@camstack/addon-pipeline 1.2.372 → 1.2.374

package/dist/stream-broker/index.js

@@ -3,12 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DmuX7IFJ.js");
-const require_node = require("../node-DqA6nD1z.js");
+const require_dist = require("../dist-CBEUVjTS.js");
+const require_node = require("../node-DMgi6pND.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
-const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
-const require_segment_demux_js = require("../segment-demux-js-BkGK1rhu.js");
+const require_segment_demux_js = require("../segment-demux-js-CSQVhbFI.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_crypto = require("node:crypto");
@@ -364,207 +363,253 @@ function formatProbedSummary(declared, snapshot, opts) {
 	return parts.join(SEP);
 }
 //#endregion
-//#region src/stream-broker/broker-row-stores.ts
-/**
-* The stream-broker's flattened settings maps — one row per entry.
-*
-* ## What this replaced
-*
-* `stream-broker:addon-settings` / `root` was 33 155 bytes on the reference
-* hub, and three keys were 32 735 of it: `probeSnapshots` (17 282 B, 109
-* streams), `rtspTokens` (13 147 B, 243 streams) and `profileMap` (2 306 B, 29
-* cameras — a per-DEVICE map, so it grows with the fleet). Every read of that
-* row parsed all of it, including `BaseAddon.resolveConfig`, and every write
-* rewrote all of it — a probe flush every few seconds while streams are live.
-*
-* Two keys deliberately STAY blob keys on that row, and the reasons are not
-* "they are small":
-*
-*   - `rtspEnabled` — brokerId → boolean, EMPTY on the reference hub. Its
-*     persister replaces the whole map from the set of registered restreamers,
-*     and reproducing that on rows means an authoritative prune. A prune driven
-*     by a map that shrinks whenever a broker unregisters is exactly the shape
-*     that turns an unbind into a wipe (D130, D49), and the twin key
-*     `rtspTokens` carries a comment about precisely that loss. Nothing is
-*     bought by moving 0 bytes at that risk.
-*   - `deviceOverrides` — 354 B, two cameras, same replace-the-whole-map
-*     persister, written only when an operator edits an override.
-*
-* The row survives either way: it is also where `BaseAddon.resolveConfig` reads
-* the operator's config fields from. The problem was a 33 KB row, not a blob.
-*/
-/**
-* The addon id — the settings-store namespace whose `root` row the flattened
-* keys are being retired from. Matches `packages/addon-pipeline/package.json`
-* (`camstack.addons[].id`).
-*/
-var STREAM_BROKER_ADDON_ID = "stream-broker";
-/**
-* Every one of these collections is keyed by the BROKER ID
-* (`<deviceId>/<camStreamId>`) or by the numeric deviceId. `brokerDeviceId`
-* recovers the numeric device from either, for the projected column that makes
-* a per-camera question an indexed query — and for `tags: { deviceId }` on
-* every line these stores log.
-*
-* Returns `null` rather than guessing: a key whose head is not a number is a
-* key this addon did not write, and inventing a device for it would put a row
-* on a camera at random.
-*/
-function brokerDeviceId(key) {
-	const head = key.includes("/") ? key.slice(0, key.indexOf("/")) : key;
-	const id = Number(head);
-	return Number.isInteger(id) && id > 0 ? id : null;
-}
-/**
-* Bound for a whole-map read. `settings-store.query` silently caps an unbounded
-* read at 2 000 rows and answers as if that were everything; at 974 devices ×
-* up to 5 streams the default is HALF the margin, so every read here names its
-* own ceiling and a truncation is reported rather than shrunk.
-*/
-var BROKER_ROWS_LIMIT = 2e4;
-/**
-* @durable class=mirror owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), replaced wholesale from the
-*     manager's live probe map by the throttled metrics flush and once on shutdown"
-*   retention="the flush is authoritative: a broker the manager no longer holds loses its
-*     row. Losing the whole collection costs the settings 'Probed' field showing 'not yet
-*     probed' until the stream is pulled again — it is re-derived from the next probe."
-*/
-var BROKER_PROBE_SNAPSHOTS_COLLECTION = "stream-broker:probe-snapshots";
-var BROKER_PROBE_SNAPSHOTS_SPEC = {
-	collection: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-	schema: ProbedSnapshotSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}, {
-		name: "at",
-		type: "INTEGER",
-		notNull: true
-	}],
-	indexes: [{
-		name: "idx_stream_broker_probe_device",
-		columns: ["deviceId"]
-	}],
-	project: (key, value) => ({
-		deviceId: brokerDeviceId(key),
-		at: value.at
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function probeSnapshotsStore(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
-		spec: BROKER_PROBE_SNAPSHOTS_SPEC,
-		store,
-		logger
-	});
-}
-/**
-* The token, wrapped in an object rather than stored bare.
-*
-* A bare string in a `JSON` column round-trips only because the engine's
-* decoder JSON-parses a stored string ONLY when it starts with `{` or `[`. That
-* is a heuristic, not a contract; a token is opaque hex today and a future
-* format that starts with a brace would come back as an object. One field costs
-* nothing and makes the row self-describing.
-*/
-var RtspTokenRowSchema = require_dist.object({ token: require_dist.string().min(1) });
-/**
-* @durable class=ledger owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), upserted when the restream
-*     server mints a token. MERGE only — a token is stable forever per stream unless it
-*     is explicitly regenerated"
-*   retention="nothing deletes a row. The persister receives only the CURRENTLY registered
-*     restreamers, so a replace would erase the token of an unregistered broker and turn
-*     an external NVR URL into a dead 404 at the next idle or reboot."
-*/
-var BROKER_RTSP_TOKENS_COLLECTION = "stream-broker:rtsp-tokens";
-var BROKER_RTSP_TOKENS_SPEC = {
-	collection: BROKER_RTSP_TOKENS_COLLECTION,
-	schema: RtspTokenRowSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}],
-	indexes: [{
-		name: "idx_stream_broker_rtsp_tokens_device",
-		columns: ["deviceId"]
-	}],
-	project: (key) => ({ deviceId: brokerDeviceId(key) }),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function rtspTokensStore(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
-		spec: BROKER_RTSP_TOKENS_SPEC,
-		store,
-		logger
-	});
-}
-/** One camera's profile → camStreamId assignment, plus whether it is automatic. */
+//#region src/stream-broker/broker-device-state.ts
+/**
+* The stream-broker's per-camera state, kept as per-device settings (D870).
+*
+* Three maps used to be collections of their own (`stream-broker:probe-snapshots`,
+* `:profile-map`, `:rtsp-tokens`), each keyed by the camera. A camera's data in
+* a side table is a row somebody must remember to delete when the camera goes;
+* as a KEY of the camera's own settings it is cleared by the central device
+* delete (D865) with everything else.
+*
+* | key              | value for one camera                                      |
+* | ---------------- | --------------------------------------------------------- |
+* | `probeSnapshots` | `{ [camStreamId]: ProbedSnapshot }` - what the broker last probed |
+* | `brokerProfile`  | `{ map, auto }` - the profile -> camStreamId assignment   |
+* | `rtspTokens`     | JSON text of `{ [camStreamId]: token }` - a SECRET: declared in `secretStatePaths`, so the settings view stores a keychain marker and the text lives in the keychain |
+*
+* Failure direction: a load that cannot ask the store THROWS (D49). The writers
+* built on {@link DeviceKeyMirror} refuse to write until a load has succeeded,
+* because a replace driven by an empty "known" set would otherwise drop or
+* shrink rows it never saw.
+*/
+/** Per-device settings keys. */
+var PROBE_SNAPSHOTS_KEY = "probeSnapshots";
+var BROKER_PROFILE_KEY = "brokerProfile";
+var RTSP_TOKENS_KEY = "rtspTokens";
+/** One camera's profile -> camStreamId assignment, plus whether it is automatic. */
 var ProfileAssignmentSchema = require_dist.object({
 	map: require_dist.record(require_dist.string(), require_dist.string()),
 	auto: require_dist.boolean()
 });
+var ProbeSnapshotsOfDeviceSchema = require_dist.record(require_dist.string(), ProbedSnapshotSchema);
+var RtspTokensOfDeviceSchema = require_dist.record(require_dist.string(), require_dist.string().min(1));
 /**
-* @durable class=config owner=stream-broker
-*   write="one row per camera, replaced wholesale from the manager's assignment map on
-*     every profile mutation — the map is authoritative and its boot pass PRUNES cameras
-*     the device registry no longer knows, which is why the write is a replace and not
-*     an upsert"
-*   retention="the replace is the retention: a camera dropped from the manager's map loses
-*     its row. Losing a row costs one automatic re-assignment on the next catalog pull."
-*/
-var BROKER_PROFILE_MAP_COLLECTION = "stream-broker:profile-map";
-var BROKER_PROFILE_MAP_SPEC = {
-	collection: BROKER_PROFILE_MAP_COLLECTION,
-	schema: ProfileAssignmentSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	}, {
-		name: "auto",
-		type: "BOOLEAN",
-		notNull: true
-	}],
-	project: (key, value) => ({
-		deviceId: Number(key),
-		auto: value.auto
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
+* A broker id is `<deviceId>/<camStreamId>`. Returns `null` rather than
+* guessing: a key whose head is not a number is a key this addon did not
+* write, and inventing a device for it would put a value on a camera at random.
+*/
+function splitBrokerId(brokerId) {
+	const slash = brokerId.indexOf("/");
+	if (slash <= 0) return null;
+	const deviceId = Number(brokerId.slice(0, slash));
+	if (!Number.isInteger(deviceId) || deviceId <= 0) return null;
+	return {
+		deviceId,
+		camStreamId: brokerId.slice(slash + 1)
+	};
+}
+/** Group `<deviceId>/<camStreamId>` -> value into deviceId -> camStreamId -> value. */
+function groupByDevice(flat) {
+	const entries = flat instanceof Map ? [...flat.entries()] : Object.entries(flat);
+	const out = /* @__PURE__ */ new Map();
+	for (const [brokerId, value] of entries) {
+		const parts = splitBrokerId(brokerId);
+		if (parts === null) continue;
+		const group = out.get(parts.deviceId) ?? {};
+		group[parts.camStreamId] = value;
+		out.set(parts.deviceId, group);
+	}
+	return out;
+}
+/** The inverse of {@link groupByDevice}. */
+function flattenByDevice(grouped) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of grouped) for (const [camStreamId, value] of Object.entries(group)) out.set(`${deviceId}/${camStreamId}`, value);
+	return out;
+}
+/** A stored value that exists but cannot be read now (see `DeviceKeyMirrorDeps.decode`). */
+var HELD_UNAVAILABLE = Symbol("held-unavailable");
+/**
+* One settings key across the fleet: loaded once, then written by diff.
+*
+* `replace` is authoritative (a camera the caller no longer holds loses the
+* key, but only if this mirror has SEEN it - it never deletes what it did not
+* load); `merge` only ever adds and changes.
+*/
+var DeviceKeyMirror = class {
+	deps;
+	/** The JSON of what the store holds per device, as of the last load or write. */
+	held = /* @__PURE__ */ new Map();
+	values = /* @__PURE__ */ new Map();
+	blocked = /* @__PURE__ */ new Map();
+	/** Cameras whose stored value is GONE: a load never re-blocks them. */
+	released = /* @__PURE__ */ new Set();
+	loaded = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Read the key of every camera that has it. THROWS when the store cannot be asked. */
+	async load() {
+		const ids = await this.deps.settings.listDeviceStoreIds();
+		const blobs = await this.deps.settings.readDeviceStoreBatch(ids);
+		const out = /* @__PURE__ */ new Map();
+		this.held.clear();
+		this.values.clear();
+		this.loaded = false;
+		this.blocked.clear();
+		for (const [deviceId, blob] of blobs) {
+			const stored = blob[this.deps.key];
+			if (stored === void 0) continue;
+			const value = this.deps.decode(stored);
+			if (value === HELD_UNAVAILABLE) {
+				if (!this.released.has(deviceId)) this.blocked.set(deviceId, stored);
+				continue;
+			}
+			if (value === null) {
+				this.deps.logger.warn("broker device state skipped - it does not parse", {
+					tags: { deviceId },
+					meta: { key: this.deps.key }
+				});
+				continue;
+			}
+			out.set(deviceId, value);
+			this.values.set(deviceId, value);
+			this.held.set(deviceId, JSON.stringify(this.deps.encode(value)));
+		}
+		this.loaded = true;
+		return out;
+	}
+	/** Cameras whose stored value exists but could not be read: never written, never replaced. */
+	heldDevices() {
+		return this.blocked;
+	}
+	/**
+	* Stop protecting a camera whose stored value is GONE (the secret was deleted
+	* or the keychain restored without it): there is nothing left to overwrite.
+	*/
+	release(deviceId) {
+		this.blocked.delete(deviceId);
+		this.released.add(deviceId);
+	}
+	/** Is this camera's token write (and restream URL) blocked right now? */
+	isBlocked(deviceId) {
+		return this.blocked.has(deviceId);
+	}
+	assertLoaded() {
+		if (!this.loaded) throw new Error(`broker device state "${this.deps.key}" was never loaded - refusing to write`);
+	}
+	async writeChanged(next) {
+		let written = 0;
+		for (const [deviceId, value] of next) {
+			if (this.blocked.has(deviceId)) continue;
+			const encoded = this.deps.encode(value);
+			const text = JSON.stringify(encoded);
+			if (this.held.get(deviceId) === text) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: encoded });
+			this.held.set(deviceId, text);
+			this.values.set(deviceId, value);
+			written += 1;
+		}
+		return written;
+	}
+	/** Make the store hold exactly `next` for the cameras this mirror knows. */
+	async replace(next) {
+		this.assertLoaded();
+		const written = await this.writeChanged(next);
+		let removed = 0;
+		for (const deviceId of [...this.held.keys()]) {
+			if (next.has(deviceId) || this.blocked.has(deviceId)) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+			this.held.delete(deviceId);
+			this.values.delete(deviceId);
+			removed += 1;
+		}
+		return {
+			written,
+			removed
+		};
+	}
+	/** Add or change; never remove. */
+	async merge(next) {
+		this.assertLoaded();
+		return this.writeChanged(next);
+	}
+	/** Drop one camera's key (a device that changed hardware under its number). */
+	async remove(deviceId) {
+		this.assertLoaded();
+		if (!this.held.has(deviceId) || this.blocked.has(deviceId)) return false;
+		await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+		this.held.delete(deviceId);
+		this.values.delete(deviceId);
+		return true;
+	}
+	/** What the store holds for the camera as of the last load or write. */
+	current(deviceId) {
+		return this.values.get(deviceId);
+	}
+	/** Whether a load has answered; a writer that was never loaded refuses. */
+	get isLoaded() {
+		return this.loaded;
+	}
 };
-function profileMapStore(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
-		spec: BROKER_PROFILE_MAP_SPEC,
-		store,
-		logger
+function parseWith(schema) {
+	return (stored) => {
+		const parsed = schema.safeParse(stored);
+		return parsed.success ? parsed.data : null;
+	};
+}
+function probeSnapshotsMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: PROBE_SNAPSHOTS_KEY,
+		logger,
+		decode: parseWith(ProbeSnapshotsOfDeviceSchema),
+		encode: (value) => value
+	});
+}
+function profileMapMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: BROKER_PROFILE_KEY,
+		logger,
+		decode: parseWith(ProfileAssignmentSchema),
+		encode: (value) => value
+	});
+}
+/** The tokens of one camera are ONE keychain-held text: JSON of `{ camStreamId: token }`. */
+function rtspTokensMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: RTSP_TOKENS_KEY,
+		logger,
+		decode: (stored) => {
+			if (require_dist.isSecretMarker(stored)) return HELD_UNAVAILABLE;
+			if (typeof stored !== "string") return null;
+			try {
+				const parsed = RtspTokensOfDeviceSchema.safeParse(JSON.parse(stored));
+				return parsed.success ? parsed.data : null;
+			} catch {
+				return null;
+			}
+		},
+		encode: (value) => JSON.stringify(value)
 	});
 }
 /**
-* The dead `addon-settings` / `root` keys. A CLAIM that each key is dead,
-* enforced by nothing else — the migration script names the same three, keep
-* the two in lockstep.
+* Fold freshly minted tokens (`<deviceId>/<camStreamId>` -> token) into what
+* each camera already holds. Only ever adds or changes: a token is stable
+* forever per stream unless explicitly regenerated.
 */
-var STREAM_BROKER_RETIRED_ROOT_KEYS = [
-	{
-		key: "probeSnapshots",
-		successor: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob it was 17 KB of the 33 KB root row, rewritten whole by the throttled metrics flush"
-	},
-	{
-		key: "rtspTokens",
-		successor: BROKER_RTSP_TOKENS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob a single minted token rewrote 33 KB"
-	},
-	{
-		key: "profileMap",
-		successor: BROKER_PROFILE_MAP_COLLECTION,
-		reason: "one row per camera since the flatten; a per-DEVICE map, so as a blob it grew with the fleet — 2.3 KB at 29 cameras, ~77 KB at 974"
-	}
-];
+function mergeRtspTokens(mirror, minted) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of groupByDevice(minted)) out.set(deviceId, {
+		...mirror.current(deviceId),
+		...group
+	});
+	return out;
+}
 //#endregion
 //#region src/stream-broker/live-viewers.ts
 /**
@@ -3089,6 +3134,223 @@ var RtpPacketizer = class {
 		};
 	}
 };
+function isTransferable(buf) {
+	return typeof Reflect.get(buf, "transfer") === "function";
+}
+var Slab = class {
+	now;
+	buffer;
+	offset = 0;
+	holds = 0;
+	state = "active";
+	releasedAt = 0;
+	constructor(buffer, now) {
+		this.now = now;
+		this.buffer = buffer;
+	}
+};
+/** ArrayBuffer -> slab, for every slab ArrayBuffer currently in service. */
+var slabOf = /* @__PURE__ */ new WeakMap();
+var slabsLive = 0;
+var slabsFree = 0;
+var slabAllocs = 0;
+var slabRecycles = 0;
+function readSlabTotals() {
+	return {
+		live: slabsLive,
+		free: slabsFree,
+		allocs: slabAllocs,
+		recycles: slabRecycles
+	};
+}
+/** True when `buf` is a view of a pool slab. */
+function isSlabView(buf) {
+	return slabOf.has(buf.buffer);
+}
+/** A retaining structure keeps `buf`: its slab cannot be recycled until released. */
+function holdPacket(buf) {
+	const slab = slabOf.get(buf.buffer);
+	if (slab === void 0) return;
+	slab.holds += 1;
+	if (slab.state === "quarantined") slab.state = "held";
+}
+/** The matching drop. Safe on a non-slab buffer and on a stale (recycled) view. */
+function releasePacket(buf) {
+	const slab = slabOf.get(buf.buffer);
+	if (slab === void 0 || slab.holds === 0) return;
+	slab.holds -= 1;
+	if (slab.holds === 0 && slab.state === "held") {
+		slab.state = "quarantined";
+		slab.releasedAt = slab.now();
+	}
+}
+function releasePackets(bufs) {
+	for (const b of bufs) releasePacket(b);
+}
+/**
+* A consumer's own hold on the last `limit` packets it forwarded.
+*
+* werift keeps the last RTP_HISTORY_SIZE (4096) packets of each sender for NACK
+* retransmission, and those packets' payloads are views of the broker's slabs.
+* The session mirrors that window here: each forwarded packet is held, and
+* the one falling out of the window is released, so a retransmit asked for
+* within the history is served from bytes nobody has recycled.
+*/
+var HeldPacketWindow = class {
+	limit;
+	slots;
+	next = 0;
+	constructor(limit) {
+		this.limit = limit;
+		this.slots = new Array(limit).fill(void 0);
+	}
+	hold(buf) {
+		holdPacket(buf);
+		const evicted = this.slots[this.next];
+		if (evicted !== void 0) releasePacket(evicted);
+		this.slots[this.next] = buf;
+		this.next = (this.next + 1) % this.limit;
+	}
+	releaseAll() {
+		for (let i = 0; i < this.slots.length; i++) {
+			const held = this.slots[i];
+			if (held !== void 0) releasePacket(held);
+			this.slots[i] = void 0;
+		}
+		this.next = 0;
+	}
+};
+var PacketSlabPool = class {
+	slabBytes;
+	maxPacket;
+	quarantineMs;
+	maxFree;
+	now;
+	active = null;
+	/** Sealed slabs, oldest first; entries may have been re-held since. */
+	sealed = [];
+	free = [];
+	allocs = 0;
+	recycles = 0;
+	ownBuffers = 0;
+	constructor(options = {}) {
+		this.slabBytes = options.slabBytes ?? 65536;
+		this.maxPacket = this.slabBytes >> 2;
+		this.quarantineMs = options.quarantineMs ?? 2e3;
+		this.maxFree = options.maxFree ?? 2;
+		this.now = options.now ?? Date.now;
+	}
+	/**
+	* A copy of `src[start, end)` in this pool's active slab. An oversized
+	* packet gets its own buffer (it owns its ArrayBuffer, like the old
+	* `copyOwned`).
+	*/
+	copy(src, start, end) {
+		const length = end - start;
+		recordCopyOwned(length);
+		if (length > this.maxPacket) {
+			this.ownBuffers += 1;
+			const own = Buffer.allocUnsafeSlow(length);
+			src.copy(own, 0, start, end);
+			return own;
+		}
+		let slab = this.active;
+		if (slab === null || slab.offset + length > this.slabBytes) slab = this.rotate();
+		const view = Buffer.from(slab.buffer, slab.offset, length);
+		src.copy(view, 0, start, end);
+		slab.offset += length;
+		return view;
+	}
+	/**
+	* `buf` itself when it is already owned (a slab view or a whole-ArrayBuffer
+	* buffer), else a copy in the active slab. Used for packets that arrive from
+	* paths that do not cut through {@link copy} (push-rtp).
+	*/
+	adopt(buf) {
+		if (isSlabView(buf)) return buf;
+		if (buf.byteOffset === 0 && buf.buffer.byteLength === buf.length) return buf;
+		return this.copy(buf, 0, buf.length);
+	}
+	stats() {
+		return {
+			live: this.sealed.length + (this.active === null ? 0 : 1),
+			free: this.free.length,
+			allocs: this.allocs,
+			recycles: this.recycles,
+			ownBuffers: this.ownBuffers
+		};
+	}
+	/** Drop every slab of this pool from the process counters (stream torn down). */
+	dispose() {
+		const live = this.sealed.length + (this.active === null ? 0 : 1);
+		slabsLive -= live;
+		slabsFree -= this.free.length;
+		this.sealed = [];
+		this.free = [];
+		this.active = null;
+	}
+	rotate() {
+		const previous = this.active;
+		if (previous !== null) {
+			this.sealed.push(previous);
+			if (previous.holds === 0) {
+				previous.state = "quarantined";
+				previous.releasedAt = this.now();
+			} else previous.state = "held";
+		}
+		this.reclaim();
+		const next = this.free.pop() ?? this.allocate();
+		if (next.state === "free") {
+			slabsFree -= 1;
+			slabsLive += 1;
+		}
+		next.state = "active";
+		next.offset = 0;
+		next.holds = 0;
+		this.active = next;
+		return next;
+	}
+	allocate() {
+		this.allocs += 1;
+		slabAllocs += 1;
+		slabsLive += 1;
+		const slab = new Slab(new ArrayBuffer(this.slabBytes), this.now);
+		slabOf.set(slab.buffer, slab);
+		return slab;
+	}
+	/** Move quarantined slabs whose time is up to the free list. */
+	reclaim() {
+		if (this.sealed.length === 0) return;
+		const cutoff = this.now() - this.quarantineMs;
+		const keep = [];
+		for (const slab of this.sealed) if (slab.state === "quarantined" && slab.releasedAt <= cutoff) this.recycle(slab);
+		else keep.push(slab);
+		this.sealed = keep;
+	}
+	recycle(slab) {
+		slabsLive -= 1;
+		if (this.free.length >= this.maxFree) {
+			slabOf.delete(slab.buffer);
+			slab.state = "free";
+			return;
+		}
+		const old = slab.buffer;
+		slabOf.delete(old);
+		slab.buffer = isTransferable(old) ? old.transfer() : new ArrayBuffer(this.slabBytes);
+		if (!isTransferable(old)) {
+			this.allocs += 1;
+			slabAllocs += 1;
+		}
+		slabOf.set(slab.buffer, slab);
+		slab.state = "free";
+		slab.offset = 0;
+		slab.holds = 0;
+		this.free.push(slab);
+		slabsFree += 1;
+		this.recycles += 1;
+		slabRecycles += 1;
+	}
+};
 //#endregion
 //#region src/stream-broker/stream-broker/owned-buffer.ts
 /**
@@ -3115,10 +3377,20 @@ function ownsBackingStore(buf) {
 }
 /**
 * What retaining `buf` really costs: its own length when it owns its
-* ArrayBuffer, the whole shared slab when it is a view of one.
+* ArrayBuffer (a packet slab is densely packed, so a slab view counts as its
+* own length too), the whole shared slab when it is a view of a pooled one.
+* The diagnostic `BackingTally` still sums the distinct ArrayBuffers.
 */
 function backingStoreBytes(buf) {
-	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
+	return ownsBackingStore(buf) || isSlabView(buf) ? buf.length : buf.buffer.byteLength;
+}
+/**
+* What `buf` PINS: its own length when it is the whole of its ArrayBuffer, the
+* whole ArrayBuffer otherwise — a packet slab view included. This is the
+* diagnostic figure (`BackingTally`); caps charge {@link backingStoreBytes}.
+*/
+function pinnedBackingBytes(buf) {
+	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length ? buf.length : buf.buffer.byteLength;
 }
 /**
 * `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
@@ -3167,7 +3439,7 @@ var BackingTally = class {
 		}
 		this.entries += 1;
 		this.payload += buf.length;
-		const backing = backingStoreBytes(buf);
+		const backing = pinnedBackingBytes(buf);
 		this.naive += backing;
 		if (!this.seen.has(buf.buffer)) {
 			this.seen.add(buf.buffer);
@@ -3460,6 +3732,7 @@ function formatBrokerMem(input) {
 	const w = input.worker;
 	if (w !== void 0 && w !== null) parts.push(`workers=${w.workers}`, `workerHeapMb=${mb(w.heapBytes)}`, `workerPhysicalMb=${mb(w.physicalBytes)}`, `workerUsedMb=${mb(w.usedBytes)}`, `workerAgeS=${Math.round(w.maxAgeMs / 1e3)}`, `workerIdleExit=${w.idleTerminates ? "yes" : "never"}`);
 	parts.push(`brokers=${samples.length}`, `ingesting=${ingesting}`, `annexBPlanes=${planes}`, `rtsp=${rtsp}`, `webrtc=${input.webrtcSessions}`, `encoded=${kindList(consumers)}`, `audioSubs=${audio}`, `pipeClients=${pipe}`, `egress=${input.egressTranscodes}`, `children=${input.childProcesses}`, `opened=${churn.opened}`, `closed=${churn.closed}`, `openedKinds=${kindList(churn.openedByKind)}`, `closedKinds=${kindList(churn.closedByKind)}`, `preBufferMb=${mb(pre)}`, `clipMb=${mb(clip)}`, `rtpRingMb=${mb(rtp)}`, `keyframeMb=${mb(kf)}`, `writeQueueSumMb=${mb(qSum)}`, `writeQueueMaxMb=${mb(qMax)}`, `copiedPackets=${copied.packets}`, `copiedMb=${mb(copied.bytes)}`, `topRingMb=${top === "" ? "none" : top}`);
+	if (input.slabs !== void 0) parts.push(`slabs=${input.slabs.live}/${input.slabs.free}`, `slabAllocs=${input.slabs.allocsDelta}`);
 	const sessions = input.sessions;
 	if (sessions !== void 0) parts.push(...formatSessionMem(sessions, input));
 	return parts.join(" ");
@@ -3849,8 +4122,7 @@ var RtspRestreamer = class {
 		this.mutedSdp = null;
 		this.deframer = null;
 		this.detectedCodec = null;
-		this.lastKeyframeRtpPackets = [];
-		this.lastKeyframeRtpBytes = 0;
+		this.dropKeyframeRtpCache();
 		this._rtpPassthroughMode = false;
 		this.collectingKeyframeRtp = false;
 		this.egressAudioBlock = null;
@@ -4203,21 +4475,21 @@ var RtspRestreamer = class {
 		if (isKeyframe || isParameterSet) {
 			if (!this.collectingKeyframeRtp) {
 				this.collectingKeyframeRtp = true;
-				this.lastKeyframeRtpPackets = [];
-				this.lastKeyframeRtpBytes = 0;
+				this.dropKeyframeRtpCache();
 			}
 		}
 		if (this.collectingKeyframeRtp && !isKeyframe && !isParameterSet) this.collectingKeyframeRtp = false;
 		if (this.collectingKeyframeRtp) {
+			const cached = isSlabView(rtpData) ? rtpData : detachFromPool(rtpData);
+			holdPacket(cached);
 			this.lastKeyframeRtpPackets.push({
-				data: detachFromPool(rtpData),
+				data: cached,
 				marker: rtpPacket.marker
 			});
 			this.lastKeyframeRtpBytes += rtpData.length;
 			if (this.lastKeyframeRtpBytes > MAX_KEYFRAME_CACHE_BYTES) {
 				this.warnCacheCapExceeded("rtp", this.lastKeyframeRtpBytes, this.lastKeyframeRtpPackets.length);
-				this.lastKeyframeRtpPackets = [];
-				this.lastKeyframeRtpBytes = 0;
+				this.dropKeyframeRtpCache();
 				this.collectingKeyframeRtp = false;
 			}
 		}
@@ -4655,6 +4927,7 @@ var RtspRestreamer = class {
 	}
 	destroy() {
 		this._onSessionCountChanged = null;
+		this.dropKeyframeRtpCache();
 		this.sentryAudioSilence?.release("restreamer destroyed");
 		this.abortAllReplays();
 		this.deframer?.flush();
@@ -4663,6 +4936,12 @@ var RtspRestreamer = class {
 		this.packetizer = null;
 		this.deframer = null;
 	}
+	/** Empty the keyframe RTP cache and let go of the slabs it pinned. */
+	dropKeyframeRtpCache() {
+		for (const cached of this.lastKeyframeRtpPackets) releasePacket(cached.data);
+		this.lastKeyframeRtpPackets = [];
+		this.lastKeyframeRtpBytes = 0;
+	}
 	/** Called by deframer for each complete NAL unit. */
 	handleNal(nal, isKeyframe) {
 		if (!this.codecParams) this.tryInitCodec(nal);
@@ -4792,6 +5071,13 @@ function resolveJoinBurstBound(input) {
 	};
 }
 //#endregion
+//#region src/stream-broker/stream-broker/held-write.ts
+/** Write `payload`, holding its slab until the write completes (or fails). */
+function writeHeld(sink, payload) {
+	holdPacket(payload);
+	return sink.write(payload, () => releasePacket(payload));
+}
+//#endregion
 //#region src/stream-broker/rtsp/rtsp-session.ts
 /**
 * Handles one RTSP client connection.
@@ -5107,15 +5393,17 @@ var RtspSession = class {
 	*
 	* ## Why sharing the payload is safe, and what would make it unsafe
 	*
-	* The payload buffer handed here is a private allocation per packet —
-	* `copyOwned(readBuffer, …)` in the readers' `onData`, for video and audio
-	* alike — never a view of the reader's socket buffer, which advances on the
-	* next read. Nothing in the broker writes into a captured packet: every
-	* mutation in this path targets a freshly allocated buffer. (The same object
-	* is what the broker's `rtpRing` and the restreamer's keyframe cache retain —
-	* it owns its backing store, so `detachFromPool` keeps it as is — and that is
-	* fine: a pending write holds its own reference, and the rule below is about
-	* mutation, not retention.)
+	* The payload is a view of the broker's packet slab (`slab-pool.ts`, D868),
+	* never of the reader's socket buffer, which advances on the next read.
+	* Nothing in the broker writes into a captured packet: every mutation in this
+	* path targets a freshly allocated buffer. A slab is RECYCLED once the
+	* broker's rings let go of it, and a queued socket write outlives that: Node
+	* keeps the chunk behind a full kernel buffer for as long as the peer takes to
+	* drain (seconds, for a recorder or a LAN decoder), and libuv reads the bytes
+	* only when it writes. So the payload goes out through `writeHeld`, which
+	* holds its slab until Node's write callback (success, error or destroy). A
+	* write that skipped the hold would send a header promising N bytes followed
+	* by zeros.
 	*
 	* The rule to keep: **`socket.write` forbids MUTATION before the write
 	* completes, not retention.** So the header, which IS built per call, must
@@ -5152,7 +5440,7 @@ var RtspSession = class {
 			process.nextTick(this.uncorkAccessUnit);
 		}
 		this.socket.write(header);
-		this.socket.write(payload);
+		writeHeld(this.socket, payload);
 		if (endOfAccessUnit) this.uncorkAccessUnit();
 		this.lastRtpAt = Date.now();
 		this.bytesSent += 4 + payload.length;
@@ -5289,6 +5577,18 @@ var RtspListenServer = class RtspListenServer {
 	brokerTokens = /* @__PURE__ */ new Map();
 	/** token → brokerId (reverse map) */
 	tokenBrokers = /* @__PURE__ */ new Map();
+	/**
+	* brokerId → INTERNAL loopback-only alias token (D870). A camera whose
+	* external restream token is held in an unreadable keychain has NO external
+	* URL, but the broker's own consumers (recording, decode, snapshots, grid,
+	* egress) still ride its restream: they get this ephemeral token, which is
+	* never persisted, never handed out through the consumer URL APIs, and only
+	* answers loopback / local-network peers.
+	*/
+	internalAliases = /* @__PURE__ */ new Map();
+	internalAliasTokens = /* @__PURE__ */ new Set();
+	/** Which peers may dial an internal alias; replaceable for tests. */
+	aliasPeerPolicy = isClusterLocalAddress;
 	/** brokerId → enabled (default true) */
 	brokerEnabled = /* @__PURE__ */ new Map();
 	/** brokerId → warm-up closure registered alongside the restreamer */
@@ -5319,7 +5619,37 @@ var RtspListenServer = class RtspListenServer {
 		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
 		return token;
 	}
+	/**
+	* Register (or refresh) the internal loopback-only alias of a broker. Returns
+	* its token. The external token map is untouched, so the alias can never be
+	* listed, persisted or surfaced as a consumer URL.
+	*/
+	registerInternalAlias(brokerId, restreamer, warmUp, sentryOpener) {
+		const token = this.internalAliases.get(brokerId) ?? RtspListenServer.generateToken();
+		this.restreamers.set(token, restreamer);
+		this.tokenBrokers.set(token, brokerId);
+		this.internalAliases.set(brokerId, token);
+		this.internalAliasTokens.add(token);
+		if (warmUp) this.brokerWarmUps.set(brokerId, warmUp);
+		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
+		return token;
+	}
+	/** Replace the peer policy of the internal aliases (tests only). */
+	setAliasPeerPolicy(policy) {
+		this.aliasPeerPolicy = policy;
+	}
+	/** The token an IN-PROCESS consumer dials: the internal alias when there is one, else the external token. */
+	getInternalToken(brokerId) {
+		return this.internalAliases.get(brokerId) ?? this.brokerTokens.get(brokerId);
+	}
 	unregisterRestreamer(brokerId) {
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			this.internalAliases.delete(brokerId);
+		}
 		const token = this.brokerTokens.get(brokerId);
 		if (token) {
 			this.restreamers.delete(token);
@@ -5341,6 +5671,17 @@ var RtspListenServer = class RtspListenServer {
 		this.restreamers.set(newToken, restreamer);
 		this.brokerTokens.set(brokerId, newToken);
 		this.tokenBrokers.set(newToken, brokerId);
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			const newAlias = RtspListenServer.generateToken();
+			this.restreamers.set(newAlias, restreamer);
+			this.tokenBrokers.set(newAlias, brokerId);
+			this.internalAliases.set(brokerId, newAlias);
+			this.internalAliasTokens.add(newAlias);
+		}
 		return newToken;
 	}
 	/** Get the current token for a broker. */
@@ -5424,6 +5765,11 @@ var RtspListenServer = class RtspListenServer {
 			socket.destroy();
 			return;
 		}
+		if (this.internalAliasTokens.has(lookupPath) && !this.aliasPeerPolicy(socket.remoteAddress)) {
+			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
+			socket.destroy();
+			return;
+		}
 		const brokerId = this.tokenBrokers.get(lookupPath);
 		if (brokerId && !this.isEnabled(brokerId)) {
 			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
@@ -5482,6 +5828,24 @@ var RtspListenServer = class RtspListenServer {
 		});
 	}
 };
+/**
+* Is the peer on the loopback interface or the local network (RFC 1918, link-local,
+* ULA)? The internal alias answers only these: a recorder or decoder on another
+* node of the cluster is a legitimate consumer, the public internet is not.
+*/
+function isClusterLocalAddress(address) {
+	if (address === void 0) return false;
+	const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+	if (v4 === "::1") return true;
+	const m = /^(\d+)\.(\d+)\.\d+\.\d+$/.exec(v4);
+	if (m !== null) {
+		const a = Number(m[1]);
+		const b = Number(m[2]);
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+	}
+	const lower = address.toLowerCase();
+	return lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd");
+}
 //#endregion
 //#region src/stream-broker/rtsp/rtsp-restream-provider.ts
 /**
@@ -5563,6 +5927,24 @@ var RtspRestreamProviderImpl = class {
 			enabled: this.server.isEnabled(brokerId)
 		};
 	}
+	/**
+	* The entry an IN-PROCESS consumer dials (recording, decode, snapshots, grid,
+	* egress): the loopback-only internal alias when the camera's external token
+	* is held back (D870), else the external entry. NEVER hand this out through a
+	* consumer URL API - use {@link getEntry} for that.
+	*/
+	getInternalEntry(brokerId, hostname) {
+		const token = this.server.getInternalToken(brokerId);
+		if (!token) return null;
+		const port = this.server.getPort();
+		const host = hostname ?? "127.0.0.1";
+		return {
+			brokerId,
+			url: `rtsp://${host}:${port}/${token}`,
+			mutedUrl: `rtsp://${host}:${port}/${token}/muted`,
+			enabled: this.server.isEnabled(brokerId)
+		};
+	}
 	regenerateToken(brokerId) {
 		const token = this.server.regenerateToken(brokerId);
 		if (token) {
@@ -10515,6 +10897,7 @@ var Rfc4571Reader = class {
 	options;
 	callbacks;
 	logger;
+	allocatePacket;
 	host;
 	port;
 	authLine;
@@ -10528,6 +10911,7 @@ var Rfc4571Reader = class {
 	constructor(options, callbacks) {
 		this.options = options;
 		this.callbacks = callbacks;
+		this.allocatePacket = options.packetAllocator ?? copyOwned;
 		this.logger = options.logger;
 		const parsed = new URL(options.url);
 		this.host = parsed.hostname;
@@ -10592,7 +10976,7 @@ var Rfc4571Reader = class {
 		while (this.readBuffer.length >= 2) {
 			const length = this.readBuffer.readUInt16BE(0);
 			if (this.readBuffer.length < 2 + length) return;
-			const rtpPacket = copyOwned(this.readBuffer, 2, 2 + length);
+			const rtpPacket = this.allocatePacket(this.readBuffer, 2, 2 + length);
 			this.readBuffer = this.readBuffer.subarray(2 + length);
 			this.dispatchRtp(rtpPacket);
 		}
@@ -11113,6 +11497,7 @@ var NativeRtspClient = class {
 	keepaliveIntervalMs;
 	logger;
 	callbacks;
+	allocatePacket;
 	/** Parsed SDP from DESCRIBE response. */
 	parsedSdp = null;
 	rawSdpText = null;
@@ -11139,6 +11524,7 @@ var NativeRtspClient = class {
 	tornDown = false;
 	constructor(options, callbacks) {
 		this.callbacks = callbacks;
+		this.allocatePacket = options.packetAllocator ?? copyOwned;
 		this.logger = options.logger;
 		this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
 		this.keepaliveIntervalMs = options.keepaliveIntervalMs ?? DEFAULT_KEEPALIVE_INTERVAL_MS;
@@ -11311,7 +11697,7 @@ var NativeRtspClient = class {
 			const channel = this.readBuffer[1];
 			const length = this.readBuffer.readUInt16BE(2);
 			if (this.readBuffer.length < 4 + length) return;
-			const payload = copyOwned(this.readBuffer, 4, 4 + length);
+			const payload = this.allocatePacket(this.readBuffer, 4, 4 + length);
 			this.readBuffer = this.readBuffer.subarray(4 + length);
 			this.handleInterleavedPacket(channel, payload);
 		} else {
@@ -11766,7 +12152,7 @@ var AudioCodecSession = class {
 	processPacket(rtpData) {
 		if (this.closed) return;
 		if (rtpData.length <= RTP_HEADER_LENGTH) return;
-		const payload = rtpData.subarray(RTP_HEADER_LENGTH);
+		const payload = Buffer.from(rtpData.subarray(RTP_HEADER_LENGTH));
 		this.packetsIn++;
 		this.ensureSession().then((sid) => {
 			if (!sid || this.closed) return;
@@ -13384,6 +13770,13 @@ var StreamBroker = class StreamBroker {
 	* Only populated for RTP sources (`isRtpSource()`).
 	*/
 	rtpRing = [];
+	/**
+	* Where this stream's source packets are cut (`slab-pool.ts`, D868): the
+	* readers copy into the pool's slabs, the ring and the restreamer's keyframe
+	* cache hold/release them, and a slab no ring holds is recycled.
+	*/
+	packetPool = new PacketSlabPool();
+	packetAllocator = (src, start, end) => this.packetPool.copy(src, start, end);
 	rtpRingCurAuStart = 0;
 	rtpRingPrevMarker = true;
 	rtpRingHasKeyframe = false;
@@ -13904,6 +14297,8 @@ var StreamBroker = class StreamBroker {
 		this.annexBAssembler.reset();
 		this.encodedCallbacks.clear();
 		this.audioChunkPlane.dispose();
+		this.resetRtpPreBuffer();
+		this.packetPool.dispose();
 	}
 	/** Whether the broker is currently suspended (idle, no RTSP connection). */
 	get suspended() {
@@ -14658,7 +15053,8 @@ var StreamBroker = class StreamBroker {
 	captureRtpForPreBuffer(rtpData) {
 		const marker = rtpData.length > 1 && (rtpData[1] & 128) !== 0;
 		if (this.rtpRingPrevMarker || this.rtpRing.length === 0) this.rtpRingCurAuStart = this.rtpRing.length;
-		const owned = detachFromPool(rtpData);
+		const owned = this.packetPool.adopt(rtpData);
+		holdPacket(owned);
 		this.rtpRing.push(owned);
 		this.rtpRingBytes += backingStoreBytes(owned);
 		if (this._lastNalParamSet || this._lastNalKeyframe) {
@@ -14754,6 +15150,7 @@ var StreamBroker = class StreamBroker {
 	* non-decodable slice instead of waiting for the new dial's first keyframe.
 	*/
 	resetRtpPreBuffer() {
+		releasePackets(this.rtpRing);
 		this.rtpRing = [];
 		this.rtpRingBytes = 0;
 		this.rtpRingCurAuStart = 0;
@@ -14850,6 +15247,7 @@ var StreamBroker = class StreamBroker {
 		if (cut <= 0) return;
 		const dropped = this.rtpRing.splice(0, cut);
 		for (const b of dropped) this.rtpRingBytes -= backingStoreBytes(b);
+		releasePackets(dropped);
 		this.rtpRingKeyframeMarks = this.rtpRingKeyframeMarks.filter((mark) => mark.index >= cut).map((mark) => ({
 			index: mark.index - cut,
 			ts: mark.ts
@@ -15530,7 +15928,7 @@ var StreamBroker = class StreamBroker {
 				this.audioRtpDecoder?.processPacket(rtpData);
 				if (this.hasAudioConsumer()) this.audioCodecSession?.processPacket(rtpData);
 				if ((this.audioCodec === "PCMU" || this.audioCodec === "PCMA") && this.encodedCallbacks.size > 0 && rtpData.length > 12) {
-					const payload = rtpData.subarray(12);
+					const payload = Buffer.from(rtpData.subarray(12));
 					if (payload.length > 0) {
 						const rtpTimestamp = rtpData.readUInt32BE(4);
 						const pts = Math.floor(rtpTimestamp / 8);
@@ -15593,7 +15991,8 @@ var StreamBroker = class StreamBroker {
 		this.logger?.info("starting native RTSP reader");
 		const client = new NativeRtspClient({
 			url: source.url,
-			logger: this.logger?.child("rtsp-native")
+			logger: this.logger?.child("rtsp-native"),
+			packetAllocator: this.packetAllocator
 		}, this.buildRtpStreamCallbacks("native RTSP", () => this.destroyNativeClient(), () => this.nativeClient !== client));
 		this.nativeClient = client;
 		client.connect().catch((err) => {
@@ -16100,7 +16499,8 @@ var StreamBroker = class StreamBroker {
 		const reader = new Rfc4571Reader({
 			url: source.url,
 			sdp,
-			...this.logger ? { logger: this.logger.child("rfc4571") } : {}
+			...this.logger ? { logger: this.logger.child("rfc4571") } : {},
+			packetAllocator: this.packetAllocator
 		}, this.buildRtpStreamCallbacks("rfc4571", () => this.destroyRfc4571Reader(), () => this.rfc4571Reader !== reader));
 		this.rfc4571Reader = reader;
 		reader.connect().catch((err) => {
@@ -17278,6 +17678,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 	rtspProvider;
 	persistedTokens = /* @__PURE__ */ new Map();
 	/**
+	* True for a camera whose restream tokens are held in an unreadable keychain
+	* (D870). Such a camera gets NO restream URL - minting a temporary token would
+	* hand consumers a URL that dies as soon as the real one is restored - while
+	* every other camera, and the camera's own streams and recording, are
+	* untouched.
+	*/
+	restreamGate = () => false;
+	/**
 	* Last runtime probe per broker, captured while the broker was streaming.
 	* Survives the stream going idle so the per-stream "Probed" settings field
 	* stays populated (with an "as of" tag). In-memory only — repopulates on the
@@ -17477,7 +17885,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			hwaccel: this.hwaccel ?? void 0,
 			cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 			rtspEntryLookup: (brokerId) => {
-				const entry = this.rtspProvider.getEntry(brokerId);
+				const entry = this.rtspProvider.getInternalEntry(brokerId);
 				return entry ? {
 					url: entry.url,
 					mutedUrl: entry.mutedUrl
@@ -17536,7 +17944,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 				cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 				resolveProfileSource: (deviceId, profile) => this.assignments.get(deviceId)?.map[profile] ?? null,
 				rtspEntryLookup: (brokerId) => {
-					const entry = this.rtspProvider.getEntry(brokerId);
+					const entry = this.rtspProvider.getInternalEntry(brokerId);
 					return entry ? { url: entry.url } : null;
 				},
 				sourceHasMedia: (brokerId) => {
@@ -18600,6 +19008,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 	loadPersistedTokens(tokens) {
 		this.persistedTokens = new Map(tokens);
 	}
+	/** See {@link restreamGate}. */
+	setRestreamGate(gate) {
+		this.restreamGate = gate;
+	}
+	/**
+	* Register the restream URLs of ONE camera now (its tokens became readable, or
+	* were issued fresh): each of its source brokers and the profile restreamers
+	* over them. No broker is torn down or recreated, so nothing stops recording.
+	*/
+	registerRestreamersForDevice(deviceId) {
+		if (this.restreamGate(deviceId)) return;
+		for (const [brokerId, broker] of this.brokers) if (brokerId.startsWith(`${deviceId}/`)) this.registerSourceRestreamer(brokerId, broker);
+		this.syncProfileRestreamers(deviceId);
+	}
 	/** Upsert a single SOURCE (non-derived) cam-stream into the registry
 	*  WITHOUT ranking or broker creation. Returns the prior entry (if any)
 	*  so callers can detect url refresh / already-existed. */
@@ -19343,6 +19765,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 		return { success: true };
 	}
 	/**
+	* Drop a DELETED camera's whole override entry and persist (D870). The
+	* device-removal hook's one reach into the override map; `forgetDeviceHardware`
+	* keeps the entry's non-hardware fields, a deleted camera keeps nothing.
+	*/
+	dropDeviceOverride(deviceId) {
+		if (!this.deviceOverrides.delete(deviceId)) return false;
+		this.deviceOverridePersister?.(this.deviceOverrides);
+		return true;
+	}
+	/** Cameras that have an override entry. */
+	listDeviceOverrideIds() {
+		return [...this.deviceOverrides.keys()];
+	}
+	/**
 	* The hardware behind `deviceId` was replaced (`deviceManager.migrateDevice`)
 	* — forget everything this broker knows that described the OLD box. See the
 	* cap doc for the inventory. What deliberately SURVIVES is the role-scoped
@@ -20121,6 +20557,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			const sourceBrokerId = brokerIdFor(deviceId, camStreamId);
 			const sourceBroker = this.brokers.get(sourceBrokerId);
 			if (!sourceBroker) continue;
+			if (this.restreamGate(deviceId)) continue;
 			const existingToken = this.persistedTokens.get(profileBrokerId);
 			const warmUp = () => sourceBroker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
 			const openPrestreamWindow = () => sourceBroker.openPrestreamWindow();
@@ -21780,11 +22217,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 		this.brokers.set(brokerId, broker);
 		this.applyClipRetention(deviceId);
-		const existingToken = this.persistedTokens.get(brokerId);
-		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
-		const openPrestreamWindow = () => broker.openPrestreamWindow();
-		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
-		if (!existingToken) this.rtspProvider.persistTokens();
+		this.registerSourceRestreamer(brokerId, broker);
 		await this.fanOutRegistration(deviceId, brokerId, cam, broker);
 		this.syncProfileRestreamers(deviceId);
 		if (cam.kind === "derived") {
@@ -21793,6 +22226,28 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 	}
 	/**
+	* Register one source broker's RTSP restreamer with its persisted token (or a
+	* freshly minted one). A camera whose tokens are held in an unreadable keychain
+	* gets no EXTERNAL token, only the internal loopback-only alias.
+	*/
+	registerSourceRestreamer(brokerId, broker) {
+		const deviceId = parseBrokerId(brokerId)?.deviceId;
+		if (deviceId === void 0) return;
+		if (this.restreamGate(deviceId)) {
+			this.logger.warn("external restream URL withheld - the tokens are held but unreadable", {
+				tags: { deviceId },
+				meta: { brokerId }
+			});
+			this.rtspServer.registerInternalAlias(brokerId, broker.getRtspRestreamer(), () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION), () => broker.openPrestreamWindow());
+			return;
+		}
+		const existingToken = this.persistedTokens.get(brokerId);
+		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
+		const openPrestreamWindow = () => broker.openPrestreamWindow();
+		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
+		if (!existingToken) this.rtspProvider.persistTokens();
+	}
+	/**
 	* Tear down the broker for a `(deviceId, camStreamId)` pair. No-op
 	* when no broker exists. Called by `retractCameraStream` and by the
 	* teardown half of `restartBroker`.
@@ -21912,7 +22367,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			};
 		} else {
 			const sourceBrokerId = brokerIdFor(deviceId, request.camStreamId);
-			const entry = this.rtspProvider.getEntry(sourceBrokerId, "127.0.0.1");
+			const entry = this.rtspProvider.getInternalEntry(sourceBrokerId, "127.0.0.1");
 			if (!entry) throw new Error(`derived source camStream loopback unavailable: ${sourceBrokerId}`);
 			loopbackUrl = entry.url;
 			release = async () => {};
@@ -22690,19 +23145,19 @@ var H265Repacketizer = class {
 		return this.codecInfo;
 	}
 	updateVps(vps) {
-		this.ensureCodecInfo().vps = vps;
+		this.ensureCodecInfo().vps = Buffer.from(vps);
 	}
 	updateSps(sps) {
-		this.ensureCodecInfo().sps = sps;
+		this.ensureCodecInfo().sps = Buffer.from(sps);
 	}
 	updatePps(pps) {
-		this.ensureCodecInfo().pps = pps;
+		this.ensureCodecInfo().pps = Buffer.from(pps);
 	}
 	updateSeiPrefix(sei) {
-		this.ensureCodecInfo().seiPrefix = sei;
+		this.ensureCodecInfo().seiPrefix = Buffer.from(sei);
 	}
 	updateSeiSuffix(sei) {
-		this.ensureCodecInfo().seiSuffix = sei;
+		this.ensureCodecInfo().seiSuffix = Buffer.from(sei);
 	}
 	shouldFilter(_nalType) {
 		return false;
@@ -23013,6 +23468,48 @@ var H265Repacketizer = class {
 		}
 	}
 };
+//#endregion
+//#region src/stream-broker/webrtc/output-arena.ts
+/**
+* A bump allocator for the buffers the WebRTC send path builds per packet
+* (repacketizer outputs, STAP-A aggregates).
+*
+* `Buffer.from([...])` and `Buffer.concat` below 4 KiB are served from Node's
+* shared 8 KiB pool: one ~1.2 KB fragment per pool slab share, interleaved
+* with every other short-lived pooled buffer in the process. werift keeps the
+* last RTP_HISTORY_SIZE (4096) outputs of a sender for NACK, so each pinned
+* the shared slab it came from and everything beside it. Here every output is
+* a dense view of an arena that holds nothing else.
+*
+* Nothing is ever reused: an arena is left to the GC once full, and lives as
+* long as the last view of it (a NACK slot, a datagram still in flight). That
+* is why there is no hold/release protocol here, unlike `slab-pool.ts`.
+*/
+/** Bytes per arena: ~50 packets of ~1.2 KB per allocation instead of one per 6. */
+var OUTPUT_ARENA_BYTES = 64 * 1024;
+/** A request larger than a quarter of an arena gets its own buffer. */
+var OUTPUT_ARENA_MAX_REQUEST = 16384;
+var OutputArena = class {
+	chunk = Buffer.allocUnsafeSlow(0);
+	offset = 0;
+	chunks = 0;
+	/** `size` writable bytes (contents unspecified: the caller fills all of them). */
+	take(size) {
+		if (size > OUTPUT_ARENA_MAX_REQUEST) return Buffer.allocUnsafeSlow(size);
+		if (this.offset + size > this.chunk.length) {
+			this.chunk = Buffer.allocUnsafeSlow(OUTPUT_ARENA_BYTES);
+			this.chunks += 1;
+			this.offset = 0;
+		}
+		const out = this.chunk.subarray(this.offset, this.offset + size);
+		this.offset += size;
+		return out;
+	}
+	/** ArrayBuffers allocated by this arena so far. */
+	get allocations() {
+		return this.chunks;
+	}
+};
 var NAL_HEADER_SIZE = 1;
 var FU_A_HEADER_SIZE = 2;
 var LENGTH_FIELD_SIZE = 2;
@@ -23057,6 +23554,8 @@ var H264Repacketizer = class {
 	pendingFuA;
 	stapa;
 	fuaMin;
+	/** Dense home for every buffer this repacketizer builds (`output-arena.ts`). */
+	arena = new OutputArena();
 	constructor(console, maxPacketSize, codecInfo, jitterBuffer = new JitterBuffer(console, 4)) {
 		this.console = console;
 		this.maxPacketSize = maxPacketSize;
@@ -23074,70 +23573,78 @@ var H264Repacketizer = class {
 		return this.codecInfo;
 	}
 	updateSps(sps) {
-		this.ensureCodecInfo().sps = sps;
+		this.ensureCodecInfo().sps = Buffer.from(sps);
 	}
 	updatePps(pps) {
-		this.ensureCodecInfo().pps = pps;
+		this.ensureCodecInfo().pps = Buffer.from(pps);
 	}
 	updateSei(sei) {
-		this.ensureCodecInfo().sei = sei;
+		this.ensureCodecInfo().sei = Buffer.from(sei);
 	}
 	shouldFilter(_nalType) {
 		return false;
 	}
 	packetizeFuA(data, noStart, noEnd) {
+		let nalHeader;
+		let bodyStart;
 		if ((data[0] & 31) === 28) {
-			const fnri = data[0] & 224;
-			const originalNalType = data[1] & 31;
 			const isFuStart = !!(data[1] & 128);
 			const isFuEnd = !!(data[1] & 64);
-			const isFuMiddle = !isFuStart && !isFuEnd;
-			const originalNalHeader = Buffer.from([fnri | originalNalType]);
-			data = Buffer.concat([originalNalHeader, data.subarray(FU_A_HEADER_SIZE)]);
+			nalHeader = data[0] & 224 | data[1] & 31;
+			bodyStart = FU_A_HEADER_SIZE;
 			if (isFuStart) noEnd = true;
 			else if (isFuEnd) noStart = true;
-			else if (isFuMiddle) {
+			else {
 				noStart = true;
 				noEnd = true;
 			}
+		} else {
+			nalHeader = data[0];
+			bodyStart = NAL_HEADER_SIZE;
 		}
-		const fnri = data[0] & 224;
-		const nalType = data[0] & 31;
-		const fuIndicator = fnri | 28;
-		const fuHeaderMiddle = Buffer.from([fuIndicator, nalType]);
-		const fuHeaderStart = noStart ? fuHeaderMiddle : Buffer.from([fuIndicator, nalType | 128]);
-		const fuHeaderEnd = noEnd ? fuHeaderMiddle : Buffer.from([fuIndicator, nalType | 64]);
-		let fuHeader = fuHeaderStart;
+		const nalType = nalHeader & 31;
+		const fuIndicator = nalHeader & 224 | 28;
+		const startHeader = noStart ? nalType : nalType | 128;
+		const endHeader = noEnd ? nalType : nalType | 64;
 		const packages = [];
-		let offset = NAL_HEADER_SIZE;
+		let offset = bodyStart;
+		let first = true;
 		while (offset < data.length) {
 			const packageSize = Math.min(this.fuaMax, data.length - offset);
-			const payload = data.subarray(offset, offset + packageSize);
+			const last = offset + packageSize === data.length;
+			const out = this.arena.take(FU_A_HEADER_SIZE + packageSize);
+			out[0] = fuIndicator;
+			out[1] = last ? endHeader : first ? startHeader : nalType;
+			data.copy(out, FU_A_HEADER_SIZE, offset, offset + packageSize);
+			packages.push(out);
 			offset += packageSize;
-			if (offset === data.length) fuHeader = fuHeaderEnd;
-			packages.push(Buffer.concat([fuHeader, payload]));
-			fuHeader = fuHeaderMiddle;
+			first = false;
 		}
 		return packages;
 	}
 	packetizeOneStapA(datas) {
-		const payload = [];
 		if (!datas.length) throw new Error("packetizeOneStapA requires at least one NAL");
-		let counter = 0;
+		const taken = [];
 		let availableSize = this.maxPacketSize - STAP_A_HEADER_SIZE;
 		const stapHeader = 24;
-		while (datas.length && datas[0].length + LENGTH_FIELD_SIZE <= availableSize && counter < 9) {
+		while (datas.length && datas[0].length + LENGTH_FIELD_SIZE <= availableSize && taken.length < 9) {
 			const nalu = datas.shift();
 			availableSize -= LENGTH_FIELD_SIZE + nalu.length;
-			counter += 1;
-			const packed = Buffer.alloc(2);
-			packed.writeUInt16BE(nalu.length, 0);
-			payload.push(packed, nalu);
+			taken.push(nalu);
+		}
+		if (taken.length === 0) return datas.shift();
+		if (taken.length === 1) return taken[0];
+		let total = 1;
+		for (const nalu of taken) total += LENGTH_FIELD_SIZE + nalu.length;
+		const out = this.arena.take(total);
+		out[0] = stapHeader;
+		let offset = 1;
+		for (const nalu of taken) {
+			out.writeUInt16BE(nalu.length, offset);
+			nalu.copy(out, offset + LENGTH_FIELD_SIZE);
+			offset += LENGTH_FIELD_SIZE + nalu.length;
 		}
-		if (counter === 0) return datas.shift();
-		if (counter === 1) return payload[1];
-		payload.unshift(Buffer.from([stapHeader]));
-		return Buffer.concat(payload);
+		return out;
 	}
 	packetizeStapA(datas) {
 		const ret = [];
@@ -23169,12 +23676,15 @@ var H264Repacketizer = class {
 		const originalNalType = first.payload[1] & 31;
 		const hasFuStart = !!(first.payload[1] & 128);
 		const hasFuEnd = !!(last.payload[1] & 64);
-		const fnri = first.payload[0] & 224;
-		const originalNalHeader = Buffer.from([fnri | originalNalType]);
+		const originalNalHeader = first.payload[0] & 224 | originalNalType;
 		const getDefragmentedPendingFua = () => {
-			const originalFragments = pending.map((packet) => packet.payload.subarray(FU_A_HEADER_SIZE));
-			originalFragments.unshift(originalNalHeader);
-			return Buffer.concat(originalFragments);
+			let total = NAL_HEADER_SIZE;
+			for (const packet of pending) total += packet.payload.length - FU_A_HEADER_SIZE;
+			const out = this.arena.take(total);
+			out[0] = originalNalHeader;
+			let offset = NAL_HEADER_SIZE;
+			for (const packet of pending) offset += packet.payload.copy(out, offset, FU_A_HEADER_SIZE);
+			return out;
 		};
 		if (originalNalType === 7) {
 			const splits = splitH264NaluStartCode(getDefragmentedPendingFua());
@@ -23699,6 +24209,8 @@ function selectAudioClock(mimeType) {
 */
 /** A REMB unchanged this long is no estimate (`RembWatch`). */
 var REMB_STALE_MS = 3e4;
+/** werift's NACK history depth (patched RTP_HISTORY_SIZE, `patches/werift+0.22.9.patch`). */
+var SOURCE_RTP_HOLD_PACKETS = 4096;
 var _werift;
 async function loadWerift() {
 	if (_werift) return _werift;
@@ -24246,6 +24758,8 @@ var AdaptiveSession = class AdaptiveSession {
 	*  recovery). While active, live source-RTP packets are enqueued behind
 	*  the replay tail to preserve packet order. Aborted on close/rebind. */
 	activeRtpReplay = null;
+	/** The source packets werift's NACK history may still read (`slab-pool.ts`). */
+	sourceRtpHold = new HeldPacketWindow(SOURCE_RTP_HOLD_PACKETS);
 	/**
 	* Trickle ICE: the server's locally-gathered candidates, buffered as werift
 	* surfaces them via `onIceCandidate`. The client polls `getIceCandidates`
@@ -25124,6 +25638,7 @@ var AdaptiveSession = class AdaptiveSession {
 			this.activeRtpReplay.abort();
 			this.activeRtpReplay = null;
 		}
+		this.sourceRtpHold.releaseAll();
 		await this.releaseTranscodeEgress();
 		try {
 			await this.source.return(void 0);
@@ -25257,6 +25772,7 @@ var AdaptiveSession = class AdaptiveSession {
 			} });
 			return false;
 		}
+		this.sourceRtpHold.hold(rtpData);
 		if (this.sourceVideoSsrc === null) this.sourceVideoSsrc = srcPkt.header.ssrc;
 		const pt = this.videoSender.codec?.payloadType ?? (codec === "H265" ? 97 : 96);
 		let outPkts;
@@ -37862,6 +38378,16 @@ function dialAnswerFromError(err) {
 }
 //#endregion
 //#region src/stream-broker/broker-mem-report.ts
+function readSlabReading() {
+	const totals = readSlabTotals();
+	const allocsDelta = totals.allocs - lastSlabAllocs;
+	lastSlabAllocs = totals.allocs;
+	return {
+		live: totals.live,
+		free: totals.free,
+		allocsDelta
+	};
+}
 /** Linux only: elsewhere (or on a read error) the native view is simply absent. */
 async function readProc() {
 	if (process.platform !== "linux") return {
@@ -37874,6 +38400,8 @@ async function readProc() {
 		maps
 	};
 }
+/** `slabAllocs` is a delta: the totals the previous line saw. */
+var lastSlabAllocs = readSlabTotals().allocs;
 async function emitOnce(deps) {
 	const now = Date.now();
 	const [proc, worker] = await Promise.all([readProc(), readDemuxWorkerHeaps(now)]);
@@ -37886,6 +38414,7 @@ async function emitOnce(deps) {
 		proc,
 		churn: consumerChurn.drain(),
 		copied: readCopyOwnedTotals(),
+		slabs: readSlabReading(),
 		v8: readV8Heap(),
 		worker,
 		sessions: deps.sessionMem(),
@@ -37973,18 +38502,177 @@ function subscribeDeviceRemoval(subscribe, deps) {
 	});
 }
 //#endregion
+//#region src/stream-broker/device-removal-hook.ts
+/**
+* The stream-broker's `device-removal-hook` (D870).
+*
+* What the broker keeps PER CAMERA is a key of the camera's own settings
+* (`probeSnapshots`, `brokerProfile`, `rtspTokens` - see `broker-device-state.ts`),
+* and the central device delete (D865) clears those for every addon. What is
+* left is the broker's live state and its one addon-level map keyed by camera,
+* `deviceOverrides`: the hook retracts the camera's streams, purges its slot
+* assignments and drops its override entry. Idempotent - a camera with nothing
+* left answers zero counts.
+*/
+function createBrokerRemovalHook(deps) {
+	return {
+		onDeviceRemoved: async (input) => {
+			const { deviceId } = input;
+			try {
+				await deps.retractDevice(deviceId);
+			} catch (err) {
+				deps.logger.warn("stream-broker: retract of a deleted device failed", {
+					tags: { deviceId },
+					meta: { error: require_dist.errMsg(err) }
+				});
+				throw err;
+			}
+			const overrides = deps.dropDeviceOverride(deviceId) ? 1 : 0;
+			if (overrides > 0) deps.logger.info("stream-broker: removed the override of a deleted device", {
+				tags: { deviceId },
+				meta: { deletedAt: input.deletedAt }
+			});
+			return { counts: { "device-overrides": overrides } };
+		},
+		listDeviceData: async () => deps.overrideDeviceIds().filter((deviceId) => Number.isInteger(deviceId) && deviceId > 0).map((deviceId) => ({
+			store: "device-overrides",
+			deviceId,
+			count: 1
+		}))
+	};
+}
+/** Classify every held camera against the keychain: wait for it, or give up on the value. */
+async function classifyHeld(held, secrets) {
+	const refs = /* @__PURE__ */ new Map();
+	for (const [deviceId, stored] of held) if (require_dist.isSecretMarker(stored)) refs.set(deviceId, stored.$secret);
+	if (refs.size === 0) return [];
+	const resolved = await secrets.resolve([...refs.values()]);
+	const out = [];
+	for (const [deviceId, ref] of refs) {
+		const entry = resolved[ref];
+		if (entry === void 0 || entry.kind === "unavailable") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: entry?.kind === "unavailable" ? entry.reason : null
+		});
+		else if (entry.kind === "missing") out.push({
+			deviceId,
+			ref,
+			kind: "missing",
+			reason: null
+		});
+		else if (entry.kind === "forbidden") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: "forbidden"
+		});
+	}
+	return out;
+}
+var UNAVAILABLE_TEXT = "The camera's RTSP restream URLs are unavailable (consumers such as Home Assistant or an NVR get errors) until the keychain is readable. Its streams and recording are not affected.";
+var issuedText = (deviceId) => `New RTSP restream URLs were issued for camera ${deviceId} - update the consumers (NVR, Home Assistant). The previous tokens were lost: the keychain no longer holds them.`;
+var TokenRecovery = class {
+	deps;
+	/** Cameras alerted as unavailable: the alert is cleared when the value resolves. */
+	waiting = /* @__PURE__ */ new Set();
+	/** Consecutive `missing` reads per camera (D49: two before the value is given up). */
+	missingReads = /* @__PURE__ */ new Map();
+	timer = null;
+	running = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Cameras currently blocked. */
+	blocked() {
+		return [...this.deps.mirror.heldDevices().keys()].toSorted((a, b) => a - b);
+	}
+	/** Check now, then on a timer while any camera is still held. */
+	start() {
+		if (this.timer !== null) return;
+		this.tick();
+		this.timer = setInterval(() => void this.tick(), this.deps.recheckMs ?? 3e4);
+		this.timer.unref?.();
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+	}
+	/** One scheduled / change-triggered check; never overlaps itself, never throws. */
+	async tick() {
+		if (this.running) return;
+		this.running = true;
+		try {
+			await this.check();
+		} catch (err) {
+			this.deps.logger.warn("restream-token re-check failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		} finally {
+			this.running = false;
+		}
+		if (this.blocked().length === 0 && this.waiting.size === 0) this.stop();
+	}
+	/** See the module doc. Idempotent. */
+	async check() {
+		const before = new Set(this.deps.mirror.heldDevices().keys());
+		if (before.size === 0 && this.waiting.size === 0) return;
+		const tokens = await this.deps.mirror.load();
+		const now = new Set(this.deps.mirror.heldDevices().keys());
+		const classified = await classifyHeld(this.deps.mirror.heldDevices(), this.deps.secrets);
+		const released = [];
+		for (const camera of classified) {
+			if (camera.kind === "missing") {
+				const reads = (this.missingReads.get(camera.deviceId) ?? 0) + 1;
+				this.missingReads.set(camera.deviceId, reads);
+				if (reads < 2) continue;
+				this.deps.mirror.release(camera.deviceId);
+				this.missingReads.delete(camera.deviceId);
+				if (this.waiting.delete(camera.deviceId)) await this.deps.alerts.clear(camera.deviceId);
+				released.push(camera.deviceId);
+				continue;
+			}
+			this.missingReads.delete(camera.deviceId);
+			if (this.waiting.has(camera.deviceId)) continue;
+			this.waiting.add(camera.deviceId);
+			this.deps.logger.error("restream tokens held but not readable", {
+				tags: { deviceId: camera.deviceId },
+				meta: {
+					reason: camera.reason,
+					ref: camera.ref
+				}
+			});
+			await this.deps.alerts.raise({
+				deviceId: camera.deviceId,
+				kind: "unavailable",
+				message: UNAVAILABLE_TEXT
+			});
+		}
+		const recovered = [...before].filter((id) => !now.has(id) && !released.includes(id));
+		for (const deviceId of recovered) if (this.waiting.delete(deviceId)) await this.deps.alerts.clear(deviceId);
+		if (recovered.length > 0) this.deps.logger.info("restream tokens readable again", { meta: { cameras: recovered.length } });
+		const cameras = [...recovered, ...released];
+		if (cameras.length > 0) await this.deps.onRegister(tokens, cameras);
+		for (const deviceId of released) {
+			this.deps.logger.error("restream tokens lost - new URLs issued", { tags: { deviceId } });
+			await this.deps.alerts.raise({
+				deviceId,
+				kind: "missing",
+				message: issuedText(deviceId)
+			});
+		}
+	}
+};
+//#endregion
 //#region src/stream-broker/addon.ts
 /**
-* Hydrate the persisted RTSP restream state. Tokens come from their own
-* collection (one row per broker); `rtspEnabled` is still a key of the settings
-* row. An unparseable token row is skipped by the store — one dead token, not
-* every token — and an empty set keeps first-boot silence (no loader call, no
-* log).
+* Hydrate the persisted RTSP restream state. Tokens come from the cameras' own
+* settings; `rtspEnabled` is still a key of the settings row. An unreadable
+* token set THROWS (the caller refuses to write tokens afterwards - a
+* replacement minted over a token that was merely unreadable would turn every
+* external NVR URL into a 404), and an empty set keeps first-boot silence.
 */
 async function hydratePersistedRtspState(deps) {
-	const rows = await deps.tokensStore.readAll();
-	const tokens = /* @__PURE__ */ new Map();
-	for (const [brokerId, row] of rows) tokens.set(brokerId, row.token);
+	const tokens = flattenByDevice(await deps.tokensMirror.load());
 	if (tokens.size > 0) {
 		deps.loadTokens(tokens);
 		deps.logger.info("Loaded persisted RTSP tokens", { meta: { tokenCount: tokens.size } });
@@ -38053,6 +38741,8 @@ var PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS = 6e4;
 * the sample as absent (the RTCP Receiver-Report path drives the ladder anyway). */
 var NETWORK_QUALITY_STATS_TIMEOUT_MS = 2e3;
 var StreamBrokerAddon = class extends require_dist.BaseAddon {
+	/** The restream tokens of a camera are a per-device setting held in the keychain (D870). */
+	secretStatePaths = ["rtspTokens"];
 	brokerManager = null;
 	/** The node's pinned ffmpeg, mirrored here so the recorded-playback demuxers
 	*  (segment-demux/segment-audio) spawn the same binary as the transcode
@@ -38109,6 +38799,7 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 	*  restarts). Loaded on activate, flushed throttled from the metrics loop and
 	*  once on shutdown. */
 	probeSnapshots = null;
+	removalHook = null;
 	lastProbePersistAt = 0;
 	constructor() {
 		super({
@@ -38171,24 +38862,26 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 			logger: this.ctx.logger
 		});
 		await this.ffmpegWiring.load();
-		await this.declareRowCollections();
-		await this.purgeFlattenedSettingsKeys();
+		const deviceSettings = this.deviceSettings();
 		const rtspProvider = this.brokerManager.getRtspRestreamProvider();
 		const brokerManager = this.brokerManager;
-		const rtspTokens = rtspTokensStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const rtspTokens = rtspTokensMirror(deviceSettings, this.ctx.logger);
 		const rtspEnabledState = this.state("rtspEnabled", RtspEnabledSchema, {});
 		try {
 			await hydratePersistedRtspState({
-				tokensStore: rtspTokens,
+				tokensMirror: rtspTokens,
 				enabledState: rtspEnabledState,
 				loadTokens: (tokens) => brokerManager.loadPersistedTokens(tokens),
 				loadEnabled: (states) => rtspProvider.loadPersistedEnabled(states),
 				logger: this.ctx.logger
 			});
-		} catch {}
+		} catch (err) {
+			this.ctx.logger.warn("Failed to load persisted RTSP state - tokens will not be written", { meta: { error: require_dist.errMsg(err) } });
+		}
+		this.startTokenRecovery(rtspTokens, brokerManager);
 		rtspProvider.setTokenPersister(async (tokens) => {
 			try {
-				for (const [brokerId, token] of tokens) await rtspTokens.write(brokerId, { token });
+				await rtspTokens.merge(mergeRtspTokens(rtspTokens, tokens));
 				this.ctx.logger.info("Persisted RTSP tokens", { meta: { current: tokens.size } });
 			} catch (err) {
 				this.ctx.logger.warn("Failed to persist RTSP tokens", { meta: { error: require_dist.errMsg(err) } });
@@ -38221,24 +38914,22 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 				this.ctx.logger.warn("Failed to persist device overrides", { meta: { error: require_dist.errMsg(err) } });
 			});
 		});
-		const profileMap = profileMapStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const profileMap = profileMapMirror(deviceSettings, this.ctx.logger);
 		const profileMapPersister = (assignments) => {
 			const next = /* @__PURE__ */ new Map();
-			for (const [deviceId, assignment] of assignments) next.set(`${deviceId}`, {
+			for (const [deviceId, assignment] of assignments) next.set(deviceId, {
 				map: { ...assignment.map },
 				auto: assignment.auto
 			});
-			profileMap.replaceAll(next).catch((err) => {
+			profileMap.replace(next).catch((err) => {
 				this.ctx.logger.warn("Failed to persist profile map", { meta: { error: require_dist.errMsg(err) } });
 			});
 		};
 		this.brokerManager.setProfileMapPersister(profileMapPersister);
 		try {
-			const rows = await profileMap.readAll();
+			const rows = await profileMap.load();
 			const loaded = /* @__PURE__ */ new Map();
-			for (const [rawKey, val] of rows) {
-				const deviceId = Number(rawKey);
-				if (!Number.isInteger(deviceId)) continue;
+			for (const [deviceId, val] of rows) {
 				const map = {};
 				for (const profile of PROFILE_KEYS) {
 					const v = val.map[profile];
@@ -38254,18 +38945,18 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load profile map", { meta: { error: require_dist.errMsg(err) } });
 		}
-		const probeSnapshots = probeSnapshotsStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const probeSnapshots = probeSnapshotsMirror(deviceSettings, this.ctx.logger);
 		this.probeSnapshots = probeSnapshots;
 		try {
-			const rows = await probeSnapshots.readAll();
-			const blob = Object.fromEntries(rows);
+			const rows = await probeSnapshots.load();
+			const blob = Object.fromEntries(flattenByDevice(rows));
 			this.brokerManager.loadProbeSnapshots(blob);
-			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: rows.size } });
+			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: Object.keys(blob).length } });
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load probe snapshots", { meta: { error: require_dist.errMsg(err) } });
 		}
 		this.brokerManager.setDeviceHardwareForgetHook(async (deviceId) => {
-			const rtspTokenRowsDeleted = await rtspTokens.deleteWhere({ where: { deviceId } });
+			const rtspTokenRowsDeleted = await rtspTokens.remove(deviceId) ? 1 : 0;
 			this.flushProbeSnapshots(Date.now(), true);
 			return { rtspTokenRowsDeleted };
 		});
@@ -38523,6 +39214,14 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("stream-broker: client-log ingest failed to serve", { meta: { error: require_dist.errMsg(err) } });
 		}
+		this.removalHook = createBrokerRemovalHook({
+			logger: this.ctx.logger,
+			retractDevice: async (deviceId) => {
+				await retractRemovedDevice(deviceId, this.deviceRemovalDeps());
+			},
+			dropDeviceOverride: (deviceId) => brokerManager.dropDeviceOverride(deviceId),
+			overrideDeviceIds: () => brokerManager.listDeviceOverrideIds()
+		});
 		return [
 			{
 				capability: require_dist.streamBrokerCapability,
@@ -38541,9 +39240,90 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 				provider: widgetsProvider
 			},
 			logChannelsRegistration,
-			loadContributionRegistration
+			loadContributionRegistration,
+			{
+				capability: require_dist.deviceRemovalHookCapability,
+				provider: this.removalHook
+			}
 		];
 	}
+	/**
+	* Watch the cameras whose restream tokens are held but unreadable (D870): no
+	* restream URL is registered for them (the manager's gate), an alert says so,
+	* and when a value resolves ONLY that camera's restreamers are registered with
+	* the stored tokens - no teardown. A lost secret is released after two
+	* consistent reads and gets new, persisted tokens.
+	*/
+	startTokenRecovery(mirror, brokerManager) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) {
+			if (mirror.heldDevices().size > 0) this.ctx.logger.error("restream tokens look held but this addon has no keychain access", { meta: { cameras: mirror.heldDevices().size } });
+			return;
+		}
+		brokerManager.setRestreamGate((deviceId) => mirror.isBlocked(deviceId));
+		if (mirror.heldDevices().size === 0) return;
+		const alertId = (deviceId) => `stream-broker-tokens:${deviceId}`;
+		const warn = (what) => (err) => this.ctx.logger.warn(what, { meta: { error: require_dist.errMsg(err) } });
+		const recovery = new TokenRecovery({
+			mirror,
+			secrets,
+			logger: this.ctx.logger,
+			alerts: {
+				raise: async ({ deviceId, kind, message }) => {
+					const now = Date.now();
+					await this.ctx.api.alerts.emit.mutate({
+						id: alertId(deviceId),
+						category: "streams",
+						severity: "warning",
+						title: kind === "missing" ? "New RTSP restream URLs issued" : "RTSP restream URLs unavailable",
+						message,
+						status: "active",
+						read: false,
+						createdAt: now,
+						updatedAt: now,
+						source: {
+							type: "device",
+							id: String(deviceId)
+						},
+						metadata: {
+							deviceId,
+							kind
+						}
+					}).catch(warn("could not raise the restream-token alert"));
+				},
+				clear: async (deviceId) => {
+					await this.ctx.api.alerts.update.mutate({
+						alertId: alertId(deviceId),
+						patch: {
+							status: "completed",
+							updatedAt: Date.now()
+						}
+					}).catch(warn("could not clear the restream-token alert"));
+				}
+			},
+			onRegister: async (tokens, cameras) => {
+				brokerManager.loadPersistedTokens(flattenByDevice(tokens));
+				for (const deviceId of cameras) brokerManager.registerRestreamersForDevice(deviceId);
+			}
+		});
+		recovery.start();
+		const unsubscribe = secrets.onChange((ref) => {
+			if (ref.startsWith("secret://stream-broker/device/")) recovery.tick();
+		});
+		this.ctx.addDisposer(() => {
+			recovery.stop();
+			unsubscribe();
+		});
+	}
+	async onHubReachable() {
+		const removalHook = this.removalHook;
+		if (removalHook === null) return;
+		this.ctx.addDisposer(require_dist.armRemovalReconcile({
+			api: this.ctx.api,
+			logger: this.ctx.logger,
+			remove: (input) => removalHook.onDeviceRemoved(input)
+		}));
+	}
 	async onShutdown() {
 		this.logChannels?.stop();
 		this.logChannels = null;
@@ -38644,41 +39424,14 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		this.flushProbeSnapshots(timestamp, false);
 	}
 	/**
-	* Declare the three row collections that replaced the `probeSnapshots`,
-	* `rtspTokens` and `profileMap` blob keys. Idempotent — a re-declaration of
-	* the same shape is a no-op in the engine.
-	*
-	* Not swallowed: a broker whose `stream-broker:rtsp-tokens` is undeclared
-	* mints a new token for every stream and every external NVR URL in the
-	* installation goes dead. Crashing loudly is bounded by `CrashSupervisor`
-	* (D6); silently reissuing tokens is not.
+	* The per-device settings, as the broker persists through them. Resolved
+	* reads/writes (keychain markers never reach this code), and a context with
+	* no settings is a broker that cannot start.
 	*/
-	async declareRowCollections() {
-		const store = this.ctx.api.settingsStore;
-		const logger = this.ctx.logger;
-		await probeSnapshotsStore(store, logger).declare();
-		await rtspTokensStore(store, logger).declare();
-		await profileMapStore(store, logger).declare();
-	}
-	/**
-	* Drop the flattened keys from `stream-broker:addon-settings` / `root`, each
-	* gated on its own successor collection being non-empty. `rtspEnabled` and
-	* `deviceOverrides` stay — see `broker-row-stores.ts` for why.
-	*
-	* Best-effort: a purge that throws must not take the broker down. The keys
-	* are dead weight, not a fault.
-	*/
-	async purgeFlattenedSettingsKeys() {
-		try {
-			await require_retire_root_keys.retireRootKeys({
-				store: this.ctx.api.settingsStore,
-				addonId: STREAM_BROKER_ADDON_ID,
-				logger: this.ctx.logger,
-				specs: STREAM_BROKER_RETIRED_ROOT_KEYS
-			});
-		} catch (err) {
-			this.ctx.logger.warn("stream-broker: retiring the flattened settings keys failed", { meta: { error: require_dist.errMsg(err) } });
-		}
+	deviceSettings() {
+		const settings = this.ctx.settings;
+		if (settings === void 0) throw new Error("stream-broker: device settings are not available");
+		return settings;
 	}
 	/**
 	* Persist the manager's probe map to the durable handle. Throttled to
@@ -38691,7 +39444,7 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		if (!store || !manager) return;
 		if (!force && now - this.lastProbePersistAt < PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS) return;
 		this.lastProbePersistAt = now;
-		store.replaceAll(new Map(Object.entries(manager.getProbeSnapshots()))).catch((err) => {
+		store.replace(groupByDevice(manager.getProbeSnapshots())).catch((err) => {
 			this.ctx.logger.warn("Failed to persist probe snapshots", { meta: { error: require_dist.errMsg(err) } });
 		});
 	}