fix(test): prima parte vuol dire tracciato, non fuori da vendor

Il controllo sui riferimenti esterni scandiva anche i file che git non
conosce. Una copia di comodo di una libreria lasciata in static/js/ --
fabric-debug.js -- sembrava codice nostro e faceva fallire la prova con gli
URL nei propri commenti, ma non sta nel repository e in reparto non ci
arriva mai. Su un checkout pulito la prova passava: falliva solo su chi
aveva quel file, cioe' proprio su chi stava lavorando.

Il filtro ora e' la tracciabilita', non il percorso. Non i pattern di
.gitignore, che non dicono nulla su un file gia' tracciato. Se git non
risponde si scandisce tutto come prima: una prova-guardia che ammutolisce
quando perde l'appoggio e' peggio di una che grida al lupo.

Verificato che morda ancora: un fetch verso un CDN in un file tracciato la
fa fallire.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BBnuACZSCJqXrMYC3LUMU

.dockerignore

@@ -28,14 +28,10 @@ htmlcov/
 # Node
 node_modules/
 
-# Local-only notes (Markdown docs are still copied if a Dockerfile asks)
-PIANO_IMPLEMENTAZIONE.md
+# Local-only notes
+docs/
 *.docx
 
-# Legacy Dockerfiles preserved in tree but not needed in builds
-src/backend/Dockerfile.legacy
-src/frontend/flask_app/Dockerfile.legacy
-
 # Uploads are a runtime volume, never baked in.
 uploads/
 

.env.example

@@ -24,14 +24,35 @@ API_SERVER_URL=http://localhost:8000
 # Each physical tablet/PC deployment must set this unique per-station value.
 # Leave empty only for a single-station all-in-one demo using ST-DEFAULT.
 STATION_CODE=ST-DEFAULT
+# Allow switching station from the URL (?station=CODE) during commissioning, so a
+# single PC can exercise several stations. Leave at 0 in production: on the shop
+# floor the station identity comes from the local install, and measuring against
+# another station's recipes would silently break traceability.
+STATION_SWITCH_ENABLED=0
+
+# --- Vision ---
+# Internal address of the vision worker. Never exposed outside tmflow-net.
+VISION_WORKER_URL=http://vision:8100
+# The pinned VisionSuite commit, stamped into the vision image at build time
+# (Dockerfile.vision ARG). Required: `docker compose build vision` fails
+# immediately without it. Set with:
+#   VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD)
+VISION_ENGINE_VERSION=
 
 # --- File Storage ---
-UPLOAD_DIR=server/uploads
+# Resolved against the project root in src/backend/config.py.
+# Default "uploads" maps to <project_root>/uploads, mounted as a Docker
+# volume in production.
+UPLOAD_DIR=uploads
 MAX_UPLOAD_SIZE_MB=50
 
 # --- Setup Page ---
 SETUP_PASSWORD=  # Password per /api/setup, vuoto = disabilitato
 
+# --- AI (OpenRouter) ---
+OPENROUTER_API_KEY=  # API key per parsing schede tecniche, vuoto = disabilitato
+OPENROUTER_MODEL=anthropic/claude-sonnet-4  # Modello AI da utilizzare
+
 # --- Docker ---
 DB_ROOT_PASSWORD=root_password_change_me
 NGINX_PORT=80

.gitignore

@@ -38,6 +38,10 @@ uploads/images/*
 uploads/pdfs/*
 uploads/logos/*
 uploads/reports/*
+uploads/general/
+# Statistics files emitted when a production is closed: shop-floor evidence, not
+# source. They live on the mounted volume in production.
+uploads/statistics/
 !uploads/images/.gitkeep
 !uploads/pdfs/.gitkeep
 !uploads/logos/.gitkeep
@@ -48,6 +52,8 @@ src/frontend/flask_app/static/css/tailwind.css
 
 # Node
 node_modules/
+src/frontend/flask_app/package.json
+src/frontend/flask_app/package-lock.json
 
 # Flask-Babel compiled
 *.mo
@@ -70,3 +76,7 @@ nul
 
 # Competitor analysis (local only)
 Concorrente/
+docker-compose.override.yml
+
+# Subagent-driven development scratch: ledger, briefs, review packages
+.superpowers/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "vendor/visionsuite"]
+	path = vendor/visionsuite
+	url = ssh://git@git.tielogic.xyz:222/Adriano/visionsuite.git

CLAUDE.md

@@ -123,7 +123,7 @@ uv lock                                     # rigenera uv.lock
 ### i18n (Traduzioni)
 ```bash
 # Estrai stringhe
-cd src/frontend/flask_app && uv run pybabel extract -F babel.cfg -k _ -o translations/messages.pot .
+cd src/frontend/flask_app && uv run pybabel extract -F translations/babel.cfg -k _ -o translations/messages.pot .
 
 # Aggiorna catalogo
 cd src/frontend/flask_app && uv run pybabel update -i translations/messages.pot -d translations

Dockerfile.frontend

@@ -20,8 +20,14 @@ RUN uv sync --frozen --no-dev --extra client
 COPY src/frontend/flask_app/ ./flask_app/
 
 # Build TailwindCSS (one-shot; no watcher in production image).
+#
+# Versione esatta, non `tailwindcss@3`. Con il vincolo aperto ogni ricostruzione
+# dell'immagine poteva prendere una minor diversa e produrre un CSS diverso senza
+# che nessuno l'avesse validato: per un sistema che produce evidenze per audit
+# ISO 9001 / IATF 16949 è lo stesso problema che il punto 12 risolve per le
+# librerie del browser. Aggiornarla è una decisione, non un effetto collaterale.
 WORKDIR /app/flask_app
-RUN npm install tailwindcss@3 && \
+RUN npm install tailwindcss@3.4.19 && \
     npx tailwindcss -i static/css/input.css -o static/css/tailwind.css --minify
 
 # Compile Flask-Babel translation catalogs.

Dockerfile.vision

@@ -0,0 +1,41 @@
+FROM python:3.13-slim
+
+# opencv-python (pulled in transitively by vs-core/vs-task/vs-measure/vs-pm2d)
+# needs libGL and glib at runtime even though it is never imported by name here.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libgl1 libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+COPY vendor/ ./vendor/
+RUN uv sync --extra vision-worker --frozen --no-dev
+
+COPY src/vision/ ./src/vision/
+COPY src/vision_worker/ ./src/vision_worker/
+
+# Ruling R8: the version is stamped at build time, not discovered at runtime.
+# COPY vendor/ above does not bring vendor/visionsuite/.git along - it is a
+# gitlink file pointing at ../../.git/modules/vendor/visionsuite, which lives
+# outside the build context - so `git rev-parse HEAD` cannot work in here.
+# Pass the submodule's commit in from the host, which does have git:
+#   VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD) \
+#     docker compose build vision
+ARG VISION_ENGINE_VERSION
+# I4: a build without the commit must fail now, at build time - not later, at
+# every request including /health, with a container Docker still reports as
+# healthy because no healthcheck existed to say otherwise.
+RUN test -n "$VISION_ENGINE_VERSION" || { \
+        echo "VISION_ENGINE_VERSION is required. Build with:"; \
+        echo '  VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD) docker compose build vision'; \
+        exit 1; \
+    }
+ENV VISION_ENGINE_VERSION=${VISION_ENGINE_VERSION}
+
+EXPOSE 8100
+
+# Two workers, not four: each holds the vision stack in memory.
+CMD ["uv", "run", "uvicorn", "src.vision_worker.main:app", \
+     "--host", "0.0.0.0", "--port", "8100", "--workers", "2"]

README.md

@@ -1,6 +1,10 @@
 # TieMeasureFlow by Tielogic
 
-Sistema di gestione task per misurazioni con calibro manuale. Soluzione tablet-first, multi-ruolo, con statistiche SPC (Statistical Process Control) integrate.
+Sistema di gestione task per misurazioni con calibro manuale. Soluzione tablet-first, multi-ruolo, con statistiche SPC (Statistical Process Control) integrate, identità per-stazione e rate limiting per-tablet.
+
+> **Versione corrente:** V3.0.0 (in sviluppo) — branch `V3.0.0`.
+> Per stato dettagliato e prossimi passi vedi [`docs/architecture/STATO_PROGETTO.md`](docs/architecture/STATO_PROGETTO.md) e [`docs/architecture/ROADMAP.md`](docs/architecture/ROADMAP.md).
+> V3.0.0 lavora sui quindici punti di `TieMeasureFlow_modifiche_2026-07-28.md`: vedi [Novità di V3.0.0](#novità-di-v300).
 
 ---
 
@@ -12,10 +16,39 @@ Caratteristiche principali:
 
 - Recipe versioning condizionale (copy-on-write se esistono misurazioni, update in-place altrimenti)
 - Calcolo pass/fail/warning su quattro limiti di tolleranza (UTL, UWL, LWL, LTL)
+- Tracciamento del tempo di inserimento per ogni misura (`input_duration_ms`): il client misura quanto tempo l'operatore impiega su ciascun subtask, dall'attivazione al salvataggio, utile per analisi di tempo ciclo e produttività
 - SPC: Cp, Cpk, Pp, Ppk, control chart UCL/LCL, istogramma con curva normale — puro stdlib (no numpy)
 - Annotazioni grafiche su disegni tecnici (Fabric.js) con viewer sincronizzato all'esecuzione
+- Identità per-stazione (`STATION_CODE`): ogni tablet vede solo le ricette assegnate alla propria stazione, gestione assegnazioni via GUI admin
 - Interfaccia completamente localizzata IT/EN, dark mode, ottimizzata per tablet touch
-- Autenticazione API Key, rate limiting sliding window, audit log persistente
+- Autenticazione API Key, rate limiting sliding window per-IP reale (X-Forwarded-For-aware), audit log persistente
+- Capacità testata per ~20 tablet contemporanei (gunicorn 5 workers × 4 thread + uvicorn 4 workers async)
+
+---
+
+## Novità di V3.0.0
+
+V3.0.0 lavora sui quindici punti raccolti in `TieMeasureFlow_modifiche_2026-07-28.md`,
+dal sopralluogo del 28/07. Quanto segue è **fatto e in esercizio**.
+
+| # | Punto | Cosa cambia |
+|---|---|---|
+| 1 · 6 | **Produzione con una vita propria** | `production_runs` e `production_events` sul server: avvio, fermo linea, ripresa e fine produzione esistono come stato, non come pulsanti. La fine produzione emette il file di statistica dell'intera produzione |
+| 2 | **Tipo di task dichiarato** | `task_type` (`note`, `measure`, `drawing`, `xf_compare`, `camera_measure`) al posto di «ha subtask, quindi è una misura»: un task di misura senza quote non si comporta più come una nota |
+| 3 | **Ciclo di misura** | L'intervallo della ricetta vive sul server, sopravvive al cambio pagina, conta anche il ritardo (in rosso, oltre lo zero) e riporta l'operatore alla misura. Cicalino via WebAudio |
+| 5 | **Fuori tolleranza vincolante** | Una quota fuori tolleranza blocca l'avanzamento finché il capoturno non autorizza — o finché quella stessa quota non viene rimisurata dentro i limiti. L'autorizzazione resta scritta sulla misura e nel CSV |
+| 7 | **Stazioni** | Ricette per stazione, cambio stazione da URL per il collaudo, reset per riga |
+| 8 | **Tracciabilità obbligatoria** | `requires_lot` / `requires_serial` per ricetta, verificati sul server: nessuna porta d'ingresso li aggira, barcode compreso |
+| 9 | **Blocco inserimento manuale** | `allow_manual_input`: con la ricetta a solo calibro il tastierino non viene disegnato affatto, e il server rifiuta comunque un valore digitato a mano |
+| 10 | **Sequenza per l'operatore** | La ricetta si apre sul primo task, non su un elenco. La lista scende a secondo livello e dice quali task sono rimasti incompiuti (`2/3`). «Fine ciclo misura» è visibile da subito e spento finché mancano quote |
+| 11 | **Descrizioni formattate** | `**grassetto**` e a capo nelle descrizioni dei task, con marcatura e non HTML: la sanificazione è per costruzione |
+| 12 | **Funzionamento senza internet** | Tutte le librerie e i font nell'installazione, versioni congelate e verificate per impronta, Content-Security-Policy a sola origine locale |
+| 14 | **Layout stabile** | Una cornice sola per tutte le viste, allineata alla navbar; spazio della barra di scorrimento sempre riservato; schermata di misura su `100dvh`. Vedi [`docs/architecture/LAYOUT.md`](docs/architecture/LAYOUT.md) |
+| 15 | **Statistica separata** | Si registra sempre, si consulta a parte: nessun percorso dell'operatore porta alla statistica (verificato da test) |
+
+**Aperto**: il punto 4 (numero di tentativi prima del capoturno) attende le risposte
+del cliente su modalità di autorizzazione e numero di tentativi; il punto 13
+(generazione task dalla scheda tecnica con l'AI) è fuori offerta.
 
 ---
 
@@ -26,25 +59,25 @@ Browser/Tablet
       |
 Reverse Proxy (Nginx — sviluppo | Traefik+SSL — produzione)
       |
-Flask Client  :5000  (rendering server-side, Jinja2 + Alpine.js)
-      |  X-API-Key
-FastAPI Server  :8000  (API REST asincrona)
+Flask Frontend  :5000  (rendering server-side, Jinja2 + Alpine.js)
+      |  X-API-Key + X-Forwarded-For
+FastAPI Backend  :8000  (API REST asincrona)
       |
 MySQL 8.0
 ```
 
-Il client Flask non espone mai le credenziali al browser: ogni chiamata al backend avviene server-side con l'header `X-API-Key` estratto dalla sessione Flask.
+Il frontend Flask non espone mai le credenziali al browser: ogni chiamata al backend avviene server-side con l'header `X-API-Key` estratto dalla sessione Flask. L'IP reale del tablet è propagato in `X-Forwarded-For` per il rate limiter.
 
 ---
 
 ## Stack Tecnologico
 
-### Backend (server/)
+### Backend (`src/backend/`)
 
 | Componente | Versione | Ruolo |
 |---|---|---|
 | FastAPI | ultima stabile | Framework API REST asincrono |
-| SQLAlchemy 2.0 | async | ORM con pool connessioni |
+| SQLAlchemy 2.0 | async | ORM con pool connessioni 10+20 |
 | asyncmy | ultima stabile | Driver MySQL asincrono |
 | MySQL | 8.0 | Database relazionale |
 | Alembic | ultima stabile | Migrazioni schema |
@@ -54,35 +87,56 @@ Il client Flask non espone mai le credenziali al browser: ogni chiamata al backe
 | bcrypt | ultima stabile | Hashing password |
 | Pillow | ultima stabile | Thumbnail automatici upload |
 
-### Frontend (client/)
+### Frontend (`src/frontend/flask_app/`)
 
 | Componente | Versione | Ruolo |
 |---|---|---|
 | Flask | 3.x | Framework web server-side |
+| gunicorn | 21+ | WSGI server (5 workers × 4 thread gthread) |
 | Jinja2 | incluso in Flask | Template engine |
-| Alpine.js | 3.x (CDN) | Reattivita leggera lato client |
-| TailwindCSS | 3.x | CSS utility-first |
-| Plotly.js | CDN | Grafici SPC interattivi |
-| Fabric.js | 5.3.1 (CDN) | Editor annotazioni disegni tecnici |
+| Alpine.js | 3.15.12 (locale) | Reattività leggera lato client |
+| TailwindCSS | 3.4.19 (build) | CSS utility-first, compilato nell'immagine |
+| Plotly.js | 2.32.0 (locale) | Grafici SPC interattivi |
+| PDF.js | 3.11.174 (locale) | Visualizzazione disegni PDF, worker incluso |
+| Fabric.js | 5.3.1 (locale) | Editor annotazioni disegni tecnici |
+| Inter + JetBrains Mono | woff2 locali | Font UI e numeri |
 | Flask-Babel | ultima stabile | i18n IT/EN |
 
+**Nessuna libreria arriva dalla rete.** Tutte stanno in
+[`src/frontend/flask_app/static/vendor/`](src/frontend/flask_app/static/vendor/VERSIONS.md)
+con versione nel nome e impronta SHA-256 verificata da un test: l'installazione a
+Tràfilo è su rete di produzione isolata, dove una pagina che aspetta un CDN è una
+pagina bianca. Una Content-Security-Policy a sola origine locale (`app.py`) fa sì che
+un tag verso l'esterno aggiunto in futuro venga rifiutato alla scrivania, non in
+reparto.
+
+### Tooling
+
+| Componente | Ruolo |
+|---|---|
+| **uv** | Package manager Python (no `requirements.txt`) |
+| `pyproject.toml` | Dipendenze monorepo con extra `server`/`client`/`dev` |
+| `uv.lock` | Lockfile per build riproducibili |
+| `.python-version` | Pin Python 3.11 |
+| pytest + pytest-asyncio + httpx + aiosqlite | Test stack |
+
 ---
 
 ## Quick Start con Docker
 
-Docker Compose è il metodo raccomandato. Gestisce database, migrazioni e configurazione Nginx in un solo comando.
+Docker Compose è il metodo raccomandato. Gestisce database, migrazioni, build delle immagini con `uv` e configurazione Nginx in un solo comando.
 
 ```bash
 # 1. Clona il repository
-git clone <repository-url>
+git clone ssh://git@git.tielogic.xyz:222/Adriano/TieMeasureFlow.git
 cd TieMeasureFlow
 
 # 2. Configura le variabili d'ambiente
 cp .env.example .env
-# Modifica .env: credenziali DB, chiavi segrete, SETUP_PASSWORD
+# Modifica .env: credenziali DB, chiavi segrete, SETUP_PASSWORD, STATION_CODE per ogni tablet
 
 # 3. Avvia i servizi (ambiente di sviluppo)
-docker compose -f docker-compose.dev.yml up -d
+docker compose -f docker-compose.dev.yml up -d --build
 
 # 4. Verifica lo stato dei container
 docker compose -f docker-compose.dev.yml ps
@@ -90,6 +144,7 @@ docker compose -f docker-compose.dev.yml ps
 # 5. Setup iniziale (solo al primo avvio)
 # Apri http://localhost/api/setup nel browser
 # Usa SETUP_PASSWORD configurata in .env
+# Lo script seed crea anche la stazione ST-DEFAULT con tutte le ricette assegnate
 ```
 
 L'applicazione sarà disponibile su:
@@ -97,8 +152,9 @@ L'applicazione sarà disponibile su:
 - Frontend: http://localhost
 - API: http://localhost/api
 - Pagina setup: http://localhost/api/setup
+- Admin stazioni: http://localhost/admin/stations (solo `is_admin`)
 
-Per il deployment in produzione (Traefik + SSL) consulta [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md).
+Per il deployment in produzione (Traefik + SSL) consulta [`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md).
 
 ---
 
@@ -108,12 +164,14 @@ Dopo il primo avvio, la pagina `/api/setup` (protetta da `SETUP_PASSWORD`) perme
 
 - **Initialize Database** — crea tutte le tabelle
 - **Create Admin User** — crea l'utente amministratore con credenziali da `.env`
-- **Seed Demo Data** — carica ricette, misurazioni e utenti di esempio
+- **Seed Demo Data** — carica ricette, misurazioni e utenti di esempio + crea stazione `ST-DEFAULT` con tutte le ricette assegnate
 - **Reset Database** — elimina e ricrea tutte le tabelle (attenzione: cancella tutti i dati)
 - **Gestione utenti** — crea, modifica, attiva/disattiva account dalla stessa pagina
 
 Se `SETUP_PASSWORD` è vuota o assente nel `.env`, l'endpoint è disabilitato.
 
+Per gestire stazioni e assegnazioni ricette dopo il setup: `/admin/stations` (richiede login admin).
+
 ---
 
 ## Setup Manuale (Senza Docker)
@@ -121,8 +179,9 @@ Se `SETUP_PASSWORD` è vuota o assente nel `.env`, l'endpoint è disabilitato.
 ### Requisiti
 
 - Python 3.11 o superiore
-- Node.js 18 o superiore
+- Node.js 18 o superiore (per TailwindCSS)
 - MySQL 8.0
+- [uv](https://docs.astral.sh/uv/) installato
 
 ### 1. Database MySQL
 
@@ -139,35 +198,37 @@ SQL
 
 ```bash
 cp .env.example .env
-# Imposta DB_HOST, DB_USER, DB_PASSWORD, DB_NAME, SERVER_SECRET_KEY, CLIENT_SECRET_KEY, SETUP_PASSWORD
+# Imposta DB_HOST, DB_USER, DB_PASSWORD, DB_NAME, SERVER_SECRET_KEY,
+# CLIENT_SECRET_KEY, SETUP_PASSWORD, STATION_CODE
 ```
 
-### 3. Server FastAPI
+### 3. Installa dipendenze (uv)
 
 ```bash
-cd server
-python -m venv venv
-source venv/bin/activate        # Windows: venv\Scripts\activate
-pip install -r requirements.txt
-alembic -c migrations/alembic.ini upgrade head
-uvicorn main:app --reload --host 0.0.0.0 --port 8000
+uv sync --extra server --extra client --extra dev
 ```
 
-### 4. Client Flask
+### 4. Backend FastAPI
 
 ```bash
-cd client
-python -m venv venv
-source venv/bin/activate        # Windows: venv\Scripts\activate
-pip install -r requirements.txt
-pybabel compile -d translations
-flask run --host 0.0.0.0 --port 5000
+uv run alembic -c src/backend/migrations/alembic.ini upgrade head
+uv run uvicorn src.backend.main:app --reload --host 0.0.0.0 --port 8000
 ```
 
-### 5. TailwindCSS (watch per sviluppo)
+### 5. Frontend Flask
 
 ```bash
-cd client
+# Compila i cataloghi i18n una volta
+cd src/frontend/flask_app && uv run --project ../../.. pybabel compile -d translations && cd -
+
+# Avvia (development)
+cd src/frontend/flask_app && uv run --project ../../.. flask run --host 0.0.0.0 --port 5000
+```
+
+### 6. TailwindCSS (watch per sviluppo)
+
+```bash
+cd src/frontend/flask_app
 npx tailwindcss -i static/css/input.css -o static/css/tailwind.css --watch
 ```
 
@@ -185,9 +246,10 @@ I ruoli sono combinabili (array JSON per utente). Il flag `is_admin` è separato
 | Ruolo | Descrizione |
 |---|---|
 | **Maker** | Crea e gestisce ricette di misurazione: caricamento disegni (PDF/immagini), annotazioni Fabric.js, definizione task/subtask, configurazione tolleranze, versioning copy-on-write |
-| **MeasurementTec** | Esegue misurazioni: scansione barcode per selezione ricetta, interfaccia task-driven, input da calibro USB HID o numpad touch, validazione real-time pass/warning/fail |
-| **Metrologist** | Analisi qualità: dashboard SPC (X-bar, R, Cp, Cpk, Pp, Ppk), filtri multi-dimensionali, export report PDF, analisi capability e control chart |
-| **Admin** (flag) | Gestione sistema: CRUD utenti, cambio password, attivazione/disattivazione account |
+| **MeasurementTec** | Esegue misurazioni: scansione barcode per selezione ricetta, interfaccia task-driven, input da calibro USB HID o numpad touch, validazione real-time pass/warning/fail. Vede solo le ricette assegnate alla propria stazione (`STATION_CODE`) |
+| **Supervisor** (capoturno) | Autorizza ciò che l'operatore non può decidere da solo: una quota fuori tolleranza che deve restare, il fermo linea, la fine produzione. L'autorizzazione resta scritta sulla misura (`supervisor_id`, `authorised_at`) e finisce nel file di statistica |
+| **Metrologist** | Analisi qualità: dashboard SPC (X-bar, R, Cp, Cpk, Pp, Ppk), filtri multi-dimensionali, export report PDF, analisi capability e control chart. **L'operatore non raggiunge la statistica da nessun percorso** |
+| **Admin** (flag) | Gestione sistema: CRUD utenti, cambio password, attivazione/disattivazione account, **CRUD stazioni e assegnazioni ricette** |
 
 ---
 
@@ -195,39 +257,61 @@ I ruoli sono combinabili (array JSON per utente). Il flag `is_admin` è separato
 
 ```
 TieMeasureFlow/
-├── server/                      # FastAPI Backend
-│   ├── main.py                  # Entry point, lifespan, middleware, 10 router
+├── pyproject.toml              # Dipendenze monorepo (uv)
+├── uv.lock                     # Lockfile riproducibile
+├── .python-version             # 3.11
+├── Dockerfile                  # Backend (uv + uvicorn)
+├── Dockerfile.frontend         # Frontend (uv + gunicorn + Tailwind + Babel)
+├── docker-compose.dev.yml      # Sviluppo (Nginx, porta 80)
+├── docker-compose.yml          # Produzione (Traefik, SSL)
+├── nginx/                      # Config Nginx (dev)
+├── uploads/                    # Volume Docker file caricati
+├── scripts/                    # Script del progetto (seed ricette di collaudo)
+├── docs/                       # Documentazione (vedi indice docs/README.md)
+└── src/
+    ├── backend/                # FastAPI Backend
+    │   ├── main.py             # Entry point, lifespan, middleware, 11 router
     │   ├── config.py           # Settings (pydantic_settings.BaseSettings)
     │   ├── database.py         # SQLAlchemy 2.0 async engine
-│   ├── models/                  # ORM: User, Recipe, RecipeVersion, RecipeTask,
-│   │                            #   RecipeSubtask, Measurement, AccessLog,
-│   │                            #   SystemSetting, RecipeVersionAudit
-│   ├── schemas/                 # Pydantic v2 per validazione I/O API
-│   ├── routers/                 # auth, users, recipes, tasks, measurements,
-│   │                            #   files, settings, statistics, reports, setup
+    │   ├── api/
+    │   │   ├── routers/        # auth, users, recipes, tasks, measurements,
+    │   │   │                   #   files, settings, statistics, reports,
+    │   │   │                   #   setup, stations
+    │   │   └── middleware/     # api_key, rate_limit, security_headers, logging
+    │   ├── models/
+    │   │   ├── orm/            # SQLAlchemy: User, Recipe, RecipeVersion,
+    │   │   │                   #   RecipeTask, RecipeSubtask, Measurement,
+    │   │   │                   #   AccessLog, SystemSetting,
+    │   │   │                   #   RecipeVersionAudit, Station,
+    │   │   │                   #   StationRecipeAssignment,
+    │   │   │                   #   ProductionRun, ProductionEvent
+    │   │   └── api/            # Pydantic v2 schemas request/response
     │   ├── services/           # recipe_service, measurement_service,
-│   │                            #   spc_service, report_service, auth_service
-│   ├── middleware/              # api_key, rate_limit, security_headers, logging
+    │   │                       #   spc_service, report_service,
+    │   │                       #   auth_service, station_service,
+    │   │                       #   production_service,
+    │   │                       #   production_export_service
     │   ├── migrations/         # Alembic (alembic.ini + env.py)
-│   └── templates/               # Template HTML pagina setup
-├── client/                      # Flask Frontend
-│   ├── app.py                   # Factory pattern, CSRF, Babel
-│   ├── blueprints/              # auth, maker, measure, statistics, admin
-│   ├── services/                # APIClient singleton (proxy verso FastAPI)
-│   ├── templates/               # Jinja2 + Alpine.js
-│   ├── static/
-│   │   ├── css/                 # TailwindCSS compilato
-│   │   └── js/                  # numpad, caliper, barcode, csv-export,
-│   │                            #   spc-charts, annotation-editor/viewer
-│   └── translations/            # Flask-Babel .po/.mo IT/EN
-├── nginx/                       # Configurazione Nginx (dev)
-├── docs/                        # Documentazione tecnica
-│   ├── API.md                   # Riferimento API REST
-│   ├── DEPLOYMENT.md            # Guida deployment VPS (Traefik, SSL, DNS)
-│   └── USER_GUIDE.md            # Manuale utente per ruolo
-├── docker-compose.yml           # Produzione (Traefik, SSL)
-├── docker-compose.dev.yml       # Sviluppo (Nginx, porta 80)
-└── .env.example                 # Template variabili d'ambiente
+    │   ├── templates/          # Pagina setup (Jinja2)
+    │   └── tests/              # pytest + httpx + aiosqlite
+    └── frontend/
+        └── flask_app/          # Flask Frontend
+            ├── app.py          # Factory + ProxyFix + CSRF + Babel
+            ├── config.py       # STATION_CODE, API_SERVER_URL, ecc.
+            ├── compile_translations.py
+            ├── blueprints/     # auth, maker, measure, statistics, admin
+            ├── services/       # APIClient (proxy verso FastAPI con XFF)
+            ├── templates/      # Jinja2 + Alpine.js
+            ├── static/
+            │   ├── css/        # TailwindCSS compilato + themes.css
+            │   │               #   (cornice pagina, temi, scrollbar)
+            │   ├── js/         # numpad, caliper, barcode, csv-export,
+            │   │               #   spc-charts, annotation-editor/viewer,
+            │   │               #   production-clock, rich-text
+            │   └── vendor/     # Alpine, Plotly, PDF.js (+worker), Fabric,
+            │                   #   font woff2 — vedi VERSIONS.md
+            ├── translations/   # Flask-Babel .po/.mo IT/EN
+            └── tests/
 ```
 
 ---
@@ -238,7 +322,7 @@ TieMeasureFlow/
 
 | Comando | Descrizione |
 |---|---|
-| `docker compose -f docker-compose.dev.yml up -d` | Avvia servizi in sviluppo |
+| `docker compose -f docker-compose.dev.yml up -d --build` | Avvia servizi in sviluppo (build incluso) |
 | `docker compose -f docker-compose.dev.yml down` | Ferma e rimuove i container |
 | `docker compose logs -f server` | Segui log server in tempo reale |
 | `docker compose logs -f client` | Segui log client in tempo reale |
@@ -248,47 +332,153 @@ TieMeasureFlow/
 
 ### Alembic (migrations)
 
-Nota: `alembic.ini` si trova dentro `server/migrations/`, è richiesto il flag `-c`.
+`alembic.ini` si trova in `src/backend/migrations/`, è richiesto il flag `-c`. `env.py` aggiunge la project root a `sys.path` per risolvere `src.backend.*`.
 
 ```bash
-cd server
-alembic -c migrations/alembic.ini upgrade head                              # Applica migrazioni
-alembic -c migrations/alembic.ini revision --autogenerate -m "descrizione"  # Genera migrazione
-alembic -c migrations/alembic.ini downgrade -1                              # Rollback ultima
+uv run alembic -c src/backend/migrations/alembic.ini upgrade head                              # Applica migrazioni
+uv run alembic -c src/backend/migrations/alembic.ini revision --autogenerate -m "descrizione"  # Genera
+uv run alembic -c src/backend/migrations/alembic.ini downgrade -1                              # Rollback ultima
 ```
 
 Via Docker:
 
 ```bash
-docker compose exec server alembic -c migrations/alembic.ini upgrade head
+docker compose exec server uv run alembic -c src/backend/migrations/alembic.ini upgrade head
 ```
 
 ### i18n (Traduzioni)
 
 ```bash
-cd client
-pybabel extract -F babel.cfg -k _ -o translations/messages.pot .   # Estrai stringhe
-pybabel update -i translations/messages.pot -d translations         # Aggiorna catalogo
-pybabel compile -d translations                                      # Compila .po → .mo
+cd src/frontend/flask_app
+uv run --project ../../.. pybabel extract -F babel.cfg -k _ -o translations/messages.pot .   # Estrai
+uv run --project ../../.. pybabel update -i translations/messages.pot -d translations         # Aggiorna
+uv run --project ../../.. pybabel compile -d translations                                     # Compila .po → .mo
+```
+
+### Gestione dipendenze (uv)
+
+```bash
+uv add <pacchetto>                           # core (entrambi)
+uv add --optional server <pacchetto>         # solo backend
+uv add --optional client <pacchetto>         # solo frontend
+uv add --optional dev <pacchetto>            # solo dev/test
+uv sync --extra server --extra client --extra dev  # reinstalla
+uv lock                                      # rigenera uv.lock
 ```
 
 ---
 
 ## Testing
 
-Il server usa SQLite in-memory tramite `aiosqlite`: i test girano senza MySQL installato.
+Il backend usa SQLite in-memory tramite `aiosqlite`: i test girano senza MySQL installato.
 
 ```bash
-# Server
-cd server && pytest                                         # Tutti i test
-cd server && pytest tests/test_auth.py                     # Singolo modulo
-cd server && pytest tests/test_auth.py::test_login_success # Singolo test
-cd server && pytest --cov                                  # Con copertura
+# Tutti i test (backend + frontend)
+uv run pytest
 
-# Client
-cd client && pytest
+# Solo backend
+uv run pytest src/backend/tests/
+uv run pytest src/backend/tests/test_auth.py
+uv run pytest src/backend/tests/test_auth.py::test_login_success
+uv run pytest --cov src/backend
+
+# Solo frontend
+uv run pytest src/frontend/flask_app/tests/
 ```
 
+Il modulo di visione (`src/vision/`) è un albero a parte, con un vincolo di
+versione diverso dal resto del monorepo: le librerie di VisionSuite da cui
+dipende richiedono Python 3.13 o superiore, mentre backend e frontend restano
+su Python 3.11. Per questo motivo l'esecuzione di `uv run pytest` con
+l'interprete di default mostra i test di `src/vision/tests/` come *skipped*,
+non come falliti: il pacchetto viene rilevato ma la sua esecuzione reale
+richiede un ambiente Python 3.13 dedicato, creato con il proprio extra `uv`.
+Per eseguirli davvero:
+
+```bash
+# Prepara l'ambiente Python 3.13 con le dipendenze di visione
+uv sync --extra vision --extra dev --python 3.13
+
+# Esegue i test del runner di visione in quell'ambiente
+uv run --python 3.13 --extra vision --extra dev pytest src/vision/tests
+```
+
+`src/vision_worker/tests/` eredita lo stesso vincolo su Python 3.13, perché
+il worker dipende da `src.vision.runner`, ma aggiunge dipendenze proprie -
+FastAPI, Uvicorn, Pillow, python-multipart - dichiarate in un extra
+separato, `vision-worker`, tenuto distinto da `vision` apposta: un
+consumatore che incorpora solo il runner (come un futuro agente di stazione,
+che non è un servizio web) non deve trascinarsi dietro un server che non gli
+serve. `vision-worker` include comunque `vision`, quindi un solo extra basta
+per avere un worker funzionante:
+
+```bash
+uv run --python 3.13 --extra vision-worker --extra dev pytest src/vision_worker/tests
+```
+
+Per eseguire entrambe le suite insieme, nominando esplicitamente entrambi
+gli extra:
+
+```bash
+uv run --python 3.13 --extra vision --extra vision-worker --extra dev pytest src/vision/tests src/vision_worker/tests
+```
+
+### Il worker di visione (`Dockerfile.vision`)
+
+Il worker gira in un container separato dal server FastAPI principale, così
+che l'immagine dell'API resti leggera e un aggiornamento di VisionSuite non
+richieda di riavviare il traffico di produzione. Il container non pubblica
+porte verso l'esterno: lo raggiunge solo il server, all'indirizzo interno
+`http://vision:8100` sulla rete `tmflow-net`.
+
+Ogni misura riporta il commit di VisionSuite che l'ha prodotta
+(`engine_version`), perché una stazione che misura con un motore diverso da
+quello atteso deve poter essere identificata. Il container, però, non ha
+accesso al repository Git del progetto principale — `vendor/visionsuite` è un
+submodule, e la copia `.git` che lo collega al repository ospitante non
+viene inclusa nel contesto di build — quindi la versione non può essere
+scoperta al volo dentro l'immagine. Va invece **stampata al momento del
+build**, leggendo il commit dalla macchina che esegue `docker compose build`,
+dove il repository Git è presente per intero:
+
+```bash
+VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD) \
+  docker compose -f docker-compose.dev.yml build vision
+```
+
+La variabile viene passata come build argument (`ARG VISION_ENGINE_VERSION`
+in `Dockerfile.vision`) e fissata nell'immagine come variabile d'ambiente, in
+modo che il worker la trovi già pronta a ogni avvio senza doverla ricalcolare.
+Fuori da un container, in un checkout di sviluppo locale, la stessa funzione
+ricade su `git rev-parse` se la variabile non è impostata — comodo per
+lavorare sul runner senza Docker. Ma se un'immagine viene costruita senza
+passare `VISION_ENGINE_VERSION`, quel ripiego non ha nulla su cui appoggiarsi:
+il `.git` del submodule non arriva nel contesto di build, e il worker
+risponde con un errore esplicito su `/health` invece di indovinare una
+versione o restituire `"unknown"`. La build va quindi sempre lanciata con la
+variabile impostata, sia in sviluppo sia in produzione, con lo stesso comando
+mostrato sopra (sostituendo `docker-compose.dev.yml` con `docker-compose.yml`
+in produzione).
+
+Stato corrente su `V3.0.0`, con `uv run pytest` su Python 3.11 e senza
+l'extra `vision` (un conteggio senza il suo ambiente non dice nulla, regola
+che vale anche qui): **390 pass, 1 fail, 4 skip** — 243 in `src/backend/tests/`,
+147 pass + 2 skip in `src/frontend/flask_app/tests/`, più 2 skip in
+`src/vision/tests/` e `src/vision_worker/tests/` per il vincolo su Python
+3.13 descritto sopra. Il fallimento è preesistente e indipendente da questo
+lavoro: `test_offline.py::test_no_first_party_script_calls_out`, dovuto a una
+copia locale di Fabric.js non tracciata da git (`static/js/fabric-debug.js`)
+che nei propri commenti cita pagine di documentazione esterne.
+
+Alcuni test frontend non renderizzano niente e leggono i sorgenti, perché guardano
+proprietà che sopravvivono solo se qualcuno le controlla:
+
+| File | Cosa impedisce |
+|---|---|
+| `test_offline.py` | Una libreria caricata dalla rete, un worker PDF.js lasciato sul CDN, una libreria sostituita senza aggiornare l'impronta |
+| `test_layout_shell.py` | Una vista che torna a dichiararsi la propria larghezza |
+| `test_template_js_syntax.py` | Una traduzione con l'apostrofo dentro una stringa JS a virgolette singole, che spegne Alpine su tutta la pagina |
+
 ---
 
 ## Variabili d'Ambiente
@@ -304,8 +494,12 @@ Copia `.env.example` in `.env` e configura:
 | `SERVER_CORS_ORIGINS` | Origini CORS ammesse |
 | `CLIENT_SECRET_KEY` | Chiave segreta Flask (sessioni, CSRF) |
 | `API_SERVER_URL` | URL del backend visto dal client (es. `http://server:8000`) |
-| `UPLOAD_DIR` | Percorso upload file (default: `uploads`, relativo a `server/`) |
-| `MAX_UPLOAD_SIZE_MB` | Limite dimensione upload |
+| `STATION_CODE` | **Per-tablet** — codice stazione (es. `ST-001`). Senza, il client mostra errore configurazione. |
+| `VISION_WORKER_URL` | Indirizzo interno del worker di visione (default: `http://vision:8100`, mai esposto fuori da `tmflow-net`) |
+| `UPLOAD_DIR` | Percorso upload file (default: `uploads`, project root) |
+| `MAX_UPLOAD_SIZE_MB` | Limite dimensione upload (default 50) |
+| `RATE_LIMIT_LOGIN` | Login req/min/IP (default 5) |
+| `RATE_LIMIT_GENERAL` | Richieste req/min/IP (default 300, per-tablet) |
 | `NGINX_PORT`, `NGINX_SSL_PORT` | Porte Nginx (solo compose dev) |
 | `SETUP_PASSWORD` | Password pagina setup (vuota = endpoint disabilitato) |
 | `SSL_CERTFILE`, `SSL_KEYFILE` | Certificato SSL (solo setup manuale) |
@@ -314,16 +508,38 @@ Copia `.env.example` in `.env` e configura:
 
 ## Documentazione
 
+Indice completo: [`docs/README.md`](docs/README.md).
+
+### Stato e direzione
+
 | Documento | Contenuto |
 |---|---|
-| [docs/API.md](docs/API.md) | Riferimento completo API REST (endpoint, parametri, schemi) |
-| [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) | Guida deployment VPS: Docker, Traefik, SSL, DNS, firewall |
-| [docs/USER_GUIDE.md](docs/USER_GUIDE.md) | Manuale utente per ruolo (Maker, MeasurementTec, Metrologist) |
+| [`TieMeasureFlow_modifiche_2026-07-28.md`](TieMeasureFlow_modifiche_2026-07-28.md) | I quindici punti del 28/07: cosa deve cambiare, dove intervenire, decisioni in attesa del cliente (D-1…D-9) |
+| [`docs/architecture/STATO_PROGETTO.md`](docs/architecture/STATO_PROGETTO.md) | Snapshot V2.0.0: cosa funziona oggi, test status, decisioni architetturali |
+| [`docs/architecture/ROADMAP.md`](docs/architecture/ROADMAP.md) | Cosa resta da fare (Fasi 2-7 rev04, decisioni cliente aperte, stime) |
+
+### Riferimenti operativi
+
+| Documento | Contenuto |
+|---|---|
+| [`docs/API.md`](docs/API.md) | Riferimento completo API REST (endpoint, parametri, schemi) |
+| [`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md) | Guida deployment VPS: Docker, Traefik, SSL, DNS, firewall |
+| [`docs/USER_GUIDE.md`](docs/USER_GUIDE.md) | Manuale utente per ruolo (Maker, MeasurementTec, Metrologist) |
+| [`docs/I18N_SETUP.md`](docs/I18N_SETUP.md) | Setup e workflow traduzioni (Flask-Babel + Alpine.js) |
+| [`docs/architecture/LAYOUT.md`](docs/architecture/LAYOUT.md) | La cornice delle pagine: perché il layout si spostava e la regola che lo tiene fermo |
+| [`src/frontend/flask_app/static/vendor/VERSIONS.md`](src/frontend/flask_app/static/vendor/VERSIONS.md) | Librerie di terze parti in locale: versioni, impronte, come aggiornarle |
+
+### Piani dettagliati
+
+| Documento | Contenuto |
+|---|---|
+| [`docs/superpowers/plans/2026-04-17-rev04-master-roadmap.md`](docs/superpowers/plans/2026-04-17-rev04-master-roadmap.md) | Master plan rev04 (M1 + M2, decisioni aperte, stime) |
+| [`docs/superpowers/plans/2026-04-17-rev04-phase1-stations.md`](docs/superpowers/plans/2026-04-17-rev04-phase1-stations.md) | Piano TDD Fase 1 stazioni (completato) |
 
 ---
 
 ## Licenza
 
-Proprietary - Tielogic. All rights reserved.
+Proprietary — Tielogic. All rights reserved.
 
 Questo software è di proprietà esclusiva di Tielogic ed è protetto dalle leggi sul copyright. Non è consentita la distribuzione, modifica o utilizzo senza autorizzazione scritta.

TieMeasureFlow_modifiche_2026-07-28.md

@@ -0,0 +1,614 @@
+# TieMeasureFlow — modifiche da apportare
+
+**Data:** 28 luglio 2026 (agg. serale: architettura d'installazione, punti 7-8 precisati, punti 14-15 nuovi, timer bidirezionale nel punto 3)
+**Riferimento codice:** branch `V2.0.0`, commit `2a56632`
+**Destinatari:** Parte 1 leggibile da cliente e rivenditore · Parte 2 per chi mette mano al codice
+
+---
+
+## Come leggere questo documento
+
+La **Parte 1** dice *cosa deve fare* il sistema e *perché*: si può mandare a Ricerca e
+Misure e a Tràfilo. La **Parte 2** dice *dove si interviene*, con file e criteri di
+completamento. La **Parte 3** elenca le domande la cui risposta non dipende da noi.
+
+Ogni punto porta lo **stato verificato sul codice**, non riferito: `già fatto`,
+`parziale`, `da fare`. Serve a evitare l'equivoco emerso in questi giorni — diverse
+funzioni risultano "già implementate" perché **l'interfaccia c'è**, ma dietro non
+succede nulla.
+
+**Fonti:** specifica *Schema sviluppo SW TieFlow rev. 04-2026*; *MODIFICHE TIEMEASURE
+v260519*; call del 28/07/2026; rettifica di Marco Menoncin del 28/07; lettura diretta
+del codice.
+
+---
+
+## Il punto che regge tutti gli altri
+
+**Lo stato della produzione oggi vive dentro una pagina del browser.**
+
+Il timer, il conteggio dei cicli, il flag "produzione avviata" e le misure in corso
+sono variabili del componente Alpine di `task_execute.html`. La navigazione fra un
+task e l'altro è un **ricaricamento completo di pagina** (`window.location.href`).
+
+Conseguenza diretta: **cambiando task si perde tutto.** Il timer smette di esistere,
+il conteggio dei cicli riparte, "produzione avviata" si dimentica.
+
+Questo spiega, senza bisogno di altre ipotesi:
+
+- perché il loop di misura non regge quando la ricetta ha altri task dopo la misura;
+- perché con più task di misura non si sa a quale tornare allo scadere del timer;
+- perché *fermo linea* e *fine produzione* non hanno nulla da fermare o da chiudere;
+- perché non esiste storico di cosa è successo durante una produzione.
+
+**Va risolto per primo**: i punti 2, 3, 6 e 8 dipendono da questa scelta, e affrontarli
+prima significa rifarli dopo.
+
+---
+
+## Architettura d'installazione (decisa il 28/07)
+
+Chiude la domanda D-3 lato Tielogic. L'installazione a Tràfilo è così composta:
+
+```
+SERVER (uno, del cliente)          STAZIONE (una per PC, installata in locale)
+┌─────────────────────────┐        ┌──────────────────────────────────────┐
+│ MySQL                   │◄──API──│ App di stazione:                     │
+│ Backend dati (API)      │        │  · interfaccia operatore (frontend)  │
+│ File dei disegni        │        │  · agente hardware: calibro USB,     │
+│ Migrazioni dello schema │        │    driver camera, colonnina/cicalino │
+│ Adattatore GAIA         │        │  · elaborazione visione (futura:     │
+└─────────────────────────┘        │    XF compare, pattern matching)     │
+                                   └──────────────────────────────────────┘
+```
+
+- **Sul server vive tutto ciò che è stato**: il database, i file dei disegni, le
+  migrazioni dello schema e l'unico punto di contatto col gestionale GAIA.
+  Aggiornare la logica dati = un deploy, in un posto solo.
+- **Sulla stazione vive tutto ciò che tocca l'hardware**: calibro, telecamera,
+  segnalazione luminosa/acustica, e in prospettiva l'elaborazione visione — che
+  così non carica il server (rilevante per il dimensionamento, D-4).
+  L'app di stazione è **senza stato**: non tocca il database direttamente, parla
+  col backend dati via API e gli manda risultati e immagini.
+- **L'identità della stazione è data dall'installazione** (configurata sul PC),
+  non più dal container sul server: il vincolo "una stazione = un container"
+  decade.
+- La **licenza per postazione** ha l'aggancio naturale nell'app di stazione
+  installata.
+
+**Correzione a quanto detto in call:** i disegni **non stanno nel database** —
+stanno su filesystem (`uploads/`), serviti dal backend. Con questa architettura
+restano sul server, in un posto solo: nessuna cartella da sincronizzare fra i PC.
+
+Conseguenza per lo sviluppo: lo stato della produzione (punto 1) va nel database
+**per obbligo architetturale**, non per scelta — con 20 app di stazione non esiste
+altro posto dove possa vivere.
+
+---
+
+# Parte 1 — Cosa deve fare il sistema
+
+## Quadro: cosa già funziona
+
+Da mettere a verbale, perché in parte era dato per mancante:
+
+| Funzione | Stato |
+|---|---|
+| Stazioni e assegnazione ricette alle stazioni | ✅ presente |
+| Ruolo **capoturno** con autorizzazione a login | ✅ presente |
+| Timer d'intervallo misura con **conto alla rovescia a video** e cicalino | ✅ presente |
+| Logout automatico per inattività, configurabile | ✅ presente |
+| Tolleranze con soglie di attenzione (UTL/UWL/LWL/LTL) ed esito per quota | ✅ presente |
+| Versionamento delle ricette con storico delle modifiche | ✅ presente |
+| Registrazione del **tempo di inserimento** di ogni misura | ✅ presente (28/07) |
+| Pulsanti *Fermo linea*, *Fine produzione*, *Avvio produzione* | ⚠️ solo interfaccia |
+
+L'ultima riga è la più importante: i tre pulsanti esistono, chiedono correttamente
+l'autorizzazione del capoturno, **e poi non fanno nulla**.
+
+---
+
+## 1. Memoria della produzione in corso `da fare` · prerequisito
+
+**Oggi:** lo stato di una produzione esiste solo finché l'operatore resta sulla stessa
+schermata.
+
+**Deve:** la produzione diventa un'entità con una vita propria — si apre quando parte,
+registra ciò che accade (avvio, cicli di misura, fermo linea, ripresa, chiusura) e si
+chiude quando il capoturno la chiude. Se l'operatore cambia task, esce e rientra, o il
+tablet si riavvia, la produzione è ancora lì con il suo timer.
+
+**Perché conta:** senza questo, *fermo linea* e *fine produzione* non possono
+funzionare, il loop di misura non è realizzabile e non esiste il dato storico su cui
+poggiano sia la statistica sia l'integrazione col gestionale.
+
+---
+
+## 2. Tipo di task esplicito `da fare`
+
+**Oggi:** il sistema distingue un task di misura da un task documentale **deducendolo**:
+se ha delle quote è una misura, altrimenti è una nota. Non esiste un tipo dichiarato.
+
+**Deve:** ogni task nasce con un tipo scelto da chi crea la ricetta — **nota**,
+**misura**, **disegno** — predisposto per i tipi futuri (confronto profilo/DXF, misura
+con camera).
+
+**Perché conta:** è la richiesta n. 1 di Menoncin, ed è ciò a cui si agganciano timer e
+loop. Con la deduzione attuale un task di misura a cui non sono ancora state inserite le
+quote viene trattato come una nota: il sistema si comporta in modo diverso a seconda di
+quanto è completa la ricetta.
+
+---
+
+## 3. Loop di misura e ripetizione `parziale`
+
+**Oggi:** allo scadere del timer suona il cicalino e il ciclo si riazzera — ma solo se
+l'operatore è rimasto su quella schermata.
+
+**Deve:**
+- l'operatore esegue i task in sequenza fino al primo task di misura;
+- da lì **resta in loop sulla misura** finché la produzione non viene chiusa;
+- il conto alla rovescia di **quanto manca alla prossima misura** è sempre visibile;
+- **arrivato a zero, il contatore riparte nell'altro senso**: mostra da quanto tempo
+  si è **oltre** l'intervallo di misura, in evidenza — così il ritardo si vede, non
+  si deduce (richiesta dell'operatore, 28/07);
+- allo scadere del timer la misura **si ripropone** ovunque si trovi l'operatore;
+- se la ricetta ha **più task di misura**, il timer riparte alla fine dell'**ultimo**;
+- dev'essere possibile **girare il pezzo e rimisurare** senza chiudere il ciclo.
+
+**Perché conta:** è la seconda richiesta di Menoncin e il comportamento descritto al
+punto 4.10 della specifica del 19/05. La logica c'è già in gran parte: manca che
+sopravviva al cambio di schermata (punto 1).
+
+---
+
+## 4. Limite di tentativi prima del capoturno `da fare`
+
+**Oggi:** l'operatore può ripetere la misura quante volte vuole.
+
+**Deve:** dopo un numero di tentativi definito nella ricetta, per proseguire serve
+l'autorizzazione del capoturno.
+
+**Perché conta:** è nella specifica ed è la contromisura al caso in cui si ripete finché
+non "viene bene". Il meccanismo di autorizzazione esiste già: manca il contatore e la
+soglia.
+
+---
+
+## 5. Avanzamento solo se in tolleranza `da verificare`
+
+**Deve:** si passa alla quota successiva in autonomia **solo se la quota è in
+tolleranza**; per confermare una quota fuori tolleranza serve il capoturno.
+
+**Nota:** il gate del capoturno per il fuori tolleranza è implementato. Va verificato
+sul campo che **blocchi davvero l'avanzamento** e non sia solo una richiesta di conferma.
+Se blocca, il punto si chiude senza sviluppo.
+
+---
+
+## 6. Fermo linea e Fine produzione: dare effetto `parziale`
+
+**Oggi:** entrambi chiedono l'autorizzazione del capoturno, poi non succede niente.
+
+**Deve:**
+- **Fermo linea** — sospende il timer e la produzione; il capoturno può riattivarla;
+- **Fine produzione** — chiude la produzione, ferma il timer definitivamente e **invia
+  i dati di misura dell'intera produzione** al file di statistica.
+
+**Perché conta:** il comportamento verso il gestionale è ancora da definire (Parte 3),
+ma **tutto ciò che sta prima del gestionale si può e si deve fare adesso**: sospendere,
+riprendere, chiudere, registrare. Consegnare i pulsanti funzionanti senza il gestionale
+è possibile; il contrario no.
+
+---
+
+## 7. Gestione delle stazioni `parziale`
+
+**Deve:**
+- la lista stazioni mostra, oltre a codice e postazione, **le ricette collegate**;
+- esiste un **reset della stazione**, con un pulsante **per riga** nella lista:
+  la stazione torna senza ricette associate e si riassegna (precisazione
+  dell'operatore, 28/07);
+- la **stazione corrente si può cambiare al volo**, per poter provare più stazioni da un
+  solo computer senza riconfigurare l'installazione.
+
+**Perché conta:** è la terza richiesta di Menoncin. Il cambio al volo non è un vezzo da
+sviluppatori: senza, la sessione di collaudo con Menoncin richiede tanti PC quante sono
+le stazioni da provare.
+
+---
+
+## 8. Tracciabilità obbligatoria `parziale`
+
+**Oggi:** numero di lotto e numero seriale sono facoltativi e si inseriscono nella lista
+task, cioè dopo aver iniziato.
+
+**Deve:** l'obbligatorietà di lotto e seriale si **decide alla creazione della
+ricetta** (obbligatori sì/no); l'operatore li inserisce **alla selezione della
+ricetta**, e finché mancano il pulsante *Avvia* **non si attiva** (precisazione
+dell'operatore, 28/07).
+
+**Perché conta:** una misura senza lotto non è tracciabile a posteriori, e la
+tracciabilità è metà del valore del sistema in un audit.
+
+---
+
+## 9. Blocco dell'inserimento manuale `da fare`
+
+**Oggi:** il sistema registra **come** è stata inserita una misura (calibro o tastiera),
+ma accetta sempre entrambi.
+
+**Deve:** un'impostazione della ricetta consente o vieta l'inserimento manuale, **con
+divieto come impostazione predefinita**: si misura col calibro.
+
+**Perché conta:** è il punto sollevato in call — senza questo vincolo un valore in
+tolleranza si può digitare. Il dato su *come* è stata inserita c'è già: manca la regola
+che lo impedisce.
+
+---
+
+## 10. Interfaccia operatore: sequenza e conferme `da fare`
+
+Richieste del 19/05, tutte di interfaccia:
+
+- un pulsante che **avvia i task in sequenza**, senza sceglierli a uno a uno;
+- la lista completa dei task retrocessa a **secondo livello**, per tornare a vedere i
+  task precedenti;
+- «inizia misure» rinominato **«visualizza singolo TASK»**;
+- dentro il task, «Riepilogo» sostituito da **«Completato»** per passare al successivo;
+- un task lasciato a metà **resta incompiuto** e si vede;
+- «fine ciclo misura» **cliccabile solo quando tutte le quote hanno un valore**.
+
+---
+
+## 11. Formattazione delle descrizioni `da fare`
+
+**Deve:** le descrizioni dei task accettano andate a capo e grassetto.
+
+**Perché conta:** chi crea le ricette fa **copia e incolla dal PDF della scheda
+tecnica**; oggi il testo arriva appiattito e va risistemato a mano ogni volta.
+
+---
+
+## 12. Funzionamento senza internet `da fare` · bloccante per l'installazione
+
+**Oggi:** l'applicazione **non funziona senza collegamento a internet**. Cinque librerie
+vengono scaricate al volo da servizi esterni ogni volta che si apre una pagina.
+
+**In una rete di produzione isolata — la norma in fabbrica — il risultato è una pagina
+bianca.** Non un degrado: l'interfaccia non parte proprio, e senza le altre non si vedono
+i disegni tecnici né i grafici statistici.
+
+**Deve:** tutte le librerie sono incluse nell'installazione e l'applicazione funziona a
+rete staccata.
+
+**Perché conta ora:** l'installazione a Tràfilo è on-premise e prevista per settembre.
+È poco lavoro, ma va fatto **prima**, non in fabbrica il giorno dell'installazione.
+
+**Beneficio collaterale non ovvio:** oggi una delle librerie è agganciata a una versione
+"qualunque della serie 3" — cioè **l'applicazione cambia da sola** quando gli autori
+pubblicano un aggiornamento, senza che nessuno l'abbia validata. Per un sistema che
+produce evidenze per audit ISO 9001 / IATF 16949 questo è di per sé un problema.
+Includendo le librerie le versioni si congelano: da difetto diventa argomento di vendita.
+
+---
+
+## 13. Generazione dei task dalla scheda tecnica con l'AI `fuori offerta`
+
+**Richiesta:** leggere il PDF della scheda tecnica e **creare un task per blocco**,
+invece del copia-incolla manuale.
+
+**Storia:** posta il **19/05/2026** nel documento delle modifiche, rimasta senza
+risposta; **rilanciata da Tràfilo il 28/07** come elaborazione massiva iniziale delle
+schede, «senza installare agenti nel sistema».
+
+**Stato:** non è in nessuna offerta. Prima di quotare servono tre informazioni: quante
+sono le schede, se il formato è standard, e se l'elaborazione è una-tantum in fase di
+avviamento o una funzione permanente del prodotto. Sono domande da fare, non da
+supporre — vedi Parte 3.
+
+---
+
+## 14. Stabilità del layout `da fare` · da circoscrivere
+
+**Oggi:** le dimensioni delle viste **cambiano a seconda del menu**: passando da una
+schermata all'altra la finestra non mantiene proporzioni stabili.
+
+**Deve:** il layout resta stabile nel passaggio fra le viste.
+
+**Nota:** segnalazione dell'operatore del 28/07, non ancora circoscritta sul codice —
+prima di intervenire va riprodotta e va stilato l'elenco delle viste interessate.
+
+---
+
+## 15. Statistica: si registra sempre, si consulta a parte `già fatto` · da confermare sul campo
+
+**Richiesta (28/07):** a fine misura l'operatore **non va portato nella pagina della
+statistica**. I dati **entrano comunque in statistica**: cambia solo chi la consulta —
+serve l'**utente con il ruolo adeguato**, che apre la pagina dedicata.
+
+**Verificato sul codice:** è già così. Tutte le pagine di statistica richiedono il
+ruolo **Metrologo** (`role_required("Metrologist")` su ogni route), e a fine ciclo
+l'operatore viene portato al **riepilogo**, non alla statistica.
+
+**Resta da fare:** niente sviluppo; il requisito entra come **criterio di collaudo**
+(l'operatore non deve poter raggiungere la statistica da nessun percorso) e va tenuto
+fermo quando il punto 10 ridisegna la navigazione a fine task.
+
+---
+
+# Parte 2 — Dove si interviene
+
+Riferimenti al branch `V2.0.0`, commit `2a56632`.
+
+## Ordine consigliato
+
+```
+12 (offline)  ──────────────►  indipendente, si può fare subito
+                               bloccante per l'installazione
+
+ 1 (stato produzione)  ──┬───►   3 (loop misura)
+                         ├───►   6 (fermo linea / fine produzione)
+                         └───►   4 (limite tentativi)
+
+ 2 (tipo task)  ─────────────►   3, 10
+
+ 7 (stazioni) · 8 (tracciabilità) · 9 (inserimento manuale) · 11 (formattazione)
+   indipendenti fra loro
+
+ 5 (avanzamento in tolleranza)  ──►  prima verificare, forse è già a posto
+
+14 (layout)  ────────────────►  prima riprodurre e circoscrivere le viste
+
+15 (statistica riservata)  ──►  già a posto: solo criterio di collaudo,
+                                da non rompere lavorando sul punto 10
+```
+
+La separazione **backend dati sul server / app di stazione in locale** (vedi
+*Architettura d'installazione*) non è un punto di questa lista: è il contesto in
+cui i punti 1, 3, 6 e 7 vanno progettati. In pratica: API senza stato, stato solo
+nel database, niente dipendenze dal container per l'identità della stazione.
+
+## 1 · Stato della produzione lato server
+
+**Problema tecnico:** `task_execute.html` tiene in variabili Alpine
+(`timerActive`, `timerRemaining`, `_timerInterval`, `cycleCount`, `cycleConfirmed`,
+`productionStarted`, `measurements`) uno stato che deve sopravvivere alla pagina.
+`goToNextTask()` fa `window.location.href` → il componente viene distrutto.
+Lato server la sessione conserva soltanto `lot_number` e `serial_number`.
+
+**Intervento:**
+- nuove tabelle `production_runs` e `production_events` (avvio, ciclo completato, fermo
+  linea, ripresa, chiusura), con `station_id`, `recipe_version_id`, `operator_id`,
+  `supervisor_id` dove serve, timestamp;
+- endpoint REST per aprire, interrogare e aggiornare la produzione corrente della
+  stazione;
+- il frontend legge lo stato all'apertura di ogni pagina invece di tenerlo in memoria;
+  il conto alla rovescia si **ricalcola dall'orario di scadenza** salvato lato server,
+  non da un contatore locale;
+- gli endpoint vanno progettati **senza stato in memoria di processo**: con l'app di
+  stazione installata su ogni PC (vedi *Architettura d'installazione*) il database è
+  l'unico posto condiviso.
+
+**File:** `src/backend/models/orm/` (nuovo modulo), `src/backend/migrations/versions/`
+(migrazione 005), `src/backend/api/routers/`, `src/frontend/flask_app/blueprints/measure.py`,
+`src/frontend/flask_app/templates/measure/task_execute.html`.
+
+**Fatto quando:** avviata una produzione, si naviga fra i task, si esce e si rientra, e
+il timer prosegue coerente; il riavvio del browser non azzera nulla.
+
+---
+
+## 2 · Tipo di task
+
+**Problema tecnico:** `RecipeTask` non ha campo tipo; il frontend decide con
+`subtasks.length > 0` (`task_execute.html`, `task_list.html`).
+
+**Intervento:** campo `type` su `recipe_tasks` con valori `note | measure | drawing`
+(predisposto per `xf_compare`, `camera_measure`), migrazione con valorizzazione dei dati
+esistenti secondo la regola attuale, selezione del tipo nell'editor ricetta,
+sostituzione dei controlli su `subtasks.length` con il tipo.
+
+**File:** `src/backend/models/orm/task.py`, nuova migrazione,
+`src/backend/models/api/`, `src/frontend/flask_app/templates/maker/task_editor.html`,
+`templates/measure/task_execute.html`, `templates/measure/task_list.html`.
+
+**Fatto quando:** una ricetta con un task di misura ancora privo di quote si comporta da
+task di misura.
+
+---
+
+## 3 · Loop di misura
+
+**Base già presente:** `confirmCycle()`, `startMeasurementTimer()`, `onTimerExpired()`,
+`timerDisplay`, `playBuzzer()` in `task_execute.html` (righe ~955-1050). La logica è
+corretta; il problema è la persistenza (punto 1) e il fatto che allo scadere non si può
+riportare l'operatore sul task giusto.
+
+**Intervento:** spostare la scadenza sul server; alla scadenza, **redirezione al task di
+misura** della produzione corrente; con più task di misura far ripartire il timer al
+completamento dell'**ultimo**; aggiungere «rimisura» che riapre il ciclo senza chiuderlo.
+
+**Timer bidirezionale:** oggi il contatore **solo decrementa e si ferma a zero**
+(`timerRemaining--`, poi `onTimerExpired()`); `timerDisplay` formatta minuti:secondi
+dal residuo. Va esteso: sotto zero il valore continua **in negativo** e la
+visualizzazione passa a "oltre da m:s", con stile in evidenza. Calcolando dal
+timestamp di scadenza lato server (come sopra), il ritardo è coerente su qualunque
+schermata e sopravvive al ricaricamento.
+
+**Fatto quando:** con una ricetta a due task di misura e task documentali in coda, allo
+scadere del timer l'operatore viene riportato alla misura da qualunque schermata.
+
+---
+
+## 4 · Limite di tentativi
+
+**Problema tecnico:** nessun `max_retries` nel codice.
+
+**Intervento:** campo sulla ricetta (accanto a `measurement_interval_minutes`, che segue
+lo stesso schema), contatore per quota nella produzione corrente, superata la soglia
+riuso del modale capoturno esistente con motivo `max_retries`.
+
+**File:** `src/backend/models/orm/recipe.py`, migrazione,
+`templates/maker/recipe_editor.html` (accanto al timer), `task_execute.html`.
+
+---
+
+## 5 · Avanzamento in tolleranza — prima verificare
+
+Il modale capoturno gestisce già `out_of_tolerance` (`task_execute.html`,
+`openSupervisorModal`, `validateSupervisor`, endpoint
+`measure.validate_supervisor`). **Prima di sviluppare, provare**: se il rifiuto blocca
+l'avanzamento, il punto è chiuso. Se è solo una conferma, va reso vincolante.
+
+---
+
+## 6 · Fermo linea e Fine produzione
+
+**Problema tecnico:** in `task_execute.html` i due pulsanti aprono il modale e poi
+ricadono su un commento: `fermo_linea and fine_produzione are handled by GAIA
+integration (future)`. `startProduction()` è un `TODO` con la chiamata commentata.
+
+**Intervento (senza gestionale):** scrivere gli eventi su `production_events`,
+sospendere e riprendere il timer, chiudere la produzione, ed **emettere il file di
+statistica** con tutte le misure della produzione. L'invio al gestionale resta un
+adattatore separato da riempire quando il protocollo sarà definito (Parte 3): va
+previsto il punto d'innesto, non l'implementazione.
+
+**Fatto quando:** *fermo linea* congela il timer e solo il capoturno lo riattiva; *fine
+produzione* chiude e produce il file.
+
+---
+
+## 7 · Stazioni
+
+**Base presente:** `Station` e `StationRecipeAssignment` (`models/orm/station.py`,
+migrazione 002).
+
+**Intervento:** ricette collegate nella lista stazioni; pulsante di reset **per riga**
+che rimuove le assegnazioni; selezione della stazione corrente da parametro URL con
+ricaduta sulla variabile d'ambiente, per il collaudo da una sola macchina.
+
+**Nota (28/07, chiude il dubbio che era in D-3):** in produzione l'identità della
+stazione è data dall'**installazione locale** dell'app di stazione, non dal container.
+Il cambio al volo via URL resta come strumento di **collaudo**.
+
+---
+
+## 8 · Tracciabilità
+
+**Base presente:** `lot_number` e `serial_number` su `Measurement`, salvataggio in
+sessione (`measure.save_traceability`), inserimento in `task_list.html`.
+
+**Intervento:** flag sulla ricetta (`richiede lotto`, `richiede seriale`); spostare
+l'inserimento sull'avvio produzione; *Avvia* disabilitato finché mancano.
+
+---
+
+## 9 · Inserimento manuale
+
+**Base presente:** `Measurement.input_method` (`manual | usb_caliper`), valorizzato dal
+frontend.
+
+**Intervento:** flag sulla ricetta `consente inserimento manuale`, **predefinito falso**;
+validazione **lato server** — un flag solo nel frontend non protegge da nulla; tastierino
+nascosto quando vietato.
+
+---
+
+## 10 · Interfaccia operatore
+
+Interventi su `templates/measure/task_list.html` e `task_execute.html`: pulsante di
+avvio in sequenza, retrocessione della lista a secondo livello, rinomina dei due
+pulsanti, stato «incompiuto» sui task abbandonati, «fine ciclo misura» abilitato solo a
+quote complete.
+
+---
+
+## 11 · Formattazione descrizioni
+
+`RecipeTask.description` è già `Text`. Serve un editor minimale (grassetto e a capo) e
+la resa corrispondente in esecuzione, con **sanificazione dell'HTML** in ingresso.
+
+**File:** `templates/maker/task_editor.html`, `templates/measure/task_execute.html`.
+
+---
+
+## 12 · Funzionamento senza internet
+
+**Verificato sul codice.** Cinque librerie esterne in sei template:
+
+| Libreria | Dove | Senza rete si perde |
+|---|---|---|
+| Alpine.js `3.x.x` | `base.html` | **tutta l'interfaccia** |
+| Plotly `2.32.0` | `statistics/dashboard.html` | carte di controllo e istogrammi |
+| PDF.js `3.11.174` | `task_execute`, `recipe_preview`, `task_drawing`, `task_editor` | visualizzazione dei disegni |
+| Fabric.js `5.3.1` | `maker/task_drawing.html` | editor delle annotazioni |
+| Google Fonts | `base.html` | estetica e attese al caricamento |
+
+**Intervento:** scaricare le librerie in `src/frontend/flask_app/static/vendor/` (la
+cartella **esiste già ed è vuota**), ripuntare i tag, chiudere la policy di sicurezza in
+`security_headers.py` da elenco-di-CDN a solo-origine-locale.
+
+⚠️ **Trappola da non mancare:** PDF.js ha una **seconda** referenza al CDN,
+`pdfjsLib.GlobalWorkerOptions.workerSrc`, presente in **quattro file**. Ripuntando solo
+lo script principale la libreria si carica in locale **e il worker continua a cercare
+internet**: sembra funzionare finché non si apre un disegno.
+
+**Fatto quando:** con la rete staccata si percorre login → scelta ricetta → esecuzione
+task → annotazione disegno → statistiche → report, senza errori in console.
+
+---
+
+# Parte 3 — Decisioni che non dipendono da noi
+
+Da chiudere **prima** che i punti collegati entrino in sviluppo. Vanno girate a Tràfilo
+tramite Menoncin.
+
+| # | Domanda | Blocca | Chi risponde |
+|---|---|---|---|
+| **D-1** | **Protocollo del gestionale GAIA**: come si scambiano i dati — servizi web, database condiviso, file? | avvio produzione, fermo linea, fine produzione verso il gestionale; lettura dei codici articolo per stazione | IT Tràfilo + fornitore GAIA |
+| **D-2** | **Rete e credenziali** per raggiungere GAIA dal server dove sarà installato | come sopra | IT Tràfilo |
+| ~~**D-3**~~ | ~~Una applicazione per stazione o una sola per tutte?~~ **Decisa il 28/07** lato Tielogic: backend dati sul server, app di stazione installata su ogni PC — vedi *Architettura d'installazione*. Resta la validazione con l'IT di Tràfilo (macchina e rete) | — | chiusa (noi); validazione in D-4 |
+| **D-4** | **Server**: quale macchina, quanto spazio disco. Sul server stanno database **e file dei disegni** (`uploads/`); l'elaborazione visione **non** è sul server (sta sull'app di stazione), quindi pesa lo spazio disco, non la potenza di calcolo | installazione | IT Tràfilo |
+| **D-5** | **Cicalino**: basta il suono del browser o serve una segnalazione luminosa? La specifica chiede luce **e** suono accesi per tutta la misura, visibili da lontano. Con l'architettura del 28/07 l'app di stazione **può pilotare una colonnina**: la domanda diventa *quale hardware* | punto 3 | Tràfilo |
+| **D-6** | **Autorizzazione capoturno**: username e password come oggi, o PIN rapido / badge? Venti volte al giorno la password è un attrito | punti 4, 5, 6 | Tràfilo |
+| **D-7** | **Numero di tentativi** consentiti prima del capoturno: quanti, e uguali per tutte le ricette? | punto 4 | Tràfilo |
+| **D-8** | **Schede tecniche**: quante sono, il formato è standard, e serve una conversione una-tantum o una funzione permanente? | punto 13 e la sua quotazione | Tràfilo |
+| **D-9** | Modificare i parametri di una ricetta (timer, tentativi) **crea una nuova versione** o no? Sono parametri di esercizio, non di prodotto | punti 4, 3 | noi, con conferma cliente |
+
+**Nota su D-1 e D-2:** finché non hanno risposta, del gestionale si può solo predisporre
+il punto d'innesto. Tutto il resto del punto 6 — sospendere, riprendere, chiudere,
+registrare, produrre il file — **si fa comunque e va fatto adesso**.
+
+---
+
+## Appendice — Come è stato verificato
+
+Ogni «già fatto» e ogni «da fare» viene dalla lettura del codice al commit `2a56632`,
+non dai documenti. In particolare:
+
+- il **tipo di task** è dedotto da `subtasks.length > 0` in `task_execute.html:117` e
+  `task_list.html:169`;
+- il **ruolo capoturno** esiste come `Supervisor`
+  (`api/middleware/api_key.py:71`, `blueprints/measure.py:350`);
+- **fermo linea / fine produzione / avvio produzione** hanno interfaccia e gate ma
+  nessun effetto (`task_execute.html:1017-1021`, `1118`);
+- il **timer** è un `setInterval` locale alla pagina (`task_execute.html:968-995`) e la
+  navigazione fra task è un ricaricamento (`task_execute.html:1054`);
+- **`max_retries`** e **`production_events`** non compaiono in nessun file;
+- le **cinque librerie da CDN** sono ai riferimenti citati al punto 12, e
+  `static/vendor/` contiene solo `.gitkeep`;
+- i **disegni stanno su filesystem**, non nel database: cartella `uploads/` servita
+  dal backend (`api/routers/files.py:201`, `FileResponse`) — verifica del 28/07 sera,
+  corregge quanto detto in call;
+- la **statistica è già riservata**: ogni route di `blueprints/statistics.py` porta
+  `@role_required("Metrologist")`; a fine ciclo il frontend va al riepilogo
+  (`task_execute.html:1126`), non alla statistica;
+- il **timer si ferma a zero**: decremento in `task_execute.html:974-975` con uscita
+  su `onTimerExpired()` — il conteggio del ritardo (punto 3) oggi non esiste;
+- lo stack attuale è a 4 container (`docker-compose.yml`): MySQL 8, backend FastAPI,
+  frontend Flask, nginx — base della sezione *Architettura d'installazione*.
+
+Il punto 14 (layout) è l'unico **non verificato sul codice**: è una segnalazione
+dell'operatore del 28/07, da riprodurre.

docker-compose.dev.yml

@@ -33,6 +33,7 @@ services:
     environment:
       DB_HOST: mysql
       UPLOAD_DIR: uploads
+      VISION_WORKER_URL: http://vision:8100
     volumes:
       - upload_data:/app/uploads
     depends_on:
@@ -41,6 +42,23 @@ services:
     networks:
       - tmflow-net
 
+  vision:
+    build:
+      context: .
+      dockerfile: Dockerfile.vision
+      args:
+        VISION_ENGINE_VERSION: ${VISION_ENGINE_VERSION:-}
+    container_name: tmflow-vision
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8100/health', timeout=5)"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    networks:
+      - tmflow-net
+
   client:
     build:
       context: .

docker-compose.yml

@@ -33,6 +33,7 @@ services:
     environment:
       DB_HOST: mysql
       UPLOAD_DIR: uploads
+      VISION_WORKER_URL: http://vision:8100
     volumes:
       - upload_data:/app/uploads
     depends_on:
@@ -50,6 +51,23 @@ services:
       - tmflow-net
       - traefik-net
 
+  vision:
+    build:
+      context: .
+      dockerfile: Dockerfile.vision
+      args:
+        VISION_ENGINE_VERSION: ${VISION_ENGINE_VERSION:-}
+    container_name: tmflow-vision
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8100/health', timeout=5)"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    networks:
+      - tmflow-net
+
   client:
     build:
       context: .
@@ -93,4 +111,4 @@ networks:
     driver: bridge
   traefik-net:
     external: true
-    name: root_default
+    name: traefik

docs/API.md

@@ -23,6 +23,7 @@ TieMeasureFlow provides a REST API built with FastAPI for managing measurement t
    - [Measurements](#measurements)
    - [Files](#files)
    - [Settings](#settings)
+   - [Stations](#stations)
    - [Statistics](#statistics)
    - [Reports](#reports)
 7. [Pagination](#pagination)
@@ -1101,6 +1102,189 @@ Content-Type: multipart/form-data
 
 ---
 
+### Stations
+
+Stations model the physical measurement posts on the shop floor. Each Flask client identifies itself through `STATION_CODE`, and the operator only sees recipes assigned to that station. See the user guide section "Admin Workflow → Station Management" for the operational model.
+
+#### GET `/stations`
+
+List stations. **Admin only.**
+
+Query parameters:
+- `active_only` (bool, default `false`): if `true`, return only stations where `active = true`.
+
+Response `200`:
+```json
+[
+  {
+    "id": 1,
+    "code": "ST-DEFAULT",
+    "name": "Default Station",
+    "location": "Initial seed - change me",
+    "notes": null,
+    "active": true,
+    "created_by": 5,
+    "created_at": "2026-04-26T10:12:06"
+  }
+]
+```
+
+Errors:
+- 401: Missing or invalid API key
+- 403: Admin role required
+
+---
+
+#### POST `/stations`
+
+Create a station. **Admin only.**
+
+Request body:
+```json
+{
+  "code": "ST-LINEA-A",
+  "name": "Linea A — Tornitura alberi",
+  "location": "Reparto 2 — Cella 3",
+  "notes": "Provisioned 2026-04-26 by Adriano",
+  "active": true
+}
+```
+
+`code` (1-100 chars) and `name` (1-255 chars) are required. `location` is optional (≤ 255 chars). `active` defaults to `true`.
+
+Response `201`: same shape as `GET /stations` items.
+
+Errors:
+- 400: Invalid payload (missing `code`/`name`, exceeded length)
+- 403: Admin role required
+- 409: Station with that code already exists
+
+---
+
+#### GET `/stations/{station_id}`
+
+Get a single station by id. **Admin only.**
+
+Response `200`: same as the list item shape.
+
+Errors:
+- 403: Admin role required
+- 404: Station not found
+
+---
+
+#### PUT `/stations/{station_id}`
+
+Update a station's editable fields. **Admin only.**
+
+Request body (all fields optional):
+```json
+{
+  "name": "Linea A — riconfigurata",
+  "location": "Reparto 2 — Cella 4",
+  "notes": "Moved cell on 2026-05-12",
+  "active": false
+}
+```
+
+Note: the `code` field is not in the schema. Codes are immutable on purpose (changing the code would orphan every tablet pointing at it).
+
+Response `200`: the updated station.
+
+Errors:
+- 400: Invalid payload
+- 403: Admin role required
+- 404: Station not found
+
+---
+
+#### DELETE `/stations/{station_id}`
+
+Delete a station. **Admin only.**
+
+The deletion cascades to every row in `station_recipe_assignments` for that station. Existing measurements are NOT affected (measurements link to recipe versions, not stations).
+
+Response `204`: no body.
+
+Errors:
+- 403: Admin role required
+- 404: Station not found
+
+---
+
+#### GET `/stations/{station_id}/recipes`
+
+Admin view of the recipes currently assigned to a station. Returns the same projection used by the assignment modal in `/admin/stations`. **Admin only.**
+
+Response `200`:
+```json
+[
+  {
+    "id": 2,
+    "code": "DEMO-001",
+    "name": "Demo Measurement Recipe",
+    "active": true
+  }
+]
+```
+
+Errors:
+- 403: Admin role required
+- 404: Station not found
+
+---
+
+#### GET `/stations/by-code/{code}/recipes`
+
+**Operator view** (any authenticated user, no admin requirement). Returns the active recipes assigned to the station whose code matches `{code}`. The Flask client calls this endpoint at every page load of `/measure/select`, passing its own `STATION_CODE`.
+
+Response `200`: same shape as `GET /stations/{station_id}/recipes`.
+
+Errors:
+- 401: Missing or invalid API key
+- 404: Station not found OR station is not active (operator-facing endpoint deliberately treats both cases as 404 to avoid leaking the existence of disabled stations)
+
+---
+
+#### POST `/stations/{station_id}/recipes`
+
+Assign an existing recipe to a station. **Admin only.**
+
+Request body:
+```json
+{ "recipe_id": 2 }
+```
+
+Response `201`:
+```json
+{
+  "id": 1,
+  "station_id": 1,
+  "recipe_id": 2,
+  "assigned_by": 5,
+  "assigned_at": "2026-04-26T10:12:06"
+}
+```
+
+Errors:
+- 403: Admin role required
+- 404: Station or recipe not found
+- 409: Recipe already assigned to this station
+
+---
+
+#### DELETE `/stations/{station_id}/recipes/{recipe_id}`
+
+Remove an existing assignment. **Admin only.**
+
+Response `204`: no body.
+
+Errors:
+- 403: Admin role required
+- 404: Station/recipe not found, or no assignment between them
+
+---
+
 ### Statistics
 
 All statistics endpoints **require Metrologist role**.

docs/COLLAUDO.md

@@ -0,0 +1,191 @@
+# Scaletta di collaudo — V3.0.0
+
+Tredici dei quindici punti del 28/07 sono in esercizio e **nessuno li ha ancora
+percorsi**. Questa è la scaletta per farlo: ordinata in modo che ogni prova prepari
+la successiva, e scritta perché si possa spuntare riga per riga.
+
+Per ogni riga: cosa fare, e **come si vede che è giusto**. Se qualcosa non torna,
+annotare il testo esatto dell'eventuale errore in console — non «dava errore».
+
+Totale stimato: **circa 90 minuti**, di cui 30 sul solo punto 3 (il timer, che si
+misura aspettando).
+
+---
+
+## 0 · Preparazione (5 min)
+
+| | Cosa | Verifica |
+|---|---|---|
+| 0.1 | Aprire il sito e fare **ricarica forzata** (`Ctrl+Shift+R`) | CSS e JS sono in cache per 7 giorni: senza questo si collauda la versione di ieri |
+| 0.2 | Aprire la **console del browser** (`F12`) e lasciarla aperta per tutto il collaudo | Molte prove si leggono lì, non a schermo |
+| 0.3 | Verificare che esistano le ricette `COLLAUDO-A` e `COLLAUDO-B` | Sono in `/measure/select`. Se una sessione precedente le ha sporcate: `docker compose exec server uv run python /tmp/seed_collaudo.py --replace` (cancella anche le misure fatte su di esse) |
+
+**Credenziali del capoturno:** `capoturno` / `Collaudo2026!` — da cambiare prima di
+qualunque uso reale.
+
+**Le ricette:**
+
+- **COLLAUDO-A** — lotto obbligatorio, digitazione ammessa, intervallo **2 minuti**.
+  Cinque task: nota → misura (2 quote) → nota → misura (1 quota) → nota.
+- **COLLAUDO-B** — lotto **e** seriale obbligatori, **solo calibro**, una quota.
+
+**Le quote e i valori da usare** (tutte con nominale al centro):
+
+| Quota | Task | Nominale | Conforme | Attenzione | Fuori tolleranza |
+|---|---|---|---|---|---|
+| 1 · Diametro esterno | A, misura 1 | 10.00 | `10.00` | `10.30` | `12.00` |
+| 2 · Spessore parete | A, misura 1 | 25.00 | `25.00` | `25.30` | `27.00` |
+| 3 · Lunghezza totale | A, misura 2 | 100.00 | `100.00` | `100.70` | `105.00` |
+
+---
+
+## 1 · Layout — punto 14 (10 min) · **da monitor da scrivania**
+
+Va fatto **prima** e **non dal tablet**: in verticale su un tablet quasi tutte le
+larghezze coincidono e il difetto non si vede. Serve uno schermo largo.
+
+| | Cosa | Verifica |
+|---|---|---|
+| 1.1 | Percorrere Ricette → apri una ricetta → Task → Disegno → Anteprima, e tornare indietro | Il blocco di contenuto **non cambia larghezza** fra una schermata e l'altra |
+| 1.2 | Su ognuna, guardare il bordo sinistro del contenuto e quello della barra in alto | Sono **allineati**: il contenuto sta dentro la stessa cornice della navbar |
+| 1.3 | Passare da una pagina lunga (che scorre) a una corta (che non scorre) | Niente **salta di lato** di qualche pixel: lo spazio della barra di scorrimento è riservato sempre |
+| 1.4 | Entrare in un task di misura e uscirne | Stesso controllo: nessuno spostamento orizzontale |
+| 1.5 | Admin → Utenti, Stazioni, Impostazioni; poi il proprio Profilo | Utenti e Stazioni sono larghe, Impostazioni e Profilo strette — ma con **gli stessi margini esterni** |
+| 1.6 | **Dal tablet**, entrare in un task di misura | Il piede con «Fine ciclo misura» e il tastierino è visibile **senza scorrere**, anche quando la barra dell'indirizzo compare e sparisce |
+
+---
+
+## 2 · Niente arriva dalla rete — punto 12 (15 min)
+
+Da fare **adesso**, perché la Content-Security-Policy è appena entrata in vigore: se
+una libreria avesse bisogno di un permesso non concesso, il sintomo compare ora.
+
+> **Attenzione al metodo.** Il sistema è oggi su una VPS pubblica: staccare la rete
+> significherebbe perdere anche il server, quindi non prova niente. La prova
+> equivalente e più diretta è guardare **dove vanno le richieste**. Il giro a rete
+> davvero staccata si fa in reparto, sull'installazione on-premise.
+
+| | Cosa | Verifica |
+|---|---|---|
+| 2.1 | Console → scheda **Rete**, spuntare «Disabilita cache», ricaricare | Ordinando per dominio compare **un solo dominio**: `tieflow.tielogic.xyz`. Nessun `cdn`, `jsdelivr`, `cloudflare`, `googleapis`, `plot.ly` |
+| 2.2 | Ripetere su: login, selezione ricetta, esecuzione task, editor annotazioni (`/maker`), dashboard statistiche | Sempre un dominio solo. La dashboard è quella che carica Plotly, l'editor quella che carica Fabric |
+| 2.3 | Aprire un task che ha un **disegno PDF** allegato | Il disegno si vede. È la prova del *worker* di PDF.js: se cercasse la rete, tutto sembrerebbe a posto fino a questo momento |
+| 2.4 | Con la console aperta su ogni pagina del giro | **Zero** messaggi che iniziano con `Refused to load…` o `…violates the following Content Security Policy directive`. Se ce n'è uno, copiarlo per intero: dice quale permesso manca |
+| 2.5 | Generare un **report PDF** dalle statistiche | Il PDF esce. È generato sul server, non nel browser, ma vale la pena vederlo funzionare nel giro completo |
+
+---
+
+## 3 · Le regole della ricetta — punti 8 e 9 (10 min) · **COLLAUDO-B**
+
+| | Cosa | Verifica |
+|---|---|---|
+| 3.1 | `/measure/select`, **senza** compilare lotto e seriale | Sulla scheda di COLLAUDO-B il pulsante è spento e dice **«Compila prima: lotto, seriale»** |
+| 3.2 | Compilare **solo** il lotto | Il pulsante resta spento e ora chiede solo il **seriale** |
+| 3.3 | Provare ad andare a mano su `/measure/start/<id>` di COLLAUDO-B senza seriale | Rimanda alla selezione con il messaggio «Compila prima:». La regola non si aggira dall'indirizzo |
+| 3.4 | Compilare entrambi e avviare | Entra nel task |
+| 3.5 | Guardare il tastierino | I tasti numerici **non ci sono affatto** — non sono grigi, non ci sono. Restano «cancella» e «conferma» |
+| 3.6 | Con un **calibro USB** collegato, prendere una lettura | Il valore entra e si salva |
+| 3.7 | *(facoltativo, per chi vuole la prova dura)* Provare a salvare un valore digitato aggirando lo schermo | Il server risponde **422**: la regola vive lì, non nella pagina |
+
+---
+
+## 4 · Il primo ciclo e l'avvio produzione — punti 10 e 11 (10 min) · **COLLAUDO-A**
+
+> Da qui in avanti si lavora su COLLAUDO-A. **Il timer non parte subito**: prima si
+> fa un ciclo completo, poi compare «Avvio Produzione». È voluto — il primo pezzo è
+> l'attrezzaggio, non produzione.
+
+| | Cosa | Verifica |
+|---|---|---|
+| 4.1 | Selezione ricetta → COLLAUDO-A → lotto `LOT-TEST-01` → **AVVIA IN SEQUENZA** | Si apre **il primo task** (la nota «Preparazione del pezzo»), **non** l'elenco dei task |
+| 4.2 | Leggere la nota | «a sinistra» è in **grassetto**, le righe vanno a capo e la riga vuota si vede (punto 11) |
+| 4.3 | Guardare i due pulsanti in alto a destra | Sono **«Lista task»** e **«Completato»**. Su una nota «Completato» è attivo |
+| 4.4 | Premere «Completato» | Passa al task 2, «Misura 1 — diametro e spessore» |
+| 4.5 | Guardare il pulsante in basso a destra | **«Mancano 2 quote»**, grigio e non cliccabile |
+| 4.6 | Misurare la quota 1 con `10.00` e confermare | Verde (conforme). Il pulsante in basso ora dice **«Manca 1 quota»** |
+| 4.7 | **Prova chiave del punto 10**: premere «Lista task» adesso, a metà | Nel'elenco il task «Misura 1» porta **«Incompiuto 1/2»** con il bordo ambra. Gli altri non dicono niente |
+| 4.8 | Premere **«Visualizza singolo TASK»** su quel task | Ci si torna dentro, con la quota già presa |
+| 4.9 | Misurare la quota 2 con `25.00` | Il pulsante in basso diventa blu: **«Fine ciclo misura»** |
+| 4.10 | Premerlo | Compare il verde **«Task successivo»** (non un secondo «Completato») |
+| 4.11 | Guardare sotto il piede della pagina | Compare il pulsante verde **«Avvio Produzione»** |
+| 4.12 | Premere «Avvio Produzione» | Parte il conto alla rovescia da **2 minuti**. Da qui in avanti compaiono «Fermo linea» e «Fine produzione» |
+
+---
+
+## 5 · Il fuori tolleranza — punto 5 (15 min)
+
+La parte più importante del collaudo: fino a ieri questo gate era una modale che si
+poteva chiudere.
+
+| | Cosa | Verifica |
+|---|---|---|
+| 5.1 | Tornare su «Misura 1». Cliccare la **quota 1** in alto per rimisurarla, e inserire `12.00` | Si salva ed è **rossa**. La misura sbagliata resta a registro: è un dato, non un errore da nascondere |
+| 5.2 | Provare a passare alla **quota 2** e salvare un valore | **Rifiutato.** Compare l'avviso che serve l'autorizzazione |
+| 5.3 | Guardare «Completato» in alto | È **spento**, e passandoci sopra dice «Serve l'autorizzazione del capoturno» |
+| 5.4 | **Ricaricare la pagina** (`F5`) | Il blocco **è ancora lì**. Ricaricare non è una via d'uscita |
+| 5.5 | **La via d'uscita senza capoturno**: cliccare di nuovo la quota 1 e rimisurarla con `10.00` | Il blocco **si scioglie**. È voluto: il calibro scivola, il pezzo si riposiziona, e chiamare il capoturno per questo sarebbe assurdo |
+| 5.6 | Rifarlo: quota 1 con `12.00`, e stavolta **autorizzare** con `capoturno` / `Collaudo2026!` | Il blocco si scioglie e la misura resta segnata come autorizzata |
+| 5.7 | Provare ad autorizzare con una password sbagliata | Rifiutato, e il blocco **resta** |
+| 5.8 | Provare ad autorizzare con un utente **senza** ruolo Supervisor (es. l'operatore stesso) | Rifiutato: non basta essere collegati, serve il ruolo |
+| 5.9 | Rimettere `10.00` sulla quota 1 e `25.00` sulla 2, chiudere il ciclo | Si prosegue normalmente |
+
+---
+
+## 6 · Il ciclo di misura — punto 3 (30 min, quasi tutti di attesa)
+
+| | Cosa | Verifica |
+|---|---|---|
+| 6.1 | Con il conto alla rovescia in corso, **cambiare task** | Il tempo residuo **prosegue**, non riparte da 2 minuti |
+| 6.2 | **Ricaricare la pagina** (`F5`) | Idem: il tempo è lo stesso. Vive sul server, non nella pagina |
+| 6.3 | Fermarsi su una **nota** e lasciare scadere l'intervallo | A ~5 secondi dalla scadenza compare l'avviso e **suona il cicalino** |
+| 6.4 | Non toccare niente | Alla scadenza si viene portati **al primo task di misura** della ricetta, non a quello dove si era |
+| 6.5 | Fare un ciclo completo: misura 1 (2 quote) → nota → **misura 2** (quota 3, `100.00`) → «Fine ciclo misura» | Chiudendo il ciclo **sull'ultimo task di misura** l'intervallo **riparte da 2 minuti** |
+| 6.6 | Ripetere ma chiudendo il ciclo sulla **prima** misura | L'intervallo **non** riparte: il ciclo si chiude solo sull'ultimo task di misura |
+| 6.7 | **La prova più delicata**: stare **dentro** un task di misura, con una quota già presa e una da prendere, e lasciare scadere l'intervallo | **Non** si viene spostati. Il conteggio diventa **rosso** e prosegue **oltre lo zero**, mostrando il ritardo. Chi sta misurando va lasciato finire |
+| 6.8 | Usare **«Rimisura»** dopo aver completato le quote | Registra una seconda lettura dello stesso pezzo **senza** far ripartire l'intervallo. Girare il pezzo e rimisurare non è un pezzo nuovo |
+
+---
+
+## 7 · Fermo linea e fine produzione — punto 6 (10 min)
+
+| | Cosa | Verifica |
+|---|---|---|
+| 7.1 | Dentro un task di misura, premere **«Fermo linea»** → credenziali capoturno | Il conto alla rovescia **si ferma** |
+| 7.2 | Ricaricare la pagina | È ancora fermo: lo stato è sul server |
+| 7.3 | Premere **«Ripresa»** → credenziali | Riparte |
+| 7.4 | Premere **«Fine produzione»** → credenziali | La produzione si chiude |
+| 7.5 | Sul server: `docker compose exec server ls uploads/statistics/` | C'è un file `production_<id>_<data>.csv` |
+| 7.6 | Aprire il file | Contiene **tutte** le misure della produzione, compresi i `12.00`. Sulla riga autorizzata le colonne `authorised_by` e `authorised_at` sono **valorizzate**: il file mostra il guasto **e** la decisione |
+| 7.7 | Aprire il file in Excel | Le accentate si leggono, il separatore è quello configurato |
+
+---
+
+## 8 · La statistica resta separata — punto 15 (5 min)
+
+| | Cosa | Verifica |
+|---|---|---|
+| 8.1 | Collegarsi con un utente che ha **solo** il ruolo MeasurementTec | In barra **non c'è** la voce Statistiche |
+| 8.2 | Percorrere tutto il flusso operatore guardando ogni schermata | Nessun collegamento porta alla statistica, in nessun punto |
+| 8.3 | Andare a mano su `/statistics/dashboard` | **403**: il ruolo non basta |
+| 8.4 | Verificare che le misure ci siano comunque | Con un utente Metrologist, le misure appena fatte compaiono in dashboard. Si registra sempre, si consulta a parte |
+
+---
+
+## Cosa annotare
+
+Per ogni riga che non torna:
+
+1. **Numero della riga** di questa scaletta.
+2. **Cosa è successo** invece di quello che c'è scritto.
+3. Se c'è un errore in console, il **testo esatto**, per intero.
+4. Se è un problema di aspetto, uno **screenshot** e su **quale schermo** (tablet o
+   monitor, e in che orientamento) — per il punto 14 è l'informazione che manca.
+
+## Cosa questa scaletta non copre
+
+- Il **punto 4** (numero di tentativi prima del capoturno) non è implementato: è
+  fermo sulle risposte del cliente (D-6, D-7, D-9).
+- Il **cicalino** è il suono del browser. Se serva una colonnina luminosa è D-5.
+- Il giro a **rete davvero staccata** si fa in reparto, sull'installazione
+  on-premise: qui si prova l'equivalente (nessuna richiesta esce dal dominio).
+- Il **carico** con venti tablet insieme non è mai stato misurato.

docs/DEPLOYMENT.md

@@ -134,10 +134,11 @@ SSL_KEYFILE=
 | `CLIENT_HOST` | string | 0.0.0.0 | Flask client bind address |
 | `CLIENT_PORT` | int | 5000 | Flask client port |
 | `SERVER_CORS_ORIGINS` | string | http://localhost:5000 | Comma-separated CORS origins |
-| `UPLOAD_DIR` | string | uploads | Directory for file uploads |
+| `UPLOAD_DIR` | string | uploads | Directory for file uploads (resolved against the project root) |
 | `MAX_UPLOAD_SIZE_MB` | int | 50 | Maximum upload file size in MB |
-| `RATE_LIMIT_LOGIN` | int | 5 | Login requests per minute |
-| `RATE_LIMIT_GENERAL` | int | 100 | General requests per minute |
+| `RATE_LIMIT_LOGIN` | int | 5 | Login requests per minute, per real client IP |
+| `RATE_LIMIT_GENERAL` | int | 300 | General requests per minute, per real client IP (post-V2.0.0; was 100 in V1.0.x) |
+| `STATION_CODE` | string | (empty) | **Per-tablet** code identifying the station this Flask client serves. Must match a station created in the admin UI. Empty = the client refuses `/measure/select` with HTTP 503 "Stazione non configurata". |
 | `SSL_CERTFILE` | string | (empty) | Path to SSL certificate (production) |
 | `SSL_KEYFILE` | string | (empty) | Path to SSL private key (production) |
 

docs/I18N_SETUP.md

@@ -10,7 +10,7 @@ TieMeasureFlow supports complete internationalization (i18n) with:
 ## Directory Structure
 
 ```
-client/
+src/frontend/flask_app/
 ├── translations/               # Flask-Babel translations
 │   ├── babel.cfg              # Extraction config
 │   ├── it/LC_MESSAGES/
@@ -99,7 +99,7 @@ flash(_("Profilo aggiornato con successo"))
 After editing .po files:
 
 ```bash
-cd client
+cd src/frontend/flask_app
 python compile_translations.py
 ```
 

docs/README.md

@@ -0,0 +1,50 @@
+# Documentazione TieMeasureFlow
+
+Indice della documentazione del progetto.
+
+## Stato e direzione
+
+| Documento | Scopo |
+|---|---|
+| [`../TieMeasureFlow_modifiche_2026-07-28.md`](../TieMeasureFlow_modifiche_2026-07-28.md) | **Il piano di lavoro corrente**: i quindici punti del sopralluogo del 28/07 e le decisioni in attesa del cliente (D-1…D-9). |
+| [`architecture/STATO_PROGETTO.md`](architecture/STATO_PROGETTO.md) | Cosa è fatto oggi (V3.0.0), punto per punto, e cosa non è ancora stato provato sul campo. |
+| [`architecture/ROADMAP.md`](architecture/ROADMAP.md) | Cosa resta, in ordine: collaudo, punto 4, innesto GAIA, installazione a Tràfilo. Include la mappatura con le Fasi rev04 di aprile. |
+| [`architecture/LAYOUT.md`](architecture/LAYOUT.md) | La cornice delle pagine: perché il layout si spostava fra le viste e la regola che lo tiene fermo. |
+| [`../src/frontend/flask_app/static/vendor/VERSIONS.md`](../src/frontend/flask_app/static/vendor/VERSIONS.md) | Librerie di terze parti in locale: versioni, impronte SHA-256, come aggiornarle. |
+
+## Riferimenti operativi
+
+| Documento | Scopo |
+|---|---|
+| [`API.md`](API.md) | Riferimento endpoint REST esposti dal backend FastAPI. |
+| [`DEPLOYMENT.md`](DEPLOYMENT.md) | Guida deploy su VPS (Hostinger/Tielogic con Traefik + Let's Encrypt). |
+| [`USER_GUIDE.md`](USER_GUIDE.md) | Manuale utente (operatore, maker, metrologist, admin). |
+| [`I18N_SETUP.md`](I18N_SETUP.md) | Setup e workflow traduzioni (Flask-Babel + Alpine.js). |
+| [`COLLAUDO.md`](COLLAUDO.md) | **Scaletta di collaudo V3.0.0**: cosa provare, in che ordine, con quali valori, e come si vede che è giusto. |
+
+## Piani dettagliati TDD (rev04) — storici
+
+> Il piano rev04 di aprile è **superato** dal documento del 28/07. La mappatura fra
+> le sue sette Fasi e i quindici punti correnti è in fondo a `architecture/ROADMAP.md`.
+
+| Documento | Scopo |
+|---|---|
+| [`superpowers/plans/2026-04-17-rev04-master-roadmap.md`](superpowers/plans/2026-04-17-rev04-master-roadmap.md) | Master plan rev04 V1.0.7 → V1.1.0, le 7 fasi e le decisioni aperte. |
+| [`superpowers/plans/2026-04-17-rev04-phase1-stations.md`](superpowers/plans/2026-04-17-rev04-phase1-stations.md) | Piano TDD dettagliato Fase 1 (stazioni e identità per-tablet). **COMPLETATO.** |
+
+## Specifiche esterne (binari)
+
+| Documento | Scopo |
+|---|---|
+| [`specs/2026-04-16-schema-sviluppo-rev04.docx`](specs/2026-04-16-schema-sviluppo-rev04.docx) | Schema sviluppo SW TieFlow rev04-2026 fornito dal committente. |
+
+## Storico
+
+| Documento | Scopo |
+|---|---|
+| [`archive/2026-02-06-piano-implementazione-v1.md`](archive/2026-02-06-piano-implementazione-v1.md) | Piano implementazione V1.0.0 originale (riferimento storico). |
+
+## Ulteriori riferimenti nel repo
+
+- [`/CLAUDE.md`](../CLAUDE.md) — guidance per Claude Code (architettura, comandi, pattern critici).
+- [`/README.md`](../README.md) — entry point del progetto.

docs/USER_GUIDE.md

@@ -37,6 +37,8 @@ TieMeasureFlow is a web-based measurement management system that enables teams t
 | **Subtask** | Individual measurement point with tolerance limits (UTL/UWL/LWL/LTL) |
 | **Measurement** | Individual recorded value with automatic pass/fail/warning status |
 | **Lot/Serial** | Traceability fields linking measurements to physical parts |
+| **Station** | A physical measurement post (typically one tablet on a production line). Each station has a unique code (`STATION_CODE`) and a list of assigned recipes |
+| **Station assignment** | Many-to-many link between a station and the recipes available to the operators using that station's tablet |
 
 ### Architecture
 
@@ -175,23 +177,25 @@ TieMeasureFlow has four primary roles. Users can have multiple roles simultaneou
 
 ### Admin
 
-**Purpose:** System administration and user management
+**Purpose:** System administration, user management and station deployment
 
 **Permissions:**
 - Create/edit/delete users
 - Assign roles to users
 - Regenerate user API keys
+- Create/edit/delete stations and assign recipes to them
 - Configure system settings
 - Upload company logo
 - Manage CSV export settings
 
 **Access:**
-- Menu: **Admin** → User Management
-- Can see: All users and system settings
+- Menu: **Admin** → Utenti / Stazioni
+- Can see: All users, all stations and system settings
 
 **Typical Tasks:**
 - Onboard new users
 - Reset lost API keys
+- Roll out a new tablet: create the matching station, assign recipes, hand the `STATION_CODE` to devops
 - Configure locale/format settings
 - Upload company branding
 - Manage system access
@@ -276,6 +280,12 @@ When you edit a recipe (add/remove tasks, change tolerances), a **new version**
 
 ## MeasurementTec Workflow
 
+### Recipes you see are filtered by station
+
+Each tablet/PC running the Flask client is configured at deployment time with a `STATION_CODE` environment variable (for example `ST-LINEA-A`). Whenever you open **Select Recipe**, the page only lists recipes that the admin has assigned to that station. If your tablet shows fewer recipes than you expect, ask the admin to assign the missing recipes to your station — see **Admin Workflow → Station Management**.
+
+If the page shows "Stazione non configurata" (HTTP 503), the deployment is missing the `STATION_CODE` setting; this is a deploy-time configuration issue, not something the operator can fix from the UI.
+
 ### Select a Recipe
 
 **Method 1: Search**
@@ -503,6 +513,82 @@ If user loses their API key:
 4. New key is generated and displayed
 5. Provide new key to user (display once only)
 
+### Station Management
+
+Stations are how TieMeasureFlow enforces "this tablet is responsible for these measurements". Each physical measurement post in the shop floor is modelled as a station; each tablet's Flask client identifies itself through a `STATION_CODE` env var that must match a station's code in the database.
+
+The page is reachable from the navbar entry **"Stazioni"** (workstation icon) for any user with the admin flag, or directly at `/admin/stations`.
+
+#### Mental model
+
+- **One station = one tablet/PC** in the shop floor. The station's identity (`STATION_CODE`) is configured **once at deploy time** in the tablet's `.env`, never changed at runtime.
+- A station has a list of **assigned recipes**. The operator using that tablet sees exactly that list — no more, no less.
+- A recipe can be assigned to several stations (e.g. a calibration recipe everyone needs).
+- A station can be temporarily **disabled** (`active = false`) to take a line offline without losing its history; tablets pointing at a disabled station get HTTP 404 from the recipe endpoint.
+
+#### Create a Station
+
+1. Navigate to **Admin** → **Stazioni**
+2. Click **Nuova Stazione**
+3. Fill in the modal:
+   - **Codice** (required, unique): `ST-LINEA-A`. This is the value the tablet will set as `STATION_CODE` in its `.env`. Use ASCII letters, digits and hyphens only — no spaces, no accented characters. Once created the code cannot be changed (changing it would break every tablet pointing at it).
+   - **Nome** (required): human-readable description, e.g. `Linea A — Tornitura alberi`.
+   - **Postazione** (optional): physical location, e.g. `Reparto 2 — Cella 3`.
+   - **Note** (optional): free text, useful for tracking who set up the station.
+   - **Attiva** (default checked): uncheck only when retiring the station.
+4. Click **Crea Stazione**
+
+Naming convention: prefix every station code with `ST-` and use a stable identifier that survives shop-floor reorganisations.
+
+#### Assign Recipes to a Station
+
+1. From the stations table, click the **checklist icon** on the row of the target station
+2. The "Ricette Assegnate" modal opens with two columns:
+   - **Ricette disponibili** (left): every recipe in the system not yet assigned to this station. Each row has an inline **+ Assegna** button that immediately moves the recipe to the right column.
+   - **Assegnate alla stazione** (right): the list the operator at this station's tablet will see. The **X** button removes the assignment.
+3. Use the search field at the top to narrow either column by recipe code or name
+4. Empty-state hints tell you why a column is empty:
+   - "Tutte le ricette sono già assegnate" — nothing more to assign
+   - "Nessuna ricetta nel sistema" — create at least one recipe first (Maker workflow)
+   - "Nessun risultato per il filtro" — clear the search
+
+The assignment audit trail (`assigned_by`, `assigned_at`) is stored on the server but not currently shown in the UI.
+
+#### Edit a Station
+
+1. Click the **pencil icon** (or the row itself) for the target station
+2. Update **Nome**, **Postazione**, **Note** or the **Attiva** flag
+3. Click **Salva Modifiche**
+
+The **Codice** field is read-only on edit because the value is contractually bound to the `STATION_CODE` set on already-deployed tablets. To rename a station you must delete it and create a new one with the new code, then update every affected tablet's `.env`.
+
+#### Delete a Station
+
+1. Click the **trash icon** for the station
+2. Confirm in the modal
+
+Deletion cascades to **all recipe assignments** for that station. Existing measurements collected by tablets at that station are not affected (measurements are linked to recipe versions, not stations).
+
+#### The `ST-DEFAULT` station
+
+The first time `/api/setup/seed` runs, it creates a station called `ST-DEFAULT` and assigns every demo recipe to it. This is intended for single-tablet demos and dev setups where no per-station segmentation is needed.
+
+In multi-station production deployments you should either:
+
+- Delete `ST-DEFAULT` once your real stations are configured, or
+- Disable it (`Attiva` off), to prevent a misconfigured tablet from accidentally inheriting the default assignment set.
+
+#### Tablet deployment cheat sheet
+
+For each new physical tablet:
+
+1. Admin creates the station in the UI (e.g. `ST-LINEA-A`)
+2. Admin assigns the relevant recipes
+3. Devops sets `STATION_CODE=ST-LINEA-A` in the tablet's `.env`
+4. Tablet container starts; the operator opens **Measure → Select Recipe** and sees the curated list
+
+If step 3 is missed, **Select Recipe** shows the page "Stazione non configurata" — this is the intentional fail-fast behaviour to prevent a tablet from silently falling back to the wrong recipe set.
+
 ### System Settings
 
 #### Configure CSV Export

docs/architecture/LAYOUT.md

@@ -0,0 +1,98 @@
+# Cornice delle pagine
+
+Nasce dal punto 14 del documento del 28/07: *«le dimensioni delle viste cambiano a
+seconda del menu; passando da una schermata all'altra la finestra non mantiene
+proporzioni stabili»*. La segnalazione era di un operatore e non era ancora stata
+circoscritta sul codice. Questo è l'esito della circoscrizione e la regola che ne
+è uscita.
+
+## Cosa succedeva
+
+Tre meccanismi distinti, tutti verificabili sul codice senza avere il tablet in mano.
+
+**1. Ogni vista si dichiarava la propria larghezza.** Sette valori diversi su
+diciassette template, e nessuno coincideva con quello della navbar, che sta a
+`max-w-7xl` su tutte le pagine. Il contenuto risultava quindi disallineato dalla
+barra sopra di sé, e il disallineamento cambiava da pagina a pagina.
+
+| vista | prima | dopo |
+|---|---|---|
+| `measure/select_recipe.html` | `max-w-7xl` `py-8` | `tmf-page` |
+| `measure/task_list.html` | `max-w-5xl` `py-8` | `tmf-page` |
+| `measure/task_complete.html` | `max-w-7xl` `py-6` | `tmf-page` |
+| `maker/recipe_list.html` | `max-w-6xl` `py-8` | `tmf-page` |
+| `maker/task_editor.html` | `max-w-5xl` `py-8` | `tmf-page` |
+| `maker/task_drawing.html` | `max-w-5xl` `py-8` | `tmf-page` |
+| `maker/recipe_preview.html` | `max-w-5xl` `py-8` | `tmf-page` |
+| `admin/stations.html` | `max-w-7xl` `py-6` | `tmf-page` |
+| `admin/users.html` | `max-w-7xl` `py-6` | `tmf-page` |
+| `statistics/dashboard.html` | `max-w-7xl` `py-6` | `tmf-page` |
+| `admin/settings.html` | `max-w-3xl` `py-6` | `tmf-page tmf-page-narrow` |
+| `auth/profile.html` | `max-w-4xl` `py-8` | `tmf-page tmf-page-narrow` |
+| `maker/recipe_editor.html` | `max-w-4xl` `py-8` | `tmf-page tmf-page-narrow` |
+| `maker/version_history.html` | `max-w-4xl` `py-8` | `tmf-page tmf-page-narrow` |
+| `errors/station_not_configured.html` | `max-w-2xl` `py-8` | `tmf-page tmf-page-narrow` |
+
+Il percorso dell'operatore — quello da cui è arrivata la segnalazione — faceva
+`1280px → 1024px → tutto schermo → 1280px` in quattro passaggi.
+
+**2. Il padding verticale non era lo stesso.** `py-8` e `py-6` mescolati fra viste
+consecutive: la prima card si trovava a un'altezza diversa a ogni cambio di
+schermata.
+
+**3. La barra di scorrimento appariva e spariva.** È una barra classica da 8px
+(`themes.css`, `::-webkit-scrollbar`), quindi occupa spazio nel layout. Una pagina
+lunga la mostrava, una corta no, e la schermata di misura la toglie sempre
+(`body { overflow: hidden }`): a ogni navigazione tutto il contenuto centrato —
+navbar compresa — si spostava di 8px in orizzontale.
+
+## La regola
+
+Due classi in `static/css/themes.css`, nessuna larghezza nei template.
+
+- **`.tmf-page`** — la cornice: `max-width: 80rem`, padding `1rem / 1.5rem / 2rem`
+  ai tre breakpoint, `padding-block: 1.5rem`. Sono esattamente i valori della
+  navbar (`max-w-7xl px-4 sm:px-6 lg:px-8`), così il contenuto ci si allinea.
+- **`.tmf-page-narrow`** — si aggiunge alla prima e stringe a `56rem`. È per i
+  moduli: un campo di testo largo 1280px non si compila meglio.
+- **`html { scrollbar-gutter: stable }`** — lo spazio della barra è riservato
+  sempre, anche dove la pagina non scorre.
+- **`body.h-screen { height: 100dvh }`** — la schermata di misura è alta quanto la
+  finestra vera. `100vh` su Android e iOS è l'altezza che la pagina avrebbe con la
+  barra dell'indirizzo nascosta: su un tablet il piede della schermata — dove
+  stanno «Fine ciclo misura» e il tastierino — finiva sotto il bordo, e ricompariva
+  quando la barra si ritraeva.
+
+Due larghezze in tutto il prodotto al posto di sette, e il criterio è il tipo di
+pagina: liste, tabelle e tele di disegno stanno larghe, i moduli stanno stretti.
+
+## Le due eccezioni
+
+Hanno geometria propria per un motivo, e sono elencate in
+`tests/test_layout_shell.py` perché non sembrino dimenticate.
+
+- **`auth/login.html`** — schermata piena senza navbar: non c'è niente a cui
+  allinearsi.
+- **`measure/task_execute.html`** — la schermata di misura è un pannello a tutta
+  altezza che non deve scorrere mentre un operatore sta misurando
+  (`h-screen overflow-hidden`, footer nascosto). È l'unica vista in cui il cambio
+  di forma è voluto, ed è anche l'unica in cui l'operatore si ferma a lavorare:
+  entrarci e uscirne resta un salto, ma ora è l'unico.
+
+## Cosa resta da verificare sul campo
+
+La segnalazione non è mai stata riprodotta su un dispositivo: quanto sopra viene
+dalla lettura del codice, non da una prova. Quello che è dimostrato è che il
+layout *poteva* muoversi per quattro motivi distinti e che ora non può più per
+nessuno dei quattro.
+
+Se l'operatore vedesse ancora spostamenti, il sospetto successivo è la **tastiera
+virtuale**: quando compare, il browser ridimensiona la finestra, e con `100dvh` la
+schermata di misura si ridimensiona con lei invece di scorrere sotto. È il
+comportamento giusto per il tastierino a schermo, ma va guardato con un calibro
+USB collegato, dove la tastiera di sistema non dovrebbe comparire affatto.
+
+Da chiedere all'operatore che ha aperto la segnalazione: **su quale schermo** l'ha
+vista. Su un tablet in verticale la maggior parte delle larghezze qui sopra
+collassa allo stesso valore e il difetto non si vede; su un monitor da scrivania
+si vede tutto.

docs/architecture/ROADMAP.md

@@ -0,0 +1,146 @@
+# Roadmap TieMeasureFlow — V3.0.0 → installazione a Tràfilo
+
+> Aggiornata al 2026-07-28. Aggiornare a ogni punto chiuso.
+
+## Dove siamo
+
+La roadmap rev04 di aprile (Fasi 1-7, milestone M1/M2) è **superata dai fatti**: il
+sopralluogo del 28/07 ha prodotto un elenco di quindici punti concreti che è oggi il
+piano di lavoro. Buona parte delle vecchie Fasi 2 e 4 è dentro quei punti ed è già
+fatta; il resto è confluito o decaduto. La mappatura è in fondo, per non perdere il
+filo con i documenti di aprile.
+
+- Piano corrente: [`../../TieMeasureFlow_modifiche_2026-07-28.md`](../../TieMeasureFlow_modifiche_2026-07-28.md)
+- Stato di dettaglio: [`STATO_PROGETTO.md`](STATO_PROGETTO.md)
+- Piano rev04 (storico): [`../superpowers/plans/2026-04-17-rev04-master-roadmap.md`](../superpowers/plans/2026-04-17-rev04-master-roadmap.md)
+
+**Scadenza che comanda tutto: l'installazione on-premise a Tràfilo è prevista per
+settembre 2026.**
+
+## I quindici punti
+
+| # | Punto | Stato |
+|---|---|---|
+| 1 | Memoria della produzione in corso | ✅ fatto |
+| 2 | Tipo di task esplicito | ✅ fatto |
+| 3 | Loop di misura e ripetizione | ✅ fatto |
+| 4 | Limite di tentativi prima del capoturno | ⛔ **fermo** su D-6, D-7, D-9 |
+| 5 | Avanzamento solo se in tolleranza | ✅ fatto |
+| 6 | Fermo linea e Fine produzione con effetto | ✅ fatto (innesto GAIA fermo su D-1, D-2) |
+| 7 | Gestione delle stazioni | ✅ fatto |
+| 8 | Tracciabilità obbligatoria | ✅ fatto |
+| 9 | Blocco dell'inserimento manuale | ✅ fatto |
+| 10 | Interfaccia operatore: sequenza e conferme | ✅ fatto |
+| 11 | Formattazione delle descrizioni | ✅ fatto |
+| 12 | Funzionamento senza internet | ✅ fatto |
+| 13 | Generazione task dalla scheda tecnica con l'AI | — fuori offerta (quotazione su D-8) |
+| 14 | Stabilità del layout | ✅ fatto |
+| 15 | Statistica separata dalla registrazione | ✅ fatto |
+
+## Cosa resta, in ordine
+
+### 1. Collaudo sul campo — *da fare adesso, non serve nessuna risposta*
+
+È il lavoro più urgente rimasto, ed è l'unico che non dipende da nessuno. Tredici
+punti sono in esercizio e **nessuno li ha percorsi su un tablet**.
+
+Le ricette `COLLAUDO-A` e `COLLAUDO-B` sono già sul sistema, con un utente
+`capoturno` (`scripts/seed_collaudo.py`). Da verificare, in quest'ordine:
+
+| Cosa | Come si vede che è giusto |
+|---|---|
+| Ciclo di misura (3) | Il conto alla rovescia sopravvive al cambio task, prosegue in rosso oltre lo zero, riporta alla misura |
+| Fuori tolleranza (5) | Con `12.00` sulla prima quota non si passa alla seconda finché il capoturno non autorizza, o finché non si rimisura dentro |
+| Tracciabilità (8) | Su `COLLAUDO-B` l'avvio non parte finché lotto e seriale non ci sono |
+| Inserimento manuale (9) | Su `COLLAUDO-B` il tastierino numerico non c'è affatto |
+| Sequenza (10) | La ricetta si apre sul primo task; un task lasciato a metà appare «Incompiuto 1/2» nella lista |
+| Senza rete (12) | Staccare la rete e percorrere login → ricetta → task → annotazione → statistiche → report, console aperta |
+| Layout (14) | **Da un monitor da scrivania**, non solo dal tablet: è lì che il difetto si vedeva |
+
+Il giro del punto 12 va fatto **ora**, perché la Content-Security-Policy è appena
+entrata in vigore: se una libreria avesse bisogno di un permesso non concesso, il
+sintomo compare adesso.
+
+### 2. Punto 4 — appena arrivano le risposte
+
+Numero di tentativi prima del capoturno. Serve sapere **D-7** (quanti, e se uguali
+per tutte le ricette), **D-6** (password, PIN o badge) e **D-9** (se cambiare i
+parametri crea una nuova versione). Il resto dell'impianto è pronto: il blocco per
+fuori tolleranza e l'autorizzazione del capoturno esistono già, manca il contatore.
+
+Stima, a decisioni chiuse: **2-3 giorni**.
+
+### 3. Innesto verso GAIA — fermo su D-1 e D-2
+
+Avvio produzione, fermo linea e fine produzione hanno già lo stato e gli eventi; la
+fine produzione emette già il file di statistica. Manca solo il canale verso il
+gestionale, e non si può nemmeno disegnare finché non si sa **come** si parla con
+GAIA (D-1) e **da dove** (D-2).
+
+Stima, a protocollo noto: **1-2 settimane**, molto dipendente dalla risposta.
+
+### 4. Installazione a Tràfilo — settembre
+
+| Cosa | Blocco |
+|---|---|
+| Macchina server, spazio disco | D-4 |
+| Immagini Docker portate in reparto, non repository da compilare sul posto | — |
+| Colonnina luminosa, se serve | D-5 |
+| Validazione rete e macchine con l'IT | D-4 |
+
+Nota: **la costruzione delle immagini richiede rete** (npm, apt, uv); è l'esecuzione
+a non richiederla. In reparto va portata l'immagine già costruita.
+
+## Decisioni in attesa del cliente
+
+Da girare a Tràfilo tramite Menoncin. Le prime due e la D-4 hanno l'orizzonte di
+settembre; D-6 e D-7 bloccano lavoro che sappiamo già fare.
+
+| ID | Decisione | Blocca | Chi risponde |
+|---|---|---|---|
+| **D-1** | Protocollo del gestionale GAIA: servizi web, database condiviso, file? | innesto GAIA (punto 6) | IT Tràfilo + fornitore GAIA |
+| **D-2** | Rete e credenziali per raggiungere GAIA | come sopra | IT Tràfilo |
+| ~~D-3~~ | ~~Una app per stazione o una sola?~~ **Decisa il 28/07**: dati sul server, app di stazione su ogni PC | — | chiusa; validazione in D-4 |
+| **D-4** | Server: quale macchina, quanto spazio disco (database **e** disegni) | installazione | IT Tràfilo |
+| **D-5** | Cicalino: basta il suono del browser o serve una colonnina luminosa? | punto 3 (completamento) | Tràfilo |
+| **D-6** | Autorizzazione capoturno: password come oggi, o PIN / badge? Venti volte al giorno la password è attrito | punti 4, 5, 6 | Tràfilo |
+| **D-7** | Quanti tentativi prima del capoturno, e uguali per tutte le ricette? | punto 4 | Tràfilo |
+| **D-8** | Schede tecniche: quante, formato standard, conversione una-tantum o funzione permanente? | punto 13 e la sua quotazione | Tràfilo |
+| **D-9** | Cambiare i parametri di una ricetta (timer, tentativi) crea una nuova versione? | punti 3, 4 | noi, con conferma cliente |
+
+Una decisione già presa che va **confermata**: la migrazione 009 ha impostato
+`allow_manual_input = 1` su tutte le ricette esistenti, per conservare il
+comportamento in essere invece di irrigidire di colpo ricette già in uso. Va deciso
+ricetta per ricetta quali devono passare a solo calibro.
+
+## Tech debt
+
+| Item | Priorità | Note |
+|---|---|---|
+| `components/barcode_scanner.html` dipende da `html5-qrcode`, mai caricata | Media | Codice morto: il componente non è incluso da nessuna parte e il lettore che l'operatore usa è un campo di testo. Da rimuovere, o da completare portando la libreria in `static/vendor/` |
+| Pagina `task_complete`: riga vuota segnalata in alcuni scenari | Media | Segnalazione di aprile mai riprodotta. Da verificare durante il collaudo, ora che il flusso è cambiato |
+| `.env` rename a convenzione spec (SERVICE_NAME, SERVICE_DOMAIN, API_KEY) | Bassa | Rinviato: impatta i deploy esistenti |
+| Header `X-API-Key` → `X-Api-Key` | Bassa | Breaking per i deploy esistenti |
+| Envelope risposta `{success,data,error}` | Bassa | Eventuale API v2 |
+| Test di carico a 20 tablet reali | Bassa | La capacità è dimensionata ma mai misurata sotto carico vero |
+
+I quattro test rotti tracciati nello snapshot V2.0.0 non risultano più: la suite è a
+360 pass, 0 fail.
+
+## Mappatura con la roadmap rev04 di aprile
+
+Per chi torna sui documenti di aprile e non ritrova le Fasi.
+
+| Fase rev04 | Che fine ha fatto |
+|---|---|
+| 1 — Stazioni per-tablet | Chiusa in V2.0.0, ampliata dal punto 7 |
+| 2 — Ruolo Capoturno + override | Assorbita dai punti 5 e 6: il ruolo `Supervisor` esiste e l'autorizzazione resta scritta sulla misura. L'override a token breve dipende da D-6 |
+| 3 — Editor ricetta a blocchi | Sostituita dal punto 2 (tipo di task dichiarato), che risolve il problema vero senza riscrivere l'editor |
+| 4 — Workflow operatore | Assorbita dai punti 3, 4, 10: timer e sequenza sono fatti, i tentativi sono il punto 4 |
+| 5 — Import GAIA | Diventata l'innesto del punto 6, ferma su D-1 e D-2 |
+| 6 — Deploy industriale (registry + Watchtower) | Ridimensionata: con una rete isolata l'aggiornamento automatico non ha senso. Restano immagini versionate portate a mano |
+| 7 — Hardening | Parzialmente assorbita: CSP, versioni congelate e impronte sono entrate col punto 12 |
+
+Le vecchie decisioni `D-0.x` sono confluite nelle `D-x` qui sopra: D-0.1→D-1,
+D-0.2→D-2, D-0.4→D-5, D-0.5→D-9, D-0.6→D-6. D-0.8 (nome del ruolo capoturno) è
+chiusa: si chiama `Supervisor`. D-0.7 (auto-logout) era già risolta.

docs/architecture/STATO_PROGETTO.md

@@ -0,0 +1,192 @@
+# Stato Progetto TieMeasureFlow — V3.0.0
+
+> Snapshot al 2026-07-28. Aggiornare ad ogni milestone.
+> Lo snapshot V2.0.0 è in [`../archive/STATO_PROGETTO_V2.0.0_2026-04-27.md`](../archive/STATO_PROGETTO_V2.0.0_2026-04-27.md).
+
+## Versione corrente
+
+**V3.0.0** (in sviluppo, branch `V3.0.0`). Versione precedente: `V2.0.0`.
+
+In esercizio su `tieflow.tielogic.xyz` (Docker Compose + Traefik + Let's Encrypt),
+schema alla migrazione `010_meas_authorisation`.
+
+## Sintesi esecutiva
+
+V2.0.0 aveva chiuso stazioni per-tablet, ristrutturazione monorepo con `uv` e la
+tenuta multi-tablet. **V3.0.0 nasce dal sopralluogo del 28/07 e lavora sui quindici
+punti** raccolti in [`TieMeasureFlow_modifiche_2026-07-28.md`](../../TieMeasureFlow_modifiche_2026-07-28.md).
+
+Il filo che li tiene insieme: fino a V2.0.0 il sistema *registrava* misure ma non
+*governava* la produzione. Le regole vivevano nell'interfaccia — una modale che si
+poteva chiudere, un timer che moriva al cambio pagina, un tipo di task dedotto dalla
+presenza di quote. V3.0.0 le sposta sul server, dove non si aggirano.
+
+Tredici punti su quindici sono fatti e in esercizio. Uno è fermo sulle risposte del
+cliente, uno è fuori offerta.
+
+## I quindici punti
+
+| # | Punto | Stato | Dove vive |
+|---|---|---|---|
+| 1 | Memoria della produzione in corso | ✅ | `production_runs`, `production_service` |
+| 2 | Tipo di task esplicito | ✅ | `RecipeTask.task_type`, migrazione 007 |
+| 3 | Loop di misura e ripetizione | ✅ | `production-clock.js`, `production_service`, migrazione 008 |
+| 4 | Limite di tentativi prima del capoturno | ⛔ **Fermo su D-6, D-7, D-9** | — |
+| 5 | Avanzamento solo se in tolleranza | ✅ | `measurement_service.pending_authorisation`, migrazione 010 |
+| 6 | Fermo linea e Fine produzione con effetto | ✅ | `production_service`, `production_export_service` |
+| 7 | Gestione delle stazioni | ✅ | `station_service`, `/admin/stations` |
+| 8 | Tracciabilità obbligatoria | ✅ | `Recipe.requires_lot/serial`, migrazione 009 |
+| 9 | Blocco dell'inserimento manuale | ✅ | `Recipe.allow_manual_input`, `numpad.js` |
+| 10 | Interfaccia operatore: sequenza e conferme | ✅ | `/measure/start`, `task-progress`, `task_list`, `task_execute` |
+| 11 | Formattazione delle descrizioni | ✅ | filtro `rich_text`, `rich-text.js` |
+| 12 | Funzionamento senza internet | ✅ | `static/vendor/`, CSP in `app.py` |
+| 13 | Generazione task dalla scheda tecnica con l'AI | — **Fuori offerta** | — |
+| 14 | Stabilità del layout | ✅ | `.tmf-page` in `themes.css`, [`LAYOUT.md`](LAYOUT.md) |
+| 15 | Statistica separata dalla registrazione | ✅ | `@role_required("Metrologist")`, test dedicato |
+
+## Cosa è entrato in V3.0.0
+
+### Produzione come stato, non come pulsante (punti 1, 6)
+
+- Tabelle `production_runs` e `production_events`; una produzione si apre su una
+  stazione, accumula eventi (`start`, `cycle_completed`, `task_measured`,
+  `remeasure`, `line_stop`, `resume`, `close`) e si chiude.
+- Fermo linea, ripresa e fine produzione richiedono le credenziali del capoturno e
+  **cambiano lo stato**: prima erano modali che si chiudevano.
+- La fine produzione emette il file di statistica dell'intera produzione
+  (`production_export_service`), CSV con i delimitatori configurati, marcando le
+  misure come esportate. Il punto d'innesto verso GAIA è lì accanto, in attesa di
+  D-1 e D-2.
+
+### Il ciclo di misura (punto 3)
+
+- L'intervallo della ricetta è calcolato dal server (`seconds_to_next_measurement`,
+  `overdue`, `server_time`): sopravvive al cambio task, che è un ricaricamento di
+  pagina, e non si azzera cambiando schermata.
+- Il conteggio **prosegue oltre lo zero**: il ritardo si vede, in rosso.
+- A scadenza l'operatore viene riportato al primo task di misura della ricetta, con
+  cinque secondi di preavviso; chi sta già misurando viene lasciato finire.
+- Cicalino via WebAudio, nessun file audio da caricare.
+- `remeasure` distingue una seconda lettura dello stesso pezzo da un ciclo nuovo:
+  girare il pezzo e rimisurare non deve far ripartire l'intervallo.
+
+### Le regole della ricetta (punti 8, 9)
+
+- `requires_lot`, `requires_serial`, `allow_manual_input` per ricetta, verificati in
+  `measurement_service`: **ogni porta d'ingresso passa di lì**, barcode compreso.
+- Con `allow_manual_input` a falso il tastierino non viene disegnato — non nascosto:
+  il markup non esiste — e il server rifiuta comunque un valore digitato a mano.
+- Il rilevamento del calibro USB è stato reso più tollerante (Enter veloce), perché
+  con la regola stretta una lettura corta come `9.5` veniva scambiata per digitazione.
+
+### Il fuori tolleranza (punto 5)
+
+- Una quota fuori tolleranza e non autorizzata **blocca** il salvataggio della quota
+  successiva e la chiusura del ciclo (409).
+- Conta l'**ultima** lettura di ogni quota: rimisurare la stessa quota resta
+  possibile — il calibro scivola, il pezzo si riposiziona — e una lettura dentro i
+  limiti scioglie il blocco senza chiamare nessuno.
+- L'autorizzazione del capoturno resta scritta sulla misura (`supervisor_id`,
+  `authorised_at`) e finisce in due colonne del CSV di produzione: il file mostra il
+  guasto **e** la decisione.
+- Quanti tentativi siano ammessi è il punto 4, non questo.
+
+### L'interfaccia dell'operatore (punti 10, 11, 14, 15)
+
+- La ricetta si apre sul primo task (`/measure/start/<id>`), non su un elenco. La
+  lista scende a secondo livello e mostra quali task sono rimasti incompiuti
+  (`GET /api/measurements/task-progress`, contato per quota e non per tentativo).
+- «Fine ciclo misura» è visibile da subito e spento finché mancano quote, con
+  scritto quante ne mancano.
+- Descrizioni con `**grassetto**` e a capo: marcatura, non HTML, così la
+  sanificazione è per costruzione.
+- Una cornice sola per tutte le viste, allineata alla navbar — vedi [`LAYOUT.md`](LAYOUT.md).
+- Nessun percorso dell'operatore porta alla statistica, ed è un test.
+
+### Fuori dalla rete (punto 12)
+
+- Alpine, Plotly, PDF.js (+ worker), Fabric e i font sono nell'installazione, con
+  versione nel nome e impronta SHA-256 verificata da un test.
+- Content-Security-Policy a sola origine locale servita **dal client Flask**: prima
+  esisteva solo sul backend, cioè sulle risposte API e non sulle pagine.
+- Tailwind fissato a `3.4.19` nel `Dockerfile.frontend`.
+
+## Migrazioni
+
+| # | Contenuto |
+|---|---|
+| 001–004 | image_path, stazioni, intervallo di misura + auto-logout, `input_duration_ms` |
+| 005–006 | `production_runs`, misure legate alla produzione |
+| 007 | `task_type` dichiarato |
+| 008 | tipi di evento del ciclo + `task_id` sull'evento |
+| 009 | `requires_lot`, `requires_serial`, `allow_manual_input` |
+| 010 | `supervisor_id`, `authorised_at` sulla misura |
+
+Le 008 e 010 usano il *batch mode* per compatibilità SQLite (i test) e sono state
+verificate anche in resa MySQL (`alembic upgrade X:Y --sql`) prima del deploy.
+
+La 009 imposta `allow_manual_input = 1` sulle ricette esistenti: conserva il
+comportamento in essere invece di irrigidire di colpo ricette già in uso. È una
+scelta, e va confermata dal cliente ricetta per ricetta.
+
+## Test status
+
+| | Test | Fail |
+|---|---|---|
+| Backend (`src/backend/tests/`) | 212 | 0 |
+| Frontend (`src/frontend/flask_app/tests/`) | 148 | 0 |
+| **Totale** | **360** | **0** |
+
+I quattro fallimenti pre-esistenti tracciati nello snapshot V2.0.0 non ci sono più.
+
+Tre file di test non renderizzano niente e leggono i sorgenti, perché guardano
+proprietà che sopravvivono solo se qualcuno le controlla:
+
+| File | Cosa impedisce |
+|---|---|
+| `test_offline.py` | Una libreria caricata dalla rete, un worker PDF.js lasciato sul CDN, una libreria sostituita senza aggiornare l'impronta |
+| `test_layout_shell.py` | Una vista che torna a dichiararsi la propria larghezza |
+| `test_template_js_syntax.py` | Una traduzione con l'apostrofo dentro una stringa JS a virgolette singole, che spegne Alpine su tutta la pagina |
+
+## Cosa non è stato provato
+
+Va detto perché non si confonda «i test passano» con «funziona in reparto».
+
+- **Il collaudo sul campo non è mai stato percorso.** Le ricette `COLLAUDO-A` e
+  `COLLAUDO-B` sono state seminate sul sistema in esercizio (`scripts/seed_collaudo.py`)
+  insieme a un utente `capoturno`, ma nessuno ha ancora guidato il flusso su un
+  tablet vero.
+- **Il punto 14 non è stato riprodotto su un dispositivo**: è dimostrato che il
+  layout *poteva* muoversi per quattro motivi e che ora non può più, non che
+  l'operatore vedesse esattamente quelli.
+- **Il punto 12 non è stato provato a rete staccata.** È dimostrato che nessuna
+  risorsa esterna viene richiesta. Il giro con la rete staccata va fatto, ed è ora il
+  momento giusto perché la CSP è appena entrata in vigore.
+- **Il cicalino** è il suono del browser. Se serva una colonnina luminosa è D-5.
+
+## Stack
+
+- **Backend:** FastAPI + SQLAlchemy 2.0 async + MySQL 8 + Alembic + Pydantic v2 +
+  WeasyPrint + Plotly/Kaleido. 12 router.
+- **Frontend:** Flask + Jinja2 + Alpine.js 3.15.12 + TailwindCSS 3.4.19 +
+  Fabric.js 5.3.1 + PDF.js 3.11.174 + Plotly.js 2.32.0 + Flask-Babel —
+  **tutte copie locali**, nessun CDN.
+- **Deploy:** Docker Compose. Dev = Nginx; Prod = Traefik + Let's Encrypt.
+- **Tooling:** uv, pytest + pytest-asyncio + httpx + aiosqlite.
+
+## Decisioni architetturali rilevanti
+
+| Decisione | Stato | Note |
+|---|---|---|
+| Le regole di misura stanno sul server, non sullo schermo | **Confermata (V3.0.0)** | Tracciabilità, inserimento manuale, fuori tolleranza: la schermata può nasconderle, il server le rifiuta. |
+| Una app di stazione per PC, dati sul server | **Decisa il 28/07** (D-3) | Validazione con l'IT di Tràfilo aperta come D-4. |
+| Descrizioni in marcatura, non in HTML | **Confermata** | Niente HTML accettato in ingresso: la sanificazione è per costruzione, non per filtro. |
+| Frontend Flask invece di React (deroga vs spec §8) | **Confermata** | Tablet UX server-side, calibri USB, editor Fabric.js, i18n Babel collaudato. |
+| NATS messaging (spec §7) | **Skippato** | Monorepo single-host, nessun microservizio. |
+| Envelope risposta `{success,data,error}` (spec §6) | **Rimandato** | Costo alto, rotture client. Eventuale API v2. |
+| Header `X-API-Key` vs spec `X-Api-Key` | **Mantenuto attuale** | Rinominare è breaking per i deploy esistenti. |
+
+## Branch git
+
+- **Corrente:** `V3.0.0`
+- **Precedenti:** `V2.0.0`, `V1.0.0` … `V1.0.7` (release storiche)

docs/archive/STATO_PROGETTO_V2.0.0_2026-04-27.md

@@ -0,0 +1,145 @@
+# Stato Progetto TieMeasureFlow — V2.0.0
+
+> Snapshot al 2026-04-27. Aggiornare ad ogni milestone.
+
+## Versione corrente
+
+**V2.0.0** (in sviluppo, branch `V2.0.0` come default su `git.tielogic.xyz`).
+
+Versione precedente di produzione: `V1.0.7`.
+
+## Sintesi esecutiva
+
+Il sistema base (V1.0.7) è completo e collaudato: ricette, task, misurazioni, SPC, report PDF, gestione utenti, dashboard metrologist. La V2.0.0 in corso aggiunge il primo blocco della migrazione **rev04** (stazioni per-tablet) e ristruttura l'intero monorepo secondo lo standard `python-project-spec-design.md` (uv + `src/backend/` + `src/frontend/flask_app/`).
+
+## Cosa funziona oggi (V2.0.0 — branch corrente)
+
+### Funzionalità ereditate da V1.0.7
+- Autenticazione username/password + API key per-utente, ruoli combinabili (Maker, MeasurementTec, Metrologist) + flag `is_admin`.
+- Recipe versioning copy-on-write: una nuova versione si crea solo se la corrente ha già measurements; altrimenti update in-place.
+- Editor ricette (Maker) con annotation editor Fabric.js (~1200 LOC, collaudato su tablet).
+- Workflow operatore tablet: select_recipe → task_list → task_execute → task_complete, con barcode scanner e numpad touch (input USB calibro con burst detection).
+- Calcolo pass/fail con limiti UTL/UWL/LWL/LTL.
+- Dashboard SPC: capability (Cp/Cpk/Pp/Ppk), control chart (UCL/LCL = mean ± 3σ), istogramma con curva normale, calcoli puro stdlib (no numpy).
+- Report PDF (WeasyPrint + Kaleido SVG).
+- Setup page protetta da `SETUP_PASSWORD` per inizializzazione DB e seed.
+- i18n IT/EN (Flask-Babel + Alpine.js JSON).
+- Tema light/dark via `Alpine.store('theme')` + localStorage.
+
+### Aggiunte V2.0.0 (rev04 Fase 1 — Stazioni per-tablet)
+- Tabelle `stations` + `station_recipe_assignments` (Alembic migration `002_add_stations.py`).
+- Modelli ORM: `Station`, `StationRecipeAssignment` con vincolo unique `(station_id, recipe_id)`.
+- Schemas Pydantic: `StationCreate/Update/Response`, `StationRecipeAssignmentCreate/Response`, `RecipeSummary`.
+- Service `station_service` (CRUD + assegnazioni + cascade delete).
+- Router `/api/stations` con CRUD admin + endpoint operatore `GET /api/stations/by-code/{code}/recipes`.
+- Seed automatico `ST-DEFAULT` con tutte le ricette esistenti (idempotente).
+- Variabile env client `STATION_CODE` letta da `Config`, helper `APIClient.get_station_recipes()`.
+- Filtro `select_recipe`: il client mostra solo le ricette assegnate alla propria stazione, errore se `STATION_CODE` non configurato.
+- **GUI admin completa** in `/admin/stations`: tabella con search, modal create/edit, modal gestione assegnazioni ricette, conferma eliminazione, link in navbar (desktop + mobile).
+- 47 nuovi test (32 server + 15 client) tutti pass.
+
+### Aggiunte V2.0.0 (performance + multi-utente)
+- Gunicorn 5 workers × 4 thread (gthread) — capacità ~20 richieste concorrenti Flask, regge 20+ tablet.
+- Uvicorn 4 workers + `--proxy-headers --forwarded-allow-ips='*'`.
+- Rate limit middleware: identificazione IP reale via `X-Forwarded-For` → `X-Real-IP` → `request.client.host`.
+- Rate limit general 100 → 300 req/min/IP (per-tablet ora, non più condiviso).
+- Flask `ProxyFix(x_for=1, x_proto=1, x_host=1)` per IP reale dietro Nginx.
+- `APIClient` propaga `X-Forwarded-For` + `X-Real-IP` (sia JSON che multipart).
+- 12 test aggiuntivi (7 server + 5 client).
+
+### Aggiunte V2.0.0 (struttura monorepo)
+- `pyproject.toml` unico con extra `server`/`client`/`dev`. Niente più `requirements.txt`.
+- `uv.lock` (77 pacchetti) + `.python-version` (3.11) committati per build riproducibili.
+- Layout `src/backend/` + `src/frontend/flask_app/` (vedi sotto).
+- `Dockerfile` (root) + `Dockerfile.frontend` riscritti con `uv sync --frozen --no-dev --extra server|client`.
+- `docker-compose.{dev,}.yml` con build context `.`.
+- Alembic env.py aggiunge project root a `sys.path`; `script_location = %(here)s` resta valido.
+- `.dockerignore` aggiornato.
+
+### Hardening post-restructure (smoke test 2026-04-26)
+
+Sequenza di smoke test in locale (uvicorn + gunicorn + MySQL Docker) ha fatto emergere quattro regressioni che sarebbero rimaste invisibili al test suite:
+
+- **`src/backend/config.py`**: `env_file` era cwd-relative (`../../.env`). Rotto fuori da `src/backend/`. Risolto con percorso assoluto `Path(__file__).resolve().parents[2] / ".env"`.
+- **`src/backend/models/orm/__init__.py`**: `Station` e `StationRecipeAssignment` non erano esportati, quindi `Base.metadata.create_all` non creava le tabelle stations. Aggiunti agli import.
+- **`.env.example`**: `UPLOAD_DIR=server/uploads` era residuo della vecchia struttura → file landavano fuori dall'albero di progetto. Aggiornato a `UPLOAD_DIR=uploads`.
+- **Apostrofi italiani in template Alpine** (`l'utente`, `nell'eliminazione`, `nell'assegnazione`): chiudevano prematuramente JS string literals dentro `x-text` e blocchi `<script>`. Riscritti con delimitatori `&quot;...&quot;` o riformulazione testuale.
+
+Inoltre **UX rework** della modale assegnazione ricette su `/admin/stations`: dropdown sostituita da layout a 2 colonne (disponibili / assegnate) con bottone inline `+ Assegna`, search filter, empty state esplicativo (mostrava silenziosamente lista vuota se tutte le ricette erano già assegnate).
+
+Test guard aggiunto: `test_template_js_syntax.py` valida ogni inline `<script>` E ogni espressione Alpine (`x-*`, `@*`, `:*`) della pagina con `node --check`. Cattura automaticamente il bug-class apostrofo. Skip se Node non è installato.
+
+## Layout repository (V2.0.0)
+
+```
+TieMeasureFlow/
+├── pyproject.toml + uv.lock + .python-version
+├── Dockerfile (backend) + Dockerfile.frontend
+├── docker-compose.dev.yml + docker-compose.yml
+├── nginx/
+├── uploads/                      # volume Docker
+├── docs/                         # raggruppata e indicizzata
+│   ├── README.md (indice)
+│   ├── API.md / DEPLOYMENT.md / USER_GUIDE.md / I18N_SETUP.md
+│   ├── architecture/             # questo file + ROADMAP.md
+│   ├── archive/                  # piani storici
+│   ├── specs/                    # spec esterne (.docx)
+│   └── superpowers/plans/        # piani TDD dettagliati
+└── src/
+    ├── backend/
+    │   ├── main.py / config.py / database.py
+    │   ├── api/{routers,middleware}/
+    │   ├── models/{orm,api}/
+    │   ├── services/
+    │   ├── migrations/
+    │   ├── templates/
+    │   └── tests/
+    └── frontend/
+        └── flask_app/
+            ├── app.py / config.py / compile_translations.py
+            ├── blueprints/ (auth, maker, measure, statistics, admin)
+            ├── services/ (api_client.py)
+            ├── templates/ + static/ + translations/
+            └── tests/
+```
+
+## Smoke test status
+
+Validazione end-to-end in locale (2026-04-26):
+
+- ✅ MySQL container Docker up, schema creato, alembic stamp head OK
+- ✅ uvicorn `--reload` su :8000, `/api/health` risponde
+- ✅ Seed `/api/setup/seed` con `SETUP_PASSWORD=adriano77` → admin + 4 utenti demo + DEMO-001 + ST-DEFAULT con assegnazione automatica
+- ✅ Login `admin/admin123` via web, sessione persistente
+- ✅ `/admin/stations`: tabella, modal create/edit, modal gestione assegnazioni a 2 colonne con search, eliminazione con cascade
+- ✅ `/admin/users`, `/maker/recipes`, `/measure/select` (filtrato per stazione), `/statistics/dashboard`
+- ✅ Workflow MeasurementTec end-to-end: select_recipe → task_list → task_execute → task_complete (riepilogo con misure)
+- ✅ Hot reload Flask + uvicorn `--reload` + Tailwind watch attivi durante lo sviluppo
+
+## Test status
+| Backend (`src/backend/tests/`) | 127 | 3 | Fail pre-esistenti: `test_recipes` (2) + `test_tasks` (1). Nessuno introdotto dalla V2.0.0. |
+| Frontend (`src/frontend/flask_app/tests/`) | 46 | 1 | +2 test post-restructure (`test_template_js_syntax.py`). Fail pre-esistente: `test_save_measurement_proxy`. |
+| **Totale** | **173** | **4** | Tutti i fallimenti tracciati come tech debt da risolvere. |
+
+## Stack confermato
+
+- **Backend:** FastAPI + SQLAlchemy 2.0 async + MySQL 8 + Alembic + Pydantic v2 + WeasyPrint + Plotly/Kaleido.
+- **Frontend:** Flask + Jinja2 + Alpine.js + TailwindCSS + Fabric.js 5.3.1 + html5-qrcode + Plotly.js + Flask-Babel.
+- **Deploy:** Docker Compose. Dev = Nginx; Prod = Traefik + Let's Encrypt SSL.
+- **Tooling:** uv (package mgmt), pytest + pytest-asyncio + httpx + aiosqlite (test).
+
+## Decisioni architetturali rilevanti
+
+| Decisione | Stato | Note |
+|---|---|---|
+| Frontend Flask invece di React (deroga vs spec §8) | **Confermata** | Tablet UX server-side, USB calipers/barcode, Fabric.js editor, i18n Babel collaudato. Vedi conversazione 2026-04-25. |
+| NATS messaging (spec §7) | **Skippato** | Monorepo single-host, no microservizi. Nessuno stub `nats_client/` creato. |
+| Envelope risposta `{success,data,error}` (spec §6) | **Rimandato** | Costo 4-5gg refactor + rotture client. Eventuale v2 API in M2. |
+| Header `X-API-Key` vs spec `X-Api-Key` | **Mantenuto attuale** | Rinominare costa 50+ punti di codice + breaking per deploy. Rivedere in M2. |
+| Variabili `.env` (DB_HOST, SERVER_PORT, ...) | **Mantenute attuali** | Rename a SERVICE_NAME/SERVICE_DOMAIN/API_KEY rinviato (impatta deploy esistenti). |
+
+## Branch git
+
+- **Default:** `V2.0.0` (lavoro corrente)
+- **Mantenuti:** `V1.0.0` … `V1.0.7` (release branches storiche)
+- **Mergiato e chiuso:** `feature/rev04-phase1-stations` (in `V2.0.0` con commit `ea8e468`)

docs/superpowers/specs/2026-08-16-visionsuite-integration-design.md

@@ -0,0 +1,474 @@
+# Integrazione di VisionSuite in TieMeasureFlow — design
+
+> Progetto: TieMeasureFlow V3.0.0 → V3.1.0
+> Data: 2026-08-16
+> Stato: design approvato, piano di implementazione da scrivere
+
+## Perché
+
+TieMeasureFlow oggi registra misure prese a mano, con il calibro USB o con il
+tastierino. Il passo successivo che il cliente chiede è misurare con una camera:
+acquisire l'immagine di un pezzo e ricavarne le quote, oppure confrontarne il
+profilo con il disegno DXF di riferimento.
+
+La visione artificiale non va scritta qui. Tielogic ha già
+[VisionSuite](ssh://git@git.tielogic.xyz:222/Adriano/visionsuite.git), un
+monorepo di moduli riusabili il cui README indica esplicitamente TieMeasureFlow
+fra i consumatori previsti. Questo documento descrive come agganciarlo.
+
+Il terreno è in parte già preparato. La migrazione `007_task_type` ha introdotto
+il tipo di task dichiarato e l'enum contiene fin da allora due valori che nessuno
+produce né consuma ancora:
+
+```python
+TASK_TYPES = ("note", "measure", "drawing", "xf_compare", "camera_measure")
+MEASURING_TASK_TYPES = ("measure", "camera_measure")
+```
+
+Questo lavoro li riempie.
+
+## Che cosa entra e che cosa resta fuori
+
+**Entra:** l'acquisizione da camera, l'esecuzione di un programma di visione su
+quell'immagine — pattern matching più misure, oppure pattern matching più
+confronto DXF — e l'ingresso dei risultati nel modello di misura che già esiste.
+
+**Resta fuori, per ora:** i semafori USB. Sono previsti dall'architettura — è
+l'agente di stazione a possederli, insieme alle camere — ma non fanno parte di
+questa consegna. Il confine è disegnato perché ci entrino senza ristrutturazioni.
+
+## Le otto decisioni
+
+Sono le scelte prese in fase di brainstorming, con il motivo per cui sono state
+prese. Chi legge fra sei mesi ha bisogno del motivo più della scelta.
+
+### 1. La visione gira sia sul server sia sulla stazione
+
+Il motore è un componente unico distribuito in due posti: accanto al server e
+dentro l'agente di stazione. Questo dà la resilienza — se cade il collegamento,
+la stazione continua a misurare — e permette al server di elaborare in fase di
+produzione, di comporre ricette per conto del Maker e di rifare analisi su
+immagini archiviate.
+
+È coerente con la decisione **D-3**, chiusa il 28/07: dati sul server, app di
+stazione su ogni PC.
+
+### 2. Server e stazione montano la stessa identica versione di VisionSuite
+
+Non è una raccomandazione di build: è un vincolo metrologico. Se il server monta
+un commit e una stazione ne monta un altro, lo stesso pezzo con lo stesso grafo
+può dare due numeri diversi, e nessuno se ne accorge finché non arriva una
+contestazione.
+
+Da qui tre obblighi che il design deve garantire:
+
+- VisionSuite entra come **sottomodulo git su un commit preciso**, lo stesso per
+  entrambi — la forma che il README di VisionSuite prescrive
+- ogni misura porta scritto **con quale versione del motore** è stata prodotta
+- una stazione che monta una versione diversa da quella del server **si rifiuta
+  di misurare** e lo dichiara, invece di produrre numeri plausibili e sbagliati
+
+### 3. L'agente di stazione è sottile
+
+L'agente parla ai device, consegna immagini e — più avanti — piloterà i semafori.
+Non contiene decisioni di visione.
+
+La conseguenza pratica è l'impacchettamento: un agente che non contiene
+VisionSuite non contiene nemmeno PyTorch. Distribuirlo come eseguibile su Windows
+o come container su Linux diventa realistico, e la scelta su driver e formato può
+restare tardiva — che è bene, perché dipende dalla **D-4**, ancora aperta.
+
+L'agente incorpora il motore solo quando la stazione è configurata per elaborare
+in locale, e in quel caso resta comunque un guscio: riceve un grafo, lo esegue,
+restituisce le uscite.
+
+### 4. Il server non importa mai VisionSuite
+
+La visione sul lato server vive in un **servizio separato** nello stesso compose,
+il *vision worker*. Il server FastAPI continua a fare quello che fa —
+autenticazione, ricette, misure, statistica — e resta leggero.
+
+Quattro ragioni concrete: l'immagine dell'API non passa da poche centinaia di
+megabyte a cinque gigabyte; un aggiornamento di VisionSuite non richiede di
+riavviare l'API in produzione; un'elaborazione che va in crash non porta giù le
+richieste degli altri tablet; il giorno in cui la visione chiede una GPU o una
+macchina propria si sposta senza toccare il resto.
+
+Il confine va difeso: se un domani il server importasse VisionSuite per una
+scorciatoia, il vantaggio si perde in silenzio.
+
+### 5. La configurazione dei device sta sul PC
+
+Le camere — e domani i semafori — appartengono alla macchina, non alla ricetta.
+Il server ne tiene uno **specchio** in sola lettura, popolato dall'agente quando
+si connette, perché il Maker deve poter scegliere un device da un elenco stando
+alla scrivania.
+
+Un device che l'agente non dichiara più è **offline**, non cancellato: una
+ricetta che lo referenzia deve continuare a esistere e a spiegare perché non può
+girare.
+
+### 6. Dove si esegue lo decide la configurazione della stazione
+
+Ogni PC dichiara se elabora in locale o delega al server, nella stessa
+configurazione dove già stanno i device. Il default è il server.
+
+Le macchine capaci si prendono il carico e non mandano immagini in rete; quelle
+deboli delegano. Se il server non risponde e la stazione ha il motore, la
+stazione ripiega in locale e lo segna nel risultato. Un impianto misto si governa
+senza toccare le ricette.
+
+La ricetta non dice mai dove gira: legare una scelta di impianto a un documento
+di produzione significa dover rimettere mano alle ricette per spostare il carico.
+
+### 7. Il verdetto lo dà TieMeasureFlow, non il grafo
+
+Gli strumenti di quota di `vs-task` hanno anche loro `nominal`, `plus`, `minus` e
+un `outcome`. Quell'esito viene ignorato e quei limiti restano vuoti: il grafo
+produce numeri, `measurement_service` decide se sono buoni.
+
+Due giudici sullo stesso valore è il modo più rapido per ottenere un CSV che si
+contraddice e una contestazione che non si sa come chiudere.
+
+La conseguenza è che tutto il resto continua a funzionare senza modifiche:
+pass/warning/fail, gate del fuori tolleranza con autorizzazione del capoturno,
+Cp/Cpk, carta di controllo, colonne del CSV di produzione. Una quota da camera è
+una misura come le altre.
+
+### 8. La sorgente immagine è un'astrazione a tre facce
+
+Il motore riceve un'immagine e non sa da dove venga. Le tre sorgenti sono: dal
+vivo da un device tramite l'agente, un'immagine di riferimento salvata sul
+server, un file caricato dal Maker.
+
+Non è un'astrazione nostra: è quella che VisionSuite si è già data — *«espongono
+una sorgente, non una telecamera: è questo che permette di collaudare un impianto
+a cinque telecamere senza avere le cinque telecamere sul tavolo, e di scrivere
+prove che danno sempre lo stesso risultato»*.
+
+Sblocca tre cose che altrimenti non ci sarebbero:
+
+- il Maker compone alla scrivania, senza tenere occupata una stazione né avere il
+  pezzo in mano
+- una ricetta si prova prima di andare in produzione, invece di scoprirne i
+  difetti misurando
+- diventa possibile una **prova di non regressione**: salvando accanto
+  all'immagine il risultato atteso, si riesegue l'intero parco ricette dopo un
+  aggiornamento di VisionSuite e si vede quali quote si sono mosse
+
+Quest'ultima è la rete di sicurezza che rende sostenibile aggiornare il
+sottomodulo, con un motore che sta su due host.
+
+> **Non ancora consegnata.** La colonna `expected_json` esiste, ma nessun
+> percorso la scrive — nemmeno `preview`, che è l'unico posto dove un grafo gira
+> davvero su un'immagine. La prova di non regressione è quindi **promessa da
+> questo documento e non mantenuta da nessuna riga di codice**. Diventa una
+> consegna nominata del piano 1b: «`preview` può promuovere le proprie uscite a
+> `expected_json`». Finché non è fatta, questa decisione non va dichiarata
+> completa.
+
+## Architettura
+
+### I componenti
+
+| Componente | Nuovo | Dove vive | Responsabilità |
+|---|---|---|---|
+| `vendor/visionsuite` | sì | sottomodulo git | i pacchetti `vs-core`, `vs-camera`, `vs-pm2d`, `vs-measure`, `vs-dxf`, su un commit fisso |
+| Vision runner | sì | libreria condivisa | immagine + grafo + calibrazione → quote e artefatti. Unica implementazione, due host |
+| Vision worker | sì | container nel compose | espone il runner dietro una API interna. Il container pesante |
+| Agente di stazione | sì | PC di reparto | possiede i device, acquisisce, apre la connessione verso il server, incorpora il runner se configurato |
+| Backend FastAPI | modificato | container esistente | tipi di task, grafo sul task, registro device, inoltro, ingresso risultati. **Nessun import di VisionSuite** |
+| Frontend Flask | modificato | container esistente | Maker: device, fotogramma, aggancio quote. Measure: schermata del task con camera |
+
+L'aggancio del sottomodulo segue la forma prescritta dal README di VisionSuite:
+dipendenza dai soli pacchetti che servono, dichiarati in path editable.
+
+```toml
+[tool.uv.sources]
+visionsuite = { path = "vendor/visionsuite/packages/vs-core", editable = true }
+vs-camera   = { path = "vendor/visionsuite/packages/vs-camera", editable = true }
+```
+
+I due host non montano lo stesso insieme, ed è il punto dell'intera struttura di
+VisionSuite:
+
+| Pacchetto | Worker | Agente | Perché |
+|---|---|---|---|
+| `vs-core` | sì | sì | strutture di base e calibrazione, servono a entrambi |
+| `vs-pm2d` | sì | solo se elabora in locale | pattern matching |
+| `vs-measure` | sì | solo se elabora in locale | primitive e quote |
+| `vs-dxf` | sì | solo se elabora in locale | confronto col disegno. È quello che porta PyTorch |
+| `vs-camera` | **no** | sì | il worker non tocca hardware: riceve immagini già acquisite |
+
+Un agente su una stazione che delega al server monta quindi due soli pacchetti,
+`vs-core` e `vs-camera`, e resta leggero. È la differenza fra un eseguibile
+distribuibile e un'installazione da cinque gigabyte su ogni PC di reparto.
+
+I nomi di importazione non sono uniformi — `vs-core` si importa come
+`visionsuite`, `vs-pm2d` come `pm2d`, `vs-dxf` come `dxf_compare` — ed è una
+stortura nota e dichiarata a monte, non un errore da correggere qui.
+
+### Il flusso di una misura, esecuzione sul server
+
+```
+operatore apre il task
+  → client chiede al server di eseguire
+  → server chiede all'agente un fotogramma sul device dichiarato
+  → agente acquisisce e carica l'immagine
+  → server passa immagine e grafo al worker
+  → worker restituisce le uscite
+  → server applica pass/fail, gate del fuori tolleranza, salva in measurements
+  → client mostra esito e immagine con le zone dove ha guardato
+```
+
+### Il flusso con esecuzione in locale
+
+Il giro si accorcia: il server manda il grafo all'agente, l'agente acquisisce ed
+esegue, e rimanda uscite più immagine. **Da lì in poi il server fa le stesse
+identiche cose.** Il verdetto, il gate e il salvataggio non cambiano mai posto:
+cambia chi calcola i numeri, non chi decide se sono buoni.
+
+È questo che rende le due strade equivalenti a valle, e che permette di cambiare
+la configurazione di una stazione senza toccare né il frontend né le ricette.
+
+## Modello dati
+
+### Il grafo di visione
+
+`recipe_tasks` prende **`vision_json`** (JSON, nullable): il grafo di `vs-task`
+serializzato, opaco al server.
+
+Il versionamento arriva gratis. Il copy-on-write delle ricette copia già i task
+in profondità, quindi una modifica al grafo su una ricetta con misure produce una
+versione nuova come qualunque altra modifica; in `recipe_service` è un campo in
+più nella copia, non una logica nuova.
+
+Non si riusa `annotations_json`, che sta lì accanto: le annotazioni sono un
+disegno per l'operatore, il grafo è un programma da eseguire. Hanno cicli di vita
+e regole di validazione diversi, e mescolarli significa non poter validare né
+l'uno né l'altro.
+
+### Il legame fra quota del grafo e quota della ricetta
+
+`recipe_subtasks` prende **`vision_output`** (String, nullable): la coppia
+«identificativo dello strumento, nome della sua uscita».
+
+È la stessa forma di legame che `vs-task` usa internamente, e per la stessa
+ragione dichiarata nel suo README: *«Il legame è un ID, non un puntatore»* — un
+riferimento in memoria non si scrive su disco.
+
+Tutto il resto della subtask — nominale, UTL, UWL, LWL, LTL, unità — resta com'è
+e continua a significare quello che significa oggi.
+
+### Le misure
+
+`input_method` passa da `("usb_caliper", "manual")` a
+`("usb_caliper", "manual", "camera")`.
+
+Il contorno della visione **non** va su `measurements`. Quella tabella la leggono
+la statistica e l'export a ogni giro, e appesantirla la rovina. Ma soprattutto
+sarebbe sbagliato di modello: una sola acquisizione produce N quote, e immagine,
+overlay, device e versione del motore sono gli stessi per tutte.
+
+Nasce quindi **`vision_results`**, una riga per **esecuzione**:
+
+| Campo | Perché c'è |
+|---|---|
+| `image_path`, `overlay_path` | l'immagine, e quella con sopra le zone dove ha guardato |
+| `engine_version` | il commit di VisionSuite che ha prodotto i numeri |
+| `executed_on` | `server` o `station` |
+| `station_id`, `device_id` | da quale macchina e quale camera |
+| `calibration_snapshot` | la taratura in vigore in quel momento, **copiata** |
+| `graph_snapshot` | il grafo effettivamente eseguito, **copiato** |
+| `duration_ms`, `executed_at` | quanto è costata, quando |
+
+Su `measurements` una sola colonna nuova: `vision_result_id`, FK nullable.
+
+Calibrazione e grafo si copiano invece di essere referenziati per la stessa
+ragione: una taratura rifatta sei mesi dopo non deve riscrivere il significato di
+una misura già presa.
+
+### Il registro dei device
+
+**`station_devices`**: `station_id`, `code` (l'identificativo locale), `kind`
+(`camera` oggi, `light` domani), `label`, `capabilities` (JSON), `calibration`
+(JSON) con `calibration_taken_at`, `last_seen_at`.
+
+Si popola dall'agente. Il server lo riceve e non lo modifica.
+
+### Le immagini di riferimento
+
+**`vision_reference_images`**: `task_id`, `path`, e la provenienza per intero —
+`station_id`, `device_id`, snapshot della calibrazione, `engine_version`,
+`acquired_at`, una nota — più `expected_json` per l'atteso della prova di non
+regressione.
+
+La provenienza non è rimandabile. Senza, si riesegue il grafo mesi dopo, escono
+numeri diversi, e non c'è modo di distinguere un motore aggiornato da un'ottica
+spostata.
+
+### Migrazione 011
+
+Cinque cose: `vision_json` su `recipe_tasks`, `vision_output` su
+`recipe_subtasks`, `camera` in `input_method_enum`, `vision_result_id` su
+`measurements`, e le tre tabelle nuove.
+
+Più una sesta, **da fare adesso o mai**: `task_type_enum` contiene `xf_compare`,
+refuso per `dxf_compare`. Oggi nessuna riga usa quel valore e correggerlo costa
+una riga. Dal primo task salvato in poi diventa una migrazione di dati, e il
+refuso finisce nelle API pubbliche.
+
+Come le migrazioni 008 e 010, va scritta in *batch mode* per la compatibilità
+SQLite dei test e verificata in resa MySQL con `alembic upgrade X:Y --sql` prima
+del deploy: è la procedura che il progetto si è già dato.
+
+## API
+
+L'agente apre lui la connessione. **Il server non bussa mai a un PC**, e questo
+evita di dover aprire porte sulle macchine di reparto — che è materia della D-4.
+
+| Verso | Endpoint | Cosa fa |
+|---|---|---|
+| agente → server | `WS /api/stations/agent` | si autentica con la chiave di stazione, dichiara i device, resta in ascolto |
+| server → agente | comando `acquire` | «scatta sul device X»; l'agente carica con `POST /api/vision/frames` |
+| server → agente | comando `execute` | esecuzione in locale: manda il grafo, riceve le uscite |
+| client → server | `POST /api/vision/execute` | esegui il task per la produzione in corso; **il server sceglie dove** |
+| client → server | `POST /api/vision/preview` | authoring: esegui su una sorgente qualsiasi, non salvare nulla |
+| client → server | `GET /api/stations/{code}/devices` | l'elenco per il Maker |
+| client → server | `POST /api/vision/reference-images` | salva un fotogramma come riferimento |
+| server → worker | `POST /run` | interno, mai esposto: immagine e grafo → uscite e overlay |
+
+Un solo endpoint decide dove si esegue, ed è `execute`. Il client non sa e non
+deve sapere se ha misurato il server o la stazione: chiede una misura e riceve un
+esito.
+
+## Errori e casi limite
+
+| Caso | Comportamento |
+|---|---|
+| Versione del motore diversa fra stazione e server | la stazione si rifiuta di misurare e lo dichiara. Mai produrre numeri con un motore non concorde |
+| Agente non raggiungibile | il task di visione non è eseguibile e lo dice. Da decidere con il cliente se la stazione debba consentire il ripiego sul calibro |
+| Server non raggiungibile, stazione con motore | la stazione esegue in locale e lo segna in `executed_on` |
+| Device dichiarato dalla ricetta ma offline | la ricetta resta valida, il task spiega perché non può girare |
+| Il grafo non produce un'uscita attesa da una subtask | la misura non si salva, l'errore nomina l'uscita mancante |
+| Elaborazione in crash o oltre il tempo | il worker isola il guasto, l'API resta in piedi, il task riporta l'errore |
+| Device senza calibrazione | le quote in millimetri non si producono. Mai convertire con un fattore implicito |
+
+## Prove
+
+Ai tre file di test che il progetto ha già e che leggono i sorgenti invece di
+renderizzare — `test_offline.py`, `test_layout_shell.py`,
+`test_template_js_syntax.py` — se ne aggiunge la stessa specie:
+
+- **una prova che il server non importi VisionSuite.** È il confine su cui poggia
+  la decisione 4, e senza qualcuno che lo controlli si perde in silenzio
+- **una prova che il commit del sottomodulo dichiarato coincida** con quello che
+  server e agente montano
+
+Per il resto, il runner si prova su immagini di riferimento salvate — che è
+precisamente ciò per cui l'astrazione della sorgente esiste. Nessuna prova
+richiede una camera collegata.
+
+## Quello che questo design non risolve
+
+- **Il dimensionamento del server.** Il pattern matching è pesante e, con
+  l'esecuzione lato server come default, la CPU è contesa fra tutte le stazioni.
+  Va aggiunto alla **D-4**, che finora chiedeva solo quale macchina e quanto
+  disco: ora chiede anche quanti core e quanta RAM.
+- **La conservazione delle immagini.** Due politiche distinte, entrambe da
+  portare in D-4: le immagini di riferimento sono poche e vivono quanto la
+  ricetta; quelle di produzione sono una per pezzo e crescono senza limite, e
+  vogliono una scadenza o una regola del tipo «si conservano solo quelle dei
+  pezzi fuori tolleranza».
+- **Che cosa fa la stazione se la rete cade** e non è configurata per elaborare
+  in locale: si blocca, o consente il calibro e segna il task come non
+  eseguibile? È una domanda per il cliente.
+- **L'impacchettamento dell'agente.** Le macchine possono essere Linux o Windows
+  e i driver possono stare sulla macchina o nel container. La decisione è
+  volutamente tardiva; il design la rende tale tenendo l'agente sottile e neutro.
+
+## Correzioni imposte dall'esecuzione
+
+Il piano derivato da questo documento è stato eseguito il 16/08/2026. Sei cose
+che qui erano scritte male o taciute, corrette dai fatti.
+
+### Il gate del fuori tolleranza vale per l'acquisizione, non per la quota
+
+La decisione 7 e il testo del punto 5 parlano di «la quota successiva». Quella
+regola era stata pensata per la misura **manuale e sequenziale**, dove esiste
+davvero un momento successivo in cui l'operatore potrebbe tirare avanti con una
+lettura cattiva irrisolta.
+
+Una camera produce tutte le N quote **nello stesso istante**. Dentro
+un'acquisizione non esiste un «tirare avanti», quindi lì non c'è nulla da
+presidiare — e applicare la regola sequenziale a un evento simultaneo produceva
+un blocco permanente: la lettura fuori tolleranza non veniva mai registrata,
+quindi nessuno poteva autorizzarla, e rifare la stessa foto ripeteva l'errore.
+
+Il gate si valuta **una volta per acquisizione**: se la misura pendente è fra le
+quote che questa acquisizione riprodurrà non blocca — riacquisire *è* rimisurare
+quelle quote, che questo documento già dichiara la via d'uscita che non richiede
+il capoturno. Fra due acquisizioni, e alla chiusura del ciclo, blocca come prima.
+
+### Il repository è deliberatamente bi-ambiente
+
+`vs-task`, `vs-measure` e `vs-pm2d` dichiarano `requires-python >= 3.13`;
+`vs-core` si ferma a 3.10. Backend e frontend restano su **3.11**, l'albero della
+visione gira su **3.13**, e l'extra `vision` porta i marker d'ambiente che
+tengono separate le due risoluzioni.
+
+Questo rafforza la decisione 4 più di come era argomentata: con VisionSuite dentro
+il server FastAPI, questa scoperta avrebbe costretto l'intero backend a 3.13.
+
+### La versione del motore si timbra al build
+
+`vendor/visionsuite/.git` è un file che rimanda a `../../.git/modules/...`, che
+nel contesto di build non esiste: interrogare git dentro il container non
+funziona. `engine_version()` legge `VISION_ENGINE_VERSION` dall'ambiente, ripiega
+su git nei checkout di sviluppo, e **alza un errore** se non risolve né l'uno né
+l'altro. Il build fallisce se la variabile manca.
+
+### La divisione degli extra compra esplicitezza, non peso
+
+Gli extra sono due — `vision` per il runner, `vision-worker` per il servizio web
+— ed è la forma giusta. Ma la motivazione che sembrava ovvia è falsa: `vs-pm2d`
+dichiara **di suo** `fastapi`, `uvicorn`, `python-multipart` e `pillow`, quindi
+un agente di stazione che fa pattern matching se li porterà dietro comunque. La
+correzione vera è a monte — una libreria non dovrebbe dipendere da un server web
+— e va aggiunta alle verifiche su VisionSuite qui sotto.
+
+### L'immagine di produzione non viene ancora conservata
+
+`vision_results.image_path` e `overlay_path` migrano e restano `NULL`: nulla le
+scrive. Il flusso descritto in questo documento si chiude con «il client mostra
+esito e immagine», e finché quelle colonne sono vuote una misura contestata non
+ha prova materiale. Consegna nominata del piano 1b, insieme all'overlay.
+
+### Prima di applicare le migrazioni in produzione
+
+La 011 rinomina un valore di enum su una tabella in esercizio. Va contato prima
+che nessuna riga usi `xf_compare`: in strict mode una riga sopravvissuta fa
+fallire l'`ALTER` a metà deploy, fuori strict mode diventa `''` in silenzio.
+Attenzione anche alla finestra: il `MODIFY` su `recipe_tasks` è una rinomina di
+valore e userà `ALGORITHM=COPY`, mentre quello su `measurements.input_method`
+aggiunge in coda e dovrebbe restare `INPLACE` — da confermare sulle dimensioni
+reali, perché `measurements` è la tabella grossa.
+
+## Da verificare prima di cominciare
+
+VisionSuite è stato lavorato fino al 15/08/2026 e il suo ultimo commit è
+*«Rassegna delle firme pubbliche prima che si congelino»*: le API si stanno
+stabilizzando proprio ora. Prima di fissare il commit del sottomodulo:
+
+- **il suo README è indietro rispetto al codice.** Dichiara `vs-measure` «da
+  scrivere» quando invece esiste, con circa 4.865 righe e tredici file di test, e
+  dichiara `vs-dxf` non avviabile quando l'import di `common.calibration` non c'è
+  più. Va riletto lo stato reale, non quello documentato.
+- **il test di calibrazione dato per rosso** — la focale recuperata a 373 contro
+  456 attesi, con tolleranza al 5% — va verificato sullo stato attuale. Il README
+  di VisionSuite avverte di guardarlo *prima* di costruirci sopra misure in
+  millimetri, che è esattamente ciò che questo lavoro fa. Le calibrazioni sono
+  state toccate il 13/08 e lo stato potrebbe essere cambiato.
+- **il peso dell'ambiente.** `vs-dxf` dipende da PyTorch e l'installazione
+  completa arriva a circa 5 GB. È la ragione per cui il worker è un container a
+  parte, e va confermato che il solo sottoinsieme necessario pesi meno.

pyproject.toml

@@ -30,6 +30,8 @@ server = [
     "plotly>=5.0.0",
     "kaleido>=0.2.0",
     "weasyprint>=62.0",
+    "pdfplumber>=0.10.0",
+    "httpx>=0.27.0",
 ]
 
 # Frontend (Flask tablet UI).
@@ -51,6 +53,32 @@ dev = [
     "coverage>=7.0.0",
 ]
 
+# Vision runner (VisionSuite submodule): what src/vision/runner.py needs to
+# execute a graph. vs-task/vs-measure/vs-pm2d require Python >=3.13 upstream;
+# marker keeps the base 3.11 resolution untouched. numpy is declared
+# explicitly - runner.py imports it directly, and it must not depend on
+# being pulled in as a side effect of vs-pm2d's own dependencies.
+vision = [
+    "visionsuite; python_version>='3.13'",
+    "vs-task; python_version>='3.13'",
+    "vs-measure; python_version>='3.13'",
+    "vs-pm2d; python_version>='3.13'",
+    "numpy; python_version>='3.13'",
+]
+
+# Vision worker (src/vision_worker/): the FastAPI shell around the runner,
+# on top of `vision`. Kept separate on purpose (Ruling R9) - VisionSuite's
+# whole structure exists so a consumer installs only what it needs, and a
+# later station agent embeds the same runner without being a web service.
+# It must not drag fastapi/uvicorn onto shop-floor PCs.
+vision-worker = [
+    "tiemeasureflow[vision]",
+    "fastapi>=0.110.0; python_version>='3.13'",
+    "uvicorn[standard]>=0.30.0; python_version>='3.13'",
+    "pillow>=10.0.0; python_version>='3.13'",
+    "python-multipart>=0.0.6; python_version>='3.13'",
+]
+
 [project.scripts]
 # Backend
 server = "uvicorn:run"  # placeholder, real CMD lives in Dockerfile
@@ -68,6 +96,12 @@ packages = ["src/backend", "src/frontend"]
 # Pin the resolver to the deps we declared; reproducible builds.
 package = false
 
+[tool.uv.sources]
+visionsuite = { path = "vendor/visionsuite/packages/vs-core", editable = true }
+vs-task     = { path = "vendor/visionsuite/packages/vs-task", editable = true }
+vs-measure  = { path = "vendor/visionsuite/packages/vs-measure", editable = true }
+vs-pm2d     = { path = "vendor/visionsuite/packages/vs-pm2d", editable = true }
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
-testpaths = ["src/backend/tests", "src/frontend/flask_app/tests"]
+testpaths = ["src/backend/tests", "src/frontend/flask_app/tests", "src/vision/tests", "src/vision_worker/tests"]

scripts/seed_collaudo.py

@@ -0,0 +1,321 @@
+"""Seed the recipes used to accept points 2, 3, 5, 8, 9 and 11 on a real screen.
+
+The tests prove the rules hold; this puts them in front of an operator. Two
+recipes, because they need opposite settings:
+
+  COLLAUDO-A  typing allowed, lot compulsory, two measurement tasks with
+              documental tasks before, between and after them, interval of two
+              minutes. This is the one to drive: the measurement loop, the
+              bidirectional countdown, the out-of-tolerance gate, the cycle that
+              closes only on the last measurement task.
+
+  COLLAUDO-B  caliper only, lot and serial compulsory. This one is to look at:
+              the keypad is not drawn, and Avvia does not start until both
+              traceability fields are filled in.
+
+Run it inside the server container, where src.backend and the database settings
+are already in place:
+
+    docker compose cp scripts/seed_collaudo.py server:/tmp/seed_collaudo.py
+    docker compose exec server uv run python /tmp/seed_collaudo.py --station ST-DEFAULT
+
+Re-running finds the recipes already there and stops. --replace deletes them
+first, along with anything measured against them - which is what you want between
+one acceptance session and the next, and never what you want by accident.
+"""
+import argparse
+import asyncio
+import sys
+
+from sqlalchemy import delete, select
+
+sys.path.insert(0, "/app")
+
+from src.backend.database import async_session_factory  # noqa: E402
+from src.backend.models.orm.measurement import Measurement  # noqa: E402
+from src.backend.models.orm.production import (  # noqa: E402
+    ProductionEvent, ProductionRun,
+)
+from src.backend.models.orm.recipe import Recipe, RecipeVersion  # noqa: E402
+from src.backend.models.orm.station import (  # noqa: E402
+    Station, StationRecipeAssignment,
+)
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask  # noqa: E402
+from src.backend.models.orm.user import User  # noqa: E402
+from src.backend.services import auth_service  # noqa: E402
+
+CODES = ("COLLAUDO-A", "COLLAUDO-B")
+
+# Limits chosen so every outcome is one deliberate keystroke away:
+#   10.00 -> conforme      10.30 -> attenzione (dentro tolleranza)
+#   12.00 -> fuori tolleranza, serve il capoturno
+QUOTES_A1 = [
+    dict(marker_number=1, description="Diametro esterno",
+         nominal=10.0, ltl=9.5, lwl=9.8, uwl=10.2, utl=10.5, unit="mm"),
+    dict(marker_number=2, description="Spessore parete",
+         nominal=25.0, ltl=24.5, lwl=24.8, uwl=25.2, utl=25.5, unit="mm"),
+]
+QUOTES_A2 = [
+    dict(marker_number=3, description="Lunghezza totale",
+         nominal=100.0, ltl=99.0, lwl=99.5, uwl=100.5, utl=101.0, unit="mm"),
+]
+QUOTES_B = [
+    dict(marker_number=1, description="Diametro con calibro",
+         nominal=10.0, ltl=9.5, lwl=9.8, uwl=10.2, utl=10.5, unit="mm"),
+]
+
+# A description with a blank line and a bold phrase: point 11 is visible or it is
+# not, and this is where you look.
+NOTA_INIZIALE = (
+    "Prendere il pezzo dalla cassetta **a sinistra** della postazione.\n"
+    "Pulire la superficie prima di misurare.\n\n"
+    "**Attenzione**: non misurare pezzi ancora caldi."
+)
+NOTA_INTERMEDIA = (
+    "Girare il pezzo di **90 gradi** prima della seconda misura.\n"
+    "Se il pezzo non appoggia in piano, ripetere il posizionamento."
+)
+NOTA_FINALE = (
+    "Riporre il pezzo nella cassetta **a destra**.\n"
+    "Segnalare al capoturno qualsiasi quota fuori tolleranza."
+)
+
+
+async def _find_recipes(session, codes):
+    result = await session.execute(select(Recipe).where(Recipe.code.in_(codes)))
+    return list(result.scalars().all())
+
+
+async def _delete_recipes(session, recipes):
+    """Remove the collaudo recipes and everything measured against them."""
+    for recipe in recipes:
+        versions = (await session.execute(
+            select(RecipeVersion.id).where(RecipeVersion.recipe_id == recipe.id)
+        )).scalars().all()
+        runs = (await session.execute(
+            select(ProductionRun.id).where(ProductionRun.recipe_id == recipe.id)
+        )).scalars().all()
+
+        if versions:
+            await session.execute(
+                delete(Measurement).where(Measurement.version_id.in_(versions))
+            )
+        if runs:
+            await session.execute(
+                delete(ProductionEvent).where(ProductionEvent.run_id.in_(runs))
+            )
+            await session.execute(
+                delete(ProductionRun).where(ProductionRun.id.in_(runs))
+            )
+        await session.execute(
+            delete(StationRecipeAssignment).where(
+                StationRecipeAssignment.recipe_id == recipe.id
+            )
+        )
+        # Versions, tasks and subtasks go with the recipe through the ORM cascade.
+        await session.delete(recipe)
+    await session.flush()
+
+
+async def _add_task(session, version_id, order_index, title, task_type,
+                    directive=None, description=None, quotes=()):
+    task = RecipeTask(
+        version_id=version_id,
+        order_index=order_index,
+        title=title,
+        task_type=task_type,
+        directive=directive,
+        description=description,
+    )
+    session.add(task)
+    await session.flush()
+    for quote in quotes:
+        session.add(RecipeSubtask(task_id=task.id, **quote))
+    await session.flush()
+    return task
+
+
+async def _create_recipe(session, user_id, *, code, name, description,
+                         interval, requires_lot, requires_serial,
+                         allow_manual_input):
+    recipe = Recipe(
+        code=code,
+        name=name,
+        description=description,
+        created_by=user_id,
+        active=True,
+        measurement_interval_minutes=interval,
+        requires_lot=requires_lot,
+        requires_serial=requires_serial,
+        allow_manual_input=allow_manual_input,
+    )
+    session.add(recipe)
+    await session.flush()
+
+    version = RecipeVersion(
+        recipe_id=recipe.id,
+        version_number=1,
+        is_current=True,
+        created_by=user_id,
+        change_notes="Ricetta di collaudo",
+    )
+    session.add(version)
+    await session.flush()
+    return recipe, version
+
+
+async def _assign(session, station, recipe, user_id):
+    session.add(StationRecipeAssignment(
+        station_id=station.id, recipe_id=recipe.id, assigned_by=user_id,
+    ))
+    await session.flush()
+
+
+async def _ensure_supervisor(session, username, password):
+    """A capoturno with the role, not an admin standing in for one.
+
+    An admin is accepted by the authorisation check, but the acceptance session
+    should exercise the role the shop floor will actually use.
+    """
+    existing = (await session.execute(
+        select(User).where(User.username == username)
+    )).scalar_one_or_none()
+    if existing is not None:
+        return existing, False
+
+    user = await auth_service.create_user(
+        session,
+        username=username,
+        password=password,
+        display_name="Capo Turno (collaudo)",
+        roles=["Supervisor", "MeasurementTec"],
+    )
+    await session.flush()
+    return user, True
+
+
+async def seed(station_code: str, replace: bool, supervisor_password: str) -> int:
+    async with async_session_factory() as session:
+        owner = (await session.execute(
+            select(User).where(User.is_admin == True)  # noqa: E712
+        )).scalars().first()
+        if owner is None:
+            print("Nessun utente amministratore: impossibile intestare le ricette.")
+            return 2
+
+        station = (await session.execute(
+            select(Station).where(Station.code == station_code)
+        )).scalar_one_or_none()
+        if station is None:
+            print(f"Stazione '{station_code}' inesistente.")
+            return 2
+
+        existing = await _find_recipes(session, CODES)
+        if existing and not replace:
+            found = ", ".join(r.code for r in existing)
+            print(f"Ricette di collaudo gia' presenti ({found}).")
+            print("Usa --replace per rifarle da zero (cancella anche le misure).")
+            return 1
+        if existing:
+            await _delete_recipes(session, existing)
+            print(f"Rimosse: {', '.join(r.code for r in existing)}")
+
+        # ---- COLLAUDO-A: the one to drive ----
+        recipe_a, version_a = await _create_recipe(
+            session, owner.id,
+            code="COLLAUDO-A",
+            name="Collaudo — ciclo di misura",
+            description=(
+                "Due task di misura con task documentali intorno. "
+                "Lotto obbligatorio, inserimento manuale consentito, "
+                "intervallo di 2 minuti."
+            ),
+            interval=2,
+            requires_lot=True,
+            requires_serial=False,
+            allow_manual_input=True,
+        )
+        await _add_task(
+            session, version_a.id, 0, "Preparazione del pezzo", "note",
+            directive="Leggere prima di iniziare",
+            description=NOTA_INIZIALE,
+        )
+        await _add_task(
+            session, version_a.id, 1, "Misura 1 — diametro e spessore", "measure",
+            directive="Misurare le due quote in sequenza",
+            description="Quota **1** e quota **2**.\nUsare il calibro o il tastierino.",
+            quotes=QUOTES_A1,
+        )
+        await _add_task(
+            session, version_a.id, 2, "Riposizionamento", "note",
+            directive="Fra la prima e la seconda misura",
+            description=NOTA_INTERMEDIA,
+        )
+        await _add_task(
+            session, version_a.id, 3, "Misura 2 — lunghezza", "measure",
+            directive="Ultimo task di misura: chiude il ciclo",
+            description="Alla conferma di questa quota **riparte l'intervallo**.",
+            quotes=QUOTES_A2,
+        )
+        await _add_task(
+            session, version_a.id, 4, "Chiusura", "note",
+            directive="Dopo le misure",
+            description=NOTA_FINALE,
+        )
+        await _assign(session, station, recipe_a, owner.id)
+
+        # ---- COLLAUDO-B: the one to look at ----
+        recipe_b, version_b = await _create_recipe(
+            session, owner.id,
+            code="COLLAUDO-B",
+            name="Collaudo — solo calibro",
+            description=(
+                "Lotto e seriale obbligatori, inserimento manuale vietato: "
+                "il tastierino non compare e Avvia non parte finche' mancano i dati."
+            ),
+            interval=5,
+            requires_lot=True,
+            requires_serial=True,
+            allow_manual_input=False,
+        )
+        await _add_task(
+            session, version_b.id, 0, "Misura con calibro", "measure",
+            directive="Il valore deve arrivare dal calibro",
+            description="Nessun tastierino: la ricetta **non ammette valori digitati**.",
+            quotes=QUOTES_B,
+        )
+        await _assign(session, station, recipe_b, owner.id)
+
+        supervisor, created = await _ensure_supervisor(
+            session, "capoturno", supervisor_password,
+        )
+
+        await session.commit()
+
+    print(f"Ricette create e assegnate alla stazione {station_code}:")
+    print("  COLLAUDO-A  ciclo di misura, lotto obbligatorio, intervallo 2 min")
+    print("  COLLAUDO-B  solo calibro, lotto e seriale obbligatori")
+    if created:
+        print(f"Capoturno creato: {supervisor.username} / {supervisor_password}")
+        print("  cambiare la password prima di qualunque uso reale.")
+    else:
+        print(f"Capoturno gia' presente: {supervisor.username} (password invariata)")
+    return 0
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--station", default="ST-DEFAULT",
+                        help="codice della stazione a cui assegnare le ricette")
+    parser.add_argument("--replace", action="store_true",
+                        help="cancella le ricette di collaudo esistenti e le misure fatte su di esse")
+    parser.add_argument("--supervisor-password", default="Collaudo2026!",
+                        help="password del capoturno, se va creato")
+    args = parser.parse_args()
+    return asyncio.run(
+        seed(args.station, args.replace, args.supervisor_password)
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

src/backend/Dockerfile.legacy

@@ -1,26 +0,0 @@
-FROM python:3.11-slim
-
-# Installa dipendenze sistema per WeasyPrint
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpango-1.0-0 \
-    libpangocairo-1.0-0 \
-    libcairo2 \
-    libgdk-pixbuf-2.0-0 \
-    libffi-dev \
-    shared-mime-info \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
-COPY . .
-
-# Crea directory uploads
-RUN mkdir -p uploads/images uploads/pdfs uploads/logos uploads/reports
-
-EXPOSE 8000
-
-# Entry point: Alembic upgrade + Uvicorn
-CMD ["sh", "-c", "alembic -c migrations/alembic.ini upgrade head && uvicorn main:app --host 0.0.0.0 --port 8000 --workers 4 --proxy-headers --forwarded-allow-ips='*'"]

src/backend/api/middleware/__init__.py

@@ -6,6 +6,7 @@ from src.backend.api.middleware.api_key import (
     require_maker,
     require_measurement_tec,
     require_metrologist,
+    require_supervisor,
     require_admin_user,
 )
 from src.backend.api.middleware.logging import AccessLogMiddleware
@@ -19,6 +20,7 @@ __all__ = [
     "require_maker",
     "require_measurement_tec",
     "require_metrologist",
+    "require_supervisor",
     "require_admin_user",
     "AccessLogMiddleware",
     "RateLimitMiddleware",

src/backend/api/middleware/api_key.py

@@ -68,4 +68,5 @@ def require_admin():
 require_maker = require_role("Maker")
 require_measurement_tec = require_role("MeasurementTec")
 require_metrologist = require_role("Metrologist")
+require_supervisor = require_role("Supervisor")
 require_admin_user = require_admin()

src/backend/api/middleware/security_headers.py

@@ -10,16 +10,18 @@ from starlette.middleware.base import BaseHTTPMiddleware
 
 from src.backend.config import settings
 
-# Content Security Policy - allows CDN resources used by the client
+# Content Security Policy - same-origin only: every third-party library now ships with
+# the app (see frontend static/vendor/), so no CDN host needs allowing. The install runs
+# on an isolated shop-floor network where an outbound fetch would simply fail.
 # Note: 'unsafe-eval' required for Plotly.js runtime evaluation in SPC charts
 CSP = (
     "default-src 'self'; "
-    "script-src 'self' 'unsafe-inline' 'unsafe-eval' "
-    "https://cdn.tailwindcss.com https://cdn.jsdelivr.net https://cdn.plot.ly; "
-    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
-    "font-src 'self' https://fonts.gstatic.com; "
+    "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+    "style-src 'self' 'unsafe-inline'; "
+    "font-src 'self'; "
     "img-src 'self' data: blob:; "
-    "connect-src 'self'"
+    "connect-src 'self'; "
+    "worker-src 'self' blob:"
 )
 
 

src/backend/api/routers/files.py

@@ -1,5 +1,5 @@
 """File upload/download/delete router for images and PDFs."""
-import os
+import logging
 import re
 from pathlib import Path
 
@@ -11,6 +11,8 @@ from src.backend.config import settings
 from src.backend.api.middleware.api_key import get_current_user, require_maker
 from src.backend.models.orm.user import User
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(prefix="/api/files", tags=["files"])
 
 # Allowed MIME types
@@ -65,6 +67,37 @@ def sanitize_filename(filename: str) -> str:
     return filename
 
 
+def resolve_upload_path(file_path: str) -> Path:
+    """Resolve a user-supplied relative path inside the uploads directory.
+
+    Raises:
+        HTTPException: 404 if the path escapes the uploads directory,
+            cannot be resolved, or does not point to an existing file.
+    """
+    try:
+        full_path = (settings.upload_path / file_path).resolve()
+        if not full_path.is_relative_to(settings.upload_path.resolve()):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Access denied",
+            )
+    except HTTPException:
+        raise
+    except (OSError, RuntimeError, ValueError):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="File not found",
+        )
+
+    if not full_path.exists() or not full_path.is_file():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="File not found",
+        )
+
+    return full_path
+
+
 def generate_thumbnail(image_path: Path, thumbnail_path: Path, max_size: tuple[int, int] = (200, 200)):
     """Generate a thumbnail for an image."""
     try:
@@ -73,7 +106,7 @@ def generate_thumbnail(image_path: Path, thumbnail_path: Path, max_size: tuple[i
             img.save(thumbnail_path, quality=85)
     except Exception as e:
         # If thumbnail generation fails, we continue without it
-        print(f"Thumbnail generation failed: {e}")
+        logger.warning("Thumbnail generation failed for %s: %s", image_path, e)
 
 
 @router.post("/upload")
@@ -164,30 +197,7 @@ async def get_file(
 
     Requires authentication but no specific role.
     """
-    # Construct full path
-    full_path = settings.upload_path / file_path
-
-    # Security: ensure path is within uploads directory
-    try:
-        full_path = full_path.resolve()
-        if not str(full_path).startswith(str(settings.upload_path.resolve())):
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="Access denied",
-            )
-    except Exception:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="File not found",
-        )
-
-    # Check if file exists
-    if not full_path.exists() or not full_path.is_file():
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="File not found",
-        )
-
+    full_path = resolve_upload_path(file_path)
     return FileResponse(full_path)
 
 
@@ -200,29 +210,7 @@ async def delete_file(
 
     Also deletes associated thumbnail if it exists.
     """
-    # Construct full path
-    full_path = settings.upload_path / file_path
-
-    # Security: ensure path is within uploads directory
-    try:
-        full_path = full_path.resolve()
-        if not str(full_path).startswith(str(settings.upload_path.resolve())):
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="Access denied",
-            )
-    except Exception:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="File not found",
-        )
-
-    # Check if file exists
-    if not full_path.exists() or not full_path.is_file():
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="File not found",
-        )
+    full_path = resolve_upload_path(file_path)
 
     # Delete thumbnail if it exists
     if full_path.parent.name != "thumbnails":

src/backend/api/routers/measurements.py

@@ -19,11 +19,14 @@ from src.backend.models.orm.recipe import RecipeVersion
 from src.backend.models.orm.setting import SystemSetting
 from src.backend.models.orm.user import User
 from src.backend.models.api.measurement import (
+    MeasurementAuthorisation,
     MeasurementBatchCreate,
     MeasurementCreate,
     MeasurementListResponse,
     MeasurementResponse,
+    TaskProgressListResponse,
 )
+from src.backend.services import auth_service, measurement_service
 from src.backend.services.measurement_service import save_measurement
 
 router = APIRouter(prefix="/api/measurements", tags=["measurements"])
@@ -46,6 +49,8 @@ async def create_measurement(
             lot_number=data.lot_number,
             serial_number=data.serial_number,
             input_method=data.input_method,
+            input_duration_ms=data.input_duration_ms,
+            production_run_id=data.production_run_id,
         )
         return MeasurementResponse.model_validate(measurement)
     except ValueError as e:
@@ -55,6 +60,78 @@ async def create_measurement(
         )
 
 
+@router.get("/pending-authorisation", response_model=MeasurementResponse | None)
+async def get_pending_authorisation(
+    version_id: int = Query(..., gt=0),
+    production_run_id: int | None = Query(None, gt=0),
+    user: User = Depends(require_measurement_tec),
+    db: AsyncSession = Depends(get_db),
+):
+    """The out-of-tolerance measurement holding this operator up, or null.
+
+    Asked on load, so that reloading the page is not a way past the gate: the
+    screen finds the same block waiting for it that the server enforces.
+    """
+    blocking = await measurement_service.pending_authorisation(
+        db, version_id, user.id, production_run_id,
+    )
+    return MeasurementResponse.model_validate(blocking) if blocking else None
+
+
+@router.get("/task-progress", response_model=TaskProgressListResponse)
+async def get_task_progress(
+    version_id: int = Query(..., gt=0),
+    production_run_id: int | None = Query(None, gt=0),
+    user: User = Depends(require_measurement_tec),
+    db: AsyncSession = Depends(get_db),
+):
+    """How many quotes of each measurement task are already taken.
+
+    The task list is where an operator picks up work they left behind, and until
+    now it showed a task begun and a task never touched identically.
+    """
+    tasks = await measurement_service.task_progress(
+        db, version_id, user.id, production_run_id,
+    )
+    return TaskProgressListResponse(tasks=tasks)
+
+
+@router.post("/{measurement_id}/authorise", response_model=MeasurementResponse)
+async def authorise_measurement(
+    measurement_id: int,
+    action: MeasurementAuthorisation,
+    user: User = Depends(require_measurement_tec),
+    db: AsyncSession = Depends(get_db),
+):
+    """Let an out-of-tolerance value stand, on the capoturno's name.
+
+    Credentials go to this endpoint rather than to a separate check because the
+    approval has to end up attached to the measurement. A check whose answer is
+    thrown away is what this point had before: a modal that closed.
+    """
+    result = await db.execute(
+        select(Measurement).where(Measurement.id == measurement_id)
+    )
+    measurement = result.scalar_one_or_none()
+    if measurement is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Measurement not found",
+        )
+    if measurement.pass_fail != "fail":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This measurement is within tolerance: there is nothing to authorise",
+        )
+
+    supervisor = await auth_service.authorise_supervisor(
+        db, action.supervisor_username, action.supervisor_password,
+    )
+    measurement = await measurement_service.authorise_measurement(
+        db, measurement, supervisor,
+    )
+    return MeasurementResponse.model_validate(measurement)
+
+
 @router.post("/batch", response_model=list[MeasurementResponse])
 async def create_measurement_batch(
     data: MeasurementBatchCreate,
@@ -74,6 +151,8 @@ async def create_measurement_batch(
                 lot_number=measurement_data.lot_number,
                 serial_number=measurement_data.serial_number,
                 input_method=measurement_data.input_method,
+                input_duration_ms=measurement_data.input_duration_ms,
+                production_run_id=measurement_data.production_run_id,
             )
             measurements.append(measurement)
         return [MeasurementResponse.model_validate(m) for m in measurements]
@@ -84,24 +163,18 @@ async def create_measurement_batch(
         )
 
 
-@router.get("/", response_model=MeasurementListResponse)
-async def get_measurements(
-    recipe_id: int | None = Query(None),
-    version_id: int | None = Query(None),
-    subtask_id: int | None = Query(None),
-    measured_by: int | None = Query(None),
-    lot_number: str | None = Query(None),
-    serial_number: str | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
-    pass_fail: str | None = Query(None, pattern="^(pass|warning|fail)$"),
-    page: int = Query(1, ge=1),
-    per_page: int = Query(50, ge=1, le=500),
-    user: User = Depends(require_metrologist),
-    db: AsyncSession = Depends(get_db),
-):
-    """Query measurements with filters and pagination."""
-    # Build filter conditions
+def _build_measurement_filters(
+    recipe_id: int | None,
+    version_id: int | None,
+    subtask_id: int | None,
+    measured_by: int | None,
+    lot_number: str | None,
+    serial_number: str | None,
+    date_from: datetime | None,
+    date_to: datetime | None,
+    pass_fail: str | None,
+) -> list:
+    """Build SQLAlchemy filter conditions shared by list and CSV export."""
     filters = []
     if recipe_id is not None:
         # Filter by recipe via subquery on RecipeVersion
@@ -125,6 +198,37 @@ async def get_measurements(
         filters.append(Measurement.measured_at <= date_to)
     if pass_fail is not None:
         filters.append(Measurement.pass_fail == pass_fail)
+    return filters
+
+
+@router.get("/", response_model=MeasurementListResponse)
+async def get_measurements(
+    recipe_id: int | None = Query(None),
+    version_id: int | None = Query(None),
+    subtask_id: int | None = Query(None),
+    measured_by: int | None = Query(None),
+    lot_number: str | None = Query(None),
+    serial_number: str | None = Query(None),
+    date_from: datetime | None = Query(None),
+    date_to: datetime | None = Query(None),
+    pass_fail: str | None = Query(None, pattern="^(pass|warning|fail)$"),
+    page: int = Query(1, ge=1),
+    per_page: int = Query(50, ge=1, le=500),
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Query measurements with filters and pagination.
+
+    Available to any authenticated user. The MeasurementTec workflow needs
+    this endpoint to render `task_complete.html` after running through a
+    recipe; the Metrologist dashboard uses the same endpoint with broader
+    filters. Measurements carry no PII beyond numeric values + a recipe
+    reference, so role-gating beyond authentication isn't justified.
+    """
+    filters = _build_measurement_filters(
+        recipe_id, version_id, subtask_id, measured_by, lot_number,
+        serial_number, date_from, date_to, pass_fail,
+    )
 
     # Build query
     query = select(Measurement).where(and_(*filters) if filters else True)
@@ -189,29 +293,10 @@ async def export_measurements_csv(
     decimal_setting = decimal_result.scalar_one_or_none()
     decimal_separator = decimal_setting.setting_value if decimal_setting else "."
 
-    # Build filter conditions (same as get_measurements)
-    filters = []
-    if recipe_id is not None:
-        version_ids = select(RecipeVersion.id).where(
-            RecipeVersion.recipe_id == recipe_id
+    filters = _build_measurement_filters(
+        recipe_id, version_id, subtask_id, measured_by, lot_number,
+        serial_number, date_from, date_to, pass_fail,
     )
-        filters.append(Measurement.version_id.in_(version_ids))
-    if version_id is not None:
-        filters.append(Measurement.version_id == version_id)
-    if subtask_id is not None:
-        filters.append(Measurement.subtask_id == subtask_id)
-    if measured_by is not None:
-        filters.append(Measurement.measured_by == measured_by)
-    if lot_number is not None:
-        filters.append(Measurement.lot_number == lot_number)
-    if serial_number is not None:
-        filters.append(Measurement.serial_number == serial_number)
-    if date_from is not None:
-        filters.append(Measurement.measured_at >= date_from)
-    if date_to is not None:
-        filters.append(Measurement.measured_at <= date_to)
-    if pass_fail is not None:
-        filters.append(Measurement.pass_fail == pass_fail)
 
     # Query all matching measurements
     query = select(Measurement).where(and_(*filters) if filters else True)

src/backend/api/routers/production.py

@@ -0,0 +1,163 @@
+"""Production runs router - open, read, and drive the life of a production.
+
+Deliberately stateless: nothing lives in process memory. With one station app
+installed per PC the database is the only shared place, and any station app must be
+able to ask "what is going on here?" and get the same answer.
+"""
+from fastapi import APIRouter, Depends, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.api.middleware.api_key import get_current_user
+from src.backend.database import get_db
+from src.backend.models.api.production import (
+    CycleCompletePayload,
+    ProductionEventResponse,
+    ProductionRunCreate,
+    ProductionRunResponse,
+    ProductionRunWithEventsResponse,
+    RemeasurePayload,
+    SupervisorAction,
+)
+from src.backend.models.orm.production import ProductionRun
+from src.backend.models.orm.user import User
+from src.backend.services import auth_service, production_service
+
+router = APIRouter(prefix="/api/production-runs", tags=["production"])
+
+_DERIVED = {
+    "seconds_to_next_measurement", "overdue", "server_time", "measurement_task_ids",
+}
+
+
+async def _as_response(db: AsyncSession, run: ProductionRun) -> ProductionRunResponse:
+    """The stored run plus everything the client cannot work out on its own."""
+    return ProductionRunResponse(
+        **ProductionRunResponse.model_validate(run).model_dump(exclude=_DERIVED),
+        **production_service.describe(run),
+        measurement_task_ids=await production_service.measurement_task_ids(
+            db, run.version_id,
+        ),
+    )
+
+
+@router.post("", response_model=ProductionRunResponse, status_code=status.HTTP_201_CREATED)
+async def open_production_run(
+    data: ProductionRunCreate,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Start a production at a station."""
+    run = await production_service.open_run(db, data, user)
+    return await _as_response(db, run)
+
+
+@router.get("/current", response_model=ProductionRunResponse | None)
+async def get_current_production_run(
+    station_code: str = Query(..., min_length=1),
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """The run open at this station, or null.
+
+    This is what every page asks on load instead of keeping the timer in memory.
+    """
+    station = await production_service.get_station_by_code(db, station_code)
+    run = await production_service.get_open_run_for_station(db, station.id)
+    return await _as_response(db, run) if run is not None else None
+
+
+@router.get("/{run_id}", response_model=ProductionRunWithEventsResponse)
+async def get_production_run(
+    run_id: int,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """A run with its full trace - the history a production did not have before."""
+    run = await production_service.get_run(db, run_id)
+    events = await production_service.list_run_events(db, run_id)
+    return ProductionRunWithEventsResponse(
+        **(await _as_response(db, run)).model_dump(),
+        events=[ProductionEventResponse.model_validate(e) for e in events],
+    )
+
+
+@router.post("/{run_id}/cycle", response_model=ProductionRunResponse)
+async def complete_measurement_cycle(
+    run_id: int,
+    payload: CycleCompletePayload | None = None,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Record a finished measurement task; the last one restarts the interval."""
+    run = await production_service.get_run(db, run_id)
+    run = await production_service.complete_cycle(
+        db, run, user,
+        task_id=payload.task_id if payload else None,
+        note=payload.note if payload else None,
+    )
+    return await _as_response(db, run)
+
+
+@router.post("/{run_id}/remeasure", response_model=ProductionRunResponse)
+async def remeasure_in_cycle(
+    run_id: int,
+    payload: RemeasurePayload | None = None,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Turn the piece over and measure again, without closing the cycle."""
+    run = await production_service.get_run(db, run_id)
+    run = await production_service.remeasure(
+        db, run, user,
+        task_id=payload.task_id if payload else None,
+        note=payload.note if payload else None,
+    )
+    return await _as_response(db, run)
+
+
+@router.post("/{run_id}/pause", response_model=ProductionRunResponse)
+async def pause_production_run(
+    run_id: int,
+    action: SupervisorAction,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Fermo linea - requires a supervisor."""
+    run = await production_service.get_run(db, run_id)
+    supervisor = await auth_service.authorise_supervisor(
+        db, action.supervisor_username, action.supervisor_password,
+    )
+    run = await production_service.pause_run(db, run, user, supervisor, note=action.note)
+    return await _as_response(db, run)
+
+
+@router.post("/{run_id}/resume", response_model=ProductionRunResponse)
+async def resume_production_run(
+    run_id: int,
+    action: SupervisorAction,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Restart a stopped line - requires a supervisor."""
+    run = await production_service.get_run(db, run_id)
+    supervisor = await auth_service.authorise_supervisor(
+        db, action.supervisor_username, action.supervisor_password,
+    )
+    run = await production_service.resume_run(db, run, user, supervisor, note=action.note)
+    return await _as_response(db, run)
+
+
+@router.post("/{run_id}/close", response_model=ProductionRunResponse)
+async def close_production_run(
+    run_id: int,
+    action: SupervisorAction,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Fine produzione - requires a supervisor. Stops the timer for good."""
+    run = await production_service.get_run(db, run_id)
+    supervisor = await auth_service.authorise_supervisor(
+        db, action.supervisor_username, action.supervisor_password,
+    )
+    run = await production_service.close_run(db, run, user, supervisor, note=action.note)
+    return await _as_response(db, run)

src/backend/api/routers/recipes.py

@@ -1,5 +1,7 @@
-"""Recipe router - CRUD, versioning, barcode lookup."""
-from fastapi import APIRouter, Depends, Query
+"""Recipe router - CRUD, versioning, barcode lookup, AI parsing."""
+import logging
+
+from fastapi import APIRouter, Depends, File, HTTPException, Query, UploadFile, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.database import get_db
@@ -164,3 +166,31 @@ async def get_measurement_count(
     """
     count = await recipe_service.get_measurement_count(db, recipe_id, version_number)
     return {"recipe_id": recipe_id, "version_number": version_number, "measurement_count": count}
+
+
+@router.post("/{recipe_id}/parse-technical-sheet")
+async def parse_technical_sheet(
+    recipe_id: int,
+    file: UploadFile = File(...),
+    _user: User = Depends(require_maker),
+    db: AsyncSession = Depends(get_db),
+):
+    """Parse a PDF technical sheet using AI and return suggested tasks."""
+    from src.backend.services import ai_service
+
+    if not file.content_type or "pdf" not in file.content_type:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Il file deve essere un PDF")
+
+    pdf_bytes = await file.read()
+    if len(pdf_bytes) > 20 * 1024 * 1024:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="File troppo grande (max 20MB)")
+
+    try:
+        tasks = await ai_service.parse_technical_sheet(pdf_bytes)
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
+    except Exception as e:
+        logging.getLogger(__name__).error("AI parsing error: %s", e)
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="Errore nel servizio AI")
+
+    return {"recipe_id": recipe_id, "suggested_tasks": tasks}

src/backend/api/routers/setup.py

@@ -15,6 +15,7 @@ from pydantic import BaseModel
 from sqlalchemy import inspect as sa_inspect, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from src.backend.api.routers.users import VALID_ROLES
 from src.backend.config import settings
 from src.backend.database import Base, engine, async_session_factory
 from src.backend.models.orm import (
@@ -26,7 +27,7 @@ from src.backend.services.measurement_service import calculate_pass_fail
 
 router = APIRouter(prefix="/api/setup", tags=["setup"])
 
-_templates_dir = Path(__file__).resolve().parent.parent / "templates"
+_templates_dir = Path(__file__).resolve().parent.parent.parent / "templates"
 templates = Jinja2Templates(directory=str(_templates_dir))
 
 
@@ -215,7 +216,7 @@ async def _seed_default_station(session: AsyncSession, admin_user: User) -> None
 async def setup_page(request: Request):
     """Serve the setup page HTML."""
     _check_setup_enabled()
-    return templates.TemplateResponse("setup/setup.html", {"request": request})
+    return templates.TemplateResponse(request, "setup/setup.html")
 
 
 @router.get("/status")
@@ -544,7 +545,6 @@ async def manage_user(body: ManageUserBody):
     """Create or update a user. user_id=null creates new, user_id=int updates."""
     _check_password(body.password)
 
-    VALID_ROLES = {"Maker", "MeasurementTec", "Metrologist"}
     invalid = set(body.roles) - VALID_ROLES
     if invalid:
         raise HTTPException(

src/backend/api/routers/stations.py

@@ -11,6 +11,8 @@ from src.backend.models.api.station import (
     StationResponse,
     StationRecipeAssignmentCreate,
     StationRecipeAssignmentResponse,
+    StationResetResponse,
+    StationWithRecipesResponse,
     RecipeSummary,
 )
 from src.backend.services import station_service
@@ -18,15 +20,36 @@ from src.backend.services import station_service
 router = APIRouter(prefix="/api/stations", tags=["stations"])
 
 
-@router.get("", response_model=list[StationResponse])
+@router.get("", response_model=list[StationWithRecipesResponse])
 async def list_stations(
     active_only: bool = False,
     admin: User = Depends(require_admin_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """List all stations (admin only)."""
+    """List all stations with the recipes assigned to each (admin only).
+
+    The admin station list shows which products a station handles, so the
+    assignments travel with the station instead of needing a call per row.
+    Station.assignments is selectin-loaded, so this costs no extra query.
+
+    Only active recipes are listed, matching what an operator actually sees
+    at that station via /by-code/{code}/recipes.
+    """
     stations = await station_service.list_stations(db, active_only=active_only)
-    return [StationResponse.model_validate(s) for s in stations]
+    return [
+        StationWithRecipesResponse(
+            **StationResponse.model_validate(s).model_dump(),
+            recipes=sorted(
+                (
+                    RecipeSummary.model_validate(a.recipe)
+                    for a in s.assignments
+                    if a.recipe is not None and a.recipe.active
+                ),
+                key=lambda r: r.code,
+            ),
+        )
+        for s in stations
+    ]
 
 
 @router.post("", response_model=StationResponse, status_code=status.HTTP_201_CREATED)
@@ -128,6 +151,22 @@ async def assign_recipe_to_station(
     return StationRecipeAssignmentResponse.model_validate(assignment)
 
 
+@router.delete("/{station_id}/recipes", response_model=StationResetResponse)
+async def reset_station_recipes(
+    station_id: int,
+    admin: User = Depends(require_admin_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Clear every recipe assignment of a station (admin only).
+
+    Backs the per-row reset in the admin list: the station is left with no
+    recipes and can be reassigned from scratch, without deleting the station
+    itself. Idempotent - resetting an already empty station reports removed=0.
+    """
+    removed = await station_service.unassign_all_recipes(db, station_id)
+    return StationResetResponse(station_id=station_id, removed=removed)
+
+
 @router.delete(
     "/{station_id}/recipes/{recipe_id}",
     status_code=status.HTTP_204_NO_CONTENT,

src/backend/api/routers/tasks.py

@@ -172,12 +172,14 @@ async def create_task(
     new_task = RecipeTask(
         version_id=new_version.id,
         order_index=max_order + 1,
+        task_type=data.task_type,
         title=data.title,
         directive=data.directive,
         description=data.description,
         file_path=data.file_path,
         file_type=data.file_type,
         annotations_json=data.annotations_json,
+        vision_json=data.vision_json,
     )
     db.add(new_task)
     await db.flush()
@@ -196,6 +198,7 @@ async def create_task(
             ltl=sub_data.ltl,
             unit=sub_data.unit,
             image_path=sub_data.image_path,
+            vision_output=sub_data.vision_output,
         )
         db.add(sub)
 
@@ -223,7 +226,10 @@ async def reorder_tasks(
     result = await db.execute(
         select(RecipeTask)
         .where(RecipeTask.id.in_(data.task_ids))
-        .options(selectinload(RecipeTask.subtasks))
+        .options(
+            selectinload(RecipeTask.subtasks),
+            selectinload(RecipeTask.version),
+        )
     )
     tasks_map = {t.id: t for t in result.scalars().all()}
 
@@ -336,6 +342,7 @@ async def create_subtask(
         ltl=data.ltl,
         unit=data.unit,
         image_path=data.image_path,
+        vision_output=data.vision_output,
     )
     db.add(subtask)
     await db.flush()

src/backend/api/routers/users.py

@@ -11,6 +11,10 @@ from src.backend.services.auth_service import create_user, hash_password, regene
 
 router = APIRouter(prefix="/api/users", tags=["users"])
 
+# Combinable user roles. Supervisor (capoturno) authorizes out-of-tolerance
+# overrides during measurement without needing full admin privileges.
+VALID_ROLES = {"Maker", "MeasurementTec", "Metrologist", "Supervisor"}
+
 
 @router.get("", response_model=list[UserResponse])
 async def list_users(
@@ -40,12 +44,11 @@ async def create_new_user(
             detail=f"Username '{data.username}' already exists",
         )
     # Validate roles
-    valid_roles = {"Maker", "MeasurementTec", "Metrologist"}
     for role in data.roles:
-        if role not in valid_roles:
+        if role not in VALID_ROLES:
             raise HTTPException(
                 status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                detail=f"Invalid role '{role}'. Valid roles: {valid_roles}",
+                detail=f"Invalid role '{role}'. Valid roles: {VALID_ROLES}",
             )
     user = await create_user(
         db,
@@ -77,12 +80,11 @@ async def update_user(
     update_data = data.model_dump(exclude_unset=True)
     # Validate roles if provided
     if "roles" in update_data:
-        valid_roles = {"Maker", "MeasurementTec", "Metrologist"}
         for role in update_data["roles"]:
-            if role not in valid_roles:
+            if role not in VALID_ROLES:
                 raise HTTPException(
                     status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                    detail=f"Invalid role '{role}'. Valid roles: {valid_roles}",
+                    detail=f"Invalid role '{role}'. Valid roles: {VALID_ROLES}",
                 )
     for field, value in update_data.items():
         setattr(user, field, value)

src/backend/api/routers/vision.py

@@ -0,0 +1,133 @@
+"""The client asks for a measurement and gets an outcome.
+
+It does not know, and must not know, whether the server or the station computed
+the numbers: that is what lets a station's configuration change without touching
+the frontend or the recipes.
+"""
+from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.api.middleware.api_key import require_maker, require_measurement_tec
+from src.backend.api.routers.files import ALLOWED_IMAGE_TYPES, validate_file_size
+from src.backend.config import settings
+from src.backend.database import get_db
+from src.backend.models.api.vision import VisionExecuteResponse, VisionMeasurementResult
+from src.backend.models.orm.task import RecipeTask
+from src.backend.models.orm.user import User
+from src.backend.services import vision_service
+
+router = APIRouter(prefix="/api/vision", tags=["vision"])
+
+# A vision graph measures pixels, not a PDF: stricter than files.py's
+# ALLOWED_TYPES, which also accepts documents for technical drawings.
+_IMAGE_EXTENSIONS = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/gif": "gif",
+    "image/webp": "webp",
+}
+
+
+async def _task_or_404(db: AsyncSession, task_id: int) -> RecipeTask:
+    """Shared by the endpoints of this router."""
+    task = (await db.execute(
+        select(RecipeTask).where(RecipeTask.id == task_id)
+    )).scalar_one_or_none()
+    if task is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Task not found"
+        )
+    return task
+
+
+async def _read_image(image: UploadFile) -> bytes:
+    """Type checked from the header before reading, size checked once the body
+    is in hand - the same two-step convention `files.py::upload_file` already
+    uses, reused rather than reinvented here.
+    """
+    if image.content_type not in ALLOWED_IMAGE_TYPES:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File type {image.content_type} not allowed. Must be an image.",
+        )
+    content = await image.read()
+    if not validate_file_size(len(content)):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=(
+                f"File size {len(content)} bytes exceeds maximum "
+                f"{settings.max_upload_size_mb}MB"
+            ),
+        )
+    return content
+
+
+@router.post("/execute", response_model=VisionExecuteResponse)
+async def execute(
+    task_id: int = Form(...),
+    image: UploadFile = File(...),
+    lot_number: str | None = Form(None),
+    serial_number: str | None = Form(None),
+    production_run_id: int | None = Form(None),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_measurement_tec),
+) -> VisionExecuteResponse:
+    task = await _task_or_404(db, task_id)
+
+    result, saved = await vision_service.execute_task(
+        db,
+        task,
+        await _read_image(image),
+        current_user.id,
+        version_id=task.version_id,
+        lot_number=lot_number,
+        serial_number=serial_number,
+        production_run_id=production_run_id,
+    )
+    await db.commit()
+
+    return VisionExecuteResponse(
+        vision_result_id=result.id,
+        engine_version=result.engine_version,
+        measurements=[
+            VisionMeasurementResult(
+                subtask_id=m.subtask_id, value=float(m.value), pass_fail=m.pass_fail,
+            )
+            for m in saved
+        ],
+    )
+
+
+# Composing a recipe and keeping a reference image are Maker operations, not
+# measuring: both endpoints below gate on `require_maker`, not the
+# `require_measurement_tec` that `execute` above uses.
+
+
+@router.post("/reference-images")
+async def add_reference_image(
+    task_id: int = Form(...),
+    image: UploadFile = File(...),
+    note: str | None = Form(None),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_maker),
+) -> dict:
+    task = await _task_or_404(db, task_id)
+    content = await _read_image(image)
+    reference = await vision_service.save_reference_image(
+        db, task.id, content, note=note,
+        extension=_IMAGE_EXTENSIONS[image.content_type],
+    )
+    await db.commit()
+    return {"id": reference.id, "path": reference.path, "note": reference.note}
+
+
+@router.post("/preview")
+async def preview(
+    task_id: int = Form(...),
+    image: UploadFile = File(...),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_maker),
+) -> dict:
+    task = await _task_or_404(db, task_id)
+    return await vision_service.preview(db, task, await _read_image(image))

src/backend/config.py

@@ -34,6 +34,13 @@ class Settings(BaseSettings):
     # Setup page (empty = disabled)
     setup_password: str | None = None
 
+    # AI / OpenRouter (for technical sheet parsing)
+    openrouter_api_key: str | None = None
+    openrouter_model: str = "anthropic/claude-sonnet-4"
+
+    # Vision worker (internal network only, reachable as `vision` in Compose)
+    vision_worker_url: str = "http://vision:8100"
+
     @property
     def database_url(self) -> str:
         """Async MySQL connection string."""
@@ -57,8 +64,13 @@ class Settings(BaseSettings):
         # Path(__file__) = src/backend/config.py → parents[2] = project root
         return Path(__file__).resolve().parents[2] / self.upload_dir
 
-    # ../../.env reaches the project root from src/backend/.
-    model_config = {"env_file": "../../.env", "env_file_encoding": "utf-8", "extra": "ignore"}
+    # Always resolve .env against the project root regardless of cwd
+    # (pydantic-settings would otherwise treat the path as cwd-relative).
+    model_config = {
+        "env_file": str(Path(__file__).resolve().parents[2] / ".env"),
+        "env_file_encoding": "utf-8",
+        "extra": "ignore",
+    }
 
 
 settings = Settings()

src/backend/main.py

@@ -21,6 +21,8 @@ from src.backend.api.routers.reports import router as reports_router
 from src.backend.api.routers.statistics import router as statistics_router
 from src.backend.api.routers.setup import router as setup_router
 from src.backend.api.routers.stations import router as stations_router
+from src.backend.api.routers.production import router as production_router
+from src.backend.api.routers.vision import router as vision_router
 
 
 @asynccontextmanager
@@ -73,6 +75,8 @@ app.include_router(statistics_router)
 app.include_router(reports_router)
 app.include_router(setup_router)
 app.include_router(stations_router)
+app.include_router(production_router)
+app.include_router(vision_router)
 
 
 @app.get("/api/health")

src/backend/migrations/env.py

@@ -36,6 +36,8 @@ from src.backend.models.orm.task import RecipeTask, RecipeSubtask  # noqa: F401
 from src.backend.models.orm.measurement import Measurement  # noqa: F401
 from src.backend.models.orm.access_log import AccessLog  # noqa: F401
 from src.backend.models.orm.setting import SystemSetting, RecipeVersionAudit  # noqa: F401
+from src.backend.models.orm.station import Station, StationRecipeAssignment  # noqa: F401
+from src.backend.models.orm.production import ProductionRun, ProductionEvent  # noqa: F401
 
 target_metadata = Base.metadata
 

src/backend/migrations/versions/003_add_measurement_interval_and_auto_logout.py

@@ -0,0 +1,24 @@
+"""add measurement_interval_minutes to recipes
+
+Revision ID: 003_measurement_interval
+Revises: 002_add_stations
+Create Date: 2026-05-23
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '003_measurement_interval'
+down_revision: Union[str, None] = '002_add_stations'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('recipes', sa.Column('measurement_interval_minutes', sa.SmallInteger(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('recipes', 'measurement_interval_minutes')

src/backend/migrations/versions/004_add_input_duration_ms.py

@@ -0,0 +1,27 @@
+"""add input_duration_ms to measurements
+
+Revision ID: 004_input_duration
+Revises: 003_measurement_interval
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '004_input_duration'
+down_revision: Union[str, None] = '003_measurement_interval'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        'measurements',
+        sa.Column('input_duration_ms', sa.Integer, nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column('measurements', 'input_duration_ms')

src/backend/migrations/versions/005_add_production_runs.py

@@ -0,0 +1,100 @@
+"""add production_runs and production_events
+
+Gives a production a life of its own: before this its state lived in the Alpine
+component of task_execute.html, so changing task - a full page load - lost the timer,
+the cycle count and the "production started" flag.
+
+Revision ID: 005_production_runs
+Revises: 004_input_duration
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '005_production_runs'
+down_revision: Union[str, None] = '004_input_duration'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'production_runs',
+        sa.Column('id', sa.Integer, primary_key=True, autoincrement=True),
+        sa.Column('station_id', sa.Integer, sa.ForeignKey('stations.id'), nullable=False),
+        sa.Column('recipe_id', sa.Integer, sa.ForeignKey('recipes.id'), nullable=False),
+        sa.Column('version_id', sa.Integer, sa.ForeignKey('recipe_versions.id'), nullable=False),
+        sa.Column('operator_id', sa.Integer, sa.ForeignKey('users.id'), nullable=False),
+        sa.Column('lot_number', sa.String(100), nullable=True),
+        sa.Column('serial_number', sa.String(100), nullable=True),
+        sa.Column(
+            'status',
+            sa.Enum('running', 'paused', 'closed', name='production_run_status_enum'),
+            nullable=False,
+            server_default='running',
+        ),
+        sa.Column('measurement_interval_minutes', sa.SmallInteger, nullable=True),
+        sa.Column('next_measurement_at', sa.DateTime, nullable=True),
+        sa.Column('cycle_count', sa.Integer, nullable=False, server_default='0'),
+        sa.Column('started_at', sa.DateTime, nullable=False, server_default=sa.func.now()),
+        sa.Column('paused_at', sa.DateTime, nullable=True),
+        sa.Column('closed_at', sa.DateTime, nullable=True),
+        sa.Column('closed_by', sa.Integer, sa.ForeignKey('users.id'), nullable=True),
+        # Mirrors station_id while open, NULL once closed. The unique constraint makes
+        # "one open run per station" a database guarantee rather than a race; repeated
+        # NULLs do not collide, so closed runs are free to pile up.
+        sa.Column('active_station_id', sa.Integer, nullable=True),
+        # Declared inline rather than added afterwards: adding a constraint is an ALTER,
+        # which SQLite cannot do, and the test databases are SQLite.
+        sa.UniqueConstraint('active_station_id', name='uq_production_runs_active_station'),
+        mysql_engine='InnoDB',
+        mysql_charset='utf8mb4',
+    )
+    op.create_index('ix_production_runs_station_id', 'production_runs', ['station_id'])
+    op.create_index('ix_production_runs_recipe_id', 'production_runs', ['recipe_id'])
+    op.create_index('ix_production_runs_version_id', 'production_runs', ['version_id'])
+    op.create_index('ix_production_runs_operator_id', 'production_runs', ['operator_id'])
+    op.create_index('ix_production_runs_lot_number', 'production_runs', ['lot_number'])
+    op.create_index('ix_production_runs_serial_number', 'production_runs', ['serial_number'])
+    op.create_index('ix_production_runs_status', 'production_runs', ['status'])
+    op.create_index(
+        'ix_production_runs_next_measurement_at', 'production_runs', ['next_measurement_at'],
+    )
+    op.create_index(
+        'ix_production_runs_station_status', 'production_runs', ['station_id', 'status'],
+    )
+
+    op.create_table(
+        'production_events',
+        sa.Column('id', sa.Integer, primary_key=True, autoincrement=True),
+        sa.Column(
+            'run_id', sa.Integer,
+            sa.ForeignKey('production_runs.id', ondelete='CASCADE'), nullable=False,
+        ),
+        sa.Column(
+            'event_type',
+            sa.Enum(
+                'start', 'cycle_completed', 'line_stop', 'resume', 'close',
+                name='production_event_type_enum',
+            ),
+            nullable=False,
+        ),
+        sa.Column('user_id', sa.Integer, sa.ForeignKey('users.id'), nullable=False),
+        sa.Column('supervisor_id', sa.Integer, sa.ForeignKey('users.id'), nullable=True),
+        sa.Column('note', sa.Text, nullable=True),
+        sa.Column('created_at', sa.DateTime, nullable=False, server_default=sa.func.now()),
+        mysql_engine='InnoDB',
+        mysql_charset='utf8mb4',
+    )
+    op.create_index('ix_production_events_run_id', 'production_events', ['run_id'])
+    op.create_index('ix_production_events_event_type', 'production_events', ['event_type'])
+    op.create_index('ix_production_events_user_id', 'production_events', ['user_id'])
+    op.create_index('ix_production_events_created_at', 'production_events', ['created_at'])
+
+
+def downgrade() -> None:
+    op.drop_table('production_events')
+    op.drop_table('production_runs')

src/backend/migrations/versions/006_link_measurements_to_production.py

@@ -0,0 +1,63 @@
+"""link measurements to their production run
+
+Fine produzione has to hand the measurements of the whole production to the
+statistics file. Without this column "the measurements of this production" is not a
+query: measurements only knew their recipe version, lot and serial, none of which
+delimits one run from the next on the same recipe and lot.
+
+Nullable on purpose: measurements taken before this - and any taken outside a
+production - simply have no run.
+
+Revision ID: 006_measurement_run
+Revises: 005_production_runs
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '006_measurement_run'
+down_revision: Union[str, None] = '005_production_runs'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Batch mode, because the column carries a foreign key: adding a constraint is
+    # an ALTER that SQLite cannot do, and alembic raises rather than silently
+    # dropping it. On MySQL this is a plain ALTER; on SQLite it rebuilds the table.
+    # Keeping the key is worth the ceremony - ON DELETE SET NULL means a measurement,
+    # the record that matters in an audit, survives its run being deleted.
+    with op.batch_alter_table('measurements') as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                'production_run_id', sa.Integer,
+                sa.ForeignKey(
+                    'production_runs.id',
+                    ondelete='SET NULL',
+                    # Named because batch mode requires it, and because an anonymous
+                    # constraint cannot be referred to later.
+                    name='fk_measurements_production_run',
+                ),
+                nullable=True,
+            ),
+        )
+    op.create_index(
+        'ix_measurements_production_run_id', 'measurements', ['production_run_id'],
+    )
+
+    # Where the statistics file for a closed run was written. No constraint, so a
+    # plain ALTER is enough.
+    op.add_column(
+        'production_runs',
+        sa.Column('statistics_path', sa.String(500), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column('production_runs', 'statistics_path')
+    op.drop_index('ix_measurements_production_run_id', table_name='measurements')
+    with op.batch_alter_table('measurements') as batch_op:
+        batch_op.drop_column('production_run_id')

src/backend/migrations/versions/007_add_task_type.py

@@ -0,0 +1,64 @@
+"""add an explicit type to recipe tasks
+
+Until now the kind of a task was deduced: quotes present meant a measurement,
+otherwise a note. A measurement task whose quotes had not been entered yet was
+therefore treated as a note - the system behaved differently depending on how
+complete the recipe happened to be.
+
+Existing rows are classified by the rule that was in force, so nothing changes
+behaviour on upgrade: tasks with quotes become 'measure'. Tasks with no quotes but
+a drawing attached become 'drawing' rather than 'note' - that is what they already
+displayed as, and calling them notes would be the one place this migration did
+change behaviour.
+
+Revision ID: 007_task_type
+Revises: 006_measurement_run
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '007_task_type'
+down_revision: Union[str, None] = '006_measurement_run'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+TASK_TYPES = ('note', 'measure', 'drawing', 'xf_compare', 'camera_measure')
+
+
+def upgrade() -> None:
+    op.add_column(
+        'recipe_tasks',
+        sa.Column(
+            'task_type',
+            sa.Enum(*TASK_TYPES, name='task_type_enum'),
+            nullable=False,
+            server_default='note',
+        ),
+    )
+    op.create_index('ix_recipe_tasks_task_type', 'recipe_tasks', ['task_type'])
+
+    # Backfill by the rule the frontend used, so no recipe changes behaviour.
+    op.execute(
+        """
+        UPDATE recipe_tasks
+           SET task_type = 'measure'
+         WHERE id IN (SELECT DISTINCT task_id FROM recipe_subtasks)
+        """
+    )
+    op.execute(
+        """
+        UPDATE recipe_tasks
+           SET task_type = 'drawing'
+         WHERE task_type = 'note'
+           AND file_path IS NOT NULL
+        """
+    )
+
+
+def downgrade() -> None:
+    op.drop_index('ix_recipe_tasks_task_type', table_name='recipe_tasks')
+    op.drop_column('recipe_tasks', 'task_type')

src/backend/migrations/versions/008_measurement_loop_events.py

@@ -0,0 +1,74 @@
+"""widen the production event trace for the measurement loop
+
+The loop needs to distinguish two things the trace could not say before: a
+measurement task finished while the cycle is still running (task_measured), and the
+piece turned over and measured again without closing the cycle (remeasure). Only
+the last measurement task of a recipe still produces cycle_completed, because only
+that one restarts the interval.
+
+Both values are added in one go. Widening a MySQL enum rewrites the table, so the
+values that are already planned go in now rather than one migration at a time -
+the same reasoning as the task types in 007.
+
+The events that happen inside a cycle also need to say which task they are about,
+so the column comes with them: a task_measured that does not name its task records
+nothing usable.
+
+Revision ID: 008_loop_events
+Revises: 007_task_type
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '008_loop_events'
+down_revision: Union[str, None] = '007_task_type'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+OLD_TYPES = ('start', 'cycle_completed', 'line_stop', 'resume', 'close')
+NEW_TYPES = (
+    'start', 'cycle_completed', 'task_measured', 'remeasure',
+    'line_stop', 'resume', 'close',
+)
+
+
+def _alter(values: Sequence[str]) -> None:
+    """Restate the column with a new set of allowed values.
+
+    On MySQL this is the ALTER that rewrites the enum. On SQLite, where an enum is
+    stored as a plain VARCHAR, batch mode rebuilds the table instead of emitting an
+    ALTER the engine does not support - the tests run there.
+    """
+    with op.batch_alter_table('production_events') as batch:
+        batch.alter_column(
+            'event_type',
+            existing_type=sa.Enum(*OLD_TYPES, name='production_event_type_enum'),
+            type_=sa.Enum(*values, name='production_event_type_enum'),
+            existing_nullable=False,
+        )
+
+
+def upgrade() -> None:
+    _alter(NEW_TYPES)
+    with op.batch_alter_table('production_events') as batch:
+        batch.add_column(sa.Column('task_id', sa.Integer(), nullable=True))
+        batch.create_foreign_key(
+            'fk_production_events_task_id', 'recipe_tasks', ['task_id'], ['id'],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('production_events') as batch:
+        batch.drop_constraint('fk_production_events_task_id', type_='foreignkey')
+        batch.drop_column('task_id')
+    # The new kinds of event have no equivalent in the old vocabulary, and a row
+    # left with a value the column no longer accepts would fail the rebuild.
+    op.execute(
+        "DELETE FROM production_events "
+        "WHERE event_type IN ('task_measured', 'remeasure')"
+    )
+    _alter(OLD_TYPES)

src/backend/migrations/versions/009_recipe_measurement_rules.py

@@ -0,0 +1,57 @@
+"""traceability and manual input become rules of the recipe
+
+Three settings that were nowhere: whether the lot and the serial are compulsory,
+and whether a value may be typed instead of read from the caliper. Until now lot
+and serial were optional everywhere and the keypad was always available, so a
+value that happens to be in tolerance could simply be entered by hand.
+
+Backfill: the two traceability flags start false, which is exactly today's
+behaviour. Manual input starts *true* on the recipes that already exist - the
+column default is false, so recipes written from now on are caliper-only, but
+flipping the ones already in use would stop a running line at the next
+measurement. Turning them off is a decision for whoever owns the recipe, taken in
+the editor, not a side effect of an upgrade.
+
+Revision ID: 009_recipe_rules
+Revises: 008_loop_events
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '009_recipe_rules'
+down_revision: Union[str, None] = '008_loop_events'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        'recipes',
+        sa.Column(
+            'requires_lot', sa.Boolean(), nullable=False, server_default='0',
+        ),
+    )
+    op.add_column(
+        'recipes',
+        sa.Column(
+            'requires_serial', sa.Boolean(), nullable=False, server_default='0',
+        ),
+    )
+    op.add_column(
+        'recipes',
+        sa.Column(
+            'allow_manual_input', sa.Boolean(), nullable=False, server_default='0',
+        ),
+    )
+    # Recipes already in production keep the behaviour they were written under.
+    op.execute("UPDATE recipes SET allow_manual_input = 1")
+
+
+def downgrade() -> None:
+    op.drop_column('recipes', 'allow_manual_input')
+    op.drop_column('recipes', 'requires_serial')
+    op.drop_column('recipes', 'requires_lot')

src/backend/migrations/versions/010_measurement_authorisation.py

@@ -0,0 +1,49 @@
+"""record who authorised an out-of-tolerance measurement
+
+The supervisor gate existed on screen and nowhere else: the modal opened, the
+credentials were checked, the modal closed, and nothing was written down. Nothing
+depended on the answer either, so a value outside tolerance could be left behind
+by dismissing the modal.
+
+These two columns are what the rule now stands on. A failed measurement with no
+supervisor on it is a measurement waiting for one, and while one is waiting the
+operator cannot move to the next quote.
+
+Existing rows are left null. Backfilling an authorisation that never happened
+would be inventing an audit record; the fails already in the database belong to
+production runs that are over, and nothing is waiting on them.
+
+Revision ID: 010_meas_authorisation
+Revises: 009_recipe_rules
+Create Date: 2026-07-28
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '010_meas_authorisation'
+down_revision: Union[str, None] = '009_recipe_rules'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('measurements') as batch:
+        batch.add_column(sa.Column('supervisor_id', sa.Integer(), nullable=True))
+        batch.add_column(sa.Column('authorised_at', sa.DateTime(), nullable=True))
+        batch.create_foreign_key(
+            'fk_measurements_supervisor_id', 'users', ['supervisor_id'], ['id'],
+        )
+        batch.create_index(
+            'ix_measurements_supervisor_id', ['supervisor_id'],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('measurements') as batch:
+        batch.drop_index('ix_measurements_supervisor_id')
+        batch.drop_constraint('fk_measurements_supervisor_id', type_='foreignkey')
+        batch.drop_column('authorised_at')
+        batch.drop_column('supervisor_id')

src/backend/migrations/versions/011_vision_graph.py

@@ -0,0 +1,55 @@
+"""the vision graph lives on the task, and the quote names its output
+
+`xf_compare` was a typo for `dxf_compare`. No row uses either value yet, so
+renaming costs one statement here; from the first saved task onwards it would
+be a data migration and the typo would already be in the public API.
+
+Revision ID: 011_vision_graph
+Revises: 010_meas_authorisation
+Create Date: 2026-08-16
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '011_vision_graph'
+down_revision: Union[str, None] = '010_meas_authorisation'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+OLD_TYPES = ('note', 'measure', 'drawing', 'xf_compare', 'camera_measure')
+NEW_TYPES = ('note', 'measure', 'drawing', 'dxf_compare', 'camera_measure')
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('recipe_tasks') as batch:
+        batch.add_column(sa.Column('vision_json', sa.JSON(), nullable=True))
+        batch.alter_column(
+            'task_type',
+            existing_type=sa.Enum(*OLD_TYPES, name='task_type_enum'),
+            type_=sa.Enum(*NEW_TYPES, name='task_type_enum'),
+            existing_nullable=False,
+            existing_server_default='note',
+        )
+
+    with op.batch_alter_table('recipe_subtasks') as batch:
+        batch.add_column(
+            sa.Column('vision_output', sa.String(length=120), nullable=True)
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('recipe_subtasks') as batch:
+        batch.drop_column('vision_output')
+
+    with op.batch_alter_table('recipe_tasks') as batch:
+        batch.alter_column(
+            'task_type',
+            existing_type=sa.Enum(*NEW_TYPES, name='task_type_enum'),
+            type_=sa.Enum(*OLD_TYPES, name='task_type_enum'),
+            existing_nullable=False,
+            existing_server_default='note',
+        )
+        batch.drop_column('vision_json')

src/backend/migrations/versions/012_vision_results.py

@@ -0,0 +1,79 @@
+"""one row per vision execution, and camera as an input method
+
+The vision surroundings do not go on `measurements`: statistics and the export
+read that table on every pass. And it would be wrong modelling anyway - one
+acquisition produces N quotes, and image, overlay, device and engine version are
+the same for all of them.
+
+Revision ID: 012_vision_results
+Revises: 011_vision_graph
+Create Date: 2026-08-16
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '012_vision_results'
+down_revision: Union[str, None] = '011_vision_graph'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+OLD_METHODS = ('usb_caliper', 'manual')
+NEW_METHODS = ('usb_caliper', 'manual', 'camera')
+
+
+def upgrade() -> None:
+    op.create_table(
+        'vision_results',
+        sa.Column('id', sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column('task_id', sa.Integer(),
+                  sa.ForeignKey('recipe_tasks.id'), nullable=False, index=True),
+        sa.Column('image_path', sa.String(length=500), nullable=True),
+        sa.Column('overlay_path', sa.String(length=500), nullable=True),
+        sa.Column('engine_version', sa.String(length=64), nullable=False),
+        sa.Column('executed_on',
+                  sa.Enum('server', 'station', name='vision_executed_on_enum'),
+                  nullable=False),
+        sa.Column('station_id', sa.Integer(),
+                  sa.ForeignKey('stations.id'), nullable=True),
+        sa.Column('device_code', sa.String(length=100), nullable=True),
+        sa.Column('calibration_snapshot', sa.JSON(), nullable=True),
+        sa.Column('graph_snapshot', sa.JSON(), nullable=False),
+        sa.Column('duration_ms', sa.Integer(), nullable=True),
+        sa.Column('executed_at', sa.DateTime(), nullable=False,
+                  server_default=sa.func.now()),
+        mysql_engine='InnoDB',
+        mysql_charset='utf8mb4',
+    )
+
+    with op.batch_alter_table('measurements') as batch:
+        batch.alter_column(
+            'input_method',
+            existing_type=sa.Enum(*OLD_METHODS, name='input_method_enum'),
+            type_=sa.Enum(*NEW_METHODS, name='input_method_enum'),
+            existing_nullable=False,
+        )
+        batch.add_column(
+            sa.Column('vision_result_id', sa.Integer(), nullable=True)
+        )
+        batch.create_foreign_key(
+            'fk_measurements_vision_result',
+            'vision_results', ['vision_result_id'], ['id'],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('measurements') as batch:
+        batch.drop_constraint('fk_measurements_vision_result',
+                              type_='foreignkey')
+        batch.drop_column('vision_result_id')
+        batch.alter_column(
+            'input_method',
+            existing_type=sa.Enum(*NEW_METHODS, name='input_method_enum'),
+            type_=sa.Enum(*OLD_METHODS, name='input_method_enum'),
+            existing_nullable=False,
+        )
+
+    op.drop_table('vision_results')

src/backend/migrations/versions/013_reference_images.py

@@ -0,0 +1,49 @@
+"""reference images, with their provenance
+
+A reference image without provenance is a trap: the graph is re-run months later,
+different numbers come out, and there is no way to tell an updated engine from a
+moved lens.
+
+`expected_json` holds what the graph is supposed to produce on this image. It is
+what makes a regression run possible after a VisionSuite upgrade - the safety net
+that makes bumping the submodule sustainable with an engine on two hosts.
+
+Revision ID: 013_reference_images
+Revises: 012_vision_results
+Create Date: 2026-08-16
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '013_reference_images'
+down_revision: Union[str, None] = '012_vision_results'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'vision_reference_images',
+        sa.Column('id', sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column('task_id', sa.Integer(),
+                  sa.ForeignKey('recipe_tasks.id'), nullable=False, index=True),
+        sa.Column('path', sa.String(length=500), nullable=False),
+        sa.Column('station_id', sa.Integer(),
+                  sa.ForeignKey('stations.id'), nullable=True),
+        sa.Column('device_code', sa.String(length=100), nullable=True),
+        sa.Column('calibration_snapshot', sa.JSON(), nullable=True),
+        sa.Column('engine_version', sa.String(length=64), nullable=True),
+        sa.Column('note', sa.String(length=500), nullable=True),
+        sa.Column('expected_json', sa.JSON(), nullable=True),
+        sa.Column('acquired_at', sa.DateTime(), nullable=False,
+                  server_default=sa.func.now()),
+        mysql_engine='InnoDB',
+        mysql_charset='utf8mb4',
+    )
+
+
+def downgrade() -> None:
+    op.drop_table('vision_reference_images')

src/backend/models/api/measurement.py

@@ -12,7 +12,15 @@ class MeasurementCreate(BaseModel):
     value: float
     lot_number: Optional[str] = Field(None, max_length=100)
     serial_number: Optional[str] = Field(None, max_length=100)
+    # "camera" is deliberately absent from this pattern, even though the ORM
+    # enum and the database allow it. Do not add it here: a camera
+    # measurement must be produced by vision_service.execute_task, never by a
+    # client posting JSON straight to this endpoint - there is no image, no
+    # graph and no engine_version behind a value that arrived this way.
     input_method: str = Field("manual", pattern="^(usb_caliper|manual)$")
+    input_duration_ms: Optional[int] = Field(None, ge=0)
+    # The production this belongs to, when one is open at the station.
+    production_run_id: Optional[int] = Field(None, gt=0)
 
 
 class MeasurementBatchCreate(BaseModel):
@@ -34,6 +42,12 @@ class MeasurementResponse(BaseModel):
     lot_number: Optional[str] = None
     serial_number: Optional[str] = None
     input_method: str
+    input_duration_ms: Optional[int] = None
+    production_run_id: Optional[int] = None
+    # Who let this value stand, when it was out of tolerance. Null on a value in
+    # tolerance - and on one that is not and is still waiting for an answer.
+    supervisor_id: Optional[int] = None
+    authorised_at: Optional[datetime] = None
     measured_at: datetime
     synced_to_csv: bool
 
@@ -47,6 +61,29 @@ class MeasurementListResponse(BaseModel):
     pages: int
 
 
+class MeasurementAuthorisation(BaseModel):
+    """Credentials of the supervisor allowing an out-of-tolerance value to stand."""
+
+    supervisor_username: str = Field(..., min_length=1)
+    supervisor_password: str = Field(..., min_length=1)
+
+
+class TaskProgressResponse(BaseModel):
+    """How far one measurement task has got: quotes taken out of quotes expected."""
+
+    task_id: int
+    quotes: int
+    measured: int
+    # empty (declared as measurement, no quotes yet) | none | partial | complete
+    state: str
+
+
+class TaskProgressListResponse(BaseModel):
+    """Progress of every measurement task of a version."""
+
+    tasks: list[TaskProgressResponse]
+
+
 class MeasurementQuery(BaseModel):
     """Schema for measurement query filters."""
     recipe_id: Optional[int] = None

src/backend/models/api/production.py

@@ -0,0 +1,89 @@
+"""Pydantic schemas for production runs and their events."""
+from datetime import datetime
+from typing import Literal, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class ProductionRunCreate(BaseModel):
+    station_code: str = Field(..., min_length=1, max_length=100)
+    recipe_id: int = Field(..., gt=0)
+    version_id: Optional[int] = Field(default=None, gt=0)
+    lot_number: Optional[str] = Field(default=None, max_length=100)
+    serial_number: Optional[str] = Field(default=None, max_length=100)
+
+
+class ProductionEventResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: int
+    event_type: str
+    user_id: int
+    supervisor_id: Optional[int]
+    task_id: Optional[int] = None
+    note: Optional[str]
+    created_at: datetime
+
+
+class ProductionRunResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    station_id: int
+    recipe_id: int
+    version_id: int
+    operator_id: int
+    lot_number: Optional[str]
+    serial_number: Optional[str]
+    status: str
+    measurement_interval_minutes: Optional[int]
+    next_measurement_at: Optional[datetime]
+    cycle_count: int
+    started_at: datetime
+    paused_at: Optional[datetime]
+    closed_at: Optional[datetime]
+    closed_by: Optional[int]
+    statistics_path: Optional[str] = None
+
+    # Derived server-side so every client agrees on the countdown regardless of
+    # clock skew. Negative once the interval has elapsed: how long the run has been
+    # overdue is a fact the operator must see, not deduce.
+    seconds_to_next_measurement: Optional[int] = None
+    overdue: bool = False
+    server_time: Optional[datetime] = None
+
+    # The measurement tasks of this run's version, in execution order. The client
+    # needs them to bring the operator back to the measurement when the interval
+    # expires, whichever screen they are on, and to know which task closes a cycle.
+    measurement_task_ids: list[int] = Field(default_factory=list)
+
+
+class ProductionRunWithEventsResponse(ProductionRunResponse):
+    events: list[ProductionEventResponse] = Field(default_factory=list)
+
+
+class SupervisorAction(BaseModel):
+    """Credentials of the supervisor authorising a line stop or a close."""
+
+    supervisor_username: str = Field(..., min_length=1)
+    supervisor_password: str = Field(..., min_length=1)
+    note: Optional[str] = None
+
+
+class CycleCompletePayload(BaseModel):
+    # Which measurement task was just finished. The interval restarts only on the
+    # last one of the recipe; omitting it closes the cycle outright.
+    task_id: Optional[int] = Field(default=None, gt=0)
+    note: Optional[str] = None
+
+
+class RemeasurePayload(BaseModel):
+    """The piece was turned over: measure it again inside the same cycle."""
+
+    task_id: Optional[int] = Field(default=None, gt=0)
+    note: Optional[str] = None
+
+
+ProductionEventType = Literal[
+    "start", "cycle_completed", "task_measured", "remeasure",
+    "line_stop", "resume", "close",
+]

src/backend/models/api/recipe.py

@@ -14,6 +14,12 @@ class RecipeCreate(BaseModel):
     name: str = Field(..., min_length=1, max_length=255)
     description: Optional[str] = None
     image_path: Optional[str] = Field(None, max_length=500)
+    measurement_interval_minutes: Optional[int] = Field(None, ge=1, le=1440)
+    # Rules of the recipe: what the operator must supply, and how a value may be
+    # entered. Manual input defaults to forbidden - the caliper is the instrument.
+    requires_lot: bool = False
+    requires_serial: bool = False
+    allow_manual_input: bool = False
     # Optional task-level fields for the initial technical drawing
     file_path: Optional[str] = Field(None, max_length=500)
     file_type: Optional[str] = Field(None, pattern="^(image|pdf)$")
@@ -25,6 +31,10 @@ class RecipeUpdate(BaseModel):
     name: Optional[str] = Field(None, min_length=1, max_length=255)
     description: Optional[str] = None
     image_path: Optional[str] = Field(None, max_length=500)
+    measurement_interval_minutes: Optional[int] = Field(None, ge=1, le=1440)
+    requires_lot: Optional[bool] = None
+    requires_serial: Optional[bool] = None
+    allow_manual_input: Optional[bool] = None
     change_notes: Optional[str] = None
     # Task-level fields: saved to the first task of the new version
     file_path: Optional[str] = Field(None, max_length=500)
@@ -55,6 +65,12 @@ class RecipeResponse(BaseModel):
     name: str
     description: Optional[str] = None
     image_path: Optional[str] = None
+    measurement_interval_minutes: Optional[int] = None
+    # The operator's screen reads these to know whether to ask for lot and serial
+    # before starting, and whether to offer the keypad at all.
+    requires_lot: bool = False
+    requires_serial: bool = False
+    allow_manual_input: bool = False
     created_by: int
     created_at: datetime
     active: bool

src/backend/models/api/station.py

@@ -51,7 +51,20 @@ class RecipeSummary(BaseModel):
     code: str
     name: str
     active: bool
+    image_path: Optional[str] = None
+    description: Optional[str] = None
+    # The selection screen has to know before the operator starts: what a recipe
+    # demands is the difference between an enabled Avvia and a disabled one.
+    requires_lot: bool = False
+    requires_serial: bool = False
 
 
 class StationWithRecipesResponse(StationResponse):
     recipes: list[RecipeSummary] = Field(default_factory=list)
+
+
+class StationResetResponse(BaseModel):
+    """Outcome of clearing every recipe assignment of a station."""
+
+    station_id: int
+    removed: int

src/backend/models/api/task.py

@@ -1,8 +1,13 @@
 """Pydantic schemas for RecipeTask and RecipeSubtask operations."""
-from typing import Any, Optional
+from typing import Any, Literal, Optional
 
 from pydantic import BaseModel, ConfigDict, Field
 
+from src.backend.models.orm.task import TASK_TYPES
+
+# Kept in step with the ORM enum so the two cannot drift apart.
+TaskType = Literal[TASK_TYPES]
+
 
 class SubtaskCreate(BaseModel):
     """Schema for creating a subtask."""
@@ -16,6 +21,7 @@ class SubtaskCreate(BaseModel):
     ltl: Optional[float] = None
     unit: str = Field("mm", max_length=20)
     image_path: Optional[str] = Field(None, max_length=500)
+    vision_output: Optional[str] = None
 
 
 class SubtaskUpdate(BaseModel):
@@ -30,6 +36,7 @@ class SubtaskUpdate(BaseModel):
     ltl: Optional[float] = None
     unit: Optional[str] = Field(None, max_length=20)
     image_path: Optional[str] = Field(None, max_length=500)
+    vision_output: Optional[str] = None
 
 
 class SubtaskResponse(BaseModel):
@@ -48,27 +55,32 @@ class SubtaskResponse(BaseModel):
     ltl: Optional[float] = None
     unit: str
     image_path: Optional[str] = None
+    vision_output: Optional[str] = None
 
 
 class TaskCreate(BaseModel):
     """Schema for creating a task."""
     title: str = Field(..., min_length=1, max_length=255)
+    task_type: TaskType = "note"
     directive: Optional[str] = None
     description: Optional[str] = None
     file_path: Optional[str] = Field(None, max_length=500)
     file_type: Optional[str] = Field(None, pattern="^(image|pdf)$")
     annotations_json: Optional[dict[str, Any]] = None
+    vision_json: Optional[dict] = None
     subtasks: list[SubtaskCreate] = []
 
 
 class TaskUpdate(BaseModel):
     """Schema for updating a task."""
     title: Optional[str] = Field(None, min_length=1, max_length=255)
+    task_type: Optional[TaskType] = None
     directive: Optional[str] = None
     description: Optional[str] = None
     file_path: Optional[str] = Field(None, max_length=500)
     file_type: Optional[str] = Field(None, pattern="^(image|pdf)$")
     annotations_json: Optional[dict[str, Any]] = None
+    vision_json: Optional[dict] = None
 
 
 class TaskResponse(BaseModel):
@@ -79,12 +91,14 @@ class TaskResponse(BaseModel):
     version_id: int
     recipe_id: Optional[int] = None
     order_index: int
+    task_type: str
     title: str
     directive: Optional[str] = None
     description: Optional[str] = None
     file_path: Optional[str] = None
     file_type: Optional[str] = None
     annotations_json: Optional[dict[str, Any]] = None
+    vision_json: Optional[dict] = None
     subtasks: list[SubtaskResponse] = []
 
 

src/backend/models/api/vision.py

@@ -0,0 +1,16 @@
+"""Pydantic schemas for the vision execution response."""
+from pydantic import BaseModel
+
+
+class VisionMeasurementResult(BaseModel):
+    """One quote's outcome, as much of it as the client needs to show."""
+    subtask_id: int
+    value: float
+    pass_fail: str
+
+
+class VisionExecuteResponse(BaseModel):
+    """What `POST /api/vision/execute` returns: the run, and every quote it filled."""
+    vision_result_id: int
+    engine_version: str
+    measurements: list[VisionMeasurementResult]

src/backend/models/orm/__init__.py

@@ -5,6 +5,9 @@ from src.backend.models.orm.task import RecipeTask, RecipeSubtask
 from src.backend.models.orm.measurement import Measurement
 from src.backend.models.orm.access_log import AccessLog
 from src.backend.models.orm.setting import SystemSetting, RecipeVersionAudit
+from src.backend.models.orm.station import Station, StationRecipeAssignment
+from src.backend.models.orm.production import ProductionRun, ProductionEvent
+from src.backend.models.orm.vision import VisionReferenceImage, VisionResult
 
 __all__ = [
     "User",
@@ -16,4 +19,10 @@ __all__ = [
     "AccessLog",
     "SystemSetting",
     "RecipeVersionAudit",
+    "Station",
+    "StationRecipeAssignment",
+    "ProductionRun",
+    "ProductionEvent",
+    "VisionResult",
+    "VisionReferenceImage",
 ]

src/backend/models/orm/measurement.py

@@ -38,11 +38,43 @@ class Measurement(Base):
 
     # Input method
     input_method: Mapped[str] = mapped_column(
-        Enum("usb_caliper", "manual", name="input_method_enum"),
+        Enum("usb_caliper", "manual", "camera", name="input_method_enum"),
         nullable=False,
         default="manual",
     )
 
+    # The vision execution that produced this value, when there was one. Null for
+    # everything taken by caliper or typed by hand.
+    vision_result_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("vision_results.id"), nullable=True
+    )
+
+    # Time spent by the operator entering this value (client-reported)
+    input_duration_ms: Mapped[Optional[int]] = mapped_column(
+        Integer, nullable=True
+    )
+
+    # The production this was taken during, when there was one. Nullable: rows
+    # predating production runs, and measurements taken outside a production, have
+    # none. This is what makes "the measurements of this production" a query, which
+    # fine produzione needs to emit the statistics file.
+    production_run_id: Mapped[Optional[int]] = mapped_column(
+        Integer,
+        ForeignKey("production_runs.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
+
+    # Who let an out-of-tolerance value stand, and when. Null on a value that is
+    # within tolerance, and null on one that is not and has not been authorised -
+    # which is exactly the state that stops the operator moving on to the next
+    # quote. Before this the supervisor's approval was a modal that closed: nothing
+    # recorded it, and nothing depended on it.
+    supervisor_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("users.id"), nullable=True, index=True
+    )
+    authorised_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+
     # Timestamp
     measured_at: Mapped[datetime] = mapped_column(
         DateTime, nullable=False, server_default=func.now(), index=True

src/backend/models/orm/production.py

@@ -0,0 +1,166 @@
+"""ProductionRun and ProductionEvent models.
+
+A production run is what an operator opens when production starts and a supervisor
+closes when it ends. It is the thing that outlives a page: before this, the timer,
+the cycle count and the "production started" flag were Alpine variables in
+task_execute.html, and navigating between tasks - a full page load - destroyed them.
+
+The measurement deadline is stored as an absolute timestamp (next_measurement_at)
+rather than a remaining count. Any client can then derive the countdown from it, get
+the same answer, survive a reload, and tell how far *past* the interval it is by
+letting the difference go negative.
+
+With one station app installed per PC (see the install architecture of 28/07) the
+database is the only place this state can live: the API keeps nothing in process
+memory.
+"""
+from datetime import datetime
+from typing import TYPE_CHECKING, Optional
+
+from sqlalchemy import (
+    DateTime, Enum, ForeignKey, Index, Integer, SmallInteger, String, Text,
+    UniqueConstraint, func,
+)
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from src.backend.database import Base
+
+if TYPE_CHECKING:
+    from src.backend.models.orm.recipe import Recipe, RecipeVersion
+    from src.backend.models.orm.station import Station
+
+
+RUN_STATUSES = ("running", "paused", "closed")
+# task_measured marks a measurement task finished inside a cycle that is not over
+# yet; only the last one produces cycle_completed and restarts the interval.
+# remeasure is the piece being turned and measured again without closing the cycle.
+EVENT_TYPES = (
+    "start", "cycle_completed", "task_measured", "remeasure",
+    "line_stop", "resume", "close",
+)
+
+
+class ProductionRun(Base):
+    __tablename__ = "production_runs"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+
+    station_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("stations.id"), nullable=False, index=True
+    )
+    recipe_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("recipes.id"), nullable=False, index=True
+    )
+    version_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("recipe_versions.id"), nullable=False, index=True
+    )
+    operator_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("users.id"), nullable=False, index=True
+    )
+
+    # Traceability travels with the run instead of the Flask session, so it stays
+    # attached to every measurement taken during it.
+    lot_number: Mapped[Optional[str]] = mapped_column(String(100), nullable=True, index=True)
+    serial_number: Mapped[Optional[str]] = mapped_column(String(100), nullable=True, index=True)
+
+    status: Mapped[str] = mapped_column(
+        Enum(*RUN_STATUSES, name="production_run_status_enum"),
+        nullable=False,
+        default="running",
+        index=True,
+    )
+
+    # Snapshot of the recipe interval at start: editing the recipe mid-run must not
+    # move the deadline of a production already under way.
+    measurement_interval_minutes: Mapped[Optional[int]] = mapped_column(
+        SmallInteger, nullable=True
+    )
+    # When the next measurement falls due. Null when the recipe has no interval.
+    # Past this instant the run is overdue, and by how much is simply now - this.
+    next_measurement_at: Mapped[Optional[datetime]] = mapped_column(
+        DateTime, nullable=True, index=True
+    )
+    cycle_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+
+    started_at: Mapped[datetime] = mapped_column(
+        DateTime, nullable=False, server_default=func.now()
+    )
+    paused_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+    closed_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+    closed_by: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("users.id"), nullable=True
+    )
+    # Statistics file emitted when the run was closed, relative to the upload dir.
+    statistics_path: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+
+    # Mirrors station_id while the run is open and goes NULL when it closes. A unique
+    # index on it lets the database - not a check-then-insert race - guarantee that a
+    # station never has two open runs. Repeated NULLs do not collide in a unique index.
+    active_station_id: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
+
+    station: Mapped["Station"] = relationship(lazy="selectin")
+    recipe: Mapped["Recipe"] = relationship(lazy="selectin")
+    version: Mapped["RecipeVersion"] = relationship(lazy="selectin")
+    events: Mapped[list["ProductionEvent"]] = relationship(
+        back_populates="run",
+        cascade="all, delete-orphan",
+        order_by="ProductionEvent.created_at",
+    )
+
+    __table_args__ = (
+        UniqueConstraint("active_station_id", name="uq_production_runs_active_station"),
+        Index("ix_production_runs_station_status", "station_id", "status"),
+        {"mysql_engine": "InnoDB", "mysql_charset": "utf8mb4"},
+    )
+
+    @property
+    def is_open(self) -> bool:
+        return self.status in ("running", "paused")
+
+    def __repr__(self) -> str:
+        return f"<ProductionRun {self.id} station={self.station_id} {self.status}>"
+
+
+class ProductionEvent(Base):
+    """Append-only trace of what happened during a run.
+
+    This is the record that did not exist before: without it there is no history of
+    a production, and nothing for the statistics file or the ERP hand-off to stand on.
+    """
+
+    __tablename__ = "production_events"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    run_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("production_runs.id", ondelete="CASCADE"),
+        nullable=False, index=True,
+    )
+    event_type: Mapped[str] = mapped_column(
+        Enum(*EVENT_TYPES, name="production_event_type_enum"), nullable=False, index=True
+    )
+    user_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("users.id"), nullable=False, index=True
+    )
+    # Who authorised it, when the action needed a supervisor (fermo linea, chiusura).
+    supervisor_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("users.id"), nullable=True
+    )
+    # Which task the event is about, for the ones that happen inside a cycle. A
+    # task_measured or a remeasure that does not say which task is not a record of
+    # anything; null for the events that concern the run as a whole.
+    task_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("recipe_tasks.id"), nullable=True
+    )
+    note: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime, nullable=False, server_default=func.now(), index=True
+    )
+
+    run: Mapped["ProductionRun"] = relationship(back_populates="events")
+
+    __table_args__ = (
+        {"mysql_engine": "InnoDB", "mysql_charset": "utf8mb4"},
+    )
+
+    def __repr__(self) -> str:
+        return f"<ProductionEvent run={self.run_id} {self.event_type}>"

src/backend/models/orm/recipe.py

@@ -2,7 +2,7 @@
 from datetime import datetime
 from typing import TYPE_CHECKING, Optional
 
-from sqlalchemy import Boolean, DateTime, ForeignKey, Index, Integer, String, Text, UniqueConstraint, func
+from sqlalchemy import Boolean, DateTime, ForeignKey, Index, Integer, SmallInteger, String, Text, UniqueConstraint, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from src.backend.database import Base
@@ -24,6 +24,23 @@ class Recipe(Base):
         DateTime, nullable=False, server_default=func.now()
     )
     active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, index=True)
+    measurement_interval_minutes: Mapped[Optional[int]] = mapped_column(SmallInteger, nullable=True)
+
+    # Traceability, decided when the recipe is written rather than left to whoever
+    # is at the machine: a measurement without the lot it belongs to cannot be
+    # traced back afterwards, and tracing back is half of what the system is for.
+    requires_lot: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=False, server_default="0"
+    )
+    requires_serial: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=False, server_default="0"
+    )
+    # Whether a value may be typed instead of read from the caliper. Forbidden by
+    # default: without the rule, a value that happens to be in tolerance can simply
+    # be entered by hand, which is the case this setting exists to prevent.
+    allow_manual_input: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=False, server_default="0"
+    )
 
     # Relationships
     versions: Mapped[list["RecipeVersion"]] = relationship(

src/backend/models/orm/task.py

@@ -12,6 +12,15 @@ if TYPE_CHECKING:
     from src.backend.models.orm.recipe import RecipeVersion
 
 
+# What a task is, declared by whoever writes the recipe instead of guessed from its
+# contents. The last two are not built yet; they are in the enum from the start
+# because widening a MySQL enum later is an ALTER on a live table.
+TASK_TYPES = ("note", "measure", "drawing", "dxf_compare", "camera_measure")
+
+# Types the operator screen treats as "there are quotes to take here".
+MEASURING_TASK_TYPES = ("measure", "camera_measure")
+
+
 class RecipeTask(Base):
     __tablename__ = "recipe_tasks"
 
@@ -20,6 +29,16 @@ class RecipeTask(Base):
         Integer, ForeignKey("recipe_versions.id"), nullable=False
     )
     order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    # Declared, not deduced. The old rule - "has subtasks, therefore a measurement" -
+    # meant a measurement task whose quotes had not been entered yet behaved as a
+    # note, so the system acted differently depending on how finished the recipe was.
+    task_type: Mapped[str] = mapped_column(
+        Enum(*TASK_TYPES, name="task_type_enum"),
+        nullable=False,
+        default="note",
+        server_default="note",
+        index=True,
+    )
     title: Mapped[str] = mapped_column(String(255), nullable=False)
     directive: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
     description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
@@ -28,6 +47,10 @@ class RecipeTask(Base):
         Enum("image", "pdf", name="file_type_enum"), nullable=True
     )
     annotations_json: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
+    # The vision graph, serialised by vs-task. Opaque here on purpose: the
+    # server routes it and never interprets it, which is what keeps VisionSuite
+    # out of this container.
+    vision_json: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
 
     # Relationships
     version: Mapped["RecipeVersion"] = relationship(back_populates="tasks")
@@ -70,6 +93,12 @@ class RecipeSubtask(Base):
 
     unit: Mapped[str] = mapped_column(String(20), nullable=False, default="mm")
     image_path: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+    # Which output of the vision graph fills this quote: "<tool_id>.<output>".
+    # A link is an id, not a pointer - the same rule vs-task follows, and for
+    # the same reason: a pointer does not survive being written to disk.
+    vision_output: Mapped[Optional[str]] = mapped_column(
+        String(120), nullable=True
+    )
 
     # Relationships
     task: Mapped["RecipeTask"] = relationship(back_populates="subtasks")

src/backend/models/orm/vision.py

@@ -0,0 +1,69 @@
+"""One row per vision execution - not per quote."""
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import DateTime, Enum, ForeignKey, Integer, JSON, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.backend.database import Base
+
+
+class VisionResult(Base):
+    __tablename__ = "vision_results"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    task_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("recipe_tasks.id"), nullable=False, index=True
+    )
+    image_path: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+    overlay_path: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+    engine_version: Mapped[str] = mapped_column(String(64), nullable=False)
+    executed_on: Mapped[str] = mapped_column(
+        Enum("server", "station", name="vision_executed_on_enum"), nullable=False
+    )
+    station_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("stations.id"), nullable=True
+    )
+    device_code: Mapped[Optional[str]] = mapped_column(String(100), nullable=True)
+    # Copied, not referenced: a calibration redone six months from now must not
+    # rewrite what a measurement already taken means. Same for the graph.
+    calibration_snapshot: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
+    graph_snapshot: Mapped[dict] = mapped_column(JSON, nullable=False)
+    duration_ms: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
+    executed_at: Mapped[datetime] = mapped_column(
+        DateTime, nullable=False, server_default=func.now()
+    )
+
+    __table_args__ = ({"mysql_engine": "InnoDB", "mysql_charset": "utf8mb4"},)
+
+    def __repr__(self) -> str:
+        return f"<VisionResult task={self.task_id} engine={self.engine_version}>"
+
+
+class VisionReferenceImage(Base):
+    """An image kept so a graph can be composed, tried and re-tried without a
+    camera - which is exactly what VisionSuite's source abstraction is for."""
+
+    __tablename__ = "vision_reference_images"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    task_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("recipe_tasks.id"), nullable=False, index=True
+    )
+    path: Mapped[str] = mapped_column(String(500), nullable=False)
+    station_id: Mapped[Optional[int]] = mapped_column(
+        Integer, ForeignKey("stations.id"), nullable=True
+    )
+    device_code: Mapped[Optional[str]] = mapped_column(String(100), nullable=True)
+    calibration_snapshot: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
+    engine_version: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
+    note: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+    expected_json: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
+    acquired_at: Mapped[datetime] = mapped_column(
+        DateTime, nullable=False, server_default=func.now()
+    )
+
+    __table_args__ = ({"mysql_engine": "InnoDB", "mysql_charset": "utf8mb4"},)
+
+    def __repr__(self) -> str:
+        return f"<VisionReferenceImage task={self.task_id} path={self.path}>"

src/backend/services/ai_service.py

@@ -0,0 +1,74 @@
+"""AI service for parsing technical sheets via OpenRouter."""
+import json
+import logging
+from io import BytesIO
+
+import httpx
+import pdfplumber
+
+from src.backend.config import settings
+
+logger = logging.getLogger(__name__)
+
+SYSTEM_PROMPT = """Sei un assistente specializzato nell'analisi di schede tecniche industriali.
+Analizza il testo estratto da una scheda tecnica e identifica i blocchi operativi distinti.
+Per ogni blocco, estrai:
+- title: titolo breve del blocco (es. "MATERIALI", "TEMPERATURA", "MISURA", "IMBALLO")
+- directive: istruzione operativa principale (es. "VERIFICARE ATTREZZATURE")
+- description: dettagli completi del blocco, preservando gli "a capo" originali
+
+Rispondi SOLO con un array JSON valido, senza markdown o testo aggiuntivo.
+Esempio:
+[
+  {"title": "MATERIALI", "directive": "Verificare materiali", "description": "RIGIDO (36): AFT9/UV CRI 7\\nMORBIDO (E38): M70"},
+  {"title": "TEMPERATURA", "directive": "Verificare impostazioni", "description": "RIGIDO: TEMP: 170/170/170/170/170\\nMORBIDO: TEMP: 130-135-140-145"}
+]"""
+
+
+def extract_text_from_pdf(pdf_bytes: bytes) -> str:
+    with pdfplumber.open(BytesIO(pdf_bytes)) as pdf:
+        pages = []
+        for page in pdf.pages:
+            text = page.extract_text()
+            if text:
+                pages.append(text)
+        return "\n\n---\n\n".join(pages)
+
+
+async def parse_technical_sheet(pdf_bytes: bytes) -> list[dict]:
+    text = extract_text_from_pdf(pdf_bytes)
+    if not text.strip():
+        return []
+
+    if not settings.openrouter_api_key:
+        raise ValueError("OPENROUTER_API_KEY non configurata")
+
+    async with httpx.AsyncClient(timeout=60) as client:
+        resp = await client.post(
+            "https://openrouter.ai/api/v1/chat/completions",
+            headers={
+                "Authorization": f"Bearer {settings.openrouter_api_key}",
+                "Content-Type": "application/json",
+            },
+            json={
+                "model": settings.openrouter_model,
+                "messages": [
+                    {"role": "system", "content": SYSTEM_PROMPT},
+                    {"role": "user", "content": f"Analizza questa scheda tecnica ed estrai i task:\n\n{text}"},
+                ],
+                "temperature": 0.1,
+            },
+        )
+        resp.raise_for_status()
+
+    data = resp.json()
+    content = data["choices"][0]["message"]["content"].strip()
+
+    # Strip markdown fences if present
+    if content.startswith("```"):
+        content = content.split("\n", 1)[1]
+        if content.endswith("```"):
+            content = content[:-3]
+        content = content.strip()
+
+    return json.loads(content)

src/backend/services/auth_service.py

@@ -3,6 +3,7 @@ import secrets
 from datetime import datetime
 
 import bcrypt
+from fastapi import HTTPException, status
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -39,6 +40,31 @@ async def authenticate_user(
     return user
 
 
+async def authorise_supervisor(db: AsyncSession, username: str, password: str) -> User:
+    """Check the credentials of the supervisor authorising something.
+
+    Used wherever the shop floor needs a capoturno: a line stop, a closure, an
+    out-of-tolerance value allowed to stand. Lives here rather than beside any one
+    of them because it is the same question every time - who is this, and are they
+    allowed to say yes.
+
+    Uses authenticate_user rather than a full login: logging in would rotate the
+    supervisor's API key and knock out whatever session they have open elsewhere.
+    """
+    supervisor = await authenticate_user(db, username, password)
+    if supervisor is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid supervisor credentials",
+        )
+    if not supervisor.has_role("Supervisor") and not supervisor.is_admin:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User is not authorised as supervisor",
+        )
+    return supervisor
+
+
 async def login_user(db: AsyncSession, user: User) -> str:
     """Generate API key and update last_login for user."""
     api_key = generate_api_key()

src/backend/services/measurement_service.py

@@ -1,11 +1,17 @@
 """Measurement service - pass/fail calculation, data storage."""
+from datetime import datetime
 from decimal import Decimal
 
-from sqlalchemy import select
+from fastapi import HTTPException, status
+from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.models.orm.measurement import Measurement
-from src.backend.models.orm.task import RecipeSubtask
+from src.backend.models.orm.recipe import Recipe, RecipeVersion
+from src.backend.models.orm.task import (
+    MEASURING_TASK_TYPES, RecipeSubtask, RecipeTask,
+)
+from src.backend.models.orm.user import User
 
 
 def calculate_pass_fail(
@@ -39,6 +45,174 @@ def calculate_pass_fail(
     return "pass", deviation
 
 
+async def recipe_of_version(db: AsyncSession, version_id: int) -> Recipe | None:
+    """The recipe a version belongs to - where the rules of measurement live."""
+    result = await db.execute(
+        select(Recipe)
+        .join(RecipeVersion, RecipeVersion.recipe_id == Recipe.id)
+        .where(RecipeVersion.id == version_id)
+    )
+    return result.scalar_one_or_none()
+
+
+def _enforce_recipe_rules(
+    recipe: Recipe | None,
+    lot_number: str | None,
+    serial_number: str | None,
+    input_method: str,
+) -> None:
+    """Refuse a measurement the recipe does not allow.
+
+    Checked here rather than only on the screen because a rule that lives in the
+    frontend is a suggestion: the keypad can be hidden and the same request still
+    sent. This is the one place every measurement passes through.
+    """
+    if recipe is None:
+        return
+
+    if recipe.requires_lot and not (lot_number or "").strip():
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="This recipe requires a lot number",
+        )
+    if recipe.requires_serial and not (serial_number or "").strip():
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="This recipe requires a serial number",
+        )
+    if input_method == "manual" and not recipe.allow_manual_input:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="This recipe does not allow values typed by hand: use the caliper",
+        )
+
+
+def _scope(query, version_id: int, measured_by: int, production_run_id: int | None):
+    """Narrow a measurement query to the run in progress, or to this operator's work.
+
+    Inside a production the run is the boundary. Outside one - a recipe executed on
+    its own - the boundary is the version and the person doing it, so two operators
+    on the same recipe do not block each other.
+    """
+    if production_run_id is not None:
+        return query.where(Measurement.production_run_id == production_run_id)
+    return query.where(
+        Measurement.version_id == version_id,
+        Measurement.measured_by == measured_by,
+        Measurement.production_run_id.is_(None),
+    )
+
+
+async def pending_authorisation(
+    db: AsyncSession,
+    version_id: int,
+    measured_by: int,
+    production_run_id: int | None = None,
+) -> Measurement | None:
+    """The out-of-tolerance measurement that is holding everything up, if any.
+
+    Only the *latest* reading of each quote counts. Measuring the same quote again
+    is allowed - the caliper slips, the piece is reseated - and a second reading
+    within tolerance releases the block. What is not allowed is moving on to the
+    next quote while the one in hand is out of tolerance and nobody has said so.
+
+    How many attempts that permits is point 4's business, not this one's. Every
+    reading stays in the record either way.
+    """
+    latest_per_subtask = _scope(
+        select(func.max(Measurement.id)),
+        version_id, measured_by, production_run_id,
+    ).group_by(Measurement.subtask_id)
+
+    result = await db.execute(
+        select(Measurement)
+        .where(
+            Measurement.id.in_(latest_per_subtask),
+            Measurement.pass_fail == "fail",
+            Measurement.supervisor_id.is_(None),
+        )
+        .order_by(Measurement.id)
+        .limit(1)
+    )
+    return result.scalar_one_or_none()
+
+
+async def task_progress(
+    db: AsyncSession,
+    version_id: int,
+    measured_by: int,
+    production_run_id: int | None = None,
+) -> list[dict]:
+    """How far each measurement task of a version has got.
+
+    A task left half done is the thing the operator cannot see today: they walk
+    away from it, come back to the list, and it looks exactly like one never
+    started. Counting quotes against measurements is what tells them apart.
+
+    Documental tasks are not in here. A note cannot be half read, and marking one
+    incomplete for ever would be noise on the only screen that has to stay legible.
+    Which tasks count is read from the declared type, not from whether quotes happen
+    to have been entered yet - the same rule point 2 settled everywhere else.
+    """
+    rows = (await db.execute(
+        select(RecipeTask.id, RecipeSubtask.id)
+        .join(RecipeSubtask, RecipeSubtask.task_id == RecipeTask.id, isouter=True)
+        .where(
+            RecipeTask.version_id == version_id,
+            RecipeTask.task_type.in_(MEASURING_TASK_TYPES),
+        )
+    )).all()
+    if not rows:
+        return []
+
+    by_task: dict[int, set[int]] = {}
+    for task_id, subtask_id in rows:
+        quotes = by_task.setdefault(task_id, set())
+        if subtask_id is not None:
+            quotes.add(subtask_id)
+
+    measured = set((await db.execute(
+        _scope(
+            select(Measurement.subtask_id).distinct(),
+            version_id, measured_by, production_run_id,
+        )
+    )).scalars().all())
+
+    progress = []
+    for task_id, subtask_ids in by_task.items():
+        total = len(subtask_ids)
+        done = len(subtask_ids & measured)
+        if total == 0:
+            # Declared as a measurement but with no quotes on it yet: nothing to
+            # take, so nothing to report as missing either.
+            state = "empty"
+        elif done == total:
+            state = "complete"
+        elif done:
+            state = "partial"
+        else:
+            state = "none"
+        progress.append({
+            "task_id": task_id,
+            "quotes": total,
+            "measured": done,
+            "state": state,
+        })
+    progress.sort(key=lambda row: row["task_id"])
+    return progress
+
+
+async def authorise_measurement(
+    db: AsyncSession, measurement: Measurement, supervisor: User,
+) -> Measurement:
+    """Let an out-of-tolerance value stand, on the supervisor's name."""
+    measurement.supervisor_id = supervisor.id
+    measurement.authorised_at = datetime.now()
+    await db.flush()
+    await db.refresh(measurement)
+    return measurement
+
+
 async def save_measurement(
     db: AsyncSession,
     subtask_id: int,
@@ -48,8 +222,20 @@ async def save_measurement(
     lot_number: str | None = None,
     serial_number: str | None = None,
     input_method: str = "manual",
+    input_duration_ms: int | None = None,
+    production_run_id: int | None = None,
+    vision_result_id: int | None = None,
+    enforce_tolerance_gate: bool = True,
 ) -> Measurement:
-    """Save a single measurement with auto-calculated pass/fail."""
+    """Save a single measurement with auto-calculated pass/fail.
+
+    ``enforce_tolerance_gate=False`` skips only the pending-authorisation check
+    below - everything else (verdict, recipe rules, deviation) still applies.
+    This is for a caller that has already evaluated the gate itself for a whole
+    batch of quotes taken at the same instant (see Ruling R10 / vision_service):
+    the gate models "moving on" between measurements taken one after another,
+    which does not exist inside a single camera acquisition.
+    """
     # Get subtask for tolerance values
     result = await db.execute(
         select(RecipeSubtask).where(RecipeSubtask.id == subtask_id)
@@ -58,6 +244,25 @@ async def save_measurement(
     if subtask is None:
         raise ValueError(f"Subtask {subtask_id} not found")
 
+    recipe = await recipe_of_version(db, version_id)
+    _enforce_recipe_rules(recipe, lot_number, serial_number, input_method)
+
+    # No moving on while a quote is out of tolerance and unauthorised. Measuring
+    # that same quote again is the way out that does not need the capoturno; the
+    # next quote is not.
+    if enforce_tolerance_gate:
+        blocking = await pending_authorisation(
+            db, version_id, measured_by, production_run_id,
+        )
+        if blocking is not None and blocking.subtask_id != subtask_id:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail=(
+                    "A measurement is out of tolerance and awaiting the supervisor: "
+                    "authorise it or measure that quote again before going on"
+                ),
+            )
+
     pass_fail, deviation = calculate_pass_fail(value, subtask)
 
     measurement = Measurement(
@@ -70,6 +275,9 @@ async def save_measurement(
         lot_number=lot_number,
         serial_number=serial_number,
         input_method=input_method,
+        input_duration_ms=input_duration_ms,
+        production_run_id=production_run_id,
+        vision_result_id=vision_result_id,
     )
     db.add(measurement)
     await db.flush()

src/backend/services/production_export_service.py

@@ -0,0 +1,168 @@
+"""Statistics file emitted when a production is closed.
+
+Fine produzione has to hand the measurements of the whole production over. That part
+does not depend on the ERP: the file is produced now, and the hand-off to GAIA plugs
+in beside it once the protocol is agreed (questions D-1 and D-2). Keeping it in its
+own module makes that seam obvious rather than buried in the close path.
+
+The CSV uses the delimiters configured in system_settings, the same ones the manual
+export honours, so a shop floor set to the Italian convention (';' and ',') gets
+files that open correctly in their Excel.
+"""
+import csv
+import io
+from datetime import datetime
+from pathlib import Path
+
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.config import settings
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.production import ProductionRun
+from src.backend.models.orm.recipe import Recipe
+from src.backend.models.orm.setting import SystemSetting
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeSubtask
+
+# Written under the upload directory: it is the volume that is already mounted and
+# backed up, so the files survive a container being replaced.
+EXPORT_SUBDIR = "statistics"
+
+HEADER = [
+    "production_run_id",
+    "station_code",
+    "recipe_code",
+    "version_id",
+    "lot_number",
+    "serial_number",
+    "measurement_id",
+    "subtask_id",
+    "marker_number",
+    "subtask_description",
+    "nominal",
+    "value",
+    "deviation",
+    "pass_fail",
+    # The limits travel with the row: without them a pass/fail cannot be re-derived
+    # from the file years later, which is the whole point of an audit record.
+    "ltl",
+    "lwl",
+    "uwl",
+    "utl",
+    "unit",
+    "input_method",
+    "input_duration_ms",
+    "measured_by",
+    "measured_at",
+    # A value outside tolerance that was allowed to stand carries the name of who
+    # allowed it. Without these two columns the file would show the failure and
+    # not the decision, which is the half an auditor asks about.
+    "authorised_by",
+    "authorised_at",
+]
+
+
+async def _csv_format(db: AsyncSession) -> tuple[str, str]:
+    """Delimiter and decimal separator as configured for this installation."""
+    delimiter_row = await db.execute(
+        select(SystemSetting).where(SystemSetting.setting_key == "csv_delimiter")
+    )
+    delimiter = delimiter_row.scalar_one_or_none()
+    decimal_row = await db.execute(
+        select(SystemSetting).where(
+            SystemSetting.setting_key == "csv_decimal_separator"
+        )
+    )
+    decimal = decimal_row.scalar_one_or_none()
+    return (
+        delimiter.setting_value if delimiter else ",",
+        decimal.setting_value if decimal else ".",
+    )
+
+
+async def build_statistics_csv(db: AsyncSession, run: ProductionRun) -> str:
+    """Render every measurement of a run as CSV text."""
+    delimiter, decimal_separator = await _csv_format(db)
+
+    station = (await db.execute(
+        select(Station).where(Station.id == run.station_id)
+    )).scalar_one_or_none()
+    recipe = (await db.execute(
+        select(Recipe).where(Recipe.id == run.recipe_id)
+    )).scalar_one_or_none()
+
+    rows = (await db.execute(
+        select(Measurement, RecipeSubtask)
+        .join(RecipeSubtask, RecipeSubtask.id == Measurement.subtask_id, isouter=True)
+        .where(Measurement.production_run_id == run.id)
+        .order_by(Measurement.measured_at, Measurement.id)
+    )).all()
+
+    def number(value) -> str:
+        return "" if value is None else str(value).replace(".", decimal_separator)
+
+    output = io.StringIO()
+    writer = csv.writer(output, delimiter=delimiter, lineterminator="\n")
+    writer.writerow(HEADER)
+
+    for measurement, subtask in rows:
+        writer.writerow([
+            run.id,
+            station.code if station else "",
+            recipe.code if recipe else "",
+            measurement.version_id,
+            measurement.lot_number or "",
+            measurement.serial_number or "",
+            measurement.id,
+            measurement.subtask_id,
+            subtask.marker_number if subtask else "",
+            subtask.description if subtask else "",
+            number(subtask.nominal) if subtask else "",
+            number(measurement.value),
+            number(measurement.deviation),
+            measurement.pass_fail,
+            number(subtask.ltl) if subtask else "",
+            number(subtask.lwl) if subtask else "",
+            number(subtask.uwl) if subtask else "",
+            number(subtask.utl) if subtask else "",
+            (subtask.unit or "") if subtask else "",
+            measurement.input_method,
+            "" if measurement.input_duration_ms is None else measurement.input_duration_ms,
+            measurement.measured_by,
+            measurement.measured_at.isoformat() if measurement.measured_at else "",
+            measurement.supervisor_id or "",
+            measurement.authorised_at.isoformat() if measurement.authorised_at else "",
+        ])
+
+    return output.getvalue()
+
+
+async def export_run_statistics(db: AsyncSession, run: ProductionRun) -> str | None:
+    """Write the run's statistics file and mark its measurements as exported.
+
+    Returns the path relative to the upload directory, or None when the run has no
+    measurements - an empty file would only be noise in the folder.
+    """
+    content = await build_statistics_csv(db, run)
+    # Header only: nothing was measured during this production.
+    if len(content.strip().splitlines()) <= 1:
+        return None
+
+    directory = Path(settings.upload_path) / EXPORT_SUBDIR
+    directory.mkdir(parents=True, exist_ok=True)
+
+    stamp = (run.closed_at or datetime.now()).strftime("%Y%m%d_%H%M%S")
+    filename = f"production_{run.id}_{stamp}.csv"
+    (directory / filename).write_text(content, encoding="utf-8-sig")
+
+    # utf-8-sig: the BOM is what makes Excel read accented characters correctly,
+    # and these files are opened in Excel on the shop floor.
+
+    await db.execute(
+        update(Measurement)
+        .where(Measurement.production_run_id == run.id)
+        .values(synced_to_csv=True)
+    )
+
+    return f"{EXPORT_SUBDIR}/{filename}"

src/backend/services/production_service.py

@@ -0,0 +1,451 @@
+"""Business logic for production runs.
+
+Routers must call into these functions rather than manipulating models directly.
+All functions are async and accept an AsyncSession; they flush but do NOT commit
+(commit is handled by the FastAPI get_db dependency).
+
+Clock convention
+----------------
+Every timestamp this module writes comes from ``_now()``, so the deadline and the
+comparison against it are always on the same clock. Clients are handed
+``seconds_to_next_measurement`` already computed rather than the raw deadline: a
+naive datetime crossing the wire would be parsed in the browser's own timezone, and
+the countdown would be off by the UTC offset. The number is the contract; the
+timestamp is only there for the audit trail.
+"""
+from datetime import datetime, timedelta
+from typing import Optional
+
+from fastapi import HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.models.api.production import ProductionRunCreate
+from src.backend.models.orm.production import ProductionEvent, ProductionRun
+from src.backend.models.orm.recipe import Recipe, RecipeVersion
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import MEASURING_TASK_TYPES, RecipeTask
+from src.backend.models.orm.user import User
+from src.backend.services import (
+    auth_service, measurement_service, production_export_service,
+)
+
+
+def _now() -> datetime:
+    """Single source of time for runs.
+
+    Naive local time, matching what the database writes for ``func.now()`` defaults,
+    so a run's started_at and its deadline are comparable.
+    """
+    return datetime.now()
+
+
+# ---------------------------------------------------------------------------
+# Derived view
+# ---------------------------------------------------------------------------
+
+
+def seconds_to_next_measurement(run: ProductionRun, now: Optional[datetime] = None) -> Optional[int]:
+    """Seconds until the next measurement is due; negative once it is overdue.
+
+    Letting the value go negative is deliberate: the operator has to see how long
+    the line has been past the interval, not merely that it elapsed.
+    While the run is paused the countdown is frozen at what was left when the line
+    stopped - a fermo linea must not eat into the measurement interval.
+    """
+    if run.next_measurement_at is None:
+        return None
+    reference = run.paused_at if (run.status == "paused" and run.paused_at) else (now or _now())
+    return int(round((run.next_measurement_at - reference).total_seconds()))
+
+
+def describe(run: ProductionRun) -> dict:
+    """Fields the API adds on top of the stored columns."""
+    now = _now()
+    remaining = seconds_to_next_measurement(run, now)
+    return {
+        "seconds_to_next_measurement": remaining,
+        "overdue": remaining is not None and remaining < 0,
+        "server_time": now,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Lookups
+# ---------------------------------------------------------------------------
+
+
+async def get_run(db: AsyncSession, run_id: int) -> ProductionRun:
+    result = await db.execute(select(ProductionRun).where(ProductionRun.id == run_id))
+    run = result.scalar_one_or_none()
+    if run is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Production run not found",
+        )
+    return run
+
+
+async def get_open_run_for_station(
+    db: AsyncSession, station_id: int,
+) -> Optional[ProductionRun]:
+    """The run currently open at a station, running or paused."""
+    result = await db.execute(
+        select(ProductionRun).where(ProductionRun.active_station_id == station_id)
+    )
+    return result.scalar_one_or_none()
+
+
+async def get_station_by_code(db: AsyncSession, code: str) -> Station:
+    result = await db.execute(select(Station).where(Station.code == code))
+    station = result.scalar_one_or_none()
+    if station is None or not station.active:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Station '{code}' not found or inactive",
+        )
+    return station
+
+
+async def measurement_task_ids(db: AsyncSession, version_id: int) -> list[int]:
+    """Ids of the measurement tasks of a version, in the order they are executed.
+
+    This is the loop the operator lives in once production starts: the client uses
+    the first of these to bring the measurement back on screen when the interval
+    expires, and the last to know which task closes a cycle.
+
+    The type is read from the declared task_type (point 2), not from whether quotes
+    happen to be present: a measurement task with no quotes yet is still where the
+    operator has to be taken.
+    """
+    result = await db.execute(
+        select(RecipeTask.id)
+        .where(
+            RecipeTask.version_id == version_id,
+            RecipeTask.task_type.in_(MEASURING_TASK_TYPES),
+        )
+        .order_by(RecipeTask.order_index, RecipeTask.id)
+    )
+    return list(result.scalars().all())
+
+
+async def list_run_events(db: AsyncSession, run_id: int) -> list[ProductionEvent]:
+    result = await db.execute(
+        select(ProductionEvent)
+        .where(ProductionEvent.run_id == run_id)
+        .order_by(ProductionEvent.created_at, ProductionEvent.id)
+    )
+    return list(result.scalars().all())
+
+
+# ---------------------------------------------------------------------------
+# Supervisor authorisation
+# The capoturno check lives in auth_service, next to the rest of the credential
+# handling: a line stop, a closure and an out-of-tolerance value all ask the same
+# question, and only one of the three is about production.
+
+
+# ---------------------------------------------------------------------------
+# Lifecycle
+# ---------------------------------------------------------------------------
+
+
+def _add_event(
+    db: AsyncSession,
+    run: ProductionRun,
+    event_type: str,
+    user: User,
+    supervisor: Optional[User] = None,
+    note: Optional[str] = None,
+    task_id: Optional[int] = None,
+) -> ProductionEvent:
+    """Append to the run's trace.
+
+    Added through the session rather than run.events: touching the collection would
+    trigger a lazy load, which raises under async SQLAlchemy.
+    """
+    event = ProductionEvent(
+        run_id=run.id,
+        event_type=event_type,
+        user_id=user.id,
+        supervisor_id=supervisor.id if supervisor else None,
+        note=note,
+        task_id=task_id,
+        created_at=_now(),
+    )
+    db.add(event)
+    return event
+
+
+async def open_run(
+    db: AsyncSession, data: ProductionRunCreate, operator: User,
+) -> ProductionRun:
+    """Start a production at a station.
+
+    Refuses if the station already has one open: two runs on the same station would
+    mean two timers and two histories for one physical line.
+    """
+    station = await get_station_by_code(db, data.station_code)
+
+    existing = await get_open_run_for_station(db, station.id)
+    if existing is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=f"Station '{station.code}' already has an open production run",
+        )
+
+    recipe_row = await db.execute(select(Recipe).where(Recipe.id == data.recipe_id))
+    recipe = recipe_row.scalar_one_or_none()
+    if recipe is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Recipe not found",
+        )
+
+    if data.version_id is not None:
+        version_row = await db.execute(
+            select(RecipeVersion).where(
+                RecipeVersion.id == data.version_id,
+                RecipeVersion.recipe_id == recipe.id,
+            )
+        )
+        version = version_row.scalar_one_or_none()
+        if version is None:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Recipe version not found for this recipe",
+            )
+    else:
+        version_row = await db.execute(
+            select(RecipeVersion).where(
+                RecipeVersion.recipe_id == recipe.id,
+                RecipeVersion.is_current == True,  # noqa: E712
+            )
+        )
+        version = version_row.scalar_one_or_none()
+        if version is None:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="Recipe has no current version",
+            )
+
+    # Traceability the recipe declares compulsory has to be there before the first
+    # measurement, not after it: a lot entered halfway through leaves the values
+    # taken up to that point unattributable.
+    if recipe.requires_lot and not (data.lot_number or "").strip():
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="This recipe requires a lot number to start a production",
+        )
+    if recipe.requires_serial and not (data.serial_number or "").strip():
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="This recipe requires a serial number to start a production",
+        )
+
+    now = _now()
+    # The interval is copied, not referenced: editing the recipe mid-production must
+    # not move the deadline of a run already under way.
+    interval = recipe.measurement_interval_minutes
+    run = ProductionRun(
+        station_id=station.id,
+        recipe_id=recipe.id,
+        version_id=version.id,
+        operator_id=operator.id,
+        lot_number=data.lot_number,
+        serial_number=data.serial_number,
+        status="running",
+        measurement_interval_minutes=interval,
+        next_measurement_at=(
+            now + timedelta(minutes=interval) if interval and interval > 0 else None
+        ),
+        cycle_count=0,
+        started_at=now,
+        active_station_id=station.id,
+    )
+    db.add(run)
+    await db.flush()
+    _add_event(db, run, "start", operator)
+    await db.flush()
+    await db.refresh(run)
+    return run
+
+
+def _require_open(run: ProductionRun) -> None:
+    if run.status == "closed":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Production run is already closed",
+        )
+
+
+def _require_measurable(run: ProductionRun) -> None:
+    _require_open(run)
+    if run.status == "paused":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Production run is paused: resume it before measuring",
+        )
+
+
+async def complete_cycle(
+    db: AsyncSession,
+    run: ProductionRun,
+    user: User,
+    task_id: Optional[int] = None,
+    note: Optional[str] = None,
+) -> ProductionRun:
+    """Record a finished measurement task, and restart the interval if it was the last.
+
+    A cycle spans every measurement task of the recipe, so only the last one closes
+    it. Restarting the interval at the first would make a recipe with three
+    measurement tasks measure three times as often as it was set up to.
+
+    An unrecognised task_id - or none at all - closes the cycle: a caller that does
+    not know about the sequence gets the behaviour that existed before it.
+    """
+    _require_measurable(run)
+
+    # A cycle that contains a quote out of tolerance is not a finished cycle. This
+    # is the same gate as on the next measurement: closing the cycle would be
+    # another way of walking past it.
+    blocking = await measurement_service.pending_authorisation(
+        db, run.version_id, user.id, run.id,
+    )
+    if blocking is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=(
+                "A measurement is out of tolerance and awaiting the supervisor: "
+                "the cycle cannot be closed until it is authorised"
+            ),
+        )
+
+    measure_ids = await measurement_task_ids(db, run.version_id)
+    closes_cycle = (
+        task_id is None or task_id not in measure_ids or task_id == measure_ids[-1]
+    )
+
+    if not closes_cycle:
+        _add_event(db, run, "task_measured", user, note=note, task_id=task_id)
+        await db.flush()
+        await db.refresh(run)
+        return run
+
+    now = _now()
+    run.cycle_count += 1
+    if run.measurement_interval_minutes and run.measurement_interval_minutes > 0:
+        # Measured from now, not from the previous deadline: a late measurement must
+        # not compress the following interval.
+        run.next_measurement_at = now + timedelta(
+            minutes=run.measurement_interval_minutes
+        )
+    _add_event(db, run, "cycle_completed", user, note=note, task_id=task_id)
+    await db.flush()
+    await db.refresh(run)
+    return run
+
+
+async def remeasure(
+    db: AsyncSession,
+    run: ProductionRun,
+    user: User,
+    task_id: Optional[int] = None,
+    note: Optional[str] = None,
+) -> ProductionRun:
+    """Measure the same task again without closing the cycle.
+
+    This is the piece being turned over. The deadline and the cycle count are left
+    exactly as they are - a second reading of the same part is not a new cycle, and
+    it must not buy the operator another interval's worth of time. The values
+    themselves are ordinary measurements: both readings stay in the statistics,
+    which is the point of taking them.
+    """
+    _require_measurable(run)
+    _add_event(db, run, "remeasure", user, note=note, task_id=task_id)
+    await db.flush()
+    await db.refresh(run)
+    return run
+
+
+async def pause_run(
+    db: AsyncSession,
+    run: ProductionRun,
+    user: User,
+    supervisor: User,
+    note: Optional[str] = None,
+) -> ProductionRun:
+    """Fermo linea: suspend the run and freeze the countdown."""
+    _require_open(run)
+    if run.status == "paused":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Production run is already paused",
+        )
+    run.status = "paused"
+    run.paused_at = _now()
+    _add_event(db, run, "line_stop", user, supervisor=supervisor, note=note)
+    await db.flush()
+    await db.refresh(run)
+    return run
+
+
+async def resume_run(
+    db: AsyncSession,
+    run: ProductionRun,
+    user: User,
+    supervisor: User,
+    note: Optional[str] = None,
+) -> ProductionRun:
+    """Restart a paused run, pushing the deadline out by the length of the stop."""
+    _require_open(run)
+    if run.status != "paused":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Production run is not paused",
+        )
+    now = _now()
+    if run.next_measurement_at is not None and run.paused_at is not None:
+        # Shift rather than recompute: whatever was left when the line stopped is
+        # what the operator gets back, so a stop neither grants nor costs time.
+        run.next_measurement_at = run.next_measurement_at + (now - run.paused_at)
+    run.status = "running"
+    run.paused_at = None
+    _add_event(db, run, "resume", user, supervisor=supervisor, note=note)
+    await db.flush()
+    await db.refresh(run)
+    return run
+
+
+async def close_run(
+    db: AsyncSession,
+    run: ProductionRun,
+    user: User,
+    supervisor: User,
+    note: Optional[str] = None,
+) -> ProductionRun:
+    """Fine produzione: close the run for good, stop the timer, emit the statistics.
+
+    Everything here happens without the ERP. Handing the production over to GAIA
+    goes at the marked seam below, once D-1 and D-2 are answered; until then the
+    file is produced and the run is properly closed, which is what the shop floor
+    needs either way.
+    """
+    _require_open(run)
+    run.status = "closed"
+    run.closed_at = _now()
+    run.closed_by = supervisor.id
+    run.next_measurement_at = None
+    run.paused_at = None
+    # Releasing the slot lets the station open a new run; the unique index on this
+    # column is what keeps exactly one open at a time.
+    run.active_station_id = None
+    _add_event(db, run, "close", user, supervisor=supervisor, note=note)
+    await db.flush()
+
+    # Statistics file for the whole production, and the measurements marked as sent.
+    run.statistics_path = await production_export_service.export_run_statistics(db, run)
+
+    # --- ERP hand-off (GAIA) plugs in here once the protocol is defined (D-1, D-2).
+    # Deliberately absent rather than stubbed: an empty call that looks wired is
+    # worse than none at all.
+
+    await db.flush()
+    await db.refresh(run)
+    return run

src/backend/services/recipe_service.py

@@ -19,6 +19,30 @@ from src.backend.models.api.recipe import RecipeCreate, RecipeUpdate
 # Helpers
 # ---------------------------------------------------------------------------
 
+# Columns of the recipe header itself, as opposed to the versioned content. Both
+# update paths - copy-on-write and in-place - write exactly these, so the list
+# lives once: a field added to one and forgotten in the other would appear to save
+# and then quietly not, depending on whether the version had measurements.
+HEADER_FIELDS = (
+    "name",
+    "description",
+    "image_path",
+    "measurement_interval_minutes",
+    "requires_lot",
+    "requires_serial",
+    "allow_manual_input",
+)
+
+
+def _header_fields(data: RecipeUpdate) -> dict:
+    """The header columns the caller actually asked to change."""
+    return {
+        field: getattr(data, field)
+        for field in HEADER_FIELDS
+        if getattr(data, field) is not None
+    }
+
+
 async def _get_recipe_or_404(db: AsyncSession, recipe_id: int) -> Recipe:
     """Return a recipe or raise 404."""
     result = await db.execute(select(Recipe).where(Recipe.id == recipe_id))
@@ -55,12 +79,20 @@ async def _copy_tasks_to_version(
         new_task = RecipeTask(
             version_id=target_version.id,
             order_index=task.order_index,
+            # Carried over explicitly: a copy-on-write version that dropped the type
+            # would silently reclassify every task the moment a recipe is edited.
+            task_type=task.task_type,
             title=task.title,
             directive=task.directive,
             description=task.description,
             file_path=task.file_path,
             file_type=task.file_type,
             annotations_json=task.annotations_json,
+            # Carried over explicitly, same reasoning as task_type above: a
+            # copy-on-write version that dropped the camera graph would leave
+            # a camera_measure task unable to execute from the moment a
+            # recipe with measurements is next edited.
+            vision_json=task.vision_json,
         )
         db.add(new_task)
         await db.flush()  # get new_task.id
@@ -78,6 +110,7 @@ async def _copy_tasks_to_version(
                 ltl=sub.ltl,
                 unit=sub.unit,
                 image_path=sub.image_path,
+                vision_output=sub.vision_output,
             )
             db.add(new_sub)
 
@@ -134,6 +167,10 @@ async def create_recipe(
         name=data.name,
         description=data.description,
         image_path=data.image_path,
+        measurement_interval_minutes=data.measurement_interval_minutes,
+        requires_lot=data.requires_lot,
+        requires_serial=data.requires_serial,
+        allow_manual_input=data.allow_manual_input,
         created_by=user.id,
     )
     db.add(recipe)
@@ -253,6 +290,7 @@ async def create_new_version(
             default_task = RecipeTask(
                 version_id=new_version.id,
                 order_index=0,
+                task_type="drawing",
                 title="Technical Drawing",
                 file_path=data.file_path,
                 file_type=data.file_type or (
@@ -266,13 +304,7 @@ async def create_new_version(
         await db.flush()
 
     # Apply header updates
-    update_fields: dict = {}
-    if data.name is not None:
-        update_fields["name"] = data.name
-    if data.description is not None:
-        update_fields["description"] = data.description
-    if data.image_path is not None:
-        update_fields["image_path"] = data.image_path
+    update_fields = _header_fields(data)
     if update_fields:
         await db.execute(
             update(Recipe).where(Recipe.id == recipe_id).values(**update_fields)
@@ -361,14 +393,7 @@ async def update_current_version(
     data: RecipeUpdate,
 ) -> RecipeVersion:
     """Update recipe header in-place on the current version (no copy-on-write)."""
-    # Apply header updates (name, description, image_path)
-    update_fields: dict = {}
-    if data.name is not None:
-        update_fields["name"] = data.name
-    if data.description is not None:
-        update_fields["description"] = data.description
-    if data.image_path is not None:
-        update_fields["image_path"] = data.image_path
+    update_fields = _header_fields(data)
     if update_fields:
         await db.execute(
             update(Recipe).where(Recipe.id == recipe_id).values(**update_fields)

src/backend/services/station_service.py

@@ -138,6 +138,26 @@ async def unassign_recipe(
     await db.flush()
 
 
+async def unassign_all_recipes(db: AsyncSession, station_id: int) -> int:
+    """Drop every recipe assignment of a station and return how many were removed.
+
+    Used by the per-row reset in the admin station list: the station goes back to
+    having no recipes so it can be reassigned from scratch. Unlike unassign_recipe
+    this is idempotent - resetting an already empty station returns 0 rather than 404.
+    """
+    await get_station(db, station_id)
+    result = await db.execute(
+        select(StationRecipeAssignment).where(
+            StationRecipeAssignment.station_id == station_id
+        )
+    )
+    assignments = list(result.scalars().all())
+    for assignment in assignments:
+        await db.delete(assignment)
+    await db.flush()
+    return len(assignments)
+
+
 async def list_station_recipes(
     db: AsyncSession, station_id: int,
 ) -> list[Recipe]:

src/backend/services/vision_service.py

@@ -0,0 +1,234 @@
+"""Route the image to the worker, map the outputs onto the quotes, save.
+
+This module never imports VisionSuite - see test_vision_boundary.py. It speaks
+to the worker over HTTP and stays ignorant of how a number was produced.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from uuid import uuid4
+
+import httpx
+from fastapi import HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.config import settings
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.vision import VisionReferenceImage, VisionResult
+from src.backend.services import measurement_service
+
+
+async def _call_worker(image_bytes: bytes, graph: dict) -> dict:
+    """The one place that talks to the worker; the tests replace it.
+
+    The worker's fault must not become the API's fault (spec's edge-case
+    table: "il worker isola il guasto, l'API resta in piedi, il task
+    riporta l'errore"). A stopped worker raises `httpx.ConnectError`; a job
+    past the timeout raises `httpx.ReadTimeout` - both would otherwise
+    propagate past this function and surface to the operator as a naked
+    500. The response shape is validated here too: a proxy answering 200
+    with something that is not the worker's JSON contract must not turn
+    into a bare KeyError further down.
+    """
+    try:
+        async with httpx.AsyncClient(timeout=120.0) as client:
+            response = await client.post(
+                f"{settings.vision_worker_url}/run",
+                files={"image": ("frame.png", image_bytes, "image/png")},
+                data={"graph": json.dumps(graph)},
+            )
+    except httpx.ConnectError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail=f"the vision worker is unreachable: {exc}",
+        ) from exc
+    except httpx.ReadTimeout as exc:
+        raise HTTPException(
+            status_code=status.HTTP_504_GATEWAY_TIMEOUT,
+            detail=f"the vision worker did not answer in time: {exc}",
+        ) from exc
+
+    if response.status_code != 200:
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail=f"the vision worker refused the job: {response.text}",
+        )
+
+    try:
+        report = response.json()
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail=f"the vision worker's answer was malformed: not valid JSON ({exc})",
+        ) from exc
+
+    if not isinstance(report, dict):
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail="the vision worker's answer was malformed: expected a JSON object",
+        )
+    missing = {"outputs", "failures", "engine_version"} - report.keys()
+    if missing:
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail=(
+                "the vision worker's answer was malformed: missing "
+                f"{', '.join(sorted(missing))}"
+            ),
+        )
+    return report
+
+
+async def execute_task(
+    db: AsyncSession,
+    task: RecipeTask,
+    image_bytes: bytes,
+    measured_by: int,
+    *,
+    version_id: int,
+    lot_number: str | None = None,
+    serial_number: str | None = None,
+    production_run_id: int | None = None,
+) -> tuple[VisionResult, list[Measurement]]:
+    if not task.vision_json:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="this task carries no vision graph",
+        )
+
+    # Ordered by marker_number - the number the operator sees on the annotated
+    # image and in reports (RecipeSubtask.__repr__, statistics.py, report_service.py
+    # all key off it). Which quote is saved first must never be an accident of
+    # how SQLite/MySQL happens to return rows.
+    quotes = (await db.execute(
+        select(RecipeSubtask)
+        .where(RecipeSubtask.task_id == task.id)
+        .where(RecipeSubtask.vision_output.is_not(None))
+        .order_by(RecipeSubtask.marker_number)
+    )).scalars().all()
+    if not quotes:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="no quote on this task names a vision output",
+        )
+
+    # Ruling R10: the gate is evaluated once per acquisition, not once per
+    # quote. `save_measurement`'s own gate models "moving on" between
+    # measurements taken one after another - a real later moment where the
+    # operator could leave a bad reading behind. A camera acquisition produces
+    # every quote of this task at the same instant: there is no "moving on"
+    # between them, so applying the sequential rule inside the batch would
+    # block on a fail this very request just saved. Check it once here,
+    # against the whole set this acquisition is about to produce, and pass
+    # enforce_tolerance_gate=False to every save_measurement call below.
+    #
+    # Checked before the worker runs (M3): a blocked operator finds out
+    # without burning a whole vision execution first - the worker is the
+    # expensive part, the gate check is not.
+    blocking = await measurement_service.pending_authorisation(
+        db, version_id, measured_by, production_run_id,
+    )
+    quote_ids = {q.id for q in quotes}
+    if blocking is not None and blocking.subtask_id not in quote_ids:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=(
+                "A measurement is out of tolerance and awaiting the supervisor: "
+                "authorise it or measure that quote again before going on"
+            ),
+        )
+
+    report = await _call_worker(image_bytes, task.vision_json)
+    outputs = report["outputs"]
+
+    # Every quote or none. A half-measured piece read as a whole one is worse
+    # than a piece not measured at all.
+    missing = [q.vision_output for q in quotes if q.vision_output not in outputs]
+    if missing:
+        failed = ", ".join(f["tool_name"] for f in report["failures"])
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=(
+                f"the graph did not produce {', '.join(missing)}"
+                + (f" (tools that failed: {failed})" if failed else "")
+            ),
+        )
+
+    result = VisionResult(
+        task_id=task.id,
+        engine_version=report["engine_version"],
+        executed_on="server",
+        graph_snapshot=task.vision_json,
+        duration_ms=report.get("duration_ms"),
+    )
+    db.add(result)
+    await db.flush()
+
+    saved: list[Measurement] = []
+    for quote in quotes:
+        saved.append(await measurement_service.save_measurement(
+            db,
+            subtask_id=quote.id,
+            version_id=version_id,
+            measured_by=measured_by,
+            value=float(outputs[quote.vision_output]),
+            lot_number=lot_number,
+            serial_number=serial_number,
+            input_method="camera",
+            production_run_id=production_run_id,
+            vision_result_id=result.id,
+            enforce_tolerance_gate=False,
+        ))
+
+    return result, saved
+
+
+async def save_reference_image(
+    db: AsyncSession,
+    task_id: int,
+    image_bytes: bytes,
+    *,
+    note: str | None = None,
+    station_id: int | None = None,
+    device_code: str | None = None,
+    calibration_snapshot: dict | None = None,
+    extension: str = "png",
+) -> VisionReferenceImage:
+    """Keep an image so the graph can be composed and re-tried without a camera.
+
+    `extension` must match the upload's real content type (the router derives
+    it from `image.content_type`) - writing a jpeg to disk as `<uuid>.png`
+    would be a lie the filename tells forever.
+    """
+    # `upload_path` is the resolved Path, `upload_dir` the bare setting: the
+    # rest of the codebase uses the former (see production_export_service).
+    folder = settings.upload_path / "vision" / "reference" / str(task_id)
+    folder.mkdir(parents=True, exist_ok=True)
+    name = f"{uuid4().hex}.{extension}"
+    (folder / name).write_bytes(image_bytes)
+
+    reference = VisionReferenceImage(
+        task_id=task_id,
+        path=str(Path("vision") / "reference" / str(task_id) / name),
+        note=note,
+        station_id=station_id,
+        device_code=device_code,
+        calibration_snapshot=calibration_snapshot,
+    )
+    db.add(reference)
+    await db.flush()
+    await db.refresh(reference)
+    return reference
+
+
+async def preview(db: AsyncSession, task: RecipeTask, image_bytes: bytes) -> dict:
+    """Run the graph and save nothing. Composing is not measuring."""
+    if not task.vision_json:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="this task carries no vision graph",
+        )
+    return await _call_worker(image_bytes, task.vision_json)

src/backend/templates/setup/setup.html

@@ -559,6 +559,19 @@
         return data;
     }
 
+    /* Setup operations rotate api_keys (DB init, admin creation, password
+     * change, user (de)activation). Any Flask session held in this browser
+     * still carries the old key, so we clear it to force a fresh /auth/login. */
+    async function invalidateClientSession() {
+        try {
+            await fetch('/auth/logout', {
+                method: 'POST',
+                credentials: 'same-origin',
+                redirect: 'manual',
+            });
+        } catch (_) { /* best-effort */ }
+    }
+
     /* ------------------------------------------------------------------ */
     /* Check DB status                                                     */
     /* ------------------------------------------------------------------ */
@@ -635,6 +648,7 @@
         try {
             const data = await apiPost('/init-db', { password: setupPassword });
             showToast(data.message, 'success');
+            await invalidateClientSession();
             await checkStatus();
         } catch (e) {
             showToast(e.message, 'error');
@@ -667,6 +681,7 @@
                 admin_display_name: display,
             });
             showToast(data.message, 'success');
+            await invalidateClientSession();
             // Clear form
             document.getElementById('admin-username').value = '';
             document.getElementById('admin-password').value = '';
@@ -690,6 +705,7 @@
             if (data.measurements_created) msg += ', measurements: ' + data.measurements_created;
             msg += ')';
             showToast(msg, 'success');
+            await invalidateClientSession();
             await loadUsers();
         } catch (e) {
             showToast(e.message, 'error');
@@ -876,6 +892,7 @@
             if (pwd) body.user_password = pwd;
             var data = await apiPost('/manage-user', body);
             showToast(data.message, 'success');
+            await invalidateClientSession();
             closeModal('modal-user');
             await loadUsers();
         } catch (e) {
@@ -908,6 +925,7 @@
                 new_password: newPwd,
             });
             showToast(data.message, 'success');
+            await invalidateClientSession();
             closeModal('modal-password');
         } catch (e) {
             showToast(e.message, 'error');
@@ -924,6 +942,7 @@
                 user_id: userId,
             });
             showToast(data.message, 'success');
+            await invalidateClientSession();
             await loadUsers();
         } catch (e) {
             showToast(e.message, 'error');

src/backend/tests/conftest.py

@@ -224,6 +224,10 @@ async def create_test_recipe(
         code=code,
         name=name,
         description="A recipe for testing",
+        # Typing is allowed here so that tests about something else can still save
+        # a measurement. The rule itself is exercised by test_recipe_rules.py, on
+        # recipes that declare it explicitly.
+        allow_manual_input=True,
         created_by=user_id,
     )
     session.add(recipe)
@@ -243,6 +247,10 @@ async def create_test_recipe(
         version_id=version.id,
         order_index=0,
         title="Test Task",
+        # Declared, like any task since the type stopped being deduced: this one has
+        # a quote under it, so a fixture that called it a note would be modelling
+        # exactly the inconsistency point 2 removed.
+        task_type="measure",
         directive="Measure the part",
         description="First measurement task",
     )

src/backend/tests/test_measurements.py

@@ -55,6 +55,59 @@ class TestCreateMeasurement:
         assert data["pass_fail"] in ("pass", "warning", "fail")
         assert data["measured_by"] == measurement_tec_user.id
 
+    async def test_create_measurement_with_input_duration(
+        self,
+        client: AsyncClient,
+        measurement_tec_user: User,
+        db_session: AsyncSession,
+    ):
+        """input_duration_ms is stored and returned when provided."""
+        recipe = await create_test_recipe(
+            db_session, measurement_tec_user.id
+        )
+        subtask_id, version_id = await _get_subtask_and_version(
+            client, measurement_tec_user, recipe.id
+        )
+
+        resp = await client.post(
+            "/api/measurements/",
+            headers=auth_headers(measurement_tec_user),
+            json={
+                "subtask_id": subtask_id,
+                "version_id": version_id,
+                "value": 10.0,
+                "input_duration_ms": 4250,
+            },
+        )
+        assert resp.status_code == 200
+        assert resp.json()["input_duration_ms"] == 4250
+
+    async def test_create_measurement_without_input_duration(
+        self,
+        client: AsyncClient,
+        measurement_tec_user: User,
+        db_session: AsyncSession,
+    ):
+        """input_duration_ms defaults to null when omitted."""
+        recipe = await create_test_recipe(
+            db_session, measurement_tec_user.id
+        )
+        subtask_id, version_id = await _get_subtask_and_version(
+            client, measurement_tec_user, recipe.id
+        )
+
+        resp = await client.post(
+            "/api/measurements/",
+            headers=auth_headers(measurement_tec_user),
+            json={
+                "subtask_id": subtask_id,
+                "version_id": version_id,
+                "value": 10.0,
+            },
+        )
+        assert resp.status_code == 200
+        assert resp.json()["input_duration_ms"] is None
+
     async def test_measurement_requires_auth(self, client: AsyncClient):
         """Creating measurement without auth returns 401."""
         resp = await client.post(
@@ -211,6 +264,43 @@ class TestListMeasurements:
         assert "total" in data
         assert data["total"] >= 3
 
+    async def test_measurement_tec_can_list_measurements(
+        self,
+        client: AsyncClient,
+        measurement_tec_user: User,
+        db_session: AsyncSession,
+    ):
+        """Regression: MeasurementTec must be able to list measurements.
+
+        The Flask client renders task_complete.html by calling GET
+        /api/measurements?version_id=X right after the operator finishes a
+        recipe. The endpoint used to require Metrologist, which silently
+        produced an empty riepilogo for every operator without that role.
+        """
+        recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+        subtask_id, version_id = await _get_subtask_and_version(
+            client, measurement_tec_user, recipe.id
+        )
+
+        for val in [9.8, 10.0, 10.2]:
+            await client.post(
+                "/api/measurements/",
+                headers=auth_headers(measurement_tec_user),
+                json={
+                    "subtask_id": subtask_id,
+                    "version_id": version_id,
+                    "value": val,
+                },
+            )
+
+        resp = await client.get(
+            f"/api/measurements/?version_id={version_id}",
+            headers=auth_headers(measurement_tec_user),
+        )
+        assert resp.status_code == 200, resp.text
+        data = resp.json()
+        assert data["total"] >= 3
+
     async def test_measurement_by_recipe_filter(
         self,
         client: AsyncClient,

src/backend/tests/test_out_of_tolerance.py

@@ -0,0 +1,411 @@
+"""Point 5: a quote out of tolerance stops the line until someone says otherwise.
+
+The gate existed on screen and nowhere else - a modal that opened, checked a
+password and closed, while the measurement had already been saved. Dismissing it
+was enough to carry on. These tests are about the part that cannot be dismissed.
+"""
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.services import auth_service
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+GOOD = 10.0     # inside every limit of the fixture quote
+OUT = 99.0      # far outside
+
+
+async def _supervisor(db_session, username="capo-tol", password="TurnoPwd1"):
+    user = await auth_service.create_user(
+        db_session, username=username, password=password,
+        display_name="Capo Turno", roles=["Supervisor"],
+    )
+    await db_session.commit()
+    return user, password
+
+
+async def _two_quotes(db_session, recipe_id: int):
+    """The fixture recipe plus a second quote, so there is a 'next' one."""
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+
+    second = RecipeSubtask(
+        task_id=task.id, marker_number=2, description="Seconda quota",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+    )
+    db_session.add(second)
+    await db_session.commit()
+    await db_session.refresh(second)
+    return version.id, first, second
+
+
+async def _measure(client, user, subtask_id, version_id, value, run_id=None):
+    body = {"subtask_id": subtask_id, "version_id": version_id, "value": value}
+    if run_id is not None:
+        body["production_run_id"] = run_id
+    return await client.post(
+        "/api/measurements/", headers=auth_headers(user), json=body,
+    )
+
+
+async def _pending(client, user, version_id, run_id=None):
+    params = {"version_id": version_id}
+    if run_id is not None:
+        params["production_run_id"] = run_id
+    return await client.get(
+        "/api/measurements/pending-authorisation",
+        headers=auth_headers(user), params=params,
+    )
+
+
+# ---------------------------------------------------------------------------
+# The block
+# ---------------------------------------------------------------------------
+
+
+async def test_next_quote_is_refused_while_one_is_out_of_tolerance(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-NEXT")
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+
+    bad = await _measure(client, measurement_tec_user, first.id, version_id, OUT)
+    assert bad.status_code == 200
+    assert bad.json()["pass_fail"] == "fail"
+
+    refused = await _measure(client, measurement_tec_user, second.id, version_id, GOOD)
+    assert refused.status_code == 409
+    assert "supervisor" in refused.json()["detail"].lower()
+
+
+async def test_the_same_quote_can_be_measured_again(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """The caliper slips, the piece is reseated. Trying again is not going on."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-AGAIN")
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+
+    await _measure(client, measurement_tec_user, first.id, version_id, OUT)
+    again = await _measure(client, measurement_tec_user, first.id, version_id, OUT)
+    assert again.status_code == 200, "rimisurare la stessa quota deve restare possibile"
+
+
+async def test_a_good_reading_of_the_same_quote_releases_the_block(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """Only the latest reading of a quote counts: it is in tolerance now."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-FIXED")
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+
+    await _measure(client, measurement_tec_user, first.id, version_id, OUT)
+    await _measure(client, measurement_tec_user, first.id, version_id, GOOD)
+
+    ahead = await _measure(client, measurement_tec_user, second.id, version_id, GOOD)
+    assert ahead.status_code == 200
+
+    # Both readings stay on record - how many are allowed is point 4's business.
+    rows = (await db_session.execute(
+        select(Measurement).where(Measurement.subtask_id == first.id)
+    )).scalars().all()
+    assert len(rows) == 2
+
+
+async def test_a_warning_does_not_block(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """Outside the warning limits but inside tolerance is still inside tolerance."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-WARN")
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+
+    warned = await _measure(client, measurement_tec_user, first.id, version_id, 10.4)
+    assert warned.json()["pass_fail"] == "warning"
+
+    ahead = await _measure(client, measurement_tec_user, second.id, version_id, GOOD)
+    assert ahead.status_code == 200
+
+
+async def test_pending_authorisation_names_the_blocking_quote(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """What the screen asks on load, so a reload is not a way past the gate."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-PEND")
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+
+    assert (await _pending(client, measurement_tec_user, version_id)).json() is None
+
+    bad = (await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT,
+    )).json()
+
+    pending = (await _pending(client, measurement_tec_user, version_id)).json()
+    assert pending["id"] == bad["id"]
+    assert pending["subtask_id"] == first.id
+
+
+# ---------------------------------------------------------------------------
+# The authorisation
+# ---------------------------------------------------------------------------
+
+
+async def test_supervisor_authorisation_is_recorded_and_releases_the_block(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-AUTH")
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+    supervisor, password = await _supervisor(db_session)
+
+    bad = (await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT,
+    )).json()
+
+    authorised = await client.post(
+        f"/api/measurements/{bad['id']}/authorise",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": supervisor.username,
+            "supervisor_password": password,
+        },
+    )
+    assert authorised.status_code == 200, authorised.text
+    body = authorised.json()
+    # Who said yes is on the measurement itself, which is the whole point.
+    assert body["supervisor_id"] == supervisor.id
+    assert body["authorised_at"] is not None
+
+    ahead = await _measure(client, measurement_tec_user, second.id, version_id, GOOD)
+    assert ahead.status_code == 200
+
+
+async def test_authorisation_refuses_someone_who_is_not_a_supervisor(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-NOSUP")
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+
+    bad = (await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT,
+    )).json()
+
+    resp = await client.post(
+        f"/api/measurements/{bad['id']}/authorise",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": maker_user.username,
+            "supervisor_password": "testpassword123",
+        },
+    )
+    assert resp.status_code in (401, 403)
+
+    # And the block is still there.
+    refused = await _measure(client, measurement_tec_user, second.id, version_id, GOOD)
+    assert refused.status_code == 409
+
+
+async def test_authorisation_refuses_wrong_credentials(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-BADPW")
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+    supervisor, _password = await _supervisor(db_session, username="capo-badpw")
+
+    bad = (await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT,
+    )).json()
+    resp = await client.post(
+        f"/api/measurements/{bad['id']}/authorise",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": supervisor.username,
+            "supervisor_password": "sbagliata",
+        },
+    )
+    assert resp.status_code == 401
+
+
+async def test_there_is_nothing_to_authorise_on_a_good_measurement(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-GOOD")
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+    supervisor, password = await _supervisor(db_session, username="capo-good")
+
+    good = (await _measure(
+        client, measurement_tec_user, first.id, version_id, GOOD,
+    )).json()
+    resp = await client.post(
+        f"/api/measurements/{good['id']}/authorise",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": supervisor.username,
+            "supervisor_password": password,
+        },
+    )
+    assert resp.status_code == 409
+
+
+# ---------------------------------------------------------------------------
+# The production run
+# ---------------------------------------------------------------------------
+
+
+async def test_cycle_cannot_close_over_an_unauthorised_fail(
+    client: AsyncClient, maker_user, measurement_tec_user, admin_user, db_session,
+):
+    """Closing the cycle would be another way of walking past the quote."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-CYC")
+    recipe.measurement_interval_minutes = 10
+    station = Station(
+        code="ST-TOL", name="Stazione", active=True, created_by=admin_user.id,
+    )
+    db_session.add(station)
+    await db_session.commit()
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+
+    run = (await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )).json()
+
+    await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT, run_id=run["id"],
+    )
+
+    refused = await client.post(
+        f"/api/production-runs/{run['id']}/cycle",
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert refused.status_code == 409
+
+    supervisor, password = await _supervisor(db_session, username="capo-cyc")
+    blocking = (await _pending(
+        client, measurement_tec_user, version_id, run_id=run["id"],
+    )).json()
+    await client.post(
+        f"/api/measurements/{blocking['id']}/authorise",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": supervisor.username,
+            "supervisor_password": password,
+        },
+    )
+
+    allowed = await client.post(
+        f"/api/production-runs/{run['id']}/cycle",
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert allowed.status_code == 200
+    assert allowed.json()["cycle_count"] == 1
+
+
+async def test_the_statistics_file_carries_the_decision(
+    client: AsyncClient, maker_user, measurement_tec_user, admin_user, db_session,
+    tmp_path, monkeypatch,
+):
+    """The file has to show the failure and who let it stand, not just the failure."""
+    from src.backend.config import settings
+
+    monkeypatch.setattr(
+        type(settings), "upload_path", property(lambda self: tmp_path), raising=False,
+    )
+
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-CSV")
+    station = Station(
+        code="ST-CSV", name="Stazione", active=True, created_by=admin_user.id,
+    )
+    db_session.add(station)
+    await db_session.commit()
+    version_id, first, _second = await _two_quotes(db_session, recipe.id)
+    supervisor, password = await _supervisor(db_session, username="capo-csv")
+    creds = {
+        "supervisor_username": supervisor.username, "supervisor_password": password,
+    }
+
+    run = (await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )).json()
+    bad = (await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT, run_id=run["id"],
+    )).json()
+    await client.post(
+        f"/api/measurements/{bad['id']}/authorise",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )
+
+    closed = (await client.post(
+        f"/api/production-runs/{run['id']}/close",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )).json()
+
+    text = (tmp_path / closed["statistics_path"]).read_text(encoding="utf-8-sig")
+    header, row = [line for line in text.splitlines() if line.strip()]
+    assert "authorised_by" in header and "authorised_at" in header
+    assert str(supervisor.id) in row
+
+
+async def test_a_fail_from_another_production_does_not_block_this_one(
+    client: AsyncClient, maker_user, measurement_tec_user, admin_user, db_session,
+    tmp_path, monkeypatch,
+):
+    """The run is the boundary: an old production must not stop a new one."""
+    # Closing a run writes the statistics file; pointed at tmp_path so the test
+    # does not leave one in the repository's uploads directory.
+    from src.backend.config import settings
+
+    monkeypatch.setattr(
+        type(settings), "upload_path", property(lambda self: tmp_path), raising=False,
+    )
+
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TOL-SCOPE")
+    station = Station(
+        code="ST-SCOPE", name="Stazione", active=True, created_by=admin_user.id,
+    )
+    db_session.add(station)
+    await db_session.commit()
+    version_id, first, second = await _two_quotes(db_session, recipe.id)
+
+    first_run = (await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )).json()
+    await _measure(
+        client, measurement_tec_user, first.id, version_id, OUT,
+        run_id=first_run["id"],
+    )
+
+    supervisor, password = await _supervisor(db_session, username="capo-scope")
+    await client.post(
+        f"/api/production-runs/{first_run['id']}/close",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": supervisor.username,
+            "supervisor_password": password,
+        },
+    )
+
+    second_run = (await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )).json()
+    resp = await _measure(
+        client, measurement_tec_user, second.id, version_id, GOOD,
+        run_id=second_run["id"],
+    )
+    assert resp.status_code == 200

src/backend/tests/test_production_runs.py

@@ -0,0 +1,747 @@
+"""Integration tests for /api/production-runs.
+
+The point of these tables is that a production outlives the page it was started
+from, so the tests lean on what must survive: the deadline, the cycle count, the
+trace of what happened, and the rule that a station has one production at a time.
+"""
+from datetime import datetime, timedelta
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.production import ProductionRun
+from src.backend.models.orm.recipe import Recipe
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeTask
+from src.backend.services import auth_service, production_service
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+async def _station(db_session, user_id: int, code: str = "ST-PROD") -> Station:
+    station = Station(code=code, name=f"Stazione {code}", active=True, created_by=user_id)
+    db_session.add(station)
+    await db_session.commit()
+    await db_session.refresh(station)
+    return station
+
+
+async def _recipe_with_interval(db_session, user_id: int, minutes, code="REC-PROD") -> Recipe:
+    recipe = await create_test_recipe(db_session, user_id=user_id, code=code)
+    recipe.measurement_interval_minutes = minutes
+    await db_session.commit()
+    await db_session.refresh(recipe)
+    return recipe
+
+
+async def _supervisor(db_session, username="capoturno", password="TurnoPwd1"):
+    user = await auth_service.create_user(
+        db_session,
+        username=username,
+        password=password,
+        display_name="Capo Turno",
+        roles=["Supervisor"],
+    )
+    await db_session.commit()
+    return user, password
+
+
+async def _advance_clock(db_session, run_id: int, delta: timedelta) -> None:
+    """Simulate wall-clock time passing, without sleeping in a test.
+
+    Winding every instant stored on the run back by D is indistinguishable from D
+    having elapsed. Moving only one of them would not be time passing - it would be
+    rewriting history, and would measure the wrong thing.
+    """
+    run = (await db_session.execute(
+        select(ProductionRun).where(ProductionRun.id == run_id)
+    )).scalar_one()
+    run.started_at = run.started_at - delta
+    if run.next_measurement_at is not None:
+        run.next_measurement_at = run.next_measurement_at - delta
+    if run.paused_at is not None:
+        run.paused_at = run.paused_at - delta
+    await db_session.commit()
+
+
+async def _only_task(db_session, version_id: int):
+    """The single task the fixture recipe comes with - a measurement one."""
+    row = await db_session.execute(
+        select(RecipeTask)
+        .where(RecipeTask.version_id == version_id)
+        .order_by(RecipeTask.order_index)
+    )
+    return row.scalars().first()
+
+
+async def _add_task(
+    db_session, version_id: int, order_index: int, title: str, task_type: str = "measure",
+) -> RecipeTask:
+    """A further task in the sequence, of a declared type."""
+    task = RecipeTask(
+        version_id=version_id, order_index=order_index, title=title, task_type=task_type,
+    )
+    db_session.add(task)
+    await db_session.commit()
+    await db_session.refresh(task)
+    return task
+
+
+async def _open(client, user, station, recipe, **extra):
+    return await client.post(
+        "/api/production-runs",
+        headers=auth_headers(user),
+        json={"station_code": station.code, "recipe_id": recipe.id, **extra},
+    )
+
+
+# ---------------------------------------------------------------------------
+# Opening
+# ---------------------------------------------------------------------------
+
+
+async def test_open_run_requires_auth(client: AsyncClient):
+    resp = await client.post("/api/production-runs", json={"station_code": "X", "recipe_id": 1})
+    assert resp.status_code == 401
+
+
+async def test_open_run_starts_the_countdown(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id)
+    recipe = await _recipe_with_interval(db_session, admin_user.id, minutes=30)
+
+    resp = await _open(client, measurement_tec_user, station, recipe)
+    assert resp.status_code == 201, resp.text
+    body = resp.json()
+    assert body["status"] == "running"
+    assert body["cycle_count"] == 0
+    assert body["measurement_interval_minutes"] == 30
+    # About half an hour out, allowing for the round trip.
+    assert 29 * 60 <= body["seconds_to_next_measurement"] <= 30 * 60
+    assert body["overdue"] is False
+
+
+async def test_open_run_without_interval_has_no_deadline(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-NOINT")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, None, code="REC-NOINT")
+
+    body = (await _open(client, measurement_tec_user, station, recipe)).json()
+    assert body["next_measurement_at"] is None
+    assert body["seconds_to_next_measurement"] is None
+    assert body["overdue"] is False
+
+
+async def test_open_run_snapshots_the_interval(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """Editing the recipe mid-production must not move a running deadline."""
+    station = await _station(db_session, admin_user.id, code="ST-SNAP")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 20, code="REC-SNAP")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+
+    recipe.measurement_interval_minutes = 90
+    await db_session.commit()
+
+    resp = await client.get(
+        f"/api/production-runs/{run_id}", headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.json()["measurement_interval_minutes"] == 20
+
+
+async def test_station_cannot_have_two_open_runs(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-ONE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 15, code="REC-ONE")
+    first = await _open(client, measurement_tec_user, station, recipe)
+    assert first.status_code == 201
+
+    second = await _open(client, measurement_tec_user, station, recipe)
+    assert second.status_code == 409
+
+
+async def test_open_run_rejects_unknown_station(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 15, code="REC-NOSTAT")
+    resp = await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": "ST-GHOST", "recipe_id": recipe.id},
+    )
+    assert resp.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# Reading the current run - what replaces the in-page state
+# ---------------------------------------------------------------------------
+
+
+async def test_current_run_is_null_when_nothing_is_running(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-IDLE")
+    resp = await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 200
+    assert resp.json() is None
+
+
+async def test_current_run_survives_and_keeps_counting_down(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """The deadline is stored, so a fresh page load rejoins the same countdown."""
+    station = await _station(db_session, admin_user.id, code="ST-KEEP")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 45, code="REC-KEEP")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+
+    later = await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )
+    body = later.json()
+    assert body["id"] == opened["id"]
+    assert body["next_measurement_at"] == opened["next_measurement_at"]
+    assert body["seconds_to_next_measurement"] <= opened["seconds_to_next_measurement"]
+
+
+# ---------------------------------------------------------------------------
+# Cycles
+# ---------------------------------------------------------------------------
+
+
+async def test_cycle_restarts_the_interval_and_counts(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-CYC")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-CYC")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+
+    resp = await client.post(
+        f"/api/production-runs/{run_id}/cycle", headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["cycle_count"] == 1
+    assert 9 * 60 <= body["seconds_to_next_measurement"] <= 10 * 60
+
+
+async def test_measurement_tasks_travel_with_the_run(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """Where the measurement is cannot be guessed by the client: the run says so.
+
+    This is what lets a screen bring the operator back to the measurement when the
+    interval expires, whatever page they wandered off to.
+    """
+    station = await _station(db_session, admin_user.id, code="ST-SEQ")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-SEQ")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    first = await _only_task(db_session, opened["version_id"])
+    # A drawing between the two measurements, to prove it is left out.
+    await _add_task(db_session, opened["version_id"], 1, "Disegno", "drawing")
+    second = await _add_task(db_session, opened["version_id"], 2, "Seconda misura")
+
+    body = (await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )).json()
+    assert body["measurement_task_ids"] == [first.id, second.id]
+
+
+async def test_cycle_closes_only_on_the_last_measurement_task(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """Restarting at the first would measure three times as often as configured."""
+    station = await _station(db_session, admin_user.id, code="ST-MULTI")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-MULTI")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    run_id = opened["id"]
+    first = await _only_task(db_session, opened["version_id"])
+    second = await _add_task(db_session, opened["version_id"], 1, "Seconda misura")
+    headers = auth_headers(measurement_tec_user)
+
+    # Four minutes of the interval have gone by when the first task is finished.
+    await _advance_clock(db_session, run_id, timedelta(minutes=4))
+
+    mid = (await client.post(
+        f"/api/production-runs/{run_id}/cycle", headers=headers, json={"task_id": first.id},
+    )).json()
+    assert mid["cycle_count"] == 0, "il ciclo non e' ancora finito"
+    assert 5 * 60 <= mid["seconds_to_next_measurement"] <= 6 * 60, (
+        "l'intervallo non deve ripartire a meta' ciclo"
+    )
+
+    end = (await client.post(
+        f"/api/production-runs/{run_id}/cycle", headers=headers, json={"task_id": second.id},
+    )).json()
+    assert end["cycle_count"] == 1
+    assert 9 * 60 <= end["seconds_to_next_measurement"] <= 10 * 60
+
+    events = (await client.get(
+        f"/api/production-runs/{run_id}", headers=headers,
+    )).json()["events"]
+    by_type = {e["event_type"]: e for e in events}
+    assert by_type["task_measured"]["task_id"] == first.id
+    assert by_type["cycle_completed"]["task_id"] == second.id
+
+
+async def test_cycle_without_a_task_closes_as_before(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """A caller that knows nothing of the sequence keeps the old behaviour."""
+    station = await _station(db_session, admin_user.id, code="ST-PLAIN")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-PLAIN")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    await _add_task(db_session, opened["version_id"], 1, "Seconda misura")
+
+    body = (await client.post(
+        f"/api/production-runs/{opened['id']}/cycle",
+        headers=auth_headers(measurement_tec_user),
+    )).json()
+    assert body["cycle_count"] == 1
+
+
+# ---------------------------------------------------------------------------
+# Rimisura - turning the piece over
+# ---------------------------------------------------------------------------
+
+
+async def test_remeasure_does_not_buy_another_interval(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """A second reading of the same part is not a new cycle."""
+    station = await _station(db_session, admin_user.id, code="ST-AGAIN")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-AGAIN")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    run_id = opened["id"]
+    task = await _only_task(db_session, opened["version_id"])
+    headers = auth_headers(measurement_tec_user)
+
+    await _advance_clock(db_session, run_id, timedelta(minutes=7))
+
+    body = (await client.post(
+        f"/api/production-runs/{run_id}/remeasure", headers=headers,
+        json={"task_id": task.id},
+    )).json()
+    assert body["cycle_count"] == 0
+    assert 2 * 60 <= body["seconds_to_next_measurement"] <= 3 * 60, (
+        "rigirare il pezzo non deve spostare la scadenza"
+    )
+
+    events = (await client.get(
+        f"/api/production-runs/{run_id}", headers=headers,
+    )).json()["events"]
+    remeasured = [e for e in events if e["event_type"] == "remeasure"]
+    assert len(remeasured) == 1
+    assert remeasured[0]["task_id"] == task.id
+
+
+async def test_remeasure_refused_while_the_line_is_stopped(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-AGPAUSE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-AGPAUSE")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-again")
+
+    await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )
+    resp = await client.post(
+        f"/api/production-runs/{run_id}/remeasure",
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 409
+
+
+async def test_overdue_run_reports_negative_seconds(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """Past the interval the countdown keeps going the other way, so the delay shows."""
+    station = await _station(db_session, admin_user.id, code="ST-LATE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 5, code="REC-LATE")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+
+    await _advance_clock(db_session, run_id, timedelta(minutes=8))
+
+    body = (await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )).json()
+    assert body["overdue"] is True
+    assert -190 <= body["seconds_to_next_measurement"] <= -170
+
+
+# ---------------------------------------------------------------------------
+# Fermo linea / ripresa / chiusura
+# ---------------------------------------------------------------------------
+
+
+async def test_pause_requires_supervisor_credentials(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-PAUSE1")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-PAUSE1")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+
+    resp = await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": "nobody", "supervisor_password": "wrong"},
+    )
+    assert resp.status_code == 401
+
+
+async def test_pause_rejects_non_supervisor(
+    client: AsyncClient, measurement_tec_user, maker_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-PAUSE2")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-PAUSE2")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+
+    resp = await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "supervisor_username": maker_user.username,
+            "supervisor_password": "testpassword123",
+        },
+    )
+    assert resp.status_code in (401, 403)
+
+
+async def test_pause_freezes_the_countdown(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """A fermo linea must not eat the measurement interval."""
+    station = await _station(db_session, admin_user.id, code="ST-FREEZE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 30, code="REC-FREEZE")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-freeze")
+
+    paused = (await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )).json()
+    assert paused["status"] == "paused"
+    frozen = paused["seconds_to_next_measurement"]
+
+    # An hour goes by with the line stopped: were the countdown still ticking, the
+    # run would now be deeply overdue.
+    await _advance_clock(db_session, run_id, timedelta(hours=1))
+
+    still = (await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )).json()
+    assert still["status"] == "paused"
+    assert still["seconds_to_next_measurement"] == frozen
+    assert still["overdue"] is False
+
+
+async def test_resume_gives_back_the_time_the_stop_took(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-RESUME")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 30, code="REC-RESUME")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-resume")
+    creds = {"supervisor_username": supervisor.username, "supervisor_password": password}
+
+    frozen = (await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )).json()["seconds_to_next_measurement"]
+
+    # The line stays down for ten minutes.
+    await _advance_clock(db_session, run_id, timedelta(minutes=10))
+
+    resumed = (await client.post(
+        f"/api/production-runs/{run_id}/resume",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )).json()
+    assert resumed["status"] == "running"
+    # The ten minutes of stop were handed back, not charged to the operator.
+    assert abs(resumed["seconds_to_next_measurement"] - frozen) <= 2
+
+
+async def test_cycle_refused_while_paused(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-PCYC")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-PCYC")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-pcyc")
+
+    await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )
+    resp = await client.post(
+        f"/api/production-runs/{run_id}/cycle", headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 409
+
+
+async def test_close_stops_the_timer_and_frees_the_station(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-CLOSE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-CLOSE")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-close")
+
+    closed = (await client.post(
+        f"/api/production-runs/{run_id}/close",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )).json()
+    assert closed["status"] == "closed"
+    assert closed["closed_by"] == supervisor.id
+    assert closed["seconds_to_next_measurement"] is None
+
+    # Nothing is open at the station any more...
+    current = await client.get(
+        "/api/production-runs/current",
+        params={"station_code": station.code},
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert current.json() is None
+
+    # ...and a new production can start there.
+    again = await _open(client, measurement_tec_user, station, recipe)
+    assert again.status_code == 201
+
+
+async def test_closed_run_refuses_further_actions(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-DEAD")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-DEAD")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-dead")
+    creds = {"supervisor_username": supervisor.username, "supervisor_password": password}
+
+    await client.post(
+        f"/api/production-runs/{run_id}/close",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )
+    cycle = await client.post(
+        f"/api/production-runs/{run_id}/cycle", headers=auth_headers(measurement_tec_user),
+    )
+    assert cycle.status_code == 409
+    pause = await client.post(
+        f"/api/production-runs/{run_id}/pause",
+        headers=auth_headers(measurement_tec_user), json=creds,
+    )
+    assert pause.status_code == 409
+
+
+# ---------------------------------------------------------------------------
+# The trace
+# ---------------------------------------------------------------------------
+
+
+async def test_run_records_what_happened(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """The history a production never had: start, cycles, stop, resume, close."""
+    station = await _station(db_session, admin_user.id, code="ST-TRACE")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-TRACE")
+    run_id = (await _open(client, measurement_tec_user, station, recipe)).json()["id"]
+    supervisor, password = await _supervisor(db_session, username="capo-trace")
+    creds = {"supervisor_username": supervisor.username, "supervisor_password": password}
+    headers = auth_headers(measurement_tec_user)
+
+    await client.post(f"/api/production-runs/{run_id}/cycle", headers=headers)
+    await client.post(f"/api/production-runs/{run_id}/pause", headers=headers, json=creds)
+    await client.post(f"/api/production-runs/{run_id}/resume", headers=headers, json=creds)
+    await client.post(f"/api/production-runs/{run_id}/close", headers=headers, json=creds)
+
+    events = (await client.get(
+        f"/api/production-runs/{run_id}", headers=headers,
+    )).json()["events"]
+    assert [e["event_type"] for e in events] == [
+        "start", "cycle_completed", "line_stop", "resume", "close",
+    ]
+    # Who authorised what is on the record.
+    by_type = {e["event_type"]: e for e in events}
+    assert by_type["line_stop"]["supervisor_id"] == supervisor.id
+    assert by_type["close"]["supervisor_id"] == supervisor.id
+    assert by_type["cycle_completed"]["supervisor_id"] is None
+
+
+async def test_traceability_travels_with_the_run(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    station = await _station(db_session, admin_user.id, code="ST-LOT")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-LOT")
+    body = (await _open(
+        client, measurement_tec_user, station, recipe,
+        lot_number="LOT-42", serial_number="SN-7",
+    )).json()
+    assert body["lot_number"] == "LOT-42"
+    assert body["serial_number"] == "SN-7"
+
+
+# ---------------------------------------------------------------------------
+# Fine produzione: the statistics file (point 6)
+# ---------------------------------------------------------------------------
+
+
+async def _measure(client, user, run_id, subtask_id, version_id, value):
+    return await client.post(
+        "/api/measurements/",
+        headers=auth_headers(user),
+        json={
+            "subtask_id": subtask_id,
+            "version_id": version_id,
+            "value": value,
+            "lot_number": "LOT-STAT",
+            "production_run_id": run_id,
+        },
+    )
+
+
+async def _first_subtask(db_session, recipe_id: int):
+    from src.backend.models.orm.recipe import RecipeVersion
+    from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+
+    row = await db_session.execute(
+        select(RecipeSubtask)
+        .join(RecipeTask, RecipeTask.id == RecipeSubtask.task_id)
+        .join(RecipeVersion, RecipeVersion.id == RecipeTask.version_id)
+        .where(RecipeVersion.recipe_id == recipe_id)
+    )
+    return row.scalars().first()
+
+
+async def test_measurement_is_tied_to_the_run(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session,
+):
+    """Without this link 'the measurements of this production' is not a query."""
+    station = await _station(db_session, admin_user.id, code="ST-LINK")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-LINK")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    subtask = await _first_subtask(db_session, recipe.id)
+
+    resp = await _measure(
+        client, measurement_tec_user, opened["id"], subtask.id, opened["version_id"], 10.0,
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["production_run_id"] == opened["id"]
+
+
+async def test_close_emits_the_statistics_file(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session, tmp_path,
+    monkeypatch,
+):
+    from src.backend.config import settings
+    from src.backend.services import production_export_service
+
+    monkeypatch.setattr(
+        type(settings), "upload_path", property(lambda self: tmp_path), raising=False,
+    )
+
+    station = await _station(db_session, admin_user.id, code="ST-STAT")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-STAT")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    subtask = await _first_subtask(db_session, recipe.id)
+    await _measure(
+        client, measurement_tec_user, opened["id"], subtask.id, opened["version_id"], 10.0,
+    )
+    supervisor, password = await _supervisor(db_session, username="capo-stat")
+
+    closed = (await client.post(
+        f"/api/production-runs/{opened['id']}/close",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )).json()
+
+    assert closed["statistics_path"], "la chiusura deve produrre il file di statistica"
+    written = tmp_path / closed["statistics_path"]
+    assert written.exists()
+
+    text = written.read_text(encoding="utf-8-sig")
+    lines = [line for line in text.splitlines() if line.strip()]
+    assert len(lines) == 2, "intestazione piu' una misura"
+    assert "production_run_id" in lines[0]
+    # The tolerance limits travel with the row: a pass/fail must stay re-derivable.
+    for column in ("ltl", "lwl", "uwl", "utl", "nominal"):
+        assert column in lines[0]
+    assert "LOT-STAT" in lines[1]
+    assert str(opened["id"]) in lines[1]
+
+
+async def test_close_marks_measurements_as_exported(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session, tmp_path,
+    monkeypatch,
+):
+    from src.backend.config import settings
+    from src.backend.models.orm.measurement import Measurement
+
+    monkeypatch.setattr(
+        type(settings), "upload_path", property(lambda self: tmp_path), raising=False,
+    )
+
+    station = await _station(db_session, admin_user.id, code="ST-SYNC")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-SYNC")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    subtask = await _first_subtask(db_session, recipe.id)
+    created = (await _measure(
+        client, measurement_tec_user, opened["id"], subtask.id, opened["version_id"], 10.0,
+    )).json()
+    assert created["synced_to_csv"] is False
+
+    supervisor, password = await _supervisor(db_session, username="capo-sync")
+    await client.post(
+        f"/api/production-runs/{opened['id']}/close",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )
+
+    row = (await db_session.execute(
+        select(Measurement).where(Measurement.id == created["id"])
+    )).scalar_one()
+    await db_session.refresh(row)
+    assert row.synced_to_csv is True
+
+
+async def test_close_without_measurements_writes_no_file(
+    client: AsyncClient, measurement_tec_user, admin_user, db_session, tmp_path,
+    monkeypatch,
+):
+    """An empty file would be noise in the folder, not evidence."""
+    from src.backend.config import settings
+
+    monkeypatch.setattr(
+        type(settings), "upload_path", property(lambda self: tmp_path), raising=False,
+    )
+
+    station = await _station(db_session, admin_user.id, code="ST-EMPTY")
+    recipe = await _recipe_with_interval(db_session, admin_user.id, 10, code="REC-EMPTY")
+    opened = (await _open(client, measurement_tec_user, station, recipe)).json()
+    supervisor, password = await _supervisor(db_session, username="capo-empty")
+
+    closed = (await client.post(
+        f"/api/production-runs/{opened['id']}/close",
+        headers=auth_headers(measurement_tec_user),
+        json={"supervisor_username": supervisor.username, "supervisor_password": password},
+    )).json()
+    assert closed["statistics_path"] is None
+    assert not (tmp_path / "statistics").exists()

src/backend/tests/test_recipe_rules.py

@@ -0,0 +1,280 @@
+"""What a recipe is allowed to demand of the operator (points 8 and 9).
+
+Two rules that used to be nobody's: whether the lot and the serial are compulsory,
+and whether a value may be typed rather than read from the caliper. Both are
+declared on the recipe and enforced on the server, because a rule enforced only by
+the screen is a suggestion - the keypad can be hidden and the same request still
+sent by hand.
+"""
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.recipe import Recipe, RecipeVersion
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+async def _rules(db_session, recipe: Recipe, **flags) -> Recipe:
+    for key, value in flags.items():
+        setattr(recipe, key, value)
+    await db_session.commit()
+    await db_session.refresh(recipe)
+    return recipe
+
+
+async def _first_subtask(db_session, recipe_id: int) -> RecipeSubtask:
+    row = await db_session.execute(
+        select(RecipeSubtask)
+        .join(RecipeTask, RecipeTask.id == RecipeSubtask.task_id)
+        .join(RecipeVersion, RecipeVersion.id == RecipeTask.version_id)
+        .where(RecipeVersion.recipe_id == recipe_id)
+    )
+    return row.scalars().first()
+
+
+async def _current_version_id(db_session, recipe_id: int) -> int:
+    row = await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )
+    return row.scalar_one().id
+
+
+async def _measure(client, user, subtask_id, version_id, **extra):
+    return await client.post(
+        "/api/measurements/",
+        headers=auth_headers(user),
+        json={
+            "subtask_id": subtask_id, "version_id": version_id, "value": 10.0, **extra,
+        },
+    )
+
+
+# ---------------------------------------------------------------------------
+# The rules are part of the recipe
+# ---------------------------------------------------------------------------
+
+
+async def test_new_recipe_forbids_typing_by_default(client: AsyncClient, maker_user):
+    """The caliper is the instrument: typing is what has to be asked for."""
+    resp = await client.post(
+        "/api/recipes",
+        headers=auth_headers(maker_user),
+        json={"code": "REG-DEF", "name": "Regole di default"},
+    )
+    assert resp.status_code == 201, resp.text
+    body = resp.json()
+    assert body["allow_manual_input"] is False
+    assert body["requires_lot"] is False
+    assert body["requires_serial"] is False
+
+
+async def test_recipe_carries_the_rules_it_was_created_with(
+    client: AsyncClient, maker_user,
+):
+    resp = await client.post(
+        "/api/recipes",
+        headers=auth_headers(maker_user),
+        json={
+            "code": "REG-SET", "name": "Con regole",
+            "requires_lot": True, "requires_serial": True, "allow_manual_input": True,
+        },
+    )
+    body = resp.json()
+    assert (body["requires_lot"], body["requires_serial"], body["allow_manual_input"]) \
+        == (True, True, True)
+
+
+async def test_rules_can_be_switched_off_again(
+    client: AsyncClient, maker_user, db_session,
+):
+    """False must reach the database: a flag that only ever turns on is a trap."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="REG-OFF")
+    await _rules(db_session, recipe, requires_lot=True, allow_manual_input=True)
+
+    resp = await client.put(
+        f"/api/recipes/{recipe.id}",
+        headers=auth_headers(maker_user),
+        json={"requires_lot": False, "allow_manual_input": False},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["requires_lot"] is False
+    assert resp.json()["allow_manual_input"] is False
+
+
+async def test_rules_survive_a_new_version(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """Editing a recipe with measurements copies it; the rules must come along."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="REG-VER")
+    await _rules(db_session, recipe, requires_lot=True)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    # A measurement on the current version forces copy-on-write on the next edit.
+    await _measure(
+        client, measurement_tec_user, subtask.id, version_id, lot_number="L-1",
+    )
+    resp = await client.put(
+        f"/api/recipes/{recipe.id}",
+        headers=auth_headers(maker_user),
+        json={"name": "Rinominata"},
+    )
+    assert resp.status_code == 200
+    assert resp.json()["requires_lot"] is True
+
+
+# ---------------------------------------------------------------------------
+# Point 8 - traceability
+# ---------------------------------------------------------------------------
+
+
+async def test_measurement_without_the_required_lot_is_refused(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TRC-LOT")
+    await _rules(db_session, recipe, requires_lot=True)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    refused = await _measure(client, measurement_tec_user, subtask.id, version_id)
+    assert refused.status_code == 422
+
+    # Blank is not a lot number either.
+    blank = await _measure(
+        client, measurement_tec_user, subtask.id, version_id, lot_number="   ",
+    )
+    assert blank.status_code == 422
+
+    accepted = await _measure(
+        client, measurement_tec_user, subtask.id, version_id, lot_number="LOT-9",
+    )
+    assert accepted.status_code == 200
+
+
+async def test_measurement_without_the_required_serial_is_refused(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TRC-SER")
+    await _rules(db_session, recipe, requires_serial=True)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    assert (await _measure(
+        client, measurement_tec_user, subtask.id, version_id,
+    )).status_code == 422
+    assert (await _measure(
+        client, measurement_tec_user, subtask.id, version_id, serial_number="SN-1",
+    )).status_code == 200
+
+
+async def test_optional_traceability_still_accepts_nothing(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """Recipes that do not ask for a lot must go on working as they did."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TRC-OPT")
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    assert (await _measure(
+        client, measurement_tec_user, subtask.id, version_id,
+    )).status_code == 200
+
+
+async def test_production_cannot_start_without_the_required_lot(
+    client: AsyncClient, maker_user, measurement_tec_user, admin_user, db_session,
+):
+    """The lot has to be there before the first value, not after it."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="TRC-RUN")
+    await _rules(db_session, recipe, requires_lot=True)
+    station = Station(
+        code="ST-TRC", name="Stazione", active=True, created_by=admin_user.id,
+    )
+    db_session.add(station)
+    await db_session.commit()
+
+    refused = await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )
+    assert refused.status_code == 422
+
+    started = await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "station_code": station.code, "recipe_id": recipe.id, "lot_number": "L-7",
+        },
+    )
+    assert started.status_code == 201
+
+
+# ---------------------------------------------------------------------------
+# Point 9 - typed values
+# ---------------------------------------------------------------------------
+
+
+async def test_typed_value_is_refused_when_the_recipe_forbids_it(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="MAN-NO")
+    await _rules(db_session, recipe, allow_manual_input=False)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    refused = await _measure(
+        client, measurement_tec_user, subtask.id, version_id, input_method="manual",
+    )
+    assert refused.status_code == 422
+    assert "caliper" in refused.json()["detail"].lower()
+
+
+async def test_the_caliper_is_always_welcome(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="MAN-USB")
+    await _rules(db_session, recipe, allow_manual_input=False)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    resp = await _measure(
+        client, measurement_tec_user, subtask.id, version_id,
+        input_method="usb_caliper",
+    )
+    assert resp.status_code == 200
+    assert resp.json()["input_method"] == "usb_caliper"
+
+
+async def test_typing_is_allowed_where_the_recipe_says_so(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id, code="MAN-YES")
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    resp = await _measure(
+        client, measurement_tec_user, subtask.id, version_id, input_method="manual",
+    )
+    assert resp.status_code == 200
+
+
+async def test_the_default_input_method_is_covered_by_the_rule(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """A request that says nothing about how the value was entered counts as typed.
+
+    Otherwise omitting the field would be the way around the rule.
+    """
+    recipe = await create_test_recipe(db_session, maker_user.id, code="MAN-DEF")
+    await _rules(db_session, recipe, allow_manual_input=False)
+    subtask = await _first_subtask(db_session, recipe.id)
+    version_id = await _current_version_id(db_session, recipe.id)
+
+    assert (await _measure(
+        client, measurement_tec_user, subtask.id, version_id,
+    )).status_code == 422

src/backend/tests/test_recipes.py

@@ -1,12 +1,40 @@
 """Tests for recipes router (/api/recipes)."""
 import pytest
 from httpx import AsyncClient
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask
 from src.backend.models.orm.user import User
 from src.backend.tests.conftest import auth_headers, create_test_recipe
 
 
+async def _seed_measurement(db: AsyncSession, recipe_id: int, user_id: int) -> None:
+    version_id = (await db.execute(
+        select(RecipeVersion.id).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    subtask_id = (await db.execute(
+        select(RecipeSubtask.id)
+        .join(RecipeSubtask.task)
+        .where(RecipeSubtask.task.has(version_id=version_id))
+    )).scalar_one()
+    db.add(Measurement(
+        subtask_id=subtask_id,
+        version_id=version_id,
+        measured_by=user_id,
+        value=10.0,
+        pass_fail="pass",
+        deviation=0.0,
+        input_method="manual",
+    ))
+    await db.flush()
+
+
 class TestListRecipes:
     """GET /api/recipes tests."""
 
@@ -160,18 +188,13 @@ class TestCreateRecipe:
 class TestUpdateRecipe:
     """PUT /api/recipes/{recipe_id} tests."""
 
-    async def test_update_recipe(
+    async def test_update_recipe_in_place(
         self,
         client: AsyncClient,
         maker_user: User,
         db_session: AsyncSession,
     ):
-        """Updating a recipe creates a new version (copy-on-write).
-
-        We verify the new version exists by listing versions, since
-        SQLAlchemy identity-map staleness with StaticPool can cause
-        ``is_current`` to appear stale in some responses.
-        """
+        """Updating a recipe without measurements updates current version in-place."""
         recipe = await create_test_recipe(db_session, maker_user.id)
         resp = await client.put(
             f"/api/recipes/{recipe.id}",
@@ -183,7 +206,9 @@ class TestUpdateRecipe:
         )
         assert resp.status_code == 200
 
-        # Verify via versions list which always does a clean query
+        # expire identity-map cache so subsequent GETs see fresh data
+        db_session.expunge_all()
+
         versions_resp = await client.get(
             f"/api/recipes/{recipe.id}/versions",
             headers=auth_headers(maker_user),
@@ -191,8 +216,38 @@ class TestUpdateRecipe:
         assert versions_resp.status_code == 200
         versions = versions_resp.json()
         version_numbers = [v["version_number"] for v in versions]
-        assert 1 in version_numbers
-        assert 2 in version_numbers
+        assert version_numbers == [1]
+
+    async def test_update_recipe_copy_on_write(
+        self,
+        client: AsyncClient,
+        maker_user: User,
+        db_session: AsyncSession,
+    ):
+        """Updating a recipe with measurements creates a new version (copy-on-write)."""
+        recipe = await create_test_recipe(db_session, maker_user.id)
+        await _seed_measurement(db_session, recipe.id, maker_user.id)
+        db_session.expunge_all()
+
+        resp = await client.put(
+            f"/api/recipes/{recipe.id}",
+            headers=auth_headers(maker_user),
+            json={
+                "name": "Updated Recipe",
+                "change_notes": "Triggers copy-on-write",
+            },
+        )
+        assert resp.status_code == 200
+        db_session.expunge_all()
+
+        versions_resp = await client.get(
+            f"/api/recipes/{recipe.id}/versions",
+            headers=auth_headers(maker_user),
+        )
+        assert versions_resp.status_code == 200
+        versions = versions_resp.json()
+        version_numbers = sorted(v["version_number"] for v in versions)
+        assert version_numbers == [1, 2]
 
 
 class TestDeleteRecipe:
@@ -222,31 +277,34 @@ class TestRecipeVersioning:
         maker_user: User,
         db_session: AsyncSession,
     ):
-        """Multiple updates create consecutive versions."""
+        """Each update creates a new version when measurements exist (copy-on-write)."""
         recipe = await create_test_recipe(db_session, maker_user.id)
+        await _seed_measurement(db_session, recipe.id, maker_user.id)
+        db_session.expunge_all()
 
-        # Update once -> v2
+        # Update once -> v2 (v1 had measurements)
         await client.put(
             f"/api/recipes/{recipe.id}",
             headers=auth_headers(maker_user),
             json={"change_notes": "Version 2"},
         )
+        db_session.expunge_all()
+        await _seed_measurement(db_session, recipe.id, maker_user.id)
+        db_session.expunge_all()
 
-        # Update again -> v3
+        # Update again -> v3 (v2 now has measurements too)
         await client.put(
             f"/api/recipes/{recipe.id}",
             headers=auth_headers(maker_user),
             json={"change_notes": "Version 3"},
         )
+        db_session.expunge_all()
 
-        # List versions
         resp = await client.get(
             f"/api/recipes/{recipe.id}/versions",
             headers=auth_headers(maker_user),
         )
         assert resp.status_code == 200
         versions = resp.json()
-        version_numbers = [v["version_number"] for v in versions]
-        assert 1 in version_numbers
-        assert 2 in version_numbers
-        assert 3 in version_numbers
+        version_numbers = sorted(v["version_number"] for v in versions)
+        assert version_numbers == [1, 2, 3]

src/backend/tests/test_stations_api.py

@@ -201,3 +201,176 @@ async def test_duplicate_assignment_returns_409(
         json={"recipe_id": recipe.id},
     )
     assert second.status_code == 409
+
+
+# ---------------------------------------------------------------------------
+# Station list carries assigned recipes (point 7)
+# ---------------------------------------------------------------------------
+
+
+async def test_list_stations_includes_assigned_recipes(
+    client: AsyncClient, admin_user, db_session,
+):
+    """The admin list shows which recipes a station handles, without a call per row."""
+    recipe = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-LIST")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-WITHREC", "name": "Con ricette"},
+    )
+    sid = created.json()["id"]
+    await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+
+    resp = await client.get("/api/stations", headers=auth_headers(admin_user))
+    assert resp.status_code == 200
+    station = next(s for s in resp.json() if s["id"] == sid)
+    assert [r["code"] for r in station["recipes"]] == ["REC-LIST"]
+
+
+async def test_list_stations_empty_recipes_when_unassigned(
+    client: AsyncClient, admin_user,
+):
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-NOREC", "name": "Senza ricette"},
+    )
+    sid = created.json()["id"]
+    resp = await client.get("/api/stations", headers=auth_headers(admin_user))
+    station = next(s for s in resp.json() if s["id"] == sid)
+    assert station["recipes"] == []
+
+
+async def test_list_stations_hides_inactive_recipes(
+    client: AsyncClient, admin_user, db_session,
+):
+    """An assigned but deactivated recipe must not show: the operator won't see it."""
+    recipe = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-OFF")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-INACT", "name": "Con ricetta spenta"},
+    )
+    sid = created.json()["id"]
+    await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+
+    recipe.active = False
+    await db_session.commit()
+
+    resp = await client.get("/api/stations", headers=auth_headers(admin_user))
+    station = next(s for s in resp.json() if s["id"] == sid)
+    assert station["recipes"] == []
+
+
+# ---------------------------------------------------------------------------
+# Per-row station reset (point 7)
+# ---------------------------------------------------------------------------
+
+
+async def test_reset_station_removes_all_assignments(
+    client: AsyncClient, admin_user, db_session,
+):
+    first = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-R1")
+    second = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-R2")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-RESET", "name": "Da azzerare"},
+    )
+    sid = created.json()["id"]
+    for recipe in (first, second):
+        await client.post(
+            f"/api/stations/{sid}/recipes",
+            headers=auth_headers(admin_user),
+            json={"recipe_id": recipe.id},
+        )
+
+    resp = await client.delete(
+        f"/api/stations/{sid}/recipes", headers=auth_headers(admin_user),
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {"station_id": sid, "removed": 2}
+
+    left = await client.get(
+        f"/api/stations/{sid}/recipes", headers=auth_headers(admin_user),
+    )
+    assert left.json() == []
+
+
+async def test_reset_station_keeps_the_station(
+    client: AsyncClient, admin_user, db_session,
+):
+    """Reset clears assignments only - the station stays and can be reassigned."""
+    recipe = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-KEEP")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-KEEP", "name": "Resta"},
+    )
+    sid = created.json()["id"]
+    await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+    await client.delete(f"/api/stations/{sid}/recipes", headers=auth_headers(admin_user))
+
+    still_there = await client.get(
+        f"/api/stations/{sid}", headers=auth_headers(admin_user),
+    )
+    assert still_there.status_code == 200
+
+    reassigned = await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+    assert reassigned.status_code == 201
+
+
+async def test_reset_empty_station_is_idempotent(client: AsyncClient, admin_user):
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-IDEM", "name": "Gia vuota"},
+    )
+    sid = created.json()["id"]
+    resp = await client.delete(
+        f"/api/stations/{sid}/recipes", headers=auth_headers(admin_user),
+    )
+    assert resp.status_code == 200
+    assert resp.json()["removed"] == 0
+
+
+async def test_reset_station_non_admin_is_403(
+    client: AsyncClient, admin_user, maker_user,
+):
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-RBAC", "name": "Protetta"},
+    )
+    sid = created.json()["id"]
+    resp = await client.delete(
+        f"/api/stations/{sid}/recipes", headers=auth_headers(maker_user),
+    )
+    assert resp.status_code == 403
+
+
+async def test_reset_unknown_station_is_404(client: AsyncClient, admin_user):
+    resp = await client.delete(
+        "/api/stations/999999/recipes", headers=auth_headers(admin_user),
+    )
+    assert resp.status_code == 404

src/backend/tests/test_task_progress.py

@@ -0,0 +1,246 @@
+"""Point 10: a task left half done has to look different from one never opened.
+
+The task list showed both the same way, so an operator coming back to a recipe
+had to remember where they had got to - or measure something twice. These tests
+are about the count the list now puts on each card.
+"""
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+async def _version_and_task(db_session, recipe_id: int):
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    return version, task
+
+
+async def _add_quote(db_session, task_id: int, marker: int):
+    quote = RecipeSubtask(
+        task_id=task_id, marker_number=marker, description=f"Quota {marker}",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+    )
+    db_session.add(quote)
+    await db_session.commit()
+    await db_session.refresh(quote)
+    return quote
+
+
+async def _measure(client, user, subtask_id, version_id, value=10.0):
+    return await client.post(
+        "/api/measurements/", headers=auth_headers(user),
+        json={"subtask_id": subtask_id, "version_id": version_id, "value": value},
+    )
+
+
+async def _progress(client, user, version_id):
+    resp = await client.get(
+        "/api/measurements/task-progress",
+        headers=auth_headers(user),
+        params={"version_id": version_id},
+    )
+    assert resp.status_code == 200
+    return {row["task_id"]: row for row in resp.json()["tasks"]}
+
+
+async def test_untouched_task_reads_as_none(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[task.id]["state"] == "none"
+    assert rows[task.id]["measured"] == 0
+
+
+async def test_half_measured_task_reads_as_partial(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    await _add_quote(db_session, task.id, 2)
+
+    await _measure(client, measurement_tec_user, first.id, version.id)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[task.id] == {
+        "task_id": task.id, "quotes": 2, "measured": 1, "state": "partial",
+    }
+
+
+async def test_every_quote_taken_reads_as_complete(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    second = await _add_quote(db_session, task.id, 2)
+
+    await _measure(client, measurement_tec_user, first.id, version.id)
+    await _measure(client, measurement_tec_user, second.id, version.id)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[task.id]["state"] == "complete"
+    assert rows[task.id]["measured"] == 2
+
+
+async def test_measuring_the_same_quote_twice_does_not_inflate_the_count(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    """Two readings of one quote are one quote done, not two.
+
+    Re-measuring is allowed - it is how an operator recovers from a caliper that
+    slipped - and counting attempts would show a task of two quotes as finished
+    after one of them had been measured twice.
+    """
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    await _add_quote(db_session, task.id, 2)
+
+    await _measure(client, measurement_tec_user, first.id, version.id, 10.0)
+    await _measure(client, measurement_tec_user, first.id, version.id, 10.1)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[task.id]["measured"] == 1
+    assert rows[task.id]["state"] == "partial"
+
+
+async def test_documental_tasks_are_left_out(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    """A note cannot be half read; carrying it as unfinished for ever is noise."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    note = RecipeTask(
+        version_id=version.id, order_index=5, title="Leggere prima",
+        task_type="note",
+    )
+    db_session.add(note)
+    await db_session.commit()
+    await db_session.refresh(note)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert note.id not in rows
+    assert task.id in rows
+
+
+async def test_a_measurement_task_without_quotes_is_not_reported_as_missing(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    """Declared as a measurement, no quotes entered yet: nothing to take."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, _task = await _version_and_task(db_session, recipe.id)
+    empty = RecipeTask(
+        version_id=version.id, order_index=6, title="Da compilare",
+        task_type="measure",
+    )
+    db_session.add(empty)
+    await db_session.commit()
+    await db_session.refresh(empty)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[empty.id]["state"] == "empty"
+    assert rows[empty.id]["quotes"] == 0
+
+
+async def test_another_operators_work_is_not_counted_as_yours(
+    client: AsyncClient, db_session, measurement_tec_user, admin_user,
+):
+    """Outside a production the boundary is the operator, as it is everywhere else."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+
+    await _measure(client, admin_user, first.id, version.id)
+
+    rows = await _progress(client, measurement_tec_user, version.id)
+    assert rows[task.id]["state"] == "none"
+
+
+async def test_inside_a_production_the_run_is_the_boundary(
+    client: AsyncClient, db_session, measurement_tec_user, admin_user,
+):
+    """A quote measured before the production opened is not part of it.
+
+    The list is read during the run, and carrying yesterday's readings into it
+    would show a task as finished that this production has not touched.
+    """
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task = await _version_and_task(db_session, recipe.id)
+    first = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+
+    # Measured outside any production.
+    await _measure(client, measurement_tec_user, first.id, version.id)
+
+    station = Station(
+        code="ST-PROG", name="Stazione", active=True, created_by=admin_user.id,
+    )
+    db_session.add(station)
+    await db_session.commit()
+    run = (await client.post(
+        "/api/production-runs",
+        headers=auth_headers(measurement_tec_user),
+        json={"station_code": station.code, "recipe_id": recipe.id},
+    )).json()
+
+    resp = await client.get(
+        "/api/measurements/task-progress",
+        headers=auth_headers(measurement_tec_user),
+        params={"version_id": version.id, "production_run_id": run["id"]},
+    )
+    assert resp.status_code == 200
+    rows = {row["task_id"]: row for row in resp.json()["tasks"]}
+    assert rows[task.id]["state"] == "none"
+
+    await client.post(
+        "/api/measurements/", headers=auth_headers(measurement_tec_user),
+        json={
+            "subtask_id": first.id, "version_id": version.id, "value": 10.0,
+            "production_run_id": run["id"],
+        },
+    )
+    resp = await client.get(
+        "/api/measurements/task-progress",
+        headers=auth_headers(measurement_tec_user),
+        params={"version_id": version.id, "production_run_id": run["id"]},
+    )
+    rows = {row["task_id"]: row for row in resp.json()["tasks"]}
+    assert rows[task.id]["state"] == "complete"
+
+
+async def test_progress_needs_a_measurement_role(
+    client: AsyncClient, db_session, maker_user, measurement_tec_user,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, _task = await _version_and_task(db_session, recipe.id)
+
+    resp = await client.get(
+        "/api/measurements/task-progress",
+        headers=auth_headers(maker_user),
+        params={"version_id": version.id},
+    )
+    assert resp.status_code == 403

src/backend/tests/test_task_type.py

@@ -0,0 +1,171 @@
+"""Tests for the explicit task type (point 2).
+
+The type used to be deduced - quotes present meant a measurement - so a measurement
+task whose quotes had not been entered yet was treated as a note, and the system
+behaved differently depending on how complete the recipe was. These tests pin the
+type down as something declared and carried.
+"""
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeTask
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+async def _current_version(db_session, recipe_id: int) -> RecipeVersion:
+    row = await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )
+    return row.scalar_one()
+
+
+async def test_task_defaults_to_note(client: AsyncClient, maker_user, db_session):
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-T1")
+    await db_session.commit()
+
+    resp = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": "Solo una nota"},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["task_type"] == "note"
+
+
+@pytest.mark.parametrize("declared", ["note", "measure", "drawing"])
+async def test_task_keeps_the_declared_type(
+    client: AsyncClient, maker_user, db_session, declared,
+):
+    recipe = await create_test_recipe(
+        db_session, user_id=maker_user.id, code=f"REC-{declared}",
+    )
+    await db_session.commit()
+
+    resp = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": f"Task {declared}", "task_type": declared},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["task_type"] == declared
+
+
+async def test_measure_task_without_quotes_is_still_a_measure_task(
+    client: AsyncClient, maker_user, db_session,
+):
+    """The criterion from the document: an unfinished recipe must not change kind."""
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-NOQ")
+    await db_session.commit()
+
+    created = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": "Misura da compilare", "task_type": "measure"},
+    )
+    task_id = created.json()["id"]
+
+    fetched = await client.get(f"/api/tasks/{task_id}", headers=auth_headers(maker_user))
+    body = fetched.json()
+    assert body["subtasks"] == [], "il task non ha ancora quote"
+    assert body["task_type"] == "measure", "e resta comunque un task di misura"
+
+
+async def test_unknown_type_is_rejected(client: AsyncClient, maker_user, db_session):
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-BAD")
+    await db_session.commit()
+
+    resp = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": "x", "task_type": "qualcosa"},
+    )
+    assert resp.status_code == 422
+
+
+async def test_type_can_be_changed(client: AsyncClient, maker_user, db_session):
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-CHG")
+    await db_session.commit()
+    created = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": "Nasce nota", "task_type": "note"},
+    )
+    task_id = created.json()["id"]
+
+    resp = await client.put(
+        f"/api/tasks/{task_id}",
+        headers=auth_headers(maker_user),
+        json={"task_type": "measure"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["task_type"] == "measure"
+
+
+async def test_type_survives_copy_on_write_versioning(
+    client: AsyncClient, maker_user, measurement_tec_user, db_session,
+):
+    """A new version must not silently reclassify every task of the recipe."""
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-COW")
+    await db_session.commit()
+
+    version = await _current_version(db_session, recipe.id)
+    row = await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )
+    first_task = row.scalars().first()
+
+    # Declare it a drawing. The point is that this survives, not how it got set.
+    await client.put(
+        f"/api/tasks/{first_task.id}",
+        headers=auth_headers(maker_user),
+        json={"task_type": "drawing"},
+    )
+
+    # Measure on the current version, which forces the next edit to copy-on-write.
+    await client.post(
+        "/api/measurements/",
+        headers=auth_headers(measurement_tec_user),
+        json={
+            "subtask_id": first_task.subtasks[0].id,
+            "version_id": version.id,
+            "value": 10.0,
+        },
+    )
+
+    # Editing now must create a new version.
+    await client.put(
+        f"/api/recipes/{recipe.id}",
+        headers=auth_headers(maker_user),
+        json={"name": "Rinominata"},
+    )
+
+    new_version = await _current_version(db_session, recipe.id)
+    assert new_version.id != version.id, "l'edit doveva creare una nuova versione"
+
+    copied = await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == new_version.id)
+    )
+    types = sorted(t.task_type for t in copied.scalars().all())
+    assert "drawing" in types, "il tipo dichiarato non e' sopravvissuto alla copia"
+
+
+async def test_task_list_exposes_the_type(client: AsyncClient, maker_user, db_session):
+    """The operator's task list reads the type, so it must come over the wire."""
+    recipe = await create_test_recipe(db_session, user_id=maker_user.id, code="REC-LST")
+    await db_session.commit()
+    await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={"title": "Misura", "task_type": "measure"},
+    )
+
+    resp = await client.get(
+        f"/api/recipes/{recipe.id}/tasks", headers=auth_headers(maker_user),
+    )
+    assert resp.status_code == 200
+    assert all("task_type" in t for t in resp.json())

src/backend/tests/test_tasks.py

@@ -189,7 +189,7 @@ class TestReorderTasks:
         """Maker can reorder tasks by providing task IDs in desired order."""
         recipe = await create_test_recipe(db_session, maker_user.id)
 
-        # Add a second task via copy-on-write
+        # Add a second task (no measurements → appended to current version)
         add_resp = await client.post(
             f"/api/recipes/{recipe.id}/tasks",
             headers=auth_headers(maker_user),
@@ -197,7 +197,11 @@ class TestReorderTasks:
         )
         assert add_resp.status_code == 201
 
-        # Get tasks from new version
+        # Force SQLA to re-fetch RecipeVersion.tasks: the shared test session
+        # caches the collection from create_test_recipe, so the GET below would
+        # otherwise return a stale list. In prod each request gets its own session.
+        db_session.expunge_all()
+
         tasks_resp = await client.get(
             f"/api/recipes/{recipe.id}/tasks",
             headers=auth_headers(maker_user),

src/backend/tests/test_vision_boundary.py

@@ -0,0 +1,106 @@
+"""Il server non importa VisionSuite, e questo lo verifica.
+
+Senza qualcuno che lo controlli, il confine si perde in silenzio: basta un
+import comodo perché l'immagine dell'API torni da cinque gigabyte e il motivo
+per cui il worker esiste svanisca senza che nessuna prova diventi rossa.
+"""
+import ast
+from pathlib import Path
+
+BACKEND = Path(__file__).resolve().parents[1]
+
+# Full dotted prefixes, not bare roots: "src" alone would forbid every import
+# the backend legitimately makes of itself (src.backend.*), so the entries
+# for the vision tree are multi-segment ("src.vision", "src.vision_worker")
+# while VisionSuite's own top-level packages stay single-segment.
+#
+# M2: "Acquire" used to sit here as a stand-in for vs-camera, but it is a
+# class/SDK name (Balluff's "mvIMPACT Acquire" SDK), never an import root -
+# it could never match. vs-camera imports under the same `visionsuite`
+# namespace as vs-core (see
+# vendor/visionsuite/packages/vs-camera/pyproject.toml: "il codice si importa
+# come visionsuite.camera...."), which "visionsuite" below already forbids,
+# so there is nothing separate to add for it.
+FORBIDDEN = {
+    "visionsuite", "pm2d", "dxf_compare", "torch",
+    "src.vision", "src.vision_worker",
+}
+
+
+def _imported_modules(source: Path) -> set[str]:
+    """Full dotted module paths this file imports - not just their first
+    segment. `from src.vision.runner import ...` must be checked against
+    "src.vision.runner" (inside the forbidden "src.vision"), not against
+    "src" alone, which is never forbidden since the backend imports itself
+    constantly.
+    """
+    tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+    modules: set[str] = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            modules.update(alias.name for alias in node.names)
+        elif isinstance(node, ast.ImportFrom) and node.module and node.level == 0:
+            modules.add(node.module)
+    return modules
+
+
+def _forbidden_hits(modules: set[str]) -> set[str]:
+    """Which FORBIDDEN entries a set of imported module paths triggers.
+
+    A module counts as forbidden if it equals a forbidden entry exactly, or
+    lives inside it ("src.vision.runner" is inside "src.vision").
+    """
+    hits: set[str] = set()
+    for module in modules:
+        for entry in FORBIDDEN:
+            if module == entry or module.startswith(entry + "."):
+                hits.add(entry)
+    return hits
+
+
+def test_the_server_never_imports_visionsuite():
+    offenders = []
+    for source in BACKEND.rglob("*.py"):
+        if "tests" in source.parts or "migrations" in source.parts:
+            continue
+        forbidden = _forbidden_hits(_imported_modules(source))
+        if forbidden:
+            offenders.append(f"{source.relative_to(BACKEND)}: {sorted(forbidden)}")
+
+    assert offenders == [], (
+        "il server deve restare cieco alla visione; usa il worker via HTTP:\n"
+        + "\n".join(offenders)
+    )
+
+
+def test_the_submodule_is_pinned():
+    """Server e stazione devono montare lo stesso commit: qui c'è la fonte."""
+    gitmodules = Path(__file__).resolve().parents[3] / ".gitmodules"
+    assert gitmodules.exists(), "vendor/visionsuite non è un sottomodulo"
+    assert "vendor/visionsuite" in gitmodules.read_text(encoding="utf-8")
+
+
+def test_a_full_module_path_import_is_caught_not_just_its_root(tmp_path):
+    """M2: `from src.vision.runner import ...` inside src/backend/** must be
+    caught. Checking only the first dotted segment ("src") would miss it -
+    "src" itself is never forbidden, the backend imports itself all the time.
+    This is the blind spot the reviewer found: same repository, no install
+    needed, the most tempting shortcut of all.
+    """
+    offender = tmp_path / "sneaky.py"
+    offender.write_text("from src.vision.runner import run_graph\n")
+    assert _forbidden_hits(_imported_modules(offender)) == {"src.vision"}
+
+
+def test_a_vision_worker_import_is_also_caught(tmp_path):
+    offender = tmp_path / "sneaky.py"
+    offender.write_text("import src.vision_worker.main\n")
+    assert _forbidden_hits(_imported_modules(offender)) == {"src.vision_worker"}
+
+
+def test_an_unrelated_src_backend_import_is_not_caught(tmp_path):
+    """The fix must not turn every self-import of the backend into an
+    offender - only the vision subtrees are forbidden."""
+    innocent = tmp_path / "innocent.py"
+    innocent.write_text("from src.backend.config import settings\n")
+    assert _forbidden_hits(_imported_modules(innocent)) == set()

src/backend/tests/test_vision_copy_on_write.py

@@ -0,0 +1,167 @@
+"""C1: the vision graph must survive copy-on-write, and creation must save it.
+
+The spec assumed versioning was free for `vision_json`/`vision_output` - "un
+campo in piu nella copia, non una logica nuova". `_copy_tasks_to_version`
+copies an explicit field list that omitted both fields, so the first edit to
+a recipe that already has measurements silently drops the camera graph from
+the new version. The creation paths (`POST /api/recipes/{id}/tasks` and
+`POST /api/tasks/{id}/subtasks`) have the same shape of bug: `TaskCreate` and
+`SubtaskCreate` declare the fields, but the routers never pass them to the
+ORM constructors, so the API answers 200 and silently does not store them.
+
+Each test file here reads on its own - the same idiom `test_vision_graph.py`
+and `test_recipes.py` already use.
+"""
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.user import User
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+async def _seed_measurement(db: AsyncSession, recipe_id: int, user_id: int) -> None:
+    """Give the current version a measurement, so an update takes the
+    copy-on-write path instead of updating in place."""
+    version_id = (await db.execute(
+        select(RecipeVersion.id).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    subtask_id = (await db.execute(
+        select(RecipeSubtask.id)
+        .join(RecipeSubtask.task)
+        .where(RecipeSubtask.task.has(version_id=version_id))
+    )).scalar_one()
+    db.add(Measurement(
+        subtask_id=subtask_id,
+        version_id=version_id,
+        measured_by=user_id,
+        value=10.0,
+        pass_fail="pass",
+        deviation=0.0,
+        input_method="manual",
+    ))
+    await db.flush()
+
+
+async def _current_task_and_subtask(db: AsyncSession, recipe_id: int):
+    version = (await db.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    subtask = (await db.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    return version, task, subtask
+
+
+@pytest.mark.asyncio
+async def test_copy_on_write_preserves_the_vision_graph(
+    client: AsyncClient, db_session: AsyncSession, maker_user: User,
+):
+    """A recipe edit that triggers copy-on-write must not drop the camera graph."""
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, subtask = await _current_task_and_subtask(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.flush()
+
+    # A measurement on v1 forces the next PUT onto the copy-on-write path.
+    await _seed_measurement(db_session, recipe.id, maker_user.id)
+    db_session.expunge_all()
+
+    resp = await client.put(
+        f"/api/recipes/{recipe.id}",
+        headers=auth_headers(maker_user),
+        json={"change_notes": "Edit that must not drop the graph"},
+    )
+    assert resp.status_code == 200
+    db_session.expunge_all()
+
+    version, new_task, new_subtask = await _current_task_and_subtask(db_session, recipe.id)
+    assert version.version_number == 2, "the edit should have created v2"
+    assert new_task.vision_json == {"schema_version": 1, "name": "p", "tools": []}
+    assert new_subtask.vision_output == "t1.diameter"
+
+
+@pytest.mark.asyncio
+async def test_creating_a_task_persists_its_vision_graph(
+    client: AsyncClient, db_session: AsyncSession, maker_user: User,
+):
+    """POST /api/recipes/{id}/tasks must store vision_json and vision_output,
+    not just accept and echo them back."""
+    recipe = await create_test_recipe(db_session, maker_user.id)
+
+    resp = await client.post(
+        f"/api/recipes/{recipe.id}/tasks",
+        headers=auth_headers(maker_user),
+        json={
+            "title": "Camera task",
+            "task_type": "camera_measure",
+            "vision_json": {"schema_version": 1, "name": "p", "tools": []},
+            "subtasks": [
+                {
+                    "marker_number": 1,
+                    "description": "Diameter",
+                    "nominal": 10.0,
+                    "vision_output": "t1.diameter",
+                }
+            ],
+        },
+    )
+    assert resp.status_code == 201
+    body = resp.json()
+    assert body["vision_json"] == {"schema_version": 1, "name": "p", "tools": []}
+    assert body["subtasks"][0]["vision_output"] == "t1.diameter"
+
+    # Reload from the database - the response reflects the ORM object right
+    # after flush, so this catches a constructor that dropped the field.
+    db_session.expunge_all()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.id == body["id"])
+    )).scalar_one()
+    sub = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().one()
+    assert task.vision_json == {"schema_version": 1, "name": "p", "tools": []}
+    assert sub.vision_output == "t1.diameter"
+
+
+@pytest.mark.asyncio
+async def test_creating_a_subtask_persists_its_vision_output(
+    client: AsyncClient, db_session: AsyncSession, maker_user: User,
+):
+    """POST /api/tasks/{id}/subtasks (the standalone endpoint) must also store it."""
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, _ = await _current_task_and_subtask(db_session, recipe.id)
+
+    resp = await client.post(
+        f"/api/tasks/{task.id}/subtasks",
+        headers=auth_headers(maker_user),
+        json={
+            "marker_number": 2,
+            "description": "Radius",
+            "nominal": 5.0,
+            "vision_output": "t1.radius",
+        },
+    )
+    assert resp.status_code == 201
+    assert resp.json()["vision_output"] == "t1.radius"
+
+    db_session.expunge_all()
+    sub = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.marker_number == 2)
+    )).scalar_one()
+    assert sub.vision_output == "t1.radius"

src/backend/tests/test_vision_execute.py

@@ -0,0 +1,329 @@
+"""A quote from a camera is a measurement like any other: same verdict, same gate."""
+import io
+
+import pytest
+from PIL import Image
+from sqlalchemy import select
+
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.vision import VisionResult
+from src.backend.services import measurement_service
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+GOOD = 10.0     # inside every limit of the fixture quote
+OUT = 99.0      # far outside
+
+
+def an_image() -> bytes:
+    buffer = io.BytesIO()
+    Image.new("L", (64, 64), color=0).save(buffer, format="PNG")
+    return buffer.getvalue()
+
+
+async def recipe_parts(db_session, recipe_id: int):
+    """`create_test_recipe` returns only the recipe: here it is broken apart."""
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    subtask = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    return version, task, subtask
+
+
+async def two_vision_quotes(db_session, recipe_id: int):
+    """The fixture recipe's task, with a second quote mapped to a vision output.
+
+    Same shape as `test_out_of_tolerance.py::_two_quotes`, adapted so both
+    quotes belong to a single camera acquisition instead of two separate
+    manual readings.
+    """
+    version, task, first = await recipe_parts(db_session, recipe_id)
+    first.vision_output = "t1.diameter"
+
+    second = RecipeSubtask(
+        task_id=task.id, marker_number=2, description="Second quote",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+        vision_output="t1.radius",
+    )
+    db_session.add(second)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    await db_session.commit()
+    await db_session.refresh(second)
+    return version, task, first, second
+
+
+@pytest.fixture
+def worker_says(monkeypatch):
+    """The worker does not run in tests: its response is faked here."""
+    def _install(outputs: dict, failures: list | None = None):
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
+            return {
+                "outputs": outputs,
+                "failures": failures or [],
+                "engine_version": "a" * 40,
+                "duration_ms": 12,
+            }
+        monkeypatch.setattr(
+            "src.backend.services.vision_service._call_worker", fake_call,
+        )
+    return _install
+
+
+@pytest.mark.asyncio
+async def test_a_camera_quote_becomes_a_measurement(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    # The fixture creates the quote with nominal 10 and tight limits around it.
+    await db_session.commit()
+    worker_says({"t1.diameter": float(subtask.nominal)})
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id), "lot_number": "L1"},
+    )
+
+    assert response.status_code == 200
+    saved = (await db_session.execute(
+        select(Measurement).where(Measurement.subtask_id == subtask.id)
+    )).scalars().all()
+    assert len(saved) == 1
+    assert saved[0].pass_fail == "pass"
+    assert saved[0].input_method == "camera"
+    assert saved[0].vision_result_id is not None
+
+
+@pytest.mark.asyncio
+async def test_the_execution_records_which_engine_produced_it(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.commit()
+    worker_says({"t1.diameter": float(subtask.nominal)})
+
+    await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id), "lot_number": "L1"},
+    )
+
+    result = (await db_session.execute(select(VisionResult))).scalars().one()
+    assert result.engine_version == "a" * 40
+    assert result.executed_on == "server"
+    assert result.graph_snapshot == task.vision_json
+
+
+@pytest.mark.asyncio
+async def test_a_missing_output_names_itself(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    """No half measurement: if an output is missing, the error names it."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.commit()
+    worker_says({"t1.radius": 5.0})
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id), "lot_number": "L1"},
+    )
+
+    assert response.status_code == 422
+    assert "t1.diameter" in response.json()["detail"]
+    assert (await db_session.execute(select(Measurement))).scalars().all() == []
+
+
+@pytest.mark.asyncio
+async def test_a_task_without_a_graph_is_refused(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    await db_session.commit()
+    worker_says({})
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 422
+    assert "graph" in response.json()["detail"].lower()
+
+
+# ---------------------------------------------------------------------------
+# Ruling R10: the gate is evaluated once per acquisition, not once per quote.
+# A camera acquisition produces every quote of the task at the same instant -
+# there is no "moving on" between them, so the sequential gate must not fire
+# inside the batch. It still has to fire between two separate acquisitions.
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_a_non_last_out_of_tolerance_quote_does_not_break_the_batch(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    """The quote evaluated first fails; the one after it must still be saved."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, first, second = await two_vision_quotes(db_session, recipe.id)
+    worker_says({"t1.diameter": OUT, "t1.radius": GOOD})
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 200
+    by_subtask = {
+        m.subtask_id: m.pass_fail
+        for m in (await db_session.execute(select(Measurement))).scalars().all()
+    }
+    assert by_subtask == {first.id: "fail", second.id: "pass"}
+
+
+@pytest.mark.asyncio
+async def test_a_pending_fail_outside_the_batch_still_blocks(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    """A fail left over from something else this camera task does not cover."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, first, second = await two_vision_quotes(db_session, recipe.id)
+
+    # A third quote on the same task, not part of this acquisition (no vision
+    # output), already failed and is waiting on a supervisor.
+    third = RecipeSubtask(
+        task_id=task.id, marker_number=3, description="Not a vision quote",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+    )
+    db_session.add(third)
+    await db_session.commit()
+    await db_session.refresh(third)
+    await measurement_service.save_measurement(
+        db_session, subtask_id=third.id, version_id=version.id,
+        measured_by=measurement_tec_user.id, value=OUT,
+    )
+    await db_session.commit()
+
+    worker_says({"t1.diameter": GOOD, "t1.radius": GOOD})
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 409
+    assert "supervisor" in response.json()["detail"].lower()
+    assert (await db_session.execute(
+        select(Measurement).where(Measurement.subtask_id.in_([first.id, second.id]))
+    )).scalars().all() == []
+
+
+@pytest.mark.asyncio
+async def test_a_pending_fail_blocks_before_the_worker_is_called(
+    client, db_session, measurement_tec_user, monkeypatch,
+):
+    """M3: a blocked operator must not burn a whole vision execution to learn
+    they are blocked. The gate is checked before the worker runs, not after."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, first, second = await two_vision_quotes(db_session, recipe.id)
+
+    third = RecipeSubtask(
+        task_id=task.id, marker_number=3, description="Not a vision quote",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+    )
+    db_session.add(third)
+    await db_session.commit()
+    await db_session.refresh(third)
+    await measurement_service.save_measurement(
+        db_session, subtask_id=third.id, version_id=version.id,
+        measured_by=measurement_tec_user.id, value=OUT,
+    )
+    await db_session.commit()
+
+    async def worker_must_not_be_called(image_bytes: bytes, graph: dict) -> dict:
+        raise AssertionError("the worker must not run while the operator is blocked")
+    monkeypatch.setattr(
+        "src.backend.services.vision_service._call_worker", worker_must_not_be_called,
+    )
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 409
+    assert "supervisor" in response.json()["detail"].lower()
+
+
+@pytest.mark.asyncio
+async def test_a_new_acquisition_can_remeasure_its_own_pending_quote(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    """Re-shooting the same task is the way out, same as re-measuring by hand."""
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, first, second = await two_vision_quotes(db_session, recipe.id)
+
+    worker_says({"t1.diameter": OUT, "t1.radius": GOOD})
+    first_shot = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p1.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+    assert first_shot.status_code == 200
+
+    # first.id is now pending authorisation - but it belongs to this same
+    # task, so a new acquisition of it is not "moving on".
+    worker_says({"t1.diameter": GOOD, "t1.radius": GOOD})
+    second_shot = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p2.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+    assert second_shot.status_code == 200
+
+    readings = (await db_session.execute(
+        select(Measurement)
+        .where(Measurement.subtask_id == first.id)
+        .order_by(Measurement.id)
+    )).scalars().all()
+    assert [m.pass_fail for m in readings] == ["fail", "pass"]
+
+    assert await measurement_service.pending_authorisation(
+        db_session, version.id, measurement_tec_user.id,
+    ) is None

src/backend/tests/test_vision_graph.py

@@ -0,0 +1,71 @@
+"""Il grafo di visione vive sul task, e la quota sa quale uscita la riempie."""
+import pytest
+from sqlalchemy import select
+
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import TASK_TYPES, RecipeSubtask, RecipeTask
+from src.backend.tests.conftest import create_test_recipe
+
+
+async def recipe_parts(db_session, recipe_id: int):
+    """`create_test_recipe` restituisce la sola ricetta: qui si scompone.
+
+    Versione corrente, il suo unico task, la sua prima quota. È l'idioma che
+    `test_out_of_tolerance.py` usa già, ripetuto perché ogni file di prova si
+    legge da solo.
+    """
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    subtask = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    return version, task, subtask
+
+
+@pytest.mark.asyncio
+async def test_task_carries_a_vision_graph(db_session, maker_user):
+    """Il grafo si salva e si rilegge identico: il server non lo interpreta."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="VIS-1")
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    graph = {
+        "schema_version": 1,
+        "name": "diametro del foro",
+        "tools": [{"id": "t1", "kind": "DetectCircle", "name": "foro"}],
+    }
+    task.vision_json = graph
+    task.task_type = "camera_measure"
+    await db_session.flush()
+    db_session.expunge_all()
+
+    reloaded = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.id == task.id)
+    )).scalar_one()
+    assert reloaded.vision_json == graph
+
+
+@pytest.mark.asyncio
+async def test_subtask_names_the_output_that_fills_it(db_session, maker_user):
+    """La quota dichiara quale uscita del grafo le compete."""
+    recipe = await create_test_recipe(db_session, maker_user.id, code="VIS-2")
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    subtask.vision_output = "t1.diameter"
+    await db_session.flush()
+    db_session.expunge_all()
+
+    reloaded = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.id == subtask.id)
+    )).scalar_one()
+    assert reloaded.vision_output == "t1.diameter"
+
+
+def test_the_typo_is_gone():
+    """`xf_compare` era un refuso: si corregge finché nessuna riga lo usa."""
+    assert "dxf_compare" in TASK_TYPES
+    assert "xf_compare" not in TASK_TYPES

src/backend/tests/test_vision_reference.py

@@ -0,0 +1,110 @@
+"""The Maker composes at a desk: image saved, graph tried, no measurement."""
+import io
+
+import pytest
+from PIL import Image
+from sqlalchemy import select
+
+from src.backend.config import settings
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.vision import VisionReferenceImage
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+def an_image() -> bytes:
+    buffer = io.BytesIO()
+    Image.new("L", (64, 64), color=0).save(buffer, format="PNG")
+    return buffer.getvalue()
+
+
+async def recipe_parts(db_session, recipe_id: int):
+    """`create_test_recipe` returns only the recipe: here it is broken apart."""
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    subtask = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    return version, task, subtask
+
+
+@pytest.fixture
+def worker_says(monkeypatch):
+    def _install(outputs: dict):
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
+            return {"outputs": outputs, "failures": [],
+                    "engine_version": "b" * 40, "duration_ms": 7}
+        monkeypatch.setattr(
+            "src.backend.services.vision_service._call_worker", fake_call,
+        )
+    return _install
+
+
+@pytest.fixture(autouse=True)
+def redirect_uploads(monkeypatch, tmp_path):
+    """Keep reference images out of the real repo tree during tests.
+
+    `settings.upload_path` is `parents[2] / self.upload_dir`, and pathlib
+    replaces the left operand of `/` when the right one is absolute - so
+    redirecting the bare `upload_dir` setting to pytest's absolute `tmp_path`
+    is enough to redirect the resolved path too.
+    """
+    monkeypatch.setattr(settings, "upload_dir", str(tmp_path))
+
+
+@pytest.mark.asyncio
+async def test_a_reference_image_keeps_its_provenance(
+    client, db_session, maker_user,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+
+    response = await client.post(
+        "/api/vision/reference-images",
+        headers=auth_headers(maker_user),
+        files={"image": ("ref.png", an_image(), "image/png")},
+        data={"task_id": str(task.id), "note": "sample part"},
+    )
+
+    assert response.status_code == 200
+    saved = (await db_session.execute(
+        select(VisionReferenceImage)
+    )).scalars().one()
+    assert saved.task_id == task.id
+    assert saved.note == "sample part"
+    assert saved.acquired_at is not None
+    assert saved.path
+
+
+@pytest.mark.asyncio
+async def test_preview_runs_the_graph_and_saves_no_measurement(
+    client, db_session, maker_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.commit()
+    worker_says({"t1.diameter": 42.0})
+
+    response = await client.post(
+        "/api/vision/preview",
+        headers=auth_headers(maker_user),
+        files={"image": ("ref.png", an_image(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["outputs"]["t1.diameter"] == 42.0
+    # This is the whole point of this test: composing does not measure.
+    assert (await db_session.execute(select(Measurement))).scalars().all() == []

src/backend/tests/test_vision_upload_limits.py

@@ -0,0 +1,190 @@
+"""I3: the three vision endpoints must not accept an unbounded or wrong-typed
+upload. `/execute`, `/preview` and `/reference-images` read the whole image
+into memory with no size cap, and `/reference-images` wrote whatever arrived
+to disk with a `.png` extension regardless of its real type - a PDF is not
+something a vision graph can measure.
+
+Reuses the project's existing convention (`validate_file_size`,
+`ALLOWED_IMAGE_TYPES` from `files.py`) instead of inventing a second one.
+"""
+import io
+
+import pytest
+from PIL import Image
+from sqlalchemy import select
+
+from src.backend.config import settings
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.vision import VisionReferenceImage, VisionResult
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+@pytest.fixture(autouse=True)
+def redirect_uploads(monkeypatch, tmp_path):
+    """Keep the reference image this file stores out of the real repo tree.
+
+    The same guard `test_vision_reference.py` carries: without it, the test that
+    proves a jpeg is stored with its own extension leaves a real file under
+    `uploads/vision/reference/`, so every suite run dirties the working tree.
+
+    `settings.upload_path` is `parents[2] / self.upload_dir`, and pathlib
+    replaces the left operand of `/` when the right one is absolute - so
+    redirecting the bare `upload_dir` setting is enough to redirect the
+    resolved path too.
+    """
+    monkeypatch.setattr(settings, "upload_dir", str(tmp_path))
+
+
+def a_png() -> bytes:
+    buffer = io.BytesIO()
+    Image.new("L", (64, 64), color=0).save(buffer, format="PNG")
+    return buffer.getvalue()
+
+
+def a_jpeg() -> bytes:
+    buffer = io.BytesIO()
+    Image.new("RGB", (64, 64), color=0).save(buffer, format="JPEG")
+    return buffer.getvalue()
+
+
+async def recipe_parts(db_session, recipe_id: int):
+    """`create_test_recipe` returns only the recipe: here it is broken apart."""
+    version = (await db_session.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe_id,
+            RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db_session.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    subtask = (await db_session.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    return version, task, subtask
+
+
+@pytest.fixture
+def worker_says(monkeypatch):
+    def _install(outputs: dict):
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
+            return {"outputs": outputs, "failures": [],
+                    "engine_version": "c" * 40, "duration_ms": 5}
+        monkeypatch.setattr(
+            "src.backend.services.vision_service._call_worker", fake_call,
+        )
+    return _install
+
+
+@pytest.mark.asyncio
+async def test_execute_rejects_a_non_image_upload(
+    client, db_session, measurement_tec_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.commit()
+    worker_says({"t1.diameter": float(subtask.nominal)})
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.pdf", b"%PDF-1.4 not an image", "application/pdf")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 400
+    assert (await db_session.execute(select(VisionResult))).scalars().all() == []
+    assert (await db_session.execute(select(Measurement))).scalars().all() == []
+
+
+@pytest.mark.asyncio
+async def test_execute_rejects_an_oversized_upload(
+    client, db_session, measurement_tec_user, worker_says, monkeypatch,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    subtask.vision_output = "t1.diameter"
+    await db_session.commit()
+    worker_says({"t1.diameter": float(subtask.nominal)})
+    monkeypatch.setattr(settings, "max_upload_size_mb", 0)
+
+    response = await client.post(
+        "/api/vision/execute",
+        headers=auth_headers(measurement_tec_user),
+        files={"image": ("p.png", a_png(), "image/png")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 400
+    assert (await db_session.execute(select(VisionResult))).scalars().all() == []
+
+
+@pytest.mark.asyncio
+async def test_preview_rejects_a_non_image_upload(
+    client, db_session, maker_user, worker_says,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    task.task_type = "camera_measure"
+    task.vision_json = {"schema_version": 1, "name": "p", "tools": []}
+    await db_session.commit()
+    worker_says({"t1.diameter": 10.0})
+
+    response = await client.post(
+        "/api/vision/preview",
+        headers=auth_headers(maker_user),
+        files={"image": ("p.pdf", b"%PDF-1.4 not an image", "application/pdf")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_reference_images_rejects_a_non_image_upload(
+    client, db_session, maker_user,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, _ = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+
+    response = await client.post(
+        "/api/vision/reference-images",
+        headers=auth_headers(maker_user),
+        files={"image": ("p.pdf", b"%PDF-1.4 not an image", "application/pdf")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 400
+    assert (await db_session.execute(
+        select(VisionReferenceImage)
+    )).scalars().all() == []
+
+
+@pytest.mark.asyncio
+async def test_reference_image_keeps_the_extension_matching_its_real_type(
+    client, db_session, maker_user,
+):
+    """A jpeg upload must not be written to disk as `<uuid>.png`."""
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, _ = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+
+    response = await client.post(
+        "/api/vision/reference-images",
+        headers=auth_headers(maker_user),
+        files={"image": ("p.jpg", a_jpeg(), "image/jpeg")},
+        data={"task_id": str(task.id)},
+    )
+
+    assert response.status_code == 200
+    saved = (await db_session.execute(select(VisionReferenceImage))).scalars().one()
+    assert saved.path.endswith(".jpg")
+    assert (settings.upload_path / saved.path).exists()

src/backend/tests/test_vision_worker_transport.py

@@ -0,0 +1,117 @@
+"""I2: a broken worker must answer with a named status, never a naked 500.
+
+`_call_worker` mapped a non-200 HTTP response to 502, but let
+`httpx.ConnectError` (worker stopped) and `httpx.ReadTimeout` (job past the
+120s budget) propagate unhandled - with no exception handler in main.py that
+turns those into anything but FastAPI's generic 500. It also read
+`report["outputs"]`, `report["failures"]` and `report["engine_version"]`
+without checking the response had that shape at all, so a proxy answering 200
+with something else (HTML, an empty body) would raise a bare KeyError instead
+of a diagnosable error.
+
+The spec's edge-case table: "il worker isola il guasto, l'API resta in
+piedi, il task riporta l'errore" - the worker's fault must not become the
+API's fault.
+"""
+import httpx
+import pytest
+from fastapi import HTTPException
+
+from src.backend.services.vision_service import _call_worker
+
+
+class _FakeResponse:
+    """Stands in for httpx.Response: only what `_call_worker` touches."""
+
+    def __init__(self, status_code: int, body=..., text: str = "", raise_on_json: bool = False):
+        self.status_code = status_code
+        self._body = body
+        self.text = text
+        self._raise_on_json = raise_on_json
+
+    def json(self):
+        if self._raise_on_json:
+            raise ValueError("not JSON")
+        return self._body
+
+
+class _FakeAsyncClient:
+    """Stands in for httpx.AsyncClient: post() does whatever the test wants."""
+
+    def __init__(self, *, response=None, raises=None):
+        self._response = response
+        self._raises = raises
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *exc_info):
+        return False
+
+    async def post(self, *args, **kwargs):
+        if self._raises is not None:
+            raise self._raises
+        return self._response
+
+
+def _install(monkeypatch, *, response=None, raises=None):
+    monkeypatch.setattr(
+        "src.backend.services.vision_service.httpx.AsyncClient",
+        lambda *a, **k: _FakeAsyncClient(response=response, raises=raises),
+    )
+
+
+@pytest.mark.asyncio
+async def test_a_stopped_worker_answers_502_not_a_naked_500(monkeypatch):
+    _install(monkeypatch, raises=httpx.ConnectError("Connection refused"))
+
+    with pytest.raises(HTTPException) as excinfo:
+        await _call_worker(b"img", {"schema_version": 1, "tools": []})
+
+    assert excinfo.value.status_code == 502
+    assert "unreachable" in excinfo.value.detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_a_job_past_the_time_budget_answers_504(monkeypatch):
+    _install(monkeypatch, raises=httpx.ReadTimeout("timed out"))
+
+    with pytest.raises(HTTPException) as excinfo:
+        await _call_worker(b"img", {"schema_version": 1, "tools": []})
+
+    assert excinfo.value.status_code == 504
+    assert "time" in excinfo.value.detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_a_response_missing_the_expected_keys_is_reported_not_raised_raw(monkeypatch):
+    """A proxy answering 200 with an unexpected shape must not KeyError."""
+    _install(monkeypatch, response=_FakeResponse(200, body={"outputs": {}}))
+
+    with pytest.raises(HTTPException) as excinfo:
+        await _call_worker(b"img", {"schema_version": 1, "tools": []})
+
+    assert excinfo.value.status_code == 502
+    assert "malformed" in excinfo.value.detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_a_response_that_is_not_a_json_object_is_reported(monkeypatch):
+    """200 with HTML or a bare list, say - not a dict at all."""
+    _install(monkeypatch, response=_FakeResponse(200, body=["not", "a", "dict"]))
+
+    with pytest.raises(HTTPException) as excinfo:
+        await _call_worker(b"img", {"schema_version": 1, "tools": []})
+
+    assert excinfo.value.status_code == 502
+    assert "malformed" in excinfo.value.detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_a_well_formed_response_still_passes_through(monkeypatch):
+    body = {"outputs": {"t1.diameter": 10.0}, "failures": [], "engine_version": "a" * 40}
+    _install(monkeypatch, response=_FakeResponse(200, body=body))
+
+    report = await _call_worker(b"img", {"schema_version": 1, "tools": []})
+
+    assert report == body

src/frontend/flask_app/Dockerfile.legacy

@@ -1,33 +0,0 @@
-FROM python:3.11-slim AS base
-
-# Installa Node.js per Tailwind CSS build
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y --no-install-recommends nodejs \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt gunicorn
-
-COPY . .
-
-# Install and build Tailwind CSS
-RUN npm install tailwindcss@3 && npx tailwindcss -i static/css/input.css -o static/css/tailwind.css --minify
-
-# Compile Flask-Babel translations
-RUN pybabel compile -d translations
-
-EXPOSE 5000
-
-CMD ["gunicorn", \
-     "--workers", "5", \
-     "--threads", "4", \
-     "--worker-class", "gthread", \
-     "--timeout", "60", \
-     "--bind", "0.0.0.0:5000", \
-     "--access-logfile", "-", \
-     "--forwarded-allow-ips", "*", \
-     "app:create_app()"]

src/frontend/flask_app/app.py

@@ -1,15 +1,44 @@
 """TieMeasureFlow Client - Flask Entry Point."""
 import json
 import os
+import re
+from datetime import date
+from urllib.parse import urlparse
 
 from flask import Flask, redirect, url_for, session, request
 from flask_babel import Babel
 from flask_wtf.csrf import CSRFProtect
-from markupsafe import Markup
+from markupsafe import Markup, escape
 from werkzeug.middleware.proxy_fix import ProxyFix
 
 from config import Config
 
+# **bold**, the whole of the markup a task description understands besides the
+# line break. DOTALL so a phrase that wraps onto the next line still closes.
+_BOLD_RX = re.compile(r"\*\*(.+?)\*\*", re.DOTALL)
+
+# Punto 12. Nothing loads from outside: every library ships with the install
+# (static/vendor/), because the shop floor network has no way out and a page that
+# waits for a CDN there is a white screen, not a slow one.
+#
+#   unsafe-inline   the templates carry their Alpine components inline
+#   unsafe-eval     Alpine 3 and Plotly both compile expressions at runtime
+#   blob:           PDF.js runs its worker from a blob, Fabric exports canvases
+#   data:           thumbnails and canvas exports are inlined
+CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+    "style-src 'self' 'unsafe-inline'; "
+    "font-src 'self'; "
+    "img-src 'self' data: blob:; "
+    "connect-src 'self'; "
+    "worker-src 'self' blob:; "
+    "object-src 'none'; "
+    "base-uri 'self'; "
+    "form-action 'self'; "
+    "frame-ancestors 'none'"
+)
+
 
 def get_locale():
     """Get user's preferred language from session or Accept-Language header."""
@@ -63,7 +92,32 @@ def create_app() -> Flask:
         """Set user's preferred language and store in session."""
         if lang in Config.LANGUAGES:
             session["language"] = lang
-        return redirect(request.referrer or url_for("auth.login"))
+        # Only follow the referrer if it points back to this host
+        # (prevents open redirect via a forged Referer header).
+        referrer = request.referrer
+        if referrer:
+            parsed = urlparse(referrer)
+            if parsed.netloc and parsed.netloc != request.host:
+                referrer = None
+        return redirect(referrer or url_for("auth.login"))
+
+    @app.template_filter("rich_text")
+    def rich_text_filter(value):
+        """Render a task description keeping its line breaks and its bold.
+
+        Whoever writes a recipe pastes from the PDF of the technical sheet, and the
+        text used to arrive flattened. Two conventions carry it: a blank line is a
+        line break, **like this** is bold.
+
+        No HTML is ever stored or trusted - the text is escaped first and the only
+        tags in the result are the ones produced here. That is the sanitisation:
+        there is nothing to sanitise, because nothing is accepted.
+        """
+        if not value:
+            return Markup("")
+        escaped = str(escape(str(value)))
+        bolded = _BOLD_RX.sub(r"<strong>\1</strong>", escaped)
+        return Markup(bolded.replace("\n", "<br>"))
 
     @app.template_filter("tojson_attr")
     def tojson_attr_filter(value):
@@ -83,6 +137,25 @@ def create_app() -> Flask:
         )
         return Markup(rv)
 
+    @app.after_request
+    def security_headers(response):
+        """Same-origin only, on the pages the browser actually loads.
+
+        The policy existed on the backend, which serves the API; the HTML comes
+        from here and carried no policy at all. So the rule that says «nothing
+        from outside» was written where it could not be broken and absent where
+        it could.
+
+        It is also the guard that makes point 12 stay done: a CDN tag added to a
+        template months from now is refused by the browser here, at a desk with a
+        network, instead of on a shop floor that has none.
+        """
+        response.headers.setdefault("Content-Security-Policy", CSP)
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+        response.headers.setdefault("X-Frame-Options", "DENY")
+        response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+        return response
+
     @app.context_processor
     def inject_globals():
         """Inject global variables into all templates."""
@@ -92,6 +165,8 @@ def create_app() -> Flask:
             "current_language": get_locale(),
             "languages": Config.LANGUAGES,
             "company_logo": session.get("company_logo"),
+            "auto_logout_minutes": session.get("auto_logout_minutes"),
+            "current_year": date.today().year,
         }
 
     return app

src/frontend/flask_app/blueprints/admin.py

@@ -43,6 +43,28 @@ def user_list():
     return render_template("admin/users.html", users=users)
 
 
+@admin_bp.route("/settings")
+@login_required
+@admin_required
+def settings_page():
+    """System settings page."""
+    resp = api_client.get("/api/settings")
+    settings = resp if not isinstance(resp, dict) or not resp.get("error") else {}
+    return render_template("admin/settings.html", settings=settings)
+
+
+@admin_bp.route("/api/settings", methods=["PUT"])
+@login_required
+@admin_required
+def api_update_settings():
+    """Proxy: Update system settings."""
+    data = request.get_json(silent=True) or {}
+    resp = api_client.put("/api/settings", data=data)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
 @admin_bp.route("/stations")
 @login_required
 @admin_required
@@ -198,3 +220,14 @@ def api_unassign_recipe(station_id: int, recipe_id: int):
     if isinstance(resp, dict) and resp.get("error"):
         return jsonify(resp), resp.get("status_code", 500)
     return jsonify({"deleted": True}), 200
+
+
+@admin_bp.route("/api/stations/<int:station_id>/recipes", methods=["DELETE"])
+@login_required
+@admin_required
+def api_reset_station_recipes(station_id: int):
+    """Proxy: Clear every recipe assignment of a station."""
+    resp = api_client.delete(f"/api/stations/{station_id}/recipes")
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200

src/frontend/flask_app/blueprints/auth.py

@@ -1,7 +1,7 @@
 """Authentication blueprint - login, logout, profile."""
 from functools import wraps
 
-from flask import Blueprint, abort, flash, redirect, render_template, request, session, url_for
+from flask import Blueprint, abort, flash, jsonify, redirect, render_template, request, session, url_for
 from flask_babel import gettext as _
 
 from services.api_client import api_client
@@ -39,15 +39,32 @@ def role_required(*roles):
     return decorator
 
 
+def _post_login_landing():
+    """Pick the landing endpoint based on the logged-in user's roles.
+
+    A Maker-only user must not be bounced to /measure (MeasurementTec-only),
+    which would raise a 403 right after login. Order of preference follows the
+    primary operator flow first, then editing, analysis, admin.
+    """
+    user = session.get("user", {})
+    roles = user.get("roles", [])
+    if "MeasurementTec" in roles:
+        return url_for("measure.select_recipe")
+    if "Maker" in roles:
+        return url_for("maker.recipe_list")
+    if "Metrologist" in roles:
+        return url_for("statistics.dashboard")
+    if user.get("is_admin"):
+        return url_for("admin.user_list")
+    return url_for("auth.profile")
+
+
 @auth_bp.route("/login", methods=["GET", "POST"])
 def login():
     """Login page and form handler."""
-    # Se già loggato, redirect a home
+    # Se già loggato, redirect alla home in base al ruolo
     if session.get("api_key"):
-        try:
-            return redirect(url_for("measure.select_recipe"))
-        except Exception:
-            return redirect(url_for("auth.profile"))
+        return redirect(_post_login_landing())
 
     if request.method == "POST":
         username = request.form.get("username", "").strip()
@@ -76,20 +93,23 @@ def login():
             if user.get("theme_pref"):
                 session["theme"] = user["theme_pref"]
 
-            # Carica logo aziendale dalle impostazioni di sistema
+            # Carica impostazioni di sistema
             settings_resp = api_client.get("/api/settings")
             if not settings_resp.get("error"):
                 logo_path = settings_resp.get("company_logo_path")
                 if logo_path:
                     session["company_logo"] = logo_path
+                auto_logout = settings_resp.get("auto_logout_minutes")
+                if auto_logout:
+                    try:
+                        session["auto_logout_minutes"] = int(auto_logout)
+                    except (ValueError, TypeError):
+                        pass
 
             flash(_("Benvenuto, %(name)s!", name=user.get("display_name", username)), "success")
 
-            # Redirect dopo login
-            try:
-                return redirect(url_for("measure.select_recipe"))
-            except Exception:
-                return redirect(url_for("auth.profile"))
+            # Redirect dopo login (in base al ruolo)
+            return redirect(_post_login_landing())
 
         except Exception as e:
             flash(_("Errore di connessione al server: %(error)s", error=str(e)), "error")
@@ -113,6 +133,27 @@ def logout():
     return redirect(url_for("auth.login"))
 
 
+@auth_bp.route("/set-theme", methods=["POST"])
+@login_required
+def set_theme():
+    """Persist the user's theme toggle (light/dark) to session and profile.
+
+    Called via AJAX from the navbar theme switch so the choice survives
+    navigation and matches on the next login. Best-effort on the API side:
+    the session is updated regardless so the current browsing stays correct.
+    """
+    theme = (request.get_json(silent=True) or {}).get("theme", "")
+    if theme not in ("light", "dark"):
+        return jsonify({"error": True, "detail": "invalid theme"}), 400
+
+    session["theme"] = theme
+    try:
+        api_client.put("/api/auth/me", data={"theme_pref": theme})
+    except Exception:
+        pass  # Non-fatal: session theme is already updated for this session.
+    return jsonify({"ok": True, "theme": theme})
+
+
 @auth_bp.route("/profile", methods=["GET", "POST"])
 @login_required
 def profile():

src/frontend/flask_app/blueprints/maker.py

@@ -1,12 +1,13 @@
 """Maker blueprint - recipe creation and editing."""
 import requests as http_requests
 
-from flask import Blueprint, Response, flash, jsonify, redirect, render_template, request, session, url_for
+from flask import Blueprint, flash, jsonify, redirect, render_template, request, session, url_for
 from flask_babel import gettext as _
 
 from blueprints.auth import login_required, role_required
 from config import Config
 from services.api_client import api_client
+from services.file_proxy import proxy_file
 
 maker_bp = Blueprint("maker", __name__, url_prefix="/maker")
 
@@ -380,19 +381,7 @@ def api_upload_file():
 @login_required
 def api_get_file(file_path: str):
     """Proxy: Serve file from API server (browser can't send X-API-Key)."""
-    api_key = session.get("api_key", "")
-    base_url = Config.API_SERVER_URL.rstrip("/")
-    resp = http_requests.get(
-        f"{base_url}/api/files/{file_path}",
-        headers={"X-API-Key": api_key},
-        timeout=30,
-    )
-    if resp.status_code != 200:
-        return Response(resp.text, status=resp.status_code)
-    return Response(
-        resp.content,
-        content_type=resp.headers.get("content-type", "application/octet-stream"),
-    )
+    return proxy_file(file_path)
 
 
 @maker_bp.route("/api/files/<path:file_path>", methods=["DELETE"])
@@ -424,3 +413,31 @@ def api_get_measurement_count(recipe_id: int, version_number: int):
         return jsonify(resp), resp.get("status_code", 500)
 
     return jsonify(resp), 200
+
+
+@maker_bp.route("/api/recipes/<int:recipe_id>/parse-technical-sheet", methods=["POST"])
+@login_required
+@role_required("Maker")
+def api_parse_technical_sheet(recipe_id: int):
+    """Proxy: Parse PDF technical sheet with AI."""
+    file = request.files.get("file")
+    if not file:
+        return jsonify({"error": True, "detail": "Nessun file caricato"}), 400
+
+    api_key = session.get("api_key", "")
+    base_url = Config.API_SERVER_URL.rstrip("/")
+    resp = http_requests.post(
+        f"{base_url}/api/recipes/{recipe_id}/parse-technical-sheet",
+        headers={"X-API-Key": api_key},
+        files={"file": (file.filename, file.stream, file.content_type)},
+        timeout=90,
+    )
+
+    try:
+        payload = resp.json()
+    except ValueError:
+        payload = {
+            "error": True,
+            "detail": resp.text or f"HTTP {resp.status_code}",
+        }
+    return jsonify(payload), resp.status_code

src/frontend/flask_app/blueprints/measure.py

@@ -1,8 +1,6 @@
 """MeasurementTec blueprint - recipe selection and measurement execution."""
-import requests as http_requests
-
 from flask import (
-    Blueprint, Response, flash, jsonify, redirect, render_template,
+    Blueprint, flash, jsonify, redirect, render_template,
     request, session, url_for,
 )
 from flask_babel import gettext as _
@@ -10,9 +8,65 @@ from flask_babel import gettext as _
 from blueprints.auth import login_required, role_required
 from config import Config
 from services.api_client import api_client
+from services.file_proxy import proxy_file
 
 measure_bp = Blueprint("measure", __name__)
 
+# Session key holding a station chosen at runtime, overriding Config.STATION_CODE.
+STATION_OVERRIDE_KEY = "station_override"
+
+
+def _current_station() -> tuple[str | None, bool]:
+    """Return the station this client acts as, and whether it is an override."""
+    override = session.get(STATION_OVERRIDE_KEY)
+    if override:
+        return override, True
+    return Config.STATION_CODE, False
+
+
+def _apply_station_switch() -> None:
+    """Honour ?station=CODE, used to exercise several stations from one PC.
+
+    Only active when STATION_SWITCH_ENABLED is set: in production the station
+    identity comes from the local install, and silently measuring against another
+    station's recipes would break traceability. An empty value clears the override
+    and falls back to the configured station.
+
+    The requested code is validated against the server before being stored, so a
+    typo leaves the operator on the current station with an explanation rather
+    than stranded on a station that does not exist.
+    """
+    if "station" not in request.args:
+        return
+
+    requested = (request.args.get("station") or "").strip().upper()
+
+    if not Config.STATION_SWITCH_ENABLED:
+        flash(_("Il cambio stazione da URL non è abilitato su questa postazione."), "error")
+        return
+
+    if not requested:
+        if session.pop(STATION_OVERRIDE_KEY, None):
+            flash(_("Stazione riportata a quella configurata."), "info")
+        return
+
+    try:
+        probe = api_client.get_station_recipes(requested)
+    except Exception:
+        flash(_("Impossibile contattare il server per cambiare stazione."), "error")
+        return
+
+    if isinstance(probe, dict) and probe.get("error"):
+        flash(
+            _("Stazione '%(code)s' inesistente o disattivata: stazione invariata.",
+              code=requested),
+            "error",
+        )
+        return
+
+    session[STATION_OVERRIDE_KEY] = requested
+    flash(_("Stazione corrente: %(code)s", code=requested), "info")
+
 
 # ---------------------------------------------------------------------------
 # Route: Recipe selection
@@ -22,13 +76,16 @@ measure_bp = Blueprint("measure", __name__)
 @role_required("MeasurementTec")
 def select_recipe():
     """Recipe selection page with search and barcode support."""
-    # Fail-fast if STATION_CODE is not configured
-    if not Config.STATION_CODE:
+    _apply_station_switch()
+    station_code, station_overridden = _current_station()
+
+    # Fail-fast if no station is configured and none was chosen
+    if not station_code:
         return render_template("errors/station_not_configured.html"), 503
 
     # Load recipes filtered by station
     try:
-        resp = api_client.get_station_recipes(Config.STATION_CODE)
+        resp = api_client.get_station_recipes(station_code)
     except Exception as e:
         return render_template(
             "errors/station_not_configured.html", error=str(e),
@@ -53,13 +110,121 @@ def select_recipe():
     return render_template(
         "measure/select_recipe.html",
         recipes=recipes,
-        station_code=Config.STATION_CODE,
+        station_code=station_code,
+        station_overridden=station_overridden,
+        station_configured=Config.STATION_CODE,
         auto_recipe_code=auto_recipe_code,
         auto_lot=auto_lot,
         auto_serial=auto_serial,
     )
 
 
+def _remember_traceability() -> tuple[str, str]:
+    """Carry lot and serial from the query string into the session."""
+    lot_number = request.args.get("lot_number", session.get("lot_number", ""))
+    serial_number = request.args.get(
+        "serial_number", session.get("serial_number", ""),
+    )
+    if lot_number:
+        session["lot_number"] = lot_number
+    if serial_number:
+        session["serial_number"] = serial_number
+    return lot_number, serial_number
+
+
+def _missing_traceability(recipe: dict, lot: str, serial: str) -> list[str]:
+    """The compulsory fields this recipe is still owed."""
+    missing = []
+    if recipe.get("requires_lot") and not (lot or "").strip():
+        missing.append(_("lotto"))
+    if recipe.get("requires_serial") and not (serial or "").strip():
+        missing.append(_("seriale"))
+    return missing
+
+
+def _ordered_tasks(recipe_id: int) -> list[dict] | None:
+    """Tasks of a recipe's current version in execution order, or None on error."""
+    resp = api_client.get(f"/api/recipes/{recipe_id}/tasks")
+    if isinstance(resp, dict) and resp.get("error"):
+        return None
+    tasks = resp if isinstance(resp, list) else resp.get("items", [])
+    return sorted(tasks, key=lambda t: (t.get("order_index", 0), t.get("id", 0)))
+
+
+def _task_progress(version_id, run_id) -> dict[int, dict]:
+    """Quotes already taken per measurement task, keyed by task id.
+
+    Never fatal: a list that cannot say which task was left half done is still a
+    usable list, and losing the whole page over a badge would be the worse trade.
+    """
+    if not version_id:
+        return {}
+    params = {"version_id": version_id}
+    if run_id:
+        params["production_run_id"] = run_id
+    resp = api_client.get("/api/measurements/task-progress", params=params)
+    if not isinstance(resp, dict) or resp.get("error"):
+        return {}
+    return {row["task_id"]: row for row in resp.get("tasks", [])}
+
+
+def _current_run_id() -> int | None:
+    """The production open at this station, if there is one."""
+    station_code, _overridden = _current_station()
+    if not station_code:
+        return None
+    # The endpoint answers with the run itself, or null when nothing is running.
+    resp = api_client.get(
+        "/api/production-runs/current", params={"station_code": station_code},
+    )
+    if not isinstance(resp, dict) or resp.get("error"):
+        return None
+    return resp.get("id")
+
+
+# ---------------------------------------------------------------------------
+# Route: start the guided sequence
+# ---------------------------------------------------------------------------
+@measure_bp.route("/start/<int:recipe_id>")
+@login_required
+@role_required("MeasurementTec")
+def start_sequence(recipe_id: int):
+    """Open the first task of a recipe and let the operator walk the sequence.
+
+    Choosing a recipe used to land on the full task list, which asked the operator
+    to pick a starting point before they had done anything. The sequence is the
+    normal way through; the list is still there, one level down, for when they need
+    to see the whole of it.
+    """
+    lot_number, serial_number = _remember_traceability()
+
+    recipe_resp = api_client.get(f"/api/recipes/{recipe_id}")
+    if recipe_resp.get("error"):
+        flash(
+            _("Ricetta non trovata: %(detail)s",
+              detail=recipe_resp.get("detail", "")),
+            "error",
+        )
+        return redirect(url_for("measure.select_recipe"))
+
+    missing = _missing_traceability(recipe_resp, lot_number, serial_number)
+    if missing:
+        flash(
+            _("Compila prima: %(fields)s", fields=", ".join(missing)),
+            "error",
+        )
+        return redirect(url_for(
+            "measure.select_recipe", recipe=recipe_resp.get("code", ""),
+        ))
+
+    tasks = _ordered_tasks(recipe_id)
+    if not tasks:
+        flash(_("Questa ricetta non ha ancora task definiti."), "error")
+        return redirect(url_for("measure.task_list", recipe_id=recipe_id))
+
+    return redirect(url_for("measure.task_execute", task_id=tasks[0]["id"]))
+
+
 # ---------------------------------------------------------------------------
 # Route: Task list for a recipe
 # ---------------------------------------------------------------------------
@@ -68,17 +233,7 @@ def select_recipe():
 @role_required("MeasurementTec")
 def task_list(recipe_id: int):
     """Task list for selected recipe."""
-    # Persist lot/serial from query params into session
-    lot_number = request.args.get(
-        "lot_number", session.get("lot_number", ""),
-    )
-    serial_number = request.args.get(
-        "serial_number", session.get("serial_number", ""),
-    )
-    if lot_number:
-        session["lot_number"] = lot_number
-    if serial_number:
-        session["serial_number"] = serial_number
+    lot_number, serial_number = _remember_traceability()
 
     # Load recipe details
     recipe_resp = api_client.get(f"/api/recipes/{recipe_id}")
@@ -90,22 +245,19 @@ def task_list(recipe_id: int):
         )
         return redirect(url_for("measure.select_recipe"))
 
-    # Load tasks for this recipe
-    tasks_resp = api_client.get(f"/api/recipes/{recipe_id}/tasks")
-    if isinstance(tasks_resp, dict) and tasks_resp.get("error"):
-        flash(
-            _("Errore nel caricamento dei task: %(detail)s",
-              detail=tasks_resp.get("detail", "")),
-            "error",
-        )
+    tasks = _ordered_tasks(recipe_id)
+    if tasks is None:
+        flash(_("Errore nel caricamento dei task."), "error")
         tasks = []
-    else:
-        tasks = tasks_resp if isinstance(tasks_resp, list) else tasks_resp.get("items", [])
+
+    version = recipe_resp.get("current_version") or {}
+    progress = _task_progress(version.get("id"), _current_run_id())
 
     return render_template(
         "measure/task_list.html",
         recipe=recipe_resp,
         tasks=tasks,
+        progress=progress,
         lot_number=lot_number,
         serial_number=serial_number,
     )
@@ -135,11 +287,19 @@ def task_execute(task_id: int):
     # Load all task IDs for this recipe (ordered) for auto-advance
     recipe_id = task_resp.get("recipe_id")
     all_task_ids = []
+    measurement_interval_minutes = None
+    # Allowed until the recipe says otherwise: a recipe that could not be read must
+    # not silently take the keypad away from the operator.
+    allow_manual_input = True
     if recipe_id:
         tasks_resp = api_client.get(f"/api/recipes/{recipe_id}/tasks")
         if isinstance(tasks_resp, list):
             sorted_tasks = sorted(tasks_resp, key=lambda t: t.get("order_index", 0))
             all_task_ids = [t["id"] for t in sorted_tasks]
+        recipe_resp = api_client.get(f"/api/recipes/{recipe_id}")
+        if not recipe_resp.get("error"):
+            measurement_interval_minutes = recipe_resp.get("measurement_interval_minutes")
+            allow_manual_input = bool(recipe_resp.get("allow_manual_input", True))
 
     return render_template(
         "measure/task_execute.html",
@@ -147,6 +307,8 @@ def task_execute(task_id: int):
         lot_number=lot_number,
         serial_number=serial_number,
         all_task_ids=all_task_ids,
+        measurement_interval_minutes=measurement_interval_minutes,
+        allow_manual_input=allow_manual_input,
     )
 
 
@@ -307,9 +469,15 @@ def save_measurement():
         "lot_number": data.get("lot_number", session.get("lot_number", "")),
         "serial_number": data.get("serial_number", session.get("serial_number", "")),
         "input_method": data.get("input_method", "manual"),
+        "input_duration_ms": data.get("input_duration_ms"),
+        # Attaches the measurement to the production under way, so fine produzione
+        # can hand the whole run to the statistics file.
+        "production_run_id": data.get("production_run_id"),
     }
 
-    resp = api_client.post("/api/measurements", data=payload)
+    # Trailing slash matters: the route is declared as "/", so omitting it costs
+    # a 307 redirect on every single measurement saved.
+    resp = api_client.post("/api/measurements/", data=payload)
 
     if resp.get("error"):
         status_code = resp.get("status_code", 500)
@@ -321,6 +489,189 @@ def save_measurement():
     return jsonify(resp), 201
 
 
+# ---------------------------------------------------------------------------
+# Routes: Out-of-tolerance authorisation (point 5)
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/measurements/pending-authorisation", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_pending_authorisation():
+    """Proxy: the out-of-tolerance measurement holding this operator up, or null.
+
+    Asked when the measurement screen loads, so reloading the page finds the same
+    block the server enforces rather than a clean slate.
+    """
+    params = {"version_id": request.args.get("version_id")}
+    run_id = request.args.get("production_run_id")
+    if run_id:
+        params["production_run_id"] = run_id
+
+    resp = api_client.get("/api/measurements/pending-authorisation", params=params)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/measurements/<int:measurement_id>/authorise", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_authorise_measurement(measurement_id: int):
+    """Proxy: the capoturno lets an out-of-tolerance value stand.
+
+    The credentials go to the endpoint that records the approval on the
+    measurement. Checking them separately, as this used to, left the approval
+    written down nowhere and nothing depending on it.
+    """
+    data = request.get_json(silent=True) or {}
+    username = (data.get("supervisor_username") or "").strip()
+    password = data.get("supervisor_password") or ""
+    if not username or not password:
+        return jsonify({
+            "error": True, "detail": _("Username e password richiesti"),
+        }), 400
+
+    resp = api_client.post(
+        f"/api/measurements/{measurement_id}/authorise",
+        data={"supervisor_username": username, "supervisor_password": password},
+    )
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+# ---------------------------------------------------------------------------
+# Routes: Production run (state that must outlive the page)
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/production/current", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_current_production():
+    """Proxy: the production open at this station, or null.
+
+    Every page asks this on load. Before, the timer and the cycle count lived in the
+    Alpine component and a change of task - a full page load - wiped them.
+    """
+    station_code, _overridden = _current_station()
+    if not station_code:
+        return jsonify({"error": True, "detail": _("Stazione non configurata")}), 503
+
+    resp = api_client.get(
+        "/api/production-runs/current", params={"station_code": station_code},
+    )
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/production/start", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_start_production():
+    """Proxy: open a production at this station."""
+    station_code, _overridden = _current_station()
+    if not station_code:
+        return jsonify({"error": True, "detail": _("Stazione non configurata")}), 503
+
+    data = request.get_json(silent=True) or {}
+    payload = {
+        "station_code": station_code,
+        "recipe_id": data.get("recipe_id"),
+        "version_id": data.get("version_id"),
+        "lot_number": data.get("lot_number") or session.get("lot_number") or None,
+        "serial_number": data.get("serial_number") or session.get("serial_number") or None,
+    }
+    resp = api_client.post("/api/production-runs", data=payload)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 201
+
+
+@measure_bp.route("/api/production/<int:run_id>/cycle", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_complete_cycle(run_id: int):
+    """Proxy: record a finished measurement task.
+
+    The task travels with the call: only the last measurement task of the recipe
+    closes the cycle and restarts the interval, and the server is what decides.
+    """
+    data = request.get_json(silent=True) or {}
+    resp = api_client.post(
+        f"/api/production-runs/{run_id}/cycle",
+        data={"task_id": data.get("task_id"), "note": data.get("note")},
+    )
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/production/<int:run_id>/remeasure", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_remeasure(run_id: int):
+    """Proxy: the piece was turned over - measure again inside the same cycle."""
+    data = request.get_json(silent=True) or {}
+    resp = api_client.post(
+        f"/api/production-runs/{run_id}/remeasure",
+        data={"task_id": data.get("task_id"), "note": data.get("note")},
+    )
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+def _supervised_action(run_id: int, action: str):
+    """Forward an action that needs the capoturno's authorisation.
+
+    The credentials go straight to the API, which checks them and records who
+    authorised what on the run's trace. Validating them separately first would
+    leave no such record, and is an extra round trip besides.
+    """
+    data = request.get_json(silent=True) or {}
+    username = (data.get("supervisor_username") or "").strip()
+    password = data.get("supervisor_password") or ""
+    if not username or not password:
+        return jsonify({
+            "error": True, "detail": _("Username e password richiesti"),
+        }), 400
+
+    resp = api_client.post(
+        f"/api/production-runs/{run_id}/{action}",
+        data={
+            "supervisor_username": username,
+            "supervisor_password": password,
+            "note": data.get("note"),
+        },
+    )
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/production/<int:run_id>/pause", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_pause_production(run_id: int):
+    """Proxy: fermo linea - suspends the run and freezes the countdown."""
+    return _supervised_action(run_id, "pause")
+
+
+@measure_bp.route("/api/production/<int:run_id>/resume", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_resume_production(run_id: int):
+    """Proxy: restart a stopped line, giving back the time the stop took."""
+    return _supervised_action(run_id, "resume")
+
+
+@measure_bp.route("/api/production/<int:run_id>/close", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_close_production(run_id: int):
+    """Proxy: fine produzione - closes the run and emits the statistics file."""
+    return _supervised_action(run_id, "close")
+
+
 # ---------------------------------------------------------------------------
 # Route: File proxy (browser can't send X-API-Key directly)
 # ---------------------------------------------------------------------------
@@ -328,16 +679,4 @@ def save_measurement():
 @login_required
 def api_get_file(file_path: str):
     """Proxy: Serve file from API server (browser can't send X-API-Key)."""
-    api_key = session.get("api_key", "")
-    base_url = Config.API_SERVER_URL.rstrip("/")
-    resp = http_requests.get(
-        f"{base_url}/api/files/{file_path}",
-        headers={"X-API-Key": api_key},
-        timeout=30,
-    )
-    if resp.status_code != 200:
-        return Response(resp.text, status=resp.status_code)
-    return Response(
-        resp.content,
-        content_type=resp.headers.get("content-type", "application/octet-stream"),
-    )
+    return proxy_file(file_path)

src/frontend/flask_app/config.py

@@ -26,6 +26,14 @@ class Config:
     # code it belongs to. Empty/None means "not configured".
     STATION_CODE: str | None = os.getenv("STATION_CODE") or None
 
+    # Allow switching the current station from the URL (?station=CODE), keeping the
+    # override in the session. Meant for commissioning: it lets one PC exercise
+    # several stations instead of needing one machine per station.
+    # Off by default - on the shop floor the station identity comes from the local
+    # install, and measuring against the wrong station's recipes would silently
+    # break traceability.
+    STATION_SWITCH_ENABLED: bool = os.getenv("STATION_SWITCH_ENABLED", "0") == "1"
+
     # Babel i18n
     BABEL_DEFAULT_LOCALE = "it"
     BABEL_DEFAULT_TIMEZONE = "Europe/Rome"