@camstack/addon-pipeline-orchestrator 1.2.257 → 1.2.258

package/dist/index.mjs

@@ -5363,7 +5363,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BaRu0bS5.mjs
+//#region ../types/dist/sleep-BXv0ZcRa.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6164,6 +6164,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -10291,6 +10325,43 @@ var LogChannelWindowSchema = object({
 	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
 	deviceIds: array(number().int()).readonly().nullable()
 });
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10494,7 +10565,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -14769,6 +14847,13 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -15294,16 +15379,101 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+_enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
 method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({
+	text: string(),
+	modelId: string().min(1).optional()
+}), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" }), method(object({ modelId: string().min(1).optional() }), object({
+	cleared: array(string()),
+	nodeId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
@@ -18709,7 +18879,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -20087,6 +20262,163 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* Store identity of the cluster row inside `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings — the same owner, and for the same reason, as the
+* detail-crop convention: hub-resident and neutral between the addons that
+* read it.
+*/
+var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -20902,7 +21234,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -21454,7 +21787,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -21589,7 +21938,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -21602,7 +21985,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -21636,7 +22024,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -21957,7 +22349,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	deviceId: number(),
 	ownerKind: MediaPresenceOwnerKindSchema,
 	ownerIds: array(string()).max(5e3)
-}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -23228,6 +23620,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -23239,7 +23642,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -24315,6 +24727,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -24411,9 +24845,19 @@ var pipelineOrchestratorCapability = {
 		* Trigger a full rebalance pass. Iterates over all assigned cameras,
 		* recomputes the optimal agent for each one based on current load +
 		* hardware affinity, and migrates cameras whose current agent is no
-		* longer optimal. Pinned cameras are never migrated.
+		* longer optimal. Pinned cameras are never migrated. `skipped` names the
+		* cameras the pass wanted to move and could not, with why — a target node
+		* that has not answered its catalog / device health yet, or a device that
+		* cannot run the camera's root (D650).
 		*/
-		rebalance: method(_void(), object({ migrated: number() }), {
+		rebalance: method(_void(), object({
+			migrated: number(),
+			skipped: array(object({
+				deviceId: number(),
+				targetNodeId: string(),
+				reason: string()
+			})).default([])
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -24423,6 +24867,13 @@ var pipelineOrchestratorCapability = {
 		getPipelineAssignment: method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()),
 		/** Get per-agent load summaries used by the load balancer + dashboards. */
 		getAgentLoad: method(_void(), array(AgentLoadSummarySchema).readonly()),
+		/**
+		* The operator's STORED model choice for one cluster-scoped step (D651).
+		* Read three-way from this addon's own store, only once its boot has
+		* settled. Unlike `addonSettings.getGlobalSettings`, it never answers a
+		* default as though someone chose it.
+		*/
+		getClusterModelChoice: method(object({ stepId: string() }), ClusterModelChoiceSchema),
 		/** Aggregate global metrics across the whole detection cluster. */
 		getGlobalMetrics: method(_void(), GlobalMetricsSchema),
 		/**
@@ -26975,6 +27426,167 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
+DeviceType.Button, DeviceType.Camera;
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema)
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -28763,17 +29375,6 @@ object({
 	deviceId: number(),
 	status: DeviceStatusSchema
 });
-object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-object({
-	deviceId: number(),
-	timestamp: number()
-});
-DeviceType.Button, DeviceType.Camera;
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -35626,42 +36227,6 @@ var zoneRulesCapability = {
 	durability: "restored"
 };
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -38489,6 +39054,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -39239,6 +39828,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -41573,6 +42168,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -44398,6 +44999,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -46858,135 +47479,6 @@ TimelapseRuleInputSchema.extend({
 	updatedAt: number()
 });
 /**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* Store identity of the cluster row inside `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings — the same owner, and for the same reason, as the
-* detail-crop convention: hub-resident and neutral between the addons that
-* read it.
-*/
-var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-string().min(1);
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
-/**
 * THE detail-crop convention — the single derivation of the rectangle a
 * detail/enrichment step (clip-embedding, face-detection, plate-detection…)
 * is fed.
@@ -47330,6 +47822,63 @@ function deviceBackendToFormat(backend) {
 	return DEVICE_BACKEND_TO_FORMAT[backend] ?? "onnx";
 }
 //#endregion
+//#region src/cluster-model-choice.ts
+/**
+* The owner's answer to "which model did the operator choose for this
+* cluster-scoped step?" (D651 fix round 3).
+*
+* The orchestrator owns `clusterModel:*`: it renders the form and stores the
+* row. A consumer that REWRITES an index on this answer (the face re-embed,
+* the CLIP rebuild) must not read the orchestrator's private store layout,
+* and must not read its hydrated settings view either — that answers
+* `value ?? default`, so a default nobody chose and a failed read both look
+* like a choice. So the owner answers, from a three-way read of its own store.
+*
+* The stored VALUE is read with the runtime's own interpretation
+* (`interpretStoredClusterModel`, fix round 4): a cleared field (`null`, `''`)
+* is absent, any non-empty string is the choice — verbatim, as the runner pins
+* it — and only a non-string is `invalid-stored`. Checking the id against the
+* dropdown here would give one stored key two meanings: the runner deliberately
+* pins an id the catalog does not list (a custom encoder), so an owner that
+* called it invalid would refuse a pass on the very model the fleet is running.
+*/
+/**
+* Turn a three-way read of `clusterModel:<stepId>` into the cap answer.
+* `'owner-not-ready'` is the caller's statement that its boot has not settled.
+*/
+function decideClusterModelChoice(stepId, read) {
+	const step = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
+	if (step === void 0) return {
+		kind: "unreadable",
+		reason: "not-cluster-scoped"
+	};
+	if (read === "owner-not-ready") return {
+		kind: "unreadable",
+		reason: "owner-not-ready"
+	};
+	if (read.kind === "unreadable") return read.error !== void 0 ? {
+		kind: "unreadable",
+		reason: read.reason,
+		error: read.error
+	} : {
+		kind: "unreadable",
+		reason: read.reason
+	};
+	const stored = interpretStoredClusterModel(read.kind === "absent" ? void 0 : read.value);
+	if (stored.kind === "absent") return {
+		kind: "absent",
+		defaultModelId: step.defaultModelId
+	};
+	if (stored.kind === "chosen") return {
+		kind: "stored",
+		modelId: stored.modelId
+	};
+	return {
+		kind: "unreadable",
+		reason: "invalid-stored"
+	};
+}
+//#endregion
 //#region src/audio-load-balancer.ts
 function balanceAudio(input) {
 	if (input.nodes.length === 0) return null;
@@ -48238,6 +48787,354 @@ function createDiskReconcileJobRunner(now = Date.now) {
 	};
 }
 //#endregion
+//#region src/pipeline-resolver.ts
+/**
+* The `package-detection` root step id. Zone-driven activation
+* ({@link applyPackageZoneActivation}) is keyed on it — the step has NO
+* user-facing toggle; a drawn package zone is the sole enable signal.
+*/
+var PACKAGE_DETECTION_STEP_ID = "package-detection";
+/**
+* The CAMERA ROOT: the always-on object-detection step every session's tracks
+* originate from. The ONE definition behind two gates that must agree (D650
+* round 4): the device election's root guard (`makeRootCapabilityGuard`)
+* excludes a device whose format cannot run it, and the attach backstop
+* (`ResolvedPipeline.droppedRoots`) refuses an attach that lost it. Any other
+* gated-on root the elected device cannot run (`segmentation`, an opt-in
+* refiner) is a logged skip, never a refusal: the election does not look at
+* it, so refusing on it left a camera pending forever.
+*
+* Mirrors the addon-pipeline step id — a cross-addon import is forbidden.
+*/
+var OBJECT_DETECTION_STEP_ID = "object-detection";
+/**
+* Zone-driven activation for the toggle-less `package-detection` root step.
+*
+* The step runs for a device IFF it has ≥1 package zone (an enabled
+* `package`-stage zone rule referencing geometry). There is deliberately NO
+* operator toggle — drawing a package zone IS the enable, removing every
+* package zone IS the disable. This gate reconciles the resolved step tree to
+* that rule:
+*
+*  - `hasPackageZone` true  → the step is ensured present as an ENABLED root
+*    (a pre-existing node keeps its `modelId` / `settings` — e.g. a per-node
+*    model choice); default-on where a zone is present.
+*  - `hasPackageZone` false → any `package-detection` node is stripped so the
+*    runner never dispatches it.
+*
+* `package-detection` is a ROOT (`inputClasses: null`) so it only ever appears
+* at the top level — no recursion into children needed. Every other step is
+* left untouched. Immutable: returns a fresh array only when a change applies.
+*/
+function applyPackageZoneActivation(steps, hasPackageZone) {
+	const existing = steps.find((s) => s.addonId === PACKAGE_DETECTION_STEP_ID);
+	if (!hasPackageZone) {
+		if (!existing) return steps;
+		return steps.filter((s) => s.addonId !== PACKAGE_DETECTION_STEP_ID);
+	}
+	if (existing) {
+		if (existing.enabled === true) return steps;
+		return steps.map((s) => s.addonId === "package-detection" ? {
+			...s,
+			enabled: true
+		} : s);
+	}
+	const node = {
+		addonId: PACKAGE_DETECTION_STEP_ID,
+		enabled: true,
+		children: []
+	};
+	return [...steps, node];
+}
+/**
+* Steps that are OFF by the per-camera gate DEFAULT (i.e. when the camera's
+* `stepToggles[addonId]` is unset). Mirrors each step's catalog
+* `enabledByDefault: false` — the heavy / opt-in classifiers + segmentation.
+*
+* The pure resolver derives the default gate from the LIVE catalog
+* (`addon.enabledByDefault ?? true`), so it stays correct if a future
+* default-off step ships. This literal set is the catalog-FREE fallback used
+* by the one-shot gating migration ({@link migrateStepGating}), which runs at
+* boot with no guaranteed live executor catalog. The two agree for every
+* step that exists today.
+*
+* `package-detection` is deliberately NOT listed — it is ZONE-driven
+* ({@link applyPackageZoneActivation}) and never governed by the gate.
+*/
+var DEFAULT_OFF_STEP_IDS = new Set([
+	"animal-classifier",
+	"bird-classifier",
+	"vehicle-classifier",
+	"segmentation"
+]);
+/**
+* Catalog-free default gate for `addonId` — `true` unless the step is in
+* {@link DEFAULT_OFF_STEP_IDS}. Used by the migration (no live catalog); the
+* resolver prefers the catalog's own `enabledByDefault ?? true`.
+*/
+function defaultStepGate(addonId) {
+	return !DEFAULT_OFF_STEP_IDS.has(addonId);
+}
+/**
+* PROVISIONING presence for `(addon, format)` — the node "provides" the step
+* iff the catalog lists at least one model with a build for the node's engine
+* format. Byte-for-byte the same test the admin-ui matrices use
+* (`addon.models.some(m => Boolean(m.formats[fmt]))`). An absent `modelId`
+* on the resolved step is still "Auto" (the node resolves its own format
+* default) — provisioning does NOT require an operator-pinned model, only a
+* compatible model to EXIST for the format.
+*/
+function addonHasCompatibleModel(addon, format) {
+	return (addon.models ?? []).some((m) => Boolean(m.formats[format]));
+}
+/**
+* A ROOT runs on the frame plane of the ELECTED device and is never jumped
+* (D650). Roots are the video steps with no `inputClasses`.
+*/
+function isVideoRoot(addon) {
+	return (addon.inputClasses ?? []).length === 0;
+}
+/**
+* The per-DEVICE provisioning gate (D650). `null` = keep the step.
+*
+*  - `audio-classifier` is NOT gated here at all. It never runs on an
+*    inference pool — the audio-analyzer runs its own backend (YAMNet in an
+*    embedded-Python subprocess, or Apple SoundAnalysis) — so an inference
+*    format says nothing about whether it can run. Only enablement applies.
+*  - A video ROOT needs a build for the ELECTED device's format — the runner
+*    never jumps it, so a sibling accelerator that could run it is irrelevant.
+*  - A detail step is kept when the elected format OR any format of the
+*    node's jump roster (`jumpFormats` — the SAME enabled∧available devices
+*    the runner jumps within) has a build: the runner's step-tree jump
+*    (`pipeline-runner/device-jump.ts`) then places it.
+*/
+function unprovisionedReason(addon, electedFormat, jumpFormats) {
+	if (addon.slot === "audio-classifier") return null;
+	if (addonHasCompatibleModel(addon, electedFormat)) return null;
+	if (isVideoRoot(addon)) return jumpFormats.some((f) => addonHasCompatibleModel(addon, f)) ? "root-not-runnable-on-elected-device" : "no-compatible-model";
+	return jumpFormats.some((f) => addonHasCompatibleModel(addon, f)) ? null : "no-compatible-model";
+}
+/**
+* Device-aware resolver — the SINGLE per-camera gate + per-DEVICE skip check.
+*
+* Step `S` runs for camera `C` on device `D`  ⇔
+*   gate(C, S)          — `stepToggles[S]` ?? `addon.enabledByDefault ?? true`
+*   AND provided(D, S)  — the catalog lists a model with a build for D's FORMAT
+*                         (a ROOT), or for D's format or any `jumpFormats`
+*                         entry (a detail step — the runner jumps it, D650);
+*                         `audio-classifier` is never format-gated (it runs
+*                         on the audio-analyzer's own backend)
+*
+* Enablement is the per-camera `stepToggles` authority ONLY. Provisioning
+* (`modelId` / `settings`) is NOT applied here — the returned tree carries bare
+* `{ addonId, enabled: true, children }` nodes; {@link applyDeviceProvisioning}
+* attaches model + settings at dispatch from the per-(node,device) base + the
+* per-camera-device override.
+*
+* A step gated ON that no device it may run on can serve is DROPPED and
+* recorded in `skipped` so the caller can surface a visible "gated on, no model
+* on this node" status at dispatch time.
+*
+* `package-detection` is excluded here — it is zone-driven
+* ({@link applyPackageZoneActivation}, applied by the caller).
+*
+* "Inference disabled for this camera" is NOT handled here — the caller
+* (resolvePipelineForDevice) consults the detection-pipeline binding and
+* short-circuits to an empty pipeline before invoking this resolver.
+*/
+function resolvePipelineWithSkips(cameraSettings, agentNodeId, deviceFormat, catalog, jumpFormats = []) {
+	const cam = cameraSettings ?? {};
+	const wholesale = cam.pipelineByAgent?.[agentNodeId];
+	if (wholesale) return {
+		config: {
+			steps: mergeEnabledByDefaultSteps(wholesale.steps, catalog),
+			audio: wholesale.audio ? {
+				modelId: wholesale.audio.modelId,
+				enabled: wholesale.audio.enabled
+			} : null
+		},
+		skipped: [],
+		droppedRoots: []
+	};
+	const toggles = cam.stepToggles ?? {};
+	const format = deviceFormat;
+	const enabled = [];
+	const skipped = [];
+	const droppedRoots = [];
+	for (const slot of catalog.slots) for (const addon of slot.addons) {
+		const addonId = addon.id;
+		if (addonId === "package-detection") continue;
+		if (!(toggles[addonId] ?? addon.enabledByDefault ?? true)) continue;
+		const reason = unprovisionedReason(addon, format, jumpFormats);
+		if (reason !== null) {
+			skipped.push({
+				addonId,
+				reason
+			});
+			if (addonId === "object-detection") droppedRoots.push(addonId);
+			continue;
+		}
+		enabled.push({ addonId });
+	}
+	const audioAddons = [];
+	const videoAddons = [];
+	for (const entry of enabled) {
+		const meta = findInCatalog(catalog, entry.addonId);
+		if (!meta) continue;
+		if (meta.slot === "audio-classifier") audioAddons.push(entry);
+		else videoAddons.push(entry);
+	}
+	return {
+		config: {
+			steps: buildTreeFromAddons(videoAddons, catalog),
+			audio: audioAddons.length > 0 ? { enabled: true } : null
+		},
+		skipped,
+		droppedRoots
+	};
+}
+function findInCatalog(catalog, addonId) {
+	for (const slot of catalog.slots) for (const addon of slot.addons) if (addon.id === addonId) return addon;
+	return null;
+}
+/**
+* Compose a step tree from a flat list of enabled video addons using
+* catalog compatibility: an addon whose `inputClasses` overlaps a
+* candidate parent's `outputClasses` attaches as the parent's child.
+* Addons with `inputClasses` null/empty become roots.
+*
+* Multiple addons in the same slot with compatible inputClasses run in
+* parallel — they attach to the same parent as siblings. Example: two
+* classifiers (bird-classifier + animal-classifier) both accept 'animal'
+* → both attach to object-detection as siblings, both receive every
+* animal crop.
+*
+* Unparented leaves (inputClasses set, but no matching parent in the
+* enabled set) are DROPPED. The runner would have nothing to feed them
+* anyway — better silent drop than dispatching a dead step.
+*/
+function buildTreeFromAddons(enabled, catalog) {
+	const bySlot = /* @__PURE__ */ new Map();
+	for (const slot of catalog.slots) bySlot.set(slot.id, slot);
+	const nodes = /* @__PURE__ */ new Map();
+	const metaById = /* @__PURE__ */ new Map();
+	for (const { addonId } of enabled) {
+		const meta = findInCatalog(catalog, addonId);
+		if (!meta) continue;
+		metaById.set(addonId, meta);
+		nodes.set(addonId, {
+			addonId,
+			enabled: true,
+			children: []
+		});
+	}
+	const roots = [];
+	for (const [addonId, node] of nodes) {
+		const inputs = metaById.get(addonId).inputClasses;
+		if (!inputs || inputs.length === 0) {
+			roots.push(node);
+			continue;
+		}
+		let parent = null;
+		for (const [candidateId, candidateNode] of nodes) {
+			if (candidateId === addonId) continue;
+			if (metaById.get(candidateId).outputClasses.some((c) => inputs.includes(c))) {
+				parent = candidateNode;
+				break;
+			}
+		}
+		if (parent) parent.children.push(node);
+	}
+	return roots;
+}
+/**
+* Back-fill catalog steps EXPLICITLY flagged `backfillIntoExistingOverrides`
+* but ENTIRELY ABSENT from an existing step tree — reconciles a stored
+* wholesale `pipelineByAgent` snapshot with genuinely-new default steps.
+*
+* Why it's needed: a `pipelineByAgent` wholesale override SNAPSHOTS the full
+* tree. A step introduced AFTER the snapshot (e.g. `clip-embedding` for object
+* semantic search) would otherwise never reach that camera.
+*
+* Why the flag (not `enabledByDefault`): absence-from-a-snapshot is ambiguous —
+* it can mean "predates this step" OR "operator deliberately pruned it". A
+* broad "back-fill every default-on step" would resurrect deliberate removals
+* of long-existing steps (face-detection, etc.), an operator-intent
+* regression. Only a step that opts in via `backfillIntoExistingOverrides`
+* (set on genuinely-new default steps ONLY) re-enters existing overrides.
+*
+* Non-destructive by design:
+*   - Only steps whose id is absent from the WHOLE tree are added. A step the
+*     operator has already seen — present anywhere, even `enabled: false` —
+*     is left exactly as-is (its enabled flag is honoured).
+*   - Only `backfillIntoExistingOverrides === true` addons are candidates.
+*     Every other step (including long-standing default-on members) is left
+*     untouched, so a deliberately-pruned override stays pruned.
+*   - Audio-classifier addons are skipped — audio lives in
+*     `CameraPipelineConfig.audio`, never in the video `steps` tree.
+*   - A candidate attaches by catalog compat (its `inputClasses` overlap a
+*     present node's `outputClasses`), mirroring {@link buildTreeFromAddons}.
+*     A candidate with non-empty `inputClasses` and NO compatible parent is
+*     dropped (never re-rooted) so a crop-scoped embedder never regresses to
+*     running on the full frame. Empty `inputClasses` ⇒ a genuine root step.
+*/
+function mergeEnabledByDefaultSteps(steps, catalog) {
+	if (steps.length === 0) return steps;
+	const present = /* @__PURE__ */ new Set();
+	const collect = (nodes) => {
+		for (const n of nodes) {
+			present.add(n.addonId);
+			if (n.children?.length) collect(n.children);
+		}
+	};
+	collect(steps);
+	const catalogById = /* @__PURE__ */ new Map();
+	for (const slot of catalog.slots) for (const addon of slot.addons) catalogById.set(addon.id, addon);
+	const newRoots = [];
+	const childrenByParent = /* @__PURE__ */ new Map();
+	for (const slot of catalog.slots) {
+		if (slot.id === "audio-classifier") continue;
+		for (const addon of slot.addons) {
+			if (addon.backfillIntoExistingOverrides !== true) continue;
+			if (present.has(addon.id)) continue;
+			const node = {
+				addonId: addon.id,
+				enabled: true,
+				children: []
+			};
+			const inputs = addon.inputClasses;
+			if (!inputs || inputs.length === 0) {
+				newRoots.push(node);
+				continue;
+			}
+			let parentId = null;
+			for (const presentId of present) {
+				const meta = catalogById.get(presentId);
+				if (!meta) continue;
+				if (meta.outputClasses.some((c) => inputs.includes(c))) {
+					parentId = presentId;
+					break;
+				}
+			}
+			if (!parentId) continue;
+			const list = childrenByParent.get(parentId) ?? [];
+			list.push(node);
+			childrenByParent.set(parentId, list);
+		}
+	}
+	if (childrenByParent.size === 0 && newRoots.length === 0) return steps;
+	const attach = (nodes) => nodes.map((n) => {
+		const rebuiltChildren = attach(n.children ?? []);
+		const extra = childrenByParent.get(n.addonId) ?? [];
+		const mergedChildren = [...rebuiltChildren, ...extra];
+		return mergedChildren.length > 0 ? {
+			...n,
+			children: mergedChildren
+		} : n;
+	});
+	return [...attach(steps), ...newRoots];
+}
+//#endregion
 //#region src/inference-device-model.ts
 /**
 * Per-device default object-detection model + deviceKey parsing for the
@@ -48263,20 +49160,14 @@ function createDiskReconcileJobRunner(now = Date.now) {
 * gates (0/3 miss recovered at the current threshold).
 */
 /**
-* The always-on object-detection ROOT step id. A camera session's tracks all
-* originate from this detector, so a device whose engine format can't run it
-* cannot host a camera root. Mirrors the addon-pipeline step id (cross-addon
-* import is forbidden — this is the same duplication rationale as the model
-* defaults above).
-*/
-var OBJECT_DETECTION_STEP_ID = "object-detection";
-/**
 * Build the camera-root capability predicate for a node from its live catalog:
 * `format → canHostCameraRoot`. A format can host a camera root iff the
 * catalog lists at least one object-detection model with a build for that
 * format — byte-for-byte the resolver's per-device skip-gate test for the root
 * step (`addonHasCompatibleModel`), so a device is deemed eligible iff the root
-* would ACTUALLY provision on it.
+* would ACTUALLY provision on it. The root is {@link OBJECT_DETECTION_STEP_ID},
+* shared with the resolver's refusal backstop (`droppedRoots`) so the two gates
+* judge the same step (D650 round 4).
 *
 * Fails OPEN when the catalog has no object-detection slot at all (never
 * observed in production) so a malformed/empty catalog never strands every
@@ -49796,16 +50687,18 @@ var CameraStatusService = class {
 		const audioAssignment = this.deps.getAudioAssignment(deviceId);
 		const audioNodeId = audioAssignment?.nodeId ?? null;
 		const audioPinned = audioAssignment?.pinned ?? false;
+		const pinned = {
+			detection: pipelineAssignment?.pinned ?? false,
+			decoder: false,
+			audio: audioPinned
+		};
+		const pendingReason = this.deps.getPendingReason(deviceId);
 		return {
 			pipelineAssignment,
 			detectionNodeId,
 			sourceNodeId,
-			pinned: {
-				detection: pipelineAssignment?.pinned ?? false,
-				decoder: false,
-				audio: audioPinned
-			},
-			detectionReason: pipelineAssignment !== null ? pipelineAssignment.reason : this.deps.hasCameraConfig(deviceId) ? `pending:${this.deps.getPendingReason(deviceId) ?? "pending"}` : this.deps.isSessionCamera(deviceId) ? "armed:on-motion" : void 0,
+			pinned,
+			detectionReason: pipelineAssignment !== null ? pipelineAssignment.reason : this.deps.hasCameraConfig(deviceId) ? `pending:${pendingReason ?? "pending"}` : this.deps.isSessionCamera(deviceId) ? pendingReason !== void 0 ? `pending:${pendingReason}` : "armed:on-motion" : void 0,
 			audioNodeId,
 			audioPinned
 		};
@@ -50661,48 +51554,6 @@ var DetectionBlindMonitor = class {
 	}
 };
 //#endregion
-//#region src/apply-device-provisioning.ts
-/**
-* Merge base then override for one step. Override keys win; undefined = inherit.
-* `jumpDeviceKey` (step-tree device jump, phase 1) is a per-(node,device) BASE
-* concept ONLY — the per-camera override never carries it (spec: per-camera jump
-* is out of scope), so it is taken from `base` verbatim.
-*/
-function resolveStep(base, override) {
-	if (!base && !override) return void 0;
-	const modelId = override?.modelId ?? base?.modelId;
-	const settings = base?.settings || override?.settings ? {
-		...base?.settings,
-		...override?.settings
-	} : void 0;
-	const jumpDeviceKey = base?.jumpDeviceKey;
-	return {
-		...modelId !== void 0 ? { modelId } : {},
-		...settings ? { settings } : {},
-		...jumpDeviceKey !== void 0 ? { jumpDeviceKey } : {}
-	};
-}
-/**
-* Attach modelId + settings onto each step from the per-(node,device) BASE and
-* the per-camera-device OVERRIDE. Pure/immutable; recurses into children. Empty
-* base+override ⇒ same reference.
-*/
-function applyDeviceProvisioning(steps, base, override) {
-	if (Object.keys(base).length === 0 && Object.keys(override).length === 0) return steps;
-	return steps.map((step) => {
-		const cfg = resolveStep(base[step.addonId], override[step.addonId]);
-		const children = step.children ? applyDeviceProvisioning(step.children, base, override) : step.children;
-		if (!cfg && children === step.children) return step;
-		return {
-			...step,
-			...cfg?.modelId !== void 0 ? { modelId: cfg.modelId } : {},
-			...cfg?.settings ? { settings: cfg.settings } : {},
-			...cfg?.jumpDeviceKey !== void 0 ? { jumpDeviceKey: cfg.jumpDeviceKey } : {},
-			...children !== void 0 ? { children } : {}
-		};
-	});
-}
-//#endregion
 //#region src/device-activity-source.ts
 /** The source's own name on the wire. One constant, used by every emit + gate. */
 var DEVICE_ACTIVITY_SOURCE = "device-activity";
@@ -51997,8 +52848,12 @@ var DetectionWiringController = class {
 			}
 			log.info("detection armed (session-time) — watching for motion", { meta: { motion: config.motionSources.join("+") } });
 		} else {
-			const hydrateNodeId = this.deps.ledger.getAssignment(deviceId)?.agentNodeId ?? this.deps.localNodeId();
-			const pipelineConfig = await this.deps.settingsStore.resolvePipelineForDevice(deviceId);
+			const placeholderNode = this.deps.ledger.getAssignment(deviceId)?.agentNodeId ?? this.deps.localNodeId();
+			const placeholder = await this.deps.settingsStore.resolvePipelineForDeviceIfCatalogCached(deviceId, placeholderNode, void 0, []);
+			const pipelineConfig = placeholder.kind === "resolved" ? placeholder.config : {
+				steps: [],
+				audio: null
+			};
 			const runnerConfig = buildRunnerConfig({
 				deviceId,
 				config,
@@ -52007,42 +52862,12 @@ var DetectionWiringController = class {
 				steps: pipelineConfig.steps,
 				audio: pipelineConfig.audio ?? null
 			});
-			let dispatchedNodeId = null;
 			try {
-				const result = await this.deps.placement.dispatchCamera(runnerConfig);
-				if (result.kind === "assigned") dispatchedNodeId = result.agentNodeId;
+				await this.deps.placement.dispatchCamera(runnerConfig);
 			} catch (err) {
 				const msg = errMsg$1(err);
 				log.error("dispatchCamera failed", { meta: { error: msg } });
 			}
-			if (dispatchedNodeId && (dispatchedNodeId !== hydrateNodeId || (runnerConfig.steps?.length ?? 0) === 0)) try {
-				const dispatchedDeviceKey = this.deps.ledger.getConfig(deviceId)?.deviceKey;
-				const corrected = await this.deps.settingsStore.resolvePipelineForDevice(deviceId, dispatchedNodeId, dispatchedDeviceKey);
-				const correctedBase = await this.deps.settingsStore.buildNodeInferenceDeviceSteps(dispatchedNodeId, dispatchedDeviceKey ?? "");
-				const correctedOverride = dispatchedDeviceKey ? await this.deps.settingsStore.readCameraDeviceOverride(deviceId, dispatchedNodeId, dispatchedDeviceKey) : {};
-				const correctedConfig = {
-					...runnerConfig,
-					...dispatchedDeviceKey ? { deviceKey: dispatchedDeviceKey } : {},
-					steps: applyDeviceProvisioning(corrected.steps, correctedBase, correctedOverride),
-					audio: corrected.audio ?? null
-				};
-				if (JSON.stringify({
-					steps: runnerConfig.steps,
-					audio: runnerConfig.audio ?? null
-				}) !== JSON.stringify({
-					steps: correctedConfig.steps,
-					audio: correctedConfig.audio
-				})) {
-					await this.deps.attachOn(dispatchedNodeId, correctedConfig);
-					this.deps.ledger.setConfig(deviceId, correctedConfig);
-					log.info("startDetection: pipeline re-resolved after agent assignment", {
-						tags: { nodeId: dispatchedNodeId },
-						meta: { stepCount: corrected.steps.length }
-					});
-				}
-			} catch (err) {
-				log.warn("startDetection: post-dispatch re-resolve failed", { meta: { error: errMsg$1(err) } });
-			}
 		}
 		try {
 			await this.deps.audio.resubscribe(deviceId, config);
@@ -52794,6 +53619,200 @@ async function migrateLegacyFlagsToBindings(deps) {
 	} });
 }
 //#endregion
+//#region src/apply-device-provisioning.ts
+/**
+* Merge base then override for one step. Override keys win; undefined = inherit.
+* `jumpDeviceKey` (step-tree device jump, phase 1) is a per-(node,device) BASE
+* concept ONLY — the per-camera override never carries it (spec: per-camera jump
+* is out of scope), so it is taken from `base` verbatim.
+*/
+function resolveStep(base, override) {
+	if (!base && !override) return void 0;
+	const modelId = override?.modelId ?? base?.modelId;
+	const settings = base?.settings || override?.settings ? {
+		...base?.settings,
+		...override?.settings
+	} : void 0;
+	const jumpDeviceKey = base?.jumpDeviceKey;
+	return {
+		...modelId !== void 0 ? { modelId } : {},
+		...settings ? { settings } : {},
+		...jumpDeviceKey !== void 0 ? { jumpDeviceKey } : {}
+	};
+}
+/**
+* Attach modelId + settings onto each step from the per-(node,device) BASE and
+* the per-camera-device OVERRIDE. Pure/immutable; recurses into children. Empty
+* base+override ⇒ same reference.
+*/
+function applyDeviceProvisioning(steps, base, override) {
+	if (Object.keys(base).length === 0 && Object.keys(override).length === 0) return steps;
+	return steps.map((step) => {
+		const cfg = resolveStep(base[step.addonId], override[step.addonId]);
+		const children = step.children ? applyDeviceProvisioning(step.children, base, override) : step.children;
+		if (!cfg && children === step.children) return step;
+		return {
+			...step,
+			...cfg?.modelId !== void 0 ? { modelId: cfg.modelId } : {},
+			...cfg?.settings ? { settings: cfg.settings } : {},
+			...cfg?.jumpDeviceKey !== void 0 ? { jumpDeviceKey: cfg.jumpDeviceKey } : {},
+			...children !== void 0 ? { children } : {}
+		};
+	});
+}
+/**
+* What each step of `steps` would run with had the camera been elected onto
+* the device whose `base` / `override` these are — as a flat
+* `stepId → { modelId?, settings? }` map (D650). It IS
+* {@link applyDeviceProvisioning} over the same resolved tree, flattened, so a
+* jump target and the elected device are provisioned by one rule, and a value
+* the resolved tree already carries (a wholesale `pipelineByAgent` snapshot)
+* survives exactly as it would on the elected device. The runner REPLACES a
+* jumped subtree's `modelId` / `settings` with these, so the elected device's
+* base and override never follow a step across. `jumpDeviceKey` is dropped: it
+* names where a step leaves the ELECTED device for, and means nothing on the
+* target. A step with neither field is absent (it runs the format default).
+*/
+function provisionDeviceSteps(steps, base, override) {
+	const out = {};
+	const walk = (list) => {
+		for (const step of list) {
+			if (step.modelId !== void 0 || step.settings !== void 0) out[step.addonId] = {
+				...step.modelId !== void 0 ? { modelId: step.modelId } : {},
+				...step.settings !== void 0 ? { settings: step.settings } : {}
+			};
+			walk(step.children ?? []);
+		}
+	};
+	walk(applyDeviceProvisioning(steps, base, override));
+	return out;
+}
+//#endregion
+//#region src/jump-roster.ts
+/**
+* The roster (unprovisioned), or `undefined` when there is no jump to make: no
+* elected device, or fewer than two eligible devices on the node.
+*/
+function buildJumpRoster(input) {
+	if (!input.deviceKey || Object.keys(input.eligible).length < 2) return void 0;
+	return buildInferenceDeviceRoster(input.eligible, input.caps);
+}
+/** The roster devices a detail step may jump TO — every entry except the elected one. */
+function jumpTargetKeys(roster, electedDeviceKey) {
+	return (roster ?? []).map((d) => d.deviceKey).filter((k) => k !== electedDeviceKey);
+}
+//#endregion
+//#region src/attach-pipeline.ts
+/**
+* The steps whose ELECTED-device base carries a manual `jumpDeviceKey` while
+* the camera has an override for that step on the elected device (D650). A
+* jumped step runs the TARGET's provisioning, so that override does not
+* travel with it — the operator must be told, not left to wonder.
+*/
+function manualJumpsLeavingOverride(base, override) {
+	const out = [];
+	for (const [stepId, cfg] of Object.entries(base)) {
+		const jumpDeviceKey = cfg.jumpDeviceKey;
+		if (jumpDeviceKey === void 0) continue;
+		const own = override[stepId];
+		if (own?.modelId === void 0 && own?.settings === void 0) continue;
+		out.push({
+			stepId,
+			jumpDeviceKey
+		});
+	}
+	return out;
+}
+/**
+* BLOCKING entry point: waits for the node's catalog (`resolvePipelineForDevice`
+* reconciles against the executor until it answers). For a FIRST placement —
+* a camera's first standing dispatch, an on-motion session, a re-attach —
+* where there is nothing better to attach than the real pipeline. See the
+* module header.
+*/
+async function resolveAttachPipeline(input, store) {
+	const roster = buildJumpRoster({
+		deviceKey: input.deviceKey,
+		eligible: input.eligible,
+		caps: input.caps
+	});
+	const resolved = await store.resolvePipelineForDeviceWithRoots(input.deviceId, input.nodeId, input.deviceKey, jumpTargetKeys(roster, input.deviceKey));
+	if (resolved.droppedRoots.length > 0) return rootRefusal(input, resolved.droppedRoots);
+	return {
+		kind: "resolved",
+		pipeline: await provisionAttachPipeline(input, roster, resolved.config, store)
+	};
+}
+/**
+* NON-BLOCKING entry point: reads the node's catalog from the cache only, and
+* answers `catalog-unavailable` instead of waiting (D650 round 2). For the
+* RETRY and re-place paths — a pending retry, a remote-health re-place, a
+* rebalance migration — which run cameras serially in one sweep: one node
+* whose executor never answers must leave ITS camera pending, not hold every
+* camera behind it (D3, D49).
+*/
+async function resolveAttachPipelineIfCatalogCached(input, store) {
+	const roster = buildJumpRoster({
+		deviceKey: input.deviceKey,
+		eligible: input.eligible,
+		caps: input.caps
+	});
+	const outcome = await store.resolvePipelineForDeviceIfCatalogCached(input.deviceId, input.nodeId, input.deviceKey, jumpTargetKeys(roster, input.deviceKey));
+	if (outcome.kind === "catalog-unavailable") return outcome;
+	if (outcome.droppedRoots.length > 0) return rootRefusal(input, outcome.droppedRoots);
+	return {
+		kind: "resolved",
+		pipeline: await provisionAttachPipeline(input, roster, outcome.config, store)
+	};
+}
+function rootRefusal(input, droppedRoots) {
+	return {
+		kind: "root-refused",
+		nodeId: input.nodeId,
+		deviceKey: input.deviceKey,
+		droppedRoots
+	};
+}
+/** Steps 3 of the module header: provision the resolved structure. */
+async function provisionAttachPipeline(input, roster, resolved, store) {
+	const { deviceId, nodeId, deviceKey } = input;
+	const electedKey = deviceKey ?? "";
+	const rosterKeys = (roster ?? []).map((d) => d.deviceKey);
+	const sources = await store.readDeviceProvisioning(deviceId, nodeId, [...new Set([electedKey, ...rosterKeys])]);
+	const elected = sources.get(electedKey);
+	if (deviceKey && elected) {
+		const left = manualJumpsLeavingOverride(elected.base, elected.override).filter((l) => rosterKeys.includes(l.jumpDeviceKey));
+		if (left.length > 0) store.warnManualJumpsLeaveOverride(deviceId, nodeId, deviceKey, left);
+	}
+	const steps = applyDeviceProvisioning(resolved.steps, elected?.base ?? {}, elected?.override ?? {});
+	const inferenceDevices = roster?.map((entry) => {
+		const src = sources.get(entry.deviceKey);
+		return {
+			...entry,
+			steps: provisionDeviceSteps(resolved.steps, src?.base ?? {}, src?.override ?? {})
+		};
+	});
+	return {
+		steps,
+		audio: resolved.audio ?? null,
+		...deviceKey ? { deviceKey } : {},
+		...inferenceDevices ? { inferenceDevices } : {}
+	};
+}
+/**
+* `config` with its pipeline REPLACED by `pipeline`. The four pipeline fields
+* are removed first, so a previous attach's `deviceKey` / roster never survives
+* a spread when the new pipeline has none (a migration to a single-device node,
+* a re-dispatch from a ledger config).
+*/
+function withAttachPipeline(config, pipeline) {
+	const { deviceKey: _deviceKey, inferenceDevices: _inferenceDevices, steps: _steps, audio: _audio, ...rest } = config;
+	return {
+		...rest,
+		...pipeline
+	};
+}
+//#endregion
 //#region src/dispatch-reconcile.ts
 function runnerAttachmentKey(nodeId, deviceId) {
 	return `${nodeId}:${deviceId}`;
@@ -53084,6 +54103,32 @@ function selectRunnerFrameSource(input) {
 //#region src/placement-service.ts
 /** Key under which the orchestrator stores its per-device manual pin — shared with `readPipelinePin` (index.ts) and `handleNodeDisconnect` (`node-lifecycle-handler.ts`). */
 var PREFERRED_AGENT_SETTING = "preferredAgent";
+/**
+* A load snapshot with this rebalance pass's own (re)assignments applied — at
+* node level, and per device so a device election in the same pass sees the
+* sessions the pass already gave each accelerator.
+*/
+function tallyLoad(load, nodeDelta, perDevice) {
+	if (nodeDelta === 0 && (perDevice === void 0 || perDevice.size === 0)) return load;
+	const known = new Set(load.devices.map((d) => d.deviceKey));
+	const devices = [...load.devices.map((d) => {
+		const delta = perDevice?.get(d.deviceKey) ?? 0;
+		return delta === 0 ? d : {
+			...d,
+			attachedCameras: Math.max(0, d.attachedCameras + delta)
+		};
+	}), ...[...perDevice ?? /* @__PURE__ */ new Map()].filter(([deviceKey, delta]) => !known.has(deviceKey) && delta > 0).map(([deviceKey, delta]) => ({
+		deviceKey,
+		backend: deviceKey.split(":")[0] ?? deviceKey,
+		attachedCameras: delta,
+		queueDepthTotal: 0
+	}))];
+	return {
+		...load,
+		attachedCameras: Math.max(0, load.attachedCameras + nodeDelta),
+		devices
+	};
+}
 var PlacementService = class {
 	deps;
 	/** True while an auto-rebalance pass is running (skip overlap). */
@@ -53121,7 +54166,116 @@ var PlacementService = class {
 		});
 		return usable;
 	}
+	/**
+	* Pick which of `nodeId`'s enabled inference devices a camera runs on, and
+	* log why (`inference device selection` — one line per placement, the same
+	* message as the on-motion path so one grep covers both). Returns the
+	* eligibility inputs too: the attach pipeline is resolved against the SAME
+	* roster the device was elected from.
+	*/
+	async electInferenceDevice(input) {
+		const targetLoad = input.loads.find((load) => load.nodeId === input.nodeId);
+		let eligible;
+		if (input.read.kind === "await-catalog") eligible = await this.deps.getEligibleInferenceDevices(input.nodeId);
+		else {
+			const known = await this.deps.getEligibleInferenceDevicesIfCached(input.nodeId);
+			if (known.kind === "unavailable") return known;
+			eligible = known.eligible;
+		}
+		const caps = await this.deps.getInferenceDeviceCaps(input.nodeId);
+		const pinnedDeviceKey = await this.deps.readPipelineDevicePin(input.deviceId);
+		const selection = pickInferenceDevice({
+			eligible,
+			loads: targetLoad?.devices ?? [],
+			caps,
+			pinnedDeviceKey,
+			currentDeviceKey: input.currentDeviceKey,
+			rotation: this.deps.inferenceRotation
+		});
+		const deviceKey = selectedDeviceKey(selection);
+		this.deps.ctx().logger.info("inference device selection", {
+			tags: {
+				deviceId: input.deviceId,
+				nodeId: input.nodeId
+			},
+			meta: {
+				path: input.path,
+				eligible: selection.eligibleKeys,
+				chosen: deviceKey ?? null,
+				reason: selection.reason,
+				...selection.kind === "selected" ? {
+					tied: selection.tiedKeys,
+					tieBreak: selection.tieBreak
+				} : {},
+				...pinnedDeviceKey ? { pin: pinnedDeviceKey } : {}
+			}
+		});
+		return {
+			kind: "elected",
+			deviceKey,
+			eligible,
+			caps
+		};
+	}
+	/**
+	* Elect a device on `nodeId` and resolve the camera's attach pipeline for
+	* it — the whole placement decision, for a first placement (`await-catalog`)
+	* or a re-place (`cached-catalog`, never waits). Nothing is attached here.
+	*/
+	async resolvePlacement(input) {
+		const election = await this.electInferenceDevice(input);
+		if (election.kind === "unavailable") return election;
+		const attachInput = {
+			deviceId: input.deviceId,
+			nodeId: input.nodeId,
+			deviceKey: election.deviceKey,
+			eligible: election.eligible,
+			caps: election.caps
+		};
+		if (input.read.kind === "await-catalog") return resolveAttachPipeline(attachInput, this.deps.settingsStore);
+		const outcome = await resolveAttachPipelineIfCatalogCached(attachInput, this.deps.settingsStore);
+		if (outcome.kind === "catalog-unavailable") return {
+			kind: "unavailable",
+			nodeId: outcome.nodeId,
+			what: "catalog"
+		};
+		return outcome;
+	}
+	/**
+	* Re-resolve a camera's attach pipeline on the device it is ALREADY
+	* elected onto (`deviceKey` from its ledger config; absent ⇒ default pool)
+	* — the entry for every path that replaces the steps of a live attach
+	* without re-electing (executor readiness, a package-zone change). Goes
+	* through the same {@link resolveAttachPipeline} as a dispatch (D650).
+	*/
+	async resolveAttachPipelineOnDevice(input) {
+		const [eligible, caps] = await Promise.all([this.deps.getEligibleInferenceDevices(input.nodeId), this.deps.getInferenceDeviceCaps(input.nodeId)]);
+		return resolveAttachPipeline({
+			...input,
+			eligible,
+			caps
+		}, this.deps.settingsStore);
+	}
+	/**
+	* FIRST placement of a standing camera: waits for the chosen node's catalog
+	* (the resolve reconciles against its executor until it answers). Callers:
+	* `startDetection`'s standing path — one camera, nothing to attach instead.
+	*/
 	async dispatchCamera(runnerConfig) {
+		return this.placeCamera(runnerConfig, { kind: "await-catalog" });
+	}
+	/**
+	* RE-placement from the ledger — the pending-retry sweep and the
+	* remote-health re-place (D650 round 2). NEVER waits for a node: the
+	* catalog is read from the cache only, and a node that has not answered
+	* leaves THIS camera pending (`catalog-unavailable:<nodeId>`) for the next
+	* round, instead of holding every camera after it in a serial sweep behind
+	* one wedged executor (D3, D49).
+	*/
+	async redispatchCamera(runnerConfig) {
+		return this.placeCamera(runnerConfig, { kind: "cached-catalog" });
+	}
+	async placeCamera(runnerConfig, catalog) {
 		if (!this.deps.ctx()) throw new Error("PipelineOrchestrator: dispatchCamera called before initialize");
 		if (this.deps.maintenancePaused?.() === true) return {
 			success: true,
@@ -53174,45 +54328,30 @@ var PlacementService = class {
 			reason = decision.reason;
 			dispatchScore = decision.score;
 		}
-		const targetLoad = loads.find((load) => load.nodeId === targetNodeId);
-		const eligibleDevices = await this.deps.getEligibleInferenceDevices(targetNodeId);
-		const deviceCaps = await this.deps.getInferenceDeviceCaps(targetNodeId);
-		const pinnedDeviceKey = await this.deps.readPipelineDevicePin(runnerConfig.deviceId);
-		const selection = pickInferenceDevice({
-			eligible: eligibleDevices,
-			loads: targetLoad?.devices ?? [],
-			caps: deviceCaps,
-			pinnedDeviceKey,
+		const placement = await this.resolvePlacement({
+			deviceId: runnerConfig.deviceId,
+			nodeId: targetNodeId,
+			loads,
 			currentDeviceKey,
-			rotation: this.deps.inferenceRotation
+			path: "standing",
+			read: catalog
 		});
-		const deviceKey = selectedDeviceKey(selection);
-		this.deps.ctx().logger.info("inference device selection", {
-			tags: {
-				deviceId: runnerConfig.deviceId,
-				nodeId: targetNodeId
-			},
-			meta: {
-				path: "standing",
-				eligible: selection.eligibleKeys,
-				chosen: deviceKey ?? null,
-				reason: selection.reason,
-				...selection.kind === "selected" ? {
-					tied: selection.tiedKeys,
-					tieBreak: selection.tieBreak
-				} : {},
-				...pinnedDeviceKey ? { pin: pinnedDeviceKey } : {}
-			}
-		});
-		const deviceBase = await this.deps.settingsStore.buildNodeInferenceDeviceSteps(targetNodeId, deviceKey ?? "");
-		const deviceOverride = deviceKey ? await this.deps.settingsStore.readCameraDeviceOverride(runnerConfig.deviceId, targetNodeId, deviceKey) : {};
-		const inferenceDevices = deviceKey && Object.keys(eligibleDevices).length >= 2 ? buildInferenceDeviceRoster(eligibleDevices, deviceCaps) : void 0;
-		const attachConfig = {
-			...runnerConfig,
-			...deviceKey ? { deviceKey } : {},
-			...inferenceDevices ? { inferenceDevices } : {},
-			...runnerConfig.steps ? { steps: applyDeviceProvisioning(runnerConfig.steps, deviceBase, deviceOverride) } : {}
-		};
+		if (placement.kind === "unavailable") {
+			this.leavePendingUnanswered(runnerConfig.deviceId, placement.nodeId, placement.what);
+			return {
+				success: true,
+				kind: "pending"
+			};
+		}
+		if (placement.kind === "root-refused") {
+			this.leavePendingRootRefused(runnerConfig.deviceId, placement);
+			return {
+				success: true,
+				kind: "pending"
+			};
+		}
+		const pipeline = placement.pipeline;
+		const attachConfig = withAttachPipeline(runnerConfig, pipeline);
 		const dispatchGuard = this.deps.ledger.markDispatching(runnerConfig.deviceId);
 		try {
 			await this.attachOn(targetNodeId, attachConfig);
@@ -53435,18 +54574,17 @@ var PlacementService = class {
 		const nodeCaps = await this.deps.settingsStore.buildNodeCaps();
 		const nodeWeights = await this.deps.settingsStore.buildNodeWeights();
 		const attachedDelta = /* @__PURE__ */ new Map();
-		const bumpAttached = (nodeId, by) => {
+		const deviceDelta = /* @__PURE__ */ new Map();
+		const bumpAttached = (nodeId, by, deviceKey) => {
 			attachedDelta.set(nodeId, (attachedDelta.get(nodeId) ?? 0) + by);
+			if (deviceKey === void 0) return;
+			const perDevice = deviceDelta.get(nodeId) ?? /* @__PURE__ */ new Map();
+			perDevice.set(deviceKey, (perDevice.get(deviceKey) ?? 0) + by);
+			deviceDelta.set(nodeId, perDevice);
 		};
-		const talliedLoads = () => loads.map((load) => {
-			const delta = attachedDelta.get(load.nodeId) ?? 0;
-			if (delta === 0) return load;
-			return {
-				...load,
-				attachedCameras: Math.max(0, load.attachedCameras + delta)
-			};
-		});
+		const talliedLoads = () => loads.map((load) => tallyLoad(load, attachedDelta.get(load.nodeId) ?? 0, deviceDelta.get(load.nodeId)));
 		let migrated = 0;
+		const skipped = [];
 		for (const [deviceId, config] of this.deps.ledger.configEntries()) {
 			if (this.deps.isIdleSessionCamera(deviceId)) continue;
 			const current = this.deps.ledger.getAssignment(deviceId);
@@ -53471,6 +54609,28 @@ var PlacementService = class {
 				const targetLoad = tallied.find((l) => l.nodeId === decision.agentNodeId);
 				if (currentLoad && targetLoad && capacityImprovement(currentLoad, targetLoad, nodeWeights) < minImprovement) continue;
 			}
+			const placement = await this.resolvePlacement({
+				deviceId,
+				nodeId: decision.agentNodeId,
+				loads: talliedLoads(),
+				currentDeviceKey: null,
+				path: "rebalance",
+				read: { kind: "cached-catalog" }
+			});
+			if (placement.kind !== "resolved") {
+				const reason = placement.kind === "root-refused" ? `root-unrunnable:${placement.nodeId}/${placement.deviceKey ?? "default-pool"}` : `${placement.what}-unavailable:${placement.nodeId}`;
+				skipped.push({
+					deviceId,
+					targetNodeId: decision.agentNodeId,
+					reason
+				});
+				if (current) this.noteMigrationSkipped(deviceId, current.agentNodeId, decision.agentNodeId, reason);
+				else if (placement.kind === "root-refused") this.leavePendingRootRefused(deviceId, placement);
+				else this.leavePendingUnanswered(deviceId, placement.nodeId, placement.what);
+				continue;
+			}
+			this.migrationSkips.delete(deviceId);
+			const targetConfig = withAttachPipeline(config, placement.pipeline);
 			if (current) {
 				await this.detachOn(current.agentNodeId, deviceId).catch((err) => {
 					const msg = errMsg$1(err);
@@ -53479,19 +54639,13 @@ var PlacementService = class {
 						meta: { error: msg }
 					});
 				});
-				bumpAttached(current.agentNodeId, -1);
+				bumpAttached(current.agentNodeId, -1, config.deviceKey);
 			}
-			const reResolved = await this.deps.settingsStore.resolvePipelineForDevice(deviceId, decision.agentNodeId);
-			const targetConfig = reResolved.steps.length > 0 ? {
-				...config,
-				steps: reResolved.steps,
-				audio: reResolved.audio ?? null
-			} : config;
 			this.deps.ledger.setConfig(deviceId, targetConfig);
 			const dispatchGuard = this.deps.ledger.markDispatching(deviceId);
 			try {
 				await this.attachOn(decision.agentNodeId, targetConfig);
-				bumpAttached(decision.agentNodeId, 1);
+				bumpAttached(decision.agentNodeId, 1, targetConfig.deviceKey);
 				this.deps.ledger.recordAssignment(deviceId, decision.agentNodeId, "rebalance", false);
 			} finally {
 				dispatchGuard.dispose();
@@ -53499,7 +54653,10 @@ var PlacementService = class {
 			migrated++;
 		}
 		ctx.logger.info("rebalance: migrated cameras", { meta: { migrated } });
-		return { migrated };
+		return {
+			migrated,
+			skipped
+		};
 	}
 	getPipelineAssignments() {
 		return this.deps.ledger.listAssignments();
@@ -53678,6 +54835,71 @@ var PlacementService = class {
 		};
 	}
 	/**
+	* A re-place found the node it chose has never answered what the placement
+	* needs (its catalog, or its device probe + pool health): the camera stays
+	* pending with the node NAMED, and the line fires once per change of pending
+	* state — a sweep re-finding the same unanswering node every tick is not
+	* news, a camera newly stuck on it (or on another node) is.
+	*/
+	leavePendingUnanswered(deviceId, nodeId, what) {
+		const reason = what === "catalog" ? `catalog-unavailable:${nodeId}` : `device-health-unavailable:${nodeId}`;
+		if (!this.setPendingIfChanged(deviceId, reason)) return;
+		this.deps.ctx().logger.warn("camera left pending — the chosen node has not answered", {
+			tags: {
+				deviceId,
+				nodeId
+			},
+			meta: {
+				reason,
+				hint: "a re-place never waits for a node; the next retry round places it once the node answers"
+			}
+		});
+	}
+	/**
+	* The NAMED refusal of a root-less attach (D650 round 3): the elected
+	* device cannot run a gated-on root of the camera, so the attach would
+	* detect nothing and — once its assignment were recorded — nothing would
+	* re-place it. The camera stays pending instead, once-per-change logged.
+	*/
+	leavePendingRootRefused(deviceId, refusal) {
+		const reason = `root-unrunnable:${refusal.nodeId}/${refusal.deviceKey ?? "default-pool"}`;
+		if (!this.setPendingIfChanged(deviceId, reason)) return;
+		this.deps.ctx().logger.error("attach refused — the elected device cannot run the camera root; camera left pending", {
+			tags: {
+				deviceId,
+				nodeId: refusal.nodeId
+			},
+			meta: {
+				reason,
+				deviceKey: refusal.deviceKey ?? null,
+				droppedRoots: refusal.droppedRoots.join(","),
+				hint: "the root is never jumped: enable a device on this node whose format ships the root model, or disable the device that cannot"
+			}
+		});
+	}
+	/** Last migration-skip reason per camera — the info line fires once per change. */
+	migrationSkips = /* @__PURE__ */ new Map();
+	noteMigrationSkipped(deviceId, sourceNodeId, targetNodeId, reason) {
+		if (this.migrationSkips.get(deviceId) === reason) return;
+		this.migrationSkips.set(deviceId, reason);
+		this.deps.ctx().logger.info("rebalance: migration skipped — camera stays on its source", {
+			tags: {
+				deviceId,
+				nodeId: targetNodeId
+			},
+			meta: {
+				sourceNodeId,
+				reason
+			}
+		});
+	}
+	/** Record `reason`; `true` when it differs from the camera's previous pending reason. */
+	setPendingIfChanged(deviceId, reason) {
+		const prior = this.deps.ledger.getPendingReason(deviceId);
+		this.deps.ledger.setPendingReason(deviceId, reason);
+		return prior !== reason;
+	}
+	/**
 	* Normalizes the `decision.kind === 'pending'` → `setPendingReason` +
 	* `warn` half shared by `dispatchCamera`/`unassignPipeline`/`rebalance`
 	* (smell #12). Each call site keeps its own bail (return / fall-through /
@@ -53934,13 +55156,16 @@ var NodeLifecycleHandler = class {
 			for (const deviceId of candidates) {
 				const cached = this.deps.ledger.getConfig(deviceId);
 				if (!cached) continue;
-				const resolved = await this.deps.settingsStore.resolvePipelineForDevice(deviceId, nodeId);
-				if (resolved.steps.length === 0) continue;
-				const next = {
-					...cached,
-					steps: resolved.steps,
-					audio: resolved.audio ?? null
-				};
+				if (this.isUnplacedPlaceholder(deviceId, cached, nodeId)) continue;
+				const outcome = await this.deps.resolveAttachPipeline({
+					deviceId,
+					nodeId,
+					deviceKey: cached.deviceKey
+				});
+				if (this.refusedReattach(deviceId, nodeId, outcome)) continue;
+				const pipeline = outcome.pipeline;
+				if (pipeline.steps.length === 0) continue;
+				const next = withAttachPipeline(cached, pipeline);
 				this.deps.ledger.setConfig(deviceId, next);
 				affected.push({
 					deviceId,
@@ -53993,6 +55218,43 @@ var NodeLifecycleHandler = class {
 		}
 	}
 	/**
+	* A re-attach whose elected device cannot run the camera's root is REFUSED
+	* (D650 round 3): the live attach is left as it is rather than replaced by
+	* one that detects nothing. Said once per pass, with the roots.
+	*/
+	refusedReattach(deviceId, nodeId, outcome) {
+		if (outcome.kind !== "root-refused") return false;
+		this.deps.logger.error("re-attach refused — the elected device cannot run the camera root", {
+			tags: {
+				deviceId,
+				nodeId
+			},
+			meta: {
+				deviceKey: outcome.deviceKey ?? null,
+				droppedRoots: outcome.droppedRoots.join(",")
+			}
+		});
+		return true;
+	}
+	/**
+	* A ledger config with no assignment AND no elected device is the standing
+	* path's PLACEHOLDER (D650 round 2): a camera the balancer has not placed,
+	* hydrated before any election. Attaching it here would place it on this
+	* node behind the balancer's back, on no device — the pending-retry sweep
+	* owns it. Skipped, and said so.
+	*/
+	isUnplacedPlaceholder(deviceId, cached, nodeId) {
+		if (this.deps.ledger.hasAssignment(deviceId) || cached.deviceKey !== void 0) return false;
+		this.deps.logger.info("readiness: skipped an unplaced placeholder config", {
+			tags: {
+				deviceId,
+				nodeId
+			},
+			meta: { reason: "no assignment and no elected device — the pending-retry sweep places it" }
+		});
+		return true;
+	}
+	/**
 	* Walk every cached RunnerCameraConfig and re-attach any whose stored
 	* `steps` are empty AND whose latest resolve produces a non-empty
 	* pipeline. Catches the "camera dispatched mid-readiness" race where
@@ -54003,13 +55265,16 @@ var NodeLifecycleHandler = class {
 		for (const [deviceId, cached] of this.deps.ledger.configEntries()) {
 			if ((cached.steps?.length ?? 0) > 0) continue;
 			if ((this.deps.ledger.getAssignment(deviceId)?.agentNodeId ?? this.deps.localNodeId()) !== nodeId) continue;
-			const resolved = await this.deps.settingsStore.resolvePipelineForDevice(deviceId, nodeId);
-			if (resolved.steps.length === 0) continue;
-			const next = {
-				...cached,
-				steps: resolved.steps,
-				audio: resolved.audio ?? null
-			};
+			if (this.isUnplacedPlaceholder(deviceId, cached, nodeId)) continue;
+			const outcome = await this.deps.resolveAttachPipeline({
+				deviceId,
+				nodeId,
+				deviceKey: cached.deviceKey
+			});
+			if (this.refusedReattach(deviceId, nodeId, outcome)) continue;
+			const pipeline = outcome.pipeline;
+			if (pipeline.steps.length === 0) continue;
+			const next = withAttachPipeline(cached, pipeline);
 			this.deps.ledger.setConfig(deviceId, next);
 			try {
 				await this.deps.attachOn(nodeId, next);
@@ -55392,9 +56657,11 @@ function wireOrchestratorSubscriptions(deps) {
 	});
 	const unsubFrameTracked = deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsFrameTracked }, (event) => {
 		if (!isEvent(event, EventCategory.PipelineAnalyticsFrameTracked)) return;
-		if (event.data.hasLiveTrack !== true) return;
 		const deviceId = event.data.deviceId;
 		if (typeof deviceId !== "number") return;
+		const liveTrackCount = event.data.liveTrackCount;
+		if (typeof liveTrackCount === "number") deps.noteSessionTrackedFrame(deviceId, liveTrackCount);
+		if (event.data.hasLiveTrack !== true) return;
 		deps.noteSessionSubjectPresent(deviceId);
 	});
 	const unsubMotionAnalysis = deps.eventBus.subscribe({ category: EventCategory.MotionAnalysis }, (event) => {
@@ -55536,303 +56803,54 @@ var PackageZoneGate = class {
 	}
 };
 //#endregion
-//#region src/pipeline-resolver.ts
-/**
-* The `package-detection` root step id. Zone-driven activation
-* ({@link applyPackageZoneActivation}) is keyed on it — the step has NO
-* user-facing toggle; a drawn package zone is the sole enable signal.
-*/
-var PACKAGE_DETECTION_STEP_ID = "package-detection";
-/**
-* Zone-driven activation for the toggle-less `package-detection` root step.
-*
-* The step runs for a device IFF it has ≥1 package zone (an enabled
-* `package`-stage zone rule referencing geometry). There is deliberately NO
-* operator toggle — drawing a package zone IS the enable, removing every
-* package zone IS the disable. This gate reconciles the resolved step tree to
-* that rule:
-*
-*  - `hasPackageZone` true  → the step is ensured present as an ENABLED root
-*    (a pre-existing node keeps its `modelId` / `settings` — e.g. a per-node
-*    model choice); default-on where a zone is present.
-*  - `hasPackageZone` false → any `package-detection` node is stripped so the
-*    runner never dispatches it.
-*
-* `package-detection` is a ROOT (`inputClasses: null`) so it only ever appears
-* at the top level — no recursion into children needed. Every other step is
-* left untouched. Immutable: returns a fresh array only when a change applies.
-*/
-function applyPackageZoneActivation(steps, hasPackageZone) {
-	const existing = steps.find((s) => s.addonId === PACKAGE_DETECTION_STEP_ID);
-	if (!hasPackageZone) {
-		if (!existing) return steps;
-		return steps.filter((s) => s.addonId !== PACKAGE_DETECTION_STEP_ID);
-	}
-	if (existing) {
-		if (existing.enabled === true) return steps;
-		return steps.map((s) => s.addonId === "package-detection" ? {
-			...s,
-			enabled: true
-		} : s);
-	}
-	const node = {
-		addonId: PACKAGE_DETECTION_STEP_ID,
-		enabled: true,
-		children: []
-	};
-	return [...steps, node];
-}
-/**
-* Steps that are OFF by the per-camera gate DEFAULT (i.e. when the camera's
-* `stepToggles[addonId]` is unset). Mirrors each step's catalog
-* `enabledByDefault: false` — the heavy / opt-in classifiers + segmentation.
-*
-* The pure resolver derives the default gate from the LIVE catalog
-* (`addon.enabledByDefault ?? true`), so it stays correct if a future
-* default-off step ships. This literal set is the catalog-FREE fallback used
-* by the one-shot gating migration ({@link migrateStepGating}), which runs at
-* boot with no guaranteed live executor catalog. The two agree for every
-* step that exists today.
-*
-* `package-detection` is deliberately NOT listed — it is ZONE-driven
-* ({@link applyPackageZoneActivation}) and never governed by the gate.
-*/
-var DEFAULT_OFF_STEP_IDS = new Set([
-	"animal-classifier",
-	"bird-classifier",
-	"vehicle-classifier",
-	"segmentation"
-]);
-/**
-* Catalog-free default gate for `addonId` — `true` unless the step is in
-* {@link DEFAULT_OFF_STEP_IDS}. Used by the migration (no live catalog); the
-* resolver prefers the catalog's own `enabledByDefault ?? true`.
-*/
-function defaultStepGate(addonId) {
-	return !DEFAULT_OFF_STEP_IDS.has(addonId);
-}
-/**
-* PROVISIONING presence for `(addon, format)` — the node "provides" the step
-* iff the catalog lists at least one model with a build for the node's engine
-* format. Byte-for-byte the same test the admin-ui matrices use
-* (`addon.models.some(m => Boolean(m.formats[fmt]))`). An absent `modelId`
-* on the resolved step is still "Auto" (the node resolves its own format
-* default) — provisioning does NOT require an operator-pinned model, only a
-* compatible model to EXIST for the format.
-*/
-function addonHasCompatibleModel(addon, format) {
-	return (addon.models ?? []).some((m) => Boolean(m.formats[format]));
-}
-/**
-* Device-aware resolver — the SINGLE per-camera gate + per-DEVICE skip check.
-*
-* Step `S` runs for camera `C` on device `D`  ⇔
-*   gate(C, S)          — `stepToggles[S]` ?? `addon.enabledByDefault ?? true`
-*   AND provided(D, S)  — the catalog lists a model with a build for D's FORMAT
-*
-* Enablement is the per-camera `stepToggles` authority ONLY. Provisioning
-* (`modelId` / `settings`) is NOT applied here — the returned tree carries bare
-* `{ addonId, enabled: true, children }` nodes; {@link applyDeviceProvisioning}
-* attaches model + settings at dispatch from the per-(node,device) base + the
-* per-camera-device override.
-*
-* A step gated ON but with NO compatible model for the DEVICE's format is
-* DROPPED and recorded in `skipped` so the caller can surface a visible "gated
-* on, no model on this device" status at dispatch time.
-*
-* `package-detection` is excluded here — it is zone-driven
-* ({@link applyPackageZoneActivation}, applied by the caller).
-*
-* "Inference disabled for this camera" is NOT handled here — the caller
-* (resolvePipelineForDevice) consults the detection-pipeline binding and
-* short-circuits to an empty pipeline before invoking this resolver.
-*/
-function resolvePipelineWithSkips(cameraSettings, agentNodeId, deviceFormat, catalog) {
-	const cam = cameraSettings ?? {};
-	const wholesale = cam.pipelineByAgent?.[agentNodeId];
-	if (wholesale) return {
-		config: {
-			steps: mergeEnabledByDefaultSteps(wholesale.steps, catalog),
-			audio: wholesale.audio ? {
-				modelId: wholesale.audio.modelId,
-				enabled: wholesale.audio.enabled
-			} : null
-		},
-		skipped: []
-	};
-	const toggles = cam.stepToggles ?? {};
-	const format = deviceFormat;
-	const enabled = [];
-	const skipped = [];
-	for (const slot of catalog.slots) for (const addon of slot.addons) {
-		const addonId = addon.id;
-		if (addonId === "package-detection") continue;
-		if (!(toggles[addonId] ?? addon.enabledByDefault ?? true)) continue;
-		if (!addonHasCompatibleModel(addon, format)) {
-			skipped.push({
-				addonId,
-				reason: "no-compatible-model"
-			});
-			continue;
-		}
-		enabled.push({ addonId });
-	}
-	const audioAddons = [];
-	const videoAddons = [];
-	for (const entry of enabled) {
-		const meta = findInCatalog(catalog, entry.addonId);
-		if (!meta) continue;
-		if (meta.slot === "audio-classifier") audioAddons.push(entry);
-		else videoAddons.push(entry);
-	}
-	return {
-		config: {
-			steps: buildTreeFromAddons(videoAddons, catalog),
-			audio: audioAddons.length > 0 ? { enabled: true } : null
-		},
-		skipped
-	};
-}
-function findInCatalog(catalog, addonId) {
-	for (const slot of catalog.slots) for (const addon of slot.addons) if (addon.id === addonId) return addon;
-	return null;
-}
-/**
-* Compose a step tree from a flat list of enabled video addons using
-* catalog compatibility: an addon whose `inputClasses` overlaps a
-* candidate parent's `outputClasses` attaches as the parent's child.
-* Addons with `inputClasses` null/empty become roots.
-*
-* Multiple addons in the same slot with compatible inputClasses run in
-* parallel — they attach to the same parent as siblings. Example: two
-* classifiers (bird-classifier + animal-classifier) both accept 'animal'
-* → both attach to object-detection as siblings, both receive every
-* animal crop.
-*
-* Unparented leaves (inputClasses set, but no matching parent in the
-* enabled set) are DROPPED. The runner would have nothing to feed them
-* anyway — better silent drop than dispatching a dead step.
-*/
-function buildTreeFromAddons(enabled, catalog) {
-	const bySlot = /* @__PURE__ */ new Map();
-	for (const slot of catalog.slots) bySlot.set(slot.id, slot);
-	const nodes = /* @__PURE__ */ new Map();
-	const metaById = /* @__PURE__ */ new Map();
-	for (const { addonId } of enabled) {
-		const meta = findInCatalog(catalog, addonId);
-		if (!meta) continue;
-		metaById.set(addonId, meta);
-		nodes.set(addonId, {
-			addonId,
-			enabled: true,
-			children: []
+//#region src/package-zone-reattach.ts
+/**
+* Re-attach a placed camera after its `package` zone rules changed.
+*
+* A package zone flips the toggle-less `package-detection` root on or off
+* (`applyPackageZoneActivation`), which changes the step TREE, so the live
+* attach must be re-resolved rather than wait for the next natural attach.
+* It goes through the one owner of an attach's steps (D650) on the device the
+* camera is already elected onto — a bare re-resolve here used to gate on the
+* node DEFAULT format and drop the device's provisioning and jump roster.
+*/
+/** No-op for a camera that is not placed or has no ledger config. Never throws. */
+async function reattachAfterPackageZoneChange(deps, deviceId) {
+	const assignment = deps.ledger.getAssignment(deviceId);
+	const cached = deps.ledger.getConfig(deviceId);
+	if (!assignment || !cached) return;
+	const nodeId = assignment.agentNodeId;
+	try {
+		const outcome = await deps.resolveAttachPipeline({
+			deviceId,
+			nodeId,
+			deviceKey: cached.deviceKey
 		});
-	}
-	const roots = [];
-	for (const [addonId, node] of nodes) {
-		const inputs = metaById.get(addonId).inputClasses;
-		if (!inputs || inputs.length === 0) {
-			roots.push(node);
-			continue;
-		}
-		let parent = null;
-		for (const [candidateId, candidateNode] of nodes) {
-			if (candidateId === addonId) continue;
-			if (metaById.get(candidateId).outputClasses.some((c) => inputs.includes(c))) {
-				parent = candidateNode;
-				break;
-			}
-		}
-		if (parent) parent.children.push(node);
-	}
-	return roots;
-}
-/**
-* Back-fill catalog steps EXPLICITLY flagged `backfillIntoExistingOverrides`
-* but ENTIRELY ABSENT from an existing step tree — reconciles a stored
-* wholesale `pipelineByAgent` snapshot with genuinely-new default steps.
-*
-* Why it's needed: a `pipelineByAgent` wholesale override SNAPSHOTS the full
-* tree. A step introduced AFTER the snapshot (e.g. `clip-embedding` for object
-* semantic search) would otherwise never reach that camera.
-*
-* Why the flag (not `enabledByDefault`): absence-from-a-snapshot is ambiguous —
-* it can mean "predates this step" OR "operator deliberately pruned it". A
-* broad "back-fill every default-on step" would resurrect deliberate removals
-* of long-existing steps (face-detection, etc.), an operator-intent
-* regression. Only a step that opts in via `backfillIntoExistingOverrides`
-* (set on genuinely-new default steps ONLY) re-enters existing overrides.
-*
-* Non-destructive by design:
-*   - Only steps whose id is absent from the WHOLE tree are added. A step the
-*     operator has already seen — present anywhere, even `enabled: false` —
-*     is left exactly as-is (its enabled flag is honoured).
-*   - Only `backfillIntoExistingOverrides === true` addons are candidates.
-*     Every other step (including long-standing default-on members) is left
-*     untouched, so a deliberately-pruned override stays pruned.
-*   - Audio-classifier addons are skipped — audio lives in
-*     `CameraPipelineConfig.audio`, never in the video `steps` tree.
-*   - A candidate attaches by catalog compat (its `inputClasses` overlap a
-*     present node's `outputClasses`), mirroring {@link buildTreeFromAddons}.
-*     A candidate with non-empty `inputClasses` and NO compatible parent is
-*     dropped (never re-rooted) so a crop-scoped embedder never regresses to
-*     running on the full frame. Empty `inputClasses` ⇒ a genuine root step.
-*/
-function mergeEnabledByDefaultSteps(steps, catalog) {
-	if (steps.length === 0) return steps;
-	const present = /* @__PURE__ */ new Set();
-	const collect = (nodes) => {
-		for (const n of nodes) {
-			present.add(n.addonId);
-			if (n.children?.length) collect(n.children);
-		}
-	};
-	collect(steps);
-	const catalogById = /* @__PURE__ */ new Map();
-	for (const slot of catalog.slots) for (const addon of slot.addons) catalogById.set(addon.id, addon);
-	const newRoots = [];
-	const childrenByParent = /* @__PURE__ */ new Map();
-	for (const slot of catalog.slots) {
-		if (slot.id === "audio-classifier") continue;
-		for (const addon of slot.addons) {
-			if (addon.backfillIntoExistingOverrides !== true) continue;
-			if (present.has(addon.id)) continue;
-			const node = {
-				addonId: addon.id,
-				enabled: true,
-				children: []
-			};
-			const inputs = addon.inputClasses;
-			if (!inputs || inputs.length === 0) {
-				newRoots.push(node);
-				continue;
-			}
-			let parentId = null;
-			for (const presentId of present) {
-				const meta = catalogById.get(presentId);
-				if (!meta) continue;
-				if (meta.outputClasses.some((c) => inputs.includes(c))) {
-					parentId = presentId;
-					break;
+		if (outcome.kind === "root-refused") {
+			deps.logger.error("package zone-rule re-attach refused — the elected device cannot run the camera root", {
+				tags: {
+					deviceId,
+					nodeId
+				},
+				meta: {
+					deviceKey: outcome.deviceKey ?? null,
+					droppedRoots: outcome.droppedRoots.join(",")
 				}
-			}
-			if (!parentId) continue;
-			const list = childrenByParent.get(parentId) ?? [];
-			list.push(node);
-			childrenByParent.set(parentId, list);
+			});
+			return;
 		}
+		const next = withAttachPipeline(cached, outcome.pipeline);
+		deps.ledger.setConfig(deviceId, next);
+		await deps.attachOn(nodeId, next);
+	} catch (err) {
+		deps.logger.warn("package zone-rule change re-dispatch failed", {
+			tags: {
+				deviceId,
+				nodeId
+			},
+			meta: { error: errMsg$1(err) }
+		});
 	}
-	if (childrenByParent.size === 0 && newRoots.length === 0) return steps;
-	const attach = (nodes) => nodes.map((n) => {
-		const rebuiltChildren = attach(n.children ?? []);
-		const extra = childrenByParent.get(n.addonId) ?? [];
-		const mergedChildren = [...rebuiltChildren, ...extra];
-		return mergedChildren.length > 0 ? {
-			...n,
-			children: mergedChildren
-		} : n;
-	});
-	return [...attach(steps), ...newRoots];
 }
 //#endregion
 //#region src/node-step-settings-fold.ts
@@ -56063,6 +57081,10 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 		this.deps = deps;
 	}
 	disposed = false;
+	/** Whether `dispose()` has run — a `null` catalog from a bounded wait means "not answered" only while this is false. */
+	isDisposed() {
+		return this.disposed;
+	}
 	/** Called once from the addon's `onShutdown()`. Idempotent. */
 	dispose() {
 		this.disposed = true;
@@ -56354,35 +57376,140 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	}
 	catalogCache = /* @__PURE__ */ new Map();
 	/**
-	* Public, non-blocking accessor for a node's cached `PipelineSchema` (the
-	* balancer's root-capability guard reads the object-detection model set from
-	* it). Returns `null` on cold start / unreachable node — the caller
-	* fails-open. Never blocks (unlike {@link waitForAgentAndCatalog}).
+	* A node's `PipelineSchema`: the cached answer when fresh, else ONE live
+	* `getSchema` RPC (bounded by the transport's request timeout, not by this
+	* store). `null` when that read fails. Unlike {@link waitForAgentAndCatalog}
+	* it does not retry; unlike {@link peekCatalogForAgent} it DOES wait for the
+	* node — use the peek on any path that must never wait.
 	*/
 	async getCatalogForNode(nodeId) {
 		return this.getCatalogForAgent(nodeId);
 	}
+	/**
+	* The node's catalog for a LIVE eligibility read, in one of two explicit
+	* modes (D650 round 3, bounded in the pre-ship review):
+	*  - `unbounded` — WAIT until the node's executor answers, the same
+	*    loss-proof reconcile the resolve uses ({@link awaitExecutorCatalog}).
+	*    For a FIRST placement, which will wait for this catalog to resolve its
+	*    pipeline anyway: electing against it too keeps the root guard from
+	*    failing open. `null` only when the store is disposed mid-wait.
+	*  - `one-round` — ONE reconcile round (one `getSchema`, no acquire wait).
+	*    `null` means "not answered". For a read nothing waits on — a background
+	*    refresher — where the unbounded form is a loop that outlives the node
+	*    it is asking (D3): a `getSchema` plus a 30 s acquire per round and a
+	*    WARN every round, for as long as the key is held.
+	*/
+	async awaitCatalogForNode(nodeId, wait) {
+		return this.awaitExecutorCatalog(nodeId, wait === "one-round" ? { maxRounds: 1 } : {});
+	}
+	/**
+	* Per-node catalog generation. {@link invalidateCatalog} bumps it; a
+	* refresh records its answer only if the generation it started under is
+	* still current, so a read that began BEFORE an invalidation can never
+	* re-install the catalog the invalidation just removed.
+	*/
+	catalogGeneration = /* @__PURE__ */ new Map();
+	/** Bumped by a full {@link invalidateCatalog}; part of every node's generation. */
+	catalogEpoch = 0;
+	catalogGenerationOf(nodeId) {
+		return `${this.catalogEpoch}:${this.catalogGeneration.get(nodeId) ?? 0}`;
+	}
+	/** Nodes whose last catalog read FAILED — the warn fires once per failing stretch. */
+	catalogReadFailing = /* @__PURE__ */ new Set();
+	/** Nodes being served a catalog past its TTL — the warn fires once per stale stretch. */
+	catalogServedStale = /* @__PURE__ */ new Set();
+	/** Nodes with a background catalog refresh in flight (single-flight per node). */
+	catalogRefreshInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A catalog served this far past its TTL is WORTH a warn: its background
+	* refresh has not landed in ten refresh windows. Below this, serving past
+	* the TTL is by construction — the re-place sweep runs every 60 s against a
+	* 30 s TTL, so every round finds the entry expired and refreshes it behind
+	* the read — and a line per round said nothing (pre-ship review, M5).
+	*/
+	static CATALOG_STALE_WARN_MS = 5 * 6e4;
+	/**
+	* Cache-only catalog read — NEVER awaits the node (D650 round 2). Serves
+	* the last answer the node gave, even past its TTL (a stale catalog is a
+	* structure that was true a minute ago; its absence is a camera left
+	* pending), and starts ONE background {@link getCatalogForAgent} when the
+	* entry is missing or expired, so the next caller sees a fresh answer.
+	* Returns `null` only when the node has never answered.
+	*/
+	peekCatalogForAgent(nodeId) {
+		const hit = this.catalogCache.get(`${nodeId}::*`);
+		const ageMs = hit === void 0 ? null : Date.now() - hit.at;
+		const fresh = ageMs !== null && ageMs < PipelineSettingsStore.CATALOG_CACHE_TTL_MS;
+		if (fresh) this.catalogServedStale.delete(nodeId);
+		else if (ageMs !== null && ageMs >= PipelineSettingsStore.CATALOG_STALE_WARN_MS && !this.catalogServedStale.has(nodeId)) {
+			this.catalogServedStale.add(nodeId);
+			this.deps.logger.warn("serving a node catalog long past its TTL — its refresh has not landed", {
+				tags: { nodeId },
+				meta: {
+					ageMs,
+					ttlMs: PipelineSettingsStore.CATALOG_CACHE_TTL_MS,
+					warnAfterMs: PipelineSettingsStore.CATALOG_STALE_WARN_MS
+				}
+			});
+		}
+		if (!fresh && !this.catalogRefreshInFlight.has(nodeId)) {
+			this.catalogRefreshInFlight.add(nodeId);
+			this.getCatalogForAgent(nodeId).finally(() => {
+				this.catalogRefreshInFlight.delete(nodeId);
+			});
+		}
+		return hit?.schema ?? null;
+	}
+	/**
+	* How many times one {@link getCatalogForAgent} call re-reads after its
+	* answer was fenced out by an invalidation, before it gives up (`null`, which
+	* the callers treat as "not answered"). Invalidations come from readiness
+	* epochs and operator resets — a bound, not a budget.
+	*/
+	static CATALOG_FENCE_REREADS = 3;
 	async getCatalogForAgent(nodeId) {
 		const api = this.deps.api();
 		if (!api) return null;
 		const engineKey = `${nodeId}::*`;
-		const now = Date.now();
-		const hit = this.catalogCache.get(engineKey);
-		if (hit && now - hit.at < PipelineSettingsStore.CATALOG_CACHE_TTL_MS) return hit.schema;
-		try {
-			const schema = await api.pipelineExecutor.getSchema.query({ nodeId });
-			this.catalogCache.set(engineKey, {
-				schema,
-				at: now
-			});
-			return schema;
-		} catch (err) {
-			this.deps.logger.debug("getCatalogForAgent failed", {
+		for (let reread = 0; !this.disposed; reread++) {
+			const now = Date.now();
+			const hit = this.catalogCache.get(engineKey);
+			if (hit && now - hit.at < PipelineSettingsStore.CATALOG_CACHE_TTL_MS) return hit.schema;
+			const generation = this.catalogGenerationOf(nodeId);
+			let schema;
+			try {
+				schema = await api.pipelineExecutor.getSchema.query({ nodeId });
+			} catch (err) {
+				if (!this.catalogReadFailing.has(nodeId)) {
+					this.catalogReadFailing.add(nodeId);
+					this.deps.logger.warn("node catalog read failed — placements on it wait or stay pending", {
+						tags: { nodeId },
+						meta: { error: errMsg$1(err) }
+					});
+				}
+				return null;
+			}
+			if (this.catalogReadFailing.delete(nodeId)) this.deps.logger.info("node catalog read recovered", { tags: { nodeId } });
+			if (this.catalogGenerationOf(nodeId) === generation) {
+				this.catalogCache.set(engineKey, {
+					schema,
+					at: now
+				});
+				return schema;
+			}
+			if (reread >= PipelineSettingsStore.CATALOG_FENCE_REREADS) {
+				this.deps.logger.warn("node catalog read fenced repeatedly — giving up this read", {
+					tags: { nodeId },
+					meta: { rereads: reread }
+				});
+				return null;
+			}
+			this.deps.logger.info("node catalog read fenced by an invalidation — re-reading", {
 				tags: { nodeId },
-				meta: { error: errMsg$1(err) }
+				meta: { reread: reread + 1 }
 			});
-			return null;
 		}
+		return null;
 	}
 	/**
 	* Consolidated catalog-cache invalidation (smell #21). Omit `nodeId` for
@@ -56394,9 +57521,11 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	*/
 	invalidateCatalog(nodeId) {
 		if (nodeId === void 0) {
+			this.catalogEpoch++;
 			this.catalogCache.clear();
 			return;
 		}
+		this.catalogGeneration.set(nodeId, (this.catalogGeneration.get(nodeId) ?? 0) + 1);
 		for (const key of Array.from(this.catalogCache.keys())) if (key.startsWith(`${nodeId}::`)) this.catalogCache.delete(key);
 	}
 	/**
@@ -56468,8 +57597,40 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	*
 	* Everything else (boot ordering, catalog cold-start, transient cap
 	* registration delay) loops with backoff until the catalog responds.
+	*
+	* `jumpDeviceKeys` (D650) are the node's OTHER enabled devices the runner
+	* may jump a detail step to — `jumpTargetKeys(roster)` of the SAME roster the
+	* attach carries. A detail step the elected device cannot run is kept when
+	* one of them can; empty ⇒ the elected format alone decides.
+	*/
+	async resolvePipelineForDevice(deviceId, agentNodeIdOverride, deviceKey, jumpDeviceKeys = []) {
+		const outcome = await this.resolvePipelineWithCatalog(deviceId, agentNodeIdOverride, deviceKey, jumpDeviceKeys, { kind: "await" });
+		if (outcome.kind === "resolved") return outcome.config;
+		throw new Error(`PipelineSettingsStore.resolvePipelineForDevice: catalog unavailable for "${outcome.nodeId}"`);
+	}
+	/**
+	* {@link resolvePipelineForDevice} with the gated-on roots the elected device
+	* cannot run (D650 round 3) — what an attach needs to refuse a camera whose
+	* own detector would not run. Waits for the catalog exactly as it does.
+	*/
+	async resolvePipelineForDeviceWithRoots(deviceId, agentNodeId, deviceKey, jumpDeviceKeys) {
+		const outcome = await this.resolvePipelineWithCatalog(deviceId, agentNodeId, deviceKey, jumpDeviceKeys, { kind: "await" });
+		if (outcome.kind === "resolved") return outcome;
+		throw new Error(`PipelineSettingsStore.resolvePipelineForDeviceWithRoots: catalog unavailable for "${outcome.nodeId}"`);
+	}
+	/**
+	* The NON-BLOCKING sibling of {@link resolvePipelineForDevice} (D650 round
+	* 2): the same resolution, but the node's catalog is read from the cache
+	* only ({@link peekCatalogForAgent}). A cold or unanswering node yields
+	* `catalog-unavailable` instead of a wait — the RETRY / re-place paths call
+	* this, so one wedged executor can never hold a sweep (D3: no waiting for a
+	* node; D49: never gate on a fallible read). A cold cache also starts one
+	* background refresh, so the next retry round finds the catalog.
 	*/
-	async resolvePipelineForDevice(deviceId, agentNodeIdOverride, deviceKey) {
+	async resolvePipelineForDeviceIfCatalogCached(deviceId, agentNodeId, deviceKey, jumpDeviceKeys) {
+		return this.resolvePipelineWithCatalog(deviceId, agentNodeId, deviceKey, jumpDeviceKeys, { kind: "cached" });
+	}
+	async resolvePipelineWithCatalog(deviceId, agentNodeIdOverride, deviceKey, jumpDeviceKeys, catalogRead) {
 		const agentNodeId = agentNodeIdOverride ?? this.deps.getAssignmentNode(deviceId);
 		if (!agentNodeId) throw new Error(`PipelineSettingsStore.resolvePipelineForDevice: no node resolvable for device ${deviceId}`);
 		if (!await this.isDetectionPipelineActive(deviceId)) {
@@ -56481,33 +57642,57 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 				meta: { reason: "detection-pipeline binding inactive" }
 			});
 			return {
-				steps: [],
-				audio: null
+				kind: "resolved",
+				config: {
+					steps: [],
+					audio: null
+				},
+				droppedRoots: []
 			};
 		}
 		const hasPackageZone = await this.deps.hasPackageZone(deviceId);
 		const cam = (await this.readCameraSettingsMap())[String(deviceId)] ?? null;
 		const wholesale = cam?.pipelineByAgent?.[agentNodeId];
 		if (wholesale) {
-			const catalog = await this.getCatalogForAgent(agentNodeId);
+			const catalog = catalogRead.kind === "await" ? await this.getCatalogForAgent(agentNodeId) : this.peekCatalogForAgent(agentNodeId);
 			const baseSteps = catalog ? mergeEnabledByDefaultSteps(wholesale.steps, catalog) : wholesale.steps;
 			return {
-				steps: baseSteps.length > 0 ? applyPackageZoneActivation(baseSteps, hasPackageZone) : baseSteps,
-				audio: wholesale.audio ? {
-					modelId: wholesale.audio.modelId,
-					enabled: wholesale.audio.enabled
-				} : null
+				kind: "resolved",
+				droppedRoots: [],
+				config: {
+					steps: baseSteps.length > 0 ? applyPackageZoneActivation(baseSteps, hasPackageZone) : baseSteps,
+					audio: wholesale.audio ? {
+						modelId: wholesale.audio.modelId,
+						enabled: wholesale.audio.enabled
+					} : null
+				}
+			};
+		}
+		let catalog;
+		if (catalogRead.kind === "await") catalog = (await this.waitForAgentAndCatalog(agentNodeId)).catalog;
+		else {
+			const cached = this.peekCatalogForAgent(agentNodeId);
+			if (!cached) return {
+				kind: "catalog-unavailable",
+				nodeId: agentNodeId
 			};
+			catalog = cached;
 		}
-		const { catalog } = await this.waitForAgentAndCatalog(agentNodeId);
 		const deviceFormat = deviceKey ? parseDeviceKey(deviceKey).format : catalog.selectedEngine.format;
-		const { config: resolvedBase, skipped } = resolvePipelineWithSkips(cam, agentNodeId, deviceFormat, catalog);
+		const jumpFormats = [...new Set(jumpDeviceKeys.map((k) => parseDeviceKey(k).format))];
+		const { config: resolvedBase, skipped, droppedRoots } = resolvePipelineWithSkips(cam, agentNodeId, deviceFormat, catalog, jumpFormats);
 		if (skipped.length > 0) this.deps.logger.warn("pipeline steps gated on but not provisioned on this node — skipped", {
 			tags: {
 				deviceId,
 				nodeId: agentNodeId
 			},
-			meta: { skipped: skipped.map((s) => `${s.addonId}:${s.reason}`).join(",") }
+			meta: {
+				skipped: skipped.map((s) => `${s.addonId}:${s.reason}`).join(","),
+				electedDeviceKey: deviceKey ?? null,
+				electedFormat: deviceFormat,
+				jumpDeviceKeys: jumpDeviceKeys.join(","),
+				why: "no enabled device of this node the step may run on ships a build for it (a root must run on the elected device; a detail step on the elected device or a jump-roster device)"
+			}
 		});
 		const resolved = {
 			...resolvedBase,
@@ -56524,7 +57709,11 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 				catalogSlotCount: catalog.slots?.length ?? 0
 			}
 		});
-		return resolved;
+		return {
+			kind: "resolved",
+			config: resolved,
+			droppedRoots
+		};
 	}
 	/**
 	* Loss-proof `pipeline-executor` gate (D8 — reconcile against the
@@ -56658,6 +57847,56 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 		return foldNodeStepSettings((await this.agentSettingsState.get())[nodeId]?.inferenceDevices, deviceKey);
 	}
 	/**
+	* The provisioning SOURCES of every device an attach may run a step on
+	* (D650): for each requested `deviceKey`, its per-(node,device) base (the
+	* same fold as {@link buildNodeInferenceDeviceSteps}) and the camera's
+	* override for that device (the same slot as {@link readCameraDeviceOverride}).
+	* ONE read of each blob for the whole set — the elected device and every
+	* jump target — instead of two reads per device. `''` is the default pool:
+	* its base is the node's folded settings and it has no camera override.
+	*/
+	async readDeviceProvisioning(deviceId, nodeId, deviceKeys) {
+		const [agentBlob, cameraMap] = await Promise.all([this.agentSettingsState.get(), this.readCameraSettingsMap()]);
+		const devices = agentBlob[nodeId]?.inferenceDevices;
+		const byDevice = cameraMap[String(deviceId)]?.stepOverridesByDevice?.[nodeId];
+		const out = /* @__PURE__ */ new Map();
+		for (const deviceKey of deviceKeys) {
+			const override = deviceKey === "" ? void 0 : byDevice?.[deviceKey];
+			out.set(deviceKey, {
+				base: foldNodeStepSettings(devices, deviceKey),
+				override: override ? { ...override } : {}
+			});
+		}
+		return out;
+	}
+	/** `${deviceId}:${stepId}` pairs already warned by {@link warnManualJumpsLeaveOverride}. */
+	warnedManualJumpOverride = /* @__PURE__ */ new Set();
+	/**
+	* WARN, once per (camera, step), that an operator `jumpDeviceKey` sends a
+	* step off the elected device while the camera has an override for that
+	* step ON the elected device (D650): the jumped step runs the TARGET's
+	* provisioning, so that override is not applied when the jump is taken.
+	*/
+	warnManualJumpsLeaveOverride(deviceId, nodeId, electedDeviceKey, steps) {
+		for (const { stepId, jumpDeviceKey } of steps) {
+			const key = `${deviceId}:${stepId}`;
+			if (this.warnedManualJumpOverride.has(key)) continue;
+			this.warnedManualJumpOverride.add(key);
+			this.deps.logger.warn("manual jumpDeviceKey leaves an elected-device override behind — the jumped step runs the target device provisioning", {
+				tags: {
+					deviceId,
+					nodeId
+				},
+				meta: {
+					step: stepId,
+					electedDeviceKey,
+					jumpDeviceKey,
+					hint: `move the camera's override for ${stepId} to ${jumpDeviceKey}, or drop the jumpDeviceKey`
+				}
+			});
+		}
+	}
+	/**
 	* Structural runtime check for `CameraPipelineConfig`. Persisted JSON
 	* may be stale or partial across upgrades, so we gate reads on shape
 	* rather than trusting the raw object. False = silently ignore that
@@ -57447,7 +58686,7 @@ var ReconcileController = class ReconcileController {
 					const cfg = this.deps.ledger.getConfig(deviceId);
 					if (!cfg) continue;
 					try {
-						const result = await this.deps.dispatchCamera(cfg);
+						const result = await this.deps.redispatchCamera(cfg);
 						retried++;
 						if (result.kind === "pending") stillPending++;
 					} catch (err) {
@@ -57558,7 +58797,7 @@ var ReconcileController = class ReconcileController {
 			});
 		});
 		this.deps.ledger.dropAssignment(deviceId, "silent");
-		await this.deps.dispatchCamera(cfg).catch((err) => {
+		await this.deps.redispatchCamera(cfg).catch((err) => {
 			this.deps.logger.warn("remote-health re-dispatch failed", {
 				tags: { deviceId },
 				meta: { error: errMsg$1(err) }
@@ -58041,7 +59280,7 @@ var TtlMemo = class {
 		});
 		if (entry && at - entry.readAt < this.ttlMs) return entry.value;
 		try {
-			return await this.read(key);
+			return await this.read(key, "miss");
 		} catch (err) {
 			if (entry) return entry.value;
 			throw err;
@@ -58073,7 +59312,7 @@ var TtlMemo = class {
 			ageMs: at - entry.readAt
 		};
 		const fallback = this.lastKnown.get(key);
-		const pending = this.read(key);
+		const pending = this.read(key, "miss");
 		if (fallback === void 0) return {
 			value: await pending,
 			stale: false,
@@ -58112,7 +59351,7 @@ var TtlMemo = class {
 	* is what re-warms a key immediately after {@link invalidate}.
 	*/
 	async refresh(key) {
-		await this.read(key).catch(() => void 0);
+		await this.read(key, "refresh").catch(() => void 0);
 	}
 	/**
 	* Re-read every key still in use and drop the ones nobody has asked for in
@@ -58138,12 +59377,16 @@ var TtlMemo = class {
 		this.generations.clear();
 		this.lastKnown.clear();
 	}
-	/** One shared in-flight read per key; stores the result on success. */
-	read(key) {
+	/**
+	* One shared in-flight read per key; stores the result on success. A
+	* refresh that finds a miss's read in flight joins it — the waiting caller
+	* chose to wait, and the refresher never awaits the promise it is handed.
+	*/
+	read(key, mode) {
 		const existing = this.inFlight.get(key);
 		if (existing) return existing;
 		const generation = this.generations.get(key) ?? 0;
-		const pending = this.opts.load(key).then((value) => {
+		const pending = this.opts.load(key, mode).then((value) => {
 			const at = this.now();
 			const stored = {
 				value,
@@ -58337,6 +59580,23 @@ var SessionDispatchController = class {
 	*/
 	motionWatchByDevice = /* @__PURE__ */ new Map();
 	/**
+	* The last session REFUSAL per camera (D650 rounds 3–4): the elected device
+	* could not run the camera root, so no session opened and nothing was
+	* recorded. Two readers:
+	*  - the refusal line fires once per CHANGE of this entry, not on every
+	*    motion edge (a camera re-elected onto the same device every few
+	*    seconds is one fact, not a log storm);
+	*  - the camera status reads it through {@link refusalReason} and shows
+	*    `pending:<reason>` in `reasons.detection`, where a STANDING camera's
+	*    pending reason already appears — an armed camera whose every session
+	*    is refused must not look like a healthy one waiting for motion.
+	* Deliberately NOT the ledger's `pendingReasons`: an entry there counts as a
+	* standing attach in {@link handleSessionMotion} and would freeze the camera
+	* idle — the trap `isIdleSessionCamera` (index.ts) flags. Cleared when a
+	* session opens and when the camera's detection is stopped.
+	*/
+	sessionRefusals = /* @__PURE__ */ new Map();
+	/**
 	* Per-device wall-clock of the last frame on which the tracker still had a
 	* subject — ANY tracked object, moving or stopped — while a session was
 	* active. The session-hold's only liveness input.
@@ -58357,6 +59617,15 @@ var SessionDispatchController = class {
 	*/
 	lastSubjectSeenAt = /* @__PURE__ */ new Map();
 	/**
+	* Per-device count of objects the TRACKER held on the last tracked frame of
+	* the active session — moving OR still (D652). Diagnostics only: it decides
+	* nothing. {@link lastSubjectSeenAt} is presence as the HOLD sees it, which
+	* the producer's stillness valve deliberately subtracts a still subject from;
+	* this is what lets a close say whether it ended tracks the tracker still
+	* had. Fed by {@link noteTrackedFrame}; pruned with the session.
+	*/
+	lastLiveTrackCount = /* @__PURE__ */ new Map();
+	/**
 	* Per-device count of "motion refired while the session was already
 	* active" no-ops since the current session was dispatched. Drives the
 	* SAMPLED debug line in the dispatch path: on a busy camera the refire
@@ -58382,7 +59651,7 @@ var SessionDispatchController = class {
 	agentLoads = new TtlMemo({ load: () => this.deps.loadService.collectAgentLoad({ onlyEnabled: true }) });
 	nodeCaps = new TtlMemo({ load: () => this.deps.settingsStore.buildNodeCaps() });
 	nodeWeights = new TtlMemo({ load: () => this.deps.settingsStore.buildNodeWeights() });
-	eligibleInferenceDevices = new TtlMemo({ load: (nodeId) => this.deps.getEligibleInferenceDevices(nodeId) });
+	eligibleInferenceDevices = new TtlMemo({ load: (nodeId, read) => this.deps.getEligibleInferenceDevices(nodeId, read === "refresh" ? "one-round" : "await-catalog") });
 	inferenceDeviceCaps = new TtlMemo({ load: (nodeId) => this.deps.getInferenceDeviceCaps(nodeId) });
 	/** Background refresher for {@link agentLoads} et al. Null until first use. */
 	balancerRefreshTimer = null;
@@ -58477,6 +59746,17 @@ var SessionDispatchController = class {
 		this.lastSubjectSeenAt.set(deviceId, at);
 	}
 	/**
+	* Record how many objects the tracker held on this frame — the count the
+	* close line reports as `liveTracks` (D652). Every tracked frame, not only
+	* the ones that hold the session: a still subject is exactly the case that
+	* stops holding it. No-op without an active session, which also bounds the
+	* map. Telemetry-lossy (D8): a dropped frame leaves the previous count.
+	*/
+	noteTrackedFrame(deviceId, liveTrackCount) {
+		if (!this.sessionRegistry.has(deviceId)) return;
+		this.lastLiveTrackCount.set(deviceId, liveTrackCount);
+	}
+	/**
 	* `sessionRegistry.has(deviceId)` — the closure other controllers (Task 3's
 	* standing-machinery guards, `index.ts`'s `isIdleSessionCamera`) consume
 	* instead of reaching into `sessionRegistry` directly.
@@ -58523,6 +59803,7 @@ var SessionDispatchController = class {
 			this.deps.dropAssignment(deviceId, "silent");
 			this.sessionRegistry.deregister(deviceId);
 			this.lastSubjectSeenAt.delete(deviceId);
+			this.lastLiveTrackCount.delete(deviceId);
 			this.notePlacementChanged();
 		});
 	}
@@ -58761,11 +60042,34 @@ var SessionDispatchController = class {
 			}
 		});
 		const deviceSelectedAt = Date.now();
-		const pipelineConfig = await this.deps.settingsStore.resolvePipelineForDevice(deviceId, targetNodeId, deviceKey);
-		const deviceBase = await this.deps.settingsStore.buildNodeInferenceDeviceSteps(targetNodeId, deviceKey ?? "");
-		const deviceOverride = deviceKey ? await this.deps.settingsStore.readCameraDeviceOverride(deviceId, targetNodeId, deviceKey) : {};
-		const steps = applyDeviceProvisioning(pipelineConfig.steps, deviceBase, deviceOverride);
-		const inferenceDevices = deviceKey && Object.keys(enabledDevices).length >= 2 ? buildInferenceDeviceRoster(enabledDevices, deviceCaps) : void 0;
+		const outcome = await resolveAttachPipeline({
+			deviceId,
+			nodeId: targetNodeId,
+			deviceKey,
+			eligible: enabledDevices,
+			caps: deviceCaps
+		}, this.deps.settingsStore);
+		if (outcome.kind === "root-refused") {
+			const reason = `root-unrunnable:${targetNodeId}/${outcome.deviceKey ?? "default-pool"}`;
+			if (this.sessionRefusals.get(deviceId) !== reason) {
+				this.sessionRefusals.set(deviceId, reason);
+				log.error("detection session refused — the elected device cannot run the camera root", {
+					tags: {
+						deviceId,
+						nodeId: targetNodeId
+					},
+					meta: {
+						reason,
+						deviceKey: outcome.deviceKey ?? null,
+						droppedRoots: outcome.droppedRoots.join(","),
+						hint: "the root is never jumped: enable a device on this node whose format ships the root model, or disable the device that cannot; said once until the refusal changes"
+					}
+				});
+			}
+			releaseGuard();
+			return null;
+		}
+		const pipeline = outcome.pipeline;
 		const zones = await this.deps.listZones(deviceId);
 		const sessionDetectionFps = detectionFpsForTrigger(config, trigger);
 		if (sessionDetectionFps !== config.detectionFps) log.info("session opened at the device-activity rate", { meta: {
@@ -58775,8 +60079,8 @@ var SessionDispatchController = class {
 		} });
 		const sessionConfig = {
 			deviceId,
-			...deviceKey ? { deviceKey } : {},
-			...inferenceDevices ? { inferenceDevices } : {},
+			...pipeline.deviceKey ? { deviceKey: pipeline.deviceKey } : {},
+			...pipeline.inferenceDevices ? { inferenceDevices: pipeline.inferenceDevices } : {},
 			motionCooldownMs: config.motionCooldownMs,
 			motionFps: config.motionFps,
 			detectionFps: sessionDetectionFps,
@@ -58784,8 +60088,8 @@ var SessionDispatchController = class {
 			detectionStreamId: config.detectionStreamId,
 			motionSources: [],
 			pipelineEnabled: config.pipelineEnabled,
-			steps,
-			audio: pipelineConfig.audio ?? null,
+			steps: pipeline.steps,
+			audio: pipeline.audio,
 			zones,
 			detectionMode: "always-on",
 			audioMode: config.audioMode,
@@ -58804,6 +60108,13 @@ var SessionDispatchController = class {
 			attachedAt = Date.now();
 			this.deps.recordAssignment(deviceId, targetNodeId, decision.reason, decision.reason === "manual");
 			this.sessionRegistry.register(deviceId, targetNodeId, Date.now(), deviceKey);
+			if (this.sessionRefusals.delete(deviceId)) log.info("detection session refusal cleared — a session opened", {
+				tags: {
+					deviceId,
+					nodeId: targetNodeId
+				},
+				meta: deviceKey ? { deviceKey } : {}
+			});
 			this.recheck?.noteSessionDispatched(deviceId, targetNodeId, sessionConfig);
 			log.info("detection session: dispatched on motion", {
 				tags: {
@@ -58812,9 +60123,7 @@ var SessionDispatchController = class {
 				},
 				meta: {
 					reason: decision.reason,
-					...deviceKey ? { deviceKey } : {},
-					...Object.keys(deviceBase).length > 0 ? { deviceBase } : {},
-					...Object.keys(deviceOverride).length > 0 ? { deviceOverride } : {}
+					...deviceKey ? { deviceKey } : {}
 				}
 			});
 		} finally {
@@ -58978,6 +60287,8 @@ var SessionDispatchController = class {
 		this.deps.dropAssignment(deviceId, "unassigned");
 		this.sessionRegistry.deregister(deviceId);
 		this.lastSubjectSeenAt.delete(deviceId);
+		const liveTracks = this.lastLiveTrackCount.get(deviceId) ?? null;
+		this.lastLiveTrackCount.delete(deviceId);
 		this.activeRefireCountByDevice.delete(deviceId);
 		this.notePlacementChanged();
 		const { openForMs, sinceSubjectSeenMs, maxHoldMs } = observed;
@@ -58988,6 +60299,7 @@ var SessionDispatchController = class {
 			openForMs,
 			sinceSubjectSeenMs,
 			subjectPresent,
+			liveTracks,
 			maxHoldMs,
 			minOpenMs: MIN_SESSION_OPEN_MS,
 			subjectStaleMs: SUBJECT_PRESENT_STALE_MS
@@ -58999,6 +60311,17 @@ var SessionDispatchController = class {
 			});
 			return;
 		}
+		if (liveTracks !== null && liveTracks > 0) {
+			const designedValve = sinceSubjectSeenMs !== null;
+			const line = reason === "motion_cleared" ? "detection session: closed on motion clear while the tracker was still tracking a subject — its live tracks end here" : "detection session: closed after motion cooldown while the tracker was still tracking a subject — its live tracks end here";
+			const extras = {
+				tags: { nodeId: session.nodeId },
+				meta
+			};
+			if (designedValve) log.info(line, extras);
+			else log.warn(line, extras);
+			return;
+		}
 		log.info(reason === "motion_cleared" ? "detection session: closed on motion clear" : "detection session: closed after motion cooldown", {
 			tags: { nodeId: session.nodeId },
 			meta
@@ -59044,6 +60367,14 @@ var SessionDispatchController = class {
 	* down too, since it reads `sessionRegistry` fresh at the top of this same
 	* callback).
 	*/
+	/**
+	* Why this camera's LAST on-motion session was refused, or `undefined` when
+	* it was not (or a session has opened since). The camera status renders it
+	* as `pending:<reason>` — see `sessionRefusals`.
+	*/
+	refusalReason(deviceId) {
+		return this.sessionRefusals.get(deviceId);
+	}
 	async stopForDevice(deviceId) {
 		await this.sessionLocks.run(deviceId, async () => {
 			const session = this.sessionRegistry.get(deviceId);
@@ -59063,6 +60394,8 @@ var SessionDispatchController = class {
 			}
 			this.deps.dropActiveDetection(deviceId);
 			this.lastSubjectSeenAt.delete(deviceId);
+			this.lastLiveTrackCount.delete(deviceId);
+			this.sessionRefusals.delete(deviceId);
 			this.recheck?.forget(deviceId);
 		});
 		const watchNodeId = this.motionWatchByDevice.get(deviceId);
@@ -59103,6 +60436,8 @@ var SessionDispatchController = class {
 		this.sessionRegistry.clear();
 		this.motionWatchByDevice.clear();
 		this.lastSubjectSeenAt.clear();
+		this.lastLiveTrackCount.clear();
+		this.sessionRefusals.clear();
 		if (this.balancerRefreshTimer !== null) {
 			clearInterval(this.balancerRefreshTimer);
 			this.balancerRefreshTimer = null;
@@ -60072,7 +61407,8 @@ async function buildOrchestratorControllers(deps) {
 		watchdog: () => pipelineWatchdog,
 		localNodeId: () => localNodeId,
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
-		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId, "await-catalog"),
+		getEligibleInferenceDevicesIfCached: (nodeId) => deps.getEligibleInferenceDevicesIfCached(nodeId),
 		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
@@ -60108,7 +61444,7 @@ async function buildOrchestratorControllers(deps) {
 		},
 		listZones: async (deviceId) => await zonesProvider?.listZones({ deviceId }) ?? [],
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
-		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		getEligibleInferenceDevices: (nodeId, read) => deps.getEligibleInferenceDevices(nodeId, read),
 		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
@@ -60151,7 +61487,7 @@ async function buildOrchestratorControllers(deps) {
 		getAudioAssignment: (deviceId) => audio.getAssignment(deviceId),
 		getCameraConfig: (deviceId) => ledger.getConfig(deviceId),
 		hasCameraConfig: (deviceId) => ledger.hasConfig(deviceId),
-		getPendingReason: (deviceId) => ledger.getPendingReason(deviceId),
+		getPendingReason: (deviceId) => ledger.getPendingReason(deviceId) ?? session.refusalReason(deviceId),
 		assignSource: (deviceId) => topology.assignSource(deviceId),
 		listAssignedDeviceIds: () => [...new Set([...ledger.listAssignedDeviceIds(), ...detectionWiring.activeDeviceIds()])],
 		isSessionCamera: (deviceId) => deps.isSessionCamera(deviceId),
@@ -60169,7 +61505,7 @@ async function buildOrchestratorControllers(deps) {
 		logger: deps.ctx().logger,
 		handleDeviceRegistered: (deviceId) => deps.handleDeviceRegistered(deviceId),
 		handleDeviceUnregistered: (deviceId) => deps.handleDeviceUnregistered(deviceId),
-		dispatchCamera: (config) => deps.dispatchCamera(config),
+		redispatchCamera: (config) => placement.redispatchCamera(config),
 		detachOn: (nodeId, deviceId) => deps.detachOn(nodeId, deviceId),
 		localNodeId: () => localNodeId,
 		activeDeviceIds: () => detectionWiring.activeDeviceIds(),
@@ -60199,6 +61535,7 @@ async function buildOrchestratorControllers(deps) {
 		loadService,
 		settingsStore,
 		attachOn: (nodeId, config) => deps.attachOn(nodeId, config),
+		resolveAttachPipeline: (input) => placement.resolveAttachPipelineOnDevice(input),
 		rebalance: (opts) => deps.rebalance(opts),
 		scheduleReconcile: () => reconcile.scheduleReconcile(),
 		schedulePendingRetry: () => reconcile.schedulePendingRetry(),
@@ -60217,6 +61554,7 @@ async function buildOrchestratorControllers(deps) {
 		if (!nodeId.includes("/")) topology.removeKnownRunnerNode(nodeId);
 		nodeLifecycle.unsubscribeDetectionPipelineReadiness(nodeId);
 		audio.markNodeOffline(nodeId);
+		deps.forgetInferenceDeviceProbe(nodeId);
 		nodeLifecycle.handleNodeDisconnect(nodeId).catch((err) => {
 			const msg = errMsg$1(err);
 			deps.ctx().logger.error("failover after disconnect failed", {
@@ -60332,26 +61670,12 @@ async function buildOrchestratorControllers(deps) {
 		fetchDevice: (deviceId) => deps.ctx().fetchDevice(deviceId),
 		onRulesChanged: (deviceId, stage) => {
 			if (stage !== "package") return;
-			const assignment = ledger.getAssignment(deviceId);
-			const cached = ledger.getConfig(deviceId);
-			if (!assignment || !cached) return;
-			settingsStore.resolvePipelineForDevice(deviceId, assignment.agentNodeId).then((resolved) => {
-				const next = {
-					...cached,
-					steps: resolved.steps,
-					audio: resolved.audio ?? null
-				};
-				ledger.setConfig(deviceId, next);
-				return deps.attachOn(assignment.agentNodeId, next);
-			}).catch((err) => {
-				deps.ctx().logger.warn("package zone-rule change re-dispatch failed", {
-					tags: {
-						deviceId,
-						nodeId: assignment.agentNodeId
-					},
-					meta: { error: errMsg$1(err) }
-				});
-			});
+			reattachAfterPackageZoneChange({
+				ledger,
+				resolveAttachPipeline: (input) => placement.resolveAttachPipelineOnDevice(input),
+				attachOn: (nodeId, config) => deps.attachOn(nodeId, config),
+				logger: deps.ctx().logger
+			}, deviceId);
 		}
 	});
 	zoneRulesProviderRef = zoneRulesProvider;
@@ -60415,6 +61739,7 @@ async function buildOrchestratorControllers(deps) {
 		getActiveDetectionConfig: (deviceId) => detectionWiring.getActiveDetectionConfig(deviceId),
 		handleSessionMotion: (deviceId, detected, emittedAt) => session.handleSessionMotion(deviceId, detected, emittedAt),
 		noteSessionSubjectPresent: (deviceId) => session.noteSubjectPresent(deviceId),
+		noteSessionTrackedFrame: (deviceId, liveTrackCount) => session.noteTrackedFrame(deviceId, liveTrackCount),
 		noteWatchdogSignal: (deviceId, stage) => pipelineWatchdog?.noteSignal(deviceId, stage)
 	});
 	reconcile.scheduleReconcile();
@@ -61139,6 +62464,15 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	/** This node's Moleculer nodeId (from this.ctx.kernel.localNodeId). */
 	localNodeId = "hub";
 	/**
+	* A shutdown latch for {@link getClusterModelChoice} (D651): cleared on the
+	* first line of `onShutdown`, so an owner that is tearing down stops
+	* answering. Set at the end of `onInitialize`; it is also false before that,
+	* but nothing can call the method then — the cap provider is registered
+	* from what `onInitialize` RETURNS, so the pre-init state is unreachable and
+	* not a claim this flag makes.
+	*/
+	clusterModelChoiceReady = false;
+	/**
 	* Single owner of the shared placement state (`assignments`/`cameraConfigs`/
 	* `pendingReasons`/`dispatchingDevices`) — see `placement-ledger.ts` (S6
 	* extraction). Constructed FIRST in `onInitialize` (several other
@@ -61383,7 +62717,9 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			attachOn: (nodeId, config) => this.attachOn(nodeId, config),
 			detachOn: (nodeId, deviceId) => this.detachOn(nodeId, deviceId),
 			readPipelinePin: (deviceId) => this.readPipelinePin(deviceId),
-			getEligibleInferenceDevices: (nodeId) => this.resolveEligibleInferenceDevices(nodeId),
+			getEligibleInferenceDevices: (nodeId, read) => this.resolveEligibleInferenceDevices(nodeId, read),
+			getEligibleInferenceDevicesIfCached: (nodeId) => this.resolveEligibleInferenceDevicesIfCached(nodeId),
+			forgetInferenceDeviceProbe: (nodeId) => this.forgetInferenceDeviceProbe(nodeId),
 			isNodeInferenceUsable: (nodeId) => this.isNodeInferenceUsable(nodeId),
 			getInferenceDeviceCaps: (nodeId) => this.getInferenceDeviceCaps(nodeId),
 			readPipelineDevicePin: (deviceId) => this.readPipelineDevicePin(deviceId),
@@ -61410,7 +62746,6 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			state: this.state.bind(this),
 			rebalance: (opts) => this.rebalance(opts),
 			setCameraPipelineForAgent: (input) => this.setCameraPipelineForAgent(input),
-			dispatchCamera: (config) => this.dispatchCamera(config),
 			maintenancePaused: () => this.storageMigrationLeaseId !== null,
 			setTopology: (topology) => {
 				this.topology = topology;
@@ -61455,6 +62790,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.autoRebalanceTimer = controllers.autoRebalanceTimer;
 		this.nodeStressLts = controllers.nodeStressLts;
 		this.nodeStressLtsTimer = controllers.nodeStressLtsTimer;
+		const widgetsProvider = { listWidgets: async () => pipelineOrchestratorWidgets };
+		this.clusterModelChoiceReady = true;
 		return {
 			providers: [
 				{
@@ -61475,7 +62812,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				},
 				{
 					capability: addonWidgetsSourceCapability,
-					provider: { listWidgets: async () => pipelineOrchestratorWidgets }
+					provider: widgetsProvider
 				},
 				{
 					capability: viewerUiCapability,
@@ -61524,6 +62861,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		};
 	}
 	async onShutdown() {
+		this.clusterModelChoiceReady = false;
 		this.audio.beginShutdown();
 		this.session.shutdown();
 		if (this.pendingRetryTimer !== null) {
@@ -61669,6 +63007,16 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* a server restart that rehydrates assignments from disk without
 	* re-dispatching).
 	*/
+	/**
+	* The operator's stored model choice for a cluster-scoped step (D651).
+	* Answers `owner-not-ready` from the first line of `onShutdown`: an owner
+	* that is tearing down must not answer at all. (Before `onInitialize`
+	* returns nobody can reach this method — see `clusterModelChoiceReady`.)
+	*/
+	async getClusterModelChoice(input) {
+		if (!this.clusterModelChoiceReady) return decideClusterModelChoice(input.stepId, "owner-not-ready");
+		return decideClusterModelChoice(input.stepId, await this.readStoredGlobalKey(clusterModelSettingKey(input.stepId)));
+	}
 	async getAgentLoad() {
 		await this.loadService.refreshDecodeHwaccels();
 		await this.loadService.collectAgentLoad();
@@ -61785,6 +63133,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async evaluateRemoteAssignmentHealth() {
 		return this.reconcile.evaluateRemoteAssignmentHealth();
 	}
+	/**
+	* Thin seam onto `ReconcileController.retryPendingDispatches` — the same
+	* `protected` pattern, for `pending-retry-catalog-wedge.spec.ts` to run one
+	* sweep and bound it.
+	*/
+	async retryPendingDispatches() {
+		return this.reconcile.retryPendingDispatches();
+	}
 	async getCapabilityBindings(input) {
 		if (!this.ctx?.settings) return {};
 		return this.settingsStore.getCapabilityBindings(input.nodeId);
@@ -61867,6 +63223,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			success: true,
 			removed: false
 		};
+		this.forgetInferenceDeviceProbe(input.agentNodeId);
 		await this.topology.refreshNodeCapabilities();
 		this.ctx.logger.info("agentSettings entry removed", { tags: { nodeId: input.agentNodeId } });
 		return {
@@ -62068,12 +63425,110 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* the runner uses its single default accelerator. NEVER throws (an
 	* unreachable probe yields no eligible devices).
 	*/
-	async resolveEligibleInferenceDevices(nodeId) {
-		const stored = (await this.settingsStore.readAgentSettingsMap())[nodeId]?.inferenceDevices ?? {};
-		const [{ probed }, poolHealth] = await Promise.all([this.probeNodeInferenceDevices(nodeId), this.probeNodeInferenceDeviceHealth(nodeId)]);
-		this.noteInferenceDeviceHealth(nodeId, poolHealth, probed.map((d) => d.key));
-		const catalog = await this.settingsStore.getCatalogForNode(nodeId);
-		const eligibility = resolveInferenceDeviceEligibility(probed, stored, catalog ? makeRootCapabilityGuard(catalog) : void 0, (deviceKey) => this.inferenceDeviceUsability.isUsable(nodeId, deviceKey));
+	async resolveEligibleInferenceDevices(nodeId, read) {
+		const [probe, poolHealth] = await Promise.all([this.probeNodeInferenceDevices(nodeId), this.probeNodeInferenceDeviceHealth(nodeId)]);
+		this.noteInferenceDeviceProbe(nodeId, probe, poolHealth);
+		const probed = probe.probed;
+		const catalog = await this.settingsStore.awaitCatalogForNode(nodeId, read === "one-round" ? "one-round" : "unbounded");
+		if (catalog === null && read === "one-round" && !this.settingsStore.isDisposed()) {
+			this.ctx.logger.debug("inference device eligibility: node catalog not answered in one round — last answer kept", {
+				tags: { nodeId },
+				meta: { nodeId }
+			});
+			throw new Error(`inference device eligibility: node "${nodeId}" catalog not answered`);
+		}
+		return this.electableDevices(nodeId, probed, catalog);
+	}
+	/**
+	* Forget a node's last device probe (pre-ship review, M4). Called when the
+	* node leaves (`AgentOffline`) and when the operator removes its settings: a
+	* node that comes back with a different accelerator set must be probed
+	* again, not elected against the list it left with.
+	*/
+	forgetInferenceDeviceProbe(nodeId) {
+		if (!this.lastInferenceDeviceProbe.delete(nodeId)) return;
+		this.ctx.logger.info("inference device probe forgotten — the node left", {
+			tags: { nodeId },
+			meta: { nodeId }
+		});
+	}
+	/**
+	* The NON-BLOCKING sibling of {@link resolveEligibleInferenceDevices}, for
+	* the RE-place paths (D650 round 3). Makes no live call to the node: the
+	* device list and the pool health are the last ones it answered, the
+	* catalog is the cached one. A node that has never answered any of them is
+	* `unavailable` — the camera stays pending, named, and ONE background
+	* refresh per node is started so the next round can place it. A cold cache
+	* never fails open here: failing open on a re-place is how a camera gets
+	* attached with no root.
+	*/
+	async resolveEligibleInferenceDevicesIfCached(nodeId) {
+		const known = this.lastInferenceDeviceProbe.get(nodeId);
+		if (known === void 0) {
+			this.refreshInferenceDeviceProbe(nodeId);
+			return {
+				kind: "unavailable",
+				nodeId,
+				what: "device-health"
+			};
+		}
+		const catalog = this.settingsStore.peekCatalogForAgent(nodeId);
+		if (catalog === null) return {
+			kind: "unavailable",
+			nodeId,
+			what: "catalog"
+		};
+		this.refreshInferenceDeviceProbe(nodeId);
+		return {
+			kind: "eligible",
+			eligible: await this.electableDevices(nodeId, known, catalog)
+		};
+	}
+	/**
+	* The last device list each node's probe returned — what the re-place paths
+	* elect against, with the pool-health mirror that probe updated. Written
+	* when a probe COMPLETES, so a cold entry means "the node's probe has never
+	* come back", never "came back with nothing".
+	*/
+	lastInferenceDeviceProbe = /* @__PURE__ */ new Map();
+	/** Nodes with a background device probe in flight (single-flight per node). */
+	inferenceProbeInFlight = /* @__PURE__ */ new Set();
+	refreshInferenceDeviceProbe(nodeId) {
+		if (this.inferenceProbeInFlight.has(nodeId)) return;
+		this.inferenceProbeInFlight.add(nodeId);
+		Promise.all([this.probeNodeInferenceDevices(nodeId), this.probeNodeInferenceDeviceHealth(nodeId)]).then(([probe, poolHealth]) => this.noteInferenceDeviceProbe(nodeId, probe, poolHealth)).finally(() => {
+			this.inferenceProbeInFlight.delete(nodeId);
+		});
+	}
+	/**
+	* Fold one COMPLETED probe into the pool-health mirror and the last-known
+	* list. "Completed" means the node ANSWERED: a probe that could not reach
+	* it (`reachable: false`) changes nothing (D49, round 4) — its empty device
+	* list is not an answer, and recording it as one both wiped a good
+	* last-known list and turned a never-answered node into an "answered with
+	* nothing" one, so `device-health-unavailable` stopped firing after a single
+	* failure. A health read that failed (`null`) changes no verdict in the
+	* mirror either, but it did come back — a node whose read never comes back
+	* at all is the one a re-place must not wait on, and that node never reaches
+	* this line.
+	*/
+	noteInferenceDeviceProbe(nodeId, probe, poolHealth) {
+		if (!probe.reachable) {
+			this.ctx.logger.debug("inference device probe unreachable — last known device list kept", {
+				tags: { nodeId },
+				meta: {
+					nodeId,
+					known: this.lastInferenceDeviceProbe.has(nodeId)
+				}
+			});
+			return;
+		}
+		this.noteInferenceDeviceHealth(nodeId, poolHealth, probe.probed.map((d) => d.key));
+		this.lastInferenceDeviceProbe.set(nodeId, probe.probed);
+	}
+	/** Eligibility from a device list + catalog; records usability like every dispatch read. */
+	async electableDevices(nodeId, probed, catalog) {
+		const eligibility = resolveInferenceDeviceEligibility(probed, (await this.settingsStore.readAgentSettingsMap())[nodeId]?.inferenceDevices ?? {}, catalog ? makeRootCapabilityGuard(catalog) : void 0, (deviceKey) => this.inferenceDeviceUsability.isUsable(nodeId, deviceKey));
 		const { eligible, excluded } = eligibility;
 		this.logInferenceDeviceShrinkage(nodeId, eligible, excluded);
 		this.noteNodeInferenceUsability(nodeId, resolveNodeInferenceUsability(eligibility));