@camstack/addon-pipeline-orchestrator 1.1.14 → 1.1.16

package/dist/index.js

@@ -4631,7 +4631,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-C2M2zF7x.mjs
+//#region ../types/dist/sleep-MHm--th-.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5909,6 +5909,7 @@ var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
 	"pull-http",
+	"pull-flv",
 	"pull-rfc4571",
 	"push-annexb",
 	"derived"
@@ -14000,7 +14001,7 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema = discriminatedUnion("ok", [object({
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
 	ok: literal(true),
 	latencyMs: number()
 }), object({
@@ -14023,7 +14024,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -14057,23 +14058,198 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: number().optional()
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-method(object({
-	title: string(),
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
 	body: string(),
-	imageUrl: string().optional(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	priority: _enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	]).default("normal"),
 	metadata: record(string(), unknown()).optional()
-}), _void(), { kind: "mutation" }), method(_void(), object({
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
 	success: boolean(),
-	error: string().optional()
-}), { kind: "mutation" });
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -14863,10 +15039,11 @@ var pipelineOrchestratorCapability = {
 		}))),
 		/**
 		* Get one camera's decoder placement (computed if not yet pinned).
-		* Consumed by `stream-broker.createBroker` so decoder provider
-		* selection is deterministic — fixes the 2026-04-18 race where
-		* `capProviders[0]` silently picked ffmpeg-on-agent-0 for a
-		* hub-assigned camera.
+		*
+		* ADVISORY today: reports the orchestrator's decoder preference only.
+		* Actual decode placement is broker-owned (local-node pin + frame-plane
+		* co-location guard). Reserved to become the binding source/decoder-owner
+		* control in the stream-LB epic (Phase 2).
 		*
 		* `pipelineNodeId` is the node already chosen to run inference for
 		* this camera. When provided, the balancer prefers co-location with
@@ -20238,13 +20415,49 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationOutput.deleteTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationOutput.discoverTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargetKinds": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"notificationOutput.sendTest": {
+	"notificationOutput.setTargetEnabled": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.testTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.upsertTarget": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
@@ -22420,470 +22633,232 @@ function buildTreeFromAddons(enabled, catalog) {
 	return roots;
 }
 //#endregion
-//#region src/zones-provider.ts
+//#region src/audio-chunk-poller.ts
 /**
-* `zones-provider.ts` — implements `zonesCapability` for the orchestrator.
+* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
+* plane (Phase 5 / D9).
 *
-* Per-camera CRUD over polygon detection zones. Persists to the
-* orchestrator's per-device settings store under the `zones` key and
-* mirrors every change into the device-state `zones` slice via
-* `api.deviceState.setCapSlice`. Downstream consumers (motion-wasm,
-* pipeline-executor, analytics, admin UI) read the live state with
-* the canonical `dev.state.zones.onChanged` channel.
+* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
+* path. A live callback cannot cross a process boundary; once the `pipeline`
+* group is dissolved (Task 8) the orchestrator runs in a different process
+* from the broker, so audio delivery must go over tRPC.
 *
-* Onboard / firmware-reported zones are out of scope for now — every
-* zone is operator-drawn. The provider keeps the surface symmetric:
-* `addZone` rejects id collisions, `updateZone` requires an existing
-* id, `removeZone` is idempotent.
-*/
-var ZONES_STORE_KEY = "zones";
-var ZONES_CAP_NAME = "zones";
-var ZonesArraySchema = array(ZoneSchema);
-var ZonesProvider = class {
-	ctx;
-	/** Per-device cache. Hydrated lazily on first read for a device. */
-	cache = /* @__PURE__ */ new Map();
-	/**
-	* Per-device durable handle over the `zones` store key. The WHOLE
-	* validated zone array round-trips on every read/write so no field can
-	* be dropped on persist. Built lazily + memoised per device.
-	*/
-	stateByDevice = /* @__PURE__ */ new Map();
-	constructor(ctx) {
-		this.ctx = ctx;
-	}
-	/** Lazily build (and memoise) the durable `zones` handle for a device. */
-	zonesState(deviceId) {
-		let handle = this.stateByDevice.get(deviceId);
-		if (!handle) {
-			handle = createDurableState({
-				key: ZONES_STORE_KEY,
-				schema: ZonesArraySchema,
-				fallback: [],
-				read: () => this.ctx.settings.readDeviceStore(deviceId),
-				write: (patch) => this.ctx.settings.writeDeviceStore(deviceId, patch),
-				onParseError: (key, error) => this.ctx.logger.warn("zones store entry failed to parse — resetting", {
-					tags: { deviceId },
-					meta: {
-						key,
-						error: error instanceof Error ? error.message : String(error)
-					}
-				})
-			});
-			this.stateByDevice.set(deviceId, handle);
-		}
-		return handle;
-	}
-	async listZones({ deviceId }) {
-		return this.loadZones(deviceId);
-	}
-	async addZone({ deviceId, zone }) {
-		const existing = await this.loadZones(deviceId);
-		if (existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.addZone: id ${zone.id} already exists`);
-		await this.persist(deviceId, [...existing, zone]);
-	}
-	async updateZone({ deviceId, zone }) {
-		const existing = await this.loadZones(deviceId);
-		if (!existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.updateZone: id ${zone.id} not found`);
-		const next = existing.map((entry) => entry.id === zone.id ? zone : entry);
-		await this.persist(deviceId, next);
-	}
-	async removeZone({ deviceId, zoneId }) {
-		const existing = await this.loadZones(deviceId);
-		if (!existing.some((entry) => entry.id === zoneId)) return;
-		await this.persist(deviceId, existing.filter((entry) => entry.id !== zoneId));
-	}
-	/**
-	* Drop a device's cache entry. Called when the device is removed so
-	* the next attach starts from a fresh disk read.
-	*/
-	forgetDevice(deviceId) {
-		this.cache.delete(deviceId);
-		this.stateByDevice.delete(deviceId);
-	}
-	async loadZones(deviceId) {
-		const cached = this.cache.get(deviceId);
-		if (cached) return cached;
-		let zones = [];
-		try {
-			zones = await this.zonesState(deviceId).get();
-		} catch (err) {
-			this.ctx.logger.warn("zones store read failed — using empty list", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-		this.cache.set(deviceId, zones);
-		return zones;
-	}
-	async persist(deviceId, zones) {
-		this.cache.set(deviceId, zones);
-		await this.zonesState(deviceId).set(zones);
-		await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
-			capName: ZONES_CAP_NAME,
-			slice: { zones }
-		});
-		this.ctx.onZonesChanged?.(deviceId, zones);
-	}
-};
-//#endregion
-//#region src/zone-rules-provider.ts
-/**
-* `zone-rules-provider.ts` — implements `zoneRulesCapability` for the
-* orchestrator.
+* The consumer:
 *
-* Per-stage rule arrays (motion / detection) live next to zones in the
-* orchestrator's per-device store under `zoneRules.<stage>` keys.
-* Every mutation mirrors to a stage-specific device-state slice
-* (`motion-zone-rules`, `detection-zone-rules`) so consumer addons
-* subscribe independently and pick up the new gating without an extra
-* cap round-trip.
+*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
+*      registers a per-subscription bounded FIFO queue and returns a
+*      `subscriptionId`;
+*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
+*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
+*   3. feeds each chunk to its downstream audio logic;
+*   4. on teardown, `unsubscribeAudioChunks`.
 *
-* The provider validates each rule against {@link ZoneRuleSchema}
-* before persisting — partial / corrupt writes are rejected outright
-* since rules drive runtime filtering and a bad payload would silently
-* widen the operator's intended scope.
+* Audio is not latency-critical like video, and chunks arrive only ~every
+* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
+* a small per-poll burst keeps latency low without busy-spinning. The
+* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
+* loses a chunk.
+*
+* Boot-race tolerance: the broker for a given camStream may not be registered
+* yet when the orchestrator wires the subscription (provider addons publish
+* their cameraStreams asynchronously after their probe completes).
+* `subscribeAudioChunks` retries with exponential backoff (capped at
+* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
+* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
+* shape so video and audio plumbing self-heal identically.
 */
-/** Settings store key for stage rules. Kept under a single nested
-*  object so a future stage just adds another property without
-*  reshuffling the schema. */
-var RULES_STORE_KEY = "zoneRules";
-/** Cap name for the unified runtime-state slice. Matches the cap's
-*  declared `name` so the codegen DeviceProxy auto-wires
-*  `device.state.zoneRules`. The slice value is the full
-*  `{motion, detection}` object — both stages travel together so a
-*  single reactive handle covers every consumer. */
-var ZONE_RULES_CAP_NAME = "zone-rules";
-var RulesArraySchema = array(ZoneRuleSchema);
-/**
-* Whole-blob schema for the per-device `zoneRules` store key. Both stages
-* travel together under one key. Deliberately lenient — each stage is
-* `unknown` so a corrupt single stage can NOT drop the sibling on load
-* (durable-state `get()` falls back to `{}` only on a whole-blob parse
-* failure). Strict per-stage validation, with its own reset-on-corrupt
-* warn, still happens in `loadRules` exactly as before the migration.
-*/
-var ZoneRulesBlockSchema = object({
-	motion: unknown().optional(),
-	detection: unknown().optional()
-}).passthrough();
-var ZoneRulesProvider = class {
-	ctx;
-	/** Per-device per-stage cache. Hydrated lazily on first read. */
-	cache = /* @__PURE__ */ new Map();
-	/**
-	* Per-device durable handle over the `zoneRules` store key. The WHOLE
-	* `{motion?, detection?}` block round-trips on every read/write so a
-	* write on one stage can never drop the other. Built lazily + memoised.
-	*/
-	stateByDevice = /* @__PURE__ */ new Map();
-	constructor(ctx) {
-		this.ctx = ctx;
-	}
-	/** Lazily build (and memoise) the durable `zoneRules` handle for a device. */
-	rulesState(deviceId) {
-		let handle = this.stateByDevice.get(deviceId);
-		if (!handle) {
-			handle = createDurableState({
-				key: RULES_STORE_KEY,
-				schema: ZoneRulesBlockSchema,
-				fallback: {},
-				read: () => this.ctx.settings.readDeviceStore(deviceId),
-				write: (patch) => this.ctx.settings.writeDeviceStore(deviceId, patch),
-				onParseError: (key, error) => this.ctx.logger.warn("zone-rules store block failed to parse — resetting", {
-					tags: { deviceId },
-					meta: {
-						key,
-						error: error instanceof Error ? error.message : String(error)
-					}
-				})
-			});
-			this.stateByDevice.set(deviceId, handle);
-		}
-		return handle;
-	}
-	async listRules({ deviceId, stage }) {
-		return this.loadRules(deviceId, stage);
-	}
-	async setRules({ deviceId, stage, rules }) {
-		const parsed = RulesArraySchema.safeParse(rules);
-		if (!parsed.success) throw new Error(`zone-rules.setRules: invalid rule payload — ${parsed.error.issues.map((i) => i.message).join("; ")}`);
-		await this.persist(deviceId, stage, parsed.data);
-	}
-	/** Drop a device's cache entries. Called when the device is removed. */
-	forgetDevice(deviceId) {
-		this.cache.delete(deviceId);
-		this.stateByDevice.delete(deviceId);
-	}
-	async loadRules(deviceId, stage) {
-		let perDevice = this.cache.get(deviceId);
-		if (!perDevice) {
-			perDevice = /* @__PURE__ */ new Map();
-			this.cache.set(deviceId, perDevice);
-		}
-		const cached = perDevice.get(stage);
-		if (cached) return cached;
-		let rules = [];
-		try {
-			const raw = (await this.rulesState(deviceId).get())[stage];
-			if (raw !== void 0) {
-				const parsed = RulesArraySchema.safeParse(raw);
-				if (parsed.success) rules = parsed.data;
-				else this.ctx.logger.warn("zone-rules store entry failed to parse — resetting", {
-					tags: { deviceId },
-					meta: {
-						stage,
-						issues: parsed.error.issues
-					}
-				});
-			}
-		} catch (err) {
-			this.ctx.logger.warn("zone-rules store read failed — using empty list", {
-				tags: { deviceId },
-				meta: {
-					stage,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-		}
-		perDevice.set(stage, rules);
-		return rules;
-	}
-	async persist(deviceId, stage, rules) {
-		let perDevice = this.cache.get(deviceId);
-		if (!perDevice) {
-			perDevice = /* @__PURE__ */ new Map();
-			this.cache.set(deviceId, perDevice);
-		}
-		perDevice.set(stage, rules);
-		await this.rulesState(deviceId).update((prev) => ({
-			...prev,
-			[stage]: rules
-		}));
-		const otherStage = stage === "motion" ? "detection" : "motion";
-		const otherRules = perDevice.get(otherStage) ?? await this.loadRules(deviceId, otherStage);
-		const sliceValue = stage === "motion" ? {
-			motion: rules,
-			detection: otherRules
-		} : {
-			motion: otherRules,
-			detection: rules
-		};
-		try {
-			await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
-				capName: ZONE_RULES_CAP_NAME,
-				slice: sliceValue
-			});
-		} catch (err) {
-			this.ctx.logger.debug("zone-rules slice mirror failed", {
-				tags: { deviceId },
-				meta: {
-					stage,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-		}
-		this.ctx.onRulesChanged?.(deviceId, stage, rules);
-	}
-};
-//#endregion
-//#region src/orchestrator-store-schemas.ts
-/**
-* `orchestrator-store-schemas.ts` — whole-blob Zod schemas for the
-* orchestrator's addon-store keys that persist an ENTIRE collection
-* under a single key (`nodeBindings`, `templates`, `agentSettings`,
-* `cameraSettings`).
-*
-* These back the durable-state primitive (`this.state(KEY, Schema, {})`)
-* so a hand-written serializer can never silently drop a field on save:
-* the whole validated value round-trips on every read and write.
-*
-* Each schema mirrors the SAME shape the orchestrator already persisted
-* (the `pipeline-orchestrator.cap.ts` storage contract). Every field that
-* is only conditionally written is `.optional()`, so an existing blob
-* that predates a newer field still loads — durable-state `get()` only
-* falls back to the empty map on a whole-blob parse failure, so the
-* schema is kept faithful to the on-disk shape rather than overly strict.
-*/
-var EngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: string(),
-	device: string().optional()
-});
-var NodeBindingsSchema = record(string(), record(string(), string()));
-var StoredPipelineConfigSchema = object({
-	engine: EngineChoiceSchema,
-	steps: array(PipelineStepInputSchema).readonly(),
-	audio: object({
-		engine: EngineChoiceSchema,
-		modelId: string(),
-		enabled: boolean(),
-		settings: record(string(), unknown()).readonly().optional()
-	}).nullable().optional()
-});
-var StoredPipelineTemplateSchema = object({
-	id: string(),
-	name: string(),
-	description: string().optional(),
-	config: StoredPipelineConfigSchema,
-	createdAt: string(),
-	updatedAt: string()
-});
-var TemplatesSchema = record(string(), StoredPipelineTemplateSchema);
-var StoredAgentAddonConfigSchema = object({
-	enabled: boolean(),
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-});
-var StoredAgentPipelineSettingsSchema = object({
-	addonDefaults: record(string(), StoredAgentAddonConfigSchema).readonly(),
-	maxCameras: number().int().nonnegative().nullable().default(null)
-});
-var AgentSettingsMapSchema = record(string(), StoredAgentPipelineSettingsSchema);
-var StoredCameraStepOverridePatchSchema = object({
-	enabled: boolean().optional(),
-	modelId: string().optional(),
-	settings: record(string(), unknown()).readonly().optional()
-});
-var StoredCameraPipelineForAgentSchema = object({
-	steps: array(PipelineStepInputSchema).readonly(),
-	audio: object({
-		modelId: string(),
-		enabled: boolean()
-	}).nullable()
-});
-var StoredCameraPipelineSettingsSchema = object({
-	pinnedAgentNodeId: string().optional(),
-	stepToggles: record(string(), boolean()).optional(),
-	stepOverridesByAgent: record(string(), record(string(), StoredCameraStepOverridePatchSchema)).optional(),
-	pipelineByAgent: record(string(), StoredCameraPipelineForAgentSchema).optional(),
-	/**
-	* Legacy "nuke inference" flag. Superseded by the detection-pipeline
-	* wrapper binding, but the one-shot boot migration
-	* (`migrateLegacyFlagsToBindings`) still reads it off the persisted
-	* blob to flip the binding off. Kept here so the durable round-trip
-	* does NOT strip it before the migration runs.
-	*/
-	disableInference: boolean().optional()
-});
-var CameraSettingsMapSchema = record(string(), StoredCameraPipelineSettingsSchema);
-//#endregion
-//#region src/load-balancer.ts
+/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
+var POLL_INTERVAL_MS = 200;
+/** How many chunks to drain per poll — a small burst absorbs jitter. */
+var PULL_MAX_COUNT = 8;
 /**
-* Compute the L2 capacity score for a runner node. Lower is better.
-* The score is a weighted sum of the runner's active workload so the balancer
-* prefers agents that are serving fewer cameras OR draining queues quickly.
-*
-* Rationale:
-*  - `attachedCameras * avgInferenceFps` approximates the total inference rate
-*    the agent is currently sustaining (not just how many cameras are assigned).
-*  - `queueDepthTotal` penalises agents that are falling behind the frame feed.
+* Consecutive pull failures before we attempt to re-subscribe. A single failed
+* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
+* sustained failure means the broker child restarted and dropped our
+* subscription, so we re-establish it.
 */
-function computeCapacityScore(load) {
-	return load.attachedCameras * Math.max(load.avgInferenceFps, 0) + Math.max(load.queueDepthTotal, 0);
-}
+var RESUBSCRIBE_AFTER_FAILURES = 2;
+/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
+var RESUBSCRIBE_THROTTLE_TICKS = 5;
+/** First subscribe-retry delay, doubled on every subsequent failure. */
+var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
 /**
-* Returns true when the node has remaining capacity.
-* A node is eligible iff `cap` is unlimited (null/absent/<=0) OR
-* its `attachedCameras` count is strictly less than the cap.
-* Pins count toward the cap via `attachedCameras`.
+* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
+* enough to recover within a single reconcile of the orchestrator and slow
+* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
 */
-function isEligible(node, caps) {
-	const cap = caps?.[node.nodeId];
-	if (cap === null || cap === void 0 || cap <= 0) return true;
-	return node.attachedCameras < cap;
-}
+var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
 /**
-* Run the two-level camera balancer.
-*
-* L1 (manual affinity): if `preferredAgent` names an online node AND that
-* node is under its `maxCameras` cap, return it. If the node is online but at
-* or over cap, return `{kind:'pending'}` — a pinned camera is never silently
-* over-assigned.
-*
-* L2 (capacity): filter to eligible nodes and pick the lowest capacity score.
-* If all nodes are at/over cap, return `{kind:'pending'}`.
+* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
 *
-* Returns `null` when no runners are online. The orchestrator decides how to
-* react — typically by logging and deferring the assignment until a runner
-* comes online.
+* Always resolves to a teardown closure — when the broker is not yet
+* registered the closure cancels the ongoing retry loop; when polling is
+* active it stops the loop and releases the broker subscription. Mirrors
+* `startFrameHandlePoller` so video and audio recover identically.
 */
-function balance(input) {
-	const online = input.nodes.filter((n) => n.nodeId.length > 0);
-	if (online.length === 0) return null;
-	const eligible = online.filter((n) => isEligible(n, input.nodeCaps));
-	if (input.preferredAgent) {
-		const pinnedOnline = online.find((n) => n.nodeId === input.preferredAgent);
-		if (pinnedOnline) {
-			if (eligible.some((n) => n.nodeId === pinnedOnline.nodeId)) return {
-				kind: "assigned",
-				agentNodeId: pinnedOnline.nodeId,
-				reason: "manual",
-				score: computeCapacityScore(pinnedOnline)
-			};
-			return {
-				kind: "pending",
-				reason: "over-cap"
-			};
-		}
-	}
-	if (eligible.length === 0) return {
-		kind: "pending",
-		reason: "over-cap"
+function startAudioChunkPoller(options) {
+	const lifecycle = {
+		stopped: false,
+		retryTimer: void 0,
+		pollTimer: void 0,
+		activeSubscriptionId: null
 	};
-	const best = eligible.map((node) => ({
-		node,
-		score: computeCapacityScore(node)
-	})).toSorted((a, b) => a.score - b.score)[0];
-	return {
-		kind: "assigned",
-		agentNodeId: best.node.nodeId,
-		reason: "capacity",
-		score: best.score
+	const teardown = () => {
+		if (lifecycle.stopped) return;
+		lifecycle.stopped = true;
+		if (lifecycle.retryTimer) {
+			clearTimeout(lifecycle.retryTimer);
+			lifecycle.retryTimer = void 0;
+		}
+		if (lifecycle.pollTimer) {
+			clearTimeout(lifecycle.pollTimer);
+			lifecycle.pollTimer = void 0;
+		}
+		const subId = lifecycle.activeSubscriptionId;
+		if (subId) {
+			lifecycle.activeSubscriptionId = null;
+			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }).catch((err) => {
+				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
+					brokerId: options.brokerId,
+					subscriptionId: subId,
+					error: errMsg(err)
+				} });
+			});
+		}
 	};
+	subscribeWithRetry(options, lifecycle);
+	return teardown;
 }
 /**
-* Decide whether a manual per-device decoder pin may be honored.
-*
-* A pin to a node OUTSIDE `enabledDecoderNodes` must NOT be honored blindly —
-* that is how video decode reaches a node that is not eligible to decode (e.g.
-* a node whose shm frame ring the broker cannot read, or one an operator
-* disabled). A pin to an ENABLED node is honored; anything else falls through
-* to the auto-balance path (which filters by `enabledDecoderNodes`).
+* Run the subscribe → poll handshake with exponential backoff on subscribe
+* failures. Resolves once the subscription is acquired (and the poll loop has
+* been started) or once `lifecycle.stopped` flips, whichever comes first.
 */
-function isDecoderPinHonored(pinnedNodeId, enabledDecoderNodes) {
-	return enabledDecoderNodes.includes(pinnedNodeId);
+async function subscribeWithRetry(options, lifecycle) {
+	const { api, brokerId, tag, logger } = options;
+	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
+	let attempt = 0;
+	while (!lifecycle.stopped) {
+		attempt += 1;
+		try {
+			const result = await api.streamBroker.subscribeAudioChunks.mutate({
+				brokerId,
+				tag
+			});
+			if (lifecycle.stopped) {
+				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }).catch((err) => {
+					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
+						brokerId,
+						subscriptionId: result.subscriptionId,
+						error: errMsg(err)
+					} });
+				});
+				return;
+			}
+			if (attempt > 1) logger.info("audio-chunk poller: subscribeAudioChunks recovered", { meta: {
+				brokerId,
+				tag,
+				attempt
+			} });
+			lifecycle.activeSubscriptionId = result.subscriptionId;
+			startPolling(options, lifecycle);
+			return;
+		} catch (err) {
+			if (lifecycle.stopped) return;
+			if (attempt === 1) logger.warn("audio-chunk poller: subscribeAudioChunks failed, retrying", { meta: {
+				brokerId,
+				tag,
+				error: errMsg(err),
+				nextRetryInMs: backoffMs
+			} });
+			else logger.debug("audio-chunk poller: subscribeAudioChunks still failing", { meta: {
+				brokerId,
+				tag,
+				attempt,
+				error: errMsg(err),
+				nextRetryInMs: backoffMs
+			} });
+			await sleep(backoffMs, lifecycle);
+			backoffMs = Math.min(MAX_SUBSCRIBE_RETRY_BACKOFF_MS, backoffMs * 2);
+		}
+	}
 }
 /**
-* Choose decoder node. Priority: manual pin → co-located with pipeline → capacity.
+* Drive the steady-state poll loop. Mid-stream `pullAudioChunks` failures
+* trigger a fresh `subscribeAudioChunks` via the recovery branch — covers
+* the broker child restart case where our `subscriptionId` is silently
+* disowned.
 */
-function balanceDecoder(input) {
-	const { decoderNodes, pipelineNodeId, preferredDecoderNode } = input;
-	if (decoderNodes.length === 0) return null;
-	if (preferredDecoderNode) {
-		const match = decoderNodes.find((n) => n.nodeId === preferredDecoderNode);
-		if (match) return {
-			decoderNodeId: match.nodeId,
-			reason: "manual",
-			score: computeCapacityScore(match)
-		};
-	}
-	const colocated = decoderNodes.find((n) => n.nodeId === pipelineNodeId);
-	if (colocated) return {
-		decoderNodeId: colocated.nodeId,
-		reason: "co-located",
-		score: computeCapacityScore(colocated)
+function startPolling(options, lifecycle) {
+	const { api, brokerId, tag, onChunk, logger } = options;
+	let consecutiveFailures = 0;
+	const resubscribe = async () => {
+		try {
+			const result = await api.streamBroker.subscribeAudioChunks.mutate({
+				brokerId,
+				tag
+			});
+			lifecycle.activeSubscriptionId = result.subscriptionId;
+			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
+				brokerId,
+				tag,
+				subscriptionId: result.subscriptionId,
+				afterFailures: consecutiveFailures
+			} });
+			return true;
+		} catch {
+			return false;
+		}
 	};
-	const best = decoderNodes.map((node) => ({
-		node,
-		score: computeCapacityScore(node)
-	})).toSorted((a, b) => a.score - b.score)[0];
-	return {
-		decoderNodeId: best.node.nodeId,
-		reason: "capacity",
-		score: best.score
+	const tick = async () => {
+		if (lifecycle.stopped) return;
+		const subId = lifecycle.activeSubscriptionId;
+		if (!subId) return;
+		try {
+			const chunks = await api.streamBroker.pullAudioChunks.query({
+				subscriptionId: subId,
+				maxCount: PULL_MAX_COUNT
+			});
+			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
+				brokerId,
+				subscriptionId: subId
+			} });
+			consecutiveFailures = 0;
+			for (const chunk of chunks) {
+				if (lifecycle.stopped) break;
+				await onChunk(chunk);
+			}
+		} catch (err) {
+			consecutiveFailures += 1;
+			if (consecutiveFailures === 1) logger.warn("audio-chunk poller: pullAudioChunks failed — attempting recovery", { meta: {
+				brokerId,
+				subscriptionId: subId,
+				error: errMsg(err)
+			} });
+			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
+		}
+		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS);
 	};
+	tick();
+}
+/**
+* Cancellable sleep — wakes early when `lifecycle.stopped` flips. We
+* keep a local wrapper around the shared {@link sleep} helper because
+* the lifecycle tracks the active retry timer for `teardown()` to
+* clear; pure `sleep()` would leak the timer if teardown fired while
+* we were waiting.
+*/
+function sleep(ms, lifecycle) {
+	return new Promise((resolve) => {
+		if (lifecycle.stopped) {
+			resolve();
+			return;
+		}
+		lifecycle.retryTimer = setTimeout(() => {
+			lifecycle.retryTimer = void 0;
+			resolve();
+		}, ms);
+	});
 }
 //#endregion
 //#region src/audio-load-balancer.ts
@@ -22902,259 +22877,412 @@ function balanceAudio(input) {
 	};
 }
 //#endregion
-//#region src/audio-chunk-poller.ts
+//#region src/camera-status/compose-camera-status.ts
+function mapAssignment(input) {
+	return {
+		detectionNodeId: input.detectionNodeId,
+		decoderNodeId: input.decoderNodeId,
+		audioNodeId: input.audioNodeId,
+		pinned: {
+			detection: input.pinned.detection,
+			decoder: input.pinned.decoder,
+			audio: input.pinned.audio
+		},
+		reasons: {
+			detection: input.reasons.detection,
+			decoder: input.reasons.decoder,
+			audio: input.reasons.audio
+		}
+	};
+}
+function mapSource(sourceResult) {
+	if (sourceResult === null) return { streams: [] };
+	return { streams: sourceResult.streams.map((s) => ({
+		camStreamId: s.camStreamId,
+		codec: s.codec,
+		width: s.width,
+		height: s.height,
+		fps: s.fps,
+		kind: s.kind
+	})) };
+}
+function mapBroker(brokerResult) {
+	if (brokerResult === null) return null;
+	return {
+		profiles: brokerResult.profiles.map((p) => ({
+			profile: p.profile,
+			status: p.status,
+			codec: p.codec,
+			width: p.width,
+			height: p.height,
+			subscribers: p.subscribers,
+			inFps: p.inFps,
+			outFps: p.outFps
+		})),
+		webrtcSessions: brokerResult.webrtcSessions,
+		rtspRestream: brokerResult.rtspRestream
+	};
+}
+function mapDecoderShm(shm) {
+	return {
+		framesWritten: shm.framesWritten,
+		getFrameHits: shm.getFrameHits,
+		getFrameMisses: shm.getFrameMisses,
+		budgetMb: shm.budgetMb
+	};
+}
+function mapDecoder(decoderResult) {
+	if (decoderResult === null) return null;
+	return {
+		nodeId: decoderResult.nodeId,
+		formats: [...decoderResult.formats],
+		sessionCount: decoderResult.sessionCount,
+		shm: mapDecoderShm(decoderResult.shm)
+	};
+}
+function mapMotion(motionResult) {
+	if (motionResult === null) return null;
+	return {
+		enabled: motionResult.enabled,
+		fps: motionResult.fps
+	};
+}
+function mapProvisioning(p) {
+	if (p.error !== void 0) return {
+		state: p.state,
+		error: p.error
+	};
+	return { state: p.state };
+}
+function mapDetection(detectionResult) {
+	if (detectionResult === null) return null;
+	const phase = detectionResult.phase;
+	return {
+		nodeId: detectionResult.nodeId,
+		engine: {
+			backend: detectionResult.engine.backend,
+			device: detectionResult.engine.device
+		},
+		phase,
+		configuredFps: detectionResult.configuredFps,
+		actualFps: detectionResult.actualFps,
+		queueDepth: detectionResult.queueDepth,
+		avgInferenceMs: detectionResult.avgInferenceMs,
+		provisioning: mapProvisioning(detectionResult.provisioning)
+	};
+}
+function mapAudio(audioResult) {
+	if (audioResult === null) return null;
+	return {
+		nodeId: audioResult.nodeId,
+		enabled: audioResult.enabled
+	};
+}
+function mapRecording(recordingResult) {
+	if (recordingResult === null) return null;
+	return {
+		mode: recordingResult.mode,
+		active: recordingResult.active,
+		storageBytes: recordingResult.storageBytes
+	};
+}
 /**
-* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
-* plane (Phase 5 / D9).
+* Pure function that composes a `CameraStatus` from per-stage fetch results.
 *
-* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
-* path. A live callback cannot cross a process boundary; once the `pipeline`
-* group is dissolved (Task 8) the orchestrator runs in a different process
-* from the broker, so audio delivery must go over tRPC.
+* - `assignment` is always built from orchestrator-local data (never null).
+* - `source` always present: defaults to `{ streams: [] }` when sourceResult is null.
+* - Every other block is null when its stage result is null (graceful degradation).
+* - `fetchedAt` is stamped exactly as provided — never calls `Date.now()`.
+* - No mutation of the input.
+*/
+function composeCameraStatus(input) {
+	return {
+		deviceId: input.deviceId,
+		assignment: mapAssignment(input),
+		source: mapSource(input.sourceResult),
+		broker: mapBroker(input.brokerResult),
+		decoder: mapDecoder(input.decoderResult),
+		motion: mapMotion(input.motionResult),
+		detection: mapDetection(input.detectionResult),
+		audio: mapAudio(input.audioResult),
+		recording: mapRecording(input.recordingResult),
+		fetchedAt: input.fetchedAt
+	};
+}
+//#endregion
+//#region src/dispatch-reconcile.ts
+/**
+* Derives the set of deviceIds that currently have at least one broker
+* profile slot that is assigned (status !== 'unassigned') AND has a
+* non-null sourceCamStreamId.
 *
-* The consumer:
+* This is the "desired" fleet — cameras the orchestrator should have
+* dispatched. Used by `reconcileDispatch` to compute the gap against
+* `cameraConfigs`.
+*/
+function desiredDeviceIdsFromSlots(slots) {
+	const result = /* @__PURE__ */ new Set();
+	for (const slot of slots) if (slot.status !== "unassigned" && slot.sourceCamStreamId !== null) result.add(slot.deviceId);
+	return result;
+}
+/**
+* Returns the deviceIds that are present in `desired` but absent from
+* `known`. These are the cameras the orchestrator has not yet dispatched
+* and needs to process via `handleDeviceRegistered`.
 *
-*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
-*      registers a per-subscription bounded FIFO queue and returns a
-*      `subscriptionId`;
-*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
-*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
-*   3. feeds each chunk to its downstream audio logic;
-*   4. on teardown, `unsubscribeAudioChunks`.
+* Additive only — cameras present in `known` are never included, even
+* if they fall out of `desired`, to avoid fighting the live event path.
+*/
+function computeDispatchGap(desired, known) {
+	return [...desired].filter((id) => !known.has(id));
+}
+//#endregion
+//#region src/frame-source-eligibility.ts
+/**
+* The set of nodes that can obtain a given camera's decoded frames.
 *
-* Audio is not latency-critical like video, and chunks arrive only ~every
-* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
-* a small per-poll burst keeps latency low without busy-spinning. The
-* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
-* loses a chunk.
+* - No `sourceOwnerNodeId` → `enabledDecoderNodes` unchanged (today's
+*   semantics; `remoteSourcingNodes` cannot restrict anything when no owner
+*   restricts first — it only ever WIDENS an owner-restricted set).
+* - With an owner → `enabledDecoderNodes ∩ ({owner} ∪ remoteSourcingNodes)`.
 *
-* Boot-race tolerance: the broker for a given camStream may not be registered
-* yet when the orchestrator wires the subscription (provider addons publish
-* their cameraStreams asynchronously after their probe completes).
-* `subscribeAudioChunks` retries with exponential backoff (capped at
-* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
-* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
-* shape so video and audio plumbing self-heal identically.
+* Pure: never mutates its inputs; result preserves `enabledDecoderNodes`
+* order.
 */
-/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
-var POLL_INTERVAL_MS = 200;
-/** How many chunks to drain per poll — a small burst absorbs jitter. */
-var PULL_MAX_COUNT = 8;
+function computeFrameSourceNodes(input) {
+	const { enabledDecoderNodes, sourceOwnerNodeId, remoteSourcingNodes } = input;
+	if (sourceOwnerNodeId === void 0) return enabledDecoderNodes;
+	const remote = remoteSourcingNodes ?? [];
+	return enabledDecoderNodes.filter((nodeId) => nodeId === sourceOwnerNodeId || remote.includes(nodeId));
+}
+//#endregion
+//#region src/load-balancer.ts
 /**
-* Consecutive pull failures before we attempt to re-subscribe. A single failed
-* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
-* sustained failure means the broker child restarted and dropped our
-* subscription, so we re-establish it.
+* Compute the L2 capacity score for a runner node. Lower is better.
+* The score is a weighted sum of the runner's active workload so the balancer
+* prefers agents that are serving fewer cameras OR draining queues quickly.
+*
+* Rationale:
+*  - `attachedCameras * avgInferenceFps` approximates the total inference rate
+*    the agent is currently sustaining (not just how many cameras are assigned).
+*  - `queueDepthTotal` penalises agents that are falling behind the frame feed.
 */
-var RESUBSCRIBE_AFTER_FAILURES = 2;
-/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
-var RESUBSCRIBE_THROTTLE_TICKS = 5;
-/** First subscribe-retry delay, doubled on every subsequent failure. */
-var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
+function computeCapacityScore(load) {
+	return load.attachedCameras * Math.max(load.avgInferenceFps, 0) + Math.max(load.queueDepthTotal, 0);
+}
 /**
-* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
-* enough to recover within a single reconcile of the orchestrator and slow
-* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
+* Returns true when the node has remaining capacity.
+* A node is eligible iff `cap` is unlimited (null/absent/<=0) OR
+* its `attachedCameras` count is strictly less than the cap.
+* Pins count toward the cap via `attachedCameras`.
 */
-var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
+function isEligible(node, caps) {
+	const cap = caps?.[node.nodeId];
+	if (cap === null || cap === void 0 || cap <= 0) return true;
+	return node.attachedCameras < cap;
+}
 /**
-* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
+* Run the two-level camera balancer.
 *
-* Always resolves to a teardown closure — when the broker is not yet
-* registered the closure cancels the ongoing retry loop; when polling is
-* active it stops the loop and releases the broker subscription. Mirrors
-* `startFrameHandlePoller` so video and audio recover identically.
+* Frame-source constraint: when `eligibleNodes` is set, only nodes in that set
+* can obtain this camera's decoded frames. Such a node is a prerequisite for
+* BOTH L1 and L2 — a node outside `eligibleNodes` is never assignable, and a
+* pin to an online-but-ineligible node returns `{kind:'pending',
+* reason:'no-frame-source'}` (mirrors the over-cap-pin behaviour: a pinned
+* camera is never silently placed on a different node).
+*
+* L1 (manual affinity): if `preferredAgent` names an online + frame-sourceable
+* node AND that node is under its `maxCameras` cap, return it. If the node is
+* online but at/over cap, return `{kind:'pending', reason:'over-cap'}`; if it
+* is online but not frame-sourceable, `{kind:'pending', reason:'no-frame-source'}`
+* — a pinned camera is never silently over-assigned or re-homed.
+*
+* L2 (capacity): among the frame-sourceable nodes, filter to those under cap
+* and pick the lowest capacity score. If no frame-sourceable node exists (but
+* online nodes do), return `no-frame-source`; if they exist but are all at/over
+* cap, return `over-cap`.
+*
+* Returns `null` when no runners are online. The orchestrator decides how to
+* react — typically by logging and deferring the assignment until a runner
+* comes online.
 */
-function startAudioChunkPoller(options) {
-	const lifecycle = {
-		stopped: false,
-		retryTimer: void 0,
-		pollTimer: void 0,
-		activeSubscriptionId: null
-	};
-	const teardown = () => {
-		if (lifecycle.stopped) return;
-		lifecycle.stopped = true;
-		if (lifecycle.retryTimer) {
-			clearTimeout(lifecycle.retryTimer);
-			lifecycle.retryTimer = void 0;
-		}
-		if (lifecycle.pollTimer) {
-			clearTimeout(lifecycle.pollTimer);
-			lifecycle.pollTimer = void 0;
-		}
-		const subId = lifecycle.activeSubscriptionId;
-		if (subId) {
-			lifecycle.activeSubscriptionId = null;
-			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }).catch((err) => {
-				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
-					brokerId: options.brokerId,
-					subscriptionId: subId,
-					error: errMsg(err)
-				} });
-			});
+function balance(input) {
+	const online = input.nodes.filter((n) => n.nodeId.length > 0);
+	if (online.length === 0) return null;
+	const sourceable = input.eligibleNodes ? online.filter((n) => input.eligibleNodes.includes(n.nodeId)) : online;
+	const eligible = sourceable.filter((n) => isEligible(n, input.nodeCaps));
+	if (input.preferredAgent) {
+		const pinnedOnline = online.find((n) => n.nodeId === input.preferredAgent);
+		if (pinnedOnline) {
+			if (!sourceable.some((n) => n.nodeId === pinnedOnline.nodeId)) return {
+				kind: "pending",
+				reason: "no-frame-source"
+			};
+			if (eligible.some((n) => n.nodeId === pinnedOnline.nodeId)) return {
+				kind: "assigned",
+				agentNodeId: pinnedOnline.nodeId,
+				reason: "manual",
+				score: computeCapacityScore(pinnedOnline)
+			};
+			return {
+				kind: "pending",
+				reason: "over-cap"
+			};
 		}
+	}
+	if (eligible.length === 0) return {
+		kind: "pending",
+		reason: sourceable.length === 0 ? "no-frame-source" : "over-cap"
+	};
+	const best = eligible.map((node) => ({
+		node,
+		score: computeCapacityScore(node)
+	})).toSorted((a, b) => a.score - b.score)[0];
+	return {
+		kind: "assigned",
+		agentNodeId: best.node.nodeId,
+		reason: "capacity",
+		score: best.score
 	};
-	subscribeWithRetry(options, lifecycle);
-	return teardown;
 }
 /**
-* Run the subscribe → poll handshake with exponential backoff on subscribe
-* failures. Resolves once the subscription is acquired (and the poll loop has
-* been started) or once `lifecycle.stopped` flips, whichever comes first.
+* Decide whether a manual per-device decoder pin may be honored.
+*
+* A pin to a node OUTSIDE `enabledDecoderNodes` must NOT be honored blindly —
+* that is how video decode reaches a node that is not eligible to decode (e.g.
+* a node whose shm frame ring the broker cannot read, or one an operator
+* disabled). A pin to an ENABLED node is honored; anything else falls through
+* to the auto-balance path (which filters by `enabledDecoderNodes`).
 */
-async function subscribeWithRetry(options, lifecycle) {
-	const { api, brokerId, tag, logger } = options;
-	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
-	let attempt = 0;
-	while (!lifecycle.stopped) {
-		attempt += 1;
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			});
-			if (lifecycle.stopped) {
-				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }).catch((err) => {
-					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
-						brokerId,
-						subscriptionId: result.subscriptionId,
-						error: errMsg(err)
-					} });
-				});
-				return;
-			}
-			if (attempt > 1) logger.info("audio-chunk poller: subscribeAudioChunks recovered", { meta: {
-				brokerId,
-				tag,
-				attempt
-			} });
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			startPolling(options, lifecycle);
-			return;
-		} catch (err) {
-			if (lifecycle.stopped) return;
-			if (attempt === 1) logger.warn("audio-chunk poller: subscribeAudioChunks failed, retrying", { meta: {
-				brokerId,
-				tag,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			else logger.debug("audio-chunk poller: subscribeAudioChunks still failing", { meta: {
-				brokerId,
-				tag,
-				attempt,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			await sleep(backoffMs, lifecycle);
-			backoffMs = Math.min(MAX_SUBSCRIBE_RETRY_BACKOFF_MS, backoffMs * 2);
-		}
-	}
+function isDecoderPinHonored(pinnedNodeId, enabledDecoderNodes) {
+	return enabledDecoderNodes.includes(pinnedNodeId);
 }
 /**
-* Drive the steady-state poll loop. Mid-stream `pullAudioChunks` failures
-* trigger a fresh `subscribeAudioChunks` via the recovery branch — covers
-* the broker child restart case where our `subscriptionId` is silently
-* disowned.
+* Choose decoder node. Priority: manual pin → co-located with pipeline → capacity.
 */
-function startPolling(options, lifecycle) {
-	const { api, brokerId, tag, onChunk, logger } = options;
-	let consecutiveFailures = 0;
-	const resubscribe = async () => {
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			});
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
-				brokerId,
-				tag,
-				subscriptionId: result.subscriptionId,
-				afterFailures: consecutiveFailures
-			} });
-			return true;
-		} catch {
-			return false;
-		}
+function balanceDecoder(input) {
+	const { decoderNodes, pipelineNodeId, preferredDecoderNode } = input;
+	if (decoderNodes.length === 0) return null;
+	if (preferredDecoderNode) {
+		const match = decoderNodes.find((n) => n.nodeId === preferredDecoderNode);
+		if (match) return {
+			decoderNodeId: match.nodeId,
+			reason: "manual",
+			score: computeCapacityScore(match)
+		};
+	}
+	const colocated = decoderNodes.find((n) => n.nodeId === pipelineNodeId);
+	if (colocated) return {
+		decoderNodeId: colocated.nodeId,
+		reason: "co-located",
+		score: computeCapacityScore(colocated)
 	};
-	const tick = async () => {
-		if (lifecycle.stopped) return;
-		const subId = lifecycle.activeSubscriptionId;
-		if (!subId) return;
-		try {
-			const chunks = await api.streamBroker.pullAudioChunks.query({
-				subscriptionId: subId,
-				maxCount: PULL_MAX_COUNT
-			});
-			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
-				brokerId,
-				subscriptionId: subId
-			} });
-			consecutiveFailures = 0;
-			for (const chunk of chunks) {
-				if (lifecycle.stopped) break;
-				await onChunk(chunk);
-			}
-		} catch (err) {
-			consecutiveFailures += 1;
-			if (consecutiveFailures === 1) logger.warn("audio-chunk poller: pullAudioChunks failed — attempting recovery", { meta: {
-				brokerId,
-				subscriptionId: subId,
-				error: errMsg(err)
-			} });
-			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
-		}
-		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS);
+	const best = decoderNodes.map((node) => ({
+		node,
+		score: computeCapacityScore(node)
+	})).toSorted((a, b) => a.score - b.score)[0];
+	return {
+		decoderNodeId: best.node.nodeId,
+		reason: "capacity",
+		score: best.score
 	};
-	tick();
-}
-/**
-* Cancellable sleep — wakes early when `lifecycle.stopped` flips. We
-* keep a local wrapper around the shared {@link sleep} helper because
-* the lifecycle tracks the active retry timer for `teardown()` to
-* clear; pure `sleep()` would leak the timer if teardown fired while
-* we were waiting.
-*/
-function sleep(ms, lifecycle) {
-	return new Promise((resolve) => {
-		if (lifecycle.stopped) {
-			resolve();
-			return;
-		}
-		lifecycle.retryTimer = setTimeout(() => {
-			lifecycle.retryTimer = void 0;
-			resolve();
-		}, ms);
-	});
 }
 //#endregion
-//#region src/dispatch-reconcile.ts
+//#region src/orchestrator-store-schemas.ts
 /**
-* Derives the set of deviceIds that currently have at least one broker
-* profile slot that is assigned (status !== 'unassigned') AND has a
-* non-null sourceCamStreamId.
+* `orchestrator-store-schemas.ts` — whole-blob Zod schemas for the
+* orchestrator's addon-store keys that persist an ENTIRE collection
+* under a single key (`nodeBindings`, `templates`, `agentSettings`,
+* `cameraSettings`).
 *
-* This is the "desired" fleet — cameras the orchestrator should have
-* dispatched. Used by `reconcileDispatch` to compute the gap against
-* `cameraConfigs`.
+* These back the durable-state primitive (`this.state(KEY, Schema, {})`)
+* so a hand-written serializer can never silently drop a field on save:
+* the whole validated value round-trips on every read and write.
+*
+* Each schema mirrors the SAME shape the orchestrator already persisted
+* (the `pipeline-orchestrator.cap.ts` storage contract). Every field that
+* is only conditionally written is `.optional()`, so an existing blob
+* that predates a newer field still loads — durable-state `get()` only
+* falls back to the empty map on a whole-blob parse failure, so the
+* schema is kept faithful to the on-disk shape rather than overly strict.
 */
-function desiredDeviceIdsFromSlots(slots) {
-	const result = /* @__PURE__ */ new Set();
-	for (const slot of slots) if (slot.status !== "unassigned" && slot.sourceCamStreamId !== null) result.add(slot.deviceId);
-	return result;
-}
+var EngineChoiceSchema = object({
+	runtime: _enum(["node", "python"]),
+	backend: string(),
+	format: string(),
+	device: string().optional()
+});
+var NodeBindingsSchema = record(string(), record(string(), string()));
+var StoredPipelineConfigSchema = object({
+	engine: EngineChoiceSchema,
+	steps: array(PipelineStepInputSchema).readonly(),
+	audio: object({
+		engine: EngineChoiceSchema,
+		modelId: string(),
+		enabled: boolean(),
+		settings: record(string(), unknown()).readonly().optional()
+	}).nullable().optional()
+});
+var StoredPipelineTemplateSchema = object({
+	id: string(),
+	name: string(),
+	description: string().optional(),
+	config: StoredPipelineConfigSchema,
+	createdAt: string(),
+	updatedAt: string()
+});
+var TemplatesSchema = record(string(), StoredPipelineTemplateSchema);
+var StoredAgentAddonConfigSchema = object({
+	enabled: boolean(),
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+});
+var StoredAgentPipelineSettingsSchema = object({
+	addonDefaults: record(string(), StoredAgentAddonConfigSchema).readonly(),
+	maxCameras: number().int().nonnegative().nullable().default(null)
+});
+var AgentSettingsMapSchema = record(string(), StoredAgentPipelineSettingsSchema);
+var StoredCameraStepOverridePatchSchema = object({
+	enabled: boolean().optional(),
+	modelId: string().optional(),
+	settings: record(string(), unknown()).readonly().optional()
+});
+var StoredCameraPipelineForAgentSchema = object({
+	steps: array(PipelineStepInputSchema).readonly(),
+	audio: object({
+		modelId: string(),
+		enabled: boolean()
+	}).nullable()
+});
+var StoredCameraPipelineSettingsSchema = object({
+	pinnedAgentNodeId: string().optional(),
+	stepToggles: record(string(), boolean()).optional(),
+	stepOverridesByAgent: record(string(), record(string(), StoredCameraStepOverridePatchSchema)).optional(),
+	pipelineByAgent: record(string(), StoredCameraPipelineForAgentSchema).optional(),
+	/**
+	* Legacy "nuke inference" flag. Superseded by the detection-pipeline
+	* wrapper binding, but the one-shot boot migration
+	* (`migrateLegacyFlagsToBindings`) still reads it off the persisted
+	* blob to flip the binding off. Kept here so the durable round-trip
+	* does NOT strip it before the migration runs.
+	*/
+	disableInference: boolean().optional()
+});
+var CameraSettingsMapSchema = record(string(), StoredCameraPipelineSettingsSchema);
+//#endregion
+//#region src/pending-retry.ts
 /**
-* Returns the deviceIds that are present in `desired` but absent from
-* `known`. These are the cameras the orchestrator has not yet dispatched
-* and needs to process via `handleDeviceRegistered`.
+* Returns the deviceIds that are KNOWN (present in `known`) but currently
+* UNASSIGNED (absent from `assigned`). These are the "stranded" cameras — the
+* orchestrator has a runner config for them but no live pipeline assignment
+* (pending / over-cap / no-frame-source / load-shed).
 *
-* Additive only — cameras present in `known` are never included, even
-* if they fall out of `desired`, to avoid fighting the live event path.
+* Mirror of `computeDispatchGap` in `dispatch-reconcile.ts`: a plain set
+* difference (`known \ assigned`). Pure — no side effects, deterministic
+* ordering (iteration order of `known`).
 */
-function computeDispatchGap(desired, known) {
-	return [...desired].filter((id) => !known.has(id));
+function computeStrandedDevices(known, assigned) {
+	return [...known].filter((id) => !assigned.has(id));
 }
 //#endregion
 //#region src/pipeline-watchdog.ts
@@ -23187,219 +23315,407 @@ var PipelineWatchdog = class {
 		});
 		this.state.set(cam.deviceId, stages);
 	}
-	unregister(deviceId) {
-		this.cameras.delete(deviceId);
-		this.state.delete(deviceId);
+	unregister(deviceId) {
+		this.cameras.delete(deviceId);
+		this.state.delete(deviceId);
+	}
+	/** Called when a stage's live signal arrives (audio chunk / motion frame / inference). */
+	noteSignal(deviceId, stage) {
+		const rt = this.state.get(deviceId)?.get(stage);
+		if (!rt) return;
+		rt.lastSeenMs = this.deps.now();
+		rt.attempts = 0;
+	}
+	tick() {
+		const now = this.deps.now();
+		for (const cam of this.cameras.values()) {
+			const { line, stalled, recoveries } = this.evaluate(cam, now);
+			if (stalled) this.deps.logger.warn(line);
+			else this.deps.logger.info(line);
+			for (const r of recoveries) {
+				const rt = this.state.get(cam.deviceId)?.get(r.stage);
+				if (rt) rt.attempts += 1;
+				this.deps.recover(cam.deviceId, r.stage, r.streamId);
+			}
+		}
+	}
+	start(intervalMs) {
+		if (this.timer) return;
+		this.timer = setInterval(() => this.tick(), intervalMs);
+	}
+	stop() {
+		if (this.timer) clearInterval(this.timer);
+		this.timer = null;
+	}
+	evaluate(cam, now) {
+		const parts = [];
+		const recoveries = [];
+		let stalled = false;
+		const stageOrder = [
+			"audio",
+			"motion",
+			"detection"
+		];
+		const stageMode = {
+			audio: cam.audioMode,
+			motion: cam.motionSources.includes("analyzer") ? "analyzer" : cam.motionSources.join("+"),
+			detection: cam.detectionMode
+		};
+		for (const stage of stageOrder) {
+			const streamId = cam.continuousStages.get(stage);
+			if (streamId === void 0) {
+				parts.push(`${stage}=${stageMode[stage]}(idle)`);
+				continue;
+			}
+			const rt = this.state.get(cam.deviceId)?.get(stage);
+			if (!rt) {
+				parts.push(`${stage}=${stageMode[stage]}(unknown)`);
+				continue;
+			}
+			const staleness = now - rt.lastSeenMs;
+			const thresholdMs = this.deps.thresholds[STAGE_THRESHOLD_KEY[stage]];
+			const sSec = Math.round(staleness / 1e3);
+			if (staleness <= thresholdMs) parts.push(`${stage}=${stageMode[stage]}@${streamId}(OK ${sSec}s)`);
+			else if (rt.attempts >= this.deps.thresholds.maxRecoveryAttempts) {
+				stalled = true;
+				parts.push(`${stage}=${stageMode[stage]}@${streamId}(STALLED ${sSec}s · exhausted ${rt.attempts})`);
+			} else {
+				stalled = true;
+				recoveries.push({
+					stage,
+					streamId
+				});
+				parts.push(`${stage}=${stageMode[stage]}@${streamId}(STALLED ${sSec}s · recovering ${rt.attempts + 1}/${this.deps.thresholds.maxRecoveryAttempts})`);
+			}
+		}
+		return {
+			line: `[watchdog] cam${cam.deviceId} ${cam.deviceName} · ${parts.join(" · ")} → ${stalled ? "STALLED" : "OK"}`,
+			stalled,
+			recoveries
+		};
+	}
+};
+//#endregion
+//#region src/remote-health.ts
+/**
+* Default thresholds: 3-min grace (cold start), 2-min stale window (metrics
+* stopped entirely), 0.5 fps floor. A degraded foreign-handle camera runs
+* ~1 fps (above the bar); with T2's frame-source eligibility a remote
+* assignment is only legal on a frame-source node, so sustained sub-0.5 fps
+* means genuinely broken.
+*/
+var DEFAULT_REMOTE_HEALTH_OPTS = {
+	graceMs: 3 * 6e4,
+	staleMs: 2 * 6e4,
+	minFps: .5
+};
+/**
+* Evaluate every remote pipeline assignment and return the cameras that must be
+* re-placed. Rules (each assignment evaluated independently):
+*   1. LOCAL assignments (`agentNodeId === localNodeId`) are skipped — the hub
+*      watchdog owns them.
+*   2. Cameras not in `activeDeviceIds` are skipped — detection isn't expected.
+*   3. Assignments younger than `graceMs` are skipped — cold-start grace.
+*   4. No fps entry, or `now - lastSeen > staleMs` → `stale-metrics`.
+*   5. Otherwise `fps < minFps` → `zero-fps`.
+*   6. Otherwise healthy → no action.
+*
+* Deterministic ordering: iteration order of `assignments`.
+*/
+function evaluateRemoteHealth(input) {
+	const { assignments, fpsMap, activeDeviceIds, localNodeId, now, opts } = input;
+	const actions = [];
+	for (const [deviceId, assignment] of assignments) {
+		if (assignment.agentNodeId === localNodeId) continue;
+		if (!activeDeviceIds.has(deviceId)) continue;
+		if (now - assignment.assignedAt < opts.graceMs) continue;
+		const entry = fpsMap.get(deviceId);
+		if (!entry || now - entry.lastSeen > opts.staleMs) {
+			actions.push({
+				deviceId,
+				kind: "replace",
+				why: "stale-metrics"
+			});
+			continue;
+		}
+		if (entry.fps < opts.minFps) {
+			actions.push({
+				deviceId,
+				kind: "replace",
+				why: "zero-fps"
+			});
+			continue;
+		}
+	}
+	return actions;
+}
+//#endregion
+//#region src/zone-rules-provider.ts
+/**
+* `zone-rules-provider.ts` — implements `zoneRulesCapability` for the
+* orchestrator.
+*
+* Per-stage rule arrays (motion / detection) live next to zones in the
+* orchestrator's per-device store under `zoneRules.<stage>` keys.
+* Every mutation mirrors to a stage-specific device-state slice
+* (`motion-zone-rules`, `detection-zone-rules`) so consumer addons
+* subscribe independently and pick up the new gating without an extra
+* cap round-trip.
+*
+* The provider validates each rule against {@link ZoneRuleSchema}
+* before persisting — partial / corrupt writes are rejected outright
+* since rules drive runtime filtering and a bad payload would silently
+* widen the operator's intended scope.
+*/
+/** Settings store key for stage rules. Kept under a single nested
+*  object so a future stage just adds another property without
+*  reshuffling the schema. */
+var RULES_STORE_KEY = "zoneRules";
+/** Cap name for the unified runtime-state slice. Matches the cap's
+*  declared `name` so the codegen DeviceProxy auto-wires
+*  `device.state.zoneRules`. The slice value is the full
+*  `{motion, detection}` object — both stages travel together so a
+*  single reactive handle covers every consumer. */
+var ZONE_RULES_CAP_NAME = "zone-rules";
+var RulesArraySchema = array(ZoneRuleSchema);
+/**
+* Whole-blob schema for the per-device `zoneRules` store key. Both stages
+* travel together under one key. Deliberately lenient — each stage is
+* `unknown` so a corrupt single stage can NOT drop the sibling on load
+* (durable-state `get()` falls back to `{}` only on a whole-blob parse
+* failure). Strict per-stage validation, with its own reset-on-corrupt
+* warn, still happens in `loadRules` exactly as before the migration.
+*/
+var ZoneRulesBlockSchema = object({
+	motion: unknown().optional(),
+	detection: unknown().optional()
+}).passthrough();
+var ZoneRulesProvider = class {
+	ctx;
+	/** Per-device per-stage cache. Hydrated lazily on first read. */
+	cache = /* @__PURE__ */ new Map();
+	/**
+	* Per-device durable handle over the `zoneRules` store key. The WHOLE
+	* `{motion?, detection?}` block round-trips on every read/write so a
+	* write on one stage can never drop the other. Built lazily + memoised.
+	*/
+	stateByDevice = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	/** Lazily build (and memoise) the durable `zoneRules` handle for a device. */
+	rulesState(deviceId) {
+		let handle = this.stateByDevice.get(deviceId);
+		if (!handle) {
+			handle = createDurableState({
+				key: RULES_STORE_KEY,
+				schema: ZoneRulesBlockSchema,
+				fallback: {},
+				read: () => this.ctx.settings.readDeviceStore(deviceId),
+				write: (patch) => this.ctx.settings.writeDeviceStore(deviceId, patch),
+				onParseError: (key, error) => this.ctx.logger.warn("zone-rules store block failed to parse — resetting", {
+					tags: { deviceId },
+					meta: {
+						key,
+						error: error instanceof Error ? error.message : String(error)
+					}
+				})
+			});
+			this.stateByDevice.set(deviceId, handle);
+		}
+		return handle;
+	}
+	async listRules({ deviceId, stage }) {
+		return this.loadRules(deviceId, stage);
+	}
+	async setRules({ deviceId, stage, rules }) {
+		const parsed = RulesArraySchema.safeParse(rules);
+		if (!parsed.success) throw new Error(`zone-rules.setRules: invalid rule payload — ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+		await this.persist(deviceId, stage, parsed.data);
 	}
-	/** Called when a stage's live signal arrives (audio chunk / motion frame / inference). */
-	noteSignal(deviceId, stage) {
-		const rt = this.state.get(deviceId)?.get(stage);
-		if (!rt) return;
-		rt.lastSeenMs = this.deps.now();
-		rt.attempts = 0;
+	/** Drop a device's cache entries. Called when the device is removed. */
+	forgetDevice(deviceId) {
+		this.cache.delete(deviceId);
+		this.stateByDevice.delete(deviceId);
 	}
-	tick() {
-		const now = this.deps.now();
-		for (const cam of this.cameras.values()) {
-			const { line, stalled, recoveries } = this.evaluate(cam, now);
-			if (stalled) this.deps.logger.warn(line);
-			else this.deps.logger.info(line);
-			for (const r of recoveries) {
-				const rt = this.state.get(cam.deviceId)?.get(r.stage);
-				if (rt) rt.attempts += 1;
-				this.deps.recover(cam.deviceId, r.stage, r.streamId);
+	async loadRules(deviceId, stage) {
+		let perDevice = this.cache.get(deviceId);
+		if (!perDevice) {
+			perDevice = /* @__PURE__ */ new Map();
+			this.cache.set(deviceId, perDevice);
+		}
+		const cached = perDevice.get(stage);
+		if (cached) return cached;
+		let rules = [];
+		try {
+			const raw = (await this.rulesState(deviceId).get())[stage];
+			if (raw !== void 0) {
+				const parsed = RulesArraySchema.safeParse(raw);
+				if (parsed.success) rules = parsed.data;
+				else this.ctx.logger.warn("zone-rules store entry failed to parse — resetting", {
+					tags: { deviceId },
+					meta: {
+						stage,
+						issues: parsed.error.issues
+					}
+				});
 			}
+		} catch (err) {
+			this.ctx.logger.warn("zone-rules store read failed — using empty list", {
+				tags: { deviceId },
+				meta: {
+					stage,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
 		}
+		perDevice.set(stage, rules);
+		return rules;
 	}
-	start(intervalMs) {
-		if (this.timer) return;
-		this.timer = setInterval(() => this.tick(), intervalMs);
-	}
-	stop() {
-		if (this.timer) clearInterval(this.timer);
-		this.timer = null;
-	}
-	evaluate(cam, now) {
-		const parts = [];
-		const recoveries = [];
-		let stalled = false;
-		const stageOrder = [
-			"audio",
-			"motion",
-			"detection"
-		];
-		const stageMode = {
-			audio: cam.audioMode,
-			motion: cam.motionSources.includes("analyzer") ? "analyzer" : cam.motionSources.join("+"),
-			detection: cam.detectionMode
+	async persist(deviceId, stage, rules) {
+		let perDevice = this.cache.get(deviceId);
+		if (!perDevice) {
+			perDevice = /* @__PURE__ */ new Map();
+			this.cache.set(deviceId, perDevice);
+		}
+		perDevice.set(stage, rules);
+		await this.rulesState(deviceId).update((prev) => ({
+			...prev,
+			[stage]: rules
+		}));
+		const otherStage = stage === "motion" ? "detection" : "motion";
+		const otherRules = perDevice.get(otherStage) ?? await this.loadRules(deviceId, otherStage);
+		const sliceValue = stage === "motion" ? {
+			motion: rules,
+			detection: otherRules
+		} : {
+			motion: otherRules,
+			detection: rules
 		};
-		for (const stage of stageOrder) {
-			const streamId = cam.continuousStages.get(stage);
-			if (streamId === void 0) {
-				parts.push(`${stage}=${stageMode[stage]}(idle)`);
-				continue;
-			}
-			const rt = this.state.get(cam.deviceId)?.get(stage);
-			if (!rt) {
-				parts.push(`${stage}=${stageMode[stage]}(unknown)`);
-				continue;
-			}
-			const staleness = now - rt.lastSeenMs;
-			const thresholdMs = this.deps.thresholds[STAGE_THRESHOLD_KEY[stage]];
-			const sSec = Math.round(staleness / 1e3);
-			if (staleness <= thresholdMs) parts.push(`${stage}=${stageMode[stage]}@${streamId}(OK ${sSec}s)`);
-			else if (rt.attempts >= this.deps.thresholds.maxRecoveryAttempts) {
-				stalled = true;
-				parts.push(`${stage}=${stageMode[stage]}@${streamId}(STALLED ${sSec}s · exhausted ${rt.attempts})`);
-			} else {
-				stalled = true;
-				recoveries.push({
+		try {
+			await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
+				capName: ZONE_RULES_CAP_NAME,
+				slice: sliceValue
+			});
+		} catch (err) {
+			this.ctx.logger.debug("zone-rules slice mirror failed", {
+				tags: { deviceId },
+				meta: {
 					stage,
-					streamId
-				});
-				parts.push(`${stage}=${stageMode[stage]}@${streamId}(STALLED ${sSec}s · recovering ${rt.attempts + 1}/${this.deps.thresholds.maxRecoveryAttempts})`);
-			}
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
 		}
-		return {
-			line: `[watchdog] cam${cam.deviceId} ${cam.deviceName} · ${parts.join(" · ")} → ${stalled ? "STALLED" : "OK"}`,
-			stalled,
-			recoveries
-		};
+		this.ctx.onRulesChanged?.(deviceId, stage, rules);
 	}
 };
 //#endregion
-//#region src/camera-status/compose-camera-status.ts
-function mapAssignment(input) {
-	return {
-		detectionNodeId: input.detectionNodeId,
-		decoderNodeId: input.decoderNodeId,
-		audioNodeId: input.audioNodeId,
-		pinned: {
-			detection: input.pinned.detection,
-			decoder: input.pinned.decoder,
-			audio: input.pinned.audio
-		},
-		reasons: {
-			detection: input.reasons.detection,
-			decoder: input.reasons.decoder,
-			audio: input.reasons.audio
-		}
-	};
-}
-function mapSource(sourceResult) {
-	if (sourceResult === null) return { streams: [] };
-	return { streams: sourceResult.streams.map((s) => ({
-		camStreamId: s.camStreamId,
-		codec: s.codec,
-		width: s.width,
-		height: s.height,
-		fps: s.fps,
-		kind: s.kind
-	})) };
-}
-function mapBroker(brokerResult) {
-	if (brokerResult === null) return null;
-	return {
-		profiles: brokerResult.profiles.map((p) => ({
-			profile: p.profile,
-			status: p.status,
-			codec: p.codec,
-			width: p.width,
-			height: p.height,
-			subscribers: p.subscribers,
-			inFps: p.inFps,
-			outFps: p.outFps
-		})),
-		webrtcSessions: brokerResult.webrtcSessions,
-		rtspRestream: brokerResult.rtspRestream
-	};
-}
-function mapDecoderShm(shm) {
-	return {
-		framesWritten: shm.framesWritten,
-		getFrameHits: shm.getFrameHits,
-		getFrameMisses: shm.getFrameMisses,
-		budgetMb: shm.budgetMb
-	};
-}
-function mapDecoder(decoderResult) {
-	if (decoderResult === null) return null;
-	return {
-		nodeId: decoderResult.nodeId,
-		formats: [...decoderResult.formats],
-		sessionCount: decoderResult.sessionCount,
-		shm: mapDecoderShm(decoderResult.shm)
-	};
-}
-function mapMotion(motionResult) {
-	if (motionResult === null) return null;
-	return {
-		enabled: motionResult.enabled,
-		fps: motionResult.fps
-	};
-}
-function mapProvisioning(p) {
-	if (p.error !== void 0) return {
-		state: p.state,
-		error: p.error
-	};
-	return { state: p.state };
-}
-function mapDetection(detectionResult) {
-	if (detectionResult === null) return null;
-	const phase = detectionResult.phase;
-	return {
-		nodeId: detectionResult.nodeId,
-		engine: {
-			backend: detectionResult.engine.backend,
-			device: detectionResult.engine.device
-		},
-		phase,
-		configuredFps: detectionResult.configuredFps,
-		actualFps: detectionResult.actualFps,
-		queueDepth: detectionResult.queueDepth,
-		avgInferenceMs: detectionResult.avgInferenceMs,
-		provisioning: mapProvisioning(detectionResult.provisioning)
-	};
-}
-function mapAudio(audioResult) {
-	if (audioResult === null) return null;
-	return {
-		nodeId: audioResult.nodeId,
-		enabled: audioResult.enabled
-	};
-}
-function mapRecording(recordingResult) {
-	if (recordingResult === null) return null;
-	return {
-		mode: recordingResult.mode,
-		active: recordingResult.active,
-		storageBytes: recordingResult.storageBytes
-	};
-}
+//#region src/zones-provider.ts
 /**
-* Pure function that composes a `CameraStatus` from per-stage fetch results.
+* `zones-provider.ts` — implements `zonesCapability` for the orchestrator.
+*
+* Per-camera CRUD over polygon detection zones. Persists to the
+* orchestrator's per-device settings store under the `zones` key and
+* mirrors every change into the device-state `zones` slice via
+* `api.deviceState.setCapSlice`. Downstream consumers (motion-wasm,
+* pipeline-executor, analytics, admin UI) read the live state with
+* the canonical `dev.state.zones.onChanged` channel.
 *
-* - `assignment` is always built from orchestrator-local data (never null).
-* - `source` always present: defaults to `{ streams: [] }` when sourceResult is null.
-* - Every other block is null when its stage result is null (graceful degradation).
-* - `fetchedAt` is stamped exactly as provided — never calls `Date.now()`.
-* - No mutation of the input.
+* Onboard / firmware-reported zones are out of scope for now — every
+* zone is operator-drawn. The provider keeps the surface symmetric:
+* `addZone` rejects id collisions, `updateZone` requires an existing
+* id, `removeZone` is idempotent.
 */
-function composeCameraStatus(input) {
-	return {
-		deviceId: input.deviceId,
-		assignment: mapAssignment(input),
-		source: mapSource(input.sourceResult),
-		broker: mapBroker(input.brokerResult),
-		decoder: mapDecoder(input.decoderResult),
-		motion: mapMotion(input.motionResult),
-		detection: mapDetection(input.detectionResult),
-		audio: mapAudio(input.audioResult),
-		recording: mapRecording(input.recordingResult),
-		fetchedAt: input.fetchedAt
-	};
-}
+var ZONES_STORE_KEY = "zones";
+var ZONES_CAP_NAME = "zones";
+var ZonesArraySchema = array(ZoneSchema);
+var ZonesProvider = class {
+	ctx;
+	/** Per-device cache. Hydrated lazily on first read for a device. */
+	cache = /* @__PURE__ */ new Map();
+	/**
+	* Per-device durable handle over the `zones` store key. The WHOLE
+	* validated zone array round-trips on every read/write so no field can
+	* be dropped on persist. Built lazily + memoised per device.
+	*/
+	stateByDevice = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	/** Lazily build (and memoise) the durable `zones` handle for a device. */
+	zonesState(deviceId) {
+		let handle = this.stateByDevice.get(deviceId);
+		if (!handle) {
+			handle = createDurableState({
+				key: ZONES_STORE_KEY,
+				schema: ZonesArraySchema,
+				fallback: [],
+				read: () => this.ctx.settings.readDeviceStore(deviceId),
+				write: (patch) => this.ctx.settings.writeDeviceStore(deviceId, patch),
+				onParseError: (key, error) => this.ctx.logger.warn("zones store entry failed to parse — resetting", {
+					tags: { deviceId },
+					meta: {
+						key,
+						error: error instanceof Error ? error.message : String(error)
+					}
+				})
+			});
+			this.stateByDevice.set(deviceId, handle);
+		}
+		return handle;
+	}
+	async listZones({ deviceId }) {
+		return this.loadZones(deviceId);
+	}
+	async addZone({ deviceId, zone }) {
+		const existing = await this.loadZones(deviceId);
+		if (existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.addZone: id ${zone.id} already exists`);
+		await this.persist(deviceId, [...existing, zone]);
+	}
+	async updateZone({ deviceId, zone }) {
+		const existing = await this.loadZones(deviceId);
+		if (!existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.updateZone: id ${zone.id} not found`);
+		const next = existing.map((entry) => entry.id === zone.id ? zone : entry);
+		await this.persist(deviceId, next);
+	}
+	async removeZone({ deviceId, zoneId }) {
+		const existing = await this.loadZones(deviceId);
+		if (!existing.some((entry) => entry.id === zoneId)) return;
+		await this.persist(deviceId, existing.filter((entry) => entry.id !== zoneId));
+	}
+	/**
+	* Drop a device's cache entry. Called when the device is removed so
+	* the next attach starts from a fresh disk read.
+	*/
+	forgetDevice(deviceId) {
+		this.cache.delete(deviceId);
+		this.stateByDevice.delete(deviceId);
+	}
+	async loadZones(deviceId) {
+		const cached = this.cache.get(deviceId);
+		if (cached) return cached;
+		let zones = [];
+		try {
+			zones = await this.zonesState(deviceId).get();
+		} catch (err) {
+			this.ctx.logger.warn("zones store read failed — using empty list", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+		this.cache.set(deviceId, zones);
+		return zones;
+	}
+	async persist(deviceId, zones) {
+		this.cache.set(deviceId, zones);
+		await this.zonesState(deviceId).set(zones);
+		await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
+			capName: ZONES_CAP_NAME,
+			slice: { zones }
+		});
+		this.ctx.onZonesChanged?.(deviceId, zones);
+	}
+};
 //#endregion
 //#region src/index.ts
 var PHASE_MODE_VALUES = new Set([
@@ -23418,6 +23734,24 @@ var DEFAULT_BROKER_CALL_TIMEOUT_MS = 5e3;
 /** Debounce window for `scheduleReconcile` — coalesces bursts of topology/slot-change signals. */
 var RECONCILE_DEBOUNCE_MS = 200;
 /**
+* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
+* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
+* `reconcileDispatch` is additive-only and never revisits these, so a slow
+* safety-net timer + event-driven debounce triggers recover them.
+*/
+var PENDING_RETRY_INTERVAL_MS = 6e4;
+/** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
+var PENDING_RETRY_DEBOUNCE_MS = 2e3;
+/**
+* Remote-assignment health loop (T7) bounded backoff. A remote camera flagged
+* as unhealthy (0-fps / metrics-stale) is re-placed at most
+* `REMOTE_HEALTH_MAX_ATTEMPTS` times inside a rolling `REMOTE_HEALTH_WINDOW_MS`
+* window; once exhausted the camera is left visibly pending (`'unhealthy'`) for
+* the operator instead of churning forever.
+*/
+var REMOTE_HEALTH_MAX_ATTEMPTS = 3;
+var REMOTE_HEALTH_WINDOW_MS = 60 * 6e4;
+/**
 * Device-details keys routed through the orchestrator's pipeline
 * settings writer instead of the device orchestration store. The
 * `cameraPipeline` key carries the full `CameraPipelineConfig`
@@ -23506,6 +23840,28 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	zoneRulesProvider = null;
 	/** In-memory assignment map — mirrored into events + per-device settings for the pin. */
 	assignments = /* @__PURE__ */ new Map();
+	/**
+	* Why a camera is currently unassigned (pending), keyed by deviceId. Set on
+	* every pending placement path (over-cap, no-frame-source, load-shed) and
+	* cleared when the camera is (re)assigned or released. Consumed by T3's
+	* pending-retry sweep + `getCameraStatus` surface — nothing reads it yet in
+	* this commit; the map is populated so T3 can wire the read side without
+	* re-touching every placement path.
+	*
+	* `protected` (not `private`) to match the existing test-seam convention in
+	* this class (`audioSubscriptions`, `audioSubLocks`) — the frame-source
+	* eligibility spec subclasses the addon to assert the recorded reason.
+	*/
+	pendingReasons = /* @__PURE__ */ new Map();
+	/**
+	* Remote-assignment health loop (T7) per-device backoff ledger. Each entry
+	* tracks how many times a remote camera has been re-placed inside the current
+	* rolling window (`REMOTE_HEALTH_WINDOW_MS`). Bounds churn: once the count
+	* hits `REMOTE_HEALTH_MAX_ATTEMPTS`, the camera is left pending (`'unhealthy'`)
+	* for the operator instead of being re-placed again. `protected` so the
+	* remote-health spec can assert the ledger without casts.
+	*/
+	remoteHealthAttempts = /* @__PURE__ */ new Map();
 	/** Per-device audio node assignment — nodeId of the audio-analyzer handling this device's chunks. */
 	audioNodeByDevice = /* @__PURE__ */ new Map();
 	/** Assignments with metadata — replaces plain audioNodeByDevice values as the source of truth. */
@@ -23625,6 +23981,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	reconcileInFlight = false;
 	/** Set to true when a reconcile is requested while one is already in-flight; triggers a follow-up pass. */
 	reconcileRerunRequested = false;
+	/** Periodic `retryPendingDispatches` safety-net timer (T3). */
+	pendingRetryTimer = null;
+	/** Pending `schedulePendingRetry` debounce timer (T3). */
+	pendingRetryDebounceTimer = null;
+	/** True while `retryPendingDispatches` is running. */
+	pendingRetryInFlight = false;
+	/** Set when a pending-retry is requested while one is already in-flight; triggers a follow-up pass. */
+	pendingRetryRerunRequested = false;
 	initTimestamp = 0;
 	constructor() {
 		super({});
@@ -23841,6 +24205,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			thresholds: DEFAULT_WATCHDOG_THRESHOLDS
 		});
 		this.pipelineWatchdog.start(PipelineOrchestratorAddon.WATCHDOG_INTERVAL_MS);
+		this.pendingRetryTimer = setInterval(() => void this.retryPendingDispatches(), PENDING_RETRY_INTERVAL_MS);
 		this.ctx.logger.info("Pipeline orchestrator detection-wiring subscriptions installed");
 		this.migrateLegacyFlagsToBindings().catch((err) => {
 			this.ctx.logger.warn("bindings migration failed — will retry on next boot", { meta: { error: errMsg(err) } });
@@ -24070,6 +24435,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			clearTimeout(this.reconcileTimer);
 			this.reconcileTimer = null;
 		}
+		if (this.pendingRetryTimer !== null) {
+			clearInterval(this.pendingRetryTimer);
+			this.pendingRetryTimer = null;
+		}
+		if (this.pendingRetryDebounceTimer !== null) {
+			clearTimeout(this.pendingRetryDebounceTimer);
+			this.pendingRetryDebounceTimer = null;
+		}
 		this.unsubDeviceRegistered?.();
 		this.unsubDeviceRegistered = null;
 		this.unsubDeviceUnregistered?.();
@@ -24095,6 +24468,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		for (const t of this.lazyAudioTeardownTimers.values()) clearTimeout(t);
 		this.lazyAudioTeardownTimers.clear();
 		this.cameraFpsMap.clear();
+		this.remoteHealthAttempts.clear();
 		this.loadShedState.clear();
 		if (this.loadShedResumeTimer) {
 			clearInterval(this.loadShedResumeTimer);
@@ -24156,6 +24530,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 							windowMs
 						}
 					});
+					this.pendingReasons.set(runnerConfig.deviceId, "load-shed");
 					return {
 						success: true,
 						kind: "pending"
@@ -24169,11 +24544,16 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const decision = balance({
 			nodes: await this.collectAgentLoad({ onlyEnabled: true }),
 			preferredAgent,
-			nodeCaps: this.buildNodeCaps()
+			nodeCaps: await this.buildNodeCaps(),
+			eligibleNodes: this.detectionEligibleNodes(runnerConfig.deviceId)
 		});
 		if (!decision) throw new Error(`dispatchCamera: no runner available for ${runnerConfig.deviceId}`);
 		if (decision.kind === "pending") {
-			this.ctx.logger.warn("camera left pending — all nodes at maxCameras", { tags: { deviceId: runnerConfig.deviceId } });
+			this.pendingReasons.set(runnerConfig.deviceId, decision.reason);
+			this.ctx.logger.warn("camera left pending — no eligible node", {
+				tags: { deviceId: runnerConfig.deviceId },
+				meta: { reason: decision.reason }
+			});
 			return {
 				success: true,
 				kind: "pending"
@@ -24224,11 +24604,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		}
 		this.assignments.delete(input.deviceId);
 		this.cameraConfigs.delete(input.deviceId);
+		this.pendingReasons.delete(input.deviceId);
 		this.pipelineWatchdog?.unregister(input.deviceId);
 		return { success: true };
 	}
 	async assignPipeline(input) {
 		if (!this.ctx) throw new Error("PipelineOrchestrator: assignPipeline called before initialize");
+		const eligible = this.detectionEligibleNodes(input.deviceId);
+		if (!eligible.includes(input.agentNodeId)) throw new Error(`Cannot pin camera ${input.deviceId} detection to '${input.agentNodeId}': the node cannot obtain this camera's decoded frames (frame-source nodes: ${eligible.join(", ") || "none"}). Add it to Enabled Decoder Nodes first.`);
 		await this.ctx.settings?.writeDeviceStore(input.deviceId, { [PREFERRED_AGENT_SETTING]: input.agentNodeId }).catch((err) => {
 			const msg = errMsg(err);
 			this.ctx.logger.warn("assignPipeline: failed to persist pin", {
@@ -24274,11 +24657,17 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			const decision = balance({
 				nodes: await this.collectAgentLoad({ onlyEnabled: true }),
 				preferredAgent: null,
-				nodeCaps: this.buildNodeCaps()
+				nodeCaps: await this.buildNodeCaps(),
+				eligibleNodes: this.detectionEligibleNodes(input.deviceId)
 			});
 			if (!decision) this.ctx.logger.warn("unassignPipeline: no runner available, leaving unassigned", { tags: { deviceId: input.deviceId } });
-			else if (decision.kind === "pending") this.ctx.logger.warn("camera left pending — all nodes at maxCameras", { tags: { deviceId: input.deviceId } });
-			else {
+			else if (decision.kind === "pending") {
+				this.pendingReasons.set(input.deviceId, decision.reason);
+				this.ctx.logger.warn("camera left pending — no eligible node", {
+					tags: { deviceId: input.deviceId },
+					meta: { reason: decision.reason }
+				});
+			} else {
 				const targetNodeId = decision.agentNodeId;
 				if (current && current.agentNodeId !== targetNodeId) await this.detachOn(current.agentNodeId, input.deviceId).catch((err) => {
 					const msg = errMsg(err);
@@ -24316,7 +24705,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async rebalance() {
 		if (!this.ctx) throw new Error("PipelineOrchestrator: rebalance called before initialize");
 		const loads = await this.collectAgentLoad({ onlyEnabled: true });
-		const nodeCaps = this.buildNodeCaps();
+		const nodeCaps = await this.buildNodeCaps();
 		let migrated = 0;
 		for (const [deviceId, config] of this.cameraConfigs) {
 			const current = this.assignments.get(deviceId);
@@ -24324,11 +24713,16 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			const decision = balance({
 				nodes: loads,
 				preferredAgent: await this.readPreferredAgent(deviceId),
-				nodeCaps
+				nodeCaps,
+				eligibleNodes: this.detectionEligibleNodes(deviceId)
 			});
 			if (!decision) continue;
 			if (decision.kind === "pending") {
-				this.ctx.logger.warn("camera left pending — all nodes at maxCameras", { tags: { deviceId } });
+				this.pendingReasons.set(deviceId, decision.reason);
+				this.ctx.logger.warn("camera left pending — no eligible node", {
+					tags: { deviceId },
+					meta: { reason: decision.reason }
+				});
 				continue;
 			}
 			if (current && current.agentNodeId === decision.agentNodeId) continue;
@@ -24535,6 +24929,57 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.enabledNodes.includes(nodeId);
 	}
 	/**
+	* The node that owns `deviceId`'s source pull (dials the real RTSP, hosts
+	* the broker). **P2a (today): intentionally `undefined`** — per-camera
+	* source ownership is not modeled yet, and an absent owner makes
+	* `computeFrameSourceNodes` collapse to the global `enabledDecoderNodes`
+	* (bit-identical to pre-P2a behavior, the safe-rollout invariant).
+	*
+	* Deliberately NOT `'hub'` yet: with an owner set and no
+	* `remoteSourcingNodes`, the predicate would restrict eligibility to the
+	* hub even when agents are decoder-enabled — a behavior change reserved for
+	* P2d, which backs this seam with the `assignSource`/`getSourceAssignment`
+	* cap surface (restream-owner design §2.3).
+	*/
+	sourceOwner(_deviceId) {}
+	/**
+	* The set of nodes that can OBTAIN a camera's decoded frames — PER-CAMERA
+	* since P2a (restream-owner design §2.3), delegating to the pure
+	* `computeFrameSourceNodes` predicate: a node qualifies iff it can decode
+	* locally (`enabledDecoderNodes`) AND (it owns the camera's source pull OR
+	* it may dial the owner's restream — `remoteSourcingNodes`, a P2c/P2d
+	* rollout knob not wired yet).
+	*
+	* **Today's effective value:** `sourceOwner()` returns `undefined` for
+	* every camera, so this is exactly `enabledDecoderNodes` — identical to the
+	* pre-P2a global predicate. Every predicate change edits the pure module
+	* (and this ONE method); `deviceId` is threaded from all placement sites so
+	* later phases turn per-camera without re-touching call sites.
+	*/
+	frameSourceNodes(deviceId) {
+		return computeFrameSourceNodes({
+			enabledDecoderNodes: this.enabledDecoderNodes,
+			sourceOwnerNodeId: this.sourceOwner(deviceId)
+		});
+	}
+	/**
+	* Nodes eligible to run a camera's detection pipeline: the whitelist of
+	* detection-enabled nodes (`enabledNodes`) intersected with the nodes that
+	* can obtain the camera's frames (`frameSourceNodes(deviceId)`). A node
+	* that is detection-enabled but cannot source frames (or vice-versa) is
+	* NEVER a valid placement — the balancer receives this as `eligibleNodes`
+	* and treats anything outside it as unassignable (`no-frame-source`).
+	*
+	* Single choke point for T2/T10: passed to every `balance()` call site and
+	* enforced by `assignPipeline` before persisting a pin. `deviceId` is
+	* optional only for node-scoped checks (reconnect-restore guard); camera
+	* placement sites always pass it.
+	*/
+	detectionEligibleNodes(deviceId) {
+		const frameSource = this.frameSourceNodes(deviceId);
+		return this.enabledNodes.filter((nodeId) => frameSource.includes(nodeId));
+	}
+	/**
 	* Query every online runner in the cluster for its current load, plus the
 	* local runner if co-located. Refreshes the `cachedAgentLoad` snapshot so
 	* `getAgentLoad()` / `getGlobalMetrics()` can return fresh data.
@@ -24635,8 +25080,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* Used by every `balance()` call so the balancer can honour operator-set
 	* per-node maximums without polling the store on each decision.
 	*/
-	buildNodeCaps() {
-		const blob = this.agentSettingsState.get();
+	async buildNodeCaps() {
+		const blob = await this.agentSettingsState.get();
 		const caps = {};
 		for (const [nodeId, settings] of Object.entries(blob)) caps[nodeId] = settings.maxCameras ?? null;
 		return caps;
@@ -24700,6 +25145,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			assignedAt: Date.now()
 		};
 		this.assignments.set(deviceId, assignment);
+		this.pendingReasons.delete(deviceId);
 		if (!this.ctx?.eventBus) return;
 		const payload = {
 			deviceId,
@@ -24784,7 +25230,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			const decision = balance({
 				nodes: loads,
 				preferredAgent: null,
-				nodeCaps: this.buildNodeCaps()
+				nodeCaps: await this.buildNodeCaps(),
+				eligibleNodes: this.detectionEligibleNodes(deviceId)
 			});
 			if (!decision) {
 				this.ctx.logger.error("Failover: no online runner", { tags: { deviceId } });
@@ -24792,7 +25239,11 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				continue;
 			}
 			if (decision.kind === "pending") {
-				this.ctx.logger.warn("camera left pending — all nodes at maxCameras", { tags: { deviceId } });
+				this.pendingReasons.set(deviceId, decision.reason);
+				this.ctx.logger.warn("Failover: camera left pending — no eligible node", {
+					tags: { deviceId },
+					meta: { reason: decision.reason }
+				});
 				this.assignments.delete(deviceId);
 				continue;
 			}
@@ -24831,6 +25282,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			tags: { nodeId },
 			meta: { policy: this.failoverPolicy.onReconnect }
 		});
+		this.schedulePendingRetry();
 		if (this.failoverPolicy.onReconnect === "rebalance") {
 			await this.rebalance().catch((err) => {
 				const msg = errMsg(err);
@@ -24838,6 +25290,17 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			});
 			return;
 		}
+		if (!this.detectionEligibleNodes().includes(nodeId)) {
+			this.ctx.logger.warn("restore skipped — node not frame-source eligible", {
+				tags: { nodeId },
+				meta: { eligibleNodes: this.detectionEligibleNodes().join(",") }
+			});
+			for (const [deviceId, assignment] of this.assignments) {
+				if (assignment.agentNodeId !== nodeId) continue;
+				this.pendingReasons.set(deviceId, "no-frame-source");
+			}
+			return;
+		}
 		let restored = 0;
 		for (const [deviceId, config] of this.cameraConfigs) {
 			const current = this.assignments.get(deviceId);
@@ -24925,34 +25388,43 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async reattachAudioForNode(nodeId) {
 		for (const [deviceId, audioNode] of this.audioNodeByDevice) {
 			if (audioNode !== nodeId) continue;
-			const config = this.cameraConfigs.get(deviceId);
-			if (!config) continue;
-			const audioCfg = {
-				...config,
-				enabled: config.pipelineEnabled
-			};
-			try {
-				await this.withAudioSubLock(deviceId, async () => {
-					const prior = this.audioSubscriptions.get(deviceId);
-					if (prior) {
-						try {
-							prior();
-						} catch {}
-						this.audioSubscriptions.delete(deviceId);
-					}
-					const unsub = await this.subscribeAudioStream(deviceId, audioCfg);
-					if (unsub) if (this.activeDetections.has(deviceId)) this.storeAudioSub(deviceId, unsub);
-					else unsub();
-				});
-			} catch (err) {
-				this.ctx.logger.error("audio re-attach on analyzer readiness failed", {
-					tags: {
-						deviceId,
-						nodeId
-					},
-					meta: { error: errMsg(err) }
-				});
-			}
+			await this.reattachAudioForDevice(deviceId);
+		}
+	}
+	/**
+	* Re-establish the audio subscription for ONE camera: tear down any prior
+	* sub and re-subscribe under the current pin/balance, keeping the new handle
+	* only while detection is active. The whole get→teardown→subscribe→store
+	* sequence runs inside `withAudioSubLock` so a prior handle is never orphaned
+	* (the same invariant `reattachAudioForNode` relied on before it was
+	* extracted here). No-op when the device has no runner config or audio is
+	* disabled/lazy (`subscribeAudioStream` self-gates).
+	*/
+	async reattachAudioForDevice(deviceId) {
+		const config = this.cameraConfigs.get(deviceId);
+		if (!config) return;
+		const audioCfg = {
+			...config,
+			enabled: config.pipelineEnabled
+		};
+		try {
+			await this.withAudioSubLock(deviceId, async () => {
+				const prior = this.audioSubscriptions.get(deviceId);
+				if (prior) {
+					try {
+						prior();
+					} catch {}
+					this.audioSubscriptions.delete(deviceId);
+				}
+				const unsub = await this.subscribeAudioStream(deviceId, audioCfg);
+				if (unsub) if (this.activeDetections.has(deviceId)) this.storeAudioSub(deviceId, unsub);
+				else unsub();
+			});
+		} catch (err) {
+			this.ctx.logger.error("audio re-attach failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
 		}
 	}
 	/**
@@ -25027,6 +25499,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				});
 			}, 3e3);
 			this.scheduleReconcile();
+			this.schedulePendingRetry();
 		} catch (err) {
 			this.ctx.logger.debug("readiness seed+redispatch failed", {
 				tags: { nodeId },
@@ -25141,6 +25614,175 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			}
 		}
 	}
+	/**
+	* Coalesce bursts of capacity/eligibility/readiness signals into a single
+	* `retryPendingDispatches` pass. Mirrors `scheduleReconcile`, but on a
+	* dedicated (longer) debounce so a raise-cap / node-connect flurry doesn't
+	* hammer `dispatchCamera`.
+	*/
+	schedulePendingRetry() {
+		if (this.pendingRetryDebounceTimer !== null) clearTimeout(this.pendingRetryDebounceTimer);
+		this.pendingRetryDebounceTimer = setTimeout(() => {
+			this.pendingRetryDebounceTimer = null;
+			this.retryPendingDispatches();
+		}, PENDING_RETRY_DEBOUNCE_MS);
+	}
+	/**
+	* Re-dispatch every KNOWN-but-UNASSIGNED camera. `reconcileDispatch` is
+	* additive-only over `cameraConfigs` and never revisits a camera that is
+	* tracked but has no live assignment (left pending by over-cap /
+	* no-frame-source / load-shed), so those cameras would otherwise stay
+	* stranded until an unrelated live event happens to touch them. This sweep
+	* closes that gap.
+	*
+	* `dispatchCamera` re-reads pins, re-balances with the frame-source
+	* predicate, and re-returns pending harmlessly when nothing changed —
+	* so a no-op sweep is cheap and side-effect-free. Serialized with an
+	* in-flight flag + trailing-rerun bit (mirrors `reconcileDispatch`).
+	*/
+	async retryPendingDispatches() {
+		if (this.pendingRetryInFlight) {
+			this.pendingRetryRerunRequested = true;
+			return;
+		}
+		if (this.reconcileInFlight) return;
+		if (!this.api) return;
+		this.pendingRetryInFlight = true;
+		try {
+			const stranded = computeStrandedDevices(new Set(this.cameraConfigs.keys()), new Set(this.assignments.keys()));
+			if (stranded.length > 0) {
+				const loadShedActive = this.isAnyNodeLoadShed();
+				let retried = 0;
+				let stillPending = 0;
+				for (const deviceId of stranded) {
+					if (this.pendingReasons.get(deviceId) === "load-shed" && loadShedActive) {
+						stillPending++;
+						continue;
+					}
+					const cfg = this.cameraConfigs.get(deviceId);
+					if (!cfg) continue;
+					try {
+						const result = await this.dispatchCamera(cfg);
+						retried++;
+						if (result.kind === "pending") stillPending++;
+					} catch (err) {
+						this.ctx.logger.warn("pending retry: dispatchCamera failed", {
+							tags: { deviceId },
+							meta: { error: errMsg(err) }
+						});
+						stillPending++;
+					}
+				}
+				this.ctx.logger.info("pending retry sweep", { meta: {
+					stranded: stranded.length,
+					retried,
+					stillPending
+				} });
+			}
+			await this.evaluateRemoteAssignmentHealth();
+		} finally {
+			this.pendingRetryInFlight = false;
+			if (this.pendingRetryRerunRequested) {
+				this.pendingRetryRerunRequested = false;
+				this.schedulePendingRetry();
+			}
+		}
+	}
+	/** True when any node is currently load-shed paused (used to skip churny retries). */
+	isAnyNodeLoadShed() {
+		for (const state of this.loadShedState.values()) if (state.pausedAt !== null) return true;
+		return false;
+	}
+	/**
+	* Evaluate the health of every REMOTE pipeline assignment and act on the
+	* cameras the pure `evaluateRemoteHealth` flags. The hub watchdog covers
+	* local cameras; this is its remote-node equivalent (gap i). Called from the
+	* T3 sweep tick after retrying pending dispatches.
+	*
+	* `protected` so the remote-health orchestrator spec can drive one evaluation
+	* pass deterministically (mirrors the `pendingReasons`/`audioSubLocks` test-seam
+	* convention in this class) without waiting on the periodic timer.
+	*/
+	async evaluateRemoteAssignmentHealth() {
+		if (!this.api) return;
+		const actions = evaluateRemoteHealth({
+			assignments: this.assignments,
+			fpsMap: this.cameraFpsMap,
+			activeDeviceIds: new Set(this.activeDetections.keys()),
+			localNodeId: this.localNodeId,
+			now: Date.now(),
+			opts: DEFAULT_REMOTE_HEALTH_OPTS
+		});
+		for (const action of actions) await this.handleRemoteHealthReplace(action);
+	}
+	/**
+	* Re-place a single unhealthy remote camera with bounded per-device backoff.
+	* Under budget: detach from the unhealthy node + re-dispatch (inherits the
+	* T2 frame-source predicate). Over budget: log an error, drop the dead
+	* assignment, and mark the camera `'unhealthy'`-pending for the operator so
+	* `getCameraStatus` surfaces it (R2 "bounded-retry ... state visible").
+	*/
+	async handleRemoteHealthReplace(action) {
+		const { deviceId, why } = action;
+		const assignment = this.assignments.get(deviceId);
+		if (!assignment) return;
+		const cfg = this.cameraConfigs.get(deviceId);
+		if (!cfg) return;
+		const now = Date.now();
+		const prior = this.remoteHealthAttempts.get(deviceId);
+		const windowFresh = prior !== void 0 && now - prior.windowStart < REMOTE_HEALTH_WINDOW_MS;
+		const count = windowFresh ? prior.count : 0;
+		if (count >= REMOTE_HEALTH_MAX_ATTEMPTS) {
+			this.ctx.logger.error("remote assignment unhealthy — retries exhausted, leaving pending", {
+				tags: {
+					deviceId,
+					nodeId: assignment.agentNodeId
+				},
+				meta: {
+					why,
+					attempts: count,
+					windowMs: REMOTE_HEALTH_WINDOW_MS
+				}
+			});
+			this.assignments.delete(deviceId);
+			this.pendingReasons.set(deviceId, "unhealthy");
+			await this.detachOn(assignment.agentNodeId, deviceId).catch((err) => {
+				this.ctx.logger.debug("remote-health exhausted-detach failed", {
+					tags: { deviceId },
+					meta: { error: errMsg(err) }
+				});
+			});
+			return;
+		}
+		this.remoteHealthAttempts.set(deviceId, {
+			count: count + 1,
+			windowStart: windowFresh ? prior.windowStart : now
+		});
+		this.ctx.logger.warn("remote assignment unhealthy — re-placing camera", {
+			tags: {
+				deviceId,
+				nodeId: assignment.agentNodeId
+			},
+			meta: {
+				why,
+				attempt: count + 1,
+				maxAttempts: REMOTE_HEALTH_MAX_ATTEMPTS
+			}
+		});
+		await this.detachOn(assignment.agentNodeId, deviceId).catch((err) => {
+			this.ctx.logger.warn("remote-health detach failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+		this.assignments.delete(deviceId);
+		await this.dispatchCamera(cfg).catch((err) => {
+			this.ctx.logger.warn("remote-health re-dispatch failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+	}
 	async getCapabilityBindings(input) {
 		if (!this.ctx?.settings) return {};
 		const perNodeRaw = (await this.nodeBindingsState.get().catch(() => ({})))[input.nodeId];
@@ -25234,12 +25876,17 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	}
 	async assignAudio(input) {
 		await this.ctx.settings?.writeDeviceStore(input.deviceId, { [AUDIO_NODE_SETTING]: input.nodeId });
+		if (!this.enabledAudioNodes.includes(input.nodeId)) this.ctx.logger.warn("audio pin stored but node is not in enabledAudioNodes — pin will not take effect until enabled", { tags: {
+			deviceId: input.deviceId,
+			nodeId: input.nodeId
+		} });
 		this.audioAssignments.delete(input.deviceId);
 		this.audioNodeByDevice.delete(input.deviceId);
 		this.ctx.logger.info("Audio node pinned", { tags: {
 			deviceId: input.deviceId,
 			nodeId: input.nodeId
 		} });
+		await this.reattachAudioForDevice(input.deviceId);
 		return { success: true };
 	}
 	async unassignAudio(input) {
@@ -25247,6 +25894,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.audioAssignments.delete(input.deviceId);
 		this.audioNodeByDevice.delete(input.deviceId);
 		this.ctx.logger.info("Audio node unpinned", { tags: { deviceId: input.deviceId } });
+		await this.reattachAudioForDevice(input.deviceId);
 		return { success: true };
 	}
 	async getAudioAssignment(input) {
@@ -25330,6 +25978,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			tags: { nodeId: input.agentNodeId },
 			meta: { maxCameras: input.maxCameras }
 		});
+		this.schedulePendingRetry();
 		return { success: true };
 	}
 	async getCameraSettings(input) {
@@ -25493,7 +26142,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const detectionNodeId = pipelineAssignment?.agentNodeId ?? null;
 		const decoderPinRaw = (api ? await this.ctx.settings?.readDeviceStore(deviceId).catch(() => ({})) ?? {} : {})["decoderNodeId"];
 		const decoderPinned = typeof decoderPinRaw === "string" && decoderPinRaw !== "auto";
-		const decoderNodeId = detectionNodeId ? await this.resolveDecoderNode(deviceId, detectionNodeId).catch(() => null) : null;
+		const advisoryDecoderNodeId = detectionNodeId ? await this.resolveDecoderNode(deviceId, detectionNodeId).catch(() => null) : null;
 		const audioAssignment = this.audioAssignments.get(deviceId) ?? null;
 		const audioNodeId = audioAssignment?.nodeId ?? null;
 		const audioPinned = audioAssignment?.pinned ?? false;
@@ -25502,11 +26151,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			decoder: decoderPinned,
 			audio: audioPinned
 		};
-		const reasons = {
-			detection: pipelineAssignment?.reason,
-			decoder: decoderPinned ? "manual" : "co-located",
-			audio: audioPinned ? "manual" : void 0
-		};
+		const detectionReason = pipelineAssignment !== null ? pipelineAssignment.reason : this.cameraConfigs.has(deviceId) ? `pending:${this.pendingReasons.get(deviceId) ?? "pending"}` : void 0;
+		const liveDecoder = { nodeId: null };
 		const allSlotsFetch = api ? api.streamBroker.listAllProfileSlots.query() : null;
 		const sourceFetch = api && allSlotsFetch ? this.boundedStage(allSlotsFetch.then((slots) => {
 			return { streams: slots.filter((s) => s.deviceId === deviceId).map((s) => ({
@@ -25537,17 +26183,19 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 					clients: await api.streamBroker.listClients.query({ brokerId: slot.brokerId }).catch(() => null)
 				};
 			})), api.streamBroker.getAllRtspEntries.query({}).catch(() => null)]);
+			const profileDetails = statsAndClients.map(({ slot, stats, clients }) => ({
+				profile: slot.profile,
+				status: slot.status,
+				codec: stats?.codec ?? slot.codec ?? "",
+				width: slot.resolution?.width ?? 0,
+				height: slot.resolution?.height ?? 0,
+				subscribers: clients?.encodedSubscribers ?? 0,
+				inFps: stats?.inputFps ?? 0,
+				outFps: stats?.decodeFps ?? 0
+			}));
+			for (const { stats } of statsAndClients) if (liveDecoder.nodeId === null && typeof stats?.decoderNodeId === "string") liveDecoder.nodeId = stats.decoderNodeId;
 			return {
-				profiles: statsAndClients.map(({ slot, stats, clients }) => ({
-					profile: slot.profile,
-					status: slot.status,
-					codec: stats?.codec ?? slot.codec ?? "",
-					width: slot.resolution?.width ?? 0,
-					height: slot.resolution?.height ?? 0,
-					subscribers: clients?.encodedSubscribers ?? 0,
-					inFps: stats?.inputFps ?? 0,
-					outFps: stats?.decodeFps ?? 0
-				})),
+				profiles: profileDetails,
 				webrtcSessions: statsAndClients.reduce((total, { clients }) => {
 					if (!clients) return total;
 					return total + clients.encoded.filter((c) => WEBRTC_KINDS.has(c.attribution.kind)).length;
@@ -25557,8 +26205,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				}) ?? false
 			};
 		}), STAGE_TIMEOUT_MS) : Promise.resolve(null);
-		const decoderFetch = decoderNodeId ? Promise.resolve({
-			nodeId: decoderNodeId,
+		const decoderFetch = advisoryDecoderNodeId ? Promise.resolve({
+			nodeId: advisoryDecoderNodeId,
 			formats: [],
 			sessionCount: 0,
 			shm: {
@@ -25626,6 +26274,13 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			detectionFetch,
 			recordingFetch
 		]);
+		const liveDecoderNodeId = brokerResult !== null ? liveDecoder.nodeId : null;
+		const decoderNodeId = liveDecoderNodeId ?? advisoryDecoderNodeId;
+		const reasons = {
+			detection: detectionReason,
+			decoder: decoderPinned ? "manual" : liveDecoderNodeId !== null ? "session" : decoderNodeId !== null ? "advisory" : void 0,
+			audio: audioPinned ? "manual" : void 0
+		};
 		return composeCameraStatus({
 			deviceId,
 			fetchedAt: Date.now(),
@@ -25981,7 +26636,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				id: "cluster",
 				title: "Cluster",
 				tab: "pipeline",
-				description: "Which cluster nodes are eligible to run the detection pipeline. Leave at least one node enabled — an empty list falls back to all online nodes so the pipeline never becomes completely unassignable.",
+				description: "Which cluster nodes are eligible to run the detection pipeline. Strict whitelist: an empty list disables dispatch everywhere. Fresh installs default to ['hub']. Video detection additionally requires the node to be frame-source capable (Enabled Decoder Nodes) until cross-node frame transport ships.",
 				fields: [
 					{
 						key: "enabledNodes",
@@ -26513,6 +27168,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.enabledDecoderNodes = rawEnabledDecoder === void 0 ? ["hub"] : Array.isArray(rawEnabledDecoder) ? rawEnabledDecoder.filter((v) => typeof v === "string" && !v.includes("/")) : ["hub"];
 		const rawEnabledAudio = config["enabledAudioNodes"];
 		this.enabledAudioNodes = rawEnabledAudio === void 0 ? ["hub"] : Array.isArray(rawEnabledAudio) ? rawEnabledAudio.filter((v) => typeof v === "string" && !v.includes("/")) : ["hub"];
+		this.schedulePendingRetry();
 	}
 	get api() {
 		return this.ctx.api ?? null;