@camstack/addon-pipeline-orchestrator 1.2.167 → 1.2.168

package/dist/index.js

@@ -21310,8 +21310,25 @@ var occupancyRecheckFramesField = {
 * (analyzer attaches detected `regions[]`; onboard does not — the
 * camera typically only reports a binary signal plus an optional
 * channel/AI class which lives in dedicated event channels).
-*/
-var MotionSourceEnum = _enum(["onboard", "analyzer"]);
+*
+* - `onboard` — the camera's firmware said something moved.
+* - `analyzer` — this runner's frame-diff said so, and attaches `regions[]`.
+* - `device-activity` — the DEVICE said it is doing its job: the
+*   `recording-signal` LEVEL the same device raises for the recorder
+*   ([D380](../../../../docs/decisions/adr-0380-a-device-decided-recording-is-a-mode-with-no-schedule-seeded-once.md)),
+*   republished as a motion source. It attaches **nothing** — no regions, no
+*   class: the only fact it carries is that the device is active, and a robot
+*   vacuum that is itself the moving object has no region worth sending. It is
+*   a LEVEL, so unlike `onboard` it has a real falling edge, and unlike
+*   `analyzer` it must not open the frame-diff side-channel — the runner's
+*   `handleOnboardMotionAnalyzer` gate is `source === 'onboard'` and stays that
+*   way ([D392](../../../../docs/decisions/adr-0392-a-device-that-says-it-is-working-is-a-motion-source-of-its-own.md)).
+*/
+var MotionSourceEnum = _enum([
+	"onboard",
+	"analyzer",
+	"device-activity"
+]);
 /**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
@@ -21575,13 +21592,20 @@ var RunnerCameraDeviceUIFields = [
 		type: "multiselect",
 		label: "Motion Sources",
 		default: ["analyzer"],
-		options: [{
-			value: "analyzer",
-			label: "Frame-diff Analyzer (motion addon)"
-		}, {
-			value: "onboard",
-			label: "Camera Onboard Sensor"
-		}]
+		options: [
+			{
+				value: "analyzer",
+				label: "Frame-diff Analyzer (motion addon)"
+			},
+			{
+				value: "onboard",
+				label: "Camera Onboard Sensor"
+			},
+			{
+				value: "device-activity",
+				label: "Device activity (the device says it is working)"
+			}
+		]
 	},
 	{
 		key: "motionFps",
@@ -29578,8 +29602,38 @@ var RecordingSignalStatusSchema = object({
 	/** Ms epoch of the last `active` transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-RecordingSignalStatusSchema.extend({ lastFetchedAt: number() });
-DeviceType.Camera, method(object({ deviceId: number() }), RecordingSignalStatusSchema);
+/** The runtime-state slice: the status plus the clock every slice carries. */
+var RecordingSignalRuntimeStateSchema = RecordingSignalStatusSchema.extend({ lastFetchedAt: number() });
+var recordingSignalCapability = {
+	name: "recording-signal",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: { 
+	/** The current level, straight from the slice the provider keeps fresh. */
+getStatus: method(object({ deviceId: number() }), RecordingSignalStatusSchema) },
+	status: {
+		schema: RecordingSignalStatusSchema,
+		kind: "push",
+		empty: {
+			active: false,
+			reason: "unknown",
+			lastChangedAt: 0
+		}
+	},
+	runtimeState: RecordingSignalRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `active: true` from
+	* before a restart is exactly the stale level the recorder's reconcile bound
+	* exists to end, and the provider re-derives the true level on activation
+	* anyway. Nothing is lost by forgetting it; a lie is avoided.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
 * a rect ROI on a camera frame and names one or more states; the engine
@@ -40055,477 +40109,278 @@ function deviceBackendToFormat(backend) {
 	return DEVICE_BACKEND_TO_FORMAT[backend] ?? "onnx";
 }
 //#endregion
-//#region src/inference-device-model.ts
+//#region src/audio-chunk-poller.ts
 /**
-* Per-device default object-detection model + deviceKey parsing for the
-* orchestrator's device-aware `getNodeInferenceDevices` view.
+* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
+* plane (Phase 5 / D9).
 *
-* This DUPLICATES the executor's per-device model resolution (P0-3:
-* `resolveDeviceEngine` + `MODEL_BY_CLASS` + the object-detection step's
-* `defaultModelIdByFormat` in `@camstack/addon-pipeline`). It is duplicated —
-* not imported — because cross-addon imports are forbidden (the orchestrator
-* and the detection-pipeline are separate addons; only tRPC crosses the
-* boundary). Keep this in sync with `default-detection-model.ts` /
-* `step-definitions.ts` if the executor's defaults change.
+* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
+* path. A live callback cannot cross a process boundary; once the `pipeline`
+* group is dissolved (Task 8) the orchestrator runs in a different process
+* from the broker, so audio delivery must go over tRPC.
 *
-* The returned ids are honest catalog ids (verified present):
-*   - `yolov9m-320-int8` — Intel NPU + iGPU (yolo26 does NOT compile on the NPU)
-*   - `yolov9m-320`      — Apple ANE (CoreML)
-*   - `ssd-mobilenet-v2-coco-edgetpu` — Coral USB Edge TPU (tflite)
-*   - `yolo26n`          — CPU / CUDA (the object-detection step's universal
-*                          nano default)
+* The consumer:
 *
-* Do not promote the accelerated ids to 640. The evaluation in
-* `docs/benchmarks/pipeline-frame-model-eval.md` failed the 640 promotion
-* gates (0/3 miss recovered at the current threshold).
+*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
+*      registers a per-subscription bounded FIFO queue and returns a
+*      `subscriptionId`;
+*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
+*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
+*   3. feeds each chunk to its downstream audio logic;
+*   4. on teardown, `unsubscribeAudioChunks`.
+*
+* Audio is not latency-critical like video, and chunks arrive only ~every
+* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
+* a small per-poll burst keeps latency low without busy-spinning. The
+* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
+* loses a chunk.
+*
+* Boot-race tolerance: the broker for a given camStream may not be registered
+* yet when the orchestrator wires the subscription (provider addons publish
+* their cameraStreams asynchronously after their probe completes).
+* `subscribeAudioChunks` retries with exponential backoff (capped at
+* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
+* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
+* shape so video and audio plumbing self-heal identically.
 */
+/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
+var POLL_INTERVAL_MS$1 = 200;
+/** How many chunks to drain per poll — a small burst absorbs jitter. */
+var PULL_MAX_COUNT = 8;
 /**
-* The always-on object-detection ROOT step id. A camera session's tracks all
-* originate from this detector, so a device whose engine format can't run it
-* cannot host a camera root. Mirrors the addon-pipeline step id (cross-addon
-* import is forbidden — this is the same duplication rationale as the model
-* defaults above).
+* Consecutive pull failures before we attempt to re-subscribe. A single failed
+* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
+* sustained failure means the broker child restarted and dropped our
+* subscription, so we re-establish it.
 */
-var OBJECT_DETECTION_STEP_ID = "object-detection";
+var RESUBSCRIBE_AFTER_FAILURES = 2;
+/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
+var RESUBSCRIBE_THROTTLE_TICKS = 5;
+/** First subscribe-retry delay, doubled on every subsequent failure. */
+var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
 /**
-* Build the camera-root capability predicate for a node from its live catalog:
-* `format → canHostCameraRoot`. A format can host a camera root iff the
-* catalog lists at least one object-detection model with a build for that
-* format — byte-for-byte the resolver's per-device skip-gate test for the root
-* step (`addonHasCompatibleModel`), so a device is deemed eligible iff the root
-* would ACTUALLY provision on it.
-*
-* Fails OPEN when the catalog has no object-detection slot at all (never
-* observed in production) so a malformed/empty catalog never strands every
-* device off the balancer. Pure + deterministic.
+* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
+* enough to recover within a single reconcile of the orchestrator and slow
+* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
 */
-function makeRootCapabilityGuard(catalog) {
-	for (const slot of catalog.slots) {
-		const objDet = slot.addons.find((a) => a.id === OBJECT_DETECTION_STEP_ID);
-		if (objDet) return (format) => objDet.models.some((m) => Boolean(m.formats[format]));
-	}
-	return () => true;
-}
-/** Split a deviceKey (`<backend>:<device>`, or bare `cpu`) into its parts + format.
-*  Format comes from the shared {@link deviceBackendToFormat} SSOT (`@camstack/types`)
-*  — the previously-local `BACKEND_FORMAT` copy is gone (R3/node-F2). Used only for
-*  STORED-ONLY keys (a configured device the live probe didn't return); a probed
-*  device carries its own honest `format` from the descriptor. */
-function parseDeviceKey(deviceKey) {
-	const colon = deviceKey.indexOf(":");
-	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
-	return {
-		backend,
-		device: colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey,
-		format: deviceBackendToFormat(backend)
-	};
-}
+var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
 /**
-* The object-detection model the executor defaults to for a deviceKey. Mirrors
-* the executor's `MODEL_BY_CLASS` classification (`classifyAccelerator`) plus
-* the tflite `defaultModelIdByFormat` for Coral. Never throws; unknown backends
-* fall back to the universal nano default (`yolo26n`).
+* Attempts after which a still-failing subscribe escalates from the fast 5 s
+* ceiling to {@link LONG_SUBSCRIBE_RETRY_BACKOFF_MS}. ~15 attempts ≈ one
+* minute of fast retries — plenty for the boot races the 5 s ceiling exists
+* for. A broker that is STILL absent after that is a long-lived condition
+* (e.g. a DISABLED camera, whose broker the stream-broker reconcile refuses
+* to recreate — 2026-07-23) and retrying every 5 s forever is pure log/RPC
+* churn. The slow loop stays alive so audio still recovers automatically
+* (≤60 s) once the camera is re-enabled.
 */
-function defaultModelIdForDevice(deviceKey) {
-	const { backend, device } = parseDeviceKey(deviceKey);
-	if (backend === "openvino") {
-		if (device === "cpu") return "yolo26n";
-		return "yolov9m-320-int8";
-	}
-	if (backend === "edgetpu") return "ssd-mobilenet-v2-coco-edgetpu";
-	if (backend === "coreml") return "yolov9m-320";
-	return "yolo26n";
-}
+var PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS = 15;
+var LONG_SUBSCRIBE_RETRY_BACKOFF_MS = 6e4;
 /**
-* Step-tree device jump (phase 1): validate every `steps[step].jumpDeviceKey`
-* manual override in a to-be-saved `inferenceDevices` map. A jump target MUST be
-* an enabled∧available device on the SAME node and DIFFERENT from the owning
-* device. `enabledAvailableKeys` is the effective enabled∧available set (from
-* `mergeInferenceDevices(probe, submitted)`) so an absent/unplugged/disabled
-* target is rejected honestly (an operator can't route a step onto a dead pool).
-* Returns the FIRST human-readable error, or `null` when every override is
-* valid. Pure + deterministic.
+* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
+*
+* Always resolves to a teardown closure — when the broker is not yet
+* registered the closure cancels the ongoing retry loop; when polling is
+* active it stops the loop and releases the broker subscription. Mirrors
+* `startFrameHandlePoller` so video and audio recover identically.
 */
-function validateJumpTargets(inferenceDevices, enabledAvailableKeys) {
-	for (const [deviceKey, entry] of Object.entries(inferenceDevices)) for (const [stepId, step] of Object.entries(entry.steps ?? {})) {
-		const target = step.jumpDeviceKey;
-		if (target === void 0) continue;
-		if (target === deviceKey) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey pointing at its own device`;
-		if (!enabledAvailableKeys.has(target)) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey "${target}" that is not an enabled, available device on this node`;
-	}
-	return null;
+function startAudioChunkPoller(options) {
+	const lifecycle = {
+		stopped: false,
+		retryTimer: void 0,
+		pollTimer: void 0,
+		activeSubscriptionId: null
+	};
+	const teardown = () => {
+		if (lifecycle.stopped) return;
+		lifecycle.stopped = true;
+		if (lifecycle.retryTimer) {
+			clearTimeout(lifecycle.retryTimer);
+			lifecycle.retryTimer = void 0;
+		}
+		if (lifecycle.pollTimer) {
+			clearTimeout(lifecycle.pollTimer);
+			lifecycle.pollTimer = void 0;
+		}
+		const subId = lifecycle.activeSubscriptionId;
+		if (subId) {
+			lifecycle.activeSubscriptionId = null;
+			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
+				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
+					brokerId: options.brokerId,
+					subscriptionId: subId,
+					error: errMsg(err)
+				} });
+			});
+		}
+	};
+	subscribeWithRetry(options, lifecycle);
+	return teardown;
 }
 /**
-* Merge a node's live-probed inference devices with its stored per-device map.
-*
-* The default is **AUTO = all discovered ACCELERATORS enabled** (spec C2,
-* opt-OUT) with TWO deliberate exceptions, both **opt-IN** (default disabled):
-*
-*   - **CPU**: `enumerateInferenceDevices` always emits a universal `cpu`
-*     floor on every platform; auto-enabling it would let the balancer
-*     round-robin ~1/N of sessions onto the slow CPU pool alongside the
-*     NPU/iGPU/ANE. CPU stays the always-available FALLBACK (a node with no
-*     eligible accelerator leaves `deviceKey` unset → the runner's default
-*     pool, which is CPU), not a balanced target — matching the spec's "no
-*     device eligible → fall back to CPU".
-*   - **Coral Edge TPU (`edgetpu`)**: the standing rule since the Coral
-*     executor landed is that it surfaces as selectable but is NEVER
-*     auto-picked — it runs a DIFFERENT, weaker model family (tflite SSD
-*     MobileNet, not the YOLO the other accelerators run), so silently
-*     enrolling a plugged-in Coral changes detection QUALITY, not just
-*     placement. The opt-OUT default did exactly that on 2026-08-01: a hub
-*     Coral nobody enabled entered the session rotation and camera 615 spent
-*     hours at 2.4fps failing tflite model resolution. An operator who wants
-*     the Coral balanced opts it in explicitly (`enabled: true`).
-*
-* So: an NPU/iGPU/ANE accelerator with NO stored entry is `enabled:true`; a
-* CPU or edgetpu device with no stored entry is `enabled:false`; an explicit
-* stored `enabled` always wins (an operator can opt CPU/Coral in, or an
-* accelerator out). A stored-only key (configured but the probe did not
-* return it — removed/unplugged HW) keeps its stored `enabled` and surfaces
-* as `available:false`, so the UI still shows it.
-*
-* Pure + deterministic (sorted by key) — the single merge authority shared by
-* the `getNodeInferenceDevices` view and the dispatcher's eligible-device pick.
+* Run the subscribe → poll handshake with exponential backoff on subscribe
+* failures. Resolves once the subscription is acquired (and the poll loop has
+* been started) or once `lifecycle.stopped` flips, whichever comes first.
 */
-function mergeInferenceDevices(probed, stored) {
-	const probedByKey = new Map(probed.map((d) => [d.key, d]));
-	const keys = new Set([...probedByKey.keys(), ...Object.keys(stored)]);
-	const out = [];
-	for (const key of Array.from(keys).toSorted()) {
-		const descriptor = probedByKey.get(key);
-		const opt = stored[key];
-		const parsed = descriptor ?? parseDeviceKey(key);
-		const weight = opt?.weight !== void 0 && opt.weight > 0 ? opt.weight : 1;
-		const autoDefault = parsed.backend !== "cpu" && parsed.backend !== "edgetpu";
-		out.push({
-			key,
-			backend: parsed.backend,
-			device: parsed.device,
-			format: parsed.format,
-			available: descriptor?.available ?? false,
-			enabled: opt?.enabled ?? autoDefault,
-			weight,
-			maxSessions: opt?.maxSessions ?? null,
-			defaultModelId: defaultModelIdForDevice(key),
-			...opt?.steps && Object.keys(opt.steps).length > 0 ? { steps: { ...opt.steps } } : {}
-		});
+async function subscribeWithRetry(options, lifecycle) {
+	const { api, brokerId, tag, ownerNodeId, logger } = options;
+	const pin = nodePin(ownerNodeId);
+	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
+	let attempt = 0;
+	while (!lifecycle.stopped) {
+		attempt += 1;
+		try {
+			const result = await api.streamBroker.subscribeAudioChunks.mutate({
+				brokerId,
+				tag
+			}, pin);
+			if (lifecycle.stopped) {
+				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }, pin).catch((err) => {
+					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
+						brokerId,
+						subscriptionId: result.subscriptionId,
+						error: errMsg(err)
+					} });
+				});
+				return;
+			}
+			if (attempt > 1) logger.info("audio-chunk poller: subscribeAudioChunks recovered", { meta: {
+				brokerId,
+				tag,
+				attempt
+			} });
+			lifecycle.activeSubscriptionId = result.subscriptionId;
+			startPolling(options, lifecycle);
+			return;
+		} catch (err) {
+			if (lifecycle.stopped) return;
+			if (attempt === 1) logger.warn("audio-chunk poller: subscribeAudioChunks failed, retrying", { meta: {
+				brokerId,
+				tag,
+				error: errMsg(err),
+				nextRetryInMs: backoffMs
+			} });
+			else logger.debug("audio-chunk poller: subscribeAudioChunks still failing", { meta: {
+				brokerId,
+				tag,
+				attempt,
+				error: errMsg(err),
+				nextRetryInMs: backoffMs
+			} });
+			await sleep(backoffMs, lifecycle);
+			backoffMs = Math.min(attempt >= PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS ? LONG_SUBSCRIBE_RETRY_BACKOFF_MS : MAX_SUBSCRIBE_RETRY_BACKOFF_MS, backoffMs * 2);
+		}
 	}
-	return out;
 }
 /**
-* The per-device concurrent-session caps for a node as `deviceKey → maxSessions`
-* (only devices that carry an explicit cap; absent = unlimited). Fed to the
-* device balancer's `nodeCaps` so a device at its cap is skipped (audit F3).
+* Drive the steady-state poll loop. Mid-stream `pullAudioChunks` failures
+* trigger a fresh `subscribeAudioChunks` via the recovery branch — covers
+* the broker child restart case where our `subscriptionId` is silently
+* disowned.
 */
-function inferenceDeviceCaps(stored) {
-	const out = {};
-	for (const [key, entry] of Object.entries(stored)) if (entry.maxSessions !== void 0 && entry.maxSessions > 0) out[key] = entry.maxSessions;
-	return out;
-}
-/** Is this device the CPU fallback rather than a real accelerator? */
-function isCpuFallback(view) {
-	return view.backend === "cpu";
-}
-function resolveInferenceDeviceEligibility(probed, stored, canRunRoot, isPoolUsable) {
-	const eligible = {};
-	const excluded = [];
-	const merged = mergeInferenceDevices(probed, stored);
-	const acceleratorServes = merged.some((d) => !isCpuFallback(d) && d.enabled && d.available && (!canRunRoot || canRunRoot(d.format)));
-	for (const d of merged) {
-		if (!d.enabled) {
-			excluded.push({
-				key: d.key,
-				reason: "disabled",
-				format: d.format
-			});
-			continue;
-		}
-		if (!d.available) {
-			excluded.push({
-				key: d.key,
-				reason: "unavailable",
-				format: d.format
-			});
-			continue;
-		}
-		if (isPoolUsable && !isPoolUsable(d.key)) {
-			excluded.push({
-				key: d.key,
-				reason: "unavailable",
-				format: d.format
-			});
-			continue;
-		}
-		if (canRunRoot && !canRunRoot(d.format)) {
-			excluded.push({
-				key: d.key,
-				reason: "cannot-host-camera-root",
-				format: d.format
-			});
-			continue;
+function startPolling(options, lifecycle) {
+	const { api, brokerId, tag, ownerNodeId, onChunk, logger } = options;
+	const pin = nodePin(ownerNodeId);
+	let consecutiveFailures = 0;
+	const resubscribe = async () => {
+		try {
+			const result = await api.streamBroker.subscribeAudioChunks.mutate({
+				brokerId,
+				tag
+			}, pin);
+			lifecycle.activeSubscriptionId = result.subscriptionId;
+			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
+				brokerId,
+				tag,
+				subscriptionId: result.subscriptionId,
+				afterFailures: consecutiveFailures
+			} });
+			return true;
+		} catch {
+			return false;
 		}
-		if (isCpuFallback(d) && acceleratorServes) {
-			excluded.push({
-				key: d.key,
-				reason: "accelerator-preferred",
-				format: d.format
-			});
-			continue;
+	};
+	const tick = async () => {
+		if (lifecycle.stopped) return;
+		const subId = lifecycle.activeSubscriptionId;
+		if (!subId) return;
+		try {
+			const chunks = await api.streamBroker.pullAudioChunks.query({
+				subscriptionId: subId,
+				maxCount: PULL_MAX_COUNT
+			}, pin);
+			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
+				brokerId,
+				subscriptionId: subId
+			} });
+			consecutiveFailures = 0;
+			for (const chunk of chunks) {
+				if (lifecycle.stopped) break;
+				await onChunk(chunk);
+			}
+		} catch (err) {
+			consecutiveFailures += 1;
+			if (consecutiveFailures === 1) logger.warn("audio-chunk poller: pullAudioChunks failed — attempting recovery", { meta: {
+				brokerId,
+				subscriptionId: subId,
+				error: errMsg(err)
+			} });
+			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
 		}
-		eligible[d.key] = d.weight;
-	}
-	return {
-		eligible,
-		excluded
+		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS$1);
 	};
+	tick();
 }
 /**
-* Join the merged device rows with the eligibility verdict so the UI can NAME
-* why an accelerator is not in play instead of leaving the operator to deduce
-* it from `enabled`/`available`.
-*
-* Deduction is not possible for two of the four reasons — `accelerator-preferred`
-* is a node-WIDE rule (a CPU row reads `enabled:true, available:true` and still
-* never gets a session, D215) and `cannot-host-camera-root` needs the node's
-* model catalog. Both live in {@link resolveInferenceDeviceEligibility}, so this
-* function only transports its answer; it never re-derives one.
-*
-* Pure; preserves `merged`'s order (sorted by key) and every other field.
+* Cancellable sleep — wakes early when `lifecycle.stopped` flips. We
+* keep a local wrapper around the shared {@link sleep} helper because
+* the lifecycle tracks the active retry timer for `teardown()` to
+* clear; pure `sleep()` would leak the timer if teardown fired while
+* we were waiting.
 */
-function annotateInferenceDeviceExclusions(merged, eligibility) {
-	const reasonByKey = new Map(eligibility.excluded.map((e) => [e.key, e.reason]));
-	return merged.map((view) => ({
-		...view,
-		exclusion: reasonByKey.get(view.key) ?? null
-	}));
+function sleep(ms, lifecycle) {
+	return new Promise((resolve) => {
+		if (lifecycle.stopped) {
+			resolve();
+			return;
+		}
+		lifecycle.retryTimer = setTimeout(() => {
+			lifecycle.retryTimer = void 0;
+			resolve();
+		}, ms);
+	});
 }
-function resolveNodeInferenceUsability(eligibility) {
-	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
-	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
+//#endregion
+//#region src/audio-load-balancer.ts
+function balanceAudio(input) {
+	if (input.nodes.length === 0) return null;
+	if (input.preferredNode) {
+		const pinned = input.nodes.find((n) => n.nodeId === input.preferredNode);
+		if (pinned) return {
+			nodeId: pinned.nodeId,
+			reason: "manual"
+		};
+	}
 	return {
-		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
-		unavailableKeys,
-		eligibleKeys
+		nodeId: input.nodes.slice().toSorted((a, b) => a.deviceCount - b.deviceCount)[0].nodeId,
+		reason: "capacity"
 	};
 }
+//#endregion
+//#region src/orchestrator-types.ts
+var PHASE_MODE_VALUES = new Set([
+	"disabled",
+	"always-on",
+	"on-motion"
+]);
+function isPipelinePhaseMode(v) {
+	return PHASE_MODE_VALUES.has(v);
+}
 /**
-* Step-tree device jump (phase 1): the attach-payload roster of a node's
-* enabled∧available inference devices with the balancer knobs (`weight`,
-* `maxSessions`) the runner uses to AUTO-jump an enrichment step off a device
-* whose format can't run it. Built from the SAME `eligible` (deviceKey→weight)
-* and `caps` (deviceKey→maxSessions) the dispatcher already computes, so the
-* roster the runner sees exactly matches the balancer's candidate set. Sorted
-* by key for determinism. Populated onto `RunnerCameraConfig.inferenceDevices`
-* ONLY when a `deviceKey` is elected and there are ≥2 entries.
-*/
-function buildInferenceDeviceRoster(eligible, caps) {
-	return Object.entries(eligible).map(([deviceKey, weight]) => ({
-		deviceKey,
-		weight: weight > 0 ? weight : 1,
-		maxSessions: caps[deviceKey] ?? null
-	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
-}
-//#endregion
-//#region src/node-inference-usability-mirror.ts
-var NodeInferenceUsabilityMirror = class {
-	state = /* @__PURE__ */ new Map();
-	/**
-	* Fold one observation in and report whether the caller should act.
-	* Never throws.
-	*/
-	observe(nodeId, usable) {
-		const prev = this.state.get(nodeId);
-		if (usable) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: false
-			});
-			return prev !== void 0 && !prev.usable ? "recovered" : null;
-		}
-		if (prev === void 0) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: true
-			});
-			return null;
-		}
-		if (!prev.usable) {
-			this.state.set(nodeId, {
-				usable: false,
-				armed: true
-			});
-			return null;
-		}
-		if (!prev.armed) {
-			this.state.set(nodeId, {
-				usable: true,
-				armed: true
-			});
-			return null;
-		}
-		this.state.set(nodeId, {
-			usable: false,
-			armed: true
-		});
-		return "became-unusable";
-	}
-	/** Can this node be given cameras? Unknown nodes answer YES. */
-	isUsable(nodeId) {
-		return this.state.get(nodeId)?.usable ?? true;
-	}
-	/** Nodes currently excluded — for the placement log and diagnostics. */
-	unusableNodeIds() {
-		const out = [];
-		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
-		return out.toSorted();
-	}
-	forget(nodeId) {
-		this.state.delete(nodeId);
-	}
-	reset() {
-		this.state.clear();
-	}
-};
-//#endregion
-//#region src/inference-device-usability-mirror.ts
-/**
-* InferenceDeviceUsabilityMirror — "can this NODE's THIS DEVICE still infer?",
-* kept off the placement path.
-*
-* The per-`(nodeId, deviceKey)` twin of {@link NodeInferenceUsabilityMirror},
-* and deliberately not a second mechanism: it composes the key and delegates
-* every decision to that class, so the arm/apply reluctance D49 pinned lives in
-* exactly one implementation and cannot drift between the node tier and the
-* device tier.
-*
-* ## Why this tier had to exist
-*
-* The node tier already answers "does this node have ANY usable accelerator".
-* On 2026-08-25 the hub's answer was, correctly, yes — its NPU was healthy the
-* whole time. What died was one DEVICE, `openvino:gpu`, and nothing anywhere
-* asked that question: the per-dispatch capability gate is keyed on model
-* FORMAT and `openvino:gpu` and `openvino:npu` share the format `openvino`, so
-* it is blind between them by construction. The balancer kept rotating cameras
-* onto the dead pool — 20 sessions in 20 minutes, every one `tieBreak:
-* "rotation"` — for 31 hours.
-*
-* ## Why a mirror and not the event
-*
-* D49, verbatim: *a one-shot event never gates on a fallible read*. The gate is
-* this in-memory mirror, refreshed off the event path by the same
-* `resolveEligibleInferenceDevices` the dispatcher already runs (plus the
-* session controller's background refresher). The consequences that buys:
-*
-*  - **A read that fails changes nothing.** The caller folds in an observation
-*    only when it HAS one; an unreachable node, a version-skewed executor or a
-*    rejected RPC never reaches {@link observe}, so the previous verdict
-*    stands. This is the whole reason the health read is specified as
-*    "synchronous over in-memory state, never throws for its own reasons": an
-*    empty answer must mean *nothing is refused*, not *I could not tell*.
-*  - **Excluding a healthy device needs a second, consecutive read.** Exclusion
-*    is the direction that DESTROYS work — it strands an accelerator that may
-*    be perfectly fine — so one bad observation only ARMS.
-*  - **Re-admitting is immediate and unconditional.** One good observation puts
-*    the device straight back. Being slow to exclude costs some wasted
-*    inference attempts; being slow to re-admit costs an idle accelerator and a
-*    node that looks broken.
-*/
-/**
-* NUL — impossible in both a Moleculer node id and a `<backend>:<device>` key,
-* so the composite key can never be ambiguous. A separator that CAN occur in
-* either half makes two distinct pairs collide, and a collision here silently
-* excludes an accelerator nobody reported.
-*/
-var SEPARATOR = "\0";
-var InferenceDeviceUsabilityMirror = class {
-	/** The one implementation of the arm/apply state machine (D49). */
-	mirror = new NodeInferenceUsabilityMirror();
-	/**
-	* Fold one observation in and report whether the caller should act.
-	* Never throws.
-	*/
-	observe(nodeId, deviceKey, usable) {
-		return this.mirror.observe(`${nodeId}${SEPARATOR}${deviceKey}`, usable);
-	}
-	/** Can the balancer put a session on this device? Unknown pairs answer YES. */
-	isUsable(nodeId, deviceKey) {
-		return this.mirror.isUsable(`${nodeId}${SEPARATOR}${deviceKey}`);
-	}
-	/** Pairs currently excluded — for the placement log and diagnostics. */
-	unusableDevices() {
-		return this.mirror.unusableNodeIds().map((composite) => {
-			const at = composite.indexOf(SEPARATOR);
-			return {
-				nodeId: composite.slice(0, at),
-				deviceKey: composite.slice(at + 1)
-			};
-		});
-	}
-	/** The excluded device keys on ONE node. */
-	unusableDeviceKeys(nodeId) {
-		return this.unusableDevices().filter((d) => d.nodeId === nodeId).map((d) => d.deviceKey);
-	}
-	forget(nodeId, deviceKey) {
-		this.mirror.forget(`${nodeId}${SEPARATOR}${deviceKey}`);
-	}
-	reset() {
-		this.mirror.reset();
-	}
-};
-/**
-* Fold ONE node's health answer into the mirror and return what changed.
-*
-* This is the whole reading discipline, in one place, because both halves of it
-* are easy to get subtly wrong and neither failure is visible in a log:
-*
-*  - **`unhealthy === null` — the read FAILED — changes nothing.** Not a single
-*    entry is touched. An unreachable node, a version-skewed executor or a
-*    rejected RPC must be distinguishable from "asked, nothing is refused", or
-*    a flaky link silently re-admits a dead accelerator (D49).
-*  - **Every device the node HAS is observed**, not merely the refused ones.
-*    The first draft observed `refused ∪ already-excluded`, which omits exactly
-*    the devices the mirror has ARMED — so their disarming good read never
-*    arrived and two bad reads an HOUR apart, with a hundred healthy ones
-*    between them, excluded a working accelerator. "Consecutive" is only a
-*    property if the good observations are delivered.
-*
-* Pure with respect to everything except `mirror`, and never throws — it is
-* called from the dispatcher's own read path.
-*/
-function foldInferenceDeviceHealth(mirror, nodeId, unhealthy, present) {
-	if (unhealthy === null) return [];
-	const refused = new Set(unhealthy);
-	const observed = new Set([
-		...present,
-		...refused,
-		...mirror.unusableDeviceKeys(nodeId)
-	]);
-	const changes = [];
-	for (const deviceKey of observed) {
-		const transition = mirror.observe(nodeId, deviceKey, !refused.has(deviceKey));
-		if (transition !== null) changes.push({
-			deviceKey,
-			transition
-		});
-	}
-	return changes;
-}
-//#endregion
-//#region src/orchestrator-types.ts
-var PHASE_MODE_VALUES = new Set([
-	"disabled",
-	"always-on",
-	"on-motion"
-]);
-function isPipelinePhaseMode(v) {
-	return PHASE_MODE_VALUES.has(v);
-}
-/**
-* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
-* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
-* `reconcileDispatch` is additive-only and never revisits these, so a slow
-* safety-net timer + event-driven debounce triggers recover them.
+* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
+* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
+* `reconcileDispatch` is additive-only and never revisits these, so a slow
+* safety-net timer + event-driven debounce triggers recover them.
 */
 var PENDING_RETRY_INTERVAL_MS = 6e4;
 /** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
@@ -40644,264 +40499,6 @@ var pipelineOrchestratorActions = defineCustomActions({
 */
 var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
 //#endregion
-//#region src/audio-chunk-poller.ts
-/**
-* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
-* plane (Phase 5 / D9).
-*
-* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
-* path. A live callback cannot cross a process boundary; once the `pipeline`
-* group is dissolved (Task 8) the orchestrator runs in a different process
-* from the broker, so audio delivery must go over tRPC.
-*
-* The consumer:
-*
-*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
-*      registers a per-subscription bounded FIFO queue and returns a
-*      `subscriptionId`;
-*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
-*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
-*   3. feeds each chunk to its downstream audio logic;
-*   4. on teardown, `unsubscribeAudioChunks`.
-*
-* Audio is not latency-critical like video, and chunks arrive only ~every
-* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
-* a small per-poll burst keeps latency low without busy-spinning. The
-* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
-* loses a chunk.
-*
-* Boot-race tolerance: the broker for a given camStream may not be registered
-* yet when the orchestrator wires the subscription (provider addons publish
-* their cameraStreams asynchronously after their probe completes).
-* `subscribeAudioChunks` retries with exponential backoff (capped at
-* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
-* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
-* shape so video and audio plumbing self-heal identically.
-*/
-/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
-var POLL_INTERVAL_MS$1 = 200;
-/** How many chunks to drain per poll — a small burst absorbs jitter. */
-var PULL_MAX_COUNT = 8;
-/**
-* Consecutive pull failures before we attempt to re-subscribe. A single failed
-* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
-* sustained failure means the broker child restarted and dropped our
-* subscription, so we re-establish it.
-*/
-var RESUBSCRIBE_AFTER_FAILURES = 2;
-/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
-var RESUBSCRIBE_THROTTLE_TICKS = 5;
-/** First subscribe-retry delay, doubled on every subsequent failure. */
-var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
-/**
-* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
-* enough to recover within a single reconcile of the orchestrator and slow
-* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
-*/
-var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
-/**
-* Attempts after which a still-failing subscribe escalates from the fast 5 s
-* ceiling to {@link LONG_SUBSCRIBE_RETRY_BACKOFF_MS}. ~15 attempts ≈ one
-* minute of fast retries — plenty for the boot races the 5 s ceiling exists
-* for. A broker that is STILL absent after that is a long-lived condition
-* (e.g. a DISABLED camera, whose broker the stream-broker reconcile refuses
-* to recreate — 2026-07-23) and retrying every 5 s forever is pure log/RPC
-* churn. The slow loop stays alive so audio still recovers automatically
-* (≤60 s) once the camera is re-enabled.
-*/
-var PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS = 15;
-var LONG_SUBSCRIBE_RETRY_BACKOFF_MS = 6e4;
-/**
-* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
-*
-* Always resolves to a teardown closure — when the broker is not yet
-* registered the closure cancels the ongoing retry loop; when polling is
-* active it stops the loop and releases the broker subscription. Mirrors
-* `startFrameHandlePoller` so video and audio recover identically.
-*/
-function startAudioChunkPoller(options) {
-	const lifecycle = {
-		stopped: false,
-		retryTimer: void 0,
-		pollTimer: void 0,
-		activeSubscriptionId: null
-	};
-	const teardown = () => {
-		if (lifecycle.stopped) return;
-		lifecycle.stopped = true;
-		if (lifecycle.retryTimer) {
-			clearTimeout(lifecycle.retryTimer);
-			lifecycle.retryTimer = void 0;
-		}
-		if (lifecycle.pollTimer) {
-			clearTimeout(lifecycle.pollTimer);
-			lifecycle.pollTimer = void 0;
-		}
-		const subId = lifecycle.activeSubscriptionId;
-		if (subId) {
-			lifecycle.activeSubscriptionId = null;
-			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
-				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
-					brokerId: options.brokerId,
-					subscriptionId: subId,
-					error: errMsg(err)
-				} });
-			});
-		}
-	};
-	subscribeWithRetry(options, lifecycle);
-	return teardown;
-}
-/**
-* Run the subscribe → poll handshake with exponential backoff on subscribe
-* failures. Resolves once the subscription is acquired (and the poll loop has
-* been started) or once `lifecycle.stopped` flips, whichever comes first.
-*/
-async function subscribeWithRetry(options, lifecycle) {
-	const { api, brokerId, tag, ownerNodeId, logger } = options;
-	const pin = nodePin(ownerNodeId);
-	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
-	let attempt = 0;
-	while (!lifecycle.stopped) {
-		attempt += 1;
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			}, pin);
-			if (lifecycle.stopped) {
-				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }, pin).catch((err) => {
-					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
-						brokerId,
-						subscriptionId: result.subscriptionId,
-						error: errMsg(err)
-					} });
-				});
-				return;
-			}
-			if (attempt > 1) logger.info("audio-chunk poller: subscribeAudioChunks recovered", { meta: {
-				brokerId,
-				tag,
-				attempt
-			} });
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			startPolling(options, lifecycle);
-			return;
-		} catch (err) {
-			if (lifecycle.stopped) return;
-			if (attempt === 1) logger.warn("audio-chunk poller: subscribeAudioChunks failed, retrying", { meta: {
-				brokerId,
-				tag,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			else logger.debug("audio-chunk poller: subscribeAudioChunks still failing", { meta: {
-				brokerId,
-				tag,
-				attempt,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			await sleep(backoffMs, lifecycle);
-			backoffMs = Math.min(attempt >= PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS ? LONG_SUBSCRIBE_RETRY_BACKOFF_MS : MAX_SUBSCRIBE_RETRY_BACKOFF_MS, backoffMs * 2);
-		}
-	}
-}
-/**
-* Drive the steady-state poll loop. Mid-stream `pullAudioChunks` failures
-* trigger a fresh `subscribeAudioChunks` via the recovery branch — covers
-* the broker child restart case where our `subscriptionId` is silently
-* disowned.
-*/
-function startPolling(options, lifecycle) {
-	const { api, brokerId, tag, ownerNodeId, onChunk, logger } = options;
-	const pin = nodePin(ownerNodeId);
-	let consecutiveFailures = 0;
-	const resubscribe = async () => {
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			}, pin);
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
-				brokerId,
-				tag,
-				subscriptionId: result.subscriptionId,
-				afterFailures: consecutiveFailures
-			} });
-			return true;
-		} catch {
-			return false;
-		}
-	};
-	const tick = async () => {
-		if (lifecycle.stopped) return;
-		const subId = lifecycle.activeSubscriptionId;
-		if (!subId) return;
-		try {
-			const chunks = await api.streamBroker.pullAudioChunks.query({
-				subscriptionId: subId,
-				maxCount: PULL_MAX_COUNT
-			}, pin);
-			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
-				brokerId,
-				subscriptionId: subId
-			} });
-			consecutiveFailures = 0;
-			for (const chunk of chunks) {
-				if (lifecycle.stopped) break;
-				await onChunk(chunk);
-			}
-		} catch (err) {
-			consecutiveFailures += 1;
-			if (consecutiveFailures === 1) logger.warn("audio-chunk poller: pullAudioChunks failed — attempting recovery", { meta: {
-				brokerId,
-				subscriptionId: subId,
-				error: errMsg(err)
-			} });
-			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
-		}
-		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS$1);
-	};
-	tick();
-}
-/**
-* Cancellable sleep — wakes early when `lifecycle.stopped` flips. We
-* keep a local wrapper around the shared {@link sleep} helper because
-* the lifecycle tracks the active retry timer for `teardown()` to
-* clear; pure `sleep()` would leak the timer if teardown fired while
-* we were waiting.
-*/
-function sleep(ms, lifecycle) {
-	return new Promise((resolve) => {
-		if (lifecycle.stopped) {
-			resolve();
-			return;
-		}
-		lifecycle.retryTimer = setTimeout(() => {
-			lifecycle.retryTimer = void 0;
-			resolve();
-		}, ms);
-	});
-}
-//#endregion
-//#region src/audio-load-balancer.ts
-function balanceAudio(input) {
-	if (input.nodes.length === 0) return null;
-	if (input.preferredNode) {
-		const pinned = input.nodes.find((n) => n.nodeId === input.preferredNode);
-		if (pinned) return {
-			nodeId: pinned.nodeId,
-			reason: "manual"
-		};
-	}
-	return {
-		nodeId: input.nodes.slice().toSorted((a, b) => a.deviceCount - b.deviceCount)[0].nodeId,
-		reason: "capacity"
-	};
-}
-//#endregion
 //#region src/audio-window-accumulator.ts
 var AudioWindowAccumulator = class {
 	deviceId;
@@ -41405,234 +41002,847 @@ var AudioSubscriptionController = class {
 					meta: { error: errMsg(err) }
 				});
 			});
-		}, windowMs);
-		this.motionAudioWindowTimers.set(deviceId, timer);
-	}
-	/** True while a motion-driven audio window is open for this device. */
-	isMotionAudioWindowOpen(deviceId) {
-		return this.motionAudioWindowTimers.has(deviceId);
-	}
-	/**
-	* Close an on-motion audio window and drop its subscription. Shared by both
-	* closers (quiet window elapsed / falling edge cooldown) so they can never
-	* disagree about what "closed" means. `reason` is logged so a camera that
-	* loses audio can always be told WHY from the per-device log view.
-	*/
-	async closeMotionAudioWindow(deviceId, reason) {
-		const pendingWindow = this.motionAudioWindowTimers.get(deviceId);
-		if (pendingWindow) {
-			clearTimeout(pendingWindow);
-			this.motionAudioWindowTimers.delete(deviceId);
+		}, windowMs);
+		this.motionAudioWindowTimers.set(deviceId, timer);
+	}
+	/** True while a motion-driven audio window is open for this device. */
+	isMotionAudioWindowOpen(deviceId) {
+		return this.motionAudioWindowTimers.has(deviceId);
+	}
+	/**
+	* Close an on-motion audio window and drop its subscription. Shared by both
+	* closers (quiet window elapsed / falling edge cooldown) so they can never
+	* disagree about what "closed" means. `reason` is logged so a camera that
+	* loses audio can always be told WHY from the per-device log view.
+	*/
+	async closeMotionAudioWindow(deviceId, reason) {
+		const pendingWindow = this.motionAudioWindowTimers.get(deviceId);
+		if (pendingWindow) {
+			clearTimeout(pendingWindow);
+			this.motionAudioWindowTimers.delete(deviceId);
+		}
+		await this.withAudioSubLock(deviceId, async () => {
+			const unsub = this.audioSubscriptions.get(deviceId);
+			if (!unsub) return;
+			try {
+				unsub();
+			} catch {}
+			this.audioSubscriptions.delete(deviceId);
+			this.deps.logger.info("lazy audio: window closed", {
+				tags: { deviceId },
+				meta: { reason }
+			});
+		});
+	}
+	/**
+	* Audio teardown for one device — the audio half of `stopDetection`.
+	* Tears down through the per-device lock so it can't race a concurrent
+	* subscribe (which would re-store a handle this teardown never sees).
+	*/
+	async stopForDevice(deviceId) {
+		await this.withAudioSubLock(deviceId, async () => {
+			const unsub = this.audioSubscriptions.get(deviceId);
+			if (unsub) {
+				try {
+					unsub();
+				} catch {}
+				this.audioSubscriptions.delete(deviceId);
+			}
+		});
+		const lazyTimer = this.lazyAudioTeardownTimers.get(deviceId);
+		if (lazyTimer) {
+			clearTimeout(lazyTimer);
+			this.lazyAudioTeardownTimers.delete(deviceId);
+		}
+		const windowTimer = this.motionAudioWindowTimers.get(deviceId);
+		if (windowTimer) {
+			clearTimeout(windowTimer);
+			this.motionAudioWindowTimers.delete(deviceId);
+		}
+		this.audioAssignments.delete(deviceId);
+	}
+	/**
+	* Centralized write into `audioSubscriptions`. If shutdown has begun, the
+	* map has already been (or is about to be) cleared lock-free in
+	* `shutdown()`; storing here would leak a zombie entry whose `unsub` is
+	* never called. So when shutting down we immediately invoke `unsub`
+	* (best-effort, error-swallowed) and DO NOT store. `protected` so
+	* `audio-sub-lock.spec.ts`'s test subclass can assert the shutdown-guard
+	* behavior without casts.
+	*/
+	storeAudioSub(deviceId, unsub) {
+		if (this.audioShuttingDown) {
+			try {
+				unsub();
+			} catch {}
+			return;
+		}
+		this.audioSubscriptions.set(deviceId, unsub);
+	}
+	/**
+	* Serialize an audio-subscription critical section per device. `fn` is
+	* chained onto the device's current lock tail, so concurrent calls for the
+	* SAME deviceId run sequentially (FIFO); different deviceIds never block
+	* each other. Thin delegate onto the `audioSubLocks` `KeyedAsyncLock`
+	* instance. `protected` so `audio-sub-lock.spec.ts`'s test subclass can
+	* drive the lock without casts.
+	*/
+	withAudioSubLock(deviceId, fn) {
+		return this.audioSubLocks.run(deviceId, fn);
+	}
+	/**
+	* Subscribe to decoded audio chunks for a camera and feed them into the
+	* audio-analyzer. Reads the analyzer's settings via its own
+	* `resolveDeviceSettings(deviceId)` method so the orchestrator does not
+	* touch the audio-analyzer schema field names directly.
+	*/
+	async subscribeAudioStream(deviceId, config) {
+		const api = this.deps.api();
+		if (!api) {
+			this.deps.logger.warn("this.ctx.api not available — cannot subscribe audio", { tags: { deviceId } });
+			return null;
+		}
+		if (!await this.deps.isAudioAnalysisActive(deviceId)) return null;
+		if (config.audioMode === "disabled") {
+			this.deps.logger.debug("audio subscribe skipped: audioMode=disabled", { tags: { deviceId } });
+			return null;
+		}
+		if (config.audioMode === "on-motion" && !this.isMotionAudioWindowOpen(deviceId)) {
+			this.deps.logger.info("audio subscribe deferred: audioMode=on-motion, no window open", { tags: { deviceId } });
+			return null;
+		}
+		const audioStream = config.audioStreamId ?? config.motionStreamId;
+		const audioBrokerId = makeSourceBrokerId(deviceId, audioStream);
+		if ((await this.deps.probeAudioTrack(deviceId, audioStream)).kind === "absent") {
+			this.deps.logger.warn("audio subscription REFUSED — this stream carries no audio track", {
+				tags: { deviceId },
+				meta: {
+					camStreamId: audioStream,
+					brokerId: audioBrokerId,
+					selectedBy: config.audioStreamId !== void 0 ? "audioStreamId" : "motionStreamId",
+					hint: "point the camera’s audio at a stream that has an audio track — no stream is substituted automatically"
+				}
+			});
+			return null;
+		}
+		const settings = await api.audioAnalysis.resolveDeviceSettings.query({ deviceId });
+		if (!settings) {
+			this.deps.logger.warn("audio-analysis returned no settings — audio subscription skipped", { tags: { deviceId } });
+			return null;
+		}
+		const audioNodeId = await this.dispatch(deviceId);
+		const isRemoteAudio = audioNodeId !== this.deps.localNodeId();
+		this.deps.logger.info("audio subscription: resolved audio node", {
+			tags: { deviceId },
+			meta: {
+				audioNodeId,
+				isRemote: isRemoteAudio
+			}
+		});
+		const accumulator = new AudioWindowAccumulator(deviceId);
+		const teardown = startAudioChunkPoller({
+			api,
+			brokerId: audioBrokerId,
+			tag: "audio-analyzer",
+			ownerNodeId: this.deps.ingestNode(),
+			logger: this.deps.logger.withTags({ deviceId }),
+			onChunk: async (chunk) => {
+				this.deps.watchdogNote(deviceId, "audio");
+				try {
+					const audioChunkInput = accumulator.push(chunk);
+					if (!audioChunkInput) return;
+					const result = await api.audioAnalyzer.analyseChunk.mutate({
+						chunk: audioChunkInput,
+						settings,
+						...isRemoteAudio ? { nodeId: audioNodeId } : {}
+					});
+					if (!result) return;
+					const frame = buildAudioResultFrame(deviceId, result);
+					this.deps.eventBus.emit({
+						id: `audio-inference-${deviceId}-${Date.now()}`,
+						timestamp: /* @__PURE__ */ new Date(),
+						source: {
+							type: "device",
+							id: deviceId,
+							nodeId: "hub",
+							addonId: "pipeline-orchestrator",
+							deviceId
+						},
+						category: EventCategory.PipelineAudioInferenceResult,
+						data: {
+							deviceId,
+							frame,
+							nodeId: "hub"
+						}
+					});
+				} catch (err) {
+					const msg = errMsg(err);
+					this.deps.logger.error("Audio analysis failed", {
+						tags: { deviceId },
+						meta: { error: msg }
+					});
+				}
+			}
+		});
+		this.deps.logger.info("Audio stream subscribed", { tags: { deviceId } });
+		return () => {
+			teardown();
+			accumulator.reset();
+		};
+	}
+	/**
+	* Set true at the very start of `onShutdown`, before the audio teardown /
+	* map clears below. Once set, `withAudioSubLock` turns queued/new critical
+	* sections into no-ops and `storeAudioSub` refuses to store, so no
+	* critical section that was in-flight (or queued) when shutdown began can
+	* resurrect a zombie subscription into the cleared `audioSubscriptions`
+	* map. MUST be called before anything else in `onShutdown` that could
+	* race a queued audio critical section (mirrors the original
+	* `this.audioShuttingDown = true` being the very first statement).
+	*/
+	beginShutdown() {
+		this.audioShuttingDown = true;
+	}
+	/**
+	* Full audio teardown — combines the former `onShutdown`'s two separate
+	* audio blocks (lazy-teardown-timer clear, then — after several unrelated
+	* session/reconcile/load-shed clears — subscription teardown + lock clear
+	* + assignment-map clears) into one call. Safe to combine: both blocks
+	* are synchronous with no interleaved `await`, and every original
+	* statement between them (`sessionRegistry.clear()`,
+	* `cameraFpsMap.clear()`, `remoteHealthAttempts.clear()`,
+	* `loadShedState.clear()`, `loadShedResumeTimer` cleanup) touches state
+	* fully disjoint from anything audio — so their relative order to each
+	* other is unaffected, and the audio-internal order (timers →
+	* subscriptions → lock → assignment maps) is reproduced exactly.
+	*/
+	shutdown() {
+		for (const t of this.lazyAudioTeardownTimers.values()) clearTimeout(t);
+		this.lazyAudioTeardownTimers.clear();
+		for (const t of this.motionAudioWindowTimers.values()) clearTimeout(t);
+		this.motionAudioWindowTimers.clear();
+		for (const unsub of this.audioSubscriptions.values()) try {
+			unsub();
+		} catch {}
+		this.audioSubscriptions.clear();
+		this.audioSubLocks.clear();
+		this.audioAssignments.clear();
+		this.readyAudioNodes.clear();
+	}
+};
+//#endregion
+//#region src/disk-reconcile-fleet.ts
+async function reconcileFleetFromDisk(deps) {
+	const deviceIds = await deps.listDeviceIds();
+	const failed = [];
+	let cameras = 0;
+	let mediaDropped = 0;
+	let tracks = 0;
+	let events = 0;
+	let completed = 0;
+	for (const deviceId of deviceIds) {
+		try {
+			await deps.rescanRecordings(deviceId);
+			const counts = await deps.reconcileAnalytics(deviceId);
+			cameras += 1;
+			mediaDropped += counts.mediaDropped;
+			tracks += counts.tracks;
+			events += counts.events;
+		} catch {
+			failed.push(deviceId);
+		}
+		completed += 1;
+		deps.onProgress?.({
+			deviceId,
+			total: deviceIds.length,
+			completed,
+			failed: [...failed],
+			mediaDropped,
+			tracks,
+			events
+		});
+	}
+	return {
+		cameras,
+		failed,
+		mediaDropped,
+		tracks,
+		events
+	};
+}
+//#endregion
+//#region src/disk-reconcile-job.ts
+/**
+* In-memory disk-wins fleet job. The tRPC mutation starts this and returns
+* immediately; the walk runs in the addon process so a 60s UDS timeout cannot
+* abort it. Status is polled via getReconcileFromDiskStatus.
+*/
+function idleDiskReconcileJob() {
+	return {
+		state: "idle",
+		total: 0,
+		completed: 0,
+		currentDeviceId: null,
+		failed: [],
+		mediaDropped: 0,
+		tracks: 0,
+		events: 0,
+		startedAtMs: null,
+		finishedAtMs: null,
+		error: null
+	};
+}
+function isTimeoutError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	return /timed out/i.test(message);
+}
+async function withTimeoutRetry(run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (!isTimeoutError(err)) throw err;
+		return await run();
+	}
+}
+function createDiskReconcileJobRunner(now = Date.now) {
+	let job = idleDiskReconcileJob();
+	let inFlight = null;
+	const snapshot = () => job;
+	const start = (deps) => {
+		if (job.state === "running" && inFlight) return job;
+		job = {
+			...idleDiskReconcileJob(),
+			state: "running",
+			startedAtMs: now()
+		};
+		deps.log?.("pipeline disk reconcile started");
+		inFlight = (async () => {
+			try {
+				const result = await reconcileFleetFromDisk({
+					listDeviceIds: deps.listDeviceIds,
+					rescanRecordings: (deviceId) => withTimeoutRetry(() => deps.rescanRecordings(deviceId)),
+					reconcileAnalytics: (deviceId) => withTimeoutRetry(() => deps.reconcileAnalytics(deviceId)),
+					onProgress: (update) => {
+						job = {
+							...job,
+							total: update.total,
+							completed: update.completed,
+							currentDeviceId: update.deviceId,
+							failed: update.failed,
+							mediaDropped: update.mediaDropped,
+							tracks: update.tracks,
+							events: update.events
+						};
+						deps.onProgress?.(update);
+						deps.log?.("pipeline disk reconcile camera", {
+							deviceId: update.deviceId,
+							completed: update.completed,
+							total: update.total,
+							failed: update.failed.length,
+							mediaDropped: update.mediaDropped,
+							tracks: update.tracks,
+							events: update.events
+						});
+					}
+				});
+				job = {
+					...job,
+					state: "done",
+					total: result.cameras + result.failed.length,
+					completed: result.cameras + result.failed.length,
+					currentDeviceId: null,
+					failed: result.failed,
+					mediaDropped: result.mediaDropped,
+					tracks: result.tracks,
+					events: result.events,
+					finishedAtMs: now(),
+					error: null
+				};
+				deps.log?.("pipeline disk reconcile", {
+					cameras: result.cameras,
+					failed: result.failed,
+					mediaDropped: result.mediaDropped,
+					tracks: result.tracks,
+					events: result.events
+				});
+			} catch (err) {
+				const error = err instanceof Error ? err.message : String(err);
+				job = {
+					...job,
+					state: "error",
+					currentDeviceId: null,
+					finishedAtMs: now(),
+					error
+				};
+				deps.log?.("pipeline disk reconcile failed", { error });
+			} finally {
+				inFlight = null;
+			}
+		})();
+		return job;
+	};
+	return {
+		snapshot,
+		start
+	};
+}
+//#endregion
+//#region src/inference-device-model.ts
+/**
+* Per-device default object-detection model + deviceKey parsing for the
+* orchestrator's device-aware `getNodeInferenceDevices` view.
+*
+* This DUPLICATES the executor's per-device model resolution (P0-3:
+* `resolveDeviceEngine` + `MODEL_BY_CLASS` + the object-detection step's
+* `defaultModelIdByFormat` in `@camstack/addon-pipeline`). It is duplicated —
+* not imported — because cross-addon imports are forbidden (the orchestrator
+* and the detection-pipeline are separate addons; only tRPC crosses the
+* boundary). Keep this in sync with `default-detection-model.ts` /
+* `step-definitions.ts` if the executor's defaults change.
+*
+* The returned ids are honest catalog ids (verified present):
+*   - `yolov9m-320-int8` — Intel NPU + iGPU (yolo26 does NOT compile on the NPU)
+*   - `yolov9m-320`      — Apple ANE (CoreML)
+*   - `ssd-mobilenet-v2-coco-edgetpu` — Coral USB Edge TPU (tflite)
+*   - `yolo26n`          — CPU / CUDA (the object-detection step's universal
+*                          nano default)
+*
+* Do not promote the accelerated ids to 640. The evaluation in
+* `docs/benchmarks/pipeline-frame-model-eval.md` failed the 640 promotion
+* gates (0/3 miss recovered at the current threshold).
+*/
+/**
+* The always-on object-detection ROOT step id. A camera session's tracks all
+* originate from this detector, so a device whose engine format can't run it
+* cannot host a camera root. Mirrors the addon-pipeline step id (cross-addon
+* import is forbidden — this is the same duplication rationale as the model
+* defaults above).
+*/
+var OBJECT_DETECTION_STEP_ID = "object-detection";
+/**
+* Build the camera-root capability predicate for a node from its live catalog:
+* `format → canHostCameraRoot`. A format can host a camera root iff the
+* catalog lists at least one object-detection model with a build for that
+* format — byte-for-byte the resolver's per-device skip-gate test for the root
+* step (`addonHasCompatibleModel`), so a device is deemed eligible iff the root
+* would ACTUALLY provision on it.
+*
+* Fails OPEN when the catalog has no object-detection slot at all (never
+* observed in production) so a malformed/empty catalog never strands every
+* device off the balancer. Pure + deterministic.
+*/
+function makeRootCapabilityGuard(catalog) {
+	for (const slot of catalog.slots) {
+		const objDet = slot.addons.find((a) => a.id === OBJECT_DETECTION_STEP_ID);
+		if (objDet) return (format) => objDet.models.some((m) => Boolean(m.formats[format]));
+	}
+	return () => true;
+}
+/** Split a deviceKey (`<backend>:<device>`, or bare `cpu`) into its parts + format.
+*  Format comes from the shared {@link deviceBackendToFormat} SSOT (`@camstack/types`)
+*  — the previously-local `BACKEND_FORMAT` copy is gone (R3/node-F2). Used only for
+*  STORED-ONLY keys (a configured device the live probe didn't return); a probed
+*  device carries its own honest `format` from the descriptor. */
+function parseDeviceKey(deviceKey) {
+	const colon = deviceKey.indexOf(":");
+	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
+	return {
+		backend,
+		device: colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey,
+		format: deviceBackendToFormat(backend)
+	};
+}
+/**
+* The object-detection model the executor defaults to for a deviceKey. Mirrors
+* the executor's `MODEL_BY_CLASS` classification (`classifyAccelerator`) plus
+* the tflite `defaultModelIdByFormat` for Coral. Never throws; unknown backends
+* fall back to the universal nano default (`yolo26n`).
+*/
+function defaultModelIdForDevice(deviceKey) {
+	const { backend, device } = parseDeviceKey(deviceKey);
+	if (backend === "openvino") {
+		if (device === "cpu") return "yolo26n";
+		return "yolov9m-320-int8";
+	}
+	if (backend === "edgetpu") return "ssd-mobilenet-v2-coco-edgetpu";
+	if (backend === "coreml") return "yolov9m-320";
+	return "yolo26n";
+}
+/**
+* Step-tree device jump (phase 1): validate every `steps[step].jumpDeviceKey`
+* manual override in a to-be-saved `inferenceDevices` map. A jump target MUST be
+* an enabled∧available device on the SAME node and DIFFERENT from the owning
+* device. `enabledAvailableKeys` is the effective enabled∧available set (from
+* `mergeInferenceDevices(probe, submitted)`) so an absent/unplugged/disabled
+* target is rejected honestly (an operator can't route a step onto a dead pool).
+* Returns the FIRST human-readable error, or `null` when every override is
+* valid. Pure + deterministic.
+*/
+function validateJumpTargets(inferenceDevices, enabledAvailableKeys) {
+	for (const [deviceKey, entry] of Object.entries(inferenceDevices)) for (const [stepId, step] of Object.entries(entry.steps ?? {})) {
+		const target = step.jumpDeviceKey;
+		if (target === void 0) continue;
+		if (target === deviceKey) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey pointing at its own device`;
+		if (!enabledAvailableKeys.has(target)) return `step "${stepId}" on "${deviceKey}" has a jumpDeviceKey "${target}" that is not an enabled, available device on this node`;
+	}
+	return null;
+}
+/**
+* Merge a node's live-probed inference devices with its stored per-device map.
+*
+* The default is **AUTO = all discovered ACCELERATORS enabled** (spec C2,
+* opt-OUT) with TWO deliberate exceptions, both **opt-IN** (default disabled):
+*
+*   - **CPU**: `enumerateInferenceDevices` always emits a universal `cpu`
+*     floor on every platform; auto-enabling it would let the balancer
+*     round-robin ~1/N of sessions onto the slow CPU pool alongside the
+*     NPU/iGPU/ANE. CPU stays the always-available FALLBACK (a node with no
+*     eligible accelerator leaves `deviceKey` unset → the runner's default
+*     pool, which is CPU), not a balanced target — matching the spec's "no
+*     device eligible → fall back to CPU".
+*   - **Coral Edge TPU (`edgetpu`)**: the standing rule since the Coral
+*     executor landed is that it surfaces as selectable but is NEVER
+*     auto-picked — it runs a DIFFERENT, weaker model family (tflite SSD
+*     MobileNet, not the YOLO the other accelerators run), so silently
+*     enrolling a plugged-in Coral changes detection QUALITY, not just
+*     placement. The opt-OUT default did exactly that on 2026-08-01: a hub
+*     Coral nobody enabled entered the session rotation and camera 615 spent
+*     hours at 2.4fps failing tflite model resolution. An operator who wants
+*     the Coral balanced opts it in explicitly (`enabled: true`).
+*
+* So: an NPU/iGPU/ANE accelerator with NO stored entry is `enabled:true`; a
+* CPU or edgetpu device with no stored entry is `enabled:false`; an explicit
+* stored `enabled` always wins (an operator can opt CPU/Coral in, or an
+* accelerator out). A stored-only key (configured but the probe did not
+* return it — removed/unplugged HW) keeps its stored `enabled` and surfaces
+* as `available:false`, so the UI still shows it.
+*
+* Pure + deterministic (sorted by key) — the single merge authority shared by
+* the `getNodeInferenceDevices` view and the dispatcher's eligible-device pick.
+*/
+function mergeInferenceDevices(probed, stored) {
+	const probedByKey = new Map(probed.map((d) => [d.key, d]));
+	const keys = new Set([...probedByKey.keys(), ...Object.keys(stored)]);
+	const out = [];
+	for (const key of Array.from(keys).toSorted()) {
+		const descriptor = probedByKey.get(key);
+		const opt = stored[key];
+		const parsed = descriptor ?? parseDeviceKey(key);
+		const weight = opt?.weight !== void 0 && opt.weight > 0 ? opt.weight : 1;
+		const autoDefault = parsed.backend !== "cpu" && parsed.backend !== "edgetpu";
+		out.push({
+			key,
+			backend: parsed.backend,
+			device: parsed.device,
+			format: parsed.format,
+			available: descriptor?.available ?? false,
+			enabled: opt?.enabled ?? autoDefault,
+			weight,
+			maxSessions: opt?.maxSessions ?? null,
+			defaultModelId: defaultModelIdForDevice(key),
+			...opt?.steps && Object.keys(opt.steps).length > 0 ? { steps: { ...opt.steps } } : {}
+		});
+	}
+	return out;
+}
+/**
+* The per-device concurrent-session caps for a node as `deviceKey → maxSessions`
+* (only devices that carry an explicit cap; absent = unlimited). Fed to the
+* device balancer's `nodeCaps` so a device at its cap is skipped (audit F3).
+*/
+function inferenceDeviceCaps(stored) {
+	const out = {};
+	for (const [key, entry] of Object.entries(stored)) if (entry.maxSessions !== void 0 && entry.maxSessions > 0) out[key] = entry.maxSessions;
+	return out;
+}
+/** Is this device the CPU fallback rather than a real accelerator? */
+function isCpuFallback(view) {
+	return view.backend === "cpu";
+}
+function resolveInferenceDeviceEligibility(probed, stored, canRunRoot, isPoolUsable) {
+	const eligible = {};
+	const excluded = [];
+	const merged = mergeInferenceDevices(probed, stored);
+	const acceleratorServes = merged.some((d) => !isCpuFallback(d) && d.enabled && d.available && (!canRunRoot || canRunRoot(d.format)));
+	for (const d of merged) {
+		if (!d.enabled) {
+			excluded.push({
+				key: d.key,
+				reason: "disabled",
+				format: d.format
+			});
+			continue;
+		}
+		if (!d.available) {
+			excluded.push({
+				key: d.key,
+				reason: "unavailable",
+				format: d.format
+			});
+			continue;
 		}
-		await this.withAudioSubLock(deviceId, async () => {
-			const unsub = this.audioSubscriptions.get(deviceId);
-			if (!unsub) return;
-			try {
-				unsub();
-			} catch {}
-			this.audioSubscriptions.delete(deviceId);
-			this.deps.logger.info("lazy audio: window closed", {
-				tags: { deviceId },
-				meta: { reason }
+		if (isPoolUsable && !isPoolUsable(d.key)) {
+			excluded.push({
+				key: d.key,
+				reason: "unavailable",
+				format: d.format
 			});
-		});
-	}
-	/**
-	* Audio teardown for one device — the audio half of `stopDetection`.
-	* Tears down through the per-device lock so it can't race a concurrent
-	* subscribe (which would re-store a handle this teardown never sees).
-	*/
-	async stopForDevice(deviceId) {
-		await this.withAudioSubLock(deviceId, async () => {
-			const unsub = this.audioSubscriptions.get(deviceId);
-			if (unsub) {
-				try {
-					unsub();
-				} catch {}
-				this.audioSubscriptions.delete(deviceId);
-			}
-		});
-		const lazyTimer = this.lazyAudioTeardownTimers.get(deviceId);
-		if (lazyTimer) {
-			clearTimeout(lazyTimer);
-			this.lazyAudioTeardownTimers.delete(deviceId);
+			continue;
 		}
-		const windowTimer = this.motionAudioWindowTimers.get(deviceId);
-		if (windowTimer) {
-			clearTimeout(windowTimer);
-			this.motionAudioWindowTimers.delete(deviceId);
+		if (canRunRoot && !canRunRoot(d.format)) {
+			excluded.push({
+				key: d.key,
+				reason: "cannot-host-camera-root",
+				format: d.format
+			});
+			continue;
 		}
-		this.audioAssignments.delete(deviceId);
-	}
-	/**
-	* Centralized write into `audioSubscriptions`. If shutdown has begun, the
-	* map has already been (or is about to be) cleared lock-free in
-	* `shutdown()`; storing here would leak a zombie entry whose `unsub` is
-	* never called. So when shutting down we immediately invoke `unsub`
-	* (best-effort, error-swallowed) and DO NOT store. `protected` so
-	* `audio-sub-lock.spec.ts`'s test subclass can assert the shutdown-guard
-	* behavior without casts.
-	*/
-	storeAudioSub(deviceId, unsub) {
-		if (this.audioShuttingDown) {
-			try {
-				unsub();
-			} catch {}
-			return;
+		if (isCpuFallback(d) && acceleratorServes) {
+			excluded.push({
+				key: d.key,
+				reason: "accelerator-preferred",
+				format: d.format
+			});
+			continue;
 		}
-		this.audioSubscriptions.set(deviceId, unsub);
-	}
-	/**
-	* Serialize an audio-subscription critical section per device. `fn` is
-	* chained onto the device's current lock tail, so concurrent calls for the
-	* SAME deviceId run sequentially (FIFO); different deviceIds never block
-	* each other. Thin delegate onto the `audioSubLocks` `KeyedAsyncLock`
-	* instance. `protected` so `audio-sub-lock.spec.ts`'s test subclass can
-	* drive the lock without casts.
-	*/
-	withAudioSubLock(deviceId, fn) {
-		return this.audioSubLocks.run(deviceId, fn);
+		eligible[d.key] = d.weight;
 	}
+	return {
+		eligible,
+		excluded
+	};
+}
+/**
+* Join the merged device rows with the eligibility verdict so the UI can NAME
+* why an accelerator is not in play instead of leaving the operator to deduce
+* it from `enabled`/`available`.
+*
+* Deduction is not possible for two of the four reasons — `accelerator-preferred`
+* is a node-WIDE rule (a CPU row reads `enabled:true, available:true` and still
+* never gets a session, D215) and `cannot-host-camera-root` needs the node's
+* model catalog. Both live in {@link resolveInferenceDeviceEligibility}, so this
+* function only transports its answer; it never re-derives one.
+*
+* Pure; preserves `merged`'s order (sorted by key) and every other field.
+*/
+function annotateInferenceDeviceExclusions(merged, eligibility) {
+	const reasonByKey = new Map(eligibility.excluded.map((e) => [e.key, e.reason]));
+	return merged.map((view) => ({
+		...view,
+		exclusion: reasonByKey.get(view.key) ?? null
+	}));
+}
+function resolveNodeInferenceUsability(eligibility) {
+	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
+	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
+	return {
+		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
+		unavailableKeys,
+		eligibleKeys
+	};
+}
+/**
+* Step-tree device jump (phase 1): the attach-payload roster of a node's
+* enabled∧available inference devices with the balancer knobs (`weight`,
+* `maxSessions`) the runner uses to AUTO-jump an enrichment step off a device
+* whose format can't run it. Built from the SAME `eligible` (deviceKey→weight)
+* and `caps` (deviceKey→maxSessions) the dispatcher already computes, so the
+* roster the runner sees exactly matches the balancer's candidate set. Sorted
+* by key for determinism. Populated onto `RunnerCameraConfig.inferenceDevices`
+* ONLY when a `deviceKey` is elected and there are ≥2 entries.
+*/
+function buildInferenceDeviceRoster(eligible, caps) {
+	return Object.entries(eligible).map(([deviceKey, weight]) => ({
+		deviceKey,
+		weight: weight > 0 ? weight : 1,
+		maxSessions: caps[deviceKey] ?? null
+	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
+}
+//#endregion
+//#region src/node-inference-usability-mirror.ts
+var NodeInferenceUsabilityMirror = class {
+	state = /* @__PURE__ */ new Map();
 	/**
-	* Subscribe to decoded audio chunks for a camera and feed them into the
-	* audio-analyzer. Reads the analyzer's settings via its own
-	* `resolveDeviceSettings(deviceId)` method so the orchestrator does not
-	* touch the audio-analyzer schema field names directly.
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
 	*/
-	async subscribeAudioStream(deviceId, config) {
-		const api = this.deps.api();
-		if (!api) {
-			this.deps.logger.warn("this.ctx.api not available — cannot subscribe audio", { tags: { deviceId } });
-			return null;
-		}
-		if (!await this.deps.isAudioAnalysisActive(deviceId)) return null;
-		if (config.audioMode === "disabled") {
-			this.deps.logger.debug("audio subscribe skipped: audioMode=disabled", { tags: { deviceId } });
-			return null;
+	observe(nodeId, usable) {
+		const prev = this.state.get(nodeId);
+		if (usable) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: false
+			});
+			return prev !== void 0 && !prev.usable ? "recovered" : null;
 		}
-		if (config.audioMode === "on-motion" && !this.isMotionAudioWindowOpen(deviceId)) {
-			this.deps.logger.info("audio subscribe deferred: audioMode=on-motion, no window open", { tags: { deviceId } });
+		if (prev === void 0) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
 			return null;
 		}
-		const audioStream = config.audioStreamId ?? config.motionStreamId;
-		const audioBrokerId = makeSourceBrokerId(deviceId, audioStream);
-		if ((await this.deps.probeAudioTrack(deviceId, audioStream)).kind === "absent") {
-			this.deps.logger.warn("audio subscription REFUSED — this stream carries no audio track", {
-				tags: { deviceId },
-				meta: {
-					camStreamId: audioStream,
-					brokerId: audioBrokerId,
-					selectedBy: config.audioStreamId !== void 0 ? "audioStreamId" : "motionStreamId",
-					hint: "point the camera’s audio at a stream that has an audio track — no stream is substituted automatically"
-				}
+		if (!prev.usable) {
+			this.state.set(nodeId, {
+				usable: false,
+				armed: true
 			});
 			return null;
 		}
-		const settings = await api.audioAnalysis.resolveDeviceSettings.query({ deviceId });
-		if (!settings) {
-			this.deps.logger.warn("audio-analysis returned no settings — audio subscription skipped", { tags: { deviceId } });
+		if (!prev.armed) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
 			return null;
 		}
-		const audioNodeId = await this.dispatch(deviceId);
-		const isRemoteAudio = audioNodeId !== this.deps.localNodeId();
-		this.deps.logger.info("audio subscription: resolved audio node", {
-			tags: { deviceId },
-			meta: {
-				audioNodeId,
-				isRemote: isRemoteAudio
-			}
-		});
-		const accumulator = new AudioWindowAccumulator(deviceId);
-		const teardown = startAudioChunkPoller({
-			api,
-			brokerId: audioBrokerId,
-			tag: "audio-analyzer",
-			ownerNodeId: this.deps.ingestNode(),
-			logger: this.deps.logger.withTags({ deviceId }),
-			onChunk: async (chunk) => {
-				this.deps.watchdogNote(deviceId, "audio");
-				try {
-					const audioChunkInput = accumulator.push(chunk);
-					if (!audioChunkInput) return;
-					const result = await api.audioAnalyzer.analyseChunk.mutate({
-						chunk: audioChunkInput,
-						settings,
-						...isRemoteAudio ? { nodeId: audioNodeId } : {}
-					});
-					if (!result) return;
-					const frame = buildAudioResultFrame(deviceId, result);
-					this.deps.eventBus.emit({
-						id: `audio-inference-${deviceId}-${Date.now()}`,
-						timestamp: /* @__PURE__ */ new Date(),
-						source: {
-							type: "device",
-							id: deviceId,
-							nodeId: "hub",
-							addonId: "pipeline-orchestrator",
-							deviceId
-						},
-						category: EventCategory.PipelineAudioInferenceResult,
-						data: {
-							deviceId,
-							frame,
-							nodeId: "hub"
-						}
-					});
-				} catch (err) {
-					const msg = errMsg(err);
-					this.deps.logger.error("Audio analysis failed", {
-						tags: { deviceId },
-						meta: { error: msg }
-					});
-				}
-			}
+		this.state.set(nodeId, {
+			usable: false,
+			armed: true
 		});
-		this.deps.logger.info("Audio stream subscribed", { tags: { deviceId } });
-		return () => {
-			teardown();
-			accumulator.reset();
-		};
+		return "became-unusable";
 	}
-	/**
-	* Set true at the very start of `onShutdown`, before the audio teardown /
-	* map clears below. Once set, `withAudioSubLock` turns queued/new critical
-	* sections into no-ops and `storeAudioSub` refuses to store, so no
-	* critical section that was in-flight (or queued) when shutdown began can
-	* resurrect a zombie subscription into the cleared `audioSubscriptions`
-	* map. MUST be called before anything else in `onShutdown` that could
-	* race a queued audio critical section (mirrors the original
-	* `this.audioShuttingDown = true` being the very first statement).
-	*/
-	beginShutdown() {
-		this.audioShuttingDown = true;
+	/** Can this node be given cameras? Unknown nodes answer YES. */
+	isUsable(nodeId) {
+		return this.state.get(nodeId)?.usable ?? true;
+	}
+	/** Nodes currently excluded — for the placement log and diagnostics. */
+	unusableNodeIds() {
+		const out = [];
+		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
+		return out.toSorted();
+	}
+	forget(nodeId) {
+		this.state.delete(nodeId);
 	}
+	reset() {
+		this.state.clear();
+	}
+};
+//#endregion
+//#region src/inference-device-usability-mirror.ts
+/**
+* InferenceDeviceUsabilityMirror — "can this NODE's THIS DEVICE still infer?",
+* kept off the placement path.
+*
+* The per-`(nodeId, deviceKey)` twin of {@link NodeInferenceUsabilityMirror},
+* and deliberately not a second mechanism: it composes the key and delegates
+* every decision to that class, so the arm/apply reluctance D49 pinned lives in
+* exactly one implementation and cannot drift between the node tier and the
+* device tier.
+*
+* ## Why this tier had to exist
+*
+* The node tier already answers "does this node have ANY usable accelerator".
+* On 2026-08-25 the hub's answer was, correctly, yes — its NPU was healthy the
+* whole time. What died was one DEVICE, `openvino:gpu`, and nothing anywhere
+* asked that question: the per-dispatch capability gate is keyed on model
+* FORMAT and `openvino:gpu` and `openvino:npu` share the format `openvino`, so
+* it is blind between them by construction. The balancer kept rotating cameras
+* onto the dead pool — 20 sessions in 20 minutes, every one `tieBreak:
+* "rotation"` — for 31 hours.
+*
+* ## Why a mirror and not the event
+*
+* D49, verbatim: *a one-shot event never gates on a fallible read*. The gate is
+* this in-memory mirror, refreshed off the event path by the same
+* `resolveEligibleInferenceDevices` the dispatcher already runs (plus the
+* session controller's background refresher). The consequences that buys:
+*
+*  - **A read that fails changes nothing.** The caller folds in an observation
+*    only when it HAS one; an unreachable node, a version-skewed executor or a
+*    rejected RPC never reaches {@link observe}, so the previous verdict
+*    stands. This is the whole reason the health read is specified as
+*    "synchronous over in-memory state, never throws for its own reasons": an
+*    empty answer must mean *nothing is refused*, not *I could not tell*.
+*  - **Excluding a healthy device needs a second, consecutive read.** Exclusion
+*    is the direction that DESTROYS work — it strands an accelerator that may
+*    be perfectly fine — so one bad observation only ARMS.
+*  - **Re-admitting is immediate and unconditional.** One good observation puts
+*    the device straight back. Being slow to exclude costs some wasted
+*    inference attempts; being slow to re-admit costs an idle accelerator and a
+*    node that looks broken.
+*/
+/**
+* NUL — impossible in both a Moleculer node id and a `<backend>:<device>` key,
+* so the composite key can never be ambiguous. A separator that CAN occur in
+* either half makes two distinct pairs collide, and a collision here silently
+* excludes an accelerator nobody reported.
+*/
+var SEPARATOR = "\0";
+var InferenceDeviceUsabilityMirror = class {
+	/** The one implementation of the arm/apply state machine (D49). */
+	mirror = new NodeInferenceUsabilityMirror();
 	/**
-	* Full audio teardown — combines the former `onShutdown`'s two separate
-	* audio blocks (lazy-teardown-timer clear, then — after several unrelated
-	* session/reconcile/load-shed clears — subscription teardown + lock clear
-	* + assignment-map clears) into one call. Safe to combine: both blocks
-	* are synchronous with no interleaved `await`, and every original
-	* statement between them (`sessionRegistry.clear()`,
-	* `cameraFpsMap.clear()`, `remoteHealthAttempts.clear()`,
-	* `loadShedState.clear()`, `loadShedResumeTimer` cleanup) touches state
-	* fully disjoint from anything audio — so their relative order to each
-	* other is unaffected, and the audio-internal order (timers →
-	* subscriptions → lock → assignment maps) is reproduced exactly.
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
 	*/
-	shutdown() {
-		for (const t of this.lazyAudioTeardownTimers.values()) clearTimeout(t);
-		this.lazyAudioTeardownTimers.clear();
-		for (const t of this.motionAudioWindowTimers.values()) clearTimeout(t);
-		this.motionAudioWindowTimers.clear();
-		for (const unsub of this.audioSubscriptions.values()) try {
-			unsub();
-		} catch {}
-		this.audioSubscriptions.clear();
-		this.audioSubLocks.clear();
-		this.audioAssignments.clear();
-		this.readyAudioNodes.clear();
+	observe(nodeId, deviceKey, usable) {
+		return this.mirror.observe(`${nodeId}${SEPARATOR}${deviceKey}`, usable);
+	}
+	/** Can the balancer put a session on this device? Unknown pairs answer YES. */
+	isUsable(nodeId, deviceKey) {
+		return this.mirror.isUsable(`${nodeId}${SEPARATOR}${deviceKey}`);
+	}
+	/** Pairs currently excluded — for the placement log and diagnostics. */
+	unusableDevices() {
+		return this.mirror.unusableNodeIds().map((composite) => {
+			const at = composite.indexOf(SEPARATOR);
+			return {
+				nodeId: composite.slice(0, at),
+				deviceKey: composite.slice(at + 1)
+			};
+		});
+	}
+	/** The excluded device keys on ONE node. */
+	unusableDeviceKeys(nodeId) {
+		return this.unusableDevices().filter((d) => d.nodeId === nodeId).map((d) => d.deviceKey);
+	}
+	forget(nodeId, deviceKey) {
+		this.mirror.forget(`${nodeId}${SEPARATOR}${deviceKey}`);
+	}
+	reset() {
+		this.mirror.reset();
 	}
 };
+/**
+* Fold ONE node's health answer into the mirror and return what changed.
+*
+* This is the whole reading discipline, in one place, because both halves of it
+* are easy to get subtly wrong and neither failure is visible in a log:
+*
+*  - **`unhealthy === null` — the read FAILED — changes nothing.** Not a single
+*    entry is touched. An unreachable node, a version-skewed executor or a
+*    rejected RPC must be distinguishable from "asked, nothing is refused", or
+*    a flaky link silently re-admits a dead accelerator (D49).
+*  - **Every device the node HAS is observed**, not merely the refused ones.
+*    The first draft observed `refused ∪ already-excluded`, which omits exactly
+*    the devices the mirror has ARMED — so their disarming good read never
+*    arrived and two bad reads an HOUR apart, with a hundred healthy ones
+*    between them, excluded a working accelerator. "Consecutive" is only a
+*    property if the good observations are delivered.
+*
+* Pure with respect to everything except `mirror`, and never throws — it is
+* called from the dispatcher's own read path.
+*/
+function foldInferenceDeviceHealth(mirror, nodeId, unhealthy, present) {
+	if (unhealthy === null) return [];
+	const refused = new Set(unhealthy);
+	const observed = new Set([
+		...present,
+		...refused,
+		...mirror.unusableDeviceKeys(nodeId)
+	]);
+	const changes = [];
+	for (const deviceKey of observed) {
+		const transition = mirror.observe(nodeId, deviceKey, !refused.has(deviceKey));
+		if (transition !== null) changes.push({
+			deviceKey,
+			transition
+		});
+	}
+	return changes;
+}
 //#endregion
 //#region src/load-balancer.ts
 /**
@@ -43568,6 +43778,90 @@ function applyDeviceProvisioning(steps, base, override) {
 	});
 }
 //#endregion
+//#region src/device-activity-source.ts
+/** The source's own name on the wire. One constant, used by every emit + gate. */
+var DEVICE_ACTIVITY_SOURCE = "device-activity";
+var DeviceActivitySource = class {
+	#deps;
+	#devices = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.#deps = deps;
+	}
+	/**
+	* A `recording-signal` level landed for a device. Idempotent in the level:
+	* only a CHANGE emits an edge, and the sustain tick — not a repeated push —
+	* is what keeps the session open.
+	*/
+	onSignalLevel(deviceId, active, reason, atMs) {
+		const entry = this.#devices.get(deviceId) ?? {
+			active: false,
+			timer: null
+		};
+		const wasActive = entry.active;
+		entry.active = active;
+		this.#devices.set(deviceId, entry);
+		if (active === wasActive) return;
+		if (active) {
+			this.#deps.logger.info("device-activity: the device reports it is working", {
+				tags: { deviceId },
+				meta: { reason }
+			});
+			this.#emit(deviceId, true, atMs);
+			this.#arm(deviceId, entry);
+			return;
+		}
+		this.#clear(entry);
+		this.#deps.logger.info("device-activity: the device reports it has stopped", {
+			tags: { deviceId },
+			meta: { reason }
+		});
+		this.#emit(deviceId, false, atMs);
+	}
+	/** Drop every timer (addon teardown). The mirror goes with the instance. */
+	stop() {
+		for (const entry of this.#devices.values()) this.#clear(entry);
+		this.#devices.clear();
+	}
+	#arm(deviceId, entry) {
+		this.#clear(entry);
+		const sustainMs = this.#deps.sustainMsFor(deviceId);
+		const timer = setInterval(() => {
+			const current = this.#devices.get(deviceId);
+			if (!current || !current.active) {
+				this.#clear(current ?? entry);
+				return;
+			}
+			this.#emit(deviceId, true, Date.now());
+		}, sustainMs);
+		timer.unref?.();
+		entry.timer = timer;
+	}
+	#clear(entry) {
+		if (entry.timer === null) return;
+		clearInterval(entry.timer);
+		entry.timer = null;
+	}
+	/**
+	* Emit, unless this camera does not carry the source. A suppressed emit is
+	* SAID — an operator who never ticked the box and an addon that is quietly
+	* broken look identical from the outside otherwise.
+	*/
+	#emit(deviceId, detected, timestamp) {
+		const sources = this.#deps.motionSourcesFor(deviceId);
+		if (sources === null || !sources.includes("device-activity")) {
+			this.#deps.logger.debug("device-activity: level not forwarded — the camera does not list `device-activity`", {
+				tags: { deviceId },
+				meta: {
+					detected,
+					sources: sources ?? "no-active-detection"
+				}
+			});
+			return;
+		}
+		this.#deps.emitMotion(deviceId, detected, timestamp);
+	}
+};
+//#endregion
 //#region src/device-detection-settings.ts
 /** Read a required string leaf out of the hydrated `flat` schema values. */
 function mustString(flat, deviceId, key) {
@@ -43593,6 +43887,32 @@ function numberOrDefault(flat, key) {
 	const dflt = uiField && "default" in uiField ? uiField.default : void 0;
 	return typeof dflt === "number" ? dflt : 0;
 }
+/** The activity rate from the hydrated store, or the shipped default. */
+function activityFps(flat) {
+	const v = flat["activityDetectionFps"];
+	return typeof v === "number" && v > 0 ? v : 1;
+}
+/**
+* The detection rate a session opens at, given WHAT OPENED IT.
+*
+* A CAP, not a set: `min(cameraRate, activityRate)`. A camera already slower
+* than the activity rate stays slower, so lowering the global rate keeps
+* working. Why this lever and not the other two: a per-device `detectionFps`
+* would also slow the sessions a real motion trigger opens on the same camera,
+* and it becomes silently wrong the day the device gains a second trigger; a
+* per-SOURCE rate table would have to reach the runner and be re-applied
+* whenever the source holding the session changes, which the attach-time config
+* cannot express. Scoping it to the session's TRIGGER puts the number exactly
+* where its justification lives.
+*
+* Applies to the session the activity level OPENS. A session already open at
+* the camera rate when the level rises is not re-attached to slow it down —
+* re-attaching a live session to change one number costs a decode restart.
+*/
+function detectionFpsForTrigger(config, trigger) {
+	if (trigger !== "device-activity") return config.detectionFps;
+	return Math.min(config.detectionFps, config.activityDetectionFps ?? 1);
+}
 /**
 * Pure decision/derivation half of the former `resolveDeviceDetectionSettings`.
 * Given the I/O-gathered raw materials, resolves every operator-wins →
@@ -43602,14 +43922,19 @@ function numberOrDefault(flat, key) {
 * the original method's "narrowing failed" catch.
 */
 function resolveDetectionSettings(input) {
-	const { deviceId, raw, flat, features, hasOnboardMotion, pipelineEnabled, motionDetectionEnabled } = input;
+	const { deviceId, raw, flat, features, hasOnboardMotion, hasActivitySignal, pipelineEnabled, motionDetectionEnabled } = input;
 	const profile = resolveDeviceProfile(features);
 	const userMotionSources = raw["motionSources"];
 	let motionSources;
 	if (userMotionSources !== void 0) motionSources = MotionSourcesSchema.parse(userMotionSources);
-	else if (hasOnboardMotion) motionSources = ["onboard"];
-	else if (profile && features.includes(DeviceFeature.BatteryOperated)) motionSources = [];
-	else motionSources = MotionSourcesSchema.parse(flat["motionSources"]);
+	else {
+		let defaulted;
+		if (hasOnboardMotion) defaulted = ["onboard"];
+		else if (hasActivitySignal) defaulted = [];
+		else if (profile && features.includes(DeviceFeature.BatteryOperated)) defaulted = [];
+		else defaulted = MotionSourcesSchema.parse(flat["motionSources"]);
+		motionSources = hasActivitySignal ? [...defaulted, DEVICE_ACTIVITY_SOURCE] : defaulted;
+	}
 	const userDetectionMode = raw["detectionMode"];
 	const detectionMode = typeof userDetectionMode === "string" && isPipelinePhaseMode(userDetectionMode) ? userDetectionMode : profile?.defaults.detectionMode ?? "on-motion";
 	const userAudioMode = raw["audioMode"];
@@ -43628,6 +43953,7 @@ function resolveDetectionSettings(input) {
 		detectionStreamProfile: mustString(flat, deviceId, "detectionStreamProfile"),
 		motionFps: numberOrDefault(flat, "motionFps"),
 		detectionFps: numberOrDefault(flat, "detectionFps"),
+		activityDetectionFps: activityFps(flat),
 		motionCooldownMs: numberOrDefault(flat, "motionCooldownMs"),
 		maxSessionHoldMs: numberOrDefault(flat, "maxSessionHoldMs"),
 		audioMotionWindowMs: numberOrDefault(flat, "audioMotionWindowMs"),
@@ -43684,6 +44010,7 @@ function buildDetectionConfigFromInputs(resolved, assigned) {
 		detectionStreamId: detectionCamStreamId,
 		motionFps: resolved.motionFps,
 		detectionFps: resolved.detectionFps,
+		activityDetectionFps: resolved.activityDetectionFps,
 		motionCooldownMs: resolved.motionCooldownMs,
 		maxSessionHoldMs: resolved.maxSessionHoldMs,
 		audioMotionWindowMs: resolved.audioMotionWindowMs,
@@ -43709,6 +44036,7 @@ function detectionConfigEquals(a, b) {
 	if (a.detectionStreamId !== b.detectionStreamId) return false;
 	if (a.motionFps !== b.motionFps) return false;
 	if (a.detectionFps !== b.detectionFps) return false;
+	if (a.activityDetectionFps !== b.activityDetectionFps) return false;
 	if (a.motionCooldownMs !== b.motionCooldownMs) return false;
 	if (a.maxSessionHoldMs !== b.maxSessionHoldMs) return false;
 	if (a.audioMotionWindowMs !== b.audioMotionWindowMs) return false;
@@ -44335,6 +44663,7 @@ var DetectionWiringController = class {
 		try {
 			const features = await this.lookupDeviceFeatures(deviceId);
 			const hasOnboardMotion = raw["motionSources"] === void 0 ? await this.deps.deviceHasOnboardMotionCap(deviceId) : false;
+			const hasActivitySignal = raw["motionSources"] === void 0 ? await this.deps.deviceHasActivitySignalCap(deviceId) : false;
 			const pipelineEnabled = await this.isDetectionPipelineActive(deviceId);
 			const motionDetectionEnabled = await this.isMotionDetectionActive(deviceId);
 			return resolveDetectionSettings({
@@ -44343,6 +44672,7 @@ var DetectionWiringController = class {
 				flat,
 				features,
 				hasOnboardMotion,
+				hasActivitySignal,
 				pipelineEnabled,
 				motionDetectionEnabled
 			});
@@ -44948,9 +45278,10 @@ var DeviceConfigContributions = class {
 		const schema = this.deps.deviceSettingsSchema();
 		if (!schema) return null;
 		const hasOnboardMotion = await this.deps.deviceHasOnboardMotionCap(input.deviceId);
-		const rawWithDefaults = raw["motionSources"] === void 0 && hasOnboardMotion ? {
+		const hasActivitySignal = await this.deps.deviceHasActivitySignalCap(input.deviceId);
+		const rawWithDefaults = raw["motionSources"] === void 0 && (hasOnboardMotion || hasActivitySignal) ? {
 			...raw,
-			motionSources: ["onboard"]
+			motionSources: [...hasOnboardMotion ? ["onboard"] : [], ...hasActivitySignal ? ["device-activity"] : []]
 		} : raw;
 		const baseSections = hydrateSchema({
 			...schema,
@@ -47770,7 +48101,8 @@ function wireOrchestratorSubscriptions(deps) {
 		if (!isEvent(event, EventCategory.MotionOnMotionChanged)) return;
 		const { deviceId, detected, timestamp } = event.data;
 		if (typeof deviceId !== "number") return;
-		deps.handleSessionMotion(deviceId, detected, typeof timestamp === "number" ? timestamp : void 0).catch((err) => {
+		const parsedSource = MotionSourceEnum.safeParse(event.data.source);
+		deps.handleSessionMotion(deviceId, detected, typeof timestamp === "number" ? timestamp : void 0, parsedSource.success ? parsedSource.data : void 0).catch((err) => {
 			deps.logger.warn("session motion handler failed", {
 				tags: { deviceId },
 				meta: {
@@ -47792,8 +48124,47 @@ function wireOrchestratorSubscriptions(deps) {
 		const deviceId = event.source.deviceId;
 		if (typeof deviceId === "number") deps.noteWatchdogSignal(deviceId, "motion");
 	});
+	const activitySource = new DeviceActivitySource({
+		logger: deps.logger,
+		emitMotion: (deviceId, detected, timestamp) => {
+			if (isTornDown) return;
+			deps.eventBus.emit(createEvent(EventCategory.MotionOnMotionChanged, {
+				type: "device",
+				id: deviceId,
+				deviceId
+			}, {
+				deviceId,
+				detected,
+				timestamp,
+				source: DEVICE_ACTIVITY_SOURCE
+			}));
+		},
+		motionSourcesFor: (deviceId) => deps.getActiveDetectionConfig(deviceId)?.motionSources ?? null,
+		sustainMsFor: (deviceId) => {
+			const cooldownMs = deps.getActiveDetectionConfig(deviceId)?.motionCooldownMs;
+			return Math.max(1e3, Math.floor((cooldownMs ?? 3e4) / 2));
+		}
+	});
+	const unsubDeviceActivity = deps.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+		const data = event.data;
+		if (typeof data !== "object" || data === null) return;
+		if (data["capName"] !== recordingSignalCapability.name) return;
+		const deviceId = data["deviceId"];
+		if (typeof deviceId !== "number") return;
+		const level = RecordingSignalStatusSchema.safeParse(data["slice"]);
+		if (!level.success) {
+			deps.logger.warn("device-activity: signal slice does not parse — ignored", {
+				tags: { deviceId },
+				meta: { slice: data["slice"] }
+			});
+			return;
+		}
+		const atMs = event.timestamp instanceof Date ? event.timestamp.getTime() : Date.now();
+		activitySource.onSignalLevel(deviceId, level.data.active, level.data.reason, atMs);
+	});
 	return () => {
 		isTornDown = true;
+		activitySource.stop();
 		for (const t of profileSlotTimers.values()) clearTimeout(t);
 		profileSlotTimers.clear();
 		unsubDeviceRegistered();
@@ -47808,6 +48179,7 @@ function wireOrchestratorSubscriptions(deps) {
 		unsubSessionMotion();
 		unsubFrameTracked();
 		unsubMotionAnalysis();
+		unsubDeviceActivity();
 	};
 }
 //#endregion
@@ -50567,7 +50939,7 @@ var SessionDispatchController = class {
 	* standing attach, so `hasStandingAttach` stays true for them and
 	* `decideSessionAction` still returns `'ignore'`.
 	*/
-	async handleSessionMotion(deviceId, detected, emittedAt) {
+	async handleSessionMotion(deviceId, detected, emittedAt, trigger) {
 		const receivedAt = Date.now();
 		const busLagMs = emittedAt !== void 0 ? receivedAt - emittedAt : void 0;
 		const config = this.deps.getActiveDetectionConfig(deviceId);
@@ -50602,7 +50974,7 @@ var SessionDispatchController = class {
 					return;
 				}
 				this.activeRefireCountByDevice.delete(deviceId);
-				await this.dispatchDetectionSession(deviceId, cur);
+				await this.dispatchDetectionSession(deviceId, cur, trigger);
 				if (this.sessionRegistry.has(deviceId)) this.scheduleSessionTeardown(deviceId, cooldownMs);
 				const doneAt = Date.now();
 				this.deps.logger.info("session motion → attach latency", {
@@ -50641,7 +51013,7 @@ var SessionDispatchController = class {
 	* `dispatchCamera`) avoids any risk of changing that already-live
 	* standing-camera path.
 	*/
-	async dispatchDetectionSession(deviceId, config) {
+	async dispatchDetectionSession(deviceId, config, trigger) {
 		const log = this.deps.logger.withTags({ deviceId });
 		await this.deps.reconcilePlacementFromRunners();
 		const preferredAgent = await this.deps.readPipelinePin(deviceId);
@@ -50697,13 +51069,19 @@ var SessionDispatchController = class {
 		const steps = applyDeviceProvisioning(pipelineConfig.steps, deviceBase, deviceOverride);
 		const inferenceDevices = deviceKey && Object.keys(enabledDevices).length >= 2 ? buildInferenceDeviceRoster(enabledDevices, deviceCaps) : void 0;
 		const zones = await this.deps.listZones(deviceId);
+		const sessionDetectionFps = detectionFpsForTrigger(config, trigger);
+		if (sessionDetectionFps !== config.detectionFps) log.info("session opened at the device-activity rate", { meta: {
+			trigger,
+			detectionFps: sessionDetectionFps,
+			cameraDetectionFps: config.detectionFps
+		} });
 		const sessionConfig = {
 			deviceId,
 			...deviceKey ? { deviceKey } : {},
 			...inferenceDevices ? { inferenceDevices } : {},
 			motionCooldownMs: config.motionCooldownMs,
 			motionFps: config.motionFps,
-			detectionFps: config.detectionFps,
+			detectionFps: sessionDetectionFps,
 			motionStreamId: config.motionStreamId,
 			detectionStreamId: config.detectionStreamId,
 			motionSources: [],
@@ -52008,6 +52386,7 @@ async function buildOrchestratorControllers(deps) {
 		localNodeId: () => localNodeId,
 		deviceSettingsSchema: () => deps.deviceSettingsSchema(),
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
+		deviceHasActivitySignalCap: (deviceId) => deps.deviceHasActivitySignalCap(deviceId),
 		deviceHasNativeObjectDetectionCap: (deviceId) => deps.deviceHasNativeObjectDetectionCap(deviceId),
 		setCameraPipelineForAgent: (input) => deps.setCameraPipelineForAgent(input),
 		emitCameraUpdated: (deviceId, config) => deps.emitCameraUpdated(deviceId, config),
@@ -52325,6 +52704,7 @@ async function buildOrchestratorControllers(deps) {
 		},
 		isCapActiveForDevice: (deviceId, capName) => deps.isCapActiveForDevice(deviceId, capName),
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
+		deviceHasActivitySignalCap: (deviceId) => deps.deviceHasActivitySignalCap(deviceId),
 		deviceSettingsSchema: () => deps.deviceSettingsSchema()
 	});
 	await detectionWiring.hydrateFeaturesMirror().catch((err) => {
@@ -52360,255 +52740,6 @@ async function buildOrchestratorControllers(deps) {
 	};
 }
 //#endregion
-//#region src/viewer-ui-provider.ts
-/**
-* viewer-ui provider — the pipeline-orchestrator serves the CamStack viewer web
-* SPA (mirrors what the now-removed standalone addon-viewer-ui used to do).
-*
-* Why here: the orchestrator is a hub bootstrap addon (always installed + baked),
-* so folding the viewer serving into it avoids a second addon whose only job was
-* to hold static files. The viewer's Expo web export is COPIED into this addon's
-* `assets/viewer/` locally by the viewer repo's `scripts/copy-dist-to-orchestrator.js`
-* (run from a checkout that HAS the `camstack/` submodule + Expo toolchain — the
-* publish/image CI does not, which is exactly why we copy a pre-built dist rather
-* than build it here). vite emits only into `dist/`, so `assets/viewer` survives
-* the addon build; `assets` is in the package `files`, so it ships on
-* `camstack deploy`. The hub's `main.ts` resolves the `viewer-ui` singleton at
-* boot and mounts the SPA at `/viewer/camstack`.
-*
-* `index.js` runs from `dist/`, so the SPA root is one level up + `assets/viewer`.
-*/
-var __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
-/** Absolute path to the staged viewer web SPA (`<addon-root>/assets/viewer`). */
-function resolveViewerDistDir() {
-	return node_path.default.resolve(__dirname$1, "..", "assets", "viewer");
-}
-/** Version of the staged viewer, written by the copy script; 'unknown' if absent. */
-function readViewerVersion() {
-	try {
-		const raw = node_fs.default.readFileSync(node_path.default.join(resolveViewerDistDir(), ".viewer-version"), "utf-8").trim();
-		if (raw) return raw;
-	} catch {}
-	return "unknown";
-}
-/** Build the viewer-ui provider. Serves whatever dist was staged into
-*  `assets/viewer`; when nothing is staged the hub's mount cleanly 404s. */
-function createViewerUiProvider() {
-	return {
-		getStaticDir: async () => ({ staticDir: resolveViewerDistDir() }),
-		getVersion: async () => ({ version: readViewerVersion() })
-	};
-}
-//#endregion
-//#region src/disk-reconcile-fleet.ts
-async function reconcileFleetFromDisk(deps) {
-	const deviceIds = await deps.listDeviceIds();
-	const failed = [];
-	let cameras = 0;
-	let mediaDropped = 0;
-	let tracks = 0;
-	let events = 0;
-	let completed = 0;
-	for (const deviceId of deviceIds) {
-		try {
-			await deps.rescanRecordings(deviceId);
-			const counts = await deps.reconcileAnalytics(deviceId);
-			cameras += 1;
-			mediaDropped += counts.mediaDropped;
-			tracks += counts.tracks;
-			events += counts.events;
-		} catch {
-			failed.push(deviceId);
-		}
-		completed += 1;
-		deps.onProgress?.({
-			deviceId,
-			total: deviceIds.length,
-			completed,
-			failed: [...failed],
-			mediaDropped,
-			tracks,
-			events
-		});
-	}
-	return {
-		cameras,
-		failed,
-		mediaDropped,
-		tracks,
-		events
-	};
-}
-//#endregion
-//#region src/disk-reconcile-job.ts
-/**
-* In-memory disk-wins fleet job. The tRPC mutation starts this and returns
-* immediately; the walk runs in the addon process so a 60s UDS timeout cannot
-* abort it. Status is polled via getReconcileFromDiskStatus.
-*/
-function idleDiskReconcileJob() {
-	return {
-		state: "idle",
-		total: 0,
-		completed: 0,
-		currentDeviceId: null,
-		failed: [],
-		mediaDropped: 0,
-		tracks: 0,
-		events: 0,
-		startedAtMs: null,
-		finishedAtMs: null,
-		error: null
-	};
-}
-function isTimeoutError(err) {
-	const message = err instanceof Error ? err.message : String(err);
-	return /timed out/i.test(message);
-}
-async function withTimeoutRetry(run) {
-	try {
-		return await run();
-	} catch (err) {
-		if (!isTimeoutError(err)) throw err;
-		return await run();
-	}
-}
-function createDiskReconcileJobRunner(now = Date.now) {
-	let job = idleDiskReconcileJob();
-	let inFlight = null;
-	const snapshot = () => job;
-	const start = (deps) => {
-		if (job.state === "running" && inFlight) return job;
-		job = {
-			...idleDiskReconcileJob(),
-			state: "running",
-			startedAtMs: now()
-		};
-		deps.log?.("pipeline disk reconcile started");
-		inFlight = (async () => {
-			try {
-				const result = await reconcileFleetFromDisk({
-					listDeviceIds: deps.listDeviceIds,
-					rescanRecordings: (deviceId) => withTimeoutRetry(() => deps.rescanRecordings(deviceId)),
-					reconcileAnalytics: (deviceId) => withTimeoutRetry(() => deps.reconcileAnalytics(deviceId)),
-					onProgress: (update) => {
-						job = {
-							...job,
-							total: update.total,
-							completed: update.completed,
-							currentDeviceId: update.deviceId,
-							failed: update.failed,
-							mediaDropped: update.mediaDropped,
-							tracks: update.tracks,
-							events: update.events
-						};
-						deps.onProgress?.(update);
-						deps.log?.("pipeline disk reconcile camera", {
-							deviceId: update.deviceId,
-							completed: update.completed,
-							total: update.total,
-							failed: update.failed.length,
-							mediaDropped: update.mediaDropped,
-							tracks: update.tracks,
-							events: update.events
-						});
-					}
-				});
-				job = {
-					...job,
-					state: "done",
-					total: result.cameras + result.failed.length,
-					completed: result.cameras + result.failed.length,
-					currentDeviceId: null,
-					failed: result.failed,
-					mediaDropped: result.mediaDropped,
-					tracks: result.tracks,
-					events: result.events,
-					finishedAtMs: now(),
-					error: null
-				};
-				deps.log?.("pipeline disk reconcile", {
-					cameras: result.cameras,
-					failed: result.failed,
-					mediaDropped: result.mediaDropped,
-					tracks: result.tracks,
-					events: result.events
-				});
-			} catch (err) {
-				const error = err instanceof Error ? err.message : String(err);
-				job = {
-					...job,
-					state: "error",
-					currentDeviceId: null,
-					finishedAtMs: now(),
-					error
-				};
-				deps.log?.("pipeline disk reconcile failed", { error });
-			} finally {
-				inFlight = null;
-			}
-		})();
-		return job;
-	};
-	return {
-		snapshot,
-		start
-	};
-}
-//#endregion
-//#region src/widget-catalog.ts
-var pipelineOrchestratorWidgets = [{
-	tab: "device-tab",
-	label: "Pipeline Quick Stats",
-	preAuth: false,
-	kind: "remote",
-	remote: {
-		remoteName: "addon_pipeline_orchestrator_widgets",
-		exposedModule: "./widgets",
-		componentKey: "pipeline-quick-stats"
-	},
-	stableId: "pipeline-quick-stats",
-	description: "Phase / Detection FPS / Inference / Active Tracks tile row.",
-	icon: "activity",
-	bundle: "remoteEntry.js",
-	hosts: ["device-tab", "dashboard"],
-	requires: {
-		deviceContext: true,
-		integrationContext: false
-	},
-	defaultSize: "md",
-	allowedSizes: [
-		"sm",
-		"md",
-		"lg"
-	],
-	defaultColumns: 6,
-	defaultRows: 1
-}, {
-	tab: "device-tab",
-	label: "Zone Editor",
-	preAuth: false,
-	kind: "remote",
-	remote: {
-		remoteName: "addon_pipeline_orchestrator_widgets",
-		exposedModule: "./widgets",
-		componentKey: "zone-editor"
-	},
-	stableId: "zone-editor",
-	description: "Polygon / tripwire CRUD + per-stage rule editor.",
-	icon: "shapes",
-	bundle: "remoteEntry.js",
-	hosts: ["device-tab"],
-	requires: {
-		deviceContext: true,
-		integrationContext: false
-	},
-	defaultSize: "xl",
-	allowedSizes: ["lg", "xl"],
-	defaultColumns: 12,
-	defaultRows: 4
-}];
-//#endregion
 //#region src/settings-ui-schemas.ts
 /** Build the addon-level schema sections (cluster roles + crop + balancer + failover). */
 function buildGlobalSettingsSections(options) {
@@ -52973,6 +53104,22 @@ function buildDeviceSettingsSections(nodeOptions) {
 						field: "detectionMode",
 						notEquals: "disabled"
 					}
+				},
+				{
+					key: "activityDetectionFps",
+					type: "slider",
+					label: "Detection FPS while the device is working",
+					min: 1,
+					max: 10,
+					step: 1,
+					default: 1,
+					showValue: true,
+					unit: "fps",
+					description: "A device-activity session lasts as long as the job does — a cleaning run is tens of minutes. This caps the rate for that session only; a session opened by motion keeps the rate above.",
+					showWhen: {
+						field: "motionSources",
+						includes: "device-activity"
+					}
 				}
 			]
 		},
@@ -53062,6 +53209,99 @@ function deriveRuntimeSettings(config) {
 	};
 }
 //#endregion
+//#region src/viewer-ui-provider.ts
+/**
+* viewer-ui provider — the pipeline-orchestrator serves the CamStack viewer web
+* SPA (mirrors what the now-removed standalone addon-viewer-ui used to do).
+*
+* Why here: the orchestrator is a hub bootstrap addon (always installed + baked),
+* so folding the viewer serving into it avoids a second addon whose only job was
+* to hold static files. The viewer's Expo web export is COPIED into this addon's
+* `assets/viewer/` locally by the viewer repo's `scripts/copy-dist-to-orchestrator.js`
+* (run from a checkout that HAS the `camstack/` submodule + Expo toolchain — the
+* publish/image CI does not, which is exactly why we copy a pre-built dist rather
+* than build it here). vite emits only into `dist/`, so `assets/viewer` survives
+* the addon build; `assets` is in the package `files`, so it ships on
+* `camstack deploy`. The hub's `main.ts` resolves the `viewer-ui` singleton at
+* boot and mounts the SPA at `/viewer/camstack`.
+*
+* `index.js` runs from `dist/`, so the SPA root is one level up + `assets/viewer`.
+*/
+var __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+/** Absolute path to the staged viewer web SPA (`<addon-root>/assets/viewer`). */
+function resolveViewerDistDir() {
+	return node_path.default.resolve(__dirname$1, "..", "assets", "viewer");
+}
+/** Version of the staged viewer, written by the copy script; 'unknown' if absent. */
+function readViewerVersion() {
+	try {
+		const raw = node_fs.default.readFileSync(node_path.default.join(resolveViewerDistDir(), ".viewer-version"), "utf-8").trim();
+		if (raw) return raw;
+	} catch {}
+	return "unknown";
+}
+/** Build the viewer-ui provider. Serves whatever dist was staged into
+*  `assets/viewer`; when nothing is staged the hub's mount cleanly 404s. */
+function createViewerUiProvider() {
+	return {
+		getStaticDir: async () => ({ staticDir: resolveViewerDistDir() }),
+		getVersion: async () => ({ version: readViewerVersion() })
+	};
+}
+//#endregion
+//#region src/widget-catalog.ts
+var pipelineOrchestratorWidgets = [{
+	tab: "device-tab",
+	label: "Pipeline Quick Stats",
+	preAuth: false,
+	kind: "remote",
+	remote: {
+		remoteName: "addon_pipeline_orchestrator_widgets",
+		exposedModule: "./widgets",
+		componentKey: "pipeline-quick-stats"
+	},
+	stableId: "pipeline-quick-stats",
+	description: "Phase / Detection FPS / Inference / Active Tracks tile row.",
+	icon: "activity",
+	bundle: "remoteEntry.js",
+	hosts: ["device-tab", "dashboard"],
+	requires: {
+		deviceContext: true,
+		integrationContext: false
+	},
+	defaultSize: "md",
+	allowedSizes: [
+		"sm",
+		"md",
+		"lg"
+	],
+	defaultColumns: 6,
+	defaultRows: 1
+}, {
+	tab: "device-tab",
+	label: "Zone Editor",
+	preAuth: false,
+	kind: "remote",
+	remote: {
+		remoteName: "addon_pipeline_orchestrator_widgets",
+		exposedModule: "./widgets",
+		componentKey: "zone-editor"
+	},
+	stableId: "zone-editor",
+	description: "Polygon / tripwire CRUD + per-stage rule editor.",
+	icon: "shapes",
+	bundle: "remoteEntry.js",
+	hosts: ["device-tab"],
+	requires: {
+		deviceContext: true,
+		integrationContext: false
+	},
+	defaultSize: "xl",
+	allowedSizes: ["lg", "xl"],
+	defaultColumns: 12,
+	defaultRows: 4
+}];
+//#endregion
 //#region src/index.ts
 /**
 * addon-pipeline-orchestrator — hub-side camera-to-agent load balancer.
@@ -53376,6 +53616,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			isCapActiveForDevice: (deviceId, capName) => this.isCapActiveForDevice(deviceId, capName),
 			isAudioAnalysisActive: (deviceId) => this.isAudioAnalysisActive(deviceId),
 			deviceHasOnboardMotionCap: (deviceId) => this.deviceHasOnboardMotionCap(deviceId),
+			deviceHasActivitySignalCap: (deviceId) => this.deviceHasActivitySignalCap(deviceId),
 			deviceHasNativeObjectDetectionCap: (deviceId) => this.deviceHasNativeObjectDetectionCap(deviceId),
 			handleDeviceRegistered: (deviceId) => this.handleDeviceRegistered(deviceId),
 			handleDeviceUnregistered: (deviceId) => this.handleDeviceUnregistered(deviceId),
@@ -54562,6 +54803,26 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* we err toward the analyzer (never lose detection coverage when the
 	* binding lookup hiccups).
 	*/
+	/**
+	* True when the device's driver registered `recording-signal` — the cap a
+	* device uses to say, itself, that it is working (a robot vacuum cleaning).
+	* Drives the `device-activity` entry in the `motionSources` DEFAULT (D392),
+	* so the source arrives on exactly the devices that can raise it and on no
+	* other camera in the fleet.
+	*
+	* Same failure discipline as `deviceHasOnboardMotionCap`: a binding lookup
+	* that throws answers `false`, which loses the DEFAULT and never the
+	* operator's explicit choice (this is asked only when they pinned nothing).
+	*/
+	async deviceHasActivitySignalCap(deviceId) {
+		const api = this.api;
+		if (!api) return false;
+		try {
+			return (await api.deviceManager.getBindings.query({ deviceId })).entries.some((e) => e.kind === "native" && e.capName === "recording-signal");
+		} catch {
+			return false;
+		}
+	}
 	async deviceHasOnboardMotionCap(deviceId) {
 		const api = this.api;
 		if (!api) return false;