@camstack/addon-pipeline-orchestrator 1.2.230 → 1.2.232

package/dist/index.js

@@ -5391,7 +5391,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CiR4z7r9.mjs
+//#region ../types/dist/sleep-CaB_hL5g.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7984,6 +7984,8 @@ var EVENT_OWNER_TYPES = [
 * nothing failing until a caller asked.
 */
 var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
@@ -22161,7 +22163,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	ownerType: EventOwnerTypeSchema,
 	eventId: number().int(),
 	deviceId: number()
-}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	deviceId: number(),
+	ownerKind: MediaPresenceOwnerKindSchema,
+	ownerIds: array(string()).max(5e3)
+}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -24359,10 +24365,9 @@ var ServerBootModeSchema = _enum([
 *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
 *  - `pending-restart` — a version is staged and the node has NOT yet
 *    restarted onto it (still running the OLD version).
-*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
-*    (it is the active probation boot) and is waiting to confirm boot-health.
-*    Apply/rollback are refused in this state and the node must NOT be
-*    manually restarted, or the probation boot auto-rolls-back.
+*  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+*    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+*    no provider emits it.
 */
 var ServerUpdateStateSchema = _enum([
 	"idle",
@@ -24451,12 +24456,35 @@ var ServerRollbackInfoSchema = object({
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
-	/** Version of the code the running process ACTUALLY loaded. */
+	/**
+	* Version of the code THIS PROCESS loaded — captured once, at boot, from the
+	* package.json of the copy the code was loaded from, and never re-read. A
+	* copy replaced on disk under a live process must not move this number;
+	* that divergence is what `installedVersion` is for. Before 2026-09-20 this
+	* was a lazy disk read that would have followed such a swap silently.
+	*/
 	runningVersion: string().nullable(),
 	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
 	nodeRuntimeVersion: string().nullable(),
 	/** Active data-dir root version; null when booted from seed/workspace. */
 	activeVersion: string().nullable(),
+	/**
+	* Version of the root package in the data-root `current/` copy RIGHT NOW —
+	* what the next boot would load if nothing is staged. Normally equal to
+	* `runningVersion`; differs only when the copy on disk changed under the
+	* live process. `null` when there is no data-root copy (baked seed or
+	* workspace boot). Optional for version skew: an older provider omits it.
+	*/
+	installedVersion: string().nullable().optional(),
+	/**
+	* True when the code that would run after a restart is NOT the code running
+	* now: a version is staged (`pendingVersion`), or `installedVersion` differs
+	* from `runningVersion`. Derived on every read, never stored. This is the
+	* one field that lets an operator or a script say "1.2.353 is installed and
+	* will run after a restart" instead of reading it off a number that means
+	* "installed". Optional for version skew.
+	*/
+	restartRequired: boolean().optional(),
 	/** N-1 version kept for rollback; null when no previous version exists. */
 	previousVersion: string().nullable(),
 	/** Version of the immutable baked seed closure (image fallback). */
@@ -24491,19 +24519,71 @@ var ServerPackageStatusSchema = object({
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
+	/** Same meaning as on the status payload: what THIS process loaded. */
 	runningVersion: string().nullable(),
 	latestVersion: string().nullable(),
+	/**
+	* `latestVersion` is newer than `runningVersion` AND is not the version
+	* already staged on this node. A staged-and-waiting version is not "an
+	* update available" — applying it again is refused (`already-staged`), and
+	* a button that announced "updating…" on this boolean then got refused
+	* would be lying. It is reported through `pendingVersion` instead.
+	*/
 	updateAvailable: boolean(),
 	checkedAtMs: number(),
 	/** Non-null when the registry lookup failed (offline, bad registry, …). */
-	error: string().nullable()
+	error: string().nullable(),
+	/**
+	* Version staged on this node and awaiting its restart, when one is. Before
+	* 2026-09-20 a check answered `{runningVersion, updateAvailable:false}` for a
+	* node whose staged closure had never booted, and the caller had no way to
+	* see the difference. Optional for version skew.
+	*/
+	pendingVersion: string().nullable().optional(),
+	/** See the status payload: staged, or installed-on-disk ≠ running. Optional for skew. */
+	restartRequired: boolean().optional()
 });
+/**
+* What an action DID — the discriminant `accepted` cannot carry. Before
+* 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+* where nothing was wrong (already current, already staged) and for a staging
+* install that died on `npm error code ECONNRESET`; the only difference was
+* prose in `message`, and an operator restarted a container on the strength of
+* it, booting the previous version.
+*
+*  - `staged`            — the closure is installed and validated; the node
+*                          restarts to apply it (`restarting:true`). NOTHING
+*                          runs the new code until that restart completes.
+*  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+*  - `already-current`   — the target IS the running version; nothing done.
+*  - `refused`           — dropped by a gate; `reason` names which.
+*  - `failed`            — attempted and did not land; `error` says why.
+*/
+var ServerUpdateOutcomeSchema = _enum([
+	"staged",
+	"restart-scheduled",
+	"already-current",
+	"refused",
+	"failed"
+]);
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
 	/** True when a graceful restart was scheduled to apply the change. */
 	restarting: boolean(),
-	message: string()
+	message: string(),
+	/** See {@link ServerUpdateOutcomeSchema}. Optional for version skew. */
+	outcome: ServerUpdateOutcomeSchema.optional(),
+	/**
+	* Stable, greppable cause for `refused` / `failed` (the engine's
+	* `UpdateRefusalReason`, `staging-failed`, …). `null` on success.
+	*/
+	reason: string().nullable().optional(),
+	/**
+	* The failure itself, verbatim enough to act on (the npm output for a
+	* staging install). Non-null only for `failed`.
+	*/
+	error: string().nullable().optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
@@ -25612,6 +25692,18 @@ method(VectorDeclareIndexInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
+_enum([
+	"queue-full",
+	"camera-backoff",
+	"sleeping",
+	"camera-refused",
+	"no-keyframe",
+	"no-catalog-row",
+	"unsupported",
+	"unknown-device",
+	"uid-missing"
+]);
+_enum(["deferred", "final"]);
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -25686,29 +25778,243 @@ var ClipSchema = object({
 	holes: array(object({
 		startMs: number(),
 		endMs: number()
-	})).optional()
+	})).optional(),
+	/**
+	* A URL that MAY produce this clip's still, asked only for rows actually on
+	* screen. The opposite of {@link ClipSchema.thumbnail}: that one is VOUCHED
+	* (a JPEG is already on disk), this one is an offer. The route answers 200
+	* with the image, or 204 with `x-camstack-reason` when it could not mint one
+	* — a surface latches that refusal to the instant rather than retrying.
+	*
+	* Never both: a clip with a vouched `thumbnail` needs no mint.
+	*/
+	thumbnailMint: string().optional(),
+	/**
+	* Why no still will be produced for this clip RIGHT NOW — set when the
+	* provider already knows, so the surface draws the glyph and the reason
+	* instead of firing a mint that cannot succeed.
+	*
+	* `sleeping` — a standalone battery camera; a read would be a wake (D549 4).
+	* `camera-refused` — the camera answered the CoverPreview with a refusal.
+	* `no-keyframe` — the window holds no decodable I-frame (an event that sits
+	*   inside no file is the measured case).
+	* `unsupported` — this source cannot mint stills at all.
+	*/
+	thumbnailUnavailable: object({ reason: _enum([
+		"sleeping",
+		"camera-refused",
+		"no-keyframe",
+		"unsupported"
+	]) }).optional(),
+	/**
+	* When the catalog this row came from was last CONFIRMED against the device.
+	* Absent means "this row was read live". A persisted catalog served while a
+	* camera sleeps carries the age it really has — a cached list is never drawn
+	* as current (D549 13).
+	*/
+	catalogAsOf: number().optional(),
+	/**
+	* The camera's OWN type strings for this clip, all of them, unmapped
+	* (`md`, `people`, `dog_cat`, `sched`, …). Kept beside {@link labels}
+	* because a firmware inventing a type must not vanish: the mapping into our
+	* filter vocabulary is lossy on purpose and this is the lossless copy
+	* (D549 20).
+	*/
+	nativeTypes: array(string()).optional(),
+	/**
+	* What the subject DID — `crossline`, `intrude`, `loitering`. A behaviour
+	* travels BESIDE a class, never instead of one, and the class filter ignores
+	* it: "a person crossed a line" is still a person (D549 20).
+	*/
+	behaviours: array(string()).optional(),
+	/**
+	* The same recording as two files — the sub twin (what the row and its
+	* thumbnail are) and its main twin, matched at listing time so a quality
+	* change never re-searches the camera (D549 15). `getClipPlayback`'s
+	* `profile` picks between them: `low | mid` → sub, `high` → main.
+	*/
+	streams: object({
+		sub: object({
+			id: string(),
+			bytes: number().optional()
+		}).optional(),
+		main: object({
+			id: string(),
+			bytes: number().optional()
+		}).optional()
+	}).optional(),
+	/** The camera says it holds a sub-stream copy of this recording. */
+	supportSub: boolean().optional(),
+	/**
+	* Whether this row has bytes behind it. ABSENT means yes — every clip that
+	* IS a file is playable, and only a source that lists EVENTS can produce a
+	* row with nothing to play (the measured case: 1 of 29 hub events on 3628
+	* fell inside no file). Such a row is shown, never dropped and never offered
+	* as playable-then-failing (D549 19).
+	*/
+	playable: boolean().optional(),
+	/** Why {@link playable} is false, verbatim (`no-file-for-window`). */
+	unplayableReason: string().optional(),
+	/**
+	* This clip is STILL BEING WRITTEN, so {@link ClipSchema.timeRange}`.endMs`
+	* is not its end.
+	*
+	* Absent — the common case — means the row is closed and its `endMs` is the
+	* end of the recording. Present and `true` means the source told us the file
+	* has no end yet, and the `endMs` we carry is whatever the camera's index
+	* entry happened to hold: on a Reolink E1 Outdoor PoE (592, measured
+	* 2026-09-20) the newest file `…_192927_000000_…_0.mp4` reported an `endTime`
+	* of 19:29:56 and STILL reported it eight minutes later, while the file went
+	* on growing. A surface that drew 29 s there was lying about a clip that
+	* plays for minutes, on the one row the operator looks at first.
+	*
+	* `endMs` is deliberately still a number: it is the best bound anything has
+	* for a mint window or a byte fetch, and every consumer already requires it.
+	* This flag says what it is WORTH, and a duration is not drawn from it.
+	*/
+	inProgress: boolean().optional()
 });
 var ClipPlaybackSchema = object({
-	/** HLS master URL through the hub data-plane (Range + token in path). */
+	/**
+	* A media URL through the hub data-plane. {@link ClipPlaybackSchema.format}
+	* says what kind — an HLS master playlist for a recording-derived clip, a
+	* progressive MP4 for a native file the vendor addon muxed and serves with
+	* `Range`. The URL is NOT a credential: both planes are registered
+	* `access: 'authenticated'` and the hub's `/addon/<id>/<prefix>` proxy takes
+	* the session cookie, so nothing is appended to it (D549 22).
+	*/
 	playbackUrl: string(),
+	/**
+	* How to play {@link playbackUrl}. Absent means `hls` — the shape every
+	* existing consumer already assumes. A player that branches on this is the
+	* one change a native clip needs; a player that ignores it will hand an MP4
+	* to hls.js and fail parsing it as a manifest.
+	*/
+	format: _enum(["hls", "mp4"]).optional(),
+	/**
+	* Which twin was actually served. A clip that holds only one stream answers
+	* with the one it has, and the surface SAYS so — a missing main twin is
+	* never served silently as if it were the asked-for quality (D549 15).
+	*/
+	served: CamProfileSchema.optional(),
 	/** Optional LAN/remote alternates for the same clip. */
 	playbackEndpoints: array(string()).optional(),
 	token: string().optional()
 });
+/**
+* Why a source cannot answer right now — per SOURCE, never fleet-wide.
+*
+* `ok` is the only state whose clip list may be read as complete. The other
+* three exist because an empty list from a sleeping camera reads as "this
+* camera has no recordings", which is the defect this whole line of work is
+* about: a battery camera nobody woke (`sleeping`), a camera that could not be
+* reached at all (`unreachable`, also what a provider that THREW reports), a
+* camera whose SD card is not mounted (`no-storage`, measured on 640 —
+* `HddInfo mount 0`, honestly nothing to list rather than "no clips"), and a
+* camera whose OWN index disagrees with its OWN calendar (`index-empty`,
+* measured on 618: the calendar marks 3–20 September, days 6–20 list zero
+* files on both streams and both filters, with 177 GB free). That last one is
+* a defect ON THE CAMERA, and the only honest thing a provider can do is say
+* which days it asked for and got nothing — "no clips" would be a lie about a
+* card that is full of them.
+*/
+var ClipSourceAvailabilitySchema = object({
+	state: _enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: string().optional(),
+	/** When this source's catalog was last CONFIRMED. A cached list is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. */
+	catalogAsOf: number().optional()
+});
+/**
+* One SOURCE of clips for a camera — a row of the picker, and the namespace
+* every clip id from it is prefixed with (`analytics`,
+* `native:reolink:onboard`, `hksv`, …).
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business.
+*/
+var ClipSourceSchema = object({
+	/** The value this source stamps on {@link ClipSchema.source}, and the prefix
+	*  of every clip id it mints. `getClipPlayback` routes on it. */
+	source: string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: string(),
+	/**
+	* The addon that SERVES this row.
+	*
+	* A surface cannot otherwise resolve a source to who answers it, and the
+	* alternative — a `native:reolink:* → provider-reolink` table inside the
+	* widget — is a second authority on provider identity living in the one
+	* package with no business knowing it, wrong the day a third source appears
+	* (D557). One addon may serve SEVERAL sources, which is why the per-device
+	* switch is keyed by SOURCE and not by this (D555) — `addon-provider-reolink`
+	* served a hub child two of them until the two views were measured to be one
+	* store read twice (D555) and then read ONE way (D565).
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in.
+	*/
+	addonId: string().optional(),
+	availability: ClipSourceAvailabilitySchema
+});
 DeviceType.Camera, method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/**
+	* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+	* carries, never a source id and never a list.
+	*
+	* Absent means the device's BOUND provider, which is CamStack on every
+	* camera today because that is what `deviceManager.getBindings`
+	* answers with. A provider the device is not bound to is refused by
+	* name rather than answered by another one (D552's
+	* `rejectUnresolvedAddonPin` rule).
+	*
+	* It replaced `sources?: string[]`, a VIEW filter over source ids that
+	* assumed the answer was a fan-out over everything a camera has. The
+	* operator settled otherwise on 2026-09-20 — *"il get videoclips
+	* prendere un provider opzionale, di default va su camstack"*,
+	* *"l'utilizzatore è uno solo"* — so the list is asked of one provider
+	* at a time and there is nothing to filter out of it.
+	*/
+	provider: string().optional()
 }), array(ClipSchema).readonly(), {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
+}), method(object({ deviceId: number() }), array(ClipSourceSchema).readonly(), {
+	kind: "query",
+	auth: "protected"
 }), method(object({
 	deviceId: number(),
-	clipId: string()
+	clipId: string(),
+	/**
+	* Which twin to serve, on the ONE quality scale the system already has
+	* (`CamProfileSchema`). `low | mid` → the sub file, `high` → the main
+	* twin; both ids are already on the row so this never re-searches the
+	* camera. Absent means the provider's own default (the sub file, which
+	* every source is measured to hold).
+	*
+	* `auto` is deliberately NOT accepted here: a stored file has no
+	* broker session, so the adaptive tier cannot be resolved for it. The
+	* viewer resolves `auto` to a profile the same way live does, before
+	* it calls (D549 15).
+	*/
+	profile: CamProfileSchema.optional()
 }), ClipPlaybackSchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Optional client-side hints sent at session creation to help the provider
@@ -37201,6 +37507,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.ownersWithMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.pauseForStorageMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39793,6 +40105,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.listSources": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"viewerUi.getStaticDir": {
 		capName: "viewer-ui",
 		capScope: "system",
@@ -41095,6 +41413,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.ownersWithMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.proposeRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -41801,6 +42124,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"waterHeater.setAway": [{
 		name: "deviceId",
 		form: "single",
@@ -53035,6 +53363,289 @@ var RepeatWarnSampler = class {
 	}
 };
 //#endregion
+//#region src/occupancy-recheck-controller.ts
+/**
+* How long a recheck registration lives once the burst was accepted. The
+* runner settles a burst at `OCCUPANCY_BURST_SAFETY_TIMEOUT_MS` (8 s) after
+* the dial; the dial itself is bounded by the decode-spawn gate. 15 s covers
+* both on this fleet and is short enough that a camera is never held for a
+* meaningful share of its 300 s cadence.
+*/
+var RECHECK_BURST_WINDOW_MS = 15e3;
+/** The `reason` every orchestrator recheck carries into the runner's log. */
+var RECHECK_REASON = "orchestrator-recheck";
+/** A found burst resets the streak; two consecutive empty ones disarm. */
+function foldBurstOutcome(streak, found) {
+	if (found) return {
+		emptyStreak: 0,
+		armed: true
+	};
+	const emptyStreak = streak.emptyStreak + 1;
+	return {
+		emptyStreak,
+		armed: emptyStreak < 2
+	};
+}
+/**
+* The registration a recheck rides on, derived from the SESSION config so the
+* stream, steps, zones and root detector are the camera's own.
+*/
+function buildRecheckAttachConfig(session) {
+	return {
+		...session,
+		detectionMode: "on-motion",
+		motionSources: [],
+		audioMode: "disabled",
+		occupancyRecheckEnabled: false,
+		preRollInferenceEnabled: false
+	};
+}
+var OccupancyRecheckController = class {
+	deps;
+	devices = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* A session was dispatched: remember where and with what, cancel any pending
+	* tick (the session sees the scene itself), and supersede a burst in flight
+	* on the same node — the session attach replaced its registration.
+	*/
+	noteSessionDispatched(deviceId, nodeId, config) {
+		const state = this.stateFor(deviceId, nodeId, config);
+		state.lastNodeId = nodeId;
+		state.lastConfig = config;
+		if (state.burst !== null && state.burst.nodeId === nodeId) {
+			state.burst.superseded = true;
+			this.deps.logger.debug("occupancy recheck: burst superseded by a session on the same node", {
+				tags: {
+					deviceId,
+					nodeId
+				},
+				meta: {
+					deviceId,
+					nodeId
+				}
+			});
+		}
+	}
+	/** A session closed: arm the cadence iff it saw a subject and the camera
+	*  has the recheck enabled. Re-evaluated from scratch on every close. */
+	noteSessionClosed(deviceId, close) {
+		const state = this.devices.get(deviceId);
+		if (state === void 0) return;
+		const cfg = state.lastConfig;
+		const enabled = cfg.occupancyRecheckEnabled === true && (cfg.occupancyRecheckSec ?? 0) > 0;
+		if (close.sawSubject) state.emptyStreak = 0;
+		state.armed = state.armed || enabled && close.sawSubject;
+		if (!state.armed) {
+			this.deps.logger.debug("occupancy recheck: not armed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					enabled,
+					sawSubject: close.sawSubject
+				}
+			});
+			return;
+		}
+		if (state.timer === null) this.schedule(deviceId, state);
+	}
+	/** Every inference result the orchestrator sees; a burst result with
+	*  detections is what makes a burst "found". */
+	noteInferenceResult(deviceId, occasion, detectionCount) {
+		const state = this.devices.get(deviceId);
+		if (state === void 0 || state.burst === null) return;
+		if (occasion === "burst" && detectionCount > 0) state.burst.found = true;
+	}
+	/** The device left the orchestrator's knowledge. */
+	forget(deviceId) {
+		const state = this.devices.get(deviceId);
+		if (state === void 0) return;
+		this.cancelTimer(state);
+		this.devices.delete(deviceId);
+	}
+	shutdown() {
+		for (const state of this.devices.values()) this.cancelTimer(state);
+		this.devices.clear();
+	}
+	stateFor(deviceId, nodeId, config) {
+		let state = this.devices.get(deviceId);
+		if (state === void 0) {
+			state = {
+				lastNodeId: nodeId,
+				lastConfig: config,
+				armed: false,
+				emptyStreak: 0,
+				timer: null,
+				burst: null
+			};
+			this.devices.set(deviceId, state);
+		}
+		return state;
+	}
+	cancelTimer(state) {
+		if (state.timer !== null) {
+			clearTimeout(state.timer);
+			state.timer = null;
+		}
+	}
+	schedule(deviceId, state) {
+		this.cancelTimer(state);
+		const delayMs = (state.lastConfig.occupancyRecheckSec ?? 0) * 1e3;
+		const timer = setTimeout(() => {
+			state.timer = null;
+			this.tick(deviceId).catch((err) => {
+				this.deps.logger.warn("occupancy recheck: tick failed", {
+					tags: { deviceId },
+					meta: {
+						deviceId,
+						error: errMsg$1(err)
+					}
+				});
+			});
+		}, delayMs);
+		timer.unref?.();
+		state.timer = timer;
+	}
+	async tick(deviceId) {
+		const state = this.devices.get(deviceId);
+		if (state === void 0 || !state.armed) return;
+		if (this.deps.isSessionActive(deviceId)) {
+			this.deps.logger.debug("occupancy recheck: skipped — a session is active", {
+				tags: { deviceId },
+				meta: { deviceId }
+			});
+			this.schedule(deviceId, state);
+			return;
+		}
+		if (state.burst !== null) {
+			this.schedule(deviceId, state);
+			return;
+		}
+		const nodeId = state.lastNodeId;
+		const config = buildRecheckAttachConfig(state.lastConfig);
+		const frames = Math.max(1, state.lastConfig.occupancyRecheckFrames ?? 4);
+		const burst = {
+			nodeId,
+			superseded: false,
+			found: false
+		};
+		state.burst = burst;
+		try {
+			await this.deps.attachOn(nodeId, config);
+		} catch (err) {
+			state.burst = null;
+			this.deps.logger.warn("occupancy recheck: attach failed — retried next tick", {
+				tags: {
+					deviceId,
+					nodeId
+				},
+				meta: {
+					deviceId,
+					nodeId,
+					error: errMsg$1(err)
+				}
+			});
+			this.schedule(deviceId, state);
+			return;
+		}
+		const answer = await this.deps.requestBurstOn(nodeId, deviceId, frames, RECHECK_REASON).catch((err) => ({
+			started: false,
+			error: errMsg$1(err)
+		}));
+		if (!answer.started) {
+			const refusedBecause = "refusedBecause" in answer ? answer.refusedBecause : void 0;
+			const error = "error" in answer ? answer.error : void 0;
+			await this.release(deviceId, state, burst);
+			const asleep = refusedBecause === "battery-asleep";
+			if (asleep) state.armed = false;
+			this.deps.logger.info("occupancy recheck: burst refused", {
+				tags: {
+					deviceId,
+					nodeId
+				},
+				meta: {
+					deviceId,
+					nodeId,
+					refusedBecause: refusedBecause ?? null,
+					error: error ?? null,
+					rearmed: !asleep
+				}
+			});
+			if (!asleep) this.schedule(deviceId, state);
+			return;
+		}
+		this.deps.logger.info("occupancy recheck: burst dispatched", {
+			tags: {
+				deviceId,
+				nodeId
+			},
+			meta: {
+				deviceId,
+				nodeId,
+				frames,
+				recheckSec: state.lastConfig.occupancyRecheckSec ?? null
+			}
+		});
+		setTimeout(() => {
+			this.settle(deviceId, state, burst).catch((err) => {
+				this.deps.logger.warn("occupancy recheck: settle failed", {
+					tags: {
+						deviceId,
+						nodeId
+					},
+					meta: {
+						deviceId,
+						nodeId,
+						error: errMsg$1(err)
+					}
+				});
+			});
+		}, RECHECK_BURST_WINDOW_MS).unref?.();
+	}
+	async settle(deviceId, state, burst) {
+		await this.release(deviceId, state, burst);
+		const fold = foldBurstOutcome({ emptyStreak: state.emptyStreak }, burst.found);
+		state.emptyStreak = fold.emptyStreak;
+		state.armed = fold.armed;
+		this.deps.logger.info("occupancy recheck: burst complete", {
+			tags: {
+				deviceId,
+				nodeId: burst.nodeId
+			},
+			meta: {
+				deviceId,
+				nodeId: burst.nodeId,
+				found: burst.found,
+				emptyStreak: fold.emptyStreak,
+				armed: fold.armed,
+				superseded: burst.superseded
+			}
+		});
+		if (state.armed && !this.deps.isSessionActive(deviceId)) this.schedule(deviceId, state);
+		else if (state.armed) state.armed = false;
+	}
+	/** Detach the recheck registration unless a session took it over. */
+	async release(deviceId, state, burst) {
+		if (state.burst === burst) state.burst = null;
+		if (burst.superseded) return;
+		await this.deps.detachOn(burst.nodeId, deviceId).catch((err) => {
+			this.deps.logger.warn("occupancy recheck: detach failed", {
+				tags: {
+					deviceId,
+					nodeId: burst.nodeId
+				},
+				meta: {
+					deviceId,
+					nodeId: burst.nodeId,
+					error: errMsg$1(err)
+				}
+			});
+		});
+	}
+};
+//#endregion
 //#region src/balancer-input-cache.ts
 /**
 * Short-TTL memo for the reads a session dispatch needs BEFORE it can choose a
@@ -53461,8 +54072,32 @@ var SessionDispatchController = class {
 	inferenceDeviceCaps = new TtlMemo({ load: (nodeId) => this.deps.getInferenceDeviceCaps(nodeId) });
 	/** Background refresher for {@link agentLoads} et al. Null until first use. */
 	balancerRefreshTimer = null;
+	/**
+	* The occupancy recheck for session-dispatched cameras (D547). The runner's
+	* own recheck lives on an `on-motion` registration no camera receives; this
+	* one is armed by the session close, which only this controller sees.
+	*/
+	recheck;
 	constructor(deps) {
 		this.deps = deps;
+		const requestBurstOn = deps.requestBurstOn;
+		if (requestBurstOn === void 0) {
+			this.recheck = null;
+			deps.logger.info("occupancy recheck has no burst producer on this build — no session-dispatched camera will be re-sampled", { meta: { why: "SessionDispatchControllerDeps.requestBurstOn absent" } });
+		} else this.recheck = new OccupancyRecheckController({
+			attachOn: (nodeId, config) => deps.attachOn(nodeId, config),
+			detachOn: (nodeId, deviceId) => deps.detachOn(nodeId, deviceId),
+			requestBurstOn,
+			isSessionActive: (deviceId) => this.sessionRegistry.has(deviceId),
+			logger: deps.logger
+		});
+	}
+	/**
+	* Every inference result the orchestrator sees, for the recheck's
+	* found/empty verdict: a `'burst'` result with detections is a found burst.
+	*/
+	noteInferenceResult(deviceId, occasion, detectionCount) {
+		this.recheck?.noteInferenceResult(deviceId, occasion, detectionCount);
 	}
 	/**
 	* Placement changed — this controller just attached or detached something, so
@@ -53855,6 +54490,7 @@ var SessionDispatchController = class {
 			attachedAt = Date.now();
 			this.deps.recordAssignment(deviceId, targetNodeId, decision.reason, decision.reason === "manual");
 			this.sessionRegistry.register(deviceId, targetNodeId, Date.now(), deviceKey);
+			this.recheck?.noteSessionDispatched(deviceId, targetNodeId, sessionConfig);
 			log.info("detection session: dispatched on motion", {
 				tags: {
 					deviceId,
@@ -54031,6 +54667,7 @@ var SessionDispatchController = class {
 		this.activeRefireCountByDevice.delete(deviceId);
 		this.notePlacementChanged();
 		const { openForMs, sinceSubjectSeenMs, maxHoldMs } = observed;
+		this.recheck?.noteSessionClosed(deviceId, { sawSubject: sinceSubjectSeenMs !== null });
 		const subjectPresent = sinceSubjectSeenMs !== null && sinceSubjectSeenMs < 4e3;
 		const meta = {
 			reason,
@@ -54112,6 +54749,7 @@ var SessionDispatchController = class {
 			}
 			this.deps.dropActiveDetection(deviceId);
 			this.lastSubjectSeenAt.delete(deviceId);
+			this.recheck?.forget(deviceId);
 		});
 		const watchNodeId = this.motionWatchByDevice.get(deviceId);
 		if (watchNodeId) {
@@ -54147,6 +54785,7 @@ var SessionDispatchController = class {
 	*/
 	shutdown() {
 		this.shuttingDown = true;
+		this.recheck?.shutdown();
 		this.sessionRegistry.clear();
 		this.motionWatchByDevice.clear();
 		this.lastSubjectSeenAt.clear();
@@ -55141,6 +55780,11 @@ async function buildOrchestratorControllers(deps) {
 		settingsStore,
 		attachOn: (nodeId, config) => deps.attachOn(nodeId, config),
 		detachOn: (nodeId, deviceId) => deps.detachOn(nodeId, deviceId),
+		requestBurstOn: async (nodeId, deviceId, frames, reason) => deps.ctx().api.pipelineRunner.requestOccupancyBurst.mutate({
+			deviceId,
+			frames,
+			reason
+		}, nodePin(nodeId)),
 		recordAssignment: (deviceId, agentNodeId, reason, pinned) => ledger.recordAssignment(deviceId, agentNodeId, reason, pinned),
 		dropAssignment: (deviceId, emit) => ledger.dropAssignment(deviceId, emit),
 		reconcilePlacementFromRunners: () => reconcile.reconcilePlacementFromRunners(),
@@ -55445,7 +56089,10 @@ async function buildOrchestratorControllers(deps) {
 		handleDeviceUnregistered: (deviceId) => deps.handleDeviceUnregistered(deviceId),
 		handleSettingsChanged: (deviceId) => deps.handleSettingsChanged(deviceId),
 		handlePipelineCameraUpdated: (deviceId, config) => deps.handlePipelineCameraUpdated(deviceId, config),
-		handleInferenceResult: (payload) => deps.handleInferenceResult(payload),
+		handleInferenceResult: (payload) => {
+			session.noteInferenceResult(payload.deviceId, payload.occasion, payload.frame.detections?.length ?? 0);
+			return deps.handleInferenceResult(payload);
+		},
 		noteMetrics: (deviceId, nodeId, metrics) => {
 			loadShed.noteMetrics(deviceId, nodeId, metrics);
 			nodeStress.noteMetrics(deviceId, nodeId, metrics);