[Epic] Project device runtimes into a non-RT control event hub

[EffortlessSteven]

Dependency

Blocked by #300.

Goal

Project OpenFlight's parsed device-runtime snapshots into a shared, ordered, non-real-time control stream inside flight-service.

Current integration points

• T.Flight and VKB STECS service runtimes poll/parse reports and cache latest snapshots.
• T.Flight snapshots expose normalized axes plus a button bitmask and hat state.
• flight-bus has allocation-free numeric axis/button events, filters, and routing primitives.
• flight-service owns runtime lifecycle and is the correct non-RT orchestration boundary.

Required design

Descriptor registry

Build or populate a registry that maps device/runtime numeric IDs to the stable control descriptors defined in #300. Preserve raw IDs when a semantic role is not validated.

Snapshot/event projection

For each supported runtime in this first lane (at minimum simulated T.Flight and simulated STECS):

• establish a non-actionable initial baseline;
• emit button press/release edges;
• emit hat/D-pad changes including neutral;
• emit encoder deltas when the runtime exposes them;
• optionally emit selected axes only when configured/rate-limited;
• emit reset/disconnect when the device/input epoch changes;
• suppress unchanged state.

Non-RT ControlEventHub

Add a service-owned hub that:

• receives projected items outside the 250 Hz RT path;
• supports multiple read-only subscribers;
• uses bounded queues;
• never blocks the RT path;
• reports an explicit reset/gap or recoverable error when a consumer falls behind;
• integrates with service startup/shutdown and safe mode.

Safe mode must behave explicitly: either the stream is disabled by negotiation or it publishes only the controls allowed by the documented safe-mode policy.

Do not duplicate mapping logic

Reuse existing parsed snapshots, device metadata, and flight-bus numeric events where appropriate. Do not add another raw-HID parser or a second hardware owner.

Acceptance criteria

• Simulated T.Flight establishes descriptor + baseline + button/hat events.
• Simulated STECS establishes descriptor + baseline + representative button/encoder events.
• First/held states never synthesize a fresh press on startup or reconnect.
• Duplicate snapshots produce no duplicate events.
• Per-device sequence/order is deterministic.
• Slow subscribers receive explicit reset/gap behavior rather than silent loss.
• Runtime shutdown/disconnect terminates or resets streams cleanly.
• No gRPC/protobuf or Runbook code is added in this issue.
• No blocking, network I/O, or new allocation occurs on protected RT hot paths.
• cargo xtask validate (or current full validation) passes.

Test matrix

Include simulated-source tests for baseline, press/release, hat neutral, encoder bursts, duplicate snapshots, disconnect/reconnect, subscriber lag, safe mode, and service shutdown.

Non-goals

• External IPC.
• Application control claims.
• MFD/LED/tactile output.
• Real-device support claims.

Program link

Parent program: EffortlessMetrics/runbook-rs#32.

[EffortlessSteven]

Decomposed into focused implementation issues:

• Control hub 2a: add stable descriptor mapping and deterministic runtime projectors #305 — stable descriptor mapping and deterministic runtime projectors
• Control hub 2b: add the bounded multi-subscriber event hub and gap/reset lifecycle #306 — bounded multi-subscriber event hub with gap/reset/safe-mode lifecycle

Keep #301 as the tracker; one child per PR.

[EffortlessSteven]

Public program tracker: #309. This issue remains the implementation epic for runtime projection and the non-RT hub; focused children are #305 and #306.