Separate PPOE and PPSM
Reason: Operations and maintenance must remain independent so service work cannot interfere with paging.
Architecture Record
Decision Log
Decisions that define PagePoint direction.
DNS/DHCP belongs to the PPSM appliance
Reason: Infrastructure services belong with maintenance and must run as OS-level daemons independent of the PPSM app process.
No live/runtime TTS in PPOE
Reason: PPOE must remain a reliable playback and paging appliance, not a speech-generation system.
PPSM Version 1 assumes externally generated audio
Reason: External generation provides flexibility, better quality, and independence from a specific TTS engine.
PPSM touchscreen is for service, not administration
Reason: The panel should support quick installer tasks. Browser-based Service Portal handles keyboard-heavy work.
Use file-based PPSM storage for Version 1
Reason: Configuration, packages, backups, logs, inventory, audit records, and job status are naturally file-based. Avoid SQLite until there is a real query or concurrency need.
Engineering Portal source lives inside PagePoint
Reason: The portal is the living technical history. It must version with the project and survive hosting changes or AI session resets.
PPSM normal operation is wired-only
Reason: PPSM owns DNS/DHCP/validation infrastructure and should use its stable wired service identity during normal operation. Keep the Wi-Fi profile available for intentional emergency access, but disable Wi-Fi autoconnect to avoid dual-homed routing, mDNS, and service-discovery ambiguity.
PPOE is authoritative for live phone count
Reason: Operator phones connect to PPOE over Socket.IO. PPOE has the live socket truth, so PPSM should display phone count from PPOE health instead of its local provisioning-oriented phone watcher.
PPSM is the isolated-network time authority
Reason: Public NTP is unavailable on the isolated PagePoint network. PPSM now combines RTC hardware with Linux chrony so OE and phones can use standard NTP instead of a custom PagePoint time protocol.
Phone provisioning framework is backend-neutral first
Reason: PPSM provisioning must support future Android and non-Android workflows. Milestone 3 therefore builds a reusable workflow, health, inventory, audit, simulator, and UI framework before adding ADB or Android-specific command execution.
Android Milestone 4A is read-only
Reason: Before PPSM repairs or provisions phones, it must learn what the Armor X12 exposes consistently. Discovery and inspection are implemented first, while mutation remains structurally separate.
Git is the official engineering history
Reason: PagePoint now has multiple major components evolving together. A clean local Git monorepo provides rollback, reproducibility, release management, customer support, future development, and AI recovery without adding unnecessary remote-hosting or DevOps complexity.
PagePoint Instruction Language is a PPSM subsystem
Reason: Guided workflows must reduce uncertainty for nontechnical users. PPSM uses a consistent short-checklist and large-demonstration language for provisioning, diagnostics, repair, reset, and future hardware workflows rather than one-off explanatory screens.
PagePoint operational audio uses PCM WAV V1
Reason: PPOE operational audio is standardized on 16 kHz, 16-bit, mono, Linear PCM WAV for simple, lossless, deterministic playback with no runtime codec ambiguity.
Stored messages use CHIME -> ZONE ID -> MESSAGE
Reason: Manual stored messages and sequence messages share one playback helper, with explicit LPA/LPB/LPC/LPD/ALL mappings. Live pages remain CHIME -> LIVE MICROPHONE with no spoken zone identification.
OE installation baseline uses the cloned production image
Reason: The original OE image preserved known-good settings and operational behavior while the new 64 GB installation was brought into service. The active OE later received release-candidate fixes and must be recaptured before final duplication.
PPSM broadcasts OE health refreshes automatically
Reason: OE reachability must be reflected on the SM without requiring a manual Diagnostics action. Startup and interval health polls now emit refreshed status.
DYY9 phones use PPSM NTP and America/New_York
Reason: DYY9 and Northeast deployments need deterministic local time and daylight-saving behavior. PPSM provisioning writes the NTP server and timezone, then health checks validate the configured state. Future regions should provide timezone through site configuration.
DYY9 audio outputs use explicit A-H channel mapping
Reason: Do not derive physical output channels by fragile string manipulation or sound-card label assumptions. The accepted DYY9 mapping is A-H = 0,1,6,7,2,3,4,5.
Startup duration cache is authoritative for stored playback timing
Reason: Synchronous duration probing in the stored-message trigger path caused about 2.5 seconds of latency and mixer starvation. Durations are validated at startup; playback refuses missing cache entries rather than blocking live operation.
RoutedAudioMixer is the single ALSA output owner
Reason: Separate live and stored 8-channel aplay owners conflicted on the USB 7.1 card. The shared mixer now owns the hardware while audio_receiver remains modular and feeds live PCM into the mixer.
LIVE PAGE IS KING within correct scope
Reason: A zone live page must immediately own its target zone without stopping unrelated zones. All Call remains globally dominant. Sequence and stored-message paths may not delay or override live pages.
Legacy relay/I2C and LPD6803 outputs are deprecated for DYY9
Reason: DYY9 OE units are audio-only. Absent relay or LED hardware must never initialize, poll, retry, or block the operational Node event loop unless explicitly enabled for legacy hardware testing.
Operational reliability outranks perfect underrun logs
Reason: A brief occasional click is less harmful than a delayed or failed live page. Do not add unacceptable live-page latency just to make diagnostic counters look cleaner.
Split message and page chimes
Reason: DYY9 requested a shorter message chime and a more urgent live-page chime. Proposed active filenames are message_chime.wav and page_chime.wav. Implementation should validate supplied files first, then change only the chime constants and startup validation.
Evaluate FFmpeg removal after DYY9 freeze
Reason: FFmpeg is currently external, not linked. A PCM-native path could remove runtime codec ambiguity later, but it is not a DYY9 release blocker and must pass full audio regression testing before deployment.