operatore: acquisizione immagine, proxy execute e overlay per camera_measure/dxf_compare (#46)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.superpowers/sdd/.gitignore

@@ -0,0 +1 @@
+*

Dockerfile

@@ -13,8 +13,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     shared-mime-info \
     && rm -rf /var/lib/apt/lists/*
 
-# Non-root user the app runs as at runtime.
-RUN useradd -u 10001 app
+# Non-root user the app runs as at runtime. -m creates a home dir: `uv run`
+# in the CMD below writes its cache under $HOME, and without one it has
+# nowhere writable to put it.
+RUN useradd -m -u 10001 app
+# Independent of $HOME regardless: keeps the cache path explicit and writable
+# by the app user even if the home directory assumption ever changes.
+ENV UV_CACHE_DIR=/tmp/uv-cache
+# `uv run` must use the venv built by `uv sync` below as it is: re-validating
+# the project would look for vendor/visionsuite (the vision-worker extra), which
+# this image does not carry (issue 39). `uv sync` itself is not affected by it.
+ENV UV_NO_SYNC=1
 
 WORKDIR /app
 
@@ -31,7 +40,7 @@ COPY src/ ./src/
 
 # Uploads directory (mounted as a volume in production).
 RUN mkdir -p /app/uploads/images /app/uploads/pdfs /app/uploads/logos /app/uploads/reports \
-    && chown -R app:app /app
+    && chown -R app:app /app /tmp/uv-cache
 
 USER app
 

Dockerfile.frontend

@@ -18,8 +18,17 @@ FROM python:3.11.16-slim AS base
 # uv from the official slim image (fast Python package manager).
 COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /usr/local/bin/
 
-# Non-root user the app runs as at runtime.
-RUN useradd -u 10001 app
+# Non-root user the app runs as at runtime. -m creates a home dir: `uv run`
+# in the CMD below writes its cache under $HOME, and without one it has
+# nowhere writable to put it.
+RUN useradd -m -u 10001 app
+# Independent of $HOME regardless: keeps the cache path explicit and writable
+# by the app user even if the home directory assumption ever changes.
+ENV UV_CACHE_DIR=/tmp/uv-cache
+# `uv run` must use the venv built by `uv sync` below as it is: re-validating
+# the project would look for vendor/visionsuite (the vision-worker extra), which
+# this image does not carry (issue 39). `uv sync` itself is not affected by it.
+ENV UV_NO_SYNC=1
 
 WORKDIR /app
 
@@ -36,7 +45,7 @@ COPY --from=tailwind-build /app/flask_app/static/css/tailwind.css ./flask_app/st
 # Compile Flask-Babel translation catalogs.
 WORKDIR /app/flask_app
 RUN uv run --project /app pybabel compile -d translations && \
-    chown -R app:app /app
+    chown -R app:app /app /tmp/uv-cache
 
 USER app
 

Dockerfile.vision

@@ -10,7 +10,12 @@ COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /usr/local/bin/uv
 
 # Non-root user the app runs as at runtime. Same UID as the server's Dockerfile
 # so both containers agree on ownership of the shared uploads volume (point 13).
-RUN useradd -u 10001 app
+# -m creates a home dir: `uv run` in the CMD below writes its cache under
+# $HOME, and without one it has nowhere writable to put it.
+RUN useradd -m -u 10001 app
+# Independent of $HOME regardless: keeps the cache path explicit and writable
+# by the app user even if the home directory assumption ever changes.
+ENV UV_CACHE_DIR=/tmp/uv-cache
 
 WORKDIR /app
 COPY pyproject.toml uv.lock ./
@@ -38,7 +43,7 @@ RUN test -n "$VISION_ENGINE_VERSION" || { \
     }
 ENV VISION_ENGINE_VERSION=${VISION_ENGINE_VERSION}
 
-RUN chown -R app:app /app
+RUN chown -R app:app /app /tmp/uv-cache
 USER app
 
 EXPOSE 8100

README.md

@@ -469,15 +469,15 @@ variabile impostata, sia in sviluppo sia in produzione, con lo stesso comando
 mostrato sopra (sostituendo `docker-compose.dev.yml` con `docker-compose.yml`
 in produzione).
 
-Stato corrente su `V3.0.0`, con `uv run pytest` su Python 3.11 e senza
-l'extra `vision` (un conteggio senza il suo ambiente non dice nulla, regola
-che vale anche qui): **390 pass, 1 fail, 4 skip** — 243 in `src/backend/tests/`,
-147 pass + 2 skip in `src/frontend/flask_app/tests/`, più 2 skip in
+Stato corrente su `V3.0.0`, con `uv run --extra server --extra client --extra
+dev pytest` su Python 3.11 e senza l'extra `vision` (un conteggio senza il
+suo ambiente non dice nulla, regola che vale anche qui): **622 pass, 4
+skip, nessun fallimento** — 410 in `src/backend/tests/`, 212 pass + 2 skip
+in `src/frontend/flask_app/tests/` (geometria propria di
+`test_layout_shell.py`, non legati alla visione), più 2 skip in
 `src/vision/tests/` e `src/vision_worker/tests/` per il vincolo su Python
-3.13 descritto sopra. Il fallimento è preesistente e indipendente da questo
-lavoro: `test_offline.py::test_no_first_party_script_calls_out`, dovuto a una
-copia locale di Fabric.js non tracciata da git (`static/js/fabric-debug.js`)
-che nei propri commenti cita pagine di documentazione esterne.
+3.13 descritto sopra. Eseguendo questi ultimi nel loro ambiente dedicato
+(comando sotto) i test collegati alla visione passano tutti: **16 pass**.
 
 Alcuni test frontend non renderizzano niente e leggono i sorgenti, perché guardano
 proprietà che sopravvivono solo se qualcuno le controlla:

docker-compose.dev.yml

@@ -14,6 +14,7 @@ services:
       --authentication-policy=mysql_native_password
       --character-set-server=utf8mb4
       --collation-server=utf8mb4_unicode_ci
+      --default-time-zone=+00:00
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
       interval: 10s
@@ -31,6 +32,7 @@ services:
     env_file:
       - .env
     environment:
+      APP_ENV: dev
       DB_HOST: mysql
       UPLOAD_DIR: uploads
       VISION_WORKER_URL: http://vision:8100

docker-compose.yml

@@ -14,6 +14,7 @@ services:
       --authentication-policy=mysql_native_password
       --character-set-server=utf8mb4
       --collation-server=utf8mb4_unicode_ci
+      --default-time-zone=+00:00
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
       interval: 10s
@@ -31,6 +32,7 @@ services:
     env_file:
       - .env
     environment:
+      APP_ENV: production
       DB_HOST: mysql
       UPLOAD_DIR: uploads
       VISION_WORKER_URL: http://vision:8100
@@ -115,7 +117,7 @@ services:
       - "traefik.http.middlewares.tmflow-headers.headers.forceSTSHeader=true"
       - "traefik.http.middlewares.tmflow-headers.headers.STSIncludeSubdomains=true"
       - "traefik.http.middlewares.tmflow-headers.headers.STSPreload=true"
-      - "traefik.http.middlewares.tmflow-headers.headers.frameDeny=true"
+      - "traefik.http.middlewares.tmflow-headers.headers.customFrameOptionsValue=SAMEORIGIN"
       - "traefik.http.routers.tmflow-web.middlewares=tmflow-headers"
     networks:
       - tmflow-net

docs/DEPLOYMENT.md

@@ -146,6 +146,7 @@ Introdotte dalla revisione del 21/09/2026:
 
 | Variable | Type | Default | Description |
 |----------|------|---------|-------------|
+| `APP_ENV` | string | dev | Ambiente di esecuzione. `dev`/`test` saltano il controllo sui segreti di default; qualsiasi altro valore lo attiva. `docker-compose.yml` lo imposta a `production`, `docker-compose.dev.yml` a `dev` |
 | `APP_DOMAIN` | string | *(nessuno, obbligatoria)* | Dominio pubblico dell'installazione, usato nelle rule Traefik di `docker-compose.yml` (solo produzione) |
 | `TRUSTED_PROXY_COUNT` | int | 1 | Quanti hop di reverse proxy fidati stanno davanti al server, per calcolare l'IP reale del tablet |
 | `WEB_CONCURRENCY` | int | 1 | Numero di worker Uvicorn del server; il `Dockerfile` ne avvia 4 di default indipendentemente da questa variabile |
@@ -434,6 +435,30 @@ docker compose -f docker-compose.yml logs -f server
 docker compose -f docker-compose.yml down
 ```
 
+### Aggiornare un'installazione esistente
+
+Le immagini precedenti creavano l'utente non privilegiato senza una home
+directory (`useradd -u 10001 app`), e il volume `upload_data` che ne è
+risultato appartiene a `root`. Le immagini attuali creano l'utente con
+`-m` e impostano `UV_CACHE_DIR=/tmp/uv-cache`, ma questo non cambia da solo
+la proprietà di un volume già esistente: se si riparte con le nuove immagini
+su un volume creato da una versione precedente, il container `server` non
+riesce a scrivere sotto `/app/uploads`.
+
+Prima del primo avvio con le nuove immagini, va quindi corretta la proprietà
+del volume:
+
+```bash
+docker compose -f docker-compose.yml run --rm --user root --entrypoint chown server -R 10001:10001 /app/uploads
+```
+
+(sostituire `docker-compose.yml` con `docker-compose.dev.yml` per
+un'installazione di sviluppo/on-premise). Il comando usa il servizio
+`server` perché è quello che monta il volume `upload_data` in lettura e
+scrittura; il worker di visione lo monta in sola lettura e non ne ha
+bisogno. Un'installazione nuova, che parte da un volume vuoto, non richiede
+questo passo.
+
 ---
 
 ## SSL/TLS

src/backend/api/middleware/api_key.py

@@ -1,10 +1,18 @@
 """API Key authentication dependency for FastAPI."""
+from datetime import timedelta
+
 from fastapi import Depends, HTTPException, Request, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.database import get_db
+from src.backend.config import settings
+from src.backend.models.orm.api_key import ApiKey
 from src.backend.models.orm.user import User
+from src.backend.services.auth_service import hash_api_key
+from src.backend.utils.tempo import utcnow
+
+_RENEW_INTERVAL = timedelta(minutes=5)
 
 
 async def get_current_user(
@@ -24,15 +32,25 @@ async def get_current_user(
         )
 
     result = await db.execute(
-        select(User).where(User.api_key == api_key, User.active == True)
+        select(ApiKey, User)
+        .join(User, User.id == ApiKey.user_id)
+        .where(ApiKey.key_hash == hash_api_key(api_key), User.active == True)
     )
-    user = result.scalar_one_or_none()
+    row = result.first()
+    now = utcnow()
 
-    if user is None:
+    if row is None or row[0].expires_at <= now:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid or inactive API key",
+            detail="Invalid or expired API key",
         )
+    key_row, user = row
+
+    # Sliding TTL, written at most once per _RENEW_INTERVAL to spare the DB.
+    if key_row.last_used_at is None or now - key_row.last_used_at > _RENEW_INTERVAL:
+        key_row.last_used_at = now
+        key_row.expires_at = now + timedelta(hours=settings.api_key_ttl_hours)
+        await db.flush()
 
     # Store user_id in request state for access logging middleware
     request.state.user_id = user.id

src/backend/api/routers/auth.py

@@ -1,5 +1,5 @@
 """Authentication router - login, logout, profile."""
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.database import get_db
@@ -34,15 +34,16 @@ async def login(data: LoginRequest, db: AsyncSession = Depends(get_db)):
 
 @router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
 async def logout(
+    request: Request,
     all_sessions: bool = False,
     user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """Logout. The API key is shared across stations logged in as the same
-    user, so by default this does not invalidate it - only this station's
-    session (its Flask session, on the client side) ends. Pass
-    ?all_sessions=true to invalidate the key everywhere."""
-    await logout_user(db, user, all_sessions=all_sessions)
+    """Logout. Deletes this session's API key only; ?all_sessions=true
+    deletes every key of the user."""
+    await logout_user(
+        db, user, key=request.headers.get("X-API-Key"), all_sessions=all_sessions
+    )
 
 
 @router.get("/me", response_model=UserResponse)

src/backend/api/routers/measurements.py

@@ -2,6 +2,8 @@
 import csv
 import io
 from datetime import datetime
+from src.backend.models.api.tipi import UtcNaiveInput
+from src.backend.utils.tempo import as_utc_naive, iso_utc, to_local, utcnow
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from fastapi.responses import StreamingResponse
@@ -19,6 +21,7 @@ from src.backend.models.orm.recipe import RecipeVersion
 from src.backend.models.orm.setting import SystemSetting
 from src.backend.models.orm.user import User
 from src.backend.models.api.measurement import (
+    CurrentCycleResponse,
     MeasurementAuthorisation,
     MeasurementBatchCreate,
     MeasurementCreate,
@@ -97,6 +100,24 @@ async def get_task_progress(
     return TaskProgressListResponse(tasks=tasks)
 
 
+@router.get("/current-cycle", response_model=CurrentCycleResponse)
+async def get_current_cycle(
+    production_run_id: int = Query(..., gt=0),
+    task_id: int = Query(..., gt=0),
+    user: User = Depends(require_measurement_tec),
+    db: AsyncSession = Depends(get_db),
+):
+    """Quotes of this task already measured in the cycle under way.
+
+    Asked on load, so that a reload mid-cycle does not present quotes again that
+    were taken a moment ago.
+    """
+    rows = await measurement_service.current_cycle_measurements(
+        db, production_run_id, task_id,
+    )
+    return CurrentCycleResponse(measurements=rows)
+
+
 @router.post("/{measurement_id}/authorise", response_model=MeasurementResponse)
 async def authorise_measurement(
     measurement_id: int,
@@ -174,6 +195,7 @@ def _build_measurement_filters(
     date_from: datetime | None,
     date_to: datetime | None,
     pass_fail: str | None,
+    production_run_id: int | None = None,
 ) -> list:
     """Build SQLAlchemy filter conditions shared by list and CSV export."""
     filters = []
@@ -199,6 +221,8 @@ def _build_measurement_filters(
         filters.append(Measurement.measured_at <= date_to)
     if pass_fail is not None:
         filters.append(Measurement.pass_fail == pass_fail)
+    if production_run_id is not None:
+        filters.append(Measurement.production_run_id == production_run_id)
     return filters
 
 
@@ -210,9 +234,10 @@ async def get_measurements(
     measured_by: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     pass_fail: str | None = Query(None, pattern="^(pass|warning|fail)$"),
+    production_run_id: int | None = Query(None, gt=0),
     page: int = Query(1, ge=1),
     per_page: int = Query(50, ge=1, le=500),
     user: User = Depends(get_current_user),
@@ -228,7 +253,7 @@ async def get_measurements(
     """
     filters = _build_measurement_filters(
         recipe_id, version_id, subtask_id, measured_by, lot_number,
-        serial_number, date_from, date_to, pass_fail,
+        serial_number, date_from, date_to, pass_fail, production_run_id,
     )
 
     # Build query
@@ -267,8 +292,8 @@ async def export_measurements_csv(
     measured_by: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     pass_fail: str | None = Query(None, pattern="^(pass|warning|fail)$"),
     user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
@@ -349,7 +374,7 @@ async def export_measurements_csv(
             neutralise_csv_cell(m.lot_number or ""),
             neutralise_csv_cell(m.serial_number or ""),
             m.input_method,
-            m.measured_at.isoformat(),
+            iso_utc(m.measured_at),
             m.synced_to_csv,
         ])
 
@@ -359,6 +384,6 @@ async def export_measurements_csv(
         iter([output.getvalue()]),
         media_type="text/csv",
         headers={
-            "Content-Disposition": f"attachment; filename=measurements_{datetime.now().strftime('%Y%m%d_%H%M%S')}.csv"
+            "Content-Disposition": f"attachment; filename=measurements_{to_local(utcnow()).strftime('%Y%m%d_%H%M%S')}.csv"
         },
     )

src/backend/api/routers/reports.py

@@ -1,5 +1,5 @@
 """Reports router — PDF report generation endpoints for Metrologist."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcNaiveInput
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from fastapi.responses import Response
@@ -18,8 +18,8 @@ async def download_spc_report(
     recipe_id: int = Query(...),
     subtask_id: int = Query(...),
     version_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
@@ -52,8 +52,8 @@ async def download_measurement_report(
     recipe_id: int = Query(...),
     subtask_id: int | None = Query(None),
     version_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),

src/backend/api/routers/setup.py

@@ -5,8 +5,8 @@ NOT protected by API Key auth (standalone access).
 """
 import hmac
 import random
-import secrets
 from datetime import datetime, timedelta
+from src.backend.utils.tempo import iso_utc, utcnow
 from pathlib import Path
 
 from alembic import command
@@ -25,7 +25,7 @@ from src.backend.models.orm import (
     User, Recipe, RecipeVersion, RecipeTask, RecipeSubtask, Measurement,
 )
 from src.backend.models.orm.station import Station, StationRecipeAssignment
-from src.backend.services.auth_service import hash_password
+from src.backend.services.auth_service import hash_password, issue_api_key, revoke_all_keys
 from src.backend.services.measurement_service import calculate_pass_fail
 
 router = APIRouter(prefix="/api/setup", tags=["setup"])
@@ -321,8 +321,6 @@ async def create_admin(body: CreateAdminBody):
     """Create an admin user with all roles."""
     _check_password(body.password)
 
-    api_key = secrets.token_hex(32)
-
     async with async_session_factory() as session:
         async with session.begin():
             user = User(
@@ -332,9 +330,10 @@ async def create_admin(body: CreateAdminBody):
                 display_name=body.admin_display_name,
                 roles=["Maker", "MeasurementTec", "Metrologist"],
                 is_admin=True,
-                api_key=api_key,
             )
             session.add(user)
+            await session.flush()
+            api_key = await issue_api_key(session, user)
 
     return {
         "status": "ok",
@@ -404,7 +403,6 @@ async def seed_demo_data(body: PasswordBody):
                     email=u["email"],
                     roles=u["roles"],
                     is_admin=u["is_admin"],
-                    api_key=secrets.token_hex(32),
                 )
                 session.add(user)
                 created_users.append(user)
@@ -558,7 +556,7 @@ async def seed_demo_data(body: PasswordBody):
             tec_user = created_users[2]  # tec1
             lot_numbers = ["LOT-2025-001", "LOT-2025-002", "LOT-2025-003", "LOT-2025-004"]
             serial_numbers = [f"SN-{i:04d}" for i in range(1, 13)]
-            base_date = datetime.now()
+            base_date = utcnow()
 
             all_subtasks = subtasks_1 + subtasks_2
             measurements_created = 0
@@ -606,8 +604,8 @@ async def list_users(body: PasswordBody):
                     "roles": u.roles or [],
                     "is_admin": u.is_admin,
                     "active": u.active,
-                    "created_at": u.created_at.isoformat() if u.created_at else None,
-                    "last_login": u.last_login.isoformat() if u.last_login else None,
+                    "created_at": iso_utc(u.created_at) or None,
+                    "last_login": iso_utc(u.last_login) or None,
                 }
                 for u in users
             ],
@@ -652,7 +650,6 @@ async def manage_user(body: ManageUserBody):
                     email=body.email,
                     roles=body.roles,
                     is_admin=body.is_admin,
-                    api_key=secrets.token_hex(32),
                 )
                 session.add(user)
                 await session.flush()
@@ -707,7 +704,7 @@ async def change_user_password(body: ChangeUserPasswordBody):
                     detail=f"User ID {body.user_id} not found",
                 )
             user.password_hash = hash_password(body.new_password)
-            user.api_key = None  # Invalidate sessions
+            await revoke_all_keys(session, user.id)  # Invalidate sessions
 
     return {"status": "ok", "message": f"Password changed for '{user.username}'"}
 
@@ -730,7 +727,7 @@ async def toggle_user_active(body: ToggleUserActiveBody):
                 )
             user.active = not user.active
             if not user.active:
-                user.api_key = None  # Invalidate sessions on deactivation
+                await revoke_all_keys(session, user.id)  # on deactivation
             new_status = "active" if user.active else "inactive"
 
     return {"status": "ok", "message": f"User '{user.username}' is now {new_status}", "active": user.active}

src/backend/api/routers/statistics.py

@@ -1,5 +1,6 @@
 """Statistics router - SPC endpoints for Metrologist dashboard."""
 from datetime import datetime
+from src.backend.models.api.tipi import UtcNaiveInput
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import and_, select
@@ -100,8 +101,8 @@ async def get_summary(
     recipe_id: int = Query(...),
     version_id: int | None = Query(None),
     subtask_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
@@ -122,8 +123,8 @@ async def get_capability(
     recipe_id: int = Query(...),
     subtask_id: int = Query(...),
     version_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
@@ -145,8 +146,8 @@ async def get_control_chart(
     recipe_id: int = Query(...),
     subtask_id: int = Query(...),
     version_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),
@@ -172,8 +173,8 @@ async def get_histogram(
     recipe_id: int = Query(...),
     subtask_id: int = Query(...),
     version_id: int | None = Query(None),
-    date_from: datetime | None = Query(None),
-    date_to: datetime | None = Query(None),
+    date_from: UtcNaiveInput = Query(None),
+    date_to: UtcNaiveInput = Query(None),
     operator_id: int | None = Query(None),
     lot_number: str | None = Query(None),
     serial_number: str | None = Query(None),

src/backend/api/routers/tasks.py

@@ -19,7 +19,8 @@ from src.backend.models.api.task import (
     TaskUpdate,
     validate_tolerance_order,
 )
-from src.backend.services import recipe_service
+from src.backend.models.orm.vision import VisionReferenceImage
+from src.backend.services import recipe_service, vision_service
 
 router = APIRouter(tags=["tasks"])
 
@@ -366,8 +367,24 @@ async def delete_task(
 
     task = await _task_for_write(db, task, user)
 
+    # The rows go with the task (migration 014 cascades them), the files do not:
+    # collect them now, remove the files only once the commit is durable - same
+    # order as vision.py::delete_reference_image. Rows are deleted explicitly so
+    # file_still_referenced sees the post-delete state even where the database
+    # does not enforce the cascade.
+    references = (await db.execute(
+        select(VisionReferenceImage).where(VisionReferenceImage.task_id == task.id)
+    )).scalars().all()
+    for reference in references:
+        await db.delete(reference)
+
     await db.delete(task)
-    await db.flush()
+    await db.commit()
+
+    # A copy-on-write sibling may still point at the same file (#38.6).
+    for reference in references:
+        if not await vision_service.file_still_referenced(db, reference.path):
+            vision_service.remove_reference_file(reference)
 
 
 # ---------------------------------------------------------------------------

src/backend/api/routers/users.py

@@ -7,7 +7,7 @@ from src.backend.database import get_db
 from src.backend.api.middleware.api_key import require_admin_user
 from src.backend.models.orm.user import User
 from src.backend.models.api.user import UserCreate, UserPasswordChange, UserResponse, UserUpdate
-from src.backend.services.auth_service import create_user, hash_password, regenerate_api_key
+from src.backend.services.auth_service import create_user, hash_password, regenerate_api_key, revoke_all_keys
 
 router = APIRouter(prefix="/api/users", tags=["users"])
 
@@ -146,7 +146,7 @@ async def change_user_password(
     if user is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
     user.password_hash = hash_password(data.password)
-    user.api_key = None
+    await revoke_all_keys(db, user.id)
     await db.flush()
     return {"message": f"Password changed for user {user.username}"}
 
@@ -168,7 +168,7 @@ async def deactivate_user(
             detail="Cannot deactivate yourself",
         )
     user.active = False
-    user.api_key = None
+    await revoke_all_keys(db, user.id)
     await db.flush()
 
 
@@ -183,5 +183,5 @@ async def regenerate_user_key(
     user = result.scalar_one_or_none()
     if user is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
-    new_key = await regenerate_api_key(db, user_id)
+    new_key = await regenerate_api_key(db, user)
     return {"api_key": new_key, "message": f"API key regenerated for user {user.username}"}

src/backend/api/routers/vision.py

@@ -4,7 +4,10 @@ It does not know, and must not know, whether the server or the station computed
 the numbers: that is what lets a station's configuration change without touching
 the frontend or the recipes.
 """
+import io
+
 from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
+from PIL import Image
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -90,9 +93,27 @@ async def _read_image(image: UploadFile) -> bytes:
             status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail="the file's content does not match a supported image format",
         )
+    _reject_animated(content)
     return content
 
 
+def _reject_animated(content: bytes) -> None:
+    """Animated GIF/WebP/APNG have no single frame to measure (decision of
+    06/10/2026, #43): refuse them instead of silently reading frame 0."""
+    try:
+        with Image.open(io.BytesIO(content)) as img:
+            animated = getattr(img, "is_animated", False) or getattr(img, "n_frames", 1) > 1
+    except Exception:
+        # Unreadable here is not this check's business: the magic bytes passed
+        # and the worker decides what it can decode.
+        return
+    if animated:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="animated images are not supported",
+        )
+
+
 @router.post("/execute", response_model=VisionExecuteResponse)
 async def execute(
     task_id: int = Form(...),
@@ -177,8 +198,10 @@ async def delete_reference_image(
     reference = await vision_service.delete_reference_image(db, reference_id)
     await db.commit()
     # Only now: if the commit above had failed, the row would still exist and
-    # the file must still be there for it.
-    vision_service.remove_reference_file(reference)
+    # the file must still be there for it. And only if no other row (a
+    # copy-on-write sibling, #38.6) still references the same path.
+    if not await vision_service.file_still_referenced(db, reference.path):
+        vision_service.remove_reference_file(reference)
 
 
 @router.post("/preview")

src/backend/config.py

@@ -28,6 +28,9 @@ class Settings(BaseSettings):
     db_user: str = "tmflow"
     db_password: str = _DEFAULT_DB_PASSWORD
 
+    # Presentation time zone (DB is UTC, #42)
+    display_timezone: str = "Europe/Rome"
+
     # Server
     server_host: str = "0.0.0.0"
     server_port: int = 8000
@@ -38,6 +41,9 @@ class Settings(BaseSettings):
     # configured limits to keep the cluster-wide effective limit close to what
     # was configured instead of multiplying it by N.
     web_concurrency: int = 1
+
+    # API key session lifetime (hours); renewed on use (env API_KEY_TTL_HOURS).
+    api_key_ttl_hours: int = 24
     # How many reverse proxies between the client and this API are trusted to
     # have appended their own hop to X-Forwarded-For (Nginx, in the default
     # deploy). Used by RateLimitMiddleware._client_ip. 0 disables proxy header

src/backend/migrations/versions/015_api_key_hash.py

@@ -0,0 +1,54 @@
+"""API keys as SHA-256 hashes, one per session (#41)
+
+Replaces the plaintext `users.api_key` column with an `api_keys` table: one
+row per login, holding only the SHA-256 hex digest, an expiry and the last
+use. Existing keys are invalidated on purpose, not migrated - the plaintext
+is exactly what must stop existing, so everybody logs in once again.
+
+Revision ID: 015_api_key_hash
+Revises: 014_vision_fk_ondelete
+Create Date: 2026-10-06
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = '015_api_key_hash'
+down_revision: Union[str, None] = '014_vision_fk_ondelete'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'api_keys',
+        sa.Column('id', sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('key_hash', sa.String(64), nullable=False),
+        sa.Column('created_at', sa.DateTime(), nullable=False),
+        sa.Column('expires_at', sa.DateTime(), nullable=False),
+        sa.Column('last_used_at', sa.DateTime(), nullable=True),
+        sa.ForeignKeyConstraint(
+            ['user_id'], ['users.id'], name='fk_api_keys_user_id', ondelete='CASCADE'
+        ),
+    )
+    op.create_index('ix_api_keys_key_hash', 'api_keys', ['key_hash'], unique=True)
+    op.create_index('ix_api_keys_user_id', 'api_keys', ['user_id'])
+
+    with op.batch_alter_table('users') as batch:
+        batch.drop_index('ix_users_api_key')
+        batch.drop_constraint('uq_users_api_key', type_='unique')
+        batch.drop_column('api_key')
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('users') as batch:
+        batch.add_column(sa.Column('api_key', sa.String(64), nullable=True))
+        batch.create_unique_constraint('uq_users_api_key', ['api_key'])
+        batch.create_index('ix_users_api_key', ['api_key'])
+
+    op.drop_index('ix_api_keys_user_id', table_name='api_keys')
+    op.drop_index('ix_api_keys_key_hash', table_name='api_keys')
+    op.drop_table('api_keys')

src/backend/models/api/measurement.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for Measurement operations."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime, UtcNaiveInput
 from typing import Optional
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -54,8 +54,8 @@ class MeasurementResponse(BaseModel):
     # Who let this value stand, when it was out of tolerance. Null on a value in
     # tolerance - and on one that is not and is still waiting for an answer.
     supervisor_id: Optional[int] = None
-    authorised_at: Optional[datetime] = None
-    measured_at: datetime
+    authorised_at: Optional[UtcDateTime] = None
+    measured_at: UtcDateTime
     synced_to_csv: bool
 
 
@@ -91,6 +91,21 @@ class TaskProgressListResponse(BaseModel):
     tasks: list[TaskProgressResponse]
 
 
+class CycleMeasurementResponse(BaseModel):
+    """One quote already measured in the cycle under way."""
+
+    subtask_id: int
+    value: float
+    pass_fail: str
+    measured_at: UtcDateTime
+
+
+class CurrentCycleResponse(BaseModel):
+    """The quotes to restore on the screen after a reload; empty if the task is closed."""
+
+    measurements: list[CycleMeasurementResponse]
+
+
 class MeasurementQuery(BaseModel):
     """Schema for measurement query filters."""
     recipe_id: Optional[int] = None
@@ -99,8 +114,8 @@ class MeasurementQuery(BaseModel):
     measured_by: Optional[int] = None
     lot_number: Optional[str] = None
     serial_number: Optional[str] = None
-    date_from: Optional[datetime] = None
-    date_to: Optional[datetime] = None
+    date_from: UtcNaiveInput = None
+    date_to: UtcNaiveInput = None
     pass_fail: Optional[str] = Field(None, pattern="^(pass|warning|fail)$")
     page: int = Field(1, ge=1)
     per_page: int = Field(50, ge=1, le=500)

src/backend/models/api/production.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for production runs and their events."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime
 from typing import Literal, Optional
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -21,7 +21,7 @@ class ProductionEventResponse(BaseModel):
     supervisor_id: Optional[int]
     task_id: Optional[int] = None
     note: Optional[str]
-    created_at: datetime
+    created_at: UtcDateTime
 
 
 class ProductionRunResponse(BaseModel):
@@ -36,11 +36,11 @@ class ProductionRunResponse(BaseModel):
     serial_number: Optional[str]
     status: str
     measurement_interval_minutes: Optional[int]
-    next_measurement_at: Optional[datetime]
+    next_measurement_at: Optional[UtcDateTime]
     cycle_count: int
-    started_at: datetime
-    paused_at: Optional[datetime]
-    closed_at: Optional[datetime]
+    started_at: UtcDateTime
+    paused_at: Optional[UtcDateTime]
+    closed_at: Optional[UtcDateTime]
     closed_by: Optional[int]
     statistics_path: Optional[str] = None
 
@@ -49,7 +49,7 @@ class ProductionRunResponse(BaseModel):
     # overdue is a fact the operator must see, not deduce.
     seconds_to_next_measurement: Optional[int] = None
     overdue: bool = False
-    server_time: Optional[datetime] = None
+    server_time: Optional[UtcDateTime] = None
 
     # The measurement tasks of this run's version, in execution order. The client
     # needs them to bring the operator back to the measurement when the interval

src/backend/models/api/recipe.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for Recipe and RecipeVersion operations."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime
 from typing import Optional, TYPE_CHECKING
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -51,7 +51,7 @@ class RecipeVersionResponse(BaseModel):
     version_number: int
     is_current: bool
     created_by: int
-    created_at: datetime
+    created_at: UtcDateTime
     change_notes: Optional[str] = None
     tasks: list["TaskResponse"] = []
 
@@ -72,7 +72,7 @@ class RecipeResponse(BaseModel):
     requires_serial: bool = False
     allow_manual_input: bool = False
     created_by: int
-    created_at: datetime
+    created_at: UtcDateTime
     active: bool
     current_version: Optional[RecipeVersionResponse] = None
 

src/backend/models/api/station.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for Station and StationRecipeAssignment."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime
 from typing import Optional
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -29,7 +29,7 @@ class StationResponse(BaseModel):
     notes: Optional[str]
     active: bool
     created_by: int
-    created_at: datetime
+    created_at: UtcDateTime
 
 
 class StationRecipeAssignmentCreate(BaseModel):
@@ -42,7 +42,7 @@ class StationRecipeAssignmentResponse(BaseModel):
     station_id: int
     recipe_id: int
     assigned_by: int
-    assigned_at: datetime
+    assigned_at: UtcDateTime
 
 
 class RecipeSummary(BaseModel):

src/backend/models/api/statistics.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for SPC statistics responses."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime, UtcNaiveInput
 from typing import Optional
 
 from pydantic import BaseModel, Field
@@ -10,8 +10,8 @@ class StatisticsQuery(BaseModel):
     recipe_id: int
     version_id: Optional[int] = None
     subtask_id: Optional[int] = None
-    date_from: Optional[datetime] = None
-    date_to: Optional[datetime] = None
+    date_from: UtcNaiveInput = None
+    date_to: UtcNaiveInput = None
     operator_id: Optional[int] = None
     lot_number: Optional[str] = None
     serial_number: Optional[str] = None
@@ -20,7 +20,7 @@ class StatisticsQuery(BaseModel):
 class ControlChartData(BaseModel):
     """Data for X-bar/R control chart."""
     values: list[float]
-    timestamps: list[datetime]
+    timestamps: list[UtcDateTime]
     mean: float
     ucl: float  # Upper Control Limit
     lcl: float  # Lower Control Limit
@@ -60,7 +60,7 @@ class CapabilityData(BaseModel):
 
 class TrendData(BaseModel):
     """Temporal trend data for capability indices."""
-    dates: list[datetime]
+    dates: list[UtcDateTime]
     cpk_values: list[Optional[float]]
     ppk_values: list[Optional[float]]
     n_per_period: list[int]

src/backend/models/api/tipi.py

@@ -0,0 +1,14 @@
+"""Shared Pydantic types for datetimes (#42): UTC in the DB, explicit +00:00 on the wire."""
+from datetime import datetime
+from typing import Annotated, Optional
+
+from pydantic import AfterValidator, PlainSerializer
+
+from src.backend.utils.tempo import as_utc_naive, to_utc_aware
+
+UtcDateTime = Annotated[
+    datetime, PlainSerializer(lambda v: to_utc_aware(v).isoformat(), return_type=str)
+]
+
+# Input: aware values are converted to UTC naive, naive is taken as UTC.
+UtcNaiveInput = Annotated[Optional[datetime], AfterValidator(as_utc_naive)]

src/backend/models/api/user.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for User operations."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime
 from typing import Optional
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -48,8 +48,8 @@ class UserResponse(BaseModel):
     language_pref: str
     theme_pref: str
     active: bool
-    created_at: datetime
-    last_login: Optional[datetime] = None
+    created_at: UtcDateTime
+    last_login: Optional[UtcDateTime] = None
 
 
 class UserPasswordChange(BaseModel):

src/backend/models/api/vision.py

@@ -1,5 +1,5 @@
 """Pydantic schemas for the vision execution response."""
-from datetime import datetime
+from src.backend.models.api.tipi import UtcDateTime
 
 from pydantic import BaseModel, ConfigDict
 
@@ -28,4 +28,4 @@ class VisionReferenceImageResponse(BaseModel):
     note: str | None = None
     station_id: int | None = None
     device_code: str | None = None
-    acquired_at: datetime
+    acquired_at: UtcDateTime

src/backend/models/orm/__init__.py

@@ -1,5 +1,6 @@
 """SQLAlchemy models for TieMeasureFlow."""
 from src.backend.models.orm.user import User
+from src.backend.models.orm.api_key import ApiKey
 from src.backend.models.orm.recipe import Recipe, RecipeVersion
 from src.backend.models.orm.task import RecipeTask, RecipeSubtask
 from src.backend.models.orm.measurement import Measurement
@@ -11,6 +12,7 @@ from src.backend.models.orm.vision import VisionReferenceImage, VisionResult
 
 __all__ = [
     "User",
+    "ApiKey",
     "Recipe",
     "RecipeVersion",
     "RecipeTask",

src/backend/models/orm/api_key.py

@@ -0,0 +1,25 @@
+"""API key sessions: one row per login, stored as a SHA-256 hash."""
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import DateTime, ForeignKey, Integer, String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.backend.database import Base
+
+
+class ApiKey(Base):
+    """One API key per login session.
+
+    Only the SHA-256 hex digest is stored, never the key. Dates are naive UTC.
+    """
+    __tablename__ = "api_keys"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    user_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    key_hash: Mapped[str] = mapped_column(String(64), nullable=False, unique=True, index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(DateTime, nullable=False)
+    last_used_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)

src/backend/models/orm/user.py

@@ -32,7 +32,6 @@ class User(Base):
 
     # Status
     active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
-    api_key: Mapped[Optional[str]] = mapped_column(String(64), unique=True, nullable=True, index=True)
 
     # Timestamps
     created_at: Mapped[datetime] = mapped_column(

src/backend/services/auth_service.py

@@ -1,12 +1,16 @@
 """Authentication service - password hashing, API key management."""
+import hashlib
 import secrets
-from datetime import datetime
+from datetime import datetime, timedelta
+from src.backend.utils.tempo import utcnow
 
 import bcrypt
 from fastapi import HTTPException, status
-from sqlalchemy import select, update
+from sqlalchemy import delete, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from src.backend.config import settings
+from src.backend.models.orm.api_key import ApiKey
 from src.backend.models.orm.user import User
 
 
@@ -58,8 +62,8 @@ async def authorise_supervisor(db: AsyncSession, username: str, password: str) -
     of them because it is the same question every time - who is this, and are they
     allowed to say yes.
 
-    Uses authenticate_user rather than a full login: logging in would rotate the
-    supervisor's API key and knock out whatever session they have open elsewhere.
+    Uses authenticate_user rather than a full login: logging in would issue a
+    needless API key for the supervisor.
     """
     supervisor = await authenticate_user(db, username, password)
     if supervisor is None:
@@ -75,39 +79,67 @@ async def authorise_supervisor(db: AsyncSession, username: str, password: str) -
     return supervisor
 
 
-async def login_user(db: AsyncSession, user: User) -> str:
-    """Generate (or reuse) the API key and update last_login for user.
+def hash_api_key(key: str) -> str:
+    """SHA-256 hex digest of an API key; this is all the DB ever stores."""
+    return hashlib.sha256(key.encode("utf-8")).hexdigest()
 
-    Reuses an existing key rather than rotating it on every login: the same
-    account logged in from two stations at once (a common shift-account
-    pattern here) must keep both sessions working. Rotating the key would
-    silently log the other station out.
-    """
-    api_key = user.api_key or generate_api_key()
+
+async def issue_api_key(db: AsyncSession, user: User) -> str:
+    """Create a new session key for the user and return it in clear (once)."""
+    key = generate_api_key()
+    now = utcnow()
+    # Housekeeping: drop this user's expired keys so the table does not grow forever.
     await db.execute(
-        update(User)
-        .where(User.id == user.id)
-        .values(api_key=api_key, last_login=datetime.utcnow())
+        delete(ApiKey).where(ApiKey.user_id == user.id, ApiKey.expires_at <= now)
+    )
+    db.add(
+        ApiKey(
+            user_id=user.id,
+            key_hash=hash_api_key(key),
+            created_at=now,
+            expires_at=now + timedelta(hours=settings.api_key_ttl_hours),
+            last_used_at=now,
+        )
+    )
+    await db.flush()
+    return key
+
+
+async def revoke_all_keys(db: AsyncSession, user_id: int) -> None:
+    """Invalidate every session key of a user."""
+    await db.execute(delete(ApiKey).where(ApiKey.user_id == user_id))
+    await db.flush()
+
+
+async def login_user(db: AsyncSession, user: User) -> str:
+    """Issue a new API key for this login and update last_login.
+
+    One key per login: the same account used from several stations at once
+    (#25) keeps every station working, because no login revokes another's key.
+    """
+    api_key = await issue_api_key(db, user)
+    await db.execute(
+        update(User).where(User.id == user.id).values(last_login=utcnow())
     )
     await db.flush()
     return api_key
 
 
 async def logout_user(
-    db: AsyncSession, user: User, all_sessions: bool = False
+    db: AsyncSession, user: User, key: str | None = None, all_sessions: bool = False
 ) -> None:
-    """Log out. By default a no-op on the shared API key.
-
-    Clearing the key on every logout would kick out any other station still
-    using the same shift account. `all_sessions=True` is the explicit
-    override for a supervisor who wants every session logged out.
-    """
-    if not all_sessions:
+    """Log out. Deletes only the key of this session; all_sessions=True
+    deletes every key of the user."""
+    if all_sessions:
+        await revoke_all_keys(db, user.id)
         return
-    await db.execute(
-        update(User).where(User.id == user.id).values(api_key=None)
-    )
-    await db.flush()
+    if key:
+        await db.execute(
+            delete(ApiKey).where(
+                ApiKey.user_id == user.id, ApiKey.key_hash == hash_api_key(key)
+            )
+        )
+        await db.flush()
 
 
 async def create_user(
@@ -138,11 +170,7 @@ async def create_user(
     return user
 
 
-async def regenerate_api_key(db: AsyncSession, user_id: int) -> str:
-    """Regenerate API key for a user."""
-    new_key = generate_api_key()
-    await db.execute(
-        update(User).where(User.id == user_id).values(api_key=new_key)
-    )
-    await db.flush()
-    return new_key
+async def regenerate_api_key(db: AsyncSession, user: User) -> str:
+    """Revoke every key of the user and issue a fresh one."""
+    await revoke_all_keys(db, user.id)
+    return await issue_api_key(db, user)

src/backend/services/measurement_service.py

@@ -1,6 +1,7 @@
 """Measurement service - pass/fail calculation, data storage."""
 import math
 from datetime import datetime
+from src.backend.utils.tempo import utcnow
 from decimal import Decimal
 from typing import TYPE_CHECKING
 
@@ -9,6 +10,7 @@ from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.production import ProductionEvent
 from src.backend.models.orm.recipe import Recipe, RecipeVersion
 from src.backend.models.orm.task import (
     MEASURING_TASK_TYPES, RecipeSubtask, RecipeTask,
@@ -241,6 +243,73 @@ async def task_progress(
     return progress
 
 
+async def current_cycle_measurements(
+    db: AsyncSession, run_id: int, task_id: int,
+) -> list[dict]:
+    """The quotes of a task already measured in the cycle that is under way.
+
+    A reload, a timer redirect or an auto-logout throws away what the page held in
+    memory; the operator would measure the same quotes again and the duplicates
+    would reach the SPC statistics. The cycle needs no column of its own: it starts
+    at the latest event of the run that opens one for this task - the run start, a
+    cycle_completed, or a remeasure of this task.
+
+    If a task_measured of this task follows that boundary the task is already
+    closed in this cycle and there is nothing to restore. Where a quote was measured
+    more than once, the last reading stands.
+    """
+    boundary = (await db.execute(
+        select(ProductionEvent.id, ProductionEvent.created_at)
+        .where(
+            ProductionEvent.run_id == run_id,
+            (ProductionEvent.event_type.in_(("start", "cycle_completed")))
+            | (
+                (ProductionEvent.event_type == "remeasure")
+                & (ProductionEvent.task_id == task_id)
+            ),
+        )
+        .order_by(ProductionEvent.id.desc())
+        .limit(1)
+    )).first()
+
+    event_filter = [ProductionEvent.run_id == run_id]
+    measurement_filter = [Measurement.production_run_id == run_id]
+    if boundary is not None:
+        boundary_id, boundary_at = boundary
+        event_filter.append(ProductionEvent.id > boundary_id)
+        measurement_filter.append(Measurement.measured_at > boundary_at)
+
+    closed = (await db.execute(
+        select(ProductionEvent.id).where(
+            *event_filter,
+            ProductionEvent.event_type == "task_measured",
+            ProductionEvent.task_id == task_id,
+        ).limit(1)
+    )).first()
+    if closed is not None:
+        return []
+
+    rows = (await db.execute(
+        select(Measurement)
+        .join(RecipeSubtask, RecipeSubtask.id == Measurement.subtask_id)
+        .where(*measurement_filter, RecipeSubtask.task_id == task_id)
+        .order_by(Measurement.measured_at, Measurement.id)
+    )).scalars().all()
+
+    latest: dict[int, Measurement] = {}
+    for m in rows:
+        latest[m.subtask_id] = m
+    return [
+        {
+            "subtask_id": m.subtask_id,
+            "value": float(m.value),
+            "pass_fail": m.pass_fail,
+            "measured_at": m.measured_at,
+        }
+        for m in sorted(latest.values(), key=lambda m: (m.measured_at, m.id))
+    ]
+
+
 async def validate_run_for_version(
     db: AsyncSession, run_id: int, version_id: int,
 ) -> "ProductionRun":
@@ -275,7 +344,7 @@ async def authorise_measurement(
 ) -> Measurement:
     """Let an out-of-tolerance value stand, on the supervisor's name."""
     measurement.supervisor_id = supervisor.id
-    measurement.authorised_at = datetime.now()
+    measurement.authorised_at = utcnow()
     await db.flush()
     await db.refresh(measurement)
     return measurement

src/backend/services/production_export_service.py

@@ -14,6 +14,7 @@ import csv
 import io
 import logging
 from datetime import datetime
+from src.backend.utils.tempo import iso_utc, to_local, utcnow
 from pathlib import Path
 
 from sqlalchemy import select, update
@@ -169,9 +170,9 @@ async def build_statistics_csv(db: AsyncSession, run: ProductionRun) -> str:
             measurement.input_method,
             "" if measurement.input_duration_ms is None else measurement.input_duration_ms,
             measurement.measured_by,
-            measurement.measured_at.isoformat() if measurement.measured_at else "",
+            iso_utc(measurement.measured_at),
             measurement.supervisor_id or "",
-            measurement.authorised_at.isoformat() if measurement.authorised_at else "",
+            iso_utc(measurement.authorised_at),
         ])
 
     return output.getvalue()
@@ -191,7 +192,7 @@ async def export_run_statistics(db: AsyncSession, run: ProductionRun) -> str | N
     directory = Path(settings.upload_path) / EXPORT_SUBDIR
     directory.mkdir(parents=True, exist_ok=True)
 
-    stamp = (run.closed_at or datetime.now()).strftime("%Y%m%d_%H%M%S")
+    stamp = to_local(run.closed_at or utcnow()).strftime("%Y%m%d_%H%M%S")
     filename = f"production_{run.id}_{stamp}.csv"
     # A large run's file can take a moment to write: off the event loop, so
     # closing one run does not stall every other request being served.

src/backend/services/production_service.py

@@ -14,6 +14,7 @@ the countdown would be off by the UTC offset. The number is the contract; the
 timestamp is only there for the audit trail.
 """
 from datetime import datetime, timedelta
+from src.backend.utils.tempo import utcnow
 from typing import Optional
 
 from fastapi import HTTPException, status
@@ -34,10 +35,10 @@ from src.backend.services import (
 def _now() -> datetime:
     """Single source of time for runs.
 
-    Naive local time, matching what the database writes for ``func.now()`` defaults,
+    Naive UTC, matching what the database writes for ``func.now()`` defaults,
     so a run's started_at and its deadline are comparable.
     """
-    return datetime.now()
+    return utcnow()
 
 
 # ---------------------------------------------------------------------------

src/backend/services/recipe_service.py

@@ -12,6 +12,7 @@ from src.backend.models.orm.recipe import Recipe, RecipeVersion
 from src.backend.models.orm.setting import RecipeVersionAudit
 from src.backend.models.orm.task import RecipeSubtask, RecipeTask
 from src.backend.models.orm.user import User
+from src.backend.models.orm.vision import VisionReferenceImage
 from src.backend.models.api.recipe import RecipeCreate, RecipeUpdate
 
 
@@ -118,6 +119,28 @@ async def _copy_tasks_to_version(
         db.add(new_task)
         await db.flush()  # get new_task.id
 
+        # Reference images (#38.6): the copied task points at the same files
+        # on disk as the source - same `path`, same acquisition metadata. A
+        # graph composed against a reference must keep working after the
+        # recipe is next edited, exactly like task_type/vision_json above.
+        # The file itself is only ever removed once no row references its
+        # path any more (see vision_service.file_still_referenced).
+        ref_images = (await db.execute(
+            select(VisionReferenceImage).where(VisionReferenceImage.task_id == task.id)
+        )).scalars().all()
+        for ref in ref_images:
+            db.add(VisionReferenceImage(
+                task_id=new_task.id,
+                path=ref.path,
+                station_id=ref.station_id,
+                device_code=ref.device_code,
+                calibration_snapshot=ref.calibration_snapshot,
+                engine_version=ref.engine_version,
+                note=ref.note,
+                expected_json=ref.expected_json,
+                acquired_at=ref.acquired_at,
+            ))
+
         for sub in task.subtasks:
             new_sub = RecipeSubtask(
                 task_id=new_task.id,

src/backend/services/report_service.py

@@ -2,6 +2,7 @@
 import asyncio
 import base64
 from datetime import datetime
+from src.backend.utils.tempo import to_local, utcnow
 from pathlib import Path
 
 import plotly.graph_objects as go
@@ -32,6 +33,11 @@ _jinja_env = Environment(
 )
 
 
+def _giorno_locale(dt: datetime) -> str:
+    """UTC naive filter bound -> local calendar day (YYYY-MM-DD)."""
+    return to_local(dt).strftime("%Y-%m-%d")
+
+
 async def _query_measurements(
     db: AsyncSession,
     recipe_id: int,
@@ -323,9 +329,9 @@ async def generate_spc_report(
     if version_id:
         filters_desc.append(f"Version: {version_id}")
     if date_from:
-        filters_desc.append(f"From: {date_from.strftime('%Y-%m-%d')}")
+        filters_desc.append(f"From: {_giorno_locale(date_from)}")
     if date_to:
-        filters_desc.append(f"To: {date_to.strftime('%Y-%m-%d')}")
+        filters_desc.append(f"To: {_giorno_locale(date_to)}")
     if lot_number:
         filters_desc.append(f"Lot: {lot_number}")
     if serial_number:
@@ -342,7 +348,7 @@ async def generate_spc_report(
         control_chart_svg=control_chart_svg,
         histogram_svg=histogram_svg,
         filters_desc=filters_desc,
-        generated_at=datetime.now(),
+        generated_at=to_local(utcnow()),
         n_measurements=len(measurements),
     )
 
@@ -395,7 +401,7 @@ async def generate_measurement_report(
             "value": f"{float(m.value):.4f}",
             "unit": st_info.get("unit", "mm"),
             "pass_fail": m.pass_fail,
-            "measured_at": m.measured_at.strftime("%Y-%m-%d %H:%M"),
+            "measured_at": to_local(m.measured_at).strftime("%Y-%m-%d %H:%M"),
             "operator": operator_map.get(m.measured_by, f"ID {m.measured_by}"),
             "lot_number": m.lot_number or "—",
             "serial_number": m.serial_number or "—",
@@ -414,9 +420,9 @@ async def generate_measurement_report(
     if version_id:
         filters_desc.append(f"Version: {version_id}")
     if date_from:
-        filters_desc.append(f"From: {date_from.strftime('%Y-%m-%d')}")
+        filters_desc.append(f"From: {_giorno_locale(date_from)}")
     if date_to:
-        filters_desc.append(f"To: {date_to.strftime('%Y-%m-%d')}")
+        filters_desc.append(f"To: {_giorno_locale(date_to)}")
     if lot_number:
         filters_desc.append(f"Lot: {lot_number}")
     if serial_number:
@@ -430,7 +436,7 @@ async def generate_measurement_report(
         rows=rows,
         summary=summary,
         filters_desc=filters_desc,
-        generated_at=datetime.now(),
+        generated_at=to_local(utcnow()),
         n_measurements=len(measurements),
     )
 

src/backend/services/vision_service.py

@@ -275,6 +275,22 @@ def remove_reference_file(reference: VisionReferenceImage) -> None:
     _reference_file_path(reference).unlink(missing_ok=True)
 
 
+async def file_still_referenced(db: AsyncSession, path: str) -> bool:
+    """True if some VisionReferenceImage row still points at *path*.
+
+    Copy-on-write (#38.6) can leave several rows sharing the same file on
+    disk (the copy carries over the source's `path` rather than duplicating
+    the file). The router must call this, after the row being deleted has
+    been committed, before it calls `remove_reference_file` - otherwise
+    deleting one task's reference would take the file out from under every
+    other task that still references it.
+    """
+    result = await db.execute(
+        select(VisionReferenceImage.id).where(VisionReferenceImage.path == path).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
 async def save_reference_image(
     db: AsyncSession,
     task_id: int,

src/backend/tests/conftest.py

@@ -40,7 +40,7 @@ from src.backend.models.orm.measurement import Measurement
 from src.backend.models.orm.access_log import AccessLog
 from src.backend.models.orm.setting import SystemSetting, RecipeVersionAudit
 from src.backend.models.orm.station import Station, StationRecipeAssignment
-from src.backend.services.auth_service import hash_password, generate_api_key
+from src.backend.services.auth_service import hash_password, issue_api_key
 
 # ---------------------------------------------------------------------------
 # In-memory SQLite engine for tests
@@ -142,7 +142,6 @@ async def _create_user(
     active: bool = True,
 ) -> User:
     """Insert a user into the test DB and return it with an API key set."""
-    api_key = generate_api_key()
     user = User(
         username=username,
         password_hash=hash_password(password),
@@ -150,13 +149,14 @@ async def _create_user(
         roles=roles or [],
         is_admin=is_admin,
         active=active,
-        api_key=api_key,
         language_pref="en",
         theme_pref="light",
     )
     session.add(user)
     await session.flush()
     await session.refresh(user)
+    # Clear key of this test session; the DB only keeps its hash.
+    user.plain_key = await issue_api_key(session, user)
     return user
 
 
@@ -278,4 +278,4 @@ async def create_test_recipe(
 
 def auth_headers(user: User) -> dict[str, str]:
     """Return headers dict with the user's API key for authenticated requests."""
-    return {"X-API-Key": user.api_key}
+    return {"X-API-Key": user.plain_key}

src/backend/tests/test_auth.py

@@ -78,75 +78,114 @@ class TestLogin:
         assert len(api_key) >= 32
 
 
-class TestLoginKeyReuse:
-    """login_user reuses an existing api_key instead of rotating it (#25)."""
+class TestLoginKeyPerSession:
+    """Each login issues its own key; none revokes another (#25, #41)."""
 
-    async def test_two_logins_same_user_share_api_key(
+    async def test_two_logins_same_user_get_distinct_valid_keys(
         self, client: AsyncClient, db_session
     ):
-        """Two stations logging in as the same shift account both keep working."""
         await _create_user(db_session, username="twostations", password="TwoStations1")
-        resp1 = await client.post(
-            "/api/auth/login",
-            json={"username": "twostations", "password": "TwoStations1"},
-        )
-        resp2 = await client.post(
-            "/api/auth/login",
-            json={"username": "twostations", "password": "TwoStations1"},
-        )
-        assert resp1.status_code == 200
-        assert resp2.status_code == 200
-        assert resp1.json()["api_key"] == resp2.json()["api_key"]
+        creds = {"username": "twostations", "password": "TwoStations1"}
+        resp1 = await client.post("/api/auth/login", json=creds)
+        resp2 = await client.post("/api/auth/login", json=creds)
+        k1, k2 = resp1.json()["api_key"], resp2.json()["api_key"]
+        assert k1 != k2
+        for k in (k1, k2):
+            resp = await client.get("/api/auth/me", headers={"X-API-Key": k})
+            assert resp.status_code == 200
 
-    async def test_login_generates_key_when_user_has_none(
+    async def test_db_stores_hash_never_clear_key(
         self, client: AsyncClient, db_session
     ):
-        """A user created without an api_key (e.g. via create_user) still gets one."""
-        from src.backend.services.auth_service import create_user
+        from sqlalchemy import select
+        from src.backend.models.orm.api_key import ApiKey
+        from src.backend.services.auth_service import hash_api_key
 
-        await create_user(
-            db_session, username="brandnew", password="BrandNew1",
-            display_name="Brand New",
-        )
+        await _create_user(db_session, username="hashed", password="HashedPass1")
         resp = await client.post(
-            "/api/auth/login",
-            json={"username": "brandnew", "password": "BrandNew1"},
+            "/api/auth/login", json={"username": "hashed", "password": "HashedPass1"}
         )
+        key = resp.json()["api_key"]
+        hashes = (await db_session.execute(select(ApiKey.key_hash))).scalars().all()
+        assert hash_api_key(key) in hashes
+        assert key not in hashes
+        assert all(len(h) == 64 for h in hashes)
+
+    async def test_expired_key_gives_401(self, client: AsyncClient, db_session):
+        from datetime import timedelta
+        from sqlalchemy import update
+        from src.backend.models.orm.api_key import ApiKey
+        from src.backend.services.auth_service import utcnow
+
+        user = await _create_user(db_session, username="expired", password="ExpiredPass1")
+        await db_session.execute(
+            update(ApiKey).values(expires_at=utcnow() - timedelta(minutes=1))
+        )
+        resp = await client.get("/api/auth/me", headers=auth_headers(user))
+        assert resp.status_code == 401
+        assert "expired" in resp.json()["detail"].lower()
+
+    async def test_use_renews_expiry_only_after_interval(
+        self, client: AsyncClient, db_session
+    ):
+        from datetime import timedelta
+        from sqlalchemy import select, update
+        from src.backend.models.orm.api_key import ApiKey
+        from src.backend.services.auth_service import utcnow
+
+        user = await _create_user(db_session, username="renew", password="RenewPass1")
+        headers = auth_headers(user)
+        old = utcnow() - timedelta(hours=10)
+
+        # Recent use: no write, expiry untouched.
+        recent = utcnow() - timedelta(minutes=1)
+        await db_session.execute(
+            update(ApiKey).values(expires_at=old + timedelta(hours=24), last_used_at=recent)
+        )
+        await client.get("/api/auth/me", headers=headers)
+        row = (await db_session.execute(select(ApiKey))).scalar_one()
+        await db_session.refresh(row)
+        assert row.last_used_at == recent
+
+        # Stale last use: expiry is pushed forward.
+        await db_session.execute(
+            update(ApiKey).values(last_used_at=utcnow() - timedelta(minutes=10))
+        )
+        before = utcnow()
+        resp = await client.get("/api/auth/me", headers=headers)
         assert resp.status_code == 200
-        assert resp.json()["api_key"]
+        await db_session.refresh(row)
+        assert row.expires_at >= before + timedelta(hours=23, minutes=59)
 
 
 class TestLogout:
-    """POST /api/auth/logout is a no-op on the shared api_key by default (#25)."""
+    """Logout deletes only this session's key (#41)."""
 
-    async def test_logout_default_keeps_api_key_valid(
-        self, client: AsyncClient, db_session
-    ):
-        user = await _create_user(
-            db_session, username="shared_logout", password="SharedPass1"
-        )
-        headers = auth_headers(user)
-        resp = await client.post("/api/auth/logout", headers=headers)
+    async def test_logout_removes_only_own_key(self, client: AsyncClient, db_session):
+        await _create_user(db_session, username="shared_logout", password="SharedPass1")
+        creds = {"username": "shared_logout", "password": "SharedPass1"}
+        k1 = (await client.post("/api/auth/login", json=creds)).json()["api_key"]
+        k2 = (await client.post("/api/auth/login", json=creds)).json()["api_key"]
+        resp = await client.post("/api/auth/logout", headers={"X-API-Key": k1})
         assert resp.status_code == 204
 
-        # The key is still valid: another station on the same account keeps working.
-        resp = await client.get("/api/auth/me", headers=headers)
-        assert resp.status_code == 200
+        assert (await client.get("/api/auth/me", headers={"X-API-Key": k1})).status_code == 401
+        assert (await client.get("/api/auth/me", headers={"X-API-Key": k2})).status_code == 200
 
-    async def test_logout_all_sessions_invalidates_api_key(
+    async def test_logout_all_sessions_removes_every_key(
         self, client: AsyncClient, db_session
     ):
-        user = await _create_user(
-            db_session, username="shared_logout_all", password="SharedPass1"
-        )
-        headers = auth_headers(user)
+        await _create_user(db_session, username="shared_logout_all", password="SharedPass1")
+        creds = {"username": "shared_logout_all", "password": "SharedPass1"}
+        k1 = (await client.post("/api/auth/login", json=creds)).json()["api_key"]
+        k2 = (await client.post("/api/auth/login", json=creds)).json()["api_key"]
         resp = await client.post(
-            "/api/auth/logout", params={"all_sessions": "true"}, headers=headers
+            "/api/auth/logout", params={"all_sessions": "true"},
+            headers={"X-API-Key": k1},
         )
         assert resp.status_code == 204
-
-        resp = await client.get("/api/auth/me", headers=headers)
-        assert resp.status_code == 401
+        for k in (k1, k2):
+            assert (await client.get("/api/auth/me", headers={"X-API-Key": k})).status_code == 401
 
 
 class TestAuthenticateUserTiming:
@@ -185,3 +224,69 @@ class TestHealthAndAuth:
         resp = await client.get("/api/users")
         assert resp.status_code == 401
         assert "API key" in resp.json()["detail"] or "Missing" in resp.json()["detail"]
+
+
+class TestRevokeAllKeys:
+    """Password change, deactivation and regenerate invalidate every key (#41)."""
+
+    async def _two_keys(self, client, db_session, name):
+        user = await _create_user(db_session, username=name, password="KeysPass123")
+        creds = {"username": name, "password": "KeysPass123"}
+        keys = [
+            (await client.post("/api/auth/login", json=creds)).json()["api_key"]
+            for _ in range(2)
+        ]
+        return user, keys
+
+    async def _all_401(self, client, keys):
+        for k in keys:
+            resp = await client.get("/api/auth/me", headers={"X-API-Key": k})
+            assert resp.status_code == 401
+
+    async def test_password_change_invalidates_all(self, client, db_session, admin_user):
+        user, keys = await self._two_keys(client, db_session, "pwkeys")
+        resp = await client.put(
+            f"/api/users/{user.id}/password",
+            headers=auth_headers(admin_user), json={"password": "NewSecurePass1"},
+        )
+        assert resp.status_code == 200
+        await self._all_401(client, keys)
+
+    async def test_deactivation_invalidates_all(self, client, db_session, admin_user):
+        user, keys = await self._two_keys(client, db_session, "offkeys")
+        resp = await client.delete(
+            f"/api/users/{user.id}", headers=auth_headers(admin_user)
+        )
+        assert resp.status_code == 204
+        await self._all_401(client, keys)
+
+    async def test_regenerate_invalidates_old_keys(self, client, db_session, admin_user):
+        user, keys = await self._two_keys(client, db_session, "regenkeys")
+        resp = await client.post(
+            f"/api/users/{user.id}/regenerate-key", headers=auth_headers(admin_user)
+        )
+        assert resp.status_code == 200
+        await self._all_401(client, keys)
+        new = resp.json()["api_key"]
+        assert (await client.get("/api/auth/me", headers={"X-API-Key": new})).status_code == 200
+
+
+class TestExpiredKeyCleanup:
+    async def test_expired_key_removed_at_next_login(self, client, db_session):
+        from datetime import timedelta
+        from sqlalchemy import select, update
+        from src.backend.models.orm.api_key import ApiKey
+        from src.backend.services.auth_service import hash_api_key, utcnow
+
+        user = await _create_user(db_session, username="cleanup", password="CleanPass123")
+        old_hash = hash_api_key(user.plain_key)
+        await db_session.execute(
+            update(ApiKey).values(expires_at=utcnow() - timedelta(minutes=1))
+        )
+        resp = await client.post(
+            "/api/auth/login", json={"username": "cleanup", "password": "CleanPass123"}
+        )
+        assert resp.status_code == 200
+        hashes = (await db_session.execute(select(ApiKey.key_hash))).scalars().all()
+        assert old_hash not in hashes
+        assert len(hashes) == 1

src/backend/tests/test_current_cycle.py

@@ -0,0 +1,172 @@
+"""#40: after a reload, the quotes already measured in the cycle come back.
+
+The cycle has no column of its own: it opens at the latest start, cycle_completed
+or remeasure-of-this-task event of the run, and a task_measured of the task after
+that boundary means the task is closed in this cycle.
+"""
+from datetime import datetime, timedelta
+
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.production import ProductionEvent, ProductionRun
+from src.backend.models.orm.recipe import RecipeVersion
+from src.backend.models.orm.station import Station
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+T0 = datetime(2026, 10, 1, 8, 0, 0)
+
+
+async def _setup(db, user):
+    recipe = await create_test_recipe(db, user.id)
+    version = (await db.execute(
+        select(RecipeVersion).where(
+            RecipeVersion.recipe_id == recipe.id, RecipeVersion.is_current == True,  # noqa: E712
+        )
+    )).scalar_one()
+    task = (await db.execute(
+        select(RecipeTask).where(RecipeTask.version_id == version.id)
+    )).scalars().first()
+    first = (await db.execute(
+        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
+    )).scalars().first()
+    second = RecipeSubtask(
+        task_id=task.id, marker_number=2, description="Quota 2",
+        nominal=10.0, utl=10.5, uwl=10.3, lwl=9.7, ltl=9.5, unit="mm",
+    )
+    db.add(second)
+    station = Station(code="ST-CYC", name="St", active=True, created_by=user.id)
+    db.add(station)
+    await db.commit()
+    run = ProductionRun(
+        station_id=station.id, recipe_id=recipe.id, version_id=version.id,
+        operator_id=user.id, status="running", active_station_id=station.id,
+    )
+    db.add(run)
+    await db.commit()
+    return run, version, task, first, second
+
+
+async def _event(db, run, user, kind, minutes, task_id=None):
+    db.add(ProductionEvent(
+        run_id=run.id, event_type=kind, user_id=user.id, task_id=task_id,
+        created_at=T0 + timedelta(minutes=minutes),
+    ))
+    await db.commit()
+
+
+async def _meas(db, run, version, subtask, user, minutes, value=10.0):
+    db.add(Measurement(
+        subtask_id=subtask.id, version_id=version.id, measured_by=user.id,
+        value=value, pass_fail="pass", production_run_id=run.id,
+        measured_at=T0 + timedelta(minutes=minutes),
+    ))
+    await db.commit()
+
+
+async def _get(client, user, run, task):
+    resp = await client.get(
+        "/api/measurements/current-cycle", headers=auth_headers(user),
+        params={"production_run_id": run.id, "task_id": task.id},
+    )
+    assert resp.status_code == 200
+    return resp.json()["measurements"]
+
+
+async def test_only_second_cycle_after_cycle_completed(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    await _event(db_session, run, u, "start", 0)
+    await _meas(db_session, run, version, q1, u, 1, 10.1)
+    await _meas(db_session, run, version, q2, u, 2, 10.2)
+    await _event(db_session, run, u, "cycle_completed", 3)
+    await _meas(db_session, run, version, q1, u, 4, 10.3)
+
+    rows = await _get(client, u, run, task)
+    assert [(r["subtask_id"], r["value"]) for r in rows] == [(q1.id, 10.3)]
+    assert rows[0]["pass_fail"] == "pass"
+
+
+async def test_last_reading_of_a_quote_wins(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    await _event(db_session, run, u, "start", 0)
+    await _meas(db_session, run, version, q1, u, 1, 10.1)
+    await _meas(db_session, run, version, q1, u, 2, 10.4)
+
+    rows = await _get(client, u, run, task)
+    assert [(r["subtask_id"], r["value"]) for r in rows] == [(q1.id, 10.4)]
+
+
+async def test_remeasure_of_the_task_empties_the_list(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    await _event(db_session, run, u, "start", 0)
+    await _meas(db_session, run, version, q1, u, 1)
+    await _event(db_session, run, u, "remeasure", 2, task_id=task.id)
+
+    assert await _get(client, u, run, task) == []
+
+
+async def test_remeasure_of_another_task_does_not_move_the_boundary(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    other = RecipeTask(
+        version_id=version.id, title="Altro", task_type=task.task_type, order_index=9,
+    )
+    db_session.add(other)
+    await db_session.commit()
+    await _event(db_session, run, u, "start", 0)
+    await _meas(db_session, run, version, q1, u, 1)
+    await _event(db_session, run, u, "remeasure", 2, task_id=other.id)
+
+    assert len(await _get(client, u, run, task)) == 1
+
+
+async def test_task_measured_after_boundary_means_closed(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    await _event(db_session, run, u, "start", 0)
+    await _meas(db_session, run, version, q1, u, 1)
+    await _meas(db_session, run, version, q2, u, 2)
+    await _event(db_session, run, u, "task_measured", 3, task_id=task.id)
+
+    assert await _get(client, u, run, task) == []
+
+
+async def test_task_measured_before_boundary_does_not_close_next_cycle(
+    client: AsyncClient, db_session, measurement_tec_user,
+):
+    u = measurement_tec_user
+    run, version, task, q1, q2 = await _setup(db_session, u)
+    await _event(db_session, run, u, "start", 0)
+    await _event(db_session, run, u, "task_measured", 1, task_id=task.id)
+    await _event(db_session, run, u, "cycle_completed", 2)
+    await _meas(db_session, run, version, q1, u, 3)
+
+    assert len(await _get(client, u, run, task)) == 1
+
+
+async def test_permissions(client: AsyncClient, db_session, measurement_tec_user, maker_user):
+    run, _v, task, _q1, _q2 = await _setup(db_session, measurement_tec_user)
+    params = {"production_run_id": run.id, "task_id": task.id}
+
+    no_key = await client.get("/api/measurements/current-cycle", params=params)
+    assert no_key.status_code in (401, 403)
+
+    forbidden = await client.get(
+        "/api/measurements/current-cycle", headers=auth_headers(maker_user), params=params,
+    )
+    assert forbidden.status_code == 403

src/backend/tests/test_migrations.py

@@ -107,3 +107,27 @@ class TestBaseMigrationNoopsOnExistingSchema:
         assert "image_path" in {
             c["name"] for c in insp.get_columns("recipes")
         }
+
+
+class TestApiKeyHashMigration:
+    """015_api_key_hash: users.api_key -> api_keys table, and back (#41)."""
+
+    def test_015_upgrade_and_downgrade(self, sqlite_database_url):
+        db_path, _ = sqlite_database_url
+        cfg = _alembic_config()
+        command.upgrade(cfg, "head")
+
+        insp = _inspect(db_path)
+        assert "api_keys" in insp.get_table_names()
+        assert "api_key" not in {c["name"] for c in insp.get_columns("users")}
+        assert {c["name"] for c in insp.get_columns("api_keys")} >= {
+            "user_id", "key_hash", "created_at", "expires_at", "last_used_at",
+        }
+
+        command.downgrade(cfg, "014_vision_fk_ondelete")
+        insp = _inspect(db_path)
+        assert "api_keys" not in insp.get_table_names()
+        assert "api_key" in {c["name"] for c in insp.get_columns("users")}
+
+        command.upgrade(cfg, "head")  # and up again
+        assert "api_keys" in _inspect(db_path).get_table_names()

src/backend/tests/test_task_cleanup_animated_run_filter.py

@@ -0,0 +1,120 @@
+"""#43: reference files removed with their task, animated images refused,
+GET /api/measurements filtered by production run."""
+import io
+
+import pytest
+from PIL import Image
+from sqlalchemy import select
+
+from src.backend.config import settings
+from src.backend.models.orm.measurement import Measurement
+from src.backend.models.orm.vision import VisionReferenceImage
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+from src.backend.tests.test_vision_upload_limits import a_png, recipe_parts
+
+
+@pytest.fixture(autouse=True)
+def redirect_uploads(monkeypatch, tmp_path):
+    monkeypatch.setattr(settings, "upload_dir", str(tmp_path))
+
+
+async def _upload_reference(client, user, task_id):
+    resp = await client.post(
+        "/api/vision/reference-images", headers=auth_headers(user),
+        files={"image": ("p.png", a_png(), "image/png")},
+        data={"task_id": str(task_id)},
+    )
+    assert resp.status_code in (200, 201), resp.text
+
+
+@pytest.mark.asyncio
+async def test_delete_task_removes_the_reference_file(client, db_session, maker_user):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, _ = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+    await _upload_reference(client, maker_user, task.id)
+    ref = (await db_session.execute(select(VisionReferenceImage))).scalars().one()
+    path = settings.upload_path / ref.path
+    assert path.exists()
+
+    resp = await client.delete(f"/api/tasks/{task.id}", headers=auth_headers(maker_user))
+
+    assert resp.status_code == 204
+    assert not path.exists()
+
+
+@pytest.mark.asyncio
+async def test_delete_task_keeps_a_file_another_task_still_references(
+    client, db_session, maker_user,
+):
+    r1 = await create_test_recipe(db_session, maker_user.id)
+    r2 = await create_test_recipe(db_session, maker_user.id, code="REC-002")
+    _, t1, _ = await recipe_parts(db_session, r1.id)
+    _, t2, _ = await recipe_parts(db_session, r2.id)
+    await db_session.commit()
+    await _upload_reference(client, maker_user, t1.id)
+    ref = (await db_session.execute(select(VisionReferenceImage))).scalars().one()
+    db_session.add(VisionReferenceImage(task_id=t2.id, path=ref.path))
+    await db_session.commit()
+    path = settings.upload_path / ref.path
+
+    resp = await client.delete(f"/api/tasks/{t1.id}", headers=auth_headers(maker_user))
+
+    assert resp.status_code == 204
+    assert path.exists()
+
+
+def _animated(fmt: str, frames: int) -> bytes:
+    imgs = [Image.new("L", (16, 16), color=i * 40) for i in range(frames)]
+    buf = io.BytesIO()
+    imgs[0].save(buf, format=fmt, save_all=True, append_images=imgs[1:], duration=50)
+    return buf.getvalue()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("fmt,mime,frames,expected", [
+    ("GIF", "image/gif", 2, 422),
+    ("WEBP", "image/webp", 2, 422),
+    ("GIF", "image/gif", 1, 201),
+])
+async def test_animated_images_are_refused(
+    client, db_session, maker_user, fmt, mime, frames, expected,
+):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    _, task, _ = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+
+    resp = await client.post(
+        "/api/vision/reference-images", headers=auth_headers(maker_user),
+        files={"image": ("a", _animated(fmt, frames), mime)},
+        data={"task_id": str(task.id)},
+    )
+
+    if expected == 422:
+        assert resp.status_code == 422
+        assert "animated" in resp.json()["detail"]
+    else:
+        assert resp.status_code in (200, 201), resp.text
+
+
+@pytest.mark.asyncio
+async def test_measurements_filter_by_production_run(client, db_session, maker_user):
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    version, _, subtask = await recipe_parts(db_session, recipe.id)
+    for run in (7, 7, 8, None):
+        db_session.add(Measurement(
+            subtask_id=subtask.id, version_id=version.id, measured_by=maker_user.id,
+            value=1.0, pass_fail="pass", deviation=0.0, input_method="manual",
+            production_run_id=run,
+        ))
+    await db_session.commit()
+
+    resp = await client.get(
+        "/api/measurements/", headers=auth_headers(maker_user),
+        params={"production_run_id": 7},
+    )
+
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["total"] == 2
+    assert {m["production_run_id"] for m in body["items"]} == {7}

src/backend/tests/test_tasks.py

@@ -73,6 +73,45 @@ class TestCreateTask:
         assert len(data["subtasks"]) == 1
         assert data["subtasks"][0]["description"] == "Surface roughness"
 
+    async def test_create_task_on_version_with_measurements_has_recipe_id(
+        self,
+        client: AsyncClient,
+        maker_user: User,
+        measurement_tec_user: User,
+        db_session: AsyncSession,
+    ):
+        """Copy-on-write branch (gitea#4): TaskResponse.recipe_id must not crash."""
+        recipe = await create_test_recipe(db_session, maker_user.id, code="COW-CT")
+        task = (await client.get(
+            f"/api/recipes/{recipe.id}/tasks", headers=auth_headers(maker_user),
+        )).json()[0]
+        subtask_id = task["subtasks"][0]["id"]
+        assert (await _measure(
+            client, measurement_tec_user, subtask_id, task["version_id"]
+        )).status_code == 200
+
+        resp = await client.post(
+            f"/api/recipes/{recipe.id}/tasks",
+            headers=auth_headers(maker_user),
+            json={
+                "title": "New Task After Measurement",
+                "subtasks": [
+                    {
+                        "marker_number": 1,
+                        "description": "Surface roughness",
+                        "nominal": 5.0,
+                        "utl": 5.5,
+                        "ltl": 4.5,
+                        "unit": "um",
+                    }
+                ],
+            },
+        )
+        assert resp.status_code == 201, resp.text
+        data = resp.json()
+        assert data["recipe_id"] == recipe.id
+        assert data["version_id"] != task["version_id"]
+
 
 class TestUpdateTask:
     """PUT /api/tasks/{task_id} tests."""

src/backend/tests/test_tempo.py

@@ -0,0 +1,113 @@
+"""UTC in the DB, explicit +00:00 on the wire, local time only on presentation (#42)."""
+from datetime import datetime, timezone
+from unittest.mock import patch
+
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.models.orm.user import User
+from src.backend.services import report_service
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+from src.backend.utils.tempo import as_utc_naive, to_local, utcnow
+
+
+def test_utcnow_naive_and_close_to_utc():
+    now = utcnow()
+    assert now.tzinfo is None
+    delta = datetime.now(timezone.utc).replace(tzinfo=None) - now
+    assert abs(delta.total_seconds()) < 5
+
+
+def test_as_utc_naive():
+    parsed = datetime.fromisoformat("2026-10-06T10:00:00+02:00")
+    assert as_utc_naive(parsed) == datetime(2026, 10, 6, 8, 0)
+    assert as_utc_naive(parsed).tzinfo is None
+    naive = datetime(2026, 10, 6, 8, 0)
+    assert as_utc_naive(naive) is naive
+    assert as_utc_naive(None) is None
+
+
+def test_to_local_is_rome():
+    assert to_local(datetime(2026, 10, 6, 8, 0)).strftime("%H:%M %z") == "10:00 +0200"
+    assert to_local(datetime(2026, 1, 6, 8, 0)).strftime("%H:%M %z") == "09:00 +0100"
+
+
+async def _make_measurement(client, user, recipe_id) -> None:
+    tasks = (await client.get(f"/api/recipes/{recipe_id}/tasks", headers=auth_headers(user))).json()
+    await client.post(
+        "/api/measurements/",
+        headers=auth_headers(user),
+        json={
+            "subtask_id": tasks[0]["subtasks"][0]["id"],
+            "version_id": tasks[0]["version_id"],
+            "value": 10.0,
+        },
+    )
+
+
+async def test_api_datetimes_carry_utc_offset_and_filter_equivalence(
+    client: AsyncClient,
+    measurement_tec_user: User,
+    metrologist_user: User,
+    db_session: AsyncSession,
+):
+    recipe = await create_test_recipe(db_session, measurement_tec_user.id)
+    await _make_measurement(client, measurement_tec_user, recipe.id)
+
+    resp = await client.get("/api/measurements/", headers=auth_headers(metrologist_user))
+    item = resp.json()["items"][0]
+    assert item["measured_at"].endswith("+00:00")
+
+    # Same instant written with +02:00 and as UTC: identical results.
+    future_utc = "2099-01-01T08:00:00+00:00"
+    future_rome = "2099-01-01T10:00:00+02:00"
+    past_utc = "2000-01-01T08:00:00+00:00"
+    past_rome = "2000-01-01T10:00:00+02:00"
+    for frm, to in ((past_utc, future_utc), (past_rome, future_rome)):
+        r = await client.get(
+            "/api/measurements/",
+            headers=auth_headers(metrologist_user),
+            params={"date_from": frm, "date_to": to},
+        )
+        assert r.status_code == 200
+        assert r.json()["total"] == 1
+
+    # Boundary: measurement is "now" in UTC; a date_from 1h ahead in UTC,
+    # written as +02:00 (now+3h local wall clock), must exclude it.
+    ahead = (utcnow().replace(microsecond=0)).replace(tzinfo=timezone.utc)
+    from datetime import timedelta
+    ahead_utc = (ahead + timedelta(hours=1)).isoformat()
+    ahead_rome = (ahead + timedelta(hours=1)).astimezone(
+        timezone(timedelta(hours=2))
+    ).isoformat()
+    totals = []
+    for frm in (ahead_utc, ahead_rome):
+        r = await client.get(
+            "/api/measurements/",
+            headers=auth_headers(metrologist_user),
+            params={"date_from": frm},
+        )
+        totals.append(r.json()["total"])
+    assert totals == [0, 0]
+
+
+async def test_report_generated_at_is_local_time(
+    db_session: AsyncSession, metrologist_user: User
+):
+    recipe = await create_test_recipe(db_session, metrologist_user.id)
+    captured: dict[str, str] = {}
+
+    def fake_render(html: str) -> bytes:
+        captured["html"] = html
+        return b"%PDF"
+
+    with patch.object(report_service, "utcnow", return_value=datetime(2026, 10, 6, 8, 0)), \
+            patch.object(report_service, "_render_pdf", side_effect=fake_render):
+        await report_service.generate_measurement_report(db_session, recipe.id)
+
+    assert "Generated 2026-10-06 10:00" in captured["html"]
+
+
+def test_report_filter_day_is_local():
+    """UTC naive 22:00 of Oct 5 is already Oct 6 in Europe/Rome (#42)."""
+    assert report_service._giorno_locale(datetime(2026, 10, 5, 22, 0, 0)) == "2026-10-06"

src/backend/tests/test_user_password_endpoint.py

@@ -17,7 +17,7 @@ class TestChangeUserPassword:
 
         the same as setup.py's change-user-password (setup.py:634).
         """
-        old_key = maker_user.api_key
+        old_key = maker_user.plain_key
         old_username = maker_user.username
         assert old_key is not None
 
@@ -31,7 +31,7 @@ class TestChangeUserPassword:
 
         # The old key no longer authenticates. Read it before the request
         # above: the client and app share one session (see conftest), so
-        # `maker_user.api_key` in this process reflects the mutation too.
+        # `maker_user.plain_key` in this process reflects the mutation too.
         resp2 = await client.get("/api/auth/me", headers={"X-API-Key": old_key})
         assert resp2.status_code == 401
 

src/backend/tests/test_vision_reference.py

@@ -192,6 +192,78 @@ async def test_deleting_an_unknown_reference_image_is_404(
     assert response.status_code == 404
 
 
+@pytest.mark.asyncio
+async def test_copy_on_write_carries_over_reference_images(
+    client, db_session, maker_user, measurement_tec_user,
+):
+    """#38.6: a copy-on-write version must list the source task's reference
+    images (same path, same metadata), and the file is removed only once no
+    row references it any more."""
+    recipe = await create_test_recipe(db_session, maker_user.id)
+    version, task, subtask = await recipe_parts(db_session, recipe.id)
+    await db_session.commit()
+
+    created = await client.post(
+        "/api/vision/reference-images",
+        headers=auth_headers(maker_user),
+        files={"image": ("ref.png", an_image(), "image/png")},
+        data={"task_id": str(task.id), "note": "orig"},
+    )
+    assert created.status_code == 200
+    old_reference_id = created.json()["id"]
+    path = created.json()["path"]
+    file_path = settings.upload_path / path
+    assert file_path.exists()
+
+    # A measurement on v1 forces the next PUT onto the copy-on-write path.
+    measured = await client.post(
+        "/api/measurements/",
+        headers=auth_headers(measurement_tec_user),
+        json={"subtask_id": subtask.id, "version_id": version.id, "value": 10.0},
+    )
+    assert measured.status_code == 200
+
+    resp = await client.put(
+        f"/api/recipes/{recipe.id}",
+        headers=auth_headers(maker_user),
+        json={"change_notes": "Edit after measurement"},
+    )
+    assert resp.status_code == 200, resp.text
+
+    db_session.expunge_all()
+    new_version, new_task, _ = await recipe_parts(db_session, recipe.id)
+    assert new_version.version_number == 2
+
+    listing = await client.get(
+        "/api/vision/reference-images",
+        headers=auth_headers(maker_user),
+        params={"task_id": new_task.id},
+    )
+    assert listing.status_code == 200
+    body = listing.json()
+    assert len(body) == 1
+    assert body[0]["path"] == path
+    assert body[0]["note"] == "orig"
+    new_reference_id = body[0]["id"]
+    assert new_reference_id != old_reference_id
+
+    # Two rows share the same file: deleting one must leave it in place.
+    del1 = await client.delete(
+        f"/api/vision/reference-images/{old_reference_id}",
+        headers=auth_headers(maker_user),
+    )
+    assert del1.status_code == 204
+    assert file_path.exists()
+
+    # Deleting the last row referencing the path removes the file too.
+    del2 = await client.delete(
+        f"/api/vision/reference-images/{new_reference_id}",
+        headers=auth_headers(maker_user),
+    )
+    assert del2.status_code == 204
+    assert not file_path.exists()
+
+
 @pytest.mark.asyncio
 async def test_preview_runs_the_graph_and_saves_no_measurement(
     client, db_session, maker_user, worker_says,

src/backend/utils/tempo.py

@@ -0,0 +1,34 @@
+"""Time helpers: the DB holds naive UTC, presentation converts to display_timezone (#42)."""
+from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
+
+from src.backend.config import settings
+
+
+def utcnow() -> datetime:
+    """Naive UTC now (the whole DB moves to naive UTC, #42)."""
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+def as_utc_naive(dt: datetime | None) -> datetime | None:
+    """Aware -> UTC naive; naive is taken as UTC already; None stays None."""
+    if dt is None or dt.tzinfo is None:
+        return dt
+    return dt.astimezone(timezone.utc).replace(tzinfo=None)
+
+
+def to_utc_aware(dt: datetime) -> datetime:
+    """Naive (UTC) or aware datetime -> aware UTC."""
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+
+def iso_utc(dt: datetime | None) -> str:
+    """ISO 8601 with explicit +00:00; "" for None (CSV cells)."""
+    return to_utc_aware(dt).isoformat() if dt else ""
+
+
+def to_local(dt: datetime) -> datetime:
+    """Naive UTC (or aware) datetime -> aware datetime in settings.display_timezone."""
+    return to_utc_aware(dt).astimezone(ZoneInfo(settings.display_timezone))

src/frontend/flask_app/app.py

@@ -2,7 +2,8 @@
 import json
 import os
 import re
-from datetime import date
+from datetime import date, datetime, timezone
+from zoneinfo import ZoneInfo
 from urllib.parse import urlparse
 
 from flask import Flask, flash, g, jsonify, redirect, url_for, session, request
@@ -154,6 +155,26 @@ def create_app() -> Flask:
         bolded = _BOLD_RX.sub(r"<strong>\1</strong>", escaped)
         return Markup(bolded.replace("\n", "<br>"))
 
+    @app.template_filter("local_dt")
+    def local_dt_filter(value, fmt="%d/%m/%Y %H:%M"):
+        """Show a UTC datetime (ISO string or datetime) in DISPLAY_TIMEZONE.
+
+        A value without timezone is taken as UTC. None or empty gives "-".
+        """
+        if value is None or value == "":
+            return "-"
+        if isinstance(value, str):
+            try:
+                value = datetime.fromisoformat(value.strip().replace("Z", "+00:00"))
+            except ValueError:
+                return value
+        if not isinstance(value, datetime):
+            return str(value)
+        if value.tzinfo is None:
+            value = value.replace(tzinfo=timezone.utc)
+        tz = ZoneInfo(app.config.get("DISPLAY_TIMEZONE") or "Europe/Rome")
+        return value.astimezone(tz).strftime(fmt)
+
     @app.template_filter("tojson_attr")
     def tojson_attr_filter(value):
         """JSON encode safe for HTML attributes (x-data, etc.).

src/frontend/flask_app/blueprints/measure.py

@@ -1,8 +1,10 @@
 """MeasurementTec blueprint - recipe selection and measurement execution."""
 import urllib.parse
 
+import requests as http_requests
+
 from flask import (
-    Blueprint, abort, flash, jsonify, redirect, render_template,
+    Blueprint, Response, abort, flash, jsonify, redirect, render_template,
     request, session, url_for,
 )
 from flask_babel import gettext as _
@@ -386,14 +388,12 @@ def task_complete(recipe_id: int):
     # Load measurements if version_id provided
     measurements = []
     if version_id:
-        # Scoped to this measurement session, not the whole version (#30): a
-        # second production run on the same recipe version used to pull in
-        # every other station's/day's readings too. GET /api/measurements has
-        # no production_run_id filter yet (that's lotto A3), so lot/serial +
-        # the current operator is the closest available identity - MANCA:
-        # once the backend accepts production_run_id, prefer it when the
-        # active run is known (see _current_run_id()).
+        # Scoped to this measurement session, not the whole version (#30): the
+        # active production run when known, else lot/serial + current operator.
         params = {"version_id": version_id, "per_page": 500}
+        run_id = _current_run_id()
+        if run_id:
+            params["production_run_id"] = run_id
         if lot_number:
             params["lot_number"] = lot_number
         if serial_number:
@@ -565,6 +565,72 @@ def save_measurement():
     return jsonify(resp), 201
 
 
+# ---------------------------------------------------------------------------
+# Route: task progress (#37.8) - browser cannot call the backend directly
+# (X-API-Key), same as every other /api/* proxy in this file.
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/task-progress/<int:task_id>", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_task_progress(task_id: int):
+    """Proxy: how many quotes of this task are already measured.
+
+    Reuses _task_progress() - same version_id/production_run_id scoping as
+    task_list.html's badges - so this answers with exactly the counts
+    (quotes/measured/state) the backend can give without conflating one
+    cycle with another; it does not, and cannot, say which quotes or with
+    what values (task-progress is an aggregate, not a per-subtask list).
+    """
+    task_resp = api_client.get(f"/api/tasks/{task_id}")
+    if isinstance(task_resp, dict) and task_resp.get("error"):
+        return jsonify(task_resp), task_resp.get("status_code", 500)
+
+    recipe_id = task_resp.get("recipe_id")
+    if recipe_id and not _recipe_allowed_at_station(recipe_id):
+        abort(403, description=_("Ricetta non assegnata a questa stazione"))
+
+    version_id = task_resp.get("version_id")
+    progress = _task_progress(version_id, _current_run_id())
+    row = progress.get(task_id, {
+        "task_id": task_id, "quotes": 0, "measured": 0, "state": "empty",
+    })
+    return jsonify(row), 200
+
+
+# ---------------------------------------------------------------------------
+# Route: quotes already measured in the current cycle (#40)
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/current-cycle/<int:task_id>", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_current_cycle(task_id: int):
+    """Proxy: quotes of this task already measured in the cycle under way.
+
+    The run comes from _current_run_id(), like the rest of the page. Outside a
+    production there is no cycle to restore and the answer is an empty list.
+    """
+    task_resp = api_client.get(f"/api/tasks/{task_id}")
+    if isinstance(task_resp, dict) and task_resp.get("error"):
+        return jsonify(task_resp), task_resp.get("status_code", 500)
+
+    recipe_id = task_resp.get("recipe_id")
+    if recipe_id and not _recipe_allowed_at_station(recipe_id):
+        abort(403, description=_("Ricetta non assegnata a questa stazione"))
+
+    run_id = _current_run_id()
+    if not run_id:
+        return jsonify({"measurements": []}), 200
+
+    resp = api_client.get(
+        "/api/measurements/current-cycle",
+        params={"production_run_id": run_id, "task_id": task_id},
+    )
+    if not isinstance(resp, dict) or resp.get("error"):
+        # Never fatal: without the restore the screen behaves as it always did.
+        return jsonify({"measurements": []}), 200
+    return jsonify(resp), 200
+
+
 # ---------------------------------------------------------------------------
 # Routes: Out-of-tolerance authorisation (point 5)
 # ---------------------------------------------------------------------------
@@ -756,3 +822,67 @@ def api_close_production(run_id: int):
 def api_get_file(file_path: str):
     """Proxy: Serve file from API server (browser can't send X-API-Key)."""
     return proxy_file(file_path)
+
+
+# ---------------------------------------------------------------------------
+# Route: vision execute (#46) - the browser sends an image, we relay it to
+# POST /api/vision/execute (multipart) because it cannot send X-API-Key itself.
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/vision/execute", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_vision_execute():
+    """Proxy: run the task's VisionSuite recipe on the uploaded image."""
+    image = request.files.get("image")
+    task_id = request.form.get("task_id")
+    if image is None or not task_id:
+        return jsonify({
+            "error": True,
+            "detail": _("Dati mancanti: task_id e image sono obbligatori"),
+        }), 400
+
+    # Same context fields as the manual flow; empty ones are left out so the
+    # backend sees them as absent rather than as "".
+    form = {"task_id": task_id}
+    for key in ("task_type", "lot_number", "serial_number", "production_run_id"):
+        val = request.form.get(key)
+        if val:
+            form[key] = val
+    form.setdefault("lot_number", session.get("lot_number", ""))
+    form.setdefault("serial_number", session.get("serial_number", ""))
+
+    resp = api_client.post(
+        "/api/vision/execute",
+        data=form,
+        files={"image": (
+            image.filename or "capture.jpg",
+            image.read(),
+            image.mimetype or "application/octet-stream",
+        )},
+    )
+    if resp.get("error"):
+        status_code = resp.get("status_code", 500)
+        body = {"error": True, "detail": resp.get("detail", _("Errore nell'esecuzione"))}
+        if resp.get("session_expired"):
+            body["session_expired"] = True
+        return jsonify(body), status_code if status_code >= 400 else 500
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/vision/results/<int:result_id>/image", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_vision_result_image(result_id: int):
+    """Proxy: the image saved with a vision result (needs X-API-Key)."""
+    base_url = Config.API_SERVER_URL.rstrip("/")
+    resp = http_requests.get(
+        f"{base_url}/api/vision/results/{result_id}/image",
+        headers={"X-API-Key": session.get("api_key", "")},
+        timeout=30,
+    )
+    if resp.status_code != 200:
+        return Response(resp.text, status=resp.status_code)
+    return Response(
+        resp.content,
+        content_type=resp.headers.get("content-type", "application/octet-stream"),
+    )

src/frontend/flask_app/config.py

@@ -56,6 +56,8 @@ class Config:
     # Babel i18n
     BABEL_DEFAULT_LOCALE = "it"
     BABEL_DEFAULT_TIMEZONE = "Europe/Rome"
+    # Il DB e le API parlano UTC; si converte solo alla presentazione.
+    DISPLAY_TIMEZONE: str = os.getenv("DISPLAY_TIMEZONE", "Europe/Rome")
     LANGUAGES = {"it": "Italiano", "en": "English"}
 
 

src/frontend/flask_app/static/js/csv-export.js

@@ -271,7 +271,7 @@ function csvExport() {
      */
     generateFilename(prefix) {
       const now = new Date();
-      const dateStr = now.toISOString().slice(0, 10); // YYYY-MM-DD
+      const dateStr = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`; // YYYY-MM-DD locale
       const timeStr = now.toTimeString().slice(0, 5).replace(':', ''); // HHMM
 
       return `${prefix}_${dateStr}_${timeStr}.csv`;

src/frontend/flask_app/static/js/vision_execute.js

@@ -0,0 +1,125 @@
+/**
+ * Vision execute - Alpine component for camera_measure / dxf_compare tasks (#46).
+ *
+ * The operator takes (or picks) an image, `acquire(blob)` sends it to the Flask
+ * proxy, and the result - quote table, outcome, failures, overlay - is shown on
+ * the image. `acquire(blob)` is the single entry point on purpose: the agent
+ * camera (#3) will call it with its own blob and reuse everything below.
+ *
+ * Config comes from window.__visionCfg (set by the template):
+ *   executeUrl, imageUrlTpl (with a 0 placeholder for the result id), taskId,
+ *   taskType, subtasks, labels.
+ * Run context (lot, serial, production run) is read lazily through `ctx()`,
+ * which the template binds to the parent task component.
+ */
+function visionExecute() {
+  // Overlay colour per role (VisionSuite roles: reference, roi, found).
+  const ROLE_COLORS = { reference: '#2563eb', found: '#16a34a', roi: '#f59e0b' };
+
+  return {
+    busy: false,
+    error: '',
+    result: null,      // last execute response
+    imageSrc: '',      // object URL of the acquired image (shown under the overlay)
+    ctx: () => ({}),   // replaced by the template: {lot, serial, runId}
+
+    // Entry point shared with the future agent camera.
+    async acquire(blob) {
+      if (!blob || this.busy) return;
+      const cfg = window.__visionCfg || {};
+      this.busy = true;
+      this.error = '';
+      this.result = null;
+      // Show the picked image at once: the overlay is drawn on top when the result arrives.
+      if (this.imageSrc) URL.revokeObjectURL(this.imageSrc);
+      this.imageSrc = URL.createObjectURL(blob);
+      try {
+        const c = this.ctx() || {};
+        const fd = new FormData();
+        fd.append('task_id', cfg.taskId);
+        fd.append('task_type', cfg.taskType || '');
+        fd.append('image', blob, blob.name || 'capture.jpg');
+        fd.append('lot_number', c.lot || '');
+        fd.append('serial_number', c.serial || '');
+        if (c.runId) fd.append('production_run_id', c.runId);
+        const csrf = document.querySelector('meta[name=csrf-token]')?.content || '';
+        const resp = await fetch(cfg.executeUrl, {
+          method: 'POST', headers: { 'X-CSRFToken': csrf }, body: fd,
+        });
+        const body = await resp.json().catch(() => ({}));
+        if (!resp.ok || body.error) {
+          this.error = body.detail || (cfg.labels && cfg.labels.requestFailed) || 'Error';
+          return;
+        }
+        this.result = body;
+        // Draw once Alpine has rendered the canvas.
+        this.$nextTick(() => this.drawOverlay());
+      } catch (e) {
+        this.error = (cfg.labels && cfg.labels.requestFailed) || 'Error';
+      } finally {
+        this.busy = false;
+      }
+    },
+
+    // Input change: take the file and allow picking the same one again.
+    onPick(ev) {
+      const f = ev.target.files && ev.target.files[0];
+      ev.target.value = '';
+      if (f) this.acquire(f);
+    },
+
+    // Image shown: the saved one from the server when available, else the local one.
+    get shownImage() {
+      const cfg = window.__visionCfg || {};
+      if (this.result && this.result.vision_result_id && cfg.imageUrlTpl) {
+        return cfg.imageUrlTpl.replace('/0/', '/' + this.result.vision_result_id + '/');
+      }
+      return this.imageSrc;
+    },
+
+    // Quote rows: server measurements joined with the subtask names.
+    get rows() {
+      const cfg = window.__visionCfg || {};
+      const subs = cfg.subtasks || [];
+      return ((this.result && this.result.measurements) || []).map((m) => {
+        const st = subs.find((s) => s.id === m.subtask_id) || {};
+        return {
+          label: (st.marker_number ? st.marker_number + '. ' : '') + (st.measurement_type || st.name || '#' + m.subtask_id),
+          value: m.value,
+          unit: st.unit || 'mm',
+          status: m.pass_fail,
+        };
+      });
+    },
+
+    statusClass(s) {
+      // Same palette as the measurement markers of the manual flow.
+      if (s === 'pass') return 'bg-measure-pass/20 text-measure-pass border border-measure-pass/40';
+      if (s === 'fail') return 'bg-red-100 dark:bg-red-900/30 text-measure-fail border border-measure-fail/40';
+      if (s === 'warning') return 'bg-amber-100 dark:bg-amber-900/30 text-measure-warning border border-measure-warning/40';
+      return 'bg-[var(--bg-secondary)] text-[var(--text-muted)] border border-[var(--border-color)]';
+    },
+
+    // Canvas is sized to the natural image, so overlay coordinates (image px)
+    // are used as they are and CSS scales the whole thing to the displayed size.
+    drawOverlay() {
+      const img = this.$refs.img, cv = this.$refs.overlay;
+      if (!img || !cv || !img.naturalWidth) return;
+      cv.width = img.naturalWidth;
+      cv.height = img.naturalHeight;
+      const g = cv.getContext('2d');
+      g.clearRect(0, 0, cv.width, cv.height);
+      g.lineWidth = Math.max(2, cv.width / 400);
+      g.lineJoin = 'round';
+      for (const item of ((this.result && this.result.overlay) || [])) {
+        const rows = item.rows || [], cols = item.cols || [];
+        if (!rows.length || rows.length !== cols.length) continue;
+        g.strokeStyle = ROLE_COLORS[item.role] || '#ef4444';
+        g.beginPath();
+        g.moveTo(cols[0], rows[0]);
+        for (let i = 1; i < rows.length; i++) g.lineTo(cols[i], rows[i]);
+        g.stroke();
+      }
+    },
+  };
+}

src/frontend/flask_app/templates/maker/task_editor.html

@@ -1156,6 +1156,15 @@ function taskEditor() {
       // Sort tasks by order_index on load
       this.tasks.sort((a, b) => (a.order_index || 0) - (b.order_index || 0));
 
+      // Show the notice left by _reloadForNewVersion() before its reload (gitea#4).
+      try {
+        var versionNotice = sessionStorage.getItem('taskEditorVersionNotice');
+        if (versionNotice) {
+          sessionStorage.removeItem('taskEditorVersionNotice');
+          this.successMessage = versionNotice;
+        }
+      } catch (_e) { /* sessionStorage unavailable - notice just does not show */ }
+
       // Check if returning from task_drawing with updated annotations
       try {
         var updatedRaw = sessionStorage.getItem('taskDrawingUpdated');
@@ -1193,6 +1202,27 @@ function taskEditor() {
       return document.querySelector('meta[name="csrf-token"]')?.content || '';
     },
 
+    // ============================================================
+    // Version conflict (gitea#4)
+    //
+    // Copy-on-write on a version with measurements creates NEW ids for its
+    // task/subtasks. The first save after that happens silently (200/201,
+    // new ids in the response); a save that still targets an id from before
+    // gets 409 "Cannot modify a non-current version". Both cases are fixed
+    // the same way: reload, so the editor starts fresh from the current
+    // version instead of patching a local state that copy-on-write already
+    // moved out from under it.
+    // ============================================================
+    _reloadForNewVersion() {
+      try {
+        sessionStorage.setItem(
+          'taskEditorVersionNotice',
+          {{ _("La ricetta ha una nuova versione: pagina ricaricata")|tojson }}
+        );
+      } catch (_e) { /* sessionStorage unavailable - reload still happens */ }
+      window.location.reload();
+    },
+
     // ============================================================
     // Render Task Preview (deferred)
     // ============================================================
@@ -1341,6 +1371,7 @@ function taskEditor() {
           })
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         const data = await resp.json();
 
         if (data.error) {
@@ -1399,10 +1430,16 @@ function taskEditor() {
           })
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         const data = await resp.json();
 
         if (data.error) {
           this.errorMessage = data.detail || {{ _("Errore nel salvataggio del task")|tojson }};
+        } else if (data.id !== taskId) {
+          // Copy-on-write happened silently: this task, and every other one
+          // in the recipe, now has a different id than what is in local state.
+          this._reloadForNewVersion();
+          return;
         } else {
           // Update local state
           const idx = this.tasks.findIndex(t => t.id === taskId);
@@ -1440,6 +1477,7 @@ function taskEditor() {
           headers: { 'X-CSRFToken': this.csrfToken() }
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         if (resp.ok || resp.status === 204) {
           this.tasks = this.tasks.filter(t => t.id !== taskId);
           this.deleteTaskModal = false;
@@ -1540,6 +1578,7 @@ function taskEditor() {
           body: JSON.stringify({ task_ids: taskIds })
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         const data = await resp.json();
 
         if (data.error) {
@@ -1608,10 +1647,16 @@ function taskEditor() {
           body: JSON.stringify(payload)
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         const data = await resp.json();
 
         if (data.error) {
           this.errorMessage = data.detail || {{ _("Errore nella creazione della misurazione")|tojson }};
+        } else if (data.task_id !== taskId) {
+          // Copy-on-write happened silently: this task, and every other one
+          // in the recipe, now has a different id than what is in local state.
+          this._reloadForNewVersion();
+          return;
         } else {
           const task = this.tasks.find(t => t.id === taskId);
           if (task) {
@@ -1679,10 +1724,16 @@ function taskEditor() {
           body: JSON.stringify(payload)
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         const data = await resp.json();
 
         if (data.error) {
           this.errorMessage = data.detail || {{ _("Errore nel salvataggio della misurazione")|tojson }};
+        } else if (data.task_id !== taskId) {
+          // Copy-on-write happened silently: this task, and every other one
+          // in the recipe, now has a different id than what is in local state.
+          this._reloadForNewVersion();
+          return;
         } else {
           // Update local state
           const task = this.tasks.find(t => t.id === taskId);
@@ -1719,6 +1770,7 @@ function taskEditor() {
           headers: { 'X-CSRFToken': this.csrfToken() }
         });
 
+        if (resp.status === 409) { this._reloadForNewVersion(); return; }
         if (resp.ok || resp.status === 204) {
           const task = this.tasks.find(t => t.id === taskId);
           if (task && task.subtasks) {
@@ -1796,6 +1848,7 @@ function taskEditor() {
           })
         });
 
+        if (updateResp.status === 409) { this._reloadForNewVersion(); return; }
         const updateData = await updateResp.json();
         if (updateData.error) {
           this.errorMessage = updateData.detail || {{ _("Errore nel salvataggio del task")|tojson }};

src/frontend/flask_app/templates/measure/task_complete.html

@@ -183,7 +183,7 @@
                     {% for m in measurements|sort(attribute='subtask.marker_number')|sort(attribute='task_info.order_index') %}
                     <tr>
                         <td class="text-center font-mono text-xs" style="color: var(--text-secondary);">
-                            {{ m.measured_at[:16]|replace('T', ' ') if m.measured_at else '-' }}
+                            {{ m.measured_at|local_dt }}
                         </td>
                         <td style="color: var(--text-secondary);" class="text-sm">
                             {{ m.task_info.title if m.task_info else '-' }}

src/frontend/flask_app/templates/measure/task_execute.html

@@ -191,7 +191,8 @@
   {# ================================================================
      MAIN — 3-column layout
      ================================================================ #}
-  <div class="flex-1 flex overflow-hidden">
+  {# #46: camera_measure / dxf_compare get the acquisition panel below instead of the manual layout #}
+  <div class="flex-1 flex overflow-hidden" x-show="!isVisionTask">
 
     {# ──────────────────────────────────────────────
        LEFT SIDEBAR — Marker list (vertical, hidden when no subtasks)
@@ -451,6 +452,63 @@
 
   </div>
 
+  {# ================================================================
+     VISION PANEL (#46) - acquire an image, run the recipe server-side, show the
+     quotes and the overlay. acquire(blob) is the entry point the agent camera
+     (#3) will reuse.
+     ================================================================ #}
+  <div x-show="isVisionTask" x-cloak
+       x-data="visionExecute()"
+       x-init="ctx = () => ({ lot: lotNumber, serial: serialNumber, runId: productionRun ? productionRun.id : null })"
+       class="flex-1 overflow-auto p-3 flex flex-col lg:flex-row gap-3">
+
+    <div class="flex-1 min-w-0 flex flex-col gap-2">
+      <div class="flex items-center gap-2 flex-wrap">
+        {# On a tablet this opens the camera; on a PC it picks a file. «Riprova» reuses the same input. #}
+        <label class="btn btn-primary text-sm gap-1.5 cursor-pointer" :class="busy ? 'opacity-50 pointer-events-none' : ''">
+          <span x-text="result ? '{{ _('Riprova') }}' : '{{ _('Acquisisci immagine') }}'"></span>
+          <input type="file" accept="image/*" capture="environment" class="hidden"
+                 @change="onPick($event)" :disabled="busy">
+        </label>
+        <span x-show="busy" class="text-sm text-[var(--text-muted)]">{{ _('Elaborazione in corso...') }}</span>
+      </div>
+
+      <div x-show="error" class="p-2 rounded-lg bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 text-sm text-measure-fail" x-text="error"></div>
+
+      <div x-show="shownImage" class="relative border border-[var(--border-color)] rounded-lg overflow-hidden bg-black/5">
+        <img x-ref="img" :src="shownImage" @load="drawOverlay()" alt="" class="block w-full h-auto">
+        <canvas x-ref="overlay" class="absolute inset-0 w-full h-full pointer-events-none"></canvas>
+      </div>
+      <div x-show="!shownImage" class="text-sm text-[var(--text-muted)]">
+        {{ _('Nessuna immagine acquisita: premi «Acquisisci immagine».') }}
+      </div>
+    </div>
+
+    <div class="lg:w-80 shrink-0 flex flex-col gap-2" x-show="result">
+      <div class="text-sm font-bold text-[var(--text-primary)]">
+        {{ _('Esito') }}: <span x-text="(result && result.outcome) || '-'"></span>
+      </div>
+
+      <table class="w-full text-sm" x-show="rows.length">
+        <template x-for="r in rows" :key="r.label">
+          <tr>
+            <td class="py-1 pr-2 text-[var(--text-secondary)]" x-text="r.label"></td>
+            <td class="py-1 pr-2 font-mono text-right" x-text="Number(r.value).toFixed(3) + ' ' + r.unit"></td>
+            <td class="py-1"><span class="inline-block px-2 py-0.5 rounded text-xs font-bold" :class="statusClass(r.status)" x-text="r.status"></span></td>
+          </tr>
+        </template>
+      </table>
+
+      <div x-show="result && result.failures && result.failures.length"
+           class="p-2 rounded-lg bg-amber-50 dark:bg-amber-900/20 border border-amber-300 dark:border-amber-700 text-xs">
+        <div class="font-bold mb-1">{{ _('Strumenti falliti') }}</div>
+        <template x-for="f in ((result && result.failures) || [])" :key="f.tool_id">
+          <div><span class="font-mono" x-text="f.tool_name || f.tool_id"></span>: <span x-text="f.error"></span></div>
+        </template>
+      </div>
+    </div>
+  </div>
+
   {# ================================================================
      MEASUREMENT TIMER BANNER
      ================================================================ #}
@@ -912,6 +970,18 @@
 <script src="{{ url_for('static', filename='js/numpad.js') }}"></script>
 <script src="{{ url_for('static', filename='js/annotation-viewer.js') }}?v=6"></script>
 <script src="{{ url_for('static', filename='js/caliper.js') }}"></script>
+{# #46: acquisition + overlay for camera_measure / dxf_compare #}
+<script>
+  window.__visionCfg = {
+    executeUrl: '{{ url_for("measure.api_vision_execute") }}',
+    imageUrlTpl: '{{ url_for("measure.api_vision_result_image", result_id=0) }}',
+    taskId: {{ task.id|tojson }},
+    taskType: {{ (task.task_type or '')|tojson }},
+    subtasks: window.__taskSubtasks,
+    labels: { requestFailed: {{ _('Richiesta non riuscita')|tojson }} },
+  };
+</script>
+<script src="{{ url_for('static', filename='js/vision_execute.js') }}"></script>
 {# The clock's rules - how a delay reads, when the buzzer goes, where the
    measurement lives - are shared with the other screens rather than restated. #}
 <script src="{{ url_for('static', filename='js/production-clock.js') }}"></script>
@@ -1100,6 +1170,7 @@ function taskExecute() {
       this.inputStartedAt = Date.now();
       // Rejoin whatever production is already open at this station.
       await this.loadProductionRun();
+      await this.loadCurrentCycle();
       await this.loadPendingAuthorisation();
       // A tablet left to sleep drifts (#37.7): catch the countdown back up to
       // the server's own clock, the same source adoptProductionRun already
@@ -1110,6 +1181,42 @@ function taskExecute() {
       });
     },
 
+    /* Quotes already measured in the cycle under way (#40).
+
+       A reload, a timer redirect or an auto-logout used to bring every quote back
+       and measuring them again put duplicates in the SPC statistics. Only inside
+       a production: outside one there is no cycle, and the screen starts empty as
+       it always did. */
+    async loadCurrentCycle() {
+      if (!this.isMeasureTask || !this.subtasks.length || !this.productionRun) return;
+      try {
+        const resp = await fetch(
+          '{{ url_for("measure.api_current_cycle", task_id=task.id) }}',
+        );
+        if (!resp.ok) return;
+        const data = await resp.json();
+        const known = new Set(this.subtasks.map(s => s.id));
+        const restored = (data.measurements || []).filter(m => known.has(m.subtask_id));
+        if (!restored.length) return;
+        this.measurements = restored.map(m => {
+          const st = this.subtasks.find(s => s.id === m.subtask_id);
+          const nominal = st ? (st.nominal || 0) : 0;
+          return {
+            subtask_id: m.subtask_id,
+            value: m.value,
+            pass_fail: m.pass_fail,
+            deviation: m.value - nominal,
+          };
+        });
+        const next = this.subtasks.findIndex(
+          s => !this.measurements.some(m => m.subtask_id === s.id),
+        );
+        this.currentIndex = next !== -1 ? next : this.subtasks.length - 1;
+      } catch (e) {
+        // Offline: the screen starts empty, as before.
+      }
+    },
+
     /* Is a quote already waiting for the capoturno?
 
        Reloading the page was the simplest way past the old gate. It is not one
@@ -1739,6 +1846,12 @@ function taskExecute() {
       return declared === 'measure' || declared === 'camera_measure';
     },
 
+    /* #46: image-based tasks run a VisionSuite recipe on the server. */
+    get isVisionTask() {
+      const t = this.task.task_type;
+      return t === 'camera_measure' || t === 'dxf_compare';
+    },
+
     /* A measurement task with no quotes yet: the recipe is unfinished. Said out
        loud rather than silently rendering an empty screen. */
     get isMeasureTaskWithoutQuotes() {

src/frontend/flask_app/templates/statistics/dashboard.html

@@ -312,8 +312,8 @@ function spcDashboard() {
       const params = new URLSearchParams();
       params.set('recipe_id', this.selectedRecipeId);
       if (this.selectedSubtaskId) params.set('subtask_id', this.selectedSubtaskId);
-      if (this.dateFrom) params.set('date_from', this.dateFrom + 'T00:00:00');
-      if (this.dateTo) params.set('date_to', this.dateTo + 'T23:59:59');
+      if (this.dateFrom) params.set('date_from', new Date(this.dateFrom + 'T00:00:00').toISOString());
+      if (this.dateTo) params.set('date_to', new Date(this.dateTo + 'T23:59:59.999').toISOString());
 
       try {
         // Parallel fetch of all endpoints
@@ -417,8 +417,8 @@ function spcDashboard() {
         const params = new URLSearchParams();
         params.set('recipe_id', this.selectedRecipeId);
         if (this.selectedSubtaskId) params.set('subtask_id', this.selectedSubtaskId);
-        if (this.dateFrom) params.set('date_from', this.dateFrom + 'T00:00:00');
-        if (this.dateTo) params.set('date_to', this.dateTo + 'T23:59:59');
+        if (this.dateFrom) params.set('date_from', new Date(this.dateFrom + 'T00:00:00').toISOString());
+        if (this.dateTo) params.set('date_to', new Date(this.dateTo + 'T23:59:59.999').toISOString());
 
         const url = '/statistics/api/report-' + type + '?' + params.toString();
         const resp = await fetch(url);

src/frontend/flask_app/tests/test_local_dt.py

@@ -0,0 +1,31 @@
+"""Filtro local_dt: il backend parla UTC, la presentazione e' in Europe/Rome (#42)."""
+from datetime import datetime, timezone
+
+import pytest
+
+
+@pytest.fixture
+def local_dt(flask_app):
+    return flask_app.jinja_env.filters["local_dt"]
+
+
+def test_summer_time(local_dt):
+    assert local_dt("2026-10-06T08:00:00+00:00") == "06/10/2026 10:00"
+
+
+def test_winter_time(local_dt):
+    assert local_dt("2026-01-15T08:00:00+00:00") == "15/01/2026 09:00"
+
+
+def test_naive_is_utc(local_dt):
+    assert local_dt("2026-10-06T08:00:00") == "06/10/2026 10:00"
+
+
+def test_datetime_object_and_format(local_dt):
+    dt = datetime(2026, 10, 6, 8, 0, tzinfo=timezone.utc)
+    assert local_dt(dt, "%H:%M") == "10:00"
+
+
+@pytest.mark.parametrize("empty", [None, ""])
+def test_empty(local_dt, empty):
+    assert local_dt(empty) == "-"

src/frontend/flask_app/tests/test_maker.py

@@ -121,3 +121,43 @@ class TestRecipeEdit:
         resp = logged_in_client.get("/maker/recipes/999/edit", follow_redirects=False)
         assert resp.status_code == 302
         assert "/maker/recipes" in resp.headers["Location"]
+
+
+class TestVersionConflictProxy:
+    """gitea#4: a 409 from the backend (edit targeting a non-current version,
+    left behind by an earlier copy-on-write) must reach the browser as a 409 -
+    task_editor.html's _reloadForNewVersion() only triggers on that status.
+    """
+
+    _CONFLICT = {
+        "error": True,
+        "status_code": 409,
+        "detail": "Cannot modify a non-current version. Create a new version first.",
+    }
+
+    def test_update_task_proxies_409(self, logged_in_client, mock_api_client):
+        mock_api_client.put.return_value = self._CONFLICT
+
+        resp = logged_in_client.put("/maker/api/tasks/11", json={"title": "x"})
+
+        assert resp.status_code == 409
+        assert resp.get_json()["detail"] == self._CONFLICT["detail"]
+
+    def test_update_subtask_proxies_409(self, logged_in_client, mock_api_client):
+        mock_api_client.put.return_value = self._CONFLICT
+
+        resp = logged_in_client.put("/maker/api/subtasks/21", json={"nominal": 1.0})
+
+        assert resp.status_code == 409
+        assert resp.get_json()["detail"] == self._CONFLICT["detail"]
+
+    def test_create_subtask_proxies_409(self, logged_in_client, mock_api_client):
+        mock_api_client.post.return_value = self._CONFLICT
+
+        resp = logged_in_client.post(
+            "/maker/api/tasks/11/subtasks",
+            json={"marker_number": 1, "description": "x"},
+        )
+
+        assert resp.status_code == 409
+        assert resp.get_json()["detail"] == self._CONFLICT["detail"]

src/frontend/flask_app/tests/test_measure.py

@@ -167,6 +167,148 @@ class TestTaskList:
         assert "Misura" in resp.get_data(as_text=True)
 
 
+class TestApiTaskProgress:
+    """GET /measure/api/task-progress/<task_id> tests (gitea#37.8).
+
+    The browser cannot call /api/measurements/task-progress directly (no
+    X-API-Key); this proxy forwards it with the same version_id/
+    production_run_id scoping _task_progress() already uses for task_list.
+    """
+
+    @pytest.fixture(autouse=True)
+    def _station_configured(self, monkeypatch):
+        monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
+
+    def test_returns_this_task_progress_row(self, logged_in_client, mock_api_client):
+        mock_api_client.get_station_recipes.return_value = [{"id": 1}]
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+            "/api/production-runs/current": None,
+            "/api/measurements/task-progress": {
+                "tasks": [{"task_id": 7, "quotes": 3, "measured": 1, "state": "partial"}],
+            },
+        })
+
+        resp = logged_in_client.get("/measure/api/task-progress/7")
+
+        assert resp.status_code == 200
+        assert resp.get_json() == {
+            "task_id": 7, "quotes": 3, "measured": 1, "state": "partial",
+        }
+        # No production run open: the backend call must not carry a
+        # production_run_id it would then use to scope by the wrong cycle.
+        progress_call = next(
+            call for call in mock_api_client.get.call_args_list
+            if call.args[0] == "/api/measurements/task-progress"
+        )
+        assert progress_call.kwargs["params"] == {"version_id": 42}
+
+    def test_task_absent_from_progress_defaults_to_empty(
+        self, logged_in_client, mock_api_client,
+    ):
+        """A task with no quotes yet has no row in the backend's answer."""
+        mock_api_client.get_station_recipes.return_value = [{"id": 1}]
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+            "/api/production-runs/current": None,
+            "/api/measurements/task-progress": {"tasks": []},
+        })
+
+        resp = logged_in_client.get("/measure/api/task-progress/7")
+
+        assert resp.status_code == 200
+        assert resp.get_json() == {
+            "task_id": 7, "quotes": 0, "measured": 0, "state": "empty",
+        }
+
+    def test_refuses_a_recipe_not_assigned_to_this_station(
+        self, logged_in_client, mock_api_client,
+    ):
+        """Same #24 guard task_execute() uses: no bypass through this proxy."""
+        mock_api_client.get_station_recipes.return_value = [{"id": 99}]
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+        })
+
+        resp = logged_in_client.get("/measure/api/task-progress/7")
+
+        assert resp.status_code == 403
+
+    def test_propagates_a_task_not_found(self, logged_in_client, mock_api_client):
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/999": {"error": True, "status_code": 404, "detail": "not found"},
+        })
+
+        resp = logged_in_client.get("/measure/api/task-progress/999")
+
+        assert resp.status_code == 404
+
+    def test_requires_login(self, client):
+        resp = client.get("/measure/api/task-progress/7")
+        assert resp.status_code in (302, 401)
+
+
+class TestApiCurrentCycle:
+    """GET /measure/api/current-cycle/<task_id> (gitea#40)."""
+
+    @pytest.fixture(autouse=True)
+    def _station_configured(self, monkeypatch):
+        monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
+
+    def test_forwards_run_and_task(self, logged_in_client, mock_api_client):
+        mock_api_client.get_station_recipes.return_value = [{"id": 1}]
+        payload = {"measurements": [
+            {"subtask_id": 3, "value": 10.1, "pass_fail": "pass",
+             "measured_at": "2026-10-01T08:01:00"},
+        ]}
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+            "/api/production-runs/current": {"id": 5},
+            "/api/measurements/current-cycle": payload,
+        })
+
+        resp = logged_in_client.get("/measure/api/current-cycle/7")
+
+        assert resp.status_code == 200
+        assert resp.get_json() == payload
+        call = next(
+            c for c in mock_api_client.get.call_args_list
+            if c.args[0] == "/api/measurements/current-cycle"
+        )
+        assert call.kwargs["params"] == {"production_run_id": 5, "task_id": 7}
+
+    def test_no_run_means_empty_and_no_backend_call(
+        self, logged_in_client, mock_api_client,
+    ):
+        mock_api_client.get_station_recipes.return_value = [{"id": 1}]
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+            "/api/production-runs/current": None,
+        })
+
+        resp = logged_in_client.get("/measure/api/current-cycle/7")
+
+        assert resp.get_json() == {"measurements": []}
+        assert not any(
+            c.args[0] == "/api/measurements/current-cycle"
+            for c in mock_api_client.get.call_args_list
+        )
+
+    def test_refuses_a_recipe_not_assigned_to_this_station(
+        self, logged_in_client, mock_api_client,
+    ):
+        mock_api_client.get_station_recipes.return_value = [{"id": 99}]
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/tasks/7": {"id": 7, "recipe_id": 1, "version_id": 42},
+        })
+
+        assert logged_in_client.get("/measure/api/current-cycle/7").status_code == 403
+
+    def test_requires_login(self, client):
+        resp = client.get("/measure/api/current-cycle/7")
+        assert resp.status_code in (302, 401)
+
+
 class TestStartSequence:
     """GET /measure/start/<recipe_id> — the operator's way in."""
 
@@ -257,6 +399,7 @@ class TestTaskComplete:
             # The summary serialises the version number, so the recipe carries one.
             {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
             [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": []}],
+            None,                                                   # current run
             {"items": []},                                          # measurements
         ]
 
@@ -264,6 +407,21 @@ class TestTaskComplete:
         assert resp.status_code == 200
         assert b"productionClock(" in resp.data
 
+    def test_measured_at_shown_in_local_time(self, logged_in_client, mock_api_client):
+        """#42: the API sends UTC; the summary shows Europe/Rome."""
+        mock_api_client.get.side_effect = [
+            {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
+            [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": [
+                {"id": 1, "marker_number": 1, "description": "d", "nominal": 1.0,
+                 "unit": "mm"}]}],
+            None,
+            {"items": [{"id": 1, "subtask_id": 1, "value": 1.0, "pass_fail": "pass",
+                        "measured_at": "2026-10-06T08:00:00+00:00"}]},
+        ]
+        resp = logged_in_client.get("/measure/complete/1?version_id=5")
+        assert resp.status_code == 200
+        assert "06/10/2026 10:00" in resp.get_data(as_text=True)
+
     def test_measurements_filtered_by_lot_serial_and_operator(
         self, logged_in_client, mock_api_client,
     ):
@@ -276,13 +434,14 @@ class TestTaskComplete:
         mock_api_client.get.side_effect = [
             {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
             [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": []}],
+            None,                                                   # current run
             {"items": [], "pages": 1},
         ]
 
         resp = logged_in_client.get("/measure/complete/1?version_id=5")
         assert resp.status_code == 200
 
-        endpoint, kwargs = mock_api_client.get.call_args_list[2]
+        endpoint, kwargs = mock_api_client.get.call_args_list[3]
         assert endpoint[0] == "/api/measurements"
         params = kwargs["params"]
         assert params["version_id"] == "5"
@@ -290,6 +449,24 @@ class TestTaskComplete:
         assert params["serial_number"] == "S1"
         assert params["measured_by"] == 1  # session["user_id"] from the fixture
 
+    def test_measurements_filtered_by_the_active_production_run(
+        self, logged_in_client, mock_api_client,
+    ):
+        """#43: when the station has a run open, the summary asks for that run."""
+        mock_api_client.get.side_effect = [
+            {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
+            [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": []}],
+            {"id": 77},                                             # current run
+            {"items": [], "pages": 1},
+        ]
+
+        resp = logged_in_client.get("/measure/complete/1?version_id=5")
+        assert resp.status_code == 200
+
+        endpoint, kwargs = mock_api_client.get.call_args_list[3]
+        assert endpoint[0] == "/api/measurements"
+        assert kwargs["params"]["production_run_id"] == 77
+
     def test_measurements_without_lot_or_serial_still_scope_to_the_operator(
         self, logged_in_client, mock_api_client,
     ):
@@ -298,13 +475,14 @@ class TestTaskComplete:
         mock_api_client.get.side_effect = [
             {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
             [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": []}],
+            None,                                                   # current run
             {"items": [], "pages": 1},
         ]
 
         resp = logged_in_client.get("/measure/complete/1?version_id=5")
         assert resp.status_code == 200
 
-        endpoint, kwargs = mock_api_client.get.call_args_list[2]
+        endpoint, kwargs = mock_api_client.get.call_args_list[3]
         params = kwargs["params"]
         assert "lot_number" not in params
         assert "serial_number" not in params
@@ -323,15 +501,16 @@ class TestTaskComplete:
         mock_api_client.get.side_effect = [
             {"id": 1, "code": "REC-001", "name": "Test Recipe", "version": 1},
             [{"id": 1, "title": "Task 1", "order_index": 0, "subtasks": [subtask]}],
+            None,                                                   # current run
             page1,
             page2,
         ]
 
         resp = logged_in_client.get("/measure/complete/1?version_id=5")
         assert resp.status_code == 200
-        assert mock_api_client.get.call_count == 4
-        first_page_call = mock_api_client.get.call_args_list[2]
-        second_page_call = mock_api_client.get.call_args_list[3]
+        assert mock_api_client.get.call_count == 5
+        first_page_call = mock_api_client.get.call_args_list[3]
+        second_page_call = mock_api_client.get.call_args_list[4]
         assert first_page_call.kwargs["params"]["page"] == 1
         assert second_page_call.kwargs["params"]["page"] == 2
 

src/frontend/flask_app/tests/test_measure_vision.py

@@ -0,0 +1,86 @@
+"""gitea:Adriano/TieMeasureFlow#46 - operator side of the vision tasks.
+
+The backend of contract B is not merged yet: api_client is mocked.
+"""
+import io
+from unittest.mock import MagicMock, patch
+
+from tests.conftest import api_get_router
+
+TASK = {
+    "id": 12, "recipe_id": 3, "version_id": 5, "task_type": "camera_measure",
+    "title": "Foto", "directive": None, "description": None, "file_path": None,
+    "file_type": None, "annotations_json": None, "subtasks": [],
+}
+RECIPE = {
+    "id": 3, "code": "REC-1", "name": "Ricetta",
+    "measurement_interval_minutes": 30, "allow_manual_input": True,
+    "current_version": {"id": 5, "version_number": 1},
+}
+
+
+def test_execute_page_has_acquire_input(logged_in_client, mock_api_client, monkeypatch):
+    """camera_measure screen offers the file/camera input and the acquire entry point."""
+    monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
+    mock_api_client.get_station_recipes.return_value = {"items": [{"id": 3}]}
+    mock_api_client.get.side_effect = api_get_router({
+        "/api/tasks/12": TASK,
+        "/api/recipes/3/tasks": [{"id": 12, "order_index": 0}],
+        "/api/recipes/3": RECIPE,
+    })
+    html = logged_in_client.get("/measure/execute/12").get_data(as_text=True)
+    assert 'capture="environment"' in html
+    assert 'accept="image/*"' in html
+    assert "visionExecute()" in html
+    assert "/measure/api/vision/execute" in html
+
+
+def test_vision_execute_proxy_forwards_multipart(logged_in_client, mock_api_client):
+    mock_api_client.post.return_value = {
+        "vision_result_id": 7, "outcome": "ok", "overlay": [], "failures": [],
+        "measurements": [{"subtask_id": 1, "value": 9.9, "pass_fail": "pass"}],
+    }
+    resp = logged_in_client.post(
+        "/measure/api/vision/execute",
+        data={
+            "task_id": "12", "lot_number": "L1", "serial_number": "S1",
+            "production_run_id": "4",
+            "image": (io.BytesIO(b"\xff\xd8\xff fake"), "shot.jpg", "image/jpeg"),
+        },
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["vision_result_id"] == 7
+    args, kwargs = mock_api_client.post.call_args
+    assert args[0] == "/api/vision/execute"
+    assert kwargs["data"]["task_id"] == "12"
+    assert kwargs["data"]["lot_number"] == "L1"
+    assert kwargs["data"]["production_run_id"] == "4"
+    name, content, mime = kwargs["files"]["image"]
+    assert name == "shot.jpg" and mime == "image/jpeg" and content.startswith(b"\xff\xd8")
+
+
+def test_vision_execute_proxy_requires_image(logged_in_client, mock_api_client):
+    resp = logged_in_client.post("/measure/api/vision/execute", data={"task_id": "12"})
+    assert resp.status_code == 400
+    mock_api_client.post.assert_not_called()
+
+
+def test_vision_execute_proxy_relays_backend_error(logged_in_client, mock_api_client):
+    mock_api_client.post.return_value = {"error": True, "status_code": 422, "detail": "bad"}
+    resp = logged_in_client.post(
+        "/measure/api/vision/execute",
+        data={"task_id": "12", "image": (io.BytesIO(b"x"), "a.jpg", "image/jpeg")},
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 422
+    assert resp.get_json()["detail"] == "bad"
+
+
+def test_vision_result_image_proxy(logged_in_client):
+    fake = MagicMock(status_code=200, content=b"IMG", headers={"content-type": "image/jpeg"})
+    with patch("blueprints.measure.http_requests.get", return_value=fake) as g:
+        resp = logged_in_client.get("/measure/api/vision/results/7/image")
+    assert resp.status_code == 200 and resp.data == b"IMG"
+    assert g.call_args[0][0].endswith("/api/vision/results/7/image")
+    assert g.call_args[1]["headers"]["X-API-Key"] == "test-api-key-12345"

src/frontend/flask_app/tests/test_template_js_syntax.py

@@ -197,7 +197,9 @@ def test_admin_stations_inline_js_is_valid(logged_in_client, mock_admin_api):
     _check_alpine_attributes(html, "/admin/stations")
 
 
-def test_admin_stations_inline_js_is_valid_in_english(logged_in_client, mock_admin_api):
+def test_admin_stations_inline_js_is_valid_in_english(
+    logged_in_client, mock_admin_api, flask_app,
+):
     """gitea#37.5: the EN catalog is where this page's apostrophe actually is.
 
     translations/en/LC_MESSAGES/messages.po: msgid "Azzera le ricette della
@@ -205,7 +207,25 @@ def test_admin_stations_inline_js_is_valid_in_english(logged_in_client, mock_adm
     The IT source string has no apostrophe, so test_admin_stations_inline_js_is_valid
     (IT-only) would never have caught this - #37.5's own TEST note calls out
     the EN render specifically.
+
+    The .mo catalogs are gitignored and compiled only at Docker build time
+    (compile_translations.py) - not part of this test run - so setting
+    session["language"] = "en" alone has no effect here: flask_babel falls
+    back to the (Italian) msgid with no compiled catalog to translate from.
+    The Jinja "_" global is patched directly instead, standing in for what a
+    compiled EN catalog would return for this one string; everything else
+    round-trips unchanged, same as gettext's own fallback.
     """
+    EN_TRANSLATIONS = {
+        "Azzera le ricette della stazione": "Clear the station's recipes",
+    }
+
+    def fake_gettext(msgid, **kwargs):
+        text = EN_TRANSLATIONS.get(msgid, msgid)
+        return text % kwargs if kwargs else text
+
+    flask_app.jinja_env.globals["_"] = fake_gettext
+
     mock_admin_api.get.side_effect = [
         [{
             "id": 1, "code": "ST-DEFAULT", "name": "Default Station",
@@ -215,13 +235,18 @@ def test_admin_stations_inline_js_is_valid_in_english(logged_in_client, mock_adm
         [{"id": 1, "code": "DEMO-001", "name": "Demo Recipe", "active": True}],
     ]
 
-    with logged_in_client.session_transaction() as sess:
-        sess["language"] = "en"
     resp = logged_in_client.get("/admin/stations")
     assert resp.status_code == 200, resp.data[:300]
 
     html = resp.data.decode("utf-8")
+    # The fix (#37.5) is exactly why the apostrophe shows up escaped
+    # (tojson_attr) rather than literal - that is what keeps it from
+    # breaking the surrounding JS string.
     assert "station" in html.lower(), "sanity check: the EN string did render"
+    assert "station\\u0027s recipes" in html or "station's recipes" in html, (
+        "expected the EN string's apostrophe to reach the page only as an "
+        "escaped token (tojson_attr), not literally"
+    )
 
     scripts = _INLINE_SCRIPT_RX.findall(html)
     for i, body in enumerate(scripts):
@@ -370,3 +395,45 @@ def test_task_list_inline_js_is_valid(logged_in_client, mock_measure_api):
         _node_check(body, f"/measure/tasks script[{i}]")
 
     _check_alpine_attributes(html, "/measure/tasks")
+
+
+@pytest.fixture
+def mock_maker_api():
+    """Patch api_client used inside the maker blueprint."""
+    mock = MagicMock()
+    with patch("blueprints.maker.api_client", mock):
+        yield mock
+
+
+def test_task_editor_inline_js_is_valid(logged_in_client, mock_maker_api):
+    """gitea#4: the version-conflict reload added _reloadForNewVersion() and
+    new `if (…status === 409)` / `data.task_id !== taskId` checks in every
+    save handler. Regression guard that the inline script still parses."""
+    _force_italian(logged_in_client)
+    mock_maker_api.get.side_effect = api_get_router({
+        "/api/recipes/3/tasks": [{
+            "id": 11, "order_index": 0, "title": "Quota d'ingresso",
+            "task_type": "measure", "file_path": None, "file_type": None,
+            "annotations_json": None,
+            "subtasks": [{
+                "id": 21, "marker_number": 1, "description": "Diametro",
+                "nominal": 10.0, "utl": 10.5, "uwl": 10.2, "lwl": 9.8, "ltl": 9.5,
+                "unit": "mm",
+            }],
+        }],
+        "/api/recipes/3": {
+            "id": 3, "code": "REC-3", "name": "Ricetta con l'apostrofo",
+            "description": "Con l'apostrofo anche qui",
+        },
+    })
+
+    resp = logged_in_client.get("/maker/recipes/3/tasks")
+    assert resp.status_code == 200
+    html = resp.get_data(as_text=True)
+
+    scripts = _INLINE_SCRIPT_RX.findall(html)
+    assert scripts, "expected at least one inline <script> on /maker/recipes/3/tasks"
+    for i, body in enumerate(scripts):
+        _node_check(body, f"/maker/recipes/3/tasks script[{i}]")
+
+    _check_alpine_attributes(html, "/maker/recipes/3/tasks")

src/frontend/flask_app/translations/en/LC_MESSAGES/messages.po

@@ -2760,3 +2760,19 @@ msgstr "Reading ignored: please wait"
 msgid "Lettura del calibro rifiutata: valore troppo grande"
 msgstr "Caliper reading refused: value too large"
 
+#: app.py:131 app.py:207
+msgid "Sessione scaduta: effettua nuovamente l'accesso."
+msgstr "Session expired: please log in again."
+
+#: blueprints/measure.py:239 blueprints/measure.py:317 blueprints/measure.py:478
+msgid "Ricetta non assegnata a questa stazione"
+msgstr "Recipe not assigned to this station"
+
+#: blueprints/measure.py:462
+msgid "Codice non valido"
+msgstr "Invalid code"
+
+#: templates/maker/task_editor.html:1220
+msgid "La ricetta ha una nuova versione: pagina ricaricata"
+msgstr "The recipe has a new version: page reloaded"
+

src/frontend/flask_app/translations/it/LC_MESSAGES/messages.po

@@ -2748,3 +2748,19 @@ msgstr "Lettura ignorata: attendere"
 msgid "Lettura del calibro rifiutata: valore troppo grande"
 msgstr "Lettura del calibro rifiutata: valore troppo grande"
 
+#: app.py:131 app.py:207
+msgid "Sessione scaduta: effettua nuovamente l'accesso."
+msgstr "Sessione scaduta: effettua nuovamente l'accesso."
+
+#: blueprints/measure.py:239 blueprints/measure.py:317 blueprints/measure.py:478
+msgid "Ricetta non assegnata a questa stazione"
+msgstr "Ricetta non assegnata a questa stazione"
+
+#: blueprints/measure.py:462
+msgid "Codice non valido"
+msgstr "Codice non valido"
+
+#: templates/maker/task_editor.html:1220
+msgid "La ricetta ha una nuova versione: pagina ricaricata"
+msgstr "La ricetta ha una nuova versione: pagina ricaricata"
+