refactor(web): build the logged origin with urlunsplit, not an f-string

Semgrep's directly-returned-format-string rule read the helper as a Flask route returning a formatted string. Same output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -19,6 +19,87 @@ accepts both, but the store flags the old spelling as deprecated
 
 ## Unreleased
 
+### Security
+
+- The web interface refuses state-changing requests (`POST`, `PUT`, `PATCH`,
+  `DELETE`) sent by another website's page. Any site a LAN user visited could
+  make their browser submit a plain HTML form to `http://<pi>:5000` -- CORS
+  does not stop such a request, only hides its answer -- and
+  `/api/v3/system/action` accepted form bodies, so that page could reboot or
+  power off the Pi, pull code, or reach any other mutating route. A request
+  whose `Origin` (or, without one, `Referer`) is not the host it was sent to,
+  or is `null`, now gets 403 `CROSS_SITE_REQUEST`
+  (`web_interface/origin_guard.py`). `/api/v3/system/action` also refuses a
+  form-encoded or `text/plain` body (415) unless it carries HTMX's
+  `HX-Request` header; every caller in the interface already sends JSON.
+- **Behaviour change for API scripts:** clients that send no `Origin` or
+  `Referer` -- curl, Python `requests`, Home Assistant, the MQTT bridge --
+  are unaffected. A browser page served from a *different* origin (a
+  dashboard or userscript on another host) can no longer call the mutating
+  API; call it server-side instead. Anyone posting a form body to
+  `system/action` must switch to JSON. Behind a reverse proxy, forward the
+  original `Host`, port included (`proxy_set_header Host $http_host;`;
+  nginx's `$host` drops the port); `X-Forwarded-Host` is not trusted. A
+  TLS-terminating proxy needs nothing more: a portless `Host` matches an
+  `https://` page.
+
+### Fixes
+
+- On-demand no longer restarts a running display. `POST
+  /display/on-demand/start` treated `start_service` (on by default, and what
+  "Preview on display", the on-demand dialog and the MQTT bridge all send) as
+  "restart": it stopped the service, waited 1.5s and started it again, so
+  every request reloaded every plugin and left the panel blank for seconds.
+  The running display already reads the request within a quarter of a second,
+  mid-screen and mid-Vegas included, so the route now only starts the service
+  when it is not running. `POST /display/on-demand/stop` reads
+  `stop_service` as a boolean, so `"false"` no longer stops the service.
+
+## 3.7.0
+
+Sports consolidation stage 3 (#672). No behaviour change: nothing in core
+uses these yet, and the scoreboards adopt them when they floor on 3.7.0.
+
+### New modules
+
+A plugin may import these via `src.*` (floor on 3.7.0). All three hold code
+the scoreboard plugins carry as identical copies, moved without behaviour
+change under the plugins' own method names; each docstring lists what the
+host class must provide. The plugins delete their copies when they floor on
+3.7.0.
+
+- `src/common/sports_celebration.py` — `SportsCelebrationMixin`, the
+  score/win celebration takeover drawn by afl, football, hockey, nrl and
+  soccer (`_draw_celebration_layout` and the palette, backdrop, scenery,
+  confetti and crest steps behind it), plus its colour helpers as free
+  functions: `logo_palette`, `lift_color`, `cap_luminance`, `mix_color`,
+  `scale_color`, `dim_rgba`, `rgb_luminance`, `rgb_saturation`,
+  `color_distance`. Only the drawing: when to celebrate, the phrase and the
+  scenery stay in each plugin.
+- `src/common/sports_fetch.py` — `SportsFetchMixin`, four `SportsCore`
+  methods identical in all nine scoreboards: `_fetch_season_directly`,
+  `_background_fetches_espn_ranges`, `_needs_previous_day` and
+  `_wants_live_odds` (with `_LOOKBACK_CUTOFF_HOUR` and
+  `_LIVE_ODDS_LOOKAHEAD`).
+- `src/common/sports_card_wrappers.py` — `SportsCardWrappersMixin`, the
+  seventeen `sports_card` delegations the eight scoreboard game renderers
+  carry (`_vs_text`, `_element_color`, `_format_game_date`, ...): the methods
+  `SportsGameRendererMixin` expects its host to provide.
+
+## 3.6.2
+
+A fix to `src.common.favorite_team_check` (#670).
+
+### Fixes
+
+- The favourite-team check no longer says the Europa League season has
+  finished between matchdays. Its scoreboard keeps showing the last matchday,
+  and its calendar is a "list" of rounds rather than match days, so neither
+  3.6.1 rule applied. When every event is past, a round in a list calendar
+  that has not started yet (outside an offseason phase) now draws no
+  conclusion. PLL, the World Cup and AFL, whose seasons are over, are still
+  reported as finished: no round of theirs is still to start. (#670)
+
 ## 3.6.1
 
 A fix to `src.common.favorite_team_check` (#667). Plugins that drop their

SECURITY.md

@@ -63,6 +63,14 @@ are intentional rather than vulnerabilities:
 
 - **No web UI authentication.** The web interface assumes the network
   it's running on is trusted. Don't expose port 5000 to the internet.
+  "Trusted network" does not mean "trusted websites", though: any page
+  a LAN user opens could make their browser POST to the Pi. So the
+  interface refuses a `POST`/`PUT`/`PATCH`/`DELETE` whose `Origin` (or
+  `Referer`) header names another site (`web_interface/origin_guard.py`),
+  and `/api/v3/system/action` only accepts JSON or HTMX requests. Tools
+  that send neither header (curl, Home Assistant, the MQTT bridge) are
+  unaffected. Not covered: DNS rebinding, and anyone who can reach the
+  port directly.
 - **Plugins run unsandboxed.** Installed plugins execute in the same
   Python process as the display loop with full file-system and
   network access. Review plugin code (especially third-party plugins

docs/ARCHITECTURE.md

@@ -52,8 +52,10 @@ each other. They share three things:
 | Preview viewer marker | `/tmp/led_matrix_preview_viewer` | web, while a preview is open | display: writes full-rate snapshots only while it is fresh |
 | Hardware init status | `/tmp/led_matrix_hw_status.json` | display | web: `/api/v3/hardware/status` |
 
-The on-demand start route also restarts `ledmatrix.service` by default so the
-request takes effect straight away.
+The on-demand start route starts `ledmatrix.service` when it is not running
+(`start_service`, on by default) but never restarts a running one: the display
+reads the mailbox every `ON_DEMAND_POLL_INTERVAL` (0.25s), from its dwell
+sleep, its render loops and Vegas's interrupt check as well as the main loop.
 
 ## Display loop
 

docs/REST_API_REFERENCE.md

@@ -18,6 +18,17 @@ top level instead of under `data` (install-from-url, registry-from-url, the
 auth endpoints, upload endpoints, `system/git-info`, `system/check-update`),
 the entry below says so.
 
+**Cross-site requests are refused.** A `POST`, `PUT`, `PATCH` or `DELETE`
+carrying an `Origin` header (or, without one, a `Referer`) that is not the
+host the request was sent to gets `403` with `"error_code":
+"CROSS_SITE_REQUEST"`; so does `Origin: null`. This stops other websites from
+driving the Pi through a LAN user's browser. Scripts, curl, Home Assistant and
+the MQTT bridge send neither header and are unaffected. A browser page on
+another origin (a dashboard you host elsewhere, say) can no longer call the
+API; call it server-side instead. Behind a reverse proxy, pass the original
+`Host` through, port included (nginx: `proxy_set_header Host $http_host;`;
+`$host` drops the port) -- `X-Forwarded-Host` is not read.
+
 ## Table of Contents
 
 - [Configuration](#configuration)
@@ -390,7 +401,7 @@ Request a specific plugin to display on-demand.
 - `mode` (string, optional): Display mode name (plugin_id inferred if not provided)
 - `duration` (number, optional): Duration in seconds (0 = until stopped)
 - `pinned` (boolean, optional): Pin display (pause rotation)
-- `start_service` (boolean, optional): (Re)start the display service so it picks the request up (default: true)
+- `start_service` (boolean, optional): Start the display service if it is not running (default: true). A running service is never restarted: it picks the request up within about a quarter of a second. When false and the service is stopped, the route returns 400.
 
 **Response**:
 ```json
@@ -1388,7 +1399,10 @@ Fetches `origin` and lists branches to switch to: `current`, `upstream`,
 
 **POST** `/api/v3/system/action`
 
-Execute system-level actions. JSON or form data.
+Execute system-level actions. Send JSON (`Content-Type: application/json`).
+A form-encoded or `text/plain` body is accepted only with an `HX-Request`
+header (HTMX sends it; a cross-site HTML form cannot) and is otherwise
+refused with `415`.
 
 **Request Body**:
 ```json

docs/SPORTS_UNIFICATION.md

@@ -83,6 +83,9 @@ more. Shared sports code lives in `src/common`:
 | `espn_dates.py` | 3.5.0 | ESPN date-range and `limit` workarounds |
 | `favorite_team_check.py` | 3.6.0 | `FavoriteTeamCheck` — logs why a favourite team code shows nothing |
 | `sports_timezone.py` | 3.6.0 | Which timezone start times are drawn in (`resolve_timezone_name`) |
+| `sports_celebration.py` | 3.7.0 | `SportsCelebrationMixin` — draws the score/win takeover; colour helpers |
+| `sports_fetch.py` | 3.7.0 | `SportsFetchMixin` — season fetch, live lookback and live-odds decisions |
+| `sports_card_wrappers.py` | 3.7.0 | `SportsCardWrappersMixin` — the game renderer's `sports_card` delegations |
 
 Each is described in [src/common/README.md](../src/common/README.md).
 
@@ -168,6 +171,15 @@ Mix it in **before** the mode class — `class SoccerLive(CelebrationMixin,
 SportsLive)` — so the celebration `display()` runs first and falls through to
 the scorebug via `super()`.
 
+What shipped is narrower. `src/common/sports_celebration.py`
+(`SportsCelebrationMixin`) holds only the drawing, which is identical in the
+five scoreboards that celebrate (afl, football, hockey, nrl, soccer — hockey
+grew celebrations after this was written). Arming a celebration stays in each
+plugin: the trigger bodies differ (nrl matches favourites by team id, football
+folds a touchdown's extra point into one celebration and picks scenery by
+points), and so does `display()`. The seams above were not needed to move the
+drawing, so none was added.
+
 **Rotation strategies.** The three "dialects" turned out to be one algorithm
 (Smooth Weighted Round-Robin) in two shapes: an incremental picker holding state
 across calls (afl/nrl/soccer) and a precomputed per-cycle list

docs/WEB_INTERFACE_GUIDE.md

@@ -412,6 +412,16 @@ The API blueprint (`web_interface/blueprints/api_v3/`) is registered at
 - No authentication is currently implemented
 - Recommended for trusted networks only
 
+**Other websites:**
+- A web page you open elsewhere could otherwise make your browser send
+  commands to the Pi (reboot, update, config changes). The interface refuses
+  any change request whose `Origin`/`Referer` header names a different site
+  (403 `CROSS_SITE_REQUEST`), so use the interface from its own address.
+- Scripts, curl, Home Assistant and the MQTT bridge send no such header and
+  keep working. Behind a reverse proxy, forward the original `Host` header
+  with its port (nginx: `proxy_set_header Host $http_host;` -- `$host`
+  drops the port).
+
 **Best Practices:**
 1. Run on a private network (not exposed to internet)
 2. Use a firewall to restrict access if needed

mypy-clean.txt

@@ -32,6 +32,9 @@ src/common/render_gate.py
 src/common/scroll_config.py
 src/common/snapshot_policy.py
 src/common/sports_card.py
+src/common/sports_card_wrappers.py
+src/common/sports_celebration.py
+src/common/sports_fetch.py
 src/common/sports_scroll.py
 src/common/sports_timezone.py
 src/config_service.py

src/__init__.py

@@ -4,5 +4,5 @@ LEDMatrix Display System
 Core source package for the LED Matrix Display project.
 """
 
-__version__ = "3.6.1"
+__version__ = "3.7.0"
 

src/common/README.md

@@ -38,6 +38,9 @@ Rules for the package:
 | [`scroll_helper`](#scroll_helper) | Pre-rendered horizontal scrolling | Yes | — |
 | [`snapshot_policy`](#snapshot_policy) | When to write the web preview frame | No, core-internal | n/a |
 | [`sports_card`](#sports_card) | Scoreboard card settings, colours, fonts, dates | Yes (scoreboards) | 3.3.0 |
+| [`sports_card_wrappers`](#sports_card_wrappers) | The game renderer's `sports_card` delegations | Yes (scoreboards) | 3.7.0 |
+| [`sports_celebration`](#sports_celebration) | Draw a scoreboard's score/win celebration | Yes (scoreboards) | 3.7.0 |
+| [`sports_fetch`](#sports_fetch) | Scoreboard season fetch, lookback and live-odds decisions | Yes (scoreboards) | 3.7.0 |
 | [`sports_game_renderer`](#sports_game_renderer) | Scoreboard scroll/Vegas card geometry | Yes (scoreboards) | 3.3.0 |
 | [`sports_helpers`](#sports_helpers) | Small helpers every scoreboard `sports.py` copies | Yes (scoreboards) | 3.5.0 |
 | [`sports_scroll`](#sports_scroll) | Scoreboard scroll-display orchestration | Yes (scoreboards) | 3.2.0 |
@@ -46,7 +49,7 @@ Rules for the package:
 | [`sync_manager`](#sync_manager) | Leader/follower sync between two displays | No, core-internal | n/a |
 | [`text_helper`](#text_helper) | Outlined text, wrapping, measurement | Yes | — |
 
-The four `sports_*` mixin and card modules hold code the scoreboard plugins
+The `sports_*` mixin and card modules hold code the scoreboard plugins
 used to carry as identical copies. Each module docstring lists what a host
 class must provide. The plan behind them is in
 [docs/SPORTS_UNIFICATION.md](../../docs/SPORTS_UNIFICATION.md).
@@ -216,6 +219,33 @@ dates (`format_game_date()`, `format_game_time()`, `card_tzinfo()`) and font
 sizes (`schema_font_size()`, `resolve_font_size()`). A plugin keeps its own
 method and delegates the body.
 
+### sports_card_wrappers
+
+[`sports_card_wrappers.py`](sports_card_wrappers.py).
+`SportsCardWrappersMixin`: the one-line methods a scoreboard's game renderer
+uses to call `sports_card` with its own `config` and `logger`
+(`_vs_text()`, `_element_color()`, `_format_game_date()`, ... seventeen in
+all), under their existing names. They are what `sports_game_renderer`'s
+mixin expects its host to provide. No `__init__` and no state.
+
+### sports_celebration
+
+[`sports_celebration.py`](sports_celebration.py). `SportsCelebrationMixin`
+draws the full-screen takeover a scoreboard shows when a team scores or wins
+(`_draw_celebration_layout(celebration)`): a backdrop in the scoring team's
+colours read off its crest, scenery, confetti, the headline and the score.
+The colour helpers are free functions (`logo_palette()`, `lift_color()`,
+`mix_color()`, ...). Deciding *when* to celebrate stays in the plugin, which
+builds the celebration dict the docstring describes.
+
+### sports_fetch
+
+[`sports_fetch.py`](sports_fetch.py). `SportsFetchMixin`: the `SportsCore`
+methods that decide which requests a scoreboard makes --
+`_fetch_season_directly()` (a season, in chunks ESPN accepts),
+`_background_fetches_espn_ranges()`, `_needs_previous_day()` (the live
+lookback) and `_wants_live_odds()` (odds only for games near the screen).
+
 ### sports_game_renderer
 
 [`sports_game_renderer.py`](sports_game_renderer.py).

src/common/favorite_team_check.py

@@ -218,6 +218,8 @@ class FavoriteTeamCheck:
                 return None  # Nothing published either way; draw no conclusion.
             if cls._moved_to_later_phase(payload):
                 return None  # e.g. postseason under way; see the method.
+            if cls._later_round_scheduled(payload, now):
+                return None  # e.g. Europa League between matchdays.
             return ("the season has finished and the next one's fixtures are "
                     "not published yet")
 
@@ -259,6 +261,44 @@ class FavoriteTeamCheck:
         known = [t for t in event_types if isinstance(t, int)]
         return bool(known) and all(t < league_type for t in known)
 
+    @classmethod
+    def _later_round_scheduled(cls, payload, now: datetime) -> bool:
+        """
+        Whether a "list" calendar has a round that has not started yet.
+
+        Competitions with a list calendar (the UEFA club competitions, the
+        World Cup, AFL, NFL) give each phase its rounds as ``entries`` with
+        start and end dates. Between matchdays the Europa League scoreboard
+        keeps showing the last one: on 2026-09-29 every event was from 17
+        September, the next matchday was only days away, and the rounds from
+        the knockout play-offs to the final were all still to come. A round
+        that starts later means the season is not over, even though the
+        date of the next fixture is not known.
+
+        Only a round's *start* counts. End dates are padded well past the
+        last game -- the World Cup's final round ran to 1 August for a 19 July
+        final -- so a future end date is also true of a finished season.
+        Rounds in an offseason phase (the college football All-Star week)
+        are not games for the favourites and do not count either.
+        """
+        league = (payload.get('leagues') or [{}])[0] or {}
+        for phase in league.get('calendar') or []:
+            if not isinstance(phase, dict) or cls._is_offseason(phase.get('label')):
+                continue
+            for entry in phase.get('entries') or []:
+                if not isinstance(entry, dict) or cls._is_offseason(entry.get('label')):
+                    continue
+                start = cls._parse_date(entry.get('startDate'))
+                if start and start > now:
+                    return True
+        return False
+
+    @staticmethod
+    def _is_offseason(label) -> bool:
+        """'Off Season', 'Offseason', 'Off-season' ..."""
+        return isinstance(label, str) and 'offseason' in re.sub(
+            r'[^a-z]', '', label.lower())
+
     @staticmethod
     def _parse_date(raw) -> Optional[datetime]:
         if not raw or not isinstance(raw, str):

src/common/sports_card_wrappers.py

@@ -0,0 +1,136 @@
+"""The ``sports_card`` delegations every scoreboard's game renderer carries.
+
+After the card helpers moved to ``sports_card`` (3.3.0), each of the eight
+scoreboards with a ``game_renderer.py`` -- afl, baseball, basketball,
+football, hockey, lacrosse, nrl and soccer -- kept one-line methods that
+forward to them with its own ``config`` and ``logger``. Seventeen are
+identical in all eight (executable AST, docstrings stripped) or in all but
+football, and were copied here from ledmatrix-plugins ``30455671``
+(origin/main, 2026-09-29) under their existing names. Football's own
+``_format_game_date`` and ``_upcoming_center_mode`` (they follow the
+switch-mode settings when it draws the full-screen scorebug) stay in football
+and override these.
+
+``_schema_font_size`` and ``_resolve_font_size`` look the same in every copy
+but are not moved: they read ``_SCHEMA_PATH``, a module global that is each
+plugin's own ``config_schema.json``.
+
+These are the methods ``SportsGameRendererMixin`` (``sports_game_renderer``)
+lists among what its host must provide, so a renderer that inherits both no
+longer has to write them. Like that mixin this has no ``__init__`` and no
+state. It is a separate module rather than more methods there for the reason
+``sports_helpers`` gives: a missing module fails at load, where the version
+checks see it; a missing method fails mid-render.
+
+WHAT A HOST MUST PROVIDE
+------------------------
+Derived by walking every ``self.<attr>`` the mixin reads; the host-contract
+test in ``test/test_sports_card_wrappers.py`` fails if a read is added
+without being listed here.
+
+- ``config`` and ``logger``.
+- ``fonts``, read with ``getattr`` -- ``_font_color``.
+- ``_FONT_NAME_ALIASES`` and ``_FONT_PIXEL_GRID`` class attributes --
+  ``_crisp_size``, which passes them to ``sports_card.crisp_size`` so a
+  renderer that declares extra faces keeps them.
+
+Add it as a base of the plugin's renderer, e.g.
+``class GameRenderer(SportsCardWrappersMixin, SportsGameRendererMixin)``.
+The two define no name in common; a method on the plugin's own class still
+wins over either.
+"""
+
+import logging
+from typing import Any, ClassVar, Dict, Optional, Tuple
+
+from src.common import sports_card as _card
+
+
+class SportsCardWrappersMixin:
+    """The game renderer's ``sports_card`` delegations. See module docstring."""
+
+    # The host contract, declared for type checking only: these create no
+    # attributes, so the host's own values are what the methods read.
+    config: Dict[str, Any]
+    logger: logging.Logger
+    _FONT_NAME_ALIASES: ClassVar[Dict[str, str]]
+    _FONT_PIXEL_GRID: ClassVar[Dict[str, Any]]
+
+    # ---- fonts ---------------------------------------------------------
+
+    @classmethod
+    def _crisp_size(cls, font_file, desired):
+        """``sports_card.crisp_size`` with this renderer's font tables."""
+        return _card.crisp_size(font_file, desired,
+                                cls._FONT_NAME_ALIASES, cls._FONT_PIXEL_GRID)
+
+    def _unshare_element_fonts(self, fonts):
+        """``sports_card.unshare_element_fonts``."""
+        return _card.unshare_element_fonts(self.logger, fonts)
+
+    def _font_color(self, font, default: Tuple[int, int, int] = (255, 255, 255)):
+        """``sports_card.font_color`` for one of ``self.fonts``."""
+        return _card.font_color(self.config, getattr(self, "fonts", None), font, default)
+
+    # ---- colours and favourites ---------------------------------------
+
+    @staticmethod
+    def _coerce_rgb(value, fallback):
+        """``sports_card.coerce_rgb``."""
+        return _card.coerce_rgb(value, fallback)
+
+    @staticmethod
+    def _side_is_favorite(game: Dict[str, Any], side: str, favorites: set) -> bool:
+        """``sports_card.side_is_favorite``."""
+        return _card.side_is_favorite(game, side, favorites)
+
+    @staticmethod
+    def _side_score(game: Dict[str, Any], side: str) -> Optional[int]:
+        """``sports_card.side_score``."""
+        return _card.side_score(game, side)
+
+    def _favorite_result(self, game: Dict[str, Any]) -> Optional[str]:
+        """``sports_card.favorite_result``."""
+        return _card.favorite_result(self.config, game)
+
+    def _score_color_for(self, game: Dict[str, Any], game_type: str, default=None):
+        """``sports_card.score_color_for``."""
+        return _card.score_color_for(self.config, self.logger, game, game_type, default)
+
+    def _recent_score_color(self, game: Dict[str, Any], default):
+        """``sports_card.recent_score_color``."""
+        return _card.recent_score_color(self.config, self.logger, game, default)
+
+    def _element_color(self, element: str, default: Tuple[int, int, int] = (255, 255, 255)):
+        """``sports_card.element_color``."""
+        return _card.element_color(self.config, element, default)
+
+    # ---- card options, dates and times --------------------------------
+
+    def _scroll_card_option(self, key: str, default: Any = None) -> Any:
+        """``sports_card.scroll_card_option``."""
+        return _card.scroll_card_option(self.config, key, default)
+
+    def _upcoming_center_mode(self) -> str:
+        """``sports_card.upcoming_center_mode``."""
+        return _card.upcoming_center_mode(self.config)
+
+    def _vs_text(self) -> str:
+        """``sports_card.vs_text``."""
+        return _card.vs_text(self.config)
+
+    def _format_game_date(self, date_text: str, game: Optional[Dict] = None) -> str:
+        """``sports_card.format_game_date``."""
+        return _card.format_game_date(self.config, self.logger, date_text, game)
+
+    def _weekday_for(self, game: Optional[Dict]) -> str:
+        """``sports_card.weekday_for``."""
+        return _card.weekday_for(self.config, self.logger, game)
+
+    def _card_tzinfo(self):
+        """``sports_card.card_tzinfo``."""
+        return _card.card_tzinfo(self.config, self.logger)
+
+    def _format_game_time(self, time_text: str) -> str:
+        """``sports_card.format_game_time``."""
+        return _card.format_game_time(self.config, time_text)

src/common/sports_celebration.py

@@ -0,0 +1,780 @@
+"""How the scoreboards draw a score or win celebration.
+
+Five scoreboards -- afl, football, hockey, nrl and soccer -- take over the
+panel when a team scores or wins: a backdrop in the scoring team's colours
+read off its crest, scenery for the kind of score, confetti, the headline and
+the score with the scoring side's digits breathing. The drawing is identical
+in all five ``sports.py`` copies (executable AST, docstrings stripped), and
+so are the colour helpers it uses; they were copied here from
+ledmatrix-plugins ``30455671`` (origin/main, 2026-09-29).
+
+Only the drawing moved. What *arms* a celebration stays in each plugin,
+because it differs: which scores count (``_check_for_goal`` /
+``_check_for_score``, and nrl matches favourites by team id), the phrase and
+the scenery (``_start_celebration``), and when a win fires
+(``_check_for_win``). So does ``display()``, which decides whether the
+takeover or the scorebug is on screen. A plugin hands this mixin a
+celebration dict and it draws it.
+
+The colour helpers are public free functions here (``logo_palette``,
+``lift_color``, ``mix_color``, ...); in the plugins they were the same
+functions with a leading underscore.
+
+THE CELEBRATION DICT
+--------------------
+Built by the plugin's ``_start_celebration``. Read here: ``game`` (a
+view-model dict; ``<side>_id``, ``<side>_abbr``, ``<side>_logo_path`` and
+``<side>_logo_url`` for the crests, ``id`` for the confetti seed),
+``scored_side`` (``"away"`` or ``"home"``), ``away_score``, ``home_score``,
+``phrase``, ``started_at`` (a ``time.time()`` value) and ``motif``
+(``"score"``, ``"kick"``, ``"touchdown"``, ``"net"`` or ``"win"``; anything
+else draws the ``"score"`` diagonals). The drawing caches what it derives in
+the same dict, under ``_palette``, ``_backdrop``, ``_confetti`` and
+``_crests``, so each is worked out once per celebration.
+
+WHAT A HOST MUST PROVIDE
+------------------------
+Derived by walking every ``self.<attr>`` the mixin reads; the host-contract
+test in ``test/test_sports_celebration.py`` fails if a read is added without
+being listed here. All five scoreboards' ``SportsLive`` provide them.
+
+- ``display_manager`` -- ``image`` is replaced with the frame, then
+  ``update_display()``; ``clear()`` on ``force_clear``. Its ``matrix``
+  width and height are used when it has a matrix, else ``display_width`` /
+  ``display_height``.
+- ``fonts`` -- ``"time"`` and ``"status"`` for the headline (the first that
+  fits), ``"score"`` for the score.
+- ``logger``.
+- ``_load_and_resize_logo(team_id, abbr, logo_path, logo_url)`` -- a crest
+  as an RGBA image, or ``None``.
+- ``_draw_text_with_outline(draw, text, position, font, fill=...)`` -- on
+  ``SportsCoreSharedMixin``.
+- ``celebration_duration``, ``celebration_team_colors`` and
+  ``celebration_confetti``, read with ``getattr`` (defaults 8, on, on).
+
+Mix it in ahead of the mode classes, e.g.
+``class SportsLive(SportsCelebrationMixin, SportsLiveSharedMixin,
+SportsCore)``. It defines nothing any of them define, so the order only
+matters for a plugin that keeps its own copy of one of these methods: a
+method on the plugin's class always wins over the mixin's.
+"""
+
+import colorsys
+import logging
+import math
+import random
+import time
+from typing import Any, Callable, ClassVar, Dict, List, Optional, Sequence, Tuple
+
+from PIL import Image, ImageDraw
+
+#: A colour as the helpers return it: three 0-255 channels.
+Color = Tuple[int, ...]
+#: ``deep``, ``glow``, ``headline`` and ``accent``; see ``logo_palette``.
+Palette = Dict[str, Color]
+#: One confetti flake: column, start height, fall speed, sway phase, size
+#: in pixels, colour.
+Flake = Tuple[float, float, float, float, int, Color]
+
+# ----------------------------------------------------------------------
+# Colour helpers for the score/win celebration
+#
+# Module level rather than methods: they are pure, which is what makes the
+# palette testable without standing up a live manager, and they are shared by
+# the takeover's backdrop, confetti and text.
+# ----------------------------------------------------------------------
+
+#: The crest is sampled at this resolution. Big enough that a secondary
+#: colour survives (a helmet stripe, a trim), small enough that the whole
+#: sample is ~1600 pixels of pure-Python work, once per team.
+_PALETTE_SAMPLE_PX = 40
+#: Above this, a colour carries team identity; below it, it is a grey.
+_PALETTE_VIVID_SATURATION = 0.22
+#: Ignore pixels this dark -- crest outlines, drop shadows, anti-aliasing.
+_PALETTE_MIN_CHANNEL = 24
+#: How far apart two bins must be to count as a second, different colour.
+_PALETTE_DISTINCT_DISTANCE = 90.0
+#: Never bleed a lifted colour below this saturation; past it a hue stops
+#: being the team's colour and starts being a pastel.
+_PALETTE_MIN_SATURATION = 0.42
+#: Lift a headline colour until it is at least this luminous. Chosen so
+#: midnight navy reaches a blue that reads at 6px on a panel without
+#: becoming a different colour.
+_PALETTE_HEADLINE_LUMINANCE = 112.0
+#: A crest colour this luminous already reads on a panel, so it is preferred
+#: over a darker one that would have to be lifted to get there. Lifting is a
+#: compromise -- Green Bay's dark green only reaches legibility as a teal --
+#: and most teams whose primary is dark carry a bright second colour that is
+#: just as much theirs. This is what picks the Packers' gold over that teal.
+_PALETTE_LEGIBLE_LUMINANCE = 90.0
+#: ...but only from a colour the crest actually means. The pixels where a
+#: bright edge is anti-aliased into a dark fill are luminous too, and there is
+#: always a band of them: Kansas City's white-on-red outline leaves a pink at
+#: luminance 90 that would otherwise be preferred over the red itself. A blend
+#: is a mix, so it is markedly less saturated than either colour it sits
+#: between -- that pink is 0.48 where the red is 0.96 and the Packers' gold,
+#: which this must keep, is 0.89.
+_PALETTE_LEGIBLE_SATURATION = 0.65
+#: And it has to be a band of the crest, not a speck of one.
+_PALETTE_LEGIBLE_AREA = 0.02
+#: Cap the backdrop's luminance so the headline stays legible over it,
+#: and the scenery's so it stays behind the headline. Both are luminance and
+#: not HSV value on purpose: a silver crest -- the Raiders, or the grey
+#: placeholder a failed logo download leaves behind -- has a value of ~0.95,
+#: and capping that at 0.34 still yields a light grey card that white text
+#: then vanishes into. Scaling the channels down is also hue-exact, which is
+#: what lets this be the plain arithmetic that lifting a colour cannot be.
+_PALETTE_BACKDROP_LUMINANCE = 34.0
+_PALETTE_SCENERY_LUMINANCE = 70.0
+
+
+def rgb_luminance(color: Sequence[float]) -> float:
+    """Rec. 709 relative luminance, 0-255."""
+    return 0.2126 * color[0] + 0.7152 * color[1] + 0.0722 * color[2]
+
+
+def rgb_saturation(color: Sequence[float]) -> float:
+    """HSV saturation, 0-1."""
+    high = max(color)
+    return (high - min(color)) / high if high else 0.0
+
+
+def color_distance(a: Sequence[float], b: Sequence[float]) -> float:
+    """Euclidean distance between two colours in RGB."""
+    return math.sqrt(sum((x - y) ** 2 for x, y in zip(a, b)))
+
+
+def mix_color(a: Sequence[float], b: Sequence[float], t: float) -> Color:
+    """Blend ``a`` towards ``b``; t=0 is all a, t=1 is all b."""
+    t = min(max(t, 0.0), 1.0)
+    return tuple(int(round(a[i] + (b[i] - a[i]) * t)) for i in range(3))
+
+
+def scale_color(color: Sequence[float], factor: float) -> Color:
+    """Scale a colour's brightness, clamped to the panel's range."""
+    return tuple(min(255, max(0, int(round(c * factor)))) for c in color)
+
+
+def lift_color(color: Sequence[float], min_luminance: float = _PALETTE_HEADLINE_LUMINANCE,
+               cap_saturation: float = 0.92) -> Color:
+    """Raise a colour's brightness until it reads on a panel, keeping its hue.
+
+    Scaling the channels directly is what the obvious version of this does,
+    and it shifts hue badly on exactly the colours that need lifting: it turns
+    Baltimore's navy-purple into magenta. Working in HSV and raising only the
+    value leaves the hue where the team put it.
+    """
+    if rgb_luminance(color) >= min_luminance:
+        return tuple(int(c) for c in color)
+    hue, saturation, value = colorsys.rgb_to_hsv(*[c / 255.0 for c in color])
+    if saturation < 0.12:
+        # A grey or a silver has no hue to preserve; just make it bright.
+        lifted = colorsys.hsv_to_rgb(hue, saturation, max(value, 0.85))
+        return tuple(int(round(c * 255)) for c in lifted)
+    saturation = min(saturation, cap_saturation)
+
+    def _rgb(s: float, v: float) -> Color:
+        return tuple(int(round(c * 255)) for c in colorsys.hsv_to_rgb(hue, s, v))
+
+    out = _rgb(saturation, value)
+    while value < 1.0 and rgb_luminance(out) < min_luminance:
+        value = min(1.0, value + 0.05)
+        out = _rgb(saturation, value)
+    # Blue carries almost no luminance -- pure blue sits at 18 of 255 -- so a
+    # navy or a deep purple runs out of value long before it is legible.
+    # Bleeding saturation out of it is the only way up, and it keeps the hue
+    # (Baltimore stays purple, just a lighter one) where giving up would
+    # leave the headline unreadable. Floored so it never washes out to white.
+    while saturation > _PALETTE_MIN_SATURATION and rgb_luminance(out) < min_luminance:
+        saturation = max(_PALETTE_MIN_SATURATION, saturation - 0.05)
+        out = _rgb(saturation, value)
+    return out
+
+
+def cap_luminance(color: Sequence[float], max_luminance: float) -> Color:
+    """Darken a colour until it is no brighter than ``max_luminance``.
+
+    A straight channel scale, which is exactly hue-preserving on the way down
+    -- unlike lifting, where clamping at 255 is what bends the hue.
+    """
+    luminance = rgb_luminance(color)
+    if luminance <= max_luminance or luminance <= 0:
+        return tuple(int(c) for c in color)
+    return scale_color(color, max_luminance / luminance)
+
+
+def dim_rgba(image: Image.Image, factor: float) -> Image.Image:
+    """Scale an RGBA image's colour channels, leaving its alpha alone.
+
+    ImageEnhance.Brightness would scale the alpha band too, which fades the
+    crest out instead of dimming it and leaves its anti-aliased edge looking
+    chewed against the backdrop.
+    """
+    red, green, blue, alpha = image.split()
+    lut = [min(255, int(i * factor)) for i in range(256)]
+    return Image.merge(
+        "RGBA", (red.point(lut), green.point(lut), blue.point(lut), alpha)
+    )
+
+
+_Buckets = Dict[Tuple[int, int, int], List[int]]
+
+
+def _palette_buckets(logo: Image.Image) -> Tuple[_Buckets, _Buckets]:
+    """Bucket a crest's opaque pixels into coarse colour bins.
+
+    Returns ``(vivid, neutral)``; each maps a 3-bit-per-channel key to
+    ``[r_sum, g_sum, b_sum, count]``. Neutral holds the greys, silvers and
+    whites that carry no identity on their own but are all a monochrome crest
+    -- the Raiders' silver on black -- has to offer.
+    """
+    sample = logo.convert("RGBA")
+    sample.thumbnail((_PALETTE_SAMPLE_PX, _PALETTE_SAMPLE_PX), Image.Resampling.BOX)
+    vivid: _Buckets = {}
+    neutral: _Buckets = {}
+    # tobytes() rather than getdata(): same pixels, no per-pixel Python
+    # object, and getdata() is deprecated from Pillow 14.
+    raw = sample.tobytes()
+    for i in range(0, len(raw) - 3, 4):
+        red, green, blue, alpha = raw[i], raw[i + 1], raw[i + 2], raw[i + 3]
+        if alpha < 160:
+            continue
+        high, low = max(red, green, blue), min(red, green, blue)
+        if high < _PALETTE_MIN_CHANNEL:
+            continue
+        target = vivid if (high - low) / high >= _PALETTE_VIVID_SATURATION else neutral
+        acc = target.setdefault((red >> 5, green >> 5, blue >> 5), [0, 0, 0, 0])
+        acc[0] += red
+        acc[1] += green
+        acc[2] += blue
+        acc[3] += 1
+    return vivid, neutral
+
+
+def _bucket_mean(acc: List[int]) -> Color:
+    count = acc[3]
+    return (acc[0] // count, acc[1] // count, acc[2] // count)
+
+
+def _bucket_headline_score(acc: List[int]) -> float:
+    """How well a colour bin would serve as 6px of text on a panel.
+
+    Area alone picks the biggest block of colour, which on a lot of crests is
+    a dark navy fill -- correct as a backdrop, invisible as text. Weighting
+    area by saturation and by luminance picks the colour the team is loud in:
+    Chicago's orange over its navy, Baltimore's gold over its purple.
+    """
+    color = _bucket_mean(acc)
+    return (
+        acc[3]
+        * (0.30 + 0.70 * rgb_saturation(color))
+        * (0.20 + 0.80 * min(1.0, rgb_luminance(color) / 120.0))
+    )
+
+
+def logo_palette(logo: Image.Image) -> Optional[Palette]:
+    """Pick a celebration palette out of a team crest, or None.
+
+    Two rankings, because a crest's largest colour and its most legible one
+    are usually not the same and the takeover needs both:
+
+    * ``deep`` -- the largest vivid area, darkened into the background wash.
+      This is what the team reads as at a glance: Chicago navy, Dallas navy,
+      Baltimore purple.
+    * ``headline`` -- the vivid area that best survives being shrunk to text,
+      then lifted until it is legible: Chicago orange, Baltimore gold.
+    * ``accent`` -- the next vivid colour far enough away from the headline to
+      be told apart, for confetti. Falls back to the headline.
+
+    A crest with no vivid pixels at all falls back to its brightest neutral,
+    which for the Raiders' silver-on-black is exactly the right answer.
+    """
+    try:
+        vivid, neutral = _palette_buckets(logo)
+    except Exception:  # noqa: BLE001 - a crest is never worth the takeover
+        return None
+
+    pool = list(vivid.values())
+    if not pool and neutral:
+        pool = [
+            max(
+                neutral.values(),
+                key=lambda acc: acc[3]
+                * (0.2 + 0.8 * min(1.0, rgb_luminance(_bucket_mean(acc)) / 160.0)),
+            )
+        ]
+    if not pool:
+        return None
+
+    deep_base = _bucket_mean(max(pool, key=lambda acc: acc[3]))
+    ranked = sorted(pool, key=_bucket_headline_score, reverse=True)
+    headline_base = _bucket_mean(ranked[0])
+    vivid_pixels = sum(acc[3] for acc in pool)
+    for acc in ranked:
+        candidate = _bucket_mean(acc)
+        if (
+            rgb_luminance(candidate) >= _PALETTE_LEGIBLE_LUMINANCE
+            and rgb_saturation(candidate) >= _PALETTE_LEGIBLE_SATURATION
+            and acc[3] >= max(3, vivid_pixels * _PALETTE_LEGIBLE_AREA)
+        ):
+            headline_base = candidate
+            break
+    headline = lift_color(headline_base)
+
+    accent = headline
+    for acc in ranked[1:]:
+        candidate = _bucket_mean(acc)
+        if color_distance(candidate, headline_base) > _PALETTE_DISTINCT_DISTANCE:
+            accent = lift_color(candidate)
+            break
+
+    deep = cap_luminance(deep_base, _PALETTE_BACKDROP_LUMINANCE)
+    return {
+        "deep": deep,
+        # Scenery is the backdrop carried a little way towards the headline:
+        # tied to the team's colours, and guaranteed to be visible even when
+        # the backdrop is nearly black.
+        "glow": cap_luminance(
+            mix_color(deep, headline, 0.22), _PALETTE_SCENERY_LUMINANCE
+        ),
+        "headline": headline,
+        "accent": accent,
+    }
+
+
+class SportsCelebrationMixin:
+    """Draws a score/win celebration takeover. See the module docstring."""
+
+    # The host contract, declared for type checking only: these create no
+    # attributes, so the host's own values are what the methods read.
+    display_manager: Any
+    display_width: int
+    display_height: int
+    fonts: Dict[str, Any]
+    logger: logging.Logger
+    _load_and_resize_logo: Callable[..., Optional[Image.Image]]
+    _draw_text_with_outline: Callable[..., None]
+
+    def _fit_font(self, draw, text: str, max_width: int, fonts: list):
+        """Return the first font whose rendered ``text`` fits ``max_width``,
+        falling back to the last (smallest) font."""
+        for font in fonts:
+            if draw.textlength(text, font=font) <= max_width - 2:
+                return font
+        return fonts[-1]
+
+    # ------------------------------------------------------------------
+    # Celebration palette
+    #
+    # The takeover is drawn in the scoring team's own colours, taken from the
+    # pixels of its crest.
+    #
+    # ESPN does serve team.color / team.alternateColor, but only inside
+    # _extract_game_details_common -- a function each scoreboard lineage
+    # keeps its own copy of -- so reading it there would drag every one of
+    # them into a celebration change. The crest is already downloaded,
+    # decoded and sitting in the logo cache by the time a celebration draws,
+    # so the colours come from it instead: no extra request, no per-league
+    # colour table to maintain, and it works for any team ESPN can name --
+    # including the FCS opponents no table would list.
+    #
+    # Where a crest's colour differs from the club's published one it
+    # tends to differ usefully: a published primary is often a near-black
+    # navy, or an actual #000000, where what the crest carries is the colour
+    # that reads on an LED panel. Measured across all 32 clubs in
+    # football-scoreboard.
+    # ------------------------------------------------------------------
+
+    #: Used when the crest yields nothing (no logo on disk yet, or the grey
+    #: placeholder a failed download leaves) or team colours are switched
+    #: off -- the navy and amber the celebration wore before it had a palette.
+    _DEFAULT_CELEBRATION_PALETTE: ClassVar[Palette] = {
+        "deep": (10, 10, 40),
+        "glow": (30, 30, 86),
+        "headline": (255, 208, 56),
+        "accent": (255, 255, 255),
+    }
+
+    def _celebration_palette(self, celebration: Dict) -> Palette:
+        """The scoring team's colours, derived once per celebration."""
+        cached: Optional[Palette] = celebration.get("_palette")
+        if cached is not None:
+            return cached
+
+        palette = dict(self._DEFAULT_CELEBRATION_PALETTE)
+        if getattr(self, "celebration_team_colors", True):
+            try:
+                game = celebration["game"]
+                side = celebration.get("scored_side") or "home"
+                logo = self._load_and_resize_logo(
+                    game.get("%s_id" % side),
+                    game.get("%s_abbr" % side),
+                    game.get("%s_logo_path" % side),
+                    game.get("%s_logo_url" % side),
+                )
+                derived = logo_palette(logo) if logo is not None else None
+                if derived:
+                    palette = derived
+            except Exception as e:  # noqa: BLE001 - never lose a takeover to a crest
+                self.logger.debug(f"Celebration palette fell back to the default: {e}")
+
+        celebration["_palette"] = palette
+        return palette
+
+    # ------------------------------------------------------------------
+    # Celebration choreography
+    #
+    # Every frame is a finished card. The beats below shift the emphasis --
+    # an opening colour hit, confetti, a breathing score -- but none of them
+    # leaves the panel mid-wipe, because on a switch-mode board the core
+    # drives this plugin at 1 FPS (display_controller reserves its high-FPS
+    # loop for plugins that scroll or declare needs_high_fps), so any single
+    # frame may be the only one a viewer ever sees of it.
+    # ------------------------------------------------------------------
+
+    #: Fraction of the celebration spent on the opening colour hit.
+    _CELEBRATION_IMPACT: ClassVar[float] = 0.11
+    #: Fraction of it after which the takeover eases back down.
+    _CELEBRATION_SETTLE: ClassVar[float] = 0.80
+    #: Seconds per breath of the scoring side's digits. Deliberately a
+    #: continuous sine rather than an on/off toggle: the 4 Hz flash this
+    #: replaced was sampled once a second on a switch-mode board, which
+    #: aliases into a colour that changes at random. A ramp degrades into a
+    #: slow glow instead, and still reads as a pulse at 125 FPS.
+    _CELEBRATION_BREATH_SECONDS: ClassVar[float] = 1.7
+
+    def _celebration_backdrop(
+        self,
+        celebration: Dict,
+        width: int,
+        height: int,
+        palette: Palette,
+    ) -> Image.Image:
+        """The static half of the takeover: a team-colour gradient with the
+        scenery for this kind of score painted into it.
+
+        Built once per celebration per panel size and copied per frame, so the
+        per-pixel work never lands on the render path.
+        """
+        cached: Optional[Tuple[Tuple[int, int], Image.Image]] = celebration.get("_backdrop")
+        if cached is not None and cached[0] == (width, height):
+            return cached[1]
+
+        # One column, then stretched: filling the panel pixel by pixel would
+        # be `width` times the work for the same image.
+        column = Image.new("RGB", (1, max(height, 1)))
+        pixels: Any = column.load()
+        for y in range(height):
+            k = y / max(height - 1, 1)
+            pixels[0, y] = mix_color(palette["deep"], (0, 0, 0), 0.18 + 0.82 * k)
+        backdrop = column.resize((width, height)).convert("RGBA")
+
+        try:
+            self._draw_celebration_motif(
+                ImageDraw.Draw(backdrop),
+                celebration.get("motif") or "score",
+                width,
+                height,
+                palette,
+            )
+        except Exception as e:  # noqa: BLE001 - scenery is never worth a blank panel
+            self.logger.debug(f"Celebration motif skipped: {e}")
+
+        celebration["_backdrop"] = ((width, height), backdrop)
+        return backdrop
+
+    def _draw_celebration_motif(
+        self,
+        draw,
+        motif: str,
+        width: int,
+        height: int,
+        palette: Palette,
+    ) -> None:
+        """Paint the scenery for one kind of score, dim enough to stay behind
+        the headline and the score instead of competing with them."""
+        glow = palette["glow"]
+        if motif == "kick":
+            # The uprights a field goal or an extra point went through,
+            # spread wide enough to frame the score rather than sit beside it.
+            half = max(8, min(width // 3, height))
+            mid = width // 2
+            crossbar = int(height * 0.60)
+            draw.line([(mid - half, int(height * 0.08)), (mid - half, crossbar)], fill=glow)
+            draw.line([(mid + half, int(height * 0.08)), (mid + half, crossbar)], fill=glow)
+            draw.line([(mid - half, crossbar), (mid + half, crossbar)], fill=glow)
+            draw.line([(mid, crossbar), (mid, height - 1)], fill=glow)
+        elif motif == "touchdown":
+            # The goal line, with its hash marks.
+            line_y = int(height * 0.36)
+            draw.line([(0, line_y), (width, line_y)], fill=glow)
+            for x in range(3, width, 9):
+                draw.line([(x, line_y - 2), (x, line_y + 2)], fill=glow)
+        elif motif == "net":
+            # The goal a puck just went into: frame, posts and mesh, sized to
+            # frame the score the way the uprights do.
+            half = max(7, min(width // 4, height))
+            mid = width // 2
+            top = int(height * 0.34)
+            draw.rectangle([(mid - half, top), (mid + half, height - 1)], outline=glow)
+            step = max(3, (half * 2) // 6)
+            for x in range(mid - half + step, mid + half, step):
+                draw.line([(x, top + 1), (x, height - 2)], fill=glow)
+            for y in range(top + step, height - 1, step):
+                draw.line([(mid - half + 1, y), (mid + half - 1, y)], fill=glow)
+        elif motif == "win":
+            # A sunburst behind the winner.
+            cx, cy = width // 2, height // 2
+            reach = max(width, height)
+            for i in range(10):
+                angle = (math.pi * 2 * i / 10) + math.pi / 20
+                draw.line(
+                    [
+                        (cx, cy),
+                        (cx + math.cos(angle) * reach, cy + math.sin(angle) * reach),
+                    ],
+                    fill=glow,
+                )
+        else:
+            for x in range(-height, width + height, 11):
+                draw.line([(x, height), (x + height, 0)], fill=glow)
+
+    def _celebration_confetti(
+        self,
+        celebration: Dict,
+        width: int,
+        height: int,
+        palette: Palette,
+    ) -> List[Flake]:
+        """Seed the confetti once per celebration.
+
+        Seeded from the game rather than the clock, so the same score always
+        produces the same fall -- which is what lets a golden screen lock the
+        effect down instead of having to tolerate it.
+        """
+        cached: Optional[Tuple[Tuple[int, int], List[Flake]]] = celebration.get("_confetti")
+        if cached is not None and cached[0] == (width, height):
+            return cached[1]
+
+        # Sparse on purpose. At one flake per 170 square pixels a 128x32
+        # panel carried 24 single-pixel specks over the headline and the
+        # score, which reads as a dead-pixel problem rather than as confetti.
+        count = max(6, min(22, (width * height) // 260))
+        seed = "%s/%s" % (
+            (celebration.get("game") or {}).get("id", "?"),
+            celebration.get("phrase", ""),
+        )
+        rng = random.Random(seed)  # nosec B311 - confetti, not security
+        # Team colours, plus a pale tint of the headline rather than a flat
+        # white, so the fall still belongs to the team that scored.
+        colors = [
+            palette["headline"],
+            palette["accent"],
+            mix_color(palette["headline"], (255, 255, 255), 0.55),
+        ]
+        flakes = [
+            (
+                float(rng.randrange(max(width, 1))),  # column
+                rng.uniform(0.0, float(height)),      # start height
+                rng.uniform(0.40, 1.15),              # fall speed
+                rng.uniform(0.0, math.pi * 2),        # sway phase
+                2 if rng.random() < 0.6 else 1,       # size in pixels
+                colors[rng.randrange(len(colors))],
+            )
+            for _ in range(count)
+        ]
+        celebration["_confetti"] = ((width, height), flakes)
+        return flakes
+
+    def _draw_celebration_confetti(
+        self,
+        draw,
+        celebration: Dict,
+        width: int,
+        height: int,
+        palette: Palette,
+        elapsed: float,
+        progress: float,
+    ) -> None:
+        """Draw the confetti for this instant, thinning it out as the
+        celebration eases back towards the scorebug."""
+        flakes = self._celebration_confetti(celebration, width, height, palette)
+        fade = 1.0
+        if progress > self._CELEBRATION_SETTLE:
+            fade = max(
+                0.0,
+                1.0
+                - (progress - self._CELEBRATION_SETTLE)
+                / (1.0 - self._CELEBRATION_SETTLE),
+            )
+        if fade <= 0.02:
+            return
+        alpha = int(235 * fade)
+        for column, start, speed, phase, size, color in flakes:
+            y = (start + speed * elapsed * height * 0.42) % (height + 4) - 2
+            x = column + math.sin(elapsed * 2.1 + phase) * 2.4
+            draw.rectangle(
+                [(int(x), int(y)), (int(x) + size - 1, int(y) + size - 1)],
+                fill=tuple(color) + (alpha,),
+            )
+
+    def _celebration_crests(
+        self, celebration: Dict, height: int
+    ) -> Dict[str, Optional[Image.Image]]:
+        """The two crests for the takeover, with the side that did not score
+        dimmed so the scoring team reads at a glance."""
+        cached: Optional[Tuple[int, Dict[str, Optional[Image.Image]]]] = celebration.get("_crests")
+        if cached is not None and cached[0] == height:
+            return cached[1]
+
+        game = celebration["game"]
+        scored = celebration.get("scored_side")
+        crests: Dict[str, Optional[Image.Image]] = {}
+        for side in ("away", "home"):
+            logo = None
+            try:
+                logo = self._load_and_resize_logo(
+                    game.get("%s_id" % side),
+                    game.get("%s_abbr" % side),
+                    game.get("%s_logo_path" % side),
+                    game.get("%s_logo_url" % side),
+                )
+            except Exception as e:  # noqa: BLE001 - a crest is never worth the panel
+                self.logger.debug(f"Celebration logo load failed: {e}")
+            if logo is not None and side != scored:
+                logo = dim_rgba(logo, 0.40)
+            crests[side] = logo
+
+        celebration["_crests"] = (height, crests)
+        return crests
+
+    def _draw_celebration_layout(self, celebration: Dict, force_clear: bool = False) -> None:
+        """Render the full-screen goal/win takeover."""
+        if force_clear:
+            self.display_manager.clear()
+
+        display_width = (
+            self.display_manager.matrix.width
+            if hasattr(self.display_manager, "matrix") and self.display_manager.matrix
+            else self.display_width
+        )
+        display_height = (
+            self.display_manager.matrix.height
+            if hasattr(self.display_manager, "matrix") and self.display_manager.matrix
+            else self.display_height
+        )
+
+        elapsed = max(0.0, time.time() - celebration["started_at"])
+        # getattr throughout the render path: the golden-screen tests build a
+        # live manager through __new__ and set only what they draw with, and a
+        # celebration must never be lost to a missing knob.
+        duration = max(float(getattr(self, "celebration_duration", 8) or 8), 0.5)
+        progress = min(elapsed / duration, 1.0)
+        palette = self._celebration_palette(celebration)
+
+        main_img = self._celebration_backdrop(
+            celebration, display_width, display_height, palette
+        ).copy()
+
+        # Crests at the edges, bleeding off as the scorebug's do.
+        crests = self._celebration_crests(celebration, display_height)
+        center_y = display_height // 2
+        home_logo, away_logo = crests.get("home"), crests.get("away")
+        if home_logo is not None:
+            main_img.paste(
+                home_logo,
+                (display_width - home_logo.width + 2, center_y - home_logo.height // 2),
+                home_logo,
+            )
+        if away_logo is not None:
+            main_img.paste(away_logo, (-2, center_y - away_logo.height // 2), away_logo)
+
+        # The opening hit: the team's headline colour washes the panel and
+        # decays out of it. Held below opaque so the outlined text drawn on
+        # top still reads in whichever frame happens to catch it.
+        impact = max(0.0, 1.0 - progress / self._CELEBRATION_IMPACT)
+        if impact > 0.0:
+            # Scaled by how colourful the team is. A saturated crest gets the
+            # full hit; a silver one -- the Raiders, or the grey placeholder a
+            # failed logo download leaves -- would otherwise wash the whole
+            # panel out to the same flat grey as its own headline colour.
+            punch = 0.45 + 0.55 * rgb_saturation(palette["headline"])
+            alpha = int(140 * punch * (impact ** 1.5))
+            if alpha > 0:
+                main_img = Image.alpha_composite(
+                    main_img,
+                    Image.new(
+                        "RGBA",
+                        (display_width, display_height),
+                        tuple(palette["headline"]) + (alpha,),
+                    ),
+                )
+
+        overlay = Image.new("RGBA", (display_width, display_height), (0, 0, 0, 0))
+        draw = ImageDraw.Draw(overlay)
+
+        if getattr(self, "celebration_confetti", True):
+            try:
+                self._draw_celebration_confetti(
+                    draw,
+                    celebration,
+                    display_width,
+                    display_height,
+                    palette,
+                    elapsed,
+                    progress,
+                )
+            except Exception as e:  # noqa: BLE001
+                self.logger.debug(f"Celebration confetti skipped: {e}")
+
+        # Headline across the top, shrunk to fit the panel width, struck
+        # white on the opening hit and settling into the team's colour.
+        phrase = celebration["phrase"]
+        phrase_font = self._fit_font(
+            draw, phrase, display_width, [self.fonts["time"], self.fonts["status"]]
+        )
+        phrase_width = draw.textlength(phrase, font=phrase_font)
+        # Eased in by colour rather than by position. Sliding it down into
+        # place put the first frame at y=-3 with its top row cut off, and on a
+        # 1 FPS board that clipped frame can be the only one anyone sees.
+        self._draw_text_with_outline(
+            draw,
+            phrase,
+            ((display_width - phrase_width) // 2, 1),
+            phrase_font,
+            fill=mix_color(palette["headline"], (255, 255, 255), impact),
+        )
+
+        # Score centred low, the scoring side's digits breathing in the team's
+        # headline colour so the change reads at a glance.
+        away_text = str(celebration["away_score"])
+        home_text = str(celebration["home_score"])
+        score_font = self.fonts["score"]
+        segments = [
+            (away_text, celebration["scored_side"] == "away"),
+            ("-", False),
+            (home_text, celebration["scored_side"] == "home"),
+        ]
+        total_width = sum(draw.textlength(seg, font=score_font) for seg, _ in segments)
+        breath = 0.72 + 0.28 * (
+            0.5
+            + 0.5 * math.sin(2 * math.pi * elapsed / self._CELEBRATION_BREATH_SECONDS)
+        )
+        highlight = scale_color(palette["headline"], breath)
+        x = (display_width - total_width) // 2
+        # display_height - 14 was sized for the old fixed 8px score. #338
+        # scales the score with the panel (16px at 48 and 64 tall), which put
+        # the bottom of the digits off the panel. Lift it by the measured ink
+        # (+1 for the outline stroke) only when it would clip, so panels where
+        # it always fitted render exactly as before.
+        score_text = "".join(seg for seg, _ in segments)
+        ink_bottom = draw.textbbox((0, 0), score_text, font=score_font)[3]
+        y = min(display_height - 14, display_height - ink_bottom - 2)
+        for seg, is_highlight in segments:
+            color = highlight if is_highlight else (216, 216, 216)
+            self._draw_text_with_outline(draw, seg, (int(x), y), score_font, fill=color)
+            x += draw.textlength(seg, font=score_font)
+
+        main_img = Image.alpha_composite(main_img, overlay).convert("RGB")
+        self.display_manager.image = main_img
+        self.display_manager.update_display()

src/common/sports_fetch.py

@@ -0,0 +1,188 @@
+"""Which requests a scoreboard makes: season fetches, the lookback, live odds.
+
+Four ``SportsCore`` methods are identical (executable AST, docstrings
+stripped) in all nine scoreboards' ``sports.py`` -- afl, baseball,
+basketball, football, hockey, lacrosse, nrl, soccer and ufc -- and were
+copied here from ledmatrix-plugins ``30455671`` (origin/main, 2026-09-29)
+under their existing names:
+
+- ``_background_fetches_espn_ranges`` -- whether the core's background
+  service can fetch an ESPN date range, or the plugin must;
+- ``_fetch_season_directly`` -- fetch and cache a season in chunks ESPN
+  accepts, on the calling thread;
+- ``_needs_previous_day`` (with ``_LOOKBACK_CUTOFF_HOUR``) -- whether the
+  live fetch still has to ask for yesterday;
+- ``_wants_live_odds`` (with ``_LIVE_ODDS_LOOKAHEAD``) -- whether a live
+  game is close enough to the screen to be worth an odds request.
+
+Three other ``SportsCore`` methods are as identical and stay in the plugins,
+for the reasons ``sports_shared`` gives: ``_get_timezone`` binds each
+plugin's own ``resolve_timezone`` shim, and ``_extract_game_details`` /
+``_fetch_data`` are the abstract sport-specific contract. So does
+``SportsUpcoming.__init__``: the mixins in ``src/common`` hold no
+constructor, so the plugins' constructor signature stays theirs.
+
+A new module rather than more methods on ``sports_shared``, for the reason
+``sports_helpers`` gives: a missing module fails at load, where the version
+checks see it; a missing method fails mid-update.
+
+WHAT A HOST MUST PROVIDE
+------------------------
+Derived by walking every ``self.<attr>`` the mixin reads; the host-contract
+test in ``test/test_sports_fetch.py`` fails if a read is added without being
+listed here.
+
+- ``session``, ``headers``, ``cache_manager`` and ``logger`` --
+  ``_fetch_season_directly``.
+- ``_games_lock`` -- ``_wants_live_odds``, which also reads ``live_games``,
+  ``current_game_index`` and ``_rotation_schedule`` with ``getattr``
+  (only ``SportsLive`` has them).
+- ``live_games``, read with ``getattr`` -- ``_needs_previous_day``.
+- ``background_service``, read with ``getattr`` --
+  ``_background_fetches_espn_ranges``.
+
+Add it as a base of the plugin's ``SportsCore``, e.g.
+``class SportsCore(SportsFetchMixin, SportsCoreSharedMixin,
+SportsHelpersMixin, ABC)``. It defines nothing those define; a method or
+constant on the plugin's own class still wins over the mixin's.
+"""
+
+import logging
+import threading
+from datetime import datetime, timedelta
+from typing import Any, ClassVar, Dict, Optional
+
+from src.common.espn_dates import ESPN_MAX_LIMIT, fetch_espn_scoreboard
+
+
+class SportsFetchMixin:
+    """Season fetch, lookback and live-odds decisions. See module docstring."""
+
+    # The host contract, declared for type checking only: these create no
+    # attributes, so the host's own values are what the methods read.
+    session: Any
+    headers: Dict[str, str]
+    cache_manager: Any
+    logger: logging.Logger
+    _games_lock: threading.RLock
+
+    #: How many games past the one on screen keep their odds warm. One is
+    #: enough for the line to be ready when the rotation advances; more just
+    #: re-creates the whole-slate fetch this replaced.
+    _LIVE_ODDS_LOOKAHEAD: ClassVar[int] = 1
+
+    def _wants_live_odds(self, game: Dict) -> bool:
+        """Whether a live game is near enough the front of the rotation to be
+        worth an odds request.
+
+        Odds used to be fetched for *every* live game in the league on every
+        update. The renderer only ever draws ``current_game``, and a full
+        rotation of a big slate takes minutes while ``live_odds_update_interval``
+        is 60s -- so all but one of those requests expired before the game they
+        belonged to came round.
+
+        Measured 2026-09-19 over a full college-football slate: 11,978 odds
+        requests in 13h on one rig, 54% of all its ESPN traffic, across only
+        ~140 distinct games. The eager loop also cost up to 2s of ``update()``
+        per live game, because ``_fetch_odds`` waits on its worker thread.
+
+        Mirrors the narrowing already applied to the upcoming path and to
+        ``_attach_odds_to_rotated_games``: only games about to be on screen are
+        asked about. ``get_odds`` still caches per game, so a game re-entering
+        the window inside its TTL costs a cache lookup, not a request.
+
+        The rotation state read here is the previous cycle's -- the new list is
+        still being built -- which is exactly the question being asked: is this
+        game at or near the position currently on the panel?
+        """
+        # Read defensively: this predicate lives on SportsCore so it sits
+        # beside _fetch_odds, but live_games/_rotation_schedule belong to
+        # SportsLive, which is the only caller.
+        with self._games_lock:
+            games = list(getattr(self, "live_games", ()) or ())
+            index = getattr(self, "current_game_index", 0)
+            schedule = list(getattr(self, "_rotation_schedule", ()) or ())
+        if not games:
+            # Cold start: nothing is on screen yet, so let the games seen on
+            # this first pass through rather than render a blank line for a
+            # whole cycle. Bounded -- the next pass has a rotation to narrow by.
+            return True
+        order = schedule or [g.get("id") for g in games]
+        if not order:
+            return True
+        start = index if 0 <= index < len(order) else 0
+        wanted = {
+            order[(start + offset) % len(order)]
+            for offset in range(self._LIVE_ODDS_LOOKAHEAD + 1)
+        }
+        return game.get("id") in wanted
+
+    #: Hour of the Eastern day past which last night's games are assumed over.
+    #:
+    #: The live fetch asks ESPN for a two-day window so a game that started
+    #: yesterday and is still running is not lost. ESPN rejects date *ranges*,
+    #: so that window is split into one request per day -- doubling every live
+    #: poll. Measured 2026-09-19: 1,858 requests per rig spent on yesterday's
+    #: date, which after breakfast holds nothing but final games.
+    #:
+    #: No sport on these boards runs six hours past midnight, and one that
+    #: somehow did is still covered: a game already being tracked keeps its own
+    #: day in the window regardless of the hour.
+    _LOOKBACK_CUTOFF_HOUR: ClassVar[int] = 6
+
+    def _needs_previous_day(self, now: datetime) -> bool:
+        """Whether the previous Eastern day can still hold a live game."""
+        if now.hour < self._LOOKBACK_CUTOFF_HOUR:
+            return True
+        previous = (now - timedelta(days=1)).strftime("%Y%m%d")
+        for game in (getattr(self, "live_games", None) or []):
+            start: Any = game.get("start_time_utc") if hasattr(game, "get") else None
+            try:
+                if start.astimezone(now.tzinfo).strftime("%Y%m%d") == previous:
+                    return True
+            except (AttributeError, ValueError, OSError, OverflowError):
+                continue
+        return False
+
+    def _background_fetches_espn_ranges(self) -> bool:
+        """Can the core's background service fetch an ESPN date range?
+
+        Cores from before the 2026-09-15 fix send a season range to ESPN as-is,
+        which now answers 400 for every sport. On those cores the managers fetch
+        the season themselves with _fetch_season_directly instead.
+        """
+        service = getattr(self, "background_service", None)
+        return bool(getattr(service, "handles_espn_date_ranges", False))
+
+    def _fetch_season_directly(
+        self,
+        url: str,
+        datestring: str,
+        cache_key: str,
+        label: str,
+        ttl: Optional[int] = None,
+    ) -> Optional[Dict]:
+        """Fetch a season schedule on this thread, in chunks ESPN accepts, and cache it.
+
+        ``label`` names the schedule in log lines, e.g. ``"2026 season"``.
+        """
+        try:
+            data = fetch_espn_scoreboard(
+                self.session,
+                url,
+                params={"dates": datestring, "limit": ESPN_MAX_LIMIT},
+                headers=self.headers,
+                timeout=30,
+                logger=self.logger,
+            )
+        except Exception as e:
+            self.logger.error(f"Failed to fetch {label} schedule: {e}")
+            return None
+        if ttl is None:
+            self.cache_manager.set(cache_key, data)
+        else:
+            self.cache_manager.set(cache_key, data, ttl=ttl)
+        self.logger.info(
+            f"Fetched {label} schedule: {len(data.get('events', []))} events"
+        )
+        return data

test/test_api_v3_on_demand_restart.py

@@ -1,25 +1,27 @@
-"""Regression test: POST /display/on-demand/start restarting a running
-service must not import a name that does not exist.
+"""POST /display/on-demand/start and /stop must not restart a running display.
 
-display.py has `import web_interface.blueprints.api_v3 as _pkg` and reads
-mutable, test-patched attributes back through it (`_pkg.time.time()`,
-`_pkg._get_starlark_plugin()`, ...) rather than binding them by value, per
-the package's own docstring. One spot went further and wrote a genuine
-`import` *statement* against that alias --
+The start route used to treat ``start_service`` (default True, and what both
+the web UI and the MQTT bridge send) as "restart": with the service running it
+ran ``systemctl stop``, slept 1.5s and started it again. Every on-demand or
+"Preview on display" click therefore cold-restarted the display process --
+every plugin reloaded, the panel blank for seconds -- to deliver a request the
+running process polls for every ON_DEMAND_POLL_INTERVAL anyway (see
+test_on_demand_mailbox.py and test_display_pending_changes.py for the display
+side: the mailbox is read mid-dwell, mid-screen and mid-Vegas-iteration).
 
-    import _pkg.time as time_module
+The restart did not buy anything either: a freshly started display restores
+only the on-demand session it saved itself (``display_on_demand_config``), so
+the new request reached it through the same mailbox, one cold start later.
 
--- but `_pkg` is a local name bound by `import ... as _pkg` in this module,
-not a real top-level package, so `import _pkg.time` is not something Python
-can resolve; it raises ModuleNotFoundError. That line only runs when the
-display service is already running and the caller also asked to (re)start
-it, so this endpoint failed on exactly the restart path -- the one where a
-cache write recording the new on-demand request had already happened.
+This file previously pinned that restart path (it guarded a broken
+``import _pkg.time`` inside it). The path is gone; these tests pin its
+replacement: a running service is left alone, a stopped one is started (only
+when start_service is set), and the request lands in the mailbox either way.
 
-The route wraps its body in `except Exception`, so the failure reached the
-caller as a handled 500 with a generic message, not an unhandled crash --
-but a 500 all the same on a request that should have restarted the service
-and reported success.
+The service helpers are patched where they run. display.py binds
+_get_display_service_status by value, while _ensure_display_service_running
+(in the package __init__) looks it up in its own module, so both are patched;
+_run_systemctl_command is the one place a systemctl command is issued.
 """
 
 import sys
@@ -32,60 +34,137 @@ sys.path.insert(0, str(Path(__file__).parent.parent))
 
 from test._api_v3_test_helpers import api_v3_client, api_v3_module  # noqa: F401,E402
 
-URL = "/api/v3/display/on-demand/start"
+START_URL = "/api/v3/display/on-demand/start"
+STOP_URL = "/api/v3/display/on-demand/stop"
+MAILBOX = "display_on_demand_request"
 
 
 @pytest.fixture
-def restart_path(api_v3_module):
-    """Force the `service_was_running and start_service` branch.
+def service(api_v3_module):
+    """A display service whose state the test sets; records systemctl calls.
 
-    plugin_manager and config_manager are set to None so the route takes
-    the simplest path to that branch rather than tripping over unrelated
-    MagicMock plumbing. The cache is the blueprint's cache_manager, which
-    api_v3_module already set to a MagicMock. _get_display_service_status,
-    _stop_display_service and _ensure_display_service_running are bound by
-    value in display.py (see its own docstring), so they are patched on
-    that submodule rather than on the package.
+    plugin_manager and config_manager are None so the route skips plugin
+    resolution (not what is under test here). The cache is the blueprint's
+    MagicMock cache_manager, so mailbox writes are visible as set() calls.
     """
     api_v3_module.api_v3.plugin_manager = None
     api_v3_module.api_v3.config_manager = None
+    state = {"active": True}
 
-    with patch("web_interface.blueprints.api_v3.display._get_display_service_status") as get_status, \
-         patch("web_interface.blueprints.api_v3.display._stop_display_service") as stop_service, \
-         patch("web_interface.blueprints.api_v3.display._ensure_display_service_running") as ensure_running:
-        # Active before the request: service_was_running becomes True.
-        get_status.return_value = {"active": True}
-        ensure_running.return_value = {"active": True}
+    def status():
+        return {"active": state["active"]}
+
+    def systemctl(args):
+        if args[-2:] == ["start", "ledmatrix.service"]:
+            state["active"] = True
+        elif args[-2:] == ["stop", "ledmatrix.service"]:
+            state["active"] = False
+        return {"returncode": 0, "stdout": "", "stderr": ""}
+
+    with patch("web_interface.blueprints.api_v3._get_display_service_status",
+               side_effect=status), \
+         patch("web_interface.blueprints.api_v3.display._get_display_service_status",
+               side_effect=status), \
+         patch("web_interface.blueprints.api_v3._run_systemctl_command",
+               side_effect=systemctl) as run_systemctl, \
+         patch("web_interface.blueprints.api_v3.display._stop_display_service") as stop_service:
         yield {
-            "get_status": get_status,
+            "state": state,
+            "systemctl": run_systemctl,
             "stop_service": stop_service,
-            "ensure_running": ensure_running,
+            "cache": api_v3_module.api_v3.cache_manager,
         }
 
 
-class TestRestartingARunningService:
-    def test_it_does_not_500(self, api_v3_client, restart_path):
-        response = api_v3_client.post(
-            URL, json={"plugin_id": "weather", "start_service": True})
-        body = response.get_json()
-        assert response.status_code == 200, body
-        assert body["status"] == "success", body
+def _mailbox_writes(cache):
+    return [c.args[1] for c in cache.set.call_args_list if c.args and c.args[0] == MAILBOX]
 
-    def test_the_service_is_actually_stopped_and_restarted(
-            self, api_v3_client, restart_path):
-        api_v3_client.post(
-            URL, json={"plugin_id": "weather", "start_service": True})
-        restart_path["stop_service"].assert_called_once()
-        restart_path["ensure_running"].assert_called_once()
 
-    def test_a_service_that_was_not_running_is_not_stopped_first(
-            self, api_v3_client, restart_path):
-        # The buggy import sits inside `if service_was_running and
-        # start_service`, so it only ever fired on the restart path --
-        # this is the other side of that branch, unaffected either way,
-        # kept here so the branch condition itself stays covered.
-        restart_path["get_status"].return_value = {"active": False}
-        response = api_v3_client.post(
-            URL, json={"plugin_id": "weather", "start_service": True})
+def _systemctl_verbs(run_systemctl):
+    return [c.args[0][-2] for c in run_systemctl.call_args_list]
+
+
+class TestStartWhileTheServiceIsRunning:
+    @pytest.mark.parametrize("body", [
+        {"plugin_id": "weather"},                           # "Preview on display", MQTT
+        {"plugin_id": "weather", "start_service": True},    # on-demand modal, box ticked
+        {"plugin_id": "weather", "start_service": "true"},
+    ])
+    def test_the_service_is_not_stopped_or_restarted(self, api_v3_client, service, body):
+        response = api_v3_client.post(START_URL, json=body)
         assert response.status_code == 200, response.get_json()
-        restart_path["stop_service"].assert_not_called()
+        assert response.get_json()["status"] == "success"
+        service["stop_service"].assert_not_called()
+        assert _systemctl_verbs(service["systemctl"]) == [], (
+            "a running display service was sent a systemctl command")
+
+    def test_the_request_is_posted_for_the_running_display(self, api_v3_client, service):
+        response = api_v3_client.post(
+            START_URL, json={"plugin_id": "weather", "mode": "weather_current",
+                             "duration": 60, "pinned": True})
+        data = response.get_json()["data"]
+        writes = _mailbox_writes(service["cache"])
+        assert len(writes) == 1
+        assert writes[0]["action"] == "start"
+        assert writes[0]["request_id"] == data["request_id"]
+        assert writes[0]["plugin_id"] == "weather"
+        assert writes[0]["mode"] == "weather_current"
+        assert writes[0]["duration"] == 60
+        assert writes[0]["pinned"] is True
+
+    def test_the_response_reports_the_service_was_not_started(self, api_v3_client, service):
+        data = api_v3_client.post(START_URL, json={"plugin_id": "weather"}).get_json()["data"]
+        assert data["service"]["active"] is True
+        assert data["service"]["started"] is False
+
+    def test_it_answers_without_the_old_restart_pause(self, api_v3_client, service):
+        # The restart slept 1.5s; nothing here should sleep at all.
+        with patch("time.sleep") as sleep:
+            api_v3_client.post(START_URL, json={"plugin_id": "weather"})
+        sleep.assert_not_called()
+
+
+class TestStartWhileTheServiceIsStopped:
+    def test_start_service_starts_it_once_and_never_stops_it(self, api_v3_client, service):
+        service["state"]["active"] = False
+        response = api_v3_client.post(START_URL, json={"plugin_id": "weather"})
+        assert response.status_code == 200, response.get_json()
+        assert _systemctl_verbs(service["systemctl"]) == ["start"]
+        service["stop_service"].assert_not_called()
+        # Written before the start, so the new process finds it on its first poll.
+        assert len(_mailbox_writes(service["cache"])) == 1
+
+    def test_without_start_service_it_is_left_stopped(self, api_v3_client, service):
+        service["state"]["active"] = False
+        response = api_v3_client.post(
+            START_URL, json={"plugin_id": "weather", "start_service": "false"})
+        assert response.status_code == 400
+        assert _systemctl_verbs(service["systemctl"]) == []
+
+    def test_a_start_that_fails_is_reported(self, api_v3_client, service):
+        service["state"]["active"] = False
+        service["systemctl"].side_effect = lambda args: {
+            "returncode": 1, "stdout": "", "stderr": "denied"}
+        response = api_v3_client.post(START_URL, json={"plugin_id": "weather"})
+        assert response.status_code == 500
+        assert response.get_json()["status"] == "error"
+
+
+class TestStop:
+    def test_stop_posts_a_stop_request_and_leaves_the_service_running(
+            self, api_v3_client, service):
+        response = api_v3_client.post(STOP_URL, json={})
+        assert response.status_code == 200, response.get_json()
+        writes = _mailbox_writes(service["cache"])
+        assert [w["action"] for w in writes] == ["stop"]
+        service["stop_service"].assert_not_called()
+        assert _systemctl_verbs(service["systemctl"]) == []
+
+    def test_a_string_false_stop_service_does_not_stop_it(self, api_v3_client, service):
+        # bool("false") is True: the flag was read raw and stopped the service.
+        api_v3_client.post(STOP_URL, json={"stop_service": "false"})
+        service["stop_service"].assert_not_called()
+
+    def test_stop_service_true_still_stops_it(self, api_v3_client, service):
+        api_v3_client.post(STOP_URL, json={"stop_service": True})
+        service["stop_service"].assert_called_once()

test/test_favorite_team_check.py

@@ -439,3 +439,101 @@ class ScheduleNoteMatchdayTests(unittest.TestCase):
         # without games, so a future entry there is not a next fixture.
         note = self.note(self.payload([-9], [11], whitelist=False))
         self.assertIn("season has finished", note)
+
+
+class ScheduleNoteListCalendarTests(unittest.TestCase):
+    """A round still to start in a "list" calendar is not a finished season.
+
+    Shapes captured from ESPN on 2026-09-29, with dates kept relative to that
+    day. The Europa League scoreboard still showed the 17 September matchday
+    and its calendar is a ``"list"`` of rounds, not match days, so the check
+    said the season had finished -- with the knockout rounds, and the next
+    league-phase matchday, still to come. PLL, the World Cup and AFL really had
+    finished and must still say so, although each has a season or round
+    ``endDate`` in the future.
+    """
+
+    note = ScheduleNoteTests.note
+
+    @staticmethod
+    def iso(days):
+        return (datetime.now(timezone.utc) + timedelta(days=days)).strftime(
+            "%Y-%m-%dT%H:%MZ")
+
+    @classmethod
+    def list_league(cls, event_days, rounds, league_type=14540,
+                    event_type=14540, phase_label="UEFA Europa League",
+                    extra_phases=()):
+        """``rounds`` is ``[(label, start_day, end_day), ...]`` for one phase."""
+        return {
+            "events": [{"date": cls.iso(d), "season": {"type": event_type}}
+                       for d in event_days],
+            "leagues": [{
+                "season": {"type": {"type": league_type}},
+                "calendarType": "list",
+                "calendarIsWhitelist": True,
+                "calendar": [{
+                    "label": phase_label,
+                    "startDate": cls.iso(-90), "endDate": cls.iso(275),
+                    "entries": [{"label": label, "startDate": cls.iso(start),
+                                 "endDate": cls.iso(end)}
+                                for label, start, end in rounds],
+                }] + list(extra_phases),
+            }],
+        }
+
+    def test_europa_between_matchdays_is_not_finished(self):
+        note = self.note(self.list_league([-12], [
+            ("League Phase", -31, 123),
+            ("Knockout Round Playoffs", 123, 151),
+            ("Rd of 16", 151, 172),
+            ("Quarterfinals", 172, 200),
+            ("Semifinals", 200, 221),
+            ("Final", 222, 275),
+        ]))
+        self.assertIsNone(note)
+
+    def test_world_cup_after_the_final_is_still_finished(self):
+        # The competition runs to 31 December, and the last round ended 12
+        # days after the final; no round is still to start.
+        note = self.note(self.list_league([-72], [
+            ("Group", -110, -93),
+            ("Semifinals", -77, -72),
+            ("Final", -72, -59),
+        ], league_type=13803, event_type=13803, phase_label="FIFA World Cup"))
+        self.assertIn("season has finished", note)
+
+    def test_afl_after_the_grand_final_is_still_finished(self):
+        # The Grand Final round had started but had not ended yet.
+        note = self.note(self.list_league([-3], [
+            ("Preliminary Finals", -13, -6),
+            ("Grand Final", -6, 1),
+        ], league_type=3, event_type=3, phase_label="Postseason"))
+        self.assertIn("season has finished", note)
+
+    def test_an_offseason_round_does_not_count(self):
+        # College football's "Off Season" phase holds the All-Star week.
+        offseason = {"label": "Off Season", "startDate": self.iso(2),
+                     "endDate": self.iso(6),
+                     "entries": [{"label": "All-Star", "startDate": self.iso(2),
+                                  "endDate": self.iso(6)}]}
+        note = self.note(self.list_league(
+            [-3], [("CFP", -40, 1)], league_type=3, event_type=3,
+            phase_label="Postseason", extra_phases=[offseason]))
+        self.assertIn("season has finished", note)
+
+    def test_pll_with_a_season_end_date_in_the_future_is_still_finished(self):
+        # A "day" whitelist whose last match day is past; the season's own
+        # endDate (1 January) is ignored.
+        note = self.note({
+            "events": [{"date": self.iso(-9), "season": {"type": 2}}],
+            "leagues": [{
+                "season": {"type": {"type": 2}, "startDate": self.iso(-271),
+                           "endDate": self.iso(94)},
+                "calendarType": "day",
+                "calendarIsWhitelist": True,
+                "calendarEndDate": self.iso(94),
+                "calendar": [self.iso(-30), self.iso(-22), self.iso(-9)],
+            }],
+        })
+        self.assertIn("season has finished", note)

test/test_sports_card_wrappers.py

@@ -0,0 +1,152 @@
+"""src.common.sports_card_wrappers: each delegation, and the host contract.
+
+Every method here forwards to the ``sports_card`` function it names with the
+host's ``config`` and ``logger``. The tests pin what each returns for a
+configured card, so a delegation that passes the wrong thing -- an empty
+config, the other side, a dropped default -- fails here rather than as a
+wrong colour on a panel.
+"""
+
+import ast
+import logging
+from pathlib import Path
+from zoneinfo import ZoneInfo
+
+from PIL import ImageFont
+
+from src.common import sports_card, sports_card_wrappers, sports_game_renderer
+from src.common.sports_card_wrappers import SportsCardWrappersMixin
+from src.common.sports_game_renderer import SportsGameRendererMixin
+
+CONFIG = {
+    "timezone": "America/Chicago",
+    "favorite_teams": ["BOS"],
+    "scroll_card": {"vs_text": "@", "upcoming_center": "date_time",
+                    "date_format": "weekday", "time_format": "24h"},
+    "customization": {
+        "score_text": {"text_color": [9, 9, 9]},
+        "favorite_result_colors": {"enabled": True, "win_color": [0, 200, 0]},
+    },
+}
+
+GAME = {"home_abbr": "BOS", "away_abbr": "NYY", "home_score": "3", "away_score": "1",
+        "start_time_utc": "2026-09-19T23:00:00Z"}
+
+
+class Host(SportsCardWrappersMixin):
+    """The documented contract, and not one attribute more."""
+
+    _FONT_NAME_ALIASES = dict(sports_card.FONT_NAME_ALIASES)
+    _FONT_PIXEL_GRID = dict(sports_card.FONT_PIXEL_GRID)
+
+    def __init__(self, config=CONFIG):
+        self.config = config
+        self.logger = logging.getLogger("test.sports_card_wrappers")
+        self.fonts = {"score": ImageFont.load_default()}
+
+
+class TestDelegations:
+    def test_card_options(self):
+        host = Host()
+        assert host._scroll_card_option("vs_text", "VS") == "@"
+        assert host._scroll_card_option("missing", "fallback") == "fallback"
+        assert host._vs_text() == "@"
+        assert host._upcoming_center_mode() == "date_time"
+
+    def test_dates_and_times(self):
+        host = Host()
+        assert host._card_tzinfo() == ZoneInfo("America/Chicago")
+        assert host._weekday_for(GAME) == "Sat"          # 18:00 in Chicago
+        assert host._format_game_time("7:05 PM") == "19:05"
+        assert host._format_game_date("9/19", GAME) == sports_card.format_game_date(
+            CONFIG, host.logger, "9/19", GAME)
+        assert host._format_game_date("9/19", GAME) != "9/19"
+
+    def test_colours(self):
+        host = Host()
+        assert tuple(host._element_color("score_text")) == (9, 9, 9)
+        assert tuple(host._element_color("missing_element", (1, 2, 3))) == (1, 2, 3)
+        assert tuple(host._font_color(host.fonts["score"])) == (9, 9, 9)
+        assert host._coerce_rgb([300, -1, "7"], (1, 2, 3)) == (255, 0, 7)
+
+    def test_favourites(self):
+        host = Host()
+        assert host._side_is_favorite(GAME, "home", {"BOS"}) is True
+        assert host._side_is_favorite(GAME, "away", {"BOS"}) is False
+        assert host._side_score(GAME, "home") == 3
+        assert host._favorite_result(GAME) == "win"
+        assert host._recent_score_color(GAME, (1, 1, 1)) == (0, 200, 0)
+        assert host._score_color_for(GAME, "recent") == (0, 200, 0)
+        assert tuple(host._score_color_for(GAME, "live")) == (9, 9, 9)
+
+    def test_fonts(self):
+        host = Host()
+        font = host.fonts["score"]
+        unshared = host._unshare_element_fonts({"score": font, "time": font})
+        assert set(unshared) == {"score", "time"}
+
+    def test_crisp_size_uses_the_hosts_own_tables(self):
+        class NoTables(Host):
+            _FONT_NAME_ALIASES = {}
+            _FONT_PIXEL_GRID = {}
+
+        assert Host._crisp_size("PressStart2P-Regular.ttf", 9) == 8   # snapped
+        assert NoTables._crisp_size("PressStart2P-Regular.ttf", 9) == 9  # unknown face
+
+
+class TestComposition:
+    def test_it_supplies_what_the_geometry_mixin_needs(self):
+        # sports_game_renderer's docstring lists these as host-provided.
+        for name in ("_scroll_card_option", "_upcoming_center_mode", "_vs_text",
+                     "_element_color", "_format_game_date", "_format_game_time"):
+            assert f"``{name}``" in sports_game_renderer.__doc__
+            assert name in SportsCardWrappersMixin.__dict__
+
+    def test_the_two_mixins_share_no_names(self):
+        ours = {n for n in SportsCardWrappersMixin.__dict__ if not n.startswith("__")}
+        theirs = {n for n in SportsGameRendererMixin.__dict__ if not n.startswith("__")}
+        assert ours & theirs == set()
+
+    def test_a_renderers_own_method_wins(self):
+        class Renderer(SportsCardWrappersMixin, SportsGameRendererMixin):
+            def _vs_text(self):
+                return "v"
+
+            def __init__(self):
+                self.config, self.logger = CONFIG, logging.getLogger("t")
+
+        assert Renderer()._vs_text() == "v"
+        assert Renderer()._upcoming_center_mode() == "date_time"
+
+
+# ---------------------------------------------------------------------------
+# Host contract
+# ---------------------------------------------------------------------------
+
+def _self_reads():
+    """Every ``self.X`` / ``cls.X`` / ``getattr(self, "X")`` the mixin reads."""
+    tree = ast.parse(Path(sports_card_wrappers.__file__).read_text(encoding="utf-8"))
+    cls = next(n for n in tree.body
+               if isinstance(n, ast.ClassDef) and n.name == "SportsCardWrappersMixin")
+    names = set()
+    for node in ast.walk(cls):
+        if (isinstance(node, ast.Attribute) and isinstance(node.ctx, ast.Load)
+                and isinstance(node.value, ast.Name) and node.value.id in ("self", "cls")):
+            names.add(node.attr)
+        if (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+                and node.func.id == "getattr" and len(node.args) >= 2
+                and isinstance(node.args[0], ast.Name) and node.args[0].id == "self"
+                and isinstance(node.args[1], ast.Constant)):
+            names.add(node.args[1].value)
+    return names
+
+
+class TestHostContract:
+    def test_every_host_read_is_documented(self):
+        needed = _self_reads() - set(dir(SportsCardWrappersMixin))
+        undocumented = sorted(n for n in needed if f"``{n}``" not in sports_card_wrappers.__doc__)
+        assert undocumented == [], f"read but not in the host contract: {undocumented}"
+
+    def test_the_mixin_creates_no_attributes_of_its_own(self):
+        for name in ("config", "logger", "fonts", "_FONT_NAME_ALIASES", "_FONT_PIXEL_GRID"):
+            assert not hasattr(SportsCardWrappersMixin, name)

test/test_sports_celebration.py

@@ -0,0 +1,344 @@
+"""src.common.sports_celebration: the palette, the takeover, and the host contract.
+
+Ported from the scoreboards' own celebration tests (football's
+test_score_celebration.py, hockey's and soccer's test_goal_celebration.py),
+which drive the same code through a plugin's SportsLive. Here the host is a
+stub carrying exactly the documented contract, and the crests are drawn by the
+test, so every input is fixed. Pixel-exact goldens of every plugin's takeover
+live in ledmatrix-plugins (scripts/test_celebration_renders.py).
+"""
+
+import ast
+import logging
+from pathlib import Path
+from unittest import mock
+
+import pytest
+from PIL import Image, ImageChops, ImageDraw, ImageFont
+
+from src.common import sports_celebration
+from src.common.sports_celebration import (
+    SportsCelebrationMixin,
+    cap_luminance,
+    lift_color,
+    logo_palette,
+    mix_color,
+    rgb_luminance,
+    rgb_saturation,
+    scale_color,
+)
+
+FONTS = Path(__file__).resolve().parents[1] / "assets" / "fonts"
+SIZES = [(64, 32), (128, 32), (64, 64), (96, 48),
+         (128, 64), (256, 32), (128, 96), (256, 128)]
+
+
+def crest(body, band, size=64):
+    """A shield in ``body`` with a horizontal band in ``band``."""
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+    s = size / 64
+    draw.polygon([(6 * s, 4 * s), (58 * s, 4 * s), (58 * s, 34 * s),
+                  (32 * s, 60 * s), (6 * s, 34 * s)], fill=body + (255,))
+    draw.rectangle([(6 * s, 22 * s), (58 * s, 32 * s)], fill=band + (255,))
+    return img
+
+
+CRESTS = {
+    "RED": crest((200, 16, 46), (255, 255, 255)),
+    "NAV": crest((12, 35, 64), (255, 184, 28)),
+    "SIL": crest((165, 172, 175), (0, 0, 0)),
+}
+
+
+class _DisplayManager:
+    def __init__(self, width, height):
+        self.width, self.height = width, height
+        self.image = Image.new("RGB", (width, height))
+        self.updates = 0
+
+    def clear(self):
+        self.image = Image.new("RGB", (self.width, self.height))
+
+    def update_display(self):
+        self.updates += 1
+
+
+class Host(SportsCelebrationMixin):
+    """The documented contract, and not one attribute more."""
+
+    def __init__(self, width=128, height=32, **knobs):
+        self.display_manager = _DisplayManager(width, height)
+        self.display_width, self.display_height = width, height
+        press = str(FONTS / "PressStart2P-Regular.ttf")
+        self.fonts = {
+            "time": ImageFont.truetype(press, 8),
+            "status": ImageFont.truetype(str(FONTS / "4x6-font.ttf"), 6),
+            "score": ImageFont.truetype(press, 16 if height >= 48 else 10),
+        }
+        self.logger = logging.getLogger("test.sports_celebration")
+        for name, value in knobs.items():
+            setattr(self, name, value)
+
+    def _load_and_resize_logo(self, team_id, abbr, logo_path, logo_url):
+        logo = CRESTS.get(abbr)
+        if logo is None:
+            return None
+        logo = logo.copy()
+        logo.thumbnail((self.display_height, self.display_height), Image.Resampling.LANCZOS)
+        return logo
+
+    def _draw_text_with_outline(self, draw, text, position, font,
+                                fill=(255, 255, 255), outline_color=(0, 0, 0)):
+        x, y = position
+        for dx, dy in ((-1, 0), (1, 0), (0, -1), (0, 1)):
+            draw.text((x + dx, y + dy), text, font=font, fill=outline_color)
+        draw.text((x, y), text, font=font, fill=fill)
+
+
+def celebration(scorer="RED", other="NAV", side="away", kind="score", motif="score"):
+    away, home = (scorer, other) if side == "away" else (other, scorer)
+    return {
+        "kind": kind, "motif": motif,
+        "game": {"id": "401", "away_abbr": away, "home_abbr": home},
+        "scored_side": side, "team_abbr": scorer,
+        "away_score": 3, "home_score": 2, "started_at": 1000.0,
+        "phrase": f"{scorer} WINS!" if kind == "win" else f"{scorer} SCORES!",
+    }
+
+
+def render(host=None, elapsed=2.0, **kwargs):
+    host = host or Host()
+    with mock.patch("time.time", return_value=1000.0 + elapsed):
+        host._draw_celebration_layout(celebration(**kwargs), force_clear=True)
+    return host.display_manager.image
+
+
+def brightest(img, box=None):
+    region = img.crop(box) if box else img
+    return max(region.convert("RGB").getextrema()[i][1] for i in range(3))
+
+
+# ---------------------------------------------------------------------------
+# Colour helpers
+# ---------------------------------------------------------------------------
+
+class TestColourHelpers:
+    def test_mix_is_clamped_to_the_two_ends(self):
+        assert mix_color((0, 0, 0), (200, 100, 50), 0.5) == (100, 50, 25)
+        assert mix_color((0, 0, 0), (200, 100, 50), 2) == (200, 100, 50)
+        assert mix_color((0, 0, 0), (200, 100, 50), -1) == (0, 0, 0)
+
+    def test_scale_is_clamped_to_the_panel(self):
+        assert scale_color((200, 100, 0), 2) == (255, 200, 0)
+
+    def test_saturation_of_black_is_zero(self):
+        assert rgb_saturation((0, 0, 0)) == 0.0
+
+    def test_lifting_a_colour_keeps_its_hue(self):
+        # Scaling channels turns Baltimore's navy-purple magenta; HSV does not.
+        lifted = lift_color((39, 15, 98))
+        assert rgb_luminance(lifted) >= 100
+        assert lifted[2] > lifted[0] > lifted[1]
+
+    def test_a_colour_that_already_reads_is_left_alone(self):
+        assert lift_color((255, 208, 56)) == (255, 208, 56)
+
+    def test_a_grey_is_just_made_bright(self):
+        lifted = lift_color((40, 40, 40))
+        assert lifted[0] == lifted[1] == lifted[2] and rgb_luminance(lifted) > 200
+
+    def test_capping_keeps_the_hue_and_the_cap(self):
+        capped = cap_luminance((248, 61, 1), 34)
+        assert capped[0] > capped[1] > capped[2]
+        assert rgb_luminance(capped) <= 35
+
+
+class TestLogoPalette:
+    def test_a_saturated_crest_is_its_own_headline(self):
+        palette = logo_palette(CRESTS["RED"])
+        r, g, b = palette["headline"]
+        assert r > 150 and r > 2 * g and r > 2 * b
+        assert rgb_luminance(palette["deep"]) <= 36
+
+    def test_a_legible_band_beats_lifting_a_dark_body(self):
+        palette = logo_palette(CRESTS["NAV"])
+        r, g, b = palette["headline"]
+        assert r > 150 and g > 110 and b < 110, f"{palette['headline']} is not the gold band"
+        assert palette["deep"][2] >= palette["deep"][0], "the backdrop lost the navy"
+
+    def test_a_crest_with_no_colour_falls_back_to_its_brightest_grey(self):
+        palette = logo_palette(CRESTS["SIL"])
+        assert palette is not None
+        assert rgb_saturation(palette["headline"]) < 0.12
+
+    def test_nothing_opaque_is_no_palette(self):
+        assert logo_palette(Image.new("RGBA", (16, 16))) is None
+
+    def test_an_unreadable_crest_is_no_palette(self):
+        assert logo_palette(object()) is None
+
+    def test_every_colour_has_three_channels(self):
+        palette = logo_palette(CRESTS["RED"])
+        assert set(palette) == {"deep", "glow", "headline", "accent"}
+        assert all(len(c) == 3 for c in palette.values())
+
+
+# ---------------------------------------------------------------------------
+# The celebration's palette
+# ---------------------------------------------------------------------------
+
+class TestCelebrationPalette:
+    def test_read_off_the_scoring_side(self):
+        away = Host()._celebration_palette(celebration(side="away"))
+        home = Host()._celebration_palette(celebration(scorer="NAV", other="RED", side="home"))
+        assert away == logo_palette(Host()._load_and_resize_logo(None, "RED", None, None))
+        assert home["headline"] != away["headline"]
+
+    def test_worked_out_once_per_celebration(self):
+        host, c = Host(), celebration()
+        first = host._celebration_palette(c)
+        host._load_and_resize_logo = mock.Mock(side_effect=AssertionError("reloaded"))
+        assert host._celebration_palette(c) is first
+
+    @pytest.mark.parametrize("loader", [lambda *a: None, mock.Mock(side_effect=OSError("bad png"))])
+    def test_no_usable_crest_falls_back(self, loader):
+        host = Host()
+        host._load_and_resize_logo = loader
+        assert host._celebration_palette(celebration()) == Host._DEFAULT_CELEBRATION_PALETTE
+
+    def test_team_colours_off_is_the_default(self):
+        host = Host(celebration_team_colors=False)
+        assert host._celebration_palette(celebration()) == Host._DEFAULT_CELEBRATION_PALETTE
+
+
+# ---------------------------------------------------------------------------
+# The takeover
+# ---------------------------------------------------------------------------
+
+class TestTakeover:
+    def test_frame_is_presented(self):
+        host = Host()
+        render(host)
+        assert host.display_manager.updates == 1
+        assert host.display_manager.image.size == (128, 32)
+
+    def test_same_inputs_same_frame(self):
+        assert render().tobytes() == render().tobytes()
+
+    def test_the_highlight_follows_the_scoring_side(self):
+        away = render(side="away", scorer="RED", other="RED")
+        home = render(side="home", scorer="RED", other="RED")
+        assert ImageChops.difference(away, home).getbbox() is not None
+
+    def test_each_motif_paints_its_own_scenery(self):
+        shots = {m: render(Host(celebration_confetti=False), motif=m).tobytes()
+                 for m in ("score", "kick", "touchdown", "net", "win")}
+        assert len(set(shots.values())) == len(shots)
+
+    def test_an_unknown_motif_draws_the_score_scenery(self):
+        host = Host(celebration_confetti=False)
+        assert render(host, motif="bogus").tobytes() == render(Host(celebration_confetti=False),
+                                                                motif="score").tobytes()
+
+    @pytest.mark.parametrize("knob", ["celebration_team_colors", "celebration_confetti"])
+    def test_switches_change_the_frame(self, knob):
+        assert render(Host(**{knob: False})).tobytes() != render(Host()).tobytes()
+
+    def test_the_matrix_size_wins_over_the_configured_one(self):
+        host = Host(width=64, height=32)
+        host.display_manager.matrix = type("M", (), {"width": 128, "height": 32})()
+        assert render(host).size == (128, 32)
+
+    @pytest.mark.parametrize("width,height", SIZES)
+    def test_every_frame_is_a_finished_card(self, width, height):
+        # A switch-mode board samples once a second: any frame may be the only
+        # one seen, so each carries the headline and nothing is blank.
+        for elapsed in [0.0] + [i + 0.5 for i in range(8)]:
+            img = render(Host(width, height), elapsed=elapsed)
+            assert brightest(img) > 40
+            assert brightest(img, (0, 0, width, max(2, height // 4))) > 60
+
+    def test_the_score_stays_on_a_tall_panel(self):
+        # 16px digits at 48 tall used to run off the bottom row. The goal
+        # line keeps the scenery off that row, so only the score could be.
+        img = render(Host(192, 48, celebration_confetti=False), motif="touchdown")
+        assert brightest(img, (48, 47, 144, 48)) < 10
+        assert brightest(img, (48, 24, 144, 47)) > 10
+
+    def test_the_scoring_side_breathes_rather_than_toggling(self):
+        frames = {render(Host(celebration_confetti=False), elapsed=t).tobytes()
+                  for t in (0.9, 1.9, 2.9, 3.9, 4.9, 5.9)}
+        assert len(frames) > 2
+
+    def test_confetti_is_seeded_from_the_game_not_the_clock(self):
+        host, c = Host(), celebration()
+        palette = host._celebration_palette(c)
+        flakes = host._celebration_confetti(c, 128, 32, palette)
+        again = Host()._celebration_confetti(celebration(), 128, 32, palette)
+        assert flakes == again and 6 <= len(flakes) <= 22
+
+    def test_confetti_is_gone_by_the_end(self):
+        host, c = Host(), celebration()
+        palette = host._celebration_palette(c)
+        overlay = Image.new("RGBA", (128, 32), (0, 0, 0, 0))
+        host._draw_celebration_confetti(ImageDraw.Draw(overlay), c, 128, 32, palette, 8.0, 1.0)
+        assert overlay.getbbox() is None
+
+    def test_the_side_that_did_not_score_is_dimmed(self):
+        crests = Host()._celebration_crests(celebration(scorer="RED", other="RED"), 32)
+        assert brightest(crests["home"]) < brightest(crests["away"])
+
+    def test_a_crest_that_fails_to_load_is_left_out(self):
+        host = Host()
+        host._load_and_resize_logo = mock.Mock(side_effect=OSError("bad png"))
+        assert host._celebration_crests(celebration(), 32) == {"away": None, "home": None}
+        assert brightest(render(host)) > 40
+
+    def test_fit_font_falls_back_to_the_smallest(self):
+        host = Host()
+        draw = ImageDraw.Draw(Image.new("RGB", (8, 8)))
+        fonts = [host.fonts["time"], host.fonts["status"]]
+        assert host._fit_font(draw, "A", 128, fonts) is fonts[0]
+        assert host._fit_font(draw, "A VERY LONG HEADLINE", 8, fonts) is fonts[-1]
+
+
+# ---------------------------------------------------------------------------
+# Host contract
+# ---------------------------------------------------------------------------
+
+def _self_reads():
+    """Every ``self.X`` / ``getattr(self, "X")`` the mixin reads, by parsing it."""
+    tree = ast.parse(Path(sports_celebration.__file__).read_text(encoding="utf-8"))
+    cls = next(n for n in tree.body
+               if isinstance(n, ast.ClassDef) and n.name == "SportsCelebrationMixin")
+    names = set()
+    for node in ast.walk(cls):
+        if (isinstance(node, ast.Attribute) and isinstance(node.ctx, ast.Load)
+                and isinstance(node.value, ast.Name) and node.value.id == "self"):
+            names.add(node.attr)
+        if (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+                and node.func.id == "getattr" and len(node.args) >= 2
+                and isinstance(node.args[0], ast.Name) and node.args[0].id == "self"
+                and isinstance(node.args[1], ast.Constant)):
+            names.add(node.args[1].value)
+    return names
+
+
+class TestHostContract:
+    def test_every_host_read_is_documented(self):
+        needed = _self_reads() - set(dir(SportsCelebrationMixin))
+        undocumented = sorted(n for n in needed if f"``{n}" not in sports_celebration.__doc__)
+        assert undocumented == [], f"read but not in the host contract: {undocumented}"
+
+    def test_the_stub_host_is_enough(self):
+        # Host above sets the contract and nothing else; it drew every test.
+        needed = _self_reads() - set(dir(SportsCelebrationMixin))
+        host = Host(celebration_duration=8, celebration_team_colors=True,
+                    celebration_confetti=True)
+        assert all(hasattr(host, n) for n in needed)
+
+    def test_the_mixin_creates_no_attributes_of_its_own(self):
+        # The annotations are for type checking; the host's values must win.
+        for name in ("display_manager", "fonts", "logger", "_load_and_resize_logo"):
+            assert not hasattr(SportsCelebrationMixin, name)

test/test_sports_fetch.py

@@ -0,0 +1,193 @@
+"""src.common.sports_fetch: behaviour and host contract.
+
+Ported from the scoreboards' tests of the same methods (football's
+test_live_odds_follow_the_rotation.py, test_lookback_only_when_it_can_matter.py
+and test_espn_date_ranges.py) against a stub host carrying exactly the
+documented contract.
+"""
+
+import ast
+import logging
+import threading
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import pytest
+
+from src.common import espn_dates, sports_fetch
+from src.common.sports_fetch import SportsFetchMixin
+
+ET = timezone(timedelta(hours=-5))
+
+
+class _Response:
+    status_code = 200
+    content = None
+
+    def __init__(self, data):
+        self._data = data
+
+    def json(self):
+        return self._data
+
+    def raise_for_status(self):
+        pass
+
+
+class _Session:
+    def __init__(self, data=None, error=None):
+        self.data, self.error, self.calls = data, error, []
+
+    def get(self, url, params=None, headers=None, timeout=None):
+        self.calls.append((url, dict(params or {}), headers, timeout))
+        if self.error:
+            raise self.error
+        return _Response(self.data)
+
+
+class _Cache:
+    def __init__(self):
+        self.sets = []
+
+    def set(self, key, data, **kwargs):
+        self.sets.append((key, data, kwargs))
+
+
+class Host(SportsFetchMixin):
+    """The documented contract, and not one attribute more."""
+
+    def __init__(self, session=None):
+        self.session = session or _Session(data={"events": []})
+        self.headers = {"User-Agent": "test"}
+        self.cache_manager = _Cache()
+        self.logger = logging.getLogger("test.sports_fetch")
+        self._games_lock = threading.RLock()
+
+
+class TestWantsLiveOdds:
+    def test_cold_start_asks_for_every_game(self):
+        assert Host()._wants_live_odds({"id": "a"}) is True
+
+    def test_only_the_game_on_screen_and_the_next(self):
+        host = Host()
+        host.live_games = [{"id": i} for i in "abcd"]
+        host.current_game_index = 1
+        assert [host._wants_live_odds({"id": i}) for i in "abcd"] == [False, True, True, False]
+
+    def test_the_rotation_schedule_is_followed_and_wraps(self):
+        host = Host()
+        host.live_games = [{"id": i} for i in "abcd"]
+        host._rotation_schedule = ["d", "c", "b", "a"]
+        host.current_game_index = 3
+        assert [host._wants_live_odds({"id": i}) for i in "abcd"] == [True, False, False, True]
+
+    def test_an_index_past_the_end_starts_at_the_front(self):
+        host = Host()
+        host.live_games = [{"id": i} for i in "abc"]
+        host.current_game_index = 9
+        assert [host._wants_live_odds({"id": i}) for i in "abc"] == [True, True, False]
+
+    def test_the_lookahead_is_a_class_setting(self):
+        class Wider(Host):
+            _LIVE_ODDS_LOOKAHEAD = 2
+
+        host = Wider()
+        host.live_games = [{"id": i} for i in "abcd"]
+        host.current_game_index = 0
+        assert [host._wants_live_odds({"id": i}) for i in "abcd"] == [True, True, True, False]
+
+
+class TestNeedsPreviousDay:
+    def test_before_the_cutoff_yesterday_is_kept(self):
+        assert Host()._needs_previous_day(datetime(2026, 1, 15, 5, 59, tzinfo=ET)) is True
+
+    def test_after_it_with_nothing_live_it_is_dropped(self):
+        assert Host()._needs_previous_day(datetime(2026, 1, 15, 6, 0, tzinfo=ET)) is False
+
+    def test_a_live_game_from_yesterday_keeps_it(self):
+        host = Host()
+        host.live_games = [{"start_time_utc": datetime(2026, 1, 15, 3, 0, tzinfo=timezone.utc)}]
+        assert host._needs_previous_day(datetime(2026, 1, 15, 12, 0, tzinfo=ET)) is True
+
+    def test_todays_live_game_does_not(self):
+        host = Host()
+        host.live_games = [{"start_time_utc": datetime(2026, 1, 15, 18, 0, tzinfo=timezone.utc)}]
+        assert host._needs_previous_day(datetime(2026, 1, 15, 12, 0, tzinfo=ET)) is False
+
+    @pytest.mark.parametrize("game", [{}, {"start_time_utc": "2026-01-14"}, "not a game"])
+    def test_unusable_start_times_are_skipped(self, game):
+        host = Host()
+        host.live_games = [game]
+        assert host._needs_previous_day(datetime(2026, 1, 15, 12, 0, tzinfo=ET)) is False
+
+
+class TestBackgroundFetchesEspnRanges:
+    def test_no_service(self):
+        assert Host()._background_fetches_espn_ranges() is False
+
+    @pytest.mark.parametrize("flag,expected", [(True, True), (False, False), (None, False)])
+    def test_follows_the_service(self, flag, expected):
+        host = Host()
+        host.background_service = type("S", (), {"handles_espn_date_ranges": flag})()
+        assert host._background_fetches_espn_ranges() is expected
+
+    def test_an_old_service_without_the_flag(self):
+        host = Host()
+        host.background_service = object()
+        assert host._background_fetches_espn_ranges() is False
+
+
+class TestFetchSeasonDirectly:
+    def test_fetches_caches_and_returns(self):
+        host = Host(_Session(data={"events": [1, 2]}))
+        data = host._fetch_season_directly("http://espn/sb", "20260115", "k", "2026 season")
+        assert data == {"events": [1, 2]}
+        assert host.cache_manager.sets == [("k", data, {})]
+        assert host.session.calls == [
+            ("http://espn/sb", {"dates": "20260115", "limit": espn_dates.ESPN_MAX_LIMIT},
+             {"User-Agent": "test"}, 30)]
+
+    def test_a_ttl_reaches_the_cache(self):
+        host = Host()
+        host._fetch_season_directly("http://espn/sb", "20260115", "k", "x", ttl=60)
+        assert host.cache_manager.sets[0][2] == {"ttl": 60}
+
+    def test_a_failure_returns_none_and_caches_nothing(self, caplog):
+        host = Host(_Session(error=OSError("down")))
+        with caplog.at_level(logging.ERROR):
+            assert host._fetch_season_directly("http://espn/sb", "20260115", "k", "2026 season") is None
+        assert host.cache_manager.sets == []
+        assert "Failed to fetch 2026 season schedule" in caplog.text
+
+
+# ---------------------------------------------------------------------------
+# Host contract
+# ---------------------------------------------------------------------------
+
+def _self_reads():
+    """Every ``self.X`` / ``getattr(self, "X")`` the mixin reads, by parsing it."""
+    tree = ast.parse(Path(sports_fetch.__file__).read_text(encoding="utf-8"))
+    cls = next(n for n in tree.body
+               if isinstance(n, ast.ClassDef) and n.name == "SportsFetchMixin")
+    names = set()
+    for node in ast.walk(cls):
+        if (isinstance(node, ast.Attribute) and isinstance(node.ctx, ast.Load)
+                and isinstance(node.value, ast.Name) and node.value.id == "self"):
+            names.add(node.attr)
+        if (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+                and node.func.id == "getattr" and len(node.args) >= 2
+                and isinstance(node.args[0], ast.Name) and node.args[0].id == "self"
+                and isinstance(node.args[1], ast.Constant)):
+            names.add(node.args[1].value)
+    return names
+
+
+class TestHostContract:
+    def test_every_host_read_is_documented(self):
+        needed = _self_reads() - set(dir(SportsFetchMixin))
+        undocumented = sorted(n for n in needed if f"``{n}``" not in sports_fetch.__doc__)
+        assert undocumented == [], f"read but not in the host contract: {undocumented}"
+
+    def test_the_mixin_creates_no_attributes_of_its_own(self):
+        for name in ("session", "headers", "cache_manager", "logger", "_games_lock"):
+            assert not hasattr(SportsFetchMixin, name)

test/test_sports_stage3_parity.py

@@ -0,0 +1,148 @@
+"""The stage 3 sports modules still match every plugin copy that remains.
+
+``sports_celebration``, ``sports_fetch`` and ``sports_card_wrappers`` were
+copied from the scoreboard plugins, which delete their copies once they floor
+on the release that ships these. Until each has, a copy that changes on its
+own is a fix one side has and the other lacks. Point LEDMATRIX_PLUGINS at a
+ledmatrix-plugins checkout and every body here is compared, as an AST with
+docstrings and type annotations removed and public names folded to the
+plugins' private spelling, against every plugin copy. A copy that is gone
+counts as adopted. Without the variable this skips: core CI has no plugins
+checkout.
+"""
+
+import ast
+import os
+from pathlib import Path
+
+import pytest
+
+from src.common import sports_card_wrappers, sports_celebration, sports_fetch
+
+#: module -> (its mixin, plugin file, plugin class, carriers,
+#: {plugin: names it deliberately overrides}).
+MODULES = {
+    sports_celebration: ("SportsCelebrationMixin", "sports.py", "SportsLive",
+                         ("afl", "football", "hockey", "nrl", "soccer"), {}),
+    sports_fetch: ("SportsFetchMixin", "sports.py", "SportsCore",
+                   ("afl", "baseball", "basketball", "football", "hockey",
+                    "lacrosse", "nrl", "soccer", "ufc"), {}),
+    sports_card_wrappers: ("SportsCardWrappersMixin", "game_renderer.py", "GameRenderer",
+                           ("afl", "baseball", "basketball", "football", "hockey",
+                            "lacrosse", "nrl", "soccer"),
+                           {"football": {"_format_game_date", "_upcoming_center_mode"}}),
+}
+
+#: Type aliases the modules declare for annotations; nothing to compare.
+TYPE_ALIASES = {"Color", "Palette", "Flake", "_Buckets"}
+
+#: Public here, private in the plugins.
+RENAMES = {name: "_" + name for name in (
+    "rgb_luminance", "rgb_saturation", "color_distance", "mix_color",
+    "scale_color", "lift_color", "cap_luminance", "dim_rgba", "logo_palette")}
+
+
+def _plugins_root():
+    raw = os.environ.get("LEDMATRIX_PLUGINS")
+    if not raw:
+        pytest.skip("set LEDMATRIX_PLUGINS to a ledmatrix-plugins checkout to "
+                    "compare these modules against the plugin copies")
+    root = Path(raw)
+    if (root / "plugins").is_dir():
+        root = root / "plugins"
+    if not (root / "football-scoreboard" / "sports.py").is_file():
+        pytest.skip(f"LEDMATRIX_PLUGINS={raw} has no football-scoreboard/sports.py")
+    return root
+
+
+class _Normalise(ast.NodeTransformer):
+    """Drop docstrings and annotations; fold public names to private ones."""
+
+    def visit_Name(self, node):
+        node.id = RENAMES.get(node.id, node.id)
+        return node
+
+    def visit_arg(self, node):
+        node.annotation = None
+        return node
+
+    def visit_AnnAssign(self, node):
+        return self.visit(ast.Assign(targets=[node.target], value=node.value, lineno=0))
+
+    def visit_FunctionDef(self, node):
+        node.name = RENAMES.get(node.name, node.name)
+        node.returns = None
+        body = node.body
+        if (body and isinstance(body[0], ast.Expr)
+                and isinstance(body[0].value, ast.Constant)
+                and isinstance(body[0].value.value, str)):
+            node.body = body[1:] or [ast.Pass()]
+        self.generic_visit(node)
+        return node
+
+
+def _dump(node):
+    node = ast.parse(ast.unparse(node)).body[0]  # detach and copy
+    return ast.dump(_Normalise().visit(node))
+
+
+def _definitions(tree, class_name):
+    """Module-level functions and assignments, plus ``class_name``'s members."""
+    found = {}
+
+    def add(node, owner):
+        if isinstance(node, ast.FunctionDef):
+            found[(owner, node.name)] = node
+        elif isinstance(node, (ast.Assign, ast.AnnAssign)):
+            target = node.targets[0] if isinstance(node, ast.Assign) else node.target
+            if isinstance(target, ast.Name) and node.value is not None:
+                found[(owner, target.id)] = node
+
+    for node in tree.body:
+        add(node, "module")
+        if isinstance(node, ast.ClassDef) and node.name == class_name:
+            for item in node.body:
+                add(item, "class")
+    return found
+
+
+def _promoted(module, mixin):
+    """What the module moved: its functions and ``_PALETTE_*``-style constants,
+    and its mixin's methods and constants (not the host-contract annotations)."""
+    tree = ast.parse(Path(module.__file__).read_text(encoding="utf-8"))
+    ours = {}
+    for (owner, name), node in _definitions(tree, mixin).items():
+        if name in TYPE_ALIASES:
+            continue
+        ours[(owner, RENAMES.get(name, name))] = node
+    return ours
+
+
+CASES = [(module.__name__.rsplit(".", 1)[1], key)
+         for module, (mixin, *_rest) in MODULES.items()
+         for key in sorted(_promoted(module, mixin))]
+
+
+@pytest.mark.parametrize("module_name,key", CASES, ids=lambda v: str(v))
+def test_every_remaining_plugin_copy_matches(module_name, key):
+    root = _plugins_root()
+    module = next(m for m in MODULES if m.__name__.endswith("." + module_name))
+    mixin, filename, class_name, carriers, overrides = MODULES[module]
+    ours = _dump(_promoted(module, mixin)[key])
+    drifted, missing = [], []
+    for sport in carriers:
+        source = (root / f"{sport}-scoreboard" / filename).read_text(encoding="utf-8")
+        theirs = _definitions(ast.parse(source), class_name).get(key)
+        if key[1] in overrides.get(sport, ()):
+            continue
+        if theirs is None:
+            # Gone is fine once the plugin uses the module; otherwise the
+            # finder is not seeing its copy.
+            if module.__name__ not in source:
+                missing.append(sport)
+        elif _dump(theirs) != ours:
+            drifted.append(sport)
+    assert missing == [], f"{key[1]} not found in: {missing}"
+    assert drifted == [], (
+        f"{key[1]} in {module_name} differs from the copy in: {drifted}. "
+        f"Port the change to both, or stop treating it as shared.")

test/test_web_origin_guard.py

@@ -0,0 +1,285 @@
+"""State-changing requests from another website's page are refused.
+
+The interface has no login and was defended only by "it is on the LAN". But
+any site a LAN user opens can make their browser POST to http://<pi>:5000: a
+plain HTML form is a CORS "simple" request, so it arrives and runs even though
+the attacking page never sees the answer. /api/v3/system/action accepted
+form-encoded bodies and reboots, powers off and pulls code.
+
+web_interface/origin_guard.py refuses POST/PUT/PATCH/DELETE whose Origin (or
+Referer) is not this server's own host, and /system/action only takes a
+form-encoded body from HTMX (a cross-site form cannot set HX-Request).
+Requests with neither Origin nor Referer are not from a browser -- curl, Home
+Assistant, the MQTT bridge -- and still pass.
+"""
+
+import subprocess
+from unittest.mock import patch
+
+import pytest
+from flask import Flask, jsonify
+
+from test._api_v3_test_helpers import (  # noqa: F401 - fixture
+    api_v3_module, build_app,
+)
+from web_interface import origin_guard
+
+# Flask's test client addresses requests to Host: localhost.
+SELF = 'http://localhost'
+EVIL = 'http://evil.example'
+
+
+# --- The guard itself, on a throwaway app ---------------------------------
+
+@pytest.fixture
+def probe():
+    app = Flask(__name__)
+    app.config['TESTING'] = True
+    origin_guard.init_app(app)
+
+    @app.route('/change', methods=['GET', 'POST', 'PUT', 'PATCH', 'DELETE'])
+    def change():
+        return jsonify({'status': 'success'})
+
+    return app.test_client()
+
+
+@pytest.mark.parametrize('method', ['post', 'put', 'patch', 'delete'])
+def test_a_cross_site_origin_is_refused_for_every_changing_method(probe, method):
+    resp = getattr(probe, method)('/change', headers={'Origin': EVIL})
+    assert resp.status_code == 403
+    body = resp.get_json()
+    assert body['status'] == 'error'
+    assert body['error_code'] == 'CROSS_SITE_REQUEST'
+    assert body['details'].startswith('Origin ')
+    # The attacker-chosen origin is logged, never echoed back in the body.
+    assert 'evil.example' not in resp.get_data(as_text=True)
+
+
+@pytest.mark.parametrize('origin', [
+    SELF,
+    'http://LOCALHOST',          # host case is not significant
+    'http://localhost:80',       # explicit default port
+    'https://localhost:80',      # TLS proxy passing Host through: scheme ignored
+])
+def test_the_interfaces_own_origin_passes(probe, origin):
+    assert probe.post('/change', headers={'Origin': origin}).status_code == 200
+
+
+def test_the_host_the_browser_used_is_what_counts(probe):
+    # Whatever name or address the user typed -- mDNS name, LAN IP, or the
+    # access-point address the captive portal answers on.
+    for host in ('ledpi.local:5000', '192.168.1.40:5000', '192.168.4.1',
+                 '[fe80::1]:5000'):
+        resp = probe.post('/change', headers={
+            'Host': host, 'Origin': f'http://{host}'})
+        assert resp.status_code == 200, host
+
+
+def test_captive_portal_via_port_80_redirect_passes(probe):
+    # iptables REDIRECT 80 -> 5000 keeps the Host the browser sent, which
+    # carries no port; the page's Origin carries none either.
+    resp = probe.post('/change', headers={
+        'Host': '192.168.4.1', 'Origin': 'http://192.168.4.1'})
+    assert resp.status_code == 200
+
+
+def test_the_same_host_on_another_port_is_another_site(probe):
+    resp = probe.post('/change', headers={
+        'Host': 'ledpi.local:5000', 'Origin': 'http://ledpi.local:8080'})
+    assert resp.status_code == 403
+
+
+def test_an_https_page_behind_a_tls_terminating_proxy_passes(probe):
+    # nginx terminates TLS and forwards a portless Host to the plain-http
+    # upstream: the browser's Origin is https (443), Flask sees http (80).
+    resp = probe.post('/change', headers={
+        'Host': 'pi.example', 'Origin': 'https://pi.example'})
+    assert resp.status_code == 200
+    resp = probe.post('/change', headers={
+        'Host': 'pi.example', 'Referer': 'https://pi.example/v3'})
+    assert resp.status_code == 200
+
+
+def test_a_portless_host_still_refuses_a_nondefault_port(probe):
+    # Only the standard port of either scheme counts as "no port".
+    for origin in ('https://pi.example:8443', 'http://pi.example:5000',
+                   'http://pi.example:443', 'https://evil.example'):
+        resp = probe.post('/change', headers={
+            'Host': 'pi.example', 'Origin': origin})
+        assert resp.status_code == 403, origin
+
+
+def test_an_explicit_host_port_must_match_exactly(probe):
+    # A Host with a port (the proxy forwards $http_host) is compared as is.
+    assert probe.post('/change', headers={
+        'Host': 'pi.example:8443',
+        'Origin': 'https://pi.example:8443'}).status_code == 200
+    assert probe.post('/change', headers={
+        'Host': 'pi.example:8443',
+        'Origin': 'https://pi.example'}).status_code == 403
+
+
+def test_a_refusal_logs_only_the_site_never_the_referer_path(probe, caplog):
+    # A Referer's path and query can carry tokens.
+    with caplog.at_level('WARNING', logger='web_interface.origin_guard'):
+        resp = probe.post('/change', headers={
+            'Referer': EVIL + '/page?token=s3cret#frag'})
+    assert resp.status_code == 403
+    logged = caplog.text
+    assert 'evil.example' in logged
+    assert 's3cret' not in logged
+    assert '/page' not in logged
+
+
+def test_a_refusal_log_cannot_be_forged_with_newlines(probe, caplog):
+    with caplog.at_level('WARNING', logger='web_interface.origin_guard'):
+        probe.post('/change%0D%0AFAKE', headers={'Origin': EVIL})
+    assert len(caplog.records) == 1
+    message = caplog.records[0].getMessage()
+    assert '\n' not in message and '\r' not in message
+    assert 'FAKE' in message  # the path was logged, escaped
+
+
+def test_no_origin_and_no_referer_passes(probe):
+    # curl, Home Assistant, the MQTT bridge: not a browser.
+    assert probe.post('/change').status_code == 200
+    assert probe.post('/change', json={'action': 'x'}).status_code == 200
+
+
+def test_a_null_origin_is_refused(probe):
+    # Sandboxed iframes and file:// pages send "Origin: null".
+    resp = probe.post('/change', headers={'Origin': 'null'})
+    assert resp.status_code == 403
+    assert 'null' in resp.get_json()['details']
+
+
+def test_the_referer_is_checked_when_origin_is_absent(probe):
+    assert probe.post('/change', headers={
+        'Referer': EVIL + '/attack.html'}).status_code == 403
+    assert probe.post('/change', headers={
+        'Referer': SELF + '/v3'}).status_code == 200
+
+
+def test_origin_wins_over_referer(probe):
+    resp = probe.post('/change', headers={
+        'Origin': EVIL, 'Referer': SELF + '/'})
+    assert resp.status_code == 403
+
+
+@pytest.mark.parametrize('value', [
+    'not a url', 'ftp://localhost', 'http://', 'http://localhost:notaport',
+])
+def test_an_unreadable_origin_is_refused(probe, value):
+    assert probe.post('/change', headers={'Origin': value}).status_code == 403
+
+
+def test_gets_are_never_checked(probe):
+    assert probe.get('/change', headers={'Origin': EVIL}).status_code == 200
+    assert probe.get('/change', headers={'Origin': 'null'}).status_code == 200
+
+
+# --- /api/v3/system/action -------------------------------------------------
+
+@pytest.fixture
+def api_client(api_v3_module):  # noqa: F811 - pytest fixture injection
+    app = build_app(api_v3_module.api_v3)
+    origin_guard.init_app(app)
+    return app.test_client()
+
+
+def _ok(args, **kwargs):
+    return subprocess.CompletedProcess(args, 0, stdout='', stderr='')
+
+
+def test_a_cross_site_form_post_never_reaches_the_reboot(api_client):
+    with patch('subprocess.run', side_effect=_ok) as run:
+        resp = api_client.post('/api/v3/system/action',
+                               data={'action': 'reboot_system'},
+                               headers={'Origin': EVIL})
+    assert resp.status_code == 403
+    run.assert_not_called()
+
+
+def test_a_form_post_without_hx_request_is_refused_even_without_origin(api_client):
+    # Belt and braces: a browser whose Origin/Referer never arrived (a
+    # privacy proxy stripping both) still cannot send the form.
+    with patch('subprocess.run', side_effect=_ok) as run:
+        resp = api_client.post('/api/v3/system/action',
+                               data={'action': 'reboot_system'})
+    assert resp.status_code == 415
+    assert 'JSON' in resp.get_json()['message']
+    run.assert_not_called()
+
+
+def test_a_text_plain_body_is_refused(api_client):
+    # enctype="text/plain" is the other cross-site form encoding.
+    with patch('subprocess.run', side_effect=_ok) as run:
+        resp = api_client.post('/api/v3/system/action',
+                               data='{"action": "reboot_system"}',
+                               content_type='text/plain')
+    assert resp.status_code == 415
+    run.assert_not_called()
+
+
+def test_an_htmx_form_post_from_the_interface_runs(api_client):
+    with patch('subprocess.run', side_effect=_ok) as run:
+        resp = api_client.post('/api/v3/system/action',
+                               data={'action': 'stop_display'},
+                               headers={'Origin': SELF, 'HX-Request': 'true'})
+    assert resp.status_code == 200
+    assert resp.get_json()['status'] == 'success'
+    assert run.call_args[0][0] == ['sudo', 'systemctl', 'stop', 'ledmatrix.service']
+
+
+def test_a_same_origin_json_post_runs(api_client):
+    # What every button and fetch() in the interface sends.
+    with patch('subprocess.run', side_effect=_ok):
+        resp = api_client.post('/api/v3/system/action',
+                               json={'action': 'stop_display'},
+                               headers={'Origin': SELF})
+    assert resp.status_code == 200
+    assert resp.get_json()['status'] == 'success'
+
+
+def test_a_json_post_with_no_origin_runs(api_client):
+    # The MQTT bridge, Home Assistant, curl.
+    with patch('subprocess.run', side_effect=_ok):
+        resp = api_client.post('/api/v3/system/action',
+                               json={'action': 'stop_display'})
+    assert resp.status_code == 200
+
+
+def test_an_empty_json_body_still_asks_for_an_action(api_client):
+    resp = api_client.post('/api/v3/system/action', json={})
+    assert resp.status_code == 400
+    assert resp.get_json()['message'] == 'Action required'
+
+
+def test_a_json_body_that_is_not_an_object_asks_for_an_action(api_client):
+    resp = api_client.post('/api/v3/system/action', json=['reboot_system'])
+    assert resp.status_code == 400
+
+
+# --- The real app ----------------------------------------------------------
+
+def test_the_real_app_has_the_guard():
+    import web_interface.app as web_app
+    web_app.app.config['TESTING'] = True
+    with patch('subprocess.run', side_effect=_ok) as run, \
+            web_app.app.test_client() as c:
+        resp = c.post('/api/v3/system/action',
+                      json={'action': 'reboot_system'},
+                      headers={'Origin': EVIL})
+    assert resp.status_code == 403
+    assert resp.get_json()['error_code'] == 'CROSS_SITE_REQUEST'
+    run.assert_not_called()
+
+
+def test_the_real_app_leaves_gets_alone():
+    import web_interface.app as web_app
+    web_app.app.config['TESTING'] = True
+    with web_app.app.test_client() as c:
+        resp = c.get('/api/v3/no-such-endpoint-for-origin-test',
+                     headers={'Origin': EVIL})
+    assert resp.status_code == 404

web_interface/app.py

@@ -55,10 +55,17 @@ app = Flask(__name__)
 app.secret_key = os.urandom(24)
 config_manager = ConfigManager()
 
-# No CSRF protection: the UI is meant for the local network, where anyone who
-# can forge a request can also send it directly, and neither the HTMX forms
-# nor the fetch() calls carry a token. Exposing the UI beyond the LAN needs
-# CSRF tokens added to both first.
+# Cross-site request forgery: the UI has no login, and being "only on the LAN"
+# does not keep other websites out. Any page a LAN user opens can make their
+# browser POST to this server -- a plain HTML form is not blocked by CORS -- so
+# a hostile site could reboot the Pi, pull code or rewrite the config through
+# the user's browser. web_interface/origin_guard.py (registered below) refuses
+# POST/PUT/PATCH/DELETE whose Origin (or, failing that, Referer) is not this
+# server's own host; requests with neither header (curl, Home Assistant, the
+# MQTT bridge) are not from a browser and pass. There are no CSRF tokens:
+# neither the HTMX forms nor the fetch() calls carry one. Anyone who can reach
+# the port directly can still use the API, so exposing the UI beyond a trusted
+# network still needs real authentication.
 
 # Initialize rate limiting (prevent accidental abuse, not security)
 try:
@@ -402,6 +409,11 @@ def success_txt():
 from web_interface import request_logging
 request_logging.init_app(app)
 
+# Refuse state-changing requests sent by another website's page (see the
+# cross-site note near the top of this file).
+from web_interface import origin_guard
+origin_guard.init_app(app)
+
 # Global error handlers
 @app.errorhandler(404)
 def not_found_error(error):

web_interface/blueprints/api_v3/display.py

@@ -192,8 +192,9 @@ def start_on_demand_display():
                 resolved_plugin,
             )
 
-    # Set the on-demand request in cache FIRST (before starting service)
-    # This ensures the request is available when the service starts/restarts
+    # Post the request to the mailbox the display process polls
+    # (DisplayController._poll_on_demand_requests). Written before any
+    # service start, so a freshly started display finds it on its first poll.
     cache = _cache_manager()
     request_id = data.get('request_id') or str(uuid.uuid4())
     request_payload = {
@@ -207,18 +208,7 @@ def start_on_demand_display():
     }
     cache.set('display_on_demand_request', request_payload)
 
-    # Check if display service is running (or will be started)
     service_status = _get_display_service_status()
-    service_was_running = service_status.get('active', False)
-        
-    # Stop the display service first to ensure clean state when we will restart it
-    if service_was_running and start_service:
-        import time as time_module
-        logger.debug("Stopping display service before starting on-demand mode")
-        _stop_display_service()
-        # Wait a brief moment for the service to fully stop
-        time_module.sleep(1.5)
-        logger.debug("Display service stopped, now starting with on-demand request")
 
     if not service_status.get('active') and not start_service:
         return jsonify({
@@ -227,6 +217,18 @@ def start_on_demand_display():
             'service_status': service_status
         }), 400
 
+    # start_service means "start it if it is not running", as the UI's
+    # checkbox says; _ensure_display_service_running leaves a running service
+    # alone. This used to stop a running service, sleep 1.5s and start it
+    # again, so every on-demand or "Preview on display" click -- and every
+    # MQTT on-demand command, which posts here with the default -- cold-
+    # restarted the display process: every plugin reloaded and the panel was
+    # blank for seconds. The restart bought nothing. The running process
+    # reads this mailbox every ON_DEMAND_POLL_INTERVAL (0.25s), from its
+    # dwell sleep, its render loops and Vegas's interrupt check as well as
+    # the main loop, and a restarted one got the request the same way: the
+    # startup path only restores a session the display itself saved
+    # (display_on_demand_config), so it loaded nothing it would not have had.
     service_result = None
     if start_service:
         service_result = _ensure_display_service_running()
@@ -237,9 +239,6 @@ def start_on_demand_display():
                 'message': 'Failed to start display service. Please check service logs or start it manually.',
                 'service_result': service_result
             }), 500
-            
-        # Service was restarted (or started fresh) with on-demand request in cache
-        # The display controller will read the request during initialization or when it polls
 
     response_data = {
         'request_id': request_id,
@@ -254,10 +253,12 @@ def start_on_demand_display():
 def stop_on_demand_display():
     """Request the display controller to stop on-demand mode."""
     data = request.get_json(silent=True) or {}
-    stop_service = data.get('stop_service', False)
+    # _coerce_to_bool: bool("false") is True, which stopped the service.
+    stop_service = _coerce_to_bool(data.get('stop_service', False))
 
-    # Set the stop request in cache FIRST
-    # The display controller will poll this and restart without the on-demand filter
+    # The running display reads the stop from the mailbox within
+    # ON_DEMAND_POLL_INTERVAL and resumes normal rotation in place
+    # (_clear_on_demand); nothing is restarted.
     cache = _cache_manager()
     request_id = data.get('request_id') or str(uuid.uuid4())
     request_payload = {
@@ -266,10 +267,7 @@ def stop_on_demand_display():
         'timestamp': _pkg.time.time()
     }
     cache.set('display_on_demand_request', request_payload)
-        
-    # Note: The display controller's _clear_on_demand() will handle the restart
-    # to restore normal operation with all plugins
-        
+
     service_result = None
     if stop_service:
         service_result = _stop_display_service()

web_interface/blueprints/api_v3/system.py

@@ -383,16 +383,27 @@ def _perform_core_update_locked(stash_local_changes=True):
 def execute_system_action():
     """Execute system actions (start/stop/reboot/etc)"""
     try:
-        # HTMX sends data as form data, not JSON
-        data = request.get_json(silent=True) or {}
-        if not data:
-            # Try to get from form data if JSON fails
+        data = request.get_json(silent=True)
+        if data is None and not request.is_json:
+            # Every caller in the interface sends JSON (the Quick Actions
+            # buttons use HTMX's json-enc). A form-encoded body is what a
+            # cross-site HTML form can send without a CORS preflight, and
+            # this route reboots, powers off and pulls code, so it is only
+            # accepted from HTMX: a cross-site form cannot set HX-Request.
+            # This backs up the app-wide Origin check (origin_guard.py).
+            if not request.headers.get('HX-Request'):
+                return jsonify({
+                    'status': 'error',
+                    'message': ('Send the action as JSON '
+                                '(Content-Type: application/json), '
+                                'e.g. {"action": "restart_display_service"}'),
+                }), 415
             data = {
                 'action': request.form.get('action'),
                 'mode': request.form.get('mode')
             }
 
-        if not data or 'action' not in data:
+        if not isinstance(data, dict) or not data.get('action'):
             return jsonify({'status': 'error', 'message': 'Action required'}), 400
 
         action = data['action']

web_interface/origin_guard.py

@@ -0,0 +1,191 @@
+"""
+Cross-site request guard for the web interface.
+
+The threat: the interface has no login, and "it is only on the LAN" does not
+keep other websites out of it. Any page a person on the LAN opens in their
+browser can make that browser send a request to ``http://<pi>:5000``. A plain
+HTML form POST (``application/x-www-form-urlencoded``, ``multipart/form-data``
+or ``text/plain``) is a "simple" request: CORS does not preflight it and does
+not stop it from arriving, it only hides the response from the page. So a
+hostile or compromised site could reboot the Pi, pull code, install or remove
+plugins or rewrite the config, without the user ever seeing the interface.
+
+The defence here needs no tokens and no frontend change. Browsers attach an
+``Origin`` header to every cross-site POST (and to same-origin ones in all
+current browsers), and it cannot be set or removed by page script. So for any
+state-changing method:
+
+* ``Origin`` present -> it must name this server's own host, else 403.
+  ``Origin: null`` (a sandboxed iframe, a ``file://`` page, some cross-site
+  redirect chains) is never this server, so it is refused too.
+* ``Origin`` absent, ``Referer`` present -> the same check on the Referer.
+* neither -> allowed. That is curl, Home Assistant, the MQTT bridge and every
+  other script: not a browser, so not a confused deputy. A browser making a
+  cross-site request always sends ``Origin``.
+
+"This server's own host" is the ``Host`` header the request arrived with, so
+it follows whatever name or address the user typed: ``ledpi.local:5000``,
+``192.168.1.40:5000``, or ``192.168.4.1`` in access-point mode (the captive
+portal's port 80 -> 5000 redirect keeps the Host the browser sent, and the
+setup page's fetches go back to that same host).
+
+The scheme is deliberately not compared, only host and port. The claimed
+value's default port comes from its own scheme. A ``Host`` without a port
+means "the default port of whatever scheme the browser used", and that scheme
+is not always the one Flask sees: a TLS-terminating reverse proxy makes the
+browser say ``https://pi.example`` (443) while Flask sees ``http`` (80). So a
+portless ``Host`` accepts either default. An attacker cannot use that gap,
+because to match they would need to serve a page from this same host on its
+standard port. The app does not use ``ProxyFix`` and so does not trust
+``X-Forwarded-Host`` or ``X-Forwarded-Proto``: a proxy that rewrites ``Host``
+to the upstream address (nginx's default ``proxy_pass`` does) must be
+configured to pass the original one, port included
+(``proxy_set_header Host $http_host;`` -- nginx's ``$host`` drops the port).
+
+Not covered: DNS rebinding (an attacker's hostname re-pointed at the Pi is
+"same origin" to the browser), and anyone who can reach the port directly.
+Neither is new; the interface is still meant for a trusted network.
+"""
+import logging
+from urllib.parse import urlsplit, urlunsplit
+
+from flask import Flask, jsonify, request
+
+logger = logging.getLogger('web_interface.origin_guard')
+
+#: Methods that change state and so must come from this interface's own pages.
+STATE_CHANGING_METHODS = frozenset({'POST', 'PUT', 'PATCH', 'DELETE'})
+
+_DEFAULT_PORTS = {'http': 80, 'https': 443}
+
+
+def _authority(netloc: str):
+    """``(hostname, port)`` for an authority; port is None when it has none.
+
+    Lower-cases the host and drops a trailing dot, so ``Pi.local.`` and
+    ``pi.local`` compare equal. None if the authority is unreadable.
+    """
+    try:
+        parts = urlsplit(f'//{netloc}')
+        hostname = parts.hostname
+        port = parts.port
+    except ValueError:
+        # A malformed port or bracketed address.
+        return None
+    if not hostname:
+        return None
+    return hostname.lower().rstrip('.'), port
+
+
+def _url_host_port(url: str):
+    """``(hostname, port, default_port)`` for an Origin or Referer, or None.
+
+    ``port`` is the explicit port or, failing that, the URL scheme's default,
+    which is also returned as ``default_port``.
+    """
+    try:
+        parts = urlsplit(url.strip())
+    except ValueError:
+        return None
+    scheme = parts.scheme.lower()
+    if scheme not in _DEFAULT_PORTS or not parts.netloc:
+        return None
+    authority = _authority(parts.netloc.rsplit('@', 1)[-1])
+    if authority is None:
+        return None
+    hostname, port = authority
+    default_port = _DEFAULT_PORTS[scheme]
+    return hostname, default_port if port is None else port, default_port
+
+
+def _names_this_server(claimed) -> bool:
+    """Whether a claimed ``(hostname, port, default_port)`` is this request's
+    own ``Host``."""
+    own = _authority(request.host)
+    if own is None:
+        return False
+    hostname, port = own
+    claimed_host, claimed_port, claimed_default = claimed
+    if claimed_host != hostname:
+        return False
+    if port is not None:
+        return claimed_port == port
+    # A portless Host is the default port of the scheme the browser used.
+    # Behind a TLS-terminating proxy that is https/443 while Flask sees
+    # http/80, so accept the default of either scheme.
+    return claimed_port in (claimed_default,
+                            _DEFAULT_PORTS.get(request.scheme))
+
+
+def _loggable(value: str) -> str:
+    """Just the ``scheme://host[:port]`` of an Origin/Referer, for the log.
+
+    A Referer's path and query can carry tokens or other private data, and
+    only the site matters when reading a refusal.
+    """
+    try:
+        parts = urlsplit(value.strip())
+        netloc = parts.netloc.rsplit('@', 1)[-1]
+    except ValueError:
+        return '<unreadable>'
+    if not parts.scheme or not netloc:
+        return '<unreadable>'
+    return urlunsplit((parts.scheme, netloc, '', '', ''))
+
+
+def check_request_origin():
+    """None when the request may proceed, else the reason it may not.
+
+    The reason is a short phrase for the log and the error message.
+    """
+    if request.method not in STATE_CHANGING_METHODS:
+        return None
+
+    origin = request.headers.get('Origin')
+    if origin is not None:
+        header, value = 'Origin', origin
+    else:
+        referer = request.headers.get('Referer')
+        if referer is None:
+            # Not a browser (curl, Home Assistant, the MQTT bridge, scripts).
+            return None
+        header, value = 'Referer', referer
+
+    if value.strip().lower() == 'null':
+        return f'{header} is "null" (sandboxed or file:// page)'
+
+    claimed = _url_host_port(value)
+    if claimed is None:
+        return f'{header} header is not a valid http(s) URL'
+    if not _names_this_server(claimed):
+        # The claimed value is attacker-chosen: the hook logs it, but the
+        # reason (echoed in the 403 body) never repeats it.
+        return header + ' names a different host than this interface'
+    return None
+
+
+def init_app(app: Flask) -> None:
+    """Refuse state-changing requests that another website's page sent."""
+
+    @app.before_request
+    def _refuse_cross_site_requests():
+        reason = check_request_origin()
+        if reason is None:
+            return None
+        # Only the site each header names, never a Referer's path or query
+        # (which can carry tokens); %r keeps CR/LF from forging log lines.
+        origin = request.headers.get('Origin')
+        referer = request.headers.get('Referer')
+        logger.warning("Refused cross-site %s %r: %s (Origin=%r, Referer=%r)",
+                       request.method, request.path, reason,
+                       None if origin is None else _loggable(origin),
+                       None if referer is None else _loggable(referer))
+        return jsonify({
+            'status': 'error',
+            'error_code': 'CROSS_SITE_REQUEST',
+            'message': ('Refused: this request came from another website, not '
+                        'from the LEDMatrix interface. Open the interface '
+                        'directly (the address in your browser bar must be the '
+                        'same one the request goes to) and try again.'),
+            'details': reason,
+        }), 403