Harden queue worker crashes and POST validation

test_app.py

@@ -266,6 +266,39 @@ class DownloadQueueWorkerFailureTests(unittest.TestCase):
         self.assertEqual(stored["status"], "failed")
         self.assertFalse(staging_dir.exists())
 
+    def test_run_job_marks_post_start_exception_failed_without_killing_worker_state(self):
+        queue = APP.DownloadQueue(lambda: {"mode": "sub", "quality": "best", "download_dir": "/tmp/example"}, start_worker=False)
+        job = queue.add({"query": "Queue Show", "title": "Queue Show", "season": "1", "episodes": "1"})
+        staging_dir = queue_jobs.job_staging_dir(job)
+
+        class BrokenStdout:
+            def __iter__(self):
+                return self
+
+            def __next__(self):
+                raise UnicodeDecodeError("utf-8", b"\xff", 0, 1, "bad output")
+
+        class FakeProc:
+            pid = 4321
+            stdout = BrokenStdout()
+
+            def terminate(self):
+                return None
+
+        with mock.patch.object(queue_jobs.subprocess, "Popen", return_value=FakeProc()), mock.patch.object(
+            queue_jobs.os, "getpgid", side_effect=OSError("gone")
+        ):
+            queue._run_job(job)
+
+        stored = queue._find(job["id"])
+        self.assertEqual(stored["status"], "failed")
+        self.assertEqual(stored["exit_code"], 1)
+        self.assertIn("unexpectedly", stored["log"][-1].lower())
+        self.assertIsNone(queue.current_process)
+        self.assertIsNone(queue.current_job_id)
+        self.assertIsNone(queue.current_job)
+        self.assertFalse(staging_dir.exists())
+
 
 class WatchlistRefreshAllTests(unittest.TestCase):
     def test_refresh_all_iterates_every_show_id(self):
@@ -1070,6 +1103,19 @@ class HandlerRouteTests(unittest.TestCase):
             APP.Handler.body_json(handler)
         self.assertIn("utf-8", str(ctx.exception).lower())
 
+    def test_remove_post_missing_show_id_returns_bad_request(self):
+        handler = DummyHandler("/api/watchlist/remove", body=b"{}", content_length=2)
+        APP.Handler.do_POST(handler)
+        self.assertEqual(handler.error_status, HTTPStatus.BAD_REQUEST)
+        self.assertIn("show_id", handler.error_message)
+
+    def test_upload_thumbnail_post_missing_required_fields_returns_bad_request(self):
+        body = b'{"show_id":"show-1"}'
+        handler = DummyHandler("/api/watchlist/upload-thumbnail", body=body, content_length=len(body))
+        APP.Handler.do_POST(handler)
+        self.assertEqual(handler.error_status, HTTPStatus.BAD_REQUEST)
+        self.assertIn("data_url", handler.error_message)
+
     def test_thumbnail_route_serves_cached_file_without_fetching(self):
         thumb_path = APP.THUMBNAIL_ROOT / "show-1.jpg"
         thumb_path.parent.mkdir(parents=True, exist_ok=True)