[P2] Medium findings: event-loop blocking, TOML round-trip gaps, NMEA/viewer parser issues, infra polish

[h-shiono]

Tracking issue for the P2 (medium) findings from the 2026-07-15 pre-release audit. Intended for early post-release work.

Backend

• QC analysis blocks the event loop — src/mrtklib_web_ui/api/obs_qc.py:44-51 calls the CPU-heavy synchronous analyze_obs (numpy + cssrlib RINEX decode) directly. A large RINEX freezes all HTTP and WebSocket streaming for seconds–minutes. Move to run_in_executor.
• files.read_file loads the whole file into memory — src/mrtklib_web_ui/api/files.py:203-205. max_lines only trims the response; a multi-GB .pos/log can OOM the process. Stream line-by-line. Related: sync I/O inside async handlers throughout (presets / credentials / ai read_text, open, NamedTemporaryFile).
• mask_credentials coverage gaps — src/mrtklib_web_ui/services/mask_credentials.py:5 only masks user:pass@ URL userinfo. Bearer tokens, ?token= / &password= query params, and API-key-shaped secrets pass through to all WS clients unmasked (note: the full config file is broadcast line-by-line as [CONF]).
• run_mrtk_post can deadlock with log_callback=None — services/mrtk_post_service.py:988-994: pipe draining lives inside if log_callback:; a callback-less caller would fill the pipe buffer and hang on wait() (latent — the endpoint always passes a callback today).
• Minor: hard-coded telnet password admin vs launch with -w "" (mrtk_run_service.py:396,520) / _active_jobs never evicts finished jobs (api/mrtk_post.py:30,134-137) / _download_history is in-memory only, lost on restart / AI reference cache /tmp/mrtklib_ref_cache.txt never invalidated (api/ai.py:240-254) / CORS allow_credentials=True with * methods/headers (main.py:68-73)

TOML round-trip / missing UI controls

• output.maxSolutionStd — exported but never re-imported (missing from the output block in utils/tomlImport.ts), and has no UI control. Export → re-import silently resets it to 0.0.
• kf.measurementError.uraRatio (configToBackend.ts:127) and slipDetection.doppler (L115) — likewise exported but not re-imported (tomlImport.ts:252-270); values reset to defaults.
• ambiguityResolution.systems (v0.7.6 AR systems bitmask) has no UI control — type and (de)serialization are done (mrtkPostConfig.ts:239); the last remaining piece of the v0.7.6 migration. Same for ar.gps_ar.

Frontend (Viewer / performance)

• NMEA: GGA-only logs parse to zero epochs — frontend/src/components/viewer/posParser.ts:149-208: date is only set by RMC, so every GGA before the first RMC is dropped. GGA-only receiver logs (common) render empty Map/2D/Chart views.
• Hard-coded 18 s leap-second offset — posParser.ts:69-75 uses -18 for WEEK/TOW conversion instead of the table in gnssTime.ts; up to ~1 s error for pre-2017 data. Also MapView.tsx:111 labels the (UTC-shifted) times GPST — inconsistent across formats.
• enuUtils.ts:83-98 — mean/median reference has no empty-array guard (NaN propagation; combined with an empty NMEA parse this yields an all-NaN plot).
• ChartView destroys and recreates uPlot on every data change — viewer/ChartView.tsx:168-274; setData() would suffice. Noticeable jank + loss of interaction state on large .pos files.

Infra / dev workflow

• Healthcheck start_period mismatch (Dockerfile 5 s vs compose 10 s) — plain docker run can go unhealthy during a normal cold start
• uv.lock is gitignored, so --frozen never applies in CI (Dockerfile falls back to || uv sync) — non-reproducible builds
• No [tool.ruff] config (lint rules are environment-dependent)
• 30+ (val: any) casts in ProcessingConfigTabs.tsx and config: backendConfig as any at App.tsx:613 — the config→backend boundary loses all compiler protection (latent bugs)