@camstack/addon-pipeline 1.2.199 → 1.2.201

package/dist/{node-D1MLn6oV.mjs → node-CmfXSgr3.mjs}

@@ -1,189 +1,222 @@
-import { At as Fmp4BoxSplitter, Nt as isSoftwareDecode, Ot as errMsg, jt as buildFfmpegArgs } from "./dist-B23u1tmN.mjs";
+import { It as errMsg, Rt as Fmp4BoxSplitter, Vt as isSoftwareDecode, zt as buildFfmpegArgs } from "./dist-D2jcEuZD.mjs";
 import { randomUUID } from "node:crypto";
-import "node:fs";
-import "node:path";
+import { realpathSync } from "node:fs";
+import path from "node:path";
 import "node:child_process";
 import { readFile } from "node:fs/promises";
-/**
-* The registry an addon claims its OWN child processes in — the spawn-site
-* half of `load-contribution.cap.ts`.
-*
-* ## Where a claim is made, and where it is released
-*
-* At the spawn site, and nowhere else. It is the only place that knows both
-* halves: the recorder's controller knows it is starting ffmpeg for camera 615
-* profile `high`; the decode coordinator knows the session it is forking a
-* worker for. Nothing has to deduce it afterwards, and no entity needs a
-* global list of which pid belongs to which camera.
-*
-* {@link ChildCostRegistry.claim} returns a HANDLE, and the handle is the only
-* way to release. That is not decoration: the alternative — `release(pid)` —
-* lets a late release from a dead generation delete the live claim of a
-* process that inherited the same pid, which is precisely how a per-camera
-* chart charges one camera for another camera's work. A handle can only ever
-* remove the entry it created.
-*
-* ## What the registry does NOT do
-*
-* It keeps no history, no counters and no timers. It holds live claims and
-* answers questions about them; when the process holding it dies, every claim
-* in it dies with it, which is correct — those children were its children.
-*
-* ## The numbers
-*
-* {@link ChildCostRegistry.contributions} reads each claimed child's
-* CUMULATIVE CPU seconds and resident bytes out of `/proc/<pid>` at the moment
-* it is asked. On demand, never on a timer: a new periodic per-node sampler is
-* the defect half of `docs/architecture/load-ledger.md` documents. A counter
-* can be differenced by whoever already keeps a history; a rate cannot be
-* un-averaged.
-*
-* Where `/proc` does not exist (macOS, Windows) or the read fails, the numbers
-* are ABSENT — never zero. Zero would say the camera cost nothing.
-*/
-/**
-* Kernel jiffies per second (`USER_HZ`). Same constant, same reasoning, as
-* `packages/system/src/builtins/native-metrics/thread-cpu-sampler.ts`:
-* `sysconf(_SC_CLK_TCK)` is not exposed to Node and this has been 100 on every
-* kernel configuration we ship to. A wrong value would scale every CPU number
-* by a constant — visible immediately, not a silent skew.
-*/
-var CLOCK_TICKS_PER_SEC = 100;
-/** Bytes per page, for `/proc/<pid>/statm`'s page counts. */
-var PAGE_BYTES = 4096;
-/**
-* The handle a spawn site gets when nobody is collecting — a test harness, or
-* a runner built before its addon registered a registry. Reporting nothing is
-* the correct behaviour: the process still appears in the node's process
-* snapshot, unclaimed, which is exactly what "nobody reported this" should
-* look like.
-*/
-var NO_COST_CLAIM = { release: () => void 0 };
-var nodeProcStatReader = {
-	readStat: (pid) => readFile(`/proc/${pid}/stat`, "utf8"),
-	readStatm: (pid) => readFile(`/proc/${pid}/statm`, "utf8")
-};
-/**
-* Cumulative CPU seconds from a `/proc/<pid>/stat` line.
-*
-* The `comm` field is field 2, wrapped in parentheses, and can itself contain
-* spaces and parentheses — so the only correct parse cuts at the LAST `)` and
-* indexes from there. After the cut, field 3 (`state`) is index 0, so `utime`
-* (field 14) is index 11 and `stime` (field 15) is index 12.
-*
-* `null` for a line that does not parse: a process that exited between the
-* claim and the read leaves a truncated or empty file, and that is normal.
-*/
-function parseProcCpuSeconds(line) {
-	const close = line.lastIndexOf(")");
-	if (close < 0) return null;
-	const rest = line.slice(close + 1).trim().split(/\s+/);
-	const utime = Number(rest[11]);
-	const stime = Number(rest[12]);
-	if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-	return (utime + stime) / CLOCK_TICKS_PER_SEC;
-}
-/**
-* Resident bytes from a `/proc/<pid>/statm` line — field 2 is the resident set
-* in pages. `null` when the line does not parse.
-*/
-function parseProcRssBytes(line) {
-	const fields = line.trim().split(/\s+/);
-	const residentPages = Number(fields[1]);
-	if (!Number.isFinite(residentPages)) return null;
-	return residentPages * PAGE_BYTES;
-}
-/**
-* What the OS will say about one process right now: cumulative CPU seconds and
-* resident bytes, each ABSENT when it cannot be read.
-*
-* Exported because not every cost has a spawn site inside a registry. The
-* shared inference pool is the case that forced it: its process is created
-* deep inside the engine factory and belongs to no camera, so it is reported
-* as an `unattributable` contribution built from the live pool's pids rather
-* than from a claim — but its numbers must be read the same way, by the same
-* parsers, or two "CPU seconds" in one payload would mean two things.
-*/
-async function readProcessCost(pid, reader = nodeProcStatReader) {
-	let cpuSeconds = null;
-	let rssBytes = null;
-	try {
-		cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
-	} catch {
-		cpuSeconds = null;
+var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
+var FRAGMENT_LOG_EVERY = 30;
+var Fmp4FragmentChild = class {
+	deps;
+	args;
+	child = null;
+	splitter = new Fmp4BoxSplitter();
+	stopped = false;
+	unitsOut = 0;
+	activeHwAccel = null;
+	constructor(deps, args) {
+		this.deps = deps;
+		this.args = args;
 	}
-	try {
-		rssBytes = parseProcRssBytes(await reader.readStatm(pid));
-	} catch {
-		rssBytes = null;
+	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+	async start() {
+		const requested = this.args.invocation.decodeHwAccel;
+		this.activeHwAccel = requested;
+		try {
+			await this.spawnAttempt(requested);
+			return;
+		} catch (err) {
+			if (this.stopped) throw err;
+			if (requested === null || isSoftwareDecode(requested)) throw err;
+			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					decodeHwAccel: requested,
+					error: errMsg(err)
+				}
+			});
+			this.killChild();
+			this.splitter = new Fmp4BoxSplitter();
+			this.activeHwAccel = null;
+			await this.spawnAttempt(null);
+		}
 	}
-	return {
-		...cpuSeconds === null ? {} : { cpuSeconds },
-		...rssBytes === null ? {} : { rssBytes }
-	};
-}
-var ChildCostRegistry = class {
-	reader;
-	now;
-	claims = /* @__PURE__ */ new Map();
-	constructor(reader = nodeProcStatReader, now = Date.now) {
-		this.reader = reader;
-		this.now = now;
+	/** The backend the child ACTUALLY ran with — `null` for software. */
+	activeDecodeHwAccel() {
+		const value = this.activeHwAccel;
+		return value === null || value === "none" || value === "copy" ? null : value;
 	}
-	/**
-	* Record one child. The returned handle is the only way to remove it.
-	*
-	* A claim with no pid is dropped rather than stored: it could carry no
-	* measurement, and an entry with a camera and no numbers reads on a chart as
-	* a camera that cost nothing.
-	*/
-	claim(input) {
-		const pid = input.pid;
-		if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
-		const key = Symbol("child-cost-claim");
-		this.claims.set(key, {
-			role: input.role,
-			deviceId: input.deviceId,
-			unit: input.unit,
-			attribution: input.attribution ?? "measured",
-			pid,
-			startedAtMs: this.now()
-		});
-		return { release: () => {
-			this.claims.delete(key);
-		} };
+	/** Kill ffmpeg and end the plane. Idempotent. */
+	async stop() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.killChild();
+		this.args.plane.end("the fragment child stopped");
 	}
-	/** Live claims, in claim order. Diagnostics and tests; not a contribution. */
-	list() {
-		return [...this.claims.values()].map((c) => ({
-			role: c.role,
-			deviceId: c.deviceId,
-			unit: c.unit,
-			attribution: c.attribution,
-			pid: c.pid
-		}));
+	spawnAttempt(decodeHwAccel) {
+		const args = buildFfmpegArgs({
+			...this.args.invocation,
+			decodeHwAccel,
+			sink: {
+				kind: "stdout",
+				container: "mp4",
+				fragmentMs: this.args.fragmentMs
+			}
+		});
+		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				fragmentMs: this.args.fragmentMs,
+				decodeHwAccel: decodeHwAccel ?? "software",
+				argv: args.join(" ")
+			}
+		});
+		return new Promise((resolve, reject) => {
+			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			this.child = child;
+			let settled = false;
+			/**
+			* This attempt FAILED. Set before the kill, because SIGTERM makes the
+			* child exit and that exit must not be reported as a death: the retry —
+			* or the caller's rejection — already owns what happens next. Without it
+			* the timeout path ends the plane the software retry is about to fill,
+			* and the consumer sees a stream that stopped for no reason. A "which
+			* spawn is current" counter does NOT cover this: the retry has not been
+			* spawned when the kill's exit arrives.
+			*/
+			let failed = false;
+			/**
+			* This attempt is still the live producer: it has not failed (a failure
+			* hands ownership to the retry, or to the caller's rejection) and nothing
+			* has stopped the child. Those two cover every way an attempt stops being
+			* current — `start` only respawns after a rejection.
+			*/
+			const isCurrent = () => !this.stopped && !failed;
+			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+			const settle = (fail) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				if (fail) {
+					failed = true;
+					reject(fail);
+				} else resolve();
+			};
+			const timer = setTimeout(() => {
+				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+				this.killChild();
+			}, timeoutMs);
+			timer.unref?.();
+			child.stdout?.on("data", (chunk) => {
+				for (const unit of this.splitter.push(chunk)) {
+					this.unitsOut += 1;
+					this.args.plane.publish(unit);
+					if (unit.kind === "init") {
+						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+							tags: { deviceId: this.args.deviceId },
+							meta: {
+								sourceId: this.args.sourceId,
+								bytes: unit.data.length
+							}
+						});
+						settle();
+					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+						tags: { deviceId: this.args.deviceId },
+						meta: {
+							sourceId: this.args.sourceId,
+							unitsOut: this.unitsOut,
+							bytes: unit.data.length,
+							subscribers: this.args.plane.subscriberCount
+						}
+					});
+				}
+				const fault = this.splitter.fault;
+				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+			});
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (line) => {
+				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						line: line.trim()
+					}
+				});
+			});
+			child.once("error", (err) => {
+				if (!settled) {
+					settle(err);
+					return;
+				}
+				if (!isCurrent()) return;
+				this.args.plane.end("the fragment child errored");
+				this.deps.onChildExit?.(err);
+			});
+			child.once("exit", (code, signal) => {
+				if (!settled) {
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
+		});
 	}
 	/**
-	* This addon's contribution: one entry per live claim, with whatever the OS
-	* will tell us about that child right now.
-	*
-	* A child that has exited between the claim and this read contributes an
-	* entry with no numbers rather than no entry — the unit exists, the addon
-	* believes it is running, and hiding it would make a dying writer look like
-	* a writer that was never started.
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
 	*/
-	async contributions() {
-		const out = [];
-		for (const claim of this.claims.values()) out.push({
-			role: claim.role,
-			deviceId: claim.deviceId,
-			attribution: claim.attribution,
-			unit: claim.unit,
-			pid: claim.pid,
-			startedAtMs: claim.startedAtMs,
-			...await readProcessCost(claim.pid, this.reader)
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
+			}
 		});
-		return out;
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
+	}
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: errMsg(err)
+				}
+			});
+		}
 	}
 };
 /**
@@ -471,220 +504,226 @@ var Fmp4FragmentPlane = class {
 		}
 	}
 };
-var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
-/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
-var FRAGMENT_LOG_EVERY = 30;
-var Fmp4FragmentChild = class {
-	deps;
-	args;
-	child = null;
-	splitter = new Fmp4BoxSplitter();
-	stopped = false;
-	unitsOut = 0;
-	activeHwAccel = null;
-	constructor(deps, args) {
-		this.deps = deps;
-		this.args = args;
-	}
-	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
-	async start() {
-		const requested = this.args.invocation.decodeHwAccel;
-		this.activeHwAccel = requested;
-		try {
-			await this.spawnAttempt(requested);
-			return;
-		} catch (err) {
-			if (this.stopped) throw err;
-			if (requested === null || isSoftwareDecode(requested)) throw err;
-			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					decodeHwAccel: requested,
-					error: errMsg(err)
-				}
-			});
-			this.killChild();
-			this.splitter = new Fmp4BoxSplitter();
-			this.activeHwAccel = null;
-			await this.spawnAttempt(null);
-		}
+/**
+* The registry an addon claims its OWN child processes in — the spawn-site
+* half of `load-contribution.cap.ts`.
+*
+* ## Where a claim is made, and where it is released
+*
+* At the spawn site, and nowhere else. It is the only place that knows both
+* halves: the recorder's controller knows it is starting ffmpeg for camera 615
+* profile `high`; the decode coordinator knows the session it is forking a
+* worker for. Nothing has to deduce it afterwards, and no entity needs a
+* global list of which pid belongs to which camera.
+*
+* {@link ChildCostRegistry.claim} returns a HANDLE, and the handle is the only
+* way to release. That is not decoration: the alternative — `release(pid)` —
+* lets a late release from a dead generation delete the live claim of a
+* process that inherited the same pid, which is precisely how a per-camera
+* chart charges one camera for another camera's work. A handle can only ever
+* remove the entry it created.
+*
+* ## What the registry does NOT do
+*
+* It keeps no history, no counters and no timers. It holds live claims and
+* answers questions about them; when the process holding it dies, every claim
+* in it dies with it, which is correct — those children were its children.
+*
+* ## The numbers
+*
+* {@link ChildCostRegistry.contributions} reads each claimed child's
+* CUMULATIVE CPU seconds and resident bytes out of `/proc/<pid>` at the moment
+* it is asked. On demand, never on a timer: a new periodic per-node sampler is
+* the defect half of `docs/architecture/load-ledger.md` documents. A counter
+* can be differenced by whoever already keeps a history; a rate cannot be
+* un-averaged.
+*
+* Where `/proc` does not exist (macOS, Windows) or the read fails, the numbers
+* are ABSENT — never zero. Zero would say the camera cost nothing.
+*/
+/**
+* Kernel jiffies per second (`USER_HZ`). Same constant, same reasoning, as
+* `packages/system/src/builtins/native-metrics/thread-cpu-sampler.ts`:
+* `sysconf(_SC_CLK_TCK)` is not exposed to Node and this has been 100 on every
+* kernel configuration we ship to. A wrong value would scale every CPU number
+* by a constant — visible immediately, not a silent skew.
+*/
+var CLOCK_TICKS_PER_SEC = 100;
+/** Bytes per page, for `/proc/<pid>/statm`'s page counts. */
+var PAGE_BYTES = 4096;
+/**
+* The handle a spawn site gets when nobody is collecting — a test harness, or
+* a runner built before its addon registered a registry. Reporting nothing is
+* the correct behaviour: the process still appears in the node's process
+* snapshot, unclaimed, which is exactly what "nobody reported this" should
+* look like.
+*/
+var NO_COST_CLAIM = { release: () => void 0 };
+var nodeProcStatReader = {
+	readStat: (pid) => readFile(`/proc/${pid}/stat`, "utf8"),
+	readStatm: (pid) => readFile(`/proc/${pid}/statm`, "utf8")
+};
+/**
+* Cumulative CPU seconds from a `/proc/<pid>/stat` line.
+*
+* The `comm` field is field 2, wrapped in parentheses, and can itself contain
+* spaces and parentheses — so the only correct parse cuts at the LAST `)` and
+* indexes from there. After the cut, field 3 (`state`) is index 0, so `utime`
+* (field 14) is index 11 and `stime` (field 15) is index 12.
+*
+* `null` for a line that does not parse: a process that exited between the
+* claim and the read leaves a truncated or empty file, and that is normal.
+*/
+function parseProcCpuSeconds(line) {
+	const close = line.lastIndexOf(")");
+	if (close < 0) return null;
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+	return (utime + stime) / CLOCK_TICKS_PER_SEC;
+}
+/**
+* Resident bytes from a `/proc/<pid>/statm` line — field 2 is the resident set
+* in pages. `null` when the line does not parse.
+*/
+function parseProcRssBytes(line) {
+	const fields = line.trim().split(/\s+/);
+	const residentPages = Number(fields[1]);
+	if (!Number.isFinite(residentPages)) return null;
+	return residentPages * PAGE_BYTES;
+}
+/**
+* What the OS will say about one process right now: cumulative CPU seconds and
+* resident bytes, each ABSENT when it cannot be read.
+*
+* Exported because not every cost has a spawn site inside a registry. The
+* shared inference pool is the case that forced it: its process is created
+* deep inside the engine factory and belongs to no camera, so it is reported
+* as an `unattributable` contribution built from the live pool's pids rather
+* than from a claim — but its numbers must be read the same way, by the same
+* parsers, or two "CPU seconds" in one payload would mean two things.
+*/
+async function readProcessCost(pid, reader = nodeProcStatReader) {
+	let cpuSeconds = null;
+	let rssBytes = null;
+	try {
+		cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
+	} catch {
+		cpuSeconds = null;
 	}
-	/** The backend the child ACTUALLY ran with — `null` for software. */
-	activeDecodeHwAccel() {
-		const value = this.activeHwAccel;
-		return value === null || value === "none" || value === "copy" ? null : value;
+	try {
+		rssBytes = parseProcRssBytes(await reader.readStatm(pid));
+	} catch {
+		rssBytes = null;
 	}
-	/** Kill ffmpeg and end the plane. Idempotent. */
-	async stop() {
-		if (this.stopped) return;
-		this.stopped = true;
-		this.killChild();
-		this.args.plane.end("the fragment child stopped");
+	return {
+		...cpuSeconds === null ? {} : { cpuSeconds },
+		...rssBytes === null ? {} : { rssBytes }
+	};
+}
+var ChildCostRegistry = class {
+	reader;
+	now;
+	claims = /* @__PURE__ */ new Map();
+	constructor(reader = nodeProcStatReader, now = Date.now) {
+		this.reader = reader;
+		this.now = now;
 	}
-	spawnAttempt(decodeHwAccel) {
-		const args = buildFfmpegArgs({
-			...this.args.invocation,
-			decodeHwAccel,
-			sink: {
-				kind: "stdout",
-				container: "mp4",
-				fragmentMs: this.args.fragmentMs
-			}
-		});
-		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				fragmentMs: this.args.fragmentMs,
-				decodeHwAccel: decodeHwAccel ?? "software",
-				argv: args.join(" ")
-			}
-		});
-		return new Promise((resolve, reject) => {
-			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			] });
-			this.child = child;
-			let settled = false;
-			/**
-			* This attempt FAILED. Set before the kill, because SIGTERM makes the
-			* child exit and that exit must not be reported as a death: the retry —
-			* or the caller's rejection — already owns what happens next. Without it
-			* the timeout path ends the plane the software retry is about to fill,
-			* and the consumer sees a stream that stopped for no reason. A "which
-			* spawn is current" counter does NOT cover this: the retry has not been
-			* spawned when the kill's exit arrives.
-			*/
-			let failed = false;
-			/**
-			* This attempt is still the live producer: it has not failed (a failure
-			* hands ownership to the retry, or to the caller's rejection) and nothing
-			* has stopped the child. Those two cover every way an attempt stops being
-			* current — `start` only respawns after a rejection.
-			*/
-			const isCurrent = () => !this.stopped && !failed;
-			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
-			const settle = (fail) => {
-				if (settled) return;
-				settled = true;
-				clearTimeout(timer);
-				if (fail) {
-					failed = true;
-					reject(fail);
-				} else resolve();
-			};
-			const timer = setTimeout(() => {
-				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
-				this.killChild();
-			}, timeoutMs);
-			timer.unref?.();
-			child.stdout?.on("data", (chunk) => {
-				for (const unit of this.splitter.push(chunk)) {
-					this.unitsOut += 1;
-					this.args.plane.publish(unit);
-					if (unit.kind === "init") {
-						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
-							tags: { deviceId: this.args.deviceId },
-							meta: {
-								sourceId: this.args.sourceId,
-								bytes: unit.data.length
-							}
-						});
-						settle();
-					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
-						tags: { deviceId: this.args.deviceId },
-						meta: {
-							sourceId: this.args.sourceId,
-							unitsOut: this.unitsOut,
-							bytes: unit.data.length,
-							subscribers: this.args.plane.subscriberCount
-						}
-					});
-				}
-				const fault = this.splitter.fault;
-				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
-			});
-			child.stderr?.setEncoding("utf8");
-			child.stderr?.on("data", (line) => {
-				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						line: line.trim()
-					}
-				});
-			});
-			child.once("error", (err) => {
-				if (!settled) {
-					settle(err);
-					return;
-				}
-				if (!isCurrent()) return;
-				this.args.plane.end("the fragment child errored");
-				this.deps.onChildExit?.(err);
-			});
-			child.once("exit", (code, signal) => {
-				if (!settled) {
-					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
-					return;
-				}
-				if (!isCurrent()) return;
-				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
-				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						code,
-						signal,
-						unitsOut: this.unitsOut
-					}
-				});
-				this.args.plane.end("the fragment child exited");
-				this.deps.onChildExit?.(error);
-			});
+	/**
+	* Record one child. The returned handle is the only way to remove it.
+	*
+	* A claim with no pid is dropped rather than stored: it could carry no
+	* measurement, and an entry with a camera and no numbers reads on a chart as
+	* a camera that cost nothing.
+	*/
+	claim(input) {
+		const pid = input.pid;
+		if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
+		const key = Symbol("child-cost-claim");
+		this.claims.set(key, {
+			role: input.role,
+			deviceId: input.deviceId,
+			unit: input.unit,
+			attribution: input.attribution ?? "measured",
+			pid,
+			startedAtMs: this.now()
 		});
+		return { release: () => {
+			this.claims.delete(key);
+		} };
+	}
+	/** Live claims, in claim order. Diagnostics and tests; not a contribution. */
+	list() {
+		return [...this.claims.values()].map((c) => ({
+			role: c.role,
+			deviceId: c.deviceId,
+			unit: c.unit,
+			attribution: c.attribution,
+			pid: c.pid
+		}));
 	}
 	/**
-	* The byte stream stopped being splittable. Not recoverable — the splitter
-	* cannot resynchronise mid-box — so the child is a corpse and every consumer
-	* has to be told, loudly, with the reason.
+	* This addon's contribution: one entry per live claim, with whatever the OS
+	* will tell us about that child right now.
+	*
+	* A child that has exited between the claim and this read contributes an
+	* entry with no numbers rather than no entry — the unit exists, the addon
+	* believes it is running, and hiding it would make a dying writer look like
+	* a writer that was never started.
 	*/
-	onFault(reason, wasLive, current, settle) {
-		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
-		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				unitsOut: this.unitsOut,
-				interstitial: this.splitter.discardedInterstitialTypes,
-				reason
-			}
+	async contributions() {
+		const out = [];
+		for (const claim of this.claims.values()) out.push({
+			role: claim.role,
+			deviceId: claim.deviceId,
+			attribution: claim.attribution,
+			unit: claim.unit,
+			pid: claim.pid,
+			startedAtMs: claim.startedAtMs,
+			...await readProcessCost(claim.pid, this.reader)
 		});
-		this.killChild();
-		settle(error);
-		if (wasLive && current) {
-			this.args.plane.end("the fragment child produced unsplittable output");
-			this.deps.onChildExit?.(error);
-		}
-	}
-	killChild() {
-		const child = this.child;
-		this.child = null;
-		if (child && !child.killed) try {
-			child.kill("SIGTERM");
-		} catch (err) {
-			this.deps.logger.warn("fmp4 fragment child: kill error", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					error: errMsg(err)
-				}
-			});
-		}
+		return out;
 	}
 };
+/**
+* The PHYSICAL root behind a storage-location path — ONE derivation, shared.
+*
+* A symlink or a bind mount reaches one disk under two names, and a string
+* comparison misses exactly the case that matters: two locations that look
+* distinct in the config and are the same directory. Every consumer that has to
+* answer "are these the same disk" resolves it here.
+*
+* Two consumers today, and they need different things from the SAME derivation,
+* which is why the resolution failure is reported rather than swallowed:
+*
+*  - the recorder's eviction domain merges same-root aliases into one
+*    oldest-first pool. It wants a key either way — an unresolvable root falls
+*    back to the lexically-resolved path, which can only ever OVER-partition
+*    (treat one disk as two) and never merge two different disks. That is the
+*    safe failure mode for a data-loss guard.
+*  - the orchestrator's collision refusal (D389) must NOT refuse on a root it
+*    could not resolve: a location on another node, or behind a remote
+*    provider, is unresolvable from here, and refusing on an unanswerable read
+*    blocks the operator on a doubt (D49's spirit). It needs to know.
+*
+* Node-only (`node:fs`), so it lives off the root entry and is re-exported from
+* `@camstack/types/node`.
+*/
+/** Resolve a location root to its physical key. Never throws. */
+function physicalRootOf(root, realpath = realpathSync) {
+	const resolved = path.resolve(root);
+	try {
+		return {
+			key: realpath(resolved),
+			resolved: true
+		};
+	} catch {
+		return {
+			key: resolved,
+			resolved: false
+		};
+	}
+}
 //#endregion
-export { readProcessCost as a, NO_COST_CLAIM as i, Fmp4FragmentChild as n, Fmp4FragmentPlane as r, ChildCostRegistry as t };
+export { physicalRootOf as a, NO_COST_CLAIM as i, Fmp4FragmentChild as n, readProcessCost as o, Fmp4FragmentPlane as r, ChildCostRegistry as t };