.hasOutline) {
-            ctx.strokeStyle = `rgb(${el.outR},${el.outG},${el.outB})`;
-            ctx.lineWidth = lwPx;
-            ctx.stroke();
-          }
-          break;
-        }
-
-        case 'arc': {
-          const cx = (ax + el.width / 2) * s;
-          const cy = (ay + el.height / 2) * s;
-          const lwPx = Math.max(1, el.lineWidth || 2) * s;
-          const rx = Math.max(0, (el.width / 2) * s - lwPx / 2);
-          const ry = Math.max(0, (el.height / 2) * s - lwPx / 2);
-          // PIL: 0°=right, clockwise. Canvas: same with anticlockwise=false
-          const startRad = (el.startAngle ?? 0) * Math.PI / 180;
-          const endRad = (el.endAngle ?? 270) * Math.PI / 180;
-          ctx.beginPath();
-          ctx.ellipse(cx, cy, rx, ry, 0, startRad, endRad, false);
-          ctx.strokeStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.lineWidth = lwPx;
-          ctx.stroke();
-          break;
-        }
-
-        case 'pixel': {
-          ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.fillRect(ax * s, ay * s, s, s);
-          break;
-        }
-
-        case 'rounded_rectangle': {
-          const rx = ax * s, ry = ay * s;
-          const rw = el.width * s, rh = el.height * s;
-          const rad = Math.min((el.borderRadius ?? 3) * s, rw / 2, rh / 2);
-          ctx.beginPath();
-          ctx.roundRect(rx, ry, rw, rh, rad);
-          if (el.hasFill) {
-            ctx.fillStyle = `rgb(${el.fillR},${el.fillG},${el.fillB})`;
-            ctx.fill();
-          }
-          if (el.hasOutline) {
-            ctx.strokeStyle = `rgb(${el.outR},${el.outG},${el.outB})`;
-            ctx.lineWidth = s;
-            ctx.stroke();
-          }
-          break;
-        }
-
-        case 'line': {
-          // ax/ay resolve from el.x0 for a line, so this is the anchor offset.
-          // Without it a line stayed put while every other type moved.
-          const dx = ax - el.x0, dy = ay - el.y0;
-          ctx.strokeStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.lineWidth = Math.max(1, el.lineWidth || 1) * s;
-          ctx.beginPath();
-          ctx.moveTo((el.x0 + dx) * s, (el.y0 + dy) * s);
-          ctx.lineTo((el.x1 + dx) * s, (el.y1 + dy) * s);
-          ctx.stroke();
-          break;
-        }
-
-        case 'divider': {
-          const isH = (el.orientation || 'horizontal') === 'horizontal';
-          ctx.strokeStyle = `rgb(${el.r},${el.g},${el.b})`;
-          ctx.lineWidth = s;
-          ctx.beginPath();
-          if (isH) {
-            ctx.moveTo(0, (ay + 0.5) * s);
-            ctx.lineTo(_canvas.width, (ay + 0.5) * s);
-          } else {
-            ctx.moveTo((ax + 0.5) * s, 0);
-            ctx.lineTo((ax + 0.5) * s, _canvas.height);
-          }
-          ctx.stroke();
-          break;
-        }
-
-        case 'pips': {
-          const pipCount = Math.max(1, el.count ?? 5);
-          const pvPips = opts.previewValues?.[el.binding?.key];
-          const filledN = pvPips !== undefined
-            ? Math.max(0, Math.min(pipCount, Math.round(parseFloat(pvPips) || 0)))
-            : Math.max(0, Math.min(pipCount, el.filled ?? 3));
-          const ps = Math.max(1, el.pipSize ?? 4);
-          const pg = Math.max(0, el.pipSpacing ?? 2);
-          for (let i = 0; i < pipCount; i++) {
-            const isFilled = i < filledN;
-            if (!isFilled && !el.showEmpty) continue;
-            ctx.fillStyle = isFilled
-              ? `rgb(${el.r},${el.g},${el.b})`
-              : `rgb(${el.emptyR ?? 50},${el.emptyG ?? 50},${el.emptyB ?? 50})`;
-            ctx.fillRect((ax + i * (ps + pg)) * s, ay * s, ps * s, ps * s);
-          }
-          break;
-        }
-
-        case 'sparkline': {
-          const slW = el.width ?? 40, slH = el.height ?? 12;
-          const count = Math.max(1, el.barCount ?? 8);
-          const spacing = el.barSpacing ?? 1;
-          const barW = Math.max(1, Math.floor((slW - spacing * (count - 1)) / count));
-          const rawVals = (el.previewData || '').split(',')
-            .map(v => parseFloat(v.trim())).filter(n => !isNaN(n));
-          while (rawVals.length < count) rawVals.push(0);
-          const maxV = Math.max(...rawVals.slice(0, count), 0.001);
-          const rx = ax * s, ry = ay * s;
-          if (el.hasBg) {
-            ctx.fillStyle = `rgb(${el.bgR ?? 30},${el.bgG ?? 30},${el.bgB ?? 30})`;
-            ctx.fillRect(rx, ry, slW * s, slH * s);
-          }
-          ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-          for (let i = 0; i < count; i++) {
-            const norm = Math.max(0, Math.min(1, rawVals[i] / maxV));
-            const barH = Math.max(1, Math.round(slH * norm));
-            const bx = rx + (barW + spacing) * i * s;
-            const by = ry + (slH - barH) * s;
-            ctx.fillRect(bx, by, barW * s, barH * s);
-          }
-          break;
-        }
-
-        case 'gauge': {
-          const gw = (el.width ?? 32), gh = (el.height ?? 32);
-          const cx = (ax + gw / 2) * s, cy = (ay + gh / 2) * s;
-          const rx = (gw / 2) * s, ry = (gh / 2) * s;
-          const lw = Math.max(1, (el.lineWidth ?? 3));
-          // rx/ry are canvas pixels ((gw/2)*s) but lw is LED pixels, so
-          // insetting by lw/2 under-corrected by the scale factor while the
-          // stroke was drawn at lw*s -- the arc spilled outside the element's
-          // reported bounding box at any SCALE > 1, and the preview stopped
-          // matching the generated PIL output.
-          const lwPx = lw * s;
-          const startDeg = el.startAngle ?? 135;
-          const endDeg   = el.endAngle   ?? 45;
-          // Arc sweep: from startDeg clockwise to endDeg (PIL convention)
-          const totalSweep = ((endDeg - startDeg) + 360) % 360 || 360;
-          const pvGauge = opts.previewValues?.[el.binding?.key];
-          const pct = pvGauge !== undefined
-            ? Math.max(0, Math.min(100, parseFloat(pvGauge) || 0)) / 100
-            : Math.max(0, Math.min(100, el.previewPct ?? 65)) / 100;
-          const fillSweep = totalSweep * pct;
-          // A small imported gauge with a wide lineWidth would otherwise send
-          // a negative radius into ctx.ellipse(), which throws IndexSizeError
-          // and aborts the whole render() call.
-          const arx = Math.max(0, rx - lwPx / 2), ary = Math.max(0, ry - lwPx / 2);
-          // biome-ignore lint/correctness/useQwikValidLexicalScope: not Qwik -- this is an Alpine.js component, and the rule is about Qwik's $() serialization boundary, which does not exist here.
-          const toRad = deg => (deg - 90) * Math.PI / 180; // canvas 0=top, PIL 0=right → offset -90
-
-          // Track arc
-          if (el.hasTrack !== false) {
-            ctx.beginPath();
-            ctx.ellipse(cx, cy, arx, ary, 0, toRad(startDeg), toRad(startDeg + totalSweep), false);
-            ctx.strokeStyle = `rgb(${el.trackR ?? 40},${el.trackG ?? 40},${el.trackB ?? 40})`;
-            ctx.lineWidth = lwPx;
-            ctx.stroke();
-          }
-          // Fill arc
-          if (pct > 0) {
-            ctx.beginPath();
-            ctx.ellipse(cx, cy, arx, ary, 0, toRad(startDeg), toRad(startDeg + fillSweep), false);
-            ctx.strokeStyle = `rgb(${el.r},${el.g},${el.b})`;
-            ctx.lineWidth = lwPx;
-            ctx.stroke();
-          }
-          // Centre label
-          if (el.showLabel) {
-            const gfinfo = FONT_MAP[el.font || 'four_by_six'] || FONT_MAP.four_by_six;
-            const labelText = Math.round(pct * 100) + '%';
-            ctx.font = `${gfinfo.sizePx * s}px ${gfinfo.family}`;
-            ctx.fillStyle = `rgb(${el.labelR ?? 200},${el.labelG ?? 200},${el.labelB ?? 200})`;
-            const ltw = ctx.measureText(labelText).width;
-            ctx.fillText(labelText, cx - ltw / 2, cy + (gfinfo.sizePx * s) / 2);
-          }
-          break;
-        }
-
-        case 'marquee': {
-          const finfo = FONT_MAP[el.font] || FONT_MAP.press_start;
-          const text = el.text || 'Scrolling text';
-          const tw = text.length * finfo.charW * s;
-          const gap = (el.gap ?? 16) * s;
-          const totalW = tw + gap;
-          const tick = opts.animTick ?? 0;
-          const speed = (el.scrollSpeed ?? 1) * 2;
-          const scrolled = (tick * speed) % totalW;
-          // left: text enters from right; right: text enters from left
-          const startX = el.direction === 'right'
-            ? scrolled - tw
-            : matrixW * s - scrolled;
-          ctx.font = `${finfo.sizePx * s}px ${finfo.family}`;
-          ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-          // Clip to canvas width so text doesn't bleed outside
-          ctx.save();
-          ctx.beginPath();
-          ctx.rect(0, ay * s - 1, matrixW * s, (finfo.sizePx + 2) * s);
-          ctx.clip();
-          for (let i = -1; i <= 2; i++) {
-            ctx.fillText(text, startX + i * totalW, (ay + finfo.sizePx) * s);
-          }
-          ctx.restore();
-          break;
-        }
-
-        case 'progress_bar': {
-          const bw = el.barWidth ?? 60, bh = el.barHeight ?? 6;
-          const pvPb = opts.previewValues?.[el.binding?.key];
-          const pct = pvPb !== undefined
-            ? Math.max(0, Math.min(100, parseFloat(pvPb) || 0)) / 100
-            : Math.max(0, Math.min(100, el.previewPct ?? 65)) / 100;
-          const rx = ax * s, ry = ay * s;
-          if (el.hasBg) {
-            ctx.fillStyle = `rgb(${el.bgR ?? 30},${el.bgG ?? 30},${el.bgB ?? 30})`;
-            ctx.fillRect(rx, ry, bw * s, bh * s);
-          }
-          const fillW = Math.max(0, Math.round(bw * pct));
-          if (fillW > 0) {
-            ctx.fillStyle = `rgb(${el.r},${el.g},${el.b})`;
-            ctx.fillRect(rx, ry, fillW * s, bh * s);
-          }
-          if (el.hasOutline) {
-            ctx.strokeStyle = `rgb(${el.outR ?? 100},${el.outG ?? 100},${el.outB ?? 100})`;
-            ctx.lineWidth = s;
-            ctx.strokeRect(rx, ry, bw * s, bh * s);
-          }
-          break;
-        }
-      }
-
-      if (belowBreakpoint) {
-        ctx.globalAlpha = 0.6;
-        const bb = getBoundingBox(el, matrixW, matrixH);
-        ctx.font = `${Math.max(8, s * 2)}px monospace`;
-        ctx.fillStyle = '#facc15';
-        ctx.fillText(`≥${el.minWidth}px`, bb.x * s, (bb.y + 4) * s);
-      }
-    } finally {
-      ctx.restore();
-    }
-  }
-
-  // ── Selection indicator ──────────────────────────────────────────────
-  function _drawSelection(ctx, el, SCALE, matrixW, matrixH) {
-    const bb = getBoundingBox(el, matrixW, matrixH);
-    const PAD = 2, s = SCALE;
-    const rx = bb.x * s - PAD, ry = bb.y * s - PAD;
-    const rw = bb.w * s + PAD * 2, rh = bb.h * s + PAD * 2;
-
-    ctx.save();
-    ctx.strokeStyle = '#3b82f6';
-    ctx.lineWidth = 1;
-    ctx.setLineDash([3, 2]);
-    ctx.strokeRect(rx, ry, rw, rh);
-    ctx.setLineDash([]);
-
-    if (el.xAnchor || el.yAnchor) {
-      ctx.font = `${Math.max(7, s)}px sans-serif`;
-      ctx.fillStyle = '#a78bfa';
-      const anchorText = [
-        el.xAnchor ? `x:${el.xAnchor[0]}` : '',
-        el.yAnchor ? `y:${el.yAnchor[0]}` : '',
-      ].filter(Boolean).join(' ');
-      if (anchorText) ctx.fillText(anchorText, rx + 1, ry - 2);
-    }
-
-    // Resize handles: on rect, rounded rect, ellipse
-    if (RESIZABLE_TYPES.includes(el.type)) {
-      const handles = _getRectHandles(el, matrixW, matrixH);
-      const HS = 5;
-      ctx.fillStyle = 'white';
-      ctx.strokeStyle = '#2563eb';
-      ctx.lineWidth = 1;
-      for (const pt of Object.values(handles)) {
-        const hx = pt.x * s - HS / 2;
-        const hy = pt.y * s - HS / 2;
-        ctx.fillRect(hx, hy, HS, HS);
-        ctx.strokeRect(hx, hy, HS, HS);
-      }
-    } else {
-      // Corner dots for non-rectangle elements
-      ctx.fillStyle = '#3b82f6';
-      const HS = 4;
-      for (const [hx, hy] of [
-        [rx - HS / 2, ry - HS / 2], [rx + rw - HS / 2, ry - HS / 2],
-        [rx - HS / 2, ry + rh - HS / 2], [rx + rw - HS / 2, ry + rh - HS / 2],
-      ]) ctx.fillRect(hx, hy, HS, HS);
-    }
-
-    ctx.restore();
-  }
-
-  // ── Dimension tooltip while dragging ─────────────────────────────────
-  function drawDragTooltip(ctx, el, SCALE, matrixW, matrixH) {
-    const bb = getBoundingBox(el, matrixW, matrixH);
-    const label = el.type === 'rectangle'
-      ? `${el.width}×${el.height}`
-      : `${bb.x},${bb.y}`;
-    const s = SCALE;
-    ctx.save();
-    ctx.font = `${Math.max(9, s * 1.5)}px monospace`;
-    const tw = ctx.measureText(label).width;
-    const tx = bb.x * s, ty = (bb.y - 2) * s;
-    ctx.fillStyle = 'rgba(0,0,0,0.7)';
-    ctx.fillRect(tx - 2, ty - 10, tw + 4, 12);
-    ctx.fillStyle = 'white';
-    ctx.fillText(label, tx, ty);
-    ctx.restore();
-  }
-
-  // ── Public API ───────────────────────────────────────────────────────
-
-  function init(canvasEl) {
-    _canvas = canvasEl;
-    _ctx = canvasEl.getContext('2d');
-  }
-
-  function setGrid(show) { _showGrid = show; }
-
-  function updateCanvasSize(matrixW, matrixH, SCALE) {
-    if (!_canvas) return;
-    _canvas.width = matrixW * SCALE;
-    _canvas.height = matrixH * SCALE;
-  }
-
-  function render(elements, selectedId, matrixW, matrixH, SCALE, opts = {}) {
-    if (!_ctx) return;
-    const cW = matrixW * SCALE, cH = matrixH * SCALE;
-
-    const bg = opts.bgColor;
-    _ctx.fillStyle = bg ? `rgb(${bg.r},${bg.g},${bg.b})` : '#000';
-    _ctx.fillRect(0, 0, cW, cH);
-
-    if (_showGrid) {
-      _ctx.strokeStyle = 'rgba(255,255,255,0.07)';
-      _ctx.lineWidth = 0.5;
-      for (let x = SCALE; x < cW; x += SCALE) {
-        _ctx.beginPath(); _ctx.moveTo(x, 0); _ctx.lineTo(x, cH); _ctx.stroke();
-      }
-      for (let y = SCALE; y < cH; y += SCALE) {
-        _ctx.beginPath(); _ctx.moveTo(0, y); _ctx.lineTo(cW, y); _ctx.stroke();
-      }
-    }
-
-    for (const el of elements) _drawElement(_ctx, el, SCALE, matrixW, matrixH, opts);
-
-    if (opts.showRuler) {
-      _ctx.save();
-      _ctx.fillStyle = 'rgba(255,255,255,0.08)';
-      _ctx.fillRect(0, 0, cW, SCALE);             // top strip
-      _ctx.fillRect(0, 0, SCALE, cH);             // left strip
-      _ctx.strokeStyle = 'rgba(255,255,255,0.5)';
-      _ctx.fillStyle = 'rgba(255,255,255,0.6)';
-      _ctx.font = `${Math.max(5, SCALE - 1)}px monospace`;
-      const step = SCALE >= 4 ? 8 : 16;
-      for (let px = 0; px <= matrixW; px += step) {
-        const cx = px * SCALE;
-        const major = px % 32 === 0;
-        _ctx.lineWidth = 0.5;
-        _ctx.beginPath(); _ctx.moveTo(cx, 0); _ctx.lineTo(cx, major ? SCALE : SCALE * 0.5); _ctx.stroke();
-        if (major && px > 0 && px < matrixW - 4) _ctx.fillText(String(px), cx + 1, SCALE - 1);
-      }
-      for (let py = 0; py <= matrixH; py += step) {
-        const cy = py * SCALE;
-        const major = py % 32 === 0;
-        _ctx.beginPath(); _ctx.moveTo(0, cy); _ctx.lineTo(major ? SCALE : SCALE * 0.5, cy); _ctx.stroke();
-        if (major && py > 0 && py < matrixH - 4) _ctx.fillText(String(py), 1, cy + SCALE - 1);
-      }
-      _ctx.restore();
-    }
-
-    if (opts.showGuides) {
-      _ctx.save();
-      _ctx.strokeStyle = 'rgba(255,60,60,0.45)';
-      _ctx.lineWidth = 1;
-      _ctx.setLineDash([4, 3]);
-      const mx = Math.floor(cW / 2) + 0.5;
-      const my = Math.floor(cH / 2) + 0.5;
-      _ctx.beginPath(); _ctx.moveTo(mx, 0); _ctx.lineTo(mx, cH); _ctx.stroke();
-      _ctx.beginPath(); _ctx.moveTo(0, my); _ctx.lineTo(cW, my); _ctx.stroke();
-      _ctx.setLineDash([]);
-      _ctx.restore();
-    }
-
-    const sel = selectedId != null ? elements.find(e => e.id === selectedId) : null;
-    if (sel) {
-      _drawSelection(_ctx, sel, SCALE, matrixW, matrixH);
-      if (opts.showTooltip) drawDragTooltip(_ctx, sel, SCALE, matrixW, matrixH);
-    }
-  }
-
-  return {
-    init, render, setGrid, updateCanvasSize,
-    hitTest, getBoundingBox, computeActualPos, resolveAnchor,
-    getResizeHandle, getCursorForHandle,
-    ELEMENT_DEFAULTS, FONT_MAP, DISPLAY_PRESETS, RESIZABLE_TYPES,
-  };
-})();

web_interface/templates/v3/composer/manager.py.j2

@@ -1,302 +0,0 @@
-"""
-{{ plugin_name }} — LEDMatrix Plugin
-Generated by LEDMatrix Plugin Composer on {{ generated_date }}
-
-Extension points:
-  update()              → add HTTP/MQTT data-fetching logic here
-  _get_display_values() → map fetched data to display strings
-  display()             → add new elements or adapt layout per display size
-"""
-from src.plugin_system.base_plugin import BasePlugin
-{% if has_clock or has_countdown %}
-from datetime import datetime
-{% endif %}
-{% if has_blink %}
-import time
-{% endif %}
-{% if has_text_template %}
-from collections import defaultdict
-{% endif %}
-
-
-class {{ class_name }}(BasePlugin):
-
-    def __init__(self, plugin_id, config, display_manager, cache_manager, plugin_manager):
-        super().__init__(plugin_id, config, display_manager, cache_manager, plugin_manager)
-{% for var in config_vars %}
-        self.{{ var.key }} = config.get({{ var.key | tojson }}, {{ var.default | tojson }})
-{% endfor %}
-        # Live data cache — populated by update(); always {} in static layouts
-        self._data = {}
-
-    def update(self):
-        """Fetch and refresh display data.
-
-        For dynamic plugins: fetch from APIs/MQTT here and store in self._data.
-        _get_display_values() will read self._data to produce display strings.
-        """
-        # --- Data sources (add fetch logic here for dynamic plugins) ---
-        pass
-
-    def _get_display_values(self):
-        """Map config variables and live data to display-ready strings.
-
-        This is the single extension point for v2 data sources:
-        add self._data lookups here once update() populates them.
-        """
-        return {
-{% for var in config_vars %}
-            {{ var.key | tojson }}: str(self.{{ var.key }}),
-{% endfor %}
-        }
-
-    def display(self, force_clear=False):
-        try:
-{% if has_text_template %}
-            values = defaultdict(str, self._get_display_values())
-{% else %}
-            values = self._get_display_values()
-{% endif %}
-
-            if force_clear:
-                self.display_manager.clear()
-
-            width = self.display_manager.width
-            height = self.display_manager.height
-{% if bg_color %}
-
-            self.display_manager.draw.rectangle([0, 0, width, height], fill={{ bg_color }})
-{% endif %}
-
-            # ── Elements (rendered bottom to top) ──────────────────────────
-{% for el in elements %}
-{% set p = "                " if el.min_width > 0 else "            " %}
-{% set pi = (p + "    ") if el.blink else p %}
-{% if el.min_width > 0 %}
-            if width >= {{ el.min_width }}:  # breakpoint: {{ el.min_width }}px+ displays only
-{% endif %}
-{% if el.blink %}
-{{ p }}if int(time.time() * 2) % 2:
-{% endif %}
-
-{% if el.type == 'text' %}
-{{ pi }}self.display_manager.draw_text(
-{% if el.text_is_template %}
-{{ pi }}    {{ el.text | tojson }}.format_map(values),
-{% else %}
-{{ pi }}    {{ el.text | tojson }},
-{% endif %}
-{{ pi }}    x={{ el.x_expr }}, y={{ el.y_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% if el.text2 %}
-{{ pi }}self.display_manager.draw_text(
-{% if el.text_is_template %}
-{{ pi }}    {{ el.text2 | tojson }}.format_map(values),
-{% else %}
-{{ pi }}    {{ el.text2 | tojson }},
-{% endif %}
-{{ pi }}    x={{ el.x2_expr }}, y={{ el.y2_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% endif %}
-{% elif el.type == 'dynamic_text' %}
-{% if el.binding_source == 'config' %}
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    values.get({{ el.binding_key | tojson }}, ''),
-{{ pi }}    x={{ el.x_expr }}, y={{ el.y_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% else %}
-{{ pi }}pass  # non-config dynamic_text binding draws nothing
-{% endif %}
-{% elif el.type == 'clock' %}
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    datetime.now().strftime({{ el.format | tojson }}),
-{{ pi }}    x={{ el.x_expr }}, y={{ el.y_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% if el.format2 %}
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    datetime.now().strftime({{ el.format2 | tojson }}),
-{{ pi }}    x={{ el.x2_expr }}, y={{ el.y2_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% endif %}
-{% elif el.type == 'countdown' %}
-{{ pi }}_cd_target = float(values.get({{ el.binding_key | tojson }}, 0) or 0)
-{{ pi }}_cd_secs = max(0.0, _cd_target - datetime.now().timestamp())
-{% if el.countdown_format == 'dhms' %}
-{{ pi }}_cd_d, _cd_rem = divmod(int(_cd_secs), 86400)
-{{ pi }}_cd_h, _cd_rem = divmod(_cd_rem, 3600)
-{{ pi }}_cd_m, _cd_s = divmod(_cd_rem, 60)
-{{ pi }}_cd_str = f'{_cd_d}d {_cd_h:02d}:{_cd_m:02d}:{_cd_s:02d}'
-{% elif el.countdown_format == 'hms' %}
-{{ pi }}_cd_h, _cd_rem = divmod(int(_cd_secs), 3600)
-{{ pi }}_cd_m, _cd_s = divmod(_cd_rem, 60)
-{{ pi }}_cd_str = f'{_cd_h}h {_cd_m:02d}:{_cd_s:02d}'
-{% elif el.countdown_format == 'dhm' %}
-{{ pi }}_cd_d, _cd_rem = divmod(int(_cd_secs), 86400)
-{{ pi }}_cd_h, _cd_m = divmod(_cd_rem // 60, 60)
-{{ pi }}_cd_str = f'{_cd_d}d {_cd_h:02d}h {_cd_m:02d}m'
-{% else %}
-{{ pi }}_cd_d, _cd_rem = divmod(int(_cd_secs), 86400)
-{{ pi }}_cd_h = _cd_rem // 3600
-{{ pi }}_cd_str = f'{_cd_d}d {_cd_h}h'
-{% endif %}
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    _cd_str,
-{{ pi }}    x={{ el.x_expr }}, y={{ el.y_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% elif el.type == 'rectangle' %}
-{{ pi }}self.display_manager.draw.rectangle(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}    fill={{ el.fill_tuple }},
-{{ pi }}    outline={{ el.outline_tuple }},
-{{ pi }})
-{% elif el.type == 'arc' %}
-{{ pi }}self.display_manager.draw.arc(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}    start={{ el.start_angle }}, end={{ el.end_angle }},
-{{ pi }}    fill={{ el.rgb_tuple }},
-{{ pi }}    width={{ el.line_width }},
-{{ pi }})
-{% elif el.type == 'ellipse' %}
-{{ pi }}self.display_manager.draw.ellipse(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}    fill={{ el.fill_tuple }},
-{{ pi }}    outline={{ el.outline_tuple }},
-{{ pi }})
-{% elif el.type == 'pixel' %}
-{{ pi }}self.display_manager.draw.point(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}],
-{{ pi }}    fill={{ el.rgb_tuple }},
-{{ pi }})
-{% elif el.type == 'rounded_rectangle' %}
-{{ pi }}self.display_manager.draw.rounded_rectangle(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}    radius={{ el.border_radius }},
-{{ pi }}    fill={{ el.fill_tuple }},
-{{ pi }}    outline={{ el.outline_tuple }},
-{{ pi }})
-{% elif el.type in ('line', 'divider') %}
-{{ pi }}self.display_manager.draw.line(
-{{ pi }}    [{{ el.x0_expr }}, {{ el.y0_expr }}, {{ el.x1_expr }}, {{ el.y1_expr }}],
-{{ pi }}    fill={{ el.rgb_tuple }},
-{{ pi }}    width={{ el.line_width }},
-{{ pi }})
-{% elif el.type == 'pips' %}
-{{ pi }}_pip_filled = max(0, min({{ el.pip_count }}, int(float(values.get({{ el.binding_key | tojson }}, 0) or 0))))
-{{ pi }}for _pip_i in range({{ el.pip_count }}):
-{{ pi }}    _pip_x = ({{ el.x_expr }}) + _pip_i * ({{ el.pip_size }} + {{ el.pip_spacing }})
-{{ pi }}    _pip_color = {{ el.fill_tuple }} if _pip_i < _pip_filled else {{ el.empty_tuple }}
-{% if not el.show_empty %}
-{{ pi }}    if _pip_i >= _pip_filled:
-{{ pi }}        continue
-{% endif %}
-{{ pi }}    self.display_manager.draw.rectangle(
-{{ pi }}        [_pip_x, {{ el.y_expr }}, _pip_x + {{ el.pip_size }} - 1, ({{ el.y_expr }}) + {{ el.pip_size }} - 1],
-{{ pi }}        fill=_pip_color,
-{{ pi }}    )
-{% elif el.type == 'sparkline' %}
-{{ pi }}_sl_raw = str(values.get({{ el.binding_key | tojson }}, '') or '')
-{{ pi }}_sl_vals = [float(v.strip()) for v in _sl_raw.split(',') if v.strip()][:{{ el.bar_count }}]
-{{ pi }}_sl_vals += [0.0] * max(0, {{ el.bar_count }} - len(_sl_vals))
-{{ pi }}_sl_max = max(_sl_vals) if any(_sl_vals) else 1.0
-{{ pi }}_sl_bw = max(1, ({{ el.bar_width_px }} - {{ el.bar_spacing }} * ({{ el.bar_count }} - 1)) // {{ el.bar_count }})
-{% if el.bg_tuple != 'None' %}
-{{ pi }}self.display_manager.draw.rectangle(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, ({{ el.x_expr }}) + {{ el.bar_width_px }}, ({{ el.y_expr }}) + {{ el.bar_height_px }}],
-{{ pi }}    fill={{ el.bg_tuple }},
-{{ pi }})
-{% endif %}
-{{ pi }}for _sl_i, _sl_v in enumerate(_sl_vals):
-{{ pi }}    _sl_norm = max(0.0, min(1.0, _sl_v / (_sl_max or 1)))
-{{ pi }}    _sl_bh = max(1, round({{ el.bar_height_px }} * _sl_norm))
-{{ pi }}    _sl_bx = ({{ el.x_expr }}) + (_sl_bw + {{ el.bar_spacing }}) * _sl_i
-{{ pi }}    _sl_by = ({{ el.y_expr }}) + {{ el.bar_height_px }} - _sl_bh
-{{ pi }}    self.display_manager.draw.rectangle(
-{{ pi }}        [_sl_bx, _sl_by, _sl_bx + _sl_bw - 1, _sl_by + _sl_bh - 1],
-{{ pi }}        fill={{ el.fill_tuple }},
-{{ pi }}    )
-{% elif el.type == 'gauge' %}
-{{ pi }}_gv = max(0.0, min(100.0, float(values.get({{ el.binding_key | tojson }}, 0) or 0)))
-{{ pi }}_g_total = (({{ el.end_angle }} - {{ el.start_angle }}) % 360) or 360
-{{ pi }}_g_sweep = _g_total * _gv / 100.0
-{% if el.track_tuple != 'None' %}
-{{ pi }}self.display_manager.draw.arc(
-{{ pi }}    [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}    start={{ el.start_angle }}, end={{ el.start_angle }} + _g_total,
-{{ pi }}    fill={{ el.track_tuple }},
-{{ pi }}    width={{ el.line_width }},
-{{ pi }})
-{% endif %}
-{{ pi }}if _g_sweep > 0:
-{{ pi }}    self.display_manager.draw.arc(
-{{ pi }}        [{{ el.x_expr }}, {{ el.y_expr }}, {{ el.x2_expr }}, {{ el.y2_expr }}],
-{{ pi }}        start={{ el.start_angle }}, end={{ el.start_angle }} + _g_sweep,
-{{ pi }}        fill={{ el.rgb_tuple }},
-{{ pi }}        width={{ el.line_width }},
-{{ pi }}    )
-{% if el.show_label %}
-{{ pi }}_g_cx = ({{ el.x_expr }}) + ({{ el.x2_expr }} - ({{ el.x_expr }})) // 2
-{{ pi }}_g_cy = ({{ el.y_expr }}) + ({{ el.y2_expr }} - ({{ el.y_expr }})) // 2
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    f'{int(_gv)}%',
-{{ pi }}    x=_g_cx, y=_g_cy,
-{{ pi }}    color={{ el.label_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% endif %}
-{% elif el.type == 'marquee' %}
-{{ pi }}_{{ el.data_key }}_text = {{ el.text | tojson }}
-{{ pi }}_{{ el.data_key }}_tw = len(_{{ el.data_key }}_text) * {{ el.char_w }}
-{{ pi }}_{{ el.data_key }}_x = int(self._data.get({{ el.data_key | tojson }}, width))
-{% if el.direction == 'right' %}
-{{ pi }}_{{ el.data_key }}_x += {{ el.scroll_speed }}
-{{ pi }}if _{{ el.data_key }}_x > width:
-{{ pi }}    _{{ el.data_key }}_x = -(_{{ el.data_key }}_tw + {{ el.gap }})
-{% else %}
-{{ pi }}_{{ el.data_key }}_x -= {{ el.scroll_speed }}
-{{ pi }}if _{{ el.data_key }}_x < -(_{{ el.data_key }}_tw + {{ el.gap }}):
-{{ pi }}    _{{ el.data_key }}_x = width
-{% endif %}
-{{ pi }}self._data[{{ el.data_key | tojson }}] = _{{ el.data_key }}_x
-{{ pi }}self.display_manager.draw_text(
-{{ pi }}    _{{ el.data_key }}_text,
-{{ pi }}    x=_{{ el.data_key }}_x, y={{ el.y_expr }},
-{{ pi }}    color={{ el.rgb_tuple }},
-{{ pi }}    font=self.display_manager.{{ el.font_attr }},
-{{ pi }})
-{% elif el.type == 'progress_bar' %}
-{{ pi }}_pb_x = {{ el.x_expr }}
-{{ pi }}_pb_y = {{ el.y_expr }}
-{{ pi }}_pb_pct = max(0.0, min(100.0, float(values.get({{ el.binding_key | tojson }}, 0) or 0))) / 100.0
-{{ pi }}_pb_fill_w = int({{ el.bar_width }} * _pb_pct)
-{{ pi }}self.display_manager.draw.rectangle(
-{{ pi }}    [_pb_x, _pb_y, _pb_x + {{ el.bar_width }}, _pb_y + {{ el.bar_height }}],
-{{ pi }}    fill={{ el.bg_tuple }},
-{{ pi }}    outline={{ el.outline_tuple }},
-{{ pi }})
-{{ pi }}if _pb_fill_w > 0:
-{{ pi }}    self.display_manager.draw.rectangle(
-{{ pi }}        [_pb_x, _pb_y, _pb_x + _pb_fill_w, _pb_y + {{ el.bar_height }}],
-{{ pi }}        fill={{ el.fill_tuple }},
-{{ pi }}    )
-{% else %}
-{{ pi }}pass  # element type "{{ el.type }}" draws nothing
-{% endif %}
-{% endfor %}
-            # ── End elements ───────────────────────────────────────────────
-
-            self.display_manager.update_display()
-
-        except Exception as e:
-            self.logger.error('Display error: %s', e, exc_info=True)