@camstack/addon-pipeline 1.2.620 → 1.2.622

package/dist/{worker-protocol-C-G8qmye.js → worker-protocol-_avq7y8O.mjs}

@@ -60,6 +60,71 @@ function formatNativeLeaseKnobs(resolved) {
 	return `native lease knobs — ${NATIVE_LEASE_KNOB_NAMES.map(part).join("; ")}`;
 }
 //#endregion
+//#region src/session-decode/session-hwaccel.ts
+var KNOWN_BACKENDS = [
+	"videotoolbox",
+	"cuda",
+	"nvdec",
+	"vaapi",
+	"qsv",
+	"d3d11va",
+	"dxva2",
+	"amf",
+	"vdpau",
+	"drm"
+];
+function isHwAccelBackend(value) {
+	return typeof value === "string" && KNOWN_BACKENDS.includes(value);
+}
+/** Wire guard for the `start` message's `hwaccel` field. */
+function isSessionHwaccelOffer(value) {
+	return value === null || Array.isArray(value) && value.every(isHwAccelBackend);
+}
+/** The worker's decode order per platform — first successful create() wins. */
+function platformDecodeOrder(platform) {
+	switch (platform) {
+		case "darwin": return ["videotoolbox"];
+		case "linux": return [
+			"vaapi",
+			"qsv",
+			"cuda"
+		];
+		case "win32": return [
+			"d3d11va",
+			"dxva2",
+			"cuda"
+		];
+		default: return [];
+	}
+}
+/**
+* The platform order, restricted to what the resolver offers. An empty offer
+* (VA init failed and no other GPU) means software, with no per-session try.
+*/
+function sessionDecodeCandidates(platform, offer) {
+	const order = platformDecodeOrder(platform);
+	if (offer === null) return order;
+	return order.filter((backend) => offer.includes(backend));
+}
+/**
+* The parent's copy of the resolver's auto answer, refreshed on the acquire
+* leg of every session spawn and read synchronously when `start` is sent. A
+* resolve that fails changes nothing (D49): the last answer stands.
+*/
+var SessionHwaccelSource = class {
+	offer = null;
+	current() {
+		return this.offer;
+	}
+	async refresh(resolver) {
+		if (!resolver) return;
+		try {
+			const res = await resolver.resolve(null);
+			this.offer = [...res.preferred];
+		} catch {}
+	}
+};
+//#endregion
 //#region src/session-decode/worker-protocol.ts
 /**
 * Typed IPC protocol between the per-session decode coordinator (Task 3 —
@@ -129,7 +194,7 @@ function isVideoFrameGenOptions(value) {
 function isWorkerRequest(value) {
 	if (!isRecord(value)) return false;
 	switch (value.kind) {
-		case "start": return isVideoFrameSource(value.source) && isVideoFrameGenOptions(value.opts) && isWorkerLeaseKnobs(value.lease);
+		case "start": return isVideoFrameSource(value.source) && isVideoFrameGenOptions(value.opts) && isWorkerLeaseKnobs(value.lease) && isSessionHwaccelOffer(value.hwaccel);
 		case "pull": return true;
 		case "toBuffer": return isFiniteNumber(value.frameId) && (value.opts === void 0 || isFrameImageOptions(value.opts));
 		case "nativeCrop": return isFiniteNumber(value.requestId) && isFiniteNumber(value.frameId) && isNormalizedBbox(value.bbox) && (value.maxWidth === void 0 || isFiniteNumber(value.maxWidth));
@@ -160,27 +225,4 @@ function isWorkerReply(value) {
 	}
 }
 //#endregion
-Object.defineProperty(exports, "formatNativeLeaseKnobs", {
-	enumerable: true,
-	get: function() {
-		return formatNativeLeaseKnobs;
-	}
-});
-Object.defineProperty(exports, "isWorkerReply", {
-	enumerable: true,
-	get: function() {
-		return isWorkerReply;
-	}
-});
-Object.defineProperty(exports, "isWorkerRequest", {
-	enumerable: true,
-	get: function() {
-		return isWorkerRequest;
-	}
-});
-Object.defineProperty(exports, "logLevelForLine", {
-	enumerable: true,
-	get: function() {
-		return logLevelForLine;
-	}
-});
+export { sessionDecodeCandidates as a, SessionHwaccelSource as i, isWorkerRequest as n, formatNativeLeaseKnobs as o, logLevelForLine as r, isWorkerReply as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.620",
+  "version": "1.2.622",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",

package/python/coreml_load_probe.py

@@ -12,8 +12,11 @@ happens in a throwaway interpreter. The verdict is remembered next to the
 compiled-model cache:
 
   ok           -> load in-process, never probe this package again
-  crashed      -> refuse with `CoremlLoadCrashed` (reason `native-load-crashed`),
-                  now and on every later load, without re-probing
+  crashed      -> refuse with `CoremlLoadCrashed` (reason `native-load-crashed`)
+                  now. ONE crash is only `suspect` (D926): refused without
+                  probing for a cool-off, then probed again. A SECOND crash
+                  at least a cool-off after the first caches `crashed`, refused
+                  on every later load without re-probing; an `ok` resets.
   inconclusive -> (a Python exception in the child, a probe past its bound, a
                   child that could not start) remembered NOWHERE; the
                   in-process load runs exactly as it did before this gate
@@ -33,6 +36,7 @@ import platform
 import signal
 import subprocess
 import sys
+import time
 from typing import Callable, Optional
 
 # One-way: inference_pool imports this module lazily, inside its CoreML branch.
@@ -43,6 +47,63 @@ VERDICT_CRASHED = "crashed"
 VERDICT_INCONCLUSIVE = "inconclusive"
 
 PROBE_VERDICT_VERSION = 1
+
+# The two-crash rule, shared with `openvino_compile_probe` (D926, D49): one
+# native crash is `suspect`; this many crashes, the last at least a cool-off
+# after the first, is `crashed` and cached for good. A v1 `crashed` record
+# (no `crashes` list) reads as ONE crash of unknown age, so it is re-probed.
+VERDICT_SUSPECT = "suspect"
+CRASHES_TO_CONFIRM = 2
+CRASH_COOL_OFF_SEC = 600.0
+
+Clock = Callable[[], float]
+LoadAvg = Callable[[], "tuple[float, float, float]"]
+
+
+def host_loadavg() -> "tuple[float, float, float]":
+    try:
+        return os.getloadavg()
+    except (OSError, AttributeError):  # Windows has no load average
+        return (-1.0, -1.0, -1.0)
+
+
+def crash_at(crash: object) -> float:
+    if isinstance(crash, dict):
+        at = crash.get("at")
+        if isinstance(at, (int, float)):
+            return float(at)
+    return 0.0
+
+
+def crashes_confirmed(crashes: list) -> bool:
+    """Two crashes (or more), the last at least a cool-off after the first."""
+    if len(crashes) < CRASHES_TO_CONFIRM:
+        return False
+    return crash_at(crashes[-1]) - crash_at(crashes[0]) >= CRASH_COOL_OFF_SEC
+
+
+def normalise_crash_record(stored: dict) -> Optional[dict]:
+    """A stored verdict with its crash list filled in; an unconfirmed `crashed` reads `suspect`."""
+    verdict = stored.get("verdict")
+    if verdict not in (VERDICT_OK, VERDICT_CRASHED, VERDICT_SUSPECT):
+        return None
+    if verdict == VERDICT_OK:
+        return stored
+    crashes = stored.get("crashes")
+    if not isinstance(crashes, list) or not crashes:
+        crashes = [{"at": 0.0, "loadavg": None, "detail": str(stored.get("detail") or "")}]
+    out = {**stored, "crashes": crashes}
+    if verdict == VERDICT_CRASHED and not crashes_confirmed(crashes):
+        out = {**out, "verdict": VERDICT_SUSPECT}
+    return out
+
+
+def record_crash(
+    prior: list, detail: str, now: float, load: "tuple[float, float, float]",
+) -> "tuple[str, list]":
+    """Append one crash; return the verdict to store (`suspect` or `crashed`) and the list."""
+    crashes = [*prior, {"at": now, "loadavg": [round(x, 2) for x in load], "detail": detail}]
+    return (VERDICT_CRASHED if crashes_confirmed(crashes) else VERDICT_SUSPECT), crashes
 PROBE_MARKER = "@@CAMSTACK_COREML_PROBE_OK@@"
 # Long enough for the slowest cold compile measured on a Mac (rfdetr-package,
 # 58 s); the pool's own load bound reports a slow load to the host meanwhile.
@@ -169,18 +230,21 @@ def _read_verdict(path: str, key: dict) -> Optional[dict]:
         return None
     if not isinstance(stored, dict) or stored.get("key") != key:
         return None
-    if stored.get("verdict") not in (VERDICT_OK, VERDICT_CRASHED):
-        return None
-    return stored
+    return normalise_crash_record(stored)
 
 
-def _write_verdict(path: str, key: dict, verdict: str, detail: str) -> None:
+def _write_verdict(
+    path: str, key: dict, verdict: str, detail: str, crashes: "Optional[list]" = None,
+) -> None:
     """Atomic replace; a verdict that cannot be written only costs a re-probe."""
     tmp = f"{path}.tmp-{os.getpid()}"
+    record: dict = {"key": key, "verdict": verdict, "detail": detail}
+    if crashes:
+        record["crashes"] = crashes
     try:
         os.makedirs(os.path.dirname(path), exist_ok=True)
         with open(tmp, "w", encoding="utf-8") as fh:
-            json.dump({"key": key, "verdict": verdict, "detail": detail}, fh)
+            json.dump(record, fh)
         os.replace(tmp, path)
     except OSError as exc:
         sys.stderr.write(f"CoreML probe: could not persist the verdict for {path} ({exc})\n")
@@ -196,8 +260,11 @@ def ensure_coreml_loadable(
     device: str,
     run: Optional[ProbeRunner] = None,
     os_build: Optional[str] = None,
+    now: Optional[Clock] = None,
+    loadavg: Optional[LoadAvg] = None,
 ) -> None:
     """Return when `model_path` may be loaded in-process; raise when it would crash."""
+    clock = now if now is not None else time.time
     key = {
         "version": PROBE_VERDICT_VERSION,
         "fingerprint": _coreml_model_fingerprint(model_path),  # a re-download is a new package
@@ -207,17 +274,40 @@ def ensure_coreml_loadable(
     verdict_path = probe_verdict_path(model_path, device)
     known = _read_verdict(verdict_path, key)
     name = os.path.basename(model_path)
+    prior_crashes: list = []
     if known is not None:
         if known["verdict"] == VERDICT_CRASHED:
-            sys.stderr.write(f"CoreML probe: {name} device={device} is a KNOWN loader crash — refused\n")
-            sys.stderr.flush()
+            _log(f"{name} device={device} is a KNOWN loader crash "
+                 f"({len(known['crashes'])} crashes) — refused")
             raise CoremlLoadCrashed(model_path, device, str(known.get("detail") or "known crash"))
-        return
+        if known["verdict"] == VERDICT_OK:
+            return
+        prior_crashes = list(known["crashes"])
+        retry_at = crash_at(prior_crashes[-1]) + CRASH_COOL_OFF_SEC
+        if clock() < retry_at:
+            _log(f"{name} device={device} crashed the loader once — refused until the "
+                 f"cool-off ends ({retry_at - clock():.0f}s left)")
+            raise CoremlLoadCrashed(
+                model_path, device,
+                f"{known.get('detail') or 'one crash'}; one crash so far, "
+                f"re-probed after {CRASH_COOL_OFF_SEC:g}s",
+            )
     runner = run if run is not None else DEFAULT_RUNNER
     verdict, detail = runner(model_path, device)
-    sys.stderr.write(f"CoreML probe: {name} device={device} -> {verdict} ({detail})\n")
-    sys.stderr.flush()
-    if verdict in (VERDICT_OK, VERDICT_CRASHED):
+    _log(f"{name} device={device} -> {verdict} ({detail})")
+    if verdict == VERDICT_OK:
         _write_verdict(verdict_path, key, verdict, detail)
-    if verdict == VERDICT_CRASHED:
-        raise CoremlLoadCrashed(model_path, device, detail)
+        return
+    if verdict != VERDICT_CRASHED:
+        return  # inconclusive: remembered nowhere; an earlier suspect stands
+    load = (loadavg if loadavg is not None else host_loadavg)()
+    stored, crashes = record_crash(prior_crashes, detail, clock(), load)
+    _log(f"{name} device={device} loader crash {len(crashes)}/{CRASHES_TO_CONFIRM} "
+         f"(load {load[0]:.1f}) -> {stored}")
+    _write_verdict(verdict_path, key, stored, detail, crashes)
+    raise CoremlLoadCrashed(model_path, device, detail)
+
+
+def _log(line: str) -> None:
+    sys.stderr.write(f"CoreML probe: {line}\n")
+    sys.stderr.flush()

package/python/openvino_compile_probe.py

@@ -19,13 +19,24 @@ therefore writes the blob the pool then loads warm. Mirrors CoreML's
   ok           -> load in-process (a cache HIT), never probe this key again
                   while the blobs the probe wrote are still on disk
   crashed      -> refuse with `OpenvinoLoadCrashed` (reason
-                  `native-load-crashed`), now and on every later load of the
-                  same key, without re-probing
+                  `native-load-crashed`) now. ONE crash is only `suspect`:
+                  later loads are refused without probing until a cool-off
+                  (CRASH_COOL_OFF_SEC) has passed, then probed again. Only a
+                  SECOND crash at least a cool-off after the first caches
+                  `crashed` — refused on every later load of the same key,
+                  without re-probing. An `ok` in between resets the count.
   inconclusive -> (a Python exception in the child, a probe past its bound, a
                   child that could not start) remembered NOWHERE; the
                   in-process load runs exactly as it did before this gate
 
 Only a death by SIGNAL is a crash. CPU-only loads are never probed.
+
+Why two (2026-10-23, D926): a single SIGSEGV during an overloaded moment wrote
+`crashed`, and every later request for that model on the GPU was refused for
+good. A destructive verdict needs a second agreeing read (D49). Every crash is
+recorded with its time, the host load average and the child's detail. To
+clear a verdict by hand, delete
+`<models>/.ov-cache/<model>.<DEVICE>.ovprobe.json`.
 """
 from __future__ import annotations
 
@@ -33,17 +44,30 @@ import json
 import os
 import subprocess
 import sys
+import time
 from typing import Callable, Optional
 
 # One-way: inference_pool imports this module lazily, inside its OpenVINO branch.
+# The two-crash rule (D926) lives there too, shared by both probes.
 from coreml_load_probe import (
+    CRASH_COOL_OFF_SEC,
+    CRASHES_TO_CONFIRM,
     VERDICT_CRASHED,
     VERDICT_INCONCLUSIVE,
     VERDICT_OK,
+    VERDICT_SUSPECT,
+    Clock,
+    LoadAvg,
     _signal_name,
     classify_probe_exit,
+    crash_at,
+    host_loadavg,
+    normalise_crash_record,
+    record_crash,
 )
 
+# The key's version stays 1: a v1 `crashed` file (no `crashes` list) is read
+# as ONE crash of unknown age, so it is re-probed rather than discarded.
 PROBE_VERDICT_VERSION = 1
 PROBE_MARKER = "@@CAMSTACK_OV_PROBE_OK@@"
 # A cold iGPU compile of a large detector takes tens of seconds; past this the
@@ -178,17 +202,21 @@ def _read_verdict(path: str, key: dict) -> Optional[dict]:
         return None
     if not isinstance(stored, dict) or stored.get("key") != key:
         return None
-    if stored.get("verdict") not in (VERDICT_OK, VERDICT_CRASHED):
-        return None
-    return stored
+    return normalise_crash_record(stored)
 
 
-def _write_verdict(path: str, key: dict, verdict: str, detail: str, blobs: "list[str]") -> None:
+def _write_verdict(
+    path: str, key: dict, verdict: str, detail: str, blobs: "list[str]",
+    crashes: "Optional[list]" = None,
+) -> None:
     """Atomic replace; a verdict that cannot be written only costs a re-probe."""
     tmp = f"{path}.tmp-{os.getpid()}"
+    record: dict = {"key": key, "verdict": verdict, "detail": detail, "blobs": blobs}
+    if crashes:
+        record["crashes"] = crashes
     try:
         with open(tmp, "w", encoding="utf-8") as fh:
-            json.dump({"key": key, "verdict": verdict, "detail": detail, "blobs": blobs}, fh)
+            json.dump(record, fh)
         os.replace(tmp, path)
     except OSError as exc:
         sys.stderr.write(f"OpenVINO probe: could not persist the verdict for {path} ({exc})\n")
@@ -214,32 +242,58 @@ def ensure_openvino_loadable(
     cache_dir: Optional[str],
     env_tag: str = "",
     run: Optional[ProbeRunner] = None,
+    now: Optional[Clock] = None,
+    loadavg: Optional[LoadAvg] = None,
 ) -> None:
     """Return when `model_path` may be compiled in-process; raise when it would crash."""
     if not needs_probe(candidates):
         return
+    clock = now if now is not None else time.time
     name = os.path.basename(model_path)
     device = str(config.get("device", "AUTO"))
     key = probe_key(model_path, config, candidates, env_tag)
     verdict_path = probe_verdict_path(model_path, config, cache_dir) if cache_dir else None
+    prior_crashes: list = []
     if verdict_path is not None:
         known = _read_verdict(verdict_path, key)
         if known is not None:
             if known["verdict"] == VERDICT_CRASHED:
-                sys.stderr.write(
-                    f"OpenVINO probe: {name} device={device} is a KNOWN compiler crash — refused\n"
-                )
-                sys.stderr.flush()
+                _log(f"{name} device={device} is a KNOWN compiler crash "
+                     f"({len(known['crashes'])} crashes) — refused")
                 raise OpenvinoLoadCrashed(model_path, device, str(known.get("detail") or "known crash"))
-            if cache_dir is not None and _warm(known, cache_dir):
+            if known["verdict"] == VERDICT_SUSPECT:
+                prior_crashes = list(known["crashes"])
+                retry_at = crash_at(prior_crashes[-1]) + CRASH_COOL_OFF_SEC
+                if clock() < retry_at:
+                    _log(f"{name} device={device} crashed the compiler once — refused until "
+                         f"the cool-off ends ({retry_at - clock():.0f}s left)")
+                    raise OpenvinoLoadCrashed(
+                        model_path, device,
+                        f"{known.get('detail') or 'one crash'}; one crash so far, "
+                        f"re-probed after {CRASH_COOL_OFF_SEC:g}s",
+                    )
+            elif cache_dir is not None and _warm(known, cache_dir):
                 return  # blob present: the in-process load is a cache hit
     before = _blob_names(cache_dir) if cache_dir else set()
     runner = run if run is not None else DEFAULT_RUNNER
     verdict, detail = runner(model_path, config)
-    sys.stderr.write(f"OpenVINO probe: {name} device={device} -> {verdict} ({detail})\n")
+    _log(f"{name} device={device} -> {verdict} ({detail})")
+    if verdict == VERDICT_OK:
+        if verdict_path is not None and cache_dir is not None:
+            written = sorted(_blob_names(cache_dir) - before)
+            _write_verdict(verdict_path, key, verdict, detail, written)
+        return
+    if verdict != VERDICT_CRASHED:
+        return  # inconclusive: remembered nowhere; an earlier suspect stands
+    load = (loadavg if loadavg is not None else host_loadavg)()
+    stored, crashes = record_crash(prior_crashes, detail, clock(), load)
+    _log(f"{name} device={device} compiler crash {len(crashes)}/{CRASHES_TO_CONFIRM} "
+         f"(load {load[0]:.1f}) -> {stored}")
+    if verdict_path is not None and cache_dir is not None:
+        _write_verdict(verdict_path, key, stored, detail, [], crashes)
+    raise OpenvinoLoadCrashed(model_path, device, detail)
+
+
+def _log(line: str) -> None:
+    sys.stderr.write(f"OpenVINO probe: {line}\n")
     sys.stderr.flush()
-    if verdict in (VERDICT_OK, VERDICT_CRASHED) and verdict_path is not None and cache_dir is not None:
-        written = sorted(_blob_names(cache_dir) - before) if verdict == VERDICT_OK else []
-        _write_verdict(verdict_path, key, verdict, detail, written)
-    if verdict == VERDICT_CRASHED:
-        raise OpenvinoLoadCrashed(model_path, device, detail)

package/python/test_coreml_load_probe.py

@@ -224,6 +224,89 @@ class EnsureCoremlLoadableTest(unittest.TestCase):
         self.assertEqual(len(runner.calls), 1)
 
 
+class CoremlCrashNeedsASecondAgreeingReadTest(unittest.TestCase):
+    """One native abort must not ban a package forever (D926, D49)."""
+
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.pkg = _make_mlpackage(self._tmp.name)
+        self.t = 2_000_000.0
+
+    def tearDown(self) -> None:
+        self._tmp.cleanup()
+
+    def ensure(self, runner) -> None:
+        probe.ensure_coreml_loadable(
+            self.pkg, "all", run=runner, os_build="26.2",
+            now=lambda: self.t, loadavg=lambda: (4.0, 3.0, 2.0),
+        )
+
+    def stored(self) -> dict:
+        with open(probe.probe_verdict_path(self.pkg, "all"), "r", encoding="utf-8") as fh:
+            return json.load(fh)
+
+    def test_a_single_crash_is_retried_after_the_cool_off(self) -> None:
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(_Runner(probe.VERDICT_CRASHED, "signal 6"))
+        self.assertEqual(self.stored()["verdict"], probe.VERDICT_SUSPECT)
+        self.t += probe.CRASH_COOL_OFF_SEC + 1
+        ok = _Runner(probe.VERDICT_OK)
+        self.ensure(ok)
+        self.assertEqual(len(ok.calls), 1)
+        self.assertEqual(self.stored()["verdict"], probe.VERDICT_OK)
+
+    def test_within_the_cool_off_a_single_crash_refuses_without_probing(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        self.t += probe.CRASH_COOL_OFF_SEC - 1
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        self.assertEqual(len(crashed.calls), 1)
+
+    def test_two_crashes_a_cool_off_apart_are_cached(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        self.t += probe.CRASH_COOL_OFF_SEC + 1
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        stored = self.stored()
+        self.assertEqual(stored["verdict"], probe.VERDICT_CRASHED)
+        self.assertEqual(len(stored["crashes"]), 2)
+        self.assertEqual(stored["crashes"][0]["loadavg"], [4.0, 3.0, 2.0])
+        self.t += 10 * probe.CRASH_COOL_OFF_SEC
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        self.assertEqual(len(crashed.calls), 2)
+
+    def test_a_success_in_between_resets_the_count(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.CoremlLoadCrashed):
+            self.ensure(crashed)
+        self.t += probe.CRASH_COOL_OFF_SEC + 1
+        self.ensure(_Runner(probe.VERDICT_OK))
+        # An ok is remembered for good; a changed OS build is what re-probes it.
+        with open(probe.probe_verdict_path(self.pkg, "all"), "r", encoding="utf-8") as fh:
+            record = json.load(fh)
+        self.assertNotIn("crashes", record)
+
+    def test_a_legacy_single_crash_verdict_is_reprobed(self) -> None:
+        key = {
+            "version": probe.PROBE_VERDICT_VERSION,
+            "fingerprint": ip._coreml_model_fingerprint(self.pkg),
+            "device": "all",
+            "os": "26.2",
+        }
+        path = probe.probe_verdict_path(self.pkg, "all")
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump({"key": key, "verdict": probe.VERDICT_CRASHED, "detail": "sig 6"}, fh)
+        ok = _Runner(probe.VERDICT_OK)
+        self.ensure(ok)
+        self.assertEqual(len(ok.calls), 1)
+
+
 class _FakeCt:
     """The slice of coremltools `_load_model` touches before the model loads."""
 

package/python/test_openvino_compile_probe.py

@@ -217,6 +217,120 @@ class EnsureOpenvinoLoadableTest(unittest.TestCase):
             self.assertEqual(json.load(fh)["verdict"], probe.VERDICT_OK)
 
 
+class _Clock:
+    """A settable wall clock (seconds) handed to the probe as `now`."""
+
+    def __init__(self, start: float = 1_000_000.0) -> None:
+        self.t = start
+
+    def __call__(self) -> float:
+        return self.t
+
+    def advance(self, seconds: float) -> None:
+        self.t += seconds
+
+
+class CrashNeedsASecondAgreeingReadTest(unittest.TestCase):
+    """One SIGSEGV during an overloaded moment must not ban a model forever (D49).
+
+    Measured 2026-10-23: a single probe crash on the hub GPU wrote `crashed`
+    and every later load of the model was refused `native-load-crashed`.
+    """
+
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.model = os.path.join(self._tmp.name, "yolov9m-320-fp16.xml")
+        _write(self.model, b"<net/>")
+        self.cache = os.path.join(self._tmp.name, ".ov-cache")
+        os.makedirs(self.cache)
+        self.clock = _Clock()
+
+    def tearDown(self) -> None:
+        self._tmp.cleanup()
+
+    def ensure(self, runner) -> None:
+        probe.ensure_openvino_loadable(
+            self.model, GPU_CONFIG, ["GPU"], self.cache, env_tag="2025.4.1",
+            run=runner, now=self.clock, loadavg=lambda: (13.9, 9.1, 6.2),
+        )
+
+    def stored(self) -> dict:
+        path = probe.probe_verdict_path(self.model, GPU_CONFIG, self.cache)
+        with open(path, "r", encoding="utf-8") as fh:
+            return json.load(fh)
+
+    def test_a_single_crash_is_retried_after_the_cool_off(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED, "probe child died by signal 11 (SIGSEGV)")
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        self.clock.advance(probe.CRASH_COOL_OFF_SEC + 1)
+        ok = _Runner(probe.VERDICT_OK)
+        self.ensure(ok)  # no raise: the second read disagreed
+        self.assertEqual(len(ok.calls), 1)
+        self.assertEqual(self.stored()["verdict"], probe.VERDICT_OK)
+
+    def test_within_the_cool_off_a_single_crash_refuses_without_probing(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        self.clock.advance(probe.CRASH_COOL_OFF_SEC - 1)
+        with self.assertRaises(probe.OpenvinoLoadCrashed) as ctx:
+            self.ensure(crashed)
+        self.assertEqual(len(crashed.calls), 1)
+        self.assertIn("re-probed after", str(ctx.exception))
+
+    def test_a_single_crash_is_stored_as_suspect_not_crashed(self) -> None:
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(_Runner(probe.VERDICT_CRASHED, "signal 11"))
+        stored = self.stored()
+        self.assertEqual(stored["verdict"], probe.VERDICT_SUSPECT)
+        self.assertEqual(len(stored["crashes"]), 1)
+        crash = stored["crashes"][0]
+        self.assertEqual(crash["at"], self.clock.t)
+        self.assertEqual(crash["loadavg"], [13.9, 9.1, 6.2])
+        self.assertEqual(crash["detail"], "signal 11")
+
+    def test_two_crashes_a_cool_off_apart_are_cached(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        self.clock.advance(probe.CRASH_COOL_OFF_SEC + 1)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        stored = self.stored()
+        self.assertEqual(stored["verdict"], probe.VERDICT_CRASHED)
+        self.assertEqual(len(stored["crashes"]), 2)
+        # Confirmed: refused for good, never probed again.
+        self.clock.advance(10 * probe.CRASH_COOL_OFF_SEC)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        self.assertEqual(len(crashed.calls), 2)
+
+    def test_a_success_in_between_resets_the_count(self) -> None:
+        crashed = _Runner(probe.VERDICT_CRASHED)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        self.clock.advance(probe.CRASH_COOL_OFF_SEC + 1)
+        self.ensure(_Runner(probe.VERDICT_OK, blob="22bb.blob", cache_dir=self.cache))
+        os.remove(os.path.join(self.cache, "22bb.blob"))  # wiped: the next load re-probes
+        self.clock.advance(probe.CRASH_COOL_OFF_SEC + 1)
+        with self.assertRaises(probe.OpenvinoLoadCrashed):
+            self.ensure(crashed)
+        stored = self.stored()
+        self.assertEqual(stored["verdict"], probe.VERDICT_SUSPECT)
+        self.assertEqual(len(stored["crashes"]), 1)
+
+    def test_a_legacy_single_crash_verdict_is_reprobed(self) -> None:
+        # A v1 file (no crash list) is what the field wrote after ONE crash.
+        key = probe.probe_key(self.model, GPU_CONFIG, ["GPU"], "2025.4.1")
+        path = probe.probe_verdict_path(self.model, GPU_CONFIG, self.cache)
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump({"key": key, "verdict": probe.VERDICT_CRASHED, "detail": "sig 11", "blobs": []}, fh)
+        ok = _Runner(probe.VERDICT_OK)
+        self.ensure(ok)
+        self.assertEqual(len(ok.calls), 1)
+
+
 class _FakeCore:
     """The slice of `openvino.Core` `_load_model` touches before it compiles."""