@camstack/addon-pipeline-orchestrator 1.1.30 → 1.1.32

package/dist/index.mjs

@@ -4627,7 +4627,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-CZDdRBua.mjs
+//#region ../types/dist/sleep-Cc14_yxc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -4813,6 +4813,18 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineCameraUpdated"] = "pipeline.camera-updated";
 	/**
+	* The cluster camera-source OWNER changed (`clusterRoles.ingestNode`).
+	* Emitted by addon-pipeline-orchestrator whenever it (re)derives node
+	* capabilities — at boot, on agent online/offline, and on an ingest-node
+	* flip. Carries the resolved `ownerNodeId`. The stream-broker consumes it to
+	* keep its ingest-owner-gate decision current WITHOUT a per-`ensureBroker`
+	* cross-process `getIngestOwner` query (push the authority's decision instead
+	* of polling it on the hot path). Idempotent state — re-emitted on every
+	* topology change, so a dropped event self-heals on the next one (plus the
+	* broker's long backstop reconcile query).
+	*/
+	EventCategory["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
+	/**
 	* Periodic snapshot of per-node pipeline-runner load
 	* (`RunnerLocalLoad`). Emitted ~1Hz by every runner so UI dashboards
 	* subscribe instead of polling `pipelineRunner.getLocalLoad`.
@@ -7304,6 +7316,28 @@ var ModelFormatsSchema = object({
 	tflite: ModelFormatEntrySchema.optional(),
 	pt: ModelFormatEntrySchema.optional()
 });
+/**
+* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
+* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
+* grouped Family→Tier→Variant picker renders identically in the config UI and
+* in the pipeline/device steppers. The flat `id` stays the source of truth for
+* resolution/download/persistence; this is a presentation overlay resolved back
+* to an `id`.
+*/
+var ModelVariantGroupSchema = object({
+	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
+	family: string(),
+	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
+	tier: string(),
+	/** Quantization axis. Omit ⇒ the fp32 base build. */
+	precision: _enum(["fp32", "int8"]).optional(),
+	/**
+	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
+	* latency-optimized export (e.g. ReLU-activation / reduced-input variant)
+	* — the slot the future performance variants plug into.
+	*/
+	optimization: _enum(["standard", "fast"]).optional()
+});
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -7333,7 +7367,43 @@ var ModelCatalogEntrySchema = object({
 	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
 	* Downloaded into the same modelsDir alongside the model file.
 	*/
-	extraFiles: array(ModelExtraFileSchema).readonly().optional()
+	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	/**
+	* LEGACY entry — retained in the catalog so a persisted operator selection
+	* still RESOLVES (and can be re-activated), but hidden from the selectable
+	* model list and excluded from the auto format-default pick. Set on the
+	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
+	* the active lineup stays the coherent curated ladder without deleting a
+	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
+	* an explicit legacy id that has a build for the node's format.
+	*/
+	legacy: boolean().optional(),
+	/**
+	* Measured quality/latency metadata — populated from the benchmark addon on
+	* the real node classes. Absent = not yet measured (most entries today; the
+	* catalog historically carried only `sizeMB`, a poor cross-architecture
+	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	*/
+	metrics: object({
+		map50: number().optional(),
+		p95LatencyMs: record(string(), number()).optional()
+	}).optional(),
+	/**
+	* SPDX-ish license id of the model weights (e.g. `AGPL-3.0` for Ultralytics
+	* YOLO26, `GPL-3.0` for YOLOv9, `Apache-2.0` for D-FINE/RF-DETR). Matters for
+	* the retraining addon and any future commercial distribution.
+	*/
+	license: string().optional(),
+	/**
+	* Variant-selector grouping. The UI groups models by `family` + `tier` and
+	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
+	* of a family's sizes and quantizations collapse into one grouped picker
+	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
+	* (legacy / custom models) — never shown in the grouped selector. The flat
+	* `id` stays the source of truth for resolution/download/persistence; grouping
+	* is a presentation overlay resolved back to an `id`.
+	*/
+	group: ModelVariantGroupSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -7394,8 +7464,8 @@ var RecordingModeSchema = _enum([
 	"onAudioThreshold"
 ]);
 /**
-* First-class, authoritative per-camera storage mode — the netta choice the UI
-* reads directly (never inferred from `rules`):
+* First-class, authoritative per-camera storage mode — the explicit choice the
+* UI reads directly (never inferred from `rules`):
 *  - `off`        — not recording.
 *  - `events`     — record only around triggers (motion / audio threshold),
 *                   with pre/post-buffer.
@@ -9104,26 +9174,13 @@ DeviceType.Light, method(object({
 	percentage: number().min(0).max(100),
 	lastChangedAt: number()
 });
+/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
 	"hls",
 	"mjpeg",
 	"rtsp"
 ]);
-var StreamInfoSchema = object({
-	streamId: string(),
-	format: StreamFormatSchema,
-	url: string().nullable(),
-	active: boolean()
-});
-method(object({
-	streamId: string(),
-	sourceUrl: string(),
-	codec: string().optional()
-}), _void(), { kind: "mutation" }), method(object({ streamId: string() }), _void(), { kind: "mutation" }), method(object({
-	streamId: string(),
-	format: StreamFormatSchema
-}), string().nullable()), method(_void(), array(StreamInfoSchema));
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -9788,7 +9845,7 @@ var ConsumablesStatusSchema = object({
 	})),
 	lastChangedAt: number()
 });
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, method(object({
+Object.values(DeviceType), method(object({
 	deviceId: number().int().nonnegative(),
 	key: string().min(1)
 }), _void(), {
@@ -10838,7 +10895,6 @@ var PipelineDefaultStepSchema = lazy(() => object({
 	enabled: boolean(),
 	modelId: string(),
 	children: array(PipelineDefaultStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema.optional(),
 	group: string().optional(),
 	settings: record(string(), unknown()).optional()
 }));
@@ -10863,7 +10919,9 @@ var PipelineModelOptionSchema = object({
 	formats: record(string(), object({
 		downloaded: boolean(),
 		sizeMB: number()
-	}))
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -10914,15 +10972,42 @@ var EngineProvisioningSchema = object({
 	]),
 	progress: number().optional(),
 	error: string().optional(),
-	nextRetryAt: number().optional()
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
 });
 var PipelineStepInputSchema = lazy(() => object({
 	addonId: string(),
-	modelId: string(),
+	modelId: string().optional(),
 	enabled: boolean().default(true),
 	children: array(PipelineStepInputSchema).optional(),
 	settings: record(string(), unknown()).optional()
 }));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum(["unknown-addon", "no-format-build"]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
 var ReferenceImageEntrySchema = object({
 	filename: string(),
 	stepIds: array(string()).readonly().optional()
@@ -11039,6 +11124,19 @@ var pipelineExecutorCapability = {
 		getGlobalSteps: method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()),
 		getGlobalPipelineConfig: method(_void(), PipelineConfigBridge),
 		getOrchestratorConfigSchema: method(_void(), ConfigUISchemaBridge),
+		/**
+		* Gate B (pre-init config-correctness gate). PURE COMPUTE against this
+		* node's `currentEngine.format` — resolves `steps` the same way the
+		* runtime dispatch path would, and reports what WOULD happen without
+		* touching any node-global state. Called by the orchestrator at attach
+		* time (`attachOn`), node-pinned to the TARGET node, so config problems
+		* surface BEFORE `pipelineRunner.attachCamera` rather than at the first
+		* per-frame resolve. `ok` is false iff `issues` is non-empty (both
+		* `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
+		* is informational (a degraded-but-loadable model swap) and never
+		* affects `ok`. Never throws.
+		*/
+		validatePipeline: method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
 		listTemplates: method(_void(), array(PipelineTemplateSchema$1).readonly()),
 		saveTemplate: method(object({
 			name: string(),
@@ -11421,6 +11519,13 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	kind: literal("remote-restream"),
 	/** The camera's source-owner node (slice 1: always the hub). */
 	ownerNodeId: string(),
+	/**
+	* The owner's LAN-reachable host, resolved by the orchestrator from the
+	* per-node `reachableHost` override (Cluster UI). When present the runner
+	* dials THIS host for the owner's restream, in preference to the
+	* `CAMSTACK_HUB_URL`-derived default. Absent → auto-detect fallback.
+	*/
+	ownerReachableHost: string().optional(),
 	/** Operator override for the owner host the runner dials. */
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
@@ -11429,13 +11534,11 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 * specific runner instance via `attachCamera`. Carries everything the
 * runner needs to subscribe to the local broker and execute inference.
 *
-* Stateless-pipeline model: the full pipeline content (`engine`, `steps`,
-* optional `audio`) travels with the attach payload. The runner keeps it
-* in RAM for the lifetime of the attach — on rebalance, edit, or
-* restart the orchestrator re-sends the latest snapshot.
-*
-* `engine`/`steps`/`audio` are optional during the additive migration
-* window; once orchestrator + UI are migrated they become required.
+* Stateless-pipeline model: the pipeline content (`steps`, optional
+* `audio`) travels with the attach payload. The runner keeps it in RAM
+* for the lifetime of the attach — on rebalance, edit, or restart the
+* orchestrator re-sends the latest snapshot. Engine is NOT carried: it is
+* node-local, resolved by the executing runner at dispatch time.
 */
 var RunnerCameraConfigSchema = object({
 	deviceId: number(),
@@ -11486,14 +11589,11 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	pipelineEnabled: boolean().default(true),
-	/** Engine choice for video steps (runtime+backend+format). */
-	engine: PipelineEngineChoiceSchema.optional(),
 	/** Ordered tree of video steps. Absent → runner skips video detection. */
 	steps: array(PipelineStepInputSchema).readonly().optional(),
 	/** Audio classification branch. `enabled:false` disables, null skips. */
 	audio: object({
-		engine: PipelineEngineChoiceSchema,
-		modelId: string(),
+		modelId: string().optional(),
 		enabled: boolean()
 	}).nullable().optional(),
 	/**
@@ -15949,11 +16049,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	timestamp: number()
 });
 var CameraPipelineConfigSchema = object({
-	engine: PipelineEngineChoiceSchema,
+	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
 	audio: object({
-		engine: PipelineEngineChoiceSchema,
-		modelId: string(),
+		engine: PipelineEngineChoiceSchema.optional(),
+		modelId: string().optional(),
 		enabled: boolean(),
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
@@ -15968,7 +16068,7 @@ var PipelineTemplateSchema = object({
 });
 var AgentAddonConfigSchema = object({
 	enabled: boolean(),
-	modelId: string(),
+	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly()
 });
 var AgentPipelineSettingsSchema = object({
@@ -15983,7 +16083,15 @@ var AgentPipelineSettingsSchema = object({
 	/** Node is eligible to run audio-analyzer sessions. */
 	audio: boolean().optional(),
 	/** Node is eligible to be the ingest / source-owner (serve the restream). */
-	ingest: boolean().optional()
+	ingest: boolean().optional(),
+	/**
+	* Operator override for the LAN host a cross-node decoder dials to reach
+	* THIS node's restream (Cluster UI). Absent → auto-detect: a remote runner
+	* falls back to its `CAMSTACK_HUB_URL`-derived host (the Moleculer address
+	* it already uses to reach the hub). Set this only when the auto-detected
+	* address is wrong (multi-homed host, NAT, custom interface).
+	*/
+	reachableHost: string().optional()
 });
 var CameraPipelineForAgentSchema = object({
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -16089,6 +16197,15 @@ var GlobalMetricsSchema = object({
 * capability providers.
 */
 var CapabilityBindingsSchema = record(string(), string());
+/**
+* The cluster's single camera-source owner (`clusterRoles.ingestNode`) plus
+* its LAN-reachable host, if one is registered. See `getIngestOwner`.
+*/
+var IngestOwnerSchema = object({
+	ownerNodeId: string(),
+	reachableHost: string().optional(),
+	configIssue: string().optional()
+});
 /** Source block — always present; derives from the stream catalog. */
 var CameraSourceStatusSchema = object({ streams: array(object({
 	camStreamId: string(),
@@ -16103,6 +16220,14 @@ var CameraAssignmentStatusSchema = object({
 	detectionNodeId: string().nullable(),
 	decoderNodeId: string().nullable(),
 	audioNodeId: string().nullable(),
+	/**
+	* The node that OWNS this camera's physical source pull (dials the RTSP and
+	* hosts the broker/restream) — the cluster ingest owner today
+	* (`clusterRoles.ingestNode`), per-camera once source assignment lands. Lets
+	* the UI show WHERE a camera is sourced without SSH/logs, and is the node the
+	* broker block below was read from (pinned). Nullable only pre-wiring.
+	*/
+	sourceNodeId: string().nullable(),
 	pinned: object({
 		detection: boolean(),
 		decoder: boolean(),
@@ -16303,6 +16428,14 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* The cluster's single camera-source owner — resolved UNCONDITIONALLY
+		* from `clusterRoles.ingestNode` (NOT the detection-decode
+		* `remoteSourcingNodes` knob). Consumers (recorder/snapshot/audio) pin
+		* their broker calls to `ownerNodeId` and dial `reachableHost` when
+		* present. Defaults to `{ ownerNodeId: 'hub' }`.
+		*/
+		getIngestOwner: method(_void(), IngestOwnerSchema),
 		/** Pin a device's decoder to a specific node. */
 		assignDecoder: method(object({
 			deviceId: number(),
@@ -16449,6 +16582,22 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Set (or clear) the operator override for the LAN host a cross-node
+		* decoder dials to reach this node's restream. Pass a non-empty string to
+		* override the auto-detected address (the runner's `CAMSTACK_HUB_URL`
+		* default); pass `null` or an empty string to clear it and revert to
+		* auto-detect. Applied on the next dispatch cycle — takes effect for new
+		* cross-node attaches; existing attaches keep their current host until
+		* re-dispatched.
+		*/
+		setAgentReachableHost: method(object({
+			agentNodeId: string(),
+			reachableHost: string().nullable()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read one camera's settings. Null when never touched (inherits agent defaults fully). */
 		getCameraSettings: method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()),
 		/** Set or clear the 3-state toggle for one (camera, addonId). Pass `enabled: null` to clear and revert to agent default. */
@@ -16540,22 +16689,6 @@ var pipelineOrchestratorCapability = {
 		})
 	}
 };
-var RegisteredStreamSchema = object({
-	streamId: string(),
-	label: string().optional(),
-	codec: string(),
-	type: _enum(["video", "audio"]),
-	sourceUrl: string()
-});
-var ExposedResourceSchema = object({
-	streamId: string(),
-	format: string(),
-	value: string()
-});
-method(object({
-	deviceId: number(),
-	streams: array(RegisteredStreamSchema).readonly()
-}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(ExposedResourceSchema).readonly());
 /**
 * Query filter for settings-store collections.
 */
@@ -16708,9 +16841,9 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
 *
-* Shared with the `snapshot-provider` collection cap — the orchestrator
-* receives the same shape from each native provider and from the
-* broker-based fallback.
+* The `SnapshotAddon` wrapper returns this shape whether the frame came from
+* the device-native provider (onboard capture) or from the stream-broker
+* prebuffer fallback.
 */
 var SnapshotImageSchema = object({
 	base64: string(),
@@ -16742,10 +16875,6 @@ DeviceType.Camera, method(object({
 	kind: "mutation",
 	auth: "admin"
 });
-method(object({ deviceId: number() }), boolean()), method(object({
-	deviceId: number(),
-	streamId: string().optional()
-}), SnapshotImageSchema.nullable());
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
 * providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
@@ -17106,9 +17235,10 @@ method(object({
 	auth: "admin"
 });
 /**
-* Optional client-side hints sent at session creation to help the
-* provider pick the best native source. All fields are optional —
-* a viewer that knows nothing still gets a sane default.
+* Optional client-side hints sent at session creation to help the provider
+* pick the best native source. All fields optional — a viewer that knows
+* nothing still gets a sane default. (Relocated from the retired `webrtc`
+* collection cap; this `webrtc-session` cap is the live signaling surface.)
 */
 var webrtcClientHintsSchema = object({
 	viewportWidth: number().int().positive().optional(),
@@ -17119,22 +17249,6 @@ var webrtcClientHintsSchema = object({
 	/** Hard tier override; takes precedence over scoring when registered. */
 	prefersTier: string().optional()
 }).partial();
-method(object({
-	streamId: string(),
-	sdpOffer: string()
-}), string(), { kind: "mutation" }), method(object({ streamId: string() }), boolean()), method(object({
-	streamId: string(),
-	codec: string()
-}), _void(), { kind: "mutation" }), method(object({ streamId: string() }), _void(), { kind: "mutation" }), method(object({
-	streamId: string(),
-	hints: webrtcClientHintsSchema.optional()
-}), object({
-	sessionId: string(),
-	sdpOffer: string()
-}), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	sdpAnswer: string()
-}), _void(), { kind: "mutation" }), method(object({ sessionId: string() }), _void(), { kind: "mutation" }), method(object({ streamId: string() }), boolean());
 /**
 * Discriminated target for a WebRTC session. The client sends this
 * structured object instead of building / parsing brokerId strings;
@@ -22225,6 +22339,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineExecutor.validatePipeline": {
+		capName: "pipeline-executor",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.assignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22333,6 +22453,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getIngestOwner": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getPipelineAssignment": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22405,6 +22531,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setAgentReachableHost": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraPipelineForAgent": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22735,24 +22867,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"restreamer.getExposedResources": {
-		capName: "restreamer",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"restreamer.registerDevice": {
-		capName: "restreamer",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"restreamer.unregisterDevice": {
-		capName: "restreamer",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"scriptRunner.run": {
 		capName: "script-runner",
 		capScope: "device",
@@ -22855,18 +22969,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"snapshotProvider.getSnapshot": {
-		capName: "snapshot-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"snapshotProvider.supportsDevice": {
-		capName: "snapshot-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"ssoBridge.signBridgeToken": {
 		capName: "sso-bridge",
 		capScope: "system",
@@ -23293,30 +23395,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamingEngine.getStreamUrl": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"streamingEngine.listStreams": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"streamingEngine.registerStream": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"streamingEngine.unregisterStream": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"streamParams.getConfigSchema": {
 		capName: "stream-params",
 		capScope: "device",
@@ -23683,54 +23761,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"webrtc.closeSession": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.createSession": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.handleAnswer": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.handleOffer": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.hasAdaptiveBitrate": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"webrtc.registerStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.supportsStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"webrtc.unregisterStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"webrtcSession.addIceCandidate": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -23893,18 +23923,21 @@ function applyStepPatch(base, patch) {
 /**
 * Seed an agent's addonDefaults map from the catalog. For each addonId
 * advertised by any slot, populate a sensible entry:
-*   - `modelId` = addon's `defaultModelIdByFormat[engine.format]` if
-*     present, else `defaultModelId` (from StepDefinition).
 *   - `enabled` = addon's `enabledByDefault` (absent = true).
 *   - `settings` = catalog's default settings (empty for now — the
 *     runtime applies step-level defaults when settings[key] is absent).
 *
+* `modelId` is intentionally ABSENT on a fresh entry — model selection is
+* data only now. When the operator hasn't explicitly chosen a model, the
+* step carries no `modelId` and the executing NODE resolves its own
+* format default at runtime (the resolver has no notion of engines).
+*
 * Entries already present in `current` are LEFT ALONE — operators who
 * customised a model keep their choice after catalog growth adds new
 * addons. Entries for addonIds that no longer exist in the catalog are
 * dropped (the addon was removed; its config is dead weight).
 */
-function seedAgentAddonDefaults(current, engine, catalog) {
+function seedAgentAddonDefaults(current, catalog) {
 	const next = {};
 	const liveAddonIds = /* @__PURE__ */ new Set();
 	for (const slot of catalog.slots) for (const addon of slot.addons) {
@@ -23915,7 +23948,6 @@ function seedAgentAddonDefaults(current, engine, catalog) {
 		}
 		next[addon.id] = {
 			enabled: addon.enabledByDefault ?? true,
-			modelId: pickDefaultModelId(addon, engine.format),
 			settings: {}
 		};
 	}
@@ -23923,27 +23955,11 @@ function seedAgentAddonDefaults(current, engine, catalog) {
 	return next;
 }
 /**
-* Pick the best model ID for `(addon, agent.format)`:
-*   1. `defaultModelIdByFormat[agent.format]` — explicit per-format choice
-*   2. `defaultModelId` from the StepDefinition — format-agnostic default
-*   3. First model in `addon.models[]` that has `formats[agent.format]` — desperate fallback
-*
-* Returns the first candidate whose model exists in the catalog entry's
-* `formats` map for the target engine format. If no candidate matches,
-* falls through to `addon.defaultModelId` (even if incompatible — let
-* the runtime error explicitly rather than silently substitute).
-*/
-function pickDefaultModelId(addon, format) {
-	const byFormat = addon.defaultModelIdByFormat?.[format];
-	if (byFormat && addon.models.some((m) => m.id === byFormat)) return byFormat;
-	if (addon.models.some((m) => m.id === addon.defaultModelId && m.formats?.[format])) return addon.defaultModelId;
-	const compat = addon.models.find((m) => m.formats?.[format]);
-	if (compat) return compat.id;
-	return addon.defaultModelId;
-}
-/**
 * Main resolver — produces the `CameraPipelineConfig` the runner should
 * receive for `(deviceId, agent)`. Pure: zero I/O, zero side effects.
+* DATA ONLY: this resolver has no notion of engines. A step carries a
+* `modelId` only when the operator explicitly chose one; when absent,
+* the executing node resolves its own format default at runtime.
 *
 * Step chain:
 *   1. `cameraSettings.pipelineByAgent[agentNodeId]` → wholesale override
@@ -23951,16 +23967,14 @@ function pickDefaultModelId(addon, format) {
 *
 * "Inference disabled for this camera" is NOT handled here — the caller
 * (resolvePipelineForDevice) consults the detection-pipeline binding and
-* short-circuits to `emptyPipeline(engine)` before calling this resolver.
+* short-circuits to an empty pipeline before calling this resolver.
 */
-function resolvePipeline(agentSettings, cameraSettings, agentNodeId, engine, catalog) {
+function resolvePipeline(agentSettings, cameraSettings, agentNodeId, catalog) {
 	const cam = cameraSettings ?? {};
 	const wholesale = cam.pipelineByAgent?.[agentNodeId];
 	if (wholesale) return {
-		engine,
 		steps: wholesale.steps,
 		audio: wholesale.audio ? {
-			engine,
 			modelId: wholesale.audio.modelId,
 			enabled: wholesale.audio.enabled
 		} : null
@@ -23982,11 +23996,9 @@ function resolvePipeline(agentSettings, cameraSettings, agentNodeId, engine, cat
 	for (const [addonId, override] of Object.entries(toggles)) {
 		if (override !== true) continue;
 		if (addonDefaults[addonId]) continue;
-		const catalogAddon = findInCatalog(catalog, addonId);
-		if (!catalogAddon) continue;
+		if (!findInCatalog(catalog, addonId)) continue;
 		const patched = applyStepPatch({
 			enabled: true,
-			modelId: pickDefaultModelId(catalogAddon, engine.format),
 			settings: {}
 		}, overridesForAgent[addonId]);
 		if (!patched.enabled) continue;
@@ -24004,10 +24016,8 @@ function resolvePipeline(agentSettings, cameraSettings, agentNodeId, engine, cat
 		else videoAddons.push(entry);
 	}
 	return {
-		engine,
 		steps: buildTreeFromAddons(videoAddons, catalog),
 		audio: audioAddons.length > 0 ? {
-			engine,
 			modelId: audioAddons[0].cfg.modelId,
 			enabled: true,
 			...Object.keys(audioAddons[0].cfg.settings).length > 0 ? { settings: audioAddons[0].cfg.settings } : {}
@@ -24045,9 +24055,9 @@ function buildTreeFromAddons(enabled, catalog) {
 		metaById.set(addonId, meta);
 		nodes.set(addonId, {
 			addonId,
-			modelId: cfg.modelId,
 			enabled: true,
 			children: [],
+			...cfg.modelId ? { modelId: cfg.modelId } : {},
 			...Object.keys(cfg.settings).length > 0 ? { settings: cfg.settings } : {}
 		});
 	}
@@ -24155,7 +24165,7 @@ function startAudioChunkPoller(options) {
 		const subId = lifecycle.activeSubscriptionId;
 		if (subId) {
 			lifecycle.activeSubscriptionId = null;
-			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }).catch((err) => {
+			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
 				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
 					brokerId: options.brokerId,
 					subscriptionId: subId,
@@ -24173,7 +24183,8 @@ function startAudioChunkPoller(options) {
 * been started) or once `lifecycle.stopped` flips, whichever comes first.
 */
 async function subscribeWithRetry(options, lifecycle) {
-	const { api, brokerId, tag, logger } = options;
+	const { api, brokerId, tag, ownerNodeId, logger } = options;
+	const pin = nodePin(ownerNodeId);
 	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
 	let attempt = 0;
 	while (!lifecycle.stopped) {
@@ -24182,9 +24193,9 @@ async function subscribeWithRetry(options, lifecycle) {
 			const result = await api.streamBroker.subscribeAudioChunks.mutate({
 				brokerId,
 				tag
-			});
+			}, pin);
 			if (lifecycle.stopped) {
-				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }).catch((err) => {
+				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }, pin).catch((err) => {
 					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
 						brokerId,
 						subscriptionId: result.subscriptionId,
@@ -24228,14 +24239,15 @@ async function subscribeWithRetry(options, lifecycle) {
 * disowned.
 */
 function startPolling(options, lifecycle) {
-	const { api, brokerId, tag, onChunk, logger } = options;
+	const { api, brokerId, tag, ownerNodeId, onChunk, logger } = options;
+	const pin = nodePin(ownerNodeId);
 	let consecutiveFailures = 0;
 	const resubscribe = async () => {
 		try {
 			const result = await api.streamBroker.subscribeAudioChunks.mutate({
 				brokerId,
 				tag
-			});
+			}, pin);
 			lifecycle.activeSubscriptionId = result.subscriptionId;
 			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
 				brokerId,
@@ -24256,7 +24268,7 @@ function startPolling(options, lifecycle) {
 			const chunks = await api.streamBroker.pullAudioChunks.query({
 				subscriptionId: subId,
 				maxCount: PULL_MAX_COUNT
-			});
+			}, pin);
 			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
 				brokerId,
 				subscriptionId: subId
@@ -24321,6 +24333,7 @@ function mapAssignment(input) {
 		detectionNodeId: input.detectionNodeId,
 		decoderNodeId: input.decoderNodeId,
 		audioNodeId: input.audioNodeId,
+		sourceNodeId: input.sourceNodeId,
 		pinned: {
 			detection: input.pinned.detection,
 			decoder: input.pinned.decoder,
@@ -24494,14 +24507,58 @@ function computeFrameSourceNodes(input) {
 	return enabledDecoderNodes.filter((nodeId) => nodeId === sourceOwnerNodeId || remote.includes(nodeId));
 }
 //#endregion
+//#region src/ingest-owner.ts
+/**
+* The cluster's single camera-source owner + its LAN-reachable host, resolved
+* UNCONDITIONALLY from `clusterRoles.ingestNode` (NOT `resolveSourceOwner`,
+* which is gated on the detection-decode `remoteSourcingNodes` knob). Consumers
+* (recorder/snapshot/audio) pin their broker calls to `ownerNodeId` and dial
+* `reachableHost`. Defaults to `{ ownerNodeId: 'hub' }` — byte-identical to
+* today's hub-only behavior.
+*
+* `configIssue` is a NON-FATAL guard: when the configured ingest owner is an
+* agent that's unreachable or not ingest-capable, it surfaces a human-readable
+* warning string. The hub is always assumed reachable and ingest-capable, so
+* `ownerNodeId === 'hub'` never produces a `configIssue`.
+*/
+function resolveIngestOwner(clusterRoles, reachableHostByNode, ingestCapableNodes) {
+	const ownerNodeId = clusterRoles.ingestNode;
+	const reachableHost = reachableHostByNode.get(ownerNodeId);
+	const configIssue = computeIngestConfigIssue(ownerNodeId, reachableHost, ingestCapableNodes);
+	return {
+		ownerNodeId,
+		...reachableHost !== void 0 ? { reachableHost } : {},
+		...configIssue !== void 0 ? { configIssue } : {}
+	};
+}
+function computeIngestConfigIssue(ownerNodeId, reachableHost, ingestCapableNodes) {
+	if (ownerNodeId === "hub") return void 0;
+	if (reachableHost === void 0) return `ingest node '${ownerNodeId}' has no reachable host — set its reachableHost or cameras cannot be sourced from it`;
+	if (!ingestCapableNodes.includes(ownerNodeId)) return `ingest node '${ownerNodeId}' is not ingest-capable — enable its ingest capability`;
+}
+//#endregion
 //#region src/source-owner.ts
 /**
+* The set of nodes allowed to run the REMOTE-SOURCE leg — every decode-enabled
+* node EXCEPT the camera-source OWNER (the node that dials the camera). Derived
+* from `enabledDecoderNodes`. When the owner is the hub this equals the old
+* hub-exclusion (byte-identical to Phase 1); when the owner is an agent the hub
+* itself becomes a valid remote-source target.
+*
+* Rollout-safe: when the owner is the only decode node the result is `[]`, which
+* keeps `resolveSourceOwner` unmodeled and every frame source `local-broker`.
+* Pure: preserves input order, never mutates.
+*/
+function deriveRemoteSourcingNodes(enabledDecoderNodes, ownerNodeId) {
+	return enabledDecoderNodes.filter((nodeId) => nodeId !== ownerNodeId);
+}
+/**
 * The node that owns a camera's source pull (dials the real RTSP, hosts its
 * broker), or `undefined` while ownership is unmodeled (rollout OFF).
 */
 function resolveSourceOwner(input) {
 	if (input.remoteSourcingNodes.length === 0) return void 0;
-	return input.assignedOwner ?? input.hubNodeId;
+	return input.assignedOwner ?? input.ownerNodeId;
 }
 /**
 * The `frameSource` the attach payload carries for a target node:
@@ -24516,13 +24573,14 @@ function resolveSourceOwner(input) {
 * degrade to the safe local path, never to an unauthorized cross-node pull.
 */
 function selectRunnerFrameSource(input) {
-	const { targetNodeId, sourceOwnerNodeId, remoteSourcingNodes, hubHostnameOverride } = input;
+	const { targetNodeId, sourceOwnerNodeId, remoteSourcingNodes, ownerReachableHost, hubHostnameOverride } = input;
 	if (sourceOwnerNodeId === void 0) return { kind: "local-broker" };
 	if (targetNodeId === sourceOwnerNodeId) return { kind: "local-broker" };
 	if (!remoteSourcingNodes.includes(targetNodeId)) return { kind: "local-broker" };
 	return {
 		kind: "remote-restream",
 		ownerNodeId: sourceOwnerNodeId,
+		...ownerReachableHost !== void 0 ? { ownerReachableHost } : {},
 		...hubHostnameOverride !== void 0 ? { hubHostnameOverride } : {}
 	};
 }
@@ -24530,16 +24588,29 @@ function selectRunnerFrameSource(input) {
 //#region src/load-balancer.ts
 /**
 * Compute the L2 capacity score for a runner node. Lower is better.
-* The score is a weighted sum of the runner's active workload so the balancer
-* prefers agents that are serving fewer cameras OR draining queues quickly.
 *
-* Rationale:
-*  - `attachedCameras * avgInferenceFps` approximates the total inference rate
-*    the agent is currently sustaining (not just how many cameras are assigned).
-*  - `queueDepthTotal` penalises agents that are falling behind the frame feed.
+* The score is **committed standing load + real-time backpressure**:
+*
+*  - `attachedCameras` — the primary signal. Every attached camera is a
+*    standing commitment: an `on-motion` camera costs ≈ zero while idle but
+*    WILL fork a decode+inference session on its node the moment motion fires.
+*    Counting *attachments* (not current inference activity) is what makes the
+*    balancer honest about steady-state load and gives the per-node `weights`
+*    sliders camera-count-share semantics.
+*  - `queueDepthTotal` — real-time pressure: a node whose frame queues are
+*    backing up is falling behind NOW and must be deprioritised beyond its
+*    camera count.
+*
+* The previous formula multiplied `attachedCameras * avgInferenceFps`, which
+* scored a node carrying many IDLE on-motion cameras (fps 0) identically to an
+* empty node — the balancer then piled unpinned cameras onto an already-loaded
+* node until `maxCameras` bit. `avgInferenceFps` (in practice a mislabeled SUM
+* of per-camera fps) is deliberately dropped: transient inference activity is
+* not steady-state load, and a genuinely overloaded node surfaces through
+* `queueDepthTotal` instead.
 */
 function computeCapacityScore(load) {
-	return load.attachedCameras * Math.max(load.avgInferenceFps, 0) + Math.max(load.queueDepthTotal, 0);
+	return Math.max(load.attachedCameras, 0) + Math.max(load.queueDepthTotal, 0);
 }
 /**
 * Node detection weight, defaulting to 1 when absent/invalid. A higher weight
@@ -24559,6 +24630,18 @@ function weightedScore(load, weights) {
 	return computeCapacityScore(load) / nodeWeight(load.nodeId, weights);
 }
 /**
+* Weighted-score improvement of moving one camera off `current` onto `target`
+* (both weight-adjusted). Positive = `target` is less loaded than `current`.
+*
+* Used by the auto-rebalance hysteresis: a migration is applied only when this
+* clears a margin (> 1), so equalizing a mere 1-camera gap — which would just
+* reverse the imbalance — is skipped and a periodic pass never churns an
+* already-balanced cluster.
+*/
+function capacityImprovement(current, target, weights) {
+	return weightedScore(current, weights) - weightedScore(target, weights);
+}
+/**
 * Returns true when the node has remaining capacity.
 * A node is eligible iff `cap` is unlimited (null/absent/<=0) OR
 * its `attachedCameras` count is strictly less than the cap.
@@ -24703,11 +24786,11 @@ var EngineChoiceSchema = object({
 });
 var NodeBindingsSchema = record(string(), record(string(), string()));
 var StoredPipelineConfigSchema = object({
-	engine: EngineChoiceSchema,
+	engine: EngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
 	audio: object({
-		engine: EngineChoiceSchema,
-		modelId: string(),
+		engine: EngineChoiceSchema.optional(),
+		modelId: string().optional(),
 		enabled: boolean(),
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
@@ -24723,7 +24806,7 @@ var StoredPipelineTemplateSchema = object({
 var TemplatesSchema = record(string(), StoredPipelineTemplateSchema);
 var StoredAgentAddonConfigSchema = object({
 	enabled: boolean(),
-	modelId: string(),
+	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly()
 });
 var StoredAgentPipelineSettingsSchema = object({
@@ -24733,7 +24816,8 @@ var StoredAgentPipelineSettingsSchema = object({
 	detect: boolean().optional(),
 	decode: boolean().optional(),
 	audio: boolean().optional(),
-	ingest: boolean().optional()
+	ingest: boolean().optional(),
+	reachableHost: string().optional()
 });
 var AgentSettingsMapSchema = record(string(), StoredAgentPipelineSettingsSchema);
 var StoredCameraStepOverridePatchSchema = object({
@@ -24744,7 +24828,7 @@ var StoredCameraStepOverridePatchSchema = object({
 var StoredCameraPipelineForAgentSchema = object({
 	steps: array(PipelineStepInputSchema).readonly(),
 	audio: object({
-		modelId: string(),
+		modelId: string().optional(),
 		enabled: boolean()
 	}).nullable()
 });
@@ -24826,8 +24910,8 @@ var PipelineWatchdog = class {
 		const now = this.deps.now();
 		for (const cam of this.cameras.values()) {
 			const { line, stalled, recoveries } = this.evaluate(cam, now);
-			if (stalled) this.deps.logger.warn(line);
-			else this.deps.logger.info(line);
+			if (stalled) this.deps.logger.warn(line, { tags: { deviceId: cam.deviceId } });
+			else this.deps.logger.info(line, { tags: { deviceId: cam.deviceId } });
 			for (const r of recoveries) {
 				const rt = this.state.get(cam.deviceId)?.get(r.stage);
 				if (rt) {
@@ -25266,6 +25350,21 @@ var PENDING_RETRY_INTERVAL_MS = 6e4;
 /** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
 var PENDING_RETRY_DEBOUNCE_MS = 2e3;
 /**
+* Periodic auto-rebalance sweep. New attaches are already load-balanced at
+* dispatch time; this corrects DRIFT that accumulates over time (uneven
+* detach, a node returning online, a weight change) so the steady-state
+* distribution tracks the per-node weights. Only runs with ≥2 enabled detect
+* nodes, and migrates under hysteresis so a balanced cluster is a no-op.
+*/
+var AUTO_REBALANCE_INTERVAL_MS = 6e4;
+/**
+* Hysteresis margin (weight-adjusted cameras) for the periodic auto-rebalance:
+* migrate a camera only when its target node is at least this much less loaded
+* than its current node. > 1 so equalizing a single-camera gap (which would
+* only reverse the imbalance) is skipped — prevents periodic churn.
+*/
+var AUTO_REBALANCE_MIN_IMPROVEMENT = 1.5;
+/**
 * Remote-assignment health loop (T7) bounded backoff. A remote camera flagged
 * as unhealthy (0-fps / metrics-stale) is re-placed at most
 * `REMOTE_HEALTH_MAX_ATTEMPTS` times inside a rolling `REMOTE_HEALTH_WINDOW_MS`
@@ -25303,6 +25402,7 @@ var OrchestratorDiagnosticsSchema = object({
 	enabledNodes: array(string()),
 	enabledDecoderNodes: array(string()),
 	enabledAudioNodes: array(string()),
+	enabledIngestNodes: array(string()),
 	clusterRoles: object({
 		ingestNode: string(),
 		audioNode: string()
@@ -25448,21 +25548,38 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	enabledDecoderNodes = ["hub"];
 	/**
 	* Nodes allowed to run the REMOTE-SOURCE leg — dial a camera's source-owner
-	* restream over the LAN and decode it locally. Held for the source-owner
-	* plumbing (`source-owner.ts`) but currently ALWAYS EMPTY: the cross-node
-	* frame transport is a separate activation phase (placement-model §9 P1).
-	* With this empty, `resolveSourceOwner` returns `undefined` and every
-	* `selectRunnerFrameSource` emits `local-broker` — bit-identical to
-	* pre-Phase-2 behavior.
+	* restream over the LAN and decode it locally. DERIVED (Phase-1 activation,
+	* `deriveRemoteSourcingNodes`) from `enabledDecoderNodes` minus the hub, in
+	* `refreshNodeCapabilities`: every decode-enabled AGENT is a remote-sourcing
+	* node. When only the hub decodes this stays `[]`, so `resolveSourceOwner`
+	* returns `undefined` and every `selectRunnerFrameSource` emits
+	* `local-broker` — bit-identical to pre-activation (rollout-safe).
 	*/
 	remoteSourcingNodes = [];
 	/**
+	* Per-node `reachableHost` override (the LAN host a cross-node decoder dials
+	* to reach that node's restream), from `agentSettings[node].reachableHost`.
+	* DERIVED alongside the enabled-node sets in {@link refreshNodeCapabilities}
+	* so `attachOn` resolves the owner host synchronously (no per-attach durable
+	* read). Absent entry → the runner auto-detects via `CAMSTACK_HUB_URL`.
+	*/
+	reachableHostByNode = /* @__PURE__ */ new Map();
+	/**
 	* Hub-wide allow-list of node ids eligible to run audio-analyzer sessions.
 	* DERIVED from the per-node capability store (`agentSettings[node].audio`).
 	* Defaults to `['hub']`.
 	*/
 	enabledAudioNodes = ["hub"];
 	/**
+	* Hub-wide allow-list of node ids eligible to run the INGEST leg (dial the
+	* camera's real source, host its broker). DERIVED from the per-node
+	* capability store (`agentSettings[node].ingest`), mirroring
+	* `enabledAudioNodes`. Defaults to `['hub']`. Not yet consumed by any
+	* placement logic — this field only makes the persisted `ingest` flag
+	* readable for a later config guard.
+	*/
+	enabledIngestNodes = ["hub"];
+	/**
 	* Cluster-wide singleton role assignments (placement-model §6). Each role
 	* is the ONE node that serves it for every camera. Driven by the
 	* `ingestNode` / `audioNode` node-selects in the addon global schema;
@@ -25570,6 +25687,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	pendingRetryInFlight = false;
 	/** Set when a pending-retry is requested while one is already in-flight; triggers a follow-up pass. */
 	pendingRetryRerunRequested = false;
+	/** Periodic auto-rebalance sweep timer (drift correction under hysteresis). */
+	autoRebalanceTimer = null;
+	/** True while an auto-rebalance pass is running (skip overlap). */
+	autoRebalanceInFlight = false;
 	initTimestamp = 0;
 	constructor() {
 		super({});
@@ -25672,7 +25793,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			if (!isEvent(event, EventCategory.PipelineInferenceResult)) return;
 			this.handleInferenceResult(event.data).catch((err) => {
 				const msg = errMsg(err);
-				this.ctx.logger.error("PipelineInferenceResult post-processing failed", { meta: { error: msg } });
+				this.ctx.logger.error("PipelineInferenceResult post-processing failed", {
+					tags: { deviceId: event.data.deviceId },
+					meta: { error: msg }
+				});
 			});
 		});
 		const PROFILE_SLOTS_DEBOUNCE_MS = 200;
@@ -25788,6 +25912,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		});
 		this.pipelineWatchdog.start(PipelineOrchestratorAddon.WATCHDOG_INTERVAL_MS);
 		this.pendingRetryTimer = setInterval(() => void this.retryPendingDispatches(), PENDING_RETRY_INTERVAL_MS);
+		this.autoRebalanceTimer = setInterval(() => void this.runAutoRebalance(), AUTO_REBALANCE_INTERVAL_MS);
 		this.ctx.logger.info("Pipeline orchestrator detection-wiring subscriptions installed");
 		this.migrateLegacyFlagsToBindings().catch((err) => {
 			this.ctxIfReady?.logger.warn("bindings migration failed — will retry on next boot", { meta: { error: errMsg(err) } });
@@ -25998,6 +26123,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			enabledNodes: [...this.enabledNodes],
 			enabledDecoderNodes: [...this.enabledDecoderNodes],
 			enabledAudioNodes: [...this.enabledAudioNodes],
+			enabledIngestNodes: [...this.enabledIngestNodes],
 			clusterRoles: { ...this.clusterRoles },
 			assignedDeviceCount: this.assignments.size,
 			cameraConfigCount: this.cameraConfigs.size,
@@ -26023,6 +26149,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			clearTimeout(this.pendingRetryDebounceTimer);
 			this.pendingRetryDebounceTimer = null;
 		}
+		if (this.autoRebalanceTimer !== null) {
+			clearInterval(this.autoRebalanceTimer);
+			this.autoRebalanceTimer = null;
+		}
 		for (const t of this.slotReadRetryTimers.values()) clearTimeout(t);
 		this.slotReadRetryTimers.clear();
 		this.slotReadRetryAttempts.clear();
@@ -26288,8 +26418,30 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.assignments.delete(input.deviceId);
 		return { success: true };
 	}
-	async rebalance() {
+	/**
+	* Periodic auto-rebalance tick. Corrects placement drift toward the per-node
+	* weights without operator action. Guards: never overlaps itself; skips when
+	* fewer than two nodes can run detection (a hub-only cluster has nothing to
+	* balance); migrates under {@link AUTO_REBALANCE_MIN_IMPROVEMENT} hysteresis
+	* so a balanced cluster is a no-op. Errors are swallowed (best-effort net).
+	*/
+	async runAutoRebalance() {
+		if (!this.ctxIfReady) return;
+		if (this.autoRebalanceInFlight) return;
+		if (this.enabledNodes.length < 2) return;
+		this.autoRebalanceInFlight = true;
+		try {
+			const { migrated } = await this.rebalance({ minImprovement: AUTO_REBALANCE_MIN_IMPROVEMENT });
+			if (migrated > 0) this.ctx.logger.info("auto-rebalance: corrected placement drift", { meta: { migrated } });
+		} catch (err) {
+			this.ctx.logger.debug("auto-rebalance pass failed", { meta: { error: errMsg(err) } });
+		} finally {
+			this.autoRebalanceInFlight = false;
+		}
+	}
+	async rebalance(opts) {
 		if (!this.ctx) throw new Error("PipelineOrchestrator: rebalance called before initialize");
+		const minImprovement = Math.max(opts?.minImprovement ?? 0, 0);
 		const loads = await this.collectAgentLoad({ onlyEnabled: true });
 		const nodeCaps = await this.buildNodeCaps();
 		const nodeWeights = await this.buildNodeWeights();
@@ -26327,6 +26479,12 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				continue;
 			}
 			if (current && current.agentNodeId === decision.agentNodeId) continue;
+			if (current && minImprovement > 0) {
+				const tallied = talliedLoads();
+				const currentLoad = tallied.find((l) => l.nodeId === current.agentNodeId);
+				const targetLoad = tallied.find((l) => l.nodeId === decision.agentNodeId);
+				if (currentLoad && targetLoad && capacityImprovement(currentLoad, targetLoad, nodeWeights) < minImprovement) continue;
+			}
 			if (current) {
 				await this.detachOn(current.agentNodeId, deviceId).catch((err) => {
 					const msg = errMsg(err);
@@ -26337,7 +26495,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				});
 				bumpAttached(current.agentNodeId, -1);
 			}
-			await this.attachOn(decision.agentNodeId, config);
+			const reResolved = await this.resolvePipelineForDevice(deviceId, decision.agentNodeId);
+			const targetConfig = reResolved.steps.length > 0 ? {
+				...config,
+				steps: reResolved.steps,
+				audio: reResolved.audio ?? null
+			} : config;
+			this.cameraConfigs.set(deviceId, targetConfig);
+			await this.attachOn(decision.agentNodeId, targetConfig);
 			bumpAttached(decision.agentNodeId, 1);
 			this.recordAssignment(deviceId, decision.agentNodeId, "rebalance", false);
 			migrated++;
@@ -26436,11 +26601,37 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async attachOn(nodeId, config) {
 		const api = this.ctx.api;
 		if (!api) throw new Error(`attachOn(${nodeId}, ${config.deviceId}): this.ctx.api not available`);
+		const sourceOwnerNodeId = this.sourceOwner(config.deviceId);
+		const ownerReachableHost = sourceOwnerNodeId !== void 0 ? this.reachableHostByNode.get(sourceOwnerNodeId) : void 0;
 		const frameSource = selectRunnerFrameSource({
 			targetNodeId: nodeId,
-			sourceOwnerNodeId: this.sourceOwner(config.deviceId),
-			remoteSourcingNodes: this.remoteSourcingNodes
+			sourceOwnerNodeId,
+			remoteSourcingNodes: this.remoteSourcingNodes,
+			...ownerReachableHost !== void 0 ? { ownerReachableHost } : {}
 		});
+		api.pipelineExecutor.validatePipeline.query({ steps: [...config.steps ?? []] }, nodePin(nodeId)).then((validation) => {
+			if (!validation || validation.ok && validation.substitutions.length === 0) return;
+			const logMeta = {
+				nodeId,
+				deviceId: config.deviceId,
+				issues: validation.issues,
+				substitutions: validation.substitutions
+			};
+			if (!validation.ok) this.ctx.logger.warn("attachOn: pre-init pipeline validation found issues", {
+				tags: {
+					nodeId,
+					deviceId: config.deviceId
+				},
+				meta: logMeta
+			});
+			else this.ctx.logger.info("attachOn: pre-init pipeline validation found model substitutions", {
+				tags: {
+					nodeId,
+					deviceId: config.deviceId
+				},
+				meta: logMeta
+			});
+		}).catch(() => {});
 		try {
 			await api.pipelineRunner.attachCamera.mutate({
 				...config,
@@ -26455,7 +26646,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 					audioMode: config.audioMode,
 					motionStreamId: config.motionStreamId,
 					detectionStreamId: config.detectionStreamId,
-					hasEngine: !!config.engine,
 					stepsCount: config.steps?.length ?? null,
 					hasAudio: config.audio?.enabled ?? null
 				};
@@ -26560,18 +26750,31 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.clusterRoles.ingestNode;
 	}
 	/**
+	* Cap surface: the cluster's single camera-source owner + its
+	* LAN-reachable host, resolved UNCONDITIONALLY from `clusterRoles.ingestNode`
+	* (NOT `resolveSourceOwner`/`sourceOwner`, which are gated on the
+	* detection-decode `remoteSourcingNodes` rollout knob). Consumers
+	* (recorder/snapshot/audio) call this to pin their broker calls to the
+	* owner and dial `reachableHost`. Rollout-safe: defaults to
+	* `{ ownerNodeId: 'hub' }` — byte-identical to today's hub-only behavior.
+	*/
+	async getIngestOwner() {
+		return resolveIngestOwner(this.clusterRoles, this.reachableHostByNode, this.enabledIngestNodes);
+	}
+	/**
 	* The node that owns `deviceId`'s source pull, or `undefined` while
 	* ownership is UNMODELED — which is exactly the rollout-OFF state: with the
 	* `remoteSourcingNodes` knob empty (the default), `resolveSourceOwner`
 	* returns `undefined`, `computeFrameSourceNodes` collapses to the global
 	* `enabledDecoderNodes`, and `selectRunnerFrameSource` emits `local-broker`
 	* for every target — bit-identical to pre-Phase-2 behavior. Populating the
-	* knob models ownership (`assignSource`, slice 1: the hub) and thereby
-	* turns eligibility per-camera and the remote-source leg dispatchable.
+	* knob (a decode node other than the ingest owner exists) models ownership as
+	* `clusterRoles.ingestNode` and thereby turns eligibility per-camera and the
+	* remote-source leg dispatchable.
 	*/
 	sourceOwner(deviceId) {
 		return resolveSourceOwner({
-			hubNodeId: this.localNodeId,
+			ownerNodeId: this.clusterRoles.ingestNode,
 			remoteSourcingNodes: this.remoteSourcingNodes,
 			...deviceId !== void 0 ? { assignedOwner: this.assignSource(deviceId) } : {}
 		});
@@ -26684,7 +26887,9 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* lookup. Works for any backend (ffmpeg / node-av / future) and no longer
 	* returns empty on a node-av-only node (the old `decoder-ffmpeg`-keyed read
 	* did). Returns `null` when the value is empty/unset, `undefined` on a read
-	* failure (keep the last known). Mirrors {@link readDetectionPipelineEngine}.
+	* failure (keep the last known). Node-local — the same pattern the
+	* orchestrator's (now-deleted) per-node engine reader used before engine
+	* resolution moved entirely off the orchestrator.
 	*/
 	async readNodeDecodeHwaccel(nodeId) {
 		try {
@@ -27160,7 +27365,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				if (resolved.steps.length === 0) continue;
 				const next = {
 					...cached,
-					engine: resolved.engine,
 					steps: resolved.steps,
 					audio: resolved.audio ?? null
 				};
@@ -27230,7 +27434,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			if (resolved.steps.length === 0) continue;
 			const next = {
 				...cached,
-				engine: resolved.engine,
 				steps: resolved.steps,
 				audio: resolved.audio ?? null
 			};
@@ -27790,6 +27993,33 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.schedulePendingRetry();
 		return { success: true };
 	}
+	/**
+	* Set (or clear) the per-node `reachableHost` override — the LAN host a
+	* cross-node decoder dials to reach this node's restream. A non-empty string
+	* overrides the auto-detected host the runner would otherwise derive from
+	* `CAMSTACK_HUB_URL`; `null` or an empty string clears it (revert to
+	* auto-detect). Persisted onto the node's `agentSettings` entry, then a
+	* debounced re-dispatch so new cross-node attaches pick up the host.
+	*/
+	async setAgentReachableHost(input) {
+		const existing = (await this.readAgentSettingsMap())[input.agentNodeId];
+		const trimmed = input.reachableHost?.trim();
+		const host = trimmed !== void 0 && trimmed.length > 0 ? trimmed : void 0;
+		const next = {
+			...existing ?? {
+				addonDefaults: {},
+				maxCameras: null
+			},
+			reachableHost: host
+		};
+		await this.writeAgentSettings(input.agentNodeId, next);
+		this.ctx.logger.info("agentSettings.reachableHost updated", {
+			tags: { nodeId: input.agentNodeId },
+			meta: { reachableHost: host ?? null }
+		});
+		this.schedulePendingRetry();
+		return { success: true };
+	}
 	async getCameraSettings(input) {
 		return (await this.readCameraSettingsMap())[String(input.deviceId)] ?? null;
 	}
@@ -27873,6 +28103,25 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		});
 		for (const deviceId of affected) await this.emitResolvedCameraUpdated(deviceId);
 	}
+	/**
+	* Re-dispatch EVERY assigned camera through the REAL attach path
+	* (`redispatchSingleCamera` → `attachOn`), so each camera's `frameSource`
+	* (`local-broker` vs `remote-restream` naming the current ingest owner) is
+	* RECOMPUTED and re-applied to its runner. Used when the cluster ingest owner
+	* changes: `frameSource` is computed only in `attachOn` (the single choke
+	* point), so a plain `emitCameraUpdated` config event would NOT move the
+	* source — the runner would keep sourcing from the OLD owner. No-op when
+	* nothing is assigned.
+	*/
+	async redispatchAllActiveCameras(reason) {
+		const deviceIds = [...this.assignments.keys()];
+		if (deviceIds.length === 0) return;
+		this.ctx.logger.info("re-dispatching all cameras", { meta: {
+			reason,
+			count: deviceIds.length
+		} });
+		for (const deviceId of deviceIds) await this.redispatchSingleCamera(deviceId);
+	}
 	async listTemplates() {
 		const templates = await this.readTemplatesMap();
 		return Object.values(templates).slice().toSorted((a, b) => a.name.localeCompare(b.name));
@@ -27949,6 +28198,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const STAGE_TIMEOUT_MS = 3e3;
 		const pipelineAssignment = this.assignments.get(deviceId) ?? null;
 		const detectionNodeId = pipelineAssignment?.agentNodeId ?? null;
+		const sourceNodeId = this.assignSource(deviceId);
 		const decoderPinRaw = (api ? await this.ctx.settings?.readDeviceStore(deviceId).catch(() => ({})) ?? {} : {})["decoderNodeId"];
 		const decoderPinned = typeof decoderPinRaw === "string" && decoderPinRaw !== "auto";
 		const advisoryDecoderNodeId = detectionNodeId ? await this.resolveDecoderNode(deviceId, detectionNodeId).catch(() => null) : null;
@@ -27962,7 +28212,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		};
 		const detectionReason = pipelineAssignment !== null ? pipelineAssignment.reason : this.cameraConfigs.has(deviceId) ? `pending:${this.pendingReasons.get(deviceId) ?? "pending"}` : void 0;
 		const liveDecoder = { nodeId: null };
-		const allSlotsFetch = api ? api.streamBroker.listAllProfileSlots.query() : null;
+		const allSlotsFetch = api ? api.streamBroker.listAllProfileSlots.query(void 0, nodePin(sourceNodeId)) : null;
 		const sourceFetch = api && allSlotsFetch ? this.boundedStage(allSlotsFetch.then((slots) => {
 			return { streams: slots.filter((s) => s.deviceId === deviceId).map((s) => ({
 				camStreamId: s.sourceCamStreamId ?? s.brokerId,
@@ -27988,10 +28238,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			const [statsAndClients, rtspEntry] = await Promise.all([Promise.all(deviceSlots.map(async (slot) => {
 				return {
 					slot,
-					stats: await api.streamBroker.getBrokerStats.query({ brokerId: slot.brokerId }).catch(() => null),
-					clients: await api.streamBroker.listClients.query({ brokerId: slot.brokerId }).catch(() => null)
+					stats: await api.streamBroker.getBrokerStats.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null),
+					clients: await api.streamBroker.listClients.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null)
 				};
-			})), api.streamBroker.getAllRtspEntries.query({}).catch(() => null)]);
+			})), api.streamBroker.getAllRtspEntries.query({}, nodePin(sourceNodeId)).catch(() => null)]);
 			const profileDetails = statsAndClients.map(({ slot, stats, clients }) => ({
 				profile: slot.profile,
 				status: slot.status,
@@ -28096,6 +28346,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			detectionNodeId,
 			decoderNodeId,
 			audioNodeId,
+			sourceNodeId,
 			pinned,
 			reasons,
 			sourceResult,
@@ -28173,14 +28424,19 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	}
 	/**
 	* Fetch `pipelineExecutor.getSchema({nodeId})` through the standard cap
-	* router, cached per `(nodeId, engineKey)` with a short TTL. Returns
-	* `null` when the executor can't be reached (no runner yet attached)
-	* — callers fall back to an empty pipeline in that case.
+	* router, cached per node with a short TTL. Returns `null` when the
+	* executor can't be reached (no runner yet attached) — callers fall
+	* back to an empty pipeline in that case.
+	*
+	* The cache key keeps the `${nodeId}::*` suffix (rather than a bare
+	* `nodeId`) so `handleDetectionPipelineReadiness`'s prefix-match
+	* invalidation (`key.startsWith(\`${nodeId}::\`)`) keeps working
+	* unchanged; there is no longer a per-engine variant to distinguish.
 	*/
-	async getCatalogForAgent(nodeId, engine) {
+	async getCatalogForAgent(nodeId) {
 		const api = this.ctx.api;
 		if (!api) return null;
-		const engineKey = engine ? `${nodeId}::${engine.runtime}/${engine.backend}/${engine.format}` : `${nodeId}::*`;
+		const engineKey = `${nodeId}::*`;
 		const now = Date.now();
 		const hit = this.catalogCache.get(engineKey);
 		if (hit && now - hit.at < PipelineOrchestratorAddon.CATALOG_CACHE_TTL_MS) return hit.schema;
@@ -28206,11 +28462,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	*
 	* Behaviour:
 	*   - Fetch catalog for the node.
-	*   - Call `seedAgentAddonDefaults(current.addonDefaults, engine, catalog)` — preserves
+	*   - Call `seedAgentAddonDefaults(current.addonDefaults, catalog)` — preserves
 	*     operator customisations, adds missing addons, drops orphans.
 	*   - Persist if anything changed.
 	*
-	* Idempotent: a second call with the same catalog is a no-op.
+	* Idempotent: a second call with the same catalog is a no-op. Data
+	* only: no engine is resolved or stored here — the executing node
+	* picks its own format default at runtime when a step's `modelId` is
+	* absent.
 	*/
 	async seedAgentSettingsFromCatalog(nodeId) {
 		await this.ctx.acquireCapability("pipeline-executor", {
@@ -28220,71 +28479,28 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const catalog = await this.getCatalogForAgent(nodeId);
 		if (!catalog) return null;
 		const existing = (await this.readAgentSettingsMap())[nodeId];
-		const engine = await this.readDetectionPipelineEngine(nodeId) ?? catalog.selectedEngine;
-		const nextAddonDefaults = seedAgentAddonDefaults(existing?.addonDefaults ?? {}, engine, catalog);
+		const nextAddonDefaults = seedAgentAddonDefaults(existing?.addonDefaults ?? {}, catalog);
 		const next = { addonDefaults: nextAddonDefaults };
 		if (!existing || JSON.stringify(existing.addonDefaults) !== JSON.stringify(next.addonDefaults)) {
 			await this.writeAgentSettings(nodeId, next);
 			this.ctx.logger.info("agentSettings seeded/refreshed", {
 				tags: { nodeId },
-				meta: {
-					runtime: engine.runtime,
-					backend: engine.backend,
-					format: engine.format,
-					addons: Object.keys(nextAddonDefaults).length
-				}
+				meta: { addons: Object.keys(nextAddonDefaults).length }
 			});
 		}
 		return next;
 	}
 	/**
-	* Fetch the engine triple (`runtime/backend/device`) from the
-	* `detection-pipeline` addon's global settings on the target node.
-	* This is the authoritative engine source since phase 2f. Returns
-	* `null` when the addon hasn't responded yet or doesn't expose the
-	* fields — callers fall back to `catalog.selectedEngine`.
-	*/
-	async readDetectionPipelineEngine(agentNodeId) {
-		const api = this.ctx.api;
-		if (!api?.addonSettings) return null;
-		try {
-			const schema = await api.addonSettings.getGlobalSettings.query({
-				addonId: "detection-pipeline",
-				nodeId: agentNodeId
-			});
-			if (!schema) return null;
-			const leaf = (key) => {
-				for (const s of schema.sections) for (const f of s.fields) if (f.key === key) return f.value;
-			};
-			const runtime = leaf("engineRuntime");
-			const backend = leaf("engineBackend");
-			const device = leaf("engineDevice");
-			if (runtime !== "python" && runtime !== "node" || typeof backend !== "string" || backend.length === 0) return null;
-			const base = {
-				runtime,
-				backend,
-				format: backend === "coreml" ? "coreml" : backend === "openvino" ? "openvino" : "onnx"
-			};
-			if (typeof device === "string" && device.length > 0) return {
-				...base,
-				device
-			};
-			return base;
-		} catch (err) {
-			this.ctx.logger.debug("readDetectionPipelineEngine failed — falling back", {
-				tags: { nodeId: agentNodeId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return null;
-		}
-	}
-	/**
 	* Resolve the pipeline for a device. NEVER returns an empty/fallback
 	* config: if the catalog or agent settings aren't available yet, this
 	* blocks (with backoff) until the detection-pipeline cap is registered
 	* and a non-null catalog comes back. Cameras must never be dispatched
-	* with `engine=node/cpu, steps=[]` because the runner then attaches
-	* the camera with no steps and silently never recovers.
+	* with `steps=[]` because the runner then attaches the camera with no
+	* steps and silently never recovers.
+	*
+	* Data only: the returned config never carries an engine — model
+	* selection is data only, and the executing node resolves its own
+	* format default at runtime when a step's `modelId` is absent.
 	*
 	* Two legitimate exceptions to "never empty":
 	*   1. The device's `detection-pipeline` binding is INACTIVE — the
@@ -28298,39 +28514,29 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async resolvePipelineForDevice(deviceId, agentNodeIdOverride) {
 		const agentNodeId = agentNodeIdOverride ?? this.assignments.get(deviceId)?.agentNodeId ?? this.localNodeId;
 		if (!await this.isDetectionPipelineActive(deviceId)) {
-			const engine = await this.waitForEngine(agentNodeId);
 			this.ctx.logger.info("resolvePipelineForDevice → empty (binding inactive)", {
 				tags: {
 					deviceId,
 					nodeId: agentNodeId
 				},
-				meta: {
-					reason: "detection-pipeline binding inactive",
-					engine: `${engine.runtime}/${engine.backend}`
-				}
+				meta: { reason: "detection-pipeline binding inactive" }
 			});
 			return {
-				engine,
 				steps: [],
 				audio: null
 			};
 		}
 		const cam = (await this.readCameraSettingsMap())[String(deviceId)] ?? null;
 		const wholesale = cam?.pipelineByAgent?.[agentNodeId];
-		if (wholesale) {
-			const engine = await this.waitForEngine(agentNodeId);
-			return {
-				engine,
-				steps: wholesale.steps,
-				audio: wholesale.audio ? {
-					engine,
-					modelId: wholesale.audio.modelId,
-					enabled: wholesale.audio.enabled
-				} : null
-			};
-		}
-		const { agent, catalog, engine } = await this.waitForAgentAndCatalog(agentNodeId);
-		const resolved = resolvePipeline(agent, cam, agentNodeId, engine, catalog);
+		if (wholesale) return {
+			steps: wholesale.steps,
+			audio: wholesale.audio ? {
+				modelId: wholesale.audio.modelId,
+				enabled: wholesale.audio.enabled
+			} : null
+		};
+		const { agent, catalog } = await this.waitForAgentAndCatalog(agentNodeId);
+		const resolved = resolvePipeline(agent, cam, agentNodeId, catalog);
 		if (resolved.steps.length === 0) this.ctx.logger.info("resolvePipelineForDevice → empty (all addons disabled)", {
 			tags: {
 				deviceId,
@@ -28378,51 +28584,27 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				await sleep$1(2e3);
 				continue;
 			}
-			const engine = await this.readDetectionPipelineEngine(nodeId) ?? catalog.selectedEngine;
 			return {
 				agent,
-				catalog,
-				engine
+				catalog
 			};
 		}
 	}
 	/**
-	* Block until a real engine choice is available. `acquireCapability`
-	* defaults to infinite wait; the post-acquire loop only handles the
-	* propagation gap where the cap is `ready` but the derived calls
-	* still return null for a tick.
-	*/
-	async waitForEngine(nodeId) {
-		await this.ctx.acquireCapability("pipeline-executor", {
-			type: "node",
-			nodeId
-		});
-		while (true) {
-			const fromAddon = await this.readDetectionPipelineEngine(nodeId);
-			if (fromAddon) return fromAddon;
-			const catalog = await this.getCatalogForAgent(nodeId);
-			if (catalog?.selectedEngine) return catalog.selectedEngine;
-			await sleep$1(2e3);
-		}
-	}
-	/**
 	* Structural runtime check for `CameraPipelineConfig`. Persisted JSON
 	* may be stale or partial across upgrades, so we gate reads on shape
 	* rather than trusting the raw object. False = silently ignore that
 	* entry and fall back to defaults — the orchestrator's job is to
 	* never crash on corrupt store state.
+	*
+	* Data only: `engine` is no longer required — a persisted config may
+	* still carry a vestigial `engine` from before the data-only refactor;
+	* it is simply ignored.
 	*/
 	isCameraPipelineConfig(value) {
 		if (!value || typeof value !== "object") return false;
 		const v = value;
-		const engine = v["engine"];
-		if (!engine || typeof engine !== "object") return false;
-		const e = engine;
-		if (typeof e["runtime"] !== "string") return false;
-		if (typeof e["backend"] !== "string") return false;
-		if (typeof e["format"] !== "string") return false;
-		if (!Array.isArray(v["steps"])) return false;
-		return true;
+		return Array.isArray(v["steps"]);
 	}
 	isPipelineTemplate(value) {
 		if (!value || typeof value !== "object") return false;
@@ -28774,10 +28956,21 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		] });
 	}
 	async updateGlobalSettings(patch) {
+		const previousIngestNode = this.clusterRoles.ingestNode;
 		await super.updateGlobalSettings(patch);
 		const full = await this.resolveGlobalStore();
 		this.globalSettings = { ...full };
 		this.applyRuntimeSettings(full);
+		if (this.clusterRoles.ingestNode !== previousIngestNode) {
+			const { configIssue } = resolveIngestOwner(this.clusterRoles, this.reachableHostByNode, this.enabledIngestNodes);
+			if (configIssue !== void 0) this.ctx.logger.warn("ingest node config issue", { meta: {
+				ingestNode: this.clusterRoles.ingestNode,
+				issue: configIssue
+			} });
+			this.refreshNodeCapabilities().then(() => this.redispatchAllActiveCameras("ingest-owner-changed")).catch((err) => {
+				this.ctx.logger.warn("ingest-owner-changed re-dispatch failed", { meta: { error: errMsg(err) } });
+			});
+		}
 		const pausedIds = [...this.loadShedState.entries()].filter(([, s]) => s.pausedAt !== null).map(([id]) => id);
 		if (pausedIds.length > 0) {
 			this.loadShedState.clear();
@@ -28946,7 +29139,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async applyPipelinePatch(deviceId, pipelinePatch) {
 		const incoming = pipelinePatch.cameraPipeline;
 		if (incoming === void 0) return;
-		if (!this.isCameraPipelineConfig(incoming)) throw new Error(`applyPipelinePatch: cameraPipeline value for device ${deviceId} is not a valid CameraPipelineConfig (expected { engine:{runtime,backend,format}, steps:[], audio?:null|object })`);
+		if (!this.isCameraPipelineConfig(incoming)) throw new Error(`applyPipelinePatch: cameraPipeline value for device ${deviceId} is not a valid CameraPipelineConfig (expected { steps:[], audio?:null|object })`);
 		const agentNodeId = this.assignments.get(deviceId)?.agentNodeId ?? this.localNodeId;
 		await this.setCameraPipelineForAgent({
 			deviceId,
@@ -29002,12 +29195,13 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	}
 	/**
 	* Recompute the derived enabled-node sets (`enabledNodes` /
-	* `enabledDecoderNodes` / `enabledAudioNodes`) from the per-node capability
-	* store. A node is eligible for a concern iff its stored flag is `true`, or
-	* the flag is unset AND the node defaults capable ({@link nodeCapabilityDefault}).
-	* Forked child nodeIds (`hub/classifier`) are never dispatchable and are
-	* excluded. `hub` is always considered even when absent from the store, so a
-	* fresh install keeps the hub-only cluster working.
+	* `enabledDecoderNodes` / `enabledAudioNodes` / `enabledIngestNodes`) from
+	* the per-node capability store. A node is eligible for a concern iff its
+	* stored flag is `true`, or the flag is unset AND the node defaults capable
+	* ({@link nodeCapabilityDefault}). Forked child nodeIds (`hub/classifier`)
+	* are never dispatchable and are excluded. `hub` is always considered even
+	* when absent from the store, so a fresh install keeps the hub-only cluster
+	* working.
 	*/
 	async refreshNodeCapabilities() {
 		let blob = {};
@@ -29021,16 +29215,30 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const detect = [];
 		const decode = [];
 		const audio = [];
+		const ingest = [];
+		const reachableHosts = /* @__PURE__ */ new Map();
 		const capable = (flag, nodeId) => typeof flag === "boolean" ? flag : PipelineOrchestratorAddon.nodeCapabilityDefault(nodeId);
 		for (const nodeId of nodeIds) {
 			const settings = blob[nodeId];
 			if (capable(settings?.detect, nodeId)) detect.push(nodeId);
 			if (capable(settings?.decode, nodeId)) decode.push(nodeId);
 			if (capable(settings?.audio, nodeId)) audio.push(nodeId);
+			if (capable(settings?.ingest, nodeId)) ingest.push(nodeId);
+			const host = settings?.reachableHost?.trim();
+			if (host !== void 0 && host.length > 0) reachableHosts.set(nodeId, host);
 		}
+		this.reachableHostByNode = reachableHosts;
 		this.enabledNodes = detect.toSorted();
 		this.enabledDecoderNodes = decode.toSorted();
 		this.enabledAudioNodes = audio.toSorted();
+		this.enabledIngestNodes = ingest.toSorted();
+		this.remoteSourcingNodes = deriveRemoteSourcingNodes(this.enabledDecoderNodes, this.clusterRoles.ingestNode);
+		const { ownerNodeId } = resolveIngestOwner(this.clusterRoles, this.reachableHostByNode, this.enabledIngestNodes);
+		this.ctx.eventBus.emit(createEvent(EventCategory.PipelineIngestOwnerChanged, {
+			type: "addon",
+			id: this.ctx.id,
+			nodeId: "hub"
+		}, { ownerNodeId }));
 	}
 	get api() {
 		return this.ctx.api ?? null;
@@ -29329,6 +29537,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			await this.stopDetection(deviceId);
 		}
 		this.activeDetections.set(deviceId, config);
+		const hydrateNodeId = this.assignments.get(deviceId)?.agentNodeId ?? this.localNodeId;
 		const pipelineConfig = await this.resolvePipelineForDevice(deviceId);
 		const zones = await this.zonesProvider?.listZones({ deviceId }) ?? [];
 		const runnerConfig = {
@@ -29340,7 +29549,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			detectionStreamId: config.detectionStreamId,
 			motionSources: config.motionSources,
 			pipelineEnabled: config.pipelineEnabled,
-			engine: pipelineConfig.engine,
 			steps: pipelineConfig.steps,
 			audio: pipelineConfig.audio ?? null,
 			zones,
@@ -29359,15 +29567,20 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			const msg = errMsg(err);
 			log.error("dispatchCamera failed", { meta: { error: msg } });
 		}
-		if (dispatchedNodeId && (runnerConfig.steps?.length ?? 0) === 0) try {
+		if (dispatchedNodeId && (dispatchedNodeId !== hydrateNodeId || (runnerConfig.steps?.length ?? 0) === 0)) try {
 			const corrected = await this.resolvePipelineForDevice(deviceId, dispatchedNodeId);
-			if (corrected.steps.length > 0) {
-				const correctedConfig = {
-					...runnerConfig,
-					engine: corrected.engine,
-					steps: corrected.steps,
-					audio: corrected.audio ?? null
-				};
+			const correctedConfig = {
+				...runnerConfig,
+				steps: corrected.steps,
+				audio: corrected.audio ?? null
+			};
+			if (JSON.stringify({
+				steps: runnerConfig.steps,
+				audio: runnerConfig.audio ?? null
+			}) !== JSON.stringify({
+				steps: correctedConfig.steps,
+				audio: correctedConfig.audio
+			})) {
 				await this.attachOn(dispatchedNodeId, correctedConfig);
 				this.cameraConfigs.set(deviceId, correctedConfig);
 				log.info("startDetection: pipeline re-resolved after agent assignment", {
@@ -29568,7 +29781,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		}
 		const nextConfig = {
 			...cached,
-			engine: config.engine,
 			steps: config.steps,
 			audio: config.audio ?? null
 		};
@@ -30060,6 +30272,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			api,
 			brokerId: audioBrokerId,
 			tag: "audio-analyzer",
+			ownerNodeId: this.clusterRoles.ingestNode,
 			logger: this.ctx.logger,
 			onChunk: async (chunk) => {
 				this.pipelineWatchdog?.noteSignal(deviceId, "audio");