Southbound conformance: PAUSED code, eight-measure health, schema alias, renderable panels

[mbreissi]

Aligns camera-adapter with the amended SOUTHBOUND contract (core docs/SOUTHBOUND.md §2.2 / §4 / §5), applied to this adapter's domain command surface (it is a camera, not a signal adapter — honest N/A calls below). Checklist status:

1. PAUSED refusal code — MIGRATED ⚠️ wire-visible

The paused-refusal wire code is now the standardized top-level PAUSED (was INSTANCE_PAUSED). This is a breaking wire-visible change for any client pinning the old string. Semantics unchanged: a paused camera refuses NEW capture work (sb/capture, sb/capture-submit, group forms) while in-flight captures run to completion; sb/reconnect, PTZ, and read-only verbs are unaffected. repoll remains N/A per D-CAM-24 (capture-on-demand/schedule-driven; no poll cycle exists). DESIGN.md (D-CAM-24, error catalog) and docs/reference/messaging-interface.md updated wholesale.

2. Eight-measure southbound_health — MIGRATED

Now exactly connectionState, publishLatencyMs, pollLatencyMs, readErrors, staleSignals, reconnects, writeErrors, signalsSubscribed. The two added measures are structurally constant 0 for a camera, emitted so the family stays fleet-uniform, with the rationale documented in code, DESIGN §19.1, and docs/reference/metrics.md:

• writeErrors: the adapter serves no southbound signal-write surface (sb/write does not exist; PTZ failures ride the CameraPtz family), so no device-path write failure can occur.
• signalsSubscribed: a camera serves no SouthboundSignalUpdate inventory — its data points are images announced on app/image/* — so the gauge reads 0 (the contract's "0 while disconnected" holds trivially).
  The health test now pins the exact eight-measure definition.

3. #/$defs/instance schema alias — CONFORMED-ALREADY

config.schema.json already aliases "instance": { "$ref": "#/$defs/camera" } (landed on main in #10). No change.

4. Panel descriptor floor — MIGRATED (with honest N/A parts)

Kept the existing view set/ids (overview/signals/diagnostics, order 10/20/30, panel scope:"instance"). Raised to the renderable floor: summary/keyValueList widgets carry rows, commandSummary widgets carry verbs (the nonstandard actions key is retired), all widgets carry id/title, and no widget names a writeVerb. N/A parts: no signalGrid (the adapter serves no sb/signals/sb/read signal inventory; the domain cameraRoster/captureSurface kinds remain, now with ids/verb bindings, for a future console) and the previously registered bare treeBrowser widget is removed — see item 5. Each panel now renders meaningfully in the shipped console via its rows/commandSummary widgets; panel-bound verbs are asserted to be verbs the adapter actually registers.

5. Hierarchical sb/browse panel mode — NOT-APPLICABLE

The adapter serves no sb/browse verb and has no hierarchical address space to browse. Its former diagnostics treeBrowser widget had no browse verb to bind (sb/discover is an active WS-Discovery network scan with a closed request schema that would reject the console's {ref, depth, maxRefs} arguments) and could never render — it is removed in favor of renderable keyValueList + commandSummary widgets bound to sb/discover/sb/queue-status. Recorded in D-CAM-26.

Validation

• Baseline (pre-change) on origin/main: cargo check OK; cargo test green — 631 lib tests (+ integration suites, 1 ignored live fixture) — after normalizing the fresh worktree's CRLF checkout of k8s/configmap.yaml back to the committed LF bytes (a core.autocrlf=true checkout artifact that breaks deployment_config.rs's exact-newline marker split on Windows checkouts; no repo content was changed).
• After: cargo test green — 631 lib tests + all integration suites (the extended health/panel tests pass).
• cargo clippy --all-targets (CI runs clippy): 0 warnings.
• Coverage gates (90% line + 95% diff, cargo llvm-cov + diff-cover) run in CI.

Follow-ups (out of scope per the migration spec)

• Adopting registerScoped/setCommandAvailability — requires a core version bump beyond the pinned rev (36a70c4).
• A Windows-checkout-robust deployment_config.rs marker split (tolerating CRLF) would remove the local-checkout fragility noted above.

🤖 Generated with Claude Code

https://claude.ai/code/session_014iQDskU2E1HLStYHoZrSTn