@camstack/addon-pipeline 1.2.44 → 1.2.46

package/dist/stream-broker/index.js

@@ -3,18 +3,20 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-BuFE5rOK.js");
+const require_dist = require("../dist-CPfFUIl9.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_model_download_service_D8B_4ktF = require("../model-download-service-D8B-4ktF-7-YxE9Wx.js");
 let node_crypto = require("node:crypto");
-node_crypto = require_chunk.__toESM(node_crypto);
+node_crypto = require_chunk.__toESM(node_crypto, 1);
 let node_child_process = require("node:child_process");
 let node_url = require("node:url");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
+require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
+require_chunk.__toESM(node_path, 1);
 node_path = require_chunk.__toESM(node_path);
 let node_net = require("node:net");
 node_net = require_chunk.__toESM(node_net);
@@ -1574,6 +1576,21 @@ var RtspRestreamer = class {
 	* trackID=1. Muted sessions still get the video-only SDP.
 	*/
 	egressAudioBlock = null;
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83) — device policy, set by `StreamBroker`.
+	*
+	* Distinct from a session's own `isMuted()`, which is a PULLER's choice
+	* (the `/muted` URL a local decoder asks for). This one overrides every
+	* puller: while true, `getSdp()` serves the video-only SDP to everyone, so
+	* a client that connects during the mute never declares an audio stream it
+	* will not receive.
+	*
+	* NOT cleared by {@link resetStreamState}. That method resets what belongs
+	* to one CONNECTION (keyframe caches, codec params, SDP); an operator's
+	* mute belongs to the device and must survive a suspend/resume — otherwise
+	* a broker going idle overnight would wake up distributing audio again.
+	*/
+	deviceAudioMuted = false;
 	/** Cached last keyframe NALs (SPS/PPS + IDR) for late-joining clients. */
 	lastKeyframeNals = [];
 	lastKeyframeNalBytes = 0;
@@ -1736,11 +1753,40 @@ var RtspRestreamer = class {
 		return this.codecParams;
 	}
 	getSdp() {
+		if (this.deviceAudioMuted) return this.getMutedSdp();
 		return this.sdp;
 	}
 	getMutedSdp() {
 		return this.mutedSdp ?? this.sdp;
 	}
+	/**
+	* Apply the broker-side audio mute. Returns how many audio-bearing pull
+	* sessions were closed so they re-`DESCRIBE` against the new SDP.
+	*
+	* Idempotent — the same value twice closes nothing. Sessions that pulled the
+	* `/muted` URL are left alone: they never had an audio track to gain or
+	* lose, and killing a local decoder's feed to change nothing would be a
+	* decode gap for free.
+	*/
+	setAudioMuted(muted) {
+		if (this.deviceAudioMuted === muted) return 0;
+		this.deviceAudioMuted = muted;
+		const audioBearing = [...this.sessions.values()].filter((s) => !s.isMuted());
+		for (const session of audioBearing) this.killSession(session.getSessionId());
+		if (audioBearing.length > 0) this.logger?.info("audio mute changed — closing audio-bearing RTSP pulls so they re-DESCRIBE", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				streamName: this.streamName,
+				muted,
+				closed: audioBearing.length
+			}
+		});
+		return audioBearing.length;
+	}
+	/** The broker-side audio mute currently in force for this restreamer. */
+	isDeviceAudioMuted() {
+		return this.deviceAudioMuted;
+	}
 	getSessionCount() {
 		return this.sessions.size;
 	}
@@ -2009,6 +2055,7 @@ var RtspRestreamer = class {
 	* would mean dropping ~300 ms of audio at every join.
 	*/
 	pushAudioRtpPassthrough(rtpData) {
+		if (this.deviceAudioMuted) return;
 		if (this.sessions.size === 0) return;
 		const rtpPacket = {
 			data: rtpData,
@@ -2965,6 +3012,147 @@ function buildAudioCodecCapApi(api) {
 	};
 }
 //#endregion
+//#region src/stream-broker/stream-broker/dead-decode-backends.ts
+/**
+* "This decode backend cannot create a device in THIS process" — remembered
+* across children, not per child.
+*
+* ## The thing this stops
+*
+* `-hwaccel vaapi` works for the decoder addon on this hub (ten concurrent 4K
+* decodes) and returns ENOMEM inside the stream-broker runner: `code=244`,
+* "Device creation failed: -12 … Cannot allocate memory". Every egress child
+* therefore spends ~3 s dying before its own software retry rescues it.
+*
+* That was already reported — `EgressTranscodeManager.onDecodeHwAccelFailed`
+* poisoned the broker's 60 s `egressHwAccelCache`. The memo is the wrong shape
+* for the verdict: it exists to avoid a per-session cross-process
+* `decoder.getInfo`, so it expires on a **read** cadence, and one minute later
+* the decoder answers `vaapi` again and the next cold child re-pays the death.
+* Measured on camera 615 on 2026-08-07: the hardware failure recurs at 22:17:07,
+* 22:18:42, 22:28:48, 22:30:52, 22:32:39, 22:34:07, 22:52:07 — once per memo
+* window, forever, on a hub where it has never once succeeded.
+*
+* ## Why this is a quarantine and not a tombstone
+*
+* A permanent verdict is wrong for the failure that is actually observed:
+* ENOMEM on device creation is a RESOURCE condition, and a resource condition
+* can clear (the operator gives the container more of the device, another
+* process releases it). A process that decided "never again" at 03:00 would
+* still be decoding in software at noon with a working accelerator, and nothing
+* would ever say so.
+*
+* So the verdict LASTS and escalates: each consecutive failure of the same
+* backend widens its quarantine — 30 min, 2 h, then 6 h — so a hub where the
+* backend is genuinely dead pays one probe per six hours instead of one per
+* minute, while a hub where it recovers still finds out.
+*
+* The FIRST rung is deliberately not a minute. One report is already a strong
+* signal: the manager only reports a backend after its child produced ZERO
+* packets *and* the software retry proved the same argv otherwise works, which
+* is a statement about the backend and not about the source. And the cost of
+* being wrong is bounded and already being paid — the egress encodes with
+* `libx264` either way, so an over-long quarantine costs a software DECODE on a
+* path that is decoding in software today, 100 % of the time.
+*
+* The invalidations are motivated, and there are exactly three:
+*
+*  1. **The window elapses.** The next acquire probes hardware once. If it
+*     works, {@link DeadDecodeBackends.markAlive} clears the record and the
+*     escalation starts from zero again.
+*  2. **The backend changes.** The record is keyed by backend name, so an
+*     operator switching the decoder from vaapi to qsv is obeyed immediately —
+*     qsv has no record.
+*  3. **The runner respawns.** This is instance state on the broker manager,
+*     never a module global, for the same reason `HwAccelCache` is: a module
+*     global outlives an addon respawn, and an addon respawn is exactly the
+*     event after which a stale verdict must not survive.
+*
+* ## Why it lives here and not in `@camstack/types`
+*
+* `addon-export-hap` has the identical gap (its `failedBackend` memo forgets on
+* the same 60 s cadence) and this is deliberately NOT shared with it yet: a
+* framework package is only live once a `@camstack/server` containing it is
+* installed, whereas this ships with `camstack deploy packages/addon-pipeline`.
+* The cross-PROCESS gap D67 names — addons may not import each other and no cap
+* carries "this backend is dead on this node right now" — is unchanged either
+* way; what is closed here is the broker's own repetition of the cost.
+*/
+/**
+* How long a backend stays quarantined after its 1st, 2nd, 3rd+ consecutive
+* failure. Escalating rather than fixed, and it starts at HALF AN HOUR: a
+* client watchdog cycles in seconds, so any first rung measured in minutes is
+* re-paid by the very churn this exists to stop. The last rung makes a
+* permanently-broken backend cost ~nothing while still being re-probed.
+*/
+var DEAD_BACKEND_QUARANTINE_MS = [
+	18e5,
+	72e5,
+	216e5
+];
+/**
+* The decoder's answer, overruled while the backend it names is quarantined.
+*
+* Composed rather than folded into `resolveEgressDecodeHwAccel`: that function
+* answers "what SHOULD decode this", which is a per-node property of the
+* hardware; this answers "what has been observed to work in THIS process",
+* which is a property of the runner. Keeping them apart is what stops a
+* runner-local ENOMEM from being mistaken for a node that has no accelerator —
+* the first is a flow bug to fix, the second a capability limit to accept.
+*/
+async function resolveWithQuarantine(input) {
+	const backend = await input.resolve();
+	if (backend === null || !input.dead.isQuarantined(backend)) return {
+		backend,
+		veto: null
+	};
+	return {
+		backend: null,
+		veto: {
+			backend,
+			failures: input.dead.failuresOf(backend),
+			remainingMs: input.dead.remainingMs(backend)
+		}
+	};
+}
+function createDeadDecodeBackends(options = {}) {
+	const now = options.now ?? (() => Date.now());
+	const records = /* @__PURE__ */ new Map();
+	const quarantineFor = (failures) => {
+		return DEAD_BACKEND_QUARANTINE_MS[Math.min(failures, DEAD_BACKEND_QUARANTINE_MS.length) - 1] ?? DEAD_BACKEND_QUARANTINE_MS[0] ?? 0;
+	};
+	return {
+		markDead(backend) {
+			const failures = (records.get(backend)?.failures ?? 0) + 1;
+			const quarantineMs = quarantineFor(failures);
+			records.set(backend, {
+				failures,
+				until: now() + quarantineMs
+			});
+			return {
+				backend,
+				failures,
+				quarantineMs
+			};
+		},
+		markAlive(backend) {
+			records.delete(backend);
+		},
+		isQuarantined(backend) {
+			const record = records.get(backend);
+			return record !== void 0 && now() < record.until;
+		},
+		remainingMs(backend) {
+			const record = records.get(backend);
+			if (record === void 0) return 0;
+			return Math.max(0, record.until - now());
+		},
+		failuresOf(backend) {
+			return records.get(backend)?.failures ?? 0;
+		}
+	};
+}
+//#endregion
 //#region src/stream-broker/stream-broker/ffmpeg-invocation.ts
 /** The full set of hwaccel settings (for validation + option surfaces). */
 var FFMPEG_HW_ACCEL_SETTINGS = [
@@ -3189,182 +3377,291 @@ function pushDimension(into, constraint, requested, known) {
 		reason: `source ${known} > requested ${requested}`
 	});
 }
-//#endregion
-//#region src/stream-broker/stream-broker/fmp4-box-splitter.ts
-var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
-/** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
-var BOX_HEADER_BYTES = 8;
-var LARGE_BOX_HEADER_BYTES = 16;
-var Fmp4BoxSplitter = class {
-	maxUnitBytes;
-	/** Bytes of the CURRENT unit plus any partial box after it. */
-	buffer = new Uint8Array(0);
-	/** Where the current unit starts inside {@link buffer}. */
-	unitStart = 0;
-	/** Where the box scanner has reached inside {@link buffer}. */
-	cursor = 0;
-	state = "init";
-	nextSequence = 0;
-	faultReason = null;
-	interstitial = /* @__PURE__ */ new Set();
-	constructor(options = {}) {
-		this.maxUnitBytes = options.maxUnitBytes ?? DEFAULT_MAX_UNIT_BYTES;
-	}
-	/**
-	* Non-null once the stream cannot be split. The splitter emits nothing
-	* further, so a caller polls this to kill the child rather than watching a
-	* silent stall — a fragmenter that quietly stops producing looks exactly like
-	* a camera with no motion.
-	*/
-	get fault() {
-		return this.faultReason;
-	}
-	/** Bytes currently held. The memory bound, observable rather than asserted. */
-	get pendingBytes() {
-		return this.buffer.length - this.unitStart;
-	}
-	/**
-	* Top-level box types seen BETWEEN fragments and discarded — `mfra`, `free`,
-	* a stray `sidx`. Reported rather than dropped in silence: they are legal and
-	* useless to a fragment consumer, but a type nobody expected showing up here
-	* is the first symptom of a muxer that is not writing what we think it is.
-	*/
-	get discardedInterstitialTypes() {
-		return [...this.interstitial];
-	}
-	/**
-	* Feed bytes; get back whatever units completed. Returns `[]` once faulted.
+/**
+* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
+* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
+*
+* ## Why a plane and not a callback
+*
+* The operator's requirement for HKSV was explicit: the live fMP4 source built
+* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
+* CamStack as an additional videoclip source alongside the recorder and the NC
+* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
+* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
+* a second ffmpeg child of the same camera. So this is the same shape the
+* broker's other multi-consumer surfaces already have
+* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
+* one producer.
+*
+* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
+* clip source; both are named here so the seam is not re-invented, and neither
+* is built.
+*
+* ## The init segment is RETAINED
+*
+* A subscriber that attaches mid-stream — the clip consumer joining an already
+* running HKSV session, which is the whole dual-use case — receives the
+* retained `ftyp`+`moov` as its first packet and then live fragments. Without
+* retention its fragments are undecodable and the failure looks like a codec
+* problem.
+*
+* ## A slow subscriber is CLOSED, never silently gapped
+*
+* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
+* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
+* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
+* shows a clip that fails to play with nothing anywhere saying why. So a
+* subscription whose queue overflows is ENDED with a reason, loudly, and the
+* other subscriptions are untouched.
+*
+* ## The PREBUFFER (phase 3)
+*
+* HKSV asks for context BEFORE the trigger — `CameraRecordingOptions.prebufferLength`
+* is a HAP-mandated minimum of 4000 ms — and a subscriber that attaches at the
+* motion edge has none. So the plane optionally retains the last few fragments
+* and replays them to a subscriber that asks for them.
+*
+* Three things this ring gets right, each of which is a measured fact rather
+* than a preference (see [D84](../../../../docs/decisions/adr-0084.md)):
+*
+*  - **It is bounded by TIME *and* BYTES.** On the live fleet a 720p copy
+*    fragment is ~255 KB and a 4K one is ~6.35 MB — a 25× spread over the same
+*    window. A time-only bound is a per-camera RAM figure nobody can predict.
+*  - **The window is measured on ARRIVAL, not parsed from `tfdt`.** The
+*    splitter deliberately never computes a fragment's duration (a second
+*    opinion about a fact the muxer owns), and a prebuffer cares about how long
+*    ago the bytes turned up, which is exactly what arrival time answers.
+*  - **A replay is not backlog.** A subscriber taking N retained fragments gets
+*    its queue capacity raised by N for them, because closing a subscriber as a
+*    slow consumer for the prebuffer it explicitly asked for would be the
+*    stupidest possible failure — and, with `DEFAULT_QUEUE_CAPACITY` of 4 and a
+*    ring of 4, the guaranteed one.
+*
+* ## `isLast`
+*
+* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
+* `isLast` — a generator that finishes without it produces the twelve-second
+* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
+* plane therefore computes it at DELIVERY time: a packet is last when the plane
+* has ended and nothing remains queued behind it. A subscription that ends
+* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
+* the future delegate must not open an HDS stream it cannot feed.
+*/
+var DEFAULT_QUEUE_CAPACITY = 4;
+var Fmp4FragmentPlane = class {
+	logger;
+	prebuffer;
+	now;
+	subscriptions = /* @__PURE__ */ new Map();
+	/** The last init unit seen, handed to every later subscriber. */
+	retainedInit = null;
+	ended = false;
+	/** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
+	ring = [];
+	ringBytes = 0;
+	constructor(logger, prebuffer, now = Date.now) {
+		this.logger = logger;
+		this.prebuffer = prebuffer;
+		this.now = now;
+	}
+	get subscriberCount() {
+		return this.subscriptions.size;
+	}
+	/** True once {@link end} has been called — no further units are accepted. */
+	get isEnded() {
+		return this.ended;
+	}
+	/** What the prebuffer ring holds right now. All zeroes when disabled. */
+	prebufferStats() {
+		const oldest = this.ring[0];
+		return {
+			fragments: this.ring.length,
+			bytes: this.ringBytes,
+			spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
+		};
+	}
+	subscribe(input) {
+		const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
+		const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
+		const sub = {
+			id: `fmp4-${(0, node_crypto.randomUUID)()}`,
+			tag: input.tag,
+			subscribedAt: this.now(),
+			capacity: requested + replay.length,
+			queue: [],
+			delivered: 0,
+			closedReason: null,
+			wake: null,
+			iterating: false
+		};
+		this.subscriptions.set(sub.id, sub);
+		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
+		for (const retained of replay) this.enqueue(sub, retained.unit);
+		if (this.ended) this.closeSubscription(sub, "ended");
+		this.logger?.info("fmp4 plane: subscribed", { meta: {
+			subscriptionId: sub.id,
+			tag: sub.tag,
+			hasRetainedInit: this.retainedInit !== null,
+			prebufferFragments: replay.length,
+			prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
+		} });
+		return this.facade(sub);
+	}
+	/**
+	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
+	* emits exactly one per child, and a second means the child was respawned, in
+	* which case the old one describes a stream that no longer exists.
 	*/
-	push(chunk) {
-		if (this.faultReason !== null || chunk.length === 0) return [];
-		this.append(chunk);
-		if (this.pendingBytes > this.maxUnitBytes) return this.fail(`a single fMP4 unit exceeded ${this.maxUnitBytes} bytes — this stream is not fragmented`);
-		return this.drainBoxes();
-	}
-	append(chunk) {
-		if (this.buffer.length === 0) {
-			this.buffer = chunk.slice();
-			return;
+	publish(unit) {
+		if (this.ended) return;
+		if (unit.kind === "init") {
+			this.retainedInit = unit;
+			this.ring.length = 0;
+			this.ringBytes = 0;
+		} else this.retain(unit);
+		for (const sub of this.subscriptions.values()) {
+			if (sub.closedReason !== null) continue;
+			this.enqueue(sub, unit);
 		}
-		const next = new Uint8Array(this.buffer.length + chunk.length);
-		next.set(this.buffer, 0);
-		next.set(chunk, this.buffer.length);
-		this.buffer = next;
 	}
-	/** Consume every COMPLETE top-level box now in the buffer. */
-	drainBoxes() {
-		const units = [];
-		for (;;) {
-			const header = this.readHeader();
-			if (this.faultReason !== null) return units;
-			if (header === null) break;
-			if (this.cursor + header.totalBytes > this.buffer.length) break;
-			const boxStart = this.cursor;
-			const boxEnd = boxStart + header.totalBytes;
-			this.cursor = boxEnd;
-			const unit = this.consumeBox(header.type, boxStart, boxEnd);
-			if (this.faultReason !== null) return units;
-			if (unit !== null) units.push(unit);
-		}
-		this.compact();
-		return units;
-	}
-	/**
-	* Apply one box to the state machine. Returns a unit when this box CLOSED
-	* one, `null` otherwise.
-	*/
-	consumeBox(type, boxStart, boxEnd) {
-		if (this.state === "init") {
-			if (type !== "moof") return null;
-			if (boxStart === this.unitStart) {
-				this.fail("a moof arrived before any initialisation box — there is no ftyp/moov to send");
-				return null;
-			}
-			const init = this.emit("init", this.unitStart, boxStart);
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return init;
-		}
-		if (this.state === "idle") {
-			if (type !== "moof") {
-				this.interstitial.add(type);
-				this.unitStart = boxEnd;
-				return null;
-			}
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return null;
+	/**
+	* The producer stopped. Every subscriber drains what it holds; its final
+	* packet carries `isLast`, and its generator then completes.
+	*/
+	end(reason = "producer ended") {
+		if (this.ended) return;
+		this.ended = true;
+		this.logger?.info("fmp4 plane: ended", { meta: {
+			reason,
+			subscribers: this.subscriptions.size
+		} });
+		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+	}
+	listSubscribers() {
+		return [...this.subscriptions.values()].map((s) => ({
+			tag: s.tag,
+			subscribedAt: s.subscribedAt,
+			delivered: s.delivered,
+			closedReason: s.closedReason
+		}));
+	}
+	/** End and forget everything. Idempotent. */
+	dispose() {
+		this.end("disposed");
+		this.subscriptions.clear();
+		this.retainedInit = null;
+		this.ring.length = 0;
+		this.ringBytes = 0;
+	}
+	/**
+	* Add one fragment to the ring and evict from the front until BOTH bounds
+	* hold. Eviction is oldest-first, which is the one place in this file where
+	* dropping is correct: the ring is context, not stream — nobody is mid-decode
+	* on it, and a subscriber only ever receives a contiguous tail of it.
+	*/
+	retain(unit) {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return;
+		const arrivedAt = this.now();
+		this.ring.push({
+			unit,
+			arrivedAt
+		});
+		this.ringBytes += unit.data.length;
+		const cutoff = arrivedAt - prebuffer.windowMs;
+		while (this.ring.length > 0) {
+			const oldest = this.ring[0];
+			if (oldest === void 0) break;
+			const tooOld = oldest.arrivedAt < cutoff;
+			const tooBig = this.ringBytes > prebuffer.maxBytes;
+			if (!tooOld && !tooBig || this.ring.length === 1) break;
+			this.ring.shift();
+			this.ringBytes -= oldest.unit.data.length;
 		}
-		if (type !== "mdat") return null;
-		const fragment = this.emit("fragment", this.unitStart, boxEnd);
-		this.unitStart = boxEnd;
-		this.state = "idle";
-		return fragment;
 	}
 	/**
-	* Parse the header at {@link cursor}, or `null` when too few bytes have
-	* arrived to know. Faults on a size the splitter cannot honour.
+	* The ring as a subscriber should receive it — window applied AT SUBSCRIBE
+	* time, not only at publish time. A camera that went quiet keeps its last
+	* fragment in the ring indefinitely (see the never-evict-the-newest rule),
+	* and replaying a 40-second-old fragment as "prebuffer" would put stale video
+	* at the head of a clip iOS presents as the moment of the event.
 	*/
-	readHeader() {
-		const available = this.buffer.length - this.cursor;
-		if (available < BOX_HEADER_BYTES) return null;
-		const view = new DataView(this.buffer.buffer, this.buffer.byteOffset, this.buffer.byteLength);
-		const size = view.getUint32(this.cursor);
-		const type = String.fromCharCode(this.buffer[this.cursor + 4] ?? 0, this.buffer[this.cursor + 5] ?? 0, this.buffer[this.cursor + 6] ?? 0, this.buffer[this.cursor + 7] ?? 0);
-		if (size === 0) {
-			this.fail(`box "${type}" declares size 0 (to EOF) — an unbounded box cannot be fragmented`);
-			return null;
-		}
-		if (size === 1) {
-			if (available < LARGE_BOX_HEADER_BYTES) return null;
-			const large = view.getBigUint64(this.cursor + BOX_HEADER_BYTES);
-			if (large > BigInt(this.maxUnitBytes)) {
-				this.fail(`box "${type}" declares ${large} bytes, over the ${this.maxUnitBytes} byte bound`);
-				return null;
-			}
-			return {
-				type,
-				totalBytes: Number(large)
-			};
-		}
-		if (size < BOX_HEADER_BYTES) {
-			this.fail(`box "${type}" declares an impossible size of ${size} bytes`);
-			return null;
+	trimmedRing() {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return [];
+		const cutoff = this.now() - prebuffer.windowMs;
+		return this.ring.filter((r) => r.arrivedAt >= cutoff);
+	}
+	enqueue(sub, unit) {
+		if (sub.queue.length >= sub.capacity) {
+			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
+				subscriptionId: sub.id,
+				tag: sub.tag,
+				capacity: sub.capacity,
+				delivered: sub.delivered
+			} });
+			this.closeSubscription(sub, "slow-consumer");
+			return;
 		}
-		return {
-			type,
-			totalBytes: size
-		};
+		sub.queue.push({
+			kind: unit.kind,
+			data: unit.data,
+			sequence: unit.sequence,
+			isLast: false
+		});
+		this.wake(sub);
 	}
-	emit(kind, start, end) {
-		const sequence = this.nextSequence;
-		this.nextSequence += 1;
+	closeSubscription(sub, reason) {
+		if (sub.closedReason !== null) return;
+		sub.closedReason = reason;
+		if (reason === "slow-consumer") sub.queue.length = 0;
+		this.wake(sub);
+	}
+	wake(sub) {
+		const resume = sub.wake;
+		sub.wake = null;
+		resume?.();
+	}
+	facade(sub) {
+		const plane = this;
 		return {
-			kind,
-			data: this.buffer.slice(start, end),
-			sequence
+			id: sub.id,
+			tag: sub.tag,
+			get delivered() {
+				return sub.delivered;
+			},
+			get closedReason() {
+				return sub.closedReason;
+			},
+			packets: () => plane.iterate(sub),
+			release: () => {
+				plane.closeSubscription(sub, "released");
+				plane.subscriptions.delete(sub.id);
+			}
 		};
 	}
-	/**
-	* Drop everything already emitted or discarded. Without this the buffer is
-	* the whole stream and the process dies in hours, not minutes.
-	*/
-	compact() {
-		if (this.unitStart === 0) return;
-		this.buffer = this.buffer.slice(this.unitStart);
-		this.cursor -= this.unitStart;
-		this.unitStart = 0;
-	}
-	fail(reason) {
-		this.faultReason = reason;
-		this.buffer = new Uint8Array(0);
-		this.unitStart = 0;
-		this.cursor = 0;
-		return [];
+	async *iterate(sub) {
+		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
+		sub.iterating = true;
+		for (;;) {
+			const next = sub.queue.shift();
+			if (next === void 0) {
+				if (sub.closedReason !== null) return;
+				await new Promise((resolve) => {
+					sub.wake = resolve;
+				});
+				continue;
+			}
+			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
+			sub.delivered += 1;
+			yield {
+				...next,
+				isLast
+			};
+			if (isLast) return;
+		}
 	}
 };
-//#endregion
-//#region src/stream-broker/stream-broker/egress-fragment-child.ts
 var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
 /** Heartbeat cadence — ~2 minutes of 4 s fragments. */
 var FRAGMENT_LOG_EVERY = 30;
@@ -3372,7 +3669,7 @@ var Fmp4FragmentChild = class {
 	deps;
 	args;
 	child = null;
-	splitter = new Fmp4BoxSplitter();
+	splitter = new require_dist.Fmp4BoxSplitter();
 	stopped = false;
 	unitsOut = 0;
 	activeHwAccel = null;
@@ -3393,13 +3690,13 @@ var Fmp4FragmentChild = class {
 			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
 				tags: { deviceId: this.args.deviceId },
 				meta: {
-					brokerId: this.args.brokerId,
+					sourceId: this.args.sourceId,
 					decodeHwAccel: requested,
 					error: require_dist.errMsg(err)
 				}
 			});
 			this.killChild();
-			this.splitter = new Fmp4BoxSplitter();
+			this.splitter = new require_dist.Fmp4BoxSplitter();
 			this.activeHwAccel = null;
 			await this.spawnAttempt(null);
 		}
@@ -3429,7 +3726,7 @@ var Fmp4FragmentChild = class {
 		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
 			tags: { deviceId: this.args.deviceId },
 			meta: {
-				brokerId: this.args.brokerId,
+				sourceId: this.args.sourceId,
 				fragmentMs: this.args.fragmentMs,
 				decodeHwAccel: decodeHwAccel ?? "software",
 				argv: args.join(" ")
@@ -3483,7 +3780,7 @@ var Fmp4FragmentChild = class {
 						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
 							tags: { deviceId: this.args.deviceId },
 							meta: {
-								brokerId: this.args.brokerId,
+								sourceId: this.args.sourceId,
 								bytes: unit.data.length
 							}
 						});
@@ -3491,7 +3788,7 @@ var Fmp4FragmentChild = class {
 					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
 						tags: { deviceId: this.args.deviceId },
 						meta: {
-							brokerId: this.args.brokerId,
+							sourceId: this.args.sourceId,
 							unitsOut: this.unitsOut,
 							bytes: unit.data.length,
 							subscribers: this.args.plane.subscriberCount
@@ -3506,7 +3803,7 @@ var Fmp4FragmentChild = class {
 				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
 					tags: { deviceId: this.args.deviceId },
 					meta: {
-						brokerId: this.args.brokerId,
+						sourceId: this.args.sourceId,
 						line: line.trim()
 					}
 				});
@@ -3522,259 +3819,61 @@ var Fmp4FragmentChild = class {
 			});
 			child.once("exit", (code, signal) => {
 				if (!settled) {
-					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
-					return;
-				}
-				if (!isCurrent()) return;
-				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
-				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						brokerId: this.args.brokerId,
-						code,
-						signal,
-						unitsOut: this.unitsOut
-					}
-				});
-				this.args.plane.end("the fragment child exited");
-				this.deps.onChildExit?.(error);
-			});
-		});
-	}
-	/**
-	* The byte stream stopped being splittable. Not recoverable — the splitter
-	* cannot resynchronise mid-box — so the child is a corpse and every consumer
-	* has to be told, loudly, with the reason.
-	*/
-	onFault(reason, wasLive, current, settle) {
-		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
-		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				brokerId: this.args.brokerId,
-				unitsOut: this.unitsOut,
-				interstitial: this.splitter.discardedInterstitialTypes,
-				reason
-			}
-		});
-		this.killChild();
-		settle(error);
-		if (wasLive && current) {
-			this.args.plane.end("the fragment child produced unsplittable output");
-			this.deps.onChildExit?.(error);
-		}
-	}
-	killChild() {
-		const child = this.child;
-		this.child = null;
-		if (child && !child.killed) try {
-			child.kill("SIGTERM");
-		} catch (err) {
-			this.deps.logger.warn("fmp4 fragment child: kill error", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					brokerId: this.args.brokerId,
-					error: require_dist.errMsg(err)
-				}
-			});
-		}
-	}
-};
-//#endregion
-//#region src/stream-broker/stream-broker/fmp4-fragment-plane.ts
-/**
-* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
-* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
-*
-* ## Why a plane and not a callback
-*
-* The operator's requirement for HKSV was explicit: the live fMP4 source built
-* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
-* CamStack as an additional videoclip source alongside the recorder and the NC
-* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
-* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
-* a second ffmpeg child of the same camera. So this is the same shape the
-* broker's other multi-consumer surfaces already have
-* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
-* one producer.
-*
-* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
-* clip source; both are named here so the seam is not re-invented, and neither
-* is built.
-*
-* ## The init segment is RETAINED
-*
-* A subscriber that attaches mid-stream — the clip consumer joining an already
-* running HKSV session, which is the whole dual-use case — receives the
-* retained `ftyp`+`moov` as its first packet and then live fragments. Without
-* retention its fragments are undecodable and the failure looks like a codec
-* problem.
-*
-* ## A slow subscriber is CLOSED, never silently gapped
-*
-* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
-* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
-* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
-* shows a clip that fails to play with nothing anywhere saying why. So a
-* subscription whose queue overflows is ENDED with a reason, loudly, and the
-* other subscriptions are untouched.
-*
-* ## `isLast`
-*
-* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
-* `isLast` — a generator that finishes without it produces the twelve-second
-* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
-* plane therefore computes it at DELIVERY time: a packet is last when the plane
-* has ended and nothing remains queued behind it. A subscription that ends
-* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
-* the future delegate must not open an HDS stream it cannot feed.
-*/
-var DEFAULT_QUEUE_CAPACITY = 4;
-var Fmp4FragmentPlane = class {
-	logger;
-	subscriptions = /* @__PURE__ */ new Map();
-	/** The last init unit seen, handed to every later subscriber. */
-	retainedInit = null;
-	ended = false;
-	constructor(logger) {
-		this.logger = logger;
-	}
-	get subscriberCount() {
-		return this.subscriptions.size;
-	}
-	/** True once {@link end} has been called — no further units are accepted. */
-	get isEnded() {
-		return this.ended;
-	}
-	subscribe(input) {
-		const sub = {
-			id: `fmp4-${(0, node_crypto.randomUUID)()}`,
-			tag: input.tag,
-			subscribedAt: Date.now(),
-			capacity: Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY),
-			queue: [],
-			delivered: 0,
-			closedReason: null,
-			wake: null,
-			iterating: false
-		};
-		this.subscriptions.set(sub.id, sub);
-		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
-		if (this.ended) this.closeSubscription(sub, "ended");
-		this.logger?.info("fmp4 plane: subscribed", { meta: {
-			subscriptionId: sub.id,
-			tag: sub.tag,
-			hasRetainedInit: this.retainedInit !== null
-		} });
-		return this.facade(sub);
-	}
-	/**
-	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
-	* emits exactly one per child, and a second means the child was respawned, in
-	* which case the old one describes a stream that no longer exists.
-	*/
-	publish(unit) {
-		if (this.ended) return;
-		if (unit.kind === "init") this.retainedInit = unit;
-		for (const sub of this.subscriptions.values()) {
-			if (sub.closedReason !== null) continue;
-			this.enqueue(sub, unit);
-		}
-	}
-	/**
-	* The producer stopped. Every subscriber drains what it holds; its final
-	* packet carries `isLast`, and its generator then completes.
-	*/
-	end(reason = "producer ended") {
-		if (this.ended) return;
-		this.ended = true;
-		this.logger?.info("fmp4 plane: ended", { meta: {
-			reason,
-			subscribers: this.subscriptions.size
-		} });
-		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
-	}
-	listSubscribers() {
-		return [...this.subscriptions.values()].map((s) => ({
-			tag: s.tag,
-			subscribedAt: s.subscribedAt,
-			delivered: s.delivered,
-			closedReason: s.closedReason
-		}));
-	}
-	/** End and forget everything. Idempotent. */
-	dispose() {
-		this.end("disposed");
-		this.subscriptions.clear();
-		this.retainedInit = null;
-	}
-	enqueue(sub, unit) {
-		if (sub.queue.length >= sub.capacity) {
-			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
-				subscriptionId: sub.id,
-				tag: sub.tag,
-				capacity: sub.capacity,
-				delivered: sub.delivered
-			} });
-			this.closeSubscription(sub, "slow-consumer");
-			return;
-		}
-		sub.queue.push({
-			kind: unit.kind,
-			data: unit.data,
-			sequence: unit.sequence,
-			isLast: false
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
 		});
-		this.wake(sub);
-	}
-	closeSubscription(sub, reason) {
-		if (sub.closedReason !== null) return;
-		sub.closedReason = reason;
-		if (reason === "slow-consumer") sub.queue.length = 0;
-		this.wake(sub);
-	}
-	wake(sub) {
-		const resume = sub.wake;
-		sub.wake = null;
-		resume?.();
 	}
-	facade(sub) {
-		const plane = this;
-		return {
-			id: sub.id,
-			tag: sub.tag,
-			get delivered() {
-				return sub.delivered;
-			},
-			get closedReason() {
-				return sub.closedReason;
-			},
-			packets: () => plane.iterate(sub),
-			release: () => {
-				plane.closeSubscription(sub, "released");
-				plane.subscriptions.delete(sub.id);
+	/**
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
+	*/
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
 			}
-		};
+		});
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
 	}
-	async *iterate(sub) {
-		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
-		sub.iterating = true;
-		for (;;) {
-			const next = sub.queue.shift();
-			if (next === void 0) {
-				if (sub.closedReason !== null) return;
-				await new Promise((resolve) => {
-					sub.wake = resolve;
-				});
-				continue;
-			}
-			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
-			sub.delivered += 1;
-			yield {
-				...next,
-				isLast
-			};
-			if (isLast) return;
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: require_dist.errMsg(err)
+				}
+			});
 		}
 	}
 };
@@ -4402,6 +4501,7 @@ var EgressTranscodeManager = class {
 		}
 		const actualHwAccel = child.decodeHwAccel();
 		if (decodeHwAccel !== null && !require_dist.isSoftwareDecode(decodeHwAccel) && actualHwAccel === null) this.opts.onDecodeHwAccelFailed?.(decodeHwAccel);
+		else if (actualHwAccel !== null && !require_dist.isSoftwareDecode(actualHwAccel)) this.opts.onDecodeHwAccelSucceeded?.(actualHwAccel);
 		const entry = {
 			key,
 			deviceId,
@@ -4604,7 +4704,7 @@ var EgressTranscodeManager = class {
 	*
 	* The child owns the software retry and the liveness reporting itself, in the
 	* same shape as the other two transports; this wrapper is the adapter, not
-	* the logic. See `egress-fragment-child.ts`.
+	* the logic. See the primitive's `ffmpeg/fmp4-fragment-child.ts`.
 	*/
 	createFragmentChild(spec, fragments) {
 		const child = new Fmp4FragmentChild({
@@ -4614,7 +4714,7 @@ var EgressTranscodeManager = class {
 			...this.opts.fragmentFirstUnitTimeoutMs === void 0 ? {} : { firstUnitTimeoutMs: this.opts.fragmentFirstUnitTimeoutMs },
 			...spec.onDied ? { onChildExit: spec.onDied } : {}
 		}, {
-			brokerId: spec.brokerId,
+			sourceId: spec.brokerId,
 			deviceId: spec.deviceId,
 			fragmentMs: fragments.fragmentMs,
 			invocation: spec.invocation,
@@ -9863,6 +9963,29 @@ var StreamBroker = class StreamBroker {
 	* right model based on per-camera codec + sample rate.
 	*/
 	audioTrackInfo = null;
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83) — operator policy, not a stream fact.
+	*
+	* While true this broker distributes NO audio on any plane it serves. It is
+	* applied at the three points audio ENTERS the broker (`onAudioRtp`,
+	* `pushEncodedPacket`) and re-checked at the single point it LEAVES
+	* (`fanOutEncoded`), so a packet already inside a decode session when the
+	* mute lands cannot escape.
+	*
+	* Deliberately NOT cleared by `resetStreamState` / a re-dial: it is device
+	* policy that outlives any one connection. `StreamBrokerManager` re-applies
+	* it to every freshly created broker for the same reason.
+	*/
+	audioMuted = false;
+	/** Audio units dropped by the mute since the current dial. Surfaced in stats. */
+	audioMutedDropped = 0;
+	/**
+	* One-shot per dial: the mute's drop is announced the FIRST time it actually
+	* drops something, not once per packet. A broker created while already muted
+	* has no transition to log, and a silent drop reads as "the camera has no
+	* microphone" — which is the confusion this whole row exists to remove.
+	*/
+	audioMutedDropLogged = false;
 	reconnectTimer;
 	placeholderTimer;
 	reconnectDelayMs = INITIAL_RECONNECT_DELAY_MS;
@@ -10414,6 +10537,69 @@ var StreamBroker = class StreamBroker {
 			this.logger?.warn("source-restart observer threw", { meta: { error: require_dist.errMsg(err) } });
 		}
 	}
+	/**
+	* Turn this broker's audio plane off (or back on).
+	*
+	* Idempotent: setting the value it already holds does nothing at all — in
+	* particular it does NOT churn the RTSP sessions, so the manager can call
+	* this on every broker creation and every reconcile pass without cost.
+	*
+	* A real transition closes the restreamer's audio-bearing pull sessions.
+	* That is not incidental: the recorder pulls this restreamer with `-map 0`,
+	* so its ffmpeg maps whatever the SDP declared at CONNECT time. Dropping the
+	* RTP while leaving an `m=audio` in its SDP would leave it waiting on an
+	* audio stream that never delivers (the mp4 muxer holds video up to
+	* `max_interleave_delta`). Re-pulling is what makes the recording honestly
+	* audio-less rather than audio-declared-and-starved. The recorder's
+	* `SegmentWriter` respawns on exit with bounded backoff, so the cost is one
+	* segment boundary per flip.
+	*/
+	setAudioMuted(muted) {
+		if (this.audioMuted === muted) return;
+		this.audioMuted = muted;
+		this.audioMutedDropped = 0;
+		this.audioMutedDropLogged = false;
+		const closedPulls = this.rtspRestreamer.setAudioMuted(muted);
+		this.logger?.info(muted ? "audio plane MUTED broker-side — live and recording go silent" : "audio plane UNMUTED broker-side — audio distribution resumes", {
+			tags: { deviceId: this.numericDeviceId },
+			meta: {
+				brokerId: this.deviceId,
+				audioCodec: this.audioCodec,
+				hasAudioTrack: this.audioTrackInfo !== null,
+				closedPulls
+			}
+		});
+	}
+	/** The broker's own audio-plane policy. `true` = distributing no audio. */
+	isAudioMuted() {
+		return this.audioMuted;
+	}
+	/**
+	* True when the current connection is muxing audio at all — the OBSERVED
+	* half of the D83 audio-plane reconcile. Read off the SDP/track snapshot
+	* rather than a packet counter so a camera that negotiated an audio track
+	* and has simply been quiet does not read as a missing mux.
+	*/
+	hasAudioTrack() {
+		return this.audioTrackInfo !== null;
+	}
+	/**
+	* Account for one audio unit the mute threw away, announcing the FIRST one
+	* per dial. Never per-packet: at 50 pps a line each would be its own outage.
+	*/
+	dropMutedAudio(where) {
+		this.audioMutedDropped += 1;
+		if (this.audioMutedDropLogged) return;
+		this.audioMutedDropLogged = true;
+		this.logger?.info("audio muted broker-side — dropping this camera’s audio plane", {
+			tags: { deviceId: this.numericDeviceId },
+			meta: {
+				brokerId: this.deviceId,
+				where,
+				audioCodec: this.audioCodec
+			}
+		});
+	}
 	/** Set whether pre-buffer counts as demand. When false and no other consumers, the broker suspends. */
 	setPreBufferEnabled(enabled) {
 		this._preBufferEnabled = enabled;
@@ -10686,6 +10872,10 @@ var StreamBroker = class StreamBroker {
 			}
 			this.resetPushStallTimer();
 		}
+		if (packet.type === "audio" && this.audioMuted) {
+			this.dropMutedAudio("push-encoded");
+			return;
+		}
 		if (packet.type === "audio" && this.source?.type === "push" && this.audioCodecSession) {
 			const codec = packet.codec.toLowerCase();
 			if (codec !== "pcmu" && codec !== "pcma") {
@@ -10966,6 +11156,10 @@ var StreamBroker = class StreamBroker {
 	* safe one.
 	*/
 	fanOutEncoded(packet) {
+		if (packet.type === "audio" && this.audioMuted) {
+			this.dropMutedAudio("encoded-fanout");
+			return;
+		}
 		for (const [cb, entry] of this.encodedCallbacks) try {
 			cb(packet);
 			entry.packetsDelivered += 1;
@@ -11244,7 +11438,9 @@ var StreamBroker = class StreamBroker {
 			preBufferMs: this.preBuffer.getBufferedDurationMs(),
 			preBufferPackets: this.preBuffer.getPacketCount(),
 			decoderNodeId: this.frameHandlePlane?.decoderNodeIds()[0] ?? null,
-			audio: this.audioTrackInfo ?? null
+			audio: this.audioTrackInfo ?? null,
+			audioMuted: this.audioMuted,
+			audioMutedDropped: this.audioMutedDropped
 		};
 	}
 	/**
@@ -11679,6 +11875,10 @@ var StreamBroker = class StreamBroker {
 			onAudioRtp: (rtpData) => {
 				if (this.stopping) return;
 				this.kickRtpActivityWatchdog();
+				if (this.audioMuted) {
+					this.dropMutedAudio("rtsp-audio-rtp");
+					return;
+				}
 				this.audioRtpSeen++;
 				if (this.audioRtpSeen === 1 || this.audioRtpSeen === 50) this.logger?.info("audio: rtp packet received", { meta: {
 					seq: this.audioRtpSeen,
@@ -12341,6 +12541,79 @@ function hexToBytes(hex) {
 	}
 	return out;
 }
+/**
+* Minimum gap between two re-dials of the same device. A re-dial costs a
+* ~2 s video interruption on every source of the camera; at the 30 s
+* reconcile cadence, an un-cooled loop against a camera whose audio genuinely
+* cannot come back would be a permanent stutter.
+*/
+var AUDIO_PLANE_REDIAL_COOLDOWN_MS = 5 * 6e4;
+var EMPTY_AUDIO_PLANE_STATE = {
+	disagreements: 0,
+	redials: 0,
+	lastRedialMs: 0,
+	gaveUp: false
+};
+/**
+* Decide what one pass should do. Pure: no clock, no I/O, no broker.
+*
+* `nowMs` is passed in rather than read so the cooldown is testable without
+* waiting five minutes for it.
+*/
+function decideAudioPlaneAction(observation, state, nowMs) {
+	switch (observation.kind) {
+		case "broker-muted":
+		case "no-live-source":
+		case "audio-present":
+		case "declared-off": return {
+			action: { kind: "none" },
+			nextState: EMPTY_AUDIO_PLANE_STATE
+		};
+		case "read-failed":
+		case "audio-unknown": return {
+			action: { kind: "none" },
+			nextState: state
+		};
+		case "declared-on": {
+			if (state.gaveUp) return {
+				action: { kind: "none" },
+				nextState: state
+			};
+			const disagreements = state.disagreements + 1;
+			if (disagreements < 2) return {
+				action: { kind: "await-second-pass" },
+				nextState: {
+					...state,
+					disagreements
+				}
+			};
+			if (state.redials >= 3) return {
+				action: { kind: "give-up" },
+				nextState: {
+					...state,
+					disagreements,
+					gaveUp: true
+				}
+			};
+			if (state.lastRedialMs > 0 && nowMs - state.lastRedialMs < 3e5) return {
+				action: { kind: "cooldown" },
+				nextState: {
+					...state,
+					disagreements: 2
+				}
+			};
+			return {
+				action: { kind: "redial" },
+				nextState: {
+					disagreements: 0,
+					redials: state.redials + 1,
+					lastRedialMs: nowMs,
+					gaveUp: false
+				}
+			};
+		}
+	}
+}
 //#endregion
 //#region src/stream-broker/stream-broker/transcode-pipeline.ts
 /**
@@ -12825,12 +13098,31 @@ var DeviceOverrideSchema = require_dist.object({
 	preBuffer: require_dist.record(require_dist.string(), StreamPreBufferSchema).optional(),
 	joinBurstMaxSpanMs: require_dist.record(require_dist.string(), require_dist.number()).optional(),
 	streamingDebug: require_dist.boolean().optional(),
+	audioMuted: require_dist.boolean().optional(),
 	webrtcDebug: require_dist.boolean().optional(),
 	derivedStreams: require_dist.record(require_dist.string(), DerivedStreamSchema).optional(),
 	hwaccel: require_dist.record(require_dist.string(), FfmpegHwAccelSettingSchema).optional(),
 	sourceParser: require_dist.record(require_dist.string(), SourceParserSettingSchema).optional(),
 	sourceParserArgs: require_dist.record(require_dist.string(), SourceParserArgsEntrySchema).optional()
 });
+/**
+* Read `audioEnabled` off a `privacyMask.getStatus` payload (D83 reconcile).
+*
+* `getStatus` is the one cap method whose output is the generic device-status
+* shape rather than the cap's own schema, so it arrives untyped — this is the
+* documented type boundary, and a guard rather than a cast.
+*
+* `null` means UNKNOWN, and unknown must never become "audio is on": that is
+* the read that would re-dial a healthy stream on the strength of a payload
+* we could not parse. The camera says `null` itself when it has no microphone
+* control (`supportsAudioMute === false`), which lands in the same bucket for
+* the same reason.
+*/
+function readDeclaredAudioEnabled(v) {
+	if (v === null || typeof v !== "object") return null;
+	const raw = { ...v }["audioEnabled"];
+	return typeof raw === "boolean" ? raw : null;
+}
 /** Whole-blob schema for the persisted `deviceOverrides` store key:
 *  numeric-string deviceId → DeviceOverride (includes `derivedStreams`). */
 var DeviceOverridesMapSchema = require_dist.record(require_dist.string(), DeviceOverrideSchema);
@@ -12954,6 +13246,11 @@ var StreamBrokerManager = class StreamBrokerManager {
 	/** Per-device overrides (pre-buffer + legacy). */
 	deviceOverrides = /* @__PURE__ */ new Map();
 	/**
+	* D83 audio-plane reconcile memory, per device. Absent = agreeing; entries
+	* are deleted the moment a pass agrees, so a healthy fleet holds none.
+	*/
+	audioPlaneState = /* @__PURE__ */ new Map();
+	/**
 	* `deviceId:camStreamId` keys for which the `native-udp` → `native-tcp`
 	* fallback warning has already been logged, so the warn fires once per stream
 	* rather than on every source (re)build / dial.
@@ -13161,6 +13458,15 @@ var StreamBrokerManager = class StreamBrokerManager {
 	*/
 	egressHwAccelCache = require_dist.createHwAccelCache({ ttlMs: 6e4 });
 	/**
+	* Backends that could not create a device in THIS process. Separate from the
+	* memo above on purpose: the memo answers "what should decode this" on a read
+	* cadence and expires in a minute, so folding the failure into it meant the
+	* next cold child one minute later re-paid the same ~3 s death — measured
+	* seven times on 615 between 22:17 and 22:52 on 2026-08-07. See
+	* `dead-decode-backends.ts`.
+	*/
+	deadDecodeBackends = createDeadDecodeBackends();
+	/**
 	* Snapshot of the system `ffmpeg` config section (binaryPath / hwAccel /
 	* threadCount). Refreshed by the host addon via `setFfmpegConfig`; the
 	* transcode manager reads it live per spawn. Defaults are safe (PATH ffmpeg,
@@ -13360,8 +13666,17 @@ var StreamBrokerManager = class StreamBrokerManager {
 					};
 				},
 				onDecodeHwAccelFailed: (backend) => {
-					this.egressHwAccelCache.write(null);
-					this.logger.warn("egress transcode: decode backend FAILED in this process — software until the memo expires", { meta: { backend } });
+					const verdict = this.deadDecodeBackends.markDead(backend);
+					this.logger.warn("egress transcode: decode backend FAILED in this process — QUARANTINED, software until it is re-probed", { meta: {
+						backend,
+						failures: verdict.failures,
+						quarantineMs: verdict.quarantineMs
+					} });
+				},
+				onDecodeHwAccelSucceeded: (backend) => {
+					if (this.deadDecodeBackends.failuresOf(backend) === 0) return;
+					this.deadDecodeBackends.markAlive(backend);
+					this.logger.info("egress transcode: decode backend RECOVERED in this process — the quarantine is lifted", { meta: { backend } });
 				}
 			});
 		}
@@ -13384,6 +13699,22 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* hub).
 	*/
 	async resolveEgressHwAccel(deviceId, override) {
+		const resolved = await resolveWithQuarantine({
+			resolve: () => this.readEgressHwAccel(deviceId, override),
+			dead: this.deadDecodeBackends
+		});
+		if (resolved.veto !== null) this.logger.warn("egress transcode: decoding in SOFTWARE — the backend is QUARANTINED after failing in this process", {
+			tags: { deviceId },
+			meta: {
+				backend: resolved.veto.backend,
+				failures: resolved.veto.failures,
+				remainingMs: resolved.veto.remainingMs
+			}
+		});
+		return resolved.backend;
+	}
+	/** The decoder addon's answer for this node — before the process quarantine. */
+	async readEgressHwAccel(deviceId, override) {
 		const decoderApi = this.buildDecoderCapApi(deviceId);
 		return require_dist.resolveEgressDecodeHwAccel({
 			readDecoderBackend: async () => {
@@ -14301,7 +14632,96 @@ var StreamBrokerManager = class StreamBrokerManager {
 			this.disabledDevices.add(d.id);
 			await this.releaseDisabledDeviceBrokers(d.id, firstSeen);
 		} else this.disabledDevices.delete(d.id);
-		await Promise.allSettled(cameras.filter((d) => !d.disabled).map((d) => this.reconcileDeviceCatalog(d.id)));
+		const live = cameras.filter((d) => !d.disabled);
+		await Promise.allSettled(live.map((d) => this.reconcileDeviceCatalog(d.id)));
+		await Promise.allSettled(live.map((d) => this.reconcileDeviceAudioPlane(d.id)));
+		const liveIds = new Set(live.map((d) => d.id));
+		for (const deviceId of [...this.audioPlaneState.keys()]) if (!liveIds.has(deviceId)) this.audioPlaneState.delete(deviceId);
+	}
+	/**
+	* ONE device's audio-plane reconcile pass. See `audio-plane-reconcile.ts`
+	* for the decision rules; this half only gathers and acts.
+	*
+	* Every branch that changes nothing still says so at debug — the whole
+	* failure this repairs was invisible, and a reconcile whose "I looked and
+	* everything was fine" is unobservable is a reconcile nobody can trust
+	* after the next incident.
+	*/
+	async reconcileDeviceAudioPlane(deviceId) {
+		const observation = await this.observeAudioPlane(deviceId);
+		const { action, nextState } = decideAudioPlaneAction(observation, this.audioPlaneState.get(deviceId) ?? EMPTY_AUDIO_PLANE_STATE, Date.now());
+		if (nextState === EMPTY_AUDIO_PLANE_STATE) this.audioPlaneState.delete(deviceId);
+		else this.audioPlaneState.set(deviceId, nextState);
+		const meta = {
+			observed: observation.kind,
+			disagreements: nextState.disagreements,
+			redials: nextState.redials
+		};
+		switch (action.kind) {
+			case "none": return;
+			case "await-second-pass":
+				this.logger.info("audio-plane reconcile: camera declares audio but no broker carries a track — confirming on the next pass", {
+					tags: { deviceId },
+					meta
+				});
+				return;
+			case "cooldown":
+				this.logger.debug("audio-plane reconcile: disagreement held — re-dial cooling down", {
+					tags: { deviceId },
+					meta: {
+						...meta,
+						cooldownMs: AUDIO_PLANE_REDIAL_COOLDOWN_MS
+					}
+				});
+				return;
+			case "give-up":
+				this.logger.warn("audio-plane reconcile: giving up — the camera declares audio and re-dialing has not brought a track back", {
+					tags: { deviceId },
+					meta: {
+						...meta,
+						maxRedials: 3
+					}
+				});
+				return;
+			case "redial":
+				this.logger.info("audio-plane reconcile: audio declared but absent on every source — re-dialing", {
+					tags: { deviceId },
+					meta
+				});
+				this.redialDeviceSources(deviceId, "audio-plane-reconcile");
+				return;
+		}
+	}
+	/**
+	* The gather half. Cheap questions first: the expensive device read happens
+	* ONLY when the free in-memory answer already looks wrong.
+	*/
+	async observeAudioPlane(deviceId) {
+		if (this.deviceOverrides.get(deviceId)?.audioMuted === true) return { kind: "broker-muted" };
+		const streams = this.cameraStreams.get(deviceId);
+		if (!streams) return { kind: "no-live-source" };
+		const sources = [];
+		for (const [camStreamId, entry] of streams) {
+			if (entry.kind === "derived") continue;
+			const broker = this.brokers.get(brokerIdFor(deviceId, camStreamId));
+			if (broker && broker.status === "streaming") sources.push(broker);
+		}
+		if (sources.length === 0) return { kind: "no-live-source" };
+		if (sources.some((b) => b.hasAudioTrack())) return { kind: "audio-present" };
+		if (!this.api) return { kind: "read-failed" };
+		let status;
+		try {
+			status = await this.api.privacyMask.getStatus.query({ deviceId });
+		} catch (err) {
+			this.logger.debug("audio-plane reconcile: device audio read failed — changing nothing", {
+				tags: { deviceId },
+				meta: { error: require_dist.errMsg(err) }
+			});
+			return { kind: "read-failed" };
+		}
+		const declared = readDeclaredAudioEnabled(status);
+		if (declared === null) return { kind: "audio-unknown" };
+		return declared ? { kind: "declared-on" } : { kind: "declared-off" };
 	}
 	/** Release every live broker of a disabled device (idempotent — later poll
 	*  ticks find none and no-op). `logTransition` marks the disable EDGE. */
@@ -16260,6 +16680,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		broker.setRestreamUrlResolver(() => this.rtspProvider.getEntry(brokerId)?.mutedUrl ?? null);
 		broker.setFfmpegBinaryPath(this.ffmpegConfig.binaryPath);
 		this.applyPreBufferConfig(broker, deviceId, camStreamId);
+		this.applyAudioMuteConfig(broker, deviceId);
 		this.applyJoinBurstBound(broker, deviceId, camStreamId);
 		this.applyClipRetention(deviceId);
 		if (this.deviceOverrides.get(deviceId)?.streamingDebug) broker.setStreamingDebug(true);
@@ -16455,6 +16876,72 @@ var StreamBrokerManager = class StreamBrokerManager {
 		broker.setPreBufferEnabled(defaultWarm);
 		broker.setPreBufferDuration(defaultWarm ? this.defaultPreBufferSec : 0);
 	}
+	/** Push the persisted mute onto a broker. Idempotent — safe on every pass. */
+	applyAudioMuteConfig(broker, deviceId) {
+		broker.setAudioMuted(this.deviceOverrides.get(deviceId)?.audioMuted === true);
+	}
+	/** Every live broker of a device, derived and source alike. */
+	brokersOfDevice(deviceId) {
+		const streams = this.cameraStreams.get(deviceId);
+		if (!streams) return [];
+		const found = [];
+		for (const camStreamId of streams.keys()) {
+			const broker = this.brokers.get(brokerIdFor(deviceId, camStreamId));
+			if (broker) found.push(broker);
+		}
+		return found;
+	}
+	/**
+	* `streamBroker.getDeviceAudioMute` — read the device's audio-plane policy.
+	*
+	* The STORE is the answer, not the brokers: the policy applies to brokers
+	* that do not exist yet, so a camera with nothing dialled is still muted.
+	* `appliedBrokers` reports how much of it is presently in force, and is
+	* diagnostic only — a switch that read it as the state would flip itself
+	* off every time the camera went idle.
+	*/
+	getDeviceAudioMute(input) {
+		return {
+			muted: this.deviceOverrides.get(input.deviceId)?.audioMuted === true,
+			appliedBrokers: this.brokersOfDevice(input.deviceId).filter((b) => b.isAudioMuted()).length
+		};
+	}
+	/**
+	* Set the device's audio-plane policy: persist it, then apply it to every
+	* live broker — including DERIVED ones, whose restreamer would otherwise
+	* keep serving an `m=audio` grafted from its transcode egress.
+	*
+	* Persist BEFORE applying. If the process dies between the two, the next
+	* boot re-applies from the store and the camera is silent as asked; the
+	* other order loses the operator's decision and the camera is audible again
+	* with the switch still reading off.
+	*/
+	async setDeviceAudioMute(input) {
+		const { deviceId, muted } = input;
+		const prior = this.deviceOverrides.get(deviceId)?.audioMuted === true;
+		const next = {
+			...this.deviceOverrides.get(deviceId),
+			audioMuted: muted
+		};
+		this.deviceOverrides.set(deviceId, next);
+		this.deviceOverridePersister?.(this.deviceOverrides);
+		const brokers = this.brokersOfDevice(deviceId);
+		for (const broker of brokers) broker.setAudioMuted(muted);
+		if (prior !== muted) {
+			this.logger.info("broker audio mute set", {
+				tags: { deviceId },
+				meta: {
+					muted,
+					brokers: brokers.length
+				}
+			});
+			this.audioPlaneState.delete(deviceId);
+		}
+		return Promise.resolve({
+			muted,
+			appliedBrokers: brokers.filter((b) => b.isAudioMuted()).length
+		});
+	}
 	async fanOutRegistration(_deviceId, brokerId, _cam, broker) {
 		if (this.webrtcServer) this.webrtcServer.registerBroker(brokerId, broker);
 	}
@@ -17936,6 +18423,17 @@ var AdaptiveSession = class AdaptiveSession {
 	acquireTranscodeEgress;
 	/** The acquired egress, while this session holds a reference to it. */
 	transcodeEgressLeg = null;
+	/**
+	* An acquire started at the ANSWER and not yet consumed by the feed.
+	*
+	* Read-and-null-out is the whole ownership protocol: whichever of
+	* `startTranscodeFeed` and `releaseTranscodeEgress` reads a non-null value
+	* owns the release, and since both read it synchronously exactly one can.
+	* Without that, a session closing while its prewarm is in flight either
+	* double-releases (the manager logs it as a consumer bookkeeping bug) or
+	* leaks a child the primitive has no TTL to reclaim.
+	*/
+	transcodeEgressPending = null;
 	/** Unsubscribe from the acquired egress's video plane. */
 	detachTranscodeEgress = null;
 	/** Codec actually negotiated with the browser after SDP answer. */
@@ -18575,6 +19073,7 @@ var AdaptiveSession = class AdaptiveSession {
 			negotiated: this.negotiatedCodec,
 			needsTranscode: this.needsTranscode
 		} });
+		this.prewarmTranscodeEgress();
 		if (this.debug) this.logger.info("Codec negotiation detail", { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
@@ -18773,6 +19272,7 @@ var AdaptiveSession = class AdaptiveSession {
 			setRemoteMs,
 			createAnswerMs
 		} });
+		this.prewarmTranscodeEgress();
 		if (this.debug) this.logger.info("Codec negotiation detail (client-offer)", { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
@@ -19493,6 +19993,51 @@ var AdaptiveSession = class AdaptiveSession {
 	* unchanged — the request asks for `audio: 'passthrough'` precisely so the
 	* child does not encode a plane this session never reads.
 	*/
+	/**
+	* Start the egress acquire NOW, in parallel with ICE and DTLS.
+	*
+	* `needsTranscode` is final the moment the answer's codec is known — the
+	* "Codec negotiated" line already prints it — but the acquire used to happen
+	* inside `startFeedingFrames`, which runs only after the DTLS wait. On camera
+	* 615 that put the leg ~2 s after session creation and the first packet ~5 s
+	* after that, against a browser watchdog that re-offers every ~5 s: the viewer
+	* was always gone before the media existed, and the next session paid for a
+	* cold child again. Three minutes of that on 2026-08-07 22:17–22:20.
+	*
+	* Only the ffmpeg moves. The ATTACH stays behind DTLS, because `sendRtp`
+	* silently drops before the transport is connected.
+	*
+	* Idempotent and safe to call from any negotiation path; a session that needs
+	* no transcode does nothing. Public for the same reason
+	* {@link armSourceSilenceWatchdog} is — the acquire/release contract is
+	* testable without standing up werift.
+	*/
+	prewarmTranscodeEgress() {
+		if (this.closed) return;
+		if (!this.needsTranscode) return;
+		if (this.transcodeEgressPending !== null || this.transcodeEgressLeg !== null) return;
+		const acquire = this.acquireTranscodeEgress;
+		if (acquire === null) return;
+		this.logger.info("Transcode leg: prewarming the egress while ICE/DTLS negotiate", { meta: {
+			phase: "session",
+			sessionId: this.sessionId,
+			deviceId: this.deviceId,
+			sourceCodec: this.sourceCodec
+		} });
+		this.transcodeEgressPending = acquire({
+			profile: this.transcodeProfile,
+			sessionId: this.sessionId
+		});
+	}
+	/**
+	* Take ownership of the in-flight prewarm, if there is one. Nulls the field
+	* synchronously so the release path can never also claim it — see the field.
+	*/
+	claimPrewarmedEgress() {
+		const pending = this.transcodeEgressPending;
+		this.transcodeEgressPending = null;
+		return pending;
+	}
 	startTranscodeFeed(signal) {
 		const acquire = this.acquireTranscodeEgress;
 		if (acquire === null) {
@@ -19504,20 +20049,32 @@ var AdaptiveSession = class AdaptiveSession {
 			if (!this.closed) this.close();
 			return;
 		}
+		const prewarmed = this.claimPrewarmedEgress();
 		this.logger.info(`Starting ${this.sourceCodec}→H.264 Baseline transcode leg`, { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
 			deviceId: this.deviceId,
 			sourceCodec: this.sourceCodec,
-			mode: "egress-primitive"
+			mode: "egress-primitive",
+			prewarmed: prewarmed !== null
 		} });
+		const acquireNow = () => acquire({
+			profile: this.transcodeProfile,
+			sessionId: this.sessionId
+		});
 		(async () => {
 			let leg;
 			try {
-				leg = await acquire({
-					profile: this.transcodeProfile,
-					sessionId: this.sessionId
-				});
+				leg = await (prewarmed === null ? acquireNow() : prewarmed.catch((err) => {
+					if (signal.aborted || this.closed) throw err;
+					this.logger.warn("Transcode leg: the prewarmed acquire failed — retrying now that the feed has started", { meta: {
+						phase: "session",
+						sessionId: this.sessionId,
+						deviceId: this.deviceId,
+						error: require_dist.errMsg(err)
+					} });
+					return acquireNow();
+				}));
 			} catch (err) {
 				this.logger.error("Transcode feed: acquiring the egress transcode FAILED", { meta: {
 					phase: "session",
@@ -19585,6 +20142,14 @@ var AdaptiveSession = class AdaptiveSession {
 		try {
 			detach?.();
 		} catch {}
+		const orphan = this.claimPrewarmedEgress();
+		if (orphan !== null) orphan.then((prewarmedLeg) => prewarmedLeg.release()).catch((err) => {
+			this.logger.debug("Transcode leg: the unclaimed prewarm ended without a handle", { meta: {
+				phase: "session",
+				sessionId: this.sessionId,
+				error: require_dist.errMsg(err)
+			} });
+		});
 		const leg = this.transcodeEgressLeg;
 		this.transcodeEgressLeg = null;
 		if (!leg) return;