v0.392.0

Added

• Startup warns while secrets are encrypted with the key derived from the
  session secret, and the warning carries a ready-to-paste
  TESSERAE_SECRET_KEY= line. The Docker install page gains a section on
  pinning the key before storing credentials. The HA App gets the note at
  info, since it has no environment block to put the key in.
• The session cookie is pinned to SameSite=Lax and HttpOnly rather
  than inherited from the browser's defaults.
• Calendar, Month gains a Show "Week starts" label option, off by
  default; the weekday headers already say which day leads.
• Companion publishers can choose snapshot retention up to 365 days or explicitly
  retain the latest snapshot until replacement or deletion. The optional
  personal_data_retention capability enables Never; freshness stays independent
  of expiry, and existing clients retain their chosen finite deadlines.
• Home Assistant MQTT discovery now exposes lineups and device
  operations. The hub device gains an Automation switch (pause every
  scheduled push), a Quiet hours switch, a switch per lineup with
  Push now / Next / Previous buttons, and a Notify all displays
  entity. Each display gains a Lineup select, a Hold number, a
  Quiet hours override switch, In quiet hours / Online / Low
  battery binary sensors, a Next change sensor, a Refresh now
  button, an Input event entity for physical buttons and touch
  gestures, a per-display notify entity, a Wake interval number where
  the kind carries one, a firmware update entity once the device
  advertises OTA, and lazy Firmware / Temperature / Humidity /
  Uptime / Next wake sensors.
• Settings → App → Automation: a Pause automation toggle that
  holds rotations, schedules, timed page refreshes, deck pre-renders and
  home returns until resumed. Manual sends and button presses still go
  through. Backs the HA Automation switch.
• The button service notifies listeners after every handled button
  press or touch gesture, and the deck store notifies listeners on every
  change, so integrations can mirror state without polling.

Changed

• The panel-text language pickers (app default, per-device override, dev
  preview) now list every locale the installed widgets ship strings for,
  plus English, instead of a fixed English / French pair. A widget adding
  strings/<tag>.json is selectable as soon as it loads (#279).
• The TRMNL X hardware profile and the tested matrix record the panel as
  confirmed on real hardware with the stock firmware (1872x1404 mono PNG).
• The reTerminal Sticky hardware notes describe the partial refresh that
  firmware 1.30.0 brings (tap echo, device-drawn controls, live value slots
  and frame patches on this panel) and what still falls back to a full paint.

Fixed

• A touch that rotated a lineup's page held the display until the
  rotation's next daily anchor, and that anchor was placed in UTC rather
  than the configured timezone, so an evening tap could pin a panel for
  most of the next day. Touch holds now last one dwell window of the step
  they landed on; button holds keep the anchor rule, placed in the app
  timezone. The timer also logs a skipped display as manual hold and the
  Lineups card shows held instead of the last successful send, so a
  held panel no longer looks frozen.

• GTFS / GTFS-RT reads feeds whose CSV header row is padded with
  spaces (location_type, parent_station, stop_id, …, as Transperth's
  is). The padding used to survive into the column names, so every stop
  lookup missed and the build failed with "isn't in this feed".

• LAB and chroma-aware colour matching now see the diffused error, so a
  flat patch dithers under them the way it always did under rgb instead
  of collapsing to a single ink.

• The Lineups 24h rail thins a dense schedule across the whole day instead
  of drawing only its first 48 fires.

• The rail's now-marker ticks in the configured app timezone rather than
  the browser's, so it no longer jumps by the zone offset a minute after
  the page loads.

• Smart sync no longer starves a lineup on a short wake grid. The
  render-before-wake gate only opened on a tick that landed inside the
  lead window, and the default 10 s lead is narrower than the 30 s tick.
  A trusted panel waking every 5 minutes kept the same tick phase on
  every wake, so a rotation could sit on one page for an hour while its
  card said it was playing. The gate now opens on the last tick before
  the window, and a rotation held by smart sync shows a held pill with
  the reason instead of staying silent.

• Lineups remain visible after their displays are deleted. Lineups whose
  targets are all gone now appear in an Unavailable displays group on the
  Lineups page instead of disappearing, so they can still be edited, rebound
  or deleted. The editors keep the stale display (and a wiped dashboard)
  selected, so saving no longer silently unbinds the lineup or re-points it at
  the first dashboard in the list.

• A touch action no longer repaints a different lineup page over the
  one on glass. The post-action reconcile resolved "the page the
  device is showing" from the lineup's nav record before the live frame,
  and that record lagged behind touch navigation: a page: shortcut
  tapped on a dashboard's nav bar pushed the target page without
  recording it as the device's lineup position. Tapping a control on the
  page then re-rendered the stale position and patched it onto the panel,
  so the panel showed one page while its touch regions still belonged to
  another. The reconcile now starts from the page behind the device's
  live frame, and a page: shortcut onto a lineup page records the
  position.

• A lineup no longer re-promotes a pre-rendered frame that has gone
  stale. When the background warms for a page keep failing, its cached
  frame kept being swapped onto the panel at every advance, so the
  display flipped between dashboards that were all hours old. An
  advance now renders the page live when the cached frame is older than
  twice its warm cadence, and says so in the log.

• Chromium launches with --disable-dev-shm-usage. Docker gives a
  container a 64 MB /dev/shm unless shm_size is set, and Chromium
  under that limit can crash or hang mid-render, which showed as panels
  that stopped repainting with nothing in the log.

• Silent failure paths now log. A failed push (with its render or
  publish error, previously a History row only), a deck warm that
  produces no frame, a lineup advance skipped for min-hold, smart-sync
  or quiet hours, a scheduler tick that overran its interval, and a
  tick that has been stuck for five minutes each write a line, so a
  debug report of a frozen panel carries the reason.