@camstack/addon-pipeline-orchestrator 1.2.127 → 1.2.129

package/dist/index.mjs

@@ -8866,6 +8866,20 @@ var RelocateJobSchema = object({
 	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
 	*/
 	rowsReconciled: number().int().nonnegative().optional(),
+	/**
+	* Rows this run FORGOT because the file they name is not on disk.
+	*
+	* The mover derived the path from the row's own fields and `stat`ed it; an
+	* ENOENT there is a per-path confirmation that the segment is gone (D296),
+	* and the durable row is dropped through the same channel eviction uses. It
+	* is reported for the same reason `rowsReconciled` is: this is a durable
+	* mutation nobody asked for, and a migration that quietly erases hour rows is
+	* the same failure as one that quietly skips them (D295).
+	*
+	* The production drain of 2026-08-30 would have reported 11 074 here — the
+	* ledger claimed 5.65 GB of footage that no longer existed.
+	*/
+	rowsForgotten: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -9229,6 +9243,91 @@ var RelocateResidueSchema = object({
 	segments: number().int().nonnegative(),
 	bytes: number().int().nonnegative()
 }).nullable();
+/**
+* Ask one location whether its durable hour rows describe the disk — the walk
+* (D319).
+*
+* `apply` DEFAULTS TO FALSE and that default is the product: the operator's
+* missing tool is the question, and the dry run is how they sanity-check the
+* destructive run before authorising it.
+*/
+var LedgerWalkInputSchema = object({
+	locationId: string().min(1),
+	/** Forget the confirmed-absent rows, rather than only counting them. */
+	apply: boolean().optional(),
+	/** Narrow to one camera. */
+	deviceId: number().int().positive().optional(),
+	/** Narrow to these recording profiles; empty/absent = every profile. */
+	profiles: array(string().min(1)).optional()
+});
+/** Why a whole walk did nothing. Every one leaves the ledger untouched. */
+var LedgerWalkRefusalSchema = _enum([
+	"location-unknown",
+	"source-writable",
+	"no-ledger",
+	"archive-unreadable",
+	"anchor-absent",
+	"anchor-unreadable",
+	"anchor-moved"
+]);
+_enum([
+	"live-tail",
+	"listing-error",
+	"path-mismatch",
+	"durable-refused"
+]);
+/** Every skip reason, always present, always a number — so a reason that never
+*  fired reports as zero rather than absent and the report shape is constant
+*  between passes. Spelled out rather than `z.record` for exactly that. */
+var LedgerWalkSkipCountsSchema = object({
+	"live-tail": number().int().nonnegative(),
+	"listing-error": number().int().nonnegative(),
+	"path-mismatch": number().int().nonnegative(),
+	"durable-refused": number().int().nonnegative()
+});
+/** One camera's share of a walk, so a report names cameras and not rows. */
+var LedgerWalkDeviceReportSchema = object({
+	deviceId: number().int(),
+	hoursWalked: number().int().nonnegative(),
+	hoursMissing: number().int().nonnegative(),
+	ghostSegments: number().int().nonnegative(),
+	ghostBytes: number().int().nonnegative(),
+	forgottenSegments: number().int().nonnegative(),
+	orphanFiles: number().int().nonnegative()
+});
+/**
+* What one walk claimed, listed, found and (only when armed) forgot.
+*
+* `archiveSegments` is the **M** and `segmentsClaimed` the **N** (D295), so a
+* walk that saw a fraction of the location is visible in its own report rather
+* than in the absence of one.
+*/
+var LedgerWalkReportSchema = object({
+	locationId: string(),
+	applied: boolean(),
+	refused: LedgerWalkRefusalSchema.nullable(),
+	archiveSegments: number().int().nonnegative().nullable(),
+	archiveBytes: number().int().nonnegative().nullable(),
+	hoursClaimed: number().int().nonnegative(),
+	hoursWalked: number().int().nonnegative(),
+	hoursMissing: number().int().nonnegative(),
+	/** `readdir` calls issued — the cost, stated in the unit that is paid. */
+	listings: number().int().nonnegative(),
+	segmentsClaimed: number().int().nonnegative(),
+	ghostSegments: number().int().nonnegative(),
+	ghostBytes: number().int().nonnegative(),
+	ghostHoursWhole: number().int().nonnegative(),
+	forgottenSegments: number().int().nonnegative(),
+	forgottenBytes: number().int().nonnegative(),
+	/** Files under a claimed hour that no durable row names. Never deleted. */
+	orphanFiles: number().int().nonnegative(),
+	orphanSample: array(string()).readonly(),
+	hoursSkipped: number().int().nonnegative(),
+	skippedByReason: LedgerWalkSkipCountsSchema,
+	/** The walk stopped at its per-pass hour bound with claims unwalked. */
+	bounded: boolean(),
+	byDevice: array(LedgerWalkDeviceReportSchema).readonly()
+});
 /** How many rows a media pass would still act on against a given target — the
 *  media lane's denominator AND its residue, from ONE derivation so the two can
 *  never disagree. `null` = the count could not be taken. */
@@ -19805,13 +19904,15 @@ var ListGroupsPageSchema = object({
 	groups: array(AnalyticsGroupRecordSchema).readonly(),
 	nextCursor: string().nullable()
 });
+var KEY_EVENTS_DEFAULT_LIMIT = 50;
+var KEY_EVENTS_MAX_LIMIT = 200;
 var KeyEventQueryInput = object({
 	deviceId: number(),
 	/** Window lower bound (track firstSeen ≥ since). */
 	since: number(),
 	/** Window upper bound (track firstSeen ≤ until). */
 	until: number(),
-	limit: number().int().min(1).max(200).default(50),
+	limit: number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
 	/** Drop tracks scoring below this importance. */
 	minImportance: number().min(0).max(1).optional(),
 	/** Restrict to a single class (e.g. 'person'). */
@@ -19833,6 +19934,32 @@ var KeyEventSchema = object({
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
+/** `getKeyEvents`' window and filters, asked of a SET of cameras at once. */
+var KeyEventBatchQueryInput = object({
+	deviceIds: array(number()).min(1).max(200),
+	since: number(),
+	until: number(),
+	/** Applied PER CAMERA, exactly as `getKeyEvents.limit` is — never a total
+	*  across the set, which would let a busy camera starve a quiet one of its
+	*  rows and change what the merged feed contains. */
+	limit: number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
+	minImportance: number().min(0).max(1).optional(),
+	classFilter: string().optional()
+});
+/**
+* One camera's key events in a batch answer.
+*
+* The row exists for every requested id. `getKeyEvents` degrades to `[]` on
+* error rather than throwing, so a camera whose store read failed and one with
+* no events in the window were ALREADY indistinguishable per camera — the
+* batch does not make that worse, and the row keeps the deviceId the single
+* method's output never carried (the caller used to stamp it from the fan-out
+* key, which only worked because there was one query per camera).
+*/
+var KeyEventsForDeviceSchema = object({
+	deviceId: number(),
+	events: array(KeyEventSchema).readonly()
+});
 object({
 	trackId: string(),
 	className: string(),
@@ -19904,6 +20031,50 @@ var EventStoreFootprintSchema = object({
 	totalBytes: number().int(),
 	devices: array(EventStoreDeviceFootprintSchema).readonly()
 });
+/** Event-media footprint for one {@link MediaFileKind}. */
+var EventMediaKindFootprintSchema = object({
+	kind: MediaFileKindEnum,
+	/** Media rows of this kind. */
+	rows: number().int(),
+	/** Bytes on disk held by those rows. */
+	bytes: number().int()
+});
+/**
+* The media footprint broken down by KIND — the axis a deletion decision
+* actually turns on.
+*
+* A byte total says how much there is; it cannot say what is safe to remove.
+* The deletable set (the periodic `snapshot` filmstrip, the surplus per-edge
+* motion stills) and the keep set (`firstFrame`, rolling `lastFrame`,
+* `thumbnail`/`thumbnailSmall`, `keyFrame`/`keyFrameSmall`, the face/plate
+* buffers, gallery media, the CLIP `crop`) are distinguished by `kind` and by
+* nothing else, so sizing a deletion means summing per kind.
+*
+* ## Why `unaccounted*` exists
+*
+* `kinds` is enumerated from {@link MediaFileKindEnum} — the closed set the
+* writers use — and summed one kind at a time. `totalRows` / `totalBytes` come
+* from a SEPARATE unfiltered aggregate over the same rows, never from adding
+* `kinds` up. A row whose stored `kind` is not in the enum (written by a
+* retired code path, or by a version that knew a kind this one does not) would
+* otherwise vanish from the total silently, and an operator would delete
+* against a denominator smaller than the disk.
+*
+* `unaccountedRows` / `unaccountedBytes` are the difference. They are normally
+* zero; a non-zero value is a real finding and must be shown, not rounded away.
+*/
+var EventMediaKindBreakdownSchema = object({
+	/** Every media row in scope, from one unfiltered aggregate. */
+	totalRows: number().int(),
+	/** Every media byte in scope, from that same aggregate. */
+	totalBytes: number().int(),
+	/** Per-kind footprint, ordered by bytes descending. */
+	kinds: array(EventMediaKindFootprintSchema).readonly(),
+	/** `totalRows` minus the summed `kinds` rows — see the schema note. */
+	unaccountedRows: number().int(),
+	/** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+	unaccountedBytes: number().int()
+});
 /** Per-kind counts returned by the event-prune / device-delete mutations. */
 var EventPruneCountsSchema = object({
 	motion: number().int(),
@@ -20058,7 +20229,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	until: number().optional(),
 	kinds: array(string()).optional(),
 	limit: number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
-}), array(SensorEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
+}), array(SensorEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(KeyEventBatchQueryInput, array(KeyEventsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -20107,6 +20278,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(object({ deviceId: number().int().optional() }), EventMediaKindBreakdownSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	olderThanMs: number(),
 	reason: OpsLogReasonSchema.optional()
@@ -22539,6 +22713,20 @@ method(object({
 	error: string().optional()
 }), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
 	providerId: string(),
+	/**
+	* The location this config is an UNSAVED edit of, when there is one.
+	*
+	* `listLocations` replaces every declared secret with the redaction
+	* sentinel, so the edit modal's form state holds the sentinel for any
+	* credential the operator did not retype — and posting that here
+	* without a way to resolve it makes the provider try to authenticate
+	* as `__camstack_redacted__` and report the operator's own working
+	* password as wrong. Given this id, the orchestrator restores each
+	* sentinel from the stored config (same rule as `upsertLocation`)
+	* before dispatching. Omitted by the "Add location" wizard, where
+	* every value was typed just now and nothing is stored yet.
+	*/
+	locationId: string().optional(),
 	config: record(string(), unknown())
 }), object({
 	ok: boolean(),
@@ -28174,6 +28362,9 @@ method(object({
 }), method(RelocateResidueInputSchema, RelocateResidueSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(LedgerWalkInputSchema, LedgerWalkReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -28565,7 +28756,26 @@ var SceneMonitorStatusSchema = object({
 	monitors: array(SceneMonitorSchema),
 	lastFetchedAt: number()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), SceneMonitorStatusSchema), method(object({
+/**
+* One camera's row in a `listScenesBatch` answer.
+*
+* `status` is NULLABLE and the nullability is the whole point. `scene-monitor`
+* is a `defaultActive` wrapper, so every camera is asked; a camera whose
+* provider is absent (pipeline-analytics not deployed, the post-processing node
+* down) cannot answer, and that is not the same fact as a camera with no scenes
+* configured. Fanned out per camera the difference was visible — one query
+* errored while the others resolved — and a batch that returned only the rows
+* it managed would have destroyed it, silently, by making an unreachable camera
+* indistinguishable from one that answered `monitors: []`.
+*
+* So: EVERY requested deviceId gets a row. `status: null` means "this camera
+* could not be read"; `status.monitors: []` means "read, and it has none".
+*/
+var SceneMonitorStatusForDeviceSchema = object({
+	deviceId: number(),
+	status: SceneMonitorStatusSchema.nullable()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), SceneMonitorStatusSchema), method(object({ deviceIds: array(number()).min(1).max(200) }), array(SceneMonitorStatusForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	label: string(),
 	roi: MaskRectShapeSchema,
@@ -29889,6 +30099,27 @@ var CameraOccupancySnapshotSchema = object({
 	stationaryObjects: array(StationaryObjectSchema).readonly().optional()
 });
 /**
+* One camera's row in a `getCurrentSnapshotBatch` answer.
+*
+* THREE outcomes, and the single-camera method could only express two of them
+* because `snapshot: null` was already spoken for:
+*
+*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
+*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
+*    yet: no frame since boot, and no parked-object registry to hydrate from.
+*  - `read: 'unreadable'`               — the owner could not answer for this
+*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
+*
+* Collapsing the last two is the failure this field exists to prevent: a
+* hydration that threw would otherwise render as an empty Stationary section,
+* which is a definite claim about a camera nobody could read.
+*/
+var CameraOccupancySnapshotForDeviceSchema = object({
+	deviceId: number(),
+	read: _enum(["read", "unreadable"]),
+	snapshot: CameraOccupancySnapshotSchema.nullable()
+});
+/**
 * Time-series resolution. The history methods return one bucket per
 * step over the requested range. Smaller resolutions cost more
 * memory + bandwidth; bound to discrete steps so caller cannot ask
@@ -29912,7 +30143,7 @@ var HistoryPointSchema = object({
 	/** Object count averaged over the bucket (rounded to nearest integer). */
 	count: number().int().nonnegative()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({
+DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(CameraOccupancySnapshotForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	zoneId: string(),
 	className: string().optional()
@@ -33277,6 +33508,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getEventMediaFootprintByKind": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getEventStoreFootprint": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33295,6 +33532,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getKeyEventsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -34471,6 +34714,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.reconcileLedgerAgainstDisk": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.refreshStorageLocationsForMigration": {
 		capName: "recording",
 		capScope: "system",
@@ -34597,6 +34846,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"sceneMonitor.listScenesBatch": {
+		capName: "scene-monitor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.recheckNow": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -35953,6 +36208,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"zoneAnalytics.getCurrentSnapshotBatch": {
+		capName: "zone-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"zoneAnalytics.getUnzonedHistory": {
 		capName: "zone-analytics",
 		capScope: "device",
@@ -36942,6 +37203,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getEventMediaFootprintByKind": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"pipelineAnalytics.getGroup": [{
 		name: "deviceId",
 		form: "single",
@@ -36952,6 +37218,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getKeyEventsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.getMotionEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -37392,6 +37663,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recording.reconcileLedgerAgainstDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"recording.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
@@ -37457,6 +37733,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"sceneMonitor.listScenesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"sceneMonitor.recheckNow": [{
 		name: "deviceId",
 		form: "single",
@@ -37718,6 +37999,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"zoneAnalytics.getCurrentSnapshotBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"zoneAnalytics.getUnzonedHistory": [{
 		name: "deviceId",
 		form: "single",
@@ -40827,6 +41113,124 @@ function composeCameraStatus(input) {
 	};
 }
 //#endregion
+//#region src/camera-status/fleet-read-pass.ts
+/**
+* Keep a rejection from becoming an UNHANDLED one.
+*
+* A shared promise is created by the first camera to ask and consumed by the
+* others later — `listBindableCapsForDeviceType` is reached in stage 2 of
+* `readSwitchAuthorities`, after an await, so two cameras genuinely attach
+* their handlers in different ticks. Without this the first rejection would be
+* unhandled for the window in between.
+*
+* The handler is a no-op ON PURPOSE: it never becomes the answer. Every real
+* consumer attaches its own `.catch` and reports the failure per camera.
+*/
+function keepAlive(p) {
+	p.catch(() => void 0);
+	return p;
+}
+var FleetReadPass = class {
+	deps;
+	roster = null;
+	bindings = null;
+	mutes = null;
+	bindableByType = /* @__PURE__ */ new Map();
+	slotsByNode = /* @__PURE__ */ new Map();
+	rtspByNode = /* @__PURE__ */ new Map();
+	provisioningByNode = /* @__PURE__ */ new Map();
+	selectedEngineByNode = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** The cameras this pass covers — the set both batch reads are issued for. */
+	get deviceIds() {
+		return this.deps.deviceIds;
+	}
+	/**
+	* The device rows for the pass's set.
+	*
+	* **The shape follows the SET, not the caller.** A pass of one asks
+	* `getDevice` — the exact question, and the one the write path
+	* (`CameraSwitchService.setCameraSwitch`) has always asked. A pass of many
+	* asks `listAll({deviceIds})`, which exists precisely because "these N" was
+	* otherwise either N round trips or the whole fleet. Answering a set of one
+	* with the fleet-shaped method would be no cheaper and would move the write
+	* path onto a read it does not need.
+	*
+	* `projection: 'slim'` because the only fields read off it are `type` and
+	* `disabled`: the full projection reads each device's settings row, which is
+	* the per-device round trip this whole change exists to remove.
+	*/
+	deviceRoster(api) {
+		const single = this.deps.deviceIds.length === 1 ? this.deps.deviceIds[0] : void 0;
+		const source = single === void 0 ? "deviceManager.listAll" : "deviceManager.getDevice";
+		if (this.roster === null) this.roster = keepAlive(single === void 0 ? api.deviceManager.listAll.query({
+			deviceIds: [...this.deps.deviceIds],
+			projection: "slim"
+		}) : api.deviceManager.getDevice.query({ deviceId: single }).then((row) => row === null ? [] : [row]));
+		return {
+			source,
+			result: this.roster
+		};
+	}
+	/** The binding rows for the pass's set — `getBindings` for one, the batch for many. */
+	bindingRows(api) {
+		const single = this.deps.deviceIds.length === 1 ? this.deps.deviceIds[0] : void 0;
+		const source = single === void 0 ? "deviceManager.getBindingsBatch" : "deviceManager.getBindings";
+		if (this.bindings === null) this.bindings = keepAlive(single === void 0 ? api.deviceManager.getBindingsBatch.query({ deviceIds: [...this.deps.deviceIds] }) : api.deviceManager.getBindings.query({ deviceId: single }).then((row) => [row]));
+		return {
+			source,
+			result: this.bindings
+		};
+	}
+	/** The fleet's muted-camera list. One answer for every camera in the pass. */
+	mutedDevices(api) {
+		if (this.mutes === null) this.mutes = keepAlive(api.notificationRules.listDeviceMutes.query({}));
+		return this.mutes;
+	}
+	/** The bindable caps for one device TYPE. Every camera shares one answer. */
+	bindableCapsFor(api, deviceType) {
+		const existing = this.bindableByType.get(deviceType);
+		if (existing !== void 0) return existing;
+		const created = keepAlive(api.deviceManager.listBindableCapsForDeviceType.query({ deviceType }));
+		this.bindableByType.set(deviceType, created);
+		return created;
+	}
+	/** One source node's whole profile-slot table. */
+	profileSlots(api, sourceNodeId) {
+		const existing = this.slotsByNode.get(sourceNodeId);
+		if (existing !== void 0) return existing;
+		const created = keepAlive(api.streamBroker.listAllProfileSlots.query(void 0, nodePin(sourceNodeId)));
+		this.slotsByNode.set(sourceNodeId, created);
+		return created;
+	}
+	/** One source node's whole RTSP-restream table. */
+	rtspEntries(api, sourceNodeId) {
+		const existing = this.rtspByNode.get(sourceNodeId);
+		if (existing !== void 0) return existing;
+		const created = keepAlive(api.streamBroker.getAllRtspEntries.query({}, nodePin(sourceNodeId)));
+		this.rtspByNode.set(sourceNodeId, created);
+		return created;
+	}
+	/** One detection node's runtime-provisioning snapshot. */
+	engineProvisioning(api, detectionNodeId) {
+		const existing = this.provisioningByNode.get(detectionNodeId);
+		if (existing !== void 0) return existing;
+		const created = keepAlive(api.pipelineExecutor.getEngineProvisioning.query({ nodeId: detectionNodeId }));
+		this.provisioningByNode.set(detectionNodeId, created);
+		return created;
+	}
+	/** The executor's bootstrap engine, as the detection stage reads it. */
+	selectedEngine(api, detectionNodeId) {
+		const existing = this.selectedEngineByNode.get(detectionNodeId);
+		if (existing !== void 0) return existing;
+		const created = keepAlive(api.pipelineExecutor.getSelectedEngine.query({ nodeId: detectionNodeId }));
+		this.selectedEngineByNode.set(detectionNodeId, created);
+		return created;
+	}
+};
+//#endregion
 //#region src/camera-status-service.ts
 /** WebRTC consumer kinds counted toward `BrokerResult.webrtcSessions`. */
 var WEBRTC_KINDS = new Set([
@@ -41015,7 +41419,7 @@ var CameraStatusService = class {
 	* broker's actual decode-session node into `liveDecoder` (T6) — the first
 	* slot that reports one wins.
 	*/
-	buildBrokerStage(api, allSlotsFetch, deviceId, sourceNodeId, liveDecoder, sink) {
+	buildBrokerStage(api, allSlotsFetch, deviceId, sourceNodeId, pass, liveDecoder, sink) {
 		if (!api || !allSlotsFetch) return Promise.resolve(null);
 		return this.boundedStage(allSlotsFetch.then(async (slots) => {
 			const deviceSlots = slots.filter((s) => s.deviceId === deviceId);
@@ -41025,12 +41429,13 @@ var CameraStatusService = class {
 				rtspRestream: false
 			};
 			const [statsAndClients, rtspEntry] = await Promise.all([Promise.all(deviceSlots.map(async (slot) => {
+				const [stats, clients] = await Promise.all([api.streamBroker.getBrokerStats.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null), api.streamBroker.listClients.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null)]);
 				return {
 					slot,
-					stats: await api.streamBroker.getBrokerStats.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null),
-					clients: await api.streamBroker.listClients.query({ brokerId: slot.brokerId }, nodePin(sourceNodeId)).catch(() => null)
+					stats,
+					clients
 				};
-			})), api.streamBroker.getAllRtspEntries.query({}, nodePin(sourceNodeId)).catch(() => null)]);
+			})), pass.rtspEntries(api, sourceNodeId).catch(() => null)]);
 			const profileDetails = statsAndClients.map(({ slot, stats, clients }) => ({
 				profile: slot.profile,
 				status: slot.status,
@@ -41091,13 +41496,16 @@ var CameraStatusService = class {
 		};
 	}
 	/** Detection stage (pipeline-executor + runner metrics). */
-	buildDetectionStage(api, detectionNodeId, deviceId, sink) {
+	buildDetectionStage(api, detectionNodeId, deviceId, pass, sink) {
 		if (!api || !detectionNodeId) return Promise.resolve(null);
-		return this.boundedStage(Promise.all([api.pipelineExecutor.getEngineProvisioning.query({ nodeId: detectionNodeId }).catch(() => null), api.pipelineExecutor.getSelectedEngine.query({ nodeId: detectionNodeId }).catch(() => null)]).then(async ([provisioning, engine]) => {
-			const metrics = await api.pipelineRunner.getCameraMetrics.query({
+		return this.boundedStage(Promise.all([
+			pass.engineProvisioning(api, detectionNodeId).catch(() => null),
+			pass.selectedEngine(api, detectionNodeId).catch(() => null),
+			api.pipelineRunner.getCameraMetrics.query({
 				deviceId,
 				nodeId: detectionNodeId
-			}).catch(() => null);
+			}).catch(() => null)
+		]).then(async ([provisioning, engine, metrics]) => {
 			const phase = (() => {
 				const p = metrics?.phase;
 				if (p === "active") return "active";
@@ -41209,9 +41617,9 @@ var CameraStatusService = class {
 	* badge on a working camera); what matters is that the emptiness travels with
 	* the reason it is empty.
 	*/
-	buildSwitchStage(deviceId, sink) {
+	buildSwitchStage(deviceId, pass, sink) {
 		const startedAt = Date.now();
-		return this.boundedStage(this.deps.switchAuthoritiesFor(deviceId), STAGE_TIMEOUT_MS, "switches", deviceId, sink).then((reads) => {
+		return this.boundedStage(this.deps.switchAuthoritiesFor(deviceId, pass), STAGE_TIMEOUT_MS, "switches", deviceId, sink).then((reads) => {
 			if (reads === null) return [];
 			const { switchedOff, unreadable } = composeSwitchedOff(reads);
 			if (unreadable.length > 0) this.recordDegraded(sink, deviceId, "switches", "partial", Date.now() - startedAt, { unreadableAuthorities: unreadable });
@@ -41229,18 +41637,28 @@ var CameraStatusService = class {
 	* `null` of a camera that legitimately has no such stage.
 	*/
 	async getCameraStatus(deviceId) {
+		return this.composeOne(deviceId, new FleetReadPass({ deviceIds: [deviceId] }));
+	}
+	/**
+	* One camera's status, composed WITHIN a pass.
+	*
+	* Everything the camera alone can answer is fetched here; everything the pass
+	* already knows (a node's slot table, the fleet's mute list, a device type's
+	* bindable caps) is asked of `pass`, which issues it once for the whole call.
+	*/
+	async composeOne(deviceId, pass) {
 		const api = this.deps.api();
 		const degradations = { entries: [] };
 		const { detectionNodeId, sourceNodeId, pinned, detectionReason, audioNodeId, audioPinned } = this.buildAssignmentContext(deviceId);
 		const liveDecoder = { nodeId: null };
-		const allSlotsFetch = api ? api.streamBroker.listAllProfileSlots.query(void 0, nodePin(sourceNodeId)) : null;
+		const allSlotsFetch = api ? pass.profileSlots(api, sourceNodeId) : null;
 		const sourceFetch = this.buildSourceStage(api, allSlotsFetch, deviceId, degradations);
-		const brokerFetch = this.buildBrokerStage(api, allSlotsFetch, deviceId, sourceNodeId, liveDecoder, degradations);
+		const brokerFetch = this.buildBrokerStage(api, allSlotsFetch, deviceId, sourceNodeId, pass, liveDecoder, degradations);
 		const decoderFetch = this.buildDecoderStage(detectionNodeId);
 		const motionResult = this.buildMotionStage(deviceId);
-		const detectionFetch = this.buildDetectionStage(api, detectionNodeId, deviceId, degradations);
+		const detectionFetch = this.buildDetectionStage(api, detectionNodeId, deviceId, pass, degradations);
 		const recordingFetch = this.buildRecordingStage(api, deviceId, degradations);
-		const switchesFetch = this.buildSwitchStage(deviceId, degradations);
+		const switchesFetch = this.buildSwitchStage(deviceId, pass, degradations);
 		const [sourceResult, brokerResult, decoderResult, detectionResult, recordingResult, switchedOff] = await Promise.all([
 			sourceFetch,
 			brokerFetch,
@@ -41283,15 +41701,30 @@ var CameraStatusService = class {
 	* `deviceIds` defaults to all cameras currently tracked by the
 	* orchestrator's assignment map when omitted.
 	*
-	* v1: `Promise.all` over per-device composition (no concurrency cap).
-	* Note: for large fleets (hundreds of cameras) this may fan out many
-	* parallel calls. A concurrency limiter (p-limit / semaphore) should be
-	* added if latency measurements show it's necessary — deliberately
-	* deferred per the YAGNI constraint in the spec.
+	* The whole call runs inside ONE {@link FleetReadPass}, and that is what
+	* makes a five-second poll affordable. Composing a camera reaches seven
+	* stages, but six of the questions those stages ask are about a NODE, a
+	* device TYPE or the whole FLEET — the slot table, the restream table, the
+	* mute list, the engine pair, the bindable caps — and asking them per camera
+	* meant N identical round trips for N identical answers. Two more (the device
+	* row, the binding table) are per-camera questions the device manager already
+	* answers for a set. The pass asks each exactly once and shares the promise;
+	* it holds nothing between calls, so the next poll asks again from scratch.
+	*
+	* What is left is genuinely per camera and stays per camera: the broker slot
+	* stats, the runner metrics, the recorder, the broker mute and the camera's
+	* own privacy provider. Collapsing any of those would be a narrower answer,
+	* not a cheaper one.
+	*
+	* `Promise.all` over per-device composition (no concurrency cap). The fan-out
+	* is now ~8 round trips per camera rather than ~16, and the six fleet reads
+	* no longer multiply — which is the part that made the count grow with the
+	* fleet twice over.
 	*/
 	async getCameraStatuses(deviceIds) {
 		const ids = deviceIds !== void 0 && deviceIds.length > 0 ? deviceIds : this.deps.listAssignedDeviceIds();
-		return Promise.all(ids.map((deviceId) => this.getCameraStatus(deviceId)));
+		const pass = new FleetReadPass({ deviceIds: ids });
+		return Promise.all(ids.map((deviceId) => this.composeOne(deviceId, pass)));
 	}
 };
 //#endregion
@@ -41540,10 +41973,15 @@ async function probeCamera(api, deviceId, deps) {
 * @param deviceId The camera.
 * @param deps     Logger + source-owner resolver.
 */
-async function readSwitchAuthorities(api, deviceId, deps) {
+async function readSwitchAuthorities(api, deviceId, deps, sharedPass) {
 	if (!api) return unknownReads(deviceId);
-	const devicePromise = bounded(deps, deviceId, "deviceManager.getDevice", api.deviceManager.getDevice.query({ deviceId }).then((d) => isDeviceShape(d) ? d : null).catch((err) => {
-		warnUnreachable(deps, deviceId, "getDevice", err);
+	const pass = sharedPass ?? new FleetReadPass({ deviceIds: [deviceId] });
+	const roster = pass.deviceRoster(api);
+	const devicePromise = bounded(deps, deviceId, roster.source, roster.result.then((rows) => {
+		const row = rows.find((d) => d.id === deviceId);
+		return isDeviceShape(row) ? row : null;
+	}).catch((err) => {
+		warnUnreachable(deps, deviceId, roster.source, err);
 		return null;
 	}), null);
 	const unknownBindings = {
@@ -41551,11 +41989,14 @@ async function readSwitchAuthorities(api, deviceId, deps) {
 		providerAddonIdByCap: /* @__PURE__ */ new Map(),
 		allCapNames: null
 	};
-	const bindingsPromise = bounded(deps, deviceId, "deviceManager.getBindings", api.deviceManager.getBindings.query({ deviceId }).then((b) => {
+	const bindingRead = pass.bindingRows(api);
+	const bindingsPromise = bounded(deps, deviceId, bindingRead.source, bindingRead.result.then((rows) => {
+		const row = rows.find((r) => r.deviceId === deviceId);
+		if (row === void 0) return unknownBindings;
 		const active = [];
 		const all = [];
 		const providers = /* @__PURE__ */ new Map();
-		for (const e of b.entries) {
+		for (const e of row.entries) {
 			all.push(e.capName);
 			if (e.kind !== "wrapped") continue;
 			active.push(e.capName);
@@ -41567,14 +42008,14 @@ async function readSwitchAuthorities(api, deviceId, deps) {
 			allCapNames: all
 		};
 	}).catch((err) => {
-		warnUnreachable(deps, deviceId, "getBindings", err);
+		warnUnreachable(deps, deviceId, bindingRead.source, err);
 		return unknownBindings;
 	}), unknownBindings);
 	const recordingPromise = bounded(deps, deviceId, "recording.getDeviceConfig", api.recording.getDeviceConfig.query({ deviceId }).then((c) => isRecordingConfig(c) ? c : null).catch((err) => {
 		warnUnreachable(deps, deviceId, "recording.getDeviceConfig", err);
 		return null;
 	}), null);
-	const mutesPromise = bounded(deps, deviceId, "notificationRules.listDeviceMutes", api.notificationRules.listDeviceMutes.query({}).then((r) => r.mutedDeviceIds).catch((err) => {
+	const mutesPromise = bounded(deps, deviceId, "notificationRules.listDeviceMutes", pass.mutedDevices(api).then((r) => r.mutedDeviceIds).catch((err) => {
 		warnUnreachable(deps, deviceId, "notificationRules.listDeviceMutes", err);
 		return null;
 	}), null);
@@ -41589,7 +42030,7 @@ async function readSwitchAuthorities(api, deviceId, deps) {
 		mutesPromise,
 		brokerAudioPromise
 	]);
-	const [bindable, privacy] = await Promise.all([device === null ? Promise.resolve(null) : bounded(deps, deviceId, "deviceManager.listBindableCapsForDeviceType", api.deviceManager.listBindableCapsForDeviceType.query({ deviceType: device.type }).catch((err) => {
+	const [bindable, privacy] = await Promise.all([device === null ? Promise.resolve(null) : bounded(deps, deviceId, "deviceManager.listBindableCapsForDeviceType", pass.bindableCapsFor(api, device.type).catch((err) => {
 		warnUnreachable(deps, deviceId, "listBindableCapsForDeviceType", err);
 		return null;
 	}), null), readPrivacyPlanes(api, deviceId, deps, bindings.allCapNames)]);
@@ -50296,11 +50737,11 @@ async function buildOrchestratorControllers(deps) {
 		assignSource: (deviceId) => topology.assignSource(deviceId),
 		listAssignedDeviceIds: () => [...new Set([...ledger.listAssignedDeviceIds(), ...detectionWiring.activeDeviceIds()])],
 		isSessionCamera: (deviceId) => deps.isSessionCamera(deviceId),
-		switchAuthoritiesFor: async (deviceId) => (await readSwitchAuthorities(deps.ctx().api ?? null, deviceId, {
+		switchAuthoritiesFor: async (deviceId, pass) => (await readSwitchAuthorities(deps.ctx().api ?? null, deviceId, {
 			logger: deps.ctx().logger,
 			assignSource: (id) => topology.assignSource(id),
 			warnSampler: switchWarnSampler
-		})).derivation
+		}, pass)).derivation
 	});
 	const reconcile = new ReconcileController({
 		api: () => deps.ctx().api ?? null,