# Cumulative Code Review — Batches 16-18 (Cycle 1)

**Scope**: AZ-658, AZ-680, AZ-681, AZ-659, AZ-660, AZ-661
**Date**: 2026-05-20
**Overall Verdict**: PASS_WITH_WARNINGS

---

## Scope Summary

| Batch | Tasks | Components |
|-------|-------|-----------|
| 16 | AZ-658 frame_ingest decoder | frame_ingest |
| 17 | AZ-680 operator_bridge command dispatch; AZ-681 safety+BIT ack | shared, scan_controller, mission_executor, operator_bridge |
| 18 | AZ-659 frame_ingest publisher; AZ-660 detection_client gRPC stream; AZ-661 schema+health | frame_ingest, detection_client |

---

## Cross-Batch Architecture Consistency

### Layer compliance (all batches)

No layer violations found across batches 16-18. Every crate imports only `shared` (Layer 1) for cross-component types. Cross-component dispatch uses traits in `shared::contracts`. The `detection_client` receives a `broadcast::Receiver<Frame>` injected by the composition root — it does not import `frame_ingest`.

### Pattern consistency

| Pattern | Batches 16-18 usage |
|---------|---------------------|
| Async actor model | All components expose `run()` → `JoinHandle` + `Handle`. ✓ |
| `shared::models` for data | `Frame`, `DetectionBatch`, `BoundingBox`, `Detection` all come from `shared`. ✓ |
| `shared::contracts` for cross-cutting dispatch | `ScanCommandRouter`, `MissionSafetyRouter`, `BitReportSeverityLookup` added in batch 17; `detection_client` and `frame_ingest` do not need new traits. ✓ |
| Lock-free counters | `AtomicU64` used uniformly across `detection_client::DetectionStats`, `frame_ingest::PublisherStats`. ✓ |
| Broadcast channels for fan-out | Batch 18 adds `FramePublisher` (wrapping `tokio::sync::broadcast`) for the frame pipeline; consistent with the existing telemetry broadcast pattern. ✓ |

### Interface wiring readiness

The composition root (`crates/autopilot/src/runtime.rs`) still needs to wire:
- `frame_ingest.handle().subscribe_as(ConsumerId::DetectionClient)` → raw receiver forwarded to `DetectionClient::run(frame_rx)`
- `detection_client_handle.subscribe_events()` → event receiver forwarded to `scan_controller` and `telemetry_stream`

Neither wiring is in scope for batches 16-18 — they belong to the final runtime composition task. No interface mismatch found.

---

## Findings (cumulative, deduplicated)

| # | Severity | Category | File:Line | Title | Batch | Disposition |
|---|----------|----------|-----------|-------|-------|-------------|
| 1 | Low | Architecture | `detection_client/src/lib.rs` | `pub mod internal` exposes proto server types to external crates | 18 | Accepted: required for integration test fixture server; practical risk negligible |
| 2 | Low | Maintainability | `detection_client/src/internal/stats.rs:66` | `note_orphan_response` increments `stream_errors_total` — imprecise bucket | 18 | Accepted: additive counter, low severity; add `orphan_responses_total` in next stats refactor |
| 3 | Low | Performance | `detection_client/src/internal/runtime.rs:build_request` | Pixel buffer copy per gRPC frame | 18 | Accepted: unavoidable with current prost stack; revisit when `prost bytes` feature is evaluated |
| 4 | Low | Architecture | `crates/autopilot/src/runtime.rs:84` | Pre-existing dead-code lint on `vlm_provider_name` | 16 | Pre-existing; tracked in `_docs/_process_leftovers/2026-05-20_autopilot_clippy.md` |

**Critical**: 0 | **High**: 0 | **Medium**: 0 (one Medium from batch 18 was fixed inline)

---

## Per-Batch Batch Review Cross-Reference

| Batch | Per-batch verdict | Findings fixed | Open low/med |
|-------|------------------|----------------|-------------|
| 16 | PASS_WITH_WARNINGS | — | 1 Low (FFmpeg EAGAIN string match), 1 Low (autopilot dead-code) |
| 17 | PASS | — | None |
| 18 | PASS_WITH_WARNINGS | F1 Medium (dead code) fixed inline | 3 Low accepted |

---

## Open Risks

1. **`mission_executor` polling race** — `ac1_multirotor_happy_path_reaches_done` (and the earlier `ac3`) intermittently fail under load. Tracked in `_docs/_process_leftovers/2026-05-20_mission_executor_ac3_flake.md`. Not a production defect; fix in the next `mission_executor` batch.

2. **Composition root wiring gap** — `frame_ingest` publisher and `detection_client` supervisor are not yet wired in `autopilot/src/runtime.rs`. This is expected and intentional; the composition root is wired in a dedicated final-assembly task once all leaf components are done.

3. **Real `../detections` service not tested** — `detection_client` tests use a fixture in-process gRPC server. End-to-end integration against the real service is scoped to the suite-level e2e harness.

---

## Quality Gate Status (batches 16-18 combined)

- `cargo fmt --all`: clean
- `cargo clippy -p frame_ingest -p detection_client --all-targets -- -D warnings`: clean
- `cargo test -p frame_ingest -p detection_client`: all passing (17 unit + 3 publisher + 5 rtsp_lifecycle + 10 detection_client unit + 7 detection_client integration)
- `cargo test --workspace`: one pre-existing flake in `mission_executor` (documented, not blocking)

**Verdict: PASS_WITH_WARNINGS — no Critical or High findings; proceed to batch 19.**
