@camstack/addon-pipeline 1.2.294 → 1.2.296

package/dist/session-decode/{decode-worker-child.js → decode-worker-main.js}

@@ -1,6 +1,73 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-B2MfQLlu.js");
+const require_worker_protocol = require("../worker-protocol-C-G8qmye.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
+var OutboundSendTracker = class {
+	inFlight = 0;
+	idleWaiters = [];
+	/** A send left for the channel; call the returned function from its callback. */
+	begin() {
+		this.inFlight += 1;
+		let done = false;
+		return () => {
+			if (done) return;
+			done = true;
+			this.inFlight = Math.max(0, this.inFlight - 1);
+			if (this.inFlight > 0) return;
+			const waiters = this.idleWaiters;
+			this.idleWaiters = [];
+			for (const resolve of waiters) resolve();
+		};
+	}
+	get pending() {
+		return this.inFlight;
+	}
+	/** Resolves when nothing is in flight, or after `boundMs` — whichever is first. */
+	whenIdle(boundMs) {
+		if (this.inFlight === 0) return Promise.resolve("idle");
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => resolve("bound"), boundMs);
+			this.idleWaiters.push(() => {
+				clearTimeout(timer);
+				resolve("idle");
+			});
+		});
+	}
+};
+function createWorkerExit(deps) {
+	let exiting = false;
+	return (code) => {
+		if (exiting) return;
+		exiting = true;
+		let exitCode = code;
+		try {
+			deps.steps.quiesce();
+		} catch {
+			exitCode = 1;
+		} finally {
+			try {
+				deps.steps.flushFinalLines();
+			} catch {
+				exitCode = 1;
+			} finally {
+				deps.sends.whenIdle(deps.boundMs ?? 250).then(() => deps.exit(exitCode));
+			}
+		}
+	};
+}
+/**
+* Route every event that ends the worker through the one bounded exit:
+* SIGTERM (the parent's `kill()`) and a lost channel exit 0, an uncaught
+* error is reported and exits 1. Before D652 there was no SIGTERM handler and
+* a `kill()` ended the process with its last lines still queued.
+*/
+function wireWorkerExit(deps) {
+	deps.on("SIGTERM", () => deps.exitWorker(0));
+	deps.on("disconnect", () => deps.exitWorker(0));
+	deps.on("uncaughtException", (err) => {
+		deps.reportUncaught(err);
+		deps.exitWorker(1);
+	});
+}
+//#endregion
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.
@@ -302,6 +369,18 @@ var FrameSlot = class {
 		if (!this.reserved || this.reserved.frameId !== frameId) return null;
 		return this.reserved.frame;
 	}
+	/**
+	* Free only the UNDELIVERED slot frame, keeping the reserved one (D652 drain):
+	* after a drain no `pull` will ever take the slot frame, while the reserved
+	* frame is one the parent may still read. Returns whether a frame was freed.
+	*/
+	freeUndelivered() {
+		const held = this.slot;
+		if (!held) return false;
+		held.frame.free();
+		this.slot = null;
+		return true;
+	}
 	/** Free both the slot and the reserved frame (teardown). */
 	free() {
 		this.slot?.frame.free();
@@ -615,6 +694,7 @@ var NativeLeaseStore = class {
 	budgetBytes;
 	maxFrames;
 	now;
+	onEvict;
 	bytes = 0;
 	/**
 	* Frames dropped because the hold bound or the byte ceiling was reached
@@ -627,6 +707,7 @@ var NativeLeaseStore = class {
 		this.budgetBytes = options.budgetBytes;
 		this.maxFrames = Math.max(1, options.maxFrames);
 		this.now = options.now ?? Date.now;
+		this.onEvict = options.onEvict;
 	}
 	/** Frames dropped by a bound rather than released (tests / metrics). */
 	get overflowCount() {
@@ -668,6 +749,7 @@ var NativeLeaseStore = class {
 			if (oldest === frameId) break;
 			this.overflowed += 1;
 			this.drop(oldest);
+			this.onEvict?.(oldest);
 		}
 		return true;
 	}
@@ -1351,6 +1433,40 @@ function planPreRollBurst(input) {
 	};
 }
 /**
+* Fit a burst inside the hold its frames live in (D652), without shrinking the
+* history it covers.
+*
+* Every pre-roll frame the runner admits is a lazy ref: its pixels are a frame
+* the worker HOLDS until inference reads it, and the hold keeps
+* `holdFrames`. A burst of 12 into a hold of 8, read oldest-first by the lane,
+* evicts its own oldest frames before inference reaches them — 54 of 55 live
+* `toBuffer miss … released/hold-full` lines named a frameId ≤ 12. So the burst
+* sends at most `holdFrames - 1` frames (the ceiling D367 already gives the
+* runner's in-flight frames, leaving the newest slot to the first live frame).
+*
+* The REACH is kept: the window handed to the planner is still
+* `requestedFrames × cadence`, so the capped frames are spread across the same
+* span of media the operator asked for (D382 — a consumer is served the history
+* it asked for), sampled less densely. The alternative, raising the hold for the
+* burst, would pin up to `requestedFrames - holdFrames + 1` extra native rasters
+* (~24 MB each at 4K) on every session open.
+*/
+function planPreRollWithinHold(input) {
+	const requested = Number.isFinite(input.requestedFrames) && input.requestedFrames > 0 ? Math.floor(input.requestedFrames) : 0;
+	const holdCeiling = Math.max(1, Math.floor(input.holdFrames) - 1);
+	const budgetFrames = input.holdEnabled ? Math.min(requested, holdCeiling) : requested;
+	const cadenceMs = Number.isFinite(input.cadenceMs) && input.cadenceMs > 0 ? input.cadenceMs : 1e3;
+	return {
+		budgetFrames,
+		holdCapped: budgetFrames < requested,
+		plan: planPreRollBurst({
+			spanMs: requested * cadenceMs,
+			detectionFps: 1e3 / cadenceMs,
+			maxFrames: budgetFrames
+		})
+	};
+}
+/**
 * The live, per-session budget. Stateful by necessity — a stride is a decision
 * about the PREVIOUS admission — and deliberately free of any clock of its own:
 * both times are passed in, so a test can drive a catch-up burst without
@@ -1444,6 +1560,121 @@ var PreRollBurst = class {
 	}
 };
 //#endregion
+//#region src/session-decode/pre-roll-hold-ledger.ts
+var PreRollSettleTracker = class {
+	pending = /* @__PURE__ */ new Set();
+	read = 0;
+	released = 0;
+	lost = {
+		evicted: 0,
+		cleared: 0,
+		"download-failed": 0,
+		miss: 0
+	};
+	burstEnded = false;
+	emitted = false;
+	/** A pre-roll frame was delivered to the runner; inference has not read it yet. */
+	admit(frameId) {
+		if (this.emitted) return;
+		this.pending.add(frameId);
+	}
+	/**
+	* One frame's fate. Only the FIRST outcome of a delivered pre-roll frame
+	* counts: a miss that follows an eviction is the same loss, not two. Returns
+	* the summary to send when this settle was the last one owed after the burst
+	* ended, else `null`.
+	*/
+	settle(frameId, outcome) {
+		if (!this.pending.delete(frameId)) return null;
+		if (outcome === "read") this.read += 1;
+		else if (outcome === "released") this.released += 1;
+		else this.lost[outcome] += 1;
+		return this.summaryIfSettled();
+	}
+	/** Every frame still pending is lost the same way at once (a re-dial clearing the hold). */
+	settleAll(outcome) {
+		let summary = null;
+		for (const frameId of [...this.pending]) summary = this.settle(frameId, outcome) ?? summary;
+		return summary;
+	}
+	/** The burst is over: from now on the summary goes out when nothing is owed. */
+	endBurst() {
+		this.burstEnded = true;
+		return this.summaryIfSettled();
+	}
+	/**
+	* Teardown: send what is known now, `unsettled` included. `null` when there
+	* was no burst or the summary already went out.
+	*/
+	flush() {
+		if (this.emitted || !this.burstEnded) return null;
+		return this.emit();
+	}
+	summaryIfSettled() {
+		if (this.emitted || !this.burstEnded || this.pending.size > 0) return null;
+		return this.emit();
+	}
+	emit() {
+		this.emitted = true;
+		return {
+			read: this.read,
+			released: this.released,
+			lostByReason: { ...this.lost },
+			unsettled: this.pending.size
+		};
+	}
+};
+//#endregion
+//#region src/session-decode/native-disposer.ts
+var NativeDisposer = class {
+	onRefused;
+	refusing = false;
+	refused = 0;
+	constructor(onRefused) {
+		this.onRefused = onRefused;
+	}
+	/** From now on nothing native is disposed (the worker is exiting). Idempotent. */
+	refuseFromNowOn() {
+		this.refusing = true;
+	}
+	get isRefusing() {
+		return this.refusing;
+	}
+	/** Disposes refused since {@link refuseFromNowOn} — diagnostics and tests. */
+	get refusedCount() {
+		return this.refused;
+	}
+	/**
+	* Run `dispose` unless the worker is exiting. `what` names the object for the
+	* refusal line. Returns whether it ran — a caller that dropped its reference
+	* either way loses nothing: an unrun dispose is reclaimed by process exit.
+	*/
+	run(what, dispose) {
+		if (this.refusing) {
+			this.refused += 1;
+			this.onRefused?.(what);
+			return false;
+		}
+		dispose();
+		return true;
+	}
+};
+//#endregion
+//#region src/session-decode/decode-loop-policy.ts
+function inputCloseAfterLoop(state) {
+	if (state.exiting) return "none";
+	if (state.draining) return "demuxer-only";
+	return "all";
+}
+/**
+* The frame decoded after a drain/stop is nobody's: free it — unless the
+* worker is exiting, where exit reclaims it and no native call is made.
+*/
+function releaseFrameAfterStop(frame, state) {
+	if (state.exiting || frame === null) return;
+	frame.free();
+}
+//#endregion
 //#region src/session-decode/pull-demuxer-open.ts
 /**
 * Open the pull input, skipping `avformat_find_stream_info` when the opened
@@ -2014,10 +2245,11 @@ async function getConstants() {
 	}
 }
 /** The HOLD store, sized from one session's knobs. */
-function buildLeaseStore(lease) {
+function buildLeaseStore(lease, onEvict) {
 	return new NativeLeaseStore({
 		budgetBytes: lease.values.budgetMb * MB,
-		maxFrames: lease.values.holdFrames
+		maxFrames: lease.values.holdFrames,
+		...onEvict ? { onEvict } : {}
 	});
 }
 /** A TILE store (subject or scene) under `budgetMb`, on the shared tile TTL. */
@@ -2137,11 +2369,17 @@ function packSinglePlane(plane, linesize, width, height, channels) {
 	else for (let row = 0; row < height; row++) plane.copy(out, row * rowBytes, row * stride, row * stride + rowBytes);
 	return out;
 }
-/**
-* The forked child's whole runtime: decode-loop lifecycle, the latest-wins
-* frame slot, and the ROI scaler for `toBuffer`. One instance per process.
-*/
 var DecodeWorkerChild = class {
+	/**
+	* Every native dispose / close goes through here, and it refuses once the
+	* exit has begun (D652) — see `native-disposer.ts`.
+	*/
+	native;
+	requestExit;
+	constructor(hooks = {}) {
+		this.requestExit = hooks.requestExit ?? (() => void 0);
+		this.native = hooks.disposer ?? new NativeDisposer((what) => this.emitStderr(`decode-worker-child: native dispose left to process exit — ${what}\n`, "debug"));
+	}
 	nav = null;
 	consts = null;
 	hwContext = null;
@@ -2152,7 +2390,7 @@ var DecodeWorkerChild = class {
 	* ~10GB/h). Detection uses a stable ROI + resize target, so the scaler is
 	* built once and reused, rebuilt only when the key changes — mirroring the
 	* shared decoder session (`nodeav-decoder-session.ts`, which reuses one
-	* `this.scaler` for the same reason). Disposed in `teardown`.
+	* `this.scaler` for the same reason). Reclaimed by process exit (D652).
 	*/
 	scaler = null;
 	scalerKey = "";
@@ -2177,7 +2415,7 @@ var DecodeWorkerChild = class {
 	* for — the HW analogue of {@link scaler}/{@link scalerKey}. Rebuilt (old
 	* CLOSED) only when the key changes. Its internal `scale_<be>` OUTPUT hw
 	* frames pool is the leak-prone VAAPI surface pool, so it is closed on EVERY
-	* re-dial ({@link closeInput}) and on teardown — this discipline is what stops
+	* re-dial ({@link closeInput}) and by process exit — this discipline is what stops
 	* the prior "keeping decoded frames on the GPU leaked the VAAPI surface pool
 	* on every re-dial" incident from recurring.
 	*/
@@ -2189,7 +2427,7 @@ var DecodeWorkerChild = class {
 	* evicts (rebuilds) the hot-path detection filter cache — the crop geometry
 	* differs from the stable detection geometry, so sharing one cache would
 	* thrash it. Same dispose discipline: both are closed on every re-dial
-	* ({@link closeInput}) and on teardown. Rebuilt lazily per crop geometry.
+	* ({@link closeInput}) and by process exit. Rebuilt lazily per crop geometry.
 	*/
 	nativeCropHwFilter = null;
 	nativeCropHwFilterKey = "";
@@ -2201,7 +2439,7 @@ var DecodeWorkerChild = class {
 	* request that follows. Hard-capped at {@link NATIVE_RING_CAP}; single
 	* ownership via the {@link FrameSlot} `retainSuperseded` hook (a frame enters
 	* the ring exactly when the slot would otherwise free it). Cleared on every
-	* re-dial + teardown (see {@link closeInput}).
+	* re-dial, reclaimed by process exit (see {@link closeInput}).
 	*/
 	nativeRing = new NativeFrameRing(NATIVE_RING_CAP);
 	/**
@@ -2210,7 +2448,7 @@ var DecodeWorkerChild = class {
 	* eviction. Replaces the tiny GPU {@link nativeRing} as the default (the ring
 	* is used only when the lease is disabled via a 0 budget). Because it holds
 	* DOWNLOADED (system-memory) frames, retaining a large window has no VAAPI
-	* surface-pool starvation risk. Cleared on every re-dial + teardown.
+	* surface-pool starvation risk. Cleared on every re-dial; reclaimed by process exit.
 	*/
 	leaseStore = buildLeaseStore(UNSTARTED_LEASE_KNOBS);
 	/**
@@ -2296,7 +2534,7 @@ var DecodeWorkerChild = class {
 	* materialize a HW surface into a leasable software frame at NATIVE
 	* resolution (no scale). Kept separate from the detection/native-crop filters
 	* (different geometry). Same dispose discipline: closed on every re-dial
-	* ({@link closeInput}) + teardown, since it references the decoder's per-dial
+	* ({@link closeInput}), since it references the decoder's per-dial
 	* `hw_frames_ctx`.
 	*/
 	nativeLeaseDownloadFilter = null;
@@ -2390,6 +2628,19 @@ var DecodeWorkerChild = class {
 	started = false;
 	stopped = false;
 	/**
+	* Set by `drain` (D652): decoding has stopped but every frame already handed
+	* out is kept, so the parent can still read what it admitted. The decode
+	* loop's per-dial `closeInput` is skipped while this is set — that is what
+	* would free the hold — and `stop` ends the process, whose exit reclaims everything.
+	*/
+	draining = false;
+	/**
+	* Set by the EXIT path (SIGTERM / `stop` / a lost channel / an uncaught
+	* error): nothing native is disposed from here on — the decode loop may
+	* still be inside libav, and process exit reclaims it all (D652).
+	*/
+	exiting = false;
+	/**
 	* The numeric device id this worker decodes for — learned from the `start`
 	* message's {@link VideoFrameSource}. The child's stderr is INHERITED by the
 	* pipeline-runner (silent:false fork), so these lines land in the runner's
@@ -2423,6 +2674,16 @@ var DecodeWorkerChild = class {
 	preRollBurst = null;
 	/** Whether the burst's report has already been sent — it is sent exactly once. */
 	preRollReported = false;
+	/**
+	* What became of the pre-roll frames the burst delivered — read, let go, or
+	* lost after the burst's report went out (D652). Its summary is a second,
+	* later line (`preRollSettled`), never a delay on the report itself.
+	*/
+	preRollSettle = new PreRollSettleTracker();
+	/** Every IPC send until its callback fires, so an exit can wait for them (D652). */
+	outbound = new OutboundSendTracker();
+	/** Frames this burst may send to inference, after the hold cap (D652). */
+	preRollBudgetFrames = 0;
 	/** Media wall clock of the OLDEST and NEWEST frames the burst admitted. */
 	preRollFirstMediaWall = null;
 	preRollLastMediaWall = null;
@@ -2435,7 +2696,7 @@ var DecodeWorkerChild = class {
 	frames = new FrameSlot({ retainSuperseded: (frameId, frame) => this.captureNativeFrame(frameId, frame) });
 	/**
 	* Mirrors whether `this.frames` currently has a pull waiting, so
-	* `teardown` knows to resolve it with `{kind:'ended'}` — `FrameSlot`
+	* `quiesceForExit` knows to resolve it with `{kind:'ended'}` — `FrameSlot`
 	* intentionally exposes no pending-pull query, only `markPendingPull()`,
 	* so the child tracks this in lockstep (set in `handlePull`, cleared
 	* whenever `consumeDecodedFrame`'s `publish` resolves it).
@@ -2448,6 +2709,10 @@ var DecodeWorkerChild = class {
 			this.sendError("decode-worker-child: malformed request");
 			return;
 		}
+		if (this.exiting) {
+			this.refuseWhileExiting(message);
+			return;
+		}
 		switch (message.kind) {
 			case "start":
 				this.handleStart(message.source, message.opts, message.lease);
@@ -2470,13 +2735,73 @@ var DecodeWorkerChild = class {
 			case "markInferred":
 				this.admission.mark(message.frameId);
 				return;
+			case "drain":
+				this.handleDrain();
+				return;
 			case "stop":
 				this.handleStop();
 				return;
 		}
 	}
-	/** Channel teardown (explicit `stop` or the parent disconnecting) — dispose, then exit. */
-	teardown() {
+	/** The answer to a request that arrives after the exit began (D652). */
+	refuseWhileExiting(message) {
+		switch (message.kind) {
+			case "toBuffer":
+				this.send({
+					kind: "error",
+					message: "decode-worker-child: exiting — toBuffer refused",
+					frameId: message.frameId
+				});
+				return;
+			case "nativeCrop":
+				this.send({
+					kind: "nativeCropMiss",
+					requestId: message.requestId,
+					reason: "worker exiting"
+				});
+				return;
+			case "pull":
+				this.send({ kind: "ended" });
+				return;
+			case "stop":
+				this.requestExit(0);
+				return;
+			default: return;
+		}
+	}
+	/**
+	* Stop decoding without giving up a single frame the parent holds (D652).
+	*
+	* The loop ends at its next frame and never re-dials, a dial still opening is
+	* aborted, and a later `pull` answers `ended`. The reserved slot, the hold and
+	* the tile/scene stores are left exactly as they are: those are the frames the
+	* runner already admitted, and the whole point is that they stay readable
+	* until the parent has read them and sends `stop`.
+	*/
+	handleDrain() {
+		if (this.stopped) return;
+		this.draining = true;
+		this.stopped = true;
+		this.ended = true;
+		if (this.redialTimer) {
+			clearTimeout(this.redialTimer);
+			this.redialTimer = null;
+		}
+		this.abortController?.abort();
+		this.native.run("undeliveredSlotFrame", () => this.frames.freeUndelivered());
+		this.endPreRollBurst();
+	}
+	/**
+	* Exit step 1 (`createWorkerExit`): stop everything that runs, WITHOUT a
+	* native call. Before D652 this also freed the frames and disposed the
+	* demuxer, decoder, scalers and GPU context — while the decode loop could
+	* still sit in native I/O, and the process now lives on up to
+	* `WORKER_EXIT_FLUSH_BOUND_MS` after it. Process exit reclaims every native
+	* resource, the GPU pool included, so the exit path disposes nothing.
+	*/
+	quiesceForExit() {
+		this.native.refuseFromNowOn();
+		this.exiting = true;
 		this.stopped = true;
 		this.ended = true;
 		if (this.redialTimer) {
@@ -2490,21 +2815,19 @@ var DecodeWorkerChild = class {
 		if (this.started) this.logMetrics(true);
 		this.endPreRollBurst();
 		this.abortController?.abort();
-		this.frames.free();
-		this.closeInput();
-		this.scaler?.[Symbol.dispose]?.();
-		this.scaler = null;
-		this.scalerKey = "";
-		this.nativeCropScaler?.[Symbol.dispose]?.();
-		this.nativeCropScaler = null;
-		this.nativeCropScalerKey = "";
-		this.hwContext?.[Symbol.dispose]?.();
-		this.hwContext = null;
 		if (this.pendingPull) {
 			this.pendingPull = false;
 			this.send({ kind: "ended" });
 		}
 	}
+	/** Exit step 2: the last report lines — `unsettled` included. */
+	flushFinalLines() {
+		const settled = this.preRollSettle.flush();
+		if (settled) this.send({
+			kind: "preRollSettled",
+			...settled
+		});
+	}
 	/**
 	* Emit the compact throughput line (window `deliveredFps`); cheap,
 	* integer-only.
@@ -2546,7 +2869,7 @@ var DecodeWorkerChild = class {
 		this.started = true;
 		this.deviceId = source.deviceId;
 		this.lease = lease;
-		this.leaseStore = buildLeaseStore(lease);
+		this.leaseStore = buildLeaseStore(lease, (frameId) => this.settlePreRoll(frameId, "evicted"));
 		this.tileStore = buildTileStore(lease.values.tileBudgetMb);
 		this.sceneStore = buildTileStore(lease.values.sceneBudgetMb);
 		this.leaseGate = new LeaseActivityGate(lease.values.activityMs);
@@ -2582,6 +2905,7 @@ var DecodeWorkerChild = class {
 	* supersede declines it (`LeaseAdmissionLedger.unmark`), and count it.
 	*/
 	noteLeaseRelease(frameId, held, by) {
+		this.settlePreRoll(frameId, "released");
 		if (held) {
 			this.leaseReleased += 1;
 			return;
@@ -2599,6 +2923,7 @@ var DecodeWorkerChild = class {
 	}
 	async handleToBuffer(frameId, opts) {
 		const frame = this.leaseStore.get(frameId)?.frame ?? this.frames.toBuffer(frameId);
+		this.settlePreRoll(frameId, frame ? "read" : "miss");
 		if (!frame) {
 			this.sendError(describeToBufferMiss({
 				frameId,
@@ -3038,13 +3363,25 @@ var DecodeWorkerChild = class {
 	* `docs/design/decode-path.md` → "Lease admission".
 	*/
 	captureNativeFrame(frameId, frame) {
-		if (!this.leaseStore.enabled) return this.nativeRing.retain(frameId, frame);
-		if (!this.leaseGate.active) return false;
-		if (!this.admission.admit(frameId)) return false;
+		if (!this.leaseStore.enabled) {
+			this.settlePreRoll(frameId, "released");
+			return this.nativeRing.retain(frameId, frame);
+		}
+		if (!this.leaseGate.active) {
+			this.settlePreRoll(frameId, "released");
+			return false;
+		}
+		if (!this.admission.admit(frameId)) {
+			this.settlePreRoll(frameId, "released");
+			return false;
+		}
 		if (frame.isHwFrame()) {
 			const software = this.downloadToSoftware(frame);
 			frame.free();
-			if (!software) return true;
+			if (!software) {
+				this.settlePreRoll(frameId, "download-failed");
+				return true;
+			}
 			this.leaseStore.put(frameId, PINNED_RGB_CROP ? toLeasedRgbNavFrame(software) : toLeasedNavFrame(software));
 			return true;
 		}
@@ -3070,7 +3407,7 @@ var DecodeWorkerChild = class {
 			return first;
 		} catch (err) {
 			this.emitStderr(`decode-worker-child: native lease download failed — ${errMessage(err)} [forensics: frame=${frame.width}x${frame.height} fmt=${frame.format} hw=${frame.isHwFrame()} filterUses=${this.leaseDownloadFilterUses} filterAgeMs=${Date.now() - this.leaseDownloadFilterBuiltAt} dialAgeMs=${Date.now() - this.dialStartedAt} decoded=${this.framesDecoded}]\n`);
-			this.nativeLeaseDownloadFilter?.close();
+			this.native.run("nativeLeaseDownloadFilter", () => this.nativeLeaseDownloadFilter?.close());
 			this.nativeLeaseDownloadFilter = null;
 			this.nativeLeaseDownloadFilterKey = "";
 			this.leaseDownloadFailuresThisDial++;
@@ -3098,7 +3435,7 @@ var DecodeWorkerChild = class {
 			this.leaseDownloadFilterUses++;
 			return cached;
 		}
-		this.nativeLeaseDownloadFilter?.close();
+		this.native.run("nativeLeaseDownloadFilter", () => this.nativeLeaseDownloadFilter?.close());
 		this.nativeLeaseDownloadFilter = null;
 		this.nativeLeaseDownloadFilterKey = "";
 		const description = buildLeaseDownloadDescription(scaleFilter, color);
@@ -3207,14 +3544,14 @@ var DecodeWorkerChild = class {
 		const key = nativeCropScalerKey(srcW, srcH, dstW, dstH, srcFormat);
 		const cached = this.nativeCropScaler;
 		if (cached && key === this.nativeCropScalerKey) return cached;
-		this.nativeCropScaler?.[Symbol.dispose]?.();
+		this.native.run("nativeCropScaler", () => this.nativeCropScaler?.[Symbol.dispose]?.());
 		this.nativeCropScaler = null;
 		this.nativeCropScalerKey = "";
 		const scaler = new nav.SoftwareScaleContext();
 		scaler.getContext(srcW, srcH, srcFmt, dstW, dstH, C.AV_PIX_FMT_RGB24, C.SWS_FAST_BILINEAR);
 		const initRet = scaler.initContext();
 		if (initRet < 0) {
-			scaler[Symbol.dispose]?.();
+			this.native.run("nativeCropScaler", () => scaler[Symbol.dispose]?.());
 			throw new Error(`native crop sws_init_context failed: ${initRet}`);
 		}
 		this.nativeCropScaler = scaler;
@@ -3229,7 +3566,7 @@ var DecodeWorkerChild = class {
 		const key = `${region.left},${region.top},${region.width},${region.height}->${target.width}x${target.height}:${sourceColorKey(color)}`;
 		const cached = this.nativeCropHwFilter;
 		if (cached && key === this.nativeCropHwFilterKey) return cached;
-		this.nativeCropHwFilter?.close();
+		this.native.run("nativeCropHwFilter", () => this.nativeCropHwFilter?.close());
 		this.nativeCropHwFilter = null;
 		this.nativeCropHwFilterKey = "";
 		const description = buildGpuFilterDescription(scaleFilter, region, target, false, "rgb24", color);
@@ -3242,8 +3579,7 @@ var DecodeWorkerChild = class {
 		return filter;
 	}
 	handleStop() {
-		this.teardown();
-		process.exit(0);
+		this.requestExit(0);
 	}
 	async runDecodeLoop(url) {
 		const nav = await getNodeAv();
@@ -3262,7 +3598,15 @@ var DecodeWorkerChild = class {
 				if (this.stopped) break;
 				this.emitStderr(`decode-worker-child: dial ended — re-dial scheduled: ${errMessage(err)}\n`);
 			} finally {
-				this.closeInput();
+				const close = inputCloseAfterLoop({
+					draining: this.draining,
+					exiting: this.exiting
+				});
+				if (close === "all") this.closeInput();
+				else if (close === "demuxer-only") {
+					this.native.run("demuxer", () => this.demuxer?.[Symbol.dispose]?.());
+					this.demuxer = null;
+				}
 			}
 			if (this.stopped) break;
 			const skipBackoff = this.redialAsSoftware;
@@ -3306,7 +3650,7 @@ var DecodeWorkerChild = class {
 		});
 		const demuxer = opened.demuxer;
 		if (this.stopped) {
-			demuxer[Symbol.dispose]?.();
+			this.native.run("demuxer", () => demuxer[Symbol.dispose]?.());
 			return;
 		}
 		this.demuxer = demuxer;
@@ -3322,13 +3666,19 @@ var DecodeWorkerChild = class {
 		});
 		const decoderCreateMs = Date.now() - decoderStartedAt;
 		if (this.stopped) {
-			decoder[Symbol.dispose]?.();
+			this.native.run("decoder", () => decoder[Symbol.dispose]?.());
 			return;
 		}
 		this.decoder = decoder;
 		const decodeStartedAt = Date.now();
 		for await (const frame of decoder.frames(demuxer.packets(videoStream.index))) {
-			if (this.stopped) break;
+			if (this.stopped) {
+				releaseFrameAfterStop(frame, {
+					draining: this.draining,
+					exiting: this.exiting
+				});
+				break;
+			}
 			if (!frame) continue;
 			this.reportDialTiming({
 				hwContextMs: this.hwContextMs,
@@ -3458,16 +3808,19 @@ var DecodeWorkerChild = class {
 			});
 			if (this.preRollMs > 0 && this.preRollMaxFrames > 0) {
 				const preRollCadenceMs = this.minIntervalMs > 0 ? this.minIntervalMs : 1e3;
+				const withinHold = planPreRollWithinHold({
+					requestedFrames: this.preRollMaxFrames,
+					cadenceMs: preRollCadenceMs,
+					holdFrames: this.lease?.values.holdFrames ?? UNSTARTED_LEASE_KNOBS.values.holdFrames,
+					holdEnabled: this.leaseStore.enabled
+				});
+				this.preRollBudgetFrames = withinHold.budgetFrames;
 				this.preRollBurst = new PreRollBurst({
 					budget: {
-						maxFrames: this.preRollMaxFrames,
+						maxFrames: withinHold.budgetFrames,
 						maxWallMs: PRE_ROLL_BURST_MAX_WALL_MS
 					},
-					plan: planPreRollBurst({
-						spanMs: this.preRollMaxFrames * preRollCadenceMs,
-						detectionFps: 1e3 / preRollCadenceMs,
-						maxFrames: this.preRollMaxFrames
-					}),
+					plan: withinHold.plan,
 					startedAtWall: now
 				});
 			}
@@ -3528,12 +3881,27 @@ var DecodeWorkerChild = class {
 			droppedByReason: report.droppedByReason,
 			strideMs: report.strideMs,
 			subsampled: report.subsampled,
-			spanMs: first !== null && last !== null ? Math.round(last - first) : 0
+			spanMs: first !== null && last !== null ? Math.round(last - first) : 0,
+			budgetFrames: this.preRollBudgetFrames
+		});
+		const settled = this.preRollSettle.endBurst();
+		if (settled) this.send({
+			kind: "preRollSettled",
+			...settled
+		});
+	}
+	/** One pre-roll frame's fate; sends the settle summary when it was the last owed. */
+	settlePreRoll(frameId, outcome) {
+		const settled = this.preRollSettle.settle(frameId, outcome);
+		if (settled) this.send({
+			kind: "preRollSettled",
+			...settled
 		});
 	}
 	/** Send a `frame` reply to the parent and count it toward `deliveredFps`. */
 	deliverFrame(reply) {
 		this.framesDelivered++;
+		if (reply.preRoll) this.preRollSettle.admit(reply.frameId);
 		this.send(this.toFrameReply(reply));
 	}
 	/**
@@ -3563,7 +3931,7 @@ var DecodeWorkerChild = class {
 			this.emitStderr(`decode-worker-child: GPU filter probe failed — using software decode: ${errMessage(err)}\n`);
 			return false;
 		} finally {
-			filter?.close();
+			this.native.run("hwFilterProbe", () => filter?.close());
 		}
 	}
 	/**
@@ -3578,7 +3946,7 @@ var DecodeWorkerChild = class {
 		if (this.hwFilterDecision === "software") return;
 		this.hwFilterDecision = "software";
 		this.redialAsSoftware = true;
-		this.hwFilter?.close();
+		this.native.run("hwFilter", () => this.hwFilter?.close());
 		this.hwFilter = null;
 		this.hwFilterKey = "";
 		this.abortController?.abort();
@@ -3652,14 +4020,14 @@ var DecodeWorkerChild = class {
 		const key = `${srcKind}:${srcW}x${srcH}->${dstW}x${dstH}:${dstFmt}`;
 		const cached = this.scaler;
 		if (cached && key === this.scalerKey) return cached;
-		this.scaler?.[Symbol.dispose]?.();
+		this.native.run("scaler", () => this.scaler?.[Symbol.dispose]?.());
 		this.scaler = null;
 		this.scalerKey = "";
 		const scaler = new nav.SoftwareScaleContext();
 		scaler.getContext(srcW, srcH, navPixelFormatFor(srcKind, C), dstW, dstH, dstFmt, C.SWS_FAST_BILINEAR);
 		const initRet = scaler.initContext();
 		if (initRet < 0) {
-			scaler[Symbol.dispose]?.();
+			this.native.run("scaler", () => scaler[Symbol.dispose]?.());
 			throw new Error(`sws_init_context failed: ${initRet}`);
 		}
 		this.scaler = scaler;
@@ -3717,7 +4085,7 @@ var DecodeWorkerChild = class {
 		const key = `${region.left},${region.top},${region.width},${region.height}->${target.width}x${target.height}:${pixel}:${sourceColorKey(color)}`;
 		const cached = this.hwFilter;
 		if (cached && key === this.hwFilterKey) return cached;
-		this.hwFilter?.close();
+		this.native.run("hwFilter", () => this.hwFilter?.close());
 		this.hwFilter = null;
 		this.hwFilterKey = "";
 		const description = buildGpuFilterDescription(scaleFilter, region, target, fullFrame, pixel, color);
@@ -3772,25 +4140,30 @@ var DecodeWorkerChild = class {
 	* the next dial's first `toBuffer`.
 	*/
 	closeInput() {
-		this.nativeRing.clear();
-		this.leaseStore.clear();
+		this.native.run("nativeRing", () => this.nativeRing.clear());
+		this.native.run("leaseStore", () => this.leaseStore.clear());
+		const cleared = this.preRollSettle.settleAll("cleared");
+		if (cleared) this.send({
+			kind: "preRollSettled",
+			...cleared
+		});
 		this.tileStore.clear();
 		this.sceneStore.clear();
 		this.pendingCuts.clear();
 		this.tileFrameWidth = 0;
 		this.tileFrameHeight = 0;
-		this.nativeLeaseDownloadFilter?.close();
+		this.native.run("nativeLeaseDownloadFilter", () => this.nativeLeaseDownloadFilter?.close());
 		this.nativeLeaseDownloadFilter = null;
 		this.nativeLeaseDownloadFilterKey = "";
-		this.nativeCropHwFilter?.close();
+		this.native.run("nativeCropHwFilter", () => this.nativeCropHwFilter?.close());
 		this.nativeCropHwFilter = null;
 		this.nativeCropHwFilterKey = "";
-		this.hwFilter?.close();
+		this.native.run("hwFilter", () => this.hwFilter?.close());
 		this.hwFilter = null;
 		this.hwFilterKey = "";
-		this.decoder?.[Symbol.dispose]?.();
+		this.native.run("decoder", () => this.decoder?.[Symbol.dispose]?.());
 		this.decoder = null;
-		this.demuxer?.[Symbol.dispose]?.();
+		this.native.run("demuxer", () => this.demuxer?.[Symbol.dispose]?.());
 		this.demuxer = null;
 	}
 	/**
@@ -3823,7 +4196,13 @@ var DecodeWorkerChild = class {
 		}
 	}
 	send(reply) {
-		process.send?.(reply);
+		if (!process.send) return;
+		const done = this.outbound.begin();
+		try {
+			process.send(reply, void 0, void 0, () => done());
+		} catch {
+			done();
+		}
 	}
 	/**
 	* The `User-Agent` this worker's RTSP dial carries — its identity inside the
@@ -3872,7 +4251,20 @@ var DecodeWorkerChild = class {
 		});
 	}
 };
-var worker = new DecodeWorkerChild();
+//#endregion
+//#region src/session-decode/decode-worker-main.ts
+/**
+* Decode-worker — the process ENTRY (its own vite build entry, the path
+* `fork-decode-worker.ts` forks). The worker itself is `DecodeWorkerChild` in
+* `decode-worker-child.ts`; this file only instantiates it and wires the process:
+* IPC messages, the native preload, the sharp warn sink, and the ONE bounded
+* exit every ending goes through (D652).
+*
+* ‼ SANCTIONED RAW IPC ‼ — `process.on('message')` / `process.send` are the
+* correct mechanism for this private, directly-forked worker only; see the
+* note at the top of `decode-worker-child.ts`.
+*/
+var worker = new DecodeWorkerChild({ requestExit: (code) => exitWorker(code) });
 require_lazy_sharp.setSharpWarnSink((message) => {
 	worker.emitStderr(`decode-worker-child: ${message}\n`, "warn");
 });
@@ -3880,17 +4272,34 @@ process.on("message", (message) => {
 	worker.handleMessage(message);
 });
 worker.warm();
-process.on("disconnect", () => {
-	worker.teardown();
-	process.exit(0);
+/**
+* The ONE way this worker exits: quiesce (the disposer starts refusing, so
+* nothing native is freed under a live read), queue the last lines, wait —
+* bounded — for them to leave, exit. `stop`, SIGTERM (the parent's `kill()`),
+* a lost channel and an uncaught error all land here, and a step that throws
+* still exits (with code 1). Before D652 there was no SIGTERM handler and a
+* `kill()` ended the process with those lines still queued.
+*/
+var exitWorker = createWorkerExit({
+	sends: worker.outbound,
+	steps: {
+		quiesce: () => worker.quiesceForExit(),
+		flushFinalLines: () => worker.flushFinalLines()
+	},
+	exit: (code) => process.exit(code)
 });
-process.on("uncaughtException", (err) => {
-	worker.emitStderr(`decode-worker-child: uncaught exception — ${errMessage(err)}\n`);
-	worker.teardown();
-	process.exit(1);
+wireWorkerExit({
+	on: (event, listener) => {
+		if (event === "SIGTERM") process.on("SIGTERM", () => listener(void 0));
+		else if (event === "disconnect") process.on("disconnect", () => listener(void 0));
+		else process.on("uncaughtException", (err) => listener(err));
+	},
+	exitWorker,
+	reportUncaught: (err) => {
+		worker.emitStderr(`decode-worker-child: uncaught exception — ${errMessage(err)}\n`);
+	}
 });
 process.on("unhandledRejection", (reason) => {
 	worker.emitStderr(`decode-worker-child: unhandled rejection — ${errMessage(reason)}\n`);
 });
 //#endregion
-exports.DecodeWorkerChild = DecodeWorkerChild;