Repository navigation
Priority plan: cinema-seat motion macros, WS2811 effects, profiles, and Pealayer 4D integration #554
Description
Why this exists
This is the current coordination and handoff issue for the user-visible outcome that matters most now:
- preserve and reconcile every useful implementation without losing history;
- make cinema-seat motion on R1/R2 and R3/R4 recordable, editable and replayable as synchronized macros/effects;
- deliver the requested high-quality WS2811 effects from the PC host;
- advertise board-specific controls, names, icons and roles truthfully to Pealayer;
- let Pealayer design and play those effects in sync with video;
- keep DAVID-PC, CAFE-PC and ERFAN-GAMING on merged
main, using canonical binaries with working TUI/WebUI and peer communication.
This issue does not erase or supersede the detailed requirements in linked issues. It gives agents a short current map, dependency order and handoff format.
Product outcome
For the currently connected cinema-seat board, a user must be able to:
- discover Side A and Side B as semantic seat-motion controls rather than guess relay numbers;
- record Up/Down/Stop activity from supported sources with authoritative monotonic timing;
- inspect, rename, edit and replay the resulting macro;
- send the macro from PCController CLI/TUI/WebUI/API and from Pealayer;
- place motion, relay, PWM/MOSFET, lighting, audio and other supported actions on a Pealayer effect timeline and keep playback synchronized with video;
- select the requested WS2811 police, thunder and converging-red-dot effects, preview them and run them on the physical strip;
- see only capabilities actually advertised by the selected board/profile.
Current priority and guardrails
Feature delivery and preservation are the headline. Existing motion interlocks, stop paths, bounded queues, brightness/current limits and programming protections remain guardrails; do not broaden this pass into unrelated safety redesign.
- GitHub and merged
mainare the durable source of truth. - No unique work may remain only in an agent directory, local branch or machine checkout.
- Update existing issues and preserve their history; create a child issue only for a genuinely separate, testable slice.
- This is alpha: maintain one living negotiated contract, not
/vN, schema generations or compatibility scaffolding for obsolete alpha formats. - Never invent devices, channels, names, icons, effects or values. Unavailable capability is absent.
- Do not use board display names as durable identity and do not make Pealayer understand relay wiring.
Domain map
Use the concise domain: motion, domain: macros, domain: lighting, domain: profiles, domain: integration, domain: webui and domain: tui labels in both repositories. Existing technical/priority/state labels remain useful and may coexist.
Lane A — board profile and truthful hardware descriptors
The board stores only compact facts it must own:
- a stable board/profile identity that survives host and display-name changes;
- semantic output role/mode, including whether R1/R2 and R3/R4 are Side A/B direction-enable motion pairs or ordinary relays;
- bounded mappings/limits that firmware must enforce or advertise.
The PC-side profile, keyed by stable identity with USB-instance fallback only for unprovisioned boards, owns richer mutable metadata:
- board display name and venue/use label;
- localized channel names, icons, colors and grouping;
- semantic actions such as
seat.a.up,seat.a.down,seat.a.stop,relay.5,pwm.0and strip targets; - Pealayer presentation and effect-editor metadata.
PCController publishes resolved, live capability descriptors. Pealayer consumes those descriptors and never infers wiring from relay numbers, board names or samples.
Lane B — cinema-seat motion recording and macro playback
Owning issue: #44. Related: #24, #25, #45, #47, #162, #166.
- Inventory and test every recording source: physical/front-panel input, learned RF, host/TUI/WebUI/API command, automation and Pealayer action.
- Prefer board-originated monotonic timestamps/deltas; clearly mark host-arrival timing only where the source cannot supply device time.
- Record semantic Side A/B Up/Down/Stop actions for motion-configured boards, not fragile direct-relay assumptions.
- Keep relay, PWM/MOSFET, display, audio, RF and extensible opcode actions in the same editable timeline.
- Verify bounded MCU queue refill, execution evidence, progress, underrun, cancel and final all-off state on the physical CAFE board.
- Expose list/create/record/edit/save/discard/play/cancel/progress through library, CLI/TUI/WebUI, JSON-RPC/events and Pealayer.
Lane C — WS2811 effects
Owning issue: #390. Related: #107, #183, #377.
Required built-ins:
- configurable red/blue police pattern;
- deterministic white thunder/lightning with decay and peak limit;
- two fading red dots travelling from opposite ends to the center.
The PC host remains the rich renderer. A bounded RAM-resident board queue or compact reusable descriptor/cache may reduce latency and serial bandwidth only after measuring ATmega328P SRAM/stack headroom. It must be optional, capability-negotiated and unable to starve motion/relay/control traffic. Do not move the rich effect generator into AVR flash merely to reduce traffic.
Completion requires physical strip observation with frame rate, jitter, queue/underrun and reconnect evidence—not only frame hashes or VirtualBoard success.
Lane D — Pealayer 4D effect authoring
Cross-project owner: ToghrolTP/pealayer#32 plus focused child work as needed.
- Discover PCController, board profile, targets, controls, effects and action schemas dynamically.
- Provide an effect library/editor that can place seat A/B Up/Down/Stop, general relays, PWM/MOSFET, strip effects, display/audio and other advertised actions on a video-relative timeline.
- Support record-from-live-control, manual editing, trimming, copying, moving, naming and categorizing actions.
- Start/pause/cancel/reseek deterministically with video; show drift, disconnected/degraded state and actual applied/rejected outcomes.
- Never ship hardcoded sample effects as live hardware capabilities.
Lane E — host parity and deployment
- Deploy only merged
mainpackages to canonical install roots on all three Windows hosts. - Verify exact source/package identity, process path, TUI on the interactive console, WebUI assets/routes, HTTP/WebSocket/event flow and peer/local IPC communication.
- CAFE-PC is the physical acceptance host. Leave seat outputs and strip in a known state after each test.
Agent handoff contract
Every owner should comment with:
- exact owned slice and related issue;
- current
mainSHA and branch/PR if code is changing; - behavior already present, with source/test evidence;
- precise missing behavior and dependency;
- next smallest mergeable slice;
- tests and physical evidence performed;
- final output state and deployment identity.
Do not repeat historical claims as current fact. Refresh issue bodies/labels/open state as evidence changes.
Definition of done
- Seat motion can be recorded, edited and replayed on the physical CAFE board and initiated from Pealayer in sync with a video.
- The three requested WS2811 effects visibly work on the real strip and are available through supported PCController surfaces and Pealayer.
- Board/profile descriptors truthfully carry identity, roles, names/icons and capabilities without hardcoded Pealayer knowledge.
- DAVID-PC, CAFE-PC and ERFAN-GAMING run the same merged package and can communicate through advertised endpoints.
- TUI and WebUI are operational on every applicable host; their whole-surface audit issues have current evidence and child fixes.
- No unique implementation remains only in a local checkout, orphan branch or closed-unmerged PR.
Media timing and MCU expansion documentation checkpoint
Media timing and MCU expansion roadmap (merged PR #608; complete successor reconciliation PR #619) links this integration lane to #18, #103/#227, #87 and #71/#390. This is a preserved later-work plan, not deployment or physical acceptance.
- Keep prepared-plan ACK and matching clock-epoch/revision ACK as separate gates; distinguish 40 ms publish cadence, 50 ms default action ACK lateness, 250 ms execution freshness and three-second presence/display leases.
- Follow the roadmap's reviewed DISPLAY_TEXT scheduled-segment contract; do not present reserved MEDIA_CLOCK 0x4A as an implemented MCU epoch scheduler. Prepared timeline execution remains host-owned; board-side epoch/deadline execution is a later explicitly validated capability.
- Treat Unsupported/native capability mismatch distinctly from physical disconnect; preserve truthful identity/session/authority diagnostics.
- Measure physical output edges against actual video presentation under load, seeks, pause/resume, reconnect and authority handoff. No perfect-timing claim follows from a host ACK, merge, compiled profile or staged package.
- Keep strip diagnosis and optional expanded feature bundles coordinated with their existing owners. Do not flash another task's board or silently migrate host/board ownership during documentation work.
Activity
Add host-rendered WS2811 cinema effects (#557)
DRSDavidSoft commentedon Sep 29, 2026
Milestone: first usable lighting + video-macro integration slice
GitHub remains the source of truth. This checkpoint preserves what is complete and what still needs implementation.
Completed and merged
9ab05e62be7bcfb6c708e22ac427031200c52216police,white-thunder, andconverging-redstrip effects;111f6616f7da2e25d45a920f16826baa65702781cargo test --lockedpass across all unit and integration suites.Live deployment finding and correction
David-PC and Cafe-PC were rebuilt/deployed from #557. Live invocation then exposed a route missed by lower-level tests:
strip effect ...was not forwarded by the public command engine. #558 adds that one-line route and, importantly, a public-command regression test. It is auto-merge gated by the normal cross-platform build and CodeQL checks; final three-host deployment will use its merge commit, not an intermediate branch binary.Host state
9ab05e62, exact deployed package hashccc560fb..., binary97160182..., interactive session 4, WebUI/TUI host listening on:::8787, COM3 authenticated, board healthy, zero framing/CRC errors.127.0.0.1:8788(no physical board attached).ssh -p 6022 ghj@localhostworks again. Its currently healthy but stale PCController will be updated from Fix strip effect command routing #558's merge package.Next acceptance work
strip effect listthrough the real shared command path;motion.a|b.up|down|stoproles so R1–R4 can be either seat pairs or ordinary relays without hardcoding presentation names;Safety/enclosure work remains a guardrail but is not the headline of this prototype milestone, per project-owner priority.
Fix strip effect command routing (#558)
DRSDavidSoft commentedon Sep 29, 2026
Peer-native deployment hardening is now PR #559. It closes the specific gap where transfer/staging succeeded but the sender did not wait for restart health or prove the active executable SHA. The Go coordinator now waits through close/relaunch/reconnect, requires exact SHA acknowledgement, emits factual progress to TUI/Web/taskbar/toasts, and preserves retry identity on uncertain terminal outcomes. Focused Go tests plus 344 Web tests/typecheck/build are green locally. Next acceptance gate after merge: build main once, install DAVID-PC, then distribute that exact artifact to CAFE-PC and ERFAN-GAMING through peer-update host, with SSH used only for diagnostics/recovery.
DRSDavidSoft commentedon Sep 30, 2026
Native peer deployment milestone
PR #559 now has live three-host evidence. DAVID-PC sent the verified candidate to CAFE-PC through the PCController Go bridge; CAFE-PC then sent it to ERFAN-GAMING through its configured bridge. Both remote operations reached terminal
completedacknowledgement only after the restarted instance reported the exact SHA continuously through the health-commit window.All three canonical processes now run executable SHA
9c48c19d60f7b3bd8bf810dfa064e20ea3b2e4074709fde413126fe852bc858f. CAFE's physical board remains connected. The same change publishes bounded update progress to TUI, Web UI, taskbar and native/Web toasts and exposes self-identifying host facts. See PR #559 for exact operation IDs, root-cause fixes, tests, and remaining one-time DAVID-PC firewall elevation action.DRSDavidSoft commentedon Sep 30, 2026
Refreshed current-state checkpoint
The implementation has advanced beyond the older audit and the next work will build on, not duplicate, these merged milestones:
mainthrough the Go peer updater; prove all three on CAFE's physical strip and verify TUI/Web/API discoverabilitymainmust be rebuilt and redistributed through PCController itselfseat.a/b.up/down/stopevidence alongside electrical masks; physical CAFE recording/replay acceptanceCurrent architectural decision
For the first mergeable slice, keep rich mutable metadata on the PC host in a profile keyed by stable board identity. Advertise stable control/action IDs and presentation metadata to every client. A later firmware slice may store only a compact
profile_id/identity hint if physical portability requires it; do not spend scarce AVR flash/SRAM on localized names or icons.ordinary-relaysorcinema-seat-motion; the host must not infer this from board name.Active next slices
Concise domain labels remain the tracking vocabulary:
motion,macros,lighting,profiles,integration,webui, andtui. GitHub comments/PRs are the handoff; no unique work may remain only in an agent checkout.DRSDavidSoft commentedon Sep 30, 2026
Deployment update: live validation exposed a cross-host routing defect in the native updater. The DAVID local update host command used default port 8787 before loading configured primary port 8788 and therefore updated CAFE. PR #560 fixes initialization order and adds focused regression coverage. Until #560 is merged and deployed, local host updates must not be considered safe on hosts whose configured primary differs from 8787. No code was lost: CAFE accepted the candidate and DAVID remained on its prior verified binary.
DRSDavidSoft commentedon Sep 30, 2026
Live deployment and discovery checkpoint
The native peer-update path is now proven across the three Windows hosts with exact restart acknowledgement. A wrong-target defect found during this verification is fixed by PR #560 and guarded by a focused test.
Operations: DAVID self-update op-436baa1db8a54753; DAVID to CAFE op-88153406df266d6f; CAFE to ERFAN op-97ea636aeacd7e9f. All returned terminal_verified=true and the exact active SHA after restart. No manual binary copy or remote build was used.
Fresh controller.host.facts queries also succeeded on every host. Current machine facts: DAVID Windows 11 Enterprise 26100, 16 logical processors, 68.5 GB physical memory; CAFE Windows 10 Enterprise 19045, ASUS K55VD, 4 logical processors, 12.8 GB; ERFAN Windows 10 Enterprise 19045, 8 logical processors, 8.5 GB.
Discovery evidence is live: CAFE and ERFAN see each other over mDNS/SSDP/WS-Discovery/broadcast/NetBIOS, and DAVID sees CAFE through its reachable network/tunnel endpoint. Pealayer auto-selection work is active on a dedicated branch and ranks an attached configured board before falling back to localhost.
Next merge order remains: #560, TUI strip-effect completion discoverability, semantic board profiles/actions/presentation, then Pealayer live end-to-end acceptance and a final native peer deployment.
24 remaining items
DRSDavidSoft commentedon Oct 10, 2026
PR #627 is pushed through
7a6aae5aonfix/media-timeline-request-priority. Review caught a pause-event regression introduced by the bounded arming wait: the paused clock snapshot was already accepted, but an arm failure returned before broadcasting that state. Publication now precedes the wait, and a regression test proves paused state delivery alongside a failed arm. The control media suite passed through the stable Windows runner, with the temporary local Go directive restored before commit; diff check passed.The earlier UART-priority and paused-epoch-ACK fixes remain intact. The added blocked-cleanup test confirms read-only authority/playback snapshots stay available during serial safety cleanup. The separate Pealayer metadata worker is being reviewed in ToghrolTP/pealayer#133; stale metadata acquisition time needs explicit guarding there.
Next: let required checks finish and merge #627, deploy its exact tested merged package through the existing updater coordination, and complete the safe joint playback/restore trace. Queue priority cannot preempt an operation already on the wire. Keep the 50 ms cue budget and 250 ms clock-freshness guard. No application restart or live board action was performed in this source/test checkpoint.
DRSDavidSoft commentedon Oct 10, 2026
Cause and fix
Follow-up to #627 and #554: unchanged paused clock heartbeats unnecessarily awaited another timeline-worker sequence acknowledgement. Under scheduling pressure this produced a 250 ms arm timeout and repeated plan preparation, even though the same paused epoch and position had already been armed.
Only a fresh, loaded, unchanged paused heartbeat for the same client, plan revision, armed epoch and acknowledged position skips that redundant wait. Initial arming, playing-to-paused cleanup, seek, new epoch, changed revision, expired lease and faulted/unacknowledged plans keep the existing acknowledgement path. The 50 ms cue deadline and 250 ms freshness guard are unchanged.
Verification
node Tools/Build/go-tests.mjs --go <installed Go> --package internal/control --run TestMedia: PASS.Live acceptance / handoff
This follow-up is not deployed yet. Previous exact #627 candidate is running and both applications answer their health endpoints, but shared-load latency still prevents a complete timing acceptance claim. Deployment owner must install the exact tested merged package, then verify unchanged paused heartbeats and safe cue-free playback with real media. Do not actuate a relay, seek across a latched relay cue, or weaken safety deadlines to pass a test.
Closes no wider timing or firmware issue; #554 remains the coordination owner.
DRSDavidSoft commentedon Oct 10, 2026
Joint live acceptance failed; both apps left open and paused
The human approved a one-minute no-interaction test. Fresh preflight found a persistent Relay 8 cue, so seeking beyond all cues was rejected as unsafe. An alternate interval was verified using Pealayer's live
/api/peer/session:timeline.timeline.analog_trackswas genuinely empty; exactly four current instances/templates matched two direct seat hold cues (ending at STOP), a future Relay 8 cue and a future strip reference. Source inspection and controller-owner review confirmed that the 1.5–61.5 second interval crossed no hardware cue, with only the first seat cue's historical STOP restored.The test sought to 1.5 seconds while paused, waited for matching paused epoch/revision acknowledgement and requested Play. Playback briefly advanced to 1.92 seconds, then faulted before a stable playing sample could be recorded. No scheduled motion cue was crossed. The intended 60-second acceptance did not pass.
Fault snapshot captured from PCController before final Pause:
f414b89, controller CI 1449 (PR Acknowledge media arming and prioritize timeline UART requests #627 source).faulted, 814 resolved steps, zero acknowledged cue steps; clock position 1850 ms.motion-1/0: historical STOP, not a direction command.resume state motion-1/0 not acknowledged after 93.7 ms: waiting for serial request slot: context deadline exceeded; output-off cleanup not acknowledged: waiting for serial request slot: context deadline exceeded.Final Pause was explicitly requested and then verified: Pealayer
playing=false, position 1.92 seconds, controller timelinepaused, both app processes responsive and board connection present. A later refresh cleared transient presentation error, butrequires_reprepare=trueremains; this is not proof of timing recovery.Pealayer PR #133 is merged as
ea2df166f287346f853f7417884927eaa42849f1; the exact installed reviewed commit remains independently fetchable. Required gates/Windows build passed; an optional macOS Apple silicon job was still running at merge and is not claimed complete.The controller owner has durably published the unchanged-paused-heartbeat fix in PCController PR #628, head
af8c82e04fba2be87664b0fbf013d1ed722f2c98. Its focusedTestMediachecks passed through the required stable Windows runner; CI/deployment remain pending. The restore slot failure above is additional evidence to investigate, not automatically resolved by that heartbeat fix. Preserve the 50 ms physical deadline and 250 ms clock freshness guard; no unsupported seat/Relay 8 actuation test is authorized.Next owner action: trace normal in-flight UART ownership and scheduling pressure, deploy the exact validated controller follow-up through its updater, reverify the live plan before any new playback, and repeat the bounded safe interval test. Do not mark #80/#554 or physical timing acceptance complete from clean repositories, smoke tests or recovered paused health.
DRSDavidSoft commentedon Oct 10, 2026
Timing failure diagnostic
Follow-up to #627, #628 and #554. A safe cue-free playback test still failed while restoring a historical STOP command: 93.7 ms elapsed waiting for serial admission, followed by output-off cleanup also failing to acquire that slot. No motion cue was executed. The paused heartbeat fix is separate and does not establish a restore fix.
This change identifies the requested opcode, elapsed queue wait, and the registered active opcode/monotonic age in serial admission failures. It reports the completion-race case explicitly when no request is currently registered. No command payload, device identity or client information is exposed. Wrapped context errors retain their identity. No safety deadline or request scheduling policy changes.
Focused regression holds a GET_STATUS response, times out a priority STOP request, verifies the blocking opcode is reported, then confirms cancellation does not emit the expired request after the slot becomes free.
Verification: stable-path Windows runner
node Tools/Build/go-tests.mjs --package internal/link --run 'TestRequest|TestTimelineRequest|TestCancelledQueuedRequest|TestConcurrentRequest'PASS, including existing priority/cancellation/serialization cases. Local Go 1.27.1 used temporarily; repository Go 1.27.2 directive restored before commit.git diff --checkPASS.Next action: deploy the exact tested merged diagnostic head with #628, capture the active opcode on any repeated safe STOP restore failure, and fix the concrete blocking path. Do not increase the 50 ms cue deadline or 250 ms clock freshness guard, actuate a motion cue, or count a runtime restart as success. The owning issue remains #554.
Checkpoint: PR #629, branch
fix/serial-slot-diagnostics, remote commit858b80a4; its complete source tree is identical to focused-tested local commit06a72805. Git Data API publication worked while native Git pushes stalled. The local commit is intentionally preserved metadata, not unpublished source; do not discard it without this comparison. Relevant worktrees are clean. Deployment is still pending. Merge #628 and #629, then build/deploy the exact combined merged head; avoid a later artifact from a branch that omits the sibling fix.DRSDavidSoft commentedon Oct 10, 2026
Cause
Media-authority transfer stopped the old executor, then attempted output cleanup against its old generation whenever any board was connected. Once that generation was superseded, all four pinned cleanup requests were guaranteed to fail, permanently preventing a new publisher claim/release. Sending those commands to a replacement board would also be unsafe.
Fix and safety
Require cleanup only when the prepared plan belongs to the currently connected generation. Never retarget an old plan or old cleanup to the replacement session. The new publisher must still reprepare its plan and arm its clock. Cleanup errors on the current generation still reject transfer and retain its owner; cue deadlines, freshness guards, exclusive reservations and authority admission are unchanged.
Focused verification
node Tools/Build/go-tests.mjs --package internal/control --run TestMedia.git diff --checkPASS. Local installed Go 1.27.1 used with a temporary directive, restored to repository Go 1.27.2 before commit.Delivery / next action
Coordinate with #628 and #629 under #554. Merge all three and deploy an exact tested combined main package; any individual branch package omits the other fixes. Live motion remains unaccepted: the previous safe STOP restore timed out on serial admission. The diagnostic identifies the active blocking opcode on the next bounded test. Do not bypass the 50 ms cue or 250 ms freshness guards, reset a healthy board, or count the cleanup fix as proof that the independent timing defect is eliminated.
A board reset was observed during preflight, but this PR fixes the subsequent stale-generation recovery blocker, not the unproven cause of that reset. Preserve and investigate reset/liveness evidence separately.
Durable handoff: PR #630, branch
fix/media-authority-reconnect, exact tested local/remote commit45ae32fb. Publication through the Git Data API preserved the exact commit this time (including its trailing message newline); remote ref verified. No runtime replacement, board reset or actuation was performed in this source pass. Deployment/test owner must use combined main containing #628, #629 and #630 before the bounded human-authorized existing Seat Down test; do not cross or restore the unrelated persistent relay cue. Actual physical movement needs the human's confirmation in addition to protocol acknowledgements.DRSDavidSoft commentedon Oct 10, 2026
Combined media-runtime repairs
Integration of three reviewed, focused-tested changes via merge commits, preserving both sides and keeping the individual protected PRs active:
af8c82e0858b80a445ae32fbNo safety deadline is widened. Current-generation cleanup still fails closed, new plans require preparation and arming, and no motion cue, reset, restart or production replacement was performed by this source-integration task.
Verification and delivery
Combined stable-path Windows tests select
TestMedia|TestRequest|TestTimelineRequest|TestCancelledQueuedRequest|TestConcurrentRequestininternal/controlandinternal/link. Repository Go 1.27.2 stays unchanged; focused local tests use the installed Go 1.27.1 with a temporary restored directive.Result: both packages PASS on combined head
bf87970e;git diff --checkPASS. The three original source heads are ancestors of this candidate, not cherry-picked replacements.This branch enables a single exact combined CI package. Do not deploy an individual #629 branch artifact that lacks the other repairs. Required merge protections and individual PR auto-merges remain intact; this PR is not authorization to bypass them. Production deployment must follow the user's exact tested merged-head policy, unless the human explicitly authorizes a pre-merge acceptance candidate in the deployment owner's chat.
Live acceptance is still failed, not completed: the safe STOP restore waited 93.7 ms for serial admission. A subsequent board reset led to stale-generation authority cleanup failures. The new diagnostic must identify the next blocking opcode; the reset cause also remains to investigate. Deployment/test owner must coordinate one updater replacement, keep physical movement confirmation separate from ACK/screenshots, and test only the bounded existing authorized Seat Down cue, avoiding the unrelated persistent relay cue.
Owning issue: #554. Merge/fetch current main into this branch without rebase/force as other PRs land, compare both sides, and preserve all unsuperseded work.
DRSDavidSoft commentedon Oct 10, 2026
Combined media-runtime continuation: PR #631, branch
fix/media-playback-runtime, updated headfe1cfefb.91534a40with a merge commit (no rebase/force). Avoid redundant paused-clock rearming under load #628 is now merged; Identify serial admission blocker in timing faults #629/Recover media authority after board generation replacement #630 source heads remain preserved ancestors of the combined branch.bf87970eremain applicable to the exact same source. Repository Go 1.27.2 is unchanged.Next action: obtain a successful Windows package for exact tested merged main containing all three fixes, coordinate the single updater delivery, then verify authority recovery, paused heartbeats and the existing bounded human-authorized Seat Down cue. Obtain human readiness and physical movement confirmation; protocol ACK or a software screenshot alone is insufficient. Preserve the 50 ms cue and 250 ms freshness safeguards and investigate any remaining active-opcode timeout/reset cause.
DRSDavidSoft commentedon Oct 10, 2026
Seat-cue acceptance checkpoint
02a275e81a57de036fd3b1407bd9d335c688b402, merge257bce876b1639891b7c70aa7c75283235b62dc6). Actual Persian synthesis completed with one intra-op and one inter-op worker; playback completed before any timing test. Private text, WAV and screenshots remain outside Git.f414b89f06c9fc5a054ab7110e85606826baeea0; these two documentation/tooling changes do not modify its Rust runtime. Health and an interactive responding window are live-verified. Playback remains paused. No new seat-motion test has run in this pass.fe1cfefb49218f3aa98a203bab6a8243c84e43e1. It includes the paused-clock fix, serial-slot diagnostic and stale-generation authority fix. Wait for protected merge and a matching successful Windows package; do not deploy an obsolete single-fix branch or bypass gates.Next owner action: complete the combined controller package, then perform the bounded pre-cue test and publish a truthful acceptance receipt. Health alone does not establish hardware timing recovery.
DRSDavidSoft commentedon Oct 10, 2026
Installed combined controller; bounded cue still fails closed
PCController #631 is merged and its matching Windows host CI1456 package was SHA-verified and installed through the product updater (operation
op-a75f83ee79779a7acompleted). Interactive process/health verified; board reset count unchanged. Source/build/installed identities and the complete bounded receipt are in seat-cue timing.Both host and board already use the configurable enclosure-door policy Always. The user clarified this is a control-panel door, not a seat-area guard. No door setting, firmware, emergency stop, relay interlock or other protective mechanism was changed.
The authorized early cue is Down at 404 ms, STOP at 904 ms. Playback started from a frame-rounded 160 ms (requested154). The first cue failed before a motion write: dispatch54.2465 ms late, ACK0, clocksequence1274 at458 ms, revision178/epoch5/generation1. Final Pause and zero relays / both sides applied Stop were verified. Physical-motion acceptance is NOT passed. Original fault was captured before Pause/reprepare changed the presentation.
Pealayer PR136, source
2483b9f4a8757b05129ce990026b521f8fbda692, is merged and adds direct nonblocking process-status diagnostics so ACK age is not taken from a cached UI string. PR137, source8698d47c5bfb215a4d5be97c704a09a9ed8b35f7, is also merged and forwards coordinated worker/read delays and clock corrections. Canonical main316d6681f66fb66636943b7cd5e3df382c10b9bbis GitHub-verified and clean. Source independently reviewed; focused regressions added; no local Rust compilation/tests. Successful Windows package and deployment remain pending. No timing guards or actuators changed.Controller PR632 on
fix/media-cue-dispatchadds interval/correction/worker-delay diagnostics. A concrete starvation path was found: catalog expansion held the shared connection RWMutex and could block the executor behind a pending writer. Source owner is moving presentation outside that lock and running deterministic regressions; review and final exact head/package must be checked. This path is not yet proven to explain the physical 54 ms miss. No blind widening of dispatch/ACK/clock budgets. Keep runtime paused and outputs stopped pending reviewed source/merged package and a newly announced bounded acceptance test.Private screenshots/narration remain outside Git. A short post-test paused CPU sample measured Pealayer66.4% and controller34.8% of one logical core; this is not a CPU soak, whole-machine attribution or sustained-playing acceptance. Remote-access services remain untouched.
DRSDavidSoft commentedon Oct 10, 2026
Why
The bounded physical test captured in #554 failed closed: the first motion cue due at 404 ms was considered 54.2465 ms late, before any write or ACK. The existing lateness number does not distinguish a client clock leap from executor starvation or snapshot lock contention. Old cumulative Pealayer transport maxima cannot be attributed to this new test.
Change
Runtime.Snapshotno longer holds the shared connection RWMutex across effect catalog/config/library expansion. A pending writer formerly blocked subsequent readers, including the executor generation check. Capture the runner pointer with the board snapshot, then build presentation catalogs outside the connection lock. A blocked-provider regression verifies connection writer/reader access and retained catalog content.This fixes a reproducible shared-lock starvation path and adds targeted diagnostic instrumentation, not a claim that it caused the live miss or that physical timing acceptance is complete. The 50 ms dispatch/ACK budget, 250 ms clock freshness, safety/ownership and physical test scope are unchanged. No app restart, board reset, firmware flash or actuation was performed in this source lane.
Verification and next action
Stable-path Windows runner:
node Tools/Build/go-tests.mjs --go "C:\Program Files\Go-1.27.1\bin\go.exe" --package internal/control --run 'TestMedia|TestDoorEvent|TestResetEvent|TestAlertEvent|TestDisconnectedRuntime'— PASS. The focused catalog-lock regression fails against the original Snapshot lock scope (250 ms timeout), and passes with the fix restored. The local module directive was temporarily lowered solely for the installed compiler, then restored to 1.27.2 before commit.git diff --checkpassed.Source:
fix/media-cue-dispatchat01cb5ecb(includes diagnostic commit94c0aa8b). After review and matching Windows CI, merge and let the exclusive live-test owner deploy the exact tested merged package. Collect these phases in a renewed announced bounded test; repair any additional proven source cause without widening guards. Pealayer PR136/137 supply live nonblocking ACK age and forwarding of these fields rather than cached UI age. Motion acceptance remains failed/pending; leave runtime paused/stopped until coordinated testing.Refs #554; does not close the larger acceptance issue.
DRSDavidSoft commentedon Oct 10, 2026
Checkpoint: final fix/media-cue-dispatch head01cb5ecb is pushed and API-ref verified; both relevant PCController worktrees and canonical Pealayer source are clean, no stale worktree metadata. Existing paused-clock/serial-diagnostics local duplicate commit IDs are intentionally preserved: their source trees exactly match GitHub af8c82e/858b80a4, already integrated by #631. The priority source is also main ancestry; no useful source is stranded in these metadata-only differences. #632 protected auto-merge is queued for the final head, owner has exclusive package deployment/live test lane. No runtime changes in this source pass; physical timing remains pending, guard budgets unchanged. Next: matching tested merged Windows package, then announced bounded cue test and phase evidence before any broader acceptance claim.
DRSDavidSoft commentedon Oct 10, 2026
Paired timing-fault deployment checkpoint
c26cc561d2bf353a948312f89f59d90dbda8e38d, after all required checks passed. Final tested source:01cb5ecb0f9a68179546ba51e9c88786d3709b90; GitHub compare confirms it is contained in main.0.0.0-ci.1459, source hashF69E5C467072921F8DD848C51E053EC4504BE26C2D5F2FE0258033F7D93EF412, executable SHA-2563FA0CB311E6D16106C2EBCB82DD99B4D25C9D3C7990322AFA2B637FF9AAC878C. Updater operation completed; installed file hash, live version, RPC and interactive responsiveness verified. Matching public package sidecars updated. No board flash/reset; relay outputs zero and both motion states Stop.f414b89f06c9fc5a054ab7110e85606826baeea0executable. The exact merged-main diagnostics build316d6681f66fb66636943b7cd5e3df382c10b9bbis staged (SHA-256A9F434FE1A976C501DDDA86CDAF6AB0AB5BBB4AE0C8B6D315C477FBC94CEF4A8). Staging DLL aliases use only the destination-validated runtime. Command-tool policy rejected attempts containing its smoke-test launch; no smoke success is claimed and this staged Pealayer executable has NOT been installed.8ac7097cc48d13bef57ad3bd32db7d5a3eac5e26, GitHub-ref verified. Both registered PCController worktrees are clean; source owner owns their branch cleanup. Private screenshots, speech, media/configuration and generated staging packages stay local; this is not a claim that the entire machine is wipe-safe.Next owner action: verify/install the staged exact merged Pealayer diagnostics build only when smoke validation is available; obtain fresh human readiness and run the narrowly authorized cue test with the installed CI1459 controller. Preserve the 50 ms dispatch/ACK and 250 ms clock-freshness guards. Record the receipt in Pealayer #80 and PCController #554; no concurrent runtime actuation or remote-access service changes.
DRSDavidSoft commentedon Oct 11, 2026
Outcome
The narrowly authorized existing Seat Left Down cue and its STOP both received board ACKs without a timing fault after the PCController #632 deployment. The player was paused afterward, both motion states were Stop and all relays were off. Human-observed mechanical movement/STOP is still pending; this is not sustained or open-enclosure acceptance.
Evidence and limits
Owning trackers: ToghrolTP/pealayer#80 and #554.
Technical receipt: https://github.com/ToghrolTP/pealayer/blob/aa9907bdce4514311822fb4a9b4664e94a6da1c7/docs/verification/seat-cue-timing.md
Owning documentation PR: ToghrolTP/pealayer#140
DRSDavidSoft commentedon Oct 11, 2026
Coordination contract checkpoint at merged main c26cc56: whole-effect repeat/interval and user-selectable recorder opcode/track filters are NOT currently implemented. appconfig.Macro has no repeat fields; MacroStep has repeat_count (0/1 means once, max1000) and repeat_interval_ms (max3600000; implicit interval max(duration,1ms), no duration overlap). MediaTimelineCue has id/reference/time_ms/duration_ms only. Recording start/append APIs have metadata/capture-mode but no selector; background evidence is excluded and fixed opcode allowlists apply. Timestamped relay edges persist complete relay-mask plus action_ids, so hiding tracks is not a recording filter and may replay excluded outputs. Board-retained capture is a bounded relay tail, not arbitrary opcode capture. Pealayer owner has received exact supported contracts and backend gaps; next action is agree whole-effect repeat and explicit none/all capture-selection semantics, then implement common recorder/compiler enforcement with preserved unselected outputs, clocks, overflow/capacity and host/MCU tests. Do not claim invented top-level repeat fields or UI-only filtering are effective. Read-only source audit; no code, runtime, board, plan or output changes. Existing tested cue protocol success and pending human physical confirmation remain separate.