fix(record,rollout): refuse to start on a robot record with zero cameras

[Mokuroh54]

The robot record is the single source of a session's cameras. A record whose camera list is empty was accepted by both start paths, and each failed silently in its own way.

The two failure modes

Recording produced a videoless dataset. load_robot_cameras returns {} for a named-but-camera-less record, which is indistinguishable from the legitimate blank-name camera-less session. The session started normally, ran to completion, and wrote a whole dataset with no video — invisible until someone opened it.

Inference ran the arm with no vision at all. This one was worse than believed. Empty camera_bindings short-circuit inside bind_robot_cameras before the record is ever read, so the CameraResolutionError everyone trusted to catch camera mistakes structurally could not fire here. A camera-less record with no bindings started a real run, driving the follower, feeding the policy none of the image features it was trained on.

The guard

A shared require_robot_cameras(robot_name, action) in utils/config.py — load_robot_cameras, plus a refusal when the robot IS named and DOES resolve but has zero cameras. Both start paths call it, reusing the existing 400 refusal shape so the frontend surfaces it unchanged:

Robot 'X' has no cameras configured — add one in Robot settings before {recording,running a policy}.

action completes the sentence, so each flow names what it is refusing rather than a generic "starting". In inference the check runs ahead of binding resolution, so the actionable message wins over the binding-shaped no camera named 'wrist'; cameras on this robot: none. Teleoperation and calibration open no cameras and must not use the helper — the docstring says so. A blank robot_name stays a legitimate camera-less session (pinned by test), so the gate doesn't quietly become "recording always requires a robot record".

Why an empty record is not consent

Nobody has to choose this state. A robot record is created camera-less and stays that way until a camera is added, and external cleanup of stale camera entries — for instance removing entries that predate unique_id support — can empty a record that used to have cameras. "No cameras" is therefore never evidence that a camera-less session was intended, so it can't be read as one.

Deliberate behavior widening

Inference with empty bindings naming a nonexistent record now 400s where it was previously ignored outright — matching what recording already did. State-only policies still run fine on a robot that has cameras; on a camera-less robot they are now refused, per the hard-gate decision.

Checks

pytest tests/test_record.py tests/test_rollout.py tests/test_utils_config.py — 370 passed. ruff check + ruff format --check clean on the touched files. pre-commit run --all-files green.

🤖 Generated with Claude Code