ruview @ v2235

What's in this release

This release is a batch of bug fixes from a review of the 10 most recent user-reported issues, plus a follow-up that finishes wiring together the "trust layer" preview from the last major release — closing the gap where the pieces existed and were tested, but weren't actually connected to each other yet.

Bugs fixed

• The UI could falsely claim a real ESP32 sensor was connected when it wasn't. A background check that asks the server "is this real hardware or a simulation?" was sending that request without the required login token. When the check failed for that reason, the UI defaulted to the most confident answer — "yes, it's live hardware" — instead of the honest "I don't know, showing simulated data." Now the check sends the token properly, so it gets a real answer instead of guessing wrong.

• With more than one sensor in a room, the "is someone present" reading would flicker on and off dozens of times a second. The system was supposed to combine what all the sensors see into one confident answer, but a leftover shortcut meant the top-line reading was actually just "whatever the most recently arrived sensor said" — so if two sensors disagreed, the displayed answer flipped every time a new packet arrived from either one. Fixed by always using the properly combined answer.

• In a Home Assistant smart-home setup with multiple sensors, every sensor's "present"/"not present" entity showed the exact same value — even though the sensors were in different rooms and genuinely saw different things. The code was looking for a piece of data under the wrong internal name, so it silently fell back to a single shared value for every sensor instead of each sensor's own reading. This is a subtle, interesting bug: there was already an automated test meant to catch exactly this kind of mistake, but the test itself used the same wrong internal name — so it always passed even though the real code was broken. Both the real bug and the flawed test are now fixed.

• A demo page could silently show fake data as if it were live, if the page happened to be served from a slightly different network port than expected (a common situation when the usual port is already busy). The page would try to connect to the wrong address, fail quietly, and keep showing simulated numbers with no warning. It now figures out the right address automatically, and — more importantly — an earlier fix already made sure the page won't visually claim to be "live" unless a real data frame actually arrives, so even a wrong guess here can no longer mislead anyone.

• On a fresh install with no trained model loaded, the pose-tracking dots on screen could be invisible even though the system had real coordinates for them. A confidence score was landing exactly on the cutoff value the display uses to decide "should I draw this or not," and ties lost. Nudged the score just past that line so it always draws.

• A security setting for encrypting the connection to a smart-home message broker (MQTT) was accepted but silently ignored. If you pointed the app at your own certificate for a self-signed/home-network broker, it would still only trust public internet certificate authorities and fail to connect — with no indication that your setting had no effect. It's now actually applied, and if the certificate file can't be read for some reason, the log now says so clearly instead of just failing later with a confusing error.

• A frozen sensor could keep reporting "I'm online and working" to Home Assistant forever, even after it had stopped sending any real data — because the "still alive" heartbeat and the actual data stream weren't checked against each other. A stuck sensor now correctly flips to "unavailable" within about 10 seconds of going quiet, instead of silently showing a stale reading as if it were current.

The "trust layer" is now actually wired together

The previous release introduced building blocks for a system that can say "here's my answer, and proof it's trustworthy right now" instead of quietly guessing — but as disclosed at the time, those building blocks weren't yet connected to each other. This release connects them: the piece that detects "conditions have changed, I'm not confident anymore" now has a real, working bridge into the piece that checks whether a certificate of trust is still valid, which feeds into the piece that decides whether an action is allowed. A test now proves the full chain works end-to-end with a real signed certificate — not just three separate pieces each tested on their own.

Still not done: this trust chain still isn't automatically running inside the live sensor server yet — it's a correctly-wired, tested toolkit a developer can use, not something that watches your live sensors on its own yet. That remains a bigger, separate project.

Also fixed

• A published pre-trained model file can't be verified with the standard, official tool because of a small formatting mistake in how it was saved — flagged with the exact byte-level fix needed, and the outdated documentation claiming it works was corrected.
• A structural check that can catch a broken "presence detector" AI model before it ships (added last release) is now actually run automatically whenever related code changes, so that specific safety net can't silently break without anyone noticing.

Verification

• Full automated test suite: 4,391 tests passed, 0 failed.
• Honesty note: the multi-sensor fixes above were verified with automated tests, not a live multi-sensor test rig — no real ESP32 hardware was reachable during this work session (it wasn't physically connected/available at the time).

Docker image

docker pull ghcr.io/ruvnet/RuView:de27336fa1db971d4689fd2db19610e8a7966dee