[debeski]

Follow-up fixes from the review of the 0.8.0b1 stress work. VERSION is now 0.8.0b2; the 0.8.0b1 tag and artifacts are untouched.

Fixes

• Scan deadline grace (worker.py): the parent now kills the scan process at scan_timeout_seconds + SCAN_TIMEOUT_GRACE_SECONDS (15s), not exactly at scan_timeout_seconds. The child's own deadline starts later, after startup, so before this the parent always force-terminated it first. The child never got to close the TWAIN source or report its own error. gui_task_timeout_seconds is unchanged.
• Callback URL parse guard (worker.py): _send_callback skips a URL that urlparse rejects (e.g. http://[) instead of raising after the job is already completed.
• Per-scan transport check (static/scanlink.js): startScan() now checks /health before every scan POST, not only the first. A stale preferred transport (HTTPS gone, HTTP healthy) falls back instead of failing every later scan. An unreachable helper reports helper_unavailable / insecure_origin instead of scan_request_uncertain. The scan POST is still sent only once.

Also in this branch

• The two docs commits from 0.8/stress_fixes that never reached main (0.8.0b1 publication and paired DjangoLux acceptance records), cherry-picked so the tracker and architecture docs don't diverge.

Known issue, not changed here

Callbacks are never delivered, and haven't been since 36249b6 (2026-04-28): _process_job passes the serialized job, which omits callback_url, to _send_callback. The developer guide still promises delivery. Turning it back on changes production behavior, so it needs an owner decision. It's recorded in tracker.md.

Testing

• macOS: python -m unittest discover -s tests -t .: 42 tests OK, 1 Windows-only skip.
• The new tests (child reports its own timeout within the grace; unparseable callback is skipped) fail against the 0.8.0b1 code.
• scanlink.js checked with a local Node harness using mocked fetch: 4/4 scenarios pass (the 0.8.0b1 client fails 2: stale-transport fallback and helper-closed message).
• Not run: Windows CI, tests/windows_install_smoke.ps1, physical TWAIN scanner, real browser policies.

Follow-up

DjangoLux's scan_button.js should get the same per-scan health check if it shares the stale-preferred-transport logic.

🤖 Generated with Claude Code