@camstack/addon-export-hap 1.2.13 → 1.2.15

package/dist/export-hap.addon.mjs

@@ -1,8 +1,9 @@
 import { createRequire } from "node:module";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as path from "node:path";
+import { readFileSync } from "node:fs";
 import { spawn } from "node:child_process";
-import { Accessory, AudioBitrate, AudioStreamingCodecType, AudioStreamingSamplerate, CameraController, Categories, Characteristic, DoorbellController, H264Level, H264Profile, HAPStorage, SRTPCryptoSuites, Service, uuid } from "@homebridge/hap-nodejs";
+import { Accessory, AudioBitrate, AudioRecordingCodecType, AudioRecordingSamplerate, AudioStreamingCodecType, AudioStreamingSamplerate, CameraController, Categories, Characteristic, DoorbellController, H264Level, H264Profile, HAPStorage, HDSProtocolError, HDSProtocolSpecificErrorReason, MediaContainerType, SRTPCryptoSuites, Service, VideoCodecType, uuid } from "@homebridge/hap-nodejs";
 import * as fs from "node:fs/promises";
 import { createSocket } from "node:dgram";
 import { networkInterfaces } from "node:os";
@@ -10,6 +11,43 @@ import { networkInterfaces } from "node:os";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
+//#region src/exposed-entry.ts
+/**
+* Carrying an exposed-device entry across a re-expose.
+*
+* `exposeDevice` rebuilds its entry from scratch — display name, mapper kind,
+* timestamp — and then REPLACES the stored one. Anything the rebuilt object
+* does not mention is therefore destroyed, and two things it never mentioned
+* were the per-camera settings and the capability list.
+*
+* The visible cost: the operator's "Source stream (HomeKit)" selector writes
+* `low`, the addon logs `streamPreference changed — refreshing accessory
+* {from=auto to=low}`, and the accessory that comes back derives its
+* advertisement from DEFAULTS — `streamPreference=auto` — because the settings
+* were dropped between the write and the rebuild. The selector only ever took
+* effect after a full addon restart, when the settings were loaded first. A
+* second write after the re-expose hid this: the store ended up correct, so
+* nothing looked wrong except the stream nobody could explain.
+*/
+/**
+* Fill `base` from `existing` for the given keys, letting `base` win wherever
+* it actually says something.
+*
+* That asymmetry is the point: a caller who passes `capabilities` is stating a
+* new truth and must not be overruled by the stored copy, while a caller who
+* says nothing about `settings` is not asking for them to be erased.
+*/
+function carryForward(base, existing, keys) {
+	if (existing === void 0) return base;
+	const out = { ...base };
+	for (const key of keys) {
+		if (out[key] !== void 0) continue;
+		const carried = existing[key];
+		if (carried !== void 0) out[key] = carried;
+	}
+	return out;
+}
+//#endregion
 //#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -6472,7 +6510,20 @@ var BrokerStatsSchema = object({
 		sampleRate: number(),
 		channels: number(),
 		supported: boolean()
-	}).nullable().optional()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
 });
 /**
 * Exporter-facing "profile restream" entry. Returned by
@@ -6521,9 +6572,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Output schema shared by the contribution + live methods.
@@ -6974,7 +7054,300 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/canonical-hash-7nfBbEqR.mjs
+//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
+var AUDIO_ENCODER_BY_CODEC = {
+	opus: "libopus",
+	aac: "aac",
+	pcmu: "pcm_mulaw",
+	pcma: "pcm_alaw"
+};
+/**
+* Camera-microphone audio, per codec. Lives HERE rather than in
+* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
+* on these types); it is re-exported from there, which is where to read it.
+*
+* Every source in this repo is a mono camera mic. The former broker preset
+* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
+* that is the value this consolidation changed.
+*/
+var AUDIO_PRESETS = {
+	aac: {
+		kind: "encode",
+		codec: "aac",
+		bitrateKbps: 128,
+		sampleRateHz: 48e3,
+		channels: 1
+	},
+	opus: {
+		kind: "encode",
+		codec: "opus",
+		bitrateKbps: 64,
+		sampleRateHz: 48e3,
+		channels: 1
+	},
+	pcmu: {
+		kind: "encode",
+		codec: "pcmu",
+		sampleRateHz: 8e3,
+		channels: 1
+	}
+};
+/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
+function logBannerArgs(level) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		level
+	];
+}
+/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
+function isSoftwareDecode(decodeHwAccel) {
+	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
+}
+/**
+* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
+* appended to this list by a caller — that is the whole point of the function.
+*/
+function buildInputArgs(input, decodeHwAccel) {
+	const args = [];
+	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
+	if (input.extraArgs?.length) args.push(...input.extraArgs);
+	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
+	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
+	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
+	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
+	args.push("-i", input.url);
+	return args;
+}
+/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
+function buildVideoFilterArgs(scale, outputArgs) {
+	if (!scale) return [];
+	if (outputArgs.some((a) => a === "-vf")) return [];
+	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
+	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
+}
+/** Rate-control args for an encode plan. */
+function buildRateControlArgs(video) {
+	const kbps = video.bitrateKbps;
+	if (kbps === void 0) return [];
+	const rc = video.rateControl ?? {
+		kind: "cap",
+		vbvSeconds: 2
+	};
+	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
+	return [
+		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
+		"-maxrate",
+		`${kbps}k`,
+		"-bufsize",
+		`${bufsize}k`
+	];
+}
+/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
+function buildVideoArgs(video, outputArgs) {
+	if (video.kind === "copy") return [
+		"-c:v",
+		"copy",
+		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
+	];
+	const args = [
+		...buildVideoFilterArgs(video.scale, outputArgs),
+		"-c:v",
+		video.encoder
+	];
+	if (video.preset !== void 0) args.push("-preset", video.preset);
+	if (video.tune !== void 0) args.push("-tune", video.tune);
+	if (video.profile !== void 0) args.push("-profile:v", video.profile);
+	if (video.level !== void 0) args.push("-level", video.level);
+	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
+	if (video.fps !== void 0) args.push("-r", String(video.fps));
+	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
+	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
+	if (video.bf !== void 0) args.push("-bf", String(video.bf));
+	args.push(...buildRateControlArgs(video));
+	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
+	return args;
+}
+/** The whole audio block, after `-i`. */
+function buildAudioArgs(audio) {
+	if (audio.kind === "none") return ["-an"];
+	if (audio.kind === "copy") return ["-c:a", "copy"];
+	const args = [];
+	if (audio.filter !== void 0) args.push("-af", audio.filter);
+	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
+	if (audio.application !== void 0) args.push("-application", audio.application);
+	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
+	if (audio.globalHeader === true) args.push("-flags", "+global_header");
+	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
+	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
+	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
+	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
+	return args;
+}
+/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
+function buildRtpOutputArgs(out) {
+	const args = [];
+	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
+	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
+	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
+	args.push("-f", "rtp", out.url);
+	return args;
+}
+/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
+function isElementaryVideoSink(sink) {
+	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
+}
+/**
+* The fragmented-MP4 muxer flags, in the order the recorder has proven them
+* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
+* `-segment_format_options`, across every vendor in the fleet):
+*
+* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
+*   opens on a sync sample. HKSV's whole requirement.
+* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
+*   is what makes the head a standalone INITIALISATION segment.
+* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
+*   demuxable without the bytes that preceded it. D31's byte-range read path
+*   depends on exactly this property of the recorder's segments.
+*/
+var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
+/**
+* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
+* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
+* which is what a plain `container` read would have done for `mp4` — a valid
+* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
+* unusable byte stream.
+*/
+function buildStdoutOrRtspSinkArgs(sink) {
+	if (sink.kind === "rtsp-listen") return [
+		"-f",
+		"rtsp",
+		"-rtsp_transport",
+		"tcp",
+		"-rtsp_flags",
+		"listen",
+		sink.url
+	];
+	if (sink.kind === "rtp-outputs") return [];
+	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
+		"-f",
+		sink.container,
+		"pipe:1"
+	];
+}
+/**
+* How far BELOW the negotiated fragment length `-min_frag_duration` is set.
+*
+* `-min_frag_duration` refuses to cut before that much media has accumulated,
+* and then waits for the next key frame. Set to exactly `fragmentMs`, the
+* commonest camera configuration in existence — a key-frame grid EQUAL to the
+* requested fragment length — lands the deadline on the same instant as the key
+* frame, loses the race, and skips to the following one: **every fragment comes
+* out at twice the requested length.**
+*
+* Measured on the live fleet 2026-08-07, camera 615, `-c:v copy` (D84):
+*
+* | slot | GOP | `-min_frag_duration` | median gap |
+* | --- | --- | --- | --- |
+* | 1280×720 | 40 f @ 10 fps = 4.0 s | 4000 ms | **7944 ms** |
+* | 1280×720 | 40 f @ 10 fps = 4.0 s | 3600 ms | 3973 ms |
+* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 4000 ms | 8042 ms |
+* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 3600 ms | 3998 ms |
+*
+* A doubled fragment is not a cosmetic overshoot: HKSV requires every fragment
+* to be no longer than the length the controller SELECTED, so the shipped-but-
+* inert phase-1 sink would have violated the contract on its first real clip.
+*
+* 10 % is chosen against the two failures either side of it. Too small and
+* ordinary jitter (measured spread 3953-4096 ms) re-loses the race; too large
+* and a source with a key frame slightly EARLY than the grid gets cut there,
+* yielding a short fragment for no reason.
+*/
+var FMP4_MIN_FRAG_MARGIN = .9;
+/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
+function buildFmp4SinkArgs(sink) {
+	return [
+		"-movflags",
+		FMP4_MOVFLAGS,
+		"-min_frag_duration",
+		String(Math.max(0, Math.round(sink.fragmentMs * FMP4_MIN_FRAG_MARGIN * 1e3))),
+		"-f",
+		"mp4",
+		"pipe:1"
+	];
+}
+/**
+* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
+* audio optional so a source with no audio skips it instead of failing the
+* whole invocation.
+*/
+function buildAudioSidecarArgs(sidecar) {
+	return [
+		"-map",
+		"0:a:0?",
+		...buildAudioArgs(sidecar.codec === "pcma" ? {
+			kind: "encode",
+			codec: "pcma",
+			sampleRateHz: 8e3,
+			channels: 1
+		} : AUDIO_PRESETS[sidecar.codec]),
+		...buildRtpOutputArgs({
+			url: sidecar.rtpUrl,
+			sdpFile: sidecar.sdpFile
+		})
+	];
+}
+/**
+* Assemble the full ffmpeg argument list. Layout:
+*
+*   -hide_banner -loglevel <level>
+*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
+*   [<input.extraArgs>]               │
+*   [-fflags <flag>…]                 │
+*   [-rtsp_transport tcp]             │
+*   -i <url>                         ─┘
+*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
+*   <consumer outputArgs verbatim>             │
+*   <sink>                                    ─┘ terminal
+*/
+function buildFfmpegArgs(inv) {
+	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
+	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
+	if (inv.sink.kind === "rtp-outputs") {
+		const videoLeg = inv.sink.video ? [
+			"-an",
+			"-map",
+			"0:v:0",
+			...buildVideoArgs(inv.video, inv.outputArgs),
+			...threadArgs,
+			...inv.outputArgs,
+			...buildRtpOutputArgs(inv.sink.video)
+		] : [];
+		const audioLeg = inv.sink.audio ? [
+			"-vn",
+			"-map",
+			"0:a:0?",
+			...buildAudioArgs(inv.audio),
+			...buildRtpOutputArgs(inv.sink.audio)
+		] : [];
+		return [
+			...head,
+			...videoLeg,
+			...audioLeg
+		];
+	}
+	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
+	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
+	return [
+		...head,
+		...buildVideoArgs(inv.video, inv.outputArgs),
+		...threadArgs,
+		...audioArgs,
+		...inv.outputArgs,
+		...sinkArgs,
+		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
+	];
+}
 /**
 * Deterministic SHA-256 hash of an arbitrary serialisable value. The
 * canonical form sorts object keys alphabetically at every depth so two
@@ -7006,6 +7379,190 @@ function replaceWithSortedKeys(_key, value) {
 	}
 	return value;
 }
+var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
+/** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
+var BOX_HEADER_BYTES = 8;
+var LARGE_BOX_HEADER_BYTES = 16;
+var Fmp4BoxSplitter = class {
+	maxUnitBytes;
+	/** Bytes of the CURRENT unit plus any partial box after it. */
+	buffer = new Uint8Array(0);
+	/** Where the current unit starts inside {@link buffer}. */
+	unitStart = 0;
+	/** Where the box scanner has reached inside {@link buffer}. */
+	cursor = 0;
+	state = "init";
+	nextSequence = 0;
+	faultReason = null;
+	interstitial = /* @__PURE__ */ new Set();
+	constructor(options = {}) {
+		this.maxUnitBytes = options.maxUnitBytes ?? DEFAULT_MAX_UNIT_BYTES;
+	}
+	/**
+	* Non-null once the stream cannot be split. The splitter emits nothing
+	* further, so a caller polls this to kill the child rather than watching a
+	* silent stall — a fragmenter that quietly stops producing looks exactly like
+	* a camera with no motion.
+	*/
+	get fault() {
+		return this.faultReason;
+	}
+	/** Bytes currently held. The memory bound, observable rather than asserted. */
+	get pendingBytes() {
+		return this.buffer.length - this.unitStart;
+	}
+	/**
+	* Top-level box types seen BETWEEN fragments and discarded — `mfra`, `free`,
+	* a stray `sidx`. Reported rather than dropped in silence: they are legal and
+	* useless to a fragment consumer, but a type nobody expected showing up here
+	* is the first symptom of a muxer that is not writing what we think it is.
+	*/
+	get discardedInterstitialTypes() {
+		return [...this.interstitial];
+	}
+	/**
+	* Feed bytes; get back whatever units completed. Returns `[]` once faulted.
+	*/
+	push(chunk) {
+		if (this.faultReason !== null || chunk.length === 0) return [];
+		this.append(chunk);
+		if (this.pendingBytes > this.maxUnitBytes) return this.fail(`a single fMP4 unit exceeded ${this.maxUnitBytes} bytes — this stream is not fragmented`);
+		return this.drainBoxes();
+	}
+	append(chunk) {
+		if (this.buffer.length === 0) {
+			this.buffer = chunk.slice();
+			return;
+		}
+		const next = new Uint8Array(this.buffer.length + chunk.length);
+		next.set(this.buffer, 0);
+		next.set(chunk, this.buffer.length);
+		this.buffer = next;
+	}
+	/** Consume every COMPLETE top-level box now in the buffer. */
+	drainBoxes() {
+		const units = [];
+		for (;;) {
+			const header = this.readHeader();
+			if (this.faultReason !== null) return units;
+			if (header === null) break;
+			if (this.cursor + header.totalBytes > this.buffer.length) break;
+			const boxStart = this.cursor;
+			const boxEnd = boxStart + header.totalBytes;
+			this.cursor = boxEnd;
+			const unit = this.consumeBox(header.type, boxStart, boxEnd);
+			if (this.faultReason !== null) return units;
+			if (unit !== null) units.push(unit);
+		}
+		this.compact();
+		return units;
+	}
+	/**
+	* Apply one box to the state machine. Returns a unit when this box CLOSED
+	* one, `null` otherwise.
+	*/
+	consumeBox(type, boxStart, boxEnd) {
+		if (this.state === "init") {
+			if (type !== "moof") return null;
+			if (boxStart === this.unitStart) {
+				this.fail("a moof arrived before any initialisation box — there is no ftyp/moov to send");
+				return null;
+			}
+			const init = this.emit("init", this.unitStart, boxStart);
+			this.unitStart = boxStart;
+			this.state = "fragment";
+			return init;
+		}
+		if (this.state === "idle") {
+			if (type !== "moof") {
+				this.interstitial.add(type);
+				this.unitStart = boxEnd;
+				return null;
+			}
+			this.unitStart = boxStart;
+			this.state = "fragment";
+			return null;
+		}
+		if (type !== "mdat") return null;
+		const fragment = this.emit("fragment", this.unitStart, boxEnd);
+		this.unitStart = boxEnd;
+		this.state = "idle";
+		return fragment;
+	}
+	/**
+	* Parse the header at {@link cursor}, or `null` when too few bytes have
+	* arrived to know. Faults on a size the splitter cannot honour.
+	*/
+	readHeader() {
+		const available = this.buffer.length - this.cursor;
+		if (available < BOX_HEADER_BYTES) return null;
+		const view = new DataView(this.buffer.buffer, this.buffer.byteOffset, this.buffer.byteLength);
+		const size = view.getUint32(this.cursor);
+		const type = String.fromCharCode(this.buffer[this.cursor + 4] ?? 0, this.buffer[this.cursor + 5] ?? 0, this.buffer[this.cursor + 6] ?? 0, this.buffer[this.cursor + 7] ?? 0);
+		if (size === 0) {
+			this.fail(`box "${type}" declares size 0 (to EOF) — an unbounded box cannot be fragmented`);
+			return null;
+		}
+		if (size === 1) {
+			if (available < LARGE_BOX_HEADER_BYTES) return null;
+			const large = view.getBigUint64(this.cursor + BOX_HEADER_BYTES);
+			if (large > BigInt(this.maxUnitBytes)) {
+				this.fail(`box "${type}" declares ${large} bytes, over the ${this.maxUnitBytes} byte bound`);
+				return null;
+			}
+			return {
+				type,
+				totalBytes: Number(large)
+			};
+		}
+		if (size < BOX_HEADER_BYTES) {
+			this.fail(`box "${type}" declares an impossible size of ${size} bytes`);
+			return null;
+		}
+		return {
+			type,
+			totalBytes: size
+		};
+	}
+	emit(kind, start, end) {
+		const sequence = this.nextSequence;
+		this.nextSequence += 1;
+		return {
+			kind,
+			data: this.buffer.slice(start, end),
+			sequence
+		};
+	}
+	/**
+	* Drop everything already emitted or discarded. Without this the buffer is
+	* the whole stream and the process dies in hours, not minutes.
+	*/
+	compact() {
+		if (this.unitStart === 0) return;
+		this.buffer = this.buffer.slice(this.unitStart);
+		this.cursor -= this.unitStart;
+		this.unitStart = 0;
+	}
+	fail(reason) {
+		this.faultReason = reason;
+		this.buffer = new Uint8Array(0);
+		this.unitStart = 0;
+		this.cursor = 0;
+		return [];
+	}
+};
+//#endregion
+//#region ../types/dist/err-msg-IQTHeDzc.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg$12(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -7095,6 +7652,34 @@ var BASE_LIVE_EGRESS_PROFILE = {
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 ({ ...BASE_LIVE_EGRESS_PROFILE });
+/** VBV window for a consumer whose budget is enforced per second (HomeKit). */
+var RATE_CONTROL_TIGHT = {
+	kind: "cbr",
+	vbvSeconds: 1
+};
+var HAP_AUDIO_BASE = {
+	kind: "encode",
+	codec: "opus",
+	bitrateKbps: 24,
+	channels: 1,
+	application: "lowdelay",
+	globalHeader: true,
+	filter: "aresample=async=1000:first_pts=0"
+};
+function createHwAccelCache(options) {
+	const now = options.now ?? (() => Date.now());
+	let value = null;
+	let writtenAt = Number.NEGATIVE_INFINITY;
+	return {
+		read() {
+			return now() - writtenAt < options.ttlMs ? value : void 0;
+		},
+		write(next) {
+			value = next;
+			writtenAt = now();
+		}
+	};
+}
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -7151,7 +7736,7 @@ object({
 * ## This file adds no state
 *
 * Every switch here is a VIEW onto an authority that already existed
-* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
 * group is that there is exactly one place each function is turned off, and
 * the group routes to it:
 *
@@ -7162,6 +7747,53 @@ object({
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
 * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
 *
 * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
 * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -7180,14 +7812,18 @@ object({
 *   `CameraStatus.switchedOff`.
 */
 /**
-* The five functions the operator named (2026-08-05). Deliberately NOT one id
-* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
 * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
-* editor, not in a five-button safety group.
+* editor, not in a safety group.
 */
 var CameraSwitchIdSchema = _enum([
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -7205,14 +7841,27 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 		capName: string()
 	}),
 	object({ kind: literal("recording-config") }),
-	object({ kind: literal("notification-mute") })
+	object({ kind: literal("notification-mute") }),
+	object({
+		kind: literal("camera-audio"),
+		capName: string()
+	}),
+	object({
+		kind: literal("camera-mask"),
+		capName: string()
+	}),
+	object({ kind: literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
 * control, never as a dead control — an absent function and a broken one must
 * not look the same.
 */
-var CameraSwitchUnavailableReasonSchema = _enum(["no-provider", "source-unreachable"]);
+var CameraSwitchUnavailableReasonSchema = _enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
 /**
 * One switch, resolved for one camera.
 *
@@ -9234,6 +9883,26 @@ var EgressTranscodeRequestSchema = object({
 		"h264_mp4toannexb",
 		"hevc_mp4toannexb"
 	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
 	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
 	/**
 	* Operator/consumer override for decode hardware. ABSENT is the normal case
@@ -9278,7 +9947,13 @@ var EgressTranscodeSchema = object({
 	* Returned rather than assumed: a consumer that asked for hardware and got
 	* software needs to be able to see that without reading the broker's logs.
 	*/
-	decodeHwAccel: string().nullable()
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
 });
 method(object({
 	deviceId: number().int().nonnegative(),
@@ -9426,7 +10101,25 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), boolean()), object({
+}), method(object({ brokerId: string() }), boolean()), method(object({ deviceId: number().int() }), object({
+	muted: boolean(),
+	/**
+	* How many live non-derived brokers currently hold the mute. Purely
+	* diagnostic: `muted` is the policy and is authoritative on its own
+	* (it applies to brokers that do not exist yet), while this says
+	* whether anything is presently being silenced.
+	*/
+	appliedBrokers: number().int().nonnegative()
+})), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({
+	muted: boolean(),
+	appliedBrokers: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string(),
 	profile: CamProfileSchema
@@ -14749,6 +15442,30 @@ var TrackSourceSchema = _enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = _enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -14758,18 +15475,31 @@ var TrackSourceSchema = _enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -14783,7 +15513,32 @@ var TrackFlagsPatchSchema = object(TrackFlagFields);
 var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
-	debug: boolean()
+	debug: boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = object({
+	deviceId: number(),
+	tracks: number().int(),
+	files: number().int(),
+	bytes: number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = object({
+	generatedAt: number(),
+	trackCount: number().int(),
+	fileCount: number().int(),
+	byteCount: number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: boolean(),
+	devices: array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = object({
 	trackId: string(),
@@ -14828,7 +15583,8 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -15042,7 +15798,8 @@ var KeyEventSchema = object({
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 object({
 	trackId: string(),
@@ -15303,6 +16060,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -17120,9 +17883,15 @@ DeviceType.Camera, method(object({
 	* Bypass the cache freshness check and fetch directly from the
 	* native (or stream-broker fallback). Triggered by the UI's
 	* "refresh" button so an operator can force a fresh frame
-	* even when the cache is well within `snapshotMaxAgeMs`.
-	* On battery cams this WILL wake the camera — accept the
-	* cost only when the user explicitly asks for it.
+	* even when the cache is well within the device's
+	* `snapshotMaxAgeS` window.
+	*
+	* **`force` is an OPERATOR signal, not a freshness preference.** On a
+	* battery camera it is the one thing that walks past the wrapper's
+	* sleep gate and wakes the camera, so a background caller — a poller,
+	* an event handler, a thumbnail — must NEVER set it. Every such caller
+	* gets the cached frame, which on a sleeping battery camera is the
+	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
@@ -20957,6 +21726,173 @@ DeviceType.Camera, method(object({
 	status: OsdStatusSchema
 });
 /**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("static"),
+		text: string().max(64)
+	}),
+	object({
+		kind: literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: string().min(1).max(64).optional()
+	}),
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().optional(),
+		capName: string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: record(string(), string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = object({
+	slotId: string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: boolean(),
+	cameraEnabled: boolean(),
+	cameraText: string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = _enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = object({
+	slotId: string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: string().optional()
+});
+var OsdSourceValueTypeEnum = _enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = object({
+	deviceId: number().int(),
+	deviceName: string(),
+	capName: string(),
+	valuePath: string(),
+	label: string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: array(string()).readonly().optional()
+});
+method(object({ deviceId: number().int() }), object({
+	supported: boolean(),
+	slots: array(OsdSlotViewSchema)
+}), { auth: "admin" }), method(object({ deviceId: number().int() }), object({ sources: array(OsdSourceOptionSchema) }), { auth: "admin" }), method(object({}), object({
+	supported: array(string()),
+	catalog: array(NcConditionDescriptorSchema)
+}), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema
+}), object({
+	slot: OsdSlotViewSchema,
+	render: OsdRenderResultSchema
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema.optional()
+}), OsdRenderResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ results: array(OsdRenderResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Feeder connectivity / power status — mirrors the HA petkit device-status
 * enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
 * `on_batteries` (running on battery backup). `null` until first reported.
@@ -21404,12 +22340,30 @@ object({
 });
 DeviceType.Sensor;
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -21425,16 +22379,40 @@ object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: boolean().nullable(),
 	lastFetchedAt: number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = object({
 	/** Maximum number of supported zones. */
 	maxRegions: number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = object({
@@ -21447,6 +22425,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), PrivacyMaskOptionsSche
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 var PtzPresetSchema = object({
 	id: string(),
@@ -21656,6 +22640,21 @@ var LocateSegmentResultSchema = discriminatedUnion("kind", [object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = object({ data: _instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = object({
+	data: _instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: number()
+});
 method(object({
 	deviceId: number(),
 	fromMs: number(),
@@ -21698,6 +22697,14 @@ method(object({
 }), ReadSegmentBytesResultSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	profile: string(),
+	startMs: number(),
+	epochMs: number()
+}), ReadGopBytesResultSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	config: RecordingConfigSchema
@@ -22178,6 +23185,16 @@ var StreamProfileConfigSchema = object({
 		"baseline"
 	]).optional(),
 	gop: number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: boolean().optional()
 });
 object({
@@ -22218,7 +23235,13 @@ var StreamParamsOptionsSchema = object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = object({
 	width: number().optional(),
 	height: number().optional(),
@@ -22231,8 +23254,7 @@ var StreamProfilePatchSchema = object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: number().optional(),
-	audio: boolean().optional()
+	gop: number().optional()
 });
 DeviceType.Camera, method(object({ deviceId: number() }), StreamParamsOptionsSchema), method(object({
 	deviceId: number(),
@@ -25826,6 +26848,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -25988,6 +27052,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26744,6 +27820,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -26912,6 +27994,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -27452,6 +28540,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -27572,6 +28666,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -28333,6 +29433,88 @@ object({
 	square: false
 }).paddingRatio;
 /**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
+object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
 * Compute the stable 64-char lowercase-hex fingerprint of a device's
 * export-relevant shape. Two structurally-equal shapes (any feature order,
 * any duplicates, any deviceId) hash identically.
@@ -28358,6 +29540,506 @@ function resolveExportFingerprint(input) {
 	if (input.ready) return input.fresh;
 	return input.persisted ?? input.fresh;
 }
+/**
+* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
+* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
+*
+* ## Why a plane and not a callback
+*
+* The operator's requirement for HKSV was explicit: the live fMP4 source built
+* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
+* CamStack as an additional videoclip source alongside the recorder and the NC
+* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
+* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
+* a second ffmpeg child of the same camera. So this is the same shape the
+* broker's other multi-consumer surfaces already have
+* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
+* one producer.
+*
+* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
+* clip source; both are named here so the seam is not re-invented, and neither
+* is built.
+*
+* ## The init segment is RETAINED
+*
+* A subscriber that attaches mid-stream — the clip consumer joining an already
+* running HKSV session, which is the whole dual-use case — receives the
+* retained `ftyp`+`moov` as its first packet and then live fragments. Without
+* retention its fragments are undecodable and the failure looks like a codec
+* problem.
+*
+* ## A slow subscriber is CLOSED, never silently gapped
+*
+* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
+* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
+* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
+* shows a clip that fails to play with nothing anywhere saying why. So a
+* subscription whose queue overflows is ENDED with a reason, loudly, and the
+* other subscriptions are untouched.
+*
+* ## The PREBUFFER (phase 3)
+*
+* HKSV asks for context BEFORE the trigger — `CameraRecordingOptions.prebufferLength`
+* is a HAP-mandated minimum of 4000 ms — and a subscriber that attaches at the
+* motion edge has none. So the plane optionally retains the last few fragments
+* and replays them to a subscriber that asks for them.
+*
+* Three things this ring gets right, each of which is a measured fact rather
+* than a preference (see [D84](../../../../docs/decisions/adr-0084.md)):
+*
+*  - **It is bounded by TIME *and* BYTES.** On the live fleet a 720p copy
+*    fragment is ~255 KB and a 4K one is ~6.35 MB — a 25× spread over the same
+*    window. A time-only bound is a per-camera RAM figure nobody can predict.
+*  - **The window is measured on ARRIVAL, not parsed from `tfdt`.** The
+*    splitter deliberately never computes a fragment's duration (a second
+*    opinion about a fact the muxer owns), and a prebuffer cares about how long
+*    ago the bytes turned up, which is exactly what arrival time answers.
+*  - **A replay is not backlog.** A subscriber taking N retained fragments gets
+*    its queue capacity raised by N for them, because closing a subscriber as a
+*    slow consumer for the prebuffer it explicitly asked for would be the
+*    stupidest possible failure — and, with `DEFAULT_QUEUE_CAPACITY` of 4 and a
+*    ring of 4, the guaranteed one.
+*
+* ## `isLast`
+*
+* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
+* `isLast` — a generator that finishes without it produces the twelve-second
+* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
+* plane therefore computes it at DELIVERY time: a packet is last when the plane
+* has ended and nothing remains queued behind it. A subscription that ends
+* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
+* the future delegate must not open an HDS stream it cannot feed.
+*/
+var DEFAULT_QUEUE_CAPACITY = 4;
+var Fmp4FragmentPlane = class {
+	logger;
+	prebuffer;
+	now;
+	subscriptions = /* @__PURE__ */ new Map();
+	/** The last init unit seen, handed to every later subscriber. */
+	retainedInit = null;
+	ended = false;
+	/** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
+	ring = [];
+	ringBytes = 0;
+	constructor(logger, prebuffer, now = Date.now) {
+		this.logger = logger;
+		this.prebuffer = prebuffer;
+		this.now = now;
+	}
+	get subscriberCount() {
+		return this.subscriptions.size;
+	}
+	/** True once {@link end} has been called — no further units are accepted. */
+	get isEnded() {
+		return this.ended;
+	}
+	/** What the prebuffer ring holds right now. All zeroes when disabled. */
+	prebufferStats() {
+		const oldest = this.ring[0];
+		return {
+			fragments: this.ring.length,
+			bytes: this.ringBytes,
+			spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
+		};
+	}
+	subscribe(input) {
+		const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
+		const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
+		const sub = {
+			id: `fmp4-${randomUUID()}`,
+			tag: input.tag,
+			subscribedAt: this.now(),
+			capacity: requested + replay.length,
+			queue: [],
+			delivered: 0,
+			closedReason: null,
+			wake: null,
+			iterating: false
+		};
+		this.subscriptions.set(sub.id, sub);
+		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
+		for (const retained of replay) this.enqueue(sub, retained.unit);
+		if (this.ended) this.closeSubscription(sub, "ended");
+		this.logger?.info("fmp4 plane: subscribed", { meta: {
+			subscriptionId: sub.id,
+			tag: sub.tag,
+			hasRetainedInit: this.retainedInit !== null,
+			prebufferFragments: replay.length,
+			prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
+		} });
+		return this.facade(sub);
+	}
+	/**
+	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
+	* emits exactly one per child, and a second means the child was respawned, in
+	* which case the old one describes a stream that no longer exists.
+	*/
+	publish(unit) {
+		if (this.ended) return;
+		if (unit.kind === "init") {
+			this.retainedInit = unit;
+			this.ring.length = 0;
+			this.ringBytes = 0;
+		} else this.retain(unit);
+		for (const sub of this.subscriptions.values()) {
+			if (sub.closedReason !== null) continue;
+			this.enqueue(sub, unit);
+		}
+	}
+	/**
+	* The producer stopped. Every subscriber drains what it holds; its final
+	* packet carries `isLast`, and its generator then completes.
+	*/
+	end(reason = "producer ended") {
+		if (this.ended) return;
+		this.ended = true;
+		this.logger?.info("fmp4 plane: ended", { meta: {
+			reason,
+			subscribers: this.subscriptions.size
+		} });
+		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+	}
+	listSubscribers() {
+		return [...this.subscriptions.values()].map((s) => ({
+			tag: s.tag,
+			subscribedAt: s.subscribedAt,
+			delivered: s.delivered,
+			closedReason: s.closedReason
+		}));
+	}
+	/** End and forget everything. Idempotent. */
+	dispose() {
+		this.end("disposed");
+		this.subscriptions.clear();
+		this.retainedInit = null;
+		this.ring.length = 0;
+		this.ringBytes = 0;
+	}
+	/**
+	* Add one fragment to the ring and evict from the front until BOTH bounds
+	* hold. Eviction is oldest-first, which is the one place in this file where
+	* dropping is correct: the ring is context, not stream — nobody is mid-decode
+	* on it, and a subscriber only ever receives a contiguous tail of it.
+	*/
+	retain(unit) {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return;
+		const arrivedAt = this.now();
+		this.ring.push({
+			unit,
+			arrivedAt
+		});
+		this.ringBytes += unit.data.length;
+		const cutoff = arrivedAt - prebuffer.windowMs;
+		while (this.ring.length > 0) {
+			const oldest = this.ring[0];
+			if (oldest === void 0) break;
+			const tooOld = oldest.arrivedAt < cutoff;
+			const tooBig = this.ringBytes > prebuffer.maxBytes;
+			if (!tooOld && !tooBig || this.ring.length === 1) break;
+			this.ring.shift();
+			this.ringBytes -= oldest.unit.data.length;
+		}
+	}
+	/**
+	* The ring as a subscriber should receive it — window applied AT SUBSCRIBE
+	* time, not only at publish time. A camera that went quiet keeps its last
+	* fragment in the ring indefinitely (see the never-evict-the-newest rule),
+	* and replaying a 40-second-old fragment as "prebuffer" would put stale video
+	* at the head of a clip iOS presents as the moment of the event.
+	*/
+	trimmedRing() {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return [];
+		const cutoff = this.now() - prebuffer.windowMs;
+		return this.ring.filter((r) => r.arrivedAt >= cutoff);
+	}
+	enqueue(sub, unit) {
+		if (sub.queue.length >= sub.capacity) {
+			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
+				subscriptionId: sub.id,
+				tag: sub.tag,
+				capacity: sub.capacity,
+				delivered: sub.delivered
+			} });
+			this.closeSubscription(sub, "slow-consumer");
+			return;
+		}
+		sub.queue.push({
+			kind: unit.kind,
+			data: unit.data,
+			sequence: unit.sequence,
+			isLast: false
+		});
+		this.wake(sub);
+	}
+	closeSubscription(sub, reason) {
+		if (sub.closedReason !== null) return;
+		sub.closedReason = reason;
+		if (reason === "slow-consumer") sub.queue.length = 0;
+		this.wake(sub);
+	}
+	wake(sub) {
+		const resume = sub.wake;
+		sub.wake = null;
+		resume?.();
+	}
+	facade(sub) {
+		const plane = this;
+		return {
+			id: sub.id,
+			tag: sub.tag,
+			get delivered() {
+				return sub.delivered;
+			},
+			get closedReason() {
+				return sub.closedReason;
+			},
+			packets: () => plane.iterate(sub),
+			release: () => {
+				plane.closeSubscription(sub, "released");
+				plane.subscriptions.delete(sub.id);
+			}
+		};
+	}
+	async *iterate(sub) {
+		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
+		sub.iterating = true;
+		for (;;) {
+			const next = sub.queue.shift();
+			if (next === void 0) {
+				if (sub.closedReason !== null) return;
+				await new Promise((resolve) => {
+					sub.wake = resolve;
+				});
+				continue;
+			}
+			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
+			sub.delivered += 1;
+			yield {
+				...next,
+				isLast
+			};
+			if (isLast) return;
+		}
+	}
+};
+var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
+var FRAGMENT_LOG_EVERY = 30;
+var Fmp4FragmentChild = class {
+	deps;
+	args;
+	child = null;
+	splitter = new Fmp4BoxSplitter();
+	stopped = false;
+	unitsOut = 0;
+	activeHwAccel = null;
+	constructor(deps, args) {
+		this.deps = deps;
+		this.args = args;
+	}
+	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+	async start() {
+		const requested = this.args.invocation.decodeHwAccel;
+		this.activeHwAccel = requested;
+		try {
+			await this.spawnAttempt(requested);
+			return;
+		} catch (err) {
+			if (this.stopped) throw err;
+			if (requested === null || isSoftwareDecode(requested)) throw err;
+			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					decodeHwAccel: requested,
+					error: errMsg$12(err)
+				}
+			});
+			this.killChild();
+			this.splitter = new Fmp4BoxSplitter();
+			this.activeHwAccel = null;
+			await this.spawnAttempt(null);
+		}
+	}
+	/** The backend the child ACTUALLY ran with — `null` for software. */
+	activeDecodeHwAccel() {
+		const value = this.activeHwAccel;
+		return value === null || value === "none" || value === "copy" ? null : value;
+	}
+	/** Kill ffmpeg and end the plane. Idempotent. */
+	async stop() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.killChild();
+		this.args.plane.end("the fragment child stopped");
+	}
+	spawnAttempt(decodeHwAccel) {
+		const args = buildFfmpegArgs({
+			...this.args.invocation,
+			decodeHwAccel,
+			sink: {
+				kind: "stdout",
+				container: "mp4",
+				fragmentMs: this.args.fragmentMs
+			}
+		});
+		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				fragmentMs: this.args.fragmentMs,
+				decodeHwAccel: decodeHwAccel ?? "software",
+				argv: args.join(" ")
+			}
+		});
+		return new Promise((resolve, reject) => {
+			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			this.child = child;
+			let settled = false;
+			/**
+			* This attempt FAILED. Set before the kill, because SIGTERM makes the
+			* child exit and that exit must not be reported as a death: the retry —
+			* or the caller's rejection — already owns what happens next. Without it
+			* the timeout path ends the plane the software retry is about to fill,
+			* and the consumer sees a stream that stopped for no reason. A "which
+			* spawn is current" counter does NOT cover this: the retry has not been
+			* spawned when the kill's exit arrives.
+			*/
+			let failed = false;
+			/**
+			* This attempt is still the live producer: it has not failed (a failure
+			* hands ownership to the retry, or to the caller's rejection) and nothing
+			* has stopped the child. Those two cover every way an attempt stops being
+			* current — `start` only respawns after a rejection.
+			*/
+			const isCurrent = () => !this.stopped && !failed;
+			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+			const settle = (fail) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				if (fail) {
+					failed = true;
+					reject(fail);
+				} else resolve();
+			};
+			const timer = setTimeout(() => {
+				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+				this.killChild();
+			}, timeoutMs);
+			timer.unref?.();
+			child.stdout?.on("data", (chunk) => {
+				for (const unit of this.splitter.push(chunk)) {
+					this.unitsOut += 1;
+					this.args.plane.publish(unit);
+					if (unit.kind === "init") {
+						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+							tags: { deviceId: this.args.deviceId },
+							meta: {
+								sourceId: this.args.sourceId,
+								bytes: unit.data.length
+							}
+						});
+						settle();
+					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+						tags: { deviceId: this.args.deviceId },
+						meta: {
+							sourceId: this.args.sourceId,
+							unitsOut: this.unitsOut,
+							bytes: unit.data.length,
+							subscribers: this.args.plane.subscriberCount
+						}
+					});
+				}
+				const fault = this.splitter.fault;
+				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+			});
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (line) => {
+				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						line: line.trim()
+					}
+				});
+			});
+			child.once("error", (err) => {
+				if (!settled) {
+					settle(err);
+					return;
+				}
+				if (!isCurrent()) return;
+				this.args.plane.end("the fragment child errored");
+				this.deps.onChildExit?.(err);
+			});
+			child.once("exit", (code, signal) => {
+				if (!settled) {
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
+		});
+	}
+	/**
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
+	*/
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
+			}
+		});
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
+	}
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: errMsg$12(err)
+				}
+			});
+		}
+	}
+};
 //#endregion
 //#region src/accessory-publisher.ts
 /**
@@ -28471,7 +30153,7 @@ function clearPairingFiles(accessoryUuid, logger) {
 }
 //#endregion
 //#region src/hap-setup-uri.ts
-function errMsg$10(e) {
+function errMsg$11(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 /**
@@ -28498,7 +30180,7 @@ function firstExposedAccessorySetupUri(exposed, logger) {
 		try {
 			return first.setupURI();
 		} catch (err) {
-			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$10(err) } });
+			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$11(err) } });
 			return;
 		}
 	}
@@ -28536,13 +30218,19 @@ function hapServiceName(parts, fallback) {
 /**
 * The privacy-mask switch.
 *
-* The camera's own name carries the meaning; "Privacy" only says which of the
-* camera's switches this is. It used to be the WHOLE name, which is why the
-* operator saw a switch that named neither its camera nor, with two cameras
-* exposed, which camera it belonged to.
+* Just "Privacy". The camera name is NOT prefixed: this service lives inside
+* the camera's own accessory, iOS already renders it under the camera, and a
+* round that prefixed it gave the operator "Videocamera ingresso Privacy"
+* sitting inside a tile titled "Videocamera ingresso".
+*
+* The prefix was added for a real reason — two cameras publishing a switch
+* called "Privacy" — but that was a symptom of the label being the ONLY thing
+* shown, which stopped being true once `ConfiguredName` made the service
+* render in its accessory's context. Uniqueness is required WITHIN one
+* accessory, not across the bridge, and one camera has one privacy switch.
 */
-function privacyServiceName(deviceName) {
-	return hapServiceName([deviceName, PRIVACY_SUFFIX], PRIVACY_SUFFIX);
+function privacyServiceName() {
+	return hapServiceName([PRIVACY_SUFFIX], PRIVACY_SUFFIX);
 }
 /**
 * Deliberately not localised, and deliberately not a translation table.
@@ -28559,35 +30247,60 @@ var PRIVACY_SUFFIX = "Privacy";
 * the parent camera.
 *
 * The child's OWN stored name wins. It is the string the operator typed, in
-* the operator's language, and the previous rule threw it away: `role` was
+* the operator's language, and an early rule threw it away: `role` was
 * consulted first and title-cased, so every siren on the fleet published as
 * the English word "Siren" no matter what the operator had called it.
 *
-* The parent name is prefixed only when the child's name does not already
-* carry it — providers name children both ways ("Sirena" and "Videocamera
-* cucina Sirena") and the result must be one form, not two.
+* Providers name children both ways — "Sirena" and "Videocamera cucina
+* Sirena". The parent half is now REMOVED rather than added, because the
+* service is published inside the parent camera's own accessory and iOS
+* already shows it there. The result must be one form, not two.
 */
 function childServiceName(parentName, child) {
-	const own = child.name.trim();
-	if (own.length > 0) return mentions(own, parentName) ? hapServiceName([own], parentName) : hapServiceName([parentName, own], own);
-	return hapServiceName([parentName, typeof child.role === "string" ? titleCase(child.role) : ""], parentName);
+	const own = withoutParent(child.name.trim(), parentName);
+	if (own.length > 0) return hapServiceName([own], own);
+	return hapServiceName([typeof child.role === "string" ? titleCase(child.role) : ""], CHILD_FALLBACK);
 }
 /**
-* A PTZ action switch.
+* Last resort for a child that carries neither a name nor a role. Better than
+* the parent's name, which would publish a service indistinguishable from the
+* accessory holding it — the exact defect this module keeps being asked to fix.
 *
-* The action labels themselves stay in `ptz-labels.ts` — they name a HomeKit
-* control, not a device — but the service is still qualified by the camera, so
-* a home with two PTZ cameras does not publish two switches called "Preset
-* ingresso".
+* English, like the role slugs it stands in for ("Floodlight", "Siren"): the
+* only strings this module invents are English, and inventing one Italian word
+* would be a localisation layer that localises nothing.
 */
-function ptzServiceName(deviceName, actionLabel) {
-	return hapServiceName([deviceName, actionLabel], actionLabel);
+var CHILD_FALLBACK = "Accessory";
+/**
+* A PTZ action switch: the bare action, "Preset ingresso" / "Pan Left" /
+* "Autotrack".
+*
+* The labels themselves stay in `ptz-labels.ts` — they name a HomeKit control,
+* not a device. This function exists only to put the operator-typed half of a
+* preset name through the same sanitisation everything else gets; it no longer
+* qualifies the label with the camera, because all eight PTZ services live on
+* that camera's accessory and are unique among themselves.
+*/
+function ptzServiceName(actionLabel) {
+	return hapServiceName([actionLabel], actionLabel);
 }
-/** Does `name` already contain `parentName` as a whole word? */
-function mentions(name, parentName) {
-	const needle = parentName.trim().toLowerCase();
-	if (needle.length === 0) return true;
-	return name.toLowerCase().includes(needle);
+/**
+* Drop `parentName` from the front of `name`.
+*
+* A PREFIX only. "Videocamera cucina Sirena" → "Sirena"; "Sirena" is already
+* bare and untouched. A parent name appearing anywhere else in the child's
+* name is left alone — cutting from the middle of a string the operator typed
+* would mangle it, and this function must never make a label WORSE.
+*
+* Returns `name` unchanged when stripping would leave nothing: a child the
+* operator called exactly what the camera is called still needs a label.
+*/
+function withoutParent(name, parentName) {
+	const needle = parentName.trim();
+	if (needle.length === 0) return name;
+	if (!name.toLowerCase().startsWith(needle.toLowerCase())) return name;
+	const rest = name.slice(needle.length).trim();
+	return rest.length > 0 ? rest : name;
 }
 /**
 * Truncate to the HAP ceiling and shave any leading/trailing character the
@@ -28636,7 +30349,7 @@ async function buildBattery(bctx) {
 		const status = await proxy.battery?.getStatus({});
 		if (status) applyToService(service, status);
 	} catch (err) {
-		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
+		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$10(err) } });
 	}
 	const unsubscribes = [];
 	if (proxy.state.battery) {
@@ -28662,7 +30375,7 @@ function applyToService(service, status) {
 	const lowBattery = pct <= LOW_BATTERY_THRESHOLD_PCT ? Characteristic.StatusLowBattery.BATTERY_LEVEL_LOW : Characteristic.StatusLowBattery.BATTERY_LEVEL_NORMAL;
 	service.updateCharacteristic(Characteristic.StatusLowBattery, lowBattery);
 }
-function errMsg$9(err) {
+function errMsg$10(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -39158,9 +40871,121 @@ function ingestDecryptedRtcp(plaintext, tally) {
 		failure: null
 	};
 }
+function classifyConnection(input) {
+	if (input.negotiatedWidth < 640) return "watch";
+	if (input.audioPacketTimeMs >= 60) return "remote";
+	return input.viaHomeHub ? "home-hub" : "local";
+}
+/**
+* The slot each class asks for.
+*
+* ## `local` takes the camera's best stream — settled by measurement
+*
+* This function was pinned to `low` for EVERY class by one number. On 615/high,
+* 3840x2160 pass-through:
+*
+*   durationMs=30820  videoPacketsForwarded=93  videoKeyframes=1
+*   audioPacketsForwarded=1497  lost=0
+*
+* Three video datagrams a second, one key frame in half a minute, while the
+* AUDIO leg of the *same* ffmpeg ran perfectly. It read as "our path cannot
+* carry a high-bitrate stream".
+*
+* **It was not HomeKit, not 4K and not SRTP. The loopback UDP socket ffmpeg
+* writes its RTP into had no `SO_RCVBUF` at all** (2026-08-07). It ran on
+* `net.core.rmem_default`, 212 992 B — about a fifth of one 4K IDR, which
+* arrives as ~750 datagrams at `pkt_size=1378` in a single burst. The kernel
+* discarded the overflow, and a datagram dropped there never reaches a
+* `message` handler, so it lowered the forwarded count exactly like a packet
+* ffmpeg never wrote and the controller reported no loss for it either. Audio,
+* a few hundred bytes every 20 ms, never filled the buffer. That is the whole
+* asymmetry. See `stream-socket-buffer.ts`.
+*
+* With an 8 MiB buffer (granted — this hub's `net.core.rmem_max` is 16 MiB),
+* the same camera and the same slot, session
+* `12308100-7dbe-4ad1-b277-1f046ba54ec2` on 2026-08-07:
+*
+*   selectedProfile=high  transcode=false  slotMeasuredKbps=5097
+*   videoPacketsForwarded=6512  durationMs=9867      (~660/s, was ~3/s)
+*   msToFirstKeyframe=858  deliveredFps=24  worstFractionLostPct=0.4
+*   videoLoopRcvbufBytes=16777216  clamped=false
+*
+* Operator: loaded instantly, and visibly not the low stream. A 220x increase
+* in delivered packet rate from sizing one socket.
+*
+* ## Why the remote classes stay `low`
+*
+* Not caution left over from the freeze — a different, UNMEASURED question.
+* `watch`, `remote` and `home-hub` all send video across a link whose budget
+* nothing here has measured; the buffer fix says something about a loopback hop
+* inside one host and nothing whatsoever about a WAN. 4K pass-through at ~5 Mbps
+* to a phone on LTE is a decision that needs its own evidence, and `watch` has
+* a panel under 640 px wide that could not use the pixels anyway. Raise these
+* only with a measurement of the remote link, not by analogy with this one.
+*
+* `mid` remains excluded from every class, unrelated to all of the above: it is
+* a 10 fps stream on this fleet and it has never rendered under any combination
+* tried.
+*/
+function slotForConnection(connection) {
+	switch (connection) {
+		case "watch": return "low";
+		case "remote": return "low";
+		case "home-hub": return "low";
+		case "local": return "high";
+	}
+}
 //#endregion
 //#region src/mappers/builders/stream-bitrate.ts
 /**
+* Send a stream that FITS the rate HomeKit negotiated. (R5)
+*
+* The controller's own Receiver Reports, read on the live hub on 2026-08-06,
+* closed a year of guessing: one 19.27 s session on `615/mid` forwarded 737
+* video packets at `mtu=1378` — roughly **421 kbps** — against a negotiated
+* `max_bit_rate` of **299**, and iOS reported losing **450 of those 737
+* packets (61 %)**, worst fraction lost 51.2 %, peak jitter 3.03 s. Under
+* `-c:v copy` the accessory has no lever at all: it forwards whatever the
+* camera's encoder produces, at whatever cadence it produces it.
+*
+* So the fix has two halves, and this module owns both:
+*
+*   1. **Choose a slot that fits.** Among the slots that can be passed through
+*      (H.264) and whose rate is known to be within budget, the existing
+*      resolution-closest picker decides — so the "which slot serves which
+*      resolution" opinion stays single, exactly as D51 requires.
+*   2. **Transcode only when none does**, with a real cap
+*      (`-b:v` / `-maxrate` / `-bufsize`) at the negotiated rate.
+*
+* ## Where the authoritative rate comes from, and why it is NOT the obvious one
+*
+* `webrtcSession.listStreams` reports a `bitrateKbps` per slot and it is a
+* **measured flow rate**, which is meaningless for a slot nobody is consuming.
+* Live on 2026-08-06 it reported `mid = 9 kbps` for the very slot that had just
+* delivered ~421 kbps, `low = 5 kbps`, and `high = 5441 kbps` (high was being
+* consumed, hence plausible). Selecting on that reading would admit every slot.
+*
+* The authority is therefore the camera's **configured** encoder rate, from
+* `streamParams.getStatus` — `main` / `sub` / `ext`, each carrying the
+* `bitrate` the operator (or the vendor default) set. On 615 that is
+* `main 8192`, `sub 2048`, `ext 2048` kbps. It is mapped onto a profile slot
+* through the slot's assigned cam-stream, matched on resolution and frame
+* rate; an ambiguous or absent match is reported as **unknown**, never as a
+* number.
+*
+* This inverts D51's ordering — there, `measured` outranks `published` — and
+* the inversion is deliberate:
+*
+*   - a frame rate is a stable property of the source and a measurement of it
+*     is the *best* evidence;
+*   - a bitrate under VBR is an envelope. A measurement is a **lower bound**
+*     on it, and a lower bound can prove a slot does NOT fit but can never
+*     prove that it does.
+*
+* So `measured` is kept, and used only in the direction it is sound in.
+* Everything here is pure; the cap reads live in `stream-bitrate-probe.ts`.
+*/
+/**
 * Fraction of the negotiated ceiling we actually aim the encoder at.
 *
 * `max_bit_rate` is what the controller budgeted for the stream; what crosses
@@ -39253,7 +41078,8 @@ function classifyBitrateFit(evidence, budgetKbps) {
 function selectStreamForBudget(input) {
 	const budgetKbps = budgetForNegotiatedRate(input.negotiatedMaxBitrateKbps);
 	const notes = fitNotes(input.entries, input.bitrates, budgetKbps);
-	const fallback = pickPreferredRtspEntry(input.entries, input.pref, input.deviceId, { targetResolution: input.targetResolution });
+	const effectivePref = input.pref === "auto" ? slotForConnection(input.connection) : input.pref;
+	const fallback = pickPreferredRtspEntry(input.entries, effectivePref, input.deviceId, { targetResolution: input.targetResolution });
 	if (fallback === null) return null;
 	const fallbackProfile = toCamProfile$1(fallback.profileId);
 	if (budgetKbps === null) {
@@ -39278,7 +41104,7 @@ function selectStreamForBudget(input) {
 		return classifyBitrateFit(input.bitrates.get(entry.profile), budgetKbps) === "fits";
 	});
 	if (affordable.length > 0) {
-		const picked = pickPreferredRtspEntry(affordable, input.pref, input.deviceId, { targetResolution: input.targetResolution });
+		const picked = pickPreferredRtspEntry(affordable, effectivePref, input.deviceId, { targetResolution: input.targetResolution });
 		if (picked !== null) return {
 			kind: "copy",
 			reason: "source-fits-budget",
@@ -39323,16 +41149,15 @@ function withSlotCodecs(entries, slots) {
 	});
 }
 /**
-* The rate we will actually deliver: never more than the controller asked for,
-* and never more than the source produces. `-r` above the source rate makes
-* ffmpeg DUPLICATE frames, which spends the budget on nothing.
-*/
-function deliverableFps(negotiatedFps, slotFps) {
-	if (slotFps === null || !Number.isFinite(slotFps) || slotFps <= 0) return negotiatedFps;
-	return Math.min(negotiatedFps, Math.floor(slotFps));
-}
-/**
-* The ffmpeg video-output arguments.
+* The video half of the ffmpeg plan, in the SHARED vocabulary
+* (`@camstack/types` `ffmpeg/invocation.ts`). This function used to emit
+* arguments; it now describes them, and `buildFfmpegArgs` emits every one — the
+* repo keeps exactly one argv builder, and HomeKit stopped being an exception
+* to that (D67, `scripts/check-ffmpeg-primitive.ts` Rule 1).
+*
+* Nothing about the RESULT changed except the rescale spelling: `-s WxH` became
+* `-vf scale=W:H`. Equivalent for a plain rescale, and worth knowing because
+* the two are NOT interchangeable once another `-vf` is in play.
 *
 * Pass-through carries `-bsf:v dump_extra` so every IDR inlines its own
 * SPS/PPS — sources that publish parameter sets only in the RTSP SDP hand iOS
@@ -39343,54 +41168,42 @@ function deliverableFps(negotiatedFps, slotFps) {
 * **one-second** `-bufsize` bounds any one-second window at the negotiated
 * rate, which is also the only lever available on the 3.03 s peak jitter — the
 * VBV window is what forces x264 to size a key frame to fit rather than
-* emitting it as one tight burst.
-*/
-/**
-* Seconds between forced IDRs on the transcode path.
-*
-* A join can only start decoding at a key frame, so this is the worst-case
-* wait a controller pays before the first picture — and the bound the RTSP
-* join-burst withhold falls back on when it declines to replay a wide GOP.
-*/
-var KEYFRAME_INTERVAL_SEC = 4;
-function buildVideoEncodeArgs(input) {
-	if (!input.transcode) return [
-		"-c:v",
-		"copy",
-		"-bsf:v",
-		"dump_extra"
-	];
-	const rate = input.budgetKbps === null ? [] : [
-		"-b:v",
-		`${input.budgetKbps}k`,
-		"-maxrate",
-		`${input.budgetKbps}k`,
-		"-bufsize",
-		`${input.budgetKbps}k`
-	];
-	return [
-		"-c:v",
-		"libx264",
-		"-preset",
-		"ultrafast",
-		"-tune",
-		"zerolatency",
-		"-pix_fmt",
-		"yuv420p",
-		"-r",
-		String(input.fps),
-		"-s",
-		`${input.width}x${input.height}`,
-		"-g",
-		String(Math.max(1, Math.round(input.fps * KEYFRAME_INTERVAL_SEC))),
-		...rate,
-		"-profile:v",
-		"baseline",
-		"-level",
-		"3.1",
-		"-bsf:v",
-		"dump_extra"
-	];
+* emitting it as one tight burst. That window is {@link RATE_CONTROL_TIGHT},
+* the shared constant whose whole reason to exist is HomeKit's per-second
+* budget; the browser and Echo use the relaxed two-second one.
+*
+* **The encoder stays `libx264`, deliberately.** `h264_vaapi` / `h264_qsv`
+* carry their own rate-control model, do not accept `-profile:v baseline`, and
+* emit parameter sets on their own schedule rather than x264's — which puts the
+* two load-bearing flags below back in play, with no hardware here to prove
+* they still hold. Hardware DECODE is where the measured cost is.
+*/
+function buildVideoPlan(input) {
+	if (!input.transcode) return {
+		kind: "copy",
+		bitstreamFilter: "dump_extra"
+	};
+	return {
+		kind: "encode",
+		encoder: "libx264",
+		scale: {
+			mode: "exact",
+			width: input.width,
+			height: input.height
+		},
+		preset: "ultrafast",
+		tune: "zerolatency",
+		profile: "baseline",
+		level: "3.1",
+		pixelFormat: "yuv420p",
+		fps: input.fps,
+		gopFrames: Math.max(1, Math.round(input.fps * 4)),
+		...input.budgetKbps === null ? {} : {
+			bitrateKbps: input.budgetKbps,
+			rateControl: RATE_CONTROL_TIGHT
+		},
+		bitstreamFilter: "dump_extra"
+	};
 }
 /** Compact `mid=2048pub/9meas:over-budget` rendering for a single log field. */
 function formatFitNotes(notes) {
@@ -39470,23 +41283,129 @@ function toCamProfile$1(profileId) {
 	return CAM_PROFILES$1.find((p) => p === profileId) ?? null;
 }
 //#endregion
+//#region src/mappers/builders/deadline.ts
+/**
+* Bound a piece of optional work in time.
+*
+* HomeKit answers `Selected RTP Stream Configuration` inside a write handler
+* hap-nodejs expects back quickly, and the start path behind it makes six
+* sequential cross-process cap calls into a stream-broker that regularly
+* freezes for two to three seconds at a time. Measured on the live hub: the
+* controller negotiated at :11, gave up at 9.1 s, and the bitrate fit resolved
+* at :32 — twenty-one seconds — with the start then failing on `Not running`
+* because the session it was preparing no longer existed.
+*
+* The evidence those calls gather is genuinely optional: an absent reading
+* classifies as `unknown`, and the tolerated branch still picks a slot. So the
+* right trade under load is to answer with less evidence rather than late, and
+* this makes that trade explicit at each call site instead of leaving it to
+* whatever the broker's latency happens to be.
+*
+* A late failure from work we stopped waiting on is swallowed on purpose: the
+* probe keeps running after the deadline fires, and an unhandled rejection
+* from an abandoned probe would take the process down over a reading nobody is
+* using any more.
+*/
+var TIMED_OUT = Symbol("deadline:timed-out");
+var FAILED = Symbol("deadline:failed");
+async function withDeadline(work, ms, fallback, onTimeout) {
+	let timer;
+	const guard = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(TIMED_OUT), ms);
+	});
+	try {
+		const settled = await Promise.race([work.catch(() => FAILED), guard]);
+		if (settled === TIMED_OUT) {
+			onTimeout();
+			return fallback;
+		}
+		return settled === FAILED ? fallback : settled;
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+		work.catch(() => void 0);
+	}
+}
+//#endregion
 //#region src/mappers/builders/stream-bitrate-probe.ts
 /**
-* Resolve every profile slot's rate. Never throws: an unresolvable slot ends
-* up `unknown`, which the selector treats as "cannot prove it fits" and
-* therefore transcodes — the safe direction on the wire.
+* Total budget for the rate evidence, not per call — the point is to bound
+* what the CONTROLLER waits for, and it waits for the sum.
+*/
+var BITRATE_EVIDENCE_BUDGET_MS = 1500;
+var NO_EVIDENCE = {
+	camStreams: null,
+	streamParams: null,
+	choices: null
+};
+/**
+* The last evidence that actually arrived, per device.
+*
+* Falling back to NO evidence on a slow read was not a neutral degradation: it
+* changed WHICH SLOT the picker chose. Measured on 615 within forty seconds,
+* same camera, same negotiated 1280x720:
+*
+*   10:22:11  mid  10 fps
+*   10:22:17  low  24 fps
+*   10:22:26  mid  10 fps
+*   10:22:50  low  24 fps
+*
+* With evidence, `low` classifies as a fit and wins; without it every slot is
+* `unknown` and the fallback takes `mid`. So the stream a controller received
+* depended on whether a cap read beat a 1500 ms timer — a coin flip, and one
+* that hands iOS a different profile on each retry.
+*
+* A rate is a property of the camera's encoder configuration, which changes
+* when an operator changes it and not otherwise. Yesterday's reading is a far
+* better answer than no reading, and the ONE case that must still see fresh
+* numbers — the operator lowering a substream — is a deliberate act followed
+* by a new session, by which time the background read has long landed.
+*/
+var lastGoodEvidence = /* @__PURE__ */ new Map();
+/**
+* Resolve every profile slot's rate. Never throws and never outlives its
+* budget: a slow read falls back to this device's last good reading, and only
+* a device that has never answered at all ends up `unknown`.
 */
 async function probeProfileBitrates(input) {
-	const { proxy } = input.bctx;
-	const camStreams = await probe$1(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", input.log);
-	const streamParams = await probe$1(() => proxy.streamParams?.getStatus({}), "streamParams.getStatus", input.log);
-	const choices = await probe$1(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", input.log);
+	const deviceId = input.bctx.numericDeviceId;
+	const evidence = await gatherRateEvidence(input.bctx.proxy, input.log, lastGoodEvidence.get(deviceId));
+	if (evidence.camStreams !== null || evidence.streamParams !== null) lastGoodEvidence.set(deviceId, evidence);
 	return resolveProfileBitrates({
 		slots: input.slots,
-		camStreams: camStreams ?? [],
+		camStreams: evidence.camStreams ?? [],
+		streamParams: evidence.streamParams,
+		choices: evidence.choices ?? []
+	});
+}
+/**
+* Issue the three reads CONCURRENTLY under one budget.
+*
+* Exported so the concurrency and the budget can be asserted directly: run in
+* sequence these latencies add, and adding them is what cost a session.
+*/
+async function gatherRateEvidence(proxy, log, lastGood) {
+	const startedAt = Date.now();
+	const evidence = await withDeadline(Promise.all([
+		probe$1(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", log),
+		probe$1(() => proxy.streamParams?.getStatus({}), "streamParams.getStatus", log),
+		probe$1(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", log)
+	]).then(([camStreams, streamParams, choices]) => ({
+		camStreams,
 		streamParams,
-		choices: choices ?? []
+		choices
+	})), BITRATE_EVIDENCE_BUDGET_MS, lastGood ?? NO_EVIDENCE, () => {
+		log.warn("export-hap: rate evidence ABANDONED on its budget", { meta: {
+			budgetMs: BITRATE_EVIDENCE_BUDGET_MS,
+			fellBackTo: lastGood === void 0 ? "no-evidence" : "last-good",
+			consequence: lastGood === void 0 ? "every slot rate reads UNKNOWN; the picker loses its rate preference" : "the previous reading decides the fit, so the chosen slot stays STABLE"
+		} });
 	});
+	const elapsedMs = Date.now() - startedAt;
+	if (elapsedMs > 1500 / 2) log.info("export-hap: rate evidence was slow", { meta: {
+		elapsedMs,
+		budgetMs: BITRATE_EVIDENCE_BUDGET_MS
+	} });
+	return evidence;
 }
 async function probe$1(call, label, log) {
 	try {
@@ -39504,61 +41423,138 @@ async function probe$1(call, label, log) {
 		return null;
 	}
 }
+//#endregion
+//#region src/mappers/builders/stream-ffmpeg-args.ts
+/**
+* The ffmpeg PLAN for one HomeKit streaming session.
+*
+* This file used to assemble the argument vector by hand. It no longer emits a
+* single argument: it describes the session as an {@link FfmpegInvocation} and
+* `buildFfmpegArgs` (`@camstack/types` `ffmpeg/invocation.ts`) emits every one.
+* The repo keeps exactly ONE argv builder — `scripts/check-ffmpeg-primitive.ts`
+* Rule 1 refuses a second, and HomeKit was the last exception (D67).
+*
+* ## What moved behind the primitive, and what stayed here
+*
+* MOVED — everything that describes an ENCODE, because it is the same job every
+* other live egress does and the repo had five disagreeing copies of it: the
+* encoder, preset, tune, profile, level, pixel format, rate, GOP, the tight VBV
+* window ({@link RATE_CONTROL_TIGHT}), the bitstream filter, and the Opus block
+* ({@link HAP_AUDIO_BASE}).
+*
+* STAYED — everything that is a HAP PROTOCOL fact and belongs to no other
+* consumer: the payload types, the SSRCs (and their signed-int32 coercion), the
+* MTU baked into each `rtp://…?pkt_size=` target, the loopback ports the
+* JS-side SRTP encrypt reads from, and the negotiated audio sample rate and
+* packet time.
+*
+* ## The two flags this file exists to protect
+*
+* `-g` and `-bsf:v dump_extra` were two of the four causes of the year-long
+* failure, and both live in the encode plan now. They are asserted by token
+* AND by position in `__tests__/stream-ffmpeg-argv.spec.ts`, on both the copy
+* and the encode branch, so the move behind the primitive cannot quietly drop
+* either. Every other comment below records something learned the expensive
+* way; deleting one loses the reason a flag is there.
+*/
+/**
+* Opus encoder targets — kept low because:
+*  - Camera audio is overwhelmingly speech / ambient noise; 24 kbps mono
+*    is the published "fullband speech" sweet spot for libopus (well
+*    above the 20 kbps "wideband speech" floor).
+*  - HAP audio is one-shot live (no buffering on the controller side),
+*    so under-shooting the bitrate is cheaper than over-shooting it and
+*    hitting jitter.
+*  - Mono / low-delay profile matches Apple Home's published Opus decoder
+*    expectations for camera accessories.
+*
+* The numbers themselves live in `@camstack/types` `ffmpeg/encode-defaults.ts`
+* now, alongside every other live-egress constant, so the five sets that used
+* to disagree about Opus channel count can be diffed in one place. Re-exported
+* here because the session telemetry reports the bitrate it dialled.
+*/
+var OPUS_BITRATE_KBPS = 24;
+/**
+* The Opus plane, per session.
+*
+* Re-encoded regardless of source codec: the source pool is a mix of
+* PCM_MULAW, PCM_ALAW, G.711 and AAC depending on driver, and Apple Home
+* expects Opus on the wire.
+*
+* `sampleRateHz` and `frameDurationMs` are NEGOTIATED — the controller picks
+* them — which is why the shared {@link HAP_AUDIO_BASE} leaves both out and
+* they are filled in here.
+*
+* CRITICAL on the sample rate: encode at the rate iOS asked for, never a
+* constant. iOS's `AudioStreamingSamplerate` enum surfaces as 8 / 16 / 24 kHz;
+* encoding at 24 when iOS asked for 16 produces RTP timestamps stepping by 480
+* samples/packet against a clock expecting 320 — the SRTP frames decrypt
+* cleanly but the speaker stays mute, because the timestamps slide out of the
+* AV-sync window before the first Opus frame renders. The same request value
+* drives `audioIntervalScale` in the re-stamping pass, so the two MUST come
+* from one source.
+*
+* On the frame duration: libopus emits exactly one RTP packet per Opus frame at
+* that duration, and matching HAP's `packet_time` (20 ms on LAN, 30/40/60 on
+* LTE) is what keeps the 1:1 frame↔packet mapping the controller expects.
+*/
+function audioPlan(input) {
+	return {
+		...HAP_AUDIO_BASE,
+		sampleRateHz: input.audioSampleRateKhz * 1e3,
+		frameDurationMs: input.audioPacketTimeMs,
+		vbvBufferKbits: 96
+	};
+}
 /**
 * Two outputs from one input: video SRTP and audio SRTP, one process, one
-* lifetime, one kill signal. ffmpeg-internal stream selection (`-vn` / `-an`
-* plus per-output codec args) keeps both flowing through it.
+* lifetime, one kill signal. The shared builder's `rtp-outputs` sink maps each
+* plane explicitly (`-an -map 0:v:0` / `-vn -map 0:a:0?`) so ffmpeg never
+* guesses which stream belongs where, and `0:a:0?` makes the audio optional so
+* a source with no microphone skips it instead of failing the invocation.
 */
-function buildSessionFfmpegArgs(input) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		"warning",
-		...input.decodeArgs,
-		"-rtsp_transport",
-		"tcp",
-		"-i",
-		input.rtspUrl,
-		"-an",
-		"-map",
-		"0:v:0",
-		...input.videoArgs,
-		"-payload_type",
-		String(input.videoPayloadType),
-		"-ssrc",
-		String(input.videoSsrcSigned),
-		"-f",
-		"rtp",
-		input.videoTarget,
-		"-vn",
-		"-map",
-		"0:a:0?",
-		"-af",
-		"aresample=async=1000:first_pts=0",
-		"-c:a",
-		"libopus",
-		"-application",
-		"lowdelay",
-		"-frame_duration",
-		String(input.audioPacketTimeMs),
-		"-flags",
-		"+global_header",
-		"-ar",
-		String(input.audioSampleRateKhz * 1e3),
-		"-b:a",
-		`24k`,
-		"-bufsize",
-		`96k`,
-		"-ac",
-		String(1),
-		"-payload_type",
-		String(input.audioPayloadType),
-		"-ssrc",
-		String(input.audioSsrcSigned),
-		"-f",
-		"rtp",
-		input.audioTarget
-	];
+/**
+* How long ffmpeg may inspect the broker's restream before emitting.
+*
+* Not zero. A zero-length probe makes ffmpeg trust the SDP completely, and an
+* RTSP source that announces a track it then never sends would leave the
+* mapping wrong with no way to notice. 200 ms and 64 KB is far below the
+* shortest key-frame interval on this fleet while still letting the demuxer
+* see real packets — enough to be honest, short enough that nobody watches it.
+*/
+var HAP_INPUT_PROBE = {
+	analyzeDurationUs: 2e5,
+	probeSizeBytes: 64 * 1024
+};
+function buildSessionInvocation(input) {
+	return {
+		logLevel: "warning",
+		decodeHwAccel: input.decode.hwaccel,
+		input: {
+			url: input.rtspUrl,
+			rtspTransport: "tcp",
+			analyzeDurationUs: HAP_INPUT_PROBE.analyzeDurationUs,
+			probeSizeBytes: HAP_INPUT_PROBE.probeSizeBytes,
+			...input.decode.extraInputArgs.length > 0 ? { extraArgs: input.decode.extraInputArgs } : {}
+		},
+		video: input.video,
+		audio: audioPlan(input),
+		threadCount: 0,
+		outputArgs: [],
+		sink: {
+			kind: "rtp-outputs",
+			video: {
+				url: input.videoTarget,
+				payloadType: input.videoPayloadType,
+				ssrc: input.videoSsrcSigned
+			},
+			audio: {
+				url: input.audioTarget,
+				payloadType: input.audioPayloadType,
+				ssrc: input.audioSsrcSigned
+			}
+		}
+	};
 }
 /**
 * The resolutions we offer, before rates are attached. Same list the delegate
@@ -39698,6 +41694,84 @@ var CAM_PROFILES = [
 function toCamProfile(profileId) {
 	return CAM_PROFILES.find((p) => p === profileId) ?? null;
 }
+//#endregion
+//#region src/mappers/builders/h264-idr.ts
+/**
+* Does this RTP packet carry the start of an H.264 IDR?
+*
+* A pass-through session cannot manufacture a key frame on demand — it can
+* only forward the one the camera decides to emit. So the number that decides
+* whether a controller sees a picture or a loader is *how long it waited for
+* the first IDR*, and until now nothing measured it: a session could report
+* a thousand packets forwarded, zero loss, and a blank screen, with no field
+* distinguishing "the stream is broken" from "the next key frame is 20
+* seconds away".
+*
+* That is the whole reason this exists, so it is deliberately narrow: a
+* boolean per packet, no state, no allocation, and it never throws. It runs on
+* every forwarded video packet, and a parser that throws on a malformed packet
+* would take the media path down with it.
+*/
+/** NAL unit type carrying a coded slice of an IDR picture (RFC 6184 §5.2). */
+var NAL_TYPE_IDR = 5;
+/** Single-time aggregation packet — several NALs in one RTP payload. */
+var NAL_TYPE_STAP_A = 24;
+/** Fragmentation units: one NAL spread over several RTP payloads. */
+var NAL_TYPE_FU_A = 28;
+var NAL_TYPE_FU_B = 29;
+var RTP_MIN_HEADER_BYTES = 12;
+var NAL_TYPE_MASK = 31;
+/** FU header start bit — set only on the FIRST fragment of a fragmented NAL. */
+var FU_START_BIT = 128;
+function rtpPacketCarriesIdr(packet) {
+	const payloadStart = rtpPayloadOffset(packet);
+	if (payloadStart === null) return false;
+	const firstPayloadByte = packet[payloadStart];
+	if (firstPayloadByte === void 0) return false;
+	const nalType = firstPayloadByte & NAL_TYPE_MASK;
+	if (nalType === NAL_TYPE_FU_A || nalType === NAL_TYPE_FU_B) {
+		const fuHeader = packet[payloadStart + 1];
+		if (fuHeader === void 0) return false;
+		if ((fuHeader & FU_START_BIT) === 0) return false;
+		return (fuHeader & NAL_TYPE_MASK) === NAL_TYPE_IDR;
+	}
+	if (nalType === NAL_TYPE_STAP_A) return stapContainsIdr(packet, payloadStart + 1);
+	return nalType === NAL_TYPE_IDR;
+}
+/**
+* Byte offset of the RTP payload, or `null` when the packet is too short to
+* hold one. The variable-length parts are what make this worth a function:
+* a fixed offset of 12 is right for every packet ffmpeg emits today and wrong
+* the moment one carries a CSRC list or a header extension.
+*/
+function rtpPayloadOffset(packet) {
+	if (packet.length <= RTP_MIN_HEADER_BYTES) return null;
+	const flags = packet[0];
+	if (flags === void 0) return null;
+	const csrcCount = flags & 15;
+	const hasExtension = (flags & 16) !== 0;
+	let offset = RTP_MIN_HEADER_BYTES + csrcCount * 4;
+	if (hasExtension) {
+		if (offset + 4 > packet.length) return null;
+		const words = packet.readUInt16BE(offset + 2);
+		offset += 4 + words * 4;
+	}
+	return offset < packet.length ? offset : null;
+}
+/** Walk a STAP-A's `[size][nal]` pairs looking for an IDR. */
+function stapContainsIdr(packet, start) {
+	let offset = start;
+	while (offset + 2 <= packet.length) {
+		const size = packet.readUInt16BE(offset);
+		offset += 2;
+		if (size === 0 || offset + size > packet.length) return false;
+		const nalHeader = packet[offset];
+		if (nalHeader === void 0) return false;
+		if ((nalHeader & NAL_TYPE_MASK) === NAL_TYPE_IDR) return true;
+		offset += size;
+	}
+	return false;
+}
 /**
 * How long after spawn an exit still counts as "hardware init failed".
 *
@@ -39762,34 +41836,65 @@ function software(reason) {
 	return {
 		kind: "software",
 		reason,
+		hwaccel: null,
+		extraInputArgs: [],
 		args: []
 	};
 }
 function hardware(backend, source, input) {
+	if (input.recentlyFailedBackend === backend) return software("hardware-attempt-failed");
+	const { hwaccel, extraInputArgs } = decodePlan(backend, input);
 	return {
 		kind: "hardware",
 		backend,
 		source,
-		args: decodeArgs(backend, input)
+		hwaccel,
+		extraInputArgs,
+		args: [
+			"-hwaccel",
+			hwaccel,
+			...extraInputArgs
+		]
 	};
 }
 /**
-* The input-side flags, and nothing else.
+* The input-side decode configuration, and nothing else.
 *
 * No `-hwaccel_output_format`: the decoded frames have to land in system
 * memory for libx264 to scale and encode them. Setting it would keep them on
 * the GPU, which only pays off with a GPU scale filter — and that is the
 * decoder addon's job, not a two-output SRTP session's.
+*
+* The two halves are returned SEPARATELY because the shared argv builder emits
+* `-hwaccel` itself (it is the only function allowed to, so the flag cannot
+* drift past `-i`) and takes everything else as the input plan's `extraArgs`.
 */
-function decodeArgs(backend, input) {
-	if (backend === "videotoolbox" && input.platform === "darwin") return ["-hwaccel", "auto"];
-	const args = ["-hwaccel", backend];
-	if (RENDER_NODE_BACKENDS.includes(backend)) args.push("-hwaccel_device", input.renderDevice ?? "/dev/dri/renderD128");
-	return args;
+function decodePlan(backend, input) {
+	if (backend === "videotoolbox" && input.platform === "darwin") return {
+		hwaccel: "auto",
+		extraInputArgs: []
+	};
+	return {
+		hwaccel: backend,
+		extraInputArgs: RENDER_NODE_BACKENDS.includes(backend) ? ["-hwaccel_device", input.renderDevice ?? "/dev/dri/renderD128"] : []
+	};
 }
 //#endregion
 //#region src/mappers/builders/stream-hwaccel-probe.ts
 /**
+* The real read: `decoder.getInfo`, pinned to the LOCAL node.
+*
+* Pinned explicitly rather than left to routing, because an unpinned singleton
+* cap answers from whichever node owns it and would report the WRONG host's
+* hardware.
+*/
+function decoderInfoSourceFromContext(ctx) {
+	return {
+		localNodeId: ctx.kernel?.localNodeId,
+		readInfo: (nodeId) => ctx.api.decoder.getInfo.query(void 0, nodePin(nodeId))
+	};
+}
+/**
 * Read this node's decode-hwaccel state, or `null` when nothing answered.
 *
 * Never throws. `null` means "we do not know", which
@@ -39797,27 +41902,144 @@ function decodeArgs(backend, input) {
 * the safe direction, because a guess here costs the whole stream.
 */
 async function probeDecoderHwaccel(input) {
-	const { ctx, log } = input;
-	const nodeId = ctx.kernel?.localNodeId;
+	const { source, log, memo } = input;
+	const memoised = memo.read();
+	if (memoised !== void 0) return memoised;
+	const nodeId = source.localNodeId;
 	if (nodeId === void 0 || nodeId.length === 0) {
 		log.warn("export-hap: hwaccel probe skipped — no local node id, decoding in SOFTWARE");
 		return null;
 	}
 	try {
-		const info = await ctx.api.decoder.getInfo.query(void 0, nodePin(nodeId));
+		const info = await source.readInfo(nodeId);
 		if (info === null || info === void 0) {
 			log.info("export-hap: hwaccel probe returned nothing — decoding in SOFTWARE", { meta: { nodeId } });
+			memo.write(null);
 			return null;
 		}
-		return {
+		const reading = {
 			hwaccel: info.hwaccel ?? null,
 			probedBestHwaccel: info.probedBestHwaccel ?? null
 		};
+		memo.write(reading);
+		return reading;
 	} catch (err) {
 		log.warn("export-hap: hwaccel probe failed — decoding in SOFTWARE", { meta: {
 			nodeId,
 			error: err instanceof Error ? err.message : String(err)
 		} });
+		memo.write(null);
+		return null;
+	}
+}
+/**
+* What we ask for on the VIDEO loopback socket.
+*
+* Generous on purpose: the cost is virtual address space the kernel only
+* commits as datagrams actually queue, and the failure it prevents is a black
+* tile. Sized well above {@link KEYFRAME_BURST_FLOOR_BYTES} so a slow drain
+* (the JS forwarder is on the same event loop as everything else this addon
+* does) still has headroom.
+*/
+var VIDEO_LOOPBACK_RCVBUF_BYTES = 8 * 1024 * 1024;
+/**
+* What we ask for on the AUDIO loopback socket.
+*
+* Audio never bursts — that is the control in this experiment, and it is why
+* the two legs get different numbers rather than one shared constant. If audio
+* ever starts dropping at the same buffer that carries video fine, the cause is
+* not burst size.
+*/
+var AUDIO_LOOPBACK_RCVBUF_BYTES = 1024 * 1024;
+function errMsg$9(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Set `SO_RCVBUF` and READ IT BACK.
+*
+* Never throws: a platform that refuses the option must cost the buffer, never
+* the session. The read-back is the point — a request the kernel clamped and a
+* request it honoured are indistinguishable at the call site.
+*/
+function applyReceiveBuffer(socket, requestedBytes) {
+	let error = null;
+	try {
+		socket.setRecvBufferSize(requestedBytes);
+	} catch (err) {
+		error = errMsg$9(err);
+	}
+	let effectiveBytes = null;
+	try {
+		effectiveBytes = socket.getRecvBufferSize();
+	} catch (err) {
+		if (error === null) error = errMsg$9(err);
+	}
+	return {
+		requestedBytes,
+		effectiveBytes,
+		clamped: effectiveBytes !== null && effectiveBytes < requestedBytes,
+		sufficientForKeyframeBurst: effectiveBytes !== null && effectiveBytes >= 2097152,
+		error
+	};
+}
+/** Where the kernel publishes per-socket UDP counters, by address family. */
+var PROC_NET_UDP = {
+	ipv4: "/proc/net/udp",
+	ipv6: "/proc/net/udp6"
+};
+/**
+* The per-socket `drops` count for `port`, out of a `/proc/net/udp` table.
+*
+* Pure so the format assumption is pinned by a test rather than by a live
+* kernel. Returns `null` when the port has no row — which is NOT the same as
+* zero drops, and the two must never collapse: `0` is evidence the buffer held,
+* `null` is the absence of evidence.
+*/
+function parseUdpSocketDrops(table, port) {
+	const lines = table.split("\n");
+	for (const line of lines) {
+		const fields = line.trim().split(/\s+/);
+		if (fields.length < 13) continue;
+		const local = fields[1];
+		if (local === void 0) continue;
+		const hexPort = local.split(":")[1];
+		if (hexPort === void 0) continue;
+		const parsedPort = Number.parseInt(hexPort, 16);
+		if (!Number.isFinite(parsedPort) || parsedPort !== port) continue;
+		const drops = Number(fields[fields.length - 1]);
+		return Number.isFinite(drops) ? drops : null;
+	}
+	return null;
+}
+/**
+* Fold a fresh drop sample into the one already held.
+*
+* A socket that has been CLOSED disappears from `/proc/net/udp`, so a resample
+* after teardown returns `null` — "I can no longer look", which must never
+* erase "I looked and it was 0". The first live session that proved the buffer
+* fix reported `videoLoopKernelDrops=null` for exactly this reason: on a
+* controller `stop` the sockets are closed synchronously while the summary is
+* emitted later from ffmpeg's `exit` handler.
+*/
+function mergeDropSample(previous, sampled) {
+	return sampled ?? previous;
+}
+/**
+* Read the kernel's drop counter for a bound local UDP port.
+*
+* Linux only — `null` on every other platform and on every read failure, which
+* is honest: "we could not look" and "nothing was dropped" are different
+* answers and this returns the first as `null`.
+*
+* Synchronous on purpose. It is called at the session heartbeat (5 s) and once
+* at teardown, against a memory-backed pseudo-file; making it async would mean
+* the SUMMARY line — the one line this experiment is read from — could not
+* carry a fresh count, which is the only reason it exists.
+*/
+function readUdpSocketDrops(port, ipVersion) {
+	try {
+		return parseUdpSocketDrops(readFileSync(PROC_NET_UDP[ipVersion], "utf8"), port);
+	} catch {
 		return null;
 	}
 }
@@ -39946,6 +42168,9 @@ function summariseSession(snapshot) {
 		encodeBudgetKbps: slot?.budgetKbps ?? null,
 		fitNotes: slot?.fitNotes ?? [],
 		videoPacketsForwarded: snapshot.videoPacketsForwarded,
+		msToFirstKeyframe: snapshot.firstKeyframeAtMs === null || snapshot.startedAtMs === null ? null : snapshot.firstKeyframeAtMs - snapshot.startedAtMs,
+		videoKeyframes: snapshot.videoKeyframes,
+		maxKeyframeGapMs: snapshot.maxKeyframeGapMs,
 		audioPacketsForwarded: snapshot.audioPacketsForwarded,
 		videoRtcpSrSent: snapshot.videoRtcpSrSent,
 		audioRtcpSrSent: snapshot.audioRtcpSrSent,
@@ -39960,11 +42185,21 @@ function summariseSession(snapshot) {
 		videoLossVerdict: lossVerdict(snapshot.videoReceiverReports),
 		audioLossVerdict: lossVerdict(snapshot.audioReceiverReports),
 		mediaStarved: snapshot.videoPacketsForwarded === 0,
+		videoLoopRcvbufRequestedBytes: snapshot.videoLoopback.rcvbufRequestedBytes,
+		videoLoopRcvbufBytes: snapshot.videoLoopback.rcvbufEffectiveBytes,
+		videoLoopRcvbufClamped: snapshot.videoLoopback.rcvbufClamped,
+		videoLoopKernelDrops: snapshot.videoLoopback.kernelDrops,
+		videoLoopKernelDropped: (snapshot.videoLoopback.kernelDrops ?? 0) > 0,
+		audioLoopRcvbufBytes: snapshot.audioLoopback.rcvbufEffectiveBytes,
+		audioLoopKernelDrops: snapshot.audioLoopback.kernelDrops,
+		audioLoopKernelDropped: (snapshot.audioLoopback.kernelDrops ?? 0) > 0,
 		drops: nonZeroDrops(snapshot.drops)
 	};
 }
 //#endregion
 //#region src/mappers/builders/camera-streams.ts
+/** A decoder that is slow to describe itself costs hardware decode, not the session. */
+var HWACCEL_PROBE_BUDGET_MS = 1e3;
 var SRTP_KEY_LEN = 16;
 var SRTP_SALT_LEN = 14;
 /**
@@ -40048,6 +42283,7 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 				const hadFfmpeg = session.ffmpeg !== null;
 				killFfmpeg(session, ctx, numericDeviceId);
 				stopHeartbeat(session);
+				sampleLoopbackDrops(session);
 				if (!hadFfmpeg) logSessionSummary(session, log, "accessory-dispose-no-ffmpeg");
 				await closeIntercomTalkSession(session, bctx).catch(() => void 0);
 				closeSocket(session.videoUdp);
@@ -40076,8 +42312,10 @@ async function prepareStream(request, sessions, bctx) {
 	const localIp = pickLocalInterfaceIp(request.targetAddress, ipVersion);
 	const videoUdp = await bindUdp(ipVersion, localIp);
 	const audioUdp = await bindUdp(ipVersion, localIp);
-	const videoLoopUdp = await bindLoopback(ipVersion);
-	const audioLoopUdp = await bindLoopback(ipVersion);
+	const videoLoop = await bindLoopback(ipVersion, VIDEO_LOOPBACK_RCVBUF_BYTES);
+	const audioLoop = await bindLoopback(ipVersion, AUDIO_LOOPBACK_RCVBUF_BYTES);
+	const videoLoopUdp = videoLoop.socket;
+	const audioLoopUdp = audioLoop.socket;
 	const localVideoPort = videoUdp.address().port;
 	const localAudioPort = audioUdp.address().port;
 	if (request.video.srtp_key.length !== SRTP_KEY_LEN || request.video.srtp_salt.length !== SRTP_SALT_LEN || request.audio.srtp_key.length !== SRTP_KEY_LEN || request.audio.srtp_salt.length !== SRTP_SALT_LEN) {
@@ -40153,6 +42391,10 @@ async function prepareStream(request, sessions, bctx) {
 		drops: emptyDropCounters(),
 		videoPacketsForwarded: 0,
 		audioPacketsForwarded: 0,
+		videoKeyframes: 0,
+		firstKeyframeAtMs: null,
+		lastKeyframeAtMs: null,
+		maxKeyframeGapMs: 0,
 		videoRtcpSrSent: 0,
 		audioRtcpSrSent: 0,
 		videoRtcpReceived: 0,
@@ -40192,6 +42434,12 @@ async function prepareStream(request, sessions, bctx) {
 		audioInSrtcp,
 		audioSendGate: null,
 		ipVersion,
+		videoLoopRcvbuf: videoLoop.buffer,
+		audioLoopRcvbuf: audioLoop.buffer,
+		videoLoopPort: videoLoopUdp.address().port,
+		audioLoopPort: audioLoopUdp.address().port,
+		videoLoopKernelDrops: null,
+		audioLoopKernelDrops: null,
 		ffmpeg: null,
 		lastStartParams: null,
 		upstreamAudioSrtp,
@@ -40231,6 +42479,7 @@ async function prepareStream(request, sessions, bctx) {
 	});
 	videoLoopUdp.on("message", (rtpPacket) => {
 		session.videoPacketsForwarded += 1;
+		if (rtpPacketCarriesIdr(rtpPacket)) recordKeyframe(session);
 		if (session.videoPacketsForwarded === 1) tagLog.info("export-hap: first video packet from ffmpeg", { meta: {
 			sessionId: session.sessionId,
 			bytes: rtpPacket.length
@@ -40246,6 +42495,8 @@ async function prepareStream(request, sessions, bctx) {
 			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$8(err) } });
 		});
 	});
+	logLoopbackBuffer(tagLog, request.sessionID, "video", videoLoop.buffer);
+	logLoopbackBuffer(tagLog, request.sessionID, "audio", audioLoop.buffer);
 	tagLog.info("export-hap: stream prepared", { meta: {
 		sessionId: request.sessionID,
 		controllerAddress: request.targetAddress,
@@ -40326,12 +42577,45 @@ function sameIpv4Subnet(a, mask, b) {
 	return true;
 }
 /**
+* Report one loopback socket's receive buffer.
+*
+* `warn` when the video leg cannot hold a 4K key-frame burst: that is the state
+* in which this addon silently drops most of a key frame and the tile stays
+* black, and it was invisible for the whole life of this code path.
+*/
+function logLoopbackBuffer(log, sessionId, leg, outcome) {
+	const meta = {
+		sessionId,
+		leg,
+		requestedBytes: outcome.requestedBytes,
+		effectiveBytes: outcome.effectiveBytes,
+		clamped: outcome.clamped,
+		sufficientForKeyframeBurst: outcome.sufficientForKeyframeBurst,
+		error: outcome.error
+	};
+	if (leg === "video" && !outcome.sufficientForKeyframeBurst) {
+		log.warn("export-hap: loopback receive buffer is TOO SMALL for a key-frame burst — raise net.core.rmem_max on the host", { meta });
+		return;
+	}
+	log.info("export-hap: loopback receive buffer", { meta });
+}
+/**
 * Resolve once-per-session: the local IP we bind iOS-facing sockets to
 * AND its mate on `127.0.0.1` for the ffmpeg loopback path. Both go
 * through the bounded-wait `dgram.bind` pattern.
+*
+* `SO_RCVBUF` is set AFTER the bind and read back, never assumed. Until
+* 2026-08-07 nothing set it at all, so these sockets ran on
+* `net.core.rmem_default` (212 992 B on this hub) — about a fifth of one 4K
+* key frame, which arrives as ~750 datagrams in one burst. See
+* `stream-socket-buffer.ts` for the measurement.
 */
-async function bindLoopback(ipVersion) {
-	return bindUdp(ipVersion, ipVersion === "ipv6" ? "::1" : "127.0.0.1");
+async function bindLoopback(ipVersion, requestedRcvbufBytes) {
+	const socket = await bindUdp(ipVersion, ipVersion === "ipv6" ? "::1" : "127.0.0.1");
+	return {
+		socket,
+		buffer: applyReceiveBuffer(socket, requestedRcvbufBytes)
+	};
 }
 /** Book a named drop. Every silent `return` on the streaming path routes here. */
 function drop(session, reason) {
@@ -40472,6 +42756,30 @@ function logReceiverReports(session, leg, reports, isFirst, log) {
 	if (!shouldLogReceiverReport(session, leg)) return;
 	log.info("export-hap: controller receiver report", { meta });
 }
+/**
+* Record a forwarded key frame. Kept separate from the packet counter because
+* the interesting quantity is TIMING, not a tally: the first arrival dates the
+* moment the controller could begin decoding, and the widest gap says how long
+* a mid-GOP join can be expected to stare at a loader.
+*/
+function recordKeyframe(session) {
+	const now = Date.now();
+	session.videoKeyframes += 1;
+	if (session.firstKeyframeAtMs === null) session.firstKeyframeAtMs = now;
+	else if (session.lastKeyframeAtMs !== null) session.maxKeyframeGapMs = Math.max(session.maxKeyframeGapMs, now - session.lastKeyframeAtMs);
+	session.lastKeyframeAtMs = now;
+}
+/**
+* Refresh the kernel's per-socket drop counters.
+*
+* Called immediately before every line that reports them, because a stale
+* sample on the summary would answer the experiment's central question with
+* data from five seconds earlier. Cheap: `/proc/net/udp` is memory-backed.
+*/
+function sampleLoopbackDrops(session) {
+	session.videoLoopKernelDrops = mergeDropSample(session.videoLoopKernelDrops, readUdpSocketDrops(session.videoLoopPort, session.ipVersion));
+	session.audioLoopKernelDrops = mergeDropSample(session.audioLoopKernelDrops, readUdpSocketDrops(session.audioLoopPort, session.ipVersion));
+}
 /** Snapshot every counter into the summary meta. */
 function sessionSummaryMeta(session) {
 	return summariseSession({
@@ -40482,6 +42790,9 @@ function sessionSummaryMeta(session) {
 		selectedSlot: session.selectedSlot,
 		videoPacketsForwarded: session.videoPacketsForwarded,
 		audioPacketsForwarded: session.audioPacketsForwarded,
+		videoKeyframes: session.videoKeyframes,
+		firstKeyframeAtMs: session.firstKeyframeAtMs,
+		maxKeyframeGapMs: session.maxKeyframeGapMs,
 		videoRtcpSrSent: session.videoRtcpSrSent,
 		audioRtcpSrSent: session.audioRtcpSrSent,
 		videoRtcpReceived: session.videoRtcpReceived,
@@ -40494,7 +42805,19 @@ function sessionSummaryMeta(session) {
 		audioReceiverReports: session.audioReceiverReports,
 		drops: session.drops,
 		ffmpegExit: session.ffmpegExit,
-		stopRequestedByController: session.stopRequestedByController
+		stopRequestedByController: session.stopRequestedByController,
+		videoLoopback: {
+			rcvbufRequestedBytes: session.videoLoopRcvbuf.requestedBytes,
+			rcvbufEffectiveBytes: session.videoLoopRcvbuf.effectiveBytes,
+			rcvbufClamped: session.videoLoopRcvbuf.clamped,
+			kernelDrops: session.videoLoopKernelDrops
+		},
+		audioLoopback: {
+			rcvbufRequestedBytes: session.audioLoopRcvbuf.requestedBytes,
+			rcvbufEffectiveBytes: session.audioLoopRcvbuf.effectiveBytes,
+			rcvbufClamped: session.audioLoopRcvbuf.clamped,
+			kernelDrops: session.audioLoopKernelDrops
+		}
 	});
 }
 /**
@@ -40508,6 +42831,7 @@ function armHeartbeat(session, log) {
 	const timer = setInterval(() => {
 		const forwarded = session.videoPacketsForwarded - lastVideo;
 		lastVideo = session.videoPacketsForwarded;
+		sampleLoopbackDrops(session);
 		log.info("export-hap: stream heartbeat", { meta: {
 			...sessionSummaryMeta(session),
 			videoPacketsSinceLastBeat: forwarded,
@@ -40546,6 +42870,7 @@ function stopHeartbeat(session) {
 */
 function logSessionSummary(session, log, trigger) {
 	session.endedAtMs = Date.now();
+	sampleLoopbackDrops(session);
 	log.info("export-hap: stream session summary", { meta: {
 		...sessionSummaryMeta(session),
 		trigger
@@ -40730,6 +43055,7 @@ async function handleStreamRequest(request, sessions, bctx, advertised) {
 		const hadFfmpeg = session.ffmpeg !== null;
 		killFfmpeg(session, bctx.ctx, bctx.numericDeviceId);
 		stopHeartbeat(session);
+		sampleLoopbackDrops(session);
 		if (!hadFfmpeg) logSessionSummary(session, log, "controller-stop-no-ffmpeg");
 		await closeIntercomTalkSession(session, bctx).catch(() => void 0);
 		closeSocket(session.videoUdp);
@@ -40839,7 +43165,7 @@ async function handleStreamRequest(request, sessions, bctx, advertised) {
 async function startFfmpegForSession(bctx, session, sessionId, video, advertised) {
 	const { ctx, proxy, numericDeviceId, options } = bctx;
 	const startLog = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const entries = await proxy.cameraStreams?.getProfileRtspEntries({}) ?? [];
+	const [entries, brokerStreams] = await Promise.all([(async () => await proxy.cameraStreams?.getProfileRtspEntries({}) ?? [])(), (async () => await proxy.cameraStreams?.getBrokerStreams({}) ?? [])()]);
 	if (entries.length === 0) {
 		startLog.warn("export-hap: stream start DROPPED — device publishes no profile RTSP entries", { meta: {
 			sessionId,
@@ -40848,16 +43174,21 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		throw new Error(`export-hap: no profile RTSP entries for device ${numericDeviceId}`);
 	}
 	const pref = options.hapDeviceSettings.streamPreference;
-	const brokerStreams = await proxy.cameraStreams?.getBrokerStreams({}) ?? [];
 	const bitrates = await probeProfileBitrates({
 		bctx,
 		slots: brokerStreams,
 		log: startLog
 	});
+	const connection = classifyConnection({
+		negotiatedWidth: video.width,
+		audioPacketTimeMs: session.negotiated?.audioPacketTimeMs ?? 20,
+		viaHomeHub: false
+	});
 	const fit = selectStreamForBudget({
 		entries: withSlotCodecs(entries, brokerStreams),
 		deviceId: numericDeviceId,
 		pref,
+		connection,
 		targetResolution: {
 			width: video.width,
 			height: video.height
@@ -40883,7 +43214,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	const resolvedFps = pickedProfile === null ? void 0 : advertised.fpsByProfile.get(pickedProfile);
 	const advertisedFps = resolvedFps?.fps ?? video.fps;
 	const advertisedFpsSource = resolvedFps?.source ?? "assumed";
-	const deliveredFps = needsTranscode ? deliverableFps(video.fps, resolvedFps?.fps ?? null) : advertisedFps;
+	const deliveredFps = needsTranscode ? video.fps : advertisedFps;
 	const slotEvidence = pickedProfile === null ? void 0 : bitrates.get(pickedProfile);
 	const fitNotes = formatFitNotes(fit.notes);
 	session.selectedSlot = {
@@ -40928,7 +43259,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	const audioLoopPort = session.audioLoopUdp.address().port;
 	const videoTarget = `rtp://127.0.0.1:${videoLoopPort}?pkt_size=${video.mtu}`;
 	const audioTarget = `rtp://127.0.0.1:${audioLoopPort}?pkt_size=${video.mtu}`;
-	const videoArgs = buildVideoEncodeArgs({
+	const videoPlan = buildVideoPlan({
 		transcode: needsTranscode,
 		width: video.width,
 		height: video.height,
@@ -40937,19 +43268,21 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	});
 	const hwDecode = selectHwDecode({
 		transcode: needsTranscode,
-		reading: needsTranscode ? await probeDecoderHwaccel({
-			ctx,
-			log: startLog
-		}) : null,
-		platform: process.platform
+		reading: needsTranscode ? await withDeadline(probeDecoderHwaccel({
+			source: decoderInfoSourceFromContext(ctx),
+			log: startLog,
+			memo: options.decodeMemos.reading
+		}), HWACCEL_PROBE_BUDGET_MS, null, () => startLog.warn("export-hap: hwaccel probe ABANDONED on its budget — decoding in SOFTWARE", { meta: { budgetMs: HWACCEL_PROBE_BUDGET_MS } })) : null,
+		platform: process.platform,
+		recentlyFailedBackend: options.decodeMemos.failedBackend.read() ?? null
 	});
 	logDecodePath(startLog, sessionId, hwDecode, needsTranscode);
 	const videoSsrcSigned = session.videoSsrc | 0;
 	const audioSsrcSigned = video.audio_ssrc | 0;
-	const buildArgs = (decodeArgs) => buildSessionFfmpegArgs({
-		decodeArgs,
+	const buildArgs = (decode) => buildFfmpegArgs(buildSessionInvocation({
+		decode,
 		rtspUrl,
-		videoArgs,
+		video: videoPlan,
 		videoTarget,
 		audioTarget,
 		videoPayloadType: video.pt,
@@ -40958,13 +43291,13 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		audioSsrcSigned,
 		audioPacketTimeMs: video.packet_time ?? 20,
 		audioSampleRateKhz: video.sample_rate ?? 16
-	});
+	}));
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	let hardwareAlreadyFailed = false;
 	const spawnFfmpeg = (decision) => {
 		const spawnedAtMs = Date.now();
 		const usedHardware = decision.kind === "hardware";
-		const proc = spawn("ffmpeg", buildArgs(decision.args), { stdio: [
+		const proc = spawn("ffmpeg", buildArgs(decision), { stdio: [
 			"ignore",
 			"ignore",
 			"pipe"
@@ -40987,6 +43320,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 				runtimeMs: Date.now() - spawnedAtMs
 			})) {
 				hardwareAlreadyFailed = true;
+				if (decision.kind === "hardware") options.decodeMemos.failedBackend.write(decision.backend);
 				log.warn("export-hap: hardware decode FAILED at init — respawning ffmpeg in software", { meta: {
 					sessionId,
 					backend: decision.kind === "hardware" ? decision.backend : null,
@@ -40996,11 +43330,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 					runtimeMs: Date.now() - spawnedAtMs
 				} });
 				if (session.ffmpeg === proc) session.ffmpeg = null;
-				spawnFfmpeg({
-					kind: "software",
-					reason: "hardware-attempt-failed",
-					args: []
-				});
+				spawnFfmpeg(software("hardware-attempt-failed"));
 				return;
 			}
 			onFfmpegExit(proc, code, signal);
@@ -41045,7 +43375,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		fitReason: fit.reason,
 		encodeBudgetKbps: fit.budgetKbps,
 		audioCodec: "opus",
-		audioBitrateKbps: 24,
+		audioBitrateKbps: OPUS_BITRATE_KBPS,
 		videoDecode: hwDecode.kind === "hardware" ? hwDecode.backend : "software"
 	} });
 }
@@ -41250,16 +43580,87 @@ function errMsg$8(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+//#region src/mappers/builders/doorbell-delivery.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function numberOrNull(value) {
+	return typeof value === "number" ? value : null;
+}
+function isConnectionLike(value) {
+	return isRecord(value) && typeof value["hasEventNotifications"] === "function";
+}
+function isIterable(value) {
+	return isRecord(value) && typeof value[Symbol.iterator] === "function";
+}
+/** `accessory._server.httpServer.connections`, or null at any missing hop. */
+function readConnections(accessory) {
+	if (!isRecord(accessory)) return null;
+	const server = accessory["_server"];
+	if (!isRecord(server)) return null;
+	const httpServer = server["httpServer"];
+	if (!isRecord(httpServer)) return null;
+	const connections = httpServer["connections"];
+	return isIterable(connections) ? connections : null;
+}
+/**
+* Probe how far a ring on `characteristic` of `accessory` can travel RIGHT NOW.
+* Pure with respect to HAP state — it only reads. Never throws.
+*/
+function describeDoorbellDelivery(accessory, characteristic) {
+	const aid = isRecord(accessory) ? numberOrNull(accessory["aid"]) : null;
+	const iid = isRecord(characteristic) ? numberOrNull(characteristic["iid"]) : null;
+	const serverPublished = isRecord(accessory) && isRecord(accessory["_server"]);
+	const connections = readConnections(accessory);
+	if (connections === null) return {
+		aid,
+		iid,
+		serverPublished,
+		connectionCount: 0,
+		subscriberCount: 0
+	};
+	let connectionCount = 0;
+	let subscriberCount = 0;
+	for (const connection of connections) {
+		connectionCount += 1;
+		if (aid === null || iid === null) continue;
+		if (isConnectionLike(connection) && connection.hasEventNotifications(aid, iid)) subscriberCount += 1;
+	}
+	return {
+		aid,
+		iid,
+		serverPublished,
+		connectionCount,
+		subscriberCount
+	};
+}
+/**
+* True when the ring provably reached nobody: no connection is subscribed to
+* the characteristic, so hap-nodejs dropped every event frame silently. The
+* caller must say so out loud — this is a branch that discards work.
+*/
+function ringReachedNobody(report) {
+	return report.subscriberCount === 0;
+}
+//#endregion
 //#region src/mappers/builders/doorbell.ts
 async function buildDoorbell(input) {
 	const { bctx, controller } = input;
 	const { ctx, numericDeviceId } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	log.info("export-hap: doorbell forward armed — HomeKit will ring on doorbell.onPressed");
 	const unsubscribe = ctx.eventBus.subscribe({ category: EventCategory.DoorbellOnPressed }, (event) => {
-		if (event.data.deviceId !== numericDeviceId) return;
+		if (event.data?.deviceId !== numericDeviceId) return;
 		try {
+			const delivery = describeDoorbellDelivery(bctx.accessory, bctx.accessory.getService(Service.Doorbell)?.getCharacteristic(Characteristic.ProgrammableSwitchEvent) ?? null);
 			controller.ringDoorbell();
+			if (ringReachedNobody(delivery)) {
+				log.warn("export-hap: doorbell rang but NO HomeKit controller is subscribed — the press was dropped before it left the hub (no home hub connected, or the accessory was republished and iOS has not re-subscribed yet)", { meta: { ...delivery } });
+				return;
+			}
+			log.info("export-hap: doorbell SINGLE_PRESS pushed to HomeKit", { meta: { ...delivery } });
 		} catch (err) {
-			ctx.logger.withTags({ deviceId: numericDeviceId }).warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$7(err) } });
+			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$7(err) } });
 		}
 	});
 	return { async dispose() {
@@ -41295,9 +43696,18 @@ async function buildIntercom(input) {
 *    (`proxy.motion.isDetected({})`) when the motion cap is bound.
 */
 var RESET_DEBOUNCE_MS = 5e3;
-async function buildMotionSensor(bctx) {
+/**
+* @param existing - The controller's OWN `MotionSensor`, when HomeKit Secure
+*  Video is advertised. HKSV derives its `EventTriggerOption.MOTION` from the
+*  service the `CameraController` created (`sensors: { motion: true }`) and is
+*  blind to any other one — a second MotionSensor added here would keep working
+*  as a sensor in the Home app while silently triggering no recording at all.
+*  `null` when recording is off, in which case this builder owns the service as
+*  it always has.
+*/
+async function buildMotionSensor(bctx, existing = null) {
 	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
-	const motionService = accessory.addService(Service.MotionSensor, hapServiceName([displayName], `Camera ${numericDeviceId}`));
+	const motionService = existing ?? accessory.addService(Service.MotionSensor, hapServiceName([displayName], `Camera ${numericDeviceId}`));
 	motionService.setCharacteristic(Characteristic.MotionDetected, false);
 	try {
 		const detected = await proxy.motion?.isDetected({});
@@ -41335,6 +43745,78 @@ function errMsg$6(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+//#region src/mappers/builders/service-label.ts
+/**
+* The ONE place a secondary service on the camera accessory gets its label.
+*
+* A "secondary service" here is a Switch or Lightbulb published alongside the
+* camera on the same accessory — the privacy switch, each accessory child
+* (siren, floodlight), each PTZ action. iOS Home renders these as their own
+* controls, and the operator has seen them as "Interruttore 1", "Interruttore
+* 2" through three separate rounds of fixes.
+*
+* ## Why `Name` alone cannot rename anything
+*
+* Two facts about hap-nodejs 2.1.7, both measured against the installed copy
+* rather than reasoned about:
+*
+*  1. `accessory.addService(Type, displayName, subtype)` ALREADY writes
+*     `displayName` to `Characteristic.Name` (`Service` constructor). So every
+*     round of this bug — including the one that moved the label onto
+*     `ConfiguredName` — shipped with `Name` correctly set. "iOS had no name
+*     to render" was never true.
+*  2. The mDNS configuration number (`c#`) is a sha1 over
+*     `internalHAPRepresentation(false)`, which OMITS characteristic VALUES.
+*     Changing the string in `Name` therefore does not bump `c#`, a paired
+*     controller gets no signal to re-read `/accessories`, and the name it
+*     cached at first enumeration stands forever.
+*
+* `Name` is also declared `pr` only — paired read, no write, no notify. It is
+* the seed a controller seeds its database from once; it is not a channel.
+*
+* ## Why `ConfiguredName`
+*
+* `ConfiguredName` (`000000E3`) is declared `pr | pw | ev` — the only name
+* characteristic a controller may write and may subscribe to. It is what iOS
+* 16+ reads for a service the user can rename, and adding it CHANGES the
+* accessory structure, so `c#` does bump and the controller re-reads.
+*
+* It was removed once because hap-nodejs logged
+*
+* ```
+* Characteristic not in required or optional characteristic section for
+* service Switch. Adding anyway.
+* ```
+*
+* That line is a WARNING, not a rejection: `Service.getCharacteristic` calls
+* `addCharacteristic` unconditionally and only then emits the warning. The
+* characteristic was always present and always published. hap-nodejs'
+* per-service optional lists simply predate `ConfiguredName` being valid on
+* any service.
+*
+* Registering it with {@link Service.addOptionalCharacteristic} first takes
+* the branch above the warning, so the accessory still builds with ZERO
+* characteristic warnings — which is what `service-naming.spec.ts` asserts.
+*
+* ## Scope
+*
+* Switch- and Lightbulb-shaped services only. `Service.MotionSensor` on a
+* camera accessory is not a separately named tile in iOS Home, so giving it a
+* writable name would be a guess, and this module does not guess.
+*/
+/**
+* Publish `name` as both the immutable `Name` and the controller-visible
+* `ConfiguredName` of `service`.
+*
+* `name` must already be HAP-valid — build it with `service-names.ts`, which
+* cannot return a string hap-nodejs' `checkName` would warn about.
+*/
+function applyServiceLabel(service, name) {
+	service.setCharacteristic(Characteristic.Name, name);
+	if (!service.optionalCharacteristics.some((characteristic) => characteristic.UUID === Characteristic.ConfiguredName.UUID)) service.addOptionalCharacteristic(Characteristic.ConfiguredName);
+	service.setCharacteristic(Characteristic.ConfiguredName, name);
+}
+//#endregion
 //#region src/mappers/builders/privacy-switch.ts
 /**
 * Privacy-mask switch builder — turns the camstack `privacy-mask` cap's
@@ -41352,12 +43834,12 @@ function errMsg$6(err) {
 * camera-enabled switch — distinct from privacy-mask).
 */
 async function buildPrivacySwitch(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const subtype = "privacy-mask";
-	const serviceName = privacyServiceName(displayName);
+	const serviceName = privacyServiceName();
 	const service = accessory.addService(Service.Switch, serviceName, subtype);
-	service.setCharacteristic(Characteristic.Name, serviceName);
+	applyServiceLabel(service, serviceName);
 	try {
 		const status = await proxy.privacyMask?.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(Characteristic.On, status.enabled);
@@ -41447,23 +43929,17 @@ function ptzPresetLabel(presetName) {
 *    `proxy.ptzAutotrack.setEnabled({enabled})`. Initial value is
 *    hydrated from `getStatus({})`.
 *
-* Naming: `<camera> <action>` — "Videocamera ingresso Preset stanza" — built
-* by `ptzServiceName` and written to the `Name` characteristic.
-*
-* TWO separate naming defects have been through this file, and both are fixed
-* by that one line:
-*  - `${displayName} — <action>` embedded an em-dash (U+2014), which is
-*    outside Apple's permitted set. hap-nodejs' `checkName` warned, iOS
-*    discarded the name and showed "Interruttore N". A previous round dropped
-*    the camera prefix along with the em-dash; only the em-dash was the fault.
-*  - The bare label that replaced it was then written to `ConfiguredName`,
-*    which `Service.Switch` does not list, so hap-nodejs rejected the
-*    characteristic outright — SIX rejections per PTZ camera per build, never
-*    reported because only the two switches on the non-PTZ camera were noticed.
+* Naming: the bare action — "Preset stanza", "Pan Left", "Autotrack" — built
+* by `ptzServiceName` and published through `applyServiceLabel`, which writes
+* it to BOTH `Name` and `ConfiguredName`. The camera name is deliberately not
+* prefixed — these eight services live on that camera's accessory and iOS
+* shows them there. THREE rounds of this bug have been through this file;
+* `service-label.ts` records what each got wrong, and why only the writable
+* characteristic can rename a service after pairing.
 */
 var MOMENTARY_RESET_MS = 1e3;
 async function buildPtz(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName, options } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId, options } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const timers = /* @__PURE__ */ new Set();
 	const armReset = (cb, delay) => {
@@ -41475,10 +43951,10 @@ async function buildPtz(bctx) {
 	};
 	const presets = await readPresets(bctx);
 	for (const preset of presets) {
-		const label = ptzServiceName(displayName, ptzPresetLabel(preset.name));
+		const label = ptzServiceName(ptzPresetLabel(preset.name));
 		const subtype = `ptz-preset-${preset.id}`;
 		const service = accessory.addService(Service.Switch, label, subtype);
-		service.setCharacteristic(Characteristic.Name, label);
+		applyServiceLabel(service, label);
 		service.getCharacteristic(Characteristic.On).onSet(async (value) => {
 			if (value !== true) return;
 			try {
@@ -41493,9 +43969,9 @@ async function buildPtz(bctx) {
 		});
 	}
 	if (proxy.ptz) for (const dir of PTZ_DIRECTIONS) {
-		const label = ptzServiceName(displayName, dir.label);
+		const label = ptzServiceName(dir.label);
 		const service = accessory.addService(Service.Switch, label, dir.subtype);
-		service.setCharacteristic(Characteristic.Name, label);
+		applyServiceLabel(service, label);
 		service.getCharacteristic(Characteristic.On).onSet(async (value) => {
 			if (value !== true) return;
 			try {
@@ -41539,12 +44015,12 @@ async function readPresets(bctx) {
 	}
 }
 async function tryBuildAutotrack(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId } = bctx;
 	if (!proxy.ptzAutotrack) return { async dispose() {} };
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const label = ptzServiceName(displayName, PTZ_AUTOTRACK_LABEL);
+	const label = ptzServiceName(PTZ_AUTOTRACK_LABEL);
 	const service = accessory.addService(Service.Switch, label, "ptz-autotrack");
-	service.setCharacteristic(Characteristic.Name, label);
+	applyServiceLabel(service, label);
 	try {
 		const status = await proxy.ptzAutotrack.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(Characteristic.On, status.enabled);
@@ -41627,6 +44103,814 @@ async function probe(call, label, log) {
 	}
 }
 //#endregion
+//#region src/hksv/recording-options.ts
+/**
+* The HomeKit Secure Video ADVERTISEMENT — `CameraRecordingOptions`, derived
+* from what the fMP4 sink will actually produce for THIS camera.
+*
+* ## The rule this file exists to enforce
+*
+* Never advertise something we cannot serve. That is not a slogan here: it is
+* the diagnosis of [D50](../../../../docs/decisions/adr-0050.md) — an
+* advertised `recording` whose delegate yielded nothing put every motion-capable
+* camera into a ~12 s timeout loop every 20-60 s, all day. So every number below
+* is derived from the picked source (`recording-source.ts`) or from a measured
+* property of the sink, and none of them is a plausible-looking constant.
+*
+* ## The fragment length is the subtle one
+*
+* HKSV requires every media fragment to be **no longer** than the length the
+* controller selected. On the copy branch the fragment length is the SOURCE's
+* key-frame cadence ([D80](../../../../docs/decisions/adr-0080.md)) — we do not
+* get to choose it, we can only be honest about it. So:
+*
+*  - when the camera reports its GOP (`stream-params`), the advertised length is
+*    the smallest offered value that COVERS it;
+*  - when it does not, we advertise the 4000 ms every HKSV camera uses and the
+*    delegate warns at `warn` with `tags: { deviceId }` if the fragments that
+*    actually arrive are longer.
+*
+* A camera whose GOP exceeds the longest value we offer does not advertise
+* recording at all. See {@link deriveFragmentLengthMs}.
+*/
+/**
+* The prebuffer we promise. HAP's floor is 4000 ms and its documented sensible
+* range is [4000, 8000]; the plane's ring is sized from this, so the two cannot
+* disagree. Asking for more than we retain would be the same lie in the other
+* direction.
+*/
+var HKSV_PREBUFFER_MS = 4e3;
+/**
+* The fragment lengths we are willing to advertise, shortest first. 4000 ms is
+* what every shipping HKSV camera uses; 8000 exists for a camera whose GOP is
+* 8 s, which is common enough on this fleet's defaults to be worth covering
+* rather than refusing.
+*/
+var HKSV_FRAGMENT_LENGTHS_MS = [4e3, 8e3];
+/**
+* AAC-LC at 24 kHz mono. Fixed rather than negotiated: an fMP4 fragment carries
+* its audio in-band, so unlike the live SRTP path there is no second plane on
+* which to answer a different sample rate, and D80 records that HKSV takes AAC
+* and nothing else.
+*/
+var HKSV_AUDIO_SAMPLE_RATE_HZ = 24e3;
+/**
+* The advertised fragment length for a camera whose key-frame cadence is
+* `sourceGopMs`, or `null` when no offered length covers it.
+*
+* `undefined` — the camera does not report a GOP — takes the shortest offered
+* length. That is a guess, and it is the RIGHT guess (4 s is the near-universal
+* default), but it is a guess: the delegate measures the arriving cadence and
+* says so when reality disagrees.
+*/
+function deriveFragmentLengthMs(sourceGopMs) {
+	const shortest = HKSV_FRAGMENT_LENGTHS_MS[0];
+	if (shortest === void 0) return null;
+	if (sourceGopMs === void 0 || sourceGopMs <= 0) return shortest;
+	return HKSV_FRAGMENT_LENGTHS_MS.find((ms) => ms >= sourceGopMs) ?? null;
+}
+/**
+* Build the advertisement.
+*
+* ONE resolution is advertised — the one slot the recording child pulls. HAP's
+* documentation lists 1920×1080 and 1280×720 as "required to be supported", and
+* listing both when the source is only one of them is precisely the D50 failure
+* in miniature: iOS would select a configuration we then cannot deliver, on the
+* copy branch, with no encoder to resize with.
+*/
+function buildRecordingOptions(input) {
+	const resolution = [
+		input.width,
+		input.height,
+		Math.max(1, Math.round(input.fps))
+	];
+	return {
+		prebufferLength: HKSV_PREBUFFER_MS,
+		mediaContainerConfiguration: {
+			type: MediaContainerType.FRAGMENTED_MP4,
+			fragmentLength: input.fragmentLengthMs
+		},
+		video: {
+			type: VideoCodecType.H264,
+			parameters: {
+				profiles: [
+					H264Profile.BASELINE,
+					H264Profile.MAIN,
+					H264Profile.HIGH
+				],
+				levels: [
+					H264Level.LEVEL3_1,
+					H264Level.LEVEL3_2,
+					H264Level.LEVEL4_0
+				]
+			},
+			resolutions: [resolution]
+		},
+		audio: { codecs: [{
+			type: AudioRecordingCodecType.AAC_LC,
+			audioChannels: 1,
+			bitrateMode: AudioBitrate.VARIABLE,
+			samplerate: [AudioRecordingSamplerate.KHZ_24]
+		}] }
+	};
+}
+//#endregion
+//#region src/hksv/fragment-source.ts
+/**
+* How far back the prebuffer ring reaches.
+*
+* Twice {@link HKSV_PREBUFFER_MS}, and the factor is structural rather than
+* generous: the ring holds WHOLE fragments, so a window of exactly 4 s can hold
+* a single 4 s fragment that is about to age out — a trigger landing a moment
+* later would replay nothing. Two fragment lengths guarantee at least one
+* covering fragment at every instant.
+*/
+var PREBUFFER_WINDOW_MS = HKSV_PREBUFFER_MS * 2;
+/**
+* The ring's hard byte ceiling, per camera.
+*
+* Measured fragment sizes on this fleet: ~145 KB for 4 s at 720p, ~3.6 MB for
+* 4 s at 4K. 16 MB covers two 4K fragments with room and bounds the exporter's
+* heap at a figure an operator can multiply by the camera count — which is the
+* number a time-only bound refuses to give.
+*/
+var PREBUFFER_MAX_BYTES = 16 * 1024 * 1024;
+/** Backoff after a child that died while live. Bounded, never a tight loop. */
+var RESPAWN_BACKOFF_MS = [
+	2e3,
+	5e3,
+	15e3,
+	3e4
+];
+var HksvFragmentSource = class {
+	input;
+	plane = null;
+	child = null;
+	stopped = false;
+	starting = null;
+	respawnAttempt = 0;
+	respawnTimer = null;
+	audioActive;
+	log;
+	constructor(input) {
+		this.input = input;
+		this.audioActive = input.audioActive;
+		this.log = input.logger;
+	}
+	/** True once a child has produced its initialisation segment. */
+	get isRunning() {
+		return this.child !== null && this.plane !== null && !this.plane.isEnded;
+	}
+	/**
+	* Spawn the child and start filling the ring. Idempotent, and concurrent
+	* calls share one attempt — `updateRecordingActive(true)` and a stream
+	* request can arrive in either order.
+	*/
+	async start() {
+		if (this.stopped) throw new Error("hksv fragment source: already stopped");
+		if (this.isRunning) return;
+		const inflight = this.starting;
+		if (inflight !== null) return inflight;
+		const attempt = this.spawn();
+		this.starting = attempt;
+		try {
+			await attempt;
+		} finally {
+			this.starting = null;
+		}
+	}
+	/** Stop the child, end the plane, forget the ring. Idempotent. */
+	async stop(reason) {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.clearRespawn();
+		this.log.info("hksv fragment source: stopping", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				reason,
+				brokerId: this.input.source.brokerId
+			}
+		});
+		const child = this.child;
+		this.child = null;
+		if (child) await child.stop();
+		this.plane?.dispose();
+		this.plane = null;
+	}
+	/**
+	* iOS turned recording audio on or off. Respawns onto the other url when it
+	* genuinely changed — the fragments themselves must carry or omit the track,
+	* there is nothing to strip downstream.
+	*/
+	async setAudioActive(active) {
+		if (active === this.audioActive) return;
+		this.audioActive = active;
+		this.log.info("hksv fragment source: RecordingAudioActive changed — respawning the child", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				audioActive: active,
+				brokerId: this.input.source.brokerId
+			}
+		});
+		if (!this.isRunning) return;
+		const child = this.child;
+		this.child = null;
+		if (child) await child.stop();
+		this.plane?.dispose();
+		this.plane = null;
+		await this.start();
+	}
+	/**
+	* Subscribe to the live fragments, replaying the prebuffer first.
+	*
+	* Returns `null` when there is no plane — the caller MUST treat that as
+	* "cannot serve this recording" rather than opening an HDS stream it cannot
+	* feed, which is the D50 failure exactly.
+	*/
+	subscribe(tag) {
+		const plane = this.plane;
+		if (plane === null || plane.isEnded) return null;
+		const stats = plane.prebufferStats();
+		this.log.info("hksv fragment source: subscribing a recording stream", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				tag,
+				prebufferFragments: stats.fragments,
+				prebufferBytes: stats.bytes,
+				prebufferSpanMs: stats.spanMs
+			}
+		});
+		return plane.subscribe({
+			tag,
+			withPrebuffer: true
+		});
+	}
+	/** What the ring holds — surfaced so the delegate can log what it served. */
+	prebufferSpanMs() {
+		return this.plane?.prebufferStats().spanMs ?? 0;
+	}
+	async spawn() {
+		const plane = new Fmp4FragmentPlane(this.log.child("hksv-plane"), {
+			windowMs: PREBUFFER_WINDOW_MS,
+			maxBytes: PREBUFFER_MAX_BYTES
+		}, this.input.now ?? Date.now);
+		const child = new Fmp4FragmentChild({
+			logger: this.log.child("hksv-fmp4"),
+			ffmpegBinaryPath: this.input.ffmpegBinaryPath,
+			spawnFn: this.input.spawnFn,
+			onChildExit: (error) => this.onChildExit(error)
+		}, {
+			sourceId: `hksv/${this.input.deviceId}`,
+			deviceId: this.input.deviceId,
+			fragmentMs: this.input.fragmentMs,
+			invocation: this.buildInvocation(),
+			plane
+		});
+		this.plane = plane;
+		this.child = child;
+		try {
+			await child.start();
+			this.respawnAttempt = 0;
+			this.log.info("hksv fragment source: prebuffer running", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					brokerId: this.input.source.brokerId,
+					resolution: `${this.input.source.width}x${this.input.source.height}`,
+					fragmentMs: this.input.fragmentMs,
+					audioActive: this.audioActive,
+					windowMs: PREBUFFER_WINDOW_MS
+				}
+			});
+		} catch (err) {
+			this.plane = null;
+			this.child = null;
+			plane.dispose();
+			throw err;
+		}
+	}
+	/**
+	* The child died while live. The prebuffer is gone with it — and saying so is
+	* the point: a source that silently stopped filling reads, from the delegate,
+	* exactly like a camera nothing ever happens on.
+	*/
+	onChildExit(error) {
+		if (this.stopped) return;
+		this.child = null;
+		this.plane = null;
+		const delay = RESPAWN_BACKOFF_MS[Math.min(this.respawnAttempt, RESPAWN_BACKOFF_MS.length - 1)];
+		this.respawnAttempt += 1;
+		this.log.warn("hksv fragment source: the child DIED — the prebuffer is empty until it respawns", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				brokerId: this.input.source.brokerId,
+				attempt: this.respawnAttempt,
+				respawnInMs: delay,
+				error: error.message
+			}
+		});
+		this.clearRespawn();
+		const schedule = this.input.setTimeoutFn ?? setTimeout;
+		this.respawnTimer = schedule(() => {
+			this.respawnTimer = null;
+			if (this.stopped) return;
+			this.start().catch((err) => {
+				this.log.warn("hksv fragment source: respawn failed", {
+					tags: { deviceId: this.input.deviceId },
+					meta: {
+						brokerId: this.input.source.brokerId,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			});
+		}, delay ?? 3e4);
+		this.respawnTimer?.unref?.();
+	}
+	clearRespawn() {
+		if (this.respawnTimer !== null) {
+			clearTimeout(this.respawnTimer);
+			this.respawnTimer = null;
+		}
+	}
+	/**
+	* The invocation, minus the sink the child owns.
+	*
+	* `kind: 'copy'` is not a preference: it is the 128× measurement, and it is
+	* why `pickRecordingSource` refuses a camera whose only slots are H.265. The
+	* audio IS encoded — the source mic is G.711/PCM depending on vendor and HKSV
+	* takes AAC only — which the same measurement priced at 0.4 % of a core.
+	*/
+	buildInvocation() {
+		const audio = this.audioActive ? {
+			kind: "encode",
+			codec: "aac",
+			bitrateKbps: 32,
+			sampleRateHz: HKSV_AUDIO_SAMPLE_RATE_HZ,
+			channels: 1
+		} : { kind: "none" };
+		return {
+			logLevel: "error",
+			decodeHwAccel: null,
+			input: {
+				url: this.audioActive ? this.input.source.url : this.input.source.mutedUrl,
+				rtspTransport: "tcp",
+				analyzeDurationUs: 1e6,
+				probeSizeBytes: 1e6
+			},
+			video: { kind: "copy" },
+			audio,
+			threadCount: 0,
+			outputArgs: []
+		};
+	}
+};
+//#endregion
+//#region src/hksv/recording-delegate.ts
+/**
+* `HDSProtocolSpecificErrorReason` is a `const enum`, so there is no reverse
+* map to index — and a bare number in the log is the difference between "iOS
+* closed it normally" and "iOS rejected our data", which is the whole reason
+* this line exists.
+*/
+var HDS_REASON_NAMES = {
+	[HDSProtocolSpecificErrorReason.NORMAL]: "normal",
+	[HDSProtocolSpecificErrorReason.NOT_ALLOWED]: "not-allowed",
+	[HDSProtocolSpecificErrorReason.BUSY]: "busy",
+	[HDSProtocolSpecificErrorReason.CANCELLED]: "cancelled",
+	[HDSProtocolSpecificErrorReason.UNSUPPORTED]: "unsupported",
+	[HDSProtocolSpecificErrorReason.UNEXPECTED_FAILURE]: "unexpected-failure",
+	[HDSProtocolSpecificErrorReason.TIMEOUT]: "timeout",
+	[HDSProtocolSpecificErrorReason.BAD_DATA]: "bad-data",
+	[HDSProtocolSpecificErrorReason.PROTOCOL_ERROR]: "protocol-error",
+	[HDSProtocolSpecificErrorReason.INVALID_CONFIGURATION]: "invalid-configuration"
+};
+function hdsReasonName(reason) {
+	return HDS_REASON_NAMES[reason] ?? `unknown(${String(reason)})`;
+}
+var HksvRecordingDelegate = class {
+	input;
+	active = false;
+	configuration = void 0;
+	source = null;
+	log;
+	/** The stream currently being yielded, so `closeRecordingStream` can end it. */
+	open = null;
+	constructor(input) {
+		this.input = input;
+		this.log = input.logger;
+	}
+	/** Test/diagnostic view — the prebuffer is running for this camera. */
+	get prebufferRunning() {
+		return this.source?.isRunning === true;
+	}
+	updateRecordingActive(active) {
+		if (active === this.active) return;
+		this.active = active;
+		this.log.info("hksv: recording active changed", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				active,
+				hasConfiguration: this.configuration !== void 0
+			}
+		});
+		this.reconcile("recording-active");
+	}
+	updateRecordingConfiguration(configuration) {
+		this.configuration = configuration;
+		if (configuration === void 0) {
+			this.log.info("hksv: the selected configuration was CLEARED — stopping the prebuffer", { tags: { deviceId: this.input.deviceId } });
+			this.reconcile("configuration-cleared");
+			return;
+		}
+		const selectedMs = configuration.mediaContainerConfiguration.fragmentLength;
+		this.log.info("hksv: iOS selected a recording configuration", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				fragmentLengthMs: selectedMs,
+				prebufferLengthMs: configuration.prebufferLength,
+				resolution: configuration.videoCodec.resolution.join("x"),
+				audioCodec: configuration.audioCodec.type,
+				eventTriggers: configuration.eventTriggerTypes
+			}
+		});
+		if (selectedMs < this.input.advertisedFragmentMs) this.log.warn("hksv: iOS selected a SHORTER fragment length than the source can cut", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				selectedMs,
+				advertisedMs: this.input.advertisedFragmentMs
+			}
+		});
+		this.reconcile("configuration-selected");
+	}
+	async *handleRecordingStreamRequest(streamId, signal) {
+		const source = this.source;
+		if (source === null || !source.isRunning) {
+			this.log.warn("hksv: recording stream requested with NO prebuffer running — refusing", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					streamId,
+					active: this.active,
+					hasConfiguration: this.configuration !== void 0
+				}
+			});
+			throw new HDSProtocolError(HDSProtocolSpecificErrorReason.NOT_ALLOWED);
+		}
+		const subscription = source.subscribe(`hksv/${this.input.deviceId}#${streamId}`);
+		if (subscription === null) {
+			this.log.warn("hksv: the fragment plane refused a subscription — refusing the stream", {
+				tags: { deviceId: this.input.deviceId },
+				meta: { streamId }
+			});
+			throw new HDSProtocolError(HDSProtocolSpecificErrorReason.NOT_ALLOWED);
+		}
+		this.open = {
+			streamId,
+			subscription
+		};
+		const startedAt = Date.now();
+		const prebufferSpanMs = source.prebufferSpanMs();
+		let packets = 0;
+		let bytes = 0;
+		let markedLast = false;
+		let longestFragmentGapMs = 0;
+		let lastPacketAt = startedAt;
+		try {
+			for await (const packet of subscription.packets()) {
+				if (signal?.aborted === true) {
+					this.log.info("hksv: the recording stream was aborted — ending the generator", {
+						tags: { deviceId: this.input.deviceId },
+						meta: {
+							streamId,
+							packets
+						}
+					});
+					return;
+				}
+				packets += 1;
+				bytes += packet.data.length;
+				if (packet.kind === "fragment") {
+					const now = Date.now();
+					longestFragmentGapMs = Math.max(longestFragmentGapMs, now - lastPacketAt);
+					lastPacketAt = now;
+				}
+				markedLast = markedLast || packet.isLast;
+				yield {
+					data: Buffer.from(packet.data),
+					isLast: packet.isLast
+				};
+				if (packet.isLast) return;
+			}
+			if (!markedLast && subscription.closedReason !== "released") {
+				this.log.warn("hksv: the fragment stream ended without a final packet", {
+					tags: { deviceId: this.input.deviceId },
+					meta: {
+						streamId,
+						packets,
+						closedReason: subscription.closedReason,
+						truncated: subscription.closedReason === "slow-consumer"
+					}
+				});
+				if (packets === 0) throw new HDSProtocolError(HDSProtocolSpecificErrorReason.UNEXPECTED_FAILURE);
+				yield {
+					data: Buffer.alloc(0),
+					isLast: true
+				};
+			}
+		} finally {
+			subscription.release();
+			if (this.open?.streamId === streamId) this.open = null;
+			const fragmentOverrun = longestFragmentGapMs > this.input.advertisedFragmentMs * 1.5;
+			this.log.info("hksv: recording stream finished", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					streamId,
+					packets,
+					bytes,
+					durationMs: Date.now() - startedAt,
+					prebufferSpanMs,
+					longestFragmentGapMs,
+					closedReason: subscription.closedReason,
+					markedLast
+				}
+			});
+			if (fragmentOverrun) this.log.warn("hksv: fragments arrived LONGER than the advertised length", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					longestFragmentGapMs,
+					advertisedMs: this.input.advertisedFragmentMs
+				}
+			});
+		}
+	}
+	acknowledgeStream(streamId) {
+		this.log.info("hksv: iOS acknowledged the end of stream — the clip landed", {
+			tags: { deviceId: this.input.deviceId },
+			meta: { streamId }
+		});
+	}
+	closeRecordingStream(streamId, reason) {
+		this.log.info("hksv: the recording stream was closed by the controller", {
+			tags: { deviceId: this.input.deviceId },
+			meta: {
+				streamId,
+				reason: reason === void 0 ? "connection-closed" : hdsReasonName(reason)
+			}
+		});
+		const open = this.open;
+		if (open?.streamId === streamId) {
+			open.subscription.release();
+			this.open = null;
+		}
+	}
+	/** Tear the prebuffer down — the accessory is being unexposed. */
+	async dispose() {
+		this.open?.subscription.release();
+		this.open = null;
+		const source = this.source;
+		this.source = null;
+		if (source) await source.stop("accessory disposed");
+	}
+	/**
+	* Start the prebuffer when iOS wants recording AND has chosen how, stop it
+	* otherwise. Called from every state edge rather than each edge deciding for
+	* itself: the two characteristics arrive in an order hap-nodejs explicitly
+	* does not guarantee, and a per-edge decision has to re-derive the same
+	* conjunction in two places.
+	*/
+	async reconcile(trigger) {
+		if (!(this.active && this.configuration !== void 0)) {
+			const source = this.source;
+			this.source = null;
+			if (source) await source.stop(`recording no longer wanted (${trigger})`);
+			return;
+		}
+		const configuration = this.configuration;
+		if (configuration === void 0) return;
+		const audioActive = this.input.isAudioActive();
+		const existing = this.source;
+		if (existing !== null) {
+			await existing.setAudioActive(audioActive);
+			if (!existing.isRunning) await existing.start();
+			return;
+		}
+		const source = this.input.createSource({
+			fragmentMs: configuration.mediaContainerConfiguration.fragmentLength,
+			audioActive
+		});
+		this.source = source;
+		try {
+			await source.start();
+		} catch (err) {
+			this.source = null;
+			this.log.error("hksv: the prebuffer FAILED to start — this camera will record nothing", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					trigger,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/hksv/recording-source.ts
+/** The tallest frame the recording path will hold in its prebuffer. */
+var MAX_RECORDING_HEIGHT = 1080;
+/** HKSV takes H.264 only — AAC audio and H.264 video, no negotiation. */
+var RECORDABLE_CODEC = "h264";
+/**
+* Pick the slot the recording child pulls.
+*
+* Deliberately NOT `pickPreferredRtspEntry`: that picker resolves the operator's
+* LIVE preference and, on `auto`, steers by the resolution iOS negotiated for a
+* live session — neither is a fact about recording, and on 615 it selects `mid`,
+* a 10 fps slot. Recording has one criterion, applied here and nowhere else:
+* the largest copyable frame that does not exceed {@link MAX_RECORDING_HEIGHT}.
+*/
+function pickRecordingSource(entries) {
+	const enabled = entries.filter((e) => e.enabled);
+	if (enabled.length === 0) return {
+		ok: false,
+		refusal: "no-enabled-stream"
+	};
+	const h264 = enabled.filter((e) => normaliseCodec(e.codec) === RECORDABLE_CODEC);
+	if (h264.length === 0) return {
+		ok: false,
+		refusal: "no-h264-stream"
+	};
+	const sized = h264.filter(hasUsableResolution);
+	if (sized.length === 0) return {
+		ok: false,
+		refusal: "no-resolution"
+	};
+	const withinCeiling = sized.filter((e) => height(e) <= MAX_RECORDING_HEIGHT);
+	const best = [...withinCeiling.length > 0 ? withinCeiling : sized].sort((a, b) => withinCeiling.length > 0 ? height(b) - height(a) : height(a) - height(b))[0];
+	if (best === void 0 || best.resolution === void 0) return {
+		ok: false,
+		refusal: "no-resolution"
+	};
+	return {
+		ok: true,
+		source: {
+			brokerId: best.brokerId,
+			profile: best.profile ?? best.brokerId,
+			url: best.url,
+			mutedUrl: best.mutedUrl,
+			width: best.resolution.width,
+			height: best.resolution.height
+		}
+	};
+}
+/** A one-line reason for the log — silence about a withdrawn service reads as a bug. */
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "no-enabled-stream": return "the camera has no enabled RTSP profile";
+		case "no-h264-stream": return "every enabled profile is H.265 — HKSV takes H.264 only, and a permanent transcode costs 128x a copy";
+		case "no-resolution": return "no enabled profile declares a resolution, so nothing honest could be advertised";
+	}
+}
+function height(entry) {
+	return entry.resolution?.height ?? 0;
+}
+function hasUsableResolution(entry) {
+	const r = entry.resolution;
+	return r !== void 0 && r.width > 0 && r.height > 0;
+}
+/** Publishers spell H.265 four ways; the same normalisation the broker uses. */
+function normaliseCodec(codec) {
+	return (codec ?? "").toLowerCase().replace(/[.\s-]/g, "");
+}
+//#endregion
+//#region src/hksv/build-recording.ts
+/**
+* Assemble HomeKit Secure Video for one camera — the ADVERTISEMENT and the
+* DELEGATE, together, or neither.
+*
+* That pairing is the whole rule and it is why nothing shipped for HKSV before
+* this: `recording` is optional on `CameraControllerOptions`, and passing it IS
+* the entire user-visible change. There is no "phase 1 behind a flag" for an
+* advertisement — either iOS is offered a recording toggle backed by a delegate
+* that yields real fragments, or the services are not on the accessory at all
+* ([D50](../../../../docs/decisions/adr-0050.md)).
+*
+* So this returns `null` for every reason a camera cannot record, and each of
+* them is logged at `info`/`warn` with `tags: { deviceId }`. A withdrawn
+* capability that says nothing is indistinguishable from a bug — and on this
+* surface the operator's first question is always "why does 617 have it and 615
+* not?".
+*/
+/**
+* The ffmpeg on `PATH`, exactly as the live streaming path resolves it
+* (`camera-streams.ts` spawns `'ffmpeg'`). One resolution per addon, not two.
+*/
+var FFMPEG_BINARY = "ffmpeg";
+/** Fallback when nothing measured a rate for the picked slot. */
+var ASSUMED_RECORDING_FPS = 15;
+async function buildHksvRecording(input) {
+	const { bctx } = input;
+	const { ctx, numericDeviceId } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const entries = await readProfileEntries(bctx);
+	if (entries === null) {
+		log.warn("export-hap: HKSV withheld — could not read the camera profiles", {});
+		return null;
+	}
+	const choice = pickRecordingSource(entries);
+	if (!choice.ok) {
+		log.info("export-hap: HKSV withheld — no recordable stream", { meta: {
+			refusal: choice.refusal,
+			reason: refusalReason(choice.refusal)
+		} });
+		return null;
+	}
+	const source = choice.source;
+	const gopMs = await readSourceGopMs(bctx, source.width, source.height);
+	const fragmentLengthMs = deriveFragmentLengthMs(gopMs);
+	if (fragmentLengthMs === null) {
+		log.warn("export-hap: HKSV withheld — the camera key-frame interval is longer than any fragment length we advertise", { meta: {
+			gopMs,
+			brokerId: source.brokerId
+		} });
+		return null;
+	}
+	const fps = resolveFps(input.fpsByProfile, source.profile);
+	const options = buildRecordingOptions({
+		width: source.width,
+		height: source.height,
+		fps,
+		fragmentLengthMs
+	});
+	const delegate = new HksvRecordingDelegate({
+		logger: log,
+		deviceId: numericDeviceId,
+		isAudioActive: input.isAudioActive,
+		advertisedFragmentMs: fragmentLengthMs,
+		createSource: ({ fragmentMs, audioActive }) => new HksvFragmentSource({
+			logger: log,
+			deviceId: numericDeviceId,
+			ffmpegBinaryPath: FFMPEG_BINARY,
+			spawnFn: spawn,
+			source,
+			fragmentMs,
+			audioActive
+		})
+	});
+	log.info("export-hap: HKSV ADVERTISED — recording is offered for this camera", { meta: {
+		brokerId: source.brokerId,
+		profile: source.profile,
+		resolution: `${source.width}x${source.height}`,
+		fps,
+		fragmentLengthMs,
+		sourceGopMs: gopMs ?? "unknown"
+	} });
+	return {
+		options,
+		delegate,
+		dispose: () => delegate.dispose()
+	};
+}
+/** `cameraStreams.getProfileRtspEntries`, or `null` when the cap is unreachable. */
+async function readProfileEntries(bctx) {
+	try {
+		return await bctx.proxy.cameraStreams?.getProfileRtspEntries({}) ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The camera's own key-frame interval in ms, from `stream-params`, matched to
+* the picked slot BY RESOLUTION.
+*
+* By resolution and not by name on purpose: `stream-params` names its profiles
+* `main`/`sub`/`ext` while the broker names its slots `high`/`mid`/`low`, and
+* on 615 `ext` is the 1280×720 slot the broker calls `mid` — a name-based match
+* would silently read the 4K slot's GOP for a 720p recording.
+*
+* `undefined` when the cap is not bound, which is most non-Hikvision providers.
+*/
+async function readSourceGopMs(bctx, width, height) {
+	try {
+		const status = await bctx.proxy.streamParams?.getStatus({});
+		if (!status) return void 0;
+		for (const profile of [
+			status.main,
+			status.sub,
+			status.ext
+		]) {
+			if (!profile) continue;
+			if (profile.width !== width || profile.height !== height) continue;
+			const { gop, framerate } = profile;
+			if (gop === void 0 || gop <= 0 || framerate <= 0) return void 0;
+			return Math.round(gop / framerate * 1e3);
+		}
+		return;
+	} catch {
+		return;
+	}
+}
+function resolveFps(fpsByProfile, profile) {
+	return fpsByProfile.get(profile)?.fps ?? ASSUMED_RECORDING_FPS;
+}
+//#endregion
 //#region src/mappers/builders/child-switch.ts
 /**
 * Child-switch builder — turns a camstack accessory child device (siren,
@@ -41671,7 +44955,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 	const isLightingDevice = deviceType === DeviceType.Light || deviceType === DeviceType.Generic;
 	const useLightbulb = hasBrightness && isLightingDevice;
 	const service = useLightbulb ? accessory.addService(Service.Lightbulb, displayName, subtype) : accessory.addService(Service.Switch, displayName, subtype);
-	service.setCharacteristic(Characteristic.Name, displayName);
+	applyServiceLabel(service, displayName);
 	try {
 		const switchStatus = await proxy.switch?.getStatus({});
 		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(Characteristic.On, switchStatus.on);
@@ -41832,19 +45116,39 @@ async function buildCameraAccessory(input) {
 		displayName,
 		options
 	};
-	const streams = buildCameraStreamingDelegate(bctx, await probeAdvertisedVideoProfile(bctx));
+	const advertisedVideo = await probeAdvertisedVideoProfile(bctx);
+	const streams = buildCameraStreamingDelegate(bctx, advertisedVideo);
 	const handles = [];
 	if (capNames.has("intercom")) handles.push(await buildIntercom({
 		bctx,
 		streamingOptions: streams.streamingOptions
 	}));
+	const recordingEnabled = options.hapDeviceSettings.hksvRecording === true;
+	let recordingAudioActive = true;
+	const recording = recordingEnabled ? await buildHksvRecording({
+		bctx,
+		fpsByProfile: advertisedVideo.fpsByProfile,
+		isAudioActive: () => recordingAudioActive
+	}) : null;
 	const controller = new (isDoorbell ? DoorbellController : CameraController)({
 		delegate: streams.delegate,
 		streamingOptions: streams.streamingOptions,
-		cameraStreamCount: 2
+		cameraStreamCount: 2,
+		...recording === null ? {} : { recording },
+		...recording === null || !capNames.has("motion-detection") ? {} : { sensors: { motion: true } }
 	});
 	accessory.configureController(controller);
-	if (capNames.has("motion-detection")) handles.push(await buildMotionSensor(bctx));
+	if (recording !== null) {
+		handles.push({ dispose: () => recording.dispose() });
+		const audioCharacteristic = (controller.recordingManagement?.operatingModeService)?.getCharacteristic(Characteristic.RecordingAudioActive);
+		if (audioCharacteristic) {
+			recordingAudioActive = audioCharacteristic.value !== 0 && audioCharacteristic.value !== false;
+			audioCharacteristic.on("change", ({ newValue }) => {
+				recordingAudioActive = newValue !== 0 && newValue !== false;
+			});
+		}
+	}
+	if (capNames.has("motion-detection")) handles.push(await buildMotionSensor(bctx, recording === null ? null : controller.motionService ?? null));
 	if (isDoorbell && controller instanceof DoorbellController) handles.push(await buildDoorbell({
 		bctx,
 		controller
@@ -41911,6 +45215,118 @@ function pickMapperKind(_capabilities) {
 	return "camera";
 }
 //#endregion
+//#region src/mappers/builders/stream-hwaccel-memo.ts
+/**
+* The two bounded memos HomeKit's decode path owns.
+*
+* ## Why they exist
+*
+* Everything D67 was actually about — one argv builder, one set of constants,
+* one hwaccel authority — HomeKit already had. What it did NOT have were the
+* two things the broker gained alongside them:
+*
+*  1. **A memo.** `probeDecoderHwaccel` issued a cross-process
+*     `decoder.getInfo` per SESSION. iOS starts sessions in bursts — one on
+*     record was started three times in 16 s — and every one of those paid a
+*     cap call on a hub whose main thread is the scarce resource.
+*  2. **Failure feedback.** When HomeKit's hardware child died at init and
+*     `shouldRetryInSoftware` saved the session, HomeKit told nobody. The next
+*     session re-picked the same corpse and paid the same two-second death.
+*     `EgressTranscodeManager` fixed exactly this for its own children
+*     (26a522cd5) by reporting the dead backend into the broker's 60 s memo.
+*
+* ## Both ride `HwAccelCache`, deliberately
+*
+* `createHwAccelCache` from `@camstack/types` is the primitive the broker's own
+* `egressHwAccelCache` is built from, and the discipline it encodes is the
+* point: **caller-owned, never a module global** — a module global would
+* outlive an addon respawn and survive an operator changing the decoder
+* backend. Same TTL as the broker's, so "has hardware come back yet" cannot
+* answer differently depending on which consumer asked.
+*
+* ## The cross-process gap, stated honestly
+*
+* These memos are scoped to the `export-hap` PROCESS. When HomeKit's vaapi
+* child dies, the broker's next child still pays its own two-second death, and
+* vice versa — because addons may never import each other and there is no
+* capability for "this backend is dead on this node right now". Closing that
+* would need a new cap surface, which Phase 0 explicitly does not take. What is
+* closed here is HomeKit's own repetition of the cost, across cameras and
+* across sessions.
+*/
+/**
+* The window both memos answer for.
+*
+* 60 s, the same as `stream-broker-manager`'s `egressHwAccelCache`. Long enough
+* that a burst of session restarts pays one read; short enough that an operator
+* who changes the decoder backend, or a host whose accelerator recovers, is
+* obeyed on the next session rather than after an addon respawn.
+*/
+var HAP_DECODE_MEMO_TTL_MS = 6e4;
+/**
+* Separator inside the encoded reading. A control character, because a backend
+* name is `[a-z0-9]+` and the decoder's non-backend choices are `auto` /
+* `none` / `''`, none of which can contain one — so the split is total.
+*/
+var READING_SEPARATOR = "
";
+/**
+* Marks a `null` FIELD, distinct from an EMPTY one.
+*
+* `probedBestHwaccel: ''` means the decoder answered and has never probed
+* (=> `not-probed`); `null` means the field was absent altogether. Encoding
+* both as `''` would lose a distinction `selectHwDecode` acts on.
+*/
+var NULL_FIELD = "\0";
+function encodeField(value) {
+	return value === null ? NULL_FIELD : value;
+}
+function decodeField(value) {
+	return value === NULL_FIELD ? null : value;
+}
+/**
+* A reading as ONE `string | null`, which is what {@link HwAccelCache} stores.
+*
+* The cache's three states are exactly the three a memoised reading needs:
+* `undefined` (never asked, or expired), `null` (asked, and the decoder could
+* not be reached), and a value. Encoding into the one cache rather than
+* splitting across two is what keeps those three from skewing — two caches
+* written together can still be READ across an expiry boundary.
+*/
+function encodeDecoderReading(reading) {
+	if (reading === null) return null;
+	return `${encodeField(reading.hwaccel)}${READING_SEPARATOR}${encodeField(reading.probedBestHwaccel)}`;
+}
+function decodeDecoderReading(value) {
+	if (value === null) return null;
+	const [hwaccel = NULL_FIELD, probed = NULL_FIELD] = value.split(READING_SEPARATOR);
+	return {
+		hwaccel: decodeField(hwaccel),
+		probedBestHwaccel: decodeField(probed)
+	};
+}
+function createDecoderReadingMemo(options) {
+	const cache = createHwAccelCache(options);
+	return {
+		read() {
+			const cached = cache.read();
+			return cached === void 0 ? void 0 : decodeDecoderReading(cached);
+		},
+		write(reading) {
+			cache.write(encodeDecoderReading(reading));
+		}
+	};
+}
+function createHapDecodeMemos(now) {
+	const options = {
+		ttlMs: HAP_DECODE_MEMO_TTL_MS,
+		...now ? { now } : {}
+	};
+	return {
+		reading: createDecoderReadingMemo(options),
+		failedBackend: createHwAccelCache(options)
+	};
+}
+//#endregion
 //#region src/reconcile/sync-state.ts
 function syncStateFromJson(json) {
 	const map = /* @__PURE__ */ new Map();
@@ -41977,7 +45393,10 @@ function syncStateToJson(map) {
 * intercom upload bridge, HomeKit Secure Video, recording, native
 * H.264 stream tap (currently uses RTSP + ffmpeg copy).
 */
-var DEFAULT_DEVICE_SETTINGS = { streamPreference: "auto" };
+var DEFAULT_DEVICE_SETTINGS = {
+	streamPreference: "auto",
+	hksvRecording: false
+};
 var HAP_STREAM_PREFERENCE_OPTIONS = [
 	{
 		value: "auto",
@@ -42053,6 +45472,18 @@ var ExportHapAddon = class extends BaseAddon {
 	pincode = "";
 	/** Optional mDNS/bind interface (config.interfaceName), or undefined. */
 	bind;
+	/**
+	* What this PROCESS remembers about decode hardware, shared by every camera
+	* mapper: the decoder addon's per-node reading (60 s), and the backend that
+	* last died at init (60 s).
+	*
+	* Owned here rather than as a module global for the reason `HwAccelCache`
+	* itself records — a module global outlives an addon respawn and survives an
+	* operator changing the decoder backend. Owned here rather than per mapper
+	* because the whole point is that camera B does not re-pay camera A's failed
+	* hardware init.
+	*/
+	decodeMemos = createHapDecodeMemos();
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -42194,13 +45625,14 @@ var ExportHapAddon = class extends BaseAddon {
 		const mapperKind = pickMapperKind(capabilities);
 		if (!mapperKind) throw new Error(`export-hap: no mapper for capabilities ${JSON.stringify(capabilities ?? [])}`);
 		const displayName = await this.resolveDisplayName(deviceId);
-		const baseEntry = {
+		const previous = this.config.exposed.find((e) => e.deviceId === deviceId);
+		const baseEntry = carryForward({
 			deviceId,
 			displayName,
 			mapperKind,
-			addedAt: Date.now(),
+			addedAt: previous?.addedAt ?? Date.now(),
 			...capabilities ? { capabilities: [...capabilities] } : {}
-		};
+		}, previous, ["settings", "capabilities"]);
 		const attached = await this.attachMapper(baseEntry);
 		const finalEntry = {
 			...baseEntry,
@@ -42219,13 +45651,13 @@ var ExportHapAddon = class extends BaseAddon {
 			childCount: attached.childAccessoryUuids.length
 		} });
 	}
-	async unexposeDevice(deviceId) {
+	async unexposeDevice(deviceId, options = {}) {
 		const numericId = Number.parseInt(deviceId, 10);
 		const log = this.ctx.logger.withTags({ deviceId: numericId });
 		await this.detachMapper(deviceId);
 		const next = this.config.exposed.filter((e) => e.deviceId !== deviceId);
 		if (next.length !== this.config.exposed.length) await this.updateGlobalSettings({ exposed: next });
-		clearPairingFiles(uuid.generate(`camstack:camera:${numericId}`), this.ctx.logger);
+		if (options.clearPairing !== false) clearPairingFiles(uuid.generate(`camstack:camera:${numericId}`), this.ctx.logger);
 		await this.forgetFingerprint(numericId);
 		log.info("export-hap: unexposed device");
 	}
@@ -42238,7 +45670,11 @@ var ExportHapAddon = class extends BaseAddon {
 			displayName: entry.displayName,
 			options: {
 				ptzPulseMs: this.config.ptzPulseMs,
-				hapDeviceSettings: { streamPreference: entrySettings.streamPreference ?? "auto" }
+				decodeMemos: this.decodeMemos,
+				hapDeviceSettings: {
+					streamPreference: entrySettings.streamPreference ?? "auto",
+					hksvRecording: entrySettings.hksvRecording === true
+				}
 			}
 		});
 		for (const accessory of mapper.accessories) await publishStandalone(accessory, {
@@ -42513,6 +45949,7 @@ var ExportHapAddon = class extends BaseAddon {
 		const enabled = entry !== null;
 		const enabledKey = `hap:${deviceId}:enabled`;
 		const streamPreferenceKey = `hap:${deviceId}:streamPreference`;
+		const hksvKey = `hap:${deviceId}:hksvRecording`;
 		const mapper = this.exposed.get(String(deviceId)) ?? null;
 		const paired = mapper ? accessoryPaired(mapper.accessory) : false;
 		const name = entry?.displayName ?? `Device ${deviceId}`;
@@ -42580,6 +46017,19 @@ var ExportHapAddon = class extends BaseAddon {
 							equals: true
 						},
 						immediate: true
+					},
+					{
+						type: "boolean",
+						key: hksvKey,
+						label: "HomeKit recording (Secure Video)",
+						description: "Offer “Stream and Allow Recording” in iOS Home. Requires iCloud+ and a home hub. Keeps a continuous 8s prebuffer for this camera (~0.7% of one CPU core, H.264 sources only).",
+						style: "switch",
+						value: settings.hksvRecording === true,
+						showWhen: {
+							field: enabledKey,
+							equals: true
+						},
+						immediate: true
 					}
 				]
 			}]
@@ -42604,12 +46054,15 @@ var ExportHapAddon = class extends BaseAddon {
 		const wasEnabled = this.exposed.has(deviceIdStr);
 		const enabledKey = `hap:${deviceId}:enabled`;
 		const streamPreferenceKey = `hap:${deviceId}:streamPreference`;
+		const hksvKey = `hap:${deviceId}:hksvRecording`;
 		const enabledValue = enabledKey in patch ? Boolean(patch[enabledKey]) : wasEnabled;
 		const streamPreferenceRaw = streamPreferenceKey in patch ? patch[streamPreferenceKey] : current?.settings?.streamPreference;
 		const streamPreference = typeof streamPreferenceRaw === "string" && streamPreferenceRaw.trim().length > 0 ? streamPreferenceRaw : "auto";
+		const hksvRecording = hksvKey in patch ? Boolean(patch[hksvKey]) : current?.settings?.hksvRecording === true;
 		const nextSettings = {
 			...current?.settings ?? DEFAULT_DEVICE_SETTINGS,
-			streamPreference
+			streamPreference,
+			hksvRecording
 		};
 		if (!enabledValue) {
 			if (wasEnabled) await this.unexposeDevice(deviceIdStr);
@@ -42621,18 +46074,24 @@ var ExportHapAddon = class extends BaseAddon {
 			return { success: true };
 		}
 		const currentPref = current?.settings?.streamPreference ?? "auto";
+		const currentHksv = current?.settings?.hksvRecording === true;
 		await this.updateEntrySettings(deviceIdStr, nextSettings);
-		if (currentPref !== streamPreference) {
-			log.info("export-hap: streamPreference changed — refreshing accessory", { meta: {
-				from: currentPref,
-				to: streamPreference
+		if (currentPref !== streamPreference || currentHksv !== hksvRecording) {
+			log.info("export-hap: per-camera export settings changed — refreshing accessory", { meta: {
+				streamPreference: {
+					from: currentPref,
+					to: streamPreference
+				},
+				hksvRecording: {
+					from: currentHksv,
+					to: hksvRecording
+				}
 			} });
 			try {
-				await this.unexposeDevice(deviceIdStr);
+				await this.unexposeDevice(deviceIdStr, { clearPairing: false });
 				await this.exposeDevice(deviceIdStr);
-				await this.updateEntrySettings(deviceIdStr, nextSettings);
 			} catch (err) {
-				log.warn("export-hap: failed to refresh accessory after streamPreference change", { meta: { error: errMsg(err) } });
+				log.warn("export-hap: failed to refresh accessory after a settings change", { meta: { error: errMsg(err) } });
 			}
 		}
 		return { success: true };