signalk-pypilot-newui 2.7.3 → 2.7.4

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 2.7.4 — 2026-09-15 — Async control tightening + uppercase accents
+
+Closes three findings from the external Rev277 review and finishes
+the Spanish accent pass across UPPERCASE headers and badges.
+
+### Async control
+
+- **NAV activation can no longer survive a disengage.** `setNavMode`
+  now snapshots the engage generation BEFORE `getCourse()` and
+  `setMode("nav")`, and bails silently if a disengage arrives during
+  either await. A superseded NAV attempt no longer arms the 500 ms
+  timer that could have turned a cancelled request into a fresh
+  engage. `engage()` also filters "superseded" errors so its own
+  fallback into `setState("enabled")` cannot resurrect the cancelled
+  intent.
+- **Stale target and mode retries can no longer overwrite newer
+  ones.** `setTarget` / `setMode` / `adjustTarget` now each bump a
+  dedicated generation counter and pass an `isStale()` callback into
+  `_setWithRetry`. If a first `setTarget(1 rad)` was still in retry
+  when a second `setTarget(2 rad)` succeeded, the first no longer
+  wakes up and pushes 1 rad. Same class of guard R01 already applied
+  to `ap.enabled`; now it covers all three write paths.
+- **Restore verdict actually verifies mode and target.** The 10 s
+  poll used to only check `pypilotHealthy` and `engaged`; that let a
+  pypilot ignoring the mode / target orders still be announced as
+  "restored". Now the verdict also compares `state.mode` against
+  the snapshot and `state.target` against it (with a 3° tolerance
+  for pypilot's own rounding on the wire) before speaking success.
+  A mismatch fires the failure banner with a specific reason
+  ("mode did not switch" / "target did not match").
+
+### i18n
+
+- Second Spanish accent pass covering UPPERCASE tokens the previous
+  pass missed: `ESTADÍSTICAS`, `HISTÓRICO`, `SESIÓN`, `CONEXIÓN`,
+  `CONFIGURACIÓN`, `CATÁLOGO`, `GRÁFICA`, `MÁS RÁPIDA`, `TIMÓN`,
+  `ÁNGULO`, `MÁXIMA`, and so on.
+
 ## 2.7.3 — 2026-09-14 — Spanish accents restored
 
 The Spanish translation now carries the accents it always should have

package/dist/autopilot-provider.js

@@ -73,6 +73,14 @@ class AutopilotProvider {
         // 500 ms NAV-mode setTimeout that setNavMode arms, so a disengage
         // during that window cannot be undone by the timer waking up.
         this.engageGen = 0;
+        // Rev279 (audit follow-up A / B): parallel counters for target and
+        // mode writes. Bumped on every setTarget / setMode / adjustTarget
+        // and consulted by the retry loop, so a stale write that was
+        // waiting to retry aborts before overwriting a newer intent. R01
+        // only protected ap.enabled; these close the same class of race
+        // on the two other write paths.
+        this.targetGen = 0;
+        this.modeGen = 0;
         this.navPendingTimer = null;
         // Rev272 (audit R06): adjustTarget reads data.target BEFORE awaiting
         // the write, so two concurrent +Δ calls could both start from the
@@ -280,11 +288,20 @@ class AutopilotProvider {
             !this.data.options.modes.includes(mode)) {
             throw new Error(`Invalid mode: ${mode}`);
         }
+        // Rev279 (audit follow-up B): bump modeGen so a stale mode retry
+        // aborts before overwriting a newer setMode / setState intent.
+        const gen = ++this.modeGen;
         // Rev254 (Carlos audit): fail explicit when pypilot offline.
         // Rev255: retry with backoff.
-        if (!(await this._setWithRetry("ap.mode", mode))) {
+        if (!(await this._setWithRetry("ap.mode", mode, () => this.modeGen !== gen))) {
+            if (this.modeGen !== gen) {
+                throw new Error("mode change superseded by newer order");
+            }
             throw new Error("pypilot offline: mode change not delivered");
         }
+        if (this.modeGen !== gen) {
+            throw new Error("mode change superseded after write");
+        }
     }
     async setTarget(rad) {
         // Rev272 (audit R07): reject at the boundary. Downstream callers
@@ -302,11 +319,22 @@ class AutopilotProvider {
         // side).
         // eslint-disable-next-line no-console
         console.log(`[apProvider.setTarget] rad=${rad.toFixed(4)} deg=${deg.toFixed(2)}`);
+        // Rev279 (audit follow-up B): bump targetGen so a stale target
+        // retry aborts before overwriting a newer setTarget. Without this
+        // guard, target=1 rad → 2 rad → retry(1 rad) ended up leaving
+        // 1 rad on pypilot.
+        const gen = ++this.targetGen;
         // Rev254 (Carlos audit): reject BEFORE mutating optimistic target.
         // Rev255: retry with backoff.
-        if (!(await this._setWithRetry("ap.heading_command", deg))) {
+        if (!(await this._setWithRetry("ap.heading_command", deg, () => this.targetGen !== gen))) {
+            if (this.targetGen !== gen) {
+                throw new Error("target superseded by newer order");
+            }
             throw new Error("pypilot offline: target not delivered");
         }
+        if (this.targetGen !== gen) {
+            throw new Error("target superseded after write");
+        }
         this.data.target = rad;
         this.pendingTarget = { value: rad, until: Date.now() + TARGET_PENDING_MS };
         this.notifyChanged("target");
@@ -326,11 +354,21 @@ class AutopilotProvider {
             if (this.data.engaged) {
                 const base = typeof this.data.target === "number" ? this.data.target : 0;
                 const newRad = base + rad;
+                // Rev279 (audit follow-up B): adjustTarget also bumps targetGen
+                // so an in-flight absolute setTarget cannot silently overwrite
+                // the adjusted value from a retry (and vice versa).
+                const gen = ++this.targetGen;
                 // Rev254 (Carlos audit): same reject-before-optimistic guard.
                 // Rev255: retry with backoff.
-                if (!(await this._setWithRetry("ap.heading_command", newRad * RAD_TO_DEG))) {
+                if (!(await this._setWithRetry("ap.heading_command", newRad * RAD_TO_DEG, () => this.targetGen !== gen))) {
+                    if (this.targetGen !== gen) {
+                        throw new Error("target adjust superseded by newer order");
+                    }
                     throw new Error("pypilot offline: target adjust not delivered");
                 }
+                if (this.targetGen !== gen) {
+                    throw new Error("target adjust superseded after write");
+                }
                 this.data.target = newRad;
                 this.pendingTarget = { value: newRad, until: Date.now() + TARGET_PENDING_MS };
                 // Rev84: publish ONLY the target delta.
@@ -388,10 +426,19 @@ class AutopilotProvider {
         await this.setTarget(newRad);
     }
     async engage() {
+        // Rev279 (audit follow-up A): the catch used to fall through to
+        // setState("enabled") on ANY setNavMode failure, including a
+        // "superseded by newer order" thrown when a disengage arrived
+        // during setMode's retry. That turned the cancellation into a
+        // fresh engage. setNavMode now returns silently on supersede
+        // (does not throw), but we still filter defensively so a
+        // superseded throw from lower layers cannot re-arm engage either.
         try {
             await this.setNavMode();
         }
-        catch {
+        catch (e) {
+            if (/superseded/.test(String(e?.message)))
+                return;
             await this.setState("enabled");
         }
     }
@@ -399,23 +446,40 @@ class AutopilotProvider {
         await this.setState("disabled");
     }
     async setNavMode() {
+        // Rev279 (audit follow-up A): capture engageGen BEFORE the first
+        // await. On Rev278 the snapshot was taken after
+        // `await this.setMode("nav")`, so a disengage that landed during
+        // the mode retry ended up sharing the SAME generation as the
+        // arming step — the 500 ms timer then happily fired an engage the
+        // user had explicitly cancelled. Now: any bump between here and
+        // the timer means we bail silently. engage()'s catch is not
+        // supposed to re-fire that either, so we return normally instead
+        // of throwing (throwing would trigger engage()'s fallback into a
+        // direct setState("enabled"), reintroducing the same bug).
+        const gen = this.engageGen;
+        const isStale = () => this.engageGen !== gen;
         const cdata = await this.app.getCourse?.();
+        if (isStale())
+            return;
         if (cdata?.nextPoint &&
             this.getAvailableActionIds().includes("courseCurrentPoint")) {
-            await this.setMode("nav");
-            // Rev271 (audit R04): snapshot the generation at the moment we
-            // arm the delayed engage. A disengage or other setState between
-            // now and the timer firing will have bumped the counter, and the
-            // timer will simply exit. Cancelling the timer directly (in
-            // _bumpEngageGen) is the primary defence; this second check
-            // covers the tiny window where the bump happens after our
-            // clearTimeout would have fired.
-            const gen = this.engageGen;
+            try {
+                await this.setMode("nav");
+            }
+            catch (e) {
+                // setMode threw because it was superseded — bail without
+                // arming the delayed engage.
+                if (/superseded/.test(String(e?.message)))
+                    return;
+                throw e;
+            }
+            if (isStale())
+                return;
             if (this.navPendingTimer)
                 clearTimeout(this.navPendingTimer);
             this.navPendingTimer = setTimeout(() => {
                 this.navPendingTimer = null;
-                if (this.engageGen !== gen)
+                if (isStale())
                     return; // superseded, do nothing
                 this.setState("enabled").catch(() => { });
             }, 500);

package/dist/index.js

@@ -15,7 +15,7 @@ const session_recorder_1 = require("./session-recorder");
 const trip_recorder_1 = require("./trip-recorder");
 // Rev counter bumped on every build so the user can distinguish deploys
 // from the webapp header (feedback_revision_bump_each_build).
-const PLUGIN_REVISION = "Rev278";
+const PLUGIN_REVISION = "Rev279";
 // Rev59: read package.json once at load time so /status can report the
 // npm package version alongside the internal Rev counter.
 // eslint-disable-next-line @typescript-eslint/no-require-imports

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-pypilot-newui",
-  "version": "2.7.3",
+  "version": "2.7.4",
   "description": "Signal K friendly UI for the pypilot autopilot, with the capability to spread its functions and buttons to other programs like KIP, WilhelmSK and freeboard. Touch-first mobile visor + full pypilot data (servo, gains, calibration, tack, warnings) as first-class Signal K paths and Simple Switches. Coexists with pypilot-autopilot-provider.",
   "main": "./dist/index.js",
   "scripts": {

package/public/app.js

@@ -564,6 +564,8 @@
       "restore.working":     "Restoring... verifying pypilot confirmation",
       "restore.reason.noPy": "pypilot did not confirm",
       "restore.reason.noEng":"AP did not engage",
+      "restore.reason.modeMismatch":   "mode did not switch",
+      "restore.reason.targetMismatch": "target did not match",
       // Alerts / prompts / confirms
       "alert.saveOk": "Saved.",
       "alert.saveFail": "Save failed. Are you logged in to Signal K admin?",
@@ -784,7 +786,7 @@
       "tab.setup":   "Setup",
       "tab.info":    "Info",
       // Chart tab (Rev96)
-      "chart.stats.title":         "ESTADISTICAS SESION",
+      "chart.stats.title":         "ESTADÍSTICAS SESIÓN",
       "chart.session.empty":       "Sesión no iniciada",
       "chart.session.started":     "Sesión iniciada a las",
       "chart.session.ago":         "hace",
@@ -799,7 +801,7 @@
       "chart.stat.servoRuntime":   "Servo activo",
       "chart.stat.tacksGybes":     "Viradas / Trasluchadas",
       "chart.stat.maxServoA":      "Max servo A",
-      "chart.history.title":       "HISTORICO",
+      "chart.history.title":       "HISTÓRICO",
       "chart.history.refresh":     "Actualizar",
       "chart.empty":               "Aún sin datos - esperando primera muestra...",
       "chart.servoHealth.title":   "SALUD DEL SERVO",
@@ -1144,7 +1146,7 @@
       "tackLog.bestRet":       "Mejor retención",
       "tackLog.bestRec":       "Recuperación más rápida",
       "tackLog.badgeRet":      "MEJOR RET",
-      "tackLog.badgeRec":      "MAS RAPIDA",
+      "tackLog.badgeRec":      "MÁS RÁPIDA",
       "tackLog.recoverLabel":  "Recuperación 95% SOG:",
       "tackLog.clearConfirm":  "¿Vaciar todo el historial de bordos?",
       // Veredicto HUD de maniobra
@@ -1219,9 +1221,11 @@
       "restore.doneSpeak":   "Target restaurado",
       "restore.failSpeak":   "Restauración fallida",
       "restore.failed":      "Restauración fallida",
-      "restore.working":     "Restaurando... esperando confirmacion pypilot",
+      "restore.working":     "Restaurando... esperando confirmación pypilot",
       "restore.reason.noPy": "pypilot no confirma",
       "restore.reason.noEng":"AP no enganchó",
+      "restore.reason.modeMismatch":   "el modo no cambió",
+      "restore.reason.targetMismatch": "el target no coincide",
       // Alerts / prompts / confirms
       "alert.saveOk": "Guardado.",
       "alert.saveFail": "Guardar fallo. Estas logueado como admin en Signal K?",
@@ -1278,7 +1282,7 @@
       "setup.restart.outage.pypilot": "Se reinician el core pypilot y su servidor web. El AP suelta el rumbo brevemente y se reengancha tras reconectar.",
       "setup.restart.outage.reboot":  "Se reinicia la Raspberry Pi entera (kernel, servicios, red). NO hay autopiloto durante ~35-60 segundos. Arranque en frio.",
       "helm.outage":  "Corte del piloto:",
-      "helm.warn":    "ASEGURATE DE QUE ALGUIEN ESTA AL TIMON antes de continuar. No es el momento de estar bajo cubierta.",
+      "helm.warn":    "ASEGURATE DE QUE ALGUIEN ESTA AL TIMÓN antes de continuar. No es el momento de estar bajo cubierta.",
       "helm.cancel":  "Cancelar",
       "helm.confirm": "Confirmo - hay alguien al timón",
       "helm.op.engage.title":     "Enganchar piloto",
@@ -2951,12 +2955,21 @@
           if (!state.engaged) {
             throwIfNotOk(await apEngage(), "engage");
           }
-          // Rev274: poll every 500 ms up to 10 s. Bail out as soon
-          // as any negative evidence lands (healthy went false,
-          // disengage delta undid the engage). Only speak success
-          // if BOTH survive the whole window.
+          // Rev279 (audit follow-up C): the previous verdict only
+          // required healthy + engaged after 10 s. That let a pypilot
+          // that ignored the mode / target orders (or that a competing
+          // controller quickly overrode) still be announced as
+          // "restaurado". Now we ALSO compare state.mode and
+          // state.target against the snapshot the user asked to
+          // restore, so we speak success only when the AP is engaged
+          // AND healthy AND actually running with the requested mode
+          // and target (within a 3° tolerance to allow for pypilot's
+          // own rounding on the wire).
           const started = Date.now();
           const maxMs = 10000;
+          const TOL_RAD = 3 * Math.PI / 180;
+          const wantMode = snap.mode ? String(snap.mode).toLowerCase() : null;
+          const wantTarget = typeof snap.target === "number" ? snap.target : null;
           const tick = () => {
             if (state.pypilotHealthy === false) {
               return verdict("fail", t("restore.reason.noPy"));
@@ -2965,6 +2978,18 @@
               return verdict("fail", t("restore.reason.noEng"));
             }
             if (Date.now() - started >= maxMs) {
+              // Final check on mode and target before speaking OK.
+              if (wantMode) {
+                const curMode = String(state.mode || "").toLowerCase();
+                if (curMode !== wantMode) {
+                  return verdict("fail", t("restore.reason.modeMismatch"));
+                }
+              }
+              if (wantTarget !== null && typeof state.target === "number") {
+                if (Math.abs(state.target - wantTarget) > TOL_RAD) {
+                  return verdict("fail", t("restore.reason.targetMismatch"));
+                }
+              }
               return verdict("ok");
             }
             setTimeout(tick, 500);

package/public/index.html

@@ -121,7 +121,7 @@
                    ANTES centro col x=8, DESPUÉS centro col x=48. -->
               <!-- Rev224 (Carlos): rediseno con separadores finos
                    horizontales, flecha "->" entre valores ANTES y
-                   DESPUES y fila nueva de TIEMPO de ejecucion.
+                   DESPUÉS y fila nueva de TIEMPO de ejecucion.
                    AWA sin barras de valor absoluto. -->
               <rect x="-82" y="-84" width="164" height="168" rx="10"
                     fill="rgba(11,15,20,0.98)" stroke="#4a5867" stroke-width="1.5"/>
@@ -2097,6 +2097,6 @@
     </div>
   </div>
 
-  <script src="app.js?v=Rev278"></script>
+  <script src="app.js?v=Rev279"></script>
 </body>
 </html>