Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/printers/api/asset_routes.py

@@ -2659,6 +2659,9 @@ def dashboard_supplies():
             # dashboard card and the toner report were both doing.
             'levelid': printer.get('levelid'),
             'iscritical': any(s['status'] == 'critical' for s in depleted),
+            # The emptiest cartridge on this printer, which is what decides the
+            # row's place in the queue. depleted is sorted and non-empty here.
+            'worstremaining': depleted[0]['remaining'],
             'supplies': [{
                 'text': '{} {}%'.format(_shortsupplyname(supply.get('name')),
                                         supply.get('remaining')),
@@ -2667,7 +2670,18 @@ def dashboard_supplies():
             } for supply in depleted],
         })
 
-    rows.sort(key=lambda r: (not r['iscritical'], r['printername']))
+    # Emptiest first. This sorted on iscritical then NAME, and critical is
+    # everything at or below 5%, so a cartridge at 5% and one at 0% tied on the
+    # first key and the alphabet decided which came first. That is bad ordering
+    # on its own and worse than it looks: the dashboard queue takes only the
+    # first few rows per source, so the printer that is actually empty was
+    # being truncated away while a fuller one held its place.
+    #
+    # remaining is already normalised for waste cartridges (a full waste bin
+    # reads as low remaining), so one ascending sort is worst-first for every
+    # supply type, and iscritical falls out of it rather than needing its own
+    # key. Name only breaks ties.
+    rows.sort(key=lambda r: (r['worstremaining'], r['printername']))
     # Envelope rather than a bare list, so the card can say WHY it has no rows.
     # An empty card and a blind card must not look the same.
     return success_response({'rows': rows,