@camstack/addon-decoder-ffmpeg 1.2.13 → 1.2.15

package/dist/index.js

@@ -13098,7 +13098,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14099,6 +14115,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14475,15 +14494,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14719,6 +14738,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14818,6 +14861,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14836,6 +14880,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -14987,7 +15032,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15012,6 +15070,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -23714,13 +23776,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -30573,6 +30646,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -30850,25 +30924,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -30894,22 +30975,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Fixed-capacity ring buffer. When full, push() overwrites the oldest entry.

package/dist/index.mjs

@@ -13094,7 +13094,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14095,6 +14111,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14471,15 +14490,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14715,6 +14734,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14814,6 +14857,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14832,6 +14876,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -14983,7 +15028,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15008,6 +15066,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -23710,13 +23772,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -30569,6 +30642,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -30846,25 +30920,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -30890,22 +30971,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Fixed-capacity ring buffer. When full, push() overwrites the oldest entry.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-decoder-ffmpeg",
-  "version": "1.2.13",
+  "version": "1.2.15",
   "description": "Standalone ffmpeg-subprocess decoder fallback addon for CamStack",
   "keywords": [
     "camstack",