[P1] Known-bug root causes (rover-obs glob, version 0.0.0, stale convert preview, #32 stall) + high-impact fixes

[h-shiono]

Tracking issue for the P1 findings from the 2026-07-15 pre-release audit. Root causes for all three long-standing known bugs are identified.

Known bugs (root cause identified)

1. "Rover observation file not found" although the file exists under /data/

• Fix the glob branch to return the matched concrete path(s) (+ handle compressed-file wildcards in staging)
• Cause: validate_input_path in src/mrtklib_web_ui/api/mrtk_post.py:173-180 confirms glob matches exist but then returns the unexpanded pattern string. create_subprocess_exec performs no shell expansion, so mrtk receives a literal /data/*.obs and reports the file missing. (Plain-path resolution was empirically verified correct.)
• Secondary: a compressed wildcard reaches input_staging.py → shutil.copy2("/data/*.24d", …) → FileNotFoundError. Also, inputs without a recognized root prefix silently fall back under /workspace (paths.py:30), producing spurious "not found" errors.

2. Header shows MRTKLIB version "0.0.0"

• Change /api/mrtklib/version to read .mrtklib-version (or shell out to mrtk --version)
• Cause: src/mrtklib_web_ui/main.py:97-113 returns the web UI's own Python package version (importlib.metadata). Inside the Docker image there are no git tags, so it resolves to 0.0.0.

3. Conversion tab: command preview does not update when Time Range fields change

• Add -tr (rtcmRefTime) / -tt (epochTolerance) to the preview builder
• Cause: the commandPreview memo in frontend/src/components/ConversionPanel.tsx:452-539 never reads form.rtcmRefTime / form.epochTolerance, while handleConvert does send them (L578, L580) — so only the preview is stale.

4. #32 — cssr2rtcm3 Epoch progress line stalls the console

• Make _pump_stream split on \r as well as \n (src/mrtklib_web_ui/services/process_manager.py:319) — port the fix already applied to the post/convert readers
• Same file: the stdout reader task is created fire-and-forget (L153; can be GC'd mid-run), and on natural process exit nothing removes entries from _processes / _log_tasks (leak per relay/CLAS run)

High-impact bugs

5. useWebSocket — zombie reconnect after unmount

• Add an unmount guard (shouldReconnect flag) in frontend/src/hooks/useWebSocket.ts:106-135
• Cleanup's close() fires onclose asynchronously after cleanup ran → 3 s later connect() opens a new socket on an unmounted component and it lives on indefinitely (connection leak + setState on a dead component).
• Also fix the hook's messages array (L96-98): unbounded and unread by both App.tsx call sites, yet every message triggers a full page re-render (cap it and/or make list-tracking opt-in)

6. WebSocket broadcast races

• src/mrtklib_web_ui/api/convert.py:23-32 / api/mrtk_run.py:27-37 — iterating the client set while a disconnect handler mutates it raises RuntimeError: Set changed size during iteration, aborting the rest of the broadcast. Use the copy-under-lock approach from websocket_manager.py:69-70.
• services/mrtk_run_service.py:610,628 — readline() raises on lines >64 KiB; switch to chunked reads.

7. Container hardening

• Add a non-root USER to docker/Dockerfile (adjust /workspace ownership)
• Add data/ (422 MB) and tmp/ to .dockerignore (currently sent to the build context on every build)

8. Reconcile version strings (release chore)

• Unify: README "v0.3.0-alpha" / _version.py (0.1.1a1.dev — no v0.3.0 tag exists) / .env.example (0.1.0-alpha) / frontend/package.json (0.0.0) / CHANGELOG (stuck at 0.1.0, still says "RTKLIB 2.4.3" and "Mantine v7")
• Fix the leftover "MRTKLIB v0.6.5" at README L53
• README's docker pull ...:0.3.0-alpha references a nonexistent tag (publishing is git-tag driven) — push the tag or fix the docs
• Add 0.2.x / 0.3.0-alpha entries to CHANGELOG

9. Minimal CI

• Add PR-triggered lint + build checks (ruff / tsc / eslint / docker build). Current workflows are publish-only; a broken build surfaces only at release-tag time (~120 min multi-arch build)
• Zero tests exist (pytest / pytest-asyncio already configured) — start with regression tests for path validation, TOML generation, and the glob branch

Note

• tasks/todo.md still lists "v0.7.6 UI relocation" and ".mrtklib-version bump" as TODO — both are done and should be checked off.