@camstack/addon-pipeline-orchestrator 1.2.183 → 1.2.184

package/dist/index.mjs

@@ -5348,6 +5348,86 @@ var ZodIssueCode = {
 /** @deprecated Do not use. Stub definition, only included for zod-to-json-schema compatibility. */
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
+//#endregion
+//#region ../types/dist/sleep-BnujYGPe.mjs
+/**
+* The audio chunk plane's byte format, and the ONE expansion from a coded
+* window to float samples (D455).
+*
+* ## Why a format at all
+*
+* D450 took the plane off its 8 → 16 kHz upsample: it carries the SOURCE
+* RATE, and the one consumer that needs 16 kHz resamples next to the model.
+* It left the FORMAT alone — the broker still turned each G.711 byte into a
+* 4-byte f32le sample before the bytes entered the transport, so every leg of
+* the plane carried four times the source. The plane crosses hub-main twice on
+* the way to the analyzer, and the fleet's G.711 cameras are ~79 % of it.
+*
+* So the plane carries the source BYTES too, and whoever needs floats expands
+* them where it needs them. That is the same argument D450 made for the rate,
+* one step further along the same wire.
+*
+* ## Why the expansion lives here
+*
+* Two packages need it and they must never disagree: `addon-pipeline`'s broker
+* (which still has to serve a subscriber that did NOT ask for coded bytes —
+* `AudioChunkPlane` expands per subscription) and
+* `addon-pipeline-orchestrator`'s `AudioWindowAccumulator` (which flushes an
+* f32le window to the analyzer cap, whose `AudioChunkInput` contract is
+* unchanged and stays f32le). Both bundle the bare `@camstack/types` entry
+* into their own dist (`self-contained` externals), so this travels with a
+* `camstack deploy` and needs no published server.
+*
+* A second μ-law table anywhere else is the defect this module exists to
+* prevent. (`stream-broker.ts`'s `mulawToPcm` / `alawToPcm` are the ENCODE
+* direction for the WebRTC egress — a different transform, not a copy.)
+*
+* ## Absent means f32le
+*
+* `format` is optional on the wire and its absence means `f32le` — today's
+* bytes, byte for byte. A peer that never heard of the field is served what it
+* has always been served, because the broker only emits a coded window to a
+* subscription that DECLARED it accepts one (`AudioSubscribeOptions.accept`).
+* That is the D448 `rawForward` negotiation, and it is what makes this
+* deployable one addon at a time across three nodes.
+*/
+/** Every byte format the audio chunk plane can carry. `f32le` is the default. */
+var AUDIO_CHUNK_FORMATS = [
+	"f32le",
+	"pcmu",
+	"pcma"
+];
+/**
+* Build the μ-law decode table (ITU-T G.711). Each of the 256 byte values maps
+* to a 16-bit PCM sample, normalised to [-1.0, 1.0] for f32le output.
+*
+* Moved here verbatim from `audio-rtp-decoder.ts`, which no longer decodes:
+* it buffers the coded bytes and the plane's consumers expand.
+*/
+function buildUlawTable() {
+	const table = new Float32Array(256);
+	for (let i = 0; i < 256; i++) {
+		const complemented = ~i & 255;
+		const sign = (complemented & 128) !== 0 ? -1 : 1;
+		const exponent = complemented >> 4 & 7;
+		table[i] = sign * ((8 * (complemented & 15) + 132 << exponent) - 132) / 32768;
+	}
+	return table;
+}
+/** Build the A-law decode table (ITU-T G.711). */
+function buildAlawTable() {
+	const table = new Float32Array(256);
+	for (let i = 0; i < 256; i++) {
+		const xored = i ^ 85;
+		const sign = (xored & 128) !== 0 ? 1 : -1;
+		const exponent = xored >> 4 & 7;
+		const mantissa = xored & 15;
+		table[i] = sign * (exponent === 0 ? 16 * mantissa + 8 : 16 * mantissa + 264 << exponent - 1) / 32768;
+	}
+	return table;
+}
+buildUlawTable();
+buildAlawTable();
 Object.fromEntries([
 	{
 		id: "overview",
@@ -6667,11 +6747,20 @@ var SubscribeFramesResultSchema = object({
 * (the wire-serialisable supertype of `Buffer`) to match `DecodedFrameSchema`
 * / `EncodedPacketSchema`'s precedent; a `Buffer` is assignable to it.
 */
+var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
 var DecodedAudioChunkSchema = object({
 	data: _instanceof(Uint8Array),
 	sampleRate: number().int().positive(),
 	channels: number().int().positive(),
-	timestamp: number()
+	timestamp: number(),
+	/**
+	* Byte format of `data`. ABSENT MEANS `f32le` — today's bytes, byte for
+	* byte, for any peer that never heard of this field. A coded window
+	* (`pcmu` / `pcma`, one byte per sample) is only ever emitted to a
+	* subscription that DECLARED it accepts one, so absence can never mean
+	* "coded bytes a consumer will read as floats" (D455).
+	*/
+	format: AudioChunkFormatSchema.optional()
 });
 /**
 * Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). The
@@ -6683,7 +6772,18 @@ var DecodedAudioChunkSchema = object({
 var SubscribeAudioChunksInputSchema = object({
 	brokerId: string(),
 	/** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
-	tag: string().optional()
+	tag: string().optional(),
+	/**
+	* Byte formats this subscriber can READ, best first. The broker serves the
+	* chunk's own format when it is in this list and expands to `f32le`
+	* otherwise, so a subscriber is never handed bytes it cannot interpret.
+	*
+	* Absent (or without the source format) means `f32le` — the behaviour every
+	* subscriber had before D455, unchanged. This is the negotiation half of
+	* the source-bytes lever: it is what lets the broker and its consumers
+	* deploy one at a time across three nodes.
+	*/
+	accept: array(AudioChunkFormatSchema).readonly().optional()
 });
 /** Result of `stream-broker.subscribeAudioChunks`. */
 var SubscribeAudioChunksResultSchema = object({ 
@@ -7755,7 +7855,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 * still gives the event loop a chance to drain — useful for breaking
 * up tight async loops without changing call-site semantics.
 */
-function sleep$1(ms) {
+function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
@@ -11508,6 +11608,51 @@ var AudioAnalysisSettingsSchema = object({
 	minConfidence: number().min(0).max(1).default(.3),
 	allowedClasses: array(string()).default([])
 });
+/**
+* `attachDevice` — the analyzer PULLS a camera's audio from the broker (D461).
+*
+* Until D461 the orchestrator drained the broker's chunk plane, accumulated
+* ~1 s windows and pushed them back out as `analyseChunk`. It neither produced
+* nor consumed the audio: the PCM crossed hub-main twice for a process that
+* only buffered it. `attachDevice` inverts the direction — the analyzer opens
+* its own `subscribeAudioChunks` against the broker and the subscriber IS the
+* decoder, so the coded G.711 bytes D455 put on the plane stay coded all the
+* way to the one expansion that feeds the model.
+*
+* The orchestrator still owns the POLICY (the `audioMode` gate, the on-motion
+* window, the per-device node assignment, the settings read) and therefore
+* still owns the attach/detach pair. It no longer owns the bytes.
+*/
+var AudioAttachDeviceInputSchema = object({
+	deviceId: number(),
+	/** Broker id (`<deviceId>/<camStreamId>`) carrying this camera's audio. */
+	brokerId: string(),
+	/**
+	* `clusterRoles.ingestNode` — the node whose broker owns the source dial.
+	* Every `streamBroker` call the attachment makes is pinned to it, exactly as
+	* the orchestrator's poller pinned them before the move.
+	*/
+	ingestNodeId: string(),
+	/**
+	* Resolved once by the orchestrator at attach time, exactly as it was read
+	* once per subscription before D461. The analyzer does NOT re-resolve per
+	* window: a settings change re-attaches, which is what always happened.
+	*/
+	settings: AudioAnalysisSettingsSchema
+});
+var AudioAttachDeviceResultSchema = object({
+	/** False only when the analyzer is shutting down and refused to attach. */
+	attached: boolean(),
+	/**
+	* True when the attachment replaced a live one for the same device. An
+	* attach is idempotent by REPLACEMENT — two pollers on one camera would
+	* double the broker's fanout and neither would know about the other.
+	*/
+	replaced: boolean()
+});
+var AudioDetachDeviceResultSchema = object({ 
+/** False when no attachment existed — detach is idempotent. */
+detached: boolean() });
 var AudioClassificationResultSchema = object({
 	labels: array(AudioClassificationLabelSchema).readonly(),
 	rawLabels: array(AudioClassificationLabelSchema).readonly().optional(),
@@ -11516,7 +11661,7 @@ var AudioClassificationResultSchema = object({
 method(object({
 	chunk: AudioChunkInputSchema,
 	settings: AudioAnalysisSettingsSchema
-}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }), method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }), method(_void(), boolean()), method(_void(), _void(), { kind: "mutation" }), method(_void(), object({ backend: string() }), {
+}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }), method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }), method(AudioAttachDeviceInputSchema, AudioAttachDeviceResultSchema, { kind: "mutation" }), method(object({ deviceId: number() }), AudioDetachDeviceResultSchema, { kind: "mutation" }), method(_void(), boolean()), method(_void(), _void(), { kind: "mutation" }), method(_void(), object({ backend: string() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -32327,12 +32472,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"audioAnalyzer.attachDevice": {
+		capName: "audio-analyzer",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"audioAnalyzer.classify": {
 		capName: "audio-analyzer",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"audioAnalyzer.detachDevice": {
+		capName: "audio-analyzer",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"audioAnalyzer.dispose": {
 		capName: "audio-analyzer",
 		capScope: "system",
@@ -38176,11 +38333,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"audioAnalyzer.attachDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"audioAnalyzer.classify": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
+	"audioAnalyzer.detachDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"audioMetrics.getCurrentSnapshot": [{
 		name: "deviceId",
 		form: "single",
@@ -40032,6 +40199,52 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+var G711_SCALE_CORRECTION_DB = {
+	PCMU: 20 * Math.log10(4),
+	PCMA: 20 * Math.log10(8)
+};
+/**
+* Restate a dBFS number that was MEASURED through the pre-epoch decoder as the
+* same intent on the ITU-T scale (D460).
+*
+* ## When this applies, and when it is the wrong thing to reach for
+*
+* An absolute-dBFS number in this repo is one of two things, and only one of
+* them converts:
+*
+*  - **A statement about the scale** — "-55 dBFS is near silence", "-25 dBFS
+*    is loud". It was true on the ITU-T scale before the epoch and it is true
+*    after. The defect was never in the number; it was that 19 of this hub's
+*    25 cameras did not obey it. Converting such a number takes something
+*    correct and makes it wrong, in order to preserve a bug.
+*  - **A measurement taken through the old decoder** — a value someone read
+*    off a meter that under-reported by exactly 4× (PCMU) or 8× (PCMA). It
+*    describes a sound that was really {@link G711_SCALE_CORRECTION_DB} dB
+*    louder. That is what this function is for.
+*
+* Telling the two apart is a question about PROVENANCE, not about arithmetic,
+* and it cannot be answered from the number. It is answered by the comment the
+* author left — which is why `scripts/check-dbfs-era.mts` makes leaving one
+* mandatory.
+*
+* ## Why a function and not a typed-in number
+*
+* `-55 + 12.04` written into a source file is, six months later, completely
+* indistinguishable from a threshold somebody simply preferred. Calling this
+* keeps the derivation, the law, and the original measurement all visible at
+* the call site, so a future reader can disagree with the *premise* instead of
+* having to reverse-engineer the sum.
+*
+* **This is not a runtime gain.** It converts an authored CONSTANT once, where
+* it is declared. It must never be applied to a live sample or a stored
+* `AudioEvent.dbfs`: the decoder is correct now, and a second authority
+* adjusting numbers the decoder already got right is the original defect with
+* an extra place to argue with (D459).
+*/
+function ituDbfsFromPreEpoch(law, authoredDbfs) {
+	return authoredDbfs + G711_SCALE_CORRECTION_DB[law];
+}
+Math.round(ituDbfsFromPreEpoch("PCMU", -55));
 /** Schema defaults — an untouched sub-field must author exactly these. */
 var NC_AUDIO_DEFAULTS = {
 	hitPercent: 60,
@@ -40743,248 +40956,6 @@ function deviceBackendToFormat(backend) {
 	return DEVICE_BACKEND_TO_FORMAT[backend] ?? "onnx";
 }
 //#endregion
-//#region src/audio-chunk-poller.ts
-/**
-* `AudioChunkPoller` — the consumer-side poll loop of the decoded audio-chunk
-* plane (Phase 5 / D9).
-*
-* Replaces the live-object `IStreamBroker.onDecodedAudioChunk(cb)` callback
-* path. A live callback cannot cross a process boundary; once the `pipeline`
-* group is dissolved (Task 8) the orchestrator runs in a different process
-* from the broker, so audio delivery must go over tRPC.
-*
-* The consumer:
-*
-*   1. `subscribeAudioChunks({ brokerId, tag })` over tRPC — the broker
-*      registers a per-subscription bounded FIFO queue and returns a
-*      `subscriptionId`;
-*   2. polls `pullAudioChunks({ subscriptionId, maxCount })` on a modest
-*      interval, draining `DecodedAudioChunk`s in FIFO arrival order;
-*   3. feeds each chunk to its downstream audio logic;
-*   4. on teardown, `unsubscribeAudioChunks`.
-*
-* Audio is not latency-critical like video, and chunks arrive only ~every
-* 500ms (the broker's `AudioCodecSession` window). A modest poll period plus
-* a small per-poll burst keeps latency low without busy-spinning. The
-* broker's queue is FIFO/no-drop-sized so a poll-period of jitter never
-* loses a chunk.
-*
-* Boot-race tolerance: the broker for a given camStream may not be registered
-* yet when the orchestrator wires the subscription (provider addons publish
-* their cameraStreams asynchronously after their probe completes).
-* `subscribeAudioChunks` retries with exponential backoff (capped at
-* `MAX_SUBSCRIBE_RETRY_BACKOFF_MS`) until it succeeds or the returned
-* teardown closure is invoked. Mirrors the `FrameHandlePoller` recovery
-* shape so video and audio plumbing self-heal identically.
-*/
-/** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
-var POLL_INTERVAL_MS$1 = 200;
-/** How many chunks to drain per poll — a small burst absorbs jitter. */
-var PULL_MAX_COUNT = 8;
-/**
-* Consecutive pull failures before we attempt to re-subscribe. A single failed
-* poll is treated as a blip (re-subscribing would leak a broker-side FIFO); a
-* sustained failure means the broker child restarted and dropped our
-* subscription, so we re-establish it.
-*/
-var RESUBSCRIBE_AFTER_FAILURES = 2;
-/** Re-subscribe at most once every N ticks while failing (~1s at 200ms). */
-var RESUBSCRIBE_THROTTLE_TICKS = 5;
-/** First subscribe-retry delay, doubled on every subsequent failure. */
-var INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS = 250;
-/**
-* Subscribe-retry backoff ceiling. 5 s matches the frame-handle poller — fast
-* enough to recover within a single reconcile of the orchestrator and slow
-* enough that a misconfigured camStream costs ~12 op/min, not 5/s.
-*/
-var MAX_SUBSCRIBE_RETRY_BACKOFF_MS = 5e3;
-/**
-* Attempts after which a still-failing subscribe escalates from the fast 5 s
-* ceiling to {@link LONG_SUBSCRIBE_RETRY_BACKOFF_MS}. ~15 attempts ≈ one
-* minute of fast retries — plenty for the boot races the 5 s ceiling exists
-* for. A broker that is STILL absent after that is a long-lived condition
-* (e.g. a DISABLED camera, whose broker the stream-broker reconcile refuses
-* to recreate — 2026-07-23) and retrying every 5 s forever is pure log/RPC
-* churn. The slow loop stays alive so audio still recovers automatically
-* (≤60 s) once the camera is re-enabled.
-*/
-var PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS = 15;
-var LONG_SUBSCRIBE_RETRY_BACKOFF_MS = 6e4;
-/**
-* Subscribe to a broker's decoded audio-chunk stream and start the poll loop.
-*
-* Always resolves to a teardown closure — when the broker is not yet
-* registered the closure cancels the ongoing retry loop; when polling is
-* active it stops the loop and releases the broker subscription. Mirrors
-* `startFrameHandlePoller` so video and audio recover identically.
-*/
-function startAudioChunkPoller(options) {
-	const lifecycle = {
-		stopped: false,
-		retryTimer: void 0,
-		pollTimer: void 0,
-		activeSubscriptionId: null
-	};
-	const teardown = () => {
-		if (lifecycle.stopped) return;
-		lifecycle.stopped = true;
-		if (lifecycle.retryTimer) {
-			clearTimeout(lifecycle.retryTimer);
-			lifecycle.retryTimer = void 0;
-		}
-		if (lifecycle.pollTimer) {
-			clearTimeout(lifecycle.pollTimer);
-			lifecycle.pollTimer = void 0;
-		}
-		const subId = lifecycle.activeSubscriptionId;
-		if (subId) {
-			lifecycle.activeSubscriptionId = null;
-			options.api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: subId }, nodePin(options.ownerNodeId)).catch((err) => {
-				options.logger.warn("audio-chunk poller: unsubscribeAudioChunks failed", { meta: {
-					brokerId: options.brokerId,
-					subscriptionId: subId,
-					error: errMsg(err)
-				} });
-			});
-		}
-	};
-	subscribeWithRetry(options, lifecycle);
-	return teardown;
-}
-/**
-* Run the subscribe → poll handshake with exponential backoff on subscribe
-* failures. Resolves once the subscription is acquired (and the poll loop has
-* been started) or once `lifecycle.stopped` flips, whichever comes first.
-*/
-async function subscribeWithRetry(options, lifecycle) {
-	const { api, brokerId, tag, ownerNodeId, logger } = options;
-	const pin = nodePin(ownerNodeId);
-	let backoffMs = INITIAL_SUBSCRIBE_RETRY_BACKOFF_MS;
-	let attempt = 0;
-	while (!lifecycle.stopped) {
-		attempt += 1;
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			}, pin);
-			if (lifecycle.stopped) {
-				await api.streamBroker.unsubscribeAudioChunks.mutate({ subscriptionId: result.subscriptionId }, pin).catch((err) => {
-					logger.warn("audio-chunk poller: late unsubscribe failed", { meta: {
-						brokerId,
-						subscriptionId: result.subscriptionId,
-						error: errMsg(err)
-					} });
-				});
-				return;
-			}
-			if (attempt > 1) logger.info("audio-chunk poller: subscribeAudioChunks recovered", { meta: {
-				brokerId,
-				tag,
-				attempt
-			} });
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			startPolling(options, lifecycle);
-			return;
-		} catch (err) {
-			if (lifecycle.stopped) return;
-			if (attempt === 1) logger.warn("audio-chunk poller: subscribeAudioChunks failed, retrying", { meta: {
-				brokerId,
-				tag,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			else logger.debug("audio-chunk poller: subscribeAudioChunks still failing", { meta: {
-				brokerId,
-				tag,
-				attempt,
-				error: errMsg(err),
-				nextRetryInMs: backoffMs
-			} });
-			await sleep(backoffMs, lifecycle);
-			backoffMs = Math.min(attempt >= PERSISTENT_SUBSCRIBE_FAILURE_ATTEMPTS ? LONG_SUBSCRIBE_RETRY_BACKOFF_MS : MAX_SUBSCRIBE_RETRY_BACKOFF_MS, backoffMs * 2);
-		}
-	}
-}
-/**
-* Drive the steady-state poll loop. Mid-stream `pullAudioChunks` failures
-* trigger a fresh `subscribeAudioChunks` via the recovery branch — covers
-* the broker child restart case where our `subscriptionId` is silently
-* disowned.
-*/
-function startPolling(options, lifecycle) {
-	const { api, brokerId, tag, ownerNodeId, onChunk, logger } = options;
-	const pin = nodePin(ownerNodeId);
-	let consecutiveFailures = 0;
-	const resubscribe = async () => {
-		try {
-			const result = await api.streamBroker.subscribeAudioChunks.mutate({
-				brokerId,
-				tag
-			}, pin);
-			lifecycle.activeSubscriptionId = result.subscriptionId;
-			logger.info("audio-chunk poller: re-subscribed after broker outage", { meta: {
-				brokerId,
-				tag,
-				subscriptionId: result.subscriptionId,
-				afterFailures: consecutiveFailures
-			} });
-			return true;
-		} catch {
-			return false;
-		}
-	};
-	const tick = async () => {
-		if (lifecycle.stopped) return;
-		const subId = lifecycle.activeSubscriptionId;
-		if (!subId) return;
-		try {
-			const chunks = await api.streamBroker.pullAudioChunks.query({
-				subscriptionId: subId,
-				maxCount: PULL_MAX_COUNT
-			}, pin);
-			if (consecutiveFailures > 0) logger.info("audio-chunk poller: stream recovered", { meta: {
-				brokerId,
-				subscriptionId: subId
-			} });
-			consecutiveFailures = 0;
-			for (const chunk of chunks) {
-				if (lifecycle.stopped) break;
-				await onChunk(chunk);
-			}
-		} catch (err) {
-			consecutiveFailures += 1;
-			if (consecutiveFailures === 1) logger.warn("audio-chunk poller: pullAudioChunks failed — attempting recovery", { meta: {
-				brokerId,
-				subscriptionId: subId,
-				error: errMsg(err)
-			} });
-			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
-		}
-		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS$1);
-	};
-	tick();
-}
-/**
-* Cancellable sleep — wakes early when `lifecycle.stopped` flips. We
-* keep a local wrapper around the shared {@link sleep} helper because
-* the lifecycle tracks the active retry timer for `teardown()` to
-* clear; pure `sleep()` would leak the timer if teardown fired while
-* we were waiting.
-*/
-function sleep(ms, lifecycle) {
-	return new Promise((resolve) => {
-		if (lifecycle.stopped) {
-			resolve();
-			return;
-		}
-		lifecycle.retryTimer = setTimeout(() => {
-			lifecycle.retryTimer = void 0;
-			resolve();
-		}, ms);
-	});
-}
-//#endregion
 //#region src/audio-load-balancer.ts
 function balanceAudio(input) {
 	if (input.nodes.length === 0) return null;
@@ -41001,278 +40972,6 @@ function balanceAudio(input) {
 	};
 }
 //#endregion
-//#region src/orchestrator-types.ts
-var PHASE_MODE_VALUES = new Set([
-	"disabled",
-	"always-on",
-	"on-motion"
-]);
-function isPipelinePhaseMode(v) {
-	return PHASE_MODE_VALUES.has(v);
-}
-/**
-* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
-* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
-* `reconcileDispatch` is additive-only and never revisits these, so a slow
-* safety-net timer + event-driven debounce triggers recover them.
-*/
-var PENDING_RETRY_INTERVAL_MS = 6e4;
-/** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
-var PENDING_RETRY_DEBOUNCE_MS = 2e3;
-/**
-* Periodic auto-rebalance sweep. New attaches are already load-balanced at
-* dispatch time; this corrects DRIFT that accumulates over time (uneven
-* detach, a node returning online, a weight change) so the steady-state
-* distribution tracks the per-node weights. Only runs with ≥2 enabled detect
-* nodes, and migrates under hysteresis so a balanced cluster is a no-op.
-*/
-var AUTO_REBALANCE_INTERVAL_MS = 6e4;
-/**
-* Hysteresis margin (weight-adjusted cameras) for the periodic auto-rebalance:
-* migrate a camera only when its target node is at least this much less loaded
-* than its current node. > 1 so equalizing a single-camera gap (which would
-* only reverse the imbalance) is skipped — prevents periodic churn.
-*/
-var AUTO_REBALANCE_MIN_IMPROVEMENT = 1.5;
-var REMOTE_HEALTH_WINDOW_MS = 60 * 6e4;
-/**
-* Device-details keys routed through the orchestrator's pipeline
-* settings writer instead of the device orchestration store. The
-* `cameraPipeline` key carries the full `CameraPipelineConfig`
-* emitted by the `pipeline-editor` ConfigField (Phase 6 Option B).
-*/
-var PIPELINE_PATCH_KEYS = ["cameraPipeline"];
-var DEFAULT_FAILOVER_POLICY = {
-	onDisconnect: "migrate",
-	pinnedOnDisconnect: "leave-pinned",
-	onReconnect: "restore"
-};
-/**
-* Custom-action catalog exposed through `api.addons.custom` (Task 9.1 PoC).
-*
-* The orchestrator's cap surface is the contract for all runtime traffic
-* (assignCamera / unassignCamera / rebalance / getGlobalMetrics etc). This
-* catalog is reserved for read-only diagnostics that are intentionally
-* outside the cap — they expose internal state (balancer caches, enabledNodes
-* set, active detection count) that is useful for admin tooling but does not
-* belong on the capability contract.
-*/
-var OrchestratorDiagnosticsSchema = object({
-	localNodeId: string(),
-	knownRunnerNodes: array(string()),
-	cachedAgentLoadNodeIds: array(string()),
-	enabledNodes: array(string()),
-	enabledDecoderNodes: array(string()),
-	enabledAudioNodes: array(string()),
-	enabledIngestNodes: array(string()),
-	clusterRoles: object({
-		ingestNode: string(),
-		audioNode: string(),
-		motionNode: string()
-	}),
-	assignedDeviceCount: number().int().min(0),
-	cameraConfigCount: number().int().min(0),
-	activeDetectionCount: number().int().min(0)
-});
-/**
-* The node-stress long-term-statistics read surface.
-*
-* A custom action rather than a cap method, matching how the orchestrator
-* already serves `dumpState`: this is a hub-local read over a table the hub
-* owns, and it ships with one `camstack deploy` instead of a release train.
-* The MEAN is derived here and returned alongside the addable `sum`/`samples`
-* — a chart wants the first, a re-bucketing caller wants the second, and a
-* stored mean is a field that can disagree with both.
-*/
-var NodeStressStatsInputSchema = object({
-	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
-	series: string().optional(),
-	/** A node id. Omit for every node. */
-	subject: string().optional(),
-	/** Inclusive bucket-start bounds, ms. */
-	from: number().int().optional(),
-	to: number().int().optional(),
-	limit: number().int().positive().max(5e3).optional()
-});
-var NodeStressStatsRowSchema = object({
-	subject: string(),
-	series: string(),
-	scope: string(),
-	bucketStart: number(),
-	samples: number(),
-	sum: number(),
-	mean: number(),
-	min: number(),
-	max: number()
-});
-var NodeStressStatsOutputSchema = object({
-	rows: array(NodeStressStatsRowSchema).readonly(),
-	/** Buckets still accumulating — "is it running" answerable at once, rather
-	*  than after five minutes of indistinguishable silence. */
-	open: array(NodeStressStatsRowSchema).readonly(),
-	/** The durable failover history the anti-flap guards read, newest first.
-	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
-	*  be distinguishable from "nothing is watching". */
-	moves: array(object({
-		deviceId: number(),
-		fromNodeId: string(),
-		at: number()
-	})).readonly()
-});
-var pipelineOrchestratorActions = defineCustomActions({
-	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
-	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
-});
-/**
-* Sentinel returned by `buildDetectionConfig` when the profile-slot READ
-* itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
-* while the stream-broker is (re)starting) — as opposed to `null`, which
-* means "genuinely no assigned slot / not configured". Callers MUST treat
-* this differently from `null`: never stop active detection on a transient
-* read failure (the slots almost certainly still exist), and schedule a retry.
-*/
-var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
-//#endregion
-//#region src/audio-window-accumulator.ts
-function sameFormat(a, b) {
-	return a.sampleRate === b.sampleRate && a.channels === b.channels;
-}
-var AudioWindowAccumulator = class {
-	deviceId;
-	onFormat;
-	pcmParts = [];
-	accumulatedBytes = 0;
-	accumulatedMs = 0;
-	windowSampleRate = 0;
-	windowChannels = 0;
-	windowTimestamp = 0;
-	windowOpen = false;
-	/** Last format seen on this subscription — survives a flush, unlike the window anchor. */
-	lastFormat = null;
-	constructor(deviceId, onFormat) {
-		this.deviceId = deviceId;
-		this.onFormat = onFormat;
-	}
-	/**
-	* Append one decoded PCM chunk to the open window. Returns the flushed
-	* `AudioChunkInput` once the accumulated duration reaches
-	* `AUDIO_WINDOW_TARGET_MS` (and resets for the next window), else `null`
-	* (accumulate-only, no flush yet).
-	*/
-	push(chunk) {
-		const byteLength = chunk.data.byteLength;
-		const bytes = new Uint8Array(byteLength);
-		bytes.set(new Uint8Array(chunk.data.buffer, chunk.data.byteOffset, byteLength));
-		this.observeFormat({
-			sampleRate: chunk.sampleRate,
-			channels: chunk.channels
-		});
-		if (!this.windowOpen) {
-			this.windowSampleRate = chunk.sampleRate;
-			this.windowChannels = chunk.channels;
-			this.windowTimestamp = chunk.timestamp;
-			this.windowOpen = true;
-		}
-		this.pcmParts.push(bytes);
-		this.accumulatedBytes += byteLength;
-		const channels = chunk.channels > 0 ? chunk.channels : 1;
-		const framesPerChannel = byteLength / 4 / channels;
-		this.accumulatedMs += framesPerChannel / chunk.sampleRate * 1e3;
-		if (this.accumulatedMs < 1e3) return null;
-		const windowData = new Uint8Array(this.accumulatedBytes);
-		let offset = 0;
-		for (const part of this.pcmParts) {
-			windowData.set(part, offset);
-			offset += part.byteLength;
-		}
-		const flushSampleRate = this.windowSampleRate;
-		const flushChannels = this.windowChannels;
-		const flushTimestamp = this.windowTimestamp;
-		this.reset();
-		return {
-			data: windowData,
-			sampleRate: flushSampleRate,
-			channels: flushChannels,
-			timestamp: flushTimestamp,
-			deviceId: this.deviceId
-		};
-	}
-	/**
-	* Report the first format and every change; a change under an OPEN window
-	* drops the partial window so the flushed bytes never mix two rates.
-	*/
-	observeFormat(format) {
-		const previous = this.lastFormat;
-		if (previous !== null && sameFormat(previous, format)) return;
-		const droppedMs = this.windowOpen ? Math.round(this.accumulatedMs) : 0;
-		if (this.windowOpen) this.reset();
-		this.lastFormat = format;
-		this.onFormat?.({
-			from: previous,
-			to: format,
-			droppedMs
-		});
-	}
-	/**
-	* Drop any partially-accumulated window. Called on unsubscribe / device
-	* audio stop (no trailing flush — a sub-second partial window is not worth
-	* a classify during teardown) and internally after every flush.
-	*/
-	reset() {
-		this.pcmParts = [];
-		this.accumulatedBytes = 0;
-		this.accumulatedMs = 0;
-		this.windowOpen = false;
-	}
-};
-/**
-* Build the canonical `AudioResult` frame from one `analyseChunk` result —
-* extracted verbatim from `subscribeAudioStream`'s result→event-payload
-* mapping. The caller wraps this in the `pipeline.audio-inference-result`
-* event; building the frame is pure and needs no controller state.
-*/
-function buildAudioResultFrame(deviceId, result) {
-	const windowId = `${deviceId}-${result.timestamp}`;
-	const audioDetections = [];
-	let idCounter = 0;
-	if (result.classification && result.classification.labels.length > 0) for (const label of result.classification.labels) {
-		idCounter += 1;
-		audioDetections.push({
-			id: `a${idCounter}`,
-			kind: "audio",
-			macroClass: label.className,
-			score: label.score,
-			labels: [{
-				label: label.className,
-				score: label.score
-			}],
-			startMs: 0,
-			endMs: 0
-		});
-	}
-	return {
-		kind: "audio-window",
-		windowId,
-		deviceId,
-		timestamp: result.timestamp,
-		startMs: 0,
-		endMs: 0,
-		level: {
-			rms: result.level.rms,
-			dbfs: result.level.dbfs
-		},
-		detections: audioDetections,
-		debug: result.classification ? {
-			totalInferenceMs: result.classification.inferenceMs,
-			stepTimings: [{
-				source: "audio-analyzer",
-				ms: result.classification.inferenceMs,
-				detectionCount: audioDetections.length
-			}]
-		} : void 0
-	};
-}
-//#endregion
 //#region src/keyed-async-lock.ts
 /**
 * Serializes critical sections per key. Different keys run fully
@@ -41800,73 +41499,41 @@ var AudioSubscriptionController = class {
 				isRemote: isRemoteAudio
 			}
 		});
-		const accumulator = new AudioWindowAccumulator(deviceId, (change) => {
-			const meta = {
-				sampleRate: change.to.sampleRate,
-				channels: change.to.channels,
-				previous: change.from,
-				droppedMs: change.droppedMs
-			};
-			if (change.from === null) {
-				this.deps.logger.info("audio stream delivering", {
-					tags: { deviceId },
-					meta
-				});
-				return;
-			}
-			this.deps.logger.warn("audio stream format changed — partial window dropped", {
-				tags: { deviceId },
-				meta
-			});
-		});
-		const teardown = startAudioChunkPoller({
-			api,
+		const attach = await api.audioAnalyzer.attachDevice.mutate({
+			deviceId,
 			brokerId: audioBrokerId,
-			tag: "audio-analyzer",
-			ownerNodeId: this.deps.ingestNode(),
-			logger: this.deps.logger.withTags({ deviceId }),
-			onChunk: async (chunk) => {
-				this.deps.watchdogNote(deviceId, "audio");
-				try {
-					const audioChunkInput = accumulator.push(chunk);
-					if (!audioChunkInput) return;
-					const result = await api.audioAnalyzer.analyseChunk.mutate({
-						chunk: audioChunkInput,
-						settings,
-						...isRemoteAudio ? { nodeId: audioNodeId } : {}
-					});
-					if (!result) return;
-					const frame = buildAudioResultFrame(deviceId, result);
-					this.deps.eventBus.emit({
-						id: `audio-inference-${deviceId}-${Date.now()}`,
-						timestamp: /* @__PURE__ */ new Date(),
-						source: {
-							type: "device",
-							id: deviceId,
-							nodeId: "hub",
-							addonId: "pipeline-orchestrator",
-							deviceId
-						},
-						category: EventCategory.PipelineAudioInferenceResult,
-						data: {
-							deviceId,
-							frame,
-							nodeId: "hub"
-						}
-					});
-				} catch (err) {
-					const msg = errMsg(err);
-					this.deps.logger.error("Audio analysis failed", {
-						tags: { deviceId },
-						meta: { error: msg }
-					});
+			ingestNodeId: this.deps.ingestNode(),
+			settings
+		}, nodePin(audioNodeId));
+		if (!attach.attached) {
+			this.deps.logger.warn("audio subscription REFUSED by the analyzer", {
+				tags: { deviceId },
+				meta: {
+					audioNodeId,
+					brokerId: audioBrokerId
 				}
+			});
+			return null;
+		}
+		this.deps.logger.info("Audio stream subscribed", {
+			tags: { deviceId },
+			meta: {
+				audioNodeId,
+				brokerId: audioBrokerId,
+				replaced: attach.replaced
 			}
 		});
-		this.deps.logger.info("Audio stream subscribed", { tags: { deviceId } });
 		return () => {
-			teardown();
-			accumulator.reset();
+			api.audioAnalyzer.detachDevice.mutate({ deviceId }, nodePin(audioNodeId)).catch((err) => {
+				this.deps.logger.warn("audio detachDevice failed — the broker lease will reclaim it", {
+					tags: { deviceId },
+					meta: {
+						audioNodeId,
+						brokerId: audioBrokerId,
+						error: errMsg(err)
+					}
+				});
+			});
 		};
 	}
 	/**
@@ -44615,6 +44282,138 @@ var DeviceActivitySource = class {
 	}
 };
 //#endregion
+//#region src/orchestrator-types.ts
+var PHASE_MODE_VALUES = new Set([
+	"disabled",
+	"always-on",
+	"on-motion"
+]);
+function isPipelinePhaseMode(v) {
+	return PHASE_MODE_VALUES.has(v);
+}
+/**
+* Periodic sweep interval for `retryPendingDispatches` — re-dispatches cameras
+* that are KNOWN but UNASSIGNED (pending/over-cap/no-frame-source/load-shed).
+* `reconcileDispatch` is additive-only and never revisits these, so a slow
+* safety-net timer + event-driven debounce triggers recover them.
+*/
+var PENDING_RETRY_INTERVAL_MS = 6e4;
+/** Debounce window for `schedulePendingRetry` — coalesces capacity/eligibility/readiness signals. */
+var PENDING_RETRY_DEBOUNCE_MS = 2e3;
+/**
+* Periodic auto-rebalance sweep. New attaches are already load-balanced at
+* dispatch time; this corrects DRIFT that accumulates over time (uneven
+* detach, a node returning online, a weight change) so the steady-state
+* distribution tracks the per-node weights. Only runs with ≥2 enabled detect
+* nodes, and migrates under hysteresis so a balanced cluster is a no-op.
+*/
+var AUTO_REBALANCE_INTERVAL_MS = 6e4;
+/**
+* Hysteresis margin (weight-adjusted cameras) for the periodic auto-rebalance:
+* migrate a camera only when its target node is at least this much less loaded
+* than its current node. > 1 so equalizing a single-camera gap (which would
+* only reverse the imbalance) is skipped — prevents periodic churn.
+*/
+var AUTO_REBALANCE_MIN_IMPROVEMENT = 1.5;
+var REMOTE_HEALTH_WINDOW_MS = 60 * 6e4;
+/**
+* Device-details keys routed through the orchestrator's pipeline
+* settings writer instead of the device orchestration store. The
+* `cameraPipeline` key carries the full `CameraPipelineConfig`
+* emitted by the `pipeline-editor` ConfigField (Phase 6 Option B).
+*/
+var PIPELINE_PATCH_KEYS = ["cameraPipeline"];
+var DEFAULT_FAILOVER_POLICY = {
+	onDisconnect: "migrate",
+	pinnedOnDisconnect: "leave-pinned",
+	onReconnect: "restore"
+};
+/**
+* Custom-action catalog exposed through `api.addons.custom` (Task 9.1 PoC).
+*
+* The orchestrator's cap surface is the contract for all runtime traffic
+* (assignCamera / unassignCamera / rebalance / getGlobalMetrics etc). This
+* catalog is reserved for read-only diagnostics that are intentionally
+* outside the cap — they expose internal state (balancer caches, enabledNodes
+* set, active detection count) that is useful for admin tooling but does not
+* belong on the capability contract.
+*/
+var OrchestratorDiagnosticsSchema = object({
+	localNodeId: string(),
+	knownRunnerNodes: array(string()),
+	cachedAgentLoadNodeIds: array(string()),
+	enabledNodes: array(string()),
+	enabledDecoderNodes: array(string()),
+	enabledAudioNodes: array(string()),
+	enabledIngestNodes: array(string()),
+	clusterRoles: object({
+		ingestNode: string(),
+		audioNode: string(),
+		motionNode: string()
+	}),
+	assignedDeviceCount: number().int().min(0),
+	cameraConfigCount: number().int().min(0),
+	activeDetectionCount: number().int().min(0)
+});
+/**
+* The node-stress long-term-statistics read surface.
+*
+* A custom action rather than a cap method, matching how the orchestrator
+* already serves `dumpState`: this is a hub-local read over a table the hub
+* owns, and it ships with one `camstack deploy` instead of a release train.
+* The MEAN is derived here and returned alongside the addable `sum`/`samples`
+* — a chart wants the first, a re-bucketing caller wants the second, and a
+* stored mean is a field that can disagree with both.
+*/
+var NodeStressStatsInputSchema = object({
+	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
+	series: string().optional(),
+	/** A node id. Omit for every node. */
+	subject: string().optional(),
+	/** Inclusive bucket-start bounds, ms. */
+	from: number().int().optional(),
+	to: number().int().optional(),
+	limit: number().int().positive().max(5e3).optional()
+});
+var NodeStressStatsRowSchema = object({
+	subject: string(),
+	series: string(),
+	scope: string(),
+	bucketStart: number(),
+	samples: number(),
+	sum: number(),
+	mean: number(),
+	min: number(),
+	max: number()
+});
+var NodeStressStatsOutputSchema = object({
+	rows: array(NodeStressStatsRowSchema).readonly(),
+	/** Buckets still accumulating — "is it running" answerable at once, rather
+	*  than after five minutes of indistinguishable silence. */
+	open: array(NodeStressStatsRowSchema).readonly(),
+	/** The durable failover history the anti-flap guards read, newest first.
+	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
+	*  be distinguishable from "nothing is watching". */
+	moves: array(object({
+		deviceId: number(),
+		fromNodeId: string(),
+		at: number()
+	})).readonly()
+});
+var pipelineOrchestratorActions = defineCustomActions({
+	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
+	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
+});
+/**
+* Sentinel returned by `buildDetectionConfig` when the profile-slot READ
+* itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
+* while the stream-broker is (re)starting) — as opposed to `null`, which
+* means "genuinely no assigned slot / not configured". Callers MUST treat
+* this differently from `null`: never stop active detection on a transient
+* read failure (the slots almost certainly still exist), and schedule a retry.
+*/
+var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
+//#endregion
 //#region src/device-detection-settings.ts
 /** Read a required string leaf out of the hydrated `flat` schema values. */
 function mustString(flat, deviceId, key) {
@@ -48889,6 +48688,10 @@ function wireOrchestratorSubscriptions(deps) {
 		const deviceId = event.source.deviceId;
 		if (typeof deviceId === "number") deps.noteWatchdogSignal(deviceId, "motion");
 	});
+	const unsubAudioWatchdog = deps.eventBus.subscribe({ category: EventCategory.PipelineAudioInferenceResult }, (event) => {
+		if (!isEvent(event, EventCategory.PipelineAudioInferenceResult)) return;
+		deps.noteWatchdogSignal(event.data.deviceId, "audio");
+	});
 	const activitySource = new DeviceActivitySource({
 		logger: deps.logger,
 		emitMotion: (deviceId, detected, timestamp) => {
@@ -48944,6 +48747,7 @@ function wireOrchestratorSubscriptions(deps) {
 		unsubSessionMotion();
 		unsubFrameTracked();
 		unsubMotionAnalysis();
+		unsubAudioWatchdog();
 		unsubDeviceActivity();
 	};
 }
@@ -50054,7 +49858,7 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 				nodeId
 			}, { timeoutMs: PipelineSettingsStore.EXECUTOR_RECONCILE_ROUND_MS }).then(() => true, () => false);
 			if (this.disposed) break;
-			if (readyPerRegistry) await sleep$1(PipelineSettingsStore.EXECUTOR_READY_PROBE_PACE_MS);
+			if (readyPerRegistry) await sleep(PipelineSettingsStore.EXECUTOR_READY_PROBE_PACE_MS);
 		}
 		return null;
 	}
@@ -50082,13 +49886,13 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 			let agent = (await this.readAgentSettingsMap())[nodeId];
 			if (!agent) {
 				if (!await this.seedAgentSettingsFromCatalog(nodeId)) {
-					await sleep$1(2e3);
+					await sleep(2e3);
 					continue;
 				}
 				agent = (await this.readAgentSettingsMap())[nodeId];
 			}
 			if (!agent) {
-				await sleep$1(2e3);
+				await sleep(2e3);
 				continue;
 			}
 			return {
@@ -53113,7 +52917,6 @@ async function buildOrchestratorControllers(deps) {
 		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger,
 		readDeviceStore: async (deviceId) => await deps.ctxIfReady()?.settings?.readDeviceStore(deviceId) ?? {},
-		watchdogNote: (deviceId, stage) => pipelineWatchdog?.noteSignal(deviceId, stage),
 		probeAudioTrack: (deviceId, camStreamId) => resolveAudioTrackProbe(deviceId, camStreamId),
 		ingestNode: () => topology.clusterRoles.ingestNode,
 		localNodeId: () => localNodeId,