@camstack/addon-pipeline 1.2.137 → 1.2.138

package/dist/stream-broker/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-4EMKvxCp.js");
-const require_node = require("../node-BOHn8gpk.js");
+const require_dist = require("../dist-BuIP0499.js");
+const require_node = require("../node-ChdX9lv7.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
-const require_segment_demux_js = require("../segment-demux-js-BrQ_A0oi.js");
+const require_segment_demux_js = require("../segment-demux-js-BgXbXZnp.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 let node_fs = require("node:fs");
@@ -2245,6 +2245,20 @@ function appendAudioMediaBlock(videoSdp, audioBlock) {
 	return `${videoSdp.replace(/[\r\n]+$/, "")}\r\n${audioBlock}\r\n`;
 }
 //#endregion
+//#region src/stream-broker/rtsp/join-burst-admission.ts
+/**
+* Decide whether this session may take this burst.
+*
+* Pure and total: no clock, no logger, no restreamer state. The restreamer maps
+* the result onto its counters and its `continue`.
+*/
+function admitJoinBurst(input) {
+	if (input.muted && !input.detectionIntent) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
+	if (!input.detectionIntent && input.spanMs > input.bound.maxSpanMs) return "span";
+	if (input.packets > input.bound.maxPackets) return "packets";
+	return "none";
+}
+//#endregion
 //#region src/stream-broker/rtsp/rtsp-types.ts
 /** RTSP method constants. */
 var RTSP_METHODS = [
@@ -2871,8 +2885,6 @@ var RtspRestreamer = class {
 		if (ready.length === 0) return;
 		const preRollPlans = /* @__PURE__ */ new Map();
 		const bound = this.currentPrimeBound();
-		const overSpan = spanMs > bound.maxSpanMs;
-		const overPackets = primePackets.length > bound.maxPackets;
 		/**
 		* Resolve (and memoize) the plan for one intent.
 		*
@@ -2938,14 +2950,18 @@ var RtspRestreamer = class {
 					continue;
 				}
 			}
-			if (session.isMuted() && !detectionIntent) {
-				if (!fromRing || spanMs > LIVE_EDGE_MAX_SPAN_MS) {
-					this.dropsWithheldMutedLiveEdge++;
-					withheld++;
-					continue;
-				}
-			} else if (overSpan || overPackets) {
-				if (overSpan) this.dropsWithheldSpan++;
+			const withhold = admitJoinBurst({
+				muted: session.isMuted(),
+				detectionIntent,
+				fromRing,
+				spanMs,
+				packets: primePackets.length,
+				bound,
+				liveEdgeMaxSpanMs: LIVE_EDGE_MAX_SPAN_MS
+			});
+			if (withhold !== "none") {
+				if (withhold === "live-edge") this.dropsWithheldMutedLiveEdge++;
+				else if (withhold === "span") this.dropsWithheldSpan++;
 				else this.dropsWithheldPackets++;
 				withheld++;
 				continue;
@@ -4131,6 +4147,90 @@ function buildAudioCodecCapApi(api) {
 		flushEncode: (input) => router.flushEncode.mutate(input)
 	};
 }
+//#endregion
+//#region src/stream-broker/stream-broker/catalog-pull-backoff.ts
+/**
+* CATALOG-PULL BACKOFF — how often the broker asks a camera whose
+* `stream-catalog` pull keeps failing.
+*
+* ## What this exists to stop
+*
+* 2026-08-25, device 3629 ("Videocamera porta retro", Reolink). Its Baichuan
+* session expired under a socket that stayed open, so every
+* `stream-catalog.getCatalog` answered `buildVideoStreamOptions failed …
+* responseCode 400`. The reconcile poll asked again 30 s later. And again. For
+* 35 minutes, ~70 identical failures, each one a login attempt, a 10 s timeout
+* budget and a `debug` line nobody was reading.
+*
+* The fleet was never at risk from that camera — `reconcileAllCatalogs` fans
+* out with `Promise.allSettled` and `reconcileDeviceCatalogNow` catches its own
+* pull, so exactly one device was omitted (that isolation is frozen by
+* `scripts/check-catalog-per-device-isolation.ts`). What was wrong is that the
+* omission was invisible and the retry was a flat 30 s hammer that could not
+* have recovered anyway.
+*
+* ## The shape
+*
+* The ladder is {@link BOOT_RECOVERY_BACKOFF_MS} — the repo's ONE retry
+* schedule for work that can fail for reasons that pass: two cheap attempts
+* (15 s, 60 s) for a blip, then the long tail (5 m → 90 m) for a camera that
+* is genuinely gone.
+*
+* ## The one place this DIVERGES from boot recovery, and why
+*
+* The boot ladder ENDS: it runs out and manual re-arm is the only path. This
+* one CLAMPS at the last rung and keeps asking every 90 minutes forever.
+*
+* Boot recovery can end because a human is present — a node that just booted
+* wrong is a node someone is looking at. A camera whose session expired at
+* 03:00 has nobody. The reconcile poll is the ONLY thing that will ever ask it
+* again: no event fires when a camera silently starts working, and a device
+* that never re-enters the catalog is a device with no broker, no recording
+* and no detection, permanently. Ending the chain would convert a transient
+* session expiry into a permanent outage — precisely the failure it is meant
+* to bound. A 90-minute floor is not a spin: it is ~16 pulls a day for one
+* broken camera, against 2 880 before this.
+*/
+/**
+* The rung the ladder settles on. Read off the shared schedule rather than
+* written down twice; the literal only keeps the expression total for a
+* hypothetically empty ladder, and is not the clamp.
+*/
+var LAST_RUNG_MS = require_dist.BOOT_RECOVERY_BACKOFF_MS[require_dist.BOOT_RECOVERY_BACKOFF_MS.length - 1] ?? 90 * 6e4;
+/**
+* Delay before the next poll-driven attempt, given how many pulls in a row
+* have now failed (1 = the first failure).
+*
+* Clamped at the last rung rather than exhausted — see the module doc.
+*/
+function catalogPullRetryDelayMs(consecutiveFailures) {
+	return require_dist.BOOT_RECOVERY_BACKOFF_MS[Math.max(consecutiveFailures, 1) - 1] ?? LAST_RUNG_MS;
+}
+/**
+* Advance the failure memory after one more failed pull.
+*
+* @param previous state before this failure, or `undefined` for the first one
+* @param nowMs wall clock at the moment of the failure
+*/
+function nextCatalogPullFailureState(previous, nowMs) {
+	const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
+	return {
+		consecutiveFailures,
+		nextAttemptAtMs: nowMs + catalogPullRetryDelayMs(consecutiveFailures)
+	};
+}
+/**
+* May a POLL-driven pull run for this device right now?
+*
+* Only the poll is gated. An event-driven reconcile (device registered,
+* stream params changed) is EVIDENCE that something moved and always
+* attempts — a backoff that ignores new information is just a slower way of
+* being wrong.
+*/
+function mayAttemptPolledCatalogPull(state, nowMs) {
+	if (state === void 0) return true;
+	return nowMs >= state.nextAttemptAtMs;
+}
 /**
 * Minimum gap between two re-dials of the same device. A re-dial costs a
 * ~2 s video interruption on every source of the camera; at the 30 s
@@ -14645,6 +14745,13 @@ var StreamBrokerManager = class StreamBrokerManager {
 	deviceOverridePersister = null;
 	profileMapPersister = null;
 	deviceCatalogOperations = /* @__PURE__ */ new Map();
+	/**
+	* Devices whose `stream-catalog` pull is currently failing, and when the
+	* POLL may ask again. Absent = healthy; an entry is deleted the moment a
+	* pull succeeds. See `catalog-pull-backoff.ts` for the ladder and for the
+	* outage that put it here.
+	*/
+	catalogPullFailures = /* @__PURE__ */ new Map();
 	eventBus = null;
 	/**
 	* Per-broker stream health flag set by the watchdog. `undefined`
@@ -16196,26 +16303,54 @@ var StreamBrokerManager = class StreamBrokerManager {
 	/**
 	* Pull one camera's `stream-catalog` and reconcile its cam-streams: upsert
 	* every descriptor, retract any cam-stream no longer in the catalog. A pull
-	* that throws (provider mid-restart, no `stream-catalog` cap) is skipped —
-	* the poll retries. An EMPTY catalog is also skipped rather than tearing
-	* down (a provider probe can transiently return none); genuine removal flows
-	* through the device-unregistered path.
+	* that throws (provider mid-restart, no `stream-catalog` cap, a camera whose
+	* session died) omits THIS DEVICE ONLY — it is logged at `warn` with the
+	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder. An EMPTY
+	* catalog is also skipped rather than tearing down (a provider probe can
+	* transiently return none); genuine removal flows through the
+	* device-unregistered path.
+	*
+	* `trigger` decides whether the backoff applies — see
+	* {@link CatalogReconcileTrigger}. It defaults to `'event'` (always attempt)
+	* so only the caller that actually repeats forever pays the throttle.
 	*/
-	async reconcileDeviceCatalog(deviceId) {
-		await this.runDeviceCatalogOperation(deviceId, () => this.reconcileDeviceCatalogNow(deviceId));
+	async reconcileDeviceCatalog(deviceId, trigger = "event") {
+		await this.runDeviceCatalogOperation(deviceId, () => this.reconcileDeviceCatalogNow(deviceId, trigger));
 	}
-	async reconcileDeviceCatalogNow(deviceId) {
+	async reconcileDeviceCatalogNow(deviceId, trigger) {
 		if (!this.api) return;
+		const failure = this.catalogPullFailures.get(deviceId);
+		if (trigger === "poll" && !mayAttemptPolledCatalogPull(failure, Date.now())) {
+			this.logger.debug("reconcileDeviceCatalog: skipped — device is on catalog-pull backoff", {
+				tags: { deviceId },
+				meta: {
+					consecutiveFailures: failure?.consecutiveFailures ?? 0,
+					nextAttemptInMs: Math.max(0, (failure?.nextAttemptAtMs ?? 0) - Date.now())
+				}
+			});
+			return;
+		}
 		let descriptors;
 		try {
 			descriptors = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId) ?? [];
 		} catch (err) {
-			this.logger.debug("reconcileDeviceCatalog: stream-catalog pull failed — will retry", {
+			const next = nextCatalogPullFailureState(this.catalogPullFailures.get(deviceId), Date.now());
+			this.catalogPullFailures.set(deviceId, next);
+			this.logger.warn("stream-catalog pull failed — device omitted from this catalog reconcile", {
 				tags: { deviceId },
-				meta: { error: require_dist.errMsg(err) }
+				meta: {
+					trigger,
+					consecutiveFailures: next.consecutiveFailures,
+					retryInMs: catalogPullRetryDelayMs(next.consecutiveFailures),
+					error: require_dist.errMsg(err)
+				}
 			});
 			return;
 		}
+		if (this.catalogPullFailures.delete(deviceId)) this.logger.info("stream-catalog pull recovered — device is back in the catalog", {
+			tags: { deviceId },
+			meta: { descriptors: descriptors.length }
+		});
 		if (descriptors.length === 0) return;
 		const keep = new Set(descriptors.map((d) => d.camStreamId));
 		await this.publishCatalog(deviceId, descriptors);
@@ -16250,10 +16385,11 @@ var StreamBrokerManager = class StreamBrokerManager {
 			await this.releaseDisabledDeviceBrokers(d.id, firstSeen);
 		} else this.disabledDevices.delete(d.id);
 		const live = cameras.filter((d) => !d.disabled);
-		await Promise.allSettled(live.map((d) => this.reconcileDeviceCatalog(d.id)));
+		await Promise.allSettled(live.map((d) => this.reconcileDeviceCatalog(d.id, "poll")));
 		await Promise.allSettled(live.map((d) => this.reconcileDeviceAudioPlane(d.id)));
 		const liveIds = new Set(live.map((d) => d.id));
 		for (const deviceId of [...this.audioPlaneState.keys()]) if (!liveIds.has(deviceId)) this.audioPlaneState.delete(deviceId);
+		for (const deviceId of [...this.catalogPullFailures.keys()]) if (!liveIds.has(deviceId)) this.catalogPullFailures.delete(deviceId);
 	}
 	/**
 	* ONE device's audio-plane reconcile pass. See `audio-plane-reconcile.ts`
@@ -16395,6 +16531,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		await this.runDeviceCatalogOperation(deviceId, () => this.retractDeviceNow(deviceId, opts));
 	}
 	async retractDeviceNow(deviceId, opts) {
+		this.catalogPullFailures.delete(deviceId);
 		const existing = this.cameraStreams.get(deviceId);
 		if (existing) for (const camStreamId of Array.from(existing.keys())) await this.retractCameraStream({
 			deviceId,

package/dist/stream-broker/index.mjs

@@ -1,10 +1,10 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
-import { $ as loadContributionCapability, $t as union, At as CAM_PROFILE_ORDER, Bt as parseProfileBrokerId, C as RATE_CONTROL_RELAXED, Ct as errMsg, D as RingBuffer, Dt as invocationFromEncodeProfile, Et as buildFfmpegArgs$1, F as createHwAccelCache, Ft as isEvent, G as egressTranscodeSharingKey, Gt as boolean, I as createLogChannelsProvider, It as makeProfileBrokerId, Jt as literal, K as egressTransportFromRequest, Kt as discriminatedUnion, Lt as makeSourceBrokerId, Mt as DeviceType, N as batteryCapability, Nt as createEvent, Ot as isSoftwareDecode, P as cameraStreamsCapability, Qt as string, R as declareLogChannel, Rt as nodePin, St as webrtcSessionCapability, Ut as _enum, V as deriveBatteryPresence, Wt as array, Xt as object, Yt as number, Zt as record, bt as streamBrokerCapability, en as EventCategory, et as logChannelsCapability, g as EncodeProfileSchema, ht as resolveEgressDecodeHwAccel, i as BatteryStatusSchema, jt as DeviceFeature, k as addonWidgetsSourceCapability, kt as BaseAddon, nt as maskUrlCredentials, w as RATE_CONTROL_TIGHT, wt as AUDIO_PRESETS } from "../dist-g0Or5_pR.mjs";
-import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-Bo1g8hLO.mjs";
+import { $ as loadContributionCapability, $t as string, At as BaseAddon, C as RATE_CONTROL_RELAXED, Ct as errMsg, D as RingBuffer, Dt as invocationFromEncodeProfile, Et as buildFfmpegArgs$1, F as createHwAccelCache, G as egressTranscodeSharingKey, Gt as array, I as createLogChannelsProvider, It as isEvent, K as egressTransportFromRequest, Kt as boolean, Lt as makeProfileBrokerId, Mt as DeviceFeature, N as batteryCapability, Nt as DeviceType, Ot as isSoftwareDecode, P as cameraStreamsCapability, Pt as createEvent, Qt as record, R as declareLogChannel, Rt as makeSourceBrokerId, St as webrtcSessionCapability, V as deriveBatteryPresence, Vt as parseProfileBrokerId, Wt as _enum, Xt as number, Yt as literal, Zt as object, bt as streamBrokerCapability, en as union, et as logChannelsCapability, g as EncodeProfileSchema, ht as resolveEgressDecodeHwAccel, i as BatteryStatusSchema, jt as CAM_PROFILE_ORDER, k as addonWidgetsSourceCapability, kt as BOOT_RECOVERY_BACKOFF_MS, nt as maskUrlCredentials, qt as discriminatedUnion, tn as EventCategory, w as RATE_CONTROL_TIGHT, wt as AUDIO_PRESETS, zt as nodePin } from "../dist-CmEYRK7G.mjs";
+import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-J07GBWT3.mjs";
 import { t as parseRestreamPath } from "../restream-intent-B4BXZra7.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
-import { i as require_mp4box_all, n as demuxSegmentPreferJs, r as runFfmpegOnce, t as demuxSegmentFullJs } from "../segment-demux-js-C-a2pghM.mjs";
+import { i as require_mp4box_all, n as demuxSegmentPreferJs, r as runFfmpegOnce, t as demuxSegmentFullJs } from "../segment-demux-js-Ck9ly4bX.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -2242,6 +2242,20 @@ function appendAudioMediaBlock(videoSdp, audioBlock) {
 	return `${videoSdp.replace(/[\r\n]+$/, "")}\r\n${audioBlock}\r\n`;
 }
 //#endregion
+//#region src/stream-broker/rtsp/join-burst-admission.ts
+/**
+* Decide whether this session may take this burst.
+*
+* Pure and total: no clock, no logger, no restreamer state. The restreamer maps
+* the result onto its counters and its `continue`.
+*/
+function admitJoinBurst(input) {
+	if (input.muted && !input.detectionIntent) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
+	if (!input.detectionIntent && input.spanMs > input.bound.maxSpanMs) return "span";
+	if (input.packets > input.bound.maxPackets) return "packets";
+	return "none";
+}
+//#endregion
 //#region src/stream-broker/rtsp/rtsp-types.ts
 /** RTSP method constants. */
 var RTSP_METHODS = [
@@ -2868,8 +2882,6 @@ var RtspRestreamer = class {
 		if (ready.length === 0) return;
 		const preRollPlans = /* @__PURE__ */ new Map();
 		const bound = this.currentPrimeBound();
-		const overSpan = spanMs > bound.maxSpanMs;
-		const overPackets = primePackets.length > bound.maxPackets;
 		/**
 		* Resolve (and memoize) the plan for one intent.
 		*
@@ -2935,14 +2947,18 @@ var RtspRestreamer = class {
 					continue;
 				}
 			}
-			if (session.isMuted() && !detectionIntent) {
-				if (!fromRing || spanMs > LIVE_EDGE_MAX_SPAN_MS) {
-					this.dropsWithheldMutedLiveEdge++;
-					withheld++;
-					continue;
-				}
-			} else if (overSpan || overPackets) {
-				if (overSpan) this.dropsWithheldSpan++;
+			const withhold = admitJoinBurst({
+				muted: session.isMuted(),
+				detectionIntent,
+				fromRing,
+				spanMs,
+				packets: primePackets.length,
+				bound,
+				liveEdgeMaxSpanMs: LIVE_EDGE_MAX_SPAN_MS
+			});
+			if (withhold !== "none") {
+				if (withhold === "live-edge") this.dropsWithheldMutedLiveEdge++;
+				else if (withhold === "span") this.dropsWithheldSpan++;
 				else this.dropsWithheldPackets++;
 				withheld++;
 				continue;
@@ -4128,6 +4144,90 @@ function buildAudioCodecCapApi(api) {
 		flushEncode: (input) => router.flushEncode.mutate(input)
 	};
 }
+//#endregion
+//#region src/stream-broker/stream-broker/catalog-pull-backoff.ts
+/**
+* CATALOG-PULL BACKOFF — how often the broker asks a camera whose
+* `stream-catalog` pull keeps failing.
+*
+* ## What this exists to stop
+*
+* 2026-08-25, device 3629 ("Videocamera porta retro", Reolink). Its Baichuan
+* session expired under a socket that stayed open, so every
+* `stream-catalog.getCatalog` answered `buildVideoStreamOptions failed …
+* responseCode 400`. The reconcile poll asked again 30 s later. And again. For
+* 35 minutes, ~70 identical failures, each one a login attempt, a 10 s timeout
+* budget and a `debug` line nobody was reading.
+*
+* The fleet was never at risk from that camera — `reconcileAllCatalogs` fans
+* out with `Promise.allSettled` and `reconcileDeviceCatalogNow` catches its own
+* pull, so exactly one device was omitted (that isolation is frozen by
+* `scripts/check-catalog-per-device-isolation.ts`). What was wrong is that the
+* omission was invisible and the retry was a flat 30 s hammer that could not
+* have recovered anyway.
+*
+* ## The shape
+*
+* The ladder is {@link BOOT_RECOVERY_BACKOFF_MS} — the repo's ONE retry
+* schedule for work that can fail for reasons that pass: two cheap attempts
+* (15 s, 60 s) for a blip, then the long tail (5 m → 90 m) for a camera that
+* is genuinely gone.
+*
+* ## The one place this DIVERGES from boot recovery, and why
+*
+* The boot ladder ENDS: it runs out and manual re-arm is the only path. This
+* one CLAMPS at the last rung and keeps asking every 90 minutes forever.
+*
+* Boot recovery can end because a human is present — a node that just booted
+* wrong is a node someone is looking at. A camera whose session expired at
+* 03:00 has nobody. The reconcile poll is the ONLY thing that will ever ask it
+* again: no event fires when a camera silently starts working, and a device
+* that never re-enters the catalog is a device with no broker, no recording
+* and no detection, permanently. Ending the chain would convert a transient
+* session expiry into a permanent outage — precisely the failure it is meant
+* to bound. A 90-minute floor is not a spin: it is ~16 pulls a day for one
+* broken camera, against 2 880 before this.
+*/
+/**
+* The rung the ladder settles on. Read off the shared schedule rather than
+* written down twice; the literal only keeps the expression total for a
+* hypothetically empty ladder, and is not the clamp.
+*/
+var LAST_RUNG_MS = BOOT_RECOVERY_BACKOFF_MS[BOOT_RECOVERY_BACKOFF_MS.length - 1] ?? 90 * 6e4;
+/**
+* Delay before the next poll-driven attempt, given how many pulls in a row
+* have now failed (1 = the first failure).
+*
+* Clamped at the last rung rather than exhausted — see the module doc.
+*/
+function catalogPullRetryDelayMs(consecutiveFailures) {
+	return BOOT_RECOVERY_BACKOFF_MS[Math.max(consecutiveFailures, 1) - 1] ?? LAST_RUNG_MS;
+}
+/**
+* Advance the failure memory after one more failed pull.
+*
+* @param previous state before this failure, or `undefined` for the first one
+* @param nowMs wall clock at the moment of the failure
+*/
+function nextCatalogPullFailureState(previous, nowMs) {
+	const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
+	return {
+		consecutiveFailures,
+		nextAttemptAtMs: nowMs + catalogPullRetryDelayMs(consecutiveFailures)
+	};
+}
+/**
+* May a POLL-driven pull run for this device right now?
+*
+* Only the poll is gated. An event-driven reconcile (device registered,
+* stream params changed) is EVIDENCE that something moved and always
+* attempts — a backoff that ignores new information is just a slower way of
+* being wrong.
+*/
+function mayAttemptPolledCatalogPull(state, nowMs) {
+	if (state === void 0) return true;
+	return nowMs >= state.nextAttemptAtMs;
+}
 /**
 * Minimum gap between two re-dials of the same device. A re-dial costs a
 * ~2 s video interruption on every source of the camera; at the 30 s
@@ -14642,6 +14742,13 @@ var StreamBrokerManager = class StreamBrokerManager {
 	deviceOverridePersister = null;
 	profileMapPersister = null;
 	deviceCatalogOperations = /* @__PURE__ */ new Map();
+	/**
+	* Devices whose `stream-catalog` pull is currently failing, and when the
+	* POLL may ask again. Absent = healthy; an entry is deleted the moment a
+	* pull succeeds. See `catalog-pull-backoff.ts` for the ladder and for the
+	* outage that put it here.
+	*/
+	catalogPullFailures = /* @__PURE__ */ new Map();
 	eventBus = null;
 	/**
 	* Per-broker stream health flag set by the watchdog. `undefined`
@@ -16193,26 +16300,54 @@ var StreamBrokerManager = class StreamBrokerManager {
 	/**
 	* Pull one camera's `stream-catalog` and reconcile its cam-streams: upsert
 	* every descriptor, retract any cam-stream no longer in the catalog. A pull
-	* that throws (provider mid-restart, no `stream-catalog` cap) is skipped —
-	* the poll retries. An EMPTY catalog is also skipped rather than tearing
-	* down (a provider probe can transiently return none); genuine removal flows
-	* through the device-unregistered path.
+	* that throws (provider mid-restart, no `stream-catalog` cap, a camera whose
+	* session died) omits THIS DEVICE ONLY — it is logged at `warn` with the
+	* device's id and re-asked on the `catalog-pull-backoff.ts` ladder. An EMPTY
+	* catalog is also skipped rather than tearing down (a provider probe can
+	* transiently return none); genuine removal flows through the
+	* device-unregistered path.
+	*
+	* `trigger` decides whether the backoff applies — see
+	* {@link CatalogReconcileTrigger}. It defaults to `'event'` (always attempt)
+	* so only the caller that actually repeats forever pays the throttle.
 	*/
-	async reconcileDeviceCatalog(deviceId) {
-		await this.runDeviceCatalogOperation(deviceId, () => this.reconcileDeviceCatalogNow(deviceId));
+	async reconcileDeviceCatalog(deviceId, trigger = "event") {
+		await this.runDeviceCatalogOperation(deviceId, () => this.reconcileDeviceCatalogNow(deviceId, trigger));
 	}
-	async reconcileDeviceCatalogNow(deviceId) {
+	async reconcileDeviceCatalogNow(deviceId, trigger) {
 		if (!this.api) return;
+		const failure = this.catalogPullFailures.get(deviceId);
+		if (trigger === "poll" && !mayAttemptPolledCatalogPull(failure, Date.now())) {
+			this.logger.debug("reconcileDeviceCatalog: skipped — device is on catalog-pull backoff", {
+				tags: { deviceId },
+				meta: {
+					consecutiveFailures: failure?.consecutiveFailures ?? 0,
+					nextAttemptInMs: Math.max(0, (failure?.nextAttemptAtMs ?? 0) - Date.now())
+				}
+			});
+			return;
+		}
 		let descriptors;
 		try {
 			descriptors = await this.withCatalogTimeout(this.api.streamCatalog.getCatalog.query({ deviceId }), deviceId) ?? [];
 		} catch (err) {
-			this.logger.debug("reconcileDeviceCatalog: stream-catalog pull failed — will retry", {
+			const next = nextCatalogPullFailureState(this.catalogPullFailures.get(deviceId), Date.now());
+			this.catalogPullFailures.set(deviceId, next);
+			this.logger.warn("stream-catalog pull failed — device omitted from this catalog reconcile", {
 				tags: { deviceId },
-				meta: { error: errMsg(err) }
+				meta: {
+					trigger,
+					consecutiveFailures: next.consecutiveFailures,
+					retryInMs: catalogPullRetryDelayMs(next.consecutiveFailures),
+					error: errMsg(err)
+				}
 			});
 			return;
 		}
+		if (this.catalogPullFailures.delete(deviceId)) this.logger.info("stream-catalog pull recovered — device is back in the catalog", {
+			tags: { deviceId },
+			meta: { descriptors: descriptors.length }
+		});
 		if (descriptors.length === 0) return;
 		const keep = new Set(descriptors.map((d) => d.camStreamId));
 		await this.publishCatalog(deviceId, descriptors);
@@ -16247,10 +16382,11 @@ var StreamBrokerManager = class StreamBrokerManager {
 			await this.releaseDisabledDeviceBrokers(d.id, firstSeen);
 		} else this.disabledDevices.delete(d.id);
 		const live = cameras.filter((d) => !d.disabled);
-		await Promise.allSettled(live.map((d) => this.reconcileDeviceCatalog(d.id)));
+		await Promise.allSettled(live.map((d) => this.reconcileDeviceCatalog(d.id, "poll")));
 		await Promise.allSettled(live.map((d) => this.reconcileDeviceAudioPlane(d.id)));
 		const liveIds = new Set(live.map((d) => d.id));
 		for (const deviceId of [...this.audioPlaneState.keys()]) if (!liveIds.has(deviceId)) this.audioPlaneState.delete(deviceId);
+		for (const deviceId of [...this.catalogPullFailures.keys()]) if (!liveIds.has(deviceId)) this.catalogPullFailures.delete(deviceId);
 	}
 	/**
 	* ONE device's audio-plane reconcile pass. See `audio-plane-reconcile.ts`
@@ -16392,6 +16528,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		await this.runDeviceCatalogOperation(deviceId, () => this.retractDeviceNow(deviceId, opts));
 	}
 	async retractDeviceNow(deviceId, opts) {
+		this.catalogPullFailures.delete(deviceId);
 		const existing = this.cameraStreams.get(deviceId);
 		if (existing) for (const camStreamId of Array.from(existing.keys())) await this.retractCameraStream({
 			deviceId,

package/dist/stream-broker/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-AH6OJ3hJ.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-Cad8960O.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/dist/{worker-protocol-BLfaD5uC.js → worker-protocol-Bpz62eyB.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-4EMKvxCp.js");
+const require_dist = require("./dist-BuIP0499.js");
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.
@@ -253,6 +253,7 @@ function isWorkerReply(value) {
 		case "ended": return true;
 		case "error": return typeof value.message === "string" && (value.frameId === void 0 || isFiniteNumber(value.frameId));
 		case "log": return isWorkerLogLevel(value.level) && typeof value.message === "string";
+		case "dialTiming": return isFiniteNumber(value.hwContextMs) && isFiniteNumber(value.demuxerOpenMs) && isFiniteNumber(value.decoderCreateMs) && isFiniteNumber(value.firstDecodeMs) && typeof value.streamInfoProbed === "boolean";
 		default: return false;
 	}
 }

package/dist/{worker-protocol-vc8WWhjx.mjs → worker-protocol-wMS29PG9.mjs}

@@ -1,4 +1,4 @@
-import { b as NativeLeaseSettingsSchema, p as DEFAULT_NATIVE_LEASE_SETTINGS, y as NativeLeaseAdmissionSchema } from "./dist-g0Or5_pR.mjs";
+import { b as NativeLeaseSettingsSchema, p as DEFAULT_NATIVE_LEASE_SETTINGS, y as NativeLeaseAdmissionSchema } from "./dist-CmEYRK7G.mjs";
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.
@@ -253,6 +253,7 @@ function isWorkerReply(value) {
 		case "ended": return true;
 		case "error": return typeof value.message === "string" && (value.frameId === void 0 || isFiniteNumber(value.frameId));
 		case "log": return isWorkerLogLevel(value.level) && typeof value.message === "string";
+		case "dialTiming": return isFiniteNumber(value.hwContextMs) && isFiniteNumber(value.demuxerOpenMs) && isFiniteNumber(value.decoderCreateMs) && isFiniteNumber(value.firstDecodeMs) && typeof value.streamInfoProbed === "boolean";
 		default: return false;
 	}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.137",
+  "version": "1.2.138",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",
@@ -109,7 +109,8 @@
         "execution": {
           "placement": "any-node",
           "heapProfile": "heavy",
-          "group": "detection"
+          "group": "detection",
+          "rssBudgetMb": 1536
         },
         "protected": true,
         "icon": "assets/icon.svg",
@@ -152,7 +153,8 @@
         "entry": "./dist/audio-analyzer/index.js",
         "execution": {
           "placement": "any-node",
-          "heapProfile": "heavy"
+          "heapProfile": "heavy",
+          "rssBudgetMb": 512
         },
         "capabilities": [
           {