@camstack/addon-pipeline 1.2.177 → 1.2.179

package/dist/audio-analyzer/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DxA44rNd.js");
-const require_process_memory = require("../process-memory-C6gjUbUI.js");
+const require_dist = require("../dist-Bbu27T_N.js");
+const require_process_memory = require("../process-memory-DFA42X6A.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-D7aPrnxq.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-D2ik9mux.mjs";
+import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-pMHigtQu.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BSR1vUsp.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { downloadFile } from "@camstack/system/addon-utils";

package/dist/detection-pipeline/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DxA44rNd.js");
-const require_node = require("../node-D8a2tmPR.js");
-const require_local_frame_registry = require("../local-frame-registry-8Hzf6pPx.js");
-const require_lazy_sharp = require("../lazy-sharp-B9gAzlWk.js");
+const require_dist = require("../dist-Bbu27T_N.js");
+const require_node = require("../node-DMTe6WuM.js");
+const require_local_frame_registry = require("../local-frame-registry-DK-Z1Ev1.js");
+const require_lazy_sharp = require("../lazy-sharp-V_rih5vD.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_process_memory = require("../process-memory-C6gjUbUI.js");
+const require_process_memory = require("../process-memory-DFA42X6A.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");
@@ -679,6 +679,8 @@ var MSG_INFER_CACHED = 5;
 */
 var MSG_INFER_BATCH = 3;
 var PREFIX_LEN = 9;
+/** Bytes of the absolute-deadline prefix a v2 sheddable payload carries. */
+var DEADLINE_PREFIX_LEN = 8;
 /**
 * Wire-level enum for the raw-frame fast path. Values are append-only:
 * the Python pool reads the byte directly off the IPC frame; reordering
@@ -867,6 +869,20 @@ var PoolWorker = class {
 	*  Surfaced so "the camera is quiet" and "the camera is saturated" can be
 	*  told apart without reading the logs. */
 	shedCount = 0;
+	/**
+	* Live requests whose deadline fired IN FLIGHT and were answered dropped by
+	* the local watchdog (the worker never replied in time). With a v2 worker
+	* this is the rare backstop — the worker sheds expired work itself and
+	* replies fast; against a v1 worker it is the only shed there is.
+	*/
+	deadlineShedCount = 0;
+	/**
+	* Negotiated wire version for THIS worker: `min(POOL_PROTOCOL_VERSION,
+	* what the ready handshake reported)`. A worker that reports nothing is a
+	* v1 worker and keeps receiving the byte-identical old layout — the deploy
+	* skew case that must always work (D350).
+	*/
+	wireVersion = 1;
 	nextRequestId = 1;
 	ready = false;
 	log;
@@ -936,6 +952,7 @@ var PoolWorker = class {
 		const config = {
 			runtime: this.opts.poolRuntime,
 			concurrency: this.opts.concurrency,
+			protocolVersion: 2,
 			models: initialModels.map((m) => serializeModelConfig(m))
 		};
 		if (this.opts.device) config["device"] = this.opts.device;
@@ -960,10 +977,13 @@ var PoolWorker = class {
 						this.ready = true;
 						const loadedCount = result["models"];
 						const startupMs = result["startupMs"];
+						const workers = result["workers"] ?? 1;
+						const reported = result["protocolVersion"];
+						this.wireVersion = Math.min(2, typeof reported === "number" && Number.isFinite(reported) ? reported : 1);
 						resolve({
 							startupMs,
 							loadedCount,
-							workers: result["workers"] ?? 1
+							workers
 						});
 					} else reject(/* @__PURE__ */ new Error(`Unexpected pool status: ${JSON.stringify(result)}`));
 				},
@@ -1095,19 +1115,35 @@ var PoolWorker = class {
 	deadlineFor(msgType) {
 		return SHEDDABLE_MSG_TYPES.has(msgType) ? POOL_LIVE_INFER_TIMEOUT_MS : POOL_INFER_TIMEOUT_MS;
 	}
+	/**
+	* The request's ABSOLUTE deadline for the wire (D350), or `null` when this
+	* request must not carry one: commands / model loads / cacheFrame at any
+	* version, and EVERYTHING against a v1 worker — the old layout has no room
+	* for the prefix, and a worker at a different version is the normal state
+	* during a rolling deploy. The stamp is the same instant the local watchdog
+	* arms, so "the TS side has abandoned this" and "the worker refuses to run
+	* it" are one moment, not two clocks drifting apart.
+	*/
+	deadlineStamp(msgType) {
+		if (this.wireVersion < 2 || !SHEDDABLE_MSG_TYPES.has(msgType)) return null;
+		const stamp = Buffer.allocUnsafe(DEADLINE_PREFIX_LEN);
+		stamp.writeBigUInt64LE(BigInt(Date.now() + this.deadlineFor(msgType)), 0);
+		return stamp;
+	}
 	dispatch(msgType, payload, deviceId) {
 		const shed = this.shedIfSaturated(msgType, deviceId);
 		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType), deviceId);
+			const timer = this.armRequestTimeout(reqId, msgType, resolve, reject, deviceId);
 			this.pending.set(reqId, {
 				resolve,
 				reject,
 				timer
 			});
 			try {
-				this.writeFrame(reqId, msgType, payload);
+				const stamp = this.deadlineStamp(msgType);
+				this.writeFrame(reqId, msgType, stamp ? Buffer.concat([stamp, payload]) : payload);
 			} catch (err) {
 				clearTimeout(timer);
 				this.pending.delete(reqId);
@@ -1116,13 +1152,51 @@ var PoolWorker = class {
 		});
 	}
 	/**
-	* Arm a watchdog that rejects a still-pending inference request after
-	* `POOL_INFER_TIMEOUT_MS`. `unref` so it never keeps the event loop alive.
-	* The normal response + `rejectAll` paths clear it via `PendingRequest.timer`.
-	*/
-	armRequestTimeout(reqId, reject, timeoutMs, deviceId) {
+	* Arm a watchdog for a still-pending request. `unref` so it never keeps the
+	* event loop alive. The normal response + `rejectAll` paths clear it via
+	* `PendingRequest.timer`.
+	*
+	* The two request classes settle DIFFERENTLY on expiry (D350):
+	*
+	* - A SHEDDABLE (live inference) request RESOLVES as a shed —
+	*   `{dropped: true, shedReason: 'deadline-expired'}` — because at this
+	*   point the answer is worthless whether or not it eventually arrives, and
+	*   a shed is flow control the executor already handles. It fires only when
+	*   the worker never replied at all: a v2 worker sheds expired work itself
+	*   (fast reply, this timer is cleared), so this is the wedged-worker
+	*   backstop and the v1-worker compatibility path. The 2026-09-04 storm
+	*   logged this state 16 146 times at ERROR; the shed is logged sampled at
+	*   WARN and counted (`getDeadlineExpiredShedCount`) instead.
+	* - Anything else (commands, model loads) still REJECTS with the error the
+	*   dashboards grep for — a lost command is a fault, not flow control.
+	*/
+	armRequestTimeout(reqId, msgType, resolve, reject, deviceId) {
+		const timeoutMs = this.deadlineFor(msgType);
 		const timer = setTimeout(() => {
 			if (this.pending.delete(reqId)) {
+				if (SHEDDABLE_MSG_TYPES.has(msgType)) {
+					this.deadlineShedCount++;
+					const total = this.deadlineShedCount;
+					if (total === 1 || total % SHED_LOG_SAMPLE_EVERY === 0) this.log.warn("live inference deadline expired in flight — answered dropped", {
+						...deviceId !== void 0 ? { tags: { deviceId } } : {},
+						meta: {
+							worker: this.opts.workerLabel,
+							pid: this.getPid(),
+							runtime: this.opts.poolRuntime,
+							device: this.opts.device ?? "default",
+							inFlight: this.pending.size,
+							reqId,
+							timeoutMs,
+							deadlineShedTotal: total,
+							sampledEvery: SHED_LOG_SAMPLE_EVERY
+						}
+					});
+					resolve({
+						dropped: true,
+						shedReason: "deadline-expired"
+					});
+					return;
+				}
 				this.log.error("inference request timed out", {
 					...deviceId !== void 0 ? { tags: { deviceId } } : {},
 					meta: {
@@ -1146,7 +1220,7 @@ var PoolWorker = class {
 		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType), deviceId);
+			const timer = this.armRequestTimeout(reqId, msgType, resolve, reject, deviceId);
 			this.pending.set(reqId, {
 				resolve,
 				reject,
@@ -1154,11 +1228,14 @@ var PoolWorker = class {
 			});
 			try {
 				if (!this.process?.stdin) throw new Error("PoolWorker: not initialized");
+				const stamp = this.deadlineStamp(msgType);
+				const wireLen = payloadLen + (stamp ? DEADLINE_PREFIX_LEN : 0);
 				const prefix = Buffer.allocUnsafe(PREFIX_LEN);
-				prefix.writeUInt32LE(5 + payloadLen, 0);
+				prefix.writeUInt32LE(5 + wireLen, 0);
 				prefix.writeUInt32LE(reqId, 4);
 				prefix[8] = msgType;
 				this.process.stdin.write(prefix);
+				if (stamp) this.process.stdin.write(stamp);
 				for (const part of parts) this.process.stdin.write(part);
 			} catch (err) {
 				clearTimeout(timer);
@@ -1261,12 +1338,22 @@ var SharedInferencePool = class {
 	nextFreeIndex = 0;
 	nextFrameId = 1;
 	/**
-	* Cumulative count of frames the Python pool SHED under overload
-	* (`"dropped": true` responses from the per-model in-flight bound in
-	* inference_pool.py). Without this the shed response is
-	* indistinguishable from a genuine "no detections" result.
+	* Cumulative count of dropped (shed) responses on the single-frame and
+	* batch inference paths: the Python per-model bound, the Python
+	* deadline-expired shed, and the TS in-flight watchdog's own
+	* deadline-expired resolution all land here. Without this a shed response
+	* is indistinguishable from a genuine "no detections" result.
 	*/
 	droppedResponseCount = 0;
+	/**
+	* The `shedReason: 'deadline-expired'` subset of {@link
+	* droppedResponseCount} — work that was ALREADY DEAD when it would have
+	* run (D350). This is the number that was zero-by-construction while the
+	* 2026-09-04 storm burned the accelerator on abandoned requests for 4h15m;
+	* a rising value here under load is the pool refusing dead work, which is
+	* the fix working, not a fault.
+	*/
+	deadlineExpiredShedCount = 0;
 	log;
 	concurrency;
 	tuning;
@@ -1352,7 +1439,12 @@ var SharedInferencePool = class {
 	}
 	async inferBatch(modelIndex, items, frameId = 0) {
 		if (items.length > 255) throw new Error(`SharedInferencePool.inferBatch: max 255 items per call, got ${items.length}`);
-		return this.pickWorker().inferBatch(this.encodeModelByte(modelIndex), items, frameId);
+		const results = await this.pickWorker().inferBatch(this.encodeModelByte(modelIndex), items, frameId);
+		for (const item of results) if (item["dropped"] === true) {
+			this.droppedResponseCount++;
+			if (item["shedReason"] === "deadline-expired") this.deadlineExpiredShedCount++;
+		}
+		return results;
 	}
 	async inferCached(modelIndex, frameId, deviceId) {
 		const w = this.pickWorker();
@@ -1366,6 +1458,16 @@ var SharedInferencePool = class {
 	getDroppedResponseCount() {
 		return this.droppedResponseCount;
 	}
+	/**
+	* The `deadline-expired` subset of {@link getDroppedResponseCount}:
+	* requests refused (by the Python worker, or by the local in-flight
+	* watchdog as its backstop) because their absolute deadline had already
+	* passed — dead work NOT executed (D350). Monotonic for the pool's
+	* lifetime; surfaced on the memory watchdog's `pool memory` line.
+	*/
+	getDeadlineExpiredShedCount() {
+		return this.deadlineExpiredShedCount;
+	}
 	getHandle(modelIndex) {
 		return new PoolHandle(this, modelIndex);
 	}
@@ -1504,10 +1606,13 @@ var SharedInferencePool = class {
 	trackDroppedResponse(result, modelIndex) {
 		if (result["dropped"] === true) {
 			this.droppedResponseCount++;
+			if (result["shedReason"] === "deadline-expired") this.deadlineExpiredShedCount++;
 			const total = this.droppedResponseCount;
 			if (total === 1 || total % SHED_LOG_SAMPLE_EVERY === 0) this.log.debug("Python pool shed frame under overload", { meta: {
 				modelIndex,
 				droppedTotal: total,
+				deadlineExpiredTotal: this.deadlineExpiredShedCount,
+				...typeof result["shedReason"] === "string" ? { shedReason: result["shedReason"] } : {},
 				sampledEvery: SHED_LOG_SAMPLE_EVERY,
 				runtime: this.poolRuntime,
 				device: this.device ?? "default"
@@ -2396,11 +2501,13 @@ var EngineFactory = class {
 		if (!this.pool) return {
 			inFlight: 0,
 			shed: 0,
-			dropped: 0
+			dropped: 0,
+			deadlineExpired: 0
 		};
 		return {
 			...this.pool.getBacklog(),
-			dropped: this.pool.getDroppedResponseCount()
+			dropped: this.pool.getDroppedResponseCount(),
+			deadlineExpired: this.pool.getDeadlineExpiredShedCount()
 		};
 	}
 	/** Python-side per-worker memory diagnostics (see SharedInferencePool). */
@@ -2887,6 +2994,7 @@ async function samplePool(pool, log, reportedDead) {
 			inFlight: backlog.inFlight,
 			shed: backlog.shed,
 			dropped: backlog.dropped,
+			deadlineExpired: backlog.deadlineExpired,
 			modelsLoaded: pool.factory.listLoaded().length,
 			memStats
 		}

package/dist/detection-pipeline/index.mjs

@@ -1,10 +1,10 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-D7aPrnxq.mjs";
-import { a as readProcessCost } from "../node--gufH5K3.mjs";
-import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-CZGAexUl.mjs";
+import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-pMHigtQu.mjs";
+import { a as readProcessCost } from "../node-CmPPt-uJ.mjs";
+import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-C7uCSrQG.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-D2ik9mux.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BSR1vUsp.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { spawn } from "node:child_process";
@@ -672,6 +672,8 @@ var MSG_INFER_CACHED = 5;
 */
 var MSG_INFER_BATCH = 3;
 var PREFIX_LEN = 9;
+/** Bytes of the absolute-deadline prefix a v2 sheddable payload carries. */
+var DEADLINE_PREFIX_LEN = 8;
 /**
 * Wire-level enum for the raw-frame fast path. Values are append-only:
 * the Python pool reads the byte directly off the IPC frame; reordering
@@ -860,6 +862,20 @@ var PoolWorker = class {
 	*  Surfaced so "the camera is quiet" and "the camera is saturated" can be
 	*  told apart without reading the logs. */
 	shedCount = 0;
+	/**
+	* Live requests whose deadline fired IN FLIGHT and were answered dropped by
+	* the local watchdog (the worker never replied in time). With a v2 worker
+	* this is the rare backstop — the worker sheds expired work itself and
+	* replies fast; against a v1 worker it is the only shed there is.
+	*/
+	deadlineShedCount = 0;
+	/**
+	* Negotiated wire version for THIS worker: `min(POOL_PROTOCOL_VERSION,
+	* what the ready handshake reported)`. A worker that reports nothing is a
+	* v1 worker and keeps receiving the byte-identical old layout — the deploy
+	* skew case that must always work (D350).
+	*/
+	wireVersion = 1;
 	nextRequestId = 1;
 	ready = false;
 	log;
@@ -929,6 +945,7 @@ var PoolWorker = class {
 		const config = {
 			runtime: this.opts.poolRuntime,
 			concurrency: this.opts.concurrency,
+			protocolVersion: 2,
 			models: initialModels.map((m) => serializeModelConfig(m))
 		};
 		if (this.opts.device) config["device"] = this.opts.device;
@@ -953,10 +970,13 @@ var PoolWorker = class {
 						this.ready = true;
 						const loadedCount = result["models"];
 						const startupMs = result["startupMs"];
+						const workers = result["workers"] ?? 1;
+						const reported = result["protocolVersion"];
+						this.wireVersion = Math.min(2, typeof reported === "number" && Number.isFinite(reported) ? reported : 1);
 						resolve({
 							startupMs,
 							loadedCount,
-							workers: result["workers"] ?? 1
+							workers
 						});
 					} else reject(/* @__PURE__ */ new Error(`Unexpected pool status: ${JSON.stringify(result)}`));
 				},
@@ -1088,19 +1108,35 @@ var PoolWorker = class {
 	deadlineFor(msgType) {
 		return SHEDDABLE_MSG_TYPES.has(msgType) ? POOL_LIVE_INFER_TIMEOUT_MS : POOL_INFER_TIMEOUT_MS;
 	}
+	/**
+	* The request's ABSOLUTE deadline for the wire (D350), or `null` when this
+	* request must not carry one: commands / model loads / cacheFrame at any
+	* version, and EVERYTHING against a v1 worker — the old layout has no room
+	* for the prefix, and a worker at a different version is the normal state
+	* during a rolling deploy. The stamp is the same instant the local watchdog
+	* arms, so "the TS side has abandoned this" and "the worker refuses to run
+	* it" are one moment, not two clocks drifting apart.
+	*/
+	deadlineStamp(msgType) {
+		if (this.wireVersion < 2 || !SHEDDABLE_MSG_TYPES.has(msgType)) return null;
+		const stamp = Buffer.allocUnsafe(DEADLINE_PREFIX_LEN);
+		stamp.writeBigUInt64LE(BigInt(Date.now() + this.deadlineFor(msgType)), 0);
+		return stamp;
+	}
 	dispatch(msgType, payload, deviceId) {
 		const shed = this.shedIfSaturated(msgType, deviceId);
 		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType), deviceId);
+			const timer = this.armRequestTimeout(reqId, msgType, resolve, reject, deviceId);
 			this.pending.set(reqId, {
 				resolve,
 				reject,
 				timer
 			});
 			try {
-				this.writeFrame(reqId, msgType, payload);
+				const stamp = this.deadlineStamp(msgType);
+				this.writeFrame(reqId, msgType, stamp ? Buffer.concat([stamp, payload]) : payload);
 			} catch (err) {
 				clearTimeout(timer);
 				this.pending.delete(reqId);
@@ -1109,13 +1145,51 @@ var PoolWorker = class {
 		});
 	}
 	/**
-	* Arm a watchdog that rejects a still-pending inference request after
-	* `POOL_INFER_TIMEOUT_MS`. `unref` so it never keeps the event loop alive.
-	* The normal response + `rejectAll` paths clear it via `PendingRequest.timer`.
-	*/
-	armRequestTimeout(reqId, reject, timeoutMs, deviceId) {
+	* Arm a watchdog for a still-pending request. `unref` so it never keeps the
+	* event loop alive. The normal response + `rejectAll` paths clear it via
+	* `PendingRequest.timer`.
+	*
+	* The two request classes settle DIFFERENTLY on expiry (D350):
+	*
+	* - A SHEDDABLE (live inference) request RESOLVES as a shed —
+	*   `{dropped: true, shedReason: 'deadline-expired'}` — because at this
+	*   point the answer is worthless whether or not it eventually arrives, and
+	*   a shed is flow control the executor already handles. It fires only when
+	*   the worker never replied at all: a v2 worker sheds expired work itself
+	*   (fast reply, this timer is cleared), so this is the wedged-worker
+	*   backstop and the v1-worker compatibility path. The 2026-09-04 storm
+	*   logged this state 16 146 times at ERROR; the shed is logged sampled at
+	*   WARN and counted (`getDeadlineExpiredShedCount`) instead.
+	* - Anything else (commands, model loads) still REJECTS with the error the
+	*   dashboards grep for — a lost command is a fault, not flow control.
+	*/
+	armRequestTimeout(reqId, msgType, resolve, reject, deviceId) {
+		const timeoutMs = this.deadlineFor(msgType);
 		const timer = setTimeout(() => {
 			if (this.pending.delete(reqId)) {
+				if (SHEDDABLE_MSG_TYPES.has(msgType)) {
+					this.deadlineShedCount++;
+					const total = this.deadlineShedCount;
+					if (total === 1 || total % SHED_LOG_SAMPLE_EVERY === 0) this.log.warn("live inference deadline expired in flight — answered dropped", {
+						...deviceId !== void 0 ? { tags: { deviceId } } : {},
+						meta: {
+							worker: this.opts.workerLabel,
+							pid: this.getPid(),
+							runtime: this.opts.poolRuntime,
+							device: this.opts.device ?? "default",
+							inFlight: this.pending.size,
+							reqId,
+							timeoutMs,
+							deadlineShedTotal: total,
+							sampledEvery: SHED_LOG_SAMPLE_EVERY
+						}
+					});
+					resolve({
+						dropped: true,
+						shedReason: "deadline-expired"
+					});
+					return;
+				}
 				this.log.error("inference request timed out", {
 					...deviceId !== void 0 ? { tags: { deviceId } } : {},
 					meta: {
@@ -1139,7 +1213,7 @@ var PoolWorker = class {
 		if (shed) return Promise.resolve(shed);
 		const reqId = this.allocRequestId();
 		return new Promise((resolve, reject) => {
-			const timer = this.armRequestTimeout(reqId, reject, this.deadlineFor(msgType), deviceId);
+			const timer = this.armRequestTimeout(reqId, msgType, resolve, reject, deviceId);
 			this.pending.set(reqId, {
 				resolve,
 				reject,
@@ -1147,11 +1221,14 @@ var PoolWorker = class {
 			});
 			try {
 				if (!this.process?.stdin) throw new Error("PoolWorker: not initialized");
+				const stamp = this.deadlineStamp(msgType);
+				const wireLen = payloadLen + (stamp ? DEADLINE_PREFIX_LEN : 0);
 				const prefix = Buffer.allocUnsafe(PREFIX_LEN);
-				prefix.writeUInt32LE(5 + payloadLen, 0);
+				prefix.writeUInt32LE(5 + wireLen, 0);
 				prefix.writeUInt32LE(reqId, 4);
 				prefix[8] = msgType;
 				this.process.stdin.write(prefix);
+				if (stamp) this.process.stdin.write(stamp);
 				for (const part of parts) this.process.stdin.write(part);
 			} catch (err) {
 				clearTimeout(timer);
@@ -1254,12 +1331,22 @@ var SharedInferencePool = class {
 	nextFreeIndex = 0;
 	nextFrameId = 1;
 	/**
-	* Cumulative count of frames the Python pool SHED under overload
-	* (`"dropped": true` responses from the per-model in-flight bound in
-	* inference_pool.py). Without this the shed response is
-	* indistinguishable from a genuine "no detections" result.
+	* Cumulative count of dropped (shed) responses on the single-frame and
+	* batch inference paths: the Python per-model bound, the Python
+	* deadline-expired shed, and the TS in-flight watchdog's own
+	* deadline-expired resolution all land here. Without this a shed response
+	* is indistinguishable from a genuine "no detections" result.
 	*/
 	droppedResponseCount = 0;
+	/**
+	* The `shedReason: 'deadline-expired'` subset of {@link
+	* droppedResponseCount} — work that was ALREADY DEAD when it would have
+	* run (D350). This is the number that was zero-by-construction while the
+	* 2026-09-04 storm burned the accelerator on abandoned requests for 4h15m;
+	* a rising value here under load is the pool refusing dead work, which is
+	* the fix working, not a fault.
+	*/
+	deadlineExpiredShedCount = 0;
 	log;
 	concurrency;
 	tuning;
@@ -1345,7 +1432,12 @@ var SharedInferencePool = class {
 	}
 	async inferBatch(modelIndex, items, frameId = 0) {
 		if (items.length > 255) throw new Error(`SharedInferencePool.inferBatch: max 255 items per call, got ${items.length}`);
-		return this.pickWorker().inferBatch(this.encodeModelByte(modelIndex), items, frameId);
+		const results = await this.pickWorker().inferBatch(this.encodeModelByte(modelIndex), items, frameId);
+		for (const item of results) if (item["dropped"] === true) {
+			this.droppedResponseCount++;
+			if (item["shedReason"] === "deadline-expired") this.deadlineExpiredShedCount++;
+		}
+		return results;
 	}
 	async inferCached(modelIndex, frameId, deviceId) {
 		const w = this.pickWorker();
@@ -1359,6 +1451,16 @@ var SharedInferencePool = class {
 	getDroppedResponseCount() {
 		return this.droppedResponseCount;
 	}
+	/**
+	* The `deadline-expired` subset of {@link getDroppedResponseCount}:
+	* requests refused (by the Python worker, or by the local in-flight
+	* watchdog as its backstop) because their absolute deadline had already
+	* passed — dead work NOT executed (D350). Monotonic for the pool's
+	* lifetime; surfaced on the memory watchdog's `pool memory` line.
+	*/
+	getDeadlineExpiredShedCount() {
+		return this.deadlineExpiredShedCount;
+	}
 	getHandle(modelIndex) {
 		return new PoolHandle(this, modelIndex);
 	}
@@ -1497,10 +1599,13 @@ var SharedInferencePool = class {
 	trackDroppedResponse(result, modelIndex) {
 		if (result["dropped"] === true) {
 			this.droppedResponseCount++;
+			if (result["shedReason"] === "deadline-expired") this.deadlineExpiredShedCount++;
 			const total = this.droppedResponseCount;
 			if (total === 1 || total % SHED_LOG_SAMPLE_EVERY === 0) this.log.debug("Python pool shed frame under overload", { meta: {
 				modelIndex,
 				droppedTotal: total,
+				deadlineExpiredTotal: this.deadlineExpiredShedCount,
+				...typeof result["shedReason"] === "string" ? { shedReason: result["shedReason"] } : {},
 				sampledEvery: SHED_LOG_SAMPLE_EVERY,
 				runtime: this.poolRuntime,
 				device: this.device ?? "default"
@@ -2389,11 +2494,13 @@ var EngineFactory = class {
 		if (!this.pool) return {
 			inFlight: 0,
 			shed: 0,
-			dropped: 0
+			dropped: 0,
+			deadlineExpired: 0
 		};
 		return {
 			...this.pool.getBacklog(),
-			dropped: this.pool.getDroppedResponseCount()
+			dropped: this.pool.getDroppedResponseCount(),
+			deadlineExpired: this.pool.getDeadlineExpiredShedCount()
 		};
 	}
 	/** Python-side per-worker memory diagnostics (see SharedInferencePool). */
@@ -2880,6 +2987,7 @@ async function samplePool(pool, log, reportedDead) {
 			inFlight: backlog.inFlight,
 			shed: backlog.shed,
 			dropped: backlog.dropped,
+			deadlineExpired: backlog.deadlineExpired,
 			modelsLoaded: pool.factory.listLoaded().length,
 			memStats
 		}

package/dist/{dist-DxA44rNd.js → dist-Bbu27T_N.js}

@@ -14577,6 +14577,24 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
+*
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
+*
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
+*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -20806,6 +20824,9 @@ var RetrainStatusSchema = _enum([
 *
 * `debug` does NOT pin; it is attention, not durability.
 *
+* `debugNote` is the operator's own words about WHAT should be checked on this
+* track, and it lives and dies with `debug` — see {@link MAX_TRACK_DEBUG_NOTE_LEN}.
+*
 * `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
 * A favourited track is skipped by retention the same way `staging` is, but
 * it does not enter `none|staging|trained` and has no staging budget.
@@ -20816,6 +20837,21 @@ var TrackFlagFields = {
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: boolean().optional(),
+	/**
+	* What the operator wants CHECKED on this track, in their own words.
+	*
+	* The flag alone says "look at this" and nothing about what for; a debug set
+	* reviewed hours later is a list of tracks with no question attached. Bound
+	* to `debug` on the WRITE side — the body clears it when `debug` goes off,
+	* and refuses it on a track whose debug is off — so a note can never outlive
+	* the attention it belongs to.
+	*
+	* `''` is a real value ("marked, nothing to add"); the ABSENT key means
+	* "leave whatever is stored alone", which is what lets a surface turn debug
+	* on without a note (a cancelled prompt) and what lets it edit the note
+	* without touching the flag.
+	*/
+	debugNote: string().max(500).optional(),
 	/** Operator favourited this track. Pins it against pruning. */
 	favourited: boolean().optional()
 };
@@ -20842,6 +20878,12 @@ var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
 	debug: boolean(),
+	/** The note as it STANDS after the write — never absent here (a track with no
+	*  note reports `''`), for the same reason the booleans are required: a
+	*  surface that has just written must be able to render the note it now owns
+	*  without a re-fetch, and an absent key would read as "unchanged" on a
+	*  screen that has no previous value to keep. */
+	debugNote: string(),
 	favourited: boolean(),
 	/** The lifecycle state the boolean was derived from. Required here (unlike on
 	*  a track row) because this shape is only ever produced by the write body,