@camstack/addon-pipeline 1.1.43 → 1.1.44

package/dist/stream-broker/index.mjs

@@ -1,6 +1,6 @@
 import { t as __require } from "../chunk-BdkLduGY.mjs";
-import { $ as discriminatedUnion, B as DeviceType, D as nodePin, F as webrtcSessionCapability, G as makeSourceBrokerId, H as createEvent, I as errMsg, L as BaseAddon, N as streamBrokerCapability, Q as boolean, R as CAM_PROFILE_ORDER, V as EventCategory, W as makeProfileBrokerId, X as _enum, Z as array, at as string, c as EncodeProfileSchema, d as RingBuffer, g as cameraStreamsCapability, it as record, nt as number, ot as union, p as addonWidgetsSourceCapability, q as parseProfileBrokerId, rt as object, tt as literal, w as maskUrlCredentials, z as DeviceFeature } from "../dist-GFd8M6KO.mjs";
-import { n as DecoderSessionProxy, t as FrameHandlePlane } from "../frame-handle-plane-E_AsR77T.mjs";
+import { $ as boolean, B as DeviceType, D as nodePin, F as webrtcSessionCapability, G as makeProfileBrokerId, H as createEvent, I as errMsg, J as parseProfileBrokerId, K as makeSourceBrokerId, L as BaseAddon, N as streamBrokerCapability, Q as array, R as CAM_PROFILE_ORDER, V as EventCategory, W as isEvent, Z as _enum, at as record, c as EncodeProfileSchema, d as RingBuffer, et as discriminatedUnion, g as cameraStreamsCapability, it as object, nt as literal, ot as string, p as addonWidgetsSourceCapability, rt as number, st as union, w as maskUrlCredentials, z as DeviceFeature } from "../dist-CgBGV988.mjs";
+import { a as DecoderSessionProxy, i as FrameHandlePlane, r as profileForStreamId } from "../remote-source-plane-B4hRwchu.mjs";
 import { t as createFileDataPlaneHandler } from "../model-download-service-C-IHWnXx-BPy6aoAx.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
@@ -5173,6 +5173,16 @@ var RtspListenServer = class RtspListenServer {
 //#endregion
 //#region src/stream-broker/rtsp/rtsp-restream-provider.ts
 /**
+* Parse the numeric deviceId out of a canonical brokerId
+* (`${deviceId}/${camStreamId}` or `${deviceId}/${profile}`). Returns
+* `undefined` for a malformed id — so every device-scoped log line here
+* can carry `tags.deviceId` without risking a bogus tag value.
+*/
+function deviceIdFromBrokerId$1(brokerId) {
+	const parsed = Number(brokerId.split("/")[0]);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
 * Internal sub-object of `StreamBrokerManager` that implements the RTSP
 * restream bookkeeping. No longer registered as a separate capability —
 * accessed via passthrough methods on `StreamBrokerManager`.
@@ -5255,20 +5265,26 @@ var RtspRestreamProviderImpl = class {
 		const token = this.server.regenerateToken(brokerId);
 		if (token) {
 			this.persistTokens();
-			this.logger.info("RTSP token regenerated", { meta: {
-				brokerId,
-				tokenPrefix: token.slice(0, 8)
-			} });
+			this.logger.info("RTSP token regenerated", {
+				tags: { deviceId: deviceIdFromBrokerId$1(brokerId) },
+				meta: {
+					brokerId,
+					tokenPrefix: token.slice(0, 8)
+				}
+			});
 		}
 		return token;
 	}
 	setEnabled(brokerId, enabled) {
 		this.server.setEnabled(brokerId, enabled);
 		this.persistEnabled();
-		this.logger.info("RTSP restream state changed", { meta: {
-			brokerId,
-			enabled
-		} });
+		this.logger.info("RTSP restream state changed", {
+			tags: { deviceId: deviceIdFromBrokerId$1(brokerId) },
+			meta: {
+				brokerId,
+				enabled
+			}
+		});
 	}
 	isEnabled(brokerId) {
 		return this.server.isEnabled(brokerId);
@@ -9433,7 +9449,6 @@ var StreamBroker = class StreamBroker {
 	static RTP_ACTIVITY_TIMEOUT_MS = 8e3;
 	manualStop = false;
 	stopping = false;
-	restreamers = [];
 	pipeServer;
 	rtspRestreamer;
 	preBuffer;
@@ -9610,9 +9625,6 @@ var StreamBroker = class StreamBroker {
 			url
 		};
 	}
-	setRestreamers(restreamers) {
-		this.restreamers = restreamers;
-	}
 	/**
 	* Inject a manager-owned resolver for this broker's OWN RTSP restream URL
 	* (`rtsp://127.0.0.1:<port>/<token>[/muted]`). When the source is an RTP
@@ -10053,10 +10065,6 @@ var StreamBroker = class StreamBroker {
 				this.logger?.info("First keyframe received — decoder can start");
 			}
 		}
-		for (const restreamer of this.restreamers) {
-			const streamId = `${this.deviceId}/video`;
-			restreamer.pushPacket(streamId, packet);
-		}
 		if (packet.type === "video" && this.firstKeyframeReceived) {
 			const decoderPacket = this.decoderPacketWithParamSets(packet);
 			this.decoderSeedBuffer.push(decoderPacket);
@@ -12153,6 +12161,168 @@ var TranscodePipelineManager = class {
 	}
 };
 //#endregion
+//#region src/stream-broker/webrtc/remote-encoded-source-broker.ts
+var RemoteEncodedSourceBroker = class {
+	api;
+	logger;
+	deviceId;
+	streamId;
+	ownerNodeId;
+	hostname;
+	createBroker;
+	/** Single-flight acquire. */
+	pending = null;
+	disposed = false;
+	constructor(options) {
+		this.api = options.api;
+		this.logger = options.logger.withTags({
+			deviceId: options.deviceId,
+			streamId: options.streamId
+		});
+		this.deviceId = options.deviceId;
+		this.streamId = options.streamId;
+		this.ownerNodeId = options.ownerNodeId;
+		this.hostname = options.reachableHost;
+		this.createBroker = options.createBroker;
+	}
+	/**
+	* Single-flight: acquire the owner restream + construct/start the inner
+	* broker once, sharing the same instance across concurrent callers. A
+	* rejected acquire is retryable — the next `getBroker()` re-attempts from
+	* scratch (fresh URL/token).
+	*/
+	async getBroker() {
+		if (this.disposed) throw new Error("RemoteEncodedSourceBroker: getBroker after dispose");
+		if (!this.pending) {
+			const creation = this.createEntry();
+			this.pending = creation;
+			creation.catch(() => {
+				if (this.pending === creation) this.pending = null;
+			});
+		}
+		return (await this.pending).broker;
+	}
+	/** Stop the inner broker and release the acquired restream once. Idempotent. */
+	async dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		const pending = this.pending;
+		this.pending = null;
+		if (!pending) return;
+		let entry;
+		try {
+			entry = await pending;
+		} catch {
+			return;
+		}
+		await entry.broker.stop().catch((err) => {
+			this.logger.warn("remote-encoded source broker: inner broker stop failed", { meta: {
+				streamId: this.streamId,
+				error: errMsg(err)
+			} });
+		});
+		await this.api.streamBroker.releaseStreamWithCodec.mutate({ pipelineKey: entry.pipelineKey }, nodePin(this.ownerNodeId)).catch((err) => {
+			this.logger.debug("remote-encoded source broker: releaseStreamWithCodec failed (benign on hub restart)", { meta: {
+				streamId: this.streamId,
+				pipelineKey: entry.pipelineKey,
+				error: errMsg(err)
+			} });
+		});
+	}
+	async createEntry() {
+		const { api, deviceId, streamId, ownerNodeId } = this;
+		if (this.hostname === void 0) throw new Error("RemoteEncodedSourceBroker: owner hostname unresolvable — set frameSource.hubHostnameOverride or CAMSTACK_HUB_URL (a 127.0.0.1 restream URL would dial the wrong box)");
+		const profile = profileForStreamId(await api.streamBroker.listAllProfileSlots.query(void 0, nodePin(ownerNodeId)), deviceId, streamId);
+		if (profile === null) throw new Error(`RemoteEncodedSourceBroker: no broker profile is fed by camStream '${streamId}' of device ${deviceId} — cannot acquire the owner restream`);
+		const rtpSource = await api.streamBroker.getStreamWithCodec.mutate({
+			deviceId,
+			video: "copy",
+			audio: "none",
+			profile,
+			hostname: this.hostname,
+			tag: `webrtc:remote-encoded:${deviceId}/${streamId}`
+		}, nodePin(ownerNodeId));
+		const source = {
+			type: "rtsp",
+			url: rtpSource.url,
+			videoCodec: rtpSource.videoCodec
+		};
+		const brokerId = `${deviceId}/${profile}`;
+		const broker = this.createBroker({
+			brokerId,
+			logger: this.logger.child(profile)
+		});
+		broker.setSourceProvider(() => source);
+		await broker.start(source);
+		this.logger.info("remote-encoded source broker: owner restream acquired", { meta: {
+			streamId,
+			profile,
+			codec: rtpSource.videoCodec,
+			pipelineKey: rtpSource.pipelineKey,
+			hostname: this.hostname
+		} });
+		return {
+			broker,
+			pipelineKey: rtpSource.pipelineKey
+		};
+	}
+};
+//#endregion
+//#region src/stream-broker/webrtc/resolve-tier-slot.ts
+/**
+* `resolveTierSlot` — pure helper: given an owner's profile slots, a
+* deviceId, and a preferred tier, resolve WHICH assigned tier camStream to
+* consume.
+*
+* Slice 3b (ADAPTIVE-target WebRTC live-view for remote-owned cameras,
+* lazy-per-tier). The exact-tier slot wins when it is assigned; otherwise
+* falls back through the canonical `CAM_PROFILE_ORDER` (high→mid→low) — the
+* same single-source tier order used by `stream-broker-manager` and the
+* analogous no-hints tier-selection fallback in `broker-webrtc-server.ts`.
+*/
+/**
+* Resolve the camStream feeding `deviceId` at `preferredTier`. Prefers an
+* exact-tier match; when that tier is unassigned, falls back through
+* `TIER_PREFERENCE` order to the first assigned tier. Returns `null` when
+* the device has no assigned slot at all. Pure; never mutates `slots`.
+*/
+function resolveTierSlot(slots, deviceId, preferredTier) {
+	const deviceSlots = slots.filter((slot) => slot.deviceId === deviceId);
+	const exact = deviceSlots.find((slot) => slot.profile === preferredTier && slot.sourceCamStreamId !== null);
+	if (exact && exact.sourceCamStreamId !== null) return {
+		camStreamId: exact.sourceCamStreamId,
+		profile: exact.profile
+	};
+	for (const tier of CAM_PROFILE_ORDER) {
+		const match = deviceSlots.find((slot) => slot.profile === tier && slot.sourceCamStreamId !== null);
+		if (match && match.sourceCamStreamId !== null) return {
+			camStreamId: match.sourceCamStreamId,
+			profile: match.profile
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/stream-broker/webrtc/webrtc-source-mode.ts
+/**
+* Decide how a WebRTC live-view node sources a camera. Owner==self → the
+* local broker path (unchanged). Owner≠self + reachable → a remote-encoded
+* adapter dialing the owner restream. Owner≠self + no reachableHost →
+* unresolvable (fail fast; a 127.0.0.1 restream URL would dial the wrong box).
+*/
+function resolveWebrtcSourceMode(input) {
+	if (input.ownerNodeId === input.ownNodeId) return { kind: "local" };
+	if (input.reachableHost === void 0) return {
+		kind: "unresolvable",
+		ownerNodeId: input.ownerNodeId
+	};
+	return {
+		kind: "remote-adapter",
+		ownerNodeId: input.ownerNodeId,
+		reachableHost: input.reachableHost
+	};
+}
+//#endregion
 //#region src/stream-broker/stream-broker/stream-broker-manager.ts
 /**
 * Resolve a derived stream's source to a physical camStreamId, if it is pinned
@@ -12289,6 +12459,19 @@ function findProfileForStream(map, camStreamId) {
 	return null;
 }
 /**
+* Pure lookup behind `StreamBrokerManager`'s `profileTierResolver` closure
+* (Slice 3b Task 2). `localLookup` mirrors today's behavior — parse the
+* brokerId and walk the LOCAL device's `this.assignments` map — which is
+* always empty for a remote-owned camera, so it returns null for every
+* remote-ensured adapter's brokerId. `remoteBrokerTiers` is the fallback
+* populated at the remote-adapter ensure site (Task 3) so `selectBestBroker`
+* can still tier-match a remote-owned camera's broker. Local wins when both
+* resolve a tier — a local broker is never shadowed by a stale remote entry.
+*/
+function resolveBrokerTier(brokerId, localLookup, remoteBrokerTiers) {
+	return localLookup(brokerId) ?? remoteBrokerTiers.get(brokerId) ?? null;
+}
+/**
 * Watchdog parameters for the stream-health emitter. Brokers that have
 * received zero video packets for STREAM_STALE_TIMEOUT_MS are reported
 * as `stream.offline`; the next packet flips them back to `stream.online`.
@@ -12327,7 +12510,7 @@ function parseBrokerId(brokerId) {
 		camStreamId
 	};
 }
-var StreamBrokerManager = class {
+var StreamBrokerManager = class StreamBrokerManager {
 	/**
 	* brokers keyed by brokerId = `${deviceId}/${camStreamId}`.
 	*
@@ -12396,7 +12579,6 @@ var StreamBrokerManager = class {
 	* it down on idle / retract. Populated by {@link attachDerivedFeeder}.
 	*/
 	derivedFeeders = /* @__PURE__ */ new Map();
-	restreamers = [];
 	staticDecoders;
 	logger;
 	/** Public accessor for same-process callers (e.g. `CameraStreamsProvider.pickStream`)
@@ -12415,7 +12597,6 @@ var StreamBrokerManager = class {
 	* next pull after a hub restart. Keyed by `brokerIdFor(deviceId, camStreamId)`.
 	*/
 	lastProbedByBroker = /* @__PURE__ */ new Map();
-	capabilities = null;
 	/**
 	* tRPC api proxy injected from the host addon. Used to resolve the
 	* `decoder` capability (and any future cross-cap consumers) via the
@@ -12444,9 +12625,66 @@ var StreamBrokerManager = class {
 	* node. `null` until `setApiAccess` wires it (falls back to unpinned).
 	*/
 	localNodeId = null;
+	/**
+	* Short-TTL cache of `clusterRoles.ingestNode` (via `getIngestOwner`) for the
+	* `ensureBroker` dormancy gate — the reconcile calls `ensureBroker` per
+	* camera, so a per-call cross-node query would be wasteful. Refreshed lazily
+	* when older than {@link INGEST_OWNER_CACHE_TTL_MS}. `null` = never resolved.
+	*/
+	cachedIngestOwnerNodeId = null;
+	cachedIngestOwnerAt = 0;
+	static INGEST_OWNER_CACHE_TTL_MS = 6e4;
+	lastOwnershipReconcile = Promise.resolve();
 	defaultPreBufferSec = 10;
 	webrtcServer = null;
 	/**
+	* brokerId → the remote-encoded adapter backing a non-owned camera's WebRTC
+	* session (Slice 3 Task 3 — cross-node ingest wiring). Mirrors `this.brokers`
+	* for the cross-node leg: `ensureBrokerForWebrtcSession` get-or-creates one
+	* when `getIngestOwner` resolves to a DIFFERENT node than this one, and
+	* tears it down on the adapter's inner broker's own `onDemandChange(false)`
+	* edge (last-session-idle) — the same hook `attachDerivedFeeder` uses to
+	* tear down a derived feeder.
+	*/
+	remoteBrokerAdapters = /* @__PURE__ */ new Map();
+	/**
+	* brokerId → in-flight `ensureBrokerForWebrtcSession` get-or-create for
+	* that broker's remote adapter. Manager-level single-flight guard: two
+	* concurrent WebRTC session creations for the SAME non-owned brokerId
+	* (a real race — first-session-ever for a camera whose owner is a
+	* different node) both pass the `remoteBrokerAdapters.has()` early-return
+	* with the map still empty, because the check and the eventual `.set()`
+	* straddle an `await getIngestOwner.query()`. Without this guard both
+	* callers would construct their own `RemoteEncodedSourceBroker`, both
+	* `.set()` into `remoteBrokerAdapters` (second overwrites first), and
+	* both acquire the owner's restream (`getStreamWithCodec`) — the first
+	* adapter becomes unreachable from the map so its `onDemandChange(false)`
+	* teardown never runs and its restream refcount leaks forever. Concurrent
+	* callers instead await the SAME promise, so exactly one adapter is
+	* constructed, registered, and refcounted per brokerId.
+	*/
+	remoteAdapterEnsures = /* @__PURE__ */ new Map();
+	/**
+	* brokerId → the profile tier a remote-ensured adapter was created for
+	* (Slice 3b Task 2). `this.assignments` only tracks LOCALLY-owned devices,
+	* so the `profileTierResolver` closure below always misses for a remote
+	* adapter's brokerId — this map is the fallback so `selectBestBroker` can
+	* still tier-match it. Populated at the ensure site alongside
+	* `remoteBrokerAdapters.set(brokerId, ...)` (Task 3 threads the tier in)
+	* and cleared at every `remoteBrokerAdapters.delete(brokerId)` site so no
+	* stale tier lingers past the adapter's own lifetime.
+	*/
+	remoteBrokerTiers = /* @__PURE__ */ new Map();
+	/**
+	* Injected factory for the inner broker a `RemoteEncodedSourceBroker`
+	* drives. Production wraps the real `StreamBroker` — this leg never decodes
+	* locally, so the decoder/audio-codec caps and local-node pin are unused
+	* (mirrors the recommendation in `RemoteEncodedSourceBroker`'s doc comment).
+	* Tests substitute a fake via `setRemoteEncodedBrokerFactory` so no real
+	* RTSP dial happens.
+	*/
+	createRemoteEncodedBroker = (deps) => new StreamBroker(deps.brokerId, null, deps.logger, null, null);
+	/**
 	* Transcode-pipeline manager — backs `getStreamWithCodec`. Lazily
 	* created on first acquire, lives until `destroyAll`.
 	*/
@@ -12673,9 +12911,6 @@ var StreamBrokerManager = class {
 			}
 		};
 	}
-	setCapabilitiesAccess(access) {
-		this.capabilities = access;
-	}
 	/**
 	* Wire the addon's `ctx.api` proxy. Required for the broker to
 	* resolve the `decoder` capability via tRPC — see
@@ -12720,6 +12955,61 @@ var StreamBrokerManager = class {
 		this.eventBus = bus;
 		this.startStreamHealthWatchdog();
 		this.subscribePlaceholderStateSources(bus);
+		this.subscribeIngestOwnerChanges(bus);
+	}
+	/**
+	* Track the cluster camera-source owner from the orchestrator's pushed
+	* `PipelineIngestOwnerChanged` events instead of polling `getIngestOwner`
+	* on every `ensureBroker`. The orchestrator re-emits on every node-capability
+	* refresh (boot / agent online-offline / ingest flip), so this keeps the
+	* ingest-owner gate current and prompt; the query in {@link isLocalIngestOwner}
+	* survives only as a cold-start + long-backstop reconcile (loss-safety).
+	*/
+	subscribeIngestOwnerChanges(bus) {
+		bus.subscribe({ category: EventCategory.PipelineIngestOwnerChanged }, (event) => {
+			if (!isEvent(event, EventCategory.PipelineIngestOwnerChanged)) return;
+			const { ownerNodeId } = event.data;
+			const changed = this.cachedIngestOwnerNodeId !== ownerNodeId;
+			this.cachedIngestOwnerNodeId = ownerNodeId;
+			this.cachedIngestOwnerAt = Date.now();
+			if (changed) this.logger.debug("ingest owner changed (pushed)", { meta: {
+				ownerNodeId,
+				self: this.localNodeId
+			} });
+			this.lastOwnershipReconcile = this.reconcileOwnershipTeardown();
+		});
+	}
+	/**
+	* Tear down every LOCAL physical source broker when this node is no longer the
+	* cluster ingest owner. `this.brokers` holds only physical source + derived
+	* brokers (the `RemoteEncodedSourceBroker` restream adapters a non-owner uses
+	* live in the separate `remoteBrokerAdapters` map, so they are untouched).
+	* Re-creation is blocked by the ingest-owner gate on this node; the node's
+	* consumers re-source from the new owner's restream via the orchestrator's
+	* re-dispatch. No-op when this node IS the owner or holds no brokers, so a
+	* repeated same-owner re-emit is cheap.
+	*/
+	async reconcileOwnershipTeardown() {
+		if (this.localNodeId === null) return;
+		if (this.cachedIngestOwnerNodeId === null) return;
+		if (this.cachedIngestOwnerNodeId === this.localNodeId) return;
+		if (this.brokers.size === 0) return;
+		const brokerIds = [...this.brokers.keys()];
+		this.logger.info("ingest owner moved away — tearing down local physical brokers", { meta: {
+			owner: this.cachedIngestOwnerNodeId,
+			self: this.localNodeId,
+			count: brokerIds.length
+		} });
+		for (const brokerId of brokerIds) {
+			const parsed = this.parseBrokerId(brokerId);
+			if (!parsed) continue;
+			await this.releaseBroker(parsed.deviceId, parsed.camStreamId).catch((err) => {
+				this.logger.warn("reverse-flip teardown: releaseBroker failed", { meta: {
+					brokerId,
+					error: errMsg(err)
+				} });
+			});
+		}
 	}
 	/**
 	* Subscribe to the cap-scoped bus events that drive the per-broker
@@ -12763,14 +13053,242 @@ var StreamBrokerManager = class {
 	}
 	setWebrtcServer(server) {
 		this.webrtcServer = server;
-		server.setProfileTierResolver((brokerId) => {
-			const parsed = this.parseBrokerId(brokerId);
+		server.setProfileTierResolver((brokerId) => resolveBrokerTier(brokerId, (id) => {
+			const parsed = this.parseBrokerId(id);
 			if (!parsed) return null;
 			return findProfileForStream(this.assignments.get(parsed.deviceId)?.map ?? {}, parsed.camStreamId);
-		});
+		}, this.remoteBrokerTiers));
 		server.setSourceRestreamUrlResolver((brokerId) => this.rtspProvider.getEntry(brokerId)?.url ?? null);
+		server.setEnsureAdaptiveTierBrokerHook((deviceId, tier) => this.ensureRemoteAdaptiveTierBroker(deviceId, tier));
 		for (const [brokerId, broker] of this.brokers) server.registerBroker(brokerId, broker);
 	}
+	/**
+	* Test/injection seam for the inner broker a `RemoteEncodedSourceBroker`
+	* drives (Slice 3 Task 3). Production never calls this — the field default
+	* already wraps the real `StreamBroker`. Mirrors the `createBroker`
+	* injection point `RemoteEncodedSourceBroker` itself exposes.
+	*/
+	setRemoteEncodedBrokerFactory(factory) {
+		this.createRemoteEncodedBroker = factory;
+	}
+	/**
+	* Ensure a broker exists for `brokerId` before a WebRTC session subscribes
+	* to it (Slice 3 Task 3 — cross-node ingest wiring). Called by
+	* `WebrtcSessionProvider.createSession`/`handleOffer` right before they
+	* delegate to `BrokerWebrtcServer`.
+	*
+	* No-op when a LOCAL broker already covers `brokerId` — the
+	* default/dormant state while every camera's `ingestNode` is the hub, so
+	* this returns on the very first check with ZERO extra calls (byte-
+	* identical to today). Otherwise resolves the cluster's camera-source
+	* owner (`getIngestOwner`) and branches via `resolveWebrtcSourceMode`:
+	*
+	*   - `local` → this node IS the owner but hasn't published/registered a
+	*     broker for this brokerId (a genuinely missing/misconfigured
+	*     stream) — do nothing and let `BrokerWebrtcServer` throw its normal
+	*     "No broker for stream" error, unchanged.
+	*   - `remote-adapter` → get-or-create a `RemoteEncodedSourceBroker` that
+	*     dials the owner's compressed passthrough restream, register its
+	*     inner broker with the WebRTC server exactly like a local broker (so
+	*     `setupSessionForBroker`'s resolution, tier logic, and everything
+	*     downstream see an ordinary `IStreamBroker` — this leg never touches
+	*     `broker-webrtc-server.ts`), and tear the adapter down on its own
+	*     `onDemandChange(false)` (last-session-idle) edge, mirroring
+	*     `attachDerivedFeeder`'s local-broker teardown hook.
+	*   - `unresolvable` → the owner is set but has no reachable host —
+	*     throw a descriptive error rather than let the session hang.
+	*
+	* `camStreamId === undefined` (an `adaptive` target with no cam stream
+	* pinned yet) can't resolve a single owner profile to acquire — falls
+	* through to the natural local-only resolution/error, same as today.
+	*
+	* `tier` (Slice 3b Task 3) is an optional hint from
+	* `ensureRemoteAdaptiveTierBroker` — the profile the caller already
+	* resolved `camStreamId` from via `resolveTierSlot`. When set, it is
+	* recorded into `remoteBrokerTiers` alongside the adapter registration so
+	* `resolveBrokerTier`/`selectBestBroker` can tier-match this brokerId even
+	* though it's absent from `this.assignments` (remote-owned). Callers that
+	* don't have a resolved tier (the plain WebRTC session path) omit it —
+	* unchanged behavior.
+	*/
+	async ensureBrokerForWebrtcSession(deviceId, brokerId, camStreamId, tier) {
+		if (this.brokers.has(brokerId)) return;
+		if (this.remoteBrokerAdapters.has(brokerId)) return;
+		if (camStreamId === void 0) return;
+		if (!this.api || this.localNodeId === null) return;
+		const api = this.api;
+		const ownNodeId = this.localNodeId;
+		const existingEnsure = this.remoteAdapterEnsures.get(brokerId);
+		if (existingEnsure) {
+			await existingEnsure;
+			return;
+		}
+		const ensure = this.createRemoteBrokerAdapterForSession(api, ownNodeId, deviceId, brokerId, camStreamId, tier);
+		this.remoteAdapterEnsures.set(brokerId, ensure);
+		try {
+			await ensure;
+		} finally {
+			this.remoteAdapterEnsures.delete(brokerId);
+		}
+	}
+	/**
+	* Single-flight body for `ensureBrokerForWebrtcSession`'s remote-adapter
+	* get-or-create — resolves the ingest owner, and for `remote-adapter` mode
+	* constructs the `RemoteEncodedSourceBroker`, registers it with the WebRTC
+	* server, and wires its idle-teardown hook. Only ever run once per
+	* brokerId at a time; see `remoteAdapterEnsures`.
+	*/
+	async createRemoteBrokerAdapterForSession(api, ownNodeId, deviceId, brokerId, camStreamId, tier) {
+		let owner;
+		try {
+			owner = await api.pipelineOrchestrator.getIngestOwner.query();
+		} catch (err) {
+			this.logger.debug("webrtc-session: getIngestOwner unavailable — defaulting to local (cap not mounted yet?)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			owner = { ownerNodeId: ownNodeId };
+		}
+		const mode = resolveWebrtcSourceMode({
+			ownerNodeId: owner.ownerNodeId,
+			ownNodeId,
+			reachableHost: owner.reachableHost
+		});
+		if (mode.kind === "local") return;
+		if (mode.kind === "unresolvable") {
+			const configIssueSuffix = owner.configIssue ? ` (${owner.configIssue})` : "";
+			throw new Error(`webrtc-session: device ${deviceId} is owned by node "${mode.ownerNodeId}" but no reachable host is configured for it — cannot source its WebRTC stream remotely${configIssueSuffix}`);
+		}
+		const adapter = new RemoteEncodedSourceBroker({
+			api,
+			logger: this.logger.child("remote-encoded").withTags({ deviceId }),
+			deviceId,
+			streamId: camStreamId,
+			ownerNodeId: mode.ownerNodeId,
+			reachableHost: mode.reachableHost,
+			createBroker: this.createRemoteEncodedBroker
+		});
+		this.remoteBrokerAdapters.set(brokerId, adapter);
+		if (tier) this.remoteBrokerTiers.set(brokerId, tier);
+		let broker;
+		try {
+			broker = await adapter.getBroker();
+		} catch (err) {
+			this.remoteBrokerAdapters.delete(brokerId);
+			this.remoteBrokerTiers.delete(brokerId);
+			throw err;
+		}
+		this.webrtcServer?.registerBroker(brokerId, broker);
+		let unsubscribeDemand = () => {};
+		unsubscribeDemand = broker.onDemandChange((active) => {
+			if (active) return;
+			unsubscribeDemand();
+			this.remoteBrokerAdapters.delete(brokerId);
+			this.remoteBrokerTiers.delete(brokerId);
+			this.webrtcServer?.unregisterBroker(brokerId);
+			adapter.dispose().catch((disposeErr) => {
+				this.logger.warn("webrtc-session: remote-encoded adapter dispose failed", {
+					tags: { deviceId },
+					meta: {
+						brokerId,
+						error: errMsg(disposeErr)
+					}
+				});
+			});
+		});
+	}
+	/**
+	* Idempotent cleanup for a remote adapter registered by
+	* `ensureBrokerForWebrtcSession`. `WebrtcSessionProvider.createSession`/
+	* `handleOffer` call this when the downstream `BrokerWebrtcServer`
+	* delegate throws AFTER the adapter was already registered.
+	*
+	* Without this, teardown is driven ONLY by the inner broker's
+	* `onDemandChange(true→false)` edge (last-WebRTC-subscriber-leaves). If
+	* the delegate never succeeds, demand never reaches `true`, that edge
+	* never fires, and the adapter + its WebRTC registration + the owner
+	* restream refcount (`releaseStreamWithCodec`) leak permanently.
+	*
+	* A cheap no-op when no remote adapter exists for `brokerId` — the
+	* owner==self / local-broker path never registers one, so this call adds
+	* zero behavior there. Also safe if the adapter was already torn down
+	* (e.g. a racing `onDemandChange(false)` edge) — `RemoteEncodedSourceBroker
+	* .dispose()` is itself idempotent. Dispose failures are logged and
+	* swallowed; this method never throws, so callers can always re-throw the
+	* original delegate error afterward.
+	*/
+	async disposeRemoteBrokerAdapterIfPresent(brokerId) {
+		const adapter = this.remoteBrokerAdapters.get(brokerId);
+		if (!adapter) return;
+		this.remoteBrokerAdapters.delete(brokerId);
+		this.remoteBrokerTiers.delete(brokerId);
+		this.webrtcServer?.unregisterBroker(brokerId);
+		try {
+			await adapter.dispose();
+		} catch (disposeErr) {
+			this.logger.warn("webrtc-session: remote-encoded adapter dispose failed (delegate-failure cleanup)", { meta: {
+				brokerId,
+				error: errMsg(disposeErr)
+			} });
+		}
+	}
+	/**
+	* Lazily ensure a remote adapter exists for a device's PREFERRED tier's
+	* camStream (Slice 3b Task 3 — adaptive WebRTC live-view for remote-owned
+	* cameras, lazy-per-tier). Adaptive-target sessions don't carry a
+	* session-pinned camStreamId, so unlike `ensureBrokerForWebrtcSession`
+	* this method's own job is resolving WHICH camStreamId the preferred tier
+	* maps to on the owning node — via `resolveTierSlot` walking the owner's
+	* `listAllProfileSlots` — before delegating to
+	* `ensureBrokerForWebrtcSession` for the actual get-or-create (reusing its
+	* single-flight guard and idle-teardown wiring unchanged).
+	*
+	* No-op for a LOCALLY-owned device — `this.assignments` already tracks it
+	* and the normal (non-adaptive) resolve path handles it; this returns on
+	* the very first check with ZERO extra calls, byte-identical to today.
+	*
+	* Mirrors `ensureBrokerForWebrtcSession`'s owner-resolution: graceful
+	* `getIngestOwner` (defaults to local on failure — cap not mounted yet) +
+	* `resolveWebrtcSourceMode`. `local` → return (nothing to do; the normal
+	* resolve path already covers this node being the owner). `unresolvable`
+	* → throw the same descriptive error rather than let a session hang.
+	*
+	* When the preferred tier (and every fallback tier) has no assigned slot
+	* on the owner, `resolveTierSlot` returns null — this method returns
+	* without throwing; the normal WebRTC resolve path will surface its own
+	* "no broker for stream" error naturally once a session actually tries to
+	* subscribe.
+	*/
+	async ensureRemoteAdaptiveTierBroker(deviceId, preferredTier) {
+		if (this.assignments.has(deviceId)) return;
+		if (!this.api || this.localNodeId === null) return;
+		const api = this.api;
+		const ownNodeId = this.localNodeId;
+		let owner;
+		try {
+			owner = await api.pipelineOrchestrator.getIngestOwner.query();
+		} catch (err) {
+			this.logger.debug("webrtc-adaptive-tier: getIngestOwner unavailable — defaulting to local (cap not mounted yet?)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			owner = { ownerNodeId: ownNodeId };
+		}
+		const mode = resolveWebrtcSourceMode({
+			ownerNodeId: owner.ownerNodeId,
+			ownNodeId,
+			reachableHost: owner.reachableHost
+		});
+		if (mode.kind === "local") return;
+		if (mode.kind === "unresolvable") {
+			const configIssueSuffix = owner.configIssue ? ` (${owner.configIssue})` : "";
+			throw new Error(`webrtc-adaptive-tier: device ${deviceId} is owned by node "${mode.ownerNodeId}" but no reachable host is configured for it — cannot source its WebRTC stream remotely${configIssueSuffix}`);
+		}
+		const hit = resolveTierSlot(await api.streamBroker.listAllProfileSlots.query(void 0, nodePin(mode.ownerNodeId)), deviceId, preferredTier);
+		if (hit === null) return;
+		const brokerId = makeSourceBrokerId(deviceId, hit.camStreamId);
+		await this.ensureBrokerForWebrtcSession(deviceId, brokerId, hit.camStreamId, hit.profile);
+	}
 	setProfileMapPersister(persister) {
 		this.profileMapPersister = persister;
 	}
@@ -12778,19 +13296,6 @@ var StreamBrokerManager = class {
 		this.assignments.clear();
 		for (const [k, v] of entries) this.assignments.set(k, v);
 	}
-	getLiveRestreamers() {
-		const live = this.capabilities?.getCollection?.("restreamer");
-		if (live && live.length > 0) return live;
-		return this.restreamers;
-	}
-	setRestreamers(restreamers) {
-		this.restreamers = restreamers;
-		for (const broker of this.brokers.values()) broker.setRestreamers(restreamers);
-		this.logger.info("Updated restreamers", { meta: { count: restreamers.length } });
-	}
-	getRestreamers() {
-		return this.restreamers;
-	}
 	getRtspRestreamProvider() {
 		return this.rtspProvider;
 	}
@@ -13320,12 +13825,16 @@ var StreamBrokerManager = class {
 				await broker.rotateDecoderSession(reason, agentNodeId);
 				rotated++;
 			} catch (err) {
-				this.logger.warn("decoder rotation failed", { meta: {
-					brokerId: broker.deviceId,
-					agentNodeId,
-					reason,
-					error: errMsg(err)
-				} });
+				const parsedBrokerId = parseBrokerId(broker.deviceId);
+				this.logger.warn("decoder rotation failed", {
+					...parsedBrokerId ? { tags: { deviceId: parsedBrokerId.deviceId } } : {},
+					meta: {
+						brokerId: broker.deviceId,
+						agentNodeId,
+						reason,
+						error: errMsg(err)
+					}
+				});
 			}
 		}
 		return rotated;
@@ -13415,6 +13924,7 @@ var StreamBrokerManager = class {
 			clearInterval(this.streamHealthTimer);
 			this.streamHealthTimer = void 0;
 		}
+		await this.lastOwnershipReconcile.catch(() => void 0);
 		if (this.transcodeManager) {
 			this.transcodeManager.shutdownAll();
 			this.transcodeManager = null;
@@ -13511,15 +14021,7 @@ var StreamBrokerManager = class {
 			packetCount: stats.preBufferPackets
 		};
 	}
-	async getStreamUrl(input) {
-		const prefix = input.streamId.split("/")[0];
-		if (!prefix) return { url: "" };
-		const deviceId = Number(prefix);
-		if (!Number.isFinite(deviceId)) return { url: "" };
-		for (const restreamer of this.getLiveRestreamers()) {
-			const match = restreamer.getExposedResources(deviceId).find((r) => r.format === input.format);
-			if (match) return { url: match.value };
-		}
+	async getStreamUrl(_input) {
 		return { url: "" };
 	}
 	async getRtspPort() {
@@ -13611,13 +14113,24 @@ var StreamBrokerManager = class {
 		return this.rtspProvider.getEntry(input.brokerId, input.hostname);
 	}
 	async regenerateRtspToken(input) {
-		this.logger.info("regenerateRtspToken called", { meta: { brokerId: input.brokerId } });
+		const parsedBrokerId = parseBrokerId(input.brokerId);
+		const tags = parsedBrokerId ? { deviceId: parsedBrokerId.deviceId } : void 0;
+		this.logger.info("regenerateRtspToken called", {
+			tags,
+			meta: { brokerId: input.brokerId }
+		});
 		const result = this.rtspProvider.regenerateToken(input.brokerId);
-		if (result) this.logger.info("regenerateRtspToken succeeded", { meta: {
-			brokerId: input.brokerId,
-			newTokenPrefix: result.slice(0, 8)
-		} });
-		else this.logger.warn("regenerateRtspToken failed — broker not found", { meta: { brokerId: input.brokerId } });
+		if (result) this.logger.info("regenerateRtspToken succeeded", {
+			tags,
+			meta: {
+				brokerId: input.brokerId,
+				newTokenPrefix: result.slice(0, 8)
+			}
+		});
+		else this.logger.warn("regenerateRtspToken failed — broker not found", {
+			tags,
+			meta: { brokerId: input.brokerId }
+		});
 		return result;
 	}
 	async setRtspEnabled(input) {
@@ -14656,18 +15169,69 @@ var StreamBrokerManager = class {
 	* registered. Tied to publish lifecycle: `publishCameraStream` calls
 	* this once per stream; `retractCameraStream` releases it.
 	*/
+	/**
+	* True when THIS node owns the cluster's camera source pull
+	* (`clusterRoles.ingestNode`). Backs the `ensureBroker` dormancy gate.
+	*
+	* Ownership is normally PUSHED by the orchestrator's
+	* `PipelineIngestOwnerChanged` event ({@link subscribeIngestOwnerChanges}),
+	* so the steady-state gate is a pure cache read — no per-`ensureBroker`
+	* cross-process query.
+	*
+	* - Not yet wired (`api`/`localNodeId` absent) → `true` (unchanged behavior;
+	*   the manager runs as today until `setApiAccess` supplies a node id).
+	* - Cached owner fresh (event-stamped, within {@link INGEST_OWNER_CACHE_TTL_MS}) →
+	*   pure comparison, no query.
+	* - Cold start / no event for the backstop window → a single `getIngestOwner`
+	*   reconcile query. It fails FAST now (FIX #1 makes an unregistered-provider
+	*   miss a precise error, not a 30s hang), so on failure we FAIL-OPEN: use the
+	*   last-known owner, or ALLOW when nothing is known — a rare transient
+	*   double-pull self-heals on the next pushed event, whereas denying would
+	*   starve the owner (no prebuffer, no recording).
+	*/
+	async isLocalIngestOwner() {
+		if (!this.api || this.localNodeId === null) return true;
+		const now = Date.now();
+		if (this.cachedIngestOwnerNodeId !== null && now - this.cachedIngestOwnerAt < StreamBrokerManager.INGEST_OWNER_CACHE_TTL_MS) return this.cachedIngestOwnerNodeId === this.localNodeId;
+		try {
+			const owner = await this.api.pipelineOrchestrator.getIngestOwner.query();
+			this.cachedIngestOwnerNodeId = owner.ownerNodeId;
+			this.cachedIngestOwnerAt = now;
+			return owner.ownerNodeId === this.localNodeId;
+		} catch (err) {
+			this.logger.debug("isLocalIngestOwner: getIngestOwner unavailable — fail-open", { meta: {
+				lastKnown: this.cachedIngestOwnerNodeId,
+				self: this.localNodeId,
+				error: errMsg(err)
+			} });
+			return this.cachedIngestOwnerNodeId === null ? true : this.cachedIngestOwnerNodeId === this.localNodeId;
+		}
+	}
 	async ensureBroker(deviceId, camStreamId) {
 		const cam = this.cameraStreams.get(deviceId)?.get(camStreamId);
 		if (!cam) return;
 		const brokerId = brokerIdFor(deviceId, camStreamId);
 		if (this.brokers.has(brokerId)) return;
+		if (!await this.isLocalIngestOwner()) {
+			this.logger.debug("ensureBroker: not the ingest owner — skipping local physical broker", {
+				tags: {
+					deviceId,
+					camStreamId
+				},
+				meta: {
+					brokerId,
+					ingestOwner: this.cachedIngestOwnerNodeId,
+					self: this.localNodeId
+				}
+			});
+			return;
+		}
 		const brokerLogger = this.logger.child(camStreamId).withTags({
 			deviceId,
 			camStreamId
 		});
 		const source = this.buildSourceFromCamStream(cam);
 		const broker = new StreamBroker(brokerId, this.buildDecoderCapApi(deviceId), brokerLogger, buildAudioCodecCapApi(this.api), this.localNodeId);
-		broker.setRestreamers(this.restreamers);
 		broker.setRestreamUrlResolver(() => this.rtspProvider.getEntry(brokerId)?.mutedUrl ?? null);
 		broker.setFfmpegBinaryPath(this.ffmpegConfig.binaryPath);
 		this.applyPreBufferConfig(broker, deviceId, camStreamId);
@@ -14855,44 +15419,10 @@ var StreamBrokerManager = class {
 		broker.setPreBufferEnabled(defaultWarm);
 		broker.setPreBufferDuration(defaultWarm ? this.defaultPreBufferSec : 0);
 	}
-	async fanOutRegistration(deviceId, brokerId, cam, broker) {
-		const log = this.logger.withTags({
-			deviceId,
-			brokerId,
-			camStreamId: cam.camStreamId
-		});
-		const localStreamUrl = broker.getLocalStreamUrl();
-		const codec = "h264";
-		const label = cam.label ?? brokerId;
-		for (const restreamer of this.getLiveRestreamers()) try {
-			await restreamer.registerDevice(deviceId, [{
-				streamId: brokerId,
-				label,
-				codec,
-				type: "video",
-				sourceUrl: localStreamUrl
-			}]);
-		} catch (err) {
-			log.error("Failed to register with restreamer", { meta: {
-				restreamerId: restreamer.id,
-				error: errMsg(err)
-			} });
-		}
+	async fanOutRegistration(_deviceId, brokerId, _cam, broker) {
 		if (this.webrtcServer) this.webrtcServer.registerBroker(brokerId, broker);
 	}
-	async fanOutUnregistration(deviceId, brokerId) {
-		const log = this.logger.withTags({
-			deviceId,
-			brokerId
-		});
-		for (const restreamer of this.getLiveRestreamers()) try {
-			await restreamer.unregisterDevice(deviceId);
-		} catch (err) {
-			log.error("Failed to unregister from restreamer", { meta: {
-				restreamerId: restreamer.id,
-				error: errMsg(err)
-			} });
-		}
+	async fanOutUnregistration(_deviceId, brokerId) {
 		if (this.webrtcServer) this.webrtcServer.unregisterBroker(brokerId);
 	}
 	brokerStatusToSlotStatus(status) {
@@ -16314,6 +16844,15 @@ var BrokerWebrtcServer = class {
 	* returns null when no restream is dialed → the feed falls back to stdin.
 	*/
 	sourceRestreamUrlResolver = null;
+	/**
+	* Hook the manager injects to ensure the wanted tier's ADAPTIVE broker is
+	* registered locally before `resolveBrokerId` runs — the manager wires it
+	* to `ensureRemoteAdaptiveTierBroker` so a remote node's broker gets a
+	* local registration in time for the resolve. No-ops on local-owned
+	* devices (the manager's own gate), so an unset hook or a local-owner call
+	* leaves adaptive resolution byte-identical to before this hook existed.
+	*/
+	ensureAdaptiveTierBroker = null;
 	/** sessionId → session entry. */
 	sessions = /* @__PURE__ */ new Map();
 	/**
@@ -16357,7 +16896,11 @@ var BrokerWebrtcServer = class {
 	}
 	registerBroker(brokerId, broker) {
 		this.brokers.set(brokerId, broker);
-		this.logger.info("WebRTC broker registered", { meta: { brokerId } });
+		const did = deviceIdFromBrokerId(brokerId);
+		this.logger.info("WebRTC broker registered", {
+			...did !== -1 ? { tags: { deviceId: did } } : {},
+			meta: { brokerId }
+		});
 	}
 	/**
 	* Provide a resolver that maps brokerId → current profile tier. The
@@ -16376,13 +16919,27 @@ var BrokerWebrtcServer = class {
 	setSourceRestreamUrlResolver(resolver) {
 		this.sourceRestreamUrlResolver = resolver;
 	}
+	/**
+	* Provide a hook that ensures the wanted tier's remote adaptive broker
+	* exists BEFORE `resolveBrokerId` runs, for ADAPTIVE streams only. The
+	* manager injects one wired to `ensureRemoteAdaptiveTierBroker` (Task 3).
+	* Without it (or on a local-owner call, which the hook itself no-ops on)
+	* adaptive resolution behaves exactly as before this hook existed.
+	*/
+	setEnsureAdaptiveTierBrokerHook(hook) {
+		this.ensureAdaptiveTierBroker = hook;
+	}
 	unregisterBroker(brokerId) {
 		this.brokers.delete(brokerId);
 		for (const [sid, entry] of this.sessions) if (entry.brokerId === brokerId) {
 			this.cleanupSession(sid);
 			entry.session.close().catch(() => {});
 		}
-		this.logger.info("WebRTC broker unregistered", { meta: { brokerId } });
+		const unregisterDid = deviceIdFromBrokerId(brokerId);
+		this.logger.info("WebRTC broker unregistered", {
+			...unregisterDid !== -1 ? { tags: { deviceId: unregisterDid } } : {},
+			meta: { brokerId }
+		});
 	}
 	supportsStream(streamId) {
 		if (this.brokers.has(streamId)) return true;
@@ -16476,11 +17033,21 @@ var BrokerWebrtcServer = class {
 	*/
 	async setupSessionForBroker(streamId, hints, opts) {
 		if (this.stopped) throw new Error("Server stopped");
-		const intent = streamId.endsWith("/adaptive") && opts.sessionId !== void 0 ? this.adaptiveIntent.get(opts.sessionId) : void 0;
+		const isAdaptiveStream = streamId.endsWith("/adaptive");
+		const intent = isAdaptiveStream && opts.sessionId !== void 0 ? this.adaptiveIntent.get(opts.sessionId) : void 0;
 		const resolveHints = intent !== void 0 ? {
 			...hints,
 			prefersTier: intent.prefersTier
 		} : hints;
+		if (isAdaptiveStream) {
+			const adaptiveDeviceId = deviceIdFromBrokerId(streamId);
+			const desiredTier = resolveHints.prefersTier === "high" || resolveHints.prefersTier === "mid" || resolveHints.prefersTier === "low" ? resolveHints.prefersTier : "high";
+			try {
+				await this.ensureAdaptiveTierBroker?.(adaptiveDeviceId, desiredTier);
+			} catch (err) {
+				throw new Error(`Failed to ensure remote adaptive-tier broker for stream "${streamId}" (tier: ${desiredTier}): ${errMsg(err)}`);
+			}
+		}
 		const brokerId = this.resolveBrokerId(streamId, resolveHints);
 		const broker = this.brokers.get(brokerId);
 		if (!broker) throw new Error(`No broker for stream "${streamId}" (resolved: "${brokerId}")`);
@@ -17152,13 +17719,17 @@ var BrokerWebrtcServer = class {
 				bestScore = score;
 			}
 		}
-		this.logger.debug("Adaptive source selected", { meta: {
-			deviceKey,
-			selected: bestId,
-			tier: bestTier,
-			score: Math.round(bestScore * 100) / 100,
-			hints
-		} });
+		const adaptiveDeviceId = Number(deviceKey.split("/")[0]);
+		this.logger.debug("Adaptive source selected", {
+			...Number.isFinite(adaptiveDeviceId) ? { tags: { deviceId: adaptiveDeviceId } } : {},
+			meta: {
+				deviceKey,
+				selected: bestId,
+				tier: bestTier,
+				score: Math.round(bestScore * 100) / 100,
+				hints
+			}
+		});
 		return bestId;
 	}
 	async resolveIceServers() {
@@ -17476,6 +18047,34 @@ var WebrtcSessionProvider = class WebrtcSessionProvider {
 		if (camStreamId === void 0) return WEBRTC_FALLBACK_PROFILE;
 		return withSourceResolution(WEBRTC_FALLBACK_PROFILE, this.manager.getCameraStreamProbedParams(deviceId, camStreamId));
 	}
+	/**
+	* Ensure a broker is registered for `brokerId` before delegating to the
+	* WebRTC server (Slice 3 Task 3 — cross-node ingest wiring). Defers to
+	* `StreamBrokerManager.ensureBrokerForWebrtcSession`, guarded the same way
+	* `resolveSessionDebug` guards `manager.isStreamingDebug`/`isWebrtcDebug` —
+	* older/test manager doubles that don't implement the hook simply skip it,
+	* leaving today's local-only resolution completely unchanged.
+	*/
+	async ensureBrokerAvailable(deviceId, brokerId, camStreamId) {
+		if (typeof this.manager.ensureBrokerForWebrtcSession !== "function") return;
+		await this.manager.ensureBrokerForWebrtcSession(deviceId, brokerId, camStreamId);
+	}
+	/**
+	* Best-effort cleanup for the remote-encoded adapter `ensureBrokerAvailable`
+	* may have just registered, run when the `BrokerWebrtcServer` delegate that
+	* follows it throws. Without this, a delegate failure AFTER a successful
+	* remote-adapter registration (session-construction/offer error, server
+	* stopping mid-request, …) leaks the adapter forever — its only other
+	* teardown path is the inner broker's `onDemandChange(false)` edge, which
+	* never fires because no session ever reached the `true` (demand-active)
+	* edge. Guarded the same way `ensureBrokerAvailable` guards the manager
+	* hook itself — older/test manager doubles without the method are a no-op,
+	* so the owner==self / local-broker happy path is byte-identical.
+	*/
+	async disposeRemoteBrokerAdapterOnDelegateFailure(brokerId) {
+		if (typeof this.manager.disposeRemoteBrokerAdapterIfPresent !== "function") return;
+		await this.manager.disposeRemoteBrokerAdapterIfPresent(brokerId).catch(() => {});
+	}
 	async listStreams(input) {
 		const { deviceId } = input;
 		const assignedSlots = this.manager.getProfileSlotsForDevice(deviceId).filter((s) => s.sourceCamStreamId !== null);
@@ -17537,32 +18136,44 @@ var WebrtcSessionProvider = class WebrtcSessionProvider {
 	}
 	async createSession(input) {
 		const streamId = this.resolveTargetToStreamId(input.deviceId, input.target);
-		const streamingDebug = this.resolveSessionDebug(input.deviceId);
 		const camStreamId = this.resolveCamStreamId(input.deviceId, input.target);
+		await this.ensureBrokerAvailable(input.deviceId, streamId, camStreamId);
+		const streamingDebug = this.resolveSessionDebug(input.deviceId);
 		const transcodeProfile = this.resolveTranscodeProfile(input.deviceId, camStreamId);
-		return this.webrtcServer.createSession(streamId, input.hints, {
-			streamingDebug,
-			relayOnly: input.relayOnly === true,
-			transcodeProfile,
-			...input.consumerAttribution !== void 0 ? { consumerAttribution: input.consumerAttribution } : {}
-		});
+		try {
+			return await this.webrtcServer.createSession(streamId, input.hints, {
+				streamingDebug,
+				relayOnly: input.relayOnly === true,
+				transcodeProfile,
+				...input.consumerAttribution !== void 0 ? { consumerAttribution: input.consumerAttribution } : {}
+			});
+		} catch (err) {
+			await this.disposeRemoteBrokerAdapterOnDelegateFailure(streamId);
+			throw err;
+		}
 	}
 	async handleOffer(input) {
 		const target = input.target ?? { kind: "adaptive" };
 		const streamId = this.resolveTargetToStreamId(input.deviceId, target);
-		const streamingDebug = this.resolveSessionDebug(input.deviceId);
 		const camStreamId = this.resolveCamStreamId(input.deviceId, target);
+		await this.ensureBrokerAvailable(input.deviceId, streamId, camStreamId);
+		const streamingDebug = this.resolveSessionDebug(input.deviceId);
 		const transcodeProfile = this.resolveTranscodeProfile(input.deviceId, camStreamId);
-		return this.webrtcServer.handleOffer(streamId, input.sdpOffer, void 0, {
-			streamingDebug,
-			sessionId: input.sessionId,
-			relayOnly: input.relayOnly === true,
-			nonTrickle: input.nonTrickle === true,
-			disableTurn: input.disableTurn === true,
-			disableIpv6: input.disableIpv6 === true,
-			transcodeProfile,
-			...input.consumerAttribution !== void 0 ? { consumerAttribution: input.consumerAttribution } : {}
-		});
+		try {
+			return await this.webrtcServer.handleOffer(streamId, input.sdpOffer, void 0, {
+				streamingDebug,
+				sessionId: input.sessionId,
+				relayOnly: input.relayOnly === true,
+				nonTrickle: input.nonTrickle === true,
+				disableTurn: input.disableTurn === true,
+				disableIpv6: input.disableIpv6 === true,
+				transcodeProfile,
+				...input.consumerAttribution !== void 0 ? { consumerAttribution: input.consumerAttribution } : {}
+			});
+		} catch (err) {
+			await this.disposeRemoteBrokerAdapterOnDelegateFailure(streamId);
+			throw err;
+		}
 	}
 	async handleAnswer(input) {
 		await this.webrtcServer.handleAnswer(input.sessionId, input.sdpAnswer);
@@ -17786,7 +18397,6 @@ var StreamBrokerAddon = class extends BaseAddon {
 		const localNode = this.ctx.kernel.localNodeId;
 		const localNodeId = localNode ? localNode.includes("/") ? localNode.split("/")[0] : localNode : void 0;
 		this.brokerManager.setApiAccess(this.ctx.api, localNodeId, this.ctx.kernel.hwaccel);
-		if (this.capabilities) this.brokerManager.setCapabilitiesAccess(this.capabilities);
 		await this.loadFfmpegConfig();
 		const rtspProvider = this.brokerManager.getRtspRestreamProvider();
 		const brokerManager = this.brokerManager;