@camstack/addon-pipeline 1.2.373 → 1.2.375

package/dist/stream-broker/index.mjs

@@ -1,10 +1,9 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
-import { $n as _enum, An as errMsg, At as gifFromMp4Args, Bt as memoizePinnedFfmpeg, D as G711_SCALE_CORRECTION_DB, Dn as isSoftwareDecode, Dt as ffmpegRate, En as invocationFromEncodeProfile, Ft as loadContributionCapability, Gn as makeProfileBrokerId, I as RATE_CONTROL_RELAXED, It as logChannelsCapability, J as addonWidgetsSourceCapability, Jn as nodePin, Kn as makeSourceBrokerId, L as RATE_CONTROL_TIGHT, Mn as BaseAddon, Nn as CAM_PROFILE_ORDER, On as DeviceFeature, Pn as CamProfileSchema, Qt as rankStreams, Rn as createEvent, Vn as expandAudioChunkToF32le, W as RingBuffer, Wn as isEvent, Yn as parseProfileBrokerId, an as resolveEgressDecodeHwAccel, ar as number, bn as webrtcSessionCapability, bt as egressTransportFromRequest, c as CLIP_STILL_REASON_CODE_HEADER, cr as record, dr as EventCategory, dt as declareLogChannel, er as array, gn as streamBrokerCapability, ir as literal, it as cameraStreamsCapability, jn as BOOT_RECOVERY_BACKOFF_MS, kn as DeviceType, kt as gifDeriveSpeed, lr as string, lt as createHwAccelCache, nr as discriminatedUnion, o as BatteryStatusSchema, or as object, ot as clipExportFailureOf, pt as deriveBatteryPresence, qn as maskUrlCredentials, s as CLIP_BROKER_PACED_RATES, tr as boolean, tt as batteryCapability, ur as union, ut as createLogChannelsProvider, w as EncodeProfileSchema, wn as buildFfmpegArgs, xn as AUDIO_PRESETS, yt as egressTranscodeSharingKey } from "../dist-BT3uSeR7.mjs";
-import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-BVRFl1hZ.mjs";
+import { An as errMsg, At as gifFromMp4Args, Bt as memoizePinnedFfmpeg, D as G711_SCALE_CORRECTION_DB, Dn as isSoftwareDecode, Dt as ffmpegRate, En as invocationFromEncodeProfile, Ft as loadContributionCapability, Gn as isSecretMarker, I as RATE_CONTROL_RELAXED, It as logChannelsCapability, J as addonWidgetsSourceCapability, Jn as maskUrlCredentials, Kn as makeProfileBrokerId, L as RATE_CONTROL_TIGHT, Mn as BaseAddon, Nn as CAM_PROFILE_ORDER, On as DeviceFeature, Pn as CamProfileSchema, Qt as rankStreams, Rn as createEvent, Vn as expandAudioChunkToF32le, W as RingBuffer, Wn as isEvent, Xn as parseProfileBrokerId, Yn as nodePin, Z as armRemovalReconcile, an as resolveEgressDecodeHwAccel, ar as literal, bn as webrtcSessionCapability, bt as egressTransportFromRequest, c as CLIP_STILL_REASON_CODE_HEADER, dr as union, dt as declareLogChannel, er as _enum, fr as EventCategory, gn as streamBrokerCapability, it as cameraStreamsCapability, jn as BOOT_RECOVERY_BACKOFF_MS, kn as DeviceType, kt as gifDeriveSpeed, lr as record, lt as createHwAccelCache, nr as boolean, o as BatteryStatusSchema, or as number, ot as clipExportFailureOf, pt as deriveBatteryPresence, qn as makeSourceBrokerId, rr as discriminatedUnion, s as CLIP_BROKER_PACED_RATES, sr as object, tr as array, tt as batteryCapability, ur as string, ut as createLogChannelsProvider, vt as deviceRemovalHookCapability, w as EncodeProfileSchema, wn as buildFfmpegArgs, xn as AUDIO_PRESETS, yt as egressTranscodeSharingKey } from "../dist-QyeZXkAO.mjs";
+import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-ndjp9DQO.mjs";
 import { a as parseRestreamPath, d as PREBUFFER_MAX_MS, f as capPreRollRequestMs, i as isLiveEdgeOnlyDial, m as resolvePrebuffer, n as NO_DECLARATION, p as prebufferRetentionMs, s as sdpVariantFor, u as withSentryIntent } from "../restream-intent-DyGmLAU9.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
-import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
-import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-8CfbEFeD.mjs";
+import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-CLXBgUTo.mjs";
 import { createRequire } from "node:module";
 import * as os$1 from "node:os";
 import { networkInterfaces, tmpdir } from "node:os";
@@ -360,207 +359,253 @@ function formatProbedSummary(declared, snapshot, opts) {
 	return parts.join(SEP);
 }
 //#endregion
-//#region src/stream-broker/broker-row-stores.ts
-/**
-* The stream-broker's flattened settings maps — one row per entry.
-*
-* ## What this replaced
-*
-* `stream-broker:addon-settings` / `root` was 33 155 bytes on the reference
-* hub, and three keys were 32 735 of it: `probeSnapshots` (17 282 B, 109
-* streams), `rtspTokens` (13 147 B, 243 streams) and `profileMap` (2 306 B, 29
-* cameras — a per-DEVICE map, so it grows with the fleet). Every read of that
-* row parsed all of it, including `BaseAddon.resolveConfig`, and every write
-* rewrote all of it — a probe flush every few seconds while streams are live.
-*
-* Two keys deliberately STAY blob keys on that row, and the reasons are not
-* "they are small":
-*
-*   - `rtspEnabled` — brokerId → boolean, EMPTY on the reference hub. Its
-*     persister replaces the whole map from the set of registered restreamers,
-*     and reproducing that on rows means an authoritative prune. A prune driven
-*     by a map that shrinks whenever a broker unregisters is exactly the shape
-*     that turns an unbind into a wipe (D130, D49), and the twin key
-*     `rtspTokens` carries a comment about precisely that loss. Nothing is
-*     bought by moving 0 bytes at that risk.
-*   - `deviceOverrides` — 354 B, two cameras, same replace-the-whole-map
-*     persister, written only when an operator edits an override.
-*
-* The row survives either way: it is also where `BaseAddon.resolveConfig` reads
-* the operator's config fields from. The problem was a 33 KB row, not a blob.
-*/
-/**
-* The addon id — the settings-store namespace whose `root` row the flattened
-* keys are being retired from. Matches `packages/addon-pipeline/package.json`
-* (`camstack.addons[].id`).
-*/
-var STREAM_BROKER_ADDON_ID = "stream-broker";
-/**
-* Every one of these collections is keyed by the BROKER ID
-* (`<deviceId>/<camStreamId>`) or by the numeric deviceId. `brokerDeviceId`
-* recovers the numeric device from either, for the projected column that makes
-* a per-camera question an indexed query — and for `tags: { deviceId }` on
-* every line these stores log.
-*
-* Returns `null` rather than guessing: a key whose head is not a number is a
-* key this addon did not write, and inventing a device for it would put a row
-* on a camera at random.
-*/
-function brokerDeviceId(key) {
-	const head = key.includes("/") ? key.slice(0, key.indexOf("/")) : key;
-	const id = Number(head);
-	return Number.isInteger(id) && id > 0 ? id : null;
-}
-/**
-* Bound for a whole-map read. `settings-store.query` silently caps an unbounded
-* read at 2 000 rows and answers as if that were everything; at 974 devices ×
-* up to 5 streams the default is HALF the margin, so every read here names its
-* own ceiling and a truncation is reported rather than shrunk.
-*/
-var BROKER_ROWS_LIMIT = 2e4;
-/**
-* @durable class=mirror owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), replaced wholesale from the
-*     manager's live probe map by the throttled metrics flush and once on shutdown"
-*   retention="the flush is authoritative: a broker the manager no longer holds loses its
-*     row. Losing the whole collection costs the settings 'Probed' field showing 'not yet
-*     probed' until the stream is pulled again — it is re-derived from the next probe."
-*/
-var BROKER_PROBE_SNAPSHOTS_COLLECTION = "stream-broker:probe-snapshots";
-var BROKER_PROBE_SNAPSHOTS_SPEC = {
-	collection: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-	schema: ProbedSnapshotSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}, {
-		name: "at",
-		type: "INTEGER",
-		notNull: true
-	}],
-	indexes: [{
-		name: "idx_stream_broker_probe_device",
-		columns: ["deviceId"]
-	}],
-	project: (key, value) => ({
-		deviceId: brokerDeviceId(key),
-		at: value.at
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function probeSnapshotsStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_PROBE_SNAPSHOTS_SPEC,
-		store,
-		logger
-	});
-}
-/**
-* The token, wrapped in an object rather than stored bare.
-*
-* A bare string in a `JSON` column round-trips only because the engine's
-* decoder JSON-parses a stored string ONLY when it starts with `{` or `[`. That
-* is a heuristic, not a contract; a token is opaque hex today and a future
-* format that starts with a brace would come back as an object. One field costs
-* nothing and makes the row self-describing.
-*/
-var RtspTokenRowSchema = object({ token: string().min(1) });
-/**
-* @durable class=ledger owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), upserted when the restream
-*     server mints a token. MERGE only — a token is stable forever per stream unless it
-*     is explicitly regenerated"
-*   retention="nothing deletes a row. The persister receives only the CURRENTLY registered
-*     restreamers, so a replace would erase the token of an unregistered broker and turn
-*     an external NVR URL into a dead 404 at the next idle or reboot."
-*/
-var BROKER_RTSP_TOKENS_COLLECTION = "stream-broker:rtsp-tokens";
-var BROKER_RTSP_TOKENS_SPEC = {
-	collection: BROKER_RTSP_TOKENS_COLLECTION,
-	schema: RtspTokenRowSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}],
-	indexes: [{
-		name: "idx_stream_broker_rtsp_tokens_device",
-		columns: ["deviceId"]
-	}],
-	project: (key) => ({ deviceId: brokerDeviceId(key) }),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function rtspTokensStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_RTSP_TOKENS_SPEC,
-		store,
-		logger
-	});
-}
-/** One camera's profile → camStreamId assignment, plus whether it is automatic. */
+//#region src/stream-broker/broker-device-state.ts
+/**
+* The stream-broker's per-camera state, kept as per-device settings (D870).
+*
+* Three maps used to be collections of their own (`stream-broker:probe-snapshots`,
+* `:profile-map`, `:rtsp-tokens`), each keyed by the camera. A camera's data in
+* a side table is a row somebody must remember to delete when the camera goes;
+* as a KEY of the camera's own settings it is cleared by the central device
+* delete (D865) with everything else.
+*
+* | key              | value for one camera                                      |
+* | ---------------- | --------------------------------------------------------- |
+* | `probeSnapshots` | `{ [camStreamId]: ProbedSnapshot }` - what the broker last probed |
+* | `brokerProfile`  | `{ map, auto }` - the profile -> camStreamId assignment   |
+* | `rtspTokens`     | JSON text of `{ [camStreamId]: token }` - a SECRET: declared in `secretStatePaths`, so the settings view stores a keychain marker and the text lives in the keychain |
+*
+* Failure direction: a load that cannot ask the store THROWS (D49). The writers
+* built on {@link DeviceKeyMirror} refuse to write until a load has succeeded,
+* because a replace driven by an empty "known" set would otherwise drop or
+* shrink rows it never saw.
+*/
+/** Per-device settings keys. */
+var PROBE_SNAPSHOTS_KEY = "probeSnapshots";
+var BROKER_PROFILE_KEY = "brokerProfile";
+var RTSP_TOKENS_KEY = "rtspTokens";
+/** One camera's profile -> camStreamId assignment, plus whether it is automatic. */
 var ProfileAssignmentSchema = object({
 	map: record(string(), string()),
 	auto: boolean()
 });
+var ProbeSnapshotsOfDeviceSchema = record(string(), ProbedSnapshotSchema);
+var RtspTokensOfDeviceSchema = record(string(), string().min(1));
 /**
-* @durable class=config owner=stream-broker
-*   write="one row per camera, replaced wholesale from the manager's assignment map on
-*     every profile mutation — the map is authoritative and its boot pass PRUNES cameras
-*     the device registry no longer knows, which is why the write is a replace and not
-*     an upsert"
-*   retention="the replace is the retention: a camera dropped from the manager's map loses
-*     its row. Losing a row costs one automatic re-assignment on the next catalog pull."
-*/
-var BROKER_PROFILE_MAP_COLLECTION = "stream-broker:profile-map";
-var BROKER_PROFILE_MAP_SPEC = {
-	collection: BROKER_PROFILE_MAP_COLLECTION,
-	schema: ProfileAssignmentSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	}, {
-		name: "auto",
-		type: "BOOLEAN",
-		notNull: true
-	}],
-	project: (key, value) => ({
-		deviceId: Number(key),
-		auto: value.auto
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
+* A broker id is `<deviceId>/<camStreamId>`. Returns `null` rather than
+* guessing: a key whose head is not a number is a key this addon did not
+* write, and inventing a device for it would put a value on a camera at random.
+*/
+function splitBrokerId(brokerId) {
+	const slash = brokerId.indexOf("/");
+	if (slash <= 0) return null;
+	const deviceId = Number(brokerId.slice(0, slash));
+	if (!Number.isInteger(deviceId) || deviceId <= 0) return null;
+	return {
+		deviceId,
+		camStreamId: brokerId.slice(slash + 1)
+	};
+}
+/** Group `<deviceId>/<camStreamId>` -> value into deviceId -> camStreamId -> value. */
+function groupByDevice(flat) {
+	const entries = flat instanceof Map ? [...flat.entries()] : Object.entries(flat);
+	const out = /* @__PURE__ */ new Map();
+	for (const [brokerId, value] of entries) {
+		const parts = splitBrokerId(brokerId);
+		if (parts === null) continue;
+		const group = out.get(parts.deviceId) ?? {};
+		group[parts.camStreamId] = value;
+		out.set(parts.deviceId, group);
+	}
+	return out;
+}
+/** The inverse of {@link groupByDevice}. */
+function flattenByDevice(grouped) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of grouped) for (const [camStreamId, value] of Object.entries(group)) out.set(`${deviceId}/${camStreamId}`, value);
+	return out;
+}
+/** A stored value that exists but cannot be read now (see `DeviceKeyMirrorDeps.decode`). */
+var HELD_UNAVAILABLE = Symbol("held-unavailable");
+/**
+* One settings key across the fleet: loaded once, then written by diff.
+*
+* `replace` is authoritative (a camera the caller no longer holds loses the
+* key, but only if this mirror has SEEN it - it never deletes what it did not
+* load); `merge` only ever adds and changes.
+*/
+var DeviceKeyMirror = class {
+	deps;
+	/** The JSON of what the store holds per device, as of the last load or write. */
+	held = /* @__PURE__ */ new Map();
+	values = /* @__PURE__ */ new Map();
+	blocked = /* @__PURE__ */ new Map();
+	/** Cameras whose stored value is GONE: a load never re-blocks them. */
+	released = /* @__PURE__ */ new Set();
+	loaded = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Read the key of every camera that has it. THROWS when the store cannot be asked. */
+	async load() {
+		const ids = await this.deps.settings.listDeviceStoreIds();
+		const blobs = await this.deps.settings.readDeviceStoreBatch(ids);
+		const out = /* @__PURE__ */ new Map();
+		this.held.clear();
+		this.values.clear();
+		this.loaded = false;
+		this.blocked.clear();
+		for (const [deviceId, blob] of blobs) {
+			const stored = blob[this.deps.key];
+			if (stored === void 0) continue;
+			const value = this.deps.decode(stored);
+			if (value === HELD_UNAVAILABLE) {
+				if (!this.released.has(deviceId)) this.blocked.set(deviceId, stored);
+				continue;
+			}
+			if (value === null) {
+				this.deps.logger.warn("broker device state skipped - it does not parse", {
+					tags: { deviceId },
+					meta: { key: this.deps.key }
+				});
+				continue;
+			}
+			out.set(deviceId, value);
+			this.values.set(deviceId, value);
+			this.held.set(deviceId, JSON.stringify(this.deps.encode(value)));
+		}
+		this.loaded = true;
+		return out;
+	}
+	/** Cameras whose stored value exists but could not be read: never written, never replaced. */
+	heldDevices() {
+		return this.blocked;
+	}
+	/**
+	* Stop protecting a camera whose stored value is GONE (the secret was deleted
+	* or the keychain restored without it): there is nothing left to overwrite.
+	*/
+	release(deviceId) {
+		this.blocked.delete(deviceId);
+		this.released.add(deviceId);
+	}
+	/** Is this camera's token write (and restream URL) blocked right now? */
+	isBlocked(deviceId) {
+		return this.blocked.has(deviceId);
+	}
+	assertLoaded() {
+		if (!this.loaded) throw new Error(`broker device state "${this.deps.key}" was never loaded - refusing to write`);
+	}
+	async writeChanged(next) {
+		let written = 0;
+		for (const [deviceId, value] of next) {
+			if (this.blocked.has(deviceId)) continue;
+			const encoded = this.deps.encode(value);
+			const text = JSON.stringify(encoded);
+			if (this.held.get(deviceId) === text) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: encoded });
+			this.held.set(deviceId, text);
+			this.values.set(deviceId, value);
+			written += 1;
+		}
+		return written;
+	}
+	/** Make the store hold exactly `next` for the cameras this mirror knows. */
+	async replace(next) {
+		this.assertLoaded();
+		const written = await this.writeChanged(next);
+		let removed = 0;
+		for (const deviceId of [...this.held.keys()]) {
+			if (next.has(deviceId) || this.blocked.has(deviceId)) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+			this.held.delete(deviceId);
+			this.values.delete(deviceId);
+			removed += 1;
+		}
+		return {
+			written,
+			removed
+		};
+	}
+	/** Add or change; never remove. */
+	async merge(next) {
+		this.assertLoaded();
+		return this.writeChanged(next);
+	}
+	/** Drop one camera's key (a device that changed hardware under its number). */
+	async remove(deviceId) {
+		this.assertLoaded();
+		if (!this.held.has(deviceId) || this.blocked.has(deviceId)) return false;
+		await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+		this.held.delete(deviceId);
+		this.values.delete(deviceId);
+		return true;
+	}
+	/** What the store holds for the camera as of the last load or write. */
+	current(deviceId) {
+		return this.values.get(deviceId);
+	}
+	/** Whether a load has answered; a writer that was never loaded refuses. */
+	get isLoaded() {
+		return this.loaded;
+	}
 };
-function profileMapStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_PROFILE_MAP_SPEC,
-		store,
-		logger
+function parseWith(schema) {
+	return (stored) => {
+		const parsed = schema.safeParse(stored);
+		return parsed.success ? parsed.data : null;
+	};
+}
+function probeSnapshotsMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: PROBE_SNAPSHOTS_KEY,
+		logger,
+		decode: parseWith(ProbeSnapshotsOfDeviceSchema),
+		encode: (value) => value
+	});
+}
+function profileMapMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: BROKER_PROFILE_KEY,
+		logger,
+		decode: parseWith(ProfileAssignmentSchema),
+		encode: (value) => value
+	});
+}
+/** The tokens of one camera are ONE keychain-held text: JSON of `{ camStreamId: token }`. */
+function rtspTokensMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: RTSP_TOKENS_KEY,
+		logger,
+		decode: (stored) => {
+			if (isSecretMarker(stored)) return HELD_UNAVAILABLE;
+			if (typeof stored !== "string") return null;
+			try {
+				const parsed = RtspTokensOfDeviceSchema.safeParse(JSON.parse(stored));
+				return parsed.success ? parsed.data : null;
+			} catch {
+				return null;
+			}
+		},
+		encode: (value) => JSON.stringify(value)
 	});
 }
 /**
-* The dead `addon-settings` / `root` keys. A CLAIM that each key is dead,
-* enforced by nothing else — the migration script names the same three, keep
-* the two in lockstep.
+* Fold freshly minted tokens (`<deviceId>/<camStreamId>` -> token) into what
+* each camera already holds. Only ever adds or changes: a token is stable
+* forever per stream unless explicitly regenerated.
 */
-var STREAM_BROKER_RETIRED_ROOT_KEYS = [
-	{
-		key: "probeSnapshots",
-		successor: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob it was 17 KB of the 33 KB root row, rewritten whole by the throttled metrics flush"
-	},
-	{
-		key: "rtspTokens",
-		successor: BROKER_RTSP_TOKENS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob a single minted token rewrote 33 KB"
-	},
-	{
-		key: "profileMap",
-		successor: BROKER_PROFILE_MAP_COLLECTION,
-		reason: "one row per camera since the flatten; a per-DEVICE map, so as a blob it grew with the fleet — 2.3 KB at 29 cameras, ~77 KB at 974"
-	}
-];
+function mergeRtspTokens(mirror, minted) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of groupByDevice(minted)) out.set(deviceId, {
+		...mirror.current(deviceId),
+		...group
+	});
+	return out;
+}
 //#endregion
 //#region src/stream-broker/live-viewers.ts
 /**
@@ -809,6 +854,131 @@ function healthEventIsOperatorFacing(camStreamId) {
 	return !PRIVATE_STREAM_PREFIXES.some((prefix) => camStreamId.startsWith(prefix));
 }
 //#endregion
+//#region src/stream-broker/stream-broker/stream-health-policy.ts
+/**
+* WHAT a stale stream means for a battery camera (D883).
+*
+* A mains camera whose stream goes quiet for the stale window has lost its
+* stream: that is an outage. A battery camera whose stream goes quiet has,
+* ordinarily, gone to sleep — the designed steady state, not a fault. The
+* broker used to tell the two apart by nothing, so every sleep produced a
+* `stream.offline` per profile and every wake a `stream.online`, and the
+* operator's system-event rule pushed each one.
+*
+* The verdict is made HERE, at the emitter, from the battery's own sleep
+* mirror — never by a filter downstream:
+*
+*  - asleep and nobody asked for the stream — NOT an outage (`asleep`);
+*  - asleep, a stream was DEMANDED and none arrived — `wake-timeout`;
+*  - reported awake and the stream is gone — `connection-error`;
+*  - silent past the battery refresh window — `battery-unreachable`.
+*
+* A sleep verdict needs a sleep state that was actually READ. A mirror that
+* was never fed (a restart, a dropped event) is not "asleep": the caller passes
+* `battery: null` and the stream is judged exactly as a mains one (D49 —
+* unknown excludes nothing, and a silent suppression on an unread mirror hid
+* a camera that slept and then died).
+*/
+var OUTAGE_REASONS = [
+	"stale-timeout",
+	"wake-timeout",
+	"connection-error",
+	"battery-unreachable"
+];
+/**
+* How long a demand may wait for a sleeping camera's stream before it counts
+* as a failed wake: the firmware wake bound plus the broker settle window of
+* wake-on-play (8 s + 20 s), with margin for the sweep cadence.
+*/
+var WAKE_DEMAND_BOUND_MS = 45e3;
+function isStreamOutageReason(reason) {
+	return reason !== void 0 && OUTAGE_REASONS.includes(reason);
+}
+function judgeStaleStream(input) {
+	if (input.battery === null) return {
+		kind: "outage",
+		reason: "stale-timeout"
+	};
+	const presence = deriveBatteryPresence({
+		status: input.battery.facts,
+		nowMs: input.nowMs
+	});
+	if (presence === "unreachable") return {
+		kind: "outage",
+		reason: "battery-unreachable"
+	};
+	if (presence === "awake") return {
+		kind: "outage",
+		reason: "connection-error"
+	};
+	if (input.demanded) return {
+		kind: "outage",
+		reason: "wake-timeout"
+	};
+	return {
+		kind: "suppressed",
+		presence
+	};
+}
+//#endregion
+//#region src/stream-broker/stream-broker/device-stream-outages.ts
+var DeviceStreamOutages = class {
+	byDevice = /* @__PURE__ */ new Map();
+	get(deviceId) {
+		return this.byDevice.get(deviceId);
+	}
+	/** Open the device's outage, or add this stream to the one already open. */
+	open(deviceId, camStreamId, reason, now) {
+		const existing = this.byDevice.get(deviceId);
+		if (existing) {
+			existing.camStreamIds.add(camStreamId);
+			existing.wakeOnly = false;
+			existing.lastSignalAt = now;
+			return existing;
+		}
+		const created = {
+			reason,
+			since: now,
+			camStreamIds: new Set([camStreamId]),
+			announced: false,
+			wakeOnly: false,
+			lastSignalAt: now
+		};
+		this.byDevice.set(deviceId, created);
+		return created;
+	}
+	/**
+	* A failed wake with no broker to carry it. Joins the device's open outage
+	* (one outage per device) or opens a wake-only one over its REAL streams.
+	*/
+	openWake(deviceId, camStreamIds, reason, now) {
+		const existing = this.byDevice.get(deviceId);
+		if (existing) {
+			existing.lastSignalAt = now;
+			return existing;
+		}
+		const created = {
+			reason,
+			since: now,
+			camStreamIds: new Set(camStreamIds),
+			announced: false,
+			wakeOnly: true,
+			lastSignalAt: now
+		};
+		this.byDevice.set(deviceId, created);
+		return created;
+	}
+	entries() {
+		return this.byDevice.entries();
+	}
+	close(deviceId) {
+		this.byDevice.delete(deviceId);
+	}
+	clear() {
+		this.byDevice.clear();
+	}
+};
+//#endregion
 //#region src/stream-broker/stream-broker/sentry-eligibility.ts
 function sentryEligible(input) {
 	if (input.batteryOperated === null || input.declaresSignals === null) return {
@@ -5528,6 +5698,18 @@ var RtspListenServer = class RtspListenServer {
 	brokerTokens = /* @__PURE__ */ new Map();
 	/** token → brokerId (reverse map) */
 	tokenBrokers = /* @__PURE__ */ new Map();
+	/**
+	* brokerId → INTERNAL loopback-only alias token (D870). A camera whose
+	* external restream token is held in an unreadable keychain has NO external
+	* URL, but the broker's own consumers (recording, decode, snapshots, grid,
+	* egress) still ride its restream: they get this ephemeral token, which is
+	* never persisted, never handed out through the consumer URL APIs, and only
+	* answers loopback / local-network peers.
+	*/
+	internalAliases = /* @__PURE__ */ new Map();
+	internalAliasTokens = /* @__PURE__ */ new Set();
+	/** Which peers may dial an internal alias; replaceable for tests. */
+	aliasPeerPolicy = isClusterLocalAddress;
 	/** brokerId → enabled (default true) */
 	brokerEnabled = /* @__PURE__ */ new Map();
 	/** brokerId → warm-up closure registered alongside the restreamer */
@@ -5558,7 +5740,37 @@ var RtspListenServer = class RtspListenServer {
 		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
 		return token;
 	}
+	/**
+	* Register (or refresh) the internal loopback-only alias of a broker. Returns
+	* its token. The external token map is untouched, so the alias can never be
+	* listed, persisted or surfaced as a consumer URL.
+	*/
+	registerInternalAlias(brokerId, restreamer, warmUp, sentryOpener) {
+		const token = this.internalAliases.get(brokerId) ?? RtspListenServer.generateToken();
+		this.restreamers.set(token, restreamer);
+		this.tokenBrokers.set(token, brokerId);
+		this.internalAliases.set(brokerId, token);
+		this.internalAliasTokens.add(token);
+		if (warmUp) this.brokerWarmUps.set(brokerId, warmUp);
+		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
+		return token;
+	}
+	/** Replace the peer policy of the internal aliases (tests only). */
+	setAliasPeerPolicy(policy) {
+		this.aliasPeerPolicy = policy;
+	}
+	/** The token an IN-PROCESS consumer dials: the internal alias when there is one, else the external token. */
+	getInternalToken(brokerId) {
+		return this.internalAliases.get(brokerId) ?? this.brokerTokens.get(brokerId);
+	}
 	unregisterRestreamer(brokerId) {
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			this.internalAliases.delete(brokerId);
+		}
 		const token = this.brokerTokens.get(brokerId);
 		if (token) {
 			this.restreamers.delete(token);
@@ -5580,6 +5792,17 @@ var RtspListenServer = class RtspListenServer {
 		this.restreamers.set(newToken, restreamer);
 		this.brokerTokens.set(brokerId, newToken);
 		this.tokenBrokers.set(newToken, brokerId);
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			const newAlias = RtspListenServer.generateToken();
+			this.restreamers.set(newAlias, restreamer);
+			this.tokenBrokers.set(newAlias, brokerId);
+			this.internalAliases.set(brokerId, newAlias);
+			this.internalAliasTokens.add(newAlias);
+		}
 		return newToken;
 	}
 	/** Get the current token for a broker. */
@@ -5663,6 +5886,11 @@ var RtspListenServer = class RtspListenServer {
 			socket.destroy();
 			return;
 		}
+		if (this.internalAliasTokens.has(lookupPath) && !this.aliasPeerPolicy(socket.remoteAddress)) {
+			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
+			socket.destroy();
+			return;
+		}
 		const brokerId = this.tokenBrokers.get(lookupPath);
 		if (brokerId && !this.isEnabled(brokerId)) {
 			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
@@ -5721,6 +5949,24 @@ var RtspListenServer = class RtspListenServer {
 		});
 	}
 };
+/**
+* Is the peer on the loopback interface or the local network (RFC 1918, link-local,
+* ULA)? The internal alias answers only these: a recorder or decoder on another
+* node of the cluster is a legitimate consumer, the public internet is not.
+*/
+function isClusterLocalAddress(address) {
+	if (address === void 0) return false;
+	const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+	if (v4 === "::1") return true;
+	const m = /^(\d+)\.(\d+)\.\d+\.\d+$/.exec(v4);
+	if (m !== null) {
+		const a = Number(m[1]);
+		const b = Number(m[2]);
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+	}
+	const lower = address.toLowerCase();
+	return lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd");
+}
 //#endregion
 //#region src/stream-broker/rtsp/rtsp-restream-provider.ts
 /**
@@ -5802,6 +6048,24 @@ var RtspRestreamProviderImpl = class {
 			enabled: this.server.isEnabled(brokerId)
 		};
 	}
+	/**
+	* The entry an IN-PROCESS consumer dials (recording, decode, snapshots, grid,
+	* egress): the loopback-only internal alias when the camera's external token
+	* is held back (D870), else the external entry. NEVER hand this out through a
+	* consumer URL API - use {@link getEntry} for that.
+	*/
+	getInternalEntry(brokerId, hostname) {
+		const token = this.server.getInternalToken(brokerId);
+		if (!token) return null;
+		const port = this.server.getPort();
+		const host = hostname ?? "127.0.0.1";
+		return {
+			brokerId,
+			url: `rtsp://${host}:${port}/${token}`,
+			mutedUrl: `rtsp://${host}:${port}/${token}/muted`,
+			enabled: this.server.isEnabled(brokerId)
+		};
+	}
 	regenerateToken(brokerId) {
 		const token = this.server.regenerateToken(brokerId);
 		if (token) {
@@ -14412,6 +14676,15 @@ var StreamBroker = class StreamBroker {
 		return false;
 	}
 	/**
+	* Does a consumer want this stream right now (a viewer, a recording, a
+	* detection decode, a camera-reported wake hold)? Sentry sessions and idle
+	* prestream do not count. The stream-health sweep reads it to tell a battery
+	* camera that slept unasked from one that failed to wake for somebody (D883).
+	*/
+	hasLiveDemand() {
+		return this.hasLiveIntent();
+	}
+	/**
 	* True when at least one consumer needs DECODED audio. The audio-specific
 	* subset of {@link hasDemand} — deliberately excludes video-only
 	* consumers so a video-only viewer never spins up the AAC/Opus decode
@@ -17311,6 +17584,10 @@ function resolveBrokerTier(brokerId, localLookup, remoteBrokerTiers) {
 */
 var STREAM_STALE_TIMEOUT_MS = 12e4;
 var STREAM_HEALTH_POLL_MS = 15e3;
+/** How often an unanswered / stale battery probe is asked again. */
+var BATTERY_PROBE_RETRY_MS = 6e4;
+/** A wake-only outage with no further failed wake for this long is over: the demand is gone. */
+var WAKE_ONLY_OUTAGE_TTL_MS = 5 * 6e4;
 /** Compose a SOURCE broker id from a `(deviceId, camStreamId)` tuple. Thin
 *  wrapper over the canonical `makeSourceBrokerId` — single source of truth. */
 function brokerIdFor(deviceId, camStreamId) {
@@ -17503,6 +17780,25 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* guess which one it was looking at.
 	*/
 	streamOfflineReasonByBroker = /* @__PURE__ */ new Map();
+	/**
+	* Brokers whose stream went quiet because their BATTERY camera is asleep.
+	* Not an outage and never announced (D883); remembered so the wake that ends
+	* it is recognised as a plain wake instead of a `recovered`.
+	*/
+	sleepSuppressedBrokers = /* @__PURE__ */ new Set();
+	/**
+	* What the sweep knows of a device's battery: is it one, and what did its
+	* `battery` slice last say. Fed by `BatteryOnStatusChanged` (droppable, empty
+	* after a restart) AND read from the device registry / slice by the sweep
+	* itself — the same two reads wake-on-play makes — so a restart or a lost
+	* event never leaves the verdict standing on an unread mirror (D49).
+	*/
+	batteryProbe = /* @__PURE__ */ new Map();
+	batteryProbeInFlight = /* @__PURE__ */ new Set();
+	/** When a consumer's demand on a quiet battery stream was first seen (the wake bound starts there). */
+	demandSince = /* @__PURE__ */ new Map();
+	/** The stream outage a DEVICE is in (one entry per device, however many profiles). */
+	deviceOutages = new DeviceStreamOutages();
 	streamHealthTimer;
 	/**
 	* Routes an audio-chunk `subscriptionId` (Phase 5 / D9) back to its owning
@@ -17535,6 +17831,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 	rtspProvider;
 	persistedTokens = /* @__PURE__ */ new Map();
 	/**
+	* True for a camera whose restream tokens are held in an unreadable keychain
+	* (D870). Such a camera gets NO restream URL - minting a temporary token would
+	* hand consumers a URL that dies as soon as the real one is restored - while
+	* every other camera, and the camera's own streams and recording, are
+	* untouched.
+	*/
+	restreamGate = () => false;
+	/**
 	* Last runtime probe per broker, captured while the broker was streaming.
 	* Survives the stream going idle so the per-stream "Probed" settings field
 	* stays populated (with an "as of" tag). In-memory only — repopulates on the
@@ -17734,7 +18038,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			hwaccel: this.hwaccel ?? void 0,
 			cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 			rtspEntryLookup: (brokerId) => {
-				const entry = this.rtspProvider.getEntry(brokerId);
+				const entry = this.rtspProvider.getInternalEntry(brokerId);
 				return entry ? {
 					url: entry.url,
 					mutedUrl: entry.mutedUrl
@@ -17793,7 +18097,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 				cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 				resolveProfileSource: (deviceId, profile) => this.assignments.get(deviceId)?.map[profile] ?? null,
 				rtspEntryLookup: (brokerId) => {
-					const entry = this.rtspProvider.getEntry(brokerId);
+					const entry = this.rtspProvider.getInternalEntry(brokerId);
 					return entry ? { url: entry.url } : null;
 				},
 				sourceHasMedia: (brokerId) => {
@@ -18435,6 +18739,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			const deviceId = typeof data.deviceId === "number" ? data.deviceId : null;
 			if (deviceId === null) return;
 			const sleeping = data.status?.sleeping === true;
+			this.recordBatterySleep(deviceId, data.status);
 			this.applyPlaceholderReasonToDevice(deviceId, sleeping ? "sleeping" : "reconnecting");
 		});
 		bus.subscribe({ category: EventCategory.BatteryOnWakeStarted }, (event) => {
@@ -18598,18 +18903,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		await this.batteryWakeOnPlay.run(deviceId, {
 			logger: this.logger,
 			isBatteryDevice: (id) => this.isBatteryOperated(id),
-			readBatteryFacts: async (id) => {
-				const slice = await api.deviceState.getCapSlice.query({
-					deviceId: id,
-					capName: batteryCapability.name
-				}).catch(() => null);
-				const parsed = BatteryStatusSchema.safeParse(slice);
-				if (!parsed.success) return null;
-				return {
-					sleeping: parsed.data.sleeping,
-					lastContactAt: parsed.data.lastContactAt
-				};
-			},
+			readBatteryFacts: (id) => this.readBatterySleepFacts(id),
 			wakeForStream: async (id, timeoutMs) => api.battery.wakeForStream.mutate({
 				deviceId: id,
 				timeoutMs
@@ -18617,6 +18911,9 @@ var StreamBrokerManager = class StreamBrokerManager {
 			reconcileCatalog: (id) => this.reconcileDeviceCatalog(id),
 			ensureBroker: () => this.ensureBrokerForWebrtcSession(deviceId, brokerId, camStreamId),
 			hasBroker: demandHasBroker
+		}).catch((err) => {
+			if (err instanceof BatteryStreamUnavailableError) this.announceBatteryWakeFailure(deviceId, camStreamId, err.presence === "unreachable" ? "battery-unreachable" : "wake-timeout");
+			throw err;
 		});
 	}
 	/** Any broker (local or remote-adapter) registered for this device? The
@@ -18857,6 +19154,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 	loadPersistedTokens(tokens) {
 		this.persistedTokens = new Map(tokens);
 	}
+	/** See {@link restreamGate}. */
+	setRestreamGate(gate) {
+		this.restreamGate = gate;
+	}
+	/**
+	* Register the restream URLs of ONE camera now (its tokens became readable, or
+	* were issued fresh): each of its source brokers and the profile restreamers
+	* over them. No broker is torn down or recreated, so nothing stops recording.
+	*/
+	registerRestreamersForDevice(deviceId) {
+		if (this.restreamGate(deviceId)) return;
+		for (const [brokerId, broker] of this.brokers) if (brokerId.startsWith(`${deviceId}/`)) this.registerSourceRestreamer(brokerId, broker);
+		this.syncProfileRestreamers(deviceId);
+	}
 	/** Upsert a single SOURCE (non-derived) cam-stream into the registry
 	*  WITHOUT ranking or broker creation. Returns the prior entry (if any)
 	*  so callers can detect url refresh / already-existed. */
@@ -19600,6 +19911,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 		return { success: true };
 	}
 	/**
+	* Drop a DELETED camera's whole override entry and persist (D870). The
+	* device-removal hook's one reach into the override map; `forgetDeviceHardware`
+	* keeps the entry's non-hardware fields, a deleted camera keeps nothing.
+	*/
+	dropDeviceOverride(deviceId) {
+		if (!this.deviceOverrides.delete(deviceId)) return false;
+		this.deviceOverridePersister?.(this.deviceOverrides);
+		return true;
+	}
+	/** Cameras that have an override entry. */
+	listDeviceOverrideIds() {
+		return [...this.deviceOverrides.keys()];
+	}
+	/**
 	* The hardware behind `deviceId` was replaced (`deviceManager.migrateDevice`)
 	* — forget everything this broker knows that described the OLD box. See the
 	* cap doc for the inventory. What deliberately SURVIVES is the role-scoped
@@ -20212,6 +20537,10 @@ var StreamBrokerManager = class StreamBrokerManager {
 		this.brokers.clear();
 		this.streamHealthByBroker.clear();
 		this.streamOfflineReasonByBroker.clear();
+		this.sleepSuppressedBrokers.clear();
+		this.batteryProbe.clear();
+		this.demandSince.clear();
+		this.deviceOutages.clear();
 		this.audioSubscriptionBroker.clear();
 		await this.rtspServer.stop();
 	}
@@ -20234,6 +20563,8 @@ var StreamBrokerManager = class StreamBrokerManager {
 	evaluateStreamHealth() {
 		if (!this.eventBus) return;
 		const now = Date.now();
+		const outageOpenedOn = /* @__PURE__ */ new Map();
+		const cameBackOn = /* @__PURE__ */ new Map();
 		for (const [brokerId, broker] of this.brokers) {
 			const parsed = this.parseBrokerId(brokerId);
 			if (!parsed) continue;
@@ -20243,30 +20574,386 @@ var StreamBrokerManager = class StreamBrokerManager {
 			const wasHealthy = this.streamHealthByBroker.get(brokerId);
 			const isHealthy = lastPacketAt > 0 && now - lastPacketAt <= STREAM_STALE_TIMEOUT_MS;
 			if (!isHealthy && broker.getStats().status === "streaming") broker.redial("stream-health sweep: phantom streaming, no packets within stale window");
-			if (wasHealthy === isHealthy) continue;
+			const context = {
+				deviceId,
+				camStreamId,
+				brokerId,
+				sourceType: broker.getActiveSourceType(),
+				lastPacketAt
+			};
+			if (wasHealthy === isHealthy) {
+				if (!isHealthy) this.rejudgeQuietBroker(brokerId, broker, context, now, outageOpenedOn);
+				continue;
+			}
 			if (wasHealthy === void 0 && !isHealthy && !broker.suspended) {
 				this.streamHealthByBroker.set(brokerId, false);
 				continue;
 			}
+			let verdict = null;
+			if (!isHealthy && !broker.suspended) {
+				verdict = this.judgeQuietStream(brokerId, deviceId, broker, now);
+				if (verdict === "defer") continue;
+			}
 			this.streamHealthByBroker.set(brokerId, isHealthy);
-			const reason = isHealthy ? wasHealthy === void 0 || !this.streamOfflineReasonByBroker.has(brokerId) ? "first-packet" : this.streamOfflineReasonByBroker.get(brokerId) === "suspended" ? "resumed" : "recovered" : broker.suspended ? "suspended" : "stale-timeout";
-			if (isHealthy) this.streamOfflineReasonByBroker.delete(brokerId);
-			else this.streamOfflineReasonByBroker.set(brokerId, reason);
-			this.emitStreamHealth(isHealthy, {
+			const wasSleepSuppressed = this.sleepSuppressedBrokers.delete(brokerId);
+			const previousReason = this.streamOfflineReasonByBroker.get(brokerId);
+			if (verdict !== null) {
+				if (verdict.kind === "suppressed") {
+					this.markSleepSuppressed(brokerId, context, verdict.presence, lastPacketAt);
+					continue;
+				}
+				this.openStreamOutage(brokerId, context, verdict.reason, now, outageOpenedOn);
+				continue;
+			}
+			if (!isHealthy) {
+				this.demandSince.delete(brokerId);
+				this.streamOfflineReasonByBroker.set(brokerId, "suspended");
+				this.emitStreamHealth(false, {
+					...context,
+					reason: "suspended"
+				});
+				continue;
+			}
+			this.streamOfflineReasonByBroker.delete(brokerId);
+			this.demandSince.delete(brokerId);
+			if (wasSleepSuppressed) this.logger.info("battery camera woke and delivers a stream — plain wake, no event", {
+				tags: { deviceId },
+				meta: { camStreamId }
+			});
+			if (this.deviceOutages.get(deviceId) !== void 0) {
+				if (!cameBackOn.has(deviceId)) cameBackOn.set(deviceId, context);
+				continue;
+			}
+			if (wasSleepSuppressed) {
+				this.writeCameraStreamsSlice(deviceId, this.snapshotProfileSlots(deviceId));
+				continue;
+			}
+			const reason = isStreamOutageReason(previousReason) ? "recovered" : previousReason === "suspended" ? "resumed" : "first-packet";
+			this.emitStreamHealth(true, {
+				...context,
+				reason
+			});
+		}
+		for (const [deviceId, context] of outageOpenedOn) this.announceDeviceOutage(deviceId, context);
+		for (const [deviceId, context] of cameBackOn) this.settleDeviceOutage(deviceId, context);
+		this.expireWakeOnlyOutages(now);
+	}
+	/** Record one stream as part of its device's outage (announced after the pass). */
+	openStreamOutage(brokerId, context, reason, now, outageOpenedOn) {
+		this.sleepSuppressedBrokers.delete(brokerId);
+		this.streamOfflineReasonByBroker.set(brokerId, reason);
+		this.deviceOutages.open(context.deviceId, context.camStreamId, reason, now);
+		if (!outageOpenedOn.has(context.deviceId)) outageOpenedOn.set(context.deviceId, context);
+	}
+	markSleepSuppressed(brokerId, context, presence, lastPacketAt) {
+		this.sleepSuppressedBrokers.add(brokerId);
+		this.streamOfflineReasonByBroker.delete(brokerId);
+		this.logger.info("stream quiet on a sleeping battery camera — not an outage", {
+			tags: { deviceId: context.deviceId },
+			meta: {
+				camStreamId: context.camStreamId,
+				presence,
+				lastPacketAt
+			}
+		});
+		this.writeCameraStreamsSlice(context.deviceId, this.snapshotProfileSlots(context.deviceId));
+	}
+	/**
+	* The verdict on a quiet, non-idle stream. `'defer'` = the device's battery
+	* class is still being asked of the registry; the edge is kept and judged
+	* again. A class that could not be answered, or a slice never read, judges as
+	* a mains camera — never as a sleeper (D49).
+	*/
+	judgeQuietStream(brokerId, deviceId, broker, now) {
+		const probe = this.ensureBatteryProbe(deviceId, now);
+		if (probe.state === "pending") return "defer";
+		return judgeStaleStream({
+			battery: probe.isBattery === true && probe.facts !== null ? { facts: probe.facts } : null,
+			demanded: this.demandHeldPastBound(brokerId, broker, now),
+			nowMs: now
+		});
+	}
+	demandHeldPastBound(brokerId, broker, now) {
+		if (!broker.hasLiveDemand()) {
+			this.demandSince.delete(brokerId);
+			return false;
+		}
+		const since = this.demandSince.get(brokerId) ?? now;
+		this.demandSince.set(brokerId, since);
+		return now - since >= WAKE_DEMAND_BOUND_MS;
+	}
+	/**
+	* A broker that stays quiet, pass after pass. Three things can be true of it:
+	* it was suppressed as a sleeper (the camera may have died, or a wake may
+	* have been demanded since); it went idle while holding an outage open; or it
+	* resumed from an idle suspend on a battery camera that never answered.
+	*/
+	rejudgeQuietBroker(brokerId, broker, context, now, outageOpenedOn) {
+		const { deviceId } = context;
+		const reason = this.streamOfflineReasonByBroker.get(brokerId);
+		if (isStreamOutageReason(reason) && broker.suspended) {
+			this.dropSuspendedOutage(brokerId, context);
+			return;
+		}
+		const suppressed = this.sleepSuppressedBrokers.has(brokerId);
+		const resumedQuiet = reason === "suspended" && !broker.suspended;
+		if (!suppressed && !resumedQuiet) return;
+		if (broker.suspended) {
+			this.demandSince.delete(brokerId);
+			return;
+		}
+		this.refreshBatteryFactsIfDue(deviceId, now);
+		const probe = this.batteryProbe.get(deviceId);
+		if (probe?.state !== "done" || probe.isBattery !== true || probe.facts === null) return;
+		const verdict = judgeStaleStream({
+			battery: { facts: probe.facts },
+			demanded: this.demandHeldPastBound(brokerId, broker, now),
+			nowMs: now
+		});
+		if (verdict.kind === "suppressed") return;
+		this.logger.warn("quiet battery stream is now an outage", {
+			tags: { deviceId },
+			meta: {
+				camStreamId: context.camStreamId,
+				reason: verdict.reason
+			}
+		});
+		this.openStreamOutage(brokerId, context, verdict.reason, now, outageOpenedOn);
+	}
+	/**
+	* An outage stream whose last consumer left (the broker went idle). Nobody is
+	* waiting for it any more, so the outage ends there — closed cleanly, with
+	* the one online that lets every consumer clear its row (reason `suspended`,
+	* which the notification gate discards).
+	*/
+	dropSuspendedOutage(brokerId, context) {
+		const { deviceId, camStreamId } = context;
+		this.demandSince.delete(brokerId);
+		this.streamOfflineReasonByBroker.set(brokerId, "suspended");
+		const outage = this.deviceOutages.get(deviceId);
+		this.logger.info("stream outage dropped — the broker went idle, nobody is waiting", {
+			tags: { deviceId },
+			meta: { camStreamId }
+		});
+		if (!outage) return;
+		outage.camStreamIds.delete(camStreamId);
+		if (outage.camStreamIds.size > 0 || outage.wakeOnly) return;
+		this.closeDeviceOutage(deviceId, outage, "suspended", context);
+	}
+	/** Close a device outage and, when it was announced, say so once (any online closes the rows). */
+	closeDeviceOutage(deviceId, outage, reason, context) {
+		this.deviceOutages.close(deviceId);
+		if (!outage.announced) return;
+		this.emitDeviceStreamHealth(true, deviceId, reason, /* @__PURE__ */ new Set(), context);
+	}
+	/** Wake-only outages end when the failed wakes stop (demand released). */
+	expireWakeOnlyOutages(now) {
+		for (const [deviceId, outage] of [...this.deviceOutages.entries()]) {
+			if (!outage.wakeOnly || now - outage.lastSignalAt < WAKE_ONLY_OUTAGE_TTL_MS) continue;
+			this.logger.info("wake failure outage ended — no further demand", {
+				tags: { deviceId },
+				meta: { reason: outage.reason }
+			});
+			this.closeDeviceOutage(deviceId, outage, "suspended", {
 				deviceId,
+				brokerId: String(deviceId),
+				sourceType: "battery-wake",
+				lastPacketAt: 0
+			});
+		}
+	}
+	/** The device's battery probe; starts the read when there is none (or a retry is due). */
+	ensureBatteryProbe(deviceId, now) {
+		const existing = this.batteryProbe.get(deviceId);
+		if (existing === void 0) {
+			if (!this.api) {
+				const none = {
+					state: "done",
+					isBattery: null,
+					facts: null,
+					readAt: now
+				};
+				this.batteryProbe.set(deviceId, none);
+				return none;
+			}
+			const pending = {
+				state: "pending",
+				isBattery: null,
+				facts: null,
+				readAt: now
+			};
+			this.batteryProbe.set(deviceId, pending);
+			this.probeBattery(deviceId);
+			return pending;
+		}
+		if (existing.state === "done" && existing.isBattery === null && this.api && now - existing.readAt >= BATTERY_PROBE_RETRY_MS && !this.batteryProbeInFlight.has(deviceId)) this.probeBattery(deviceId);
+		return existing;
+	}
+	async probeBattery(deviceId) {
+		this.batteryProbeInFlight.add(deviceId);
+		try {
+			const isBattery = await this.isBatteryOperated(deviceId);
+			const facts = isBattery === true ? await this.readBatterySleepFacts(deviceId) : null;
+			const current = this.batteryProbe.get(deviceId);
+			this.batteryProbe.set(deviceId, {
+				state: "done",
+				isBattery: current?.isBattery === true ? true : isBattery,
+				facts: current?.facts ?? facts,
+				readAt: Date.now()
+			});
+		} finally {
+			this.batteryProbeInFlight.delete(deviceId);
+		}
+	}
+	refreshBatteryFactsIfDue(deviceId, now) {
+		const probe = this.batteryProbe.get(deviceId);
+		if (probe?.state !== "done" || probe.isBattery !== true) return;
+		if (now - probe.readAt < BATTERY_PROBE_RETRY_MS || this.batteryProbeInFlight.has(deviceId)) return;
+		this.batteryProbeInFlight.add(deviceId);
+		this.readBatterySleepFacts(deviceId).then((facts) => {
+			const current = this.batteryProbe.get(deviceId);
+			this.batteryProbe.set(deviceId, {
+				state: "done",
+				isBattery: true,
+				facts: facts ?? current?.facts ?? null,
+				readAt: Date.now()
+			});
+		}).finally(() => this.batteryProbeInFlight.delete(deviceId));
+	}
+	/** The device's `battery` slice as sleep facts, or `null` when it cannot be read. */
+	async readBatterySleepFacts(deviceId) {
+		const api = this.api;
+		if (!api) return null;
+		const slice = await api.deviceState.getCapSlice.query({
+			deviceId,
+			capName: batteryCapability.name
+		}).catch(() => null);
+		const parsed = BatteryStatusSchema.safeParse(slice);
+		if (!parsed.success) return null;
+		return {
+			sleeping: parsed.data.sleeping,
+			lastContactAt: parsed.data.lastContactAt
+		};
+	}
+	recordBatterySleep(deviceId, status) {
+		const previous = this.batteryProbe.get(deviceId);
+		const facts = status && typeof status.sleeping === "boolean" ? {
+			sleeping: status.sleeping,
+			...typeof status.lastContactAt === "number" ? { lastContactAt: status.lastContactAt } : {}
+		} : null;
+		this.batteryProbe.set(deviceId, {
+			state: "done",
+			isBattery: true,
+			facts: facts ?? previous?.facts ?? null,
+			readAt: Date.now()
+		});
+	}
+	/**
+	* A released broker can no longer carry an outage. When it was the last
+	* stream holding an ANNOUNCED outage open, the outage is closed with an
+	* online (`broker-destroyed`, which the notification gate discards but every
+	* ledger and alert card clears on) — otherwise the row stays open for ever.
+	*/
+	forgetReleasedStreamOutage(context) {
+		const { deviceId, camStreamId } = context;
+		const outage = this.deviceOutages.get(deviceId);
+		if (!outage || !outage.camStreamIds.delete(camStreamId)) return;
+		if (outage.camStreamIds.size > 0) return;
+		this.logger.info("stream outage closed — its last stream was released", {
+			tags: { deviceId },
+			meta: {
+				reason: outage.reason,
 				camStreamId,
-				profile: findProfileForStream(this.assignments.get(deviceId)?.map ?? {}, camStreamId),
-				brokerId,
-				sourceType: broker.getActiveSourceType(),
-				lastPacketAt,
-				reason
+				announced: outage.announced
+			}
+		});
+		this.closeDeviceOutage(deviceId, outage, "broker-destroyed", context);
+	}
+	/** The ONE `stream.offline` of a device outage, naming every stream it covers. */
+	announceDeviceOutage(deviceId, context) {
+		const outage = this.deviceOutages.get(deviceId);
+		if (!outage) return;
+		if (outage.announced) {
+			this.logger.debug("stream outage joined an already announced one — no second event", {
+				tags: { deviceId },
+				meta: {
+					camStreamIds: [...outage.camStreamIds],
+					reason: outage.reason
+				}
 			});
+			return;
+		}
+		outage.announced = true;
+		this.logger.warn("stream outage", {
+			tags: { deviceId },
+			meta: {
+				reason: outage.reason,
+				camStreamIds: [...outage.camStreamIds]
+			}
+		});
+		this.emitDeviceStreamHealth(false, deviceId, outage.reason, outage.camStreamIds, context);
+	}
+	/**
+	* A broker of a device in outage is delivering again. The device is back when
+	* no stream of it is still down for an outage reason; then, and only then,
+	* the single `stream.online` (`recovered`) goes out.
+	*/
+	settleDeviceOutage(deviceId, context) {
+		const outage = this.deviceOutages.get(deviceId);
+		if (!outage) return;
+		for (const camStreamId of [...outage.camStreamIds]) {
+			const brokerId = brokerIdFor(deviceId, camStreamId);
+			if (!isStreamOutageReason(this.streamOfflineReasonByBroker.get(brokerId))) outage.camStreamIds.delete(camStreamId);
 		}
+		if (outage.camStreamIds.size > 0) return;
+		this.deviceOutages.close(deviceId);
+		if (!outage.announced) return;
+		this.logger.info("stream outage over — device delivers again", {
+			tags: { deviceId },
+			meta: {
+				reason: outage.reason,
+				outageMs: Date.now() - outage.since
+			}
+		});
+		this.emitDeviceStreamHealth(true, deviceId, "recovered", new Set(context.camStreamId !== void 0 ? [context.camStreamId] : []), context);
+	}
+	/**
+	* A wake somebody ASKED for did not produce a stream (the viewer's play
+	* button, found no broker and a wake that settled nothing). This is the one
+	* failure with no broker to carry it, so it opens the device outage itself.
+	*/
+	announceBatteryWakeFailure(deviceId, camStreamId, reason) {
+		if (!this.eventBus) return;
+		const published = [...this.cameraStreams.get(deviceId)?.keys() ?? []];
+		const streamIds = camStreamId !== void 0 && published.includes(camStreamId) ? [camStreamId] : published;
+		this.deviceOutages.openWake(deviceId, streamIds, reason, Date.now());
+		this.announceDeviceOutage(deviceId, {
+			deviceId,
+			...streamIds[0] !== void 0 ? { camStreamId: streamIds[0] } : {},
+			brokerId: streamIds[0] !== void 0 ? brokerIdFor(deviceId, streamIds[0]) : String(deviceId),
+			sourceType: "battery-wake",
+			lastPacketAt: 0
+		});
+	}
+	emitDeviceStreamHealth(online, deviceId, reason, camStreamIds, context) {
+		const ids = [...camStreamIds];
+		const first = ids[0] ?? context.camStreamId;
+		const assignments = this.assignments.get(deviceId)?.map ?? {};
+		this.emitStreamHealth(online, {
+			...context,
+			deviceId,
+			...first !== void 0 ? { camStreamId: first } : {},
+			brokerId: first !== void 0 ? brokerIdFor(deviceId, first) : context.brokerId,
+			profile: first !== void 0 ? findProfileForStream(assignments, first) : null,
+			reason,
+			camStreamIds: ids
+		});
 	}
 	emitStreamHealth(online, payload) {
 		const bus = this.eventBus;
 		if (!bus) return;
 		const category = online ? "stream.online" : "stream.offline";
+		const profile = payload.profile !== void 0 ? payload.profile : payload.camStreamId !== void 0 ? findProfileForStream(this.assignments.get(payload.deviceId)?.map ?? {}, payload.camStreamId) : null;
 		bus.emit({
 			id: `${category}-${payload.brokerId}-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -20275,7 +20962,10 @@ var StreamBrokerManager = class StreamBrokerManager {
 				type: "stream-broker",
 				id: payload.brokerId
 			},
-			data: payload
+			data: {
+				...payload,
+				profile
+			}
 		});
 		this.writeCameraStreamsSlice(payload.deviceId, this.snapshotProfileSlots(payload.deviceId));
 	}
@@ -20378,6 +21068,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			const sourceBrokerId = brokerIdFor(deviceId, camStreamId);
 			const sourceBroker = this.brokers.get(sourceBrokerId);
 			if (!sourceBroker) continue;
+			if (this.restreamGate(deviceId)) continue;
 			const existingToken = this.persistedTokens.get(profileBrokerId);
 			const warmUp = () => sourceBroker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
 			const openPrestreamWindow = () => sourceBroker.openPrestreamWindow();
@@ -22037,11 +22728,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 		this.brokers.set(brokerId, broker);
 		this.applyClipRetention(deviceId);
-		const existingToken = this.persistedTokens.get(brokerId);
-		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
-		const openPrestreamWindow = () => broker.openPrestreamWindow();
-		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
-		if (!existingToken) this.rtspProvider.persistTokens();
+		this.registerSourceRestreamer(brokerId, broker);
 		await this.fanOutRegistration(deviceId, brokerId, cam, broker);
 		this.syncProfileRestreamers(deviceId);
 		if (cam.kind === "derived") {
@@ -22050,6 +22737,28 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 	}
 	/**
+	* Register one source broker's RTSP restreamer with its persisted token (or a
+	* freshly minted one). A camera whose tokens are held in an unreadable keychain
+	* gets no EXTERNAL token, only the internal loopback-only alias.
+	*/
+	registerSourceRestreamer(brokerId, broker) {
+		const deviceId = parseBrokerId(brokerId)?.deviceId;
+		if (deviceId === void 0) return;
+		if (this.restreamGate(deviceId)) {
+			this.logger.warn("external restream URL withheld - the tokens are held but unreadable", {
+				tags: { deviceId },
+				meta: { brokerId }
+			});
+			this.rtspServer.registerInternalAlias(brokerId, broker.getRtspRestreamer(), () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION), () => broker.openPrestreamWindow());
+			return;
+		}
+		const existingToken = this.persistedTokens.get(brokerId);
+		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
+		const openPrestreamWindow = () => broker.openPrestreamWindow();
+		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
+		if (!existingToken) this.rtspProvider.persistTokens();
+	}
+	/**
 	* Tear down the broker for a `(deviceId, camStreamId)` pair. No-op
 	* when no broker exists. Called by `retractCameraStream` and by the
 	* teardown half of `restartBroker`.
@@ -22072,6 +22781,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 		});
 		this.streamHealthByBroker.delete(brokerId);
 		this.streamOfflineReasonByBroker.delete(brokerId);
+		this.sleepSuppressedBrokers.delete(brokerId);
+		this.forgetReleasedStreamOutage({
+			deviceId,
+			camStreamId,
+			brokerId,
+			sourceType: broker.getActiveSourceType(),
+			lastPacketAt: broker.getLastPacketAt()
+		});
 		await broker.stop();
 		this.brokers.delete(brokerId);
 		this.sentryFrames.delete(brokerId);
@@ -22169,7 +22886,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			};
 		} else {
 			const sourceBrokerId = brokerIdFor(deviceId, request.camStreamId);
-			const entry = this.rtspProvider.getEntry(sourceBrokerId, "127.0.0.1");
+			const entry = this.rtspProvider.getInternalEntry(sourceBrokerId, "127.0.0.1");
 			if (!entry) throw new Error(`derived source camStream loopback unavailable: ${sourceBrokerId}`);
 			loopbackUrl = entry.url;
 			release = async () => {};
@@ -38304,18 +39021,177 @@ function subscribeDeviceRemoval(subscribe, deps) {
 	});
 }
 //#endregion
+//#region src/stream-broker/device-removal-hook.ts
+/**
+* The stream-broker's `device-removal-hook` (D870).
+*
+* What the broker keeps PER CAMERA is a key of the camera's own settings
+* (`probeSnapshots`, `brokerProfile`, `rtspTokens` - see `broker-device-state.ts`),
+* and the central device delete (D865) clears those for every addon. What is
+* left is the broker's live state and its one addon-level map keyed by camera,
+* `deviceOverrides`: the hook retracts the camera's streams, purges its slot
+* assignments and drops its override entry. Idempotent - a camera with nothing
+* left answers zero counts.
+*/
+function createBrokerRemovalHook(deps) {
+	return {
+		onDeviceRemoved: async (input) => {
+			const { deviceId } = input;
+			try {
+				await deps.retractDevice(deviceId);
+			} catch (err) {
+				deps.logger.warn("stream-broker: retract of a deleted device failed", {
+					tags: { deviceId },
+					meta: { error: errMsg(err) }
+				});
+				throw err;
+			}
+			const overrides = deps.dropDeviceOverride(deviceId) ? 1 : 0;
+			if (overrides > 0) deps.logger.info("stream-broker: removed the override of a deleted device", {
+				tags: { deviceId },
+				meta: { deletedAt: input.deletedAt }
+			});
+			return { counts: { "device-overrides": overrides } };
+		},
+		listDeviceData: async () => deps.overrideDeviceIds().filter((deviceId) => Number.isInteger(deviceId) && deviceId > 0).map((deviceId) => ({
+			store: "device-overrides",
+			deviceId,
+			count: 1
+		}))
+	};
+}
+/** Classify every held camera against the keychain: wait for it, or give up on the value. */
+async function classifyHeld(held, secrets) {
+	const refs = /* @__PURE__ */ new Map();
+	for (const [deviceId, stored] of held) if (isSecretMarker(stored)) refs.set(deviceId, stored.$secret);
+	if (refs.size === 0) return [];
+	const resolved = await secrets.resolve([...refs.values()]);
+	const out = [];
+	for (const [deviceId, ref] of refs) {
+		const entry = resolved[ref];
+		if (entry === void 0 || entry.kind === "unavailable") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: entry?.kind === "unavailable" ? entry.reason : null
+		});
+		else if (entry.kind === "missing") out.push({
+			deviceId,
+			ref,
+			kind: "missing",
+			reason: null
+		});
+		else if (entry.kind === "forbidden") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: "forbidden"
+		});
+	}
+	return out;
+}
+var UNAVAILABLE_TEXT = "The camera's RTSP restream URLs are unavailable (consumers such as Home Assistant or an NVR get errors) until the keychain is readable. Its streams and recording are not affected.";
+var issuedText = (deviceId) => `New RTSP restream URLs were issued for camera ${deviceId} - update the consumers (NVR, Home Assistant). The previous tokens were lost: the keychain no longer holds them.`;
+var TokenRecovery = class {
+	deps;
+	/** Cameras alerted as unavailable: the alert is cleared when the value resolves. */
+	waiting = /* @__PURE__ */ new Set();
+	/** Consecutive `missing` reads per camera (D49: two before the value is given up). */
+	missingReads = /* @__PURE__ */ new Map();
+	timer = null;
+	running = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Cameras currently blocked. */
+	blocked() {
+		return [...this.deps.mirror.heldDevices().keys()].toSorted((a, b) => a - b);
+	}
+	/** Check now, then on a timer while any camera is still held. */
+	start() {
+		if (this.timer !== null) return;
+		this.tick();
+		this.timer = setInterval(() => void this.tick(), this.deps.recheckMs ?? 3e4);
+		this.timer.unref?.();
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+	}
+	/** One scheduled / change-triggered check; never overlaps itself, never throws. */
+	async tick() {
+		if (this.running) return;
+		this.running = true;
+		try {
+			await this.check();
+		} catch (err) {
+			this.deps.logger.warn("restream-token re-check failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		} finally {
+			this.running = false;
+		}
+		if (this.blocked().length === 0 && this.waiting.size === 0) this.stop();
+	}
+	/** See the module doc. Idempotent. */
+	async check() {
+		const before = new Set(this.deps.mirror.heldDevices().keys());
+		if (before.size === 0 && this.waiting.size === 0) return;
+		const tokens = await this.deps.mirror.load();
+		const now = new Set(this.deps.mirror.heldDevices().keys());
+		const classified = await classifyHeld(this.deps.mirror.heldDevices(), this.deps.secrets);
+		const released = [];
+		for (const camera of classified) {
+			if (camera.kind === "missing") {
+				const reads = (this.missingReads.get(camera.deviceId) ?? 0) + 1;
+				this.missingReads.set(camera.deviceId, reads);
+				if (reads < 2) continue;
+				this.deps.mirror.release(camera.deviceId);
+				this.missingReads.delete(camera.deviceId);
+				if (this.waiting.delete(camera.deviceId)) await this.deps.alerts.clear(camera.deviceId);
+				released.push(camera.deviceId);
+				continue;
+			}
+			this.missingReads.delete(camera.deviceId);
+			if (this.waiting.has(camera.deviceId)) continue;
+			this.waiting.add(camera.deviceId);
+			this.deps.logger.error("restream tokens held but not readable", {
+				tags: { deviceId: camera.deviceId },
+				meta: {
+					reason: camera.reason,
+					ref: camera.ref
+				}
+			});
+			await this.deps.alerts.raise({
+				deviceId: camera.deviceId,
+				kind: "unavailable",
+				message: UNAVAILABLE_TEXT
+			});
+		}
+		const recovered = [...before].filter((id) => !now.has(id) && !released.includes(id));
+		for (const deviceId of recovered) if (this.waiting.delete(deviceId)) await this.deps.alerts.clear(deviceId);
+		if (recovered.length > 0) this.deps.logger.info("restream tokens readable again", { meta: { cameras: recovered.length } });
+		const cameras = [...recovered, ...released];
+		if (cameras.length > 0) await this.deps.onRegister(tokens, cameras);
+		for (const deviceId of released) {
+			this.deps.logger.error("restream tokens lost - new URLs issued", { tags: { deviceId } });
+			await this.deps.alerts.raise({
+				deviceId,
+				kind: "missing",
+				message: issuedText(deviceId)
+			});
+		}
+	}
+};
+//#endregion
 //#region src/stream-broker/addon.ts
 /**
-* Hydrate the persisted RTSP restream state. Tokens come from their own
-* collection (one row per broker); `rtspEnabled` is still a key of the settings
-* row. An unparseable token row is skipped by the store — one dead token, not
-* every token — and an empty set keeps first-boot silence (no loader call, no
-* log).
+* Hydrate the persisted RTSP restream state. Tokens come from the cameras' own
+* settings; `rtspEnabled` is still a key of the settings row. An unreadable
+* token set THROWS (the caller refuses to write tokens afterwards - a
+* replacement minted over a token that was merely unreadable would turn every
+* external NVR URL into a 404), and an empty set keeps first-boot silence.
 */
 async function hydratePersistedRtspState(deps) {
-	const rows = await deps.tokensStore.readAll();
-	const tokens = /* @__PURE__ */ new Map();
-	for (const [brokerId, row] of rows) tokens.set(brokerId, row.token);
+	const tokens = flattenByDevice(await deps.tokensMirror.load());
 	if (tokens.size > 0) {
 		deps.loadTokens(tokens);
 		deps.logger.info("Loaded persisted RTSP tokens", { meta: { tokenCount: tokens.size } });
@@ -38384,6 +39260,8 @@ var PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS = 6e4;
 * the sample as absent (the RTCP Receiver-Report path drives the ladder anyway). */
 var NETWORK_QUALITY_STATS_TIMEOUT_MS = 2e3;
 var StreamBrokerAddon = class extends BaseAddon {
+	/** The restream tokens of a camera are a per-device setting held in the keychain (D870). */
+	secretStatePaths = ["rtspTokens"];
 	brokerManager = null;
 	/** The node's pinned ffmpeg, mirrored here so the recorded-playback demuxers
 	*  (segment-demux/segment-audio) spawn the same binary as the transcode
@@ -38440,6 +39318,7 @@ var StreamBrokerAddon = class extends BaseAddon {
 	*  restarts). Loaded on activate, flushed throttled from the metrics loop and
 	*  once on shutdown. */
 	probeSnapshots = null;
+	removalHook = null;
 	lastProbePersistAt = 0;
 	constructor() {
 		super({
@@ -38502,24 +39381,26 @@ var StreamBrokerAddon = class extends BaseAddon {
 			logger: this.ctx.logger
 		});
 		await this.ffmpegWiring.load();
-		await this.declareRowCollections();
-		await this.purgeFlattenedSettingsKeys();
+		const deviceSettings = this.deviceSettings();
 		const rtspProvider = this.brokerManager.getRtspRestreamProvider();
 		const brokerManager = this.brokerManager;
-		const rtspTokens = rtspTokensStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const rtspTokens = rtspTokensMirror(deviceSettings, this.ctx.logger);
 		const rtspEnabledState = this.state("rtspEnabled", RtspEnabledSchema, {});
 		try {
 			await hydratePersistedRtspState({
-				tokensStore: rtspTokens,
+				tokensMirror: rtspTokens,
 				enabledState: rtspEnabledState,
 				loadTokens: (tokens) => brokerManager.loadPersistedTokens(tokens),
 				loadEnabled: (states) => rtspProvider.loadPersistedEnabled(states),
 				logger: this.ctx.logger
 			});
-		} catch {}
+		} catch (err) {
+			this.ctx.logger.warn("Failed to load persisted RTSP state - tokens will not be written", { meta: { error: errMsg(err) } });
+		}
+		this.startTokenRecovery(rtspTokens, brokerManager);
 		rtspProvider.setTokenPersister(async (tokens) => {
 			try {
-				for (const [brokerId, token] of tokens) await rtspTokens.write(brokerId, { token });
+				await rtspTokens.merge(mergeRtspTokens(rtspTokens, tokens));
 				this.ctx.logger.info("Persisted RTSP tokens", { meta: { current: tokens.size } });
 			} catch (err) {
 				this.ctx.logger.warn("Failed to persist RTSP tokens", { meta: { error: errMsg(err) } });
@@ -38552,24 +39433,22 @@ var StreamBrokerAddon = class extends BaseAddon {
 				this.ctx.logger.warn("Failed to persist device overrides", { meta: { error: errMsg(err) } });
 			});
 		});
-		const profileMap = profileMapStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const profileMap = profileMapMirror(deviceSettings, this.ctx.logger);
 		const profileMapPersister = (assignments) => {
 			const next = /* @__PURE__ */ new Map();
-			for (const [deviceId, assignment] of assignments) next.set(`${deviceId}`, {
+			for (const [deviceId, assignment] of assignments) next.set(deviceId, {
 				map: { ...assignment.map },
 				auto: assignment.auto
 			});
-			profileMap.replaceAll(next).catch((err) => {
+			profileMap.replace(next).catch((err) => {
 				this.ctx.logger.warn("Failed to persist profile map", { meta: { error: errMsg(err) } });
 			});
 		};
 		this.brokerManager.setProfileMapPersister(profileMapPersister);
 		try {
-			const rows = await profileMap.readAll();
+			const rows = await profileMap.load();
 			const loaded = /* @__PURE__ */ new Map();
-			for (const [rawKey, val] of rows) {
-				const deviceId = Number(rawKey);
-				if (!Number.isInteger(deviceId)) continue;
+			for (const [deviceId, val] of rows) {
 				const map = {};
 				for (const profile of PROFILE_KEYS) {
 					const v = val.map[profile];
@@ -38585,18 +39464,18 @@ var StreamBrokerAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load profile map", { meta: { error: errMsg(err) } });
 		}
-		const probeSnapshots = probeSnapshotsStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const probeSnapshots = probeSnapshotsMirror(deviceSettings, this.ctx.logger);
 		this.probeSnapshots = probeSnapshots;
 		try {
-			const rows = await probeSnapshots.readAll();
-			const blob = Object.fromEntries(rows);
+			const rows = await probeSnapshots.load();
+			const blob = Object.fromEntries(flattenByDevice(rows));
 			this.brokerManager.loadProbeSnapshots(blob);
-			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: rows.size } });
+			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: Object.keys(blob).length } });
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load probe snapshots", { meta: { error: errMsg(err) } });
 		}
 		this.brokerManager.setDeviceHardwareForgetHook(async (deviceId) => {
-			const rtspTokenRowsDeleted = await rtspTokens.deleteWhere({ where: { deviceId } });
+			const rtspTokenRowsDeleted = await rtspTokens.remove(deviceId) ? 1 : 0;
 			this.flushProbeSnapshots(Date.now(), true);
 			return { rtspTokenRowsDeleted };
 		});
@@ -38854,6 +39733,14 @@ var StreamBrokerAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("stream-broker: client-log ingest failed to serve", { meta: { error: errMsg(err) } });
 		}
+		this.removalHook = createBrokerRemovalHook({
+			logger: this.ctx.logger,
+			retractDevice: async (deviceId) => {
+				await retractRemovedDevice(deviceId, this.deviceRemovalDeps());
+			},
+			dropDeviceOverride: (deviceId) => brokerManager.dropDeviceOverride(deviceId),
+			overrideDeviceIds: () => brokerManager.listDeviceOverrideIds()
+		});
 		return [
 			{
 				capability: streamBrokerCapability,
@@ -38872,9 +39759,90 @@ var StreamBrokerAddon = class extends BaseAddon {
 				provider: widgetsProvider
 			},
 			logChannelsRegistration,
-			loadContributionRegistration
+			loadContributionRegistration,
+			{
+				capability: deviceRemovalHookCapability,
+				provider: this.removalHook
+			}
 		];
 	}
+	/**
+	* Watch the cameras whose restream tokens are held but unreadable (D870): no
+	* restream URL is registered for them (the manager's gate), an alert says so,
+	* and when a value resolves ONLY that camera's restreamers are registered with
+	* the stored tokens - no teardown. A lost secret is released after two
+	* consistent reads and gets new, persisted tokens.
+	*/
+	startTokenRecovery(mirror, brokerManager) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) {
+			if (mirror.heldDevices().size > 0) this.ctx.logger.error("restream tokens look held but this addon has no keychain access", { meta: { cameras: mirror.heldDevices().size } });
+			return;
+		}
+		brokerManager.setRestreamGate((deviceId) => mirror.isBlocked(deviceId));
+		if (mirror.heldDevices().size === 0) return;
+		const alertId = (deviceId) => `stream-broker-tokens:${deviceId}`;
+		const warn = (what) => (err) => this.ctx.logger.warn(what, { meta: { error: errMsg(err) } });
+		const recovery = new TokenRecovery({
+			mirror,
+			secrets,
+			logger: this.ctx.logger,
+			alerts: {
+				raise: async ({ deviceId, kind, message }) => {
+					const now = Date.now();
+					await this.ctx.api.alerts.emit.mutate({
+						id: alertId(deviceId),
+						category: "streams",
+						severity: "warning",
+						title: kind === "missing" ? "New RTSP restream URLs issued" : "RTSP restream URLs unavailable",
+						message,
+						status: "active",
+						read: false,
+						createdAt: now,
+						updatedAt: now,
+						source: {
+							type: "device",
+							id: String(deviceId)
+						},
+						metadata: {
+							deviceId,
+							kind
+						}
+					}).catch(warn("could not raise the restream-token alert"));
+				},
+				clear: async (deviceId) => {
+					await this.ctx.api.alerts.update.mutate({
+						alertId: alertId(deviceId),
+						patch: {
+							status: "completed",
+							updatedAt: Date.now()
+						}
+					}).catch(warn("could not clear the restream-token alert"));
+				}
+			},
+			onRegister: async (tokens, cameras) => {
+				brokerManager.loadPersistedTokens(flattenByDevice(tokens));
+				for (const deviceId of cameras) brokerManager.registerRestreamersForDevice(deviceId);
+			}
+		});
+		recovery.start();
+		const unsubscribe = secrets.onChange((ref) => {
+			if (ref.startsWith("secret://stream-broker/device/")) recovery.tick();
+		});
+		this.ctx.addDisposer(() => {
+			recovery.stop();
+			unsubscribe();
+		});
+	}
+	async onHubReachable() {
+		const removalHook = this.removalHook;
+		if (removalHook === null) return;
+		this.ctx.addDisposer(armRemovalReconcile({
+			api: this.ctx.api,
+			logger: this.ctx.logger,
+			remove: (input) => removalHook.onDeviceRemoved(input)
+		}));
+	}
 	async onShutdown() {
 		this.logChannels?.stop();
 		this.logChannels = null;
@@ -38975,41 +39943,14 @@ var StreamBrokerAddon = class extends BaseAddon {
 		this.flushProbeSnapshots(timestamp, false);
 	}
 	/**
-	* Declare the three row collections that replaced the `probeSnapshots`,
-	* `rtspTokens` and `profileMap` blob keys. Idempotent — a re-declaration of
-	* the same shape is a no-op in the engine.
-	*
-	* Not swallowed: a broker whose `stream-broker:rtsp-tokens` is undeclared
-	* mints a new token for every stream and every external NVR URL in the
-	* installation goes dead. Crashing loudly is bounded by `CrashSupervisor`
-	* (D6); silently reissuing tokens is not.
-	*/
-	async declareRowCollections() {
-		const store = this.ctx.api.settingsStore;
-		const logger = this.ctx.logger;
-		await probeSnapshotsStore(store, logger).declare();
-		await rtspTokensStore(store, logger).declare();
-		await profileMapStore(store, logger).declare();
-	}
-	/**
-	* Drop the flattened keys from `stream-broker:addon-settings` / `root`, each
-	* gated on its own successor collection being non-empty. `rtspEnabled` and
-	* `deviceOverrides` stay — see `broker-row-stores.ts` for why.
-	*
-	* Best-effort: a purge that throws must not take the broker down. The keys
-	* are dead weight, not a fault.
+	* The per-device settings, as the broker persists through them. Resolved
+	* reads/writes (keychain markers never reach this code), and a context with
+	* no settings is a broker that cannot start.
 	*/
-	async purgeFlattenedSettingsKeys() {
-		try {
-			await retireRootKeys({
-				store: this.ctx.api.settingsStore,
-				addonId: STREAM_BROKER_ADDON_ID,
-				logger: this.ctx.logger,
-				specs: STREAM_BROKER_RETIRED_ROOT_KEYS
-			});
-		} catch (err) {
-			this.ctx.logger.warn("stream-broker: retiring the flattened settings keys failed", { meta: { error: errMsg(err) } });
-		}
+	deviceSettings() {
+		const settings = this.ctx.settings;
+		if (settings === void 0) throw new Error("stream-broker: device settings are not available");
+		return settings;
 	}
 	/**
 	* Persist the manager's probe map to the durable handle. Throttled to
@@ -39022,7 +39963,7 @@ var StreamBrokerAddon = class extends BaseAddon {
 		if (!store || !manager) return;
 		if (!force && now - this.lastProbePersistAt < PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS) return;
 		this.lastProbePersistAt = now;
-		store.replaceAll(new Map(Object.entries(manager.getProbeSnapshots()))).catch((err) => {
+		store.replace(groupByDevice(manager.getProbeSnapshots())).catch((err) => {
 			this.ctx.logger.warn("Failed to persist probe snapshots", { meta: { error: errMsg(err) } });
 		});
 	}