- pkill TERM alone never worked: uvicorn's graceful shutdown waits for
in-flight /stream requests (minutes long), so the old process held
the port and each new one died with EADDRINUSE — meaning the live
server was running days-old code while the static files (read from
disk per request) were current
- SIGKILL fallback after the 1s grace, and --timeout-graceful-shutdown
3 so TERM is reliable on its own going forward
- this is why the new heatmap rendered an empty grid: the stale
process served /api/stats without by_day
- middleware re-verifies the username against users.json per request:
deleted accounts' signed cookies are rejected immediately
- set_cookie/delete_cookie honor the Secure flag; run.sh sets
ANIWEB_SECURE=1 so sessions only work through the HTTPS proxy
jozamudi