@camstack/addon-pipeline 1.2.364 → 1.2.366

package/dist/stream-broker/index.mjs

@@ -1,10 +1,10 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
-import { $n as discriminatedUnion, An as BaseAddon, D as G711_SCALE_CORRECTION_DB, Dn as DeviceType, Dt as gifDeriveSpeed, En as DeviceFeature, Gn as maskUrlCredentials, Hn as isEvent, I as RATE_CONTROL_RELAXED, In as createEvent, J as addonWidgetsSourceCapability, Kn as nodePin, L as RATE_CONTROL_TIGHT, Mn as CamProfileSchema, Nt as loadContributionCapability, On as errMsg, Ot as gifFromMp4Args, Pt as logChannelsCapability, Qn as boolean, Rt as memoizePinnedFfmpeg, Sn as buildFfmpegArgs, Tn as isSoftwareDecode, Tt as ffmpegRate, Un as makeProfileBrokerId, W as RingBuffer, Wn as makeSourceBrokerId, Xn as _enum, Xt as rankStreams, Zn as array, _t as egressTranscodeSharingKey, ar as record, at as clipExportFailureOf, c as CLIP_STILL_REASON_CODE_HEADER, cr as EventCategory, ct as createHwAccelCache, et as batteryCapability, ft as deriveBatteryPresence, jn as CAM_PROFILE_ORDER, kn as BOOT_RECOVERY_BACKOFF_MS, lt as createLogChannelsProvider, mn as streamBrokerCapability, nr as number, o as BatteryStatusSchema, or as string, qn as parseProfileBrokerId, rn as resolveEgressDecodeHwAccel, rr as object, rt as cameraStreamsCapability, s as CLIP_BROKER_PACED_RATES, sr as union, tr as literal, ut as declareLogChannel, vn as webrtcSessionCapability, vt as egressTransportFromRequest, w as EncodeProfileSchema, wn as invocationFromEncodeProfile, yn as AUDIO_PRESETS, zn as expandAudioChunkToF32le } from "../dist-BX9VTm12.mjs";
-import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-C8bbmV3c.mjs";
+import { $n as discriminatedUnion, An as BaseAddon, D as G711_SCALE_CORRECTION_DB, Dn as DeviceType, Dt as gifDeriveSpeed, En as DeviceFeature, Gn as maskUrlCredentials, Hn as isEvent, I as RATE_CONTROL_RELAXED, In as createEvent, J as addonWidgetsSourceCapability, Kn as nodePin, L as RATE_CONTROL_TIGHT, Mn as CamProfileSchema, Nt as loadContributionCapability, On as errMsg, Ot as gifFromMp4Args, Pt as logChannelsCapability, Qn as boolean, Rt as memoizePinnedFfmpeg, Sn as buildFfmpegArgs, Tn as isSoftwareDecode, Tt as ffmpegRate, Un as makeProfileBrokerId, W as RingBuffer, Wn as makeSourceBrokerId, Xn as _enum, Xt as rankStreams, Zn as array, _t as egressTranscodeSharingKey, ar as record, at as clipExportFailureOf, c as CLIP_STILL_REASON_CODE_HEADER, cr as EventCategory, ct as createHwAccelCache, et as batteryCapability, ft as deriveBatteryPresence, jn as CAM_PROFILE_ORDER, kn as BOOT_RECOVERY_BACKOFF_MS, lt as createLogChannelsProvider, mn as streamBrokerCapability, nr as number, o as BatteryStatusSchema, or as string, qn as parseProfileBrokerId, rn as resolveEgressDecodeHwAccel, rr as object, rt as cameraStreamsCapability, s as CLIP_BROKER_PACED_RATES, sr as union, tr as literal, ut as declareLogChannel, vn as webrtcSessionCapability, vt as egressTransportFromRequest, w as EncodeProfileSchema, wn as invocationFromEncodeProfile, yn as AUDIO_PRESETS, zn as expandAudioChunkToF32le } from "../dist-BshC0NZR.mjs";
+import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-Dqmrb990.mjs";
 import { a as parseRestreamPath, d as PREBUFFER_MAX_MS, f as capPreRollRequestMs, i as isLiveEdgeOnlyDial, m as resolvePrebuffer, n as NO_DECLARATION, p as prebufferRetentionMs, s as sdpVariantFor, u as withSentryIntent } from "../restream-intent-DyGmLAU9.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
-import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-BhnT__dA.mjs";
+import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-COoPqx93.mjs";
 import { createRequire } from "node:module";
 import * as os$1 from "node:os";
 import { networkInterfaces, tmpdir } from "node:os";
@@ -3081,6 +3081,262 @@ var RtpPacketizer = class {
 	}
 };
 //#endregion
+//#region src/stream-broker/stream-broker/broker-mem-probe.ts
+/** Cadence of the `[broker-mem]` line — aligned with the runner's `[mem]`. */
+var BROKER_MEM_INTERVAL_MS = 5 * 6e4;
+var copiedPackets = 0;
+var copiedBytes = 0;
+/** O(1) per packet: called by `copyOwned`. No allocation. */
+function recordCopyOwned(bytes) {
+	copiedPackets += 1;
+	copiedBytes += bytes;
+}
+function readCopyOwnedTotals() {
+	return {
+		packets: copiedPackets,
+		bytes: copiedBytes
+	};
+}
+/** `RssAnon:` / `RssFile:` out of `/proc/self/status` text; null when absent. */
+function parseProcStatus(text) {
+	const anon = /^RssAnon:\s+(\d+)\s*kB/m.exec(text);
+	const file = /^RssFile:\s+(\d+)\s*kB/m.exec(text);
+	if (anon === null || file === null) return null;
+	return {
+		rssAnonKb: Number(anon[1]),
+		rssFileKb: Number(file[1])
+	};
+}
+/**
+* Summarise `/proc/self/maps`. Cheaper than `smaps_rollup`'s kernel page walk:
+* the file is one line per mapping and needs no per-page accounting. The
+* `[heap]` figure is the brk extent (virtual), which is the number glibc's
+* main arena grows when fragmented.
+*
+* Line shape: `start-end perms offset dev inode [path]` — an anonymous mapping
+* has no sixth field.
+*/
+function parseProcMaps(text) {
+	let heapBytes = 0;
+	let anonMappings = 0;
+	let anonBytes = 0;
+	let from = 0;
+	while (from < text.length) {
+		let to = text.indexOf("\n", from);
+		if (to === -1) to = text.length;
+		const line = text.slice(from, to);
+		from = to + 1;
+		const dash = line.indexOf("-");
+		const space = line.indexOf(" ");
+		if (dash <= 0 || space <= dash) continue;
+		const size = Number.parseInt(line.slice(dash + 1, space), 16) - Number.parseInt(line.slice(0, dash), 16);
+		if (!Number.isFinite(size)) continue;
+		const path = line.split(/\s+/, 6)[5];
+		if (path === void 0 || path === "") {
+			anonMappings += 1;
+			anonBytes += size;
+		} else if (path === "[heap]") heapBytes += size;
+	}
+	return {
+		heapBytes,
+		anonMappings,
+		anonBytes
+	};
+}
+/** Opened/closed consumers since the last reading; `drain()` resets. */
+var ConsumerChurn = class {
+	opened = 0;
+	closed = 0;
+	openedByKind = /* @__PURE__ */ new Map();
+	closedByKind = /* @__PURE__ */ new Map();
+	recordOpen(kind) {
+		this.opened += 1;
+		this.openedByKind.set(kind, (this.openedByKind.get(kind) ?? 0) + 1);
+	}
+	recordClose(kind) {
+		this.closed += 1;
+		this.closedByKind.set(kind, (this.closedByKind.get(kind) ?? 0) + 1);
+	}
+	drain() {
+		const reading = {
+			opened: this.opened,
+			closed: this.closed,
+			openedByKind: Object.fromEntries(this.openedByKind),
+			closedByKind: Object.fromEntries(this.closedByKind)
+		};
+		this.opened = 0;
+		this.closed = 0;
+		this.openedByKind = /* @__PURE__ */ new Map();
+		this.closedByKind = /* @__PURE__ */ new Map();
+		return reading;
+	}
+};
+/** The one churn counter of this process (the broker runner). */
+var consumerChurn = new ConsumerChurn();
+/**
+* Sliding-window limiter for the attach/detach lines. `admit(now)` answers
+* whether this line may be written; the number of lines swallowed since the
+* last admitted one is returned with it so the next line can say so (a branch
+* that drops work names it).
+*/
+function createLineLimiter(maxPerWindow, windowMs) {
+	let windowStart = 0;
+	let inWindow = 0;
+	let suppressed = 0;
+	return (now) => {
+		if (now - windowStart >= windowMs) {
+			windowStart = now;
+			inWindow = 0;
+		}
+		if (inWindow >= maxPerWindow) {
+			suppressed += 1;
+			return {
+				admit: false,
+				suppressedBefore: 0
+			};
+		}
+		inWindow += 1;
+		const suppressedBefore = suppressed;
+		suppressed = 0;
+		return {
+			admit: true,
+			suppressedBefore
+		};
+	};
+}
+var consumerLineLimiter = createLineLimiter(40, 6e4);
+/**
+* One consumer attached to / detached from a broker: counted always (the
+* `[broker-mem]` line reports opened/closed since the last line), written at
+* info under a rate limit so a step in RSS can be matched to an event. The
+* line after a suppressed burst says how many were swallowed.
+*/
+function reportConsumerEvent(logger, event, kind, deviceId, total, now = Date.now()) {
+	if (event === "attach") consumerChurn.recordOpen(kind);
+	else consumerChurn.recordClose(kind);
+	if (logger === void 0 || logger === null) return;
+	const verdict = consumerLineLimiter(now);
+	if (!verdict.admit) return;
+	const suppressed = verdict.suppressedBefore > 0 ? ` suppressedBefore=${verdict.suppressedBefore}` : "";
+	logger.info(`consumer ${event} kind=${kind} total=${total}${suppressed}`, { ...deviceId !== void 0 ? { tags: { deviceId } } : {} });
+}
+var MB = 1024 * 1024;
+function ringBytesOf(s) {
+	return s.preBufferBytes + s.clipBytes + s.rtpRingBytes + s.keyframeCacheBytes;
+}
+function mb(bytes) {
+	return (bytes / MB).toFixed(1);
+}
+function kindList(counts) {
+	const keys = Object.keys(counts).sort();
+	return keys.length === 0 ? "none" : keys.map((k) => `${k}:${counts[k]}`).join(",");
+}
+/** One greppable `key=value` line; no per-device breakdown beyond the top N. */
+function formatBrokerMem(input) {
+	const { samples, proc, churn, copied } = input;
+	const consumers = {};
+	let rtsp = 0;
+	let audio = 0;
+	let pipe = 0;
+	let ingesting = 0;
+	let planes = 0;
+	let pre = 0;
+	let clip = 0;
+	let rtp = 0;
+	let kf = 0;
+	let qSum = 0;
+	let qMax = 0;
+	for (const s of samples) {
+		if (s.ingesting) ingesting += 1;
+		if (s.annexBPlaneActive) planes += 1;
+		rtsp += s.rtspSessions;
+		audio += s.audioSubscribers;
+		pipe += s.pipeClients;
+		pre += s.preBufferBytes;
+		clip += s.clipBytes;
+		rtp += s.rtpRingBytes;
+		kf += s.keyframeCacheBytes;
+		qSum += s.writeQueueSumBytes;
+		if (s.writeQueueMaxBytes > qMax) qMax = s.writeQueueMaxBytes;
+		for (const [kind, n] of Object.entries(s.encodedByKind)) consumers[kind] = (consumers[kind] ?? 0) + n;
+	}
+	const top = [...samples].filter((s) => s.deviceId !== void 0).sort((a, b) => ringBytesOf(b) - ringBytesOf(a)).slice(0, 5).map((s) => `${s.deviceId}:${mb(ringBytesOf(s))}`).join(",");
+	const parts = ["[broker-mem]"];
+	if (proc.status !== null) parts.push(`rssAnonMb=${(proc.status.rssAnonKb / 1024).toFixed(0)}`, `rssFileMb=${(proc.status.rssFileKb / 1024).toFixed(0)}`);
+	if (proc.maps !== null) parts.push(`heapMapMb=${mb(proc.maps.heapBytes)}`, `anonMaps=${proc.maps.anonMappings}`, `anonMapsMb=${mb(proc.maps.anonBytes)}`);
+	parts.push(`brokers=${samples.length}`, `ingesting=${ingesting}`, `annexBPlanes=${planes}`, `rtsp=${rtsp}`, `webrtc=${input.webrtcSessions}`, `encoded=${kindList(consumers)}`, `audioSubs=${audio}`, `pipeClients=${pipe}`, `egress=${input.egressTranscodes}`, `children=${input.childProcesses}`, `opened=${churn.opened}`, `closed=${churn.closed}`, `openedKinds=${kindList(churn.openedByKind)}`, `closedKinds=${kindList(churn.closedByKind)}`, `preBufferMb=${mb(pre)}`, `clipMb=${mb(clip)}`, `rtpRingMb=${mb(rtp)}`, `keyframeMb=${mb(kf)}`, `writeQueueSumMb=${mb(qSum)}`, `writeQueueMaxMb=${mb(qMax)}`, `copiedPackets=${copied.packets}`, `copiedMb=${mb(copied.bytes)}`, `topRingMb=${top === "" ? "none" : top}`);
+	return parts.join(" ");
+}
+/** Count entries named `name` in `process.getActiveResourcesInfo()`. */
+function countActiveResources(resources, name) {
+	let n = 0;
+	for (const r of resources) if (r === name) n += 1;
+	return n;
+}
+//#endregion
+//#region src/stream-broker/stream-broker/owned-buffer.ts
+/**
+* Buffers that enter a LONG-LIVED ring own their backing store.
+*
+* Node serves `Buffer.from(...)`, `Buffer.allocUnsafe(n)` and `Buffer.concat`
+* below `Buffer.poolSize >>> 1` (4 KiB) as views of shared 8 KiB pool slabs.
+* That is the right choice for the ingest path — a start code, a 4-byte
+* interleave header, a 1.3 KB RTP packet that is fanned out and forgotten
+* within a tick — and the wrong one for anything RETAINED: a 600-byte NAL kept
+* for 60 s in a clip ring pins its whole slab, and with it every short-lived
+* packet that happened to be allocated beside it. On the hub that held
+* 550–980 MB of ArrayBuffers for ~150–250 MB of payload, and the full GCs the
+* pinned slabs caused ran every 0.2–0.5 s at 40–65 % of a core.
+*
+* The ring byte caps counted payload bytes, so they never saw it. Both rings
+* now pass every entry through {@link detachFromPool} on the way in and
+* account it with {@link backingStoreBytes}, so the cap measures what the
+* entry costs. Short-lived traffic stays pooled.
+*/
+/** True when `buf` is the whole of its ArrayBuffer — nothing else shares it. */
+function ownsBackingStore(buf) {
+	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length;
+}
+/**
+* What retaining `buf` really costs: its own length when it owns its
+* ArrayBuffer, the whole shared slab when it is a view of one.
+*/
+function backingStoreBytes(buf) {
+	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
+}
+/**
+* `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
+* buffer, never by its size: whether a large `allocUnsafe` is pooled is a Node
+* runtime detail), else a copy that does. One copy, never two: a buffer that is
+* already unpooled is returned as-is.
+*/
+function detachFromPool(buf) {
+	if (ownsBackingStore(buf)) return buf;
+	const owned = Buffer.allocUnsafeSlow(buf.length);
+	buf.copy(owned);
+	return owned;
+}
+/**
+* A copy of `src[start, end)` that OWNS its backing store — the shape a reader
+* hands out when the packet it cuts from its socket buffer is going to be
+* retained anyway.
+*
+* Every source video packet is: `captureRtpForPreBuffer` keeps it for the life
+* of a GOP, and the restreamer's keyframe cache keeps the keyframe ones. With
+* the readers cutting packets as `Buffer.from(subarray)` — a pooled view — the
+* ring then had to copy each one a second time to own it: two copies of every
+* packet on the ingest path (measured 15.1 + 14.8 MB/s on the hub's load).
+* Cutting the packet owned up front makes the ring's and the cache's
+* `detachFromPool` an identity, so the packet is copied once and shared by the
+* reader's fan-out, the ring, the cache and every session's write queue.
+*/
+function copyOwned(src, start, end) {
+	const owned = Buffer.allocUnsafeSlow(end - start);
+	src.copy(owned, 0, start, end);
+	recordCopyOwned(end - start);
+	return owned;
+}
+//#endregion
 //#region src/stream-broker/rtsp/sdp-builder.ts
 function buildSdp(options) {
 	const { codec, parameterSets, streamName } = options;
@@ -3690,6 +3946,26 @@ var RtspRestreamer = class {
 		for (const session of this.sessions.values()) if (session.isPrestreamIntent()) n += 1;
 		return n;
 	}
+	/**
+	* What this restreamer holds, for the `[broker-mem]` probe: live sessions,
+	* their socket write queues (sum and max) and the keyframe caches. One pass
+	* over the sessions, no allocation beyond the result.
+	*/
+	getMemProbe() {
+		let sum = 0;
+		let max = 0;
+		for (const s of this.sessions.values()) {
+			const q = s.getWriteQueueBytes();
+			sum += q;
+			if (q > max) max = q;
+		}
+		return {
+			sessions: this.sessions.size,
+			writeQueueSumBytes: sum,
+			writeQueueMaxBytes: max,
+			keyframeCacheBytes: this.lastKeyframeNalBytes + this.lastKeyframeRtpBytes
+		};
+	}
 	/** Per-session diagnostic snapshots consumed by `StreamBroker.listClients`. */
 	listSessionInfos() {
 		return [...this.sessions.values()].map((s) => s.getInfo());
@@ -3701,6 +3977,7 @@ var RtspRestreamer = class {
 			streamName: this.streamName,
 			total: this.sessions.size
 		} });
+		reportConsumerEvent(this.logger, "attach", "rtsp", this.deviceId, this.sessions.size);
 		this._onSessionCountChanged?.();
 		this.reconcileSentryAudio();
 		if (this._rtpPassthroughMode) setTimeout(() => this.servePendingSessionsRtp(), 0);
@@ -3751,7 +4028,7 @@ var RtspRestreamer = class {
 		if (this.collectingKeyframeRtp && !isKeyframe && !isParameterSet) this.collectingKeyframeRtp = false;
 		if (this.collectingKeyframeRtp) {
 			this.lastKeyframeRtpPackets.push({
-				data: Buffer.from(rtpData),
+				data: detachFromPool(rtpData),
 				marker: rtpPacket.marker
 			});
 			this.lastKeyframeRtpBytes += rtpData.length;
@@ -4165,6 +4442,7 @@ var RtspRestreamer = class {
 			streamName: this.streamName,
 			total: this.sessions.size
 		} });
+		reportConsumerEvent(this.logger, "detach", "rtsp", this.deviceId, this.sessions.size);
 		this._onSessionCountChanged?.();
 		this.reconcileSentryAudio();
 	}
@@ -4353,6 +4631,19 @@ var RtspSession = class {
 	lastRtpAt = 0;
 	/** Total video RTP bytes written to the socket. */
 	bytesSent = 0;
+	/**
+	* The socket is corked for the access unit in progress — see
+	* {@link writeInterleaved}. Cleared by the packet that ends the picture (RTP
+	* marker, or any audio packet) or by the next-tick safety net, whichever
+	* comes first.
+	*/
+	accessUnitCorked = false;
+	/** Flush the access unit in progress. Idempotent: the marker and the safety net both call it. */
+	uncorkAccessUnit = () => {
+		if (!this.accessUnitCorked) return;
+		this.accessUnitCorked = false;
+		this.socket.uncork();
+	};
 	/** Client `User-Agent` (from the first request that carries one). Lets the
 	*  broker panel identify a consumer by purpose — e.g. the recorder sets
 	*  `-user_agent recorder` on its RTSP pull — instead of a bare address. */
@@ -4421,6 +4712,10 @@ var RtspSession = class {
 			this.onClose?.();
 		});
 	}
+	/** Bytes the socket has accepted but not yet flushed (corked bytes included). */
+	getWriteQueueBytes() {
+		return this.socket.writableLength;
+	}
 	getSessionId() {
 		return this.sessionId;
 	}
@@ -4600,7 +4895,7 @@ var RtspSession = class {
 				return "dropped-backlog";
 			}
 		}
-		this.writeInterleaved(this.tracks[0].rtpChannel, packet.data);
+		this.writeInterleaved(this.tracks[0].rtpChannel, packet.data, packet.marker);
 		this.missedKeyframes = 0;
 		return "written";
 	}
@@ -4609,7 +4904,7 @@ var RtspSession = class {
 		if (!this.playing || this.closed || this.muted) return "not-playing";
 		if (this.tracks.length < 2) return "not-playing";
 		if (this.socket.writableLength > 2097152) return "dropped-backlog";
-		this.writeInterleaved(this.tracks[1].rtpChannel, packet.data);
+		this.writeInterleaved(this.tracks[1].rtpChannel, packet.data, true);
 		return "written";
 	}
 	/**
@@ -4631,14 +4926,13 @@ var RtspSession = class {
 	* ## Why sharing the payload is safe, and what would make it unsafe
 	*
 	* The payload buffer handed here is a private allocation per packet —
-	* `Buffer.from(readBuffer.subarray(...))` in `rtsp-client.ts`'s `onData`, for
-	* video and audio alike — never a view of the reader's socket buffer, which
-	* advances on the next read. Nothing in the broker writes into a captured
-	* packet: every mutation in this path targets a freshly allocated buffer.
-	* (The broker's `rtpRing` keeps its OWN copy of a pooled packet —
-	* `detachFromPool`, so a ring entry never pins a shared pool slab — so the
-	* ring no longer vouches for THIS object's lifetime, and it does not need
-	* to: a pending write holds its own reference, and the rule below is about
+	* `copyOwned(readBuffer, …)` in the readers' `onData`, for video and audio
+	* alike — never a view of the reader's socket buffer, which advances on the
+	* next read. Nothing in the broker writes into a captured packet: every
+	* mutation in this path targets a freshly allocated buffer. (The same object
+	* is what the broker's `rtpRing` and the restreamer's keyframe cache retain —
+	* it owns its backing store, so `detachFromPool` keeps it as is — and that is
+	* fine: a pending write holds its own reference, and the rule below is about
 	* mutation, not retention.)
 	*
 	* The rule to keep: **`socket.write` forbids MUTATION before the write
@@ -4648,18 +4942,36 @@ var RtspSession = class {
 	* queued. Four bytes from the Buffer pool is a pointer bump; the copy this
 	* replaces was ~1.4 KB.
 	*
-	* `cork`/`uncork` keeps the pair a single `writev` syscall, so removing the
-	* copy does not buy an extra write syscall per packet.
+	* ## One cork per ACCESS UNIT, not per packet
+	*
+	* The pair used to be corked and uncorked on its own: one `writev` per RTP
+	* packet per session, so a 4K keyframe fragmented into a hundred packets and
+	* fanned out to three sessions was three hundred syscalls for one picture no
+	* decoder can use before it is whole. The socket is corked on the first write
+	* of an access unit and uncorked by the packet that ENDS it
+	* (`endOfAccessUnit`: the RTP marker on video, every audio packet), so the
+	* picture leaves in one `writev`. A `process.nextTick` safety net uncorks
+	* whatever is still open before the tick yields to I/O — a marker-less camera
+	* or a lost marker degrades to one `writev` per tick, never to a socket held
+	* corked across a read.
+	*
+	* Backpressure sees through the cork: `writableLength` counts corked bytes,
+	* so the `MAX_WRITE_BUFFER` gate, the latch and the missed-keyframe close
+	* (D447) judge exactly what they judged per packet.
 	*/
-	writeInterleaved(channel, payload) {
+	writeInterleaved(channel, payload, endOfAccessUnit) {
 		const header = Buffer.allocUnsafe(4);
 		header[0] = 36;
 		header[1] = channel;
 		header.writeUInt16BE(payload.length, 2);
-		this.socket.cork();
+		if (!this.accessUnitCorked) {
+			this.accessUnitCorked = true;
+			this.socket.cork();
+			process.nextTick(this.uncorkAccessUnit);
+		}
 		this.socket.write(header);
 		this.socket.write(payload);
-		this.socket.uncork();
+		if (endOfAccessUnit) this.uncorkAccessUnit();
 		this.lastRtpAt = Date.now();
 		this.bytesSent += 4 + payload.length;
 	}
@@ -6357,6 +6669,10 @@ var EgressTranscodeManager = class {
 	/** In-flight starts, keyed by sharing key — concurrent acquires share one. */
 	pending = /* @__PURE__ */ new Map();
 	releaseGraceMs;
+	/** Live egress transcodes (ffmpeg children), for the `[broker-mem]` probe. */
+	activeCount() {
+		return this.entries.size;
+	}
 	constructor(opts) {
 		this.opts = opts;
 		this.releaseGraceMs = opts.releaseGraceMs ?? DEFAULT_RELEASE_GRACE_MS;
@@ -10083,7 +10399,7 @@ var Rfc4571Reader = class {
 		while (this.readBuffer.length >= 2) {
 			const length = this.readBuffer.readUInt16BE(0);
 			if (this.readBuffer.length < 2 + length) return;
-			const rtpPacket = Buffer.from(this.readBuffer.subarray(2, 2 + length));
+			const rtpPacket = copyOwned(this.readBuffer, 2, 2 + length);
 			this.readBuffer = this.readBuffer.subarray(2 + length);
 			this.dispatchRtp(rtpPacket);
 		}
@@ -10144,6 +10460,93 @@ function totalFragmentBytes(fragments) {
 	for (const fragment of fragments) total += fragment.length;
 	return total;
 }
+/** H.264: single NAL by its type; STAP-A by every aggregated type; FU-A by the FU header. */
+function classifyH264Payload(payload) {
+	const nalType = payload[0] & 31;
+	if (nalType === H264_NAL_STAP_A) {
+		let keyframe = false;
+		let parameterSet = false;
+		let offset = 1;
+		while (offset + 2 <= payload.length) {
+			const nalSize = payload.readUInt16BE(offset);
+			offset += 2;
+			if (nalSize === 0 || offset + nalSize > payload.length) break;
+			const type = payload[offset] & 31;
+			keyframe ||= type === H264_NAL_IDR;
+			parameterSet ||= type === H264_NAL_SPS || type === H264_NAL_PPS;
+			offset += nalSize;
+		}
+		return {
+			keyframe,
+			parameterSet
+		};
+	}
+	if (nalType === 28) {
+		if (payload.length < 2) return NO_PAYLOAD_CLASS;
+		return {
+			keyframe: (payload[1] & 31) === H264_NAL_IDR,
+			parameterSet: false
+		};
+	}
+	return {
+		keyframe: nalType === H264_NAL_IDR,
+		parameterSet: nalType === H264_NAL_SPS || nalType === H264_NAL_PPS
+	};
+}
+/** H.265: single NAL by its type; AP by every aggregated type; FU by the FU header. */
+function classifyH265Payload(payload) {
+	if (payload.length < 2) return NO_PAYLOAD_CLASS;
+	const nalType = payload[0] >> 1 & 63;
+	if (nalType === H265_NAL_AP) {
+		let keyframe = false;
+		let parameterSet = false;
+		let offset = 2;
+		while (offset + 2 <= payload.length) {
+			const nalSize = payload.readUInt16BE(offset);
+			offset += 2;
+			if (nalSize === 0 || offset + nalSize > payload.length) break;
+			const type = payload[offset] >> 1 & 63;
+			keyframe ||= isH265IrapType(type);
+			parameterSet ||= isH265ParameterSetType(type);
+			offset += nalSize;
+		}
+		return {
+			keyframe,
+			parameterSet
+		};
+	}
+	if (nalType === 49) {
+		if (payload.length < 3) return NO_PAYLOAD_CLASS;
+		return {
+			keyframe: isH265IrapType(payload[2] & 63),
+			parameterSet: false
+		};
+	}
+	return {
+		keyframe: isH265IrapType(nalType),
+		parameterSet: isH265ParameterSetType(nalType)
+	};
+}
+/**
+* Classify one raw RTP packet (12-byte header + payload) by what it carries —
+* the per-packet half of {@link RtpDepacketizer.processPacket}, without the
+* reassembly half. Pure: reads the headers, allocates nothing, keeps no state.
+* `null` for a packet too short to be RTP with a payload.
+*/
+function classifyRtpPacket(codec, rtpData) {
+	if (rtpData.length < 12) return null;
+	const marker = (rtpData[1] & 128) !== 0;
+	const timestamp = rtpData.readUInt32BE(4);
+	const payload = rtpData.subarray(12);
+	if (payload.length === 0) return null;
+	const carried = codec === "h264" ? classifyH264Payload(payload) : classifyH265Payload(payload);
+	return {
+		timestamp,
+		marker,
+		keyframe: carried.keyframe,
+		parameterSet: carried.parameterSet
+	};
+}
 /**
 * RTP → Annex-B NAL depacketizer.
 *
@@ -10188,87 +10591,22 @@ var RtpDepacketizer = class {
 	* short to be RTP with a payload.
 	*/
 	processPacket(rtpData) {
-		if (rtpData.length < 12) return null;
-		const marker = (rtpData[1] & 128) !== 0;
-		const timestamp = rtpData.readUInt32BE(4);
+		const carried = this.classifyPacket(rtpData);
+		if (carried === null) return null;
 		const payload = rtpData.subarray(12);
-		if (payload.length === 0) return null;
-		const carried = this.codec === "h264" ? this.classifyH264Payload(payload) : this.classifyH265Payload(payload);
-		if (this.codec === "h264") this.processH264(payload, timestamp, marker);
-		else this.processH265(payload, timestamp, marker);
-		return {
-			timestamp,
-			marker,
-			keyframe: carried.keyframe,
-			parameterSet: carried.parameterSet
-		};
-	}
-	/** H.264: single NAL by its type; STAP-A by every aggregated type; FU-A by the FU header. */
-	classifyH264Payload(payload) {
-		const nalType = payload[0] & 31;
-		if (nalType === H264_NAL_STAP_A) {
-			let keyframe = false;
-			let parameterSet = false;
-			let offset = 1;
-			while (offset + 2 <= payload.length) {
-				const nalSize = payload.readUInt16BE(offset);
-				offset += 2;
-				if (nalSize === 0 || offset + nalSize > payload.length) break;
-				const type = payload[offset] & 31;
-				keyframe ||= type === H264_NAL_IDR;
-				parameterSet ||= type === H264_NAL_SPS || type === H264_NAL_PPS;
-				offset += nalSize;
-			}
-			return {
-				keyframe,
-				parameterSet
-			};
-		}
-		if (nalType === 28) {
-			if (payload.length < 2) return NO_PAYLOAD_CLASS;
-			return {
-				keyframe: (payload[1] & 31) === H264_NAL_IDR,
-				parameterSet: false
-			};
-		}
-		return {
-			keyframe: nalType === H264_NAL_IDR,
-			parameterSet: nalType === H264_NAL_SPS || nalType === H264_NAL_PPS
-		};
+		if (this.codec === "h264") this.processH264(payload, carried.timestamp, carried.marker);
+		else this.processH265(payload, carried.timestamp, carried.marker);
+		return carried;
 	}
-	/** H.265: single NAL by its type; AP by every aggregated type; FU by the FU header. */
-	classifyH265Payload(payload) {
-		if (payload.length < 2) return NO_PAYLOAD_CLASS;
-		const nalType = payload[0] >> 1 & 63;
-		if (nalType === H265_NAL_AP) {
-			let keyframe = false;
-			let parameterSet = false;
-			let offset = 2;
-			while (offset + 2 <= payload.length) {
-				const nalSize = payload.readUInt16BE(offset);
-				offset += 2;
-				if (nalSize === 0 || offset + nalSize > payload.length) break;
-				const type = payload[offset] >> 1 & 63;
-				keyframe ||= isH265IrapType(type);
-				parameterSet ||= isH265ParameterSetType(type);
-				offset += nalSize;
-			}
-			return {
-				keyframe,
-				parameterSet
-			};
-		}
-		if (nalType === 49) {
-			if (payload.length < 3) return NO_PAYLOAD_CLASS;
-			return {
-				keyframe: isH265IrapType(payload[2] & 63),
-				parameterSet: false
-			};
-		}
-		return {
-			keyframe: isH265IrapType(nalType),
-			parameterSet: isH265ParameterSetType(nalType)
-		};
+	/**
+	* What this packet CARRIES, and nothing else: no NAL is reassembled, no buffer
+	* allocated, no reassembly state touched. The same verdict `processPacket`
+	* returns, for a broker whose Annex-B plane has no consumer — the source-RTP
+	* ring, the restreamer's keyframe cache and the stats need exactly this and
+	* none of the copies.
+	*/
+	classifyPacket(rtpData) {
+		return classifyRtpPacket(this.codec, rtpData);
 	}
 	processH264(payload, timestamp, marker) {
 		const nalType = payload[0] & 31;
@@ -10448,11 +10786,13 @@ var RtpAccessUnitTracker = class {
 		const keyframeContent = packet.keyframe || packet.parameterSet;
 		const keyframeAuStart = keyframeContent && !this.keyframeAu;
 		if (keyframeContent) this.keyframeAu = true;
+		const pictureStart = !packet.parameterSet && !this.pictureSeen;
 		if (!packet.parameterSet) this.pictureSeen = true;
 		return {
 			auStart,
 			keyframeAu: this.keyframeAu,
 			keyframeAuStart,
+			pictureStart,
 			parameterSet: packet.parameterSet
 		};
 	}
@@ -10778,7 +11118,7 @@ var NativeRtspClient = class {
 			const channel = this.readBuffer[1];
 			const length = this.readBuffer.readUInt16BE(2);
 			if (this.readBuffer.length < 4 + length) return;
-			const payload = Buffer.from(this.readBuffer.subarray(4, 4 + length));
+			const payload = copyOwned(this.readBuffer, 4, 4 + length);
 			this.readBuffer = this.readBuffer.subarray(4 + length);
 			this.handleInterleavedPacket(channel, payload);
 		} else {
@@ -11514,49 +11854,6 @@ var AudioCodecSession = class {
 	}
 };
 //#endregion
-//#region src/stream-broker/stream-broker/owned-buffer.ts
-/**
-* Buffers that enter a LONG-LIVED ring own their backing store.
-*
-* Node serves `Buffer.from(...)`, `Buffer.allocUnsafe(n)` and `Buffer.concat`
-* below `Buffer.poolSize >>> 1` (4 KiB) as views of shared 8 KiB pool slabs.
-* That is the right choice for the ingest path — a start code, a 4-byte
-* interleave header, a 1.3 KB RTP packet that is fanned out and forgotten
-* within a tick — and the wrong one for anything RETAINED: a 600-byte NAL kept
-* for 60 s in a clip ring pins its whole slab, and with it every short-lived
-* packet that happened to be allocated beside it. On the hub that held
-* 550–980 MB of ArrayBuffers for ~150–250 MB of payload, and the full GCs the
-* pinned slabs caused ran every 0.2–0.5 s at 40–65 % of a core.
-*
-* The ring byte caps counted payload bytes, so they never saw it. Both rings
-* now pass every entry through {@link detachFromPool} on the way in and
-* account it with {@link backingStoreBytes}, so the cap measures what the
-* entry costs. Short-lived traffic stays pooled.
-*/
-/** True when `buf` is the whole of its ArrayBuffer — nothing else shares it. */
-function ownsBackingStore(buf) {
-	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length;
-}
-/**
-* What retaining `buf` really costs: its own length when it owns its
-* ArrayBuffer, the whole shared slab when it is a view of one.
-*/
-function backingStoreBytes(buf) {
-	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
-}
-/**
-* `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
-* buffer, never by its size: whether a large `allocUnsafe` is pooled is a Node
-* runtime detail), else a copy that does. One copy, never two: a buffer that is
-* already unpooled is returned as-is.
-*/
-function detachFromPool(buf) {
-	if (ownsBackingStore(buf)) return buf;
-	const owned = Buffer.allocUnsafeSlow(buf.length);
-	buf.copy(owned);
-	return owned;
-}
-//#endregion
 //#region src/stream-broker/stream-broker/encoded-ring-buffer.ts
 /**
 * Time-based ring buffer for encoded video packets.
@@ -12496,9 +12793,6 @@ var StreamBroker = class StreamBroker {
 	*/
 	ffmpegBinaryPathSource = () => null;
 	rtpDepacketizer = null;
-	/** Flag-only depacketizer for the `push-rtp` source-RTP pre-buffer path
-	*  (sets keyframe/param-set flags without re-emitting AnnexB packets). */
-	pushRtpFlagDepacketizer = null;
 	audioRtpDecoder = null;
 	audioCodecSession = null;
 	/**
@@ -12742,6 +13036,8 @@ var StreamBroker = class StreamBroker {
 	* timeout was chosen against.
 	*/
 	static RTP_ACTIVITY_SWEEP_MS = 1e3;
+	/** A source counts as ingesting when its last video packet is younger than this. */
+	static INGESTING_WITHIN_MS = 1e4;
 	manualStop = false;
 	stopping = false;
 	pipeServer;
@@ -12866,10 +13162,24 @@ var StreamBroker = class StreamBroker {
 	*  log alongside `audioRtpSeen`, so a wake-up cycle that brings audio
 	*  back but never video is observable from the structured logs. */
 	videoRtpSeen = 0;
-	/** Tracking flags set synchronously by the RTP depacketizer callback. */
+	/**
+	* What the source RTP packet being handled CARRIES (keyframe / parameter-set
+	* content, read from its payload headers by `classifyRtpPacket`) — the flags
+	* `captureRtpForPreBuffer` reads. Per packet, not per completed NAL: every
+	* fragment of a fragmented IDR carries them, and the ring marks one keyframe
+	* AU for the lot.
+	*/
 	_lastNalKeyframe = false;
 	_lastNalParamSet = false;
 	/**
+	* Whether the Annex-B plane (NAL reassembly + access-unit assembly →
+	* `EncodedPacket`) is being BUILT for this stream. False while nothing
+	* consumes it: the source-RTP path then classifies each packet and copies
+	* nothing. Armed at the next keyframe access unit once a consumer attaches
+	* (`needsAnnexBPlane`), so the first packet it emits is decodable.
+	*/
+	annexBPlaneActive = false;
+	/**
 	* Source-RTP pre-buffer: a ring of raw source RTP packets trimmed to
 	* begin at the most recent keyframe access unit — i.e. the current GOP so
 	* far. A late-joining WebRTC viewer on the repacketizer path replays this
@@ -13002,6 +13312,33 @@ var StreamBroker = class StreamBroker {
 		return this.lastPacketAt;
 	}
 	/**
+	* What this broker holds, for the `[broker-mem]` probe (`broker-mem-probe.ts`).
+	* Ring sizes are the rings' own counters (backing-store bytes), so this is
+	* O(sessions + subscribers) and allocates only the result.
+	*/
+	getMemSample(now) {
+		const encodedByKind = {};
+		for (const entry of this.encodedCallbacks.values()) encodedByKind[entry.attribution.kind] = (encodedByKind[entry.attribution.kind] ?? 0) + 1;
+		for (const entry of this.rtpVideoCallbacks.values()) encodedByKind[entry.attribution.kind] = (encodedByKind[entry.attribution.kind] ?? 0) + 1;
+		const rtsp = this.rtspRestreamer.getMemProbe();
+		return {
+			deviceId: this.numericDeviceId,
+			brokerId: this.deviceId,
+			ingesting: this.lastPacketAt > 0 && now - this.lastPacketAt < StreamBroker.INGESTING_WITHIN_MS,
+			preBufferBytes: this.preBuffer.getBufferedBytes(),
+			clipBytes: this.clipBuffer?.getBufferedBytes() ?? 0,
+			rtpRingBytes: this.rtpRingBytes,
+			keyframeCacheBytes: rtsp.keyframeCacheBytes,
+			rtspSessions: rtsp.sessions,
+			writeQueueSumBytes: rtsp.writeQueueSumBytes,
+			writeQueueMaxBytes: rtsp.writeQueueMaxBytes,
+			encodedByKind,
+			audioSubscribers: this.audioChunkPlane.subscriberCount,
+			pipeClients: this.pipeServer.getClientCount(),
+			annexBPlaneActive: this.annexBPlaneActive
+		};
+	}
+	/**
 	* Whether a LAZY publisher is being built right now.
 	*
 	* A consumer deciding whether it is worth waiting for this source needs to
@@ -13945,26 +14282,7 @@ var StreamBroker = class StreamBroker {
 				return;
 			}
 		}
-		if (packet.type === "video") {
-			this.packetCount++;
-			this.totalBytes += packet.data.length;
-			this.bytesInWindow += packet.data.length;
-			this.packetsInWindow++;
-			this.lastPacketAt = Date.now();
-			const now = Date.now();
-			const windowMs = now - this.windowStartMs;
-			if (windowMs >= 2e3) {
-				this.bitrateKbps = Math.round(this.bytesInWindow * 8 / windowMs);
-				this.encodedInputFps = this.packetsInWindow / windowMs * 1e3;
-				this.bytesInWindow = 0;
-				this.packetsInWindow = 0;
-				this.windowStartMs = now;
-			}
-			if (packet.keyframe) {
-				if (this.lastKeyframeMs > 0) this.idrIntervalMs = now - this.lastKeyframeMs;
-				this.lastKeyframeMs = now;
-			}
-		}
+		if (packet.type === "video" && this.rtpDepacketizer === null) this.recordVideoStats(packet.data.length, true, packet.keyframe);
 		if (packet.type === "video" && !this.isRtpSource()) this.preBuffer.push(packet);
 		if (packet.type === "video" && this.clipBuffer && packet.isPlaceholder !== true) this.clipBuffer.push(packet);
 		this.fanOutEncoded(packet);
@@ -13983,6 +14301,7 @@ var StreamBroker = class StreamBroker {
 			packetsDelivered: 0
 		};
 		this.encodedCallbacks.set(callback, entry);
+		reportConsumerEvent(this.logger, "attach", attribution.kind, this.numericDeviceId, this.encodedCallbacks.size + this.rtpVideoCallbacks.size);
 		if (this.streamingDebug) this.logger?.info("encoded subscriber added", { meta: {
 			total: this.encodedCallbacks.size,
 			subscriberId: entry.id,
@@ -13993,6 +14312,7 @@ var StreamBroker = class StreamBroker {
 		this.checkDemand();
 		return () => {
 			this.encodedCallbacks.delete(callback);
+			reportConsumerEvent(this.logger, "detach", attribution.kind, this.numericDeviceId, this.encodedCallbacks.size + this.rtpVideoCallbacks.size);
 			if (this.streamingDebug) this.logger?.info("encoded subscriber removed", { meta: {
 				total: this.encodedCallbacks.size,
 				subscriberId: entry.id
@@ -14087,6 +14407,7 @@ var StreamBroker = class StreamBroker {
 			packetsDelivered: 0
 		};
 		this.rtpVideoCallbacks.set(callback, entry);
+		reportConsumerEvent(this.logger, "attach", attribution.kind, this.numericDeviceId, this.encodedCallbacks.size + this.rtpVideoCallbacks.size);
 		if (this.streamingDebug || CH_RTP.on) this.logger?.info("rtp video subscriber added", { meta: {
 			total: this.rtpVideoCallbacks.size,
 			subscriberId: entry.id,
@@ -14096,6 +14417,7 @@ var StreamBroker = class StreamBroker {
 		this.checkDemand();
 		return () => {
 			this.rtpVideoCallbacks.delete(callback);
+			reportConsumerEvent(this.logger, "detach", attribution.kind, this.numericDeviceId, this.encodedCallbacks.size + this.rtpVideoCallbacks.size);
 			if (this.streamingDebug || CH_RTP.on) this.logger?.info("rtp video subscriber removed", { meta: {
 				total: this.rtpVideoCallbacks.size,
 				subscriberId: entry.id
@@ -14155,8 +14477,8 @@ var StreamBroker = class StreamBroker {
 					index: auStart,
 					ts: auPacket.readUInt32BE(4)
 				});
+				this.trimRtpRingToPreRollWindow();
 			}
-			this.trimRtpRingToPreRollWindow();
 			this.rtpRingHasKeyframe = true;
 		}
 		this.rtpRingPrevMarker = marker;
@@ -14425,10 +14747,10 @@ var StreamBroker = class StreamBroker {
 	*
 	* `push-rtp` providers deliver AnnexB-equivalents separately via
 	* `pushEncodedPacket()` (see `IStreamBroker` contract) — so this path
-	* does NOT re-emit EncodedPackets; it only derives the per-packet
-	* keyframe/param-set flags the pre-buffer capture needs (via a
-	* flag-only depacketizer that never touches the AnnexB plane), keeping
-	* the AnnexB consumers (pipe, restreamer) single-fed by the provider.
+	* does NOT re-emit EncodedPackets; it only classifies each packet for the
+	* keyframe/param-set flags the pre-buffer capture needs
+	* (`classifyRtpPacket`, no reassembly), keeping the AnnexB consumers
+	* (pipe, restreamer) single-fed by the provider.
 	*
 	* The pre-buffer is captured even with zero subscribers attached — a
 	* viewer that connects mid-GOP must be able to replay the GOP that
@@ -14438,9 +14760,9 @@ var StreamBroker = class StreamBroker {
 	pushVideoRtp(rtpData) {
 		if (this.stopping) return;
 		this.kickRtpActivityWatchdog();
-		this._lastNalKeyframe = false;
-		this._lastNalParamSet = false;
-		this.ensurePushRtpFlagDepacketizer().processPacket(rtpData);
+		const carried = classifyRtpPacket(this.detectedCodec === "h265" ? "h265" : "h264", rtpData);
+		this._lastNalKeyframe = carried?.keyframe ?? false;
+		this._lastNalParamSet = carried?.parameterSet ?? false;
 		this.captureRtpForPreBuffer(rtpData);
 		if (this.rtpVideoCallbacks.size === 0) return;
 		for (const [cb, entry] of this.rtpVideoCallbacks) try {
@@ -14450,27 +14772,6 @@ var StreamBroker = class StreamBroker {
 			this.logger?.warn("rtp video subscriber threw", { meta: { error: errMsg(err) } });
 		}
 	}
-	/**
-	* Lazily build a flag-only RTP depacketizer for the `push-rtp` source
-	* path. Unlike the native reader's depacketizer (which emits AnnexB
-	* EncodedPackets via `handleDepacketizedNal`), this callback ONLY sets
-	* `_lastNalKeyframe`/`_lastNalParamSet` — the push provider owns the
-	* AnnexB plane through `pushEncodedPacket`, so re-emitting here would
-	* double-feed the pipe/restreamer. push-rtp has no SDP `onVideoTrack`,
-	* so the codec comes from the source declaration (`detectedCodec`, seeded
-	* in `start()`). Dropped on teardown (`resetRtpPipeline`) so a redial
-	* starts with clean FU reassembly state.
-	*/
-	ensurePushRtpFlagDepacketizer() {
-		if (!this.pushRtpFlagDepacketizer) {
-			const codec = this.detectedCodec === "h265" ? "h265" : "h264";
-			this.pushRtpFlagDepacketizer = new RtpDepacketizer(codec, ({ keyframe, parameterSet }) => {
-				if (keyframe) this._lastNalKeyframe = true;
-				if (parameterSet) this._lastNalParamSet = true;
-			});
-		}
-		return this.pushRtpFlagDepacketizer;
-	}
 	/** Toggle the per-device streaming debug flag. */
 	setStreamingDebug(enabled) {
 		this.streamingDebug = enabled;
@@ -14517,6 +14818,7 @@ var StreamBroker = class StreamBroker {
 			tag,
 			accept: options?.accept
 		});
+		reportConsumerEvent(this.logger, "attach", "audio-chunks", this.numericDeviceId, this.audioChunkPlane.subscriberCount);
 		this.checkDemand();
 		return result;
 	}
@@ -14527,7 +14829,10 @@ var StreamBroker = class StreamBroker {
 	/** Release an audio-chunk subscription. Returns `true` when it existed. */
 	unsubscribeAudioChunks(subscriptionId) {
 		const released = this.audioChunkPlane.unsubscribe(subscriptionId);
-		if (released) this.checkDemand();
+		if (released) {
+			reportConsumerEvent(this.logger, "detach", "audio-chunks", this.numericDeviceId, this.audioChunkPlane.subscriberCount);
+			this.checkDemand();
+		}
 		return released;
 	}
 	getStats() {
@@ -14913,10 +15218,17 @@ var StreamBroker = class StreamBroker {
 					seq: this.videoRtpSeen,
 					bytes: rtpData.length
 				} });
-				this._lastNalKeyframe = false;
-				this._lastNalParamSet = false;
-				const carried = this.rtpDepacketizer?.processPacket(rtpData) ?? null;
+				const wantPlane = this.needsAnnexBPlane();
+				if (!wantPlane && this.annexBPlaneActive) this.idleAnnexBPlane();
+				const carried = this.annexBPlaneActive ? this.rtpDepacketizer?.processPacket(rtpData) ?? null : this.rtpDepacketizer?.classifyPacket(rtpData) ?? null;
+				this._lastNalKeyframe = carried?.keyframe ?? false;
+				this._lastNalParamSet = carried?.parameterSet ?? false;
 				const auFlags = carried ? this.rtpAuTracker.classify(carried) : null;
+				if (wantPlane && !this.annexBPlaneActive && auFlags?.keyframeAuStart === true) {
+					this.armAnnexBPlane();
+					this.rtpDepacketizer?.processPacket(rtpData);
+				}
+				if (auFlags) this.recordVideoStats(rtpData.length, auFlags.pictureStart, auFlags.keyframeAu);
 				this.rtspRestreamer.pushRtpPassthrough(rtpData, auFlags?.keyframeAu ?? false, auFlags?.parameterSet ?? false);
 				this.captureRtpForPreBuffer(rtpData);
 				if (this.rtpVideoCallbacks.size > 0) for (const [cb, entry] of this.rtpVideoCallbacks) try {
@@ -15132,11 +15444,83 @@ var StreamBroker = class StreamBroker {
 	* not fed from here.
 	*/
 	handleDepacketizedNal(depacketized) {
-		if (depacketized.keyframe) this._lastNalKeyframe = true;
-		if (depacketized.parameterSet) this._lastNalParamSet = true;
 		this.annexBAssembler.push(depacketized);
 	}
 	/**
+	* Does anything consume the Annex-B plane right now? An encoded subscriber
+	* (WebRTC Annex-B, fragments, a decode session), a pipe client, a clip ring
+	* (it retains access units continuously, so it needs them built even with
+	* nobody attached), or a restreamer still in Annex-B mode (no camera SDP yet).
+	* The RTSP restream and the WebRTC RTP path are served from the source RTP
+	* and never count. Cheap — four field reads — because it runs per packet.
+	*/
+	needsAnnexBPlane() {
+		return this.encodedCallbacks.size > 0 || this.clipBuffer !== null || this.pipeServer.getClientCount() > 0 || !this.rtspRestreamer.rtpPassthroughMode;
+	}
+	/** The consumers that want the plane, for the arm/idle lines. */
+	annexBPlaneConsumers() {
+		return {
+			encodedSubscribers: this.encodedCallbacks.size,
+			clipRing: this.clipBuffer !== null,
+			pipeClients: this.pipeServer.getClientCount(),
+			restreamerAnnexB: !this.rtspRestreamer.rtpPassthroughMode
+		};
+	}
+	/**
+	* Start building access units from the keyframe AU the current packet opens.
+	* The depacketizer and the assembler are clean here (reset when the plane
+	* went idle, or never used), so nothing stale precedes that keyframe.
+	*/
+	armAnnexBPlane() {
+		this.annexBPlaneActive = true;
+		this.logger?.info("annex-b plane armed at a keyframe access unit", {
+			tags: { deviceId: this.numericDeviceId },
+			meta: this.annexBPlaneConsumers()
+		});
+	}
+	/**
+	* Stop building access units: the last consumer left. The picture in
+	* progress is dropped, not flushed — there is nobody to hand it to, and a
+	* partial picture must never reach the next consumer's clean start. Logged,
+	* once per transition: a plane that is idle on purpose must not read as a
+	* stream that stopped.
+	*/
+	idleAnnexBPlane() {
+		this.annexBPlaneActive = false;
+		this.rtpDepacketizer?.reset();
+		this.annexBAssembler.reset();
+		this.logger?.info("annex-b plane idle — no consumer, NAL reassembly skipped", { tags: { deviceId: this.numericDeviceId } });
+	}
+	/**
+	* One place for the input stats, fed from whichever path owns the pictures:
+	* the source RTP packets while the native reader is up (`onVideoRtp`), the
+	* `EncodedPacket`s otherwise (`pushEncodedPacket`). `bytes` accumulate per
+	* call; `inputFps`, `packetCount` and the IDR interval advance once per
+	* picture — the window is closed on a picture start so a window of N frames
+	* reads N, exactly as it did when every call was one access unit.
+	*/
+	recordVideoStats(bytes, pictureStart, keyframe) {
+		this.totalBytes += bytes;
+		this.bytesInWindow += bytes;
+		if (!pictureStart) return;
+		this.packetCount++;
+		this.packetsInWindow++;
+		const now = Date.now();
+		this.lastPacketAt = now;
+		const windowMs = now - this.windowStartMs;
+		if (windowMs >= 2e3) {
+			this.bitrateKbps = Math.round(this.bytesInWindow * 8 / windowMs);
+			this.encodedInputFps = this.packetsInWindow / windowMs * 1e3;
+			this.bytesInWindow = 0;
+			this.packetsInWindow = 0;
+			this.windowStartMs = now;
+		}
+		if (keyframe) {
+			if (this.lastKeyframeMs > 0) this.idrIntervalMs = now - this.lastKeyframeMs;
+			this.lastKeyframeMs = now;
+		}
+	}
+	/**
 	* One assembled access unit → one `EncodedPacket` for every Annex-B
 	* consumer (prebuffer, clip ring, pipe, WebRTC). A keyframe packet is
 	* self-contained (VPS/SPS/PPS + every IDR slice), which is what a decoder
@@ -15557,10 +15941,7 @@ var StreamBroker = class StreamBroker {
 		this.annexBAssembler.flush();
 		this.annexBAssembler.reset();
 		this.rtpAuTracker.reset();
-		if (this.pushRtpFlagDepacketizer) {
-			this.pushRtpFlagDepacketizer.reset();
-			this.pushRtpFlagDepacketizer = null;
-		}
+		this.annexBPlaneActive = false;
 		this.resetRtpPreBuffer();
 		if (this.audioRtpDecoder) {
 			this.audioRtpDecoder.flush();
@@ -19278,6 +19659,10 @@ var StreamBrokerManager = class StreamBrokerManager {
 		return { killed: broker.killClient(input.channel, input.handle) };
 	}
 	/** Raw broker instances — internal use only. */
+	/** Live egress transcodes (ffmpeg children) — the `[broker-mem]` probe. */
+	getEgressTranscodeCount() {
+		return this.egressTranscodeManager?.activeCount() ?? 0;
+	}
 	getBrokerInstances() {
 		return [...this.brokers.values()];
 	}
@@ -35150,6 +35535,7 @@ var BrokerWebrtcServer = class {
 			}
 		};
 		this.sessions.set(sessionId, entry);
+		reportConsumerEvent(this.logger, "attach", `webrtc:${entry.consumerKind}`, entry.rebind?.deviceId, this.sessions.size);
 		session.onClosed = () => this.cleanupSession(sessionId);
 		const locateRecorded = this.locateRecordedSegment;
 		const readRecorded = this.readRecordedSegmentBytes;
@@ -36367,6 +36753,7 @@ var BrokerWebrtcServer = class {
 		const entry = this.sessions.get(sessionId);
 		if (!entry) return;
 		this.sessions.delete(sessionId);
+		reportConsumerEvent(this.logger, "detach", `webrtc:${entry.consumerKind}`, entry.rebind?.deviceId, this.sessions.size);
 		entry.pendingSwitch?.cancel();
 		entry.pendingSwitch = void 0;
 		let brokerStillServed = false;
@@ -37088,6 +37475,45 @@ function dialAnswerFromError(err) {
 	};
 }
 //#endregion
+//#region src/stream-broker/broker-mem-report.ts
+/** Linux only: elsewhere (or on a read error) the native view is simply absent. */
+async function readProc() {
+	if (process.platform !== "linux") return {
+		status: null,
+		maps: null
+	};
+	const [status, maps] = await Promise.all([readFile("/proc/self/status", "utf8").then(parseProcStatus, () => null), readFile("/proc/self/maps", "utf8").then(parseProcMaps, () => null)]);
+	return {
+		status,
+		maps
+	};
+}
+async function emitOnce(deps) {
+	const now = Date.now();
+	const proc = await readProc();
+	const resources = process.getActiveResourcesInfo();
+	const line = formatBrokerMem({
+		samples: deps.manager.getBrokerInstances().map((b) => b.getMemSample(now)),
+		webrtcSessions: deps.webrtcSessions(),
+		egressTranscodes: deps.manager.getEgressTranscodeCount(),
+		childProcesses: countActiveResources(resources, "ProcessWrap"),
+		proc,
+		churn: consumerChurn.drain(),
+		copied: readCopyOwnedTotals()
+	});
+	deps.logger.info(line);
+}
+/** Start the five-minute `[broker-mem]` heartbeat; returns its stop function. */
+function startBrokerMemReport(deps) {
+	const timer = setInterval(() => {
+		emitOnce(deps).catch((err) => {
+			deps.logger.warn("broker-mem probe failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+	}, BROKER_MEM_INTERVAL_MS);
+	timer.unref();
+	return () => clearInterval(timer);
+}
+//#endregion
 //#region src/stream-broker/event-loop-stall-monitor.ts
 var DEFAULT_INTERVAL_MS = 100;
 var DEFAULT_THRESHOLD_MS = 250;
@@ -37262,6 +37688,8 @@ var StreamBrokerAddon = class extends BaseAddon {
 	*  leaks those sockets and wedges the next runner's werift ICE agent
 	*  (DTLS never connects until a full hub restart). */
 	webrtcServer = null;
+	/** Stops the five-minute `[broker-mem]` attribution heartbeat. */
+	stopBrokerMemReport = null;
 	/** Names this process's event-loop stalls — see onInitialize. */
 	loopStallMonitor = null;
 	/** The `log-channels` provider for this process. Stopped on shutdown so a
@@ -37619,6 +38047,11 @@ var StreamBrokerAddon = class extends BaseAddon {
 		this.webrtcServer = webrtcServer;
 		const webrtcSessionProvider = new WebrtcSessionProvider(webrtcServer, this.brokerManager);
 		this.metricsSnapshotTimer = setInterval(() => this.emitBrokerMetricsSnapshot(), BROKER_METRICS_SNAPSHOT_INTERVAL_MS);
+		this.stopBrokerMemReport = startBrokerMemReport({
+			logger: this.ctx.logger,
+			manager: this.brokerManager,
+			webrtcSessions: () => webrtcServer.getSessionCount()
+		});
 		const widgetsProvider = { listWidgets: async () => [{
 			tab: "device-tab",
 			label: "Stream Brokers",
@@ -37723,6 +38156,8 @@ var StreamBrokerAddon = class extends BaseAddon {
 	async onShutdown() {
 		this.logChannels?.stop();
 		this.logChannels = null;
+		this.stopBrokerMemReport?.();
+		this.stopBrokerMemReport = null;
 		this.loopStallMonitor?.stop();
 		this.loopStallMonitor = null;
 		this.flushProbeSnapshots(Date.now(), true);