@camstack/addon-pipeline 1.2.126 → 1.2.128

package/dist/detection-pipeline/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 const require_dist = require("../dist-BZUXb5S5.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BdArVUlx.js");
-const require_lazy_sharp = require("../lazy-sharp-BxMwCkCA.js");
+const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
 const require_process_memory = require("../process-memory-Dh1SyzdJ.js");
 const require_addon_utils = require("../addon-utils-BnprivSs.js");
 let sharp = require("sharp");

package/dist/detection-pipeline/index.mjs

@@ -1,7 +1,7 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
 import { $ as pickClusterStepModels, D as YAMNET_TO_MACRO, Dt as hydrateSchema, Et as createEvent, Ft as sleep, G as evaluateZoneRules, Gt as string, I as defaultDeviceFor$1, Kt as union, Lt as array, Mt as parseJsonUnknown, St as BaseAddon, Ut as object, V as detectionPipelineCapability, W as enumerateInferenceDevices, Z as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, dt as runtimeDevices$1, et as pickClusterStepSettings, gt as errMsg, jt as nodePin, l as DEFAULT_CLUSTER_STEP_SETTINGS, lt as resolvePoolMemoryPolicy, mt as supportedRuntimes$1, p as DEVICE_BACKEND_TO_FORMAT, q as inferModelProvider, qt as EventCategory, rt as pipelineExecutorCapability, st as resolveClusterStepModelId, t as APPLE_SA_TO_MACRO, x as PoolMemoryWatchdog } from "../dist-HLAOw6Pe.mjs";
 import { a as ALL_PIPELINE_STEPS, c as getDefaultModelForFormatFromDef, d as resolveModelForFormat, f as landmarkPrecisionVerdict, l as getStep, n as startEventLoopStallMonitor, o as ALL_STEPS, r as localFrameRegistry, s as getDefaultModelForFormat, u as getStepDefinition } from "../event-loop-stall-monitor-BH-cL_hg.mjs";
-import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
+import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-CDPRLalN.mjs";
 import { a as ensureModel, o as isModelDownloaded, r as deleteModelFromDisk } from "../addon-utils-CgBCF-mE.mjs";
 import sharp from "sharp";

package/dist/{lazy-sharp-6oymT_yf.mjs → lazy-sharp-BtT5x-qP.mjs}

@@ -47,9 +47,10 @@ import * as path$1 from "node:path";
 *    `CAMSTACK_FRAMEWORK_DIR` (`<frameworkDir>/node_modules/<pkg>`). The
 *    launcher points this at the ACTIVE closure in data-root mode and forked
 *    children inherit it (`server/backend/src/launcher.ts`).
-*  - **ELECTRON agent** — the app bundle beside `CAMSTACK_BUNDLED_ADDONS_DIR`
-*    (`<resources>/addons`): `<resources>/node_modules/<pkg>` and the
-*    `app.asar.unpacked` mirror.
+*  - **ELECTRON agent** — the app bundle around `CAMSTACK_BUNDLED_ADDONS_DIR`
+*    (`<resources>/node_modules/@camstack` since 2026-08-25, `<resources>/addons`
+*    before it): `<resources>/node_modules/<pkg>` and the `app.asar.unpacked`
+*    mirror. See {@link electronResourcesRoot} — the depth is NOT assumed.
 *  - **the process cwd** — always tried last, and it is NOT redundant:
 *    `CAMSTACK_FRAMEWORK_DIR` is only exported on some boots (the Docker
 *    entrypoint sets it in its fallback branch; the launcher only in data-root
@@ -108,6 +109,38 @@ function isModuleResolutionError(err) {
 	return err.message.includes("Cannot find package") || err.message.includes("Cannot find module");
 }
 /**
+* Path segments that are containers on the way to a package dir, never the
+* Electron `Resources` dir itself. Walking past them is what makes the anchor
+* derivation independent of WHICH dir the shell chose to seed addons from.
+*/
+var SEED_CONTAINER_SEGMENTS = [
+	"@camstack",
+	"node_modules",
+	"addons"
+];
+/**
+* The Electron `Contents/Resources` dir, derived from `CAMSTACK_BUNDLED_ADDONS_DIR`.
+*
+* That variable names the dir the launcher SEEDS addons from, and its shape has
+* moved: it was `<resources>/addons` (a second, hand-copied tree) and is now
+* `<resources>/node_modules/@camstack`, the closure's own scope dir — one copy
+* (D45). What this function needs is neither: it needs the sibling
+* `<resources>/node_modules`, where the hoisted `sharp` / `node-av` actually
+* live. A plain `path.dirname` answered the first shape and would have silently
+* answered `<resources>/node_modules/node_modules` for the second, losing both
+* packages in every forked decode worker on a desktop agent. So: climb past the
+* container segments instead of assuming a depth.
+*/
+function electronResourcesRoot(bundledAddonsDir) {
+	let dir = path$1.resolve(bundledAddonsDir);
+	while (SEED_CONTAINER_SEGMENTS.includes(path$1.basename(dir))) {
+		const parent = path$1.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return dir;
+}
+/**
 * The files a resolution is anchored at, in the order they are tried. Each is a
 * path INSIDE a candidate `node_modules` (so `<dir>/node_modules/<pkg>` is on
 * the walk), except the cwd anchor, which walks up from the cwd itself.
@@ -120,7 +153,7 @@ function hostExternalAnchors(env, cwd) {
 	if (frameworkDir !== void 0 && frameworkDir.length > 0) anchors.push(path$1.join(frameworkDir, "node_modules", ANCHOR_FILE));
 	const bundledAddons = env["CAMSTACK_BUNDLED_ADDONS_DIR"];
 	if (bundledAddons !== void 0 && bundledAddons.length > 0) {
-		const resourcesRoot = path$1.dirname(bundledAddons);
+		const resourcesRoot = electronResourcesRoot(bundledAddons);
 		anchors.push(path$1.join(resourcesRoot, "node_modules", ANCHOR_FILE));
 		anchors.push(path$1.join(resourcesRoot, "app.asar.unpacked", "node_modules", ANCHOR_FILE));
 	}

package/dist/{lazy-sharp-BxMwCkCA.js → lazy-sharp-DTDXrhMG.js}

@@ -49,9 +49,10 @@ node_path = require_dist.__toESM(node_path);
 *    `CAMSTACK_FRAMEWORK_DIR` (`<frameworkDir>/node_modules/<pkg>`). The
 *    launcher points this at the ACTIVE closure in data-root mode and forked
 *    children inherit it (`server/backend/src/launcher.ts`).
-*  - **ELECTRON agent** — the app bundle beside `CAMSTACK_BUNDLED_ADDONS_DIR`
-*    (`<resources>/addons`): `<resources>/node_modules/<pkg>` and the
-*    `app.asar.unpacked` mirror.
+*  - **ELECTRON agent** — the app bundle around `CAMSTACK_BUNDLED_ADDONS_DIR`
+*    (`<resources>/node_modules/@camstack` since 2026-08-25, `<resources>/addons`
+*    before it): `<resources>/node_modules/<pkg>` and the `app.asar.unpacked`
+*    mirror. See {@link electronResourcesRoot} — the depth is NOT assumed.
 *  - **the process cwd** — always tried last, and it is NOT redundant:
 *    `CAMSTACK_FRAMEWORK_DIR` is only exported on some boots (the Docker
 *    entrypoint sets it in its fallback branch; the launcher only in data-root
@@ -110,6 +111,38 @@ function isModuleResolutionError(err) {
 	return err.message.includes("Cannot find package") || err.message.includes("Cannot find module");
 }
 /**
+* Path segments that are containers on the way to a package dir, never the
+* Electron `Resources` dir itself. Walking past them is what makes the anchor
+* derivation independent of WHICH dir the shell chose to seed addons from.
+*/
+var SEED_CONTAINER_SEGMENTS = [
+	"@camstack",
+	"node_modules",
+	"addons"
+];
+/**
+* The Electron `Contents/Resources` dir, derived from `CAMSTACK_BUNDLED_ADDONS_DIR`.
+*
+* That variable names the dir the launcher SEEDS addons from, and its shape has
+* moved: it was `<resources>/addons` (a second, hand-copied tree) and is now
+* `<resources>/node_modules/@camstack`, the closure's own scope dir — one copy
+* (D45). What this function needs is neither: it needs the sibling
+* `<resources>/node_modules`, where the hoisted `sharp` / `node-av` actually
+* live. A plain `path.dirname` answered the first shape and would have silently
+* answered `<resources>/node_modules/node_modules` for the second, losing both
+* packages in every forked decode worker on a desktop agent. So: climb past the
+* container segments instead of assuming a depth.
+*/
+function electronResourcesRoot(bundledAddonsDir) {
+	let dir = node_path.resolve(bundledAddonsDir);
+	while (SEED_CONTAINER_SEGMENTS.includes(node_path.basename(dir))) {
+		const parent = node_path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return dir;
+}
+/**
 * The files a resolution is anchored at, in the order they are tried. Each is a
 * path INSIDE a candidate `node_modules` (so `<dir>/node_modules/<pkg>` is on
 * the walk), except the cwd anchor, which walks up from the cwd itself.
@@ -122,7 +155,7 @@ function hostExternalAnchors(env, cwd) {
 	if (frameworkDir !== void 0 && frameworkDir.length > 0) anchors.push(node_path.join(frameworkDir, "node_modules", ANCHOR_FILE));
 	const bundledAddons = env["CAMSTACK_BUNDLED_ADDONS_DIR"];
 	if (bundledAddons !== void 0 && bundledAddons.length > 0) {
-		const resourcesRoot = node_path.dirname(bundledAddons);
+		const resourcesRoot = electronResourcesRoot(bundledAddons);
 		anchors.push(node_path.join(resourcesRoot, "node_modules", ANCHOR_FILE));
 		anchors.push(node_path.join(resourcesRoot, "app.asar.unpacked", "node_modules", ANCHOR_FILE));
 	}

package/dist/motion-wasm/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_dist = require("../dist-BZUXb5S5.js");
-const require_lazy_sharp = require("../lazy-sharp-BxMwCkCA.js");
+const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 //#region src/motion-wasm/wasm-motion-detector.ts

package/dist/motion-wasm/index.mjs

@@ -1,5 +1,5 @@
 import { Dt as hydrateSchema, G as evaluateZoneRules, St as BaseAddon, Tt as DeviceType, X as motionDetectionCapability } from "../dist-HLAOw6Pe.mjs";
-import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
+import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { join } from "node:path";
 import { readFileSync } from "node:fs";
 //#region src/motion-wasm/wasm-motion-detector.ts

package/dist/pipeline-runner/index.js

@@ -6,7 +6,7 @@ const require_dist = require("../dist-BZUXb5S5.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BdArVUlx.js");
 const require_worker_protocol = require("../worker-protocol-BxkCoVjw.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-BxMwCkCA.js");
+const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 let sharp = require("sharp");

package/dist/pipeline-runner/index.mjs

@@ -2,7 +2,7 @@ import { Bt as lazy, Et as createEvent, F as customAction, Gt as string, Ht as n
 import { i as resolveFrameViewGeometry, r as localFrameRegistry, t as attributeStall, u as getStepDefinition } from "../event-loop-stall-monitor-BH-cL_hg.mjs";
 import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-h7Smb_0i.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
+import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-BeHi78PZ.mjs";
 import sharp from "sharp";

package/dist/recorder/index.js

@@ -6061,13 +6061,20 @@ async function readPlacementState(state) {
 * Replace the assignment map, preserving everything else in the blob. The WHOLE
 * blob round-trips on every write (the DurableState contract), so the remembered
 * volume ids cannot be dropped by an assignment write.
+*
+* `base` is REQUIRED, and it is the blob the caller already read. This used to
+* re-read the store itself, which made every write two round trips instead of
+* one — and every one of them goes over the UDS door to `hub/sqlite-settings`
+* with the 60 s default bound. The placement pass read the blob, then wrote it,
+* and paid for the read TWICE: 4 × 60 s = the `durationMs: 240003` pass measured
+* on the live hub against a 30 s budget. Taking the blob as an argument makes
+* "one plan, one read, one write" a shape the type system enforces.
 */
-async function writeAssignments(state, assignments) {
-	const blob = await state.get();
+async function writeAssignments(state, base, assignments) {
 	const next = {};
 	for (const [key, locationId] of assignments) next[key] = locationId;
 	await state.set({
-		...blob,
+		...base,
 		assignments: next,
 		updatedAt: Date.now()
 	});
@@ -6583,9 +6590,45 @@ var fsVolumeProbeDeps = {
 	newVolumeId: () => (0, node_crypto.randomUUID)()
 };
 //#endregion
+//#region src/recorder/addon/with-deadline.ts
+/**
+* Race a promise against a deadline.
+*
+* Every cross-process call the recorder makes goes over a UDS door whose
+* DEFAULT timeout is 60 s (`DEFAULT_UDS_REQUEST_TIMEOUT_MS`). That default is a
+* backstop, not a budget: a pass that makes four of them serially and bounds
+* none of them costs four minutes, and the recorder's periodic passes SKIP
+* every fire while a run is in flight — so the unbounded call does not make one
+* pass late, it cancels the seven behind it. Measured on the live hub as a
+* `durationMs: 240003` placement pass against a 30 s budget (2026-08-18/19).
+*
+* Handlers stay attached to the losing promise, so a post-deadline settlement
+* can never surface as a process-level `unhandledRejection`.
+*/
+function withDeadline(promise, ms, label) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
+		}, ms);
+		timer.unref?.();
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+//#endregion
 //#region src/recorder/addon/placement-service.ts
 /** Free space a location keeps in reserve when its config names no floor. */
 var DEFAULT_MIN_FREE_PERCENT = 10;
+/** Nothing planned, nothing to persist. */
+var NO_PLAN = {
+	assignments: /* @__PURE__ */ new Map(),
+	changes: []
+};
 var PlacementService = class {
 	deps;
 	/** Locations whose volume has been probed since the last location change. */
@@ -6614,6 +6657,9 @@ var PlacementService = class {
 	get reprobeMs() {
 		return this.deps.reprobeMs ?? 6e4;
 	}
+	get storeTimeoutMs() {
+		return this.deps.storeTimeoutMs ?? 5e3;
+	}
 	/**
 	* Forget every probe verdict. Called whenever the location set is re-resolved
 	* (rescan, storage migration) — a remount is exactly the event the probe
@@ -6756,6 +6802,10 @@ var PlacementService = class {
 	* controller's existing 30s tick — it changes the PLAN only; a running writer
 	* keeps its root until it next attaches. Returns the plan so a caller can log
 	* or assert on it.
+	*
+	* ONE read and, at most, ONE write. Both bounded
+	* ({@link PLACEMENT_STORE_TIMEOUT_MS}) and both against the same blob: the
+	* plan the pass reads is the plan it writes back.
 	*/
 	async recompute(work) {
 		const pool = this.pool();
@@ -6765,12 +6815,17 @@ var PlacementService = class {
 			type: item.profile === "low" ? "recordingsLow" : "recordings",
 			dailyBytes: this.deps.dailyBytesFor?.(item.deviceId, item.profile) ?? 0
 		}));
-		let current = /* @__PURE__ */ new Map();
+		let blob;
 		try {
-			current = new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+			blob = await this.bounded(readPlacementState(this.deps.state), "placement plan read");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan read failed — planning from scratch", { meta: { error: require_dist.errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan read failed — this tick plans NOTHING and the stored plan stands", { meta: {
+				error: require_dist.errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
+			return NO_PLAN;
 		}
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -6794,12 +6849,19 @@ var PlacementService = class {
 			});
 		}
 		try {
-			await writeAssignments(this.deps.state, plan.assignments);
+			await this.bounded(writeAssignments(this.deps.state, blob, plan.assignments), "placement plan write");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan persist failed", { meta: { error: require_dist.errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan persist failed", { meta: {
+				error: require_dist.errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
 		}
 		return plan;
 	}
+	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
+	bounded(promise, label) {
+		return withDeadline(promise, this.storeTimeoutMs, label);
+	}
 	/**
 	* The write targets and what each can still absorb — the SAME pool and the
 	* SAME headroom `recompute` plans over.
@@ -6970,7 +7032,7 @@ var PlacementService = class {
 			const blob = await readPlacementState(this.deps.state);
 			const next = new Map(Object.entries(blob.assignments));
 			next.set(key, location.id);
-			await writeAssignments(this.deps.state, next);
+			await writeAssignments(this.deps.state, blob, next);
 		} catch (err) {
 			this.deps.logger.warn("recorder placement: assignment persist failed", {
 				tags: { deviceId },
@@ -8282,6 +8344,40 @@ var PLACEMENT_TICK_MS = 3e4;
 */
 var RECONCILE_TICK_MS = 12e4;
 /**
+* Bound on the ONE store read at the head of every placement and reconcile pass
+* (`enabledDeviceIds` → `readDeviceConfigs`).
+*
+* It is a cross-process read of `hub/sqlite-settings` and it was unbounded, so
+* it fell through to the 60 s UDS default. Sixty seconds is TWICE the placement
+* pass's whole budget spent before the pass has looked at a single location, and
+* it is a third of the reconcile budget spent before a single camera is
+* evaluated. Measured on the live hub on 2026-08-25: the pass that logged
+* `durationMs: 181056` spent its first 59 952 ms here and then logged
+* `could not enumerate persisted devices`.
+*
+* Failing this read is already a handled, LOGGED degradation — the pass covers
+* the active devices only — so a bound costs one pass a narrower scope and buys
+* back 55 s. Five seconds is three orders of magnitude above the healthy read.
+*/
+var TRACKED_DEVICES_READ_TIMEOUT_MS = 5e3;
+/**
+* A placement pass slower than this is reported WITH ITS PHASES, long before it
+* reaches the 30 s budget that only says "it was slow".
+*
+* The budget line is a tombstone: by the time a pass trips it, it has already
+* skipped the ticks behind it, and it names no phase — every 240 s pass in this
+* repo's history had to be attributed by hand-correlating adjacent lines. This
+* says which half was slow, so a store that is degrading is visible while it is
+* still only degrading.
+*
+* Deliberately BELOW every bound the pass applies (5 s), so a pass that trips
+* one of them always reports its phases — a threshold equal to the bound misses
+* the trip by a rounding error. A healthy pass is single-digit milliseconds
+* (`placementMs` 3–18 ms on the live hub), so 2 s is still two orders of
+* magnitude of headroom.
+*/
+var PLACEMENT_PHASE_WARN_MS = 2e3;
+/**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
 * SIGTERM→SIGKILL grace (`$process.stop`/`restart` in the kernel
@@ -8329,11 +8425,6 @@ function passSlowAfterMs(intervalMs) {
 	return intervalMs;
 }
 /**
-* Race `promise` against a deadline. Handlers stay attached to the losing
-* promise, so a post-deadline settlement can never surface as a process-level
-* `unhandledRejection`.
-*/
-/**
 * Bound on the two registry reads the battery-wake policy makes. They run
 * before any broker call on every attach, battery camera or not, so they are
 * the cheapest place for an unresponsive durable store to cost a recording.
@@ -8348,21 +8439,6 @@ var BATTERY_READ_TIMEOUT_MS = 3e3;
 * the shipped 30 s post-buffer.
 */
 var TRIGGER_LAG_WARN_MS = 2e3;
-function withDeadline(promise, ms, label) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
-		}, ms);
-		timer.unref?.();
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 /**
 * Floor for "this writer is pinned but producing nothing".
 *
@@ -8609,7 +8685,8 @@ var RecordingController = class {
 	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
 		try {
-			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+			const enabled = await withDeadline(this.deps.enabledDeviceIds(), TRACKED_DEVICES_READ_TIMEOUT_MS, "recorder: enabledDeviceIds");
+			for (const id of enabled) ids.add(id);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
 				error: require_dist.errMsg(err),
@@ -8627,12 +8704,22 @@ var RecordingController = class {
 	async replanPlacement() {
 		if (this.stopped || this.paused) return;
 		if (this.deps.onPlacementTick === void 0) return;
+		const startedAt = this.now();
 		const ids = await this.trackedDeviceIds();
+		const enumeratedAt = this.now();
 		try {
 			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: require_dist.errMsg(err) } });
 		}
+		const finishedAt = this.now();
+		if (finishedAt - startedAt > PLACEMENT_PHASE_WARN_MS) this.deps.logger.warn("recorder: placement pass ran long — phase breakdown", { meta: {
+			totalMs: finishedAt - startedAt,
+			enumerateMs: enumeratedAt - startedAt,
+			recomputeMs: finishedAt - enumeratedAt,
+			devices: ids.length,
+			budgetMs: PLACEMENT_TICK_MS
+		} });
 	}
 	/**
 	* The backstop pass: re-evaluate every tracked-or-configured device.
@@ -11808,7 +11895,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	async resetPlacementPlan() {
 		try {
-			await writeAssignments(this.placementStore(), /* @__PURE__ */ new Map());
+			const store = this.placementStore();
+			await writeAssignments(store, await readPlacementState(store), /* @__PURE__ */ new Map());
 			this.ctx.logger.info("recorder: placement plan reset after storage migration");
 		} catch (err) {
 			this.ctx.logger.warn("recorder: placement plan reset failed", { meta: { error: require_dist.errMsg(err) } });

package/dist/recorder/index.mjs

@@ -6060,13 +6060,20 @@ async function readPlacementState(state) {
 * Replace the assignment map, preserving everything else in the blob. The WHOLE
 * blob round-trips on every write (the DurableState contract), so the remembered
 * volume ids cannot be dropped by an assignment write.
+*
+* `base` is REQUIRED, and it is the blob the caller already read. This used to
+* re-read the store itself, which made every write two round trips instead of
+* one — and every one of them goes over the UDS door to `hub/sqlite-settings`
+* with the 60 s default bound. The placement pass read the blob, then wrote it,
+* and paid for the read TWICE: 4 × 60 s = the `durationMs: 240003` pass measured
+* on the live hub against a 30 s budget. Taking the blob as an argument makes
+* "one plan, one read, one write" a shape the type system enforces.
 */
-async function writeAssignments(state, assignments) {
-	const blob = await state.get();
+async function writeAssignments(state, base, assignments) {
 	const next = {};
 	for (const [key, locationId] of assignments) next[key] = locationId;
 	await state.set({
-		...blob,
+		...base,
 		assignments: next,
 		updatedAt: Date.now()
 	});
@@ -6582,9 +6589,45 @@ var fsVolumeProbeDeps = {
 	newVolumeId: () => randomUUID()
 };
 //#endregion
+//#region src/recorder/addon/with-deadline.ts
+/**
+* Race a promise against a deadline.
+*
+* Every cross-process call the recorder makes goes over a UDS door whose
+* DEFAULT timeout is 60 s (`DEFAULT_UDS_REQUEST_TIMEOUT_MS`). That default is a
+* backstop, not a budget: a pass that makes four of them serially and bounds
+* none of them costs four minutes, and the recorder's periodic passes SKIP
+* every fire while a run is in flight — so the unbounded call does not make one
+* pass late, it cancels the seven behind it. Measured on the live hub as a
+* `durationMs: 240003` placement pass against a 30 s budget (2026-08-18/19).
+*
+* Handlers stay attached to the losing promise, so a post-deadline settlement
+* can never surface as a process-level `unhandledRejection`.
+*/
+function withDeadline(promise, ms, label) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
+		}, ms);
+		timer.unref?.();
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+//#endregion
 //#region src/recorder/addon/placement-service.ts
 /** Free space a location keeps in reserve when its config names no floor. */
 var DEFAULT_MIN_FREE_PERCENT = 10;
+/** Nothing planned, nothing to persist. */
+var NO_PLAN = {
+	assignments: /* @__PURE__ */ new Map(),
+	changes: []
+};
 var PlacementService = class {
 	deps;
 	/** Locations whose volume has been probed since the last location change. */
@@ -6613,6 +6656,9 @@ var PlacementService = class {
 	get reprobeMs() {
 		return this.deps.reprobeMs ?? 6e4;
 	}
+	get storeTimeoutMs() {
+		return this.deps.storeTimeoutMs ?? 5e3;
+	}
 	/**
 	* Forget every probe verdict. Called whenever the location set is re-resolved
 	* (rescan, storage migration) — a remount is exactly the event the probe
@@ -6755,6 +6801,10 @@ var PlacementService = class {
 	* controller's existing 30s tick — it changes the PLAN only; a running writer
 	* keeps its root until it next attaches. Returns the plan so a caller can log
 	* or assert on it.
+	*
+	* ONE read and, at most, ONE write. Both bounded
+	* ({@link PLACEMENT_STORE_TIMEOUT_MS}) and both against the same blob: the
+	* plan the pass reads is the plan it writes back.
 	*/
 	async recompute(work) {
 		const pool = this.pool();
@@ -6764,12 +6814,17 @@ var PlacementService = class {
 			type: item.profile === "low" ? "recordingsLow" : "recordings",
 			dailyBytes: this.deps.dailyBytesFor?.(item.deviceId, item.profile) ?? 0
 		}));
-		let current = /* @__PURE__ */ new Map();
+		let blob;
 		try {
-			current = new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+			blob = await this.bounded(readPlacementState(this.deps.state), "placement plan read");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan read failed — planning from scratch", { meta: { error: errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan read failed — this tick plans NOTHING and the stored plan stands", { meta: {
+				error: errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
+			return NO_PLAN;
 		}
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -6793,12 +6848,19 @@ var PlacementService = class {
 			});
 		}
 		try {
-			await writeAssignments(this.deps.state, plan.assignments);
+			await this.bounded(writeAssignments(this.deps.state, blob, plan.assignments), "placement plan write");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan persist failed", { meta: { error: errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan persist failed", { meta: {
+				error: errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
 		}
 		return plan;
 	}
+	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
+	bounded(promise, label) {
+		return withDeadline(promise, this.storeTimeoutMs, label);
+	}
 	/**
 	* The write targets and what each can still absorb — the SAME pool and the
 	* SAME headroom `recompute` plans over.
@@ -6969,7 +7031,7 @@ var PlacementService = class {
 			const blob = await readPlacementState(this.deps.state);
 			const next = new Map(Object.entries(blob.assignments));
 			next.set(key, location.id);
-			await writeAssignments(this.deps.state, next);
+			await writeAssignments(this.deps.state, blob, next);
 		} catch (err) {
 			this.deps.logger.warn("recorder placement: assignment persist failed", {
 				tags: { deviceId },
@@ -8281,6 +8343,40 @@ var PLACEMENT_TICK_MS = 3e4;
 */
 var RECONCILE_TICK_MS = 12e4;
 /**
+* Bound on the ONE store read at the head of every placement and reconcile pass
+* (`enabledDeviceIds` → `readDeviceConfigs`).
+*
+* It is a cross-process read of `hub/sqlite-settings` and it was unbounded, so
+* it fell through to the 60 s UDS default. Sixty seconds is TWICE the placement
+* pass's whole budget spent before the pass has looked at a single location, and
+* it is a third of the reconcile budget spent before a single camera is
+* evaluated. Measured on the live hub on 2026-08-25: the pass that logged
+* `durationMs: 181056` spent its first 59 952 ms here and then logged
+* `could not enumerate persisted devices`.
+*
+* Failing this read is already a handled, LOGGED degradation — the pass covers
+* the active devices only — so a bound costs one pass a narrower scope and buys
+* back 55 s. Five seconds is three orders of magnitude above the healthy read.
+*/
+var TRACKED_DEVICES_READ_TIMEOUT_MS = 5e3;
+/**
+* A placement pass slower than this is reported WITH ITS PHASES, long before it
+* reaches the 30 s budget that only says "it was slow".
+*
+* The budget line is a tombstone: by the time a pass trips it, it has already
+* skipped the ticks behind it, and it names no phase — every 240 s pass in this
+* repo's history had to be attributed by hand-correlating adjacent lines. This
+* says which half was slow, so a store that is degrading is visible while it is
+* still only degrading.
+*
+* Deliberately BELOW every bound the pass applies (5 s), so a pass that trips
+* one of them always reports its phases — a threshold equal to the bound misses
+* the trip by a rounding error. A healthy pass is single-digit milliseconds
+* (`placementMs` 3–18 ms on the live hub), so 2 s is still two orders of
+* magnitude of headroom.
+*/
+var PLACEMENT_PHASE_WARN_MS = 2e3;
+/**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
 * SIGTERM→SIGKILL grace (`$process.stop`/`restart` in the kernel
@@ -8328,11 +8424,6 @@ function passSlowAfterMs(intervalMs) {
 	return intervalMs;
 }
 /**
-* Race `promise` against a deadline. Handlers stay attached to the losing
-* promise, so a post-deadline settlement can never surface as a process-level
-* `unhandledRejection`.
-*/
-/**
 * Bound on the two registry reads the battery-wake policy makes. They run
 * before any broker call on every attach, battery camera or not, so they are
 * the cheapest place for an unresponsive durable store to cost a recording.
@@ -8347,21 +8438,6 @@ var BATTERY_READ_TIMEOUT_MS = 3e3;
 * the shipped 30 s post-buffer.
 */
 var TRIGGER_LAG_WARN_MS = 2e3;
-function withDeadline(promise, ms, label) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
-		}, ms);
-		timer.unref?.();
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 /**
 * Floor for "this writer is pinned but producing nothing".
 *
@@ -8608,7 +8684,8 @@ var RecordingController = class {
 	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
 		try {
-			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+			const enabled = await withDeadline(this.deps.enabledDeviceIds(), TRACKED_DEVICES_READ_TIMEOUT_MS, "recorder: enabledDeviceIds");
+			for (const id of enabled) ids.add(id);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
 				error: errMsg(err),
@@ -8626,12 +8703,22 @@ var RecordingController = class {
 	async replanPlacement() {
 		if (this.stopped || this.paused) return;
 		if (this.deps.onPlacementTick === void 0) return;
+		const startedAt = this.now();
 		const ids = await this.trackedDeviceIds();
+		const enumeratedAt = this.now();
 		try {
 			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: errMsg(err) } });
 		}
+		const finishedAt = this.now();
+		if (finishedAt - startedAt > PLACEMENT_PHASE_WARN_MS) this.deps.logger.warn("recorder: placement pass ran long — phase breakdown", { meta: {
+			totalMs: finishedAt - startedAt,
+			enumerateMs: enumeratedAt - startedAt,
+			recomputeMs: finishedAt - enumeratedAt,
+			devices: ids.length,
+			budgetMs: PLACEMENT_TICK_MS
+		} });
 	}
 	/**
 	* The backstop pass: re-evaluate every tracked-or-configured device.
@@ -11807,7 +11894,8 @@ var RecorderV2Addon = class extends BaseAddon {
 	*/
 	async resetPlacementPlan() {
 		try {
-			await writeAssignments(this.placementStore(), /* @__PURE__ */ new Map());
+			const store = this.placementStore();
+			await writeAssignments(store, await readPlacementState(store), /* @__PURE__ */ new Map());
 			this.ctx.logger.info("recorder: placement plan reset after storage migration");
 		} catch (err) {
 			this.ctx.logger.warn("recorder: placement plan reset failed", { meta: { error: errMsg(err) } });

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_worker_protocol = require("../worker-protocol-BxkCoVjw.js");
-const require_lazy_sharp = require("../lazy-sharp-BxMwCkCA.js");
+const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,5 +1,5 @@
 import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-h7Smb_0i.mjs";
-import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
+import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.126",
+  "version": "1.2.128",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",