@camstack/addon-pipeline-orchestrator 1.2.44 → 1.2.47

package/dist/index.mjs

@@ -8365,12 +8365,11 @@ var RecordingConfigSchema = object({
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One shape shared by the recorder's `relocateFootage` (segments) and
-* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
-* page renders both movers with one component. Jobs are in-RAM (a restart
-* forgets them — re-running is safe by construction: copy-if-absent, delete
-* after verify) and each completed/failed run also lands one durable ops-log
-* row on the owning addon's surface.
+* One shape shared by the recorder and pipeline-analytics internal movers.
+* The public admin surface is `storage-migration`; child jobs remain in RAM
+* because copy-if-absent, verify, delete and index/row repoint are resumable.
+* Each completed/failed run also lands one durable ops-log row on its owning
+* addon surface.
 */
 var RelocateJobStateSchema = _enum([
 	"running",
@@ -8397,19 +8396,100 @@ var RelocateJobSchema = object({
 	finishedAt: number().nullable(),
 	error: string().nullable()
 });
+/** Profile-derived footage selection used only by the migration coordinator:
+* `recordings` owns high+mid; `recordingsLow` owns low. */
+var RelocateFootageClassSchema = _enum(["recordings", "recordingsLow"]);
 var RelocateFootageInputSchema = object({
-	deviceId: number().optional(),
 	fromLocationId: string(),
 	toLocationId: string(),
 	entities: array(_enum(["segments"])).optional(),
+	/** Limits relocation to the logical profile class. Omit only for the
+	* pre-orchestration compatibility path. */
+	footageClass: RelocateFootageClassSchema.optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
 });
-var RelocateMediaInputSchema = object({
-	deviceId: number().optional(),
+/** Internal, lease-scoped participant operation. It is intentionally separate
+* from persistent recording settings: a migration never changes
+* `RecordingConfig.enabled` or camera wrapper bindings. */
+var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
+var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
+var StorageMigrationMediaMoveInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
+}).extend({ leaseId: string().min(1) });
+/** The independently selectable logical storage classes. `recordings`
+* encompasses the high and mid segment profiles; `recordingsLow` is low
+* segments; `eventMedia` is post-analysis blobs. */
+var StorageMigrationClassSchema = _enum([
+	"recordings",
+	"recordingsLow",
+	"eventMedia"
+]);
+/** A destination is always an existing, fully-qualified location id. The
+* migration API intentionally never changes a source location's `basePath`:
+* callers create a new `<type>:<slug>` location, then select it here. */
+var StorageMigrationDestinationsSchema = object({
+	recordings: string().min(1).optional(),
+	recordingsLow: string().min(1).optional(),
+	eventMedia: string().min(1).optional()
+}).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/** Shared input for planning and starting an orchestrated storage migration. */
+var StorageMigrationInputSchema = object({
+	destinations: StorageMigrationDestinationsSchema,
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/** The durable coordinator state machine. The only phase that changes default
+* locations is `repointing`, after every selected mover has completed and been
+* verified. */
+var StorageMigrationPhaseSchema = _enum([
+	"planning",
+	"pausing",
+	"moving",
+	"verifying",
+	"repointing",
+	"refreshing",
+	"resuming",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var StorageMigrationParticipantSchema = _enum([
+	"pipeline",
+	"recorder",
+	"analytics"
+]);
+var StorageMigrationMoveSchema = object({
+	storageClass: StorageMigrationClassSchema,
+	fromLocationId: string(),
+	toLocationId: string(),
+	moverJobId: string().nullable(),
+	state: RelocateJobStateSchema.nullable(),
+	error: string().nullable()
+});
+var StorageMigrationJobSchema = object({
+	jobId: string(),
+	phase: StorageMigrationPhaseSchema,
+	destinations: StorageMigrationDestinationsSchema,
+	throttleMbps: number(),
+	moves: array(StorageMigrationMoveSchema),
+	pauseLeaseId: string().nullable(),
+	pausedParticipants: array(StorageMigrationParticipantSchema),
+	repointed: boolean(),
+	cancelRequested: boolean(),
+	startedAt: number(),
+	updatedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var StorageMigrationPlanSchema = object({
+	destinations: StorageMigrationDestinationsSchema,
+	moves: array(object({
+		storageClass: StorageMigrationClassSchema,
+		fromLocationId: string(),
+		toLocationId: string()
+	}))
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -16851,13 +16931,19 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), EventPruneCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(RelocateJobSchema).readonly(), {
-	kind: "query",
+}), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ refreshed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationMediaMoveInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
 	auth: "admin"
-}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+}), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
@@ -18697,6 +18783,16 @@ var pipelineOrchestratorCapability = {
 	nodeIdMode: "data",
 	exposesDeviceSettings: true,
 	methods: {
+		/** Internal storage-migration participant lease. While held, dispatch
+		* requests are accepted as pending but no new runner attachment starts. */
+		pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Pin a camera's pipeline to a specific agent (L1 affinity).
 		* The orchestrator re-evaluates the assignment immediately and persists
@@ -19644,6 +19740,13 @@ method(object({ locationId: string() }), EvictableUsageSchema), method(object({
 	locationId: string(),
 	targetBytes: number().int().positive()
 }), EvictResultSchema, { kind: "mutation" });
+method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }), method(StorageMigrationInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ jobId: string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 var ProviderInfoSchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -19747,6 +19850,28 @@ var TerminalProfileInfoSchema = object({
 	label: string(),
 	description: string().optional()
 });
+/**
+* A durable operator-created Terminal instance. Profiles are templates; only
+* an instance declares a camera.
+*/
+var TerminalInstanceInfoSchema = object({
+	instanceId: string(),
+	cameraStableId: string(),
+	nodeId: string(),
+	profileId: string(),
+	profileLabel: string(),
+	name: string(),
+	enabled: boolean()
+});
+var TerminalLegacyCameraSchema = object({
+	stableId: string(),
+	nodeId: string(),
+	profileId: string(),
+	profileLabel: string(),
+	name: string(),
+	/** Only legacy monitor cameras can retain their historic stable identity. */
+	adoptable: boolean()
+});
 var TerminalOutputEventSchema = discriminatedUnion("kind", [object({
 	seq: number().int().positive(),
 	kind: literal("data"),
@@ -19763,7 +19888,29 @@ var TerminalOutputBatchSchema = object({
 	snapshot: string().optional(),
 	events: array(TerminalOutputEventSchema).readonly()
 });
-method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
+method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
+	targetNodeId: string().min(1),
+	profileId: string().min(1),
+	name: string().trim().min(1).max(160).optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ instanceId: string().min(1) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	enabled: boolean()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
+	stableId: string().min(1),
+	name: string().trim().min(1).max(160).optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
 	rows: number().int().positive()
@@ -19780,7 +19927,13 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(object({
 	sessionId: string(),
 	afterSeq: number().int().nonnegative(),
-	waitMs: number().int().min(0).max(2e3).default(0)
+	waitMs: number().int().min(0).max(2e3).default(0),
+	/**
+	* Wait when a just-opened session has no output yet. Kept opt-in so a
+	* browser's initial repaint remains immediate; the camera snapshot
+	* relay uses it to avoid encoding a blank startup frame.
+	*/
+	waitForOutput: boolean().optional()
 }), TerminalOutputBatchSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -21721,6 +21874,7 @@ var FaceInfoSchema = object({
 var FaceFilterEnum = _enum([
 	"unassigned",
 	"recognized",
+	"identified",
 	"all"
 ]);
 var MediaFileLiteSchema$1 = object({
@@ -21749,6 +21903,8 @@ method(_void(), array(IdentitySchema).readonly()), method(object({ name: string(
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
+	/** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+	deviceId: number().int().optional(),
 	limit: number().int().positive().optional(),
 	filter: FaceFilterEnum.optional(),
 	/**
@@ -23514,6 +23670,10 @@ var OsdSourceSchema = discriminatedUnion("kind", [
 		capName: string().min(1).max(64),
 		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
 		valuePath: string().min(1).max(64)
+	}),
+	object({
+		kind: literal("latest-recognition"),
+		recognition: _enum(["person", "plate"])
 	})
 ]);
 var OsdSlotBindingSchema = object({
@@ -23619,6 +23779,15 @@ method(object({ deviceId: number().int() }), object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	sourceDeviceId: number().int(),
+	targetDeviceId: number().int()
+}), object({
+	copied: number().int().nonnegative(),
+	skipped: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number().int(),
 	slotId: string().min(1),
@@ -24504,13 +24673,19 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(RelocateFootageInputSchema, object({ jobId: string() }), {
+}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(RelocateJobSchema).readonly(), {
-	kind: "query",
+}), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ refreshed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationFootageMoveInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
 	auth: "admin"
-}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+}), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -28709,6 +28884,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"osdManager.copyDeviceConfiguration": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osdManager.getConditionSupport": {
 		capName: "osd-manager",
 		capScope: "system",
@@ -28805,7 +28986,7 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.cancelMediaRelocate": {
+	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
@@ -28877,12 +29058,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineAnalytics.getMediaRelocateStatus": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28919,6 +29094,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getStorageMigrationMoveStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28997,6 +29178,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.pauseForStorageMigration": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29027,7 +29214,7 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.relocateMedia": {
+	"pipelineAnalytics.refreshStorageLocationsForMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
@@ -29039,6 +29226,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.resumeForStorageMigration": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29063,6 +29256,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.startStorageMigrationMove": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29429,6 +29628,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.pauseForStorageMigration": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.rebalance": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -29453,6 +29658,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.resumeForStorageMigration": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.saveTemplate": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -29849,7 +30060,7 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"recording.cancelRelocate": {
+	"recording.cancelStorageMigrationMove": {
 		capName: "recording",
 		capScope: "system",
 		addonId: null,
@@ -29885,7 +30096,7 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"recording.getRelocateStatus": {
+	"recording.getStorageMigrationMoveStatus": {
 		capName: "recording",
 		capScope: "system",
 		addonId: null,
@@ -29909,6 +30120,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.pauseForStorageMigration": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.pruneFootage": {
 		capName: "recording",
 		capScope: "system",
@@ -29927,7 +30144,7 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"recording.relocateFootage": {
+	"recording.refreshStorageLocationsForMigration": {
 		capName: "recording",
 		capScope: "system",
 		addonId: null,
@@ -29951,12 +30168,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.resumeForStorageMigration": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.setDeviceConfig": {
 		capName: "recording",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"recording.startStorageMigrationMove": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recordingExport.cancelExport": {
 		capName: "recordingExport",
 		capScope: "system",
@@ -30347,6 +30576,30 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageMigration.cancel": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.plan": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageMigration.start": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.status": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageProvider.abortUpload": {
 		capName: "storage-provider",
 		capScope: "system",
@@ -30725,12 +30978,42 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.adoptLegacyMonitor": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.close": {
 		capName: "terminal-session",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.createInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"terminalSession.deleteInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"terminalSession.listInstances": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"terminalSession.listLegacyCameras": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"terminalSession.listProfiles": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -30761,6 +31044,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.setInstanceEnabled": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -34671,6 +34960,48 @@ var DeviceFeaturesMirror = class {
 	}
 };
 //#endregion
+//#region src/watchdog-camera.ts
+/**
+* Derive the watchdog camera descriptor from a runner config. Captures which
+* stages are expected to flow CONTINUOUSLY (always-on audio, analyzer motion,
+* always-on detection) → the camStreamId feeding each. Audio has no dedicated
+* stream field on the runner config, so it shares the motion stream id.
+*
+* `pipelineEnabled === false` (the `object-detection` switch, D62/ADR-0109)
+* arms NOTHING: `startDetection` deliberately performs no attach and opens no
+* decode session for such a camera, so no continuous stage can ever produce a
+* signal. The camera is still returned (and still registered by the caller) so
+* its watchdog row stays visible — a switched-off camera must read as off, not
+* as broken.
+*
+* `hasAudioSource` is the caller's evidence that the camera's source actually
+* carries an audio track (`BrokerStats.audio !== null`). It fails OPEN: an
+* unknown or failed read passes `true`, because the audio stage is diagnostic
+* and a false negative silently stops watching a working camera.
+*/
+function buildWatchdogCamera(config, deviceName, hasAudioSource) {
+	const continuousStages = /* @__PURE__ */ new Map();
+	if (config.pipelineEnabled === false) return {
+		deviceId: config.deviceId,
+		deviceName,
+		audioMode: config.audioMode,
+		detectionMode: config.detectionMode,
+		motionSources: config.motionSources,
+		continuousStages
+	};
+	if (config.audioMode === "always-on" && hasAudioSource) continuousStages.set("audio", config.motionStreamId);
+	if (config.motionSources.includes("analyzer")) continuousStages.set("motion", config.motionStreamId);
+	if (config.detectionMode === "always-on") continuousStages.set("detection", config.detectionStreamId);
+	return {
+		deviceId: config.deviceId,
+		deviceName,
+		audioMode: config.audioMode,
+		detectionMode: config.detectionMode,
+		motionSources: config.motionSources,
+		continuousStages
+	};
+}
+//#endregion
 //#region src/detection-wiring-controller.ts
 var DetectionWiringController = class {
 	deps;
@@ -34875,7 +35206,8 @@ var DetectionWiringController = class {
 			await this.stopDetection(deviceId);
 		}
 		this.activeDetections.set(deviceId, config);
-		if (config.detectionMode === "on-motion") {
+		if (!config.pipelineEnabled) log.info("object detection switched off — no attach, no decode session", { meta: { detectionMode: config.detectionMode } });
+		else if (config.detectionMode === "on-motion") {
 			if (config.motionSources.includes("analyzer")) try {
 				await this.deps.session.ensureMotionWatch(deviceId, config);
 			} catch (err) {
@@ -34966,11 +35298,44 @@ var DetectionWiringController = class {
 		this.deps.forgetDeviceZones(deviceId);
 		this.deps.forgetDeviceZoneRules(deviceId);
 		this.deps.loadShed.forgetDevice(deviceId);
-		if (!this.deps.ctx().settings) return;
+		const settings = this.deps.ctx().settings;
+		if (!settings) return;
 		await this.deps.settingsStore.deleteCameraSettings(deviceId);
+		try {
+			await settings.clearDeviceStore(deviceId);
+		} catch (err) {
+			this.deps.logger.warn("failed to clear per-device orchestrator settings on removal", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
 		this.deps.logger.info("Purged pipeline config for removed device", { tags: { deviceId } });
 	}
 	/**
+	* True ONLY when the device registry positively answered "this device does
+	* not exist" (`getDevice` → `null`, per the cap contract).
+	*
+	* A FAILED read answers `false` — D49: a read that fails changes nothing, and
+	* the destructive direction here is refusing to run a live camera.
+	* Deliberately NOT routed through {@link lookupDeviceFeatures}'s mirror: that
+	* one treats missing-as-unknown on purpose (a provider restart passes through
+	* exactly that state and must not re-derive a battery camera's profile), and
+	* conflating the two would make a provider restart look like a deletion.
+	*/
+	async isDeviceDeleted(deviceId) {
+		const api = this.deps.api();
+		if (!api) return false;
+		try {
+			return await api.deviceManager.getDevice.query({ deviceId }) === null;
+		} catch (err) {
+			this.deps.logger.debug("device existence check failed — proceeding as before", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			return false;
+		}
+	}
+	/**
 	* Handle a profile-slot change: build a fresh detection config from
 	* per-device settings and start detection if motion is enabled.
 	* Fires on `camera-streams.onProfileSlotsChanged` — any publish,
@@ -34980,6 +35345,11 @@ var DetectionWiringController = class {
 		if (!this.deps.ctx()) return;
 		const log = this.deps.logger.withTags({ deviceId });
 		log.info("handleDeviceRegistered", { meta: { phase: "handleDeviceRegistered" } });
+		if (await this.isDeviceDeleted(deviceId)) {
+			log.warn("device no longer exists — refusing to start detection");
+			await this.handleDeviceUnregistered(deviceId);
+			return;
+		}
 		const config = await this.buildDetectionConfig(deviceId);
 		if (config === TRANSIENT_SLOT_READ) {
 			log.warn("Profile-slot read failed transiently — keeping detection, scheduling retry");
@@ -35119,28 +35489,17 @@ var DetectionWiringController = class {
 		});
 	}
 	/**
-	* Derive the watchdog camera descriptor from a runner config. Captures
-	* which stages are expected to flow CONTINUOUSLY (always-on audio,
-	* analyzer motion, always-on detection) → the camStreamId feeding each.
-	* Audio has no dedicated stream field on the runner config, so it shares
-	* the motion stream id.
+	* Derive the watchdog camera descriptor from a runner config — thin delegate
+	* onto the pure `buildWatchdogCamera` (`watchdog-camera.ts`), where the
+	* arming rules live (a switched-off camera arms nothing; the audio stage
+	* needs evidence of an audio track).
 	*
 	* Public — `PlacementService`'s `buildWatchdogCamera` closure (wired in
-	* `orchestrator-bootstrap.ts`) calls straight through to this method.
+	* `orchestrator-bootstrap.ts`) calls straight through to this method; the
+	* caller resolves `hasAudioSource` once per dispatch.
 	*/
-	buildWatchdogCamera(config, deviceName) {
-		const continuousStages = /* @__PURE__ */ new Map();
-		if (config.audioMode === "always-on") continuousStages.set("audio", config.motionStreamId);
-		if (config.motionSources.includes("analyzer")) continuousStages.set("motion", config.motionStreamId);
-		if (config.detectionMode === "always-on") continuousStages.set("detection", config.detectionStreamId);
-		return {
-			deviceId: config.deviceId,
-			deviceName,
-			audioMode: config.audioMode,
-			detectionMode: config.detectionMode,
-			motionSources: config.motionSources,
-			continuousStages
-		};
+	buildWatchdogCamera(config, deviceName, hasAudioSource) {
+		return buildWatchdogCamera(config, deviceName, hasAudioSource);
 	}
 	/**
 	* Watchdog recovery callback. Invoked when a camera's continuous stage
@@ -35153,7 +35512,7 @@ var DetectionWiringController = class {
 	* Public — `PipelineWatchdog`'s `recover` closure (wired in
 	* `orchestrator-bootstrap.ts`) calls straight through to this method.
 	*/
-	recoverPipelineStage(deviceId, stage, streamId) {
+	recoverPipelineStage(deviceId, stage, streamId, attempt) {
 		if (stage === "audio") {
 			const cfg = this.deps.ledger.getConfig(deviceId);
 			const audioCfg = cfg ? {
@@ -35167,6 +35526,14 @@ var DetectionWiringController = class {
 				});
 			});
 		}
+		this.deps.logger.debug("watchdog recovery: requesting source refresh", {
+			tags: { deviceId },
+			meta: {
+				stage,
+				camStreamId: streamId,
+				attempt
+			}
+		});
 		this.deps.eventBus.emit({
 			id: `watchdog-refresh-${deviceId}-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -35569,6 +35936,64 @@ function computeDispatchGap(desired, known) {
 	return [...desired].filter((id) => !known.has(id));
 }
 /**
+* Split the desired fleet (derived from broker profile slots) against the LIVE
+* device registry.
+*
+* The broker keeps a deleted device's profile-slot assignments forever, so
+* `desiredDeviceIdsFromSlots` alone re-proposes a camera the operator already
+* deleted — and the reconcile's gap-fill then resurrects it. Callers dispatch
+* `existing` only.
+*
+* The caller MUST NOT call this with a failed/partial registry read: a read
+* that fails changes nothing (D49), it never prunes the fleet.
+*/
+function splitDesiredByExistence(desired, liveDeviceIds) {
+	const existing = /* @__PURE__ */ new Set();
+	const vanished = /* @__PURE__ */ new Set();
+	for (const deviceId of desired) if (liveDeviceIds.has(deviceId)) existing.add(deviceId);
+	else vanished.add(deviceId);
+	return {
+		existing,
+		vanished
+	};
+}
+/**
+* Decide which vanished devices are CONFIRMED gone (D49's two-disagreements
+* rule). Teardown destroys work — stopping detection, releasing the camera and
+* purging its persisted config — so a single registry read is never enough: a
+* device must be missing in TWO consecutive reconcile passes before it is torn
+* down. Anything that puts the device back (a successful listing that contains
+* it, or a failed read the caller declines to act on) resets the streak, so the
+* count only ever advances on agreeing evidence.
+*
+* Teardown fires ONCE per vanish streak (`torn-down`) — the broker's slots
+* outlive the device, so it stays vanished on every later pass and would
+* otherwise be re-purged forever.
+*
+* Pure — the caller owns the (in-memory, boot-empty) state map.
+*/
+function reconcileVanishedDevices(vanished, prior) {
+	const tearDown = [];
+	const nextState = /* @__PURE__ */ new Map();
+	for (const deviceId of vanished) {
+		const state = prior.get(deviceId);
+		if (state === void 0) {
+			nextState.set(deviceId, "first-pass");
+			continue;
+		}
+		if (state === "first-pass") {
+			tearDown.push(deviceId);
+			nextState.set(deviceId, "torn-down");
+			continue;
+		}
+		nextState.set(deviceId, "torn-down");
+	}
+	return {
+		tearDown,
+		nextState
+	};
+}
+/**
 * Converge the orchestrator's `assignments` map to runner truth. Runner
 * attachments (`getLocalCameras`) are AUTHORITATIVE; this returns the actions
 * that make the map agree with them:
@@ -35715,11 +36140,17 @@ var PlacementService = class {
 	deps;
 	/** True while an auto-rebalance pass is running (skip overlap). */
 	autoRebalanceInFlight = false;
+	inFlightAttaches = 0;
+	idleWaiters = [];
 	constructor(deps) {
 		this.deps = deps;
 	}
 	async dispatchCamera(runnerConfig) {
 		if (!this.deps.ctx()) throw new Error("PipelineOrchestrator: dispatchCamera called before initialize");
+		if (this.deps.maintenancePaused?.() === true) return {
+			success: true,
+			kind: "pending"
+		};
 		const currentDeviceKey = this.deps.ledger.getConfig(runnerConfig.deviceId)?.deviceKey ?? null;
 		this.deps.ledger.setConfig(runnerConfig.deviceId, runnerConfig);
 		if (this.deps.loadShed.dispatchDeferralCheck(runnerConfig.deviceId)) return {
@@ -35810,7 +36241,10 @@ var PlacementService = class {
 		try {
 			await this.attachOn(targetNodeId, attachConfig);
 			this.deps.ledger.setConfig(runnerConfig.deviceId, attachConfig);
-			if (targetNodeId === this.deps.localNodeId()) this.deps.watchdog()?.register(this.deps.buildWatchdogCamera(runnerConfig, String(runnerConfig.deviceId)));
+			if (targetNodeId === this.deps.localNodeId()) {
+				const hasAudioSource = await this.resolveHasAudioSource(runnerConfig);
+				this.deps.watchdog()?.register(this.deps.buildWatchdogCamera(runnerConfig, String(runnerConfig.deviceId), hasAudioSource));
+			}
 			this.deps.ledger.recordAssignment(runnerConfig.deviceId, targetNodeId, reason, reason === "manual");
 		} finally {
 			dispatchGuard.dispose();
@@ -36110,6 +36544,7 @@ var PlacementService = class {
 	* an absent field would produce.
 	*/
 	async attachOn(nodeId, config) {
+		if (this.deps.maintenancePaused?.() === true) throw new Error("pipeline dispatch is paused for storage migration");
 		const ctx = this.deps.ctx();
 		const api = ctx.api;
 		if (!api) throw new Error(`attachOn(${nodeId}, ${config.deviceId}): this.ctx.api not available`);
@@ -36144,6 +36579,7 @@ var PlacementService = class {
 				meta: logMeta
 			});
 		}).catch(() => {});
+		this.inFlightAttaches++;
 		try {
 			await api.pipelineRunner.attachCamera.mutate({
 				...config,
@@ -36173,8 +36609,17 @@ var PlacementService = class {
 				});
 			}
 			throw err;
+		} finally {
+			this.inFlightAttaches--;
+			if (this.inFlightAttaches === 0) for (const resolve of this.idleWaiters.splice(0)) resolve();
 		}
 	}
+	/** Wait until every attach that began before the maintenance gate closed has
+	* settled. New attaches are rejected at the top of `attachOn`. */
+	waitForMigrationIdle() {
+		if (this.inFlightAttaches === 0) return Promise.resolve();
+		return new Promise((resolve) => this.idleWaiters.push(resolve));
+	}
 	async detachOn(nodeId, deviceId) {
 		const api = this.deps.ctx().api;
 		if (!api) return;
@@ -36225,7 +36670,20 @@ var PlacementService = class {
 			return;
 		}
 		await this.attachOn(nodeId, cached);
-		if (nodeId === this.deps.localNodeId()) this.deps.watchdog()?.register(this.deps.buildWatchdogCamera(cached, String(cached.deviceId)));
+		if (nodeId === this.deps.localNodeId()) {
+			const hasAudioSource = await this.resolveHasAudioSource(cached);
+			this.deps.watchdog()?.register(this.deps.buildWatchdogCamera(cached, String(cached.deviceId), hasAudioSource));
+		}
+	}
+	/**
+	* Resolve the watchdog's audio-track evidence for ONE dispatch. Skipped
+	* entirely (and answered `false`) when `audioMode` could not arm the stage
+	* anyway — `buildWatchdogCamera` needs both — so a camera with on-motion
+	* audio costs no broker round-trip.
+	*/
+	async resolveHasAudioSource(config) {
+		if (config.audioMode !== "always-on") return false;
+		return this.deps.hasAudioSource(config.deviceId, config.motionStreamId);
 	}
 	/**
 	* Normalizes the `decision.kind === 'pending'` → `setPendingReason` +
@@ -37597,7 +38055,9 @@ var PipelineWatchdog = class {
 		for (const [stage] of cam.continuousStages) stages.set(stage, {
 			lastSeenMs: now,
 			attempts: 0,
-			lastAttemptMs: 0
+			lastAttemptMs: 0,
+			everSeen: false,
+			registeredAtMs: now
 		});
 		this.state.set(cam.deviceId, stages);
 	}
@@ -37611,20 +38071,34 @@ var PipelineWatchdog = class {
 		if (!rt) return;
 		rt.lastSeenMs = this.deps.now();
 		rt.attempts = 0;
+		rt.everSeen = true;
 	}
 	tick() {
 		const now = this.deps.now();
 		for (const cam of this.cameras.values()) {
-			const { line, stalled, recoveries } = this.evaluate(cam, now);
+			const { line, stalled, recoveries, disarms } = this.evaluate(cam, now);
 			if (stalled) this.deps.logger.warn(line, { tags: { deviceId: cam.deviceId } });
 			else this.deps.logger.info(line, { tags: { deviceId: cam.deviceId } });
+			for (const d of disarms) {
+				this.deps.logger.warn("watchdog stage never produced a signal — disarming", {
+					tags: { deviceId: cam.deviceId },
+					meta: {
+						stage: d.stage,
+						streamId: d.streamId,
+						sinceRegisteredMs: d.sinceRegisteredMs
+					}
+				});
+				this.state.get(cam.deviceId)?.delete(d.stage);
+			}
 			for (const r of recoveries) {
 				const rt = this.state.get(cam.deviceId)?.get(r.stage);
+				let attempt = this.deps.thresholds.maxRecoveryAttempts;
 				if (rt) {
 					if (rt.attempts < this.deps.thresholds.maxRecoveryAttempts) rt.attempts += 1;
 					rt.lastAttemptMs = now;
+					attempt = rt.attempts;
 				}
-				this.deps.recover(cam.deviceId, r.stage, r.streamId);
+				this.deps.recover(cam.deviceId, r.stage, r.streamId, attempt);
 			}
 		}
 	}
@@ -37639,6 +38113,7 @@ var PipelineWatchdog = class {
 	evaluate(cam, now) {
 		const parts = [];
 		const recoveries = [];
+		const disarms = [];
 		let stalled = false;
 		const stageOrder = [
 			"audio",
@@ -37665,7 +38140,14 @@ var PipelineWatchdog = class {
 			const thresholdMs = this.deps.thresholds[STAGE_THRESHOLD_KEY[stage]];
 			const sSec = Math.round(staleness / 1e3);
 			if (staleness <= thresholdMs) parts.push(`${stage}=${stageMode[stage]}@${streamId}(OK ${sSec}s)`);
-			else if (rt.attempts >= this.deps.thresholds.maxRecoveryAttempts) {
+			else if (rt.attempts >= this.deps.thresholds.maxRecoveryAttempts && !rt.everSeen) {
+				disarms.push({
+					stage,
+					streamId,
+					sinceRegisteredMs: now - rt.registeredAtMs
+				});
+				parts.push(`${stage}=${stageMode[stage]}@${streamId}(NEVER SIGNALLED ${sSec}s · disarmed)`);
+			} else if (rt.attempts >= this.deps.thresholds.maxRecoveryAttempts) {
 				stalled = true;
 				if (now - rt.lastAttemptMs >= this.deps.thresholds.exhaustedRetryMs) {
 					recoveries.push({
@@ -37686,7 +38168,8 @@ var PipelineWatchdog = class {
 		return {
 			line: `[watchdog] cam${cam.deviceId} ${cam.deviceName} · ${parts.join(" · ")} → ${stalled ? "STALLED" : "OK"}`,
 			stalled,
-			recoveries
+			recoveries,
+			disarms
 		};
 	}
 };
@@ -38583,6 +39066,14 @@ var ReconcileController = class ReconcileController {
 	/** Shared in-flight pass so a session dispatch waits for runner truth instead of racing it. */
 	attachmentReconcilePromise = null;
 	/**
+	* Desired-but-nonexistent devices and how far their vanish streak has got
+	* (`dispatch-reconcile.ts`). PURELY in-memory and seeded EMPTY on boot: it is
+	* a confirmation counter, not a record — after a restart the first pass only
+	* ever re-observes, never destroys. Cleared whenever the registry read fails,
+	* so a failed read can never advance a device toward teardown.
+	*/
+	vanishedDevices = /* @__PURE__ */ new Map();
+	/**
 	* Per-device backoff for retrying `handleDeviceRegistered` after a
 	* TRANSIENT profile-slot read failure. Timers are `unref`'d and cleared on
 	* shutdown / device removal.
@@ -38651,13 +39142,24 @@ var ReconcileController = class ReconcileController {
 				return;
 			}
 			const desired = desiredDeviceIdsFromSlots(slots);
+			const liveDeviceIds = await this.readLiveDeviceIds();
+			const { existing, vanished } = liveDeviceIds === null ? {
+				existing: desired,
+				vanished: /* @__PURE__ */ new Set()
+			} : splitDesiredByExistence(desired, liveDeviceIds);
+			if (liveDeviceIds === null) {
+				this.deps.logger.warn("dispatch reconcile: device existence filter SKIPPED — registry read failed", { meta: { desired: desired.size } });
+				this.vanishedDevices = /* @__PURE__ */ new Map();
+			}
 			const known = new Set(this.deps.ledger.listConfigIds());
-			const gap = computeDispatchGap(desired, known);
+			const gap = computeDispatchGap(existing, known);
 			this.deps.logger.info("dispatch reconcile", { meta: {
 				desired: desired.size,
 				known: known.size,
-				gap
+				gap,
+				vanished: vanished.size
 			} });
+			await this.tearDownVanishedDevices(vanished);
 			for (const deviceId of gap) try {
 				await this.deps.handleDeviceRegistered(deviceId);
 			} catch (err) {
@@ -38676,6 +39178,53 @@ var ReconcileController = class ReconcileController {
 		}
 	}
 	/**
+	* The live device registry as an id set, or `null` when the read FAILED.
+	* `null` is the caller's signal to skip the existence filter entirely — it
+	* must never be confused with "the registry is empty", which would prune the
+	* whole fleet.
+	*
+	* Asks for the slim projection: this needs identity only, never
+	* `config`/`sourceInfo` (a full listing of 293 devices measured 271 KB).
+	*/
+	async readLiveDeviceIds() {
+		const api = this.deps.api();
+		if (!api) return null;
+		try {
+			const devices = await api.deviceManager.listAll.query({ projection: "slim" });
+			return new Set(devices.map((device) => device.id));
+		} catch (err) {
+			this.deps.logger.debug("dispatch reconcile: deviceManager.listAll failed", { meta: { error: errMsg(err) } });
+			return null;
+		}
+	}
+	/**
+	* Tear down the desired devices the registry no longer has — but only once
+	* TWO consecutive passes agree they are gone (`reconcileVanishedDevices`,
+	* D49). Teardown destroys work, so a single listing that omits a device
+	* (which a partial or racy read looks exactly like) is not enough.
+	*
+	* Runs the SAME `handleDeviceUnregistered` the `DeviceUnregistered` event
+	* runs, so there is exactly one teardown path.
+	*/
+	async tearDownVanishedDevices(vanished) {
+		const { tearDown, nextState } = reconcileVanishedDevices(vanished, this.vanishedDevices);
+		this.vanishedDevices = nextState;
+		for (const deviceId of tearDown) {
+			this.deps.logger.warn("dispatch reconcile: device no longer exists — tearing down instead of dispatching", {
+				tags: { deviceId },
+				meta: { confirmedPasses: 2 }
+			});
+			try {
+				await this.deps.handleDeviceUnregistered(deviceId);
+			} catch (err) {
+				this.deps.logger.warn("dispatch reconcile: teardown of vanished device failed", {
+					tags: { deviceId },
+					meta: { error: errMsg(err) }
+				});
+			}
+		}
+	}
+	/**
 	* Converge the in-memory `assignments` map to runner truth (Phase 1 of the
 	* placement-derived-state design). Runner attachments (`getLocalCameras`) are
 	* authoritative: detach duplicates/orphans, and drop stale assignments
@@ -38986,6 +39535,7 @@ var ReconcileController = class ReconcileController {
 		this.slotReadRetryTimers.clear();
 		this.slotReadRetryAttempts.clear();
 		this.remoteHealthAttempts.clear();
+		this.vanishedDevices = /* @__PURE__ */ new Map();
 	}
 };
 //#endregion
@@ -40051,6 +40601,31 @@ async function buildOrchestratorControllers(deps) {
 		getInitTimestamp: () => deps.initTimestamp
 	});
 	const inferenceRotation = new RoundRobinInferenceDeviceRotation();
+	/**
+	* Does this camera's source carry an audio track? Read from the broker that
+	* owns the stream (`BrokerStats.audio === null` is the documented no-audio
+	* signal), pinned to the cluster's source owner exactly like the
+	* camera-status broker stage. FAILS OPEN: no api, an RPC error, or a broker
+	* that has not detected the track yet (`undefined`, cold start) all answer
+	* `true`, because the only consumer is the watchdog's diagnostic audio stage
+	* and a false negative silently stops watching a working camera.
+	*/
+	const resolveHasAudioSource = async (deviceId, camStreamId) => {
+		const api = deps.ctx().api;
+		if (!api) return true;
+		try {
+			return (await api.streamBroker.getBrokerStats.query({ brokerId: makeSourceBrokerId(deviceId, camStreamId) }, nodePin(topology.assignSource(deviceId)))).audio !== null;
+		} catch (err) {
+			deps.ctx().logger.debug("audio-source probe failed — assuming the source has audio", {
+				tags: { deviceId },
+				meta: {
+					camStreamId,
+					error: errMsg(err)
+				}
+			});
+			return true;
+		}
+	};
 	const placement = new PlacementService({
 		ctx: () => deps.ctx(),
 		ctxIfReady: () => deps.ctxIfReady(),
@@ -40066,12 +40641,14 @@ async function buildOrchestratorControllers(deps) {
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
 		inferenceRotation,
-		buildWatchdogCamera: (config, deviceName) => detectionWiring.buildWatchdogCamera(config, deviceName),
+		buildWatchdogCamera: (config, deviceName, hasAudioSource) => detectionWiring.buildWatchdogCamera(config, deviceName, hasAudioSource),
+		hasAudioSource: (deviceId, camStreamId) => resolveHasAudioSource(deviceId, camStreamId),
 		isIdleSessionCamera: (deviceId) => deps.isIdleSessionCamera(deviceId),
 		activeSessionNode: (deviceId) => session.activeSessionNode(deviceId),
 		closeActiveSession: (deviceId) => session.closeSessionForReassign(deviceId),
 		reconcilePlacementFromRunners: () => reconcile.reconcilePlacementFromRunners(),
-		emitResolvedCameraUpdated: (deviceId) => deps.emitResolvedCameraUpdated(deviceId)
+		emitResolvedCameraUpdated: (deviceId) => deps.emitResolvedCameraUpdated(deviceId),
+		maintenancePaused: () => deps.maintenancePaused()
 	});
 	const session = new SessionDispatchController({
 		ledger,
@@ -40140,6 +40717,7 @@ async function buildOrchestratorControllers(deps) {
 		loadShed,
 		logger: deps.ctx().logger,
 		handleDeviceRegistered: (deviceId) => deps.handleDeviceRegistered(deviceId),
+		handleDeviceUnregistered: (deviceId) => deps.handleDeviceUnregistered(deviceId),
 		dispatchCamera: (config) => deps.dispatchCamera(config),
 		detachOn: (nodeId, deviceId) => deps.detachOn(nodeId, deviceId),
 		localNodeId: () => localNodeId,
@@ -40240,7 +40818,7 @@ async function buildOrchestratorControllers(deps) {
 	const pipelineWatchdog = new PipelineWatchdog({
 		now: () => Date.now(),
 		logger: deps.ctx().logger,
-		recover: (deviceId, stage, streamId) => detectionWiring.recoverPipelineStage(deviceId, stage, streamId),
+		recover: (deviceId, stage, streamId, attempt) => detectionWiring.recoverPipelineStage(deviceId, stage, streamId, attempt),
 		thresholds: DEFAULT_WATCHDOG_THRESHOLDS
 	});
 	pipelineWatchdog.start(deps.watchdogIntervalMs);
@@ -41096,6 +41674,9 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	/** Periodic auto-rebalance sweep timer (drift correction under hysteresis). */
 	autoRebalanceTimer = null;
 	initTimestamp = 0;
+	/** Storage migration maintenance lease. It only gates dispatch; it does not
+	* change any camera wrapper or persistent pipeline configuration. */
+	storageMigrationLeaseId = null;
 	constructor() {
 		super({});
 	}
@@ -41143,6 +41724,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			rebalance: (opts) => this.rebalance(opts),
 			setCameraPipelineForAgent: (input) => this.setCameraPipelineForAgent(input),
 			dispatchCamera: (config) => this.dispatchCamera(config),
+			maintenancePaused: () => this.storageMigrationLeaseId !== null,
 			setTopology: (topology) => {
 				this.topology = topology;
 			},
@@ -41289,8 +41871,29 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.settingsStore = null;
 	}
 	async dispatchCamera(runnerConfig) {
+		if (this.storageMigrationLeaseId !== null) return {
+			success: true,
+			kind: "pending"
+		};
 		return this.placement.dispatchCamera(runnerConfig);
 	}
+	async pauseForStorageMigration(input) {
+		if (this.storageMigrationLeaseId !== null && this.storageMigrationLeaseId !== input.leaseId) throw new Error("pipeline dispatch is already paused by another storage migration");
+		this.storageMigrationLeaseId = input.leaseId;
+		try {
+			await this.placement.waitForMigrationIdle();
+			return { paused: true };
+		} catch (err) {
+			this.storageMigrationLeaseId = null;
+			throw err;
+		}
+	}
+	async resumeForStorageMigration(input) {
+		if (this.storageMigrationLeaseId === null) return { resumed: true };
+		if (this.storageMigrationLeaseId !== input.leaseId) throw new Error("pipeline storage migration lease does not match");
+		this.storageMigrationLeaseId = null;
+		return { resumed: true };
+	}
 	async releaseCamera(input) {
 		return this.placement.releaseCamera(input);
 	}