Dashboard redesign — dual ops + content view
[Low] Duration badge overlaps metadata text in asset card
BUG:
upload.js AMPP sync is fire-and-forget — errors swallowed silently with no retry
No graceful shutdown handler — SIGTERM kills mam-api mid-tick, leaks Redis + Docker sockets
Error handler leaks raw Postgres error messages (schema/column/UUID syntax) to clients
UUID path params not validated — every /:id route returns 500 with PG error on bad input
Scheduler tick has race condition — multi-node deploy will double-fire recorder starts
SSRF: POST /recorders/probe accepts arbitrary URLs and probes raw TCP/UDP on internal network
Secret leak: recorder start error response includes full Docker create payload (S3 keys, stream keys)
Node hijack: POST /cluster/heartbeat allows any authed user to overwrite primary node's api_url
Migrations silently swallow failures — partial schema upgrades leave server running on broken DB