@camstack/addon-pipeline-orchestrator 1.2.166 → 1.2.168

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-zAv7pMUz.mjs
+//#region ../types/dist/event-category-CnLqLOKs.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -197,6 +197,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessCrashed"] = "process.crashed";
 	EventCategory["ProcessRestartScheduled"] = "process.restart_scheduled";
 	EventCategory["ProcessRestarted"] = "process.restarted";
+	/**
+	* The SET of storage locations changed — one was created, edited, enabled,
+	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	*
+	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
+	* it must also converge on its own periodic path, because a dropped event
+	* must not leave a node writing to yesterday's disk set forever. It exists
+	* because there was NO signal at all — an operator who added a second
+	* recordings disk in the admin UI got nothing, and the recorder kept its
+	* resolved locations until something else happened to re-resolve them
+	* (D387). Payload `StorageLocationsChangedPayload`.
+	*/
+	EventCategory["StorageLocationsChanged"] = "storage.locations-changed";
 	EventCategory["RecordingStarted"] = "recording.started";
 	EventCategory["RecordingStopped"] = "recording.stopped";
 	EventCategory["RecordingError"] = "recording.error";
@@ -9384,6 +9397,21 @@ var StorageCleanupJobSchema = object({
 });
 var StorageCleanupStatusInputSchema = object({ jobId: string().optional() });
 /**
+* The one typed state of a storage location. Authoritative Zod schema — the TS
+* alias below is `z.infer<>` of it, never a second spelling.
+*/
+var StorageLocationModeSchema = _enum([
+	"active",
+	"readonly",
+	"drain",
+	"disabled"
+]);
+_enum([
+	"normal",
+	"never",
+	"drain"
+]);
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -9449,6 +9477,21 @@ var StorageLocationSchema = object({
 	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
+	/**
+	* THE state of this location (D385), and the only authority on what may be
+	* written, read or evicted here. Interpreted in exactly one place —
+	* `storage-location-mode.ts` — which also folds the legacy
+	* `enabled` / `config.readOnly` pair into a mode so an old row is never
+	* ambiguous.
+	*
+	* OPTIONAL only for the wire and for rows written before D385: absence is
+	* resolved by `resolveLocationMode`, and the orchestrator stamps every
+	* unstamped row ONCE at hydrate so absence stops existing rather than being
+	* re-derived on every read. `enabled` survives one release as a DERIVED
+	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+	* either, so the two cannot disagree.
+	*/
+	mode: StorageLocationModeSchema.optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
 	*  for node-local locations it can reach) — never persisted, absent when the
 	*  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -9456,11 +9499,46 @@ var StorageLocationSchema = object({
 		totalBytes: number(),
 		availableBytes: number()
 	}).nullable().optional(),
+	/**
+	* How much of that volume CamStack ITSELF holds on this location (D388) —
+	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
+	* never persisted, never a filesystem walk.
+	*
+	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+	* location yet — nobody stores here, the owning addon is down, or the first
+	* refresh has not completed. A UI must omit the segment rather than draw it
+	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+	* not a bare number precisely so that a `?? 0` on the consuming side has to
+	* be spelled out loud instead of appearing by accident.
+	*
+	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+	* about the whole figure rather than about its freshest part.
+	*/
+	owned: object({
+		bytes: number().int().nonnegative(),
+		measuredAtMs: number().int().nonnegative()
+	}).optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
 object({ isDefault: boolean().optional() });
 /**
+* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
+*
+* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
+* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
+* drain with no observed growth has no honest ETA, and inventing one is how an
+* operator learns not to believe the screen.
+*/
+var StorageDrainProgressSchema = object({
+	locationId: string(),
+	startedAtMs: number(),
+	startBytes: number(),
+	bytesRemaining: number(),
+	drained: boolean(),
+	estimatedEmptyAtMs: number().nullable()
+});
+/**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
 *  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
@@ -21204,8 +21282,25 @@ var occupancyRecheckFramesField = {
 * (analyzer attaches detected `regions[]`; onboard does not — the
 * camera typically only reports a binary signal plus an optional
 * channel/AI class which lives in dedicated event channels).
-*/
-var MotionSourceEnum = _enum(["onboard", "analyzer"]);
+*
+* - `onboard` — the camera's firmware said something moved.
+* - `analyzer` — this runner's frame-diff said so, and attaches `regions[]`.
+* - `device-activity` — the DEVICE said it is doing its job: the
+*   `recording-signal` LEVEL the same device raises for the recorder
+*   ([D380](../../../../docs/decisions/adr-0380-a-device-decided-recording-is-a-mode-with-no-schedule-seeded-once.md)),
+*   republished as a motion source. It attaches **nothing** — no regions, no
+*   class: the only fact it carries is that the device is active, and a robot
+*   vacuum that is itself the moving object has no region worth sending. It is
+*   a LEVEL, so unlike `onboard` it has a real falling edge, and unlike
+*   `analyzer` it must not open the frame-diff side-channel — the runner's
+*   `handleOnboardMotionAnalyzer` gate is `source === 'onboard'` and stays that
+*   way ([D392](../../../../docs/decisions/adr-0392-a-device-that-says-it-is-working-is-a-motion-source-of-its-own.md)).
+*/
+var MotionSourceEnum = _enum([
+	"onboard",
+	"analyzer",
+	"device-activity"
+]);
 /**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
@@ -21469,13 +21564,20 @@ var RunnerCameraDeviceUIFields = [
 		type: "multiselect",
 		label: "Motion Sources",
 		default: ["analyzer"],
-		options: [{
-			value: "analyzer",
-			label: "Frame-diff Analyzer (motion addon)"
-		}, {
-			value: "onboard",
-			label: "Camera Onboard Sensor"
-		}]
+		options: [
+			{
+				value: "analyzer",
+				label: "Frame-diff Analyzer (motion addon)"
+			},
+			{
+				value: "onboard",
+				label: "Camera Onboard Sensor"
+			},
+			{
+				value: "device-activity",
+				label: "Device activity (the device says it is working)"
+			}
+		]
 	},
 	{
 		key: "motionFps",
@@ -23212,7 +23314,7 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), object({
+}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
 	ok: boolean(),
 	error: string().optional()
 }), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
@@ -23282,6 +23384,51 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(StorageMigrationJobSchema).readonly(), { auth: "admin" });
+/**
+* `storage-occupancy` — how many bytes an addon actually HOLDS on a storage
+* location (D388).
+*
+* ## Why this is not `storage-evictable`
+*
+* `storage-evictable.getEvictableUsage` looks like the same question and is
+* not, in two ways that both matter and both bite hardest on the locations an
+* operator most wants a figure for:
+*
+*  - it reports the whole eviction DOMAIN, not the location. `recordings:default`
+*    and `recordingsLow:default` deliberately share one root and evict as one
+*    oldest-first pool, so both answer with the SAME combined total. As an
+*    occupancy figure that double-counts the disk.
+*  - it reports ZERO for a location whose eviction policy is `never` (D385) —
+*    a `readonly` or `disabled` disk. Those are exactly the disks an operator
+*    is retiring and staring at.
+*
+* So this is its own contract with its own quantity, and the quantity is
+* OCCUPIED: every byte the addon holds on that location, whether or not it
+* would ever be willing to delete it. A provider that can only answer
+* "evictable" must not register here — a number that silently means different
+* things per class is worse than no number.
+*
+* ## Absence is an answer
+*
+* A location nobody reports for is UNKNOWN, never zero (D315). The orchestrator
+* stamps `StorageLocation.owned` only for locations it has a report for, and
+* the field is an OBJECT rather than a bare number so that a `?? 0` on the
+* consuming side has to be written out loud instead of appearing by accident.
+*
+* `internal: true` — consumed by the orchestrator's `listLocations` stamp, never
+* a public client surface. Clients read the stamped `StorageLocation.owned`.
+*/
+/** One provider's occupancy answer for one location. */
+var StorageOccupancyReportSchema = object({
+	locationId: string(),
+	/** Bytes this provider holds on THAT location — not its eviction domain, and
+	*  not net of what it is willing to delete. */
+	ownedBytes: number().int().nonnegative(),
+	/** When the provider last actually measured this. The orchestrator carries it
+	*  through so a UI can say how old the figure is instead of implying "now". */
+	measuredAtMs: number().int().nonnegative()
+});
+method(object({ locationIds: array(string()).readonly() }), array(StorageOccupancyReportSchema).readonly(), { auth: "admin" });
 var ProviderInfoSchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -24917,39 +25064,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, meth
 	deviceId: number(),
 	status: BatteryStatusSchema
 });
-/**
-* Network-link snapshot. Same shape for every provider (a Reolink wifi
-* camera, a Home Assistant device with a signal-strength sensor, a Tapo
-* plug): one slice under `device.runtimeState['network-link']`, one badge,
-* one Home Assistant projection.
-*/
-var NetworkLinkStatusSchema = object({
-	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
-	type: _enum([
-		"wifi",
-		"ethernet",
-		"cellular",
-		"unknown"
-	]),
-	/**
-	* Link quality, 0..100 inclusive, normalised by the provider from whatever
-	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
-	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
-	* one whose reading has not landed must not be drawn at 0 %. Consumers
-	* SKIP a null rather than coerce it.
-	*/
-	signalPercent: number().min(0).max(100).nullable(),
-	/** Raw received signal strength in dBm, when the firmware reports one. */
-	rssiDbm: number().optional(),
-	/** Network name of a wireless link, when the firmware reports it. */
-	ssid: string().optional(),
-	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
-	lastUpdated: number()
-});
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.Light, DeviceType.Lock, DeviceType.Siren, object({
-	deviceId: number(),
-	status: NetworkLinkStatusSchema
-});
 object({
 	on: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
@@ -27303,6 +27417,236 @@ DeviceType.Camera, method(object({
 	detection: NativeDetectionSchema
 });
 /**
+* `navigation` — a device-scoped capability that natively expresses the FULL
+* navigation / action surface of a robot that DRIVES ITSELF and carries an
+* on-board camera (the Dreame robot-vacuum camera is the first provider).
+*
+* Why a NEW cap rather than overloading `ptz`:
+*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
+*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
+*     The two are different physical models: PTZ is absolute-position + presets,
+*     navigation is momentary drive nudges + discrete robot ACTIONS
+*     (dock / spot-clean / follow-pet / go-to-point / …).
+*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
+*     the reverse:
+*       1. a native CamStack navigation panel (data-driven from `listActions`
+*          / `getOptions`), and
+*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
+*          robot camera shows up in the existing PTZ control path without every
+*          PTZ provider learning about robots. The mapping lives in the adapter,
+*          not here (see the addon design note):
+*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
+*            ptz.stop()                      → navigation.stop()
+*            ptz.goHome()                    → navigation.runAction('goHome')
+*            ptz.getPresets()                → navigation.listActions()  (id→preset)
+*            ptz.goToPreset(id)              → navigation.runAction(id)
+*
+* ## Continuous drive
+*
+* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
+* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
+* one `stop()` on release — exactly like the robot app's remote-drive joystick.
+* The provider forwards EACH `move` to one drive write; it must NOT debounce or
+* coalesce them. The UI owns the cadence.
+*
+* ## The action dictionary
+*
+* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
+* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
+* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
+* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
+* vendor-specific list. `kind: 'action'` entries are triggered with
+* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
+* (the entry carries the `soundId` to pass). The general primitives — `move`,
+* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
+*
+* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
+* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
+* that the currently-published `@apocaliss92/nodedreame` already exposes on
+* every device handle. A future nodedreame publish adds a typed
+* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
+* provider can then swap the raw calls for the typed methods with no change to
+* THIS contract.
+*/
+/**
+* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
+* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
+* halts it.
+*
+*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
+*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
+*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
+*               vector by it (drivers without proportional drive ignore it).
+*
+* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
+* axis alone; an all-undefined nudge is a no-op.
+*/
+var NavigationMoveCommandSchema = object({
+	pan: number().min(-1).max(1).optional(),
+	tilt: number().min(-1).max(1).optional(),
+	speed: number().min(0).max(1).optional()
+});
+/**
+* The enumerated discrete actions a navigation-capable robot can perform via
+* `runAction`. This is the CLOSED vocabulary; a given device advertises the
+* subset it supports through `listActions`. Sounds are NOT here — they go through
+* `playSound` (see the `sound` dictionary entries).
+*/
+var NavigationActionIdSchema = _enum([
+	"goHome",
+	"locate",
+	"spotClean",
+	"findPet",
+	"personFollow",
+	"stop",
+	"startClean",
+	"pauseClean",
+	"dockWash",
+	"autoEmpty",
+	"flashOn",
+	"flashOff"
+]);
+/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
+var NavigationEntryKindSchema = _enum(["action", "sound"]);
+/**
+* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
+* native panel and the PTZ mimic render as a button.
+*
+*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
+*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
+*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
+*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
+*   - `label`   — operator-facing English label.
+*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
+*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
+*                 PTZ render ONLY enabled entries. Data-driven: the provider
+*                 flips it from config, never by editing code.
+*/
+var NavigationActionEntrySchema = object({
+	id: string(),
+	kind: NavigationEntryKindSchema,
+	label: string(),
+	icon: string(),
+	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
+	soundId: number().int().optional(),
+	/** Per-device feature flag — render this entry only when true. */
+	enabled: boolean()
+});
+/** Coordinates for `goToPoint` — a point on the robot's live map. */
+var NavigationPointSchema = object({
+	x: number(),
+	y: number()
+});
+/**
+* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
+* The cap reports which are enabled so the UI / PTZ render only the controls
+* that are turned on for THIS device. Data-driven: the provider derives these
+* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
+* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
+* that are not dictionary entries.
+*
+*   - `move` / `stop`   — the momentary drive joystick.
+*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
+*                         map-coordinate plumbing is wired.
+*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
+*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
+*   - `light`           — the on/off fill-light toggle (works anytime).
+*   - `lightMode`       — the auto/manual selector + manual level slider (a
+*                         camera-service control; needs an active stream).
+*/
+var NavigationFeaturesSchema = object({
+	move: boolean(),
+	stop: boolean(),
+	goToPoint: boolean(),
+	runAction: boolean(),
+	playSound: boolean(),
+	light: boolean(),
+	lightMode: boolean()
+});
+/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
+var NavigationLightModeSchema = _enum(["auto", "manual"]);
+/**
+* Live navigation state so the UI can reflect what the robot is doing:
+*   - `mode`       — coarse activity (idle / cleaning / following / …).
+*   - `following`  — person/pet follow is currently armed.
+*   - `flash`      — the on-camera fill light is on.
+*   - `lightMode`  — auto vs manual fill-light mode.
+*   - `lightLevel` — manual fill-light level (40..100); meaningful when
+*                    `lightMode === 'manual'`.
+*/
+var NavigationStatusSchema = object({
+	mode: _enum([
+		"idle",
+		"cleaning",
+		"spot",
+		"following",
+		"goto",
+		"returning",
+		"paused",
+		"unknown"
+	]),
+	following: boolean(),
+	flash: boolean(),
+	lightMode: NavigationLightModeSchema,
+	lightLevel: number().min(40).max(100),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+NavigationStatusSchema.extend({ lastFetchedAt: number() });
+DeviceType.Camera, method(NavigationMoveCommandSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(NavigationPointSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(NavigationActionEntrySchema)), method(object({
+	deviceId: number(),
+	actionId: NavigationActionIdSchema
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	soundId: number().int()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	on: boolean()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	mode: NavigationLightModeSchema,
+	level: number().min(40).max(100).optional()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	level: number().min(40).max(100)
+}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), NavigationFeaturesSchema), object({
+	deviceId: number(),
+	status: NavigationStatusSchema
+});
+/**
+* Network-link snapshot. Same shape for every provider (a Reolink wifi
+* camera, a Home Assistant device with a signal-strength sensor, a Tapo
+* plug): one slice under `device.runtimeState['network-link']`, one badge,
+* one Home Assistant projection.
+*/
+var NetworkLinkStatusSchema = object({
+	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
+	type: _enum([
+		"wifi",
+		"ethernet",
+		"cellular",
+		"unknown"
+	]),
+	/**
+	* Link quality, 0..100 inclusive, normalised by the provider from whatever
+	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
+	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
+	* one whose reading has not landed must not be drawn at 0 %. Consumers
+	* SKIP a null rather than coerce it.
+	*/
+	signalPercent: number().min(0).max(100).nullable(),
+	/** Raw received signal strength in dBm, when the firmware reports one. */
+	rssiDbm: number().optional(),
+	/** Network name of a wireless link, when the firmware reports it. */
+	ssid: string().optional(),
+	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
+	lastUpdated: number()
+});
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.Light, DeviceType.Lock, DeviceType.Siren, object({
+	deviceId: number(),
+	status: NetworkLinkStatusSchema
+});
+/**
 * network-quality — system-scoped singleton capability tracking RTT,
 * jitter, and observed/peak bandwidth per device + per client.
 *
@@ -28544,203 +28888,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), PtzAutotrackStatusSche
 	deviceId: number(),
 	status: PtzAutotrackStatusSchema
 });
-/**
-* `navigation` — a device-scoped capability that natively expresses the FULL
-* navigation / action surface of a robot that DRIVES ITSELF and carries an
-* on-board camera (the Dreame robot-vacuum camera is the first provider).
-*
-* Why a NEW cap rather than overloading `ptz`:
-*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
-*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
-*     The two are different physical models: PTZ is absolute-position + presets,
-*     navigation is momentary drive nudges + discrete robot ACTIONS
-*     (dock / spot-clean / follow-pet / go-to-point / …).
-*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
-*     the reverse:
-*       1. a native CamStack navigation panel (data-driven from `listActions`
-*          / `getOptions`), and
-*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
-*          robot camera shows up in the existing PTZ control path without every
-*          PTZ provider learning about robots. The mapping lives in the adapter,
-*          not here (see the addon design note):
-*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
-*            ptz.stop()                      → navigation.stop()
-*            ptz.goHome()                    → navigation.runAction('goHome')
-*            ptz.getPresets()                → navigation.listActions()  (id→preset)
-*            ptz.goToPreset(id)              → navigation.runAction(id)
-*
-* ## Continuous drive
-*
-* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
-* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
-* one `stop()` on release — exactly like the robot app's remote-drive joystick.
-* The provider forwards EACH `move` to one drive write; it must NOT debounce or
-* coalesce them. The UI owns the cadence.
-*
-* ## The action dictionary
-*
-* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
-* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
-* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
-* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
-* vendor-specific list. `kind: 'action'` entries are triggered with
-* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
-* (the entry carries the `soundId` to pass). The general primitives — `move`,
-* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
-*
-* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
-* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
-* that the currently-published `@apocaliss92/nodedreame` already exposes on
-* every device handle. A future nodedreame publish adds a typed
-* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
-* provider can then swap the raw calls for the typed methods with no change to
-* THIS contract.
-*/
-/**
-* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
-* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
-* halts it.
-*
-*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
-*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
-*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
-*               vector by it (drivers without proportional drive ignore it).
-*
-* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
-* axis alone; an all-undefined nudge is a no-op.
-*/
-var NavigationMoveCommandSchema = object({
-	pan: number().min(-1).max(1).optional(),
-	tilt: number().min(-1).max(1).optional(),
-	speed: number().min(0).max(1).optional()
-});
-/**
-* The enumerated discrete actions a navigation-capable robot can perform via
-* `runAction`. This is the CLOSED vocabulary; a given device advertises the
-* subset it supports through `listActions`. Sounds are NOT here — they go through
-* `playSound` (see the `sound` dictionary entries).
-*/
-var NavigationActionIdSchema = _enum([
-	"goHome",
-	"locate",
-	"spotClean",
-	"findPet",
-	"personFollow",
-	"stop",
-	"startClean",
-	"pauseClean",
-	"dockWash",
-	"autoEmpty",
-	"flashOn",
-	"flashOff"
-]);
-/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
-var NavigationEntryKindSchema = _enum(["action", "sound"]);
-/**
-* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
-* native panel and the PTZ mimic render as a button.
-*
-*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
-*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
-*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
-*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
-*   - `label`   — operator-facing English label.
-*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
-*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
-*                 PTZ render ONLY enabled entries. Data-driven: the provider
-*                 flips it from config, never by editing code.
-*/
-var NavigationActionEntrySchema = object({
-	id: string(),
-	kind: NavigationEntryKindSchema,
-	label: string(),
-	icon: string(),
-	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
-	soundId: number().int().optional(),
-	/** Per-device feature flag — render this entry only when true. */
-	enabled: boolean()
-});
-/** Coordinates for `goToPoint` — a point on the robot's live map. */
-var NavigationPointSchema = object({
-	x: number(),
-	y: number()
-});
-/**
-* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
-* The cap reports which are enabled so the UI / PTZ render only the controls
-* that are turned on for THIS device. Data-driven: the provider derives these
-* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
-* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
-* that are not dictionary entries.
-*
-*   - `move` / `stop`   — the momentary drive joystick.
-*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
-*                         map-coordinate plumbing is wired.
-*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
-*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
-*   - `light`           — the on/off fill-light toggle (works anytime).
-*   - `lightMode`       — the auto/manual selector + manual level slider (a
-*                         camera-service control; needs an active stream).
-*/
-var NavigationFeaturesSchema = object({
-	move: boolean(),
-	stop: boolean(),
-	goToPoint: boolean(),
-	runAction: boolean(),
-	playSound: boolean(),
-	light: boolean(),
-	lightMode: boolean()
-});
-/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
-var NavigationLightModeSchema = _enum(["auto", "manual"]);
-/**
-* Live navigation state so the UI can reflect what the robot is doing:
-*   - `mode`       — coarse activity (idle / cleaning / following / …).
-*   - `following`  — person/pet follow is currently armed.
-*   - `flash`      — the on-camera fill light is on.
-*   - `lightMode`  — auto vs manual fill-light mode.
-*   - `lightLevel` — manual fill-light level (40..100); meaningful when
-*                    `lightMode === 'manual'`.
-*/
-var NavigationStatusSchema = object({
-	mode: _enum([
-		"idle",
-		"cleaning",
-		"spot",
-		"following",
-		"goto",
-		"returning",
-		"paused",
-		"unknown"
-	]),
-	following: boolean(),
-	flash: boolean(),
-	lightMode: NavigationLightModeSchema,
-	lightLevel: number().min(40).max(100),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-NavigationStatusSchema.extend({ lastFetchedAt: number() });
-DeviceType.Camera, method(NavigationMoveCommandSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(NavigationPointSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(NavigationActionEntrySchema)), method(object({
-	deviceId: number(),
-	actionId: NavigationActionIdSchema
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	soundId: number().int()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	on: boolean()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	mode: NavigationLightModeSchema,
-	level: number().min(40).max(100).optional()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	level: number().min(40).max(100)
-}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), NavigationFeaturesSchema), object({
-	deviceId: number(),
-	status: NavigationStatusSchema
-});
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceId: number().int().nonnegative() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
@@ -29427,8 +29574,38 @@ var RecordingSignalStatusSchema = object({
 	/** Ms epoch of the last `active` transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-RecordingSignalStatusSchema.extend({ lastFetchedAt: number() });
-DeviceType.Camera, method(object({ deviceId: number() }), RecordingSignalStatusSchema);
+/** The runtime-state slice: the status plus the clock every slice carries. */
+var RecordingSignalRuntimeStateSchema = RecordingSignalStatusSchema.extend({ lastFetchedAt: number() });
+var recordingSignalCapability = {
+	name: "recording-signal",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: { 
+	/** The current level, straight from the slice the provider keeps fresh. */
+getStatus: method(object({ deviceId: number() }), RecordingSignalStatusSchema) },
+	status: {
+		schema: RecordingSignalStatusSchema,
+		kind: "push",
+		empty: {
+			active: false,
+			reason: "unknown",
+			lastChangedAt: 0
+		}
+	},
+	runtimeState: RecordingSignalRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `active: true` from
+	* before a restart is exactly the stale level the recorder's reconcile bound
+	* exists to end, and the provider re-derives the true level on activation
+	* anyway. Nothing is lost by forgetting it; a lie is avoided.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
 * a rect ROI on a camera frame and names one or more states; the engine
@@ -36139,6 +36316,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storage.listDrainProgress": {
+		capName: "storage",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storage.listLocationDeclarations": {
 		capName: "storage",
 		capScope: "system",
@@ -36283,6 +36466,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageOccupancy.getOccupancy": {
+		capName: "storage-occupancy",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageProvider.abortUpload": {
 		capName: "storage-provider",
 		capScope: "system",
@@ -39892,702 +40081,113 @@ function deviceBackendToFormat(backend) {
 	return DEVICE_BACKEND_TO_FORMAT[backend] ?? "onnx";
 }
 //#endregion
-//#region src/inference-device-model.ts
+//#region src/audio-chunk-poller.ts
 /**
-* Per-device default object-detection model + deviceKey parsing for the
-* orchestrator's device-aware `getNodeInferenceDevices` view.
+* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
+* plane (Phase 5 / D9).
 *
-* This DUPLICATES the executor's per-device model resolution (P0-3:
-* `resolveDeviceEngine` + `MODEL_BY_CLASS` + the object-detection step's
-* `defaultModelIdByFormat` in `@camstack/addon-pipeline`). It is duplicated —
-* not imported — because cross-addon imports are forbidden (the orchestrator
-* and the detection-pipeline are separate addons; only tRPC crosses the
-* boundary). Keep this in sync with `default-detection-model.ts` /
-* `step-definitions.ts` if the executor's defaults change.
+* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
+* path. A live callback cannot cross a process boundary; once the `pipeline`
+* group is dissolved (Task 8) the orchestrator runs in a different process
+* from the broker, so audio delivery must go over tRPC.
 *
-* The returned ids are honest catalog ids (verified present):
-*   - `yolov9m-320-int8` — Intel NPU + iGPU (yolo26 does NOT compile on the NPU)
-*   - `yolov9m-320`      — Apple ANE (CoreML)
-*   - `ssd-mobilenet-v2-coco-edgetpu` — Coral USB Edge TPU (tflite)
-*   - `yolo26n`          — CPU / CUDA (the object-detection step's universal
-*                          nano default)
+* The consumer:
 *
-* Do not promote the accelerated ids to 640. The evaluation in
-* `docs/benchmarks/pipeline-frame-model-eval.md` failed the 640 promotion
-* gates (0/3 miss recovered at the current threshold).
-*/
-/**
-* The always-on object-detection ROOT step id. A camera session's tracks all
-* originate from this detector, so a device whose engine format can't run it
-* cannot host a camera root. Mirrors the addon-pipeline step id (cross-addon
-* import is forbidden — this is the same duplication rationale as the model
-* defaults above).
-*/
-var OBJECT_DETECTION_STEP_ID = "object-detection";
-/**
-* Build the camera-root capability predicate for a node from its live catalog:
-* `format → canHostCameraRoot`. A format can host a camera root iff the
-* catalog lists at least one object-detection model with a build for that
-* format — byte-for-byte the resolver's per-device skip-gate test for the root
-* step (`addonHasCompatibleModel`), so a device is deemed eligible iff the root
-* would ACTUALLY provision on it.
+*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
+*      registers a per-subscription bounded FIFO queue and returns a
+*      `subscriptionId`;
+*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
+*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
+*   3. feeds each chunk to its downstream audio logic;
+*   4. on teardown, `unsubscribeAudioChunks`.
 *
-* Fails OPEN when the catalog has no object-detection slot at all (never
-* observed in production) so a malformed/empty catalog never strands every
-* device off the balancer. Pure + deterministic.
+* Audio is not latency-critical like video, and chunks arrive only ~every
+* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
+* a small per-poll burst keeps latency low without busy-spinning. The
+* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
+* loses a chunk.
+*
+* Boot-race tolerance: the broker for a given camStream may not be registered
+* yet when the orchestrator wires the subscription (provider addons publish
+* their cameraStreams asynchronously after their probe completes).
+* `subscribeAudioChunks` retries with exponential backoff (capped at
+* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
+* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
+* shape so video and audio plumbing self-heal identically.
 */
-function makeRootCapabilityGuard(catalog) {
-	for (const slot of catalog.slots) {
-		const objDet = slot.addons.find((a) => a.id === OBJECT_DETECTION_STEP_ID);
-		if (objDet) return (format) => objDet.models.some((m) => Boolean(m.formats[format]));
-	}
-	return () => true;
-}
-/** Split a deviceKey (`<backend>:<device>`, or bare `cpu`) into its parts + format.
-*  Format comes from the shared {@link deviceBackendToFormat} SSOT (`@camstack/types`)
-*  — the previously-local `BACKEND_FORMAT` copy is gone (R3/node-F2). Used only for
-*  STORED-ONLY keys (a configured device the live probe didn't return); a probed
-*  device carries its own honest `format` from the descriptor. */
-function parseDeviceKey(deviceKey) {
-	const colon = deviceKey.indexOf(":");
-	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
-	return {
-		backend,
-		device: colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey,
-		format: deviceBackendToFormat(backend)
-	};
-}
+/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
+var POLL_INTERVAL_MS$1 = 200;
+/** How many chunks to drain per poll — a small burst absorbs jitter. */
+var PULL_MAX_COUNT = 8;
 /**
-* The object-detection model the executor defaults to for a deviceKey. Mirrors
-* the executor's `MODEL_BY_CLASS` classification (`classifyAccelerator`) plus
-* the tflite `defaultModelIdByFormat` for Coral. Never throws; unknown backends
-* fall back to the universal nano default (`yolo26n`).
+* Consecutive pull failures before we attempt to re-subscribe. A single failed
+* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
+* sustained failure means the broker child restarted and dropped our
+* subscription, so we re-establish it.
 */
-function defaultModelIdForDevice(deviceKey) {
-	const { backend, device } = parseDeviceKey(deviceKey);
-	if (backend === "openvino") {
-		if (device === "cpu") return "yolo26n";
-		return "yolov9m-320-int8";
-	}
-	if (backend === "edgetpu") return "ssd-mobilenet-v2-coco-edgetpu";
-	if (backend === "coreml") return "yolov9m-320";
-	return "yolo26n";
-}
+var RESUBSCRIBE_AFTER_FAILURES = 2;
+/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
+var RESUBSCRIBE_THROTTLE_TICKS = 5;
+/** First subscribe-retry delay, doubled on every subsequent failure. */
+var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
 /**
-* Step-tree device jump (phase 1): validate every `steps[step].jumpDeviceKey`
-* manual override in a to-be-saved `inferenceDevices` map. A jump target MUST be
-* an enabled∧available device on the SAME node and DIFFERENT from the owning
-* device. `enabledAvailableKeys` is the effective enabled∧available set (from
-* `mergeInferenceDevices(probe, submitted)`) so an absent/unplugged/disabled
-* target is rejected honestly (an operator can't route a step onto a dead pool).
-* Returns the FIRST human-readable error, or `null` when every override is
-* valid. Pure + deterministic.
+* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
+* enough to recover within a single reconcile of the orchestrator and slow
+* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
 */
-function validateJumpTargets(inferenceDevices, enabledAvailableKeys) {
-	for (const [deviceKey, entry] of Object.entries(inferenceDevices)) for (const [stepId, step] of Object.entries(entry.steps ?? {})) {
-		const target = step.jumpDeviceKey;
-		if (target === void 0) continue;
-		if (target === deviceKey) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey pointing at its own device`;
-		if (!enabledAvailableKeys.has(target)) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey "${target}" that is not an enabled, available device on this node`;
-	}
-	return null;
-}
+var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
 /**
-* Merge a node's live-probed inference devices with its stored per-device map.
-*
-* The default is **AUTO = all discovered ACCELERATORS enabled** (spec C2,
-* opt-OUT) with TWO deliberate exceptions, both **opt-IN** (default disabled):
-*
-*   - **CPU**: `enumerateInferenceDevices` always emits a universal `cpu`
-*     floor on every platform; auto-enabling it would let the balancer
-*     round-robin ~1/N of sessions onto the slow CPU pool alongside the
-*     NPU/iGPU/ANE. CPU stays the always-available FALLBACK (a node with no
-*     eligible accelerator leaves `deviceKey` unset → the runner's default
-*     pool, which is CPU), not a balanced target — matching the spec's "no
-*     device eligible → fall back to CPU".
-*   - **Coral Edge TPU (`edgetpu`)**: the standing rule since the Coral
-*     executor landed is that it surfaces as selectable but is NEVER
-*     auto-picked — it runs a DIFFERENT, weaker model family (tflite SSD
-*     MobileNet, not the YOLO the other accelerators run), so silently
-*     enrolling a plugged-in Coral changes detection QUALITY, not just
-*     placement. The opt-OUT default did exactly that on 2026-08-01: a hub
-*     Coral nobody enabled entered the session rotation and camera 615 spent
-*     hours at 2.4fps failing tflite model resolution. An operator who wants
-*     the Coral balanced opts it in explicitly (`enabled: true`).
-*
-* So: an NPU/iGPU/ANE accelerator with NO stored entry is `enabled:true`; a
-* CPU or edgetpu device with no stored entry is `enabled:false`; an explicit
-* stored `enabled` always wins (an operator can opt CPU/Coral in, or an
-* accelerator out). A stored-only key (configured but the probe did not
-* return it — removed/unplugged HW) keeps its stored `enabled` and surfaces
-* as `available:false`, so the UI still shows it.
-*
-* Pure + deterministic (sorted by key) — the single merge authority shared by
-* the `getNodeInferenceDevices` view and the dispatcher's eligible-device pick.
+* Attempts after which a still-failing subscribe escalates from the fast 5 s
+* ceiling to {@link LONG_SUBSCRIBE_RETRY_BACKOFF_MS}. ~15 attempts ≈ one
+* minute of fast retries — plenty for the boot races the 5 s ceiling exists
+* for. A broker that is STILL absent after that is a long-lived condition
+* (e.g. a DISABLED camera, whose broker the stream-broker reconcile refuses
+* to recreate — 2026-07-23) and retrying every 5 s forever is pure log/RPC
+* churn. The slow loop stays alive so audio still recovers automatically
+* (≤60 s) once the camera is re-enabled.
 */
-function mergeInferenceDevices(probed, stored) {
-	const probedByKey = new Map(probed.map((d) => [d.key, d]));
-	const keys = new Set([...probedByKey.keys(), ...Object.keys(stored)]);
-	const out = [];
-	for (const key of Array.from(keys).toSorted()) {
-		const descriptor = probedByKey.get(key);
-		const opt = stored[key];
-		const parsed = descriptor ?? parseDeviceKey(key);
-		const weight = opt?.weight !== void 0 && opt.weight > 0 ? opt.weight : 1;
-		const autoDefault = parsed.backend !== "cpu" && parsed.backend !== "edgetpu";
-		out.push({
-			key,
-			backend: parsed.backend,
-			device: parsed.device,
-			format: parsed.format,
-			available: descriptor?.available ?? false,
-			enabled: opt?.enabled ?? autoDefault,
-			weight,
-			maxSessions: opt?.maxSessions ?? null,
-			defaultModelId: defaultModelIdForDevice(key),
-			...opt?.steps && Object.keys(opt.steps).length > 0 ? { steps: { ...opt.steps } } : {}
-		});
-	}
-	return out;
-}
+var PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS = 15;
+var LONG_SUBSCRIBE_RETRY_BACKOFF_MS = 6e4;
 /**
-* The per-device concurrent-session caps for a node as `deviceKey → maxSessions`
-* (only devices that carry an explicit cap; absent = unlimited). Fed to the
-* device balancer's `nodeCaps` so a device at its cap is skipped (audit F3).
+* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
+*
+* Always resolves to a teardown closure — when the broker is not yet
+* registered the closure cancels the ongoing retry loop; when polling is
+* active it stops the loop and releases the broker subscription. Mirrors
+* `startFrameHandlePoller` so video and audio recover identically.
 */
-function inferenceDeviceCaps(stored) {
-	const out = {};
-	for (const [key, entry] of Object.entries(stored)) if (entry.maxSessions !== void 0 && entry.maxSessions > 0) out[key] = entry.maxSessions;
-	return out;
-}
-/** Is this device the CPU fallback rather than a real accelerator? */
-function isCpuFallback(view) {
-	return view.backend === "cpu";
-}
-function resolveInferenceDeviceEligibility(probed, stored, canRunRoot, isPoolUsable) {
-	const eligible = {};
-	const excluded = [];
-	const merged = mergeInferenceDevices(probed, stored);
-	const acceleratorServes = merged.some((d) => !isCpuFallback(d) && d.enabled && d.available && (!canRunRoot || canRunRoot(d.format)));
-	for (const d of merged) {
-		if (!d.enabled) {
-			excluded.push({
-				key: d.key,
-				reason: "disabled",
-				format: d.format
-			});
-			continue;
-		}
-		if (!d.available) {
-			excluded.push({
-				key: d.key,
-				reason: "unavailable",
-				format: d.format
-			});
-			continue;
-		}
-		if (isPoolUsable && !isPoolUsable(d.key)) {
-			excluded.push({
-				key: d.key,
-				reason: "unavailable",
-				format: d.format
-			});
-			continue;
+function startAudioChunkPoller(options) {
+	const lifecycle = {
+		stopped: false,
+		retryTimer: void 0,
+		pollTimer: void 0,
+		activeSubscriptionId: null
+	};
+	const teardown = () => {
+		if (lifecycle.stopped) return;
+		lifecycle.stopped = true;
+		if (lifecycle.retryTimer) {
+			clearTimeout(lifecycle.retryTimer);
+			lifecycle.retryTimer = void 0;
 		}
-		if (canRunRoot && !canRunRoot(d.format)) {
-			excluded.push({
-				key: d.key,
-				reason: "cannot-host-camera-root",
-				format: d.format
-			});
-			continue;
+		if (lifecycle.pollTimer) {
+			clearTimeout(lifecycle.pollTimer);
+			lifecycle.pollTimer = void 0;
 		}
-		if (isCpuFallback(d) && acceleratorServes) {
-			excluded.push({
-				key: d.key,
-				reason: "accelerator-preferred",
-				format: d.format
+		const subId = lifecycle.activeSubscriptionId;
+		if (subId) {
+			lifecycle.activeSubscriptionId = null;
+			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
+				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
+					brokerId: options.brokerId,
+					subscriptionId: subId,
+					error: errMsg(err)
+				} });
 			});
-			continue;
 		}
-		eligible[d.key] = d.weight;
-	}
-	return {
-		eligible,
-		excluded
 	};
-}
-/**
-* Join the merged device rows with the eligibility verdict so the UI can NAME
-* why an accelerator is not in play instead of leaving the operator to deduce
-* it from `enabled`/`available`.
-*
-* Deduction is not possible for two of the four reasons — `accelerator-preferred`
-* is a node-WIDE rule (a CPU row reads `enabled:true, available:true` and still
-* never gets a session, D215) and `cannot-host-camera-root` needs the node's
-* model catalog. Both live in {@link resolveInferenceDeviceEligibility}, so this
-* function only transports its answer; it never re-derives one.
-*
-* Pure; preserves `merged`'s order (sorted by key) and every other field.
-*/
-function annotateInferenceDeviceExclusions(merged, eligibility) {
-	const reasonByKey = new Map(eligibility.excluded.map((e) => [e.key, e.reason]));
-	return merged.map((view) => ({
-		...view,
-		exclusion: reasonByKey.get(view.key) ?? null
-	}));
-}
-function resolveNodeInferenceUsability(eligibility) {
-	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
-	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
-	return {
-		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
-		unavailableKeys,
-		eligibleKeys
-	};
-}
-/**
-* Step-tree device jump (phase 1): the attach-payload roster of a node's
-* enabled∧available inference devices with the balancer knobs (`weight`,
-* `maxSessions`) the runner uses to AUTO-jump an enrichment step off a device
-* whose format can't run it. Built from the SAME `eligible` (deviceKey→weight)
-* and `caps` (deviceKey→maxSessions) the dispatcher already computes, so the
-* roster the runner sees exactly matches the balancer's candidate set. Sorted
-* by key for determinism. Populated onto `RunnerCameraConfig.inferenceDevices`
-* ONLY when a `deviceKey` is elected and there are ≥2 entries.
-*/
-function buildInferenceDeviceRoster(eligible, caps) {
-	return Object.entries(eligible).map(([deviceKey, weight]) => ({
-		deviceKey,
-		weight: weight > 0 ? weight : 1,
-		maxSessions: caps[deviceKey] ?? null
-	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
-}
-//#endregion
-//#region src/node-inference-usability-mirror.ts
-var NodeInferenceUsabilityMirror = class {
-	state = /* @__PURE__ */ new Map();
-	/**
-	* Fold one observation in and report whether the caller should act.
-	* Never throws.
-	*/
-	observe(nodeId, usable) {
-		const prev = this.state.get(nodeId);
-		if (usable) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: false
-			});
-			return prev !== void 0 && !prev.usable ? "recovered" : null;
-		}
-		if (prev === void 0) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: true
-			});
-			return null;
-		}
-		if (!prev.usable) {
-			this.state.set(nodeId, {
-				usable: false,
-				armed: true
-			});
-			return null;
-		}
-		if (!prev.armed) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: true
-			});
-			return null;
-		}
-		this.state.set(nodeId, {
-			usable: false,
-			armed: true
-		});
-		return "became-unusable";
-	}
-	/** Can this node be given cameras? Unknown nodes answer YES. */
-	isUsable(nodeId) {
-		return this.state.get(nodeId)?.usable ?? true;
-	}
-	/** Nodes currently excluded — for the placement log and diagnostics. */
-	unusableNodeIds() {
-		const out = [];
-		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
-		return out.toSorted();
-	}
-	forget(nodeId) {
-		this.state.delete(nodeId);
-	}
-	reset() {
-		this.state.clear();
-	}
-};
-//#endregion
-//#region src/inference-device-usability-mirror.ts
-/**
-* InferenceDeviceUsabilityMirror — "can this NODE's THIS DEVICE still infer?",
-* kept off the placement path.
-*
-* The per-`(nodeId, deviceKey)` twin of {@link NodeInferenceUsabilityMirror},
-* and deliberately not a second mechanism: it composes the key and delegates
-* every decision to that class, so the arm/apply reluctance D49 pinned lives in
-* exactly one implementation and cannot drift between the node tier and the
-* device tier.
-*
-* ## Why this tier had to exist
-*
-* The node tier already answers "does this node have ANY usable accelerator".
-* On 2026-08-25 the hub's answer was, correctly, yes — its NPU was healthy the
-* whole time. What died was one DEVICE, `openvino:gpu`, and nothing anywhere
-* asked that question: the per-dispatch capability gate is keyed on model
-* FORMAT and `openvino:gpu` and `openvino:npu` share the format `openvino`, so
-* it is blind between them by construction. The balancer kept rotating cameras
-* onto the dead pool — 20 sessions in 20 minutes, every one `tieBreak:
-* "rotation"` — for 31 hours.
-*
-* ## Why a mirror and not the event
-*
-* D49, verbatim: *a one-shot event never gates on a fallible read*. The gate is
-* this in-memory mirror, refreshed off the event path by the same
-* `resolveEligibleInferenceDevices` the dispatcher already runs (plus the
-* session controller's background refresher). The consequences that buys:
-*
-*  - **A read that fails changes nothing.** The caller folds in an observation
-*    only when it HAS one; an unreachable node, a version-skewed executor or a
-*    rejected RPC never reaches {@link observe}, so the previous verdict
-*    stands. This is the whole reason the health read is specified as
-*    "synchronous over in-memory state, never throws for its own reasons": an
-*    empty answer must mean *nothing is refused*, not *I could not tell*.
-*  - **Excluding a healthy device needs a second, consecutive read.** Exclusion
-*    is the direction that DESTROYS work — it strands an accelerator that may
-*    be perfectly fine — so one bad observation only ARMS.
-*  - **Re-admitting is immediate and unconditional.** One good observation puts
-*    the device straight back. Being slow to exclude costs some wasted
-*    inference attempts; being slow to re-admit costs an idle accelerator and a
-*    node that looks broken.
-*/
-/**
-* NUL — impossible in both a Moleculer node id and a `<backend>:<device>` key,
-* so the composite key can never be ambiguous. A separator that CAN occur in
-* either half makes two distinct pairs collide, and a collision here silently
-* excludes an accelerator nobody reported.
-*/
-var SEPARATOR = "\0";
-var InferenceDeviceUsabilityMirror = class {
-	/** The one implementation of the arm/apply state machine (D49). */
-	mirror = new NodeInferenceUsabilityMirror();
-	/**
-	* Fold one observation in and report whether the caller should act.
-	* Never throws.
-	*/
-	observe(nodeId, deviceKey, usable) {
-		return this.mirror.observe(`${nodeId}${SEPARATOR}${deviceKey}`, usable);
-	}
-	/** Can the balancer put a session on this device? Unknown pairs answer YES. */
-	isUsable(nodeId, deviceKey) {
-		return this.mirror.isUsable(`${nodeId}${SEPARATOR}${deviceKey}`);
-	}
-	/** Pairs currently excluded — for the placement log and diagnostics. */
-	unusableDevices() {
-		return this.mirror.unusableNodeIds().map((composite) => {
-			const at = composite.indexOf(SEPARATOR);
-			return {
-				nodeId: composite.slice(0, at),
-				deviceKey: composite.slice(at + 1)
-			};
-		});
-	}
-	/** The excluded device keys on ONE node. */
-	unusableDeviceKeys(nodeId) {
-		return this.unusableDevices().filter((d) => d.nodeId === nodeId).map((d) => d.deviceKey);
-	}
-	forget(nodeId, deviceKey) {
-		this.mirror.forget(`${nodeId}${SEPARATOR}${deviceKey}`);
-	}
-	reset() {
-		this.mirror.reset();
-	}
-};
-/**
-* Fold ONE node's health answer into the mirror and return what changed.
-*
-* This is the whole reading discipline, in one place, because both halves of it
-* are easy to get subtly wrong and neither failure is visible in a log:
-*
-*  - **`unhealthy === null` — the read FAILED — changes nothing.** Not a single
-*    entry is touched. An unreachable node, a version-skewed executor or a
-*    rejected RPC must be distinguishable from "asked, nothing is refused", or
-*    a flaky link silently re-admits a dead accelerator (D49).
-*  - **Every device the node HAS is observed**, not merely the refused ones.
-*    The first draft observed `refused ∪ already-excluded`, which omits exactly
-*    the devices the mirror has ARMED — so their disarming good read never
-*    arrived and two bad reads an HOUR apart, with a hundred healthy ones
-*    between them, excluded a working accelerator. "Consecutive" is only a
-*    property if the good observations are delivered.
-*
-* Pure with respect to everything except `mirror`, and never throws — it is
-* called from the dispatcher's own read path.
-*/
-function foldInferenceDeviceHealth(mirror, nodeId, unhealthy, present) {
-	if (unhealthy === null) return [];
-	const refused = new Set(unhealthy);
-	const observed = new Set([
-		...present,
-		...refused,
-		...mirror.unusableDeviceKeys(nodeId)
-	]);
-	const changes = [];
-	for (const deviceKey of observed) {
-		const transition = mirror.observe(nodeId, deviceKey, !refused.has(deviceKey));
-		if (transition !== null) changes.push({
-			deviceKey,
-			transition
-		});
-	}
-	return changes;
-}
-//#endregion
-//#region src/orchestrator-types.ts
-var PHASE_MODE_VALUES = new Set([
-	"disabled",
-	"always-on",
-	"on-motion"
-]);
-function isPipelinePhaseMode(v) {
-	return PHASE_MODE_VALUES.has(v);
-}
-/**
-* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
-* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
-* `reconcileDispatch` is additive-only and never revisits these, so a slow
-* safety-net timer + event-driven debounce triggers recover them.
-*/
-var PENDING_RETRY_INTERVAL_MS = 6e4;
-/** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
-var PENDING_RETRY_DEBOUNCE_MS = 2e3;
-/**
-* Periodic auto-rebalance sweep. New attaches are already load-balanced at
-* dispatch time; this corrects DRIFT that accumulates over time (uneven
-* detach, a node returning online, a weight change) so the steady-state
-* distribution tracks the per-node weights. Only runs with ≥2 enabled detect
-* nodes, and migrates under hysteresis so a balanced cluster is a no-op.
-*/
-var AUTO_REBALANCE_INTERVAL_MS = 6e4;
-/**
-* Hysteresis margin (weight-adjusted cameras) for the periodic auto-rebalance:
-* migrate a camera only when its target node is at least this much less loaded
-* than its current node. > 1 so equalizing a single-camera gap (which would
-* only reverse the imbalance) is skipped — prevents periodic churn.
-*/
-var AUTO_REBALANCE_MIN_IMPROVEMENT = 1.5;
-var REMOTE_HEALTH_WINDOW_MS = 60 * 6e4;
-/**
-* Device-details keys routed through the orchestrator's pipeline
-* settings writer instead of the device orchestration store. The
-* `cameraPipeline` key carries the full `CameraPipelineConfig`
-* emitted by the `pipeline-editor` ConfigField (Phase 6 Option B).
-*/
-var PIPELINE_PATCH_KEYS = ["cameraPipeline"];
-var DEFAULT_FAILOVER_POLICY = {
-	onDisconnect: "migrate",
-	pinnedOnDisconnect: "leave-pinned",
-	onReconnect: "restore"
-};
-/**
-* Custom-action catalog exposed through `api.addons.custom` (Task 9.1 PoC).
-*
-* The orchestrator's cap surface is the contract for all runtime traffic
-* (assignCamera / unassignCamera / rebalance / getGlobalMetrics etc). This
-* catalog is reserved for read-only diagnostics that are intentionally
-* outside the cap — they expose internal state (balancer caches, enabledNodes
-* set, active detection count) that is useful for admin tooling but does not
-* belong on the capability contract.
-*/
-var OrchestratorDiagnosticsSchema = object({
-	localNodeId: string(),
-	knownRunnerNodes: array(string()),
-	cachedAgentLoadNodeIds: array(string()),
-	enabledNodes: array(string()),
-	enabledDecoderNodes: array(string()),
-	enabledAudioNodes: array(string()),
-	enabledIngestNodes: array(string()),
-	clusterRoles: object({
-		ingestNode: string(),
-		audioNode: string(),
-		motionNode: string()
-	}),
-	assignedDeviceCount: number().int().min(0),
-	cameraConfigCount: number().int().min(0),
-	activeDetectionCount: number().int().min(0)
-});
-/**
-* The node-stress long-term-statistics read surface.
-*
-* A custom action rather than a cap method, matching how the orchestrator
-* already serves `dumpState`: this is a hub-local read over a table the hub
-* owns, and it ships with one `camstack deploy` instead of a release train.
-* The MEAN is derived here and returned alongside the addable `sum`/`samples`
-* — a chart wants the first, a re-bucketing caller wants the second, and a
-* stored mean is a field that can disagree with both.
-*/
-var NodeStressStatsInputSchema = object({
-	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
-	series: string().optional(),
-	/** A node id. Omit for every node. */
-	subject: string().optional(),
-	/** Inclusive bucket-start bounds, ms. */
-	from: number().int().optional(),
-	to: number().int().optional(),
-	limit: number().int().positive().max(5e3).optional()
-});
-var NodeStressStatsRowSchema = object({
-	subject: string(),
-	series: string(),
-	scope: string(),
-	bucketStart: number(),
-	samples: number(),
-	sum: number(),
-	mean: number(),
-	min: number(),
-	max: number()
-});
-var NodeStressStatsOutputSchema = object({
-	rows: array(NodeStressStatsRowSchema).readonly(),
-	/** Buckets still accumulating — "is it running" answerable at once, rather
-	*  than after five minutes of indistinguishable silence. */
-	open: array(NodeStressStatsRowSchema).readonly(),
-	/** The durable failover history the anti-flap guards read, newest first.
-	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
-	*  be distinguishable from "nothing is watching". */
-	moves: array(object({
-		deviceId: number(),
-		fromNodeId: string(),
-		at: number()
-	})).readonly()
-});
-var pipelineOrchestratorActions = defineCustomActions({
-	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
-	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
-});
-/**
-* Sentinel returned by `buildDetectionConfig` when the profile-slot READ
-* itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
-* while the stream-broker is (re)starting) — as opposed to `null`, which
-* means "genuinely no assigned slot / not configured". Callers MUST treat
-* this differently from `null`: never stop active detection on a transient
-* read failure (the slots almost certainly still exist), and schedule a retry.
-*/
-var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
-//#endregion
-//#region src/audio-chunk-poller.ts
-/**
-* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
-* plane (Phase 5 / D9).
-*
-* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
-* path. A live callback cannot cross a process boundary; once the `pipeline`
-* group is dissolved (Task 8) the orchestrator runs in a different process
-* from the broker, so audio delivery must go over tRPC.
-*
-* The consumer:
-*
-*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
-*      registers a per-subscription bounded FIFO queue and returns a
-*      `subscriptionId`;
-*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
-*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
-*   3. feeds each chunk to its downstream audio logic;
-*   4. on teardown, `unsubscribeAudioChunks`.
-*
-* Audio is not latency-critical like video, and chunks arrive only ~every
-* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
-* a small per-poll burst keeps latency low without busy-spinning. The
-* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
-* loses a chunk.
-*
-* Boot-race tolerance: the broker for a given camStream may not be registered
-* yet when the orchestrator wires the subscription (provider addons publish
-* their cameraStreams asynchronously after their probe completes).
-* `subscribeAudioChunks` retries with exponential backoff (capped at
-* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
-* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
-* shape so video and audio plumbing self-heal identically.
-*/
-/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
-var POLL_INTERVAL_MS$1 = 200;
-/** How many chunks to drain per poll — a small burst absorbs jitter. */
-var PULL_MAX_COUNT = 8;
-/**
-* Consecutive pull failures before we attempt to re-subscribe. A single failed
-* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
-* sustained failure means the broker child restarted and dropped our
-* subscription, so we re-establish it.
-*/
-var RESUBSCRIBE_AFTER_FAILURES = 2;
-/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
-var RESUBSCRIBE_THROTTLE_TICKS = 5;
-/** First subscribe-retry delay, doubled on every subsequent failure. */
-var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
-/**
-* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
-* enough to recover within a single reconcile of the orchestrator and slow
-* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
-*/
-var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
-/**
-* Attempts after which a still-failing subscribe escalates from the fast 5 s
-* ceiling to {@link LONG_SUBSCRIBE_RETRY_BACKOFF_MS}. ~15 attempts ≈ one
-* minute of fast retries — plenty for the boot races the 5 s ceiling exists
-* for. A broker that is STILL absent after that is a long-lived condition
-* (e.g. a DISABLED camera, whose broker the stream-broker reconcile refuses
-* to recreate — 2026-07-23) and retrying every 5 s forever is pure log/RPC
-* churn. The slow loop stays alive so audio still recovers automatically
-* (≤60 s) once the camera is re-enabled.
-*/
-var PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS = 15;
-var LONG_SUBSCRIBE_RETRY_BACKOFF_MS = 6e4;
-/**
-* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
-*
-* Always resolves to a teardown closure — when the broker is not yet
-* registered the closure cancels the ongoing retry loop; when polling is
-* active it stops the loop and releases the broker subscription. Mirrors
-* `startFrameHandlePoller` so video and audio recover identically.
-*/
-function startAudioChunkPoller(options) {
-	const lifecycle = {
-		stopped: false,
-		retryTimer: void 0,
-		pollTimer: void 0,
-		activeSubscriptionId: null
-	};
-	const teardown = () => {
-		if (lifecycle.stopped) return;
-		lifecycle.stopped = true;
-		if (lifecycle.retryTimer) {
-			clearTimeout(lifecycle.retryTimer);
-			lifecycle.retryTimer = void 0;
-		}
-		if (lifecycle.pollTimer) {
-			clearTimeout(lifecycle.pollTimer);
-			lifecycle.pollTimer = void 0;
-		}
-		const subId = lifecycle.activeSubscriptionId;
-		if (subId) {
-			lifecycle.activeSubscriptionId = null;
-			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
-				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
-					brokerId: options.brokerId,
-					subscriptionId: subId,
-					error: errMsg(err)
-				} });
-			});
-		}
-	};
-	subscribeWithRetry(options, lifecycle);
-	return teardown;
+	subscribeWithRetry(options, lifecycle);
+	return teardown;
 }
 /**
 * Run the subscribe → poll handshake with exponential backoff on subscribe
@@ -40739,47 +40339,179 @@ function balanceAudio(input) {
 	};
 }
 //#endregion
-//#region src/audio-window-accumulator.ts
-var AudioWindowAccumulator = class {
-	deviceId;
-	pcmParts = [];
-	accumulatedBytes = 0;
-	accumulatedMs = 0;
-	windowSampleRate = 0;
-	windowChannels = 0;
-	windowTimestamp = 0;
-	windowOpen = false;
-	constructor(deviceId) {
-		this.deviceId = deviceId;
-	}
-	/**
-	* Append one decoded PCM chunk to the open window. Returns the flushed
-	* `AudioChunkInput` once the accumulated duration reaches
-	* `AUDIO_WINDOW_TARGET_MS` (and resets for the next window), else `null`
-	* (accumulate-only, no flush yet).
-	*/
-	push(chunk) {
-		const byteLength = chunk.data.byteLength;
-		const bytes = new Uint8Array(byteLength);
-		bytes.set(new Uint8Array(chunk.data.buffer, chunk.data.byteOffset, byteLength));
-		if (!this.windowOpen) {
-			this.windowSampleRate = chunk.sampleRate;
-			this.windowChannels = chunk.channels;
-			this.windowTimestamp = chunk.timestamp;
-			this.windowOpen = true;
-		}
-		this.pcmParts.push(bytes);
-		this.accumulatedBytes += byteLength;
-		const channels = chunk.channels > 0 ? chunk.channels : 1;
-		const framesPerChannel = byteLength / 4 / channels;
-		this.accumulatedMs += framesPerChannel / chunk.sampleRate * 1e3;
-		if (this.accumulatedMs < 1e3) return null;
-		const windowData = new Uint8Array(this.accumulatedBytes);
-		let offset = 0;
-		for (const part of this.pcmParts) {
-			windowData.set(part, offset);
-			offset += part.byteLength;
-		}
+//#region src/orchestrator-types.ts
+var PHASE_MODE_VALUES = new Set([
+	"disabled",
+	"always-on",
+	"on-motion"
+]);
+function isPipelinePhaseMode(v) {
+	return PHASE_MODE_VALUES.has(v);
+}
+/**
+* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
+* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
+* `reconcileDispatch` is additive-only and never revisits these, so a slow
+* safety-net timer + event-driven debounce triggers recover them.
+*/
+var PENDING_RETRY_INTERVAL_MS = 6e4;
+/** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
+var PENDING_RETRY_DEBOUNCE_MS = 2e3;
+/**
+* Periodic auto-rebalance sweep. New attaches are already load-balanced at
+* dispatch time; this corrects DRIFT that accumulates over time (uneven
+* detach, a node returning online, a weight change) so the steady-state
+* distribution tracks the per-node weights. Only runs with ≥2 enabled detect
+* nodes, and migrates under hysteresis so a balanced cluster is a no-op.
+*/
+var AUTO_REBALANCE_INTERVAL_MS = 6e4;
+/**
+* Hysteresis margin (weight-adjusted cameras) for the periodic auto-rebalance:
+* migrate a camera only when its target node is at least this much less loaded
+* than its current node. > 1 so equalizing a single-camera gap (which would
+* only reverse the imbalance) is skipped — prevents periodic churn.
+*/
+var AUTO_REBALANCE_MIN_IMPROVEMENT = 1.5;
+var REMOTE_HEALTH_WINDOW_MS = 60 * 6e4;
+/**
+* Device-details keys routed through the orchestrator's pipeline
+* settings writer instead of the device orchestration store. The
+* `cameraPipeline` key carries the full `CameraPipelineConfig`
+* emitted by the `pipeline-editor` ConfigField (Phase 6 Option B).
+*/
+var PIPELINE_PATCH_KEYS = ["cameraPipeline"];
+var DEFAULT_FAILOVER_POLICY = {
+	onDisconnect: "migrate",
+	pinnedOnDisconnect: "leave-pinned",
+	onReconnect: "restore"
+};
+/**
+* Custom-action catalog exposed through `api.addons.custom` (Task 9.1 PoC).
+*
+* The orchestrator's cap surface is the contract for all runtime traffic
+* (assignCamera / unassignCamera / rebalance / getGlobalMetrics etc). This
+* catalog is reserved for read-only diagnostics that are intentionally
+* outside the cap — they expose internal state (balancer caches, enabledNodes
+* set, active detection count) that is useful for admin tooling but does not
+* belong on the capability contract.
+*/
+var OrchestratorDiagnosticsSchema = object({
+	localNodeId: string(),
+	knownRunnerNodes: array(string()),
+	cachedAgentLoadNodeIds: array(string()),
+	enabledNodes: array(string()),
+	enabledDecoderNodes: array(string()),
+	enabledAudioNodes: array(string()),
+	enabledIngestNodes: array(string()),
+	clusterRoles: object({
+		ingestNode: string(),
+		audioNode: string(),
+		motionNode: string()
+	}),
+	assignedDeviceCount: number().int().min(0),
+	cameraConfigCount: number().int().min(0),
+	activeDetectionCount: number().int().min(0)
+});
+/**
+* The node-stress long-term-statistics read surface.
+*
+* A custom action rather than a cap method, matching how the orchestrator
+* already serves `dumpState`: this is a hub-local read over a table the hub
+* owns, and it ships with one `camstack deploy` instead of a release train.
+* The MEAN is derived here and returned alongside the addable `sum`/`samples`
+* — a chart wants the first, a re-bucketing caller wants the second, and a
+* stored mean is a field that can disagree with both.
+*/
+var NodeStressStatsInputSchema = object({
+	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
+	series: string().optional(),
+	/** A node id. Omit for every node. */
+	subject: string().optional(),
+	/** Inclusive bucket-start bounds, ms. */
+	from: number().int().optional(),
+	to: number().int().optional(),
+	limit: number().int().positive().max(5e3).optional()
+});
+var NodeStressStatsRowSchema = object({
+	subject: string(),
+	series: string(),
+	scope: string(),
+	bucketStart: number(),
+	samples: number(),
+	sum: number(),
+	mean: number(),
+	min: number(),
+	max: number()
+});
+var NodeStressStatsOutputSchema = object({
+	rows: array(NodeStressStatsRowSchema).readonly(),
+	/** Buckets still accumulating — "is it running" answerable at once, rather
+	*  than after five minutes of indistinguishable silence. */
+	open: array(NodeStressStatsRowSchema).readonly(),
+	/** The durable failover history the anti-flap guards read, newest first.
+	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
+	*  be distinguishable from "nothing is watching". */
+	moves: array(object({
+		deviceId: number(),
+		fromNodeId: string(),
+		at: number()
+	})).readonly()
+});
+var pipelineOrchestratorActions = defineCustomActions({
+	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
+	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
+});
+/**
+* Sentinel returned by `buildDetectionConfig` when the profile-slot READ
+* itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
+* while the stream-broker is (re)starting) — as opposed to `null`, which
+* means "genuinely no assigned slot / not configured". Callers MUST treat
+* this differently from `null`: never stop active detection on a transient
+* read failure (the slots almost certainly still exist), and schedule a retry.
+*/
+var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
+//#endregion
+//#region src/audio-window-accumulator.ts
+var AudioWindowAccumulator = class {
+	deviceId;
+	pcmParts = [];
+	accumulatedBytes = 0;
+	accumulatedMs = 0;
+	windowSampleRate = 0;
+	windowChannels = 0;
+	windowTimestamp = 0;
+	windowOpen = false;
+	constructor(deviceId) {
+		this.deviceId = deviceId;
+	}
+	/**
+	* Append one decoded PCM chunk to the open window. Returns the flushed
+	* `AudioChunkInput` once the accumulated duration reaches
+	* `AUDIO_WINDOW_TARGET_MS` (and resets for the next window), else `null`
+	* (accumulate-only, no flush yet).
+	*/
+	push(chunk) {
+		const byteLength = chunk.data.byteLength;
+		const bytes = new Uint8Array(byteLength);
+		bytes.set(new Uint8Array(chunk.data.buffer, chunk.data.byteOffset, byteLength));
+		if (!this.windowOpen) {
+			this.windowSampleRate = chunk.sampleRate;
+			this.windowChannels = chunk.channels;
+			this.windowTimestamp = chunk.timestamp;
+			this.windowOpen = true;
+		}
+		this.pcmParts.push(bytes);
+		this.accumulatedBytes += byteLength;
+		const channels = chunk.channels > 0 ? chunk.channels : 1;
+		const framesPerChannel = byteLength / 4 / channels;
+		this.accumulatedMs += framesPerChannel / chunk.sampleRate * 1e3;
+		if (this.accumulatedMs < 1e3) return null;
+		const windowData = new Uint8Array(this.accumulatedBytes);
+		let offset = 0;
+		for (const part of this.pcmParts) {
+			windowData.set(part, offset);
+			offset += part.byteLength;
+		}
 		const flushSampleRate = this.windowSampleRate;
 		const flushChannels = this.windowChannels;
 		const flushTimestamp = this.windowTimestamp;
@@ -41242,234 +40974,847 @@ var AudioSubscriptionController = class {
 					meta: { error: errMsg(err) }
 				});
 			});
-		}, windowMs);
-		this.motionAudioWindowTimers.set(deviceId, timer);
-	}
-	/** True while a motion-driven audio window is open for this device. */
-	isMotionAudioWindowOpen(deviceId) {
-		return this.motionAudioWindowTimers.has(deviceId);
-	}
-	/**
-	* Close an on-motion audio window and drop its subscription. Shared by both
-	* closers (quiet window elapsed / falling edge cooldown) so they can never
-	* disagree about what "closed" means. `reason` is logged so a camera that
-	* loses audio can always be told WHY from the per-device log view.
-	*/
-	async closeMotionAudioWindow(deviceId, reason) {
-		const pendingWindow = this.motionAudioWindowTimers.get(deviceId);
-		if (pendingWindow) {
-			clearTimeout(pendingWindow);
-			this.motionAudioWindowTimers.delete(deviceId);
+		}, windowMs);
+		this.motionAudioWindowTimers.set(deviceId, timer);
+	}
+	/** True while a motion-driven audio window is open for this device. */
+	isMotionAudioWindowOpen(deviceId) {
+		return this.motionAudioWindowTimers.has(deviceId);
+	}
+	/**
+	* Close an on-motion audio window and drop its subscription. Shared by both
+	* closers (quiet window elapsed / falling edge cooldown) so they can never
+	* disagree about what "closed" means. `reason` is logged so a camera that
+	* loses audio can always be told WHY from the per-device log view.
+	*/
+	async closeMotionAudioWindow(deviceId, reason) {
+		const pendingWindow = this.motionAudioWindowTimers.get(deviceId);
+		if (pendingWindow) {
+			clearTimeout(pendingWindow);
+			this.motionAudioWindowTimers.delete(deviceId);
+		}
+		await this.withAudioSubLock(deviceId, async () => {
+			const unsub = this.audioSubscriptions.get(deviceId);
+			if (!unsub) return;
+			try {
+				unsub();
+			} catch {}
+			this.audioSubscriptions.delete(deviceId);
+			this.deps.logger.info("lazy audio: window closed", {
+				tags: { deviceId },
+				meta: { reason }
+			});
+		});
+	}
+	/**
+	* Audio teardown for one device — the audio half of `stopDetection`.
+	* Tears down through the per-device lock so it can't race a concurrent
+	* subscribe (which would re-store a handle this teardown never sees).
+	*/
+	async stopForDevice(deviceId) {
+		await this.withAudioSubLock(deviceId, async () => {
+			const unsub = this.audioSubscriptions.get(deviceId);
+			if (unsub) {
+				try {
+					unsub();
+				} catch {}
+				this.audioSubscriptions.delete(deviceId);
+			}
+		});
+		const lazyTimer = this.lazyAudioTeardownTimers.get(deviceId);
+		if (lazyTimer) {
+			clearTimeout(lazyTimer);
+			this.lazyAudioTeardownTimers.delete(deviceId);
+		}
+		const windowTimer = this.motionAudioWindowTimers.get(deviceId);
+		if (windowTimer) {
+			clearTimeout(windowTimer);
+			this.motionAudioWindowTimers.delete(deviceId);
+		}
+		this.audioAssignments.delete(deviceId);
+	}
+	/**
+	* Centralized write into `audioSubscriptions`. If shutdown has begun, the
+	* map has already been (or is about to be) cleared lock-free in
+	* `shutdown()`; storing here would leak a zombie entry whose `unsub` is
+	* never called. So when shutting down we immediately invoke `unsub`
+	* (best-effort, error-swallowed) and DO NOT store. `protected` so
+	* `audio-sub-lock.spec.ts`'s test subclass can assert the shutdown-guard
+	* behavior without casts.
+	*/
+	storeAudioSub(deviceId, unsub) {
+		if (this.audioShuttingDown) {
+			try {
+				unsub();
+			} catch {}
+			return;
+		}
+		this.audioSubscriptions.set(deviceId, unsub);
+	}
+	/**
+	* Serialize an audio-subscription critical section per device. `fn` is
+	* chained onto the device's current lock tail, so concurrent calls for the
+	* SAME deviceId run sequentially (FIFO); different deviceIds never block
+	* each other. Thin delegate onto the `audioSubLocks` `KeyedAsyncLock`
+	* instance. `protected` so `audio-sub-lock.spec.ts`'s test subclass can
+	* drive the lock without casts.
+	*/
+	withAudioSubLock(deviceId, fn) {
+		return this.audioSubLocks.run(deviceId, fn);
+	}
+	/**
+	* Subscribe to decoded audio chunks for a camera and feed them into the
+	* audio-analyzer. Reads the analyzer's settings via its own
+	* `resolveDeviceSettings(deviceId)` method so the orchestrator does not
+	* touch the audio-analyzer schema field names directly.
+	*/
+	async subscribeAudioStream(deviceId, config) {
+		const api = this.deps.api();
+		if (!api) {
+			this.deps.logger.warn("this.ctx.api not available — cannot subscribe audio", { tags: { deviceId } });
+			return null;
+		}
+		if (!await this.deps.isAudioAnalysisActive(deviceId)) return null;
+		if (config.audioMode === "disabled") {
+			this.deps.logger.debug("audio subscribe skipped: audioMode=disabled", { tags: { deviceId } });
+			return null;
+		}
+		if (config.audioMode === "on-motion" && !this.isMotionAudioWindowOpen(deviceId)) {
+			this.deps.logger.info("audio subscribe deferred: audioMode=on-motion, no window open", { tags: { deviceId } });
+			return null;
+		}
+		const audioStream = config.audioStreamId ?? config.motionStreamId;
+		const audioBrokerId = makeSourceBrokerId(deviceId, audioStream);
+		if ((await this.deps.probeAudioTrack(deviceId, audioStream)).kind === "absent") {
+			this.deps.logger.warn("audio subscription REFUSED — this stream carries no audio track", {
+				tags: { deviceId },
+				meta: {
+					camStreamId: audioStream,
+					brokerId: audioBrokerId,
+					selectedBy: config.audioStreamId !== void 0 ? "audioStreamId" : "motionStreamId",
+					hint: "point the camera’s audio at a stream that has an audio track — no stream is substituted automatically"
+				}
+			});
+			return null;
+		}
+		const settings = await api.audioAnalysis.resolveDeviceSettings.query({ deviceId });
+		if (!settings) {
+			this.deps.logger.warn("audio-analysis returned no settings — audio subscription skipped", { tags: { deviceId } });
+			return null;
+		}
+		const audioNodeId = await this.dispatch(deviceId);
+		const isRemoteAudio = audioNodeId !== this.deps.localNodeId();
+		this.deps.logger.info("audio subscription: resolved audio node", {
+			tags: { deviceId },
+			meta: {
+				audioNodeId,
+				isRemote: isRemoteAudio
+			}
+		});
+		const accumulator = new AudioWindowAccumulator(deviceId);
+		const teardown = startAudioChunkPoller({
+			api,
+			brokerId: audioBrokerId,
+			tag: "audio-analyzer",
+			ownerNodeId: this.deps.ingestNode(),
+			logger: this.deps.logger.withTags({ deviceId }),
+			onChunk: async (chunk) => {
+				this.deps.watchdogNote(deviceId, "audio");
+				try {
+					const audioChunkInput = accumulator.push(chunk);
+					if (!audioChunkInput) return;
+					const result = await api.audioAnalyzer.analyseChunk.mutate({
+						chunk: audioChunkInput,
+						settings,
+						...isRemoteAudio ? { nodeId: audioNodeId } : {}
+					});
+					if (!result) return;
+					const frame = buildAudioResultFrame(deviceId, result);
+					this.deps.eventBus.emit({
+						id: `audio-inference-${deviceId}-${Date.now()}`,
+						timestamp: /* @__PURE__ */ new Date(),
+						source: {
+							type: "device",
+							id: deviceId,
+							nodeId: "hub",
+							addonId: "pipeline-orchestrator",
+							deviceId
+						},
+						category: EventCategory.PipelineAudioInferenceResult,
+						data: {
+							deviceId,
+							frame,
+							nodeId: "hub"
+						}
+					});
+				} catch (err) {
+					const msg = errMsg(err);
+					this.deps.logger.error("Audio analysis failed", {
+						tags: { deviceId },
+						meta: { error: msg }
+					});
+				}
+			}
+		});
+		this.deps.logger.info("Audio stream subscribed", { tags: { deviceId } });
+		return () => {
+			teardown();
+			accumulator.reset();
+		};
+	}
+	/**
+	* Set true at the very start of `onShutdown`, before the audio teardown /
+	* map clears below. Once set, `withAudioSubLock` turns queued/new critical
+	* sections into no-ops and `storeAudioSub` refuses to store, so no
+	* critical section that was in-flight (or queued) when shutdown began can
+	* resurrect a zombie subscription into the cleared `audioSubscriptions`
+	* map. MUST be called before anything else in `onShutdown` that could
+	* race a queued audio critical section (mirrors the original
+	* `this.audioShuttingDown = true` being the very first statement).
+	*/
+	beginShutdown() {
+		this.audioShuttingDown = true;
+	}
+	/**
+	* Full audio teardown — combines the former `onShutdown`'s two separate
+	* audio blocks (lazy-teardown-timer clear, then — after several unrelated
+	* session/reconcile/load-shed clears — subscription teardown + lock clear
+	* + assignment-map clears) into one call. Safe to combine: both blocks
+	* are synchronous with no interleaved `await`, and every original
+	* statement between them (`sessionRegistry.clear()`,
+	* `cameraFpsMap.clear()`, `remoteHealthAttempts.clear()`,
+	* `loadShedState.clear()`, `loadShedResumeTimer` cleanup) touches state
+	* fully disjoint from anything audio — so their relative order to each
+	* other is unaffected, and the audio-internal order (timers →
+	* subscriptions → lock → assignment maps) is reproduced exactly.
+	*/
+	shutdown() {
+		for (const t of this.lazyAudioTeardownTimers.values()) clearTimeout(t);
+		this.lazyAudioTeardownTimers.clear();
+		for (const t of this.motionAudioWindowTimers.values()) clearTimeout(t);
+		this.motionAudioWindowTimers.clear();
+		for (const unsub of this.audioSubscriptions.values()) try {
+			unsub();
+		} catch {}
+		this.audioSubscriptions.clear();
+		this.audioSubLocks.clear();
+		this.audioAssignments.clear();
+		this.readyAudioNodes.clear();
+	}
+};
+//#endregion
+//#region src/disk-reconcile-fleet.ts
+async function reconcileFleetFromDisk(deps) {
+	const deviceIds = await deps.listDeviceIds();
+	const failed = [];
+	let cameras = 0;
+	let mediaDropped = 0;
+	let tracks = 0;
+	let events = 0;
+	let completed = 0;
+	for (const deviceId of deviceIds) {
+		try {
+			await deps.rescanRecordings(deviceId);
+			const counts = await deps.reconcileAnalytics(deviceId);
+			cameras += 1;
+			mediaDropped += counts.mediaDropped;
+			tracks += counts.tracks;
+			events += counts.events;
+		} catch {
+			failed.push(deviceId);
+		}
+		completed += 1;
+		deps.onProgress?.({
+			deviceId,
+			total: deviceIds.length,
+			completed,
+			failed: [...failed],
+			mediaDropped,
+			tracks,
+			events
+		});
+	}
+	return {
+		cameras,
+		failed,
+		mediaDropped,
+		tracks,
+		events
+	};
+}
+//#endregion
+//#region src/disk-reconcile-job.ts
+/**
+* In-memory disk-wins fleet job. The tRPC mutation starts this and returns
+* immediately; the walk runs in the addon process so a 60s UDS timeout cannot
+* abort it. Status is polled via getReconcileFromDiskStatus.
+*/
+function idleDiskReconcileJob() {
+	return {
+		state: "idle",
+		total: 0,
+		completed: 0,
+		currentDeviceId: null,
+		failed: [],
+		mediaDropped: 0,
+		tracks: 0,
+		events: 0,
+		startedAtMs: null,
+		finishedAtMs: null,
+		error: null
+	};
+}
+function isTimeoutError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	return /timed out/i.test(message);
+}
+async function withTimeoutRetry(run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (!isTimeoutError(err)) throw err;
+		return await run();
+	}
+}
+function createDiskReconcileJobRunner(now = Date.now) {
+	let job = idleDiskReconcileJob();
+	let inFlight = null;
+	const snapshot = () => job;
+	const start = (deps) => {
+		if (job.state === "running" && inFlight) return job;
+		job = {
+			...idleDiskReconcileJob(),
+			state: "running",
+			startedAtMs: now()
+		};
+		deps.log?.("pipeline disk reconcile started");
+		inFlight = (async () => {
+			try {
+				const result = await reconcileFleetFromDisk({
+					listDeviceIds: deps.listDeviceIds,
+					rescanRecordings: (deviceId) => withTimeoutRetry(() => deps.rescanRecordings(deviceId)),
+					reconcileAnalytics: (deviceId) => withTimeoutRetry(() => deps.reconcileAnalytics(deviceId)),
+					onProgress: (update) => {
+						job = {
+							...job,
+							total: update.total,
+							completed: update.completed,
+							currentDeviceId: update.deviceId,
+							failed: update.failed,
+							mediaDropped: update.mediaDropped,
+							tracks: update.tracks,
+							events: update.events
+						};
+						deps.onProgress?.(update);
+						deps.log?.("pipeline disk reconcile camera", {
+							deviceId: update.deviceId,
+							completed: update.completed,
+							total: update.total,
+							failed: update.failed.length,
+							mediaDropped: update.mediaDropped,
+							tracks: update.tracks,
+							events: update.events
+						});
+					}
+				});
+				job = {
+					...job,
+					state: "done",
+					total: result.cameras + result.failed.length,
+					completed: result.cameras + result.failed.length,
+					currentDeviceId: null,
+					failed: result.failed,
+					mediaDropped: result.mediaDropped,
+					tracks: result.tracks,
+					events: result.events,
+					finishedAtMs: now(),
+					error: null
+				};
+				deps.log?.("pipeline disk reconcile", {
+					cameras: result.cameras,
+					failed: result.failed,
+					mediaDropped: result.mediaDropped,
+					tracks: result.tracks,
+					events: result.events
+				});
+			} catch (err) {
+				const error = err instanceof Error ? err.message : String(err);
+				job = {
+					...job,
+					state: "error",
+					currentDeviceId: null,
+					finishedAtMs: now(),
+					error
+				};
+				deps.log?.("pipeline disk reconcile failed", { error });
+			} finally {
+				inFlight = null;
+			}
+		})();
+		return job;
+	};
+	return {
+		snapshot,
+		start
+	};
+}
+//#endregion
+//#region src/inference-device-model.ts
+/**
+* Per-device default object-detection model + deviceKey parsing for the
+* orchestrator's device-aware `getNodeInferenceDevices` view.
+*
+* This DUPLICATES the executor's per-device model resolution (P0-3:
+* `resolveDeviceEngine` + `MODEL_BY_CLASS` + the object-detection step's
+* `defaultModelIdByFormat` in `@camstack/addon-pipeline`). It is duplicated —
+* not imported — because cross-addon imports are forbidden (the orchestrator
+* and the detection-pipeline are separate addons; only tRPC crosses the
+* boundary). Keep this in sync with `default-detection-model.ts` /
+* `step-definitions.ts` if the executor's defaults change.
+*
+* The returned ids are honest catalog ids (verified present):
+*   - `yolov9m-320-int8` — Intel NPU + iGPU (yolo26 does NOT compile on the NPU)
+*   - `yolov9m-320`      — Apple ANE (CoreML)
+*   - `ssd-mobilenet-v2-coco-edgetpu` — Coral USB Edge TPU (tflite)
+*   - `yolo26n`          — CPU / CUDA (the object-detection step's universal
+*                          nano default)
+*
+* Do not promote the accelerated ids to 640. The evaluation in
+* `docs/benchmarks/pipeline-frame-model-eval.md` failed the 640 promotion
+* gates (0/3 miss recovered at the current threshold).
+*/
+/**
+* The always-on object-detection ROOT step id. A camera session's tracks all
+* originate from this detector, so a device whose engine format can't run it
+* cannot host a camera root. Mirrors the addon-pipeline step id (cross-addon
+* import is forbidden — this is the same duplication rationale as the model
+* defaults above).
+*/
+var OBJECT_DETECTION_STEP_ID = "object-detection";
+/**
+* Build the camera-root capability predicate for a node from its live catalog:
+* `format → canHostCameraRoot`. A format can host a camera root iff the
+* catalog lists at least one object-detection model with a build for that
+* format — byte-for-byte the resolver's per-device skip-gate test for the root
+* step (`addonHasCompatibleModel`), so a device is deemed eligible iff the root
+* would ACTUALLY provision on it.
+*
+* Fails OPEN when the catalog has no object-detection slot at all (never
+* observed in production) so a malformed/empty catalog never strands every
+* device off the balancer. Pure + deterministic.
+*/
+function makeRootCapabilityGuard(catalog) {
+	for (const slot of catalog.slots) {
+		const objDet = slot.addons.find((a) => a.id === OBJECT_DETECTION_STEP_ID);
+		if (objDet) return (format) => objDet.models.some((m) => Boolean(m.formats[format]));
+	}
+	return () => true;
+}
+/** Split a deviceKey (`<backend>:<device>`, or bare `cpu`) into its parts + format.
+*  Format comes from the shared {@link deviceBackendToFormat} SSOT (`@camstack/types`)
+*  — the previously-local `BACKEND_FORMAT` copy is gone (R3/node-F2). Used only for
+*  STORED-ONLY keys (a configured device the live probe didn't return); a probed
+*  device carries its own honest `format` from the descriptor. */
+function parseDeviceKey(deviceKey) {
+	const colon = deviceKey.indexOf(":");
+	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
+	return {
+		backend,
+		device: colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey,
+		format: deviceBackendToFormat(backend)
+	};
+}
+/**
+* The object-detection model the executor defaults to for a deviceKey. Mirrors
+* the executor's `MODEL_BY_CLASS` classification (`classifyAccelerator`) plus
+* the tflite `defaultModelIdByFormat` for Coral. Never throws; unknown backends
+* fall back to the universal nano default (`yolo26n`).
+*/
+function defaultModelIdForDevice(deviceKey) {
+	const { backend, device } = parseDeviceKey(deviceKey);
+	if (backend === "openvino") {
+		if (device === "cpu") return "yolo26n";
+		return "yolov9m-320-int8";
+	}
+	if (backend === "edgetpu") return "ssd-mobilenet-v2-coco-edgetpu";
+	if (backend === "coreml") return "yolov9m-320";
+	return "yolo26n";
+}
+/**
+* Step-tree device jump (phase 1): validate every `steps[step].jumpDeviceKey`
+* manual override in a to-be-saved `inferenceDevices` map. A jump target MUST be
+* an enabled∧available device on the SAME node and DIFFERENT from the owning
+* device. `enabledAvailableKeys` is the effective enabled∧available set (from
+* `mergeInferenceDevices(probe, submitted)`) so an absent/unplugged/disabled
+* target is rejected honestly (an operator can't route a step onto a dead pool).
+* Returns the FIRST human-readable error, or `null` when every override is
+* valid. Pure + deterministic.
+*/
+function validateJumpTargets(inferenceDevices, enabledAvailableKeys) {
+	for (const [deviceKey, entry] of Object.entries(inferenceDevices)) for (const [stepId, step] of Object.entries(entry.steps ?? {})) {
+		const target = step.jumpDeviceKey;
+		if (target === void 0) continue;
+		if (target === deviceKey) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey pointing at its own device`;
+		if (!enabledAvailableKeys.has(target)) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey "${target}" that is not an enabled, available device on this node`;
+	}
+	return null;
+}
+/**
+* Merge a node's live-probed inference devices with its stored per-device map.
+*
+* The default is **AUTO = all discovered ACCELERATORS enabled** (spec C2,
+* opt-OUT) with TWO deliberate exceptions, both **opt-IN** (default disabled):
+*
+*   - **CPU**: `enumerateInferenceDevices` always emits a universal `cpu`
+*     floor on every platform; auto-enabling it would let the balancer
+*     round-robin ~1/N of sessions onto the slow CPU pool alongside the
+*     NPU/iGPU/ANE. CPU stays the always-available FALLBACK (a node with no
+*     eligible accelerator leaves `deviceKey` unset → the runner's default
+*     pool, which is CPU), not a balanced target — matching the spec's "no
+*     device eligible → fall back to CPU".
+*   - **Coral Edge TPU (`edgetpu`)**: the standing rule since the Coral
+*     executor landed is that it surfaces as selectable but is NEVER
+*     auto-picked — it runs a DIFFERENT, weaker model family (tflite SSD
+*     MobileNet, not the YOLO the other accelerators run), so silently
+*     enrolling a plugged-in Coral changes detection QUALITY, not just
+*     placement. The opt-OUT default did exactly that on 2026-08-01: a hub
+*     Coral nobody enabled entered the session rotation and camera 615 spent
+*     hours at 2.4fps failing tflite model resolution. An operator who wants
+*     the Coral balanced opts it in explicitly (`enabled: true`).
+*
+* So: an NPU/iGPU/ANE accelerator with NO stored entry is `enabled:true`; a
+* CPU or edgetpu device with no stored entry is `enabled:false`; an explicit
+* stored `enabled` always wins (an operator can opt CPU/Coral in, or an
+* accelerator out). A stored-only key (configured but the probe did not
+* return it — removed/unplugged HW) keeps its stored `enabled` and surfaces
+* as `available:false`, so the UI still shows it.
+*
+* Pure + deterministic (sorted by key) — the single merge authority shared by
+* the `getNodeInferenceDevices` view and the dispatcher's eligible-device pick.
+*/
+function mergeInferenceDevices(probed, stored) {
+	const probedByKey = new Map(probed.map((d) => [d.key, d]));
+	const keys = new Set([...probedByKey.keys(), ...Object.keys(stored)]);
+	const out = [];
+	for (const key of Array.from(keys).toSorted()) {
+		const descriptor = probedByKey.get(key);
+		const opt = stored[key];
+		const parsed = descriptor ?? parseDeviceKey(key);
+		const weight = opt?.weight !== void 0 && opt.weight > 0 ? opt.weight : 1;
+		const autoDefault = parsed.backend !== "cpu" && parsed.backend !== "edgetpu";
+		out.push({
+			key,
+			backend: parsed.backend,
+			device: parsed.device,
+			format: parsed.format,
+			available: descriptor?.available ?? false,
+			enabled: opt?.enabled ?? autoDefault,
+			weight,
+			maxSessions: opt?.maxSessions ?? null,
+			defaultModelId: defaultModelIdForDevice(key),
+			...opt?.steps && Object.keys(opt.steps).length > 0 ? { steps: { ...opt.steps } } : {}
+		});
+	}
+	return out;
+}
+/**
+* The per-device concurrent-session caps for a node as `deviceKey → maxSessions`
+* (only devices that carry an explicit cap; absent = unlimited). Fed to the
+* device balancer's `nodeCaps` so a device at its cap is skipped (audit F3).
+*/
+function inferenceDeviceCaps(stored) {
+	const out = {};
+	for (const [key, entry] of Object.entries(stored)) if (entry.maxSessions !== void 0 && entry.maxSessions > 0) out[key] = entry.maxSessions;
+	return out;
+}
+/** Is this device the CPU fallback rather than a real accelerator? */
+function isCpuFallback(view) {
+	return view.backend === "cpu";
+}
+function resolveInferenceDeviceEligibility(probed, stored, canRunRoot, isPoolUsable) {
+	const eligible = {};
+	const excluded = [];
+	const merged = mergeInferenceDevices(probed, stored);
+	const acceleratorServes = merged.some((d) => !isCpuFallback(d) && d.enabled && d.available && (!canRunRoot || canRunRoot(d.format)));
+	for (const d of merged) {
+		if (!d.enabled) {
+			excluded.push({
+				key: d.key,
+				reason: "disabled",
+				format: d.format
+			});
+			continue;
+		}
+		if (!d.available) {
+			excluded.push({
+				key: d.key,
+				reason: "unavailable",
+				format: d.format
+			});
+			continue;
 		}
-		await this.withAudioSubLock(deviceId, async () => {
-			const unsub = this.audioSubscriptions.get(deviceId);
-			if (!unsub) return;
-			try {
-				unsub();
-			} catch {}
-			this.audioSubscriptions.delete(deviceId);
-			this.deps.logger.info("lazy audio: window closed", {
-				tags: { deviceId },
-				meta: { reason }
+		if (isPoolUsable && !isPoolUsable(d.key)) {
+			excluded.push({
+				key: d.key,
+				reason: "unavailable",
+				format: d.format
 			});
-		});
-	}
-	/**
-	* Audio teardown for one device — the audio half of `stopDetection`.
-	* Tears down through the per-device lock so it can't race a concurrent
-	* subscribe (which would re-store a handle this teardown never sees).
-	*/
-	async stopForDevice(deviceId) {
-		await this.withAudioSubLock(deviceId, async () => {
-			const unsub = this.audioSubscriptions.get(deviceId);
-			if (unsub) {
-				try {
-					unsub();
-				} catch {}
-				this.audioSubscriptions.delete(deviceId);
-			}
-		});
-		const lazyTimer = this.lazyAudioTeardownTimers.get(deviceId);
-		if (lazyTimer) {
-			clearTimeout(lazyTimer);
-			this.lazyAudioTeardownTimers.delete(deviceId);
+			continue;
 		}
-		const windowTimer = this.motionAudioWindowTimers.get(deviceId);
-		if (windowTimer) {
-			clearTimeout(windowTimer);
-			this.motionAudioWindowTimers.delete(deviceId);
+		if (canRunRoot && !canRunRoot(d.format)) {
+			excluded.push({
+				key: d.key,
+				reason: "cannot-host-camera-root",
+				format: d.format
+			});
+			continue;
 		}
-		this.audioAssignments.delete(deviceId);
-	}
-	/**
-	* Centralized write into `audioSubscriptions`. If shutdown has begun, the
-	* map has already been (or is about to be) cleared lock-free in
-	* `shutdown()`; storing here would leak a zombie entry whose `unsub` is
-	* never called. So when shutting down we immediately invoke `unsub`
-	* (best-effort, error-swallowed) and DO NOT store. `protected` so
-	* `audio-sub-lock.spec.ts`'s test subclass can assert the shutdown-guard
-	* behavior without casts.
-	*/
-	storeAudioSub(deviceId, unsub) {
-		if (this.audioShuttingDown) {
-			try {
-				unsub();
-			} catch {}
-			return;
+		if (isCpuFallback(d) && acceleratorServes) {
+			excluded.push({
+				key: d.key,
+				reason: "accelerator-preferred",
+				format: d.format
+			});
+			continue;
 		}
-		this.audioSubscriptions.set(deviceId, unsub);
-	}
-	/**
-	* Serialize an audio-subscription critical section per device. `fn` is
-	* chained onto the device's current lock tail, so concurrent calls for the
-	* SAME deviceId run sequentially (FIFO); different deviceIds never block
-	* each other. Thin delegate onto the `audioSubLocks` `KeyedAsyncLock`
-	* instance. `protected` so `audio-sub-lock.spec.ts`'s test subclass can
-	* drive the lock without casts.
-	*/
-	withAudioSubLock(deviceId, fn) {
-		return this.audioSubLocks.run(deviceId, fn);
+		eligible[d.key] = d.weight;
 	}
+	return {
+		eligible,
+		excluded
+	};
+}
+/**
+* Join the merged device rows with the eligibility verdict so the UI can NAME
+* why an accelerator is not in play instead of leaving the operator to deduce
+* it from `enabled`/`available`.
+*
+* Deduction is not possible for two of the four reasons — `accelerator-preferred`
+* is a node-WIDE rule (a CPU row reads `enabled:true, available:true` and still
+* never gets a session, D215) and `cannot-host-camera-root` needs the node's
+* model catalog. Both live in {@link resolveInferenceDeviceEligibility}, so this
+* function only transports its answer; it never re-derives one.
+*
+* Pure; preserves `merged`'s order (sorted by key) and every other field.
+*/
+function annotateInferenceDeviceExclusions(merged, eligibility) {
+	const reasonByKey = new Map(eligibility.excluded.map((e) => [e.key, e.reason]));
+	return merged.map((view) => ({
+		...view,
+		exclusion: reasonByKey.get(view.key) ?? null
+	}));
+}
+function resolveNodeInferenceUsability(eligibility) {
+	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
+	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
+	return {
+		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
+		unavailableKeys,
+		eligibleKeys
+	};
+}
+/**
+* Step-tree device jump (phase 1): the attach-payload roster of a node's
+* enabled∧available inference devices with the balancer knobs (`weight`,
+* `maxSessions`) the runner uses to AUTO-jump an enrichment step off a device
+* whose format can't run it. Built from the SAME `eligible` (deviceKey→weight)
+* and `caps` (deviceKey→maxSessions) the dispatcher already computes, so the
+* roster the runner sees exactly matches the balancer's candidate set. Sorted
+* by key for determinism. Populated onto `RunnerCameraConfig.inferenceDevices`
+* ONLY when a `deviceKey` is elected and there are ≥2 entries.
+*/
+function buildInferenceDeviceRoster(eligible, caps) {
+	return Object.entries(eligible).map(([deviceKey, weight]) => ({
+		deviceKey,
+		weight: weight > 0 ? weight : 1,
+		maxSessions: caps[deviceKey] ?? null
+	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
+}
+//#endregion
+//#region src/node-inference-usability-mirror.ts
+var NodeInferenceUsabilityMirror = class {
+	state = /* @__PURE__ */ new Map();
 	/**
-	* Subscribe to decoded audio chunks for a camera and feed them into the
-	* audio-analyzer. Reads the analyzer's settings via its own
-	* `resolveDeviceSettings(deviceId)` method so the orchestrator does not
-	* touch the audio-analyzer schema field names directly.
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
 	*/
-	async subscribeAudioStream(deviceId, config) {
-		const api = this.deps.api();
-		if (!api) {
-			this.deps.logger.warn("this.ctx.api not available — cannot subscribe audio", { tags: { deviceId } });
-			return null;
-		}
-		if (!await this.deps.isAudioAnalysisActive(deviceId)) return null;
-		if (config.audioMode === "disabled") {
-			this.deps.logger.debug("audio subscribe skipped: audioMode=disabled", { tags: { deviceId } });
-			return null;
+	observe(nodeId, usable) {
+		const prev = this.state.get(nodeId);
+		if (usable) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: false
+			});
+			return prev !== void 0 && !prev.usable ? "recovered" : null;
 		}
-		if (config.audioMode === "on-motion" && !this.isMotionAudioWindowOpen(deviceId)) {
-			this.deps.logger.info("audio subscribe deferred: audioMode=on-motion, no window open", { tags: { deviceId } });
+		if (prev === void 0) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
 			return null;
 		}
-		const audioStream = config.audioStreamId ?? config.motionStreamId;
-		const audioBrokerId = makeSourceBrokerId(deviceId, audioStream);
-		if ((await this.deps.probeAudioTrack(deviceId, audioStream)).kind === "absent") {
-			this.deps.logger.warn("audio subscription REFUSED — this stream carries no audio track", {
-				tags: { deviceId },
-				meta: {
-					camStreamId: audioStream,
-					brokerId: audioBrokerId,
-					selectedBy: config.audioStreamId !== void 0 ? "audioStreamId" : "motionStreamId",
-					hint: "point the camera’s audio at a stream that has an audio track — no stream is substituted automatically"
-				}
+		if (!prev.usable) {
+			this.state.set(nodeId, {
+				usable: false,
+				armed: true
 			});
 			return null;
 		}
-		const settings = await api.audioAnalysis.resolveDeviceSettings.query({ deviceId });
-		if (!settings) {
-			this.deps.logger.warn("audio-analysis returned no settings — audio subscription skipped", { tags: { deviceId } });
+		if (!prev.armed) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
 			return null;
 		}
-		const audioNodeId = await this.dispatch(deviceId);
-		const isRemoteAudio = audioNodeId !== this.deps.localNodeId();
-		this.deps.logger.info("audio subscription: resolved audio node", {
-			tags: { deviceId },
-			meta: {
-				audioNodeId,
-				isRemote: isRemoteAudio
-			}
-		});
-		const accumulator = new AudioWindowAccumulator(deviceId);
-		const teardown = startAudioChunkPoller({
-			api,
-			brokerId: audioBrokerId,
-			tag: "audio-analyzer",
-			ownerNodeId: this.deps.ingestNode(),
-			logger: this.deps.logger.withTags({ deviceId }),
-			onChunk: async (chunk) => {
-				this.deps.watchdogNote(deviceId, "audio");
-				try {
-					const audioChunkInput = accumulator.push(chunk);
-					if (!audioChunkInput) return;
-					const result = await api.audioAnalyzer.analyseChunk.mutate({
-						chunk: audioChunkInput,
-						settings,
-						...isRemoteAudio ? { nodeId: audioNodeId } : {}
-					});
-					if (!result) return;
-					const frame = buildAudioResultFrame(deviceId, result);
-					this.deps.eventBus.emit({
-						id: `audio-inference-${deviceId}-${Date.now()}`,
-						timestamp: /* @__PURE__ */ new Date(),
-						source: {
-							type: "device",
-							id: deviceId,
-							nodeId: "hub",
-							addonId: "pipeline-orchestrator",
-							deviceId
-						},
-						category: EventCategory.PipelineAudioInferenceResult,
-						data: {
-							deviceId,
-							frame,
-							nodeId: "hub"
-						}
-					});
-				} catch (err) {
-					const msg = errMsg(err);
-					this.deps.logger.error("Audio analysis failed", {
-						tags: { deviceId },
-						meta: { error: msg }
-					});
-				}
-			}
+		this.state.set(nodeId, {
+			usable: false,
+			armed: true
 		});
-		this.deps.logger.info("Audio stream subscribed", { tags: { deviceId } });
-		return () => {
-			teardown();
-			accumulator.reset();
-		};
+		return "became-unusable";
 	}
-	/**
-	* Set true at the very start of `onShutdown`, before the audio teardown /
-	* map clears below. Once set, `withAudioSubLock` turns queued/new critical
-	* sections into no-ops and `storeAudioSub` refuses to store, so no
-	* critical section that was in-flight (or queued) when shutdown began can
-	* resurrect a zombie subscription into the cleared `audioSubscriptions`
-	* map. MUST be called before anything else in `onShutdown` that could
-	* race a queued audio critical section (mirrors the original
-	* `this.audioShuttingDown = true` being the very first statement).
-	*/
-	beginShutdown() {
-		this.audioShuttingDown = true;
+	/** Can this node be given cameras? Unknown nodes answer YES. */
+	isUsable(nodeId) {
+		return this.state.get(nodeId)?.usable ?? true;
+	}
+	/** Nodes currently excluded — for the placement log and diagnostics. */
+	unusableNodeIds() {
+		const out = [];
+		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
+		return out.toSorted();
+	}
+	forget(nodeId) {
+		this.state.delete(nodeId);
 	}
+	reset() {
+		this.state.clear();
+	}
+};
+//#endregion
+//#region src/inference-device-usability-mirror.ts
+/**
+* InferenceDeviceUsabilityMirror — "can this NODE's THIS DEVICE still infer?",
+* kept off the placement path.
+*
+* The per-`(nodeId, deviceKey)` twin of {@link NodeInferenceUsabilityMirror},
+* and deliberately not a second mechanism: it composes the key and delegates
+* every decision to that class, so the arm/apply reluctance D49 pinned lives in
+* exactly one implementation and cannot drift between the node tier and the
+* device tier.
+*
+* ## Why this tier had to exist
+*
+* The node tier already answers "does this node have ANY usable accelerator".
+* On 2026-08-25 the hub's answer was, correctly, yes — its NPU was healthy the
+* whole time. What died was one DEVICE, `openvino:gpu`, and nothing anywhere
+* asked that question: the per-dispatch capability gate is keyed on model
+* FORMAT and `openvino:gpu` and `openvino:npu` share the format `openvino`, so
+* it is blind between them by construction. The balancer kept rotating cameras
+* onto the dead pool — 20 sessions in 20 minutes, every one `tieBreak:
+* "rotation"` — for 31 hours.
+*
+* ## Why a mirror and not the event
+*
+* D49, verbatim: *a one-shot event never gates on a fallible read*. The gate is
+* this in-memory mirror, refreshed off the event path by the same
+* `resolveEligibleInferenceDevices` the dispatcher already runs (plus the
+* session controller's background refresher). The consequences that buys:
+*
+*  - **A read that fails changes nothing.** The caller folds in an observation
+*    only when it HAS one; an unreachable node, a version-skewed executor or a
+*    rejected RPC never reaches {@link observe}, so the previous verdict
+*    stands. This is the whole reason the health read is specified as
+*    "synchronous over in-memory state, never throws for its own reasons": an
+*    empty answer must mean *nothing is refused*, not *I could not tell*.
+*  - **Excluding a healthy device needs a second, consecutive read.** Exclusion
+*    is the direction that DESTROYS work — it strands an accelerator that may
+*    be perfectly fine — so one bad observation only ARMS.
+*  - **Re-admitting is immediate and unconditional.** One good observation puts
+*    the device straight back. Being slow to exclude costs some wasted
+*    inference attempts; being slow to re-admit costs an idle accelerator and a
+*    node that looks broken.
+*/
+/**
+* NUL — impossible in both a Moleculer node id and a `<backend>:<device>` key,
+* so the composite key can never be ambiguous. A separator that CAN occur in
+* either half makes two distinct pairs collide, and a collision here silently
+* excludes an accelerator nobody reported.
+*/
+var SEPARATOR = "\0";
+var InferenceDeviceUsabilityMirror = class {
+	/** The one implementation of the arm/apply state machine (D49). */
+	mirror = new NodeInferenceUsabilityMirror();
 	/**
-	* Full audio teardown — combines the former `onShutdown`'s two separate
-	* audio blocks (lazy-teardown-timer clear, then — after several unrelated
-	* session/reconcile/load-shed clears — subscription teardown + lock clear
-	* + assignment-map clears) into one call. Safe to combine: both blocks
-	* are synchronous with no interleaved `await`, and every original
-	* statement between them (`sessionRegistry.clear()`,
-	* `cameraFpsMap.clear()`, `remoteHealthAttempts.clear()`,
-	* `loadShedState.clear()`, `loadShedResumeTimer` cleanup) touches state
-	* fully disjoint from anything audio — so their relative order to each
-	* other is unaffected, and the audio-internal order (timers →
-	* subscriptions → lock → assignment maps) is reproduced exactly.
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
 	*/
-	shutdown() {
-		for (const t of this.lazyAudioTeardownTimers.values()) clearTimeout(t);
-		this.lazyAudioTeardownTimers.clear();
-		for (const t of this.motionAudioWindowTimers.values()) clearTimeout(t);
-		this.motionAudioWindowTimers.clear();
-		for (const unsub of this.audioSubscriptions.values()) try {
-			unsub();
-		} catch {}
-		this.audioSubscriptions.clear();
-		this.audioSubLocks.clear();
-		this.audioAssignments.clear();
-		this.readyAudioNodes.clear();
+	observe(nodeId, deviceKey, usable) {
+		return this.mirror.observe(`${nodeId}${SEPARATOR}${deviceKey}`, usable);
+	}
+	/** Can the balancer put a session on this device? Unknown pairs answer YES. */
+	isUsable(nodeId, deviceKey) {
+		return this.mirror.isUsable(`${nodeId}${SEPARATOR}${deviceKey}`);
+	}
+	/** Pairs currently excluded — for the placement log and diagnostics. */
+	unusableDevices() {
+		return this.mirror.unusableNodeIds().map((composite) => {
+			const at = composite.indexOf(SEPARATOR);
+			return {
+				nodeId: composite.slice(0, at),
+				deviceKey: composite.slice(at + 1)
+			};
+		});
+	}
+	/** The excluded device keys on ONE node. */
+	unusableDeviceKeys(nodeId) {
+		return this.unusableDevices().filter((d) => d.nodeId === nodeId).map((d) => d.deviceKey);
+	}
+	forget(nodeId, deviceKey) {
+		this.mirror.forget(`${nodeId}${SEPARATOR}${deviceKey}`);
+	}
+	reset() {
+		this.mirror.reset();
 	}
 };
+/**
+* Fold ONE node's health answer into the mirror and return what changed.
+*
+* This is the whole reading discipline, in one place, because both halves of it
+* are easy to get subtly wrong and neither failure is visible in a log:
+*
+*  - **`unhealthy === null` — the read FAILED — changes nothing.** Not a single
+*    entry is touched. An unreachable node, a version-skewed executor or a
+*    rejected RPC must be distinguishable from "asked, nothing is refused", or
+*    a flaky link silently re-admits a dead accelerator (D49).
+*  - **Every device the node HAS is observed**, not merely the refused ones.
+*    The first draft observed `refused ∪ already-excluded`, which omits exactly
+*    the devices the mirror has ARMED — so their disarming good read never
+*    arrived and two bad reads an HOUR apart, with a hundred healthy ones
+*    between them, excluded a working accelerator. "Consecutive" is only a
+*    property if the good observations are delivered.
+*
+* Pure with respect to everything except `mirror`, and never throws — it is
+* called from the dispatcher's own read path.
+*/
+function foldInferenceDeviceHealth(mirror, nodeId, unhealthy, present) {
+	if (unhealthy === null) return [];
+	const refused = new Set(unhealthy);
+	const observed = new Set([
+		...present,
+		...refused,
+		...mirror.unusableDeviceKeys(nodeId)
+	]);
+	const changes = [];
+	for (const deviceKey of observed) {
+		const transition = mirror.observe(nodeId, deviceKey, !refused.has(deviceKey));
+		if (transition !== null) changes.push({
+			deviceKey,
+			transition
+		});
+	}
+	return changes;
+}
 //#endregion
 //#region src/load-balancer.ts
 /**
@@ -43405,6 +43750,90 @@ function applyDeviceProvisioning(steps, base, override) {
 	});
 }
 //#endregion
+//#region src/device-activity-source.ts
+/** The source's own name on the wire. One constant, used by every emit + gate. */
+var DEVICE_ACTIVITY_SOURCE = "device-activity";
+var DeviceActivitySource = class {
+	#deps;
+	#devices = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.#deps = deps;
+	}
+	/**
+	* A `recording-signal` level landed for a device. Idempotent in the level:
+	* only a CHANGE emits an edge, and the sustain tick — not a repeated push —
+	* is what keeps the session open.
+	*/
+	onSignalLevel(deviceId, active, reason, atMs) {
+		const entry = this.#devices.get(deviceId) ?? {
+			active: false,
+			timer: null
+		};
+		const wasActive = entry.active;
+		entry.active = active;
+		this.#devices.set(deviceId, entry);
+		if (active === wasActive) return;
+		if (active) {
+			this.#deps.logger.info("device-activity: the device reports it is working", {
+				tags: { deviceId },
+				meta: { reason }
+			});
+			this.#emit(deviceId, true, atMs);
+			this.#arm(deviceId, entry);
+			return;
+		}
+		this.#clear(entry);
+		this.#deps.logger.info("device-activity: the device reports it has stopped", {
+			tags: { deviceId },
+			meta: { reason }
+		});
+		this.#emit(deviceId, false, atMs);
+	}
+	/** Drop every timer (addon teardown). The mirror goes with the instance. */
+	stop() {
+		for (const entry of this.#devices.values()) this.#clear(entry);
+		this.#devices.clear();
+	}
+	#arm(deviceId, entry) {
+		this.#clear(entry);
+		const sustainMs = this.#deps.sustainMsFor(deviceId);
+		const timer = setInterval(() => {
+			const current = this.#devices.get(deviceId);
+			if (!current || !current.active) {
+				this.#clear(current ?? entry);
+				return;
+			}
+			this.#emit(deviceId, true, Date.now());
+		}, sustainMs);
+		timer.unref?.();
+		entry.timer = timer;
+	}
+	#clear(entry) {
+		if (entry.timer === null) return;
+		clearInterval(entry.timer);
+		entry.timer = null;
+	}
+	/**
+	* Emit, unless this camera does not carry the source. A suppressed emit is
+	* SAID — an operator who never ticked the box and an addon that is quietly
+	* broken look identical from the outside otherwise.
+	*/
+	#emit(deviceId, detected, timestamp) {
+		const sources = this.#deps.motionSourcesFor(deviceId);
+		if (sources === null || !sources.includes("device-activity")) {
+			this.#deps.logger.debug("device-activity: level not forwarded — the camera does not list `device-activity`", {
+				tags: { deviceId },
+				meta: {
+					detected,
+					sources: sources ?? "no-active-detection"
+				}
+			});
+			return;
+		}
+		this.#deps.emitMotion(deviceId, detected, timestamp);
+	}
+};
+//#endregion
 //#region src/device-detection-settings.ts
 /** Read a required string leaf out of the hydrated `flat` schema values. */
 function mustString(flat, deviceId, key) {
@@ -43430,6 +43859,32 @@ function numberOrDefault(flat, key) {
 	const dflt = uiField && "default" in uiField ? uiField.default : void 0;
 	return typeof dflt === "number" ? dflt : 0;
 }
+/** The activity rate from the hydrated store, or the shipped default. */
+function activityFps(flat) {
+	const v = flat["activityDetectionFps"];
+	return typeof v === "number" && v > 0 ? v : 1;
+}
+/**
+* The detection rate a session opens at, given WHAT OPENED IT.
+*
+* A CAP, not a set: `min(cameraRate, activityRate)`. A camera already slower
+* than the activity rate stays slower, so lowering the global rate keeps
+* working. Why this lever and not the other two: a per-device `detectionFps`
+* would also slow the sessions a real motion trigger opens on the same camera,
+* and it becomes silently wrong the day the device gains a second trigger; a
+* per-SOURCE rate table would have to reach the runner and be re-applied
+* whenever the source holding the session changes, which the attach-time config
+* cannot express. Scoping it to the session's TRIGGER puts the number exactly
+* where its justification lives.
+*
+* Applies to the session the activity level OPENS. A session already open at
+* the camera rate when the level rises is not re-attached to slow it down —
+* re-attaching a live session to change one number costs a decode restart.
+*/
+function detectionFpsForTrigger(config, trigger) {
+	if (trigger !== "device-activity") return config.detectionFps;
+	return Math.min(config.detectionFps, config.activityDetectionFps ?? 1);
+}
 /**
 * Pure decision/derivation half of the former `resolveDeviceDetectionSettings`.
 * Given the I/O-gathered raw materials, resolves every operator-wins →
@@ -43439,14 +43894,19 @@ function numberOrDefault(flat, key) {
 * the original method's "narrowing failed" catch.
 */
 function resolveDetectionSettings(input) {
-	const { deviceId, raw, flat, features, hasOnboardMotion, pipelineEnabled, motionDetectionEnabled } = input;
+	const { deviceId, raw, flat, features, hasOnboardMotion, hasActivitySignal, pipelineEnabled, motionDetectionEnabled } = input;
 	const profile = resolveDeviceProfile(features);
 	const userMotionSources = raw["motionSources"];
 	let motionSources;
 	if (userMotionSources !== void 0) motionSources = MotionSourcesSchema.parse(userMotionSources);
-	else if (hasOnboardMotion) motionSources = ["onboard"];
-	else if (profile && features.includes(DeviceFeature.BatteryOperated)) motionSources = [];
-	else motionSources = MotionSourcesSchema.parse(flat["motionSources"]);
+	else {
+		let defaulted;
+		if (hasOnboardMotion) defaulted = ["onboard"];
+		else if (hasActivitySignal) defaulted = [];
+		else if (profile && features.includes(DeviceFeature.BatteryOperated)) defaulted = [];
+		else defaulted = MotionSourcesSchema.parse(flat["motionSources"]);
+		motionSources = hasActivitySignal ? [...defaulted, DEVICE_ACTIVITY_SOURCE] : defaulted;
+	}
 	const userDetectionMode = raw["detectionMode"];
 	const detectionMode = typeof userDetectionMode === "string" && isPipelinePhaseMode(userDetectionMode) ? userDetectionMode : profile?.defaults.detectionMode ?? "on-motion";
 	const userAudioMode = raw["audioMode"];
@@ -43465,6 +43925,7 @@ function resolveDetectionSettings(input) {
 		detectionStreamProfile: mustString(flat, deviceId, "detectionStreamProfile"),
 		motionFps: numberOrDefault(flat, "motionFps"),
 		detectionFps: numberOrDefault(flat, "detectionFps"),
+		activityDetectionFps: activityFps(flat),
 		motionCooldownMs: numberOrDefault(flat, "motionCooldownMs"),
 		maxSessionHoldMs: numberOrDefault(flat, "maxSessionHoldMs"),
 		audioMotionWindowMs: numberOrDefault(flat, "audioMotionWindowMs"),
@@ -43521,6 +43982,7 @@ function buildDetectionConfigFromInputs(resolved, assigned) {
 		detectionStreamId: detectionCamStreamId,
 		motionFps: resolved.motionFps,
 		detectionFps: resolved.detectionFps,
+		activityDetectionFps: resolved.activityDetectionFps,
 		motionCooldownMs: resolved.motionCooldownMs,
 		maxSessionHoldMs: resolved.maxSessionHoldMs,
 		audioMotionWindowMs: resolved.audioMotionWindowMs,
@@ -43546,6 +44008,7 @@ function detectionConfigEquals(a, b) {
 	if (a.detectionStreamId !== b.detectionStreamId) return false;
 	if (a.motionFps !== b.motionFps) return false;
 	if (a.detectionFps !== b.detectionFps) return false;
+	if (a.activityDetectionFps !== b.activityDetectionFps) return false;
 	if (a.motionCooldownMs !== b.motionCooldownMs) return false;
 	if (a.maxSessionHoldMs !== b.maxSessionHoldMs) return false;
 	if (a.audioMotionWindowMs !== b.audioMotionWindowMs) return false;
@@ -44172,6 +44635,7 @@ var DetectionWiringController = class {
 		try {
 			const features = await this.lookupDeviceFeatures(deviceId);
 			const hasOnboardMotion = raw["motionSources"] === void 0 ? await this.deps.deviceHasOnboardMotionCap(deviceId) : false;
+			const hasActivitySignal = raw["motionSources"] === void 0 ? await this.deps.deviceHasActivitySignalCap(deviceId) : false;
 			const pipelineEnabled = await this.isDetectionPipelineActive(deviceId);
 			const motionDetectionEnabled = await this.isMotionDetectionActive(deviceId);
 			return resolveDetectionSettings({
@@ -44180,6 +44644,7 @@ var DetectionWiringController = class {
 				flat,
 				features,
 				hasOnboardMotion,
+				hasActivitySignal,
 				pipelineEnabled,
 				motionDetectionEnabled
 			});
@@ -44785,9 +45250,10 @@ var DeviceConfigContributions = class {
 		const schema = this.deps.deviceSettingsSchema();
 		if (!schema) return null;
 		const hasOnboardMotion = await this.deps.deviceHasOnboardMotionCap(input.deviceId);
-		const rawWithDefaults = raw["motionSources"] === void 0 && hasOnboardMotion ? {
+		const hasActivitySignal = await this.deps.deviceHasActivitySignalCap(input.deviceId);
+		const rawWithDefaults = raw["motionSources"] === void 0 && (hasOnboardMotion || hasActivitySignal) ? {
 			...raw,
-			motionSources: ["onboard"]
+			motionSources: [...hasOnboardMotion ? ["onboard"] : [], ...hasActivitySignal ? ["device-activity"] : []]
 		} : raw;
 		const baseSections = hydrateSchema({
 			...schema,
@@ -47607,7 +48073,8 @@ function wireOrchestratorSubscriptions(deps) {
 		if (!isEvent(event, EventCategory.MotionOnMotionChanged)) return;
 		const { deviceId, detected, timestamp } = event.data;
 		if (typeof deviceId !== "number") return;
-		deps.handleSessionMotion(deviceId, detected, typeof timestamp === "number" ? timestamp : void 0).catch((err) => {
+		const parsedSource = MotionSourceEnum.safeParse(event.data.source);
+		deps.handleSessionMotion(deviceId, detected, typeof timestamp === "number" ? timestamp : void 0, parsedSource.success ? parsedSource.data : void 0).catch((err) => {
 			deps.logger.warn("session motion handler failed", {
 				tags: { deviceId },
 				meta: {
@@ -47629,8 +48096,47 @@ function wireOrchestratorSubscriptions(deps) {
 		const deviceId = event.source.deviceId;
 		if (typeof deviceId === "number") deps.noteWatchdogSignal(deviceId, "motion");
 	});
+	const activitySource = new DeviceActivitySource({
+		logger: deps.logger,
+		emitMotion: (deviceId, detected, timestamp) => {
+			if (isTornDown) return;
+			deps.eventBus.emit(createEvent(EventCategory.MotionOnMotionChanged, {
+				type: "device",
+				id: deviceId,
+				deviceId
+			}, {
+				deviceId,
+				detected,
+				timestamp,
+				source: DEVICE_ACTIVITY_SOURCE
+			}));
+		},
+		motionSourcesFor: (deviceId) => deps.getActiveDetectionConfig(deviceId)?.motionSources ?? null,
+		sustainMsFor: (deviceId) => {
+			const cooldownMs = deps.getActiveDetectionConfig(deviceId)?.motionCooldownMs;
+			return Math.max(1e3, Math.floor((cooldownMs ?? 3e4) / 2));
+		}
+	});
+	const unsubDeviceActivity = deps.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+		const data = event.data;
+		if (typeof data !== "object" || data === null) return;
+		if (data["capName"] !== recordingSignalCapability.name) return;
+		const deviceId = data["deviceId"];
+		if (typeof deviceId !== "number") return;
+		const level = RecordingSignalStatusSchema.safeParse(data["slice"]);
+		if (!level.success) {
+			deps.logger.warn("device-activity: signal slice does not parse — ignored", {
+				tags: { deviceId },
+				meta: { slice: data["slice"] }
+			});
+			return;
+		}
+		const atMs = event.timestamp instanceof Date ? event.timestamp.getTime() : Date.now();
+		activitySource.onSignalLevel(deviceId, level.data.active, level.data.reason, atMs);
+	});
 	return () => {
 		isTornDown = true;
+		activitySource.stop();
 		for (const t of profileSlotTimers.values()) clearTimeout(t);
 		profileSlotTimers.clear();
 		unsubDeviceRegistered();
@@ -47645,6 +48151,7 @@ function wireOrchestratorSubscriptions(deps) {
 		unsubSessionMotion();
 		unsubFrameTracked();
 		unsubMotionAnalysis();
+		unsubDeviceActivity();
 	};
 }
 //#endregion
@@ -50404,7 +50911,7 @@ var SessionDispatchController = class {
 	* standing attach, so `hasStandingAttach` stays true for them and
 	* `decideSessionAction` still returns `'ignore'`.
 	*/
-	async handleSessionMotion(deviceId, detected, emittedAt) {
+	async handleSessionMotion(deviceId, detected, emittedAt, trigger) {
 		const receivedAt = Date.now();
 		const busLagMs = emittedAt !== void 0 ? receivedAt - emittedAt : void 0;
 		const config = this.deps.getActiveDetectionConfig(deviceId);
@@ -50439,7 +50946,7 @@ var SessionDispatchController = class {
 					return;
 				}
 				this.activeRefireCountByDevice.delete(deviceId);
-				await this.dispatchDetectionSession(deviceId, cur);
+				await this.dispatchDetectionSession(deviceId, cur, trigger);
 				if (this.sessionRegistry.has(deviceId)) this.scheduleSessionTeardown(deviceId, cooldownMs);
 				const doneAt = Date.now();
 				this.deps.logger.info("session motion → attach latency", {
@@ -50478,7 +50985,7 @@ var SessionDispatchController = class {
 	* `dispatchCamera`) avoids any risk of changing that already-live
 	* standing-camera path.
 	*/
-	async dispatchDetectionSession(deviceId, config) {
+	async dispatchDetectionSession(deviceId, config, trigger) {
 		const log = this.deps.logger.withTags({ deviceId });
 		await this.deps.reconcilePlacementFromRunners();
 		const preferredAgent = await this.deps.readPipelinePin(deviceId);
@@ -50534,13 +51041,19 @@ var SessionDispatchController = class {
 		const steps = applyDeviceProvisioning(pipelineConfig.steps, deviceBase, deviceOverride);
 		const inferenceDevices = deviceKey && Object.keys(enabledDevices).length >= 2 ? buildInferenceDeviceRoster(enabledDevices, deviceCaps) : void 0;
 		const zones = await this.deps.listZones(deviceId);
+		const sessionDetectionFps = detectionFpsForTrigger(config, trigger);
+		if (sessionDetectionFps !== config.detectionFps) log.info("session opened at the device-activity rate", { meta: {
+			trigger,
+			detectionFps: sessionDetectionFps,
+			cameraDetectionFps: config.detectionFps
+		} });
 		const sessionConfig = {
 			deviceId,
 			...deviceKey ? { deviceKey } : {},
 			...inferenceDevices ? { inferenceDevices } : {},
 			motionCooldownMs: config.motionCooldownMs,
 			motionFps: config.motionFps,
-			detectionFps: config.detectionFps,
+			detectionFps: sessionDetectionFps,
 			motionStreamId: config.motionStreamId,
 			detectionStreamId: config.detectionStreamId,
 			motionSources: [],
@@ -51845,6 +52358,7 @@ async function buildOrchestratorControllers(deps) {
 		localNodeId: () => localNodeId,
 		deviceSettingsSchema: () => deps.deviceSettingsSchema(),
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
+		deviceHasActivitySignalCap: (deviceId) => deps.deviceHasActivitySignalCap(deviceId),
 		deviceHasNativeObjectDetectionCap: (deviceId) => deps.deviceHasNativeObjectDetectionCap(deviceId),
 		setCameraPipelineForAgent: (input) => deps.setCameraPipelineForAgent(input),
 		emitCameraUpdated: (deviceId, config) => deps.emitCameraUpdated(deviceId, config),
@@ -52162,6 +52676,7 @@ async function buildOrchestratorControllers(deps) {
 		},
 		isCapActiveForDevice: (deviceId, capName) => deps.isCapActiveForDevice(deviceId, capName),
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
+		deviceHasActivitySignalCap: (deviceId) => deps.deviceHasActivitySignalCap(deviceId),
 		deviceSettingsSchema: () => deps.deviceSettingsSchema()
 	});
 	await detectionWiring.hydrateFeaturesMirror().catch((err) => {
@@ -52197,255 +52712,6 @@ async function buildOrchestratorControllers(deps) {
 	};
 }
 //#endregion
-//#region src/viewer-ui-provider.ts
-/**
-* viewer-ui provider — the pipeline-orchestrator serves the CamStack viewer web
-* SPA (mirrors what the now-removed standalone addon-viewer-ui used to do).
-*
-* Why here: the orchestrator is a hub bootstrap addon (always installed + baked),
-* so folding the viewer serving into it avoids a second addon whose only job was
-* to hold static files. The viewer's Expo web export is COPIED into this addon's
-* `assets/viewer/` locally by the viewer repo's `scripts/copy-dist-to-orchestrator.js`
-* (run from a checkout that HAS the `camstack/` submodule + Expo toolchain — the
-* publish/image CI does not, which is exactly why we copy a pre-built dist rather
-* than build it here). vite emits only into `dist/`, so `assets/viewer` survives
-* the addon build; `assets` is in the package `files`, so it ships on
-* `camstack deploy`. The hub's `main.ts` resolves the `viewer-ui` singleton at
-* boot and mounts the SPA at `/viewer/camstack`.
-*
-* `index.js` runs from `dist/`, so the SPA root is one level up + `assets/viewer`.
-*/
-var __dirname = path.dirname(fileURLToPath(import.meta.url));
-/** Absolute path to the staged viewer web SPA (`<addon-root>/assets/viewer`). */
-function resolveViewerDistDir() {
-	return path.resolve(__dirname, "..", "assets", "viewer");
-}
-/** Version of the staged viewer, written by the copy script; 'unknown' if absent. */
-function readViewerVersion() {
-	try {
-		const raw = fs.readFileSync(path.join(resolveViewerDistDir(), ".viewer-version"), "utf-8").trim();
-		if (raw) return raw;
-	} catch {}
-	return "unknown";
-}
-/** Build the viewer-ui provider. Serves whatever dist was staged into
-*  `assets/viewer`; when nothing is staged the hub's mount cleanly 404s. */
-function createViewerUiProvider() {
-	return {
-		getStaticDir: async () => ({ staticDir: resolveViewerDistDir() }),
-		getVersion: async () => ({ version: readViewerVersion() })
-	};
-}
-//#endregion
-//#region src/disk-reconcile-fleet.ts
-async function reconcileFleetFromDisk(deps) {
-	const deviceIds = await deps.listDeviceIds();
-	const failed = [];
-	let cameras = 0;
-	let mediaDropped = 0;
-	let tracks = 0;
-	let events = 0;
-	let completed = 0;
-	for (const deviceId of deviceIds) {
-		try {
-			await deps.rescanRecordings(deviceId);
-			const counts = await deps.reconcileAnalytics(deviceId);
-			cameras += 1;
-			mediaDropped += counts.mediaDropped;
-			tracks += counts.tracks;
-			events += counts.events;
-		} catch {
-			failed.push(deviceId);
-		}
-		completed += 1;
-		deps.onProgress?.({
-			deviceId,
-			total: deviceIds.length,
-			completed,
-			failed: [...failed],
-			mediaDropped,
-			tracks,
-			events
-		});
-	}
-	return {
-		cameras,
-		failed,
-		mediaDropped,
-		tracks,
-		events
-	};
-}
-//#endregion
-//#region src/disk-reconcile-job.ts
-/**
-* In-memory disk-wins fleet job. The tRPC mutation starts this and returns
-* immediately; the walk runs in the addon process so a 60s UDS timeout cannot
-* abort it. Status is polled via getReconcileFromDiskStatus.
-*/
-function idleDiskReconcileJob() {
-	return {
-		state: "idle",
-		total: 0,
-		completed: 0,
-		currentDeviceId: null,
-		failed: [],
-		mediaDropped: 0,
-		tracks: 0,
-		events: 0,
-		startedAtMs: null,
-		finishedAtMs: null,
-		error: null
-	};
-}
-function isTimeoutError(err) {
-	const message = err instanceof Error ? err.message : String(err);
-	return /timed out/i.test(message);
-}
-async function withTimeoutRetry(run) {
-	try {
-		return await run();
-	} catch (err) {
-		if (!isTimeoutError(err)) throw err;
-		return await run();
-	}
-}
-function createDiskReconcileJobRunner(now = Date.now) {
-	let job = idleDiskReconcileJob();
-	let inFlight = null;
-	const snapshot = () => job;
-	const start = (deps) => {
-		if (job.state === "running" && inFlight) return job;
-		job = {
-			...idleDiskReconcileJob(),
-			state: "running",
-			startedAtMs: now()
-		};
-		deps.log?.("pipeline disk reconcile started");
-		inFlight = (async () => {
-			try {
-				const result = await reconcileFleetFromDisk({
-					listDeviceIds: deps.listDeviceIds,
-					rescanRecordings: (deviceId) => withTimeoutRetry(() => deps.rescanRecordings(deviceId)),
-					reconcileAnalytics: (deviceId) => withTimeoutRetry(() => deps.reconcileAnalytics(deviceId)),
-					onProgress: (update) => {
-						job = {
-							...job,
-							total: update.total,
-							completed: update.completed,
-							currentDeviceId: update.deviceId,
-							failed: update.failed,
-							mediaDropped: update.mediaDropped,
-							tracks: update.tracks,
-							events: update.events
-						};
-						deps.onProgress?.(update);
-						deps.log?.("pipeline disk reconcile camera", {
-							deviceId: update.deviceId,
-							completed: update.completed,
-							total: update.total,
-							failed: update.failed.length,
-							mediaDropped: update.mediaDropped,
-							tracks: update.tracks,
-							events: update.events
-						});
-					}
-				});
-				job = {
-					...job,
-					state: "done",
-					total: result.cameras + result.failed.length,
-					completed: result.cameras + result.failed.length,
-					currentDeviceId: null,
-					failed: result.failed,
-					mediaDropped: result.mediaDropped,
-					tracks: result.tracks,
-					events: result.events,
-					finishedAtMs: now(),
-					error: null
-				};
-				deps.log?.("pipeline disk reconcile", {
-					cameras: result.cameras,
-					failed: result.failed,
-					mediaDropped: result.mediaDropped,
-					tracks: result.tracks,
-					events: result.events
-				});
-			} catch (err) {
-				const error = err instanceof Error ? err.message : String(err);
-				job = {
-					...job,
-					state: "error",
-					currentDeviceId: null,
-					finishedAtMs: now(),
-					error
-				};
-				deps.log?.("pipeline disk reconcile failed", { error });
-			} finally {
-				inFlight = null;
-			}
-		})();
-		return job;
-	};
-	return {
-		snapshot,
-		start
-	};
-}
-//#endregion
-//#region src/widget-catalog.ts
-var pipelineOrchestratorWidgets = [{
-	tab: "device-tab",
-	label: "Pipeline Quick Stats",
-	preAuth: false,
-	kind: "remote",
-	remote: {
-		remoteName: "addon_pipeline_orchestrator_widgets",
-		exposedModule: "./widgets",
-		componentKey: "pipeline-quick-stats"
-	},
-	stableId: "pipeline-quick-stats",
-	description: "Phase / Detection FPS / Inference / Active Tracks tile row.",
-	icon: "activity",
-	bundle: "remoteEntry.js",
-	hosts: ["device-tab", "dashboard"],
-	requires: {
-		deviceContext: true,
-		integrationContext: false
-	},
-	defaultSize: "md",
-	allowedSizes: [
-		"sm",
-		"md",
-		"lg"
-	],
-	defaultColumns: 6,
-	defaultRows: 1
-}, {
-	tab: "device-tab",
-	label: "Zone Editor",
-	preAuth: false,
-	kind: "remote",
-	remote: {
-		remoteName: "addon_pipeline_orchestrator_widgets",
-		exposedModule: "./widgets",
-		componentKey: "zone-editor"
-	},
-	stableId: "zone-editor",
-	description: "Polygon / tripwire CRUD + per-stage rule editor.",
-	icon: "shapes",
-	bundle: "remoteEntry.js",
-	hosts: ["device-tab"],
-	requires: {
-		deviceContext: true,
-		integrationContext: false
-	},
-	defaultSize: "xl",
-	allowedSizes: ["lg", "xl"],
-	defaultColumns: 12,
-	defaultRows: 4
-}];
-//#endregion
 //#region src/settings-ui-schemas.ts
 /** Build the addon-level schema sections (cluster roles + crop + balancer + failover). */
 function buildGlobalSettingsSections(options) {
@@ -52810,6 +53076,22 @@ function buildDeviceSettingsSections(nodeOptions) {
 						field: "detectionMode",
 						notEquals: "disabled"
 					}
+				},
+				{
+					key: "activityDetectionFps",
+					type: "slider",
+					label: "Detection FPS while the device is working",
+					min: 1,
+					max: 10,
+					step: 1,
+					default: 1,
+					showValue: true,
+					unit: "fps",
+					description: "A device-activity session lasts as long as the job does — a cleaning run is tens of minutes. This caps the rate for that session only; a session opened by motion keeps the rate above.",
+					showWhen: {
+						field: "motionSources",
+						includes: "device-activity"
+					}
 				}
 			]
 		},
@@ -52899,6 +53181,99 @@ function deriveRuntimeSettings(config) {
 	};
 }
 //#endregion
+//#region src/viewer-ui-provider.ts
+/**
+* viewer-ui provider — the pipeline-orchestrator serves the CamStack viewer web
+* SPA (mirrors what the now-removed standalone addon-viewer-ui used to do).
+*
+* Why here: the orchestrator is a hub bootstrap addon (always installed + baked),
+* so folding the viewer serving into it avoids a second addon whose only job was
+* to hold static files. The viewer's Expo web export is COPIED into this addon's
+* `assets/viewer/` locally by the viewer repo's `scripts/copy-dist-to-orchestrator.js`
+* (run from a checkout that HAS the `camstack/` submodule + Expo toolchain — the
+* publish/image CI does not, which is exactly why we copy a pre-built dist rather
+* than build it here). vite emits only into `dist/`, so `assets/viewer` survives
+* the addon build; `assets` is in the package `files`, so it ships on
+* `camstack deploy`. The hub's `main.ts` resolves the `viewer-ui` singleton at
+* boot and mounts the SPA at `/viewer/camstack`.
+*
+* `index.js` runs from `dist/`, so the SPA root is one level up + `assets/viewer`.
+*/
+var __dirname = path.dirname(fileURLToPath(import.meta.url));
+/** Absolute path to the staged viewer web SPA (`<addon-root>/assets/viewer`). */
+function resolveViewerDistDir() {
+	return path.resolve(__dirname, "..", "assets", "viewer");
+}
+/** Version of the staged viewer, written by the copy script; 'unknown' if absent. */
+function readViewerVersion() {
+	try {
+		const raw = fs.readFileSync(path.join(resolveViewerDistDir(), ".viewer-version"), "utf-8").trim();
+		if (raw) return raw;
+	} catch {}
+	return "unknown";
+}
+/** Build the viewer-ui provider. Serves whatever dist was staged into
+*  `assets/viewer`; when nothing is staged the hub's mount cleanly 404s. */
+function createViewerUiProvider() {
+	return {
+		getStaticDir: async () => ({ staticDir: resolveViewerDistDir() }),
+		getVersion: async () => ({ version: readViewerVersion() })
+	};
+}
+//#endregion
+//#region src/widget-catalog.ts
+var pipelineOrchestratorWidgets = [{
+	tab: "device-tab",
+	label: "Pipeline Quick Stats",
+	preAuth: false,
+	kind: "remote",
+	remote: {
+		remoteName: "addon_pipeline_orchestrator_widgets",
+		exposedModule: "./widgets",
+		componentKey: "pipeline-quick-stats"
+	},
+	stableId: "pipeline-quick-stats",
+	description: "Phase / Detection FPS / Inference / Active Tracks tile row.",
+	icon: "activity",
+	bundle: "remoteEntry.js",
+	hosts: ["device-tab", "dashboard"],
+	requires: {
+		deviceContext: true,
+		integrationContext: false
+	},
+	defaultSize: "md",
+	allowedSizes: [
+		"sm",
+		"md",
+		"lg"
+	],
+	defaultColumns: 6,
+	defaultRows: 1
+}, {
+	tab: "device-tab",
+	label: "Zone Editor",
+	preAuth: false,
+	kind: "remote",
+	remote: {
+		remoteName: "addon_pipeline_orchestrator_widgets",
+		exposedModule: "./widgets",
+		componentKey: "zone-editor"
+	},
+	stableId: "zone-editor",
+	description: "Polygon / tripwire CRUD + per-stage rule editor.",
+	icon: "shapes",
+	bundle: "remoteEntry.js",
+	hosts: ["device-tab"],
+	requires: {
+		deviceContext: true,
+		integrationContext: false
+	},
+	defaultSize: "xl",
+	allowedSizes: ["lg", "xl"],
+	defaultColumns: 12,
+	defaultRows: 4
+}];
+//#endregion
 //#region src/index.ts
 /**
 * addon-pipeline-orchestrator — hub-side camera-to-agent load balancer.
@@ -53213,6 +53588,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			isCapActiveForDevice: (deviceId, capName) => this.isCapActiveForDevice(deviceId, capName),
 			isAudioAnalysisActive: (deviceId) => this.isAudioAnalysisActive(deviceId),
 			deviceHasOnboardMotionCap: (deviceId) => this.deviceHasOnboardMotionCap(deviceId),
+			deviceHasActivitySignalCap: (deviceId) => this.deviceHasActivitySignalCap(deviceId),
 			deviceHasNativeObjectDetectionCap: (deviceId) => this.deviceHasNativeObjectDetectionCap(deviceId),
 			handleDeviceRegistered: (deviceId) => this.handleDeviceRegistered(deviceId),
 			handleDeviceUnregistered: (deviceId) => this.handleDeviceUnregistered(deviceId),
@@ -54399,6 +54775,26 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* we err toward the analyzer (never lose detection coverage when the
 	* binding lookup hiccups).
 	*/
+	/**
+	* True when the device's driver registered `recording-signal` — the cap a
+	* device uses to say, itself, that it is working (a robot vacuum cleaning).
+	* Drives the `device-activity` entry in the `motionSources` DEFAULT (D392),
+	* so the source arrives on exactly the devices that can raise it and on no
+	* other camera in the fleet.
+	*
+	* Same failure discipline as `deviceHasOnboardMotionCap`: a binding lookup
+	* that throws answers `false`, which loses the DEFAULT and never the
+	* operator's explicit choice (this is asked only when they pinned nothing).
+	*/
+	async deviceHasActivitySignalCap(deviceId) {
+		const api = this.api;
+		if (!api) return false;
+		try {
+			return (await api.deviceManager.getBindings.query({ deviceId })).entries.some((e) => e.kind === "native" && e.capName === "recording-signal");
+		} catch {
+			return false;
+		}
+	}
 	async deviceHasOnboardMotionCap(deviceId) {
 		const api = this.api;
 		if (!api) return false;