@camstack/addon-pipeline-orchestrator 1.1.49 → 1.1.50

package/dist/index.mjs

@@ -6466,6 +6466,19 @@ function scopeKey(scope) {
 		case "device": return `device:${scope.deviceId}`;
 	}
 }
+/**
+* Producer transition order within ONE generation: `starting → ready →
+* down`. Used by `hydrate` to accept only forward moves for
+* same-generation snapshot records (a snapshot can be ahead of a lost
+* delta, never behind it, within one producer generation).
+*/
+function stateRank(state) {
+	switch (state) {
+		case "starting": return 0;
+		case "ready": return 1;
+		case "down": return 2;
+	}
+}
 function scopesEqual(a, b) {
 	if (a.type !== b.type) return false;
 	if (a.type === "global" || b.type === "global") return true;
@@ -6516,43 +6529,70 @@ var ReadinessRegistry = class {
 		return Array.from(this.snapshot.values());
 	}
 	/**
-	* Hydrate the snapshot from an authoritative source. Entries already
-	* present locally are skipped — live deltas (received via the event
-	* bus subscription) always take precedence over the snapshot. For
-	* each newly hydrated entry, a one-shot transition is dispatched to
-	* matching subscriptions so pending `awaitReady` callers unblock
-	* without having to wait for a fresh event.
+	* Hydrate the snapshot from an authoritative source — a RECONCILE, not
+	* an add-only merge (D8: readiness events are telemetry and may be
+	* lost; the on-reconnect/periodic snapshot re-pull is the repair path,
+	* so it MUST be able to advance a stale record — the 2026-07-17
+	* "still awaiting platform-probe forever" wedge was this method
+	* skipping every already-seen key).
 	*
-	* Local `epoch` is reset to 1 per entry — consumer-side epoch is
-	* derived from observed generation transitions, so this mirrors the
-	* value that would have been assigned had the consumer observed the
-	* first `ready` event directly.
+	*  - **Unseen keys** are added (epoch 1 — mirrors the value the
+	*    consumer would have derived from the first observed `ready`).
+	*  - **Existing keys** are UPDATED when the authoritative record
+	*    carries a different generation (producer restart / synthetic-down
+	*    superseded — epoch bumps on a new-generation `ready`, mirroring
+	*    `ingest`), or a FORWARD state move within the same generation
+	*    (`starting → ready → down`; within one producer generation a
+	*    snapshot can only be ahead of a lost delta, never behind it).
+	*  - **Never a same-generation regress** — a snapshot pulled just
+	*    before a live delta landed must not un-ready a record (the next
+	*    reconcile round converges it anyway).
+	*  - **Never a record this process is authoritative for** — node-scoped
+	*    records for our own nodeId, and device/global records we emitted,
+	*    keep local truth (an authority's stale copy of OUR record must
+	*    not regress us).
+	*
+	* Every applied entry dispatches a one-shot transition to matching
+	* subscriptions so pending `awaitReady` callers unblock without having
+	* to wait for a fresh event.
 	*/
 	hydrate(records) {
 		const now = this.now();
 		for (const record of records) {
 			const key = readinessKey(record.capName, record.scope);
-			if (this.snapshot.has(key)) continue;
+			const prev = this.snapshot.get(key) ?? null;
+			let epoch;
+			let durationInPrevState;
+			if (prev !== null) {
+				if (this.isLocallyAuthoritative(prev)) continue;
+				const sameGeneration = prev.generation === record.generation;
+				if (sameGeneration && stateRank(record.state) <= stateRank(prev.state)) continue;
+				epoch = !sameGeneration && record.state === "ready" ? prev.epoch + 1 : prev.epoch;
+				durationInPrevState = Math.max(0, now - prev.lastChange);
+			} else {
+				epoch = 1;
+				durationInPrevState = 0;
+			}
 			const hydrated = {
 				capName: record.capName,
 				scope: record.scope,
 				state: record.state,
 				generation: record.generation,
-				epoch: 1,
+				epoch,
 				lastChange: now,
 				sourceNodeId: record.sourceNodeId
 			};
 			this.snapshot.set(key, hydrated);
-			if (this.logger) this.logger.debug(`readiness: ${record.capName} (${scopeKey(record.scope)}) → ${record.state} (hydrated, gen=${record.generation.slice(0, 6)})`);
+			if (this.logger) this.logger.debug(`readiness: ${record.capName} (${scopeKey(record.scope)}) → ${record.state} (hydrated${prev !== null ? " update" : ""}, gen=${record.generation.slice(0, 6)})`);
 			const transition = {
 				capName: record.capName,
 				scope: record.scope,
 				state: record.state,
-				epoch: 1,
+				epoch,
 				generation: record.generation,
 				sourceNodeId: "hydrated",
 				ts: now,
-				durationInPrevState: 0
+				durationInPrevState
 			};
 			for (const sub of this.subscriptions) {
 				if (sub.capName !== record.capName) continue;
@@ -6565,6 +6605,17 @@ var ReadinessRegistry = class {
 			}
 		}
 	}
+	/**
+	* True when THIS process is the origin authority for `record` — a
+	* snapshot pulled from elsewhere must never overwrite it:
+	*  - node-scoped records whose `scope.nodeId` is our own node id
+	*    (this process — or a child bridged onto our bus — emits them);
+	*  - device/global-scoped records whose latest transition WE emitted.
+	*/
+	isLocallyAuthoritative(record) {
+		if (record.scope.type === "node") return record.scope.nodeId === this.sourceNodeId;
+		return record.sourceNodeId === this.sourceNodeId;
+	}
 	/** Shallow copy of the full snapshot — mainly for diagnostics/tests. */
 	getAll() {
 		return new Map(this.snapshot);
@@ -7651,6 +7702,24 @@ var RecordingRetentionSchema = object({
 	maxSizeGb: number().min(0).optional()
 });
 /**
+* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
+* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
+* previews at. Five graduated steps; absent on a config = `standard` (the
+* shipped default, matching `sheet-geometry`/`sheet-composer`).
+*
+* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
+* Each window's index sidecar carries its own tile dims, so a camera whose
+* preset changed over time renders every historical window at the dims it was
+* written with.
+*/
+var ScrubThumbnailPresetSchema = _enum([
+	"minimal",
+	"low",
+	"standard",
+	"high",
+	"max"
+]);
+/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
@@ -7687,7 +7756,14 @@ var RecordingConfigSchema = object({
 	* derived into bands once via `migrateConfigToBands`.
 	*/
 	bands: array(RecordingBandSchema).optional(),
-	retention: RecordingRetentionSchema.optional()
+	retention: RecordingRetentionSchema.optional(),
+	/**
+	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
+	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
+	* windows only — existing sheets are immutable, and each window's index
+	* carries its own tile dims so mixed-preset history renders correctly.
+	*/
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -30490,6 +30566,27 @@ var PIPELINE_EXECUTOR_CAP = "pipeline-executor";
 var PipelineSettingsStore = class PipelineSettingsStore {
 	deps;
 	static CATALOG_CACHE_TTL_MS = 3e4;
+	/**
+	* One reconcile round for {@link awaitExecutorCatalog}: the BOUNDED
+	* registry wait between two authoritative provider probes. Matches the
+	* registry's own "still awaiting" diagnostic cadence.
+	*/
+	static EXECUTOR_RECONCILE_ROUND_MS = 3e4;
+	/**
+	* Pacing between provider probes when the registry claims `ready` but
+	* the provider is not answering yet (stale registry record) — without
+	* it that combination would spin hot.
+	*/
+	static EXECUTOR_READY_PROBE_PACE_MS = 2e3;
+	/**
+	* Round bound for {@link seedAgentSettingsFromCatalog}: seeding is
+	* invoked from event handlers (`handleDetectionPipelineReadiness`) that
+	* must not accumulate unbounded loops across provider flaps — on
+	* exhaustion it returns `null` and the periodic pending-retry sweep /
+	* the next readiness epoch retries. `waitForAgentAndCatalog` keeps the
+	* UNBOUNDED reconcile (cameras are never dispatched with empty steps).
+	*/
+	static SEED_MAX_RECONCILE_ROUNDS = 4;
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -30756,11 +30853,7 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	* absent.
 	*/
 	async seedAgentSettingsFromCatalog(nodeId) {
-		await this.deps.acquireCapability(PIPELINE_EXECUTOR_CAP, {
-			type: "node",
-			nodeId
-		});
-		const catalog = await this.getCatalogForAgent(nodeId);
+		const catalog = await this.awaitExecutorCatalog(nodeId, { maxRounds: PipelineSettingsStore.SEED_MAX_RECONCILE_ROUNDS });
 		if (!catalog) return null;
 		const existing = (await this.readAgentSettingsMap())[nodeId];
 		const nextAddonDefaults = seedAgentAddonDefaults(existing?.addonDefaults ?? {}, catalog);
@@ -30864,15 +30957,64 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 		return resolved;
 	}
 	/**
-	* Block until `pipeline-executor` is ready on `nodeId` AND
+	* Loss-proof `pipeline-executor` gate (D8 — reconcile against the
+	* authority, never wait solely on an event).
+	*
+	* Readiness events are telemetry and MAY be lost across process/node
+	* hops (2026-07-17 incident: the agent's executor came back callable
+	* after an update, its `ready` delta never reached the hub registry,
+	* and the former `acquireCapability(…, Infinity)` gate wedged every
+	* dispatch forever). Each round of this loop therefore:
+	*
+	*  1. Probes the PROVIDER itself — `getCatalogForAgent` is a live
+	*     `pipelineExecutor.getSchema` RPC routed to `nodeId` (30s success
+	*     cache). The provider answering IS readiness, whatever the local
+	*     registry believes.
+	*  2. On a miss, falls back to a BOUNDED registry wait
+	*     (`EXECUTOR_RECONCILE_ROUND_MS`) — the event-driven fast path that
+	*     keeps the healthy cold-boot case latency-free (the wait resolves
+	*     the instant the `ready` delta lands). A lost event costs at most
+	*     one round, never forever.
+	*
+	* If the registry claims `ready` but the probe still misses (stale
+	* record for a dead provider), rounds pace at
+	* `EXECUTOR_READY_PROBE_PACE_MS` instead of spinning hot.
+	*
+	* Returns `null` only when `maxRounds` is exhausted (bounded callers)
+	* or the store was disposed mid-wait.
+	*/
+	async awaitExecutorCatalog(nodeId, opts = {}) {
+		const maxRounds = opts.maxRounds ?? Number.POSITIVE_INFINITY;
+		const startedAt = Date.now();
+		for (let round = 1; !this.disposed; round++) {
+			const catalog = await this.getCatalogForAgent(nodeId);
+			if (catalog) return catalog;
+			if (round >= maxRounds) return null;
+			if (round > 1) this.deps.logger.warn("executor reconcile: provider not answering yet — waiting one more round", {
+				tags: { nodeId },
+				meta: {
+					round,
+					elapsedMs: Date.now() - startedAt
+				}
+			});
+			const readyPerRegistry = await this.deps.acquireCapability(PIPELINE_EXECUTOR_CAP, {
+				type: "node",
+				nodeId
+			}, { timeoutMs: PipelineSettingsStore.EXECUTOR_RECONCILE_ROUND_MS }).then(() => true, () => false);
+			if (this.disposed) break;
+			if (readyPerRegistry) await sleep$1(PipelineSettingsStore.EXECUTOR_READY_PROBE_PACE_MS);
+		}
+		return null;
+	}
+	/**
+	* Block until `pipeline-executor` answers on `nodeId` AND
 	* `getCatalogForAgent` returns a non-null catalog AND `agentSettings`
 	* for that node has populated `addonDefaults`.
 	*
-	* `acquireCapability` defaults to infinite wait now — a single call
-	* carries the readiness gate. The thin retry below only handles
-	* the secondary case where the cap is "ready" but a derived call
-	* (getSchema) still returns null due to Moleculer service-registry
-	* propagation lag.
+	* The executor gate is {@link awaitExecutorCatalog} — reconcile-driven
+	* and UNBOUNDED here (cameras must never be dispatched with empty
+	* steps), but it converges as soon as the provider answers even when
+	* every readiness event was lost.
 	*
 	* Smell #20 fix: the retry loop used to be `while (true)` with no exit
 	* — a resolve in flight at addon shutdown would spin against a torn-
@@ -30882,16 +31024,9 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	* timing (2s backoff, same retry conditions) is unchanged.
 	*/
 	async waitForAgentAndCatalog(nodeId) {
-		await this.deps.acquireCapability(PIPELINE_EXECUTOR_CAP, {
-			type: "node",
-			nodeId
-		});
 		while (!this.disposed) {
-			const catalog = await this.getCatalogForAgent(nodeId);
-			if (!catalog) {
-				await sleep$1(2e3);
-				continue;
-			}
+			const catalog = await this.awaitExecutorCatalog(nodeId);
+			if (!catalog) break;
 			let agent = (await this.readAgentSettingsMap())[nodeId];
 			if (!agent || Object.keys(agent.addonDefaults ?? {}).length === 0) {
 				if (!await this.seedAgentSettingsFromCatalog(nodeId)) {

package/dist/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-BEIKqOjC.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-DV91ueig.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline-orchestrator",
-  "version": "1.1.49",
+  "version": "1.1.50",
   "description": "Hub-side camera-to-agent load balancer — tracks runner capacity and dispatches attachCamera calls to the optimal pipeline-runner instance",
   "keywords": [
     "camstack",