Keyboard shortcuts, live tab title, bounded dependencies, and belt-sequence hardening (ROADMAP 2.6, 3.3, 3.13)

[SeanathanVT]

Summary

Desktop quick wins from the roadmap, plus fixes for race conditions that keyboard use made easier to hit, found in several rounds of review.

Features

• Keyboard shortcuts (3.3): Space pause/resume, ↑/W and ↓/S speed, L/K/M presets, ? for a per-screen list. Start and End Session have no key, so a stray press can't start an unattended belt or end a walk. Toggle in Settings (keyboard_shortcuts_enabled, default on), as WCAG 2.1.4 requires.
  • Each shortcut clicks its button, so it goes through the same submit path, double-tap guard, and cross-site check.
  • Ignored while typing, with modifiers held, and while a dialog, the theme popover, or the phone menu is open. Space on a keyboard-focused button keeps its normal meaning, tracked by input type rather than :focus-visible so behavior matches across Safari, Chrome, and Firefox.
  • aria-keyshortcuts is the single source for the tooltips and the ? list. Shortcuts work without Bootstrap, and closing the ? list restores focus.
• Live tab title (3.13): 3.2 mph · 1.40 mi - WalkingDad while walking.
• Bounded dependencies (2.6): each direct dependency, including markupsafe, is pinned at its tested version and capped below the next major.

Fixes

• A quick second press can't undo Start/Pause/Resume/End. Routes set belt_transitioning before scheduling, guarded by a generation counter so only the newest sequence clears it, and reset when a new BLE loop starts. Pages render with buttons disabled, re-enable them after 15 s if no stats update arrives, and reload on a back/forward-cache restore.
• End stops the belt when it cancels an unfinished Pause.
• Pause and End cancel a pending speed change before stop_belt. Speed changes are ignored while a belt sequence is in flight, and checked and queued under the session lock.
• Speed rounding: round() instead of int(), which set e.g. 3.8 + 0.6 to 4.3.
• Concurrency: sequences and speed changes register before cancelling their predecessor. _cancel_task lets the caller's own cancellation propagate, cancels tasks from another event loop on that loop, and logs errors raised during cancellation. _handle_disconnect survives tasks on a closed loop.
• Shutdown overlay stops stats handling, including on the connecting page, and resets the tab title.

Docs

• CHANGELOG [Unreleased], README (features, config table), and ROADMAP 2.6, 3.3, 3.13 and 3.18.
• New ROADMAP items:
  • 1.7: Bleak 3's disconnect callback is never registered.
  • 1.8: on a C2, commands are ignored after a press on the physical remote, back-to-back speed commands are dropped, and the status packet's app_speed byte carries the target speed (km/h × 10).
  • 1.9: firmware version check and update replicating KS Fit (opt-in, fetched from KingSmith, nothing bundled), starting with an APK spike.
• AGENTS.md: follow common UI conventions and WCAG 2.2 AA where practical.

Testing

• 400 tests pass (with RuntimeWarnings treated as errors), and ruff is clean. Each new guard has a test that fails when the guard is removed.
• Browser behavior was checked in a throwaway jsdom harness across the active, paused, start and connecting screens, including the no-Bootstrap case.
• Manual check on macOS Safari with a C2: every shortcut, the focus behavior, the settings toggle, and the tab title.

Follow-ups

• ROADMAP 1.7 and 1.8, each on its own bugfix/ branch.
• Investigating KS Fit's firmware check and update (APK analysis started).

🤖 Generated with Claude Code