@camstack/addon-pipeline-orchestrator 1.2.55 → 1.2.56

package/dist/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-DQ-9VJzz.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-CIgtalSC.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.70",
+		version: "1.2.71",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_orchestrator_widgets",

package/dist/{hostInit-DEefQ-oR.mjs → hostInit-BfvdbNXJ.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.70",
+				version: "1.2.71",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/index.js

@@ -24,12 +24,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = __toESM(node_fs);
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_url = require("node:url");
-//#region ../types/dist/event-category-Cv9dO26A.mjs
+//#region ../types/dist/event-category-Bxo5yJjt.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -236,6 +237,33 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
 	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
 	/**
+	* A node the orchestrator would otherwise place cameras on has NO usable
+	* inference device: the operator enabled one or more accelerators there and
+	* the live probe reports every one of them unavailable. Emitted once per
+	* TRANSITION into that state (never per dispatch), and the node is dropped
+	* from the placement candidate set for as long as it holds.
+	*
+	* This exists because the state was previously invisible: little-unraid
+	* absorbed 283k inference errors in a day while still being handed cameras,
+	* and nothing in the system said so.
+	*
+	* A node with no accelerators configured at all is NOT this — its devices
+	* are `disabled`, not `unavailable`, and the runner's default CPU pool
+	* serves it exactly as before.
+	*/
+	EventCategory["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
+	/**
+	* A camera has an OPEN detection session and has produced no detection at
+	* all for longer than the blind threshold — the camera is being decoded and
+	* inferred and is returning nothing. Emitted once per transition into blind,
+	* per camera.
+	*
+	* The failure it reports: a 1h43 detection blackout on the entrance camera
+	* that nobody noticed, because "a camera that detects nothing" and "a quiet
+	* camera" produce byte-identical silence.
+	*/
+	EventCategory["PipelineDetectionBlind"] = "pipeline.detection-blind";
+	/**
 	* Per-camera pipeline config was mutated by the orchestrator
 	* (3-level settings change via `setAgentAddonDefaults` /
 	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
@@ -14927,6 +14955,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-inference-unavailable",
+	"detection-blind",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -15698,7 +15728,50 @@ var NcRuleInputSchema = object({
 	* tests every zone the track visited and a `crossing` condition can no longer
 	* be satisfied, because a closed track carries no crossing.
 	*/
-	waitForEnhancement: boolean().optional()
+	waitForEnhancement: boolean().optional(),
+	/**
+	* GROUP a burst of subjects into ONE notification that grows.
+	*
+	* Seconds of quiet after the last matching subject before the burst is
+	* considered over. While it is open, the first subject enqueues immediately —
+	* **exactly as today, with no added latency** — and every real growth (a new
+	* subject, or a name confirmed on one already in it) REPLACES that
+	* notification with an updated one naming everybody. The push carries the
+	* group's own coalescing tag, so the phone replaces rather than stacks.
+	*
+	* `0` / absent = off, and off is today's behaviour byte for byte.
+	*
+	* ### Why an idle cutoff and not a window
+	*
+	* The measured seven-person arrival on device 590 spans 110 s with every
+	* internal gap under 30 s. A 12 s fixed window cuts it into three groups; an
+	* idle cutoff holds it as one and ends it when the arrival actually ends.
+	* 30 is Frigate's shipped value for the same decision.
+	*
+	* ### What it replaces
+	*
+	* The blind cooldown, which collapses a burst by DISCARDING it. Measured on
+	* device 615 / *Persona su Uscio* over six days: 116 qualifying tracks → 74
+	* notifications, **44 (37.9%) suppressed outright**, 23 of them overlapping a
+	* track that did fire and 7 carrying a confirmed identity nobody heard about.
+	* A group collapses the same volume by MERGING, so the cooldown becomes a
+	* budget over GROUPS — which is what it always meant — and a growth is never
+	* throttled by the window its own first member spent.
+	*
+	* ### Interaction with {@link waitForEnhancement}
+	*
+	* They compose, and the order matters. `waitForEnhancement` defers the rule to
+	* TRACK CLOSE, so with both set the group is opened by the first member to
+	* CLOSE — already carrying its name — and grows as later members close. That
+	* is later, and complete. With grouping alone the group opens on the first
+	* object event and picks up names as they are confirmed, through the growth
+	* path. Neither combination fires twice for one subject.
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, so absent must keep meaning what it meant before this
+	* field existed.
+	*/
+	groupIdleSec: number().int().min(0).max(600).optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -16624,7 +16697,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace, hasRider) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16911,6 +16984,28 @@ var TrackSchema = object({
 	* `=== true` and render nothing otherwise, never infer "no face".
 	*/
 	hasFace: boolean().optional(),
+	/**
+	* This subject CONTAINS a folded rider — a person the rider-pairing step
+	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+	* so the passage is tracked once and as a VEHICLE.
+	*
+	* It exists because the fold's record was dishonest. D34 and the code both
+	* said "the person is not lost — it is reported so both entities stay on the
+	* record"; in fact the pair went into a per-processor RAM field behind an
+	* accessor nobody called, and every durable surface said `vehicle`, full
+	* stop. This is the composition note that makes the row true.
+	*
+	* A COMPOSITION, never a class and never a label. "This vehicle contains a
+	* person" is not an answer to "what is this" — both label tiers would refuse
+	* a macro token anyway (D89), and correctly. Nothing here changes what the
+	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+	* and a `person` rule still does not fire for someone cycling past.
+	*
+	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+	* the column, and every hub that predates the field, omits it. Test
+	* `=== true` and render nothing otherwise — never infer "no rider".
+	*/
+	hasRider: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -34805,6 +34900,15 @@ function resolveInferenceDeviceEligibility(probed, stored, canRunRoot) {
 		excluded
 	};
 }
+function resolveNodeInferenceUsability(eligibility) {
+	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
+	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
+	return {
+		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
+		unavailableKeys,
+		eligibleKeys
+	};
+}
 /**
 * Step-tree device jump (phase 1): the attach-payload roster of a node's
 * enabled∧available inference devices with the balancer knobs (`weight`,
@@ -34823,6 +34927,67 @@ function buildInferenceDeviceRoster(eligible, caps) {
 	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
 }
 //#endregion
+//#region src/node-inference-usability-mirror.ts
+var NodeInferenceUsabilityMirror = class {
+	state = /* @__PURE__ */ new Map();
+	/**
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
+	*/
+	observe(nodeId, usable) {
+		const prev = this.state.get(nodeId);
+		if (usable) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: false
+			});
+			return prev !== void 0 && !prev.usable ? "recovered" : null;
+		}
+		if (prev === void 0) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
+			return null;
+		}
+		if (!prev.usable) {
+			this.state.set(nodeId, {
+				usable: false,
+				armed: true
+			});
+			return null;
+		}
+		if (!prev.armed) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
+			return null;
+		}
+		this.state.set(nodeId, {
+			usable: false,
+			armed: true
+		});
+		return "became-unusable";
+	}
+	/** Can this node be given cameras? Unknown nodes answer YES. */
+	isUsable(nodeId) {
+		return this.state.get(nodeId)?.usable ?? true;
+	}
+	/** Nodes currently excluded — for the placement log and diagnostics. */
+	unusableNodeIds() {
+		const out = [];
+		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
+		return out.toSorted();
+	}
+	forget(nodeId) {
+		this.state.delete(nodeId);
+	}
+	reset() {
+		this.state.clear();
+	}
+};
+//#endregion
 //#region src/orchestrator-types.ts
 var PHASE_MODE_VALUES = new Set([
 	"disabled",
@@ -36333,6 +36498,69 @@ var LoadShedController = class LoadShedController {
 		}
 	}
 };
+var DEFAULT_DETECTION_BLIND_CONFIG = {
+	thresholdMs: 60 * 6e4,
+	frameFreshnessMs: 5 * 6e4
+};
+var DetectionBlindMonitor = class {
+	config;
+	state = /* @__PURE__ */ new Map();
+	constructor(config = DEFAULT_DETECTION_BLIND_CONFIG) {
+		this.config = config;
+	}
+	/**
+	* One inference frame arrived for a device. `hadDetection` is false for a
+	* frame that returned nothing — which is the whole point: an empty frame
+	* still proves the pipeline is alive, and it is the ONLY evidence that
+	* distinguishes blind from detached.
+	*/
+	noteFrame(deviceId, hadDetection, now) {
+		const prev = this.state.get(deviceId);
+		if (hadDetection) {
+			this.state.set(deviceId, {
+				lastFrameAt: now,
+				lastDetectionAt: now,
+				reported: false
+			});
+			return;
+		}
+		this.state.set(deviceId, {
+			lastFrameAt: now,
+			lastDetectionAt: prev?.lastDetectionAt ?? now,
+			reported: prev?.reported ?? false
+		});
+	}
+	/**
+	* Devices that have JUST crossed into blind. Call from an existing periodic
+	* sweep; it allocates nothing on the healthy path.
+	*/
+	sweep(now) {
+		const out = [];
+		for (const [deviceId, s] of this.state) {
+			if (s.reported) continue;
+			if (now - s.lastFrameAt > this.config.frameFreshnessMs) continue;
+			const blindForMs = now - s.lastDetectionAt;
+			if (blindForMs < this.config.thresholdMs) continue;
+			this.state.set(deviceId, {
+				...s,
+				reported: true
+			});
+			out.push({
+				deviceId,
+				blindForMs,
+				thresholdMs: this.config.thresholdMs
+			});
+		}
+		return out;
+	}
+	/** Drop a device (detach / unbind), so a re-attach starts a fresh clock. */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	reset() {
+		this.state.clear();
+	}
+};
 //#endregion
 //#region src/agent-load-service.ts
 var AgentLoadService = class AgentLoadService {
@@ -38585,6 +38813,7 @@ var DetectionWiringController = class {
 		if (!this.deps.ctx()) return;
 		const { deviceId, frame, frameHandle, capturedAt } = payload;
 		this.deps.watchdog()?.noteSignal(deviceId, "detection");
+		this.deps.blindMonitor()?.noteFrame(deviceId, frame.detections.length > 0, Date.now());
 		if (frame.detections.length === 0 && (frame.discarded?.length ?? 0) === 0) return;
 		this.deps.eventBus.emit({
 			id: `detection-${deviceId}-${Date.now()}`,
@@ -40372,6 +40601,34 @@ var PlacementService = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Drop nodes that cannot infer from a candidate set.
+	*
+	* Fails OPEN in one specific way that matters: if the filter would leave NO
+	* candidate at all, the unfiltered set is used. Placing a camera on a node
+	* that might fail its inference is bad; refusing to place it anywhere
+	* because every node is currently mid-probe is worse, and that is the exact
+	* shape a cold cluster start has.
+	*/
+	filterInferenceUsable(nodes, deviceId) {
+		const usable = nodes.filter((nodeId) => this.deps.isNodeInferenceUsable(nodeId));
+		if (usable.length === nodes.length) return nodes;
+		if (usable.length === 0) {
+			this.deps.ctx().logger.warn("every candidate node reports no usable inference device — placing anyway", {
+				tags: { deviceId },
+				meta: { nodes: [...nodes] }
+			});
+			return nodes;
+		}
+		this.deps.ctx().logger.info("nodes dropped from placement — no usable inference device", {
+			tags: { deviceId },
+			meta: {
+				dropped: nodes.filter((n) => !usable.includes(n)),
+				kept: usable
+			}
+		});
+		return usable;
+	}
 	async dispatchCamera(runnerConfig) {
 		if (!this.deps.ctx()) throw new Error("PipelineOrchestrator: dispatchCamera called before initialize");
 		if (this.deps.maintenancePaused?.() === true) return {
@@ -40386,7 +40643,7 @@ var PlacementService = class {
 		};
 		const preferredAgent = await this.deps.readPipelinePin(runnerConfig.deviceId);
 		const loads = await this.deps.loadService.collectAgentLoad({ onlyEnabled: true });
-		const eligible = this.deps.topology.detectionEligibleNodes(runnerConfig.deviceId);
+		const eligible = this.filterInferenceUsable(this.deps.topology.detectionEligibleNodes(runnerConfig.deviceId), runnerConfig.deviceId);
 		const nodeCaps = await this.deps.settingsStore.buildNodeCaps();
 		const motionRoleCandidate = pickMotionRolePlacement({
 			isAnalyzer: runnerConfig.motionSources.includes("analyzer"),
@@ -44259,7 +44516,10 @@ var SessionDispatchController = class {
 		await this.deps.reconcilePlacementFromRunners();
 		const preferredAgent = await this.deps.readPipelinePin(deviceId);
 		const loads = await this.agentLoads.get(CLUSTER_KEY);
-		const eligible = this.deps.topology.detectionEligibleNodes(deviceId);
+		const allEligible = this.deps.topology.detectionEligibleNodes(deviceId);
+		const usableEligible = allEligible.filter((n) => this.deps.isNodeInferenceUsable(n));
+		const eligible = usableEligible.length > 0 ? usableEligible : allEligible;
+		if (usableEligible.length > 0 && usableEligible.length < allEligible.length) log.info("nodes dropped from session placement — no usable inference device", { meta: { dropped: allEligible.filter((n) => !usableEligible.includes(n)) } });
 		const decision = balance({
 			nodes: loads,
 			preferredAgent,
@@ -45181,6 +45441,78 @@ var ZonesProvider = class {
 //#endregion
 //#region src/orchestrator-bootstrap.ts
 /**
+* `orchestrator-bootstrap.ts` — the controller-construction body of
+* `onInitialize` (S11 Task 4, last extraction of the S11 series).
+*
+* `buildOrchestratorControllers(deps)` constructs all ~16 controllers the
+* addon owns, in the EXACT order `onInitialize` built them in before this
+* extraction (ledger → topology → loadService → audio → settingsStore →
+* loadShed → placement → session → deviceConfig → cameraStatusService →
+* reconcile → [settings load + localNodeId resolve] → nodeLifecycle →
+* [event subs + readiness seed] → pipelineWatchdog → [timers + legacy
+* migration] → zoneRulesProvider → zonesProvider →
+* [wireOrchestratorSubscriptions + eager reconcile] → detectionWiring).
+* Every dep closure is carried over byte-for-byte — only `this.X` became
+* either a local variable (for a controller already constructed earlier in
+* THIS function) or a `deps.X` accessor (for addon-owned state/methods that
+* stay on `PipelineOrchestratorAddon`, or for a controller referenced
+* before its own construction point — a genuine forward ref, always via a
+* LAZY closure, exactly as it was in `onInitialize`).
+*
+* Three things could not simply become local variables, because an EXISTING
+* (unmoved) addon method reads the REAL class field synchronously, mid-
+* construction, not through a lazy closure:
+*   - `applyRuntimeSettings` (stays on the addon) reads `this.topology!`
+*     and `this.reconcile!` directly — called synchronously from the
+*     settings-load block below. `deps.setTopology`/`deps.setReconcile`
+*     progressively sync the REAL addon fields the instant each is built,
+*     so `applyRuntimeSettings` sees them.
+*   - `subscribeToAudioAnalyzerReadiness` (stays on the addon) reads
+*     `this.nodeLifecycle!.readinessRegistry` AND `this.audio!` directly —
+*     called synchronously right after `nodeLifecycle` is built (readiness
+*     seed + the `AgentOnline` handler). `deps.setNodeLifecycle` /
+*     `deps.setAudio` cover it the same way. This one bit LIVE: `audio` is
+*     constructed early (fourth) but `subscribeToAudioAnalyzerReadiness`
+*     wasn't called until much later (after `nodeLifecycle` exists), so the
+*     old code never noticed `this.audio` was still unsynced — until
+*     `ReadinessRegistry.onReadyState`'s `queueMicrotask` hydration replay
+*     (an already-`ready` cap fires the handler once, asynchronously, on
+*     subscribe) won the race against the `await buildOrchestratorControllers(...)`
+*     continuation in `onInitialize` that assigns `this.audio` — both are
+*     microtasks, and the replay's `queueMicrotask` was enqueued (during
+*     this still-synchronous function body) strictly before this function's
+*     `return` resolves the outer promise, so it always runs first. Fixed
+*     by syncing `this.audio` the instant it's constructed, exactly like
+*     `topology`/`reconcile`/`nodeLifecycle` — no lazy closure ever reads a
+*     controller before this function has assigned its real field.
+* Every other controller-to-controller reference in this function — even
+* ones that look like a forward ref (e.g. `loadShed`'s `attach` closure
+* onto `placement`, built one step later) — is a LAZY closure that is
+* never invoked synchronously during construction (only later, off
+* event-bus subscriptions, timers, or RPC handlers), so a plain local
+* `let` variable captured by reference is sufficient and exactly
+* preserves the original semantics: see each field's inline comment in
+* `index.ts` for the original construction-order reasoning, unchanged
+* here.
+*
+* `globalSettings` is a purely local variable — read/written ONLY by
+* closures built inside this same function (the one exception,
+* `deviceConfig`'s `setGlobalSettings`, is ALSO built here, so the local
+* variable stays the single source of truth for every reader). No code
+* outside this closure network ever read the former `this.globalSettings`
+* class field, so it isn't part of the returned `OrchestratorControllers`
+* — the field was removed from the class entirely (S11 Task 4 cleanup).
+* `localNodeId` IS returned — `index.ts` still reads `this.localNodeId`
+* from a couple of unrelated cap methods (`dumpDiagnostics`,
+* `getDecoderAssignments`), so the class field is populated once, from the
+* returned `OrchestratorControllers`, after this function returns.
+* `failoverPolicy` is the opposite case from `globalSettings` —
+* `applyRuntimeSettings` (unmoved) writes the REAL field on every future
+* settings change, so `nodeLifecycle`'s `failoverPolicy` closure MUST keep
+* reading through `deps.failoverPolicy()` (never a local snapshot) to see
+* those later updates.
+*/
+/**
 * Construct every orchestrator controller, wire the agent-lifecycle event
 * subscriptions + readiness seed + detection-wiring subscriptions, and
 * kick the eager reconcile — the ENTIRE former `onInitialize` body between
@@ -45339,6 +45671,7 @@ async function buildOrchestratorControllers(deps) {
 		localNodeId: () => localNodeId,
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
 		inferenceRotation,
@@ -45368,6 +45701,7 @@ async function buildOrchestratorControllers(deps) {
 		listZones: async (deviceId) => await zonesProvider?.listZones({ deviceId }) ?? [],
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
 		inferenceRotation,
@@ -45526,7 +45860,34 @@ async function buildOrchestratorControllers(deps) {
 		thresholds: DEFAULT_WATCHDOG_THRESHOLDS
 	});
 	pipelineWatchdog.start(deps.watchdogIntervalMs);
-	const pendingRetryTimer = setInterval(() => void reconcile.retryPendingDispatches(), PENDING_RETRY_INTERVAL_MS);
+	const blindMonitor = new DetectionBlindMonitor();
+	const pendingRetryTimer = setInterval(() => {
+		reconcile.retryPendingDispatches();
+		for (const blind of blindMonitor.sweep(Date.now())) {
+			deps.ctx().logger.error("camera is being analysed and detecting NOTHING", {
+				tags: { deviceId: blind.deviceId },
+				meta: {
+					blindForMs: blind.blindForMs,
+					thresholdMs: blind.thresholdMs
+				}
+			});
+			deps.ctx().eventBus.emit({
+				id: (0, node_crypto.randomUUID)(),
+				timestamp: /* @__PURE__ */ new Date(),
+				source: {
+					type: "device",
+					id: blind.deviceId,
+					deviceId: blind.deviceId
+				},
+				category: EventCategory.PipelineDetectionBlind,
+				data: {
+					deviceId: blind.deviceId,
+					blindForMs: blind.blindForMs,
+					thresholdMs: blind.thresholdMs
+				}
+			});
+		}
+	}, PENDING_RETRY_INTERVAL_MS);
 	const autoRebalanceTimer = setInterval(() => void placement.runAutoRebalance(), AUTO_REBALANCE_INTERVAL_MS);
 	deps.ctx().logger.info("Pipeline orchestrator detection-wiring subscriptions installed");
 	migrateLegacyFlagsToBindings({
@@ -45653,6 +46014,7 @@ async function buildOrchestratorControllers(deps) {
 		loadShed,
 		nodeStress,
 		watchdog: () => pipelineWatchdog,
+		blindMonitor: () => blindMonitor,
 		api: () => deps.ctx().api ?? null,
 		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger,
@@ -46230,6 +46592,48 @@ function deriveRuntimeSettings(config) {
 //#endregion
 //#region src/index.ts
 /**
+* addon-pipeline-orchestrator — hub-side camera-to-agent load balancer.
+*
+* Owns the control plane for the distributed detection pipeline. Tracks
+* which `addon-pipeline-runner` instance is responsible for each camera,
+* queries each runner's capacity + hardware profile, and dispatches
+* `attachCamera` / `detachCamera` cap calls to the appropriate runner via
+* the Moleculer broker. Persists manual pins via the per-device settings
+* store so user overrides survive hub restarts.
+*
+* Strictly control plane — never sees a frame, never runs inference, never
+* drains queues. The runner does that work locally on each vision node.
+*
+* ## Dispatch entrypoints
+*
+* - **`dispatchCamera(runnerConfig)`** — in-process only (not in the cap
+*   def). Called by `DetectionWiringService` with a freshly-built
+*   `RunnerCameraConfig`. Runs the L1/L2/L3 balancer, picks an agent, then
+*   issues `broker.call('pipeline-runner.pipeline-runner.attachCamera', ...)`.
+*   Caches the config so future rebalance / pinning can re-dispatch without
+*   the caller rebuilding it.
+*
+* - **`assignCamera({deviceId, agentNodeId})`** — cap method. Persists a
+*   manual `preferredAgent` pin to per-device settings and re-dispatches
+*   immediately if the camera is already attached.
+*
+* - **`unassignCamera({deviceId})`** — cap method. Clears the pin,
+*   detaches the camera from its current agent.
+*
+* - **`rebalance()`** — cap method. Walks every cached camera config and
+*   re-runs the balancer; migrates cameras whose current agent is no
+*   longer optimal. Pinned cameras are never migrated.
+*
+* ## Runner dispatch
+*
+* All runner calls go through `this.ctx.api.pipelineRunner.*` (the generated
+* tRPC cap router). The router extracts `nodeId` from the input and
+* routes transparently to the local runner (direct in-process call) or
+* to a remote agent (via Moleculer). Node discovery is driven by
+* `EventCategory.AgentOnline/AgentOffline` events forwarded by
+* `agent-registry.service.ts`.
+*/
+/**
 * The FULL action catalog, under the name the HUB HARVESTS.
 *
 * The hub's forked-addon harvest imports this entry module and reads the
@@ -46488,6 +46892,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			detachOn: (nodeId, deviceId) => this.detachOn(nodeId, deviceId),
 			readPipelinePin: (deviceId) => this.readPipelinePin(deviceId),
 			getEligibleInferenceDevices: (nodeId) => this.resolveEligibleInferenceDevices(nodeId),
+			isNodeInferenceUsable: (nodeId) => this.isNodeInferenceUsable(nodeId),
 			getInferenceDeviceCaps: (nodeId) => this.getInferenceDeviceCaps(nodeId),
 			readPipelineDevicePin: (deviceId) => this.readPipelineDevicePin(deviceId),
 			subscribeToAudioAnalyzerReadiness: (nodeId) => this.subscribeToAudioAnalyzerReadiness(nodeId),
@@ -47144,11 +47549,66 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const stored = (await this.settingsStore.readAgentSettingsMap())[nodeId]?.inferenceDevices ?? {};
 		const { probed } = await this.probeNodeInferenceDevices(nodeId);
 		const catalog = await this.settingsStore.getCatalogForNode(nodeId);
-		const { eligible, excluded } = resolveInferenceDeviceEligibility(probed, stored, catalog ? makeRootCapabilityGuard(catalog) : void 0);
+		const eligibility = resolveInferenceDeviceEligibility(probed, stored, catalog ? makeRootCapabilityGuard(catalog) : void 0);
+		const { eligible, excluded } = eligibility;
 		this.logInferenceDeviceShrinkage(nodeId, eligible, excluded);
+		this.noteNodeInferenceUsability(nodeId, resolveNodeInferenceUsability(eligibility));
 		return eligible;
 	}
 	/**
+	* Fold one usability observation into the placement mirror and announce the
+	* transition.
+	*
+	* This is called from the SAME read the dispatcher already makes, plus the
+	* session controller's background refresher — so a node's usability is
+	* re-observed on the cadence placement itself runs at, without a timer of
+	* its own. The mirror is what makes the answer readable synchronously by
+	* `detectionEligibleNodes`' callers; see its own docblock for why it refuses
+	* to act on a single bad read.
+	*
+	* The system event is emitted ONLY on the transition into unusable — the
+	* kind is `node-inference-unavailable` and it is authorable in a rule.
+	* Recovery is logged and deliberately has no event: a notification saying
+	* the broken thing is no longer broken is a second rule nobody asked for.
+	*/
+	noteNodeInferenceUsability(nodeId, usability) {
+		const transition = this.nodeInferenceUsability.observe(nodeId, usability.usable);
+		if (transition === null) return;
+		if (transition === "recovered") {
+			this.ctx.logger.info("node inference recovered — back in the placement candidate set", {
+				tags: { nodeId },
+				meta: { eligible: usability.eligibleKeys }
+			});
+			return;
+		}
+		this.ctx.logger.error("node has NO usable inference device — removed from the placement candidate set", {
+			tags: { nodeId },
+			meta: {
+				unavailable: usability.unavailableKeys,
+				eligible: usability.eligibleKeys
+			}
+		});
+		this.ctx.eventBus.emit({
+			id: (0, node_crypto.randomUUID)(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: "pipeline-orchestrator",
+				addonId: "pipeline-orchestrator"
+			},
+			category: EventCategory.PipelineNodeInferenceUnavailable,
+			data: {
+				nodeId,
+				unavailableDeviceKeys: usability.unavailableKeys
+			}
+		});
+	}
+	/** Can this node be given cameras? Read synchronously by the two dispatch
+	*  paths before they hand `eligibleNodes` to the balancer. */
+	isNodeInferenceUsable(nodeId) {
+		return this.nodeInferenceUsability.isUsable(nodeId);
+	}
+	/**
 	* Per-node signature of the last logged eligible/excluded split, so
 	* {@link logInferenceDeviceShrinkage} fires on CHANGE only. This runs on
 	* every camera dispatch; without the gate it would be one line per dispatch
@@ -47156,6 +47616,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	*/
 	lastInferenceEligibilitySignature = /* @__PURE__ */ new Map();
 	/**
+	* Which nodes can still infer. Refreshed by
+	* {@link resolveEligibleInferenceDevices}; read synchronously by both
+	* dispatch paths so a node whose every enabled accelerator vanished stops
+	* receiving cameras. little-unraid was handed cameras for a whole day in
+	* exactly that state.
+	*/
+	nodeInferenceUsability = new NodeInferenceUsabilityMirror();
+	/**
 	* Say out loud which of a node's inference devices were dropped from the
 	* candidate set, and why.
 	*

package/dist/index.mjs

@@ -1,7 +1,8 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-Cv9dO26A.mjs
+//#region ../types/dist/event-category-Bxo5yJjt.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -208,6 +209,33 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
 	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
 	/**
+	* A node the orchestrator would otherwise place cameras on has NO usable
+	* inference device: the operator enabled one or more accelerators there and
+	* the live probe reports every one of them unavailable. Emitted once per
+	* TRANSITION into that state (never per dispatch), and the node is dropped
+	* from the placement candidate set for as long as it holds.
+	*
+	* This exists because the state was previously invisible: little-unraid
+	* absorbed 283k inference errors in a day while still being handed cameras,
+	* and nothing in the system said so.
+	*
+	* A node with no accelerators configured at all is NOT this — its devices
+	* are `disabled`, not `unavailable`, and the runner's default CPU pool
+	* serves it exactly as before.
+	*/
+	EventCategory["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
+	/**
+	* A camera has an OPEN detection session and has produced no detection at
+	* all for longer than the blind threshold — the camera is being decoded and
+	* inferred and is returning nothing. Emitted once per transition into blind,
+	* per camera.
+	*
+	* The failure it reports: a 1h43 detection blackout on the entrance camera
+	* that nobody noticed, because "a camera that detects nothing" and "a quiet
+	* camera" produce byte-identical silence.
+	*/
+	EventCategory["PipelineDetectionBlind"] = "pipeline.detection-blind";
+	/**
 	* Per-camera pipeline config was mutated by the orchestrator
 	* (3-level settings change via `setAgentAddonDefaults` /
 	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
@@ -14899,6 +14927,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-inference-unavailable",
+	"detection-blind",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -15670,7 +15700,50 @@ var NcRuleInputSchema = object({
 	* tests every zone the track visited and a `crossing` condition can no longer
 	* be satisfied, because a closed track carries no crossing.
 	*/
-	waitForEnhancement: boolean().optional()
+	waitForEnhancement: boolean().optional(),
+	/**
+	* GROUP a burst of subjects into ONE notification that grows.
+	*
+	* Seconds of quiet after the last matching subject before the burst is
+	* considered over. While it is open, the first subject enqueues immediately —
+	* **exactly as today, with no added latency** — and every real growth (a new
+	* subject, or a name confirmed on one already in it) REPLACES that
+	* notification with an updated one naming everybody. The push carries the
+	* group's own coalescing tag, so the phone replaces rather than stacks.
+	*
+	* `0` / absent = off, and off is today's behaviour byte for byte.
+	*
+	* ### Why an idle cutoff and not a window
+	*
+	* The measured seven-person arrival on device 590 spans 110 s with every
+	* internal gap under 30 s. A 12 s fixed window cuts it into three groups; an
+	* idle cutoff holds it as one and ends it when the arrival actually ends.
+	* 30 is Frigate's shipped value for the same decision.
+	*
+	* ### What it replaces
+	*
+	* The blind cooldown, which collapses a burst by DISCARDING it. Measured on
+	* device 615 / *Persona su Uscio* over six days: 116 qualifying tracks → 74
+	* notifications, **44 (37.9%) suppressed outright**, 23 of them overlapping a
+	* track that did fire and 7 carrying a confirmed identity nobody heard about.
+	* A group collapses the same volume by MERGING, so the cooldown becomes a
+	* budget over GROUPS — which is what it always meant — and a growth is never
+	* throttled by the window its own first member spent.
+	*
+	* ### Interaction with {@link waitForEnhancement}
+	*
+	* They compose, and the order matters. `waitForEnhancement` defers the rule to
+	* TRACK CLOSE, so with both set the group is opened by the first member to
+	* CLOSE — already carrying its name — and grows as later members close. That
+	* is later, and complete. With grouping alone the group opens on the first
+	* object event and picks up names as they are confirmed, through the growth
+	* path. Neither combination fires twice for one subject.
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, so absent must keep meaning what it meant before this
+	* field existed.
+	*/
+	groupIdleSec: number().int().min(0).max(600).optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -16596,7 +16669,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace, hasRider) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16883,6 +16956,28 @@ var TrackSchema = object({
 	* `=== true` and render nothing otherwise, never infer "no face".
 	*/
 	hasFace: boolean().optional(),
+	/**
+	* This subject CONTAINS a folded rider — a person the rider-pairing step
+	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+	* so the passage is tracked once and as a VEHICLE.
+	*
+	* It exists because the fold's record was dishonest. D34 and the code both
+	* said "the person is not lost — it is reported so both entities stay on the
+	* record"; in fact the pair went into a per-processor RAM field behind an
+	* accessor nobody called, and every durable surface said `vehicle`, full
+	* stop. This is the composition note that makes the row true.
+	*
+	* A COMPOSITION, never a class and never a label. "This vehicle contains a
+	* person" is not an answer to "what is this" — both label tiers would refuse
+	* a macro token anyway (D89), and correctly. Nothing here changes what the
+	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+	* and a `person` rule still does not fire for someone cycling past.
+	*
+	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+	* the column, and every hub that predates the field, omits it. Test
+	* `=== true` and render nothing otherwise — never infer "no rider".
+	*/
+	hasRider: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -34777,6 +34872,15 @@ function resolveInferenceDeviceEligibility(probed, stored, canRunRoot) {
 		excluded
 	};
 }
+function resolveNodeInferenceUsability(eligibility) {
+	const eligibleKeys = Object.keys(eligibility.eligible).toSorted();
+	const unavailableKeys = eligibility.excluded.filter((e) => e.reason === "unavailable").map((e) => e.key).toSorted();
+	return {
+		usable: eligibleKeys.length > 0 || unavailableKeys.length === 0,
+		unavailableKeys,
+		eligibleKeys
+	};
+}
 /**
 * Step-tree device jump (phase 1): the attach-payload roster of a node's
 * enabled∧available inference devices with the balancer knobs (`weight`,
@@ -34795,6 +34899,67 @@ function buildInferenceDeviceRoster(eligible, caps) {
 	})).toSorted((a, b) => a.deviceKey < b.deviceKey ? -1 : a.deviceKey > b.deviceKey ? 1 : 0);
 }
 //#endregion
+//#region src/node-inference-usability-mirror.ts
+var NodeInferenceUsabilityMirror = class {
+	state = /* @__PURE__ */ new Map();
+	/**
+	* Fold one observation in and report whether the caller should act.
+	* Never throws.
+	*/
+	observe(nodeId, usable) {
+		const prev = this.state.get(nodeId);
+		if (usable) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: false
+			});
+			return prev !== void 0 && !prev.usable ? "recovered" : null;
+		}
+		if (prev === void 0) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
+			return null;
+		}
+		if (!prev.usable) {
+			this.state.set(nodeId, {
+				usable: false,
+				armed: true
+			});
+			return null;
+		}
+		if (!prev.armed) {
+			this.state.set(nodeId, {
+				usable: true,
+				armed: true
+			});
+			return null;
+		}
+		this.state.set(nodeId, {
+			usable: false,
+			armed: true
+		});
+		return "became-unusable";
+	}
+	/** Can this node be given cameras? Unknown nodes answer YES. */
+	isUsable(nodeId) {
+		return this.state.get(nodeId)?.usable ?? true;
+	}
+	/** Nodes currently excluded — for the placement log and diagnostics. */
+	unusableNodeIds() {
+		const out = [];
+		for (const [nodeId, s] of this.state) if (!s.usable) out.push(nodeId);
+		return out.toSorted();
+	}
+	forget(nodeId) {
+		this.state.delete(nodeId);
+	}
+	reset() {
+		this.state.clear();
+	}
+};
+//#endregion
 //#region src/orchestrator-types.ts
 var PHASE_MODE_VALUES = new Set([
 	"disabled",
@@ -36305,6 +36470,69 @@ var LoadShedController = class LoadShedController {
 		}
 	}
 };
+var DEFAULT_DETECTION_BLIND_CONFIG = {
+	thresholdMs: 60 * 6e4,
+	frameFreshnessMs: 5 * 6e4
+};
+var DetectionBlindMonitor = class {
+	config;
+	state = /* @__PURE__ */ new Map();
+	constructor(config = DEFAULT_DETECTION_BLIND_CONFIG) {
+		this.config = config;
+	}
+	/**
+	* One inference frame arrived for a device. `hadDetection` is false for a
+	* frame that returned nothing — which is the whole point: an empty frame
+	* still proves the pipeline is alive, and it is the ONLY evidence that
+	* distinguishes blind from detached.
+	*/
+	noteFrame(deviceId, hadDetection, now) {
+		const prev = this.state.get(deviceId);
+		if (hadDetection) {
+			this.state.set(deviceId, {
+				lastFrameAt: now,
+				lastDetectionAt: now,
+				reported: false
+			});
+			return;
+		}
+		this.state.set(deviceId, {
+			lastFrameAt: now,
+			lastDetectionAt: prev?.lastDetectionAt ?? now,
+			reported: prev?.reported ?? false
+		});
+	}
+	/**
+	* Devices that have JUST crossed into blind. Call from an existing periodic
+	* sweep; it allocates nothing on the healthy path.
+	*/
+	sweep(now) {
+		const out = [];
+		for (const [deviceId, s] of this.state) {
+			if (s.reported) continue;
+			if (now - s.lastFrameAt > this.config.frameFreshnessMs) continue;
+			const blindForMs = now - s.lastDetectionAt;
+			if (blindForMs < this.config.thresholdMs) continue;
+			this.state.set(deviceId, {
+				...s,
+				reported: true
+			});
+			out.push({
+				deviceId,
+				blindForMs,
+				thresholdMs: this.config.thresholdMs
+			});
+		}
+		return out;
+	}
+	/** Drop a device (detach / unbind), so a re-attach starts a fresh clock. */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	reset() {
+		this.state.clear();
+	}
+};
 //#endregion
 //#region src/agent-load-service.ts
 var AgentLoadService = class AgentLoadService {
@@ -38557,6 +38785,7 @@ var DetectionWiringController = class {
 		if (!this.deps.ctx()) return;
 		const { deviceId, frame, frameHandle, capturedAt } = payload;
 		this.deps.watchdog()?.noteSignal(deviceId, "detection");
+		this.deps.blindMonitor()?.noteFrame(deviceId, frame.detections.length > 0, Date.now());
 		if (frame.detections.length === 0 && (frame.discarded?.length ?? 0) === 0) return;
 		this.deps.eventBus.emit({
 			id: `detection-${deviceId}-${Date.now()}`,
@@ -40344,6 +40573,34 @@ var PlacementService = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Drop nodes that cannot infer from a candidate set.
+	*
+	* Fails OPEN in one specific way that matters: if the filter would leave NO
+	* candidate at all, the unfiltered set is used. Placing a camera on a node
+	* that might fail its inference is bad; refusing to place it anywhere
+	* because every node is currently mid-probe is worse, and that is the exact
+	* shape a cold cluster start has.
+	*/
+	filterInferenceUsable(nodes, deviceId) {
+		const usable = nodes.filter((nodeId) => this.deps.isNodeInferenceUsable(nodeId));
+		if (usable.length === nodes.length) return nodes;
+		if (usable.length === 0) {
+			this.deps.ctx().logger.warn("every candidate node reports no usable inference device — placing anyway", {
+				tags: { deviceId },
+				meta: { nodes: [...nodes] }
+			});
+			return nodes;
+		}
+		this.deps.ctx().logger.info("nodes dropped from placement — no usable inference device", {
+			tags: { deviceId },
+			meta: {
+				dropped: nodes.filter((n) => !usable.includes(n)),
+				kept: usable
+			}
+		});
+		return usable;
+	}
 	async dispatchCamera(runnerConfig) {
 		if (!this.deps.ctx()) throw new Error("PipelineOrchestrator: dispatchCamera called before initialize");
 		if (this.deps.maintenancePaused?.() === true) return {
@@ -40358,7 +40615,7 @@ var PlacementService = class {
 		};
 		const preferredAgent = await this.deps.readPipelinePin(runnerConfig.deviceId);
 		const loads = await this.deps.loadService.collectAgentLoad({ onlyEnabled: true });
-		const eligible = this.deps.topology.detectionEligibleNodes(runnerConfig.deviceId);
+		const eligible = this.filterInferenceUsable(this.deps.topology.detectionEligibleNodes(runnerConfig.deviceId), runnerConfig.deviceId);
 		const nodeCaps = await this.deps.settingsStore.buildNodeCaps();
 		const motionRoleCandidate = pickMotionRolePlacement({
 			isAnalyzer: runnerConfig.motionSources.includes("analyzer"),
@@ -44231,7 +44488,10 @@ var SessionDispatchController = class {
 		await this.deps.reconcilePlacementFromRunners();
 		const preferredAgent = await this.deps.readPipelinePin(deviceId);
 		const loads = await this.agentLoads.get(CLUSTER_KEY);
-		const eligible = this.deps.topology.detectionEligibleNodes(deviceId);
+		const allEligible = this.deps.topology.detectionEligibleNodes(deviceId);
+		const usableEligible = allEligible.filter((n) => this.deps.isNodeInferenceUsable(n));
+		const eligible = usableEligible.length > 0 ? usableEligible : allEligible;
+		if (usableEligible.length > 0 && usableEligible.length < allEligible.length) log.info("nodes dropped from session placement — no usable inference device", { meta: { dropped: allEligible.filter((n) => !usableEligible.includes(n)) } });
 		const decision = balance({
 			nodes: loads,
 			preferredAgent,
@@ -45153,6 +45413,78 @@ var ZonesProvider = class {
 //#endregion
 //#region src/orchestrator-bootstrap.ts
 /**
+* `orchestrator-bootstrap.ts` — the controller-construction body of
+* `onInitialize` (S11 Task 4, last extraction of the S11 series).
+*
+* `buildOrchestratorControllers(deps)` constructs all ~16 controllers the
+* addon owns, in the EXACT order `onInitialize` built them in before this
+* extraction (ledger → topology → loadService → audio → settingsStore →
+* loadShed → placement → session → deviceConfig → cameraStatusService →
+* reconcile → [settings load + localNodeId resolve] → nodeLifecycle →
+* [event subs + readiness seed] → pipelineWatchdog → [timers + legacy
+* migration] → zoneRulesProvider → zonesProvider →
+* [wireOrchestratorSubscriptions + eager reconcile] → detectionWiring).
+* Every dep closure is carried over byte-for-byte — only `this.X` became
+* either a local variable (for a controller already constructed earlier in
+* THIS function) or a `deps.X` accessor (for addon-owned state/methods that
+* stay on `PipelineOrchestratorAddon`, or for a controller referenced
+* before its own construction point — a genuine forward ref, always via a
+* LAZY closure, exactly as it was in `onInitialize`).
+*
+* Three things could not simply become local variables, because an EXISTING
+* (unmoved) addon method reads the REAL class field synchronously, mid-
+* construction, not through a lazy closure:
+*   - `applyRuntimeSettings` (stays on the addon) reads `this.topology!`
+*     and `this.reconcile!` directly — called synchronously from the
+*     settings-load block below. `deps.setTopology`/`deps.setReconcile`
+*     progressively sync the REAL addon fields the instant each is built,
+*     so `applyRuntimeSettings` sees them.
+*   - `subscribeToAudioAnalyzerReadiness` (stays on the addon) reads
+*     `this.nodeLifecycle!.readinessRegistry` AND `this.audio!` directly —
+*     called synchronously right after `nodeLifecycle` is built (readiness
+*     seed + the `AgentOnline` handler). `deps.setNodeLifecycle` /
+*     `deps.setAudio` cover it the same way. This one bit LIVE: `audio` is
+*     constructed early (fourth) but `subscribeToAudioAnalyzerReadiness`
+*     wasn't called until much later (after `nodeLifecycle` exists), so the
+*     old code never noticed `this.audio` was still unsynced — until
+*     `ReadinessRegistry.onReadyState`'s `queueMicrotask` hydration replay
+*     (an already-`ready` cap fires the handler once, asynchronously, on
+*     subscribe) won the race against the `await buildOrchestratorControllers(...)`
+*     continuation in `onInitialize` that assigns `this.audio` — both are
+*     microtasks, and the replay's `queueMicrotask` was enqueued (during
+*     this still-synchronous function body) strictly before this function's
+*     `return` resolves the outer promise, so it always runs first. Fixed
+*     by syncing `this.audio` the instant it's constructed, exactly like
+*     `topology`/`reconcile`/`nodeLifecycle` — no lazy closure ever reads a
+*     controller before this function has assigned its real field.
+* Every other controller-to-controller reference in this function — even
+* ones that look like a forward ref (e.g. `loadShed`'s `attach` closure
+* onto `placement`, built one step later) — is a LAZY closure that is
+* never invoked synchronously during construction (only later, off
+* event-bus subscriptions, timers, or RPC handlers), so a plain local
+* `let` variable captured by reference is sufficient and exactly
+* preserves the original semantics: see each field's inline comment in
+* `index.ts` for the original construction-order reasoning, unchanged
+* here.
+*
+* `globalSettings` is a purely local variable — read/written ONLY by
+* closures built inside this same function (the one exception,
+* `deviceConfig`'s `setGlobalSettings`, is ALSO built here, so the local
+* variable stays the single source of truth for every reader). No code
+* outside this closure network ever read the former `this.globalSettings`
+* class field, so it isn't part of the returned `OrchestratorControllers`
+* — the field was removed from the class entirely (S11 Task 4 cleanup).
+* `localNodeId` IS returned — `index.ts` still reads `this.localNodeId`
+* from a couple of unrelated cap methods (`dumpDiagnostics`,
+* `getDecoderAssignments`), so the class field is populated once, from the
+* returned `OrchestratorControllers`, after this function returns.
+* `failoverPolicy` is the opposite case from `globalSettings` —
+* `applyRuntimeSettings` (unmoved) writes the REAL field on every future
+* settings change, so `nodeLifecycle`'s `failoverPolicy` closure MUST keep
+* reading through `deps.failoverPolicy()` (never a local snapshot) to see
+* those later updates.
+*/
+/**
 * Construct every orchestrator controller, wire the agent-lifecycle event
 * subscriptions + readiness seed + detection-wiring subscriptions, and
 * kick the eager reconcile — the ENTIRE former `onInitialize` body between
@@ -45311,6 +45643,7 @@ async function buildOrchestratorControllers(deps) {
 		localNodeId: () => localNodeId,
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
 		inferenceRotation,
@@ -45340,6 +45673,7 @@ async function buildOrchestratorControllers(deps) {
 		listZones: async (deviceId) => await zonesProvider?.listZones({ deviceId }) ?? [],
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		getEligibleInferenceDevices: (nodeId) => deps.getEligibleInferenceDevices(nodeId),
+		isNodeInferenceUsable: (nodeId) => deps.isNodeInferenceUsable(nodeId),
 		getInferenceDeviceCaps: (nodeId) => deps.getInferenceDeviceCaps(nodeId),
 		readPipelineDevicePin: (deviceId) => deps.readPipelineDevicePin(deviceId),
 		inferenceRotation,
@@ -45498,7 +45832,34 @@ async function buildOrchestratorControllers(deps) {
 		thresholds: DEFAULT_WATCHDOG_THRESHOLDS
 	});
 	pipelineWatchdog.start(deps.watchdogIntervalMs);
-	const pendingRetryTimer = setInterval(() => void reconcile.retryPendingDispatches(), PENDING_RETRY_INTERVAL_MS);
+	const blindMonitor = new DetectionBlindMonitor();
+	const pendingRetryTimer = setInterval(() => {
+		reconcile.retryPendingDispatches();
+		for (const blind of blindMonitor.sweep(Date.now())) {
+			deps.ctx().logger.error("camera is being analysed and detecting NOTHING", {
+				tags: { deviceId: blind.deviceId },
+				meta: {
+					blindForMs: blind.blindForMs,
+					thresholdMs: blind.thresholdMs
+				}
+			});
+			deps.ctx().eventBus.emit({
+				id: randomUUID(),
+				timestamp: /* @__PURE__ */ new Date(),
+				source: {
+					type: "device",
+					id: blind.deviceId,
+					deviceId: blind.deviceId
+				},
+				category: EventCategory.PipelineDetectionBlind,
+				data: {
+					deviceId: blind.deviceId,
+					blindForMs: blind.blindForMs,
+					thresholdMs: blind.thresholdMs
+				}
+			});
+		}
+	}, PENDING_RETRY_INTERVAL_MS);
 	const autoRebalanceTimer = setInterval(() => void placement.runAutoRebalance(), AUTO_REBALANCE_INTERVAL_MS);
 	deps.ctx().logger.info("Pipeline orchestrator detection-wiring subscriptions installed");
 	migrateLegacyFlagsToBindings({
@@ -45625,6 +45986,7 @@ async function buildOrchestratorControllers(deps) {
 		loadShed,
 		nodeStress,
 		watchdog: () => pipelineWatchdog,
+		blindMonitor: () => blindMonitor,
 		api: () => deps.ctx().api ?? null,
 		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger,
@@ -46202,6 +46564,48 @@ function deriveRuntimeSettings(config) {
 //#endregion
 //#region src/index.ts
 /**
+* addon-pipeline-orchestrator — hub-side camera-to-agent load balancer.
+*
+* Owns the control plane for the distributed detection pipeline. Tracks
+* which `addon-pipeline-runner` instance is responsible for each camera,
+* queries each runner's capacity + hardware profile, and dispatches
+* `attachCamera` / `detachCamera` cap calls to the appropriate runner via
+* the Moleculer broker. Persists manual pins via the per-device settings
+* store so user overrides survive hub restarts.
+*
+* Strictly control plane — never sees a frame, never runs inference, never
+* drains queues. The runner does that work locally on each vision node.
+*
+* ## Dispatch entrypoints
+*
+* - **`dispatchCamera(runnerConfig)`** — in-process only (not in the cap
+*   def). Called by `DetectionWiringService` with a freshly-built
+*   `RunnerCameraConfig`. Runs the L1/L2/L3 balancer, picks an agent, then
+*   issues `broker.call('pipeline-runner.pipeline-runner.attachCamera', ...)`.
+*   Caches the config so future rebalance / pinning can re-dispatch without
+*   the caller rebuilding it.
+*
+* - **`assignCamera({deviceId, agentNodeId})`** — cap method. Persists a
+*   manual `preferredAgent` pin to per-device settings and re-dispatches
+*   immediately if the camera is already attached.
+*
+* - **`unassignCamera({deviceId})`** — cap method. Clears the pin,
+*   detaches the camera from its current agent.
+*
+* - **`rebalance()`** — cap method. Walks every cached camera config and
+*   re-runs the balancer; migrates cameras whose current agent is no
+*   longer optimal. Pinned cameras are never migrated.
+*
+* ## Runner dispatch
+*
+* All runner calls go through `this.ctx.api.pipelineRunner.*` (the generated
+* tRPC cap router). The router extracts `nodeId` from the input and
+* routes transparently to the local runner (direct in-process call) or
+* to a remote agent (via Moleculer). Node discovery is driven by
+* `EventCategory.AgentOnline/AgentOffline` events forwarded by
+* `agent-registry.service.ts`.
+*/
+/**
 * The FULL action catalog, under the name the HUB HARVESTS.
 *
 * The hub's forked-addon harvest imports this entry module and reads the
@@ -46460,6 +46864,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			detachOn: (nodeId, deviceId) => this.detachOn(nodeId, deviceId),
 			readPipelinePin: (deviceId) => this.readPipelinePin(deviceId),
 			getEligibleInferenceDevices: (nodeId) => this.resolveEligibleInferenceDevices(nodeId),
+			isNodeInferenceUsable: (nodeId) => this.isNodeInferenceUsable(nodeId),
 			getInferenceDeviceCaps: (nodeId) => this.getInferenceDeviceCaps(nodeId),
 			readPipelineDevicePin: (deviceId) => this.readPipelineDevicePin(deviceId),
 			subscribeToAudioAnalyzerReadiness: (nodeId) => this.subscribeToAudioAnalyzerReadiness(nodeId),
@@ -47116,11 +47521,66 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		const stored = (await this.settingsStore.readAgentSettingsMap())[nodeId]?.inferenceDevices ?? {};
 		const { probed } = await this.probeNodeInferenceDevices(nodeId);
 		const catalog = await this.settingsStore.getCatalogForNode(nodeId);
-		const { eligible, excluded } = resolveInferenceDeviceEligibility(probed, stored, catalog ? makeRootCapabilityGuard(catalog) : void 0);
+		const eligibility = resolveInferenceDeviceEligibility(probed, stored, catalog ? makeRootCapabilityGuard(catalog) : void 0);
+		const { eligible, excluded } = eligibility;
 		this.logInferenceDeviceShrinkage(nodeId, eligible, excluded);
+		this.noteNodeInferenceUsability(nodeId, resolveNodeInferenceUsability(eligibility));
 		return eligible;
 	}
 	/**
+	* Fold one usability observation into the placement mirror and announce the
+	* transition.
+	*
+	* This is called from the SAME read the dispatcher already makes, plus the
+	* session controller's background refresher — so a node's usability is
+	* re-observed on the cadence placement itself runs at, without a timer of
+	* its own. The mirror is what makes the answer readable synchronously by
+	* `detectionEligibleNodes`' callers; see its own docblock for why it refuses
+	* to act on a single bad read.
+	*
+	* The system event is emitted ONLY on the transition into unusable — the
+	* kind is `node-inference-unavailable` and it is authorable in a rule.
+	* Recovery is logged and deliberately has no event: a notification saying
+	* the broken thing is no longer broken is a second rule nobody asked for.
+	*/
+	noteNodeInferenceUsability(nodeId, usability) {
+		const transition = this.nodeInferenceUsability.observe(nodeId, usability.usable);
+		if (transition === null) return;
+		if (transition === "recovered") {
+			this.ctx.logger.info("node inference recovered — back in the placement candidate set", {
+				tags: { nodeId },
+				meta: { eligible: usability.eligibleKeys }
+			});
+			return;
+		}
+		this.ctx.logger.error("node has NO usable inference device — removed from the placement candidate set", {
+			tags: { nodeId },
+			meta: {
+				unavailable: usability.unavailableKeys,
+				eligible: usability.eligibleKeys
+			}
+		});
+		this.ctx.eventBus.emit({
+			id: randomUUID(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: "pipeline-orchestrator",
+				addonId: "pipeline-orchestrator"
+			},
+			category: EventCategory.PipelineNodeInferenceUnavailable,
+			data: {
+				nodeId,
+				unavailableDeviceKeys: usability.unavailableKeys
+			}
+		});
+	}
+	/** Can this node be given cameras? Read synchronously by the two dispatch
+	*  paths before they hand `eligibleNodes` to the balancer. */
+	isNodeInferenceUsable(nodeId) {
+		return this.nodeInferenceUsability.isUsable(nodeId);
+	}
+	/**
 	* Per-node signature of the last logged eligible/excluded split, so
 	* {@link logInferenceDeviceShrinkage} fires on CHANGE only. This runs on
 	* every camera dispatch; without the gate it would be one line per dispatch
@@ -47128,6 +47588,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	*/
 	lastInferenceEligibilitySignature = /* @__PURE__ */ new Map();
 	/**
+	* Which nodes can still infer. Refreshed by
+	* {@link resolveEligibleInferenceDevices}; read synchronously by both
+	* dispatch paths so a node whose every enabled accelerator vanished stops
+	* receiving cameras. little-unraid was handed cameras for a whole day in
+	* exactly that state.
+	*/
+	nodeInferenceUsability = new NodeInferenceUsabilityMirror();
+	/**
 	* Say out loud which of a node's inference devices were dropped from the
 	* candidate set, and why.
 	*

package/dist/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-DQ-9VJzz.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_orchestrator_widgets-CIgtalSC.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline-orchestrator",
-  "version": "1.2.55",
+  "version": "1.2.56",
   "description": "Hub-side camera-to-agent load balancer — tracks runner capacity and dispatches attachCamera calls to the optimal pipeline-runner instance",
   "keywords": [
     "camstack",