The app on a laptop reported an engine that was never meant to be there

Signing in on a second Mac showed "engine not reachable at
http://127.0.0.1:8010" and 0 of 0 cameras, on an account whose shops were
running and recognising people the whole time. Nothing was broken: Live() and
Cameras() read only the engine on loopback, so the app answered as though the
person had never signed in - and camera sync goes through the engine, which is
why the count was zero rather than stale.

Having no engine is a normal state. A shop PC watches cameras; an owner's
laptop, a manager's machine and a second till being set up do not, and all
three are signed in to the same estate. Both methods now fall back to head
office when loopback fails and somebody is signed in. Loopback is still tried
first: a real shop PC must never be shown a minute-old summary when the engine
two milliseconds away has the live one.

Decisions worth keeping:

- Viewing is on the snapshot, not inferred per screen. Three surfaces read it,
  and a screen that computed it separately is how the shops screen once came
  out labelled Working, in green, above "2 of 3 cameras not connecting".
- fraction_below_gate takes the WORST shop, never an average. 0.10 against
  0.73 averages to 0.42 and hides the only shop anyone needs to visit.
- A remote camera is flagged, and Edit, Remove and Check placement are
  withheld. They talk to a camera on a LAN this computer cannot reach, and a
  button that cannot work is worse than one that is absent.
- connected is three states. null is "no shop computer has reported yet" and
  reads as waiting; false is "Not connecting". A bare false sends somebody to
  check cabling on a camera nobody has tried to reach.
- Snapshots are fetched in Go as data: URIs and cached by snapshot_at. A
  webview <img> resolves a relative src against wails:// and cannot send the
  bearer - the problem VisitorImage already solved - and this screen polls
  every 8 seconds at ~90 KB a camera.
- With no engine AND no session, the engine error is still the answer. The
  person is most likely setting this PC up.

The picture is the last snapshot and the banner says so: there is no live
video from here, because the engine's MJPEG stream is on the shop PC's
loopback behind a router with no inbound route. The LiveHub relay head office
uses is the answer to that and is a further step for this client.

Verified against production: five arrivals and two cameras parsed from the
real API. viewing_test.go covers the fallback, the worst-shop rule, the
withheld credentials and that an unchanged snapshot is fetched once across
two polls.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

desktop/app.go

@@ -616,10 +616,43 @@ func (a *App) StopEngine() EngineStatus {
 
 // ---------------------------------------------------------------- cameras --
 
+// Cameras lists this PC's cameras, or the company's if this PC has none of
+// its own.
+//
+// The distinction is load-bearing and the UI is told which it got. A camera
+// from the local engine is one THIS machine can reach, edit and stream. One
+// from head office is a camera at a shop somewhere else: it has a snapshot
+// and a connection state, and it cannot be edited from here because the shop
+// PC on that LAN is the only thing that can reach it. Offering an Edit button
+// that could not work would be worse than not showing the camera at all.
 func (a *App) Cameras() ([]map[string]any, error) {
 	ctx, cancel := context.WithTimeout(a.ctx, 15*time.Second)
 	defer cancel()
-	return a.local.Cameras(ctx)
+
+	cams, err := a.local.Cameras(ctx)
+	if err == nil {
+		return cams, nil
+	}
+	if !a.cloud.LoggedIn() {
+		return nil, err
+	}
+	remote, rerr := a.cloud.RemoteCameras(ctx)
+	if rerr != nil {
+		return nil, err // the local failure is the one worth reporting
+	}
+	out := make([]map[string]any, 0, len(remote))
+	for _, c := range remote {
+		out = append(out, map[string]any{
+			"id": c.ID, "camera_id": c.CameraID, "label": c.Label,
+			"site": c.Site, "enabled": c.Enabled,
+			"connected": c.Connected, "last_seen_at": c.LastSeenAt,
+			"snapshot": c.Snapshot, "snapshot_at": c.SnapshotAt,
+			// What the screen keys off to hide Edit, Test and Check: this
+			// camera is on a network this PC cannot reach.
+			"remote": true,
+		})
+	}
+	return out, nil
 }
 
 // DiscoverCameras lists the cameras on this PC's network, so the add-camera
@@ -691,20 +724,93 @@ func (a *App) StreamURL(cameraID string) string {
 type LiveSnapshot struct {
 	Stats  map[string]any   `json:"stats"`
 	Events []map[string]any `json:"events"`
+	// Viewing is true when none of this came from an engine on THIS PC. The
+	// screen must say so: the numbers are the company's, not this machine's,
+	// and a laptop in a hotel showing "2 cameras live" without that word
+	// would be claiming to be watching a shop it cannot see.
+	Viewing bool `json:"viewing"`
 }
 
+// Live is what the shop PC sees, and falls back to what HEAD OFFICE sees.
+//
+// A PC with no engine is not necessarily broken - it is somebody signed in on
+// a laptop away from the shop, which is the ordinary way an owner looks at
+// their estate. Until now that produced "engine not reachable at
+// 127.0.0.1:8010", an accurate sentence and a useless one when the reader was
+// never expecting an engine on that machine.
+//
+// The local engine always wins when it is there: it is this shop's own
+// ground truth and it is live rather than a heartbeat old.
 func (a *App) Live() (LiveSnapshot, error) {
 	ctx, cancel := context.WithTimeout(a.ctx, 15*time.Second)
 	defer cancel()
+
 	stats, err := a.local.Stats(ctx)
+	if err == nil {
+		events, eerr := a.local.Events(ctx, 40)
+		if eerr == nil {
+			return LiveSnapshot{Stats: stats, Events: events}, nil
+		}
+	}
+	// No engine here. If nobody is signed in either, the honest answer is
+	// still the local error - there is nothing else to show and the person
+	// is most likely setting this PC up.
+	if !a.cloud.LoggedIn() {
+		return LiveSnapshot{}, err
+	}
+	return a.liveFromCloud(ctx)
+}
+
+// liveFromCloud builds the same shape the Live screen already renders, out of
+// the estate's own feed, so the view needs no second code path.
+func (a *App) liveFromCloud(ctx context.Context) (LiveSnapshot, error) {
+	sites, err := a.cloud.Sites(ctx)
 	if err != nil {
 		return LiveSnapshot{}, err
 	}
-	events, err := a.local.Events(ctx, 40)
+	arrivals, err := a.cloud.Arrivals(ctx, 40)
 	if err != nil {
 		return LiveSnapshot{}, err
 	}
-	return LiveSnapshot{Stats: stats, Events: events}, nil
+
+	// The counters are summed across the estate, and fraction_below_gate
+	// takes the WORST site rather than an average - one badly placed camera
+	// is a hole in the numbers, and averaging it against three good ones
+	// hides the only site anyone needs to visit. Same rule the heartbeat
+	// already follows.
+	var up, total int
+	worst := 0.0
+	people := map[string]struct{}{}
+	for _, s := range sites {
+		up, total = up+s.CamerasUp, total+s.CamerasTotal
+		if s.FractionBelowGate > worst {
+			worst = s.FractionBelowGate
+		}
+	}
+	events := make([]map[string]any, 0, len(arrivals))
+	for _, v := range arrivals {
+		if v.VisitorID != "" {
+			people[v.VisitorID] = struct{}{}
+		}
+		events = append(events, map[string]any{
+			"type": map[bool]string{true: "person.new", false: "person.seen"}[v.IsNew],
+			"ts":   v.OccurredAt, "camera_id": v.CameraID,
+			"data": map[string]any{
+				"label": v.Label, "ref": v.Ref, "site": v.Site,
+				"similarity": v.Similarity, "attributes": v.Attributes,
+			},
+		})
+	}
+	return LiveSnapshot{
+		Viewing: true,
+		Events:  events,
+		Stats: map[string]any{
+			"cameras":    []map[string]any{},
+			"gallery":    map[string]any{"identities": len(people), "sightings": len(arrivals)},
+			"cameras_up": up, "cameras_total": total,
+			"fraction_below_gate": worst,
+		},
+	}, nil
 }
 
 // ---------------------------------------------------------------- reports --