The framing caveat added earlier told the model to find the card's real
edge inside each mis-cut crop, then immediately offered 'say cannot_assess
if the close-up doesn't clearly contain it' — wrapped in alarming language
about cases. On a Fleer Ultra Jordan shot in a clear toploader it took the
escape hatch for corners AND edges, returning three of four categories as
'can't tell from photo' on a card whose corners are plainly visible through
the plastic. That was a regression I introduced, not a limit of the photo.
A toploader is transparent: corner sharpness, corner whitening, edge
chipping and edge whitening all read through it, and the card's cut line is
visible as a distinct boundary inside the holder's (confirmed in the pixel
profile — the card's own edge shows as a clear step ~75px inside the
detected holder boundary). Those categories now get judged normally, with
cannot_assess reserved for genuinely hidden geometry.
Surface keeps the escape hatch, because there it's correct: scratches, dust
and glare on a holder sit directly over the card's surface and can't be
separated from it in a photo.
Verified the encoded rubric against psacard.com/gradingstandards directly
(the page 403s automated fetchers, so read via a real browser session,
clicking through all 14 grade-definition slides).
The app said '55/45 to 60/40 allows a 10'. PSA publishes a flat 55/45 for
a 10 -- and the app's very next line already said 60/40 allows a 9, so the
range was internally contradictory as well as over-lenient: a 58/42 card
would read as 10-eligible when PSA would cap it at 9.
The range appears to have been a garbled memory of a real rule the app
otherwise didn't encode at all: PSA grants a 5% leeway on front centering
minimums for cards grading 7 or better. The old text applied that leeway to
the 10 only and to no other grade. Now the published tolerances stand as
written and the leeway is stated once, for the grades it actually covers,
as grader discretion keyed to eye appeal rather than a hard second
tolerance -- so a borderline card gets a range instead of a confident
single grade.
Everything else checked out exactly: 9=60/40, 8=65/35, 7=70/30, 6=80/20,
5/4=85/15, 3/2=90/10, and back 75/25 for a 10 / 90/10 from 9 down.
PSA's 'Altered Authentic' designation also confirms the trimming guidance
added earlier (alterations -> no numeric grade).
4. aspect_profile had the same root cause as edges/centering but no guard.
On the cased photo it reported 5.8% off standard -- the CASE's
proportions -- and the UI would surface that as a trimming hint about a
card it never measured. This one is more directly load-bearing than the
other two, since the measurement IS the detected box. Now refuses, with
both consumers (prompt block and UI hint) checking reliable.
5. _decode_images could KeyError/raise out of a plain read on a malformed
row, and separately b64decode returns b'' rather than raising on some
corrupt input -- which would have fed a zero-byte 'photo' into grading
to fail confusingly deep in the pipeline. Both now degrade to the
existing re-pick path.
6. _last_used_own_key is instance state on a handler that serves every
request on a keep-alive connection, so it outlives the request that set
it. Currently safe (every logging path assigns first), but a future path
that logged without reaching the assignment would bill the previous
request's payer. Cleared up-front now.
Full regression suite re-run: die-cut exclusion, uniform cards, centering,
aspect, cased-photo refusals, and the store layer all still behave.
1. detail_crops had no equivalent of the margin guard the measurements got.
When box detection fails (card still in a case), every crop is cut
relative to the wrong rectangle -- verified the 'TOP-LEFT CORNER'
close-up of the cased Ohtani is actually the CASE's corner bracket. The
measurements refuse and explain; the crops kept being produced and
captioned authoritatively, and the prompt tells the model to judge
corners/edges/surface *from* them. Now surfaces a framing caveat telling
the model to locate the real card edge inside each crop and say
cannot_assess rather than grade the holder.
2. gpt-5.6-sol's approx_image_tokens was a pre-launch guess (1500) that
advertised ~2.2x under true cost across all 9 real calls. Recalibrated
to 3560 against median real usage, and added a per-model output estimate
since GPT writes ~1.2k tokens of verdict vs Sonnet's ~0.9k. Both models
now advertise within ~3% of observed cost.
3. 'Take photo' didn't reset after a completed grade, unlike 'Choose from
library'. The result view has no photo strip, so new photos piled up
invisibly behind the old verdict, silently, to the 6-photo cap. Also
fixed the cap itself being a silent no-op with no explanation.
A 8px dot next to the card name only rewards someone who already suspects
a card and goes looking for it -- the badge needs to be the thing that
catches your eye scanning the home-screen list itself. Same red/amber
tiers as the detail-view banner, using the existing .pill shape so it sits
naturally next to the photo-count meta line rather than needing new
layout.
Confidence was entirely the model's own self-report, based only on photo
sharpness and category coverage -- it had no reliable way to account for
whether centering/edge whitening came from a real pixel measurement or from
its own eye, even though the app treats that distinction as a big deal
everywhere else (it's the whole reason cardimage.py exists). A sharp,
well-lit photo of a foil or die-cut card could claim 'high' while actually
running on eye-only judgment for two of PSA's four categories.
Enforced in code rather than left to the prompt alone -- this is an
objective, checkable fact (did centering_profile/edge_wear_profile return a
reliable result or not), exactly the kind of thing that shouldn't depend on
the model correctly weighing one more instruction among many. Only caps
high->medium when NEITHER measurement is available; one of two still
measured is left to the model's own judgment, since that's a real
legitimate basis for confidence. Also updated the prompt itself so the
model's own reasoning stays consistent with what gets displayed, rather
than silently contradicting its own prose.
Tested all five branches (neither/both/one/one-unreliable measured, and
confirmed no spurious limitation text when the model already said
medium).
The Charizard grade that prompted this had the model writing 'possible
non-standard/proxy print' directly into card_note -- the only free-text
field available -- since there was nowhere else for that observation to go.
That's why it got no visual treatment: the UI renders card_note as a plain
grey subtitle, identical to any ordinary card name.
Added authenticity as its own top-level field (flag: none/worth_checking/
likely_not_genuine, plus an observation) alongside the four grading
categories but explicitly separate from them -- this is about whether the
card is a genuine product at all, not its condition, and PSA authenticates
before it grades, so a flagged card's estimated_grade goes to null rather
than a number.
Prompted with concrete tells for both classes of concern: fan-made/proxy
prints (fictional sets, non-existent number combos, home-printer texture,
'proxy' watermarks) and counterfeits of real cards (colour/font/holo
mismatches against genuine copies). Trimming (already covered under CORNERS
from an earlier fix) now also sets this field when flagged, so the UI has
one place to check regardless of which specific issue triggered it.
UI: a full banner (not a hint line) above the slab -- critical red for
likely_not_genuine, warning amber for worth_checking -- plus a matching dot
next to the card name in History so it's visible without opening the card.
Both colours reuse --critical/--warning rather than the brand red, since
this is exactly the 'distrust this' signal those are already reserved for.
Migration tested against the live schema shape; existing rows get
authenticity=None and render with no banner, as before.
A card photographed still inside a black display case exposed this: the
case filled the entire frame with no background anywhere, so
_detect_card_box returned a box at essentially zero margin from the photo's
own edges (0px left, 1px right on a 986px-wide photo). Every downstream
measurement band -- a few percent of the card's own short dimension, by
design, since real wear lives in the outermost sliver -- then sampled
entirely within the case's embossed plastic texture, never reaching the
actual card. That texture read as 98.9% edge whitening on two sides.
The per-edge material-consistency check added for the earlier die-cut fix
didn't catch this: the case is uniformly dark on all four sides at the
shallow sampling depth used, so no edge disagreed with the others -- the
false signal came from local texture noise within one uniform (wrong)
material, not a mismatch between materials. This needed a different,
earlier check: whether box detection could plausibly have found the real
card boundary at all, gated on margin as a fraction of the photo before any
per-edge analysis runs.
Also fixed a related bug in centering_profile's existing die-cut check: it
compared each side against the median of the other three and returned on
the FIRST hit, so a genuine 2-vs-2 split (both left and right reading the
case, both top and bottom reading the real card) blamed a single side and
never even examined whether the second was equally wrong. Replaced with a
best-single-exclusion search that correctly distinguishes a true one-side
outlier from an unexplainable split.
Verified against the actual photo that exposed this (card in a scalloped
black case) -- both now correctly refuse instead of measuring the case.
Regression-tested: normal photos with reasonable margin, and the earlier
die-cut single-outlier case, are both unaffected.
vision.py now dispatches per-model to _call_anthropic or _call_openai --
same prompt, same schema, same cardimage.py measurements either way, only
the request/response shape differs. Confirmed the existing GRADING_SCHEMA
already satisfies OpenAI's strict-mode requirement (every property listed
in required, additionalProperties:false at every level) with no changes.
Settings gained a second axis: which server key applies now depends on the
selected model's provider, and friends' personal keys are stored per
provider (with a one-time migration from the old single-key localStorage
slot) since a Claude key and an OpenAI key aren't interchangeable.
CARD_GRADER_ADMIN_USER names one username (read from the proxy's forwarded
basic-auth header) who alone may write server settings; everyone else keeps
the same read-only view CARD_GRADER_LOCK used to give everyone, while still
being able to set their own personal key. Deployed here as ninja_hippo.
CARD_GRADER_LOCK remains the fallback when no admin is named.
Attribution comes from the proxy's basic-auth username, which nginx already
forwards. Recorded as a ledger of billed calls rather than a column on the
grade: a regrade overwrites the grade row, so a per-row cost would forget
what earlier runs cost, and deleting a card would erase that it was ever
paid for. Splits server-key spend (money the host actually owes) from
own-key spend (billed to the visitor) — the two must never be summed.
Attribution only, never authorization: the app is reachable directly on the
LAN, so these headers are not trustworthy for access control.
The table hardcoded $2/$10 with a comment noting it lapses 2026-08-31.
From Sept 1 that would have under-reported every grade by a third — both
the per-grade figure in the UI and the cost recorded against each result.
Storing originals for Regrade grew the database ~16MB per grade at the
upload cap. Photos now expire on a configurable window (default 7 days,
counted from last grade so regrading resets it) and the file is VACUUMed so
the space is actually returned — clearing the column alone only moves pages
to the freelist, which would have made the whole feature a no-op on disk.
Grades, thumbnails and measurements are never pruned; a pruned card's
Regrade falls back to the existing re-pick path, now with a banner saying
why.
- _body() read the full declared Content-Length into memory before any size
check, so MAX_UPLOAD_BYTES could only reject an upload already held in
RAM. nginx caps this on the proxied path, but the container also listens
on the LAN, so the app now enforces its own 20MB ceiling and closes the
connection rather than reading.
- SQLite ran with the default rollback journal and 5s lock timeout, chosen
when a row was a few KB; rows now carry the original photos, so two
people grading at once could block each other's History. WAL + 30s.
- No socket timeout meant a stalled keep-alive connection held a worker
thread indefinitely.
- An edge excluded as a different material was dropped from the UI with no
explanation, presenting three sides as though they were all four.
Same failure family as the edge-whitening fix: centering_profile assumed a
uniform printed border, so on an E-X/SPx-style die-cut the side midpoint
samples landed on clear acetate and the border-width walk measured two
different materials, producing a confident 70/30 the model then treated as
authoritative. Now the four side samples must read as the same material or
the measurement refuses with the reason; the prompt tells the model to judge
die-cut centering as design-to-cut registration instead.
Stores the original photo(s) for every card graded from now on, so an
existing history row can be re-graded in place without re-uploading -- most
useful right after a grading-logic fix like the last few commits. Cards
graded before this feature (or saved without images) fall back to the same
photo picker as a fresh grade, then start getting instant regrades from then
on. list_grades/get_grade now select an explicit column list rather than
SELECT * so the stored images are never pulled into memory just to be
discarded for the browser-facing response.
The pooled baseline that scores edge whitening was global across all four
edges, so a card that's normal printed border on three sides and clear
acetate on the fourth had the three normal edges anchor a baseline that made
the clear side read as extreme whitening -- correctly detecting a real pixel
difference, just the wrong one. Now excludes an edge from both the pool and
its own scoring when its median brightness/saturation reads as a
fundamentally different material, and surfaces why in the prompt instead of
silently dropping it.
PWA card-grading app, deployed behind Nginx Proxy Manager on Unraid with
basic auth. Includes CARD_GRADER_BASE_PATH support for running under a
sub-path, and Docker/compose config for the Unraid deployment.
