@camstack/addon-pipeline 1.2.28 → 1.2.31

package/dist/detection-pipeline/index.js

@@ -3,10 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DUHlZcWd.js");
-const require_step_definitions = require("../step-definitions-Bo1hJQQw.js");
+const require_dist = require("../dist-BvFLZyhW.js");
+const require_step_definitions = require("../step-definitions-gC-Ovglc.js");
 const require_node_topology_platform = require("../node-topology-platform-CFZ7F4xW.js");
 const require_model_download_service_Cp9f4dk6 = require("../model-download-service-Cp9f4dk6-fsdDExML.js");
+let node_os = require("node:os");
+node_os = require_chunk.__toESM(node_os);
 let node_child_process = require("node:child_process");
 let sharp = require("sharp");
 sharp = require_chunk.__toESM(sharp);
@@ -14,8 +16,6 @@ let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
-let node_os = require("node:os");
-node_os = require_chunk.__toESM(node_os);
 //#region src/detection-pipeline/runtimes.ts
 var KNOWN_PLATFORMS = [
 	"darwin",
@@ -81,14 +81,28 @@ function probedToHardwareInfo(hw) {
 		coral: coralInfoFrom(hw)
 	};
 }
+/**
+* THE per-runtime pool provisioning registry — the single source for every
+* pool's concurrency / worker count / batch tuning, keyed by the runtime THAT
+* POOL runs. `engine-factory` used to carry a second, parallel copy of these
+* defaults; it no longer does.
+*
+* `windowMs` / `maxBatchSize` are inert unless `batchMode !== 'none'`, and
+* `numStreams` / `intraOpThreads` are inert at 0 (the runtime picks) — they are
+* still spelled out per row so a reader never has to guess which default a
+* missing key would have hit.
+*/
 var RUNTIME_DETAIL = {
 	onnx: {
 		label: "ONNX Runtime",
 		pythonRequirements: ["requirements.txt", "requirements-onnxruntime.txt"],
 		tuning: {
 			concurrency: 4,
+			numWorkers: 1,
 			batchMode: "list",
+			windowMs: 2,
 			maxBatchSize: 8,
+			numStreams: 0,
 			intraOpThreads: 0
 		}
 	},
@@ -97,8 +111,12 @@ var RUNTIME_DETAIL = {
 		pythonRequirements: ["requirements.txt", "requirements-openvino.txt"],
 		tuning: {
 			concurrency: 1,
+			numWorkers: 1,
 			batchMode: "none",
-			numStreams: 0
+			windowMs: 2,
+			maxBatchSize: 8,
+			numStreams: 0,
+			intraOpThreads: 0
 		}
 	},
 	coreml: {
@@ -106,10 +124,12 @@ var RUNTIME_DETAIL = {
 		pythonRequirements: ["requirements.txt", "requirements-coreml.txt"],
 		tuning: {
 			concurrency: 1,
+			numWorkers: 1,
 			batchMode: "none",
 			windowMs: 8,
 			maxBatchSize: 8,
-			numWorkers: 1
+			numStreams: 0,
+			intraOpThreads: 0
 		}
 	},
 	edgetpu: {
@@ -117,8 +137,12 @@ var RUNTIME_DETAIL = {
 		pythonRequirements: ["requirements.txt", "requirements-edgetpu.txt"],
 		tuning: {
 			concurrency: 1,
+			numWorkers: 1,
 			batchMode: "none",
-			numWorkers: 1
+			windowMs: 2,
+			maxBatchSize: 8,
+			numStreams: 0,
+			intraOpThreads: 0
 		}
 	}
 };
@@ -161,6 +185,12 @@ function modelFormatFor(id) {
 function pythonRequirementsFor(id) {
 	return RUNTIME_DETAIL[id].pythonRequirements;
 }
+/**
+* The pool provisioning for ONE runtime. Callers must pass the runtime of the
+* pool they are provisioning — never the node's default runtime. See
+* `engine/pool-provisioning.ts` for the resolver that layers an operator
+* override on top of this.
+*/
 function tuningFor(id) {
 	return RUNTIME_DETAIL[id].tuning;
 }
@@ -379,6 +409,62 @@ var RAW_FMT_CODE = {
 * large frame) never trips; override via env for constrained hardware.
 */
 var POOL_INFER_TIMEOUT_MS = Math.max(1e3, Number(process.env["CAMSTACK_POOL_INFER_TIMEOUT_MS"]) || 6e4);
+/**
+* Max inference requests outstanding to ONE worker before new ones are SHED.
+*
+* Without this the camera dies permanently the first time the worker gets
+* slow, and it did: device 615 produced nothing for 52 minutes on 2026-07-31.
+* The worker was neither dead nor deadlocked — it was replying at full rate,
+* about a minute behind, and every reply landed after {@link
+* POOL_INFER_TIMEOUT_MS} had already abandoned its request. The proof is in the
+* logs: a steady drip of `Response for unknown request id`, request ids
+* climbing ~13/s, for as long as the outage lasted.
+*
+* That state is self-sustaining and cannot drain, because frames keep arriving
+* while every one of them is written straight to the pipe. `dispatch` had NO
+* bound: a transient slowdown (inference went 40ms → 2500ms across several
+* cameras at 16:19 that day) buys a backlog that is never paid off, and once
+* the backlog exceeds the deadline the loss is total.
+*
+* The queue is therefore capped in TIME, not just in count: at the normal ~40ms
+* per inference this is ~0.3s of work, and even at a 20× slowdown it stays well
+* inside the 60s deadline — so a worker that falls behind sheds, catches up,
+* and recovers on its own. Python already sheds under its own per-model bound
+* and answers `{dropped: true}`; this is the same contract applied one layer
+* earlier, where the unbounded queue actually is.
+*/
+var POOL_MAX_IN_FLIGHT = Math.max(1, Number(process.env["CAMSTACK_POOL_MAX_IN_FLIGHT"]) || 8);
+/**
+* Reply deadline for a LIVE inference request (ms), as opposed to the generous
+* {@link POOL_INFER_TIMEOUT_MS} that model loads and commands keep.
+*
+* 60 seconds was never a deadline for live detection — it is three orders of
+* magnitude past the point where the answer is worth having. Frames arrive at
+* ~13/s; a detection that lands 60s late describes a scene that no longer
+* exists, and the only thing the wait accomplished was holding a queue slot
+* while the backlog grew. Operator directive 2026-07-31: "a few seconds are
+* already too many for this scenario".
+*
+* Three seconds is deliberately still loose — normal inference on this fleet is
+* 35-47ms, so this trips only at a ~70× slowdown — but it bounds the damage at
+* seconds instead of a minute, and combined with {@link POOL_MAX_IN_FLIGHT} it
+* makes the backlog mathematically unable to outrun the deadline: the queue can
+* never hold more than `cap × deadline` of work.
+*
+* Commands and model loads keep the long timeout on purpose: a cold model load
+* legitimately takes tens of seconds, and shedding or timing one out
+* desynchronizes the worker's model slots.
+*/
+var POOL_LIVE_INFER_TIMEOUT_MS = Math.max(250, Number(process.env["CAMSTACK_POOL_LIVE_INFER_TIMEOUT_MS"]) || 3e3);
+/** Opcodes the in-flight cap may shed. Commands and frame-cache writes are
+*  NEVER shed: a dropped command silently desynchronizes model state, and a
+*  dropped `cacheFrame` strands the `inferCached` that follows it. */
+var SHEDDABLE_MSG_TYPES = new Set([
+	MSG_INFER_JPEG,
+	MSG_INFER_RAW,
+	MSG_INFER_BATCH,
+	MSG_INFER_CACHED
+]);
 var PoolHandle = class {
 	pool;
 	modelIndex;
@@ -458,6 +544,13 @@ var PoolWorker = class {
 	process = null;
 	receiveBuffer = Buffer.alloc(0);
 	pending = /* @__PURE__ */ new Map();
+	/** True while the in-flight cap is shedding — so the warning fires on the
+	*  EDGE rather than once per dropped frame. */
+	shedding = false;
+	/** Inference requests shed by the in-flight cap, for this worker's lifetime.
+	*  Surfaced so "the camera is quiet" and "the camera is saturated" can be
+	*  told apart without reading the logs. */
+	shedCount = 0;
 	nextRequestId = 1;
 	ready = false;
 	log;
@@ -469,6 +562,15 @@ var PoolWorker = class {
 	getPid() {
 		return this.process?.pid ?? null;
 	}
+	/** Requests written and not yet answered. This is the BACKLOG — the number
+	*  nothing measured while a camera sat at zero frames for 52 minutes. */
+	getInFlight() {
+		return this.pending.size;
+	}
+	/** Inference shed by the in-flight cap over this worker's lifetime. */
+	getShedCount() {
+		return this.shedCount;
+	}
 	isReady() {
 		return this.ready;
 	}
@@ -617,10 +719,51 @@ var PoolWorker = class {
 		this.ready = false;
 		await terminateChild(proc, POOL_WORKER_TERM_GRACE_MS);
 	}
+	/**
+	* Shed an inference request when the worker already has {@link
+	* POOL_MAX_IN_FLIGHT} outstanding — the backlog is what turns a slow worker
+	* into a dead camera. Returns the shed response, or `null` to proceed.
+	*
+	* A shed is LOUD the first time and then rate-limited: at frame rate this
+	* fires ~13×/s, so logging every one would bury the signal it is meant to
+	* raise — but logging none is how a camera went dark for 52 minutes looking
+	* like a quiet afternoon.
+	*/
+	shedIfSaturated(msgType) {
+		if (!SHEDDABLE_MSG_TYPES.has(msgType)) return null;
+		if (this.pending.size < POOL_MAX_IN_FLIGHT) {
+			this.shedding = false;
+			return null;
+		}
+		if (!this.shedding) {
+			this.shedding = true;
+			this.log.warn("worker saturated — shedding inference until it catches up", { meta: {
+				worker: this.opts.workerLabel,
+				pid: this.getPid(),
+				runtime: this.opts.poolRuntime,
+				device: this.opts.device ?? "default",
+				inFlight: this.pending.size,
+				cap: POOL_MAX_IN_FLIGHT,
+				deadlineMs: POOL_LIVE_INFER_TIMEOUT_MS
+			} });
+		}
+		this.shedCount++;
+		return {
+			dropped: true,
+			shedReason: "worker-in-flight-cap"
+		};
+	}
+	/** Live inference gets seconds; commands and model loads keep the long
+	*  timeout — see {@link POOL_LIVE_INFER_TIMEOUT_MS}. */
+	deadlineFor(msgType) {
+		return SHEDDABLE_MSG_TYPES.has(msgType) ? POOL_LIVE_INFER_TIMEOUT_MS : POOL_INFER_TIMEOUT_MS;
+	}
 	dispatch(msgType, payload) {
+		const shed = this.shedIfSaturated(msgType);
+		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject);
+			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType));
 			this.pending.set(reqId, {
 				resolve,
 				reject,
@@ -640,24 +783,30 @@ var PoolWorker = class {
 	* `POOL_INFER_TIMEOUT_MS`. `unref` so it never keeps the event loop alive.
 	* The normal response + `rejectAll` paths clear it via `PendingRequest.timer`.
 	*/
-	armRequestTimeout(reqId, reject) {
+	armRequestTimeout(reqId, reject, timeoutMs) {
 		const timer = setTimeout(() => {
 			if (this.pending.delete(reqId)) {
 				this.log.error("inference request timed out", { meta: {
 					worker: this.opts.workerLabel,
+					pid: this.getPid(),
+					runtime: this.opts.poolRuntime,
+					device: this.opts.device ?? "default",
+					inFlight: this.pending.size,
 					reqId,
 					timeoutMs: POOL_INFER_TIMEOUT_MS
 				} });
-				reject(/* @__PURE__ */ new Error(`PoolWorker[${this.opts.workerLabel}]: inference request ${reqId} timed out after ${POOL_INFER_TIMEOUT_MS}ms (worker alive, no reply)`));
+				reject(/* @__PURE__ */ new Error(`PoolWorker[${this.opts.workerLabel}]: inference request ${reqId} timed out after ${timeoutMs}ms (worker alive, no reply)`));
 			}
-		}, POOL_INFER_TIMEOUT_MS);
+		}, timeoutMs);
 		timer.unref?.();
 		return timer;
 	}
 	dispatchMulti(msgType, payloadLen, parts) {
+		const shed = this.shedIfSaturated(msgType);
+		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject);
+			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType));
 			this.pending.set(reqId, {
 				resolve,
 				reject,
@@ -763,6 +912,22 @@ var SharedInferencePool = class {
 	}
 	device;
 	/** Pid of the first worker (for legacy callers). Use `getPids()` for all. */
+	/** Summed backlog and shed count across the pool's workers. A rising
+	*  `inFlight` with a rising `shed` is a worker falling behind; a rising
+	*  `inFlight` with zero `shed` and no results is the state that used to be
+	*  invisible. */
+	getBacklog() {
+		let inFlight = 0;
+		let shed = 0;
+		for (const w of this.workers) {
+			inFlight += w.getInFlight();
+			shed += w.getShedCount();
+		}
+		return {
+			inFlight,
+			shed
+		};
+	}
 	getPid() {
 		return this.workers[0]?.getPid() ?? null;
 	}
@@ -796,6 +961,7 @@ var SharedInferencePool = class {
 			loadedCount,
 			startupMs,
 			runtime: this.poolRuntime,
+			device: this.device ?? "default",
 			workers: this.numWorkers,
 			pythonWorkers: innerWorkers,
 			pids: this.getPids()
@@ -887,7 +1053,10 @@ var SharedInferencePool = class {
 	async dispose() {
 		await Promise.all(this.workers.map((w) => w.dispose()));
 		this.workers.length = 0;
-		this.log.info("Pool process(es) terminated");
+		this.log.info("Pool process(es) terminated", { meta: {
+			runtime: this.poolRuntime,
+			device: this.device ?? "default"
+		} });
 	}
 	/**
 	* Recognise a Python overload-shed response (`"dropped": true`) on the
@@ -900,7 +1069,9 @@ var SharedInferencePool = class {
 			this.droppedResponseCount++;
 			this.log.debug("Python pool shed frame under overload", { meta: {
 				modelIndex,
-				droppedTotal: this.droppedResponseCount
+				droppedTotal: this.droppedResponseCount,
+				runtime: this.poolRuntime,
+				device: this.device ?? "default"
 			} });
 		}
 		return result;
@@ -1236,6 +1407,126 @@ var PipelineModelManager = class {
 	}
 };
 //#endregion
+//#region src/detection-pipeline/engine/resolve-device-engine.ts
+/**
+* Resolve a Phase-1 device key (`<backend>:<device>`, or bare `cpu`) into the
+* {@link PipelineEngineChoice} used to build that device's inference pool.
+* Throws on an unknown backend token so a bad `deviceKey` fails loud rather
+* than silently building a wrong pool. Format comes from the shared
+* {@link DEVICE_BACKEND_TO_FORMAT} SSOT (`@camstack/types`) — no local copy.
+*/
+function resolveDeviceEngine(deviceKey) {
+	const colon = deviceKey.indexOf(":");
+	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
+	const device = colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey;
+	const format = require_dist.DEVICE_BACKEND_TO_FORMAT[backend];
+	if (format === void 0) throw new Error(`resolveDeviceEngine: unknown backend "${backend}" in deviceKey "${deviceKey}"`);
+	return {
+		runtime: "python",
+		backend,
+		format,
+		device
+	};
+}
+/**
+* The inverse of {@link resolveDeviceEngine}: the `<backend>:<device>` key that
+* names the pool an engine belongs to. Every pool-level log line carries this —
+* without it a default pool logs anonymously and six hours of logs cannot tell
+* "the NPU is unused" from "the NPU IS the anonymous default pool".
+* Falls back to the bare backend when the engine carries no device.
+*/
+function deviceKeyOf(engine) {
+	return engine.device ? `${engine.backend}:${engine.device}` : engine.backend;
+}
+//#endregion
+//#region src/detection-pipeline/engine/pool-provisioning.ts
+/** The fields a {@link PoolProvisioningOverride} may carry, in table order. */
+var OVERRIDABLE_KEYS = [
+	"concurrency",
+	"numWorkers",
+	"batchMode",
+	"windowMs",
+	"maxBatchSize",
+	"numStreams",
+	"intraOpThreads"
+];
+/** Backends that are not a runtime of their own and run on onnxruntime. */
+var BACKEND_TO_RUNTIME = {
+	onnx: "onnx",
+	cpu: "onnx",
+	cuda: "onnx",
+	openvino: "openvino",
+	coreml: "coreml",
+	edgetpu: "edgetpu"
+};
+/**
+* The registry runtime a device-pool backend provisions from. Unknown backends
+* floor to `onnx` — the same floor `resolveDeviceEngine` applies to the model
+* format, so a pool never comes up unprovisioned.
+*/
+function runtimeIdForBackend(backend) {
+	return BACKEND_TO_RUNTIME[backend] ?? "onnx";
+}
+/**
+* Resolve the provisioning for a pool running `engine`, applying the precedence
+* documented at the top of this module. `engine.device` is not consulted today
+* (see the module doc) but is part of the signature so a bench-backed
+* per-device row lands here and nowhere else.
+*/
+function resolvePoolProvisioning(engine, override = {}) {
+	const runtime = runtimeIdForBackend(engine.backend);
+	const profile = tuningFor(runtime);
+	return {
+		runtime,
+		overriddenFields: OVERRIDABLE_KEYS.filter((k) => override[k] !== void 0),
+		concurrency: Math.max(1, override.concurrency ?? profile.concurrency),
+		numWorkers: Math.max(1, override.numWorkers ?? profile.numWorkers),
+		batchMode: override.batchMode ?? profile.batchMode,
+		windowMs: override.windowMs ?? profile.windowMs,
+		maxBatchSize: override.maxBatchSize ?? profile.maxBatchSize,
+		numStreams: override.numStreams ?? profile.numStreams,
+		intraOpThreads: override.intraOpThreads ?? profile.intraOpThreads
+	};
+}
+function positiveNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+function batchMode(value) {
+	return value === "none" || value === "list" || value === "window" ? value : void 0;
+}
+/**
+* Read the operator override out of the detection addon's settings. Only a
+* NON-AUTO value counts: the sliders persist `0` and the select persists `''`
+* for "Auto (backend default)", and those must resolve to the runtime's
+* registry value, not to a literal 0 worker threads.
+*
+* The result is deliberately sparse — an empty object means "nothing
+* overridden", which is what lets a per-device pool provision from its own
+* runtime instead of inheriting the node's.
+*/
+function readOperatorOverride(settings) {
+	const override = {};
+	const concurrency = positiveNumber(settings.concurrency);
+	if (concurrency !== void 0) override.concurrency = concurrency;
+	const numWorkers = positiveNumber(settings.numWorkers);
+	if (numWorkers !== void 0) override.numWorkers = numWorkers;
+	const mode = batchMode(settings.batchMode);
+	if (mode !== void 0) override.batchMode = mode;
+	const windowMs = positiveNumber(settings.windowMs);
+	if (windowMs !== void 0) override.windowMs = windowMs;
+	const maxBatchSize = positiveNumber(settings.maxBatchSize);
+	if (maxBatchSize !== void 0) override.maxBatchSize = maxBatchSize;
+	const numStreams = positiveNumber(settings.numStreams);
+	if (numStreams !== void 0) override.numStreams = numStreams;
+	const intraOpThreads = positiveNumber(settings.intraOpThreads);
+	if (intraOpThreads !== void 0) override.intraOpThreads = intraOpThreads;
+	return override;
+}
+/** Two overrides carry the same fields with the same values. */
+function overridesEqual(a, b) {
+	return OVERRIDABLE_KEYS.every((k) => a[k] === b[k]);
+}
+//#endregion
 //#region src/detection-pipeline/engine/engine-factory.ts
 var BACKEND_TO_POOL_RUNTIME = {
 	coreml: "coreml",
@@ -1305,9 +1596,31 @@ var EngineFactory = class {
 	poolManager = null;
 	log;
 	opts;
+	/**
+	* `<backend>:<device>` — on EVERY log line this factory writes. A pool that
+	* logs anonymously cannot be told apart from another pool of the same runtime
+	* on a different accelerator.
+	*/
+	deviceKey;
+	/**
+	* Resolved at CONSTRUCTION, not at pool spawn, so it is inspectable without
+	* starting Python and so a pool that fails to spawn still logs what it was
+	* trying to be.
+	*/
+	resolvedProvisioning;
 	constructor(opts) {
 		this.opts = opts;
 		this.log = opts.logger;
+		this.deviceKey = deviceKeyOf(opts.engine);
+		this.resolvedProvisioning = resolvePoolProvisioning(opts.engine, opts.provisioning);
+	}
+	/**
+	* The provisioning this factory's pool runs with — resolved from the pool's
+	* OWN runtime plus any operator override. Read by the effective-tuning
+	* readout and by the tests that pin the per-runtime behaviour.
+	*/
+	get provisioning() {
+		return this.resolvedProvisioning;
 	}
 	/** Detection always uses the Python pool. */
 	get usesPythonPool() {
@@ -1409,40 +1722,51 @@ var EngineFactory = class {
 			this.poolManager = null;
 		}
 	}
+	/**
+	* The one pool-init log line. `deviceKey` / `device` are the reason it
+	* exists: the default pool used to log neither, so an operator reading a
+	* day of logs could not tell whether the NPU was idle or was simply the
+	* anonymous default pool.
+	*
+	* `overriddenFields` replaces the old `source` field. `source` claimed
+	* `'auto-default' | 'user-override'` about the CONCURRENCY TUNING but read as
+	* the provenance of the device/engine choice, and was `'user-override'` on
+	* every pool because the addon always passed explicit tuning. This lists the
+	* fields the operator actually overrode — empty means pure registry.
+	*/
+	logProvisioning() {
+		const p = this.resolvedProvisioning;
+		this.log.info("Python inference pool", { meta: {
+			deviceKey: this.deviceKey,
+			backend: this.opts.engine.backend,
+			device: this.opts.engine.device ?? null,
+			runtime: p.runtime,
+			concurrency: p.concurrency,
+			numWorkers: p.numWorkers,
+			overriddenFields: p.overriddenFields,
+			tuning: {
+				batchMode: p.batchMode,
+				windowMs: p.windowMs,
+				maxBatchSize: p.maxBatchSize,
+				numStreams: p.numStreams,
+				intraOpThreads: p.intraOpThreads
+			}
+		} });
+	}
 	async initPythonPool(steps) {
+		this.logProvisioning();
 		const pythonPath = this.opts.pythonPath;
 		if (!pythonPath) throw new Error("EngineFactory: pythonPath is required — the addon must call ctx.deps.ensurePython() and pass the result. The embedded portable Python download likely failed; check the addon logs for the download error.");
 		const poolRuntime = BACKEND_TO_POOL_RUNTIME[this.opts.engine.backend];
 		if (!poolRuntime) throw new Error(`No pool runtime mapping for backend "${this.opts.engine.backend}"`);
-		const concurrency = this.opts.concurrency ?? {
-			coreml: 1,
-			openvino: 1,
-			onnxruntime: 4,
-			edgetpu: 1
-		}[poolRuntime];
-		const isAutoDefault = this.opts.concurrency === void 0;
-		const defaultBatchMode = {
-			coreml: "window",
-			openvino: "none",
-			onnxruntime: "list",
-			edgetpu: "none"
-		};
-		const tuning = this.opts.tuning ?? {};
+		const { concurrency, numWorkers } = this.resolvedProvisioning;
 		const resolvedTuning = {
-			batchMode: tuning.batchMode ?? defaultBatchMode[poolRuntime],
-			windowMs: tuning.windowMs ?? 8,
-			maxBatchSize: tuning.maxBatchSize ?? 8,
-			numStreams: tuning.numStreams ?? 0,
-			intraOpThreads: tuning.intraOpThreads ?? 0
+			batchMode: this.resolvedProvisioning.batchMode,
+			windowMs: this.resolvedProvisioning.windowMs,
+			maxBatchSize: this.resolvedProvisioning.maxBatchSize,
+			numStreams: this.resolvedProvisioning.numStreams,
+			intraOpThreads: this.resolvedProvisioning.intraOpThreads
 		};
-		const numWorkers = Math.max(1, this.opts.numWorkers ?? 1);
-		this.log.info("Python inference pool", { meta: {
-			runtime: poolRuntime,
-			concurrency,
-			numWorkers,
-			source: isAutoDefault ? "auto-default" : "user-override",
-			tuning: resolvedTuning
-		} });
 		this.pool = new SharedInferencePool(pythonPath, poolRuntime, this.log.child("pool"), {
 			concurrency,
 			tuning: resolvedTuning,
@@ -1498,28 +1822,6 @@ var EngineFactory = class {
 	}
 };
 //#endregion
-//#region src/detection-pipeline/engine/resolve-device-engine.ts
-/**
-* Resolve a Phase-1 device key (`<backend>:<device>`, or bare `cpu`) into the
-* {@link PipelineEngineChoice} used to build that device's inference pool.
-* Throws on an unknown backend token so a bad `deviceKey` fails loud rather
-* than silently building a wrong pool. Format comes from the shared
-* {@link DEVICE_BACKEND_TO_FORMAT} SSOT (`@camstack/types`) — no local copy.
-*/
-function resolveDeviceEngine(deviceKey) {
-	const colon = deviceKey.indexOf(":");
-	const backend = colon >= 0 ? deviceKey.slice(0, colon) : deviceKey;
-	const device = colon >= 0 ? deviceKey.slice(colon + 1) : deviceKey;
-	const format = require_dist.DEVICE_BACKEND_TO_FORMAT[backend];
-	if (format === void 0) throw new Error(`resolveDeviceEngine: unknown backend "${backend}" in deviceKey "${deviceKey}"`);
-	return {
-		runtime: "python",
-		backend,
-		format,
-		device
-	};
-}
-//#endregion
 //#region src/detection-pipeline/engine/idle-pool-reaper.ts
 var IdlePoolReaper = class {
 	lastUsed = /* @__PURE__ */ new Map();
@@ -2704,19 +3006,25 @@ async function nativeChildCrop(provider, bbox, imageWidth, imageHeight, maxWidth
 * DROPS detections outright, so it sits between that and a hard cut).
 */
 var FULL_FRAME_MAX_CONFIDENCE = .7;
+/** A cut only makes sense in (0, 1); anything else is treated as OFF rather
+*  than dropping every detection on a typo. */
+function isUsableHardAreaCut(ratio) {
+	return Number.isFinite(ratio) && ratio > 0 && ratio < 1;
+}
 /**
 * True when `bbox` is a near-full-frame LOW-confidence phantom that should be
 * DROPPED from the frame's detections (overlay / tracker / events / motion-wake).
 *
 * Rule (drop ⇔ returns true):
-*   (areaRatio ≥ {@link FULL_FRAME_AREA_RATIO}
-*      OR width  ≥ {@link FULL_FRAME_DIMENSION_RATIO} × frameWidth
-*      OR height ≥ {@link FULL_FRAME_DIMENSION_RATIO} × frameHeight)
-*   AND score < `maxConfidence`
+*   areaRatio ≥ `hardAreaRatio`                      ← score-independent, OFF by default
+*   OR (  (areaRatio ≥ {@link FULL_FRAME_AREA_RATIO}
+*          OR width  ≥ {@link FULL_FRAME_DIMENSION_RATIO} × frameWidth
+*          OR height ≥ {@link FULL_FRAME_DIMENSION_RATIO} × frameHeight)
+*         AND score < `maxConfidence` )
 *
-* A high-confidence detection (`score ≥ maxConfidence`) is trusted as a real
-* subject and always survives. Degenerate frame dimensions (≤0) carry no info
-* to reject on → not a phantom.
+* Below the hard cut a high-confidence detection (`score ≥ maxConfidence`) is
+* trusted as a real subject and survives. Degenerate frame dimensions (≤0)
+* carry no info to reject on → not a phantom.
 *
 * @param bbox absolute-pixel `[x1, y1, x2, y2]` box in source-frame coords.
 * @param frameWidth source frame width in px.
@@ -2725,10 +3033,26 @@ var FULL_FRAME_MAX_CONFIDENCE = .7;
 * @param maxConfidence confidence bar below which a full-frame box is a phantom
 *   (defaults to {@link FULL_FRAME_MAX_CONFIDENCE}; overridable by the caller so
 *   the bar can be threaded from detection settings without new cap methods).
+* @param hardAreaRatio area fraction at/above which the box is dropped NO
+*   MATTER the score. Defaults to {@link HARD_AREA_CUT_DISABLED} (off) — it is
+*   armed per camera, because a doorbell close-up legitimately fills the frame
+*   while an overhead courtyard box never does. Threaded from step settings as
+*   `fullFrameGuardHardAreaRatio`.
+*/
+/**
+* True when a box trips the guard's GEOMETRY test (near-full-frame, or
+* edge-to-edge in one axis) but SURVIVES because its score cleared the
+* confidence bar.
+*
+* These are the ones worth counting: on 2026-07-30 device 615 produced six
+* such boxes in a day, at 0.710-0.787, and they were only found by an offline
+* sweep of stored events — nothing in production reported them. Arming the
+* hard-area cut on a camera should be a decision made from this count, not
+* from one incident.
 */
-function isFullFramePhantomDetection(bbox, frameWidth, frameHeight, score, maxConfidence = FULL_FRAME_MAX_CONFIDENCE) {
+function isFullFrameSurvivor(bbox, frameWidth, frameHeight, score, maxConfidence = FULL_FRAME_MAX_CONFIDENCE) {
 	if (frameWidth <= 0 || frameHeight <= 0) return false;
-	if (score >= maxConfidence) return false;
+	if (score < maxConfidence) return false;
 	const [x1, y1, x2, y2] = bbox;
 	const w = x2 - x1;
 	const h = y2 - y1;
@@ -2737,6 +3061,19 @@ function isFullFramePhantomDetection(bbox, frameWidth, frameHeight, score, maxCo
 	if (h >= frameHeight * .98) return true;
 	return false;
 }
+function isFullFramePhantomDetection(bbox, frameWidth, frameHeight, score, maxConfidence = FULL_FRAME_MAX_CONFIDENCE, hardAreaRatio = 1) {
+	if (frameWidth <= 0 || frameHeight <= 0) return false;
+	const [x1, y1, x2, y2] = bbox;
+	const w = x2 - x1;
+	const h = y2 - y1;
+	const areaRatio = w * h / (frameWidth * frameHeight);
+	if (isUsableHardAreaCut(hardAreaRatio) && areaRatio >= hardAreaRatio) return true;
+	if (score >= maxConfidence) return false;
+	if (areaRatio >= .9) return true;
+	if (w >= frameWidth * .98) return true;
+	if (h >= frameHeight * .98) return true;
+	return false;
+}
 //#endregion
 //#region src/detection-pipeline/pipeline/plate-deskew.ts
 /**
@@ -3584,10 +3921,34 @@ var PipelineExecutor = class {
 					continue;
 				}
 				const fullFrameBar = rootStep.settings?.["fullFrameGuardMaxConfidence"];
-				if (isFullFramePhantomDetection(mutable.bbox, imageWidth, imageHeight, mutable.score, typeof fullFrameBar === "number" ? fullFrameBar : void 0)) {
-					if (debug) console.log(`[executor] drop det macro=${mutable.macroClass} score=${mutable.score} bbox=${JSON.stringify(mutable.bbox)} (full-frame phantom guard)`);
+				const fullFrameHardArea = rootStep.settings?.["fullFrameGuardHardAreaRatio"];
+				if (isFullFramePhantomDetection(mutable.bbox, imageWidth, imageHeight, mutable.score, typeof fullFrameBar === "number" ? fullFrameBar : void 0, typeof fullFrameHardArea === "number" ? fullFrameHardArea : void 0)) {
+					this.opts.logger?.info("full-frame phantom guard: detection dropped", {
+						tags: { deviceId },
+						meta: {
+							macroClass: mutable.macroClass,
+							score: mutable.score,
+							bbox: mutable.bbox,
+							frameWidth: imageWidth,
+							frameHeight: imageHeight,
+							areaRatio: imageWidth > 0 && imageHeight > 0 ? Math.round((mutable.bbox[2] - mutable.bbox[0]) * (mutable.bbox[3] - mutable.bbox[1]) / (imageWidth * imageHeight) * 1e3) / 1e3 : void 0,
+							bar: typeof fullFrameBar === "number" ? fullFrameBar : void 0,
+							hardAreaRatio: typeof fullFrameHardArea === "number" ? fullFrameHardArea : void 0
+						}
+					});
 					continue;
 				}
+				if (isFullFrameSurvivor(mutable.bbox, imageWidth, imageHeight, mutable.score, typeof fullFrameBar === "number" ? fullFrameBar : void 0)) this.opts.logger?.warn("full-frame box SURVIVED the guard on score", {
+					tags: { deviceId },
+					meta: {
+						macroClass: mutable.macroClass,
+						score: mutable.score,
+						bbox: mutable.bbox,
+						areaRatio: imageWidth > 0 && imageHeight > 0 ? Math.round((mutable.bbox[2] - mutable.bbox[0]) * (mutable.bbox[3] - mutable.bbox[1]) / (imageWidth * imageHeight) * 1e3) / 1e3 : void 0,
+						bar: typeof fullFrameBar === "number" ? fullFrameBar : void 0,
+						hint: "arm fullFrameGuardHardAreaRatio on this camera if these are phantoms"
+					}
+				});
 				try {
 					await this.executeChildren(rootStep.children, mutable, fullFrameJpegProvider, imageWidth, imageHeight, traceBuilder, stepTimings, ctx, poolAgg, runOpts?.plane, deviceId, nativeCropProvider);
 				} catch (err) {
@@ -4902,8 +5263,10 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 			modelsDir: this.modelsDir,
 			logger: this.log.child("engine-verify"),
 			pythonPath: this.executorOptions.pythonPath,
-			concurrency: 1,
-			numWorkers: 1
+			provisioning: {
+				concurrency: 1,
+				numWorkers: 1
+			}
 		});
 		try {
 			await probe.initialize([]);
@@ -5659,9 +6022,7 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 				modelsDir: this.modelsDir,
 				logger: this.log.child("engine-override"),
 				pythonPath: this.executorOptions.pythonPath ?? "",
-				concurrency: this.executorOptions.concurrency,
-				tuning: this.executorOptions.tuning,
-				numWorkers: this.executorOptions.numWorkers
+				provisioning: this.executorOptions.provisioning
 			});
 			const initPromise = newFactory.initialize([]);
 			this.overrideCache = {
@@ -5841,9 +6202,7 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 				modelsDir: this.modelsDir,
 				logger: this.log.child("engine-override"),
 				pythonPath: this.executorOptions.pythonPath ?? "",
-				concurrency: this.executorOptions.concurrency,
-				tuning: this.executorOptions.tuning,
-				numWorkers: this.executorOptions.numWorkers
+				provisioning: this.executorOptions.provisioning
 			});
 			const initPromise = newFactory.initialize([]);
 			this.overrideCache = {
@@ -6375,13 +6734,18 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 		if (!this.engineFactory) return;
 		await this.engineFactory.uncacheFrame(input.frameId);
 	}
+	/**
+	* The tuning of the node's DEFAULT pool. Per-device pools each resolve their
+	* own runtime's row, so this is not "the node's tuning" — the per-pool truth
+	* is on each pool's `Python inference pool` log line and in `listLoadedEngines`.
+	*/
 	async getEffectiveTuning() {
-		const t = this.executorOptions.tuning;
+		const p = resolvePoolProvisioning(this.currentEngine, this.executorOptions.provisioning);
 		return {
-			batchMode: t?.batchMode ?? "none",
-			windowMs: t?.windowMs ?? 0,
-			maxBatchSize: t?.maxBatchSize ?? 1,
-			concurrency: this.executorOptions.concurrency ?? 1
+			batchMode: p.batchMode,
+			windowMs: p.windowMs,
+			maxBatchSize: p.maxBatchSize,
+			concurrency: p.concurrency
 		};
 	}
 	/**
@@ -6399,9 +6763,7 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 			modelsDir: this.modelsDir,
 			logger: this.log.child("engine"),
 			pythonPath: this.executorOptions.pythonPath ?? "",
-			concurrency: this.executorOptions.concurrency,
-			tuning: this.executorOptions.tuning,
-			numWorkers: this.executorOptions.numWorkers
+			provisioning: this.executorOptions.provisioning
 		});
 		await this.engineFactory.initialize([]);
 	}
@@ -6440,13 +6802,18 @@ var DetectionPipelineProvider = class DetectionPipelineProvider {
 				modelsDir: this.modelsDir,
 				logger: this.log.child(`engine:${deviceKey}`),
 				pythonPath: this.executorOptions.pythonPath ?? "",
-				concurrency: this.executorOptions.concurrency,
-				tuning: this.executorOptions.tuning,
-				numWorkers: this.executorOptions.numWorkers
+				provisioning: this.executorOptions.provisioning
 			});
 			try {
 				await factory.initialize([]);
 			} catch (err) {
+				this.log.error("Device pool failed to initialize", { meta: {
+					deviceKey,
+					backend: engine.backend,
+					device: engine.device ?? null,
+					provisioning: factory.provisioning,
+					error: err instanceof Error ? err.message : String(err)
+				} });
 				await factory.dispose().catch(() => void 0);
 				throw err;
 			}
@@ -7057,21 +7424,22 @@ function toNodePlatform(value) {
 	return value === "darwin" || value === "linux" || value === "win32" ? value : void 0;
 }
 /**
-* Tuning fields that bind into the Python pool at construction. Any
-* change requires a pool respawn to take effect (the executor caches
-* `tuning` at engine-factory build time). `onConfigChanged` watches
-* these and rebuilds the provider when they flip.
+* Slider keys on the "Inference executor" section that map 1:1 onto a
+* {@link RuntimePoolProfile} field. Used to inject the node-default runtime's
+* registry value as the field's suggested default in `getGlobalSettings`.
 */
-var POOL_BOUND_KEYS = [
+var PROFILE_SLIDER_KEYS = [
 	"concurrency",
-	"batchMode",
+	"numWorkers",
 	"windowMs",
 	"maxBatchSize",
 	"numStreams",
-	"intraOpThreads",
-	"numWorkers"
+	"intraOpThreads"
 ];
-var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.BaseAddon {
+function isProfileSliderKey(key) {
+	return PROFILE_SLIDER_KEYS.some((k) => k === key);
+}
+var DetectionPipelineAddon = class extends require_dist.BaseAddon {
 	provider = null;
 	/** Last non-null probed hardware PER NODE — reused when the probe transiently
 	*  returns null so offered backends / device lists don't collapse. Keyed by
@@ -7086,14 +7454,17 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 	*  ENGINE_METRICS_HEARTBEAT_MS for liveness. */
 	lastEmittedEngineSnapshot = null;
 	/**
-	* Last-applied tuning snapshot, taken at the end of `onInitialize`
-	* and refreshed at the end of `onConfigChanged`. Lets the change
-	* handler diff the current config against the snapshot and decide
-	* whether a pool respawn is necessary — most config edits (engine
-	* cascade, audio settings) don't touch the tuning fields and don't
-	* deserve a multi-second model reload.
+	* Last-applied OPERATOR OVERRIDE, taken at the end of `onInitialize` and
+	* refreshed at the end of `onConfigChanged`. Lets the change handler diff the
+	* current config against the snapshot and decide whether a pool respawn is
+	* necessary — most config edits (engine cascade, audio settings) don't touch
+	* the tuning fields and don't deserve a multi-second model reload.
+	*
+	* The per-runtime registry values are compile-time constants resolved inside
+	* each pool, so they can never be the reason for a respawn; only an operator
+	* edit can.
 	*/
-	lastAppliedPoolConfig = {};
+	lastAppliedOverride = {};
 	/**
 	* Embedded Python path resolved once at boot via
 	* `ctx.deps.ensurePython()`. Empty string means the download failed
@@ -7261,17 +7632,16 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 				...section,
 				fields: section.fields.map((field) => {
 					if (field.type === "select") {
-						if (field.key === "batchMode" && tuning["batchMode"] !== void 0) return {
+						if (field.key === "batchMode") return {
 							...field,
-							default: tuning["batchMode"]
+							default: tuning.batchMode
 						};
 					}
 					if (field.type === "slider" && "key" in field) {
-						const tuned = tuning[field.key];
 						const sliderField = field;
-						let patchedField = typeof tuned === "number" ? {
+						let patchedField = isProfileSliderKey(sliderField.key) ? {
 							...sliderField,
-							default: tuned
+							default: tuning[sliderField.key]
 						} : sliderField;
 						if (sliderField.key === "concurrency" && backend === "coreml") patchedField = {
 							...patchedField,
@@ -7380,60 +7750,39 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 		return normalizeEngineNodeId(this.ctxIfReady?.kernel?.localNodeId ?? "hub");
 	}
 	/**
-	* Resolve the effective pool tuning for the configured backend.
+	* The operator's explicit deviations from the per-runtime registry — and
+	* NOTHING else.
 	*
-	* Reads the registry's `tuningFor(backend)` and ignores any persisted
-	* override for `concurrency / batchMode / windowMs / maxBatchSize /
-	* numStreams / intraOpThreads`. Stored values are quietly discarded so an old
-	* suboptimal user-override (saved when the UI exposed these knobs)
-	* cannot resurrect itself after a restart.
+	* This used to be `resolveBackendTuning()`: it read `tuningFor(<the node's
+	* default backend>)` and handed the whole resolved row to the provider, which
+	* passed it verbatim to every pool it built. That is how an `openvino:npu`
+	* pool on an onnx-default node came up with onnx's `concurrency: 4`. The
+	* per-runtime values now resolve inside each pool
+	* (`engine/pool-provisioning.ts`), keyed by that pool's own runtime, so
+	* nothing backend-shaped may be computed here.
 	*
-	* The matrix sweep (`bench-pool-matrix.py` + `bench-coreml-patterns.py`)
-	* already chose the best per-backend combo; the operator no longer has
-	* a reason to disagree.
+	* Precedence, in full: an operator override below wins over the pool's
+	* runtime registry row; an "Auto" field (slider `0`, select `''`) is not an
+	* override. An override is node-wide by design — the operator set it against
+	* a node, not against a runtime.
 	*/
-	resolveBackendTuning() {
-		const t = tuningFor(this.provider?.resolvedEngineBackend() ?? "onnx");
-		const num = (v, dflt) => typeof v === "number" && v > 0 ? v : dflt;
-		const batch = (v, dflt) => v === "none" || v === "list" || v === "window" ? v : dflt;
-		return {
-			concurrency: num(t["concurrency"], 1),
-			batchMode: batch(t["batchMode"], "window"),
-			windowMs: num(t["windowMs"], 2),
-			maxBatchSize: num(t["maxBatchSize"], 8),
-			numStreams: num(t["numStreams"], 0),
-			intraOpThreads: num(t["intraOpThreads"], 0),
-			numWorkers: num(t["numWorkers"], 1)
-		};
+	resolveOperatorOverride() {
+		return readOperatorOverride(this.config);
 	}
 	/**
-	* Construct a fresh provider with the given effective tuning. Single source of
-	* truth for the provider wiring — shared by `onInitialize`, the post-resolve
-	* tuning reconciliation, and the `onConfigChanged` pool respawn.
+	* Construct a fresh provider carrying the operator override. Single source of
+	* truth for the provider wiring — shared by `onInitialize` and the
+	* `onConfigChanged` pool respawn. NOTHING backend-derived is passed: each
+	* pool resolves its own runtime's registry row.
 	*/
-	buildProvider(modelsDir, tuning) {
+	buildProvider(modelsDir, override) {
 		if (!this.ctx.settings) throw new Error("DetectionPipelineAddon: ctx.settings not available");
 		return new DetectionPipelineProvider(this.ctx.settings, modelsDir, this.ctx.logger, this.ctx.eventBus ?? null, () => ({ sections: [] }), {
-			concurrency: tuning.concurrency,
-			tuning: {
-				batchMode: tuning.batchMode,
-				windowMs: tuning.windowMs,
-				maxBatchSize: tuning.maxBatchSize,
-				numStreams: tuning.numStreams,
-				intraOpThreads: tuning.intraOpThreads
-			},
-			numWorkers: tuning.numWorkers,
+			provisioning: override,
 			pythonPath: this.pythonPath,
 			pythonAddonDir: this.pythonAddonDir
 		});
 	}
-	/**
-	* Pool-bound tuning keys of `a` and `b` are equal (used to decide whether a
-	* post-resolve / config-change respawn is actually needed).
-	*/
-	static poolTuningEqual(a, b) {
-		return a.concurrency === b.concurrency && a.batchMode === b.batchMode && a.windowMs === b.windowMs && a.maxBatchSize === b.maxBatchSize && a.numStreams === b.numStreams && a.intraOpThreads === b.intraOpThreads && a.numWorkers === b.numWorkers;
-	}
 	async onInitialize() {
 		const modelsDir = await this.resolveModelsDir();
 		if (!this.ctx.settings) throw new Error("DetectionPipelineAddon: ctx.settings not available");
@@ -7442,23 +7791,12 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 		if (py.ok && py.pythonPath) this.pythonPath = py.pythonPath;
 		else this.ctx.logger.warn("Detection engine boot continues without Python — selection will provision on demand", {});
 		await this.proactivelyInstallOpenvino();
-		const initialTuning = this.resolveBackendTuning();
-		this.provider = this.buildProvider(modelsDir, initialTuning);
+		this.provider = this.buildProvider(modelsDir, this.resolveOperatorOverride());
 		await this.provider.init();
 		await this.provider.setApi(this.ctx);
-		const resolvedTuning = this.resolveBackendTuning();
-		if (!DetectionPipelineAddon.poolTuningEqual(initialTuning, resolvedTuning)) {
-			this.ctx.logger.info("detection-pipeline tuning reconciled to resolved engine", { meta: {
-				from: initialTuning,
-				to: resolvedTuning
-			} });
-			this.provider = this.buildProvider(modelsDir, resolvedTuning);
-			await this.provider.init();
-			await this.provider.setApi(this.ctx);
-		}
 		await this.provider.warmPool();
 		this.engineMetricsTimer = setInterval(() => this.emitEngineMetricsSnapshot(), ENGINE_METRICS_SNAPSHOT_INTERVAL_MS);
-		this.lastAppliedPoolConfig = this.snapshotPoolConfig();
+		this.lastAppliedOverride = this.resolveOperatorOverride();
 		return [{
 			capability: require_dist.pipelineExecutorCapability,
 			provider: this.provider
@@ -7544,36 +7882,12 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 		}
 	}
 	/**
-	* Snapshot the pool-bound subset of the EFFECTIVE tuning (post-
-	* `resolveBackendTuning`). Stored config values for these fields are
-	* ignored, so this snapshot only changes when `engineBackend` flips
-	* onto a different `tuningFor` row.
-	*/
-	snapshotPoolConfig() {
-		const t = this.resolveBackendTuning();
-		return {
-			concurrency: t.concurrency ?? 0,
-			batchMode: t.batchMode,
-			windowMs: t.windowMs,
-			maxBatchSize: t.maxBatchSize,
-			numStreams: t.numStreams,
-			intraOpThreads: t.intraOpThreads,
-			numWorkers: t.numWorkers
-		};
-	}
-	poolConfigChanged() {
-		const next = this.snapshotPoolConfig();
-		const prev = this.lastAppliedPoolConfig;
-		for (const k of POOL_BOUND_KEYS) if (next[k] !== prev[k]) return true;
-		return false;
-	}
-	/**
 	* BaseAddon calls `onConfigChanged` after every settings write. This is the
 	* SOLE apply path for tuning changes — none of those fields declare
 	* `requiresRestart` anymore (an addon restart re-probes hardware + reloads
-	* every model on every set, which is exactly what we want to avoid): pool-bound
-	* tuning (`concurrency`/`batchMode`/`windowMs`/…) drives an in-place pool
-	* respawn when the snapshot flips (`poolConfigChanged` below). The engine
+	* every model on every set, which is exactly what we want to avoid): a changed
+	* OPERATOR OVERRIDE drives an in-place pool respawn. The per-runtime registry
+	* values cannot change at runtime, so they can never trigger one. The engine
 	* SELECTION is no longer operator-facing — the node-default backend is derived
 	* once at boot (`setApi` → `resolveAutoEngine`) from static hardware, so there
 	* is no per-write engine re-select. The respawn applies optimistically — the
@@ -7581,14 +7895,15 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 	* crashed), no addon bounce.
 	*/
 	async onConfigChanged() {
-		if (!this.poolConfigChanged()) return;
+		const next = this.resolveOperatorOverride();
+		if (overridesEqual(next, this.lastAppliedOverride)) return;
 		if (!this.provider) {
-			this.lastAppliedPoolConfig = this.snapshotPoolConfig();
+			this.lastAppliedOverride = next;
 			return;
 		}
-		this.ctx.logger.info("detection-pipeline tuning changed — respawning pool", { meta: {
-			prev: this.lastAppliedPoolConfig,
-			next: this.snapshotPoolConfig()
+		this.ctx.logger.info("detection-pipeline tuning override changed — respawning pool", { meta: {
+			prev: this.lastAppliedOverride,
+			next
 		} });
 		try {
 			await this.provider.shutdown();
@@ -7596,11 +7911,11 @@ var DetectionPipelineAddon = class DetectionPipelineAddon extends require_dist.B
 			this.ctx.logger.warn("provider shutdown failed during tuning respawn", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 		const modelsDir = await this.resolveModelsDir();
-		this.provider = this.buildProvider(modelsDir, this.resolveBackendTuning());
+		this.provider = this.buildProvider(modelsDir, next);
 		await this.provider.init();
 		await this.provider.setApi(this.ctx);
 		await this.provider.warmPool();
-		this.lastAppliedPoolConfig = this.snapshotPoolConfig();
+		this.lastAppliedOverride = next;
 		this.ctx.logger.info("detection-pipeline pool respawn complete");
 	}
 };