Adding a new PlaybackOrder was unsafe by construction: three build-time
dispatch sites turned an unknown value into an enumerator silently.
Classic substituted RandomizedMediaCollectionEnumerator (the // TODO
default arm), PlaylistEnumerator had no default arm so the item was
dropped, and BlockPlayoutBuilder's allow-list continue skipped it.
(#70 already made YAML/Scripted log a warning and MultiCollectionGroup
throws.)
- each silent site now logs a Warning naming the order + engine + the
fallback taken; the fallback itself is preserved so a live channel
never goes dark on one misconfigured item and scheduler goldens do
not move.
- PlaylistEnumerator.Create gained an optional Option<ILogger> (it was
static with no logger -- why the drop was unreportable); loggered
callers pass it.
- BlockPlayoutBuilder gained an explicit Random arm (it previously
reached an enumerator only via the coincidental _ => fallback) and a
loud defensive fallback.
- new PlaybackOrderSupport matrix (per SchedulingEngineKind) + tripwire
PlaybackOrderSupportTests: Supported ∪ Unsupported must partition the
enum for every engine, so a new order fails the test until classified.
BlockPlayoutBuilder consumes the matrix for its allow-list.
- write-path rejection left unchanged (#70 closed the persistence hole;
the perimeter has been wrong three times per decisions.md); reverse
_ => None mappings reviewed and deferred (different axis; making them
loud would warn on legit enumerator types).
docs/decisions.md updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
