@trillboards/edge-sdk 0.2.40 → 0.2.41

package/dist/autoSense.d.ts

@@ -47,9 +47,16 @@ export declare function probeLiteRtLmHealth(baseUrl?: string, opts?: {
 }): Promise<LiteRtHealthResult>;
 /** A timer handle the supervisor sets for its re-probe loop (injectable in tests). */
 export type AutoSenseTimerHandle = ReturnType<typeof setTimeout>;
-/** Which sensing path the supervisor is currently running. */
-export type SensingMode = 'local' | 'cloud';
-export type AutoSenseState = SensingMode | 'waiting';
+/**
+ * Which sensing path the supervisor is currently running.
+ *
+ * `local` analyzes on-device. `waiting` runs the same manager with inference
+ * switched off — cameras open, health reported, nothing analyzed — because a
+ * connector that cannot sense yet must still be visibly alive. There is no
+ * `cloud`: see the module header.
+ */
+export type SensingMode = 'local' | 'waiting';
+export type AutoSenseState = SensingMode;
 /**
  * Everything the AutoSenseSupervisor needs, all injectable so the supervisor can
  * be unit-tested with a fake probe + fake managers. `runAutoSense` builds this
@@ -60,8 +67,6 @@ export interface AutoSenseSupervisorDeps {
     probe: () => Promise<LiteRtHealthResult>;
     /** Build (NOT start) the local-sensing manager. `null` ⇒ no feeds (fatal). */
     buildLocalManager: () => SensingManager | null;
-    /** Build (NOT start) the cloud-sensing manager. `null` ⇒ no feeds (fatal). */
-    buildCloudManager: () => SensingManager | null;
     /** Log sink (tests capture it). */
     log: (msg: string) => void;
     /** Sleep between startup re-probes (tests inject a no-op). */
@@ -80,10 +85,8 @@ export interface AutoSenseSupervisorDeps {
     startupBackoffMs: number;
     /** Steady-state re-probe interval (ms), already floored. */
     recheckIntervalMs: number;
-    /** Consecutive unhealthy re-probes required before a LOCAL→CLOUD fallback. */
+    /** Consecutive unhealthy re-probes required before the runtime is called unhealthy. */
     unhealthyChecksBeforeFallback: number;
-    /** Cloud inference is opt-in because continuous CCTV cloud load is expensive. */
-    allowCloudFallback: boolean;
     /** For the initial "probing…" log line. */
     litertLmBaseUrl: string;
     expectedModel: string;
@@ -95,13 +98,12 @@ export interface AutoSenseSupervisorDeps {
  * "restart to re-probe"), it OWNS the sensing lifecycle so the connector always
  * prefers on-device Gemma and switches automatically with NO restart:
  *
- *  - startInitial(): bounded startup re-probe → start the chosen path's REAL
- *    manager directly when litert-lm is healthy; otherwise wait locally unless
- *    cloud fallback was explicitly enabled.
+ *  - startInitial(): bounded startup re-probe → start the REAL manager with
+ *    inference ON when litert-lm is healthy, or in `healthOnly` mode when it is
+ *    not, so a waiting connector still reports its cameras.
  *  - beginRechecks(): a steady-state background re-probe loop on recheckIntervalMs.
- *  - recheck(): one tick — AUTO-UPGRADE cloud→local the instant local is ready
- *    (fixes the fresh-install race with zero restart). Explicit cloud-fallback
- *    installs may also recover local→cloud after K unhealthy probes.
+ *  - recheck(): one tick — AUTO-UPGRADE waiting→local the instant the model is
+ *    ready (fixes the fresh-install race with zero restart).
  *  - shutdown(): stop the active manager + clear the timer (SIGINT/SIGTERM).
  *
  * At most ONE switch per tick; a re-entrancy guard + the K-debounce mean a
@@ -112,7 +114,6 @@ export declare class AutoSenseSupervisor {
     private mode;
     private active;
     private localManager;
-    private cloudManager;
     private consecutiveUnhealthy;
     /**
      * Completed local analyses as of the previous re-probe. `null` = no baseline
@@ -120,6 +121,14 @@ export declare class AutoSenseSupervisor {
      * positive evidence" and leaves the pre-existing behaviour in place.
      */
     private analysesAtLastRecheck;
+    /**
+     * Why the connector is not sensing, in the probe's own words. Restated on
+     * every re-probe while waiting: a connector that goes quiet after ONE line at
+     * boot is how "waiting for a 2.4 GB model" became indistinguishable from
+     * "dead" in the first place, and the operator reading the log an hour later
+     * needs the reason to still be there.
+     */
+    private lastWaitReason;
     private timer;
     private switching;
     private stopped;
@@ -140,6 +149,7 @@ export declare class AutoSenseSupervisor {
         inFlight: number;
         buffered: number;
     };
+    /** The one manager, built on first use. Same instance for both states. */
     private getManager;
     /**
      * Initial probe (bounded startup re-probe loop for the fresh-install warmup
@@ -147,7 +157,13 @@ export declare class AutoSenseSupervisor {
      * onNoFeeds) when the chosen mode has no feeds configured.
      */
     startInitial(): Promise<boolean>;
-    /** Build + start a mode's manager and make it active. False ⇒ no feeds. */
+    /**
+     * Start the manager in the given mode and make it active. False ⇒ no feeds.
+     *
+     * `waiting` starts the SAME manager with `healthOnly`, so the feeds are
+     * validated and the cameras are opened either way — a bad/empty config still
+     * fails immediately instead of looking like a model download in progress.
+     */
     private activate;
     /** Start the steady-state background re-probe loop. */
     beginRechecks(): void;
@@ -161,12 +177,9 @@ export declare class AutoSenseSupervisor {
     /**
      * One background re-probe tick.
      *  - While WAITING: a healthy probe starts local sensing immediately.
-     *  - On CLOUD: any healthy probe → AUTO-UPGRADE to local immediately (running
-     *    on cloud while local is ready is pure waste; the K-debounce on the return
-     *    path bounds any toggling, so this is safe on the first healthy probe).
      *  - On LOCAL: a healthy probe resets the debounce; an unhealthy probe
-     *    increments it, and only after K CONSECUTIVE unhealthy probes do we
-     *    AUTO-RECOVER to cloud only when explicit fallback is enabled.
+     *    increments it, and only after K CONSECUTIVE unhealthy probes do we report
+     *    the runtime unhealthy — sensing stays put and recovers in place.
      * At most one switch per tick; re-entrancy guarded.
      *
      * ── Why an unanswered probe is not, by itself, a verdict ───────────────────
@@ -194,11 +207,11 @@ export declare class AutoSenseSupervisor {
      * landing; the moment they stop landing the same probe counts, and K of them
      * demote exactly as before.
      *
-     * It has to be `localInferences` and not the total analysis count. With
-     * `cloudFallbackOnError` on, a frame the local provider THREW on is answered
-     * by the cloud and still lands as an analysis — so a dead runtime would keep
-     * advancing the total forever and this rule would mask it permanently, which
-     * is strictly worse than the defect it replaces.
+     * It has to be `localInferences` and not the total analysis count, and that
+     * distinction must be preserved even though the connector no longer has a
+     * cloud path that could advance the total on its own: this counter is the
+     * supervisor's only proof of life, so anything but a COMPLETED on-device
+     * inference advancing it would make the proof self-fulfilling.
      *
      * Deliberately NOT keyed on "we have a request in flight": a serve that
      * ACCEPTS and never answers holds our permit for the provider's whole timeout,
@@ -216,7 +229,7 @@ export declare class AutoSenseSupervisor {
 /** Injection points for runAutoSense (default to the real probe/managers/timers). */
 export interface AutoSenseDeps {
     /**
-     * Probe used to decide local-vs-cloud. Defaults to probeLiteRtLmHealth.
+     * Probe used to decide sense-vs-wait. Defaults to probeLiteRtLmHealth.
      * Receives the resolved base URL, per-probe timeout, and the model the local
      * path will run (so the probe can require it before declaring local usable).
      */
@@ -225,8 +238,6 @@ export interface AutoSenseDeps {
     loadConfig?: (configPath: string) => EdgeAgentConfig;
     /** Build (NOT start) the local manager. Defaults to buildLocalSensingManager(config). */
     buildLocalManager?: () => SensingManager | null;
-    /** Build (NOT start) the cloud manager. Defaults to buildCloudSensingManager(config). */
-    buildCloudManager?: () => SensingManager | null;
     /** Log sink (tests capture it). Defaults to console.log. */
     log?: (msg: string) => void;
     /** Sleep between startup re-probes (tests inject a no-op). Defaults to setTimeout. */
@@ -264,8 +275,8 @@ export interface AutoSenseDeps {
  * genuine config error propagates to main() (prints + exits 1) — the same net
  * result as before, where the chosen run mode re-loaded the config and reported it.
  *
- * The explicit `local-sense` / `cloud-sense` entrypoints stay non-switching; only
- * `auto-sense` is supervised.
+ * The explicit `local-sense` entrypoint stays non-switching; only `auto-sense`
+ * is supervised.
  */
 export declare function runAutoSense(args: string[], deps?: AutoSenseDeps): Promise<void>;
 /**

package/dist/autoSense.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"autoSense.d.ts","sourceRoot":"","sources":["../src/autoSense.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAyE/E,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,EAAE,EAAE,OAAO,CAAC;IACZ,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,CACE,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,MAAmC,EAC5C,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACjF,OAAO,CAAC,kBAAkB,CAAC,CA0G7B;AAED,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjE,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAC5C,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,SAAS,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzC,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAC/C,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAC/C,mCAAmC;IACnC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,8DAA8D;IAC9D,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAC/D,gEAAgE;IAChE,UAAU,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACnD,sFAAsF;IACtF,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,6BAA6B,EAAE,MAAM,CAAC;IACtC,iFAAiF;IACjF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAmB;IAmBlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBjC,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAI7C,OAAO,CAAC,YAAY,CAAgD;IACpE,OAAO,CAAC,YAAY,CAAgD;IACpE,OAAO,CAAC,oBAAoB,CAAK;IACjC;;;;OAIG;IACH,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,uBAAuB;IAE1D,0EAA0E;IAC1E,IAAI,WAAW,IAAI,cAAc,GAAG,IAAI,CAEvC;IAED;;;;;;;;;OASG;IACH,eAAe,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAazD,OAAO,CAAC,UAAU;IASlB;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAgDtC,2EAA2E;YAC7D,QAAQ;IAkBtB,uDAAuD;IACvD,aAAa,IAAI,IAAI;IAIrB,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiE9B,iFAAiF;YACnE,QAAQ;IA0BtB,sFAAsF;IAChF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAehC;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnG,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,eAAe,CAAC;IACrD,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAChD,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAChD,4DAA4D;IAC5D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,sFAAsF;IACtF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAChE,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACpD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACjE,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,mBAAmB,GAAG,IAAI,CAAC;CACzE;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG1F;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAyB/B,CAAC"}
+{"version":3,"file":"autoSense.d.ts","sourceRoot":"","sources":["../src/autoSense.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AA8F/E,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,EAAE,EAAE,OAAO,CAAC;IACZ,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,CACE,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,MAAmC,EAC5C,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACjF,OAAO,CAAC,kBAAkB,CAAC,CA0G7B;AAED,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAC9C,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzC,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAC/C,mCAAmC;IACnC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,8DAA8D;IAC9D,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAC/D,gEAAgE;IAChE,UAAU,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACnD,sFAAsF;IACtF,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,6BAA6B,EAAE,MAAM,CAAC;IACtC,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IA4BlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IA3BjC,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAM7C,OAAO,CAAC,YAAY,CAAgD;IACpE,OAAO,CAAC,oBAAoB,CAAK;IACjC;;;;OAIG;IACH,OAAO,CAAC,qBAAqB,CAAuB;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,uBAAuB;IAE1D,0EAA0E;IAC1E,IAAI,WAAW,IAAI,cAAc,GAAG,IAAI,CAEvC;IAED;;;;;;;;;OASG;IACH,eAAe,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAazD,0EAA0E;IAC1E,OAAO,CAAC,UAAU;IAKlB;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmCtC;;;;;;OAMG;YACW,QAAQ;IAkBtB,uDAAuD;IACvD,aAAa,IAAI,IAAI;IAIrB,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiE9B,iFAAiF;YACnE,QAAQ;IA0BtB,sFAAsF;IAChF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAehC;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnG,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,eAAe,CAAC;IACrD,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAChD,4DAA4D;IAC5D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,sFAAsF;IACtF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAChE,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACpD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACjE,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,mBAAmB,GAAG,IAAI,CAAC;CACzE;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2G1F;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAyB/B,CAAC"}

package/dist/autoSense.js

@@ -43,6 +43,7 @@ const config_1 = require("./config");
 const LiteRtVlmProvider_1 = require("./LiteRtVlmProvider");
 const sensingRunMode_1 = require("./sensingRunMode");
 const gemmaModelOta_1 = require("./gemmaModelOta");
+const startupDiscovery_1 = require("./startupDiscovery");
 const connectorUpdate_1 = require("./connectorUpdate");
 /**
  * This install's version, read from package.json rather than declared as a
@@ -61,18 +62,39 @@ function connectorVersion() {
     }
 }
 /**
- * `auto-sense` — the ONE dispatching entrypoint for the BYO-CCTV connector that
- * prefers ON-DEVICE local sensing (LiteRT-LM serving Gemma). Cloud inference is
- * available only when the operator explicitly enables it.
+ * `auto-sense` — the ONE dispatching entrypoint for the BYO-CCTV connector.
+ * The connector is LOCAL-INFERENCE ONLY: it runs Gemma on-device via LiteRT-LM
+ * and there is no cloud VLM path in it at all.
  *
  * A fresh install may start before its model download finishes, so this probes
- * `litert-lm serve` health with a SHORT timeout and:
- *   - healthy  → runs the EXISTING local-sense path (no Vertex cost)
- *   - unhealthy/unreachable → waits and keeps probing without uploading frames
- *   - unhealthy + allowCloudFallback=true → runs the cloud-sense path
+ * `litert-lm serve` health with a SHORT timeout and runs one of TWO states:
+ *   - healthy  → `local`: the full on-device sensing path
+ *   - otherwise → `waiting`: cameras open, video proven, camera health reported
+ *                 on the heartbeat, and NOTHING analyzed or uploaded
  *
- * It introduces NO new providers and NO duplicated sensing logic — the local
- * and cloud run modes are reused verbatim. This module only owns the SELECTION.
+ * ── Why there is no third state ────────────────────────────────────────────
+ *
+ * There used to be: `cloud`, entered when `allowCloudFallback` was set or the
+ * local runtime went unhealthy. Measured 2026-08-12 over 255,812 image-bearing
+ * cloud VLM calls, that path cost $0.007008 per analyzed frame — ~$605/camera/
+ * month at a 30s cadence, so a 16-camera store ran ~$9,688/month against a
+ * $99-500 subscription. It is removed rather than rate-limited, which SUPERSEDES
+ * the escalation architecture from #11971 ("local Gemma decides *when* to look,
+ * the cloud decides *what* it saw") and the frequency-based cost control in
+ * plans/cctv-byo-sensing-plan.md:26. Both spent less per frame; neither changes
+ * the sign of a per-frame cost inside a flat-rate product.
+ *
+ * ── Why `waiting` is not idle ──────────────────────────────────────────────
+ *
+ * `waiting` used to start NO manager, so it emitted no analyze, no camera health
+ * and no heartbeat — a connector importing a 2.4 GB model looked exactly like a
+ * connector that had been unplugged, on the HAPPY path of a first boot. It now
+ * runs the SAME manager in `healthOnly` mode: same feeds, same cameras, same
+ * health reporting, zero inference. The portal sees a live connector whose
+ * cameras are proven and whose `sensingState` is `unavailable`.
+ *
+ * It introduces NO new providers and NO duplicated sensing logic — the local run
+ * mode is reused verbatim. This module only owns the SELECTION.
  */
 const DEFAULT_LITERT_LM_BASE_URL = 'http://localhost:9379';
 /** Default model the local-sense path runs (must match config.localSensing.model). */
@@ -86,10 +108,9 @@ const DEFAULT_PROBE_TIMEOUT_MS = 2000;
 /**
  * Startup re-probe budget. A fresh install races litert-lm warmup/model-download
  * (e.g. Windows `setup-litertlm.ps1` runs detached while the scheduled task can
- * start right after pairing). A single probe at boot would pick cloud and never
- * re-probe, stranding the box on cloud until a manual restart. So at startup we
- * re-probe a few times before entering the steady waiting state. Default 4
- * attempts.
+ * start right after pairing). A single probe at boot would drop straight into
+ * the waiting state and only leave it on the next re-probe, so at startup we
+ * re-probe a few times before settling. Default 4 attempts.
  */
 const DEFAULT_STARTUP_PROBE_ATTEMPTS = 4;
 /** Delay between startup re-probes (ms). Default 5s → ~15s warmup window. */
@@ -97,16 +118,16 @@ const DEFAULT_STARTUP_PROBE_BACKOFF_MS = 5000;
 /**
  * Steady-state background re-probe interval (ms). AFTER auto-sense picks a mode it
  * keeps probing on this cadence so it can start local inference once a fresh
- * install's litert-lm finishes warming up. Explicit cloud-fallback installs also
- * use it to upgrade cloud→local and recover local→cloud. Default 60s.
+ * install's litert-lm finishes warming up, and to restate WHY it is still
+ * waiting while it waits. Default 60s.
  */
 const DEFAULT_HEALTH_RECHECK_INTERVAL_MS = 60000;
 /** Floor for the re-probe interval (ms) so a mis-set tiny value can't hammer the serve. */
 const MIN_HEALTH_RECHECK_INTERVAL_MS = 15000;
 /**
- * Anti-thrash: consecutive UNHEALTHY background re-probes required before a
- * LOCAL→CLOUD fallback (a single flapping bad probe must not toggle the active
- * manager). The reverse cloud→local upgrade is immediate. Default 2.
+ * Anti-thrash: consecutive UNHEALTHY background re-probes required before the
+ * on-device runtime is REPORTED unhealthy (a single flapping bad probe must not
+ * raise an alarm). The waiting→local upgrade is immediate. Default 2.
  */
 const DEFAULT_LOCAL_UNHEALTHY_CHECKS_BEFORE_FALLBACK = 2;
 /**
@@ -146,10 +167,10 @@ async function probeLiteRtLmHealth(baseUrl = DEFAULT_LITERT_LM_BASE_URL, opts =
     //     -> ok=false  "is up but does not host model ...,gpu
     //                   (has: gemma-4-E2B-it.litertlm)"
     //
-    // With cloud fallback off (the default) auto-sense then sets `mode='waiting'`
-    // and starts NO manager — no analyze, no camera health, no heartbeat. The
-    // connector goes completely dark on a configuration the provider documents as
-    // valid, and says nothing.
+    // auto-sense then sets `mode='waiting'`, so a configuration the provider
+    // documents as valid would stop the connector analyzing anything. (It no
+    // longer goes DARK — waiting runs the cameras in health-only mode — but it
+    // still senses nothing, which is just as wrong for a valid config.)
     //
     // The defect is two modules disagreeing about whether `localSensing.model` may
     // carry an accelerator suffix; this makes the probe agree with the component
@@ -211,7 +232,7 @@ async function probeLiteRtLmHealth(baseUrl = DEFAULT_LITERT_LM_BASE_URL, opts =
         };
     }
     // The serve is up with model(s), but if it isn't hosting the one we'll infer
-    // against, local would fail every frame — so treat that as unhealthy → cloud.
+    // against, local would fail every frame — so treat that as unhealthy.
     if (expectedModel && !modelIds.includes(expectedModel)) {
         return {
             ok: false,
@@ -236,13 +257,12 @@ async function probeLiteRtLmHealth(baseUrl = DEFAULT_LITERT_LM_BASE_URL, opts =
  * "restart to re-probe"), it OWNS the sensing lifecycle so the connector always
  * prefers on-device Gemma and switches automatically with NO restart:
  *
- *  - startInitial(): bounded startup re-probe → start the chosen path's REAL
- *    manager directly when litert-lm is healthy; otherwise wait locally unless
- *    cloud fallback was explicitly enabled.
+ *  - startInitial(): bounded startup re-probe → start the REAL manager with
+ *    inference ON when litert-lm is healthy, or in `healthOnly` mode when it is
+ *    not, so a waiting connector still reports its cameras.
  *  - beginRechecks(): a steady-state background re-probe loop on recheckIntervalMs.
- *  - recheck(): one tick — AUTO-UPGRADE cloud→local the instant local is ready
- *    (fixes the fresh-install race with zero restart). Explicit cloud-fallback
- *    installs may also recover local→cloud after K unhealthy probes.
+ *  - recheck(): one tick — AUTO-UPGRADE waiting→local the instant the model is
+ *    ready (fixes the fresh-install race with zero restart).
  *  - shutdown(): stop the active manager + clear the timer (SIGINT/SIGTERM).
  *
  * At most ONE switch per tick; a re-entrancy guard + the K-debounce mean a
@@ -253,11 +273,12 @@ class AutoSenseSupervisor {
         this.deps = deps;
         this.mode = null;
         this.active = null;
-        // Build each mode's manager once and reuse the instance across switches (a
-        // stop()→start() cycle re-runs the SAME real manager). `undefined` = not built
-        // yet; `null` = built but no feeds (fatal — cached so we don't rebuild).
+        // Built once and reused across switches: `waiting` and `local` are the SAME
+        // manager over the same feeds, differing only in whether inference runs, so a
+        // promotion is a stop()→start() cycle on one instance rather than two
+        // half-initialised copies of the fleet. `undefined` = not built yet; `null` =
+        // built but no feeds (fatal — cached so we don't rebuild).
         this.localManager = undefined;
-        this.cloudManager = undefined;
         this.consecutiveUnhealthy = 0;
         /**
          * Completed local analyses as of the previous re-probe. `null` = no baseline
@@ -265,6 +286,14 @@ class AutoSenseSupervisor {
          * positive evidence" and leaves the pre-existing behaviour in place.
          */
         this.analysesAtLastRecheck = null;
+        /**
+         * Why the connector is not sensing, in the probe's own words. Restated on
+         * every re-probe while waiting: a connector that goes quiet after ONE line at
+         * boot is how "waiting for a 2.4 GB model" became indistinguishable from
+         * "dead" in the first place, and the operator reading the log an hour later
+         * needs the reason to still be there.
+         */
+        this.lastWaitReason = null;
         this.timer = null;
         this.switching = false;
         this.stopped = false;
@@ -295,15 +324,11 @@ class AutoSenseSupervisor {
                 : 0,
         };
     }
-    getManager(mode) {
-        if (mode === 'local') {
-            if (this.localManager === undefined)
-                this.localManager = this.deps.buildLocalManager();
-            return this.localManager;
-        }
-        if (this.cloudManager === undefined)
-            this.cloudManager = this.deps.buildCloudManager();
-        return this.cloudManager;
+    /** The one manager, built on first use. Same instance for both states. */
+    getManager() {
+        if (this.localManager === undefined)
+            this.localManager = this.deps.buildLocalManager();
+        return this.localManager;
     }
     /**
      * Initial probe (bounded startup re-probe loop for the fresh-install warmup
@@ -330,31 +355,27 @@ class AutoSenseSupervisor {
             this.deps.log(`[auto-sense] LOCAL on-device sensing selected — ${health.reason}`);
             return this.activate('local');
         }
-        if (this.deps.allowCloudFallback) {
-            this.deps.log(`[auto-sense] CLOUD sensing selected by explicit fallback policy (local VLM not usable after ` +
-                `${this.deps.startupAttempts} attempt(s)) — ${health.reason}. Will AUTO-UPGRADE to LOCAL ` +
-                `with no restart once LiteRT-LM is ready (re-probing every ${this.deps.recheckIntervalMs}ms).`);
-            return this.activate('cloud');
-        }
-        // Validate feeds before entering the wait loop so a bad/empty config still
-        // fails immediately instead of looking like a model download in progress.
-        if (!this.getManager('local')) {
-            this.deps.onNoFeeds();
-            return false;
-        }
-        this.mode = 'waiting';
-        this.deps.log(`[auto-sense] LOCAL AI is not ready yet — ${health.reason}. Cloud inference is disabled by ` +
-            `default; waiting for LiteRT-LM and re-probing every ${this.deps.recheckIntervalMs}ms.`);
-        return true;
+        this.deps.log(`[auto-sense] LOCAL AI is not ready yet — ${health.reason}. There is no cloud path: the ` +
+            `connector analyzes nothing until the on-device model is up. Starting cameras in ` +
+            `HEALTH-ONLY mode so the portal can see this connector is alive and why it is not ` +
+            `sensing, and re-probing every ${this.deps.recheckIntervalMs}ms.`);
+        this.lastWaitReason = health.reason;
+        return this.activate('waiting');
     }
-    /** Build + start a mode's manager and make it active. False ⇒ no feeds. */
+    /**
+     * Start the manager in the given mode and make it active. False ⇒ no feeds.
+     *
+     * `waiting` starts the SAME manager with `healthOnly`, so the feeds are
+     * validated and the cameras are opened either way — a bad/empty config still
+     * fails immediately instead of looking like a model download in progress.
+     */
     async activate(mode) {
-        const manager = this.getManager(mode);
+        const manager = this.getManager();
         if (!manager) {
             this.deps.onNoFeeds();
             return false;
         }
-        await manager.start();
+        await manager.start(mode === 'waiting' ? { healthOnly: true } : undefined);
         this.active = manager;
         this.mode = mode;
         this.consecutiveUnhealthy = 0;
@@ -401,12 +422,9 @@ class AutoSenseSupervisor {
     /**
      * One background re-probe tick.
      *  - While WAITING: a healthy probe starts local sensing immediately.
-     *  - On CLOUD: any healthy probe → AUTO-UPGRADE to local immediately (running
-     *    on cloud while local is ready is pure waste; the K-debounce on the return
-     *    path bounds any toggling, so this is safe on the first healthy probe).
      *  - On LOCAL: a healthy probe resets the debounce; an unhealthy probe
-     *    increments it, and only after K CONSECUTIVE unhealthy probes do we
-     *    AUTO-RECOVER to cloud only when explicit fallback is enabled.
+     *    increments it, and only after K CONSECUTIVE unhealthy probes do we report
+     *    the runtime unhealthy — sensing stays put and recovers in place.
      * At most one switch per tick; re-entrancy guarded.
      *
      * ── Why an unanswered probe is not, by itself, a verdict ───────────────────
@@ -434,11 +452,11 @@ class AutoSenseSupervisor {
      * landing; the moment they stop landing the same probe counts, and K of them
      * demote exactly as before.
      *
-     * It has to be `localInferences` and not the total analysis count. With
-     * `cloudFallbackOnError` on, a frame the local provider THREW on is answered
-     * by the cloud and still lands as an analysis — so a dead runtime would keep
-     * advancing the total forever and this rule would mask it permanently, which
-     * is strictly worse than the defect it replaces.
+     * It has to be `localInferences` and not the total analysis count, and that
+     * distinction must be preserved even though the connector no longer has a
+     * cloud path that could advance the total on its own: this counter is the
+     * supervisor's only proof of life, so anything but a COMPLETED on-device
+     * inference advancing it would make the proof self-fulfilling.
      *
      * Deliberately NOT keyed on "we have a request in flight": a serve that
      * ACCEPTS and never answers holds our permit for the provider's whole timeout,
@@ -461,14 +479,17 @@ class AutoSenseSupervisor {
         if (this.mode === 'waiting') {
             if (health.ok) {
                 this.deps.log('[auto-sense] LOCAL AI is ready — starting on-device sensing');
+                this.lastWaitReason = null;
                 await this.switchTo('local');
+                return;
             }
-            return;
-        }
-        if (this.mode === 'cloud') {
-            if (health.ok) {
-                this.deps.log('[auto-sense] upgrading CLOUD->LOCAL (LiteRT-LM now ready)');
-                await this.switchTo('local');
+            // Still waiting. Restate the cause every tick, and only when it CHANGES
+            // say so loudly — an unchanged reason is the normal shape of a long model
+            // import, not news.
+            if (health.reason !== this.lastWaitReason) {
+                this.deps.log(`[auto-sense] still waiting for the on-device model — ${health.reason} ` +
+                    '(cameras are open and reporting health; nothing is being analyzed or uploaded)');
+                this.lastWaitReason = health.reason;
             }
             return;
         }
@@ -488,19 +509,16 @@ class AutoSenseSupervisor {
             }
             this.consecutiveUnhealthy += 1;
             if (this.consecutiveUnhealthy >= this.deps.unhealthyChecksBeforeFallback) {
-                if (this.deps.allowCloudFallback) {
-                    // Name the reason. The no-fallback branch below always has; this one
-                    // did not, so the operator whose bill just moved onto the metered
-                    // cloud path saw a demotion with no cause attached to it.
-                    this.deps.log(`[auto-sense] falling back LOCAL->CLOUD (explicit policy; LiteRT-LM unhealthy after ` +
-                        `${this.consecutiveUnhealthy} consecutive checks) — ${health.reason}`);
-                    await this.switchTo('cloud');
-                }
-                else {
-                    this.deps.log(`[auto-sense] LOCAL AI health check failed — ${health.reason}. ` +
-                        'Cloud inference remains disabled; local sensing will recover in place.');
-                    this.consecutiveUnhealthy = 0;
-                }
+                // Stay on LOCAL and recover in place. Deliberately NOT a demotion to
+                // `waiting`: the probe has measured false negatives under exactly the
+                // load a healthy 16-camera connector generates (4 of 5 probes timed out
+                // during one 11.8 s inference), so tearing down a working sensing run on
+                // the strength of an unanswered ping would be the connector's own
+                // success switching it off. The loops keep trying and a genuinely dead
+                // runtime surfaces as per-frame failures, which are visible.
+                this.deps.log(`[auto-sense] LOCAL AI health check failed — ${health.reason}. ` +
+                    'There is no cloud path; on-device sensing will recover in place.');
+                this.consecutiveUnhealthy = 0;
             }
         }
     }
@@ -508,9 +526,9 @@ class AutoSenseSupervisor {
     async switchTo(mode) {
         if (this.mode === mode || this.switching)
             return;
-        const next = this.getManager(mode);
+        const next = this.getManager();
         if (!next) {
-            // Can't happen mid-run (both modes resolve the SAME static feeds), but
+            // Can't happen mid-run (it is the SAME instance over the SAME feeds), but
             // never tear down the working manager for one we can't start.
             this.deps.log(`[auto-sense] cannot switch to ${mode} sensing (no camera feeds) — staying on ${this.mode}`);
             return;
@@ -519,7 +537,7 @@ class AutoSenseSupervisor {
         try {
             if (this.active)
                 await this.active.stop();
-            await next.start();
+            await next.start(mode === 'waiting' ? { healthOnly: true } : undefined);
             this.active = next;
             this.mode = mode;
             this.consecutiveUnhealthy = 0;
@@ -575,8 +593,8 @@ function blockForever() {
  * genuine config error propagates to main() (prints + exits 1) — the same net
  * result as before, where the chosen run mode re-loaded the config and reported it.
  *
- * The explicit `local-sense` / `cloud-sense` entrypoints stay non-switching; only
- * `auto-sense` is supervised.
+ * The explicit `local-sense` entrypoint stays non-switching; only `auto-sense`
+ * is supervised.
  */
 async function runAutoSense(args, deps = {}) {
     const log = deps.log ?? ((m) => console.log(m));
@@ -585,6 +603,13 @@ async function runAutoSense(args, deps = {}) {
     const configIdx = args.indexOf('--config');
     const configPath = configIdx >= 0 && args[configIdx + 1] ? args[configIdx + 1] : 'trillboards.config.json';
     const config = load(configPath);
+    // Best-effort ONVIF LAN scan, fire-and-forget. This used to run only on
+    // `cloud-sense`; deleting that mode left it with zero call sites, which no type
+    // checker can see. `auto-sense` is what every platform runs now, so it is the
+    // right home. Settled before a no-feeds exit — feeds paired without an rtspUrl
+    // resolve to nothing sensable, and the scan is the only way the portal ever
+    // learns what is actually on the venue's network.
+    const discoveryDone = (0, startupDiscovery_1.kickStartupDiscovery)(config);
     const litertLmBaseUrl = config.localSensing?.litertLmBaseUrl || DEFAULT_LITERT_LM_BASE_URL;
     const probeTimeoutMs = config.localSensing?.healthProbeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
     const expectedModel = config.localSensing?.model || DEFAULT_LITERT_LM_MODEL;
@@ -593,7 +618,6 @@ async function runAutoSense(args, deps = {}) {
     const recheckIntervalMs = Math.max(MIN_HEALTH_RECHECK_INTERVAL_MS, config.localSensing?.healthRecheckIntervalMs ?? DEFAULT_HEALTH_RECHECK_INTERVAL_MS);
     const unhealthyChecksBeforeFallback = Math.max(1, config.localSensing?.localUnhealthyChecksBeforeFallback ??
         DEFAULT_LOCAL_UNHEALTHY_CHECKS_BEFORE_FALLBACK);
-    const allowCloudFallback = config.localSensing?.allowCloudFallback === true;
     const probe = deps.probe
         ? () => deps.probe(litertLmBaseUrl, probeTimeoutMs, expectedModel)
         : () => probeLiteRtLmHealth(litertLmBaseUrl, { timeoutMs: probeTimeoutMs, expectedModel });
@@ -608,18 +632,22 @@ async function runAutoSense(args, deps = {}) {
     const supervisor = new AutoSenseSupervisor({
         probe,
         buildLocalManager: deps.buildLocalManager ?? (() => (0, sensingRunMode_1.buildLocalSensingManager)(config, undefined, { configPath })),
-        buildCloudManager: deps.buildCloudManager ?? (() => (0, sensingRunMode_1.buildCloudSensingManager)(config, undefined, { configPath })),
         log,
         sleep,
         setTimer: deps.setTimer ?? ((cb, ms) => setTimeout(cb, ms)),
         clearTimer: deps.clearTimer ?? ((h) => clearTimeout(h)),
-        onNoFeeds: deps.onNoFeeds ?? (() => process.exit(1)),
+        onNoFeeds: deps.onNoFeeds ??
+            (() => {
+                // Let the LAN scan finish reporting before we go. Without this the exit
+                // races the POST and the operator's "Find my cameras" stays empty in
+                // exactly the situation that produced the no-feeds exit.
+                void (0, startupDiscovery_1.settleBeforeExit)(discoveryDone).finally(() => process.exit(1));
+            }),
         onLocalActivated: startModelOtaOnce,
         startupAttempts,
         startupBackoffMs,
         recheckIntervalMs,
         unhealthyChecksBeforeFallback,
-        allowCloudFallback,
         litertLmBaseUrl,
         expectedModel,
         probeTimeoutMs,