@camstack/addon-pipeline 1.2.310 → 1.2.312

package/dist/pipeline-runner/index.js

@@ -3885,6 +3885,24 @@ function isParkedDetailFresh(parked, nowMs) {
 function buildDetailNotAttachedError(deviceId) {
 	return /* @__PURE__ */ new Error(`${DETAIL_NOT_ATTACHED_MARKER} — camera ${deviceId} is not attached and no detail state is parked within the grace window`);
 }
+/**
+* The wire marker for the typed handle-expired refusal (D688): the frame handle
+* a detail dispatch named is past the native lease age bound, so every later
+* ask for it is refused too. Twin constant in
+* `addon-post-analysis/src/pipeline-analytics/detail-refusal.ts` — keep in sync.
+* An error rather than a result field for the same reason as
+* {@link DETAIL_NOT_ATTACHED_MARKER}: the cap output schema strips unknown keys.
+*/
+var DETAIL_HANDLE_EXPIRED_MARKER = "runDetailSubtree-refused:handle-expired";
+/**
+* The error the cap method throws when the dispatch's only pixel source was a
+* frame handle the lease registry refused as expired. The dispatcher recognises
+* the marker, retires the handle for that track and falls back to its parked
+* frame — it never names the same handle again.
+*/
+function buildDetailHandleExpiredError(deviceId, handleAgeMs) {
+	return /* @__PURE__ */ new Error(`${DETAIL_HANDLE_EXPIRED_MARKER} — camera ${deviceId}: the frame handle is past the native lease age bound (age ${handleAgeMs ?? "unknown"} ms)`);
+}
 //#endregion
 //#region src/pipeline-runner/face-parent-geometry.ts
 /** Is the centre of `face` inside `parent` (edges inclusive)? */
@@ -3970,7 +3988,11 @@ var FaceOutsideParentLog = class {
 //#region src/pipeline-runner/detail-subtree.ts
 /** Did the subtree run refuse because the camera is not attached (park lapsed)? */
 function isDetailNotAttachedRefusal(outcome) {
-	return "refusal" in outcome;
+	return "refusal" in outcome && outcome.refusal === "not-attached";
+}
+/** Did the subtree run refuse because the named frame handle is past its lease age bound? */
+function isDetailHandleExpiredRefusal(outcome) {
+	return "refusal" in outcome && outcome.refusal === "handle-expired";
 }
 /** Did the native-lease fetch report a miss (rather than return pixels)? */
 function isNativeCropMiss(fetch) {
@@ -4272,6 +4294,10 @@ async function runDetailSubtree(deps, input) {
 				nativeWorkerReason: nativeMiss?.workerReason ?? null
 			}
 		});
+		if (nativeMiss?.miss === "handle-expired") return {
+			refusal: "handle-expired",
+			handleAgeMs: nativeMiss.handleAgeMs
+		};
 		return null;
 	}
 	const nativeCropRef = input.frameHandle !== void 0 && crop.source === "native" ? {
@@ -10071,6 +10097,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 			recordFaceOutsideParent: (drop) => this.faceOutsideParentLog.record(drop)
 		}, input);
 		if (outcome !== null && isDetailNotAttachedRefusal(outcome)) throw buildDetailNotAttachedError(input.deviceId);
+		if (outcome !== null && isDetailHandleExpiredRefusal(outcome)) throw buildDetailHandleExpiredError(input.deviceId, outcome.handleAgeMs);
 		return outcome;
 	}
 	/**

package/dist/pipeline-runner/index.mjs

@@ -3877,6 +3877,24 @@ function isParkedDetailFresh(parked, nowMs) {
 function buildDetailNotAttachedError(deviceId) {
 	return /* @__PURE__ */ new Error(`${DETAIL_NOT_ATTACHED_MARKER} — camera ${deviceId} is not attached and no detail state is parked within the grace window`);
 }
+/**
+* The wire marker for the typed handle-expired refusal (D688): the frame handle
+* a detail dispatch named is past the native lease age bound, so every later
+* ask for it is refused too. Twin constant in
+* `addon-post-analysis/src/pipeline-analytics/detail-refusal.ts` — keep in sync.
+* An error rather than a result field for the same reason as
+* {@link DETAIL_NOT_ATTACHED_MARKER}: the cap output schema strips unknown keys.
+*/
+var DETAIL_HANDLE_EXPIRED_MARKER = "runDetailSubtree-refused:handle-expired";
+/**
+* The error the cap method throws when the dispatch's only pixel source was a
+* frame handle the lease registry refused as expired. The dispatcher recognises
+* the marker, retires the handle for that track and falls back to its parked
+* frame — it never names the same handle again.
+*/
+function buildDetailHandleExpiredError(deviceId, handleAgeMs) {
+	return /* @__PURE__ */ new Error(`${DETAIL_HANDLE_EXPIRED_MARKER} — camera ${deviceId}: the frame handle is past the native lease age bound (age ${handleAgeMs ?? "unknown"} ms)`);
+}
 //#endregion
 //#region src/pipeline-runner/face-parent-geometry.ts
 /** Is the centre of `face` inside `parent` (edges inclusive)? */
@@ -3962,7 +3980,11 @@ var FaceOutsideParentLog = class {
 //#region src/pipeline-runner/detail-subtree.ts
 /** Did the subtree run refuse because the camera is not attached (park lapsed)? */
 function isDetailNotAttachedRefusal(outcome) {
-	return "refusal" in outcome;
+	return "refusal" in outcome && outcome.refusal === "not-attached";
+}
+/** Did the subtree run refuse because the named frame handle is past its lease age bound? */
+function isDetailHandleExpiredRefusal(outcome) {
+	return "refusal" in outcome && outcome.refusal === "handle-expired";
 }
 /** Did the native-lease fetch report a miss (rather than return pixels)? */
 function isNativeCropMiss(fetch) {
@@ -4264,6 +4286,10 @@ async function runDetailSubtree(deps, input) {
 				nativeWorkerReason: nativeMiss?.workerReason ?? null
 			}
 		});
+		if (nativeMiss?.miss === "handle-expired") return {
+			refusal: "handle-expired",
+			handleAgeMs: nativeMiss.handleAgeMs
+		};
 		return null;
 	}
 	const nativeCropRef = input.frameHandle !== void 0 && crop.source === "native" ? {
@@ -10063,6 +10089,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 			recordFaceOutsideParent: (drop) => this.faceOutsideParentLog.record(drop)
 		}, input);
 		if (outcome !== null && isDetailNotAttachedRefusal(outcome)) throw buildDetailNotAttachedError(input.deviceId);
+		if (outcome !== null && isDetailHandleExpiredRefusal(outcome)) throw buildDetailHandleExpiredError(input.deviceId, outcome.handleAgeMs);
 		return outcome;
 	}
 	/**

package/dist/stream-broker/index.js

@@ -8498,6 +8498,41 @@ function resolveSourceParser(setting, sourceType) {
 	}
 }
 //#endregion
+//#region src/stream-broker/catalog-absence.ts
+function judgeCatalogAbsence(input) {
+	const { marks, listed, candidates, nowMs, confirmMinMs } = input;
+	const nextMarks = /* @__PURE__ */ new Map();
+	const marked = [];
+	const cleared = [];
+	const retract = [];
+	for (const camStreamId of candidates) {
+		const markedAt = marks.get(camStreamId);
+		if (listed.has(camStreamId)) {
+			if (markedAt !== void 0) cleared.push(camStreamId);
+			continue;
+		}
+		if (markedAt === void 0) {
+			nextMarks.set(camStreamId, nowMs);
+			marked.push(camStreamId);
+			continue;
+		}
+		if (nowMs - markedAt < confirmMinMs) {
+			nextMarks.set(camStreamId, markedAt);
+			continue;
+		}
+		retract.push({
+			camStreamId,
+			absentForMs: nowMs - markedAt
+		});
+	}
+	return {
+		nextMarks,
+		marked,
+		cleared,
+		retract
+	};
+}
+//#endregion
 //#region src/stream-broker/rtmp/flv-parser.ts
 var AudioSoundFormat = /* @__PURE__ */ function(AudioSoundFormat) {
 	AudioSoundFormat[AudioSoundFormat["PCM_BE"] = 0] = "PCM_BE";
@@ -17098,6 +17133,13 @@ var RtspEnabledSchema = require_dist.record(require_dist.string(), require_dist.
 * one observation.
 */
 var DEPARTURE_CONFIRM_MIN_MS = 3e4;
+/**
+* The catalog reconcile's second omission of a stream must be at least this
+* long after the first (D689) — the same one-poll-interval floor as the
+* departed-device sweep, for the same reason: an event-driven pull next to a
+* poll, or the startup pass's quick re-runs, are one observation.
+*/
+var CATALOG_ABSENCE_CONFIRM_MIN_MS = DEPARTURE_CONFIRM_MIN_MS;
 var PUSH_KINDS = new Set(["push-annexb"]);
 /** Walk a profile map and return the slot that points at `camStreamId`, or null. */
 function findProfileForStream(map, camStreamId) {
@@ -17304,6 +17346,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* agrees, and a reappearance clears it (D49).
 	*/
 	departureMarks = /* @__PURE__ */ new Map();
+	/**
+	* Per device: provider streams the broker holds that a successful catalog
+	* pull OMITTED, and when (D689). A mark, not a verdict — see
+	* `catalog-absence.ts`. Dropped when the stream is retracted by any path and
+	* when the device is disabled (no pulls run then, so a mark would outlive
+	* the observation it records).
+	*/
+	catalogAbsenceMarks = /* @__PURE__ */ new Map();
 	eventBus = null;
 	/**
 	* Per-broker stream health flag set by the watchdog. `undefined`
@@ -19034,6 +19084,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		await this.releaseBroker(deviceId, camStreamId);
 		streamMap.delete(camStreamId);
 		if (streamMap.size === 0) this.cameraStreams.delete(deviceId);
+		this.dropCatalogAbsenceMark(deviceId, camStreamId);
 		this.emitCamStreamsChanged(deviceId);
 		return { success: true };
 	}
@@ -19095,13 +19146,21 @@ var StreamBrokerManager = class StreamBrokerManager {
 	}
 	/**
 	* Pull one camera's `stream-catalog` and reconcile its cam-streams: upsert
-	* every descriptor, retract any cam-stream no longer in the catalog. A pull
+	* every descriptor, retract a cam-stream the catalog no longer lists. A pull
 	* that throws (provider mid-restart, no `stream-catalog` cap, a camera whose
 	* session died) omits THIS DEVICE ONLY — it is logged at `warn` with the
-	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder. An EMPTY
-	* catalog is also skipped rather than tearing down (a provider probe can
-	* transiently return none); genuine removal flows through the
-	* device-unregistered path.
+	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder.
+	*
+	* The retract DESTROYS work (broker, restreamer, every writer and viewer on
+	* it), so it is never decided by one read (D689, D49): a pull that omits a
+	* stream only marks it, and the retract needs a later successful pull, at
+	* least {@link CATALOG_ABSENCE_CONFIRM_MIN_MS} after the mark, to agree. A
+	* failed pull, or one that answered nothing at all (`null`), decides
+	* nothing. Neither does an answered EMPTY catalog: providers answer `[]`
+	* both for "not mine" and for "don't know yet" (a sleeping Reolink battery
+	* camera, a rebooting Hikvision), so it is not a read that may destroy work
+	* — it neither marks nor clears. Genuine removal of a whole camera is the
+	* `DeviceUnregistered` path and the departed-device sweep (D685).
 	*
 	* `trigger` decides whether the backoff applies — see
 	* {@link CatalogReconcileTrigger}. It defaults to `'event'` (always attempt)
@@ -19123,9 +19182,9 @@ var StreamBrokerManager = class StreamBrokerManager {
 			});
 			return;
 		}
-		let descriptors;
+		let answer;
 		try {
-			descriptors = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId) ?? [];
+			answer = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId);
 		} catch (err) {
 			const next = nextCatalogPullFailureState(this.catalogPullFailures.get(deviceId), Date.now());
 			this.catalogPullFailures.set(deviceId, next);
@@ -19142,21 +19201,85 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 		if (this.catalogPullFailures.delete(deviceId)) this.logger.info("stream-catalog pull recovered — device is back in the catalog", {
 			tags: { deviceId },
-			meta: { descriptors: descriptors.length }
+			meta: { descriptors: answer?.length ?? null }
 		});
-		if (descriptors.length === 0) return;
-		const keep = new Set(descriptors.map((d) => d.camStreamId));
+		if (answer === null || answer === void 0) {
+			this.logger.debug("stream-catalog pull answered nothing — the registry is left as it is", {
+				tags: { deviceId },
+				meta: { trigger }
+			});
+			return;
+		}
+		const descriptors = answer;
+		if (descriptors.length === 0) {
+			this.logger.debug("stream-catalog pull answered empty — ignored: neither marks nor clears a stream (D689)", {
+				tags: { deviceId },
+				meta: {
+					trigger,
+					pendingMarks: this.catalogAbsenceMarks.get(deviceId)?.size ?? 0
+				}
+			});
+			return;
+		}
 		await this.publishCatalog(deviceId, descriptors);
+		await this.retractStreamsTwoPullsOmitted(deviceId, descriptors, trigger);
+	}
+	/**
+	* The retract half of a SUCCESSFUL catalog pull (D689): mark what this pull
+	* omitted, unmark what it lists again, retract what two pulls a reconcile
+	* interval apart both omitted. See `catalog-absence.ts`.
+	*/
+	async retractStreamsTwoPullsOmitted(deviceId, descriptors, trigger) {
 		const existing = this.cameraStreams.get(deviceId);
-		if (existing) for (const [camStreamId, cam] of Array.from(existing.entries())) {
-			if (cam.brokerOwned) continue;
-			if (!keep.has(camStreamId)) await this.retractCameraStream({
+		const candidates = existing ? Array.from(existing.values()).filter((cam) => !cam.brokerOwned).map((cam) => cam.camStreamId) : [];
+		const verdict = judgeCatalogAbsence({
+			marks: this.catalogAbsenceMarks.get(deviceId) ?? /* @__PURE__ */ new Map(),
+			listed: new Set(descriptors.map((d) => d.camStreamId)),
+			candidates,
+			nowMs: Date.now(),
+			confirmMinMs: CATALOG_ABSENCE_CONFIRM_MIN_MS
+		});
+		if (verdict.nextMarks.size > 0) this.catalogAbsenceMarks.set(deviceId, verdict.nextMarks);
+		else this.catalogAbsenceMarks.delete(deviceId);
+		for (const camStreamId of verdict.marked) this.logger.info("stream absent from the catalog — retracted only if a pull a reconcile interval later agrees", {
+			tags: { deviceId },
+			meta: {
+				camStreamId,
+				trigger,
+				confirmAfterMs: CATALOG_ABSENCE_CONFIRM_MIN_MS
+			}
+		});
+		for (const camStreamId of verdict.cleared) this.logger.info("stream is back in the catalog — pending retract cancelled", {
+			tags: { deviceId },
+			meta: {
+				camStreamId,
+				trigger
+			}
+		});
+		for (const { camStreamId, absentForMs } of verdict.retract) {
+			this.logger.warn("stream absent from two catalog pulls — retracted", {
+				tags: { deviceId },
+				meta: {
+					camStreamId,
+					absentForMs,
+					trigger
+				}
+			});
+			await this.retractCameraStream({
 				deviceId,
 				camStreamId,
 				preserveAssignment: true
 			});
 		}
 	}
+	/** Forget one stream's pending catalog-absence mark — it was retracted by some path. */
+	dropCatalogAbsenceMark(deviceId, camStreamId) {
+		const marks = this.catalogAbsenceMarks.get(deviceId);
+		if (!marks?.has(camStreamId)) return;
+		const next = new Map([...marks].filter(([id]) => id !== camStreamId));
+		if (next.size > 0) this.catalogAbsenceMarks.set(deviceId, next);
+		else this.catalogAbsenceMarks.delete(deviceId);
+	}
 	/**
 	* Enumerate every camera and reconcile its catalog. The reconcile backstop
 	* (poll cadence) and the start-up fetch. Per-device failures are isolated so
@@ -19176,6 +19299,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		for (const d of cameras) if (d.disabled) {
 			const firstSeen = !this.disabledDevices.has(d.id);
 			this.disabledDevices.add(d.id);
+			this.catalogAbsenceMarks.delete(d.id);
 			await this.releaseDisabledDeviceBrokers(d.id, firstSeen);
 		} else this.disabledDevices.delete(d.id);
 		const live = cameras.filter((d) => !d.disabled);

package/dist/stream-broker/index.mjs

@@ -8494,6 +8494,41 @@ function resolveSourceParser(setting, sourceType) {
 	}
 }
 //#endregion
+//#region src/stream-broker/catalog-absence.ts
+function judgeCatalogAbsence(input) {
+	const { marks, listed, candidates, nowMs, confirmMinMs } = input;
+	const nextMarks = /* @__PURE__ */ new Map();
+	const marked = [];
+	const cleared = [];
+	const retract = [];
+	for (const camStreamId of candidates) {
+		const markedAt = marks.get(camStreamId);
+		if (listed.has(camStreamId)) {
+			if (markedAt !== void 0) cleared.push(camStreamId);
+			continue;
+		}
+		if (markedAt === void 0) {
+			nextMarks.set(camStreamId, nowMs);
+			marked.push(camStreamId);
+			continue;
+		}
+		if (nowMs - markedAt < confirmMinMs) {
+			nextMarks.set(camStreamId, markedAt);
+			continue;
+		}
+		retract.push({
+			camStreamId,
+			absentForMs: nowMs - markedAt
+		});
+	}
+	return {
+		nextMarks,
+		marked,
+		cleared,
+		retract
+	};
+}
+//#endregion
 //#region src/stream-broker/rtmp/flv-parser.ts
 var AudioSoundFormat = /* @__PURE__ */ function(AudioSoundFormat) {
 	AudioSoundFormat[AudioSoundFormat["PCM_BE"] = 0] = "PCM_BE";
@@ -17094,6 +17129,13 @@ var RtspEnabledSchema = record(string(), boolean());
 * one observation.
 */
 var DEPARTURE_CONFIRM_MIN_MS = 3e4;
+/**
+* The catalog reconcile's second omission of a stream must be at least this
+* long after the first (D689) — the same one-poll-interval floor as the
+* departed-device sweep, for the same reason: an event-driven pull next to a
+* poll, or the startup pass's quick re-runs, are one observation.
+*/
+var CATALOG_ABSENCE_CONFIRM_MIN_MS = DEPARTURE_CONFIRM_MIN_MS;
 var PUSH_KINDS = new Set(["push-annexb"]);
 /** Walk a profile map and return the slot that points at `camStreamId`, or null. */
 function findProfileForStream(map, camStreamId) {
@@ -17300,6 +17342,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* agrees, and a reappearance clears it (D49).
 	*/
 	departureMarks = /* @__PURE__ */ new Map();
+	/**
+	* Per device: provider streams the broker holds that a successful catalog
+	* pull OMITTED, and when (D689). A mark, not a verdict — see
+	* `catalog-absence.ts`. Dropped when the stream is retracted by any path and
+	* when the device is disabled (no pulls run then, so a mark would outlive
+	* the observation it records).
+	*/
+	catalogAbsenceMarks = /* @__PURE__ */ new Map();
 	eventBus = null;
 	/**
 	* Per-broker stream health flag set by the watchdog. `undefined`
@@ -19030,6 +19080,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		await this.releaseBroker(deviceId, camStreamId);
 		streamMap.delete(camStreamId);
 		if (streamMap.size === 0) this.cameraStreams.delete(deviceId);
+		this.dropCatalogAbsenceMark(deviceId, camStreamId);
 		this.emitCamStreamsChanged(deviceId);
 		return { success: true };
 	}
@@ -19091,13 +19142,21 @@ var StreamBrokerManager = class StreamBrokerManager {
 	}
 	/**
 	* Pull one camera's `stream-catalog` and reconcile its cam-streams: upsert
-	* every descriptor, retract any cam-stream no longer in the catalog. A pull
+	* every descriptor, retract a cam-stream the catalog no longer lists. A pull
 	* that throws (provider mid-restart, no `stream-catalog` cap, a camera whose
 	* session died) omits THIS DEVICE ONLY — it is logged at `warn` with the
-	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder. An EMPTY
-	* catalog is also skipped rather than tearing down (a provider probe can
-	* transiently return none); genuine removal flows through the
-	* device-unregistered path.
+	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder.
+	*
+	* The retract DESTROYS work (broker, restreamer, every writer and viewer on
+	* it), so it is never decided by one read (D689, D49): a pull that omits a
+	* stream only marks it, and the retract needs a later successful pull, at
+	* least {@link CATALOG_ABSENCE_CONFIRM_MIN_MS} after the mark, to agree. A
+	* failed pull, or one that answered nothing at all (`null`), decides
+	* nothing. Neither does an answered EMPTY catalog: providers answer `[]`
+	* both for "not mine" and for "don't know yet" (a sleeping Reolink battery
+	* camera, a rebooting Hikvision), so it is not a read that may destroy work
+	* — it neither marks nor clears. Genuine removal of a whole camera is the
+	* `DeviceUnregistered` path and the departed-device sweep (D685).
 	*
 	* `trigger` decides whether the backoff applies — see
 	* {@link CatalogReconcileTrigger}. It defaults to `'event'` (always attempt)
@@ -19119,9 +19178,9 @@ var StreamBrokerManager = class StreamBrokerManager {
 			});
 			return;
 		}
-		let descriptors;
+		let answer;
 		try {
-			descriptors = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId) ?? [];
+			answer = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId);
 		} catch (err) {
 			const next = nextCatalogPullFailureState(this.catalogPullFailures.get(deviceId), Date.now());
 			this.catalogPullFailures.set(deviceId, next);
@@ -19138,21 +19197,85 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 		if (this.catalogPullFailures.delete(deviceId)) this.logger.info("stream-catalog pull recovered — device is back in the catalog", {
 			tags: { deviceId },
-			meta: { descriptors: descriptors.length }
+			meta: { descriptors: answer?.length ?? null }
 		});
-		if (descriptors.length === 0) return;
-		const keep = new Set(descriptors.map((d) => d.camStreamId));
+		if (answer === null || answer === void 0) {
+			this.logger.debug("stream-catalog pull answered nothing — the registry is left as it is", {
+				tags: { deviceId },
+				meta: { trigger }
+			});
+			return;
+		}
+		const descriptors = answer;
+		if (descriptors.length === 0) {
+			this.logger.debug("stream-catalog pull answered empty — ignored: neither marks nor clears a stream (D689)", {
+				tags: { deviceId },
+				meta: {
+					trigger,
+					pendingMarks: this.catalogAbsenceMarks.get(deviceId)?.size ?? 0
+				}
+			});
+			return;
+		}
 		await this.publishCatalog(deviceId, descriptors);
+		await this.retractStreamsTwoPullsOmitted(deviceId, descriptors, trigger);
+	}
+	/**
+	* The retract half of a SUCCESSFUL catalog pull (D689): mark what this pull
+	* omitted, unmark what it lists again, retract what two pulls a reconcile
+	* interval apart both omitted. See `catalog-absence.ts`.
+	*/
+	async retractStreamsTwoPullsOmitted(deviceId, descriptors, trigger) {
 		const existing = this.cameraStreams.get(deviceId);
-		if (existing) for (const [camStreamId, cam] of Array.from(existing.entries())) {
-			if (cam.brokerOwned) continue;
-			if (!keep.has(camStreamId)) await this.retractCameraStream({
+		const candidates = existing ? Array.from(existing.values()).filter((cam) => !cam.brokerOwned).map((cam) => cam.camStreamId) : [];
+		const verdict = judgeCatalogAbsence({
+			marks: this.catalogAbsenceMarks.get(deviceId) ?? /* @__PURE__ */ new Map(),
+			listed: new Set(descriptors.map((d) => d.camStreamId)),
+			candidates,
+			nowMs: Date.now(),
+			confirmMinMs: CATALOG_ABSENCE_CONFIRM_MIN_MS
+		});
+		if (verdict.nextMarks.size > 0) this.catalogAbsenceMarks.set(deviceId, verdict.nextMarks);
+		else this.catalogAbsenceMarks.delete(deviceId);
+		for (const camStreamId of verdict.marked) this.logger.info("stream absent from the catalog — retracted only if a pull a reconcile interval later agrees", {
+			tags: { deviceId },
+			meta: {
+				camStreamId,
+				trigger,
+				confirmAfterMs: CATALOG_ABSENCE_CONFIRM_MIN_MS
+			}
+		});
+		for (const camStreamId of verdict.cleared) this.logger.info("stream is back in the catalog — pending retract cancelled", {
+			tags: { deviceId },
+			meta: {
+				camStreamId,
+				trigger
+			}
+		});
+		for (const { camStreamId, absentForMs } of verdict.retract) {
+			this.logger.warn("stream absent from two catalog pulls — retracted", {
+				tags: { deviceId },
+				meta: {
+					camStreamId,
+					absentForMs,
+					trigger
+				}
+			});
+			await this.retractCameraStream({
 				deviceId,
 				camStreamId,
 				preserveAssignment: true
 			});
 		}
 	}
+	/** Forget one stream's pending catalog-absence mark — it was retracted by some path. */
+	dropCatalogAbsenceMark(deviceId, camStreamId) {
+		const marks = this.catalogAbsenceMarks.get(deviceId);
+		if (!marks?.has(camStreamId)) return;
+		const next = new Map([...marks].filter(([id]) => id !== camStreamId));
+		if (next.size > 0) this.catalogAbsenceMarks.set(deviceId, next);
+		else this.catalogAbsenceMarks.delete(deviceId);
+	}
 	/**
 	* Enumerate every camera and reconcile its catalog. The reconcile backstop
 	* (poll cadence) and the start-up fetch. Per-device failures are isolated so
@@ -19172,6 +19295,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		for (const d of cameras) if (d.disabled) {
 			const firstSeen = !this.disabledDevices.has(d.id);
 			this.disabledDevices.add(d.id);
+			this.catalogAbsenceMarks.delete(d.id);
 			await this.releaseDisabledDeviceBrokers(d.id, firstSeen);
 		} else this.disabledDevices.delete(d.id);
 		const live = cameras.filter((d) => !d.disabled);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.310",
+  "version": "1.2.312",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",