@camstack/addon-pipeline 1.2.127 → 1.2.129

package/dist/motion-wasm/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BZUXb5S5.js");
-const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
+const require_dist = require("../dist-D9x2_csL.js");
+const require_lazy_sharp = require("../lazy-sharp-DrLwLKpg.js");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 //#region src/motion-wasm/wasm-motion-detector.ts

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as hydrateSchema, G as evaluateZoneRules, St as BaseAddon, Tt as DeviceType, X as motionDetectionCapability } from "../dist-HLAOw6Pe.mjs";
+import { Dt as hydrateSchema, G as evaluateZoneRules, St as BaseAddon, Tt as DeviceType, X as motionDetectionCapability } from "../dist-CMio-1qq.mjs";
 import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { join } from "node:path";
 import { readFileSync } from "node:fs";

package/dist/pipeline-runner/index.js

@@ -2,11 +2,11 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BZUXb5S5.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BdArVUlx.js");
-const require_worker_protocol = require("../worker-protocol-BxkCoVjw.js");
+const require_dist = require("../dist-D9x2_csL.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-UW8nsiMb.js");
+const require_worker_protocol = require("../worker-protocol-BmBYCioC.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
+const require_lazy_sharp = require("../lazy-sharp-DrLwLKpg.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 let sharp = require("sharp");

package/dist/pipeline-runner/index.mjs

@@ -1,6 +1,6 @@
-import { Bt as lazy, Et as createEvent, F as customAction, Gt as string, Ht as number, It as _enum, L as defineCustomActions, Lt as array, Rt as boolean, St as BaseAddon, Ut as object, Vt as literal, f as DEFAULT_NATIVE_LEASE_SETTINGS, gt as errMsg, it as pipelineRunnerCapability, jt as nodePin, nt as pickNativeLeaseOverride, p as DEVICE_BACKEND_TO_FORMAT, qt as EventCategory, tt as pickDetailCropConvention, u as DEFAULT_DETAIL_CROP_CONVENTION, z as deriveDetailCropRect } from "../dist-HLAOw6Pe.mjs";
-import { i as resolveFrameViewGeometry, r as localFrameRegistry, t as attributeStall, u as getStepDefinition } from "../event-loop-stall-monitor-BH-cL_hg.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-h7Smb_0i.mjs";
+import { Bt as lazy, Et as createEvent, F as customAction, Gt as string, Ht as number, It as _enum, L as defineCustomActions, Lt as array, Rt as boolean, St as BaseAddon, Ut as object, Vt as literal, f as DEFAULT_NATIVE_LEASE_SETTINGS, gt as errMsg, it as pipelineRunnerCapability, jt as nodePin, nt as pickNativeLeaseOverride, p as DEVICE_BACKEND_TO_FORMAT, qt as EventCategory, tt as pickDetailCropConvention, u as DEFAULT_DETAIL_CROP_CONVENTION, z as deriveDetailCropRect } from "../dist-CMio-1qq.mjs";
+import { i as resolveFrameViewGeometry, r as localFrameRegistry, t as attributeStall, u as getStepDefinition } from "../event-loop-stall-monitor-B9dxYxyf.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-BHNWB9Ve.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";

package/dist/{process-memory-CDPRLalN.mjs → process-memory-C6es8dMA.mjs}

@@ -1,4 +1,4 @@
-import { Q as parseProcStatus } from "./dist-HLAOw6Pe.mjs";
+import { Q as parseProcStatus } from "./dist-CMio-1qq.mjs";
 import { execFile } from "node:child_process";
 import * as fs from "node:fs";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-Dh1SyzdJ.js → process-memory-CSJ7-Wlp.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BZUXb5S5.js");
+const require_dist = require("./dist-D9x2_csL.js");
 let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);

package/dist/recorder/index.js

@@ -1,7 +1,7 @@
-const require_dist = require("../dist-BZUXb5S5.js");
+const require_dist = require("../dist-D9x2_csL.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
-const require_addon_utils = require("../addon-utils-BnprivSs.js");
+const require_addon_utils = require("../addon-utils-CKB-2oM9.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
@@ -6061,13 +6061,20 @@ async function readPlacementState(state) {
 * Replace the assignment map, preserving everything else in the blob. The WHOLE
 * blob round-trips on every write (the DurableState contract), so the remembered
 * volume ids cannot be dropped by an assignment write.
+*
+* `base` is REQUIRED, and it is the blob the caller already read. This used to
+* re-read the store itself, which made every write two round trips instead of
+* one — and every one of them goes over the UDS door to `hub/sqlite-settings`
+* with the 60 s default bound. The placement pass read the blob, then wrote it,
+* and paid for the read TWICE: 4 × 60 s = the `durationMs: 240003` pass measured
+* on the live hub against a 30 s budget. Taking the blob as an argument makes
+* "one plan, one read, one write" a shape the type system enforces.
 */
-async function writeAssignments(state, assignments) {
-	const blob = await state.get();
+async function writeAssignments(state, base, assignments) {
 	const next = {};
 	for (const [key, locationId] of assignments) next[key] = locationId;
 	await state.set({
-		...blob,
+		...base,
 		assignments: next,
 		updatedAt: Date.now()
 	});
@@ -6583,9 +6590,45 @@ var fsVolumeProbeDeps = {
 	newVolumeId: () => (0, node_crypto.randomUUID)()
 };
 //#endregion
+//#region src/recorder/addon/with-deadline.ts
+/**
+* Race a promise against a deadline.
+*
+* Every cross-process call the recorder makes goes over a UDS door whose
+* DEFAULT timeout is 60 s (`DEFAULT_UDS_REQUEST_TIMEOUT_MS`). That default is a
+* backstop, not a budget: a pass that makes four of them serially and bounds
+* none of them costs four minutes, and the recorder's periodic passes SKIP
+* every fire while a run is in flight — so the unbounded call does not make one
+* pass late, it cancels the seven behind it. Measured on the live hub as a
+* `durationMs: 240003` placement pass against a 30 s budget (2026-08-18/19).
+*
+* Handlers stay attached to the losing promise, so a post-deadline settlement
+* can never surface as a process-level `unhandledRejection`.
+*/
+function withDeadline(promise, ms, label) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
+		}, ms);
+		timer.unref?.();
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+//#endregion
 //#region src/recorder/addon/placement-service.ts
 /** Free space a location keeps in reserve when its config names no floor. */
 var DEFAULT_MIN_FREE_PERCENT = 10;
+/** Nothing planned, nothing to persist. */
+var NO_PLAN = {
+	assignments: /* @__PURE__ */ new Map(),
+	changes: []
+};
 var PlacementService = class {
 	deps;
 	/** Locations whose volume has been probed since the last location change. */
@@ -6614,6 +6657,9 @@ var PlacementService = class {
 	get reprobeMs() {
 		return this.deps.reprobeMs ?? 6e4;
 	}
+	get storeTimeoutMs() {
+		return this.deps.storeTimeoutMs ?? 5e3;
+	}
 	/**
 	* Forget every probe verdict. Called whenever the location set is re-resolved
 	* (rescan, storage migration) — a remount is exactly the event the probe
@@ -6756,6 +6802,10 @@ var PlacementService = class {
 	* controller's existing 30s tick — it changes the PLAN only; a running writer
 	* keeps its root until it next attaches. Returns the plan so a caller can log
 	* or assert on it.
+	*
+	* ONE read and, at most, ONE write. Both bounded
+	* ({@link PLACEMENT_STORE_TIMEOUT_MS}) and both against the same blob: the
+	* plan the pass reads is the plan it writes back.
 	*/
 	async recompute(work) {
 		const pool = this.pool();
@@ -6765,12 +6815,17 @@ var PlacementService = class {
 			type: item.profile === "low" ? "recordingsLow" : "recordings",
 			dailyBytes: this.deps.dailyBytesFor?.(item.deviceId, item.profile) ?? 0
 		}));
-		let current = /* @__PURE__ */ new Map();
+		let blob;
 		try {
-			current = new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+			blob = await this.bounded(readPlacementState(this.deps.state), "placement plan read");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan read failed — planning from scratch", { meta: { error: require_dist.errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan read failed — this tick plans NOTHING and the stored plan stands", { meta: {
+				error: require_dist.errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
+			return NO_PLAN;
 		}
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -6794,12 +6849,19 @@ var PlacementService = class {
 			});
 		}
 		try {
-			await writeAssignments(this.deps.state, plan.assignments);
+			await this.bounded(writeAssignments(this.deps.state, blob, plan.assignments), "placement plan write");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan persist failed", { meta: { error: require_dist.errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan persist failed", { meta: {
+				error: require_dist.errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
 		}
 		return plan;
 	}
+	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
+	bounded(promise, label) {
+		return withDeadline(promise, this.storeTimeoutMs, label);
+	}
 	/**
 	* The write targets and what each can still absorb — the SAME pool and the
 	* SAME headroom `recompute` plans over.
@@ -6970,7 +7032,7 @@ var PlacementService = class {
 			const blob = await readPlacementState(this.deps.state);
 			const next = new Map(Object.entries(blob.assignments));
 			next.set(key, location.id);
-			await writeAssignments(this.deps.state, next);
+			await writeAssignments(this.deps.state, blob, next);
 		} catch (err) {
 			this.deps.logger.warn("recorder placement: assignment persist failed", {
 				tags: { deviceId },
@@ -8282,6 +8344,40 @@ var PLACEMENT_TICK_MS = 3e4;
 */
 var RECONCILE_TICK_MS = 12e4;
 /**
+* Bound on the ONE store read at the head of every placement and reconcile pass
+* (`enabledDeviceIds` → `readDeviceConfigs`).
+*
+* It is a cross-process read of `hub/sqlite-settings` and it was unbounded, so
+* it fell through to the 60 s UDS default. Sixty seconds is TWICE the placement
+* pass's whole budget spent before the pass has looked at a single location, and
+* it is a third of the reconcile budget spent before a single camera is
+* evaluated. Measured on the live hub on 2026-08-25: the pass that logged
+* `durationMs: 181056` spent its first 59 952 ms here and then logged
+* `could not enumerate persisted devices`.
+*
+* Failing this read is already a handled, LOGGED degradation — the pass covers
+* the active devices only — so a bound costs one pass a narrower scope and buys
+* back 55 s. Five seconds is three orders of magnitude above the healthy read.
+*/
+var TRACKED_DEVICES_READ_TIMEOUT_MS = 5e3;
+/**
+* A placement pass slower than this is reported WITH ITS PHASES, long before it
+* reaches the 30 s budget that only says "it was slow".
+*
+* The budget line is a tombstone: by the time a pass trips it, it has already
+* skipped the ticks behind it, and it names no phase — every 240 s pass in this
+* repo's history had to be attributed by hand-correlating adjacent lines. This
+* says which half was slow, so a store that is degrading is visible while it is
+* still only degrading.
+*
+* Deliberately BELOW every bound the pass applies (5 s), so a pass that trips
+* one of them always reports its phases — a threshold equal to the bound misses
+* the trip by a rounding error. A healthy pass is single-digit milliseconds
+* (`placementMs` 3–18 ms on the live hub), so 2 s is still two orders of
+* magnitude of headroom.
+*/
+var PLACEMENT_PHASE_WARN_MS = 2e3;
+/**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
 * SIGTERM→SIGKILL grace (`$process.stop`/`restart` in the kernel
@@ -8329,11 +8425,6 @@ function passSlowAfterMs(intervalMs) {
 	return intervalMs;
 }
 /**
-* Race `promise` against a deadline. Handlers stay attached to the losing
-* promise, so a post-deadline settlement can never surface as a process-level
-* `unhandledRejection`.
-*/
-/**
 * Bound on the two registry reads the battery-wake policy makes. They run
 * before any broker call on every attach, battery camera or not, so they are
 * the cheapest place for an unresponsive durable store to cost a recording.
@@ -8348,21 +8439,6 @@ var BATTERY_READ_TIMEOUT_MS = 3e3;
 * the shipped 30 s post-buffer.
 */
 var TRIGGER_LAG_WARN_MS = 2e3;
-function withDeadline(promise, ms, label) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
-		}, ms);
-		timer.unref?.();
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 /**
 * Floor for "this writer is pinned but producing nothing".
 *
@@ -8609,7 +8685,8 @@ var RecordingController = class {
 	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
 		try {
-			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+			const enabled = await withDeadline(this.deps.enabledDeviceIds(), TRACKED_DEVICES_READ_TIMEOUT_MS, "recorder: enabledDeviceIds");
+			for (const id of enabled) ids.add(id);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
 				error: require_dist.errMsg(err),
@@ -8627,12 +8704,22 @@ var RecordingController = class {
 	async replanPlacement() {
 		if (this.stopped || this.paused) return;
 		if (this.deps.onPlacementTick === void 0) return;
+		const startedAt = this.now();
 		const ids = await this.trackedDeviceIds();
+		const enumeratedAt = this.now();
 		try {
 			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: require_dist.errMsg(err) } });
 		}
+		const finishedAt = this.now();
+		if (finishedAt - startedAt > PLACEMENT_PHASE_WARN_MS) this.deps.logger.warn("recorder: placement pass ran long — phase breakdown", { meta: {
+			totalMs: finishedAt - startedAt,
+			enumerateMs: enumeratedAt - startedAt,
+			recomputeMs: finishedAt - enumeratedAt,
+			devices: ids.length,
+			budgetMs: PLACEMENT_TICK_MS
+		} });
 	}
 	/**
 	* The backstop pass: re-evaluate every tracked-or-configured device.
@@ -11808,7 +11895,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	async resetPlacementPlan() {
 		try {
-			await writeAssignments(this.placementStore(), /* @__PURE__ */ new Map());
+			const store = this.placementStore();
+			await writeAssignments(store, await readPlacementState(store), /* @__PURE__ */ new Map());
 			this.ctx.logger.info("recorder: placement plan reset after storage migration");
 		} catch (err) {
 			this.ctx.logger.warn("recorder: placement plan reset failed", { meta: { error: require_dist.errMsg(err) } });

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { B as deriveRecordingMode, Dt as hydrateSchema, Gt as string, Ht as number, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-HLAOw6Pe.mjs";
+import { B as deriveRecordingMode, Dt as hydrateSchema, Gt as string, Ht as number, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-CMio-1qq.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CgBCF-mE.mjs";
@@ -6060,13 +6060,20 @@ async function readPlacementState(state) {
 * Replace the assignment map, preserving everything else in the blob. The WHOLE
 * blob round-trips on every write (the DurableState contract), so the remembered
 * volume ids cannot be dropped by an assignment write.
+*
+* `base` is REQUIRED, and it is the blob the caller already read. This used to
+* re-read the store itself, which made every write two round trips instead of
+* one — and every one of them goes over the UDS door to `hub/sqlite-settings`
+* with the 60 s default bound. The placement pass read the blob, then wrote it,
+* and paid for the read TWICE: 4 × 60 s = the `durationMs: 240003` pass measured
+* on the live hub against a 30 s budget. Taking the blob as an argument makes
+* "one plan, one read, one write" a shape the type system enforces.
 */
-async function writeAssignments(state, assignments) {
-	const blob = await state.get();
+async function writeAssignments(state, base, assignments) {
 	const next = {};
 	for (const [key, locationId] of assignments) next[key] = locationId;
 	await state.set({
-		...blob,
+		...base,
 		assignments: next,
 		updatedAt: Date.now()
 	});
@@ -6582,9 +6589,45 @@ var fsVolumeProbeDeps = {
 	newVolumeId: () => randomUUID()
 };
 //#endregion
+//#region src/recorder/addon/with-deadline.ts
+/**
+* Race a promise against a deadline.
+*
+* Every cross-process call the recorder makes goes over a UDS door whose
+* DEFAULT timeout is 60 s (`DEFAULT_UDS_REQUEST_TIMEOUT_MS`). That default is a
+* backstop, not a budget: a pass that makes four of them serially and bounds
+* none of them costs four minutes, and the recorder's periodic passes SKIP
+* every fire while a run is in flight — so the unbounded call does not make one
+* pass late, it cancels the seven behind it. Measured on the live hub as a
+* `durationMs: 240003` placement pass against a 30 s budget (2026-08-18/19).
+*
+* Handlers stay attached to the losing promise, so a post-deadline settlement
+* can never surface as a process-level `unhandledRejection`.
+*/
+function withDeadline(promise, ms, label) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
+		}, ms);
+		timer.unref?.();
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+//#endregion
 //#region src/recorder/addon/placement-service.ts
 /** Free space a location keeps in reserve when its config names no floor. */
 var DEFAULT_MIN_FREE_PERCENT = 10;
+/** Nothing planned, nothing to persist. */
+var NO_PLAN = {
+	assignments: /* @__PURE__ */ new Map(),
+	changes: []
+};
 var PlacementService = class {
 	deps;
 	/** Locations whose volume has been probed since the last location change. */
@@ -6613,6 +6656,9 @@ var PlacementService = class {
 	get reprobeMs() {
 		return this.deps.reprobeMs ?? 6e4;
 	}
+	get storeTimeoutMs() {
+		return this.deps.storeTimeoutMs ?? 5e3;
+	}
 	/**
 	* Forget every probe verdict. Called whenever the location set is re-resolved
 	* (rescan, storage migration) — a remount is exactly the event the probe
@@ -6755,6 +6801,10 @@ var PlacementService = class {
 	* controller's existing 30s tick — it changes the PLAN only; a running writer
 	* keeps its root until it next attaches. Returns the plan so a caller can log
 	* or assert on it.
+	*
+	* ONE read and, at most, ONE write. Both bounded
+	* ({@link PLACEMENT_STORE_TIMEOUT_MS}) and both against the same blob: the
+	* plan the pass reads is the plan it writes back.
 	*/
 	async recompute(work) {
 		const pool = this.pool();
@@ -6764,12 +6814,17 @@ var PlacementService = class {
 			type: item.profile === "low" ? "recordingsLow" : "recordings",
 			dailyBytes: this.deps.dailyBytesFor?.(item.deviceId, item.profile) ?? 0
 		}));
-		let current = /* @__PURE__ */ new Map();
+		let blob;
 		try {
-			current = new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+			blob = await this.bounded(readPlacementState(this.deps.state), "placement plan read");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan read failed — planning from scratch", { meta: { error: errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan read failed — this tick plans NOTHING and the stored plan stands", { meta: {
+				error: errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
+			return NO_PLAN;
 		}
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -6793,12 +6848,19 @@ var PlacementService = class {
 			});
 		}
 		try {
-			await writeAssignments(this.deps.state, plan.assignments);
+			await this.bounded(writeAssignments(this.deps.state, blob, plan.assignments), "placement plan write");
 		} catch (err) {
-			this.deps.logger.warn("recorder placement: plan persist failed", { meta: { error: errMsg(err) } });
+			this.deps.logger.warn("recorder placement: plan persist failed", { meta: {
+				error: errMsg(err),
+				timeoutMs: this.storeTimeoutMs
+			} });
 		}
 		return plan;
 	}
+	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
+	bounded(promise, label) {
+		return withDeadline(promise, this.storeTimeoutMs, label);
+	}
 	/**
 	* The write targets and what each can still absorb — the SAME pool and the
 	* SAME headroom `recompute` plans over.
@@ -6969,7 +7031,7 @@ var PlacementService = class {
 			const blob = await readPlacementState(this.deps.state);
 			const next = new Map(Object.entries(blob.assignments));
 			next.set(key, location.id);
-			await writeAssignments(this.deps.state, next);
+			await writeAssignments(this.deps.state, blob, next);
 		} catch (err) {
 			this.deps.logger.warn("recorder placement: assignment persist failed", {
 				tags: { deviceId },
@@ -8281,6 +8343,40 @@ var PLACEMENT_TICK_MS = 3e4;
 */
 var RECONCILE_TICK_MS = 12e4;
 /**
+* Bound on the ONE store read at the head of every placement and reconcile pass
+* (`enabledDeviceIds` → `readDeviceConfigs`).
+*
+* It is a cross-process read of `hub/sqlite-settings` and it was unbounded, so
+* it fell through to the 60 s UDS default. Sixty seconds is TWICE the placement
+* pass's whole budget spent before the pass has looked at a single location, and
+* it is a third of the reconcile budget spent before a single camera is
+* evaluated. Measured on the live hub on 2026-08-25: the pass that logged
+* `durationMs: 181056` spent its first 59 952 ms here and then logged
+* `could not enumerate persisted devices`.
+*
+* Failing this read is already a handled, LOGGED degradation — the pass covers
+* the active devices only — so a bound costs one pass a narrower scope and buys
+* back 55 s. Five seconds is three orders of magnitude above the healthy read.
+*/
+var TRACKED_DEVICES_READ_TIMEOUT_MS = 5e3;
+/**
+* A placement pass slower than this is reported WITH ITS PHASES, long before it
+* reaches the 30 s budget that only says "it was slow".
+*
+* The budget line is a tombstone: by the time a pass trips it, it has already
+* skipped the ticks behind it, and it names no phase — every 240 s pass in this
+* repo's history had to be attributed by hand-correlating adjacent lines. This
+* says which half was slow, so a store that is degrading is visible while it is
+* still only degrading.
+*
+* Deliberately BELOW every bound the pass applies (5 s), so a pass that trips
+* one of them always reports its phases — a threshold equal to the bound misses
+* the trip by a rounding error. A healthy pass is single-digit milliseconds
+* (`placementMs` 3–18 ms on the live hub), so 2 s is still two orders of
+* magnitude of headroom.
+*/
+var PLACEMENT_PHASE_WARN_MS = 2e3;
+/**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
 * SIGTERM→SIGKILL grace (`$process.stop`/`restart` in the kernel
@@ -8328,11 +8424,6 @@ function passSlowAfterMs(intervalMs) {
 	return intervalMs;
 }
 /**
-* Race `promise` against a deadline. Handlers stay attached to the losing
-* promise, so a post-deadline settlement can never surface as a process-level
-* `unhandledRejection`.
-*/
-/**
 * Bound on the two registry reads the battery-wake policy makes. They run
 * before any broker call on every attach, battery camera or not, so they are
 * the cheapest place for an unresponsive durable store to cost a recording.
@@ -8347,21 +8438,6 @@ var BATTERY_READ_TIMEOUT_MS = 3e3;
 * the shipped 30 s post-buffer.
 */
 var TRIGGER_LAG_WARN_MS = 2e3;
-function withDeadline(promise, ms, label) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`${label} timed out after ${ms}ms`));
-		}, ms);
-		timer.unref?.();
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 /**
 * Floor for "this writer is pinned but producing nothing".
 *
@@ -8608,7 +8684,8 @@ var RecordingController = class {
 	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
 		try {
-			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+			const enabled = await withDeadline(this.deps.enabledDeviceIds(), TRACKED_DEVICES_READ_TIMEOUT_MS, "recorder: enabledDeviceIds");
+			for (const id of enabled) ids.add(id);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
 				error: errMsg(err),
@@ -8626,12 +8703,22 @@ var RecordingController = class {
 	async replanPlacement() {
 		if (this.stopped || this.paused) return;
 		if (this.deps.onPlacementTick === void 0) return;
+		const startedAt = this.now();
 		const ids = await this.trackedDeviceIds();
+		const enumeratedAt = this.now();
 		try {
 			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: errMsg(err) } });
 		}
+		const finishedAt = this.now();
+		if (finishedAt - startedAt > PLACEMENT_PHASE_WARN_MS) this.deps.logger.warn("recorder: placement pass ran long — phase breakdown", { meta: {
+			totalMs: finishedAt - startedAt,
+			enumerateMs: enumeratedAt - startedAt,
+			recomputeMs: finishedAt - enumeratedAt,
+			devices: ids.length,
+			budgetMs: PLACEMENT_TICK_MS
+		} });
 	}
 	/**
 	* The backstop pass: re-evaluate every tracked-or-configured device.
@@ -11807,7 +11894,8 @@ var RecorderV2Addon = class extends BaseAddon {
 	*/
 	async resetPlacementPlan() {
 		try {
-			await writeAssignments(this.placementStore(), /* @__PURE__ */ new Map());
+			const store = this.placementStore();
+			await writeAssignments(store, await readPlacementState(store), /* @__PURE__ */ new Map());
 			this.ctx.logger.info("recorder: placement plan reset after storage migration");
 		} catch (err) {
 			this.ctx.logger.warn("recorder: placement plan reset failed", { meta: { error: errMsg(err) } });

package/dist/{segment-demux-js-D-TLcHW5.mjs → segment-demux-js-BRCjXbI0.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { gt as errMsg } from "./dist-HLAOw6Pe.mjs";
+import { gt as errMsg } from "./dist-CMio-1qq.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-DRutggd6.js → segment-demux-js-DiLDoV9_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BZUXb5S5.js");
+const require_dist = require("./dist-D9x2_csL.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-BxkCoVjw.js");
-const require_lazy_sharp = require("../lazy-sharp-DTDXrhMG.js");
+const require_worker_protocol = require("../worker-protocol-BmBYCioC.js");
+const require_lazy_sharp = require("../lazy-sharp-DrLwLKpg.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,4 +1,4 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-h7Smb_0i.mjs";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-BHNWB9Ve.mjs";
 import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 //#region src/session-decode/color-conversion.ts
 /**

package/dist/stream-broker/_stub.js

@@ -1,7 +1,7 @@
 import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-Do2DEtRt.mjs";
 import { a as p, i as m, n as h, o as g, r as _, t as v } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react__loadShare__.js-C9j-2lBe.mjs";
 import { n as y, r as b, t as x } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-XO0-Pyu6.mjs";
-import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-Cs8bmrWP.mjs";
+import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-CxppPmXr.mjs";
 import { n as C, t as w } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-BO7TIbJV.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var T = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), E = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), D = (e) => {

package/dist/stream-broker/{_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-BDR5z0Z9.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-1O99xPTr.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.105",
+		version: "1.2.106",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.71",
+		version: "1.2.72",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",