@camstack/addon-pipeline 1.2.317 → 1.2.320

package/dist/{process-memory-DE0M2AiK.mjs → process-memory-Cn3QEo37.mjs}

@@ -1,4 +1,4 @@
-import { jt as parseProcStatus } from "./dist-3isAnyIX.mjs";
+import { jt as parseProcStatus } from "./dist-BK-pWZzI.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-DAGs0yZp.js → process-memory-DR7jI54j.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-emK7D4bc.js");
-const require_dist = require("./dist-DXU3Fu7j.js");
+const require_dist = require("./dist-Bce5_ocm.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DXU3Fu7j.js");
-const require_node = require("../node-DEpHS48Q.js");
+const require_dist = require("../dist-Bce5_ocm.js");
+const require_node = require("../node-UJwLVGTT.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $t as stripRetiredBandPreBufferSec, An as sleep$1, B as VISIT_MERGE_GAP_MS, Bn as record, Bt as recordingExportCapability, C as ExportRecordSchema, Dt as migrateLegacyDeviceSignalConfig, En as nodePin, Et as memoizePinnedFfmpeg, F as RECORDING_SOURCE_CAMSTACK_ADDON, Gt as resolveLocationMode, I as RecordingConfigSchema, K as batteryCapability, L as RecordingSignalStatusSchema, Ln as number, Mn as array, N as RECORDING_EXPORT_MAX_READ_BYTES, Nn as boolean, Ot as modeMayWrite, P as RECORDING_SOURCE_CAMSTACK, Rn as object, Rt as recordingArchiveCapability, Sn as hydrateSchema, Tt as mayWriteToLocation, Un as EventCategory, Ut as resolveCreateExportSubject, Vn as string, Vt as recordingSignalCapability, X as clipExportFailureOf, Xt as storageEvictableCapability, Y as clipExportFailure, Zt as storageOccupancyCapability, _ as DEFAULT_EVENTS_BAND_BUFFER_SEC, b as EVENT_OWNER_TYPES, bn as defineCustomActions, bt as loadContributionCapability, dn as DeviceType, dt as exportSubjectOf, fn as errMsg$1, jn as _enum, k as OpsLogEntrySchema, kn as selectAssignedProfileSlots, lt as evictionPolicyForMode, mn as BaseAddon, mt as gbToBytes, o as BatteryStatusSchema, qt as resolveRecordingProfiles, rt as deriveRecordingMode, s as CLIP_BROKER_PACED_RATES, sn as evaluateSensorEdge, tn as videoclipsCapability, tt as deriveBatteryPresence, un as DeviceFeature, ut as evictionPolicyOfLocation, wt as mayReadLocation, x as EVENT_PAD_MS, yn as customAction, yt as isFirstLevelMacroClass, z as VIDEOCLIPS_MAX_OFFER_BYTES, zn as preprocess, zt as recordingCapability } from "../dist-3isAnyIX.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-PY3N7_ym.mjs";
+import { $t as stripRetiredBandPreBufferSec, An as sleep$1, B as VISIT_MERGE_GAP_MS, Bn as record, Bt as recordingExportCapability, C as ExportRecordSchema, Dt as migrateLegacyDeviceSignalConfig, En as nodePin, Et as memoizePinnedFfmpeg, F as RECORDING_SOURCE_CAMSTACK_ADDON, Gt as resolveLocationMode, I as RecordingConfigSchema, K as batteryCapability, L as RecordingSignalStatusSchema, Ln as number, Mn as array, N as RECORDING_EXPORT_MAX_READ_BYTES, Nn as boolean, Ot as modeMayWrite, P as RECORDING_SOURCE_CAMSTACK, Rn as object, Rt as recordingArchiveCapability, Sn as hydrateSchema, Tt as mayWriteToLocation, Un as EventCategory, Ut as resolveCreateExportSubject, Vn as string, Vt as recordingSignalCapability, X as clipExportFailureOf, Xt as storageEvictableCapability, Y as clipExportFailure, Zt as storageOccupancyCapability, _ as DEFAULT_EVENTS_BAND_BUFFER_SEC, b as EVENT_OWNER_TYPES, bn as defineCustomActions, bt as loadContributionCapability, dn as DeviceType, dt as exportSubjectOf, fn as errMsg$1, jn as _enum, k as OpsLogEntrySchema, kn as selectAssignedProfileSlots, lt as evictionPolicyForMode, mn as BaseAddon, mt as gbToBytes, o as BatteryStatusSchema, qt as resolveRecordingProfiles, rt as deriveRecordingMode, s as CLIP_BROKER_PACED_RATES, sn as evaluateSensorEdge, tn as videoclipsCapability, tt as deriveBatteryPresence, un as DeviceFeature, ut as evictionPolicyOfLocation, wt as mayReadLocation, x as EVENT_PAD_MS, yn as customAction, yt as isFirstLevelMacroClass, z as VIDEOCLIPS_MAX_OFFER_BYTES, zn as preprocess, zt as recordingCapability } from "../dist-BK-pWZzI.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-DQsiK6Vt.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { d as PREBUFFER_MAX_MS, l as withRecordingIntent, r as RECORDING_PRE_ROLL_REQUEST_MS } from "../restream-intent-DyGmLAU9.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";

package/dist/{segment-demux-js-k3D5kt3W.mjs → segment-demux-js-CTMbCGRL.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { fn as errMsg } from "./dist-3isAnyIX.mjs";
+import { fn as errMsg } from "./dist-BK-pWZzI.mjs";
 import { spawn } from "node:child_process";
 //#region src/stream-broker/recorded/avcc-annexb.ts
 /**

package/dist/{segment-demux-js-BZhn3qOl.js → segment-demux-js-CbazlBOP.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-emK7D4bc.js");
-const require_dist = require("./dist-DXU3Fu7j.js");
+const require_dist = require("./dist-Bce5_ocm.js");
 let node_child_process = require("node:child_process");
 //#region src/stream-broker/recorded/avcc-annexb.ts
 /**

package/dist/session-decode/decode-worker-main.js

@@ -512,9 +512,15 @@ var FrameSlot = class {
 *   native-quality media before any crop request has been seen;
 * - `arm()` on every native-crop request — post-analysis snapshot crops and
 *   the detail plane re-arm it continuously while tracks are active;
+* - `arm()` on every `markInferred` — the runner admitted the frame to
+*   detection and will lazy-`toBuffer` it after the next pull supersedes the
+*   reserved slot; without this, a quiet always-on camera closed the gate
+*   after `activityMs` and every marked supersede was freed
+*   (`toBuffer miss — released`);
 * - after `windowMs` without demand it closes and per-frame downloads stop
-*   (a later crop request simply misses once — the caller's designed
-*   detection-frame-crop fallback — and re-arms the gate for the retry).
+*   for UNMARKED frames (a later crop request simply misses once — the
+*   caller's designed detection-frame-crop fallback — and re-arms the gate
+*   for the retry). A marked frame still captures when the gate is cold.
 *
 * `windowMs: 0` disables gating entirely (always active — the legacy eager
 * behaviour).
@@ -642,6 +648,14 @@ var LeaseAdmissionLedger = class {
 	isMarked(frameId) {
 		return this.marked.has(frameId);
 	}
+	/**
+	* Same keep rule as {@link admit}, without counting. Used to park a
+	* just-superseded frame for a late mark without burning an offered/declined
+	* sample that a later promote would double-count.
+	*/
+	wouldAdmit(frameId) {
+		return this.mode === "all" || this.marked.has(frameId);
+	}
 	/** The runner admitted `frameId` to its detection queue. */
 	mark(frameId) {
 		this.markedTotal++;
@@ -680,6 +694,103 @@ var LeaseAdmissionLedger = class {
 	}
 };
 //#endregion
+//#region src/session-decode/pending-mark-hold.ts
+/**
+* One-frame grace for a late `markInferred` IPC.
+*
+* Admission for delivered frame N is decided when pull N+1 supersedes it
+* (`FrameSlot.reserveSlot` → `retainSuperseded`). The contract says the runner
+* sends `markInferred(N)` before that pull, and IPC order usually keeps it.
+* When the mark lands AFTER the supersede, today's path has already freed N:
+* a later lazy detection `toBuffer(N)` misses with `marked=true leaseFrames=0`
+* — the reserved-slot one-frame margin only covers the NEWEST id, not an id
+* already handed to retention and declined.
+*
+* This hold parks the just-superseded frame WITHOUT downloading it (no GPU→RAM
+* burn for a frame that may never be marked). A matching mark takes it for
+* lease capture; the next supersede (or `clear`) discards it. At most one
+* frame per worker.
+*/
+var PendingMarkHold = class {
+	held = null;
+	/** Id currently parked, or `null`. */
+	get frameId() {
+		return this.held?.frameId ?? null;
+	}
+	/** 0 or 1 — exposed for metrics / tests. */
+	get size() {
+		return this.held ? 1 : 0;
+	}
+	/**
+	* Park `frame` awaiting a possible late mark. Frees any previous pending
+	* (that id lost the mark race). Takes ownership of `frame`.
+	*/
+	park(frameId, frame) {
+		this.discard();
+		this.held = {
+			frameId,
+			frame
+		};
+	}
+	/** Peek without taking — lazy `toBuffer` while still pending. */
+	get(frameId) {
+		if (!this.held || this.held.frameId !== frameId) return null;
+		return this.held.frame;
+	}
+	/** Take ownership if `frameId` matches; otherwise leave pending alone. */
+	take(frameId) {
+		if (!this.held || this.held.frameId !== frameId) return null;
+		const frame = this.held.frame;
+		this.held = null;
+		return frame;
+	}
+	/** Free the pending frame if any. Returns whether something was freed. */
+	discard() {
+		if (!this.held) return false;
+		this.held.frame.free();
+		this.held = null;
+		return true;
+	}
+	/** Teardown alias. */
+	clear() {
+		this.discard();
+	}
+};
+/** Named refusal when the per-dial create cap is hit. */
+var LEASE_DOWNLOAD_REBUILD_CAP_REASON = "lease-download-rebuild-cap";
+/**
+* Counts lease-download filter creates for one dial and refuses past the bound.
+* Reset on every fresh dial (alongside {@link LeaseActivityGate.reset}).
+*/
+var LeaseDownloadRebuildCap = class {
+	maxCreatesPerDial;
+	creates = 0;
+	constructor(maxCreatesPerDial = 2) {
+		this.maxCreatesPerDial = maxCreatesPerDial;
+	}
+	/** Metric: how many `FilterAPI.create` calls this dial has already paid. */
+	get createsThisDial() {
+		return this.creates;
+	}
+	/** Whether another create is still inside the dial bound. */
+	canCreate() {
+		return this.creates < this.maxCreatesPerDial;
+	}
+	/**
+	* Record a create that is about to happen. Throws
+	* {@link LEASE_DOWNLOAD_REBUILD_CAP_REASON} if the dial is already at the cap
+	* — the caller must not call `FilterAPI.create` after that.
+	*/
+	recordCreate() {
+		if (this.creates >= this.maxCreatesPerDial) throw new Error(LEASE_DOWNLOAD_REBUILD_CAP_REASON);
+		this.creates++;
+	}
+	/** Fresh dial: the create budget starts over with a new `hw_frames_ctx`. */
+	resetForDial() {
+		this.creates = 0;
+	}
+};
+//#endregion
 //#region src/session-decode/media-clock.ts
 /**
 * Convert a container pts to milliseconds.
@@ -2618,6 +2729,13 @@ var DecodeWorkerChild = class {
 	*/
 	admission = new LeaseAdmissionLedger({ mode: UNSTARTED_LEASE_KNOBS.values.admission });
 	/**
+	* One-frame park for a late `markInferred` after supersede. Holds the native
+	* surface WITHOUT downloading until the mark arrives or the next supersede
+	* discards it — closes `toBuffer miss — released` with `marked=true` when
+	* the mark IPC loses the race with pull N+1. See `pending-mark-hold.ts`.
+	*/
+	pendingMark = new PendingMarkHold();
+	/**
 	* The knobs this session runs under — `null` until `start` hands them over.
 	* The stores above are REBUILT from them at that moment (they are empty then:
 	* nothing is captured before a dial), and never again: a knob that changes
@@ -2638,6 +2756,12 @@ var DecodeWorkerChild = class {
 	/** Root-cause instrumentation for the sporadic EIO/EINVAL add-frame failures (task: lease-filter EIO). */
 	leaseDownloadFilterUses = 0;
 	leaseDownloadFilterBuiltAt = 0;
+	/**
+	* Per-dial create budget for the lease-download filtergraph (S1 / N100 OOM
+	* unit). Metric {@link LeaseDownloadRebuildCap.createsThisDial} is emitted as
+	* `leaseDownloadFilterCreates` on the forensics + metrics lines.
+	*/
+	leaseDownloadRebuildCap = new LeaseDownloadRebuildCap();
 	dialStartedAt = 0;
 	/**
 	* `HardwareContext.create` cost, measured once per worker.
@@ -2660,9 +2784,9 @@ var DecodeWorkerChild = class {
 	* successful uses — the decoder re-creates its hw_frames_ctx shortly after
 	* dial start (post-probe pool re-init), stranding the just-built filter on
 	* the old pool. One rebuild per dial recovers that case (the ctx has
-	* settled by the next capture); a SECOND failure disables the lease for
-	* the dial (bounded: max 2 filtergraphs/dial — never the per-frame rebuild
-	* that OOM'd the N100).
+	* settled by the next capture); a SECOND failure starts the cooldown, and
+	* {@link leaseDownloadRebuildCap} refuses a third `FilterAPI.create` for
+	* the dial (the OOM unit — never the per-frame rebuild that OOM'd the N100).
 	*/
 	leaseDownloadFailuresThisDial = 0;
 	/** Throttled native-crop hit/miss counters, emitted with the throughput line. */
@@ -2830,6 +2954,8 @@ var DecodeWorkerChild = class {
 				return;
 			case "markInferred":
 				this.admission.mark(message.frameId);
+				this.leaseGate.arm();
+				this.promotePendingMark(message.frameId);
 				return;
 			case "drain":
 				this.handleDrain();
@@ -2949,7 +3075,7 @@ var DecodeWorkerChild = class {
 		const skipped = this.framesSkipped + this.frames.droppedCount;
 		const rssMb = Math.round(process.memoryUsage().rss / 1048576);
 		const ageS = Math.round((now - this.startedAt) / 1e3);
-		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, leaseOffered:${this.admission.offered}, leaseAdmitted:${this.admission.admitted}, leaseMarks:${this.admission.marks}, leaseUnmarkedCrops:${this.admission.unmarkedCrops}, leaseAdmission:${this.lease?.values.admission ?? "unstarted"}, leaseMb:${Math.round(this.leaseStore.totalBytes / 1048576)}, leaseFrames:${this.leaseStore.size}, holdOverflow:${this.leaseStore.overflowCount}, leaseReleased:${this.leaseReleased}, leaseReleaseMisses:${this.leaseReleaseMisses}, leaseReleasedEarly:${this.leaseReleasedEarly}, tilesCut:${this.tilesCut}, tileHits:${this.tileHits}, tileMisses:${this.tileMisses}, tileCutFailures:${this.tileCutFailures}, tileMissesResolvedByWait:${this.tileMissesResolvedByWait}, tileWaitTimeouts:${this.tileWaitTimeouts}, cutLatencyMsP50:${formatLatency(this.pendingCuts.latencyMs(50))}, cutLatencyMsP95:${formatLatency(this.pendingCuts.latencyMs(95))}, cutsInFlight:${this.pendingCuts.inFlight}, tileMb:${Math.round(this.tileStore.totalBytes / 1048576)}, tileFrames:${this.tileStore.frameCount}, scenesCut:${this.scenesCut}, sceneHits:${this.sceneHits}, sceneRefused:${this.sceneRefused}, sceneUnclassified:${this.sceneUnclassified}, sceneEvicted:${this.sceneStore.evictedCount}, sceneMb:${Math.round(this.sceneStore.totalBytes / 1048576)}, sceneFrames:${this.sceneStore.frameCount}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
+		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, leaseOffered:${this.admission.offered}, leaseAdmitted:${this.admission.admitted}, leaseDownloadFilterCreates:${this.leaseDownloadRebuildCap.createsThisDial}, leaseMarks:${this.admission.marks}, leaseUnmarkedCrops:${this.admission.unmarkedCrops}, leaseAdmission:${this.lease?.values.admission ?? "unstarted"}, leaseMb:${Math.round(this.leaseStore.totalBytes / 1048576)}, leaseFrames:${this.leaseStore.size}, holdOverflow:${this.leaseStore.overflowCount}, leaseReleased:${this.leaseReleased}, leaseReleaseMisses:${this.leaseReleaseMisses}, leaseReleasedEarly:${this.leaseReleasedEarly}, tilesCut:${this.tilesCut}, tileHits:${this.tileHits}, tileMisses:${this.tileMisses}, tileCutFailures:${this.tileCutFailures}, tileMissesResolvedByWait:${this.tileMissesResolvedByWait}, tileWaitTimeouts:${this.tileWaitTimeouts}, cutLatencyMsP50:${formatLatency(this.pendingCuts.latencyMs(50))}, cutLatencyMsP95:${formatLatency(this.pendingCuts.latencyMs(95))}, cutsInFlight:${this.pendingCuts.inFlight}, tileMb:${Math.round(this.tileStore.totalBytes / 1048576)}, tileFrames:${this.tileStore.frameCount}, scenesCut:${this.scenesCut}, sceneHits:${this.sceneHits}, sceneRefused:${this.sceneRefused}, sceneUnclassified:${this.sceneUnclassified}, sceneEvicted:${this.sceneStore.evictedCount}, sceneMb:${Math.round(this.sceneStore.totalBytes / 1048576)}, sceneFrames:${this.sceneStore.frameCount}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
 		this.lastMetricsAt = now;
 		this.lastDeliveredSnapshot = this.framesDelivered;
 		if (!this.warnedLarge && rssMb >= WORKER_RSS_WARN_MB) {
@@ -2970,6 +3096,7 @@ var DecodeWorkerChild = class {
 		this.sceneStore = buildTileStore(lease.values.sceneBudgetMb);
 		this.leaseGate = new LeaseActivityGate(lease.values.activityMs);
 		this.admission = new LeaseAdmissionLedger({ mode: lease.values.admission });
+		this.pendingMark.clear();
 		this.emitStderr(`decode-worker-child: ${require_worker_protocol.formatNativeLeaseKnobs(lease)}\n`, "info");
 		this.sessionFormat = opts.format ?? "rgb";
 		this.minIntervalMs = opts.fps && opts.fps > 0 ? 1e3 / opts.fps : 0;
@@ -3018,7 +3145,7 @@ var DecodeWorkerChild = class {
 		}
 	}
 	async handleToBuffer(frameId, opts) {
-		const frame = this.leaseStore.get(frameId)?.frame ?? this.frames.toBuffer(frameId);
+		const frame = this.leaseStore.get(frameId)?.frame ?? this.pendingMark.get(frameId) ?? this.frames.toBuffer(frameId);
 		this.settlePreRoll(frameId, frame ? "read" : "miss");
 		if (!frame) {
 			this.sendError(describeToBufferMiss({
@@ -3164,9 +3291,9 @@ var DecodeWorkerChild = class {
 		if (this.tileStore.get(frameId).length === 0 && this.sceneStore.get(frameId).length === 0) return `frame ${frameId} released and no retained tile for this frame`;
 		return `frame ${frameId} released and no retained subject or scene tile contains the requested rectangle`;
 	}
-	/** The GPU-ring or reserved-slot frame for `frameId` (hold-disabled / newest paths). */
+	/** The GPU-ring, pending-mark, or reserved-slot frame for `frameId`. */
 	resolveRetainedFrame(frameId) {
-		return this.nativeRing.get(frameId) ?? this.frames.toBuffer(frameId);
+		return this.nativeRing.get(frameId) ?? this.pendingMark.get(frameId) ?? this.frames.toBuffer(frameId);
 	}
 	/**
 	* The runner has this frame's detections. Cut one native TILE per subject and
@@ -3420,6 +3547,11 @@ var DecodeWorkerChild = class {
 	*      frames the runner MARKED as having reached inference in `inferred`
 	*      mode (`nativeLeaseAdmission`).
 	*
+	* When (2) or (3) would decline, the frame is PARKED in {@link pendingMark}
+	* for one supersede — a late `markInferred` can still promote it. The next
+	* supersede discards an unmarked pending. No GPU download until promote or
+	* lease, so quiet cameras still avoid the per-frame bandwidth burn.
+	*
 	* What reaches this function at all is the {@link FrameSlot} lifecycle, not a
 	* quality filter. `retainSuperseded` is called only from
 	* `FrameSlot.reserveSlot()` (`frame-slot.ts`), on the frame the PREVIOUS
@@ -3444,7 +3576,8 @@ var DecodeWorkerChild = class {
 	*
 	* The NEWEST delivered frame is never at risk either way: it is the slot's
 	* reserved frame and {@link handleNativeCrop} resolves it through
-	* `FrameSlot.toBuffer`, never through the lease.
+	* `FrameSlot.toBuffer`, never through the lease. A late mark for the PREVIOUS
+	* frame is the pending-mark hold's job — the reserved margin does not cover it.
 	*
 	* ## What it costs / saves
 	*
@@ -3460,17 +3593,57 @@ var DecodeWorkerChild = class {
 	*/
 	captureNativeFrame(frameId, frame) {
 		if (!this.leaseStore.enabled) {
+			this.flushPendingMark();
 			this.settlePreRoll(frameId, "released");
 			return this.nativeRing.retain(frameId, frame);
 		}
-		if (!this.leaseGate.active) {
+		if (!this.leaseGate.active && !this.admission.isMarked(frameId)) return this.parkPendingMark(frameId, frame);
+		if (!this.admission.wouldAdmit(frameId)) return this.parkPendingMark(frameId, frame);
+		this.flushPendingMark();
+		if (!this.admission.admit(frameId)) {
 			this.settlePreRoll(frameId, "released");
 			return false;
 		}
+		return this.leaseNativeFrame(frameId, frame);
+	}
+	/**
+	* Discard a pending mark that lost the race (never marked before the next
+	* supersede). Counts as an offered decline so metrics still see the delivery.
+	*/
+	flushPendingMark() {
+		const id = this.pendingMark.frameId;
+		if (id === null) return;
+		this.pendingMark.discard();
+		this.admission.admit(id);
+		this.settlePreRoll(id, "released");
+	}
+	/** Park a just-superseded frame awaiting a possible late `markInferred`. */
+	parkPendingMark(frameId, frame) {
+		this.flushPendingMark();
+		this.pendingMark.park(frameId, frame);
+		return true;
+	}
+	/**
+	* Promote a parked frame into the lease after a late mark. No-op when the
+	* pending id does not match (mark arrived in time and the frame was already
+	* leased, or a newer supersede already discarded it).
+	*/
+	promotePendingMark(frameId) {
+		const frame = this.pendingMark.take(frameId);
+		if (!frame) return;
 		if (!this.admission.admit(frameId)) {
+			frame.free();
 			this.settlePreRoll(frameId, "released");
-			return false;
+			return;
 		}
+		this.leaseNativeFrame(frameId, frame);
+	}
+	/**
+	* Download (if HW) and put into {@link leaseStore}. Consumes ownership of
+	* `frame` whether or not the download succeeds (returns `true` either way
+	* so the slot / pending hold never double-frees).
+	*/
+	leaseNativeFrame(frameId, frame) {
 		if (frame.isHwFrame()) {
 			const software = this.downloadToSoftware(frame);
 			frame.free();
@@ -3502,7 +3675,12 @@ var DecodeWorkerChild = class {
 			for (let i = 1; i < outputs.length; i++) outputs[i]?.free();
 			return first;
 		} catch (err) {
-			this.emitStderr(`decode-worker-child: native lease download failed — ${errMessage(err)} [forensics: frame=${frame.width}x${frame.height} fmt=${frame.format} hw=${frame.isHwFrame()} filterUses=${this.leaseDownloadFilterUses} filterAgeMs=${Date.now() - this.leaseDownloadFilterBuiltAt} dialAgeMs=${Date.now() - this.dialStartedAt} decoded=${this.framesDecoded}]\n`);
+			const reason = errMessage(err);
+			if (reason === "lease-download-rebuild-cap") {
+				this.emitStderr(`decode-worker-child: native lease download refused — ${LEASE_DOWNLOAD_REBUILD_CAP_REASON} [forensics: frame=${frame.width}x${frame.height} fmt=${frame.format} hw=${frame.isHwFrame()} filterUses=${this.leaseDownloadFilterUses} leaseDownloadFilterCreates=${this.leaseDownloadRebuildCap.createsThisDial} dialAgeMs=${Date.now() - this.dialStartedAt} decoded=${this.framesDecoded}]\n`);
+				return null;
+			}
+			this.emitStderr(`decode-worker-child: native lease download failed — ${reason} [forensics: frame=${frame.width}x${frame.height} fmt=${frame.format} hw=${frame.isHwFrame()} filterUses=${this.leaseDownloadFilterUses} filterAgeMs=${Date.now() - this.leaseDownloadFilterBuiltAt} leaseDownloadFilterCreates=${this.leaseDownloadRebuildCap.createsThisDial} dialAgeMs=${Date.now() - this.dialStartedAt} decoded=${this.framesDecoded}]\n`);
 			this.native.run("nativeLeaseDownloadFilter", () => this.nativeLeaseDownloadFilter?.close());
 			this.nativeLeaseDownloadFilter = null;
 			this.nativeLeaseDownloadFilterKey = "";
@@ -3531,6 +3709,7 @@ var DecodeWorkerChild = class {
 			this.leaseDownloadFilterUses++;
 			return cached;
 		}
+		this.leaseDownloadRebuildCap.recordCreate();
 		this.native.run("nativeLeaseDownloadFilter", () => this.nativeLeaseDownloadFilter?.close());
 		this.nativeLeaseDownloadFilter = null;
 		this.nativeLeaseDownloadFilterKey = "";
@@ -3735,6 +3914,7 @@ var DecodeWorkerChild = class {
 		this.dialStartedAt = Date.now();
 		this.dialSeq++;
 		this.leaseDownloadFailuresThisDial = 0;
+		this.leaseDownloadRebuildCap.resetForDial();
 		this.abortController = new AbortController();
 		const opened = await openPullDemuxer({
 			url,
@@ -4237,6 +4417,7 @@ var DecodeWorkerChild = class {
 	*/
 	closeInput() {
 		this.native.run("nativeRing", () => this.nativeRing.clear());
+		this.native.run("pendingMark", () => this.pendingMark.clear());
 		this.native.run("leaseStore", () => this.leaseStore.clear());
 		const cleared = this.preRollSettle.settleAll("cleared");
 		if (cleared) this.send({