@camstack/addon-pipeline 1.2.191 → 1.2.193

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, Gt as _enum, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Wt as sleep$1, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-Cjazw3T-.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-KFUZT2L-.mjs";
+import { $t as number, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as errMsg, Ft as DeviceFeature, Gt as selectAssignedProfileSlots, H as deriveBatteryPresence, Ht as nodePin, It as DeviceType, Jt as array, Kt as sleep$1, Nt as BaseAddon, P as batteryCapability, R as customAction, Rt as hydrateSchema, St as storageEvictableCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Yt as boolean, bt as resolveRecordingProfiles, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as object, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingSignalCapability, ht as recordingExportCapability, i as BatteryStatusSchema, in as EventCategory, mt as recordingCapability, nn as string, qt as _enum, tn as record, tt as loadContributionCapability, x as OpsLogEntrySchema } from "../dist-mYDK58Jp.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-xRsaPwBa.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
@@ -12517,6 +12517,7 @@ function triggerKey(source) {
 		case "audio": return "audio";
 		case "object": return `object:${source.macroClass}`;
 		case "sensor": return `sensor:${source.sourceDeviceId}`;
+		case "signal": return "signal";
 	}
 }
 /**
@@ -12547,6 +12548,7 @@ function bandTriggerSources(band) {
 		kind: "sensor",
 		sourceDeviceId
 	});
+	if (t.deviceSignal === true) sources.push({ kind: "signal" });
 	return sources;
 }
 /**
@@ -12601,7 +12603,69 @@ function withWindows(state, source, windows) {
 	const key = triggerKey(source);
 	if (windows.length === 0) next.delete(key);
 	else next.set(key, windows);
-	return { windows: next };
+	return withHeld({ windows: next }, state.held);
+}
+/** The same state with `held` replaced — absent when there is nothing held, so
+*  a state that holds nothing is shaped exactly like one built before holds
+*  existed. */
+function withHeld(state, held) {
+	if (held === void 0 || held.size === 0) {
+		const { held: _dropped, ...rest } = state;
+		return rest;
+	}
+	return {
+		...state,
+		held
+	};
+}
+/** When the source rose, or null when it is not held. */
+function heldSinceMs(state, source) {
+	return state.held?.get(triggerKey(source)) ?? null;
+}
+/**
+* Raise a LEVEL source: from `atMs` on, the live gate demands and the keep
+* gate retains, until {@link releaseTrigger}. Idempotent — a second rise of a
+* source already held keeps the ORIGINAL rise, because the level never fell in
+* between and the footage since then belongs to the same episode. A re-emitted
+* `active: true` (a slice rewritten for another field, a reconcile read) must
+* not shorten the keep span.
+*/
+function holdTrigger(state, source, atMs) {
+	const key = triggerKey(source);
+	if (state.held?.has(key)) return state;
+	const held = new Map(state.held);
+	held.set(key, atMs);
+	return withHeld(state, held);
+}
+/**
+* Lower a LEVEL source: the hold becomes the window `[since, atMs]`, folded
+* through the SAME merge every other source uses — so a rise landing inside
+* the post-buffer of the previous fall extends that episode rather than
+* opening a second one, exactly as consecutive motion triggers do. From here
+* on the band's `postBufferSec` runs and the schedule arms the close.
+*
+* A release of a source that is not held returns the SAME object: a falling
+* edge the recorder never saw rise (a runner respawn mid-job, a reconcile
+* read) has nothing to close, and the caller can skip a write.
+*/
+function releaseTrigger(state, source, atMs, mergeGapMs) {
+	const key = triggerKey(source);
+	const since = state.held?.get(key);
+	if (since === void 0) return state;
+	const held = new Map(state.held);
+	held.delete(key);
+	const span = {
+		firstMs: since,
+		lastMs: Math.max(since, atMs)
+	};
+	const windows = triggerWindowsFor(state, source);
+	const newest = windows[windows.length - 1];
+	const merged = newest !== void 0 && span.firstMs - newest.lastMs <= mergeGapMs ? [...windows.slice(0, -1), {
+		firstMs: Math.min(newest.firstMs, span.firstMs),
+		lastMs: Math.max(newest.lastMs, span.lastMs)
+	}] : [...windows, span];
+	const evicted = Math.max(0, merged.length - 32);
+	return withWindows(withHeld(state, held), source, evicted > 0 ? merged.slice(evicted) : merged);
 }
 /**
 * Fold one qualifying trigger into the history, immutably. It EXTENDS the newest
@@ -12643,7 +12707,7 @@ function pruneTriggerHistory(state, postMs, nowMs) {
 		if (live.length !== windows.length) changed = true;
 		if (live.length > 0) next.set(key, live);
 	}
-	return changed ? { windows: next } : state;
+	return changed ? withHeld({ windows: next }, state.held) : state;
 }
 /** Most recent trigger for a source, or null when none is retained. */
 function latestTriggerMs(state, source) {
@@ -12658,6 +12722,7 @@ function latestTriggerMs(state, source) {
 function eventsBandDemanded(band, triggers, atMs) {
 	const { postMs } = resolveBandBufferMs(band);
 	return bandTriggerSources(band).some((source) => {
+		if (heldSinceMs(triggers, source) !== null) return true;
 		const lastMs = latestTriggerMs(triggers, source);
 		return lastMs !== null && atMs - lastMs <= postMs;
 	});
@@ -12731,7 +12796,11 @@ function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach)
 		if (segStartMs <= window.lastMs + postMs) return true;
 		return attach.attachedAtMs <= window.lastMs + postMs && segStartMs <= deadlineMs;
 	};
-	return bandTriggerSources(band).some((source) => triggerWindowsFor(triggers, source).some(overlaps));
+	return bandTriggerSources(band).some((source) => {
+		const since = heldSinceMs(triggers, source);
+		if (since !== null && segEndMs >= since - preMs) return true;
+		return triggerWindowsFor(triggers, source).some(overlaps);
+	});
 }
 /**
 * By how many ms a discarded segment missed being kept — its start past the
@@ -12753,7 +12822,10 @@ function segmentMissedByMs(segStartMs, band, triggers, attach) {
 		const windowEndMs = window.lastMs + postMs;
 		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
 	};
-	const considered = bandTriggerSources(band).flatMap((source) => [...triggerWindowsFor(triggers, source)]);
+	const sources = bandTriggerSources(band);
+	const holds = sources.map((source) => heldSinceMs(triggers, source)).filter((s) => s !== null);
+	if (holds.length > 0) return Math.min(-1, segStartMs - Math.min(...holds));
+	const considered = sources.flatMap((source) => [...triggerWindowsFor(triggers, source)]);
 	if (considered.length === 0) return null;
 	return segStartMs - Math.max(...considered.map(latestKeptStart));
 }
@@ -12937,7 +13009,9 @@ function nextBandEdgeMs(config, nowMs) {
 function eventsWindowCloseMs(band, triggers, nowMs) {
 	if (band.mode !== "events") return null;
 	const { postMs } = resolveBandBufferMs(band);
-	const open = bandTriggerSources(band).map((source) => latestTriggerMs(triggers, source)).filter((ms) => ms !== null).map((ms) => ms + postMs).filter((ms) => ms >= nowMs);
+	const sources = bandTriggerSources(band);
+	if (sources.some((source) => heldSinceMs(triggers, source) !== null)) return null;
+	const open = sources.map((source) => latestTriggerMs(triggers, source)).filter((ms) => ms !== null).map((ms) => ms + postMs).filter((ms) => ms >= nowMs);
 	if (open.length === 0) return null;
 	return Math.max(...open) + 1;
 }
@@ -13945,6 +14019,25 @@ var PLACEMENT_TICK_MS = 3e4;
 */
 var RECONCILE_TICK_MS = 12e4;
 /**
+* How long a `recording-signal` hold may stand WITHOUT a read confirming it
+* before the reconcile releases it anyway.
+*
+* The hold is opened by an event (D8: telemetry, may be dropped) and closed by
+* an event; the reconcile beat re-reads the level through RPC every
+* {@link RECONCILE_TICK_MS} and that read is what normally keeps or ends it. This
+* bound is for the case where the READ itself keeps failing — the device-state
+* door unreachable for hours — so that one lost falling edge can never pin a
+* camera for ever (D11). It counts from the last confirmation (the rise event,
+* or the last read that said `active`), never from the rise alone: a job that
+* genuinely lasts longer than this, with the level re-read every two minutes,
+* is never cut.
+*
+* Four hours: the longest whole-house clean-and-mop observed is under three,
+* and a device-state door down for four hours is an outage that has already
+* cost more than one recording.
+*/
+var SIGNAL_HOLD_MAX_MS = 4 * 36e5;
+/**
 * Bound on the ONE store read at the head of every placement and reconcile pass
 * (`enabledDeviceIds` → `readDeviceConfigs`).
 *
@@ -14115,6 +14208,18 @@ var RecordingController = class {
 	*  {@link TriggerState}. */
 	triggers = /* @__PURE__ */ new Map();
 	/**
+	* Per device, when the `recording-signal` hold was last CONFIRMED — by the
+	* rise event or by a reconcile read that said `active`. The clock
+	* {@link SIGNAL_HOLD_MAX_MS} counts from. Deleted with the hold.
+	*/
+	signalConfirmedAt = /* @__PURE__ */ new Map();
+	/**
+	* Per device, how many CONSECUTIVE reconcile reads have said `active: false`
+	* while a hold stood. Reset by any read that says `active` and by the rise
+	* event. Reaches {@link SIGNAL_RELEASE_READS} → the reconcile releases.
+	*/
+	signalContradictions = /* @__PURE__ */ new Map();
+	/**
 	* Last sign of life per `deviceId:profile` — seeded at attach (so the grace
 	* window starts at the pin, not at the first segment) and stamped on every
 	* finalize. Read by {@link checkIdleWriters}. Stamped BEFORE the keep/discard
@@ -14386,7 +14491,8 @@ var RecordingController = class {
 	async reconcileTriggerHistory(deviceId) {
 		const loadMotion = this.deps.loadMotionEvents;
 		const loadObject = this.deps.loadObjectEvents;
-		if (loadMotion === void 0 && loadObject === void 0 || this.stopped) return;
+		const loadSignal = this.deps.loadDeviceSignal;
+		if (loadMotion === void 0 && loadObject === void 0 && loadSignal === void 0 || this.stopped) return;
 		try {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
@@ -14404,6 +14510,10 @@ var RecordingController = class {
 			};
 			for (const source of bandTriggerSources(band)) {
 				if (this.stopped) return;
+				if (source.kind === "signal") {
+					if (loadSignal !== void 0) await this.reconcileSignalLevel(deviceId, source, postMs);
+					continue;
+				}
 				const rows = await durableRowsFor(source);
 				if (rows === null || rows.length === 0) continue;
 				if (this.stopped) return;
@@ -14436,6 +14546,164 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Compare the `recording-signal` HOLD with the slice the device publishes
+	* now, and correct the hold the way D49 allows: a read that raises the level
+	* is applied at once (footage is what is at stake); a read that lowers it is
+	* applied only when {@link SIGNAL_RELEASE_READS} consecutive reads agree; a
+	* read that fails changes nothing — except that a hold nobody has confirmed
+	* for {@link SIGNAL_HOLD_MAX_MS} is released anyway, and says so.
+	*
+	* Never throws: called from the head of the reconcile beat.
+	*/
+	async reconcileSignalLevel(deviceId, source, postMs) {
+		const load = this.deps.loadDeviceSignal;
+		if (load === void 0) return;
+		const nowMs = this.now();
+		const since = heldSinceMs(this.triggersFor(deviceId), source);
+		let level;
+		try {
+			level = await load(deviceId);
+		} catch (err) {
+			this.deps.logger.warn("recorder: device signal read failed — the hold stands", {
+				tags: { deviceId },
+				meta: {
+					held: since !== null,
+					error: errMsg(err)
+				}
+			});
+			this.releaseIfHeldPastBound(deviceId, source, since, postMs, nowMs);
+			return;
+		}
+		if (this.stopped) return;
+		if (level?.active === true) {
+			this.signalConfirmedAt.set(deviceId, nowMs);
+			this.signalContradictions.delete(deviceId);
+			if (since !== null) return;
+			const rise = level.lastChangedAt > 0 ? Math.min(level.lastChangedAt, nowMs) : nowMs;
+			this.triggers.set(deviceId, holdTrigger(this.triggersFor(deviceId), source, rise));
+			this.deps.logger.info("recorder: device signal recovered from the slice — the bus had not delivered the rise", {
+				tags: { deviceId },
+				meta: {
+					since: rise,
+					lastChangedAt: level.lastChangedAt
+				}
+			});
+			return;
+		}
+		if (since === null) return;
+		const contradictions = (this.signalContradictions.get(deviceId) ?? 0) + 1;
+		if (contradictions < 2) {
+			this.signalContradictions.set(deviceId, contradictions);
+			this.deps.logger.debug("recorder: device signal read contradicts the hold — waiting for a second read to agree", {
+				tags: { deviceId },
+				meta: {
+					since,
+					reads: contradictions,
+					absent: level === null
+				}
+			});
+			return;
+		}
+		this.applySignalRelease(deviceId, source, nowMs, postMs);
+		this.deps.logger.info("recorder: device signal released by reconcile — two reads agreed the level is down", {
+			tags: { deviceId },
+			meta: {
+				since,
+				heldMs: nowMs - since,
+				absent: level === null
+			}
+		});
+	}
+	/** The bound on a hold the reads could not confirm. Warns, because it DROPS
+	*  the rest of an episode the operator may still want. */
+	releaseIfHeldPastBound(deviceId, source, since, postMs, nowMs) {
+		if (since === null) return;
+		const confirmedAt = this.signalConfirmedAt.get(deviceId) ?? since;
+		if (nowMs - confirmedAt <= 144e5) return;
+		this.applySignalRelease(deviceId, source, nowMs, postMs);
+		this.deps.logger.warn("recorder: device signal held past its bound with no read confirming it — released, the episode may be cut", {
+			tags: { deviceId },
+			meta: {
+				since,
+				confirmedAt,
+				heldMs: nowMs - since,
+				boundMs: SIGNAL_HOLD_MAX_MS
+			}
+		});
+	}
+	/** Lower the hold into a window and forget the per-device signal clocks. */
+	applySignalRelease(deviceId, source, atMs, postMs) {
+		const pruned = pruneTriggerHistory(this.triggersFor(deviceId), postMs, atMs);
+		this.triggers.set(deviceId, releaseTrigger(pruned, source, atMs, postMs));
+		this.signalConfirmedAt.delete(deviceId);
+		this.signalContradictions.delete(deviceId);
+	}
+	/**
+	* Feed the camera's own `recording-signal` LEVEL — the counterpart of
+	* `onTrigger` for `RecordingTriggers.deviceSignal`, fed from the
+	* `DeviceStateChanged` subscription in `recorder/addon/index.ts`.
+	*
+	* `active: true` HOLDS the source open (idempotent: a re-emitted slice never
+	* moves the rise); `active: false` releases it into a window ending at `atMs`,
+	* after which the band's `postBufferSec` runs and `evaluateDevice` arms the
+	* close exactly as it does for a motion episode. Both converge at once: the
+	* rise is what wakes a battery camera and pins its source (the robot's
+	* monitor opens through `battery.wakeForStream` on the attach), the fall is
+	* what lets the source be released and the monitor close.
+	*
+	* No config read on this path (D49): the hold is recorded unconditionally —
+	* it costs one map entry — and `evaluateDevice`, which reads the last-known
+	* config, decides whether any band listens. A camera whose bands do not name
+	* the signal simply never demands.
+	*/
+	async onSignalLevel(deviceId, source, active, atMs) {
+		if (this.stopped) return;
+		const before = this.triggersFor(deviceId);
+		if (active) {
+			const held = holdTrigger(before, source, atMs);
+			this.signalConfirmedAt.set(deviceId, this.now());
+			this.signalContradictions.delete(deviceId);
+			if (held !== before) {
+				this.triggers.set(deviceId, held);
+				this.deps.logger.info("recorder: device signal raised — recording window held open", {
+					tags: { deviceId },
+					meta: {
+						source: triggerKey(source),
+						atMs
+					}
+				});
+			}
+		} else {
+			const postMs = await this.postBufferMsFor(deviceId, atMs);
+			if (this.stopped) return;
+			const since = heldSinceMs(this.triggersFor(deviceId), source);
+			if (since === null) return;
+			this.applySignalRelease(deviceId, source, atMs, postMs);
+			this.deps.logger.info("recorder: device signal fell — post-buffer running, then the window closes", {
+				tags: { deviceId },
+				meta: {
+					source: triggerKey(source),
+					since,
+					atMs,
+					heldMs: atMs - since,
+					postMs
+				}
+			});
+		}
+		try {
+			await this.evaluateDevice(deviceId);
+		} catch (err) {
+			this.deps.logger.warn("recorder: device signal attach deferred — stream not available yet (retries on next broker ready/reconcile)", {
+				tags: { deviceId },
+				meta: {
+					source: triggerKey(source),
+					active,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+	/**
 	* Re-evaluate one device after a config change (called from `setDeviceConfig`).
 	* Failures propagate so the caller can surface them, but the persisted config
 	* has already been written by the time this runs.
@@ -16538,6 +16806,13 @@ var RecorderV2Addon = class extends BaseAddon {
 	*/
 	sensorTriggerUnsub = null;
 	/**
+	* Unsubscribe handle for the `DeviceStateChanged` subscription filtered on
+	* the camera's own `recording-signal` slice — the feed behind
+	* `RecordingTriggers.deviceSignal`. A LEVEL, so it has no edge memory of its
+	* own: the controller holds and releases (`onSignalLevel`).
+	*/
+	signalTriggerUnsub = null;
+	/**
 	* Edge memory + reverse index (source device → cameras) for the sensor
 	* trigger. Constructed once per addon instance: `startedAtMs` is the floor a
 	* first-sighting rise must beat, and a fresh instance per boot is exactly
@@ -16789,6 +17064,26 @@ var RecorderV2Addon = class extends BaseAddon {
 					limit: TRIGGER_RECONCILE_ROW_LIMIT
 				})).filter((event) => (event.source ?? "pipeline") === "pipeline").map((event) => event.timestamp);
 			},
+			/**
+			* The DURABLE half of the DEVICE-SIGNAL source: the camera's own
+			* `recording-signal` slice, read back through the kernel's state door.
+			* `null` when the device has never written it; a slice that does not
+			* parse is a REJECTION, not a level — the reconcile must not read
+			* garbage as "down" and release on it.
+			*/
+			loadDeviceSignal: async (deviceId) => {
+				const slice = await this.ctx.api.deviceState.getCapSlice.query({
+					deviceId,
+					capName: recordingSignalCapability.name
+				});
+				if (slice === null) return null;
+				const parsed = RecordingSignalStatusSchema.safeParse(slice);
+				if (!parsed.success) throw new Error(`recording-signal slice for device ${deviceId} does not parse`);
+				return {
+					active: parsed.data.active,
+					lastChangedAt: parsed.data.lastChangedAt
+				};
+			},
 			locations: () => this.resolvedLocations,
 			placeProfile: (deviceId, profile) => this.placeProfile(deviceId, profile),
 			onPlacementTick: (deviceIds) => this.recomputePlacement(deviceIds),
@@ -17124,6 +17419,8 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.detectionTriggerUnsub = null;
 		this.sensorTriggerUnsub?.();
 		this.sensorTriggerUnsub = null;
+		this.signalTriggerUnsub?.();
+		this.signalTriggerUnsub = null;
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
@@ -17296,6 +17593,20 @@ var RecorderV2Addon = class extends BaseAddon {
 				});
 			});
 		}
+		if (this.signalTriggerUnsub === null) this.signalTriggerUnsub = this.ctx.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+			const parsed = parseSensorStateChanged(event.data);
+			if (parsed === null || parsed.capName !== recordingSignalCapability.name) return;
+			const level = RecordingSignalStatusSchema.safeParse(parsed.slice);
+			if (!level.success) {
+				this.ctx.logger.warn("recorder: device signal slice does not parse — ignored", {
+					tags: { deviceId: parsed.deviceId },
+					meta: { slice: parsed.slice }
+				});
+				return;
+			}
+			const atMs = event.timestamp instanceof Date ? event.timestamp.getTime() : Date.now();
+			this.controller?.onSignalLevel(parsed.deviceId, { kind: "signal" }, level.data.active, atMs);
+		});
 		try {
 			await this.segmentHours?.load();
 			this.segmentHours?.repairAggregates();

package/dist/{segment-demux-js-C36b7S82.js → segment-demux-js-CBynn9Gh.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-PQArEi7A.js");
+const require_dist = require("./dist-HG5geL9t.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/{segment-demux-js-Cgz-NlSg.mjs → segment-demux-js-CXvgKfsn.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { wt as errMsg } from "./dist-Cjazw3T-.mjs";
+import { Et as errMsg } from "./dist-mYDK58Jp.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-BulRQMSK.js");
-const require_lazy_sharp = require("../lazy-sharp-DfnnPeG5.js");
+const require_worker_protocol = require("../worker-protocol-DCsi4YS1.js");
+const require_lazy_sharp = require("../lazy-sharp-DmAwZ0s9.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.
@@ -450,6 +450,17 @@ var LeaseAdmissionLedger = class {
 	get markedSize() {
 		return this.marked.size;
 	}
+	/**
+	* The runner is DONE with `frameId` before the worker ever leased it — its
+	* result came back (or it was dropped) before the next pull superseded it.
+	* Withdrawing the mark makes the supersede decline the frame, so it is
+	* freed at once instead of leased after its own release and pinned until
+	* the bound evicts it. Measured 2026-09-06: on every busy worker
+	* `leaseReleaseMisses ≈ leaseAdmitted` and `holdOverflow ≈ admitted − 8`.
+	*/
+	unmark(frameId) {
+		this.marked.delete(frameId);
+	}
 	/** Whether `frameId` is inside the remembered marked window. */
 	isMarked(frameId) {
 		return this.marked.has(frameId);
@@ -656,7 +667,7 @@ function toBufferMissRung(facts) {
 /** The error line the runner sees: the rung first, the numbers after it. */
 function describeToBufferMiss(facts) {
 	const rung = toBufferMissRung(facts);
-	return `decode-worker-child: toBuffer miss for frameId ${facts.frameId} — ${rung} {reserved=${facts.reservedFrameId ?? "none"} marked=${facts.marked} leaseFrames=${facts.leaseFrames}/${facts.holdFrames} holdOverflow=${facts.holdOverflow}}`;
+	return `decode-worker-child: toBuffer miss for frameId ${facts.frameId} — ${rung} {reserved=${facts.reservedFrameId ?? "none"} marked=${facts.marked} leaseFrames=${facts.leaseFrames}/${facts.holdFrames} holdOverflow=${facts.holdOverflow}${facts.unmarkedBy !== void 0 ? ` unmarkedBy=${facts.unmarkedBy}` : ""}}`;
 }
 //#endregion
 //#region src/session-decode/native-tile-geometry.ts
@@ -1453,6 +1464,8 @@ var NATIVE_TILE_JPEG_QUALITY = 90;
 * eager capture) — it does not disable retention. Default 15000.
 */
 var NATIVE_LEASE_ACTIVITY_WINDOW_MS = NATIVE_LEASE_KNOBS.values.activityMs;
+/** How many early-withdrawn frame ids the worker remembers for the miss line. */
+var UNMARKED_MEMORY = 256;
 /**
 * How long lease capture stays off after the download path proves broken, and
 * the ceiling that backoff climbs to. Doubling from the base, so the Nth
@@ -1886,6 +1899,10 @@ var DecodeWorkerChild = class {
 	/** Releases that found a held frame / that found nothing to release. */
 	leaseReleased = 0;
 	leaseReleaseMisses = 0;
+	/** Releases that beat the supersede and withdrew the mark instead. */
+	leaseReleasedEarly = 0;
+	/** Frame ids withdrawn early → by whom (insertion-ordered, bounded). */
+	unmarkedBy = /* @__PURE__ */ new Map();
 	/** Child-side skips only (HW-guard drops + probe/degrade frees); slot drops add {@link FrameSlot.droppedCount}. */
 	framesSkipped = 0;
 	/** Frames actually handed to the parent as a `frame` reply. */
@@ -1970,7 +1987,7 @@ var DecodeWorkerChild = class {
 				this.handleCutTiles(message.frameId, message.bboxes);
 				return;
 			case "releaseNativeLease":
-				this.noteLeaseRelease(this.leaseStore.release(message.frameId));
+				this.noteLeaseRelease(message.frameId, this.leaseStore.release(message.frameId), "release");
 				return;
 			case "markInferred":
 				this.admission.mark(message.frameId);
@@ -2034,7 +2051,7 @@ var DecodeWorkerChild = class {
 		const skipped = this.framesSkipped + this.frames.droppedCount;
 		const rssMb = Math.round(process.memoryUsage().rss / 1048576);
 		const ageS = Math.round((now - this.startedAt) / 1e3);
-		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, leaseOffered:${this.admission.offered}, leaseAdmitted:${this.admission.admitted}, leaseMarks:${this.admission.marks}, leaseUnmarkedCrops:${this.admission.unmarkedCrops}, leaseAdmission:${NATIVE_LEASE_KNOBS.values.admission}, leaseMb:${Math.round(this.leaseStore.totalBytes / 1048576)}, leaseFrames:${this.leaseStore.size}, holdOverflow:${this.leaseStore.overflowCount}, leaseReleased:${this.leaseReleased}, leaseReleaseMisses:${this.leaseReleaseMisses}, tilesCut:${this.tilesCut}, tileHits:${this.tileHits}, tileMisses:${this.tileMisses}, tileCutFailures:${this.tileCutFailures}, tileMb:${Math.round(this.tileStore.totalBytes / 1048576)}, tileFrames:${this.tileStore.frameCount}, scenesCut:${this.scenesCut}, sceneHits:${this.sceneHits}, sceneRefused:${this.sceneRefused}, sceneUnclassified:${this.sceneUnclassified}, sceneEvicted:${this.sceneStore.evictedCount}, sceneMb:${Math.round(this.sceneStore.totalBytes / 1048576)}, sceneFrames:${this.sceneStore.frameCount}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
+		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, leaseOffered:${this.admission.offered}, leaseAdmitted:${this.admission.admitted}, leaseMarks:${this.admission.marks}, leaseUnmarkedCrops:${this.admission.unmarkedCrops}, leaseAdmission:${NATIVE_LEASE_KNOBS.values.admission}, leaseMb:${Math.round(this.leaseStore.totalBytes / 1048576)}, leaseFrames:${this.leaseStore.size}, holdOverflow:${this.leaseStore.overflowCount}, leaseReleased:${this.leaseReleased}, leaseReleaseMisses:${this.leaseReleaseMisses}, leaseReleasedEarly:${this.leaseReleasedEarly}, tilesCut:${this.tilesCut}, tileHits:${this.tileHits}, tileMisses:${this.tileMisses}, tileCutFailures:${this.tileCutFailures}, tileMb:${Math.round(this.tileStore.totalBytes / 1048576)}, tileFrames:${this.tileStore.frameCount}, scenesCut:${this.scenesCut}, sceneHits:${this.sceneHits}, sceneRefused:${this.sceneRefused}, sceneUnclassified:${this.sceneUnclassified}, sceneEvicted:${this.sceneStore.evictedCount}, sceneMb:${Math.round(this.sceneStore.totalBytes / 1048576)}, sceneFrames:${this.sceneStore.frameCount}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
 		this.lastMetricsAt = now;
 		this.lastDeliveredSnapshot = this.framesDelivered;
 		if (!this.warnedLarge && rssMb >= WORKER_RSS_WARN_MB) {
@@ -2072,9 +2089,26 @@ var DecodeWorkerChild = class {
 		this.pendingPull = true;
 		this.frames.markPendingPull();
 	}
-	noteLeaseRelease(held) {
-		if (held) this.leaseReleased += 1;
-		else this.leaseReleaseMisses += 1;
+	/**
+	* Account for a release. A release that found no lease is the runner being
+	* done BEFORE the supersede leased the frame: withdraw its mark so the
+	* supersede declines it (`LeaseAdmissionLedger.unmark`), and count it.
+	*/
+	noteLeaseRelease(frameId, held, by) {
+		if (held) {
+			this.leaseReleased += 1;
+			return;
+		}
+		this.leaseReleaseMisses += 1;
+		if (this.admission.isMarked(frameId)) {
+			this.admission.unmark(frameId);
+			this.leaseReleasedEarly += 1;
+			this.unmarkedBy.set(frameId, by);
+			if (this.unmarkedBy.size > UNMARKED_MEMORY) {
+				const oldest = this.unmarkedBy.keys().next().value;
+				if (oldest !== void 0) this.unmarkedBy.delete(oldest);
+			}
+		}
 	}
 	async handleToBuffer(frameId, opts) {
 		const frame = this.leaseStore.get(frameId)?.frame ?? this.frames.toBuffer(frameId);
@@ -2085,7 +2119,8 @@ var DecodeWorkerChild = class {
 				marked: this.admission.isMarked(frameId),
 				leaseFrames: this.leaseStore.size,
 				holdFrames: NATIVE_LEASE_HOLD_FRAMES,
-				holdOverflow: this.leaseStore.overflowCount
+				holdOverflow: this.leaseStore.overflowCount,
+				...this.unmarkedBy.has(frameId) ? { unmarkedBy: this.unmarkedBy.get(frameId) } : {}
 			}), frameId);
 			return;
 		}
@@ -2320,7 +2355,7 @@ var DecodeWorkerChild = class {
 				this.sceneStore.put(frameId, [scene]);
 			}
 		} finally {
-			this.noteLeaseRelease(this.leaseStore.release(frameId));
+			this.noteLeaseRelease(frameId, this.leaseStore.release(frameId), "cut");
 		}
 	}
 	/**