@camstack/addon-pipeline 1.2.45 → 1.2.47

package/dist/stream-broker/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-QyZ7QSRP.js");
+const require_dist = require("../dist-C9Q1t0nT.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_model_download_service_D8B_4ktF = require("../model-download-service-D8B-4ktF-7-YxE9Wx.js");
 let node_crypto = require("node:crypto");
@@ -3011,6 +3011,220 @@ function buildAudioCodecCapApi(api) {
 		flushEncode: (input) => router.flushEncode.mutate(input)
 	};
 }
+/**
+* Minimum gap between two re-dials of the same device. A re-dial costs a
+* ~2 s video interruption on every source of the camera; at the 30 s
+* reconcile cadence, an un-cooled loop against a camera whose audio genuinely
+* cannot come back would be a permanent stutter.
+*/
+var AUDIO_PLANE_REDIAL_COOLDOWN_MS = 5 * 6e4;
+var EMPTY_AUDIO_PLANE_STATE = {
+	disagreements: 0,
+	redials: 0,
+	lastRedialMs: 0,
+	gaveUp: false
+};
+/**
+* Decide what one pass should do. Pure: no clock, no I/O, no broker.
+*
+* `nowMs` is passed in rather than read so the cooldown is testable without
+* waiting five minutes for it.
+*/
+function decideAudioPlaneAction(observation, state, nowMs) {
+	switch (observation.kind) {
+		case "broker-muted":
+		case "no-live-source":
+		case "audio-present":
+		case "declared-off": return {
+			action: { kind: "none" },
+			nextState: EMPTY_AUDIO_PLANE_STATE
+		};
+		case "read-failed":
+		case "audio-unknown": return {
+			action: { kind: "none" },
+			nextState: state
+		};
+		case "declared-on": {
+			if (state.gaveUp) return {
+				action: { kind: "none" },
+				nextState: state
+			};
+			const disagreements = state.disagreements + 1;
+			if (disagreements < 2) return {
+				action: { kind: "await-second-pass" },
+				nextState: {
+					...state,
+					disagreements
+				}
+			};
+			if (state.redials >= 3) return {
+				action: { kind: "give-up" },
+				nextState: {
+					...state,
+					disagreements,
+					gaveUp: true
+				}
+			};
+			if (state.lastRedialMs > 0 && nowMs - state.lastRedialMs < 3e5) return {
+				action: { kind: "cooldown" },
+				nextState: {
+					...state,
+					disagreements: 2
+				}
+			};
+			return {
+				action: { kind: "redial" },
+				nextState: {
+					disagreements: 0,
+					redials: state.redials + 1,
+					lastRedialMs: nowMs,
+					gaveUp: false
+				}
+			};
+		}
+	}
+}
+//#endregion
+//#region src/stream-broker/stream-broker/dead-decode-backends.ts
+/**
+* "This decode backend cannot create a device in THIS process" — remembered
+* across children, not per child.
+*
+* ## The thing this stops
+*
+* `-hwaccel vaapi` works for the decoder addon on this hub (ten concurrent 4K
+* decodes) and returns ENOMEM inside the stream-broker runner: `code=244`,
+* "Device creation failed: -12 … Cannot allocate memory". Every egress child
+* therefore spends ~3 s dying before its own software retry rescues it.
+*
+* That was already reported — `EgressTranscodeManager.onDecodeHwAccelFailed`
+* poisoned the broker's 60 s `egressHwAccelCache`. The memo is the wrong shape
+* for the verdict: it exists to avoid a per-session cross-process
+* `decoder.getInfo`, so it expires on a **read** cadence, and one minute later
+* the decoder answers `vaapi` again and the next cold child re-pays the death.
+* Measured on camera 615 on 2026-08-07: the hardware failure recurs at 22:17:07,
+* 22:18:42, 22:28:48, 22:30:52, 22:32:39, 22:34:07, 22:52:07 — once per memo
+* window, forever, on a hub where it has never once succeeded.
+*
+* ## Why this is a quarantine and not a tombstone
+*
+* A permanent verdict is wrong for the failure that is actually observed:
+* ENOMEM on device creation is a RESOURCE condition, and a resource condition
+* can clear (the operator gives the container more of the device, another
+* process releases it). A process that decided "never again" at 03:00 would
+* still be decoding in software at noon with a working accelerator, and nothing
+* would ever say so.
+*
+* So the verdict LASTS and escalates: each consecutive failure of the same
+* backend widens its quarantine — 30 min, 2 h, then 6 h — so a hub where the
+* backend is genuinely dead pays one probe per six hours instead of one per
+* minute, while a hub where it recovers still finds out.
+*
+* The FIRST rung is deliberately not a minute. One report is already a strong
+* signal: the manager only reports a backend after its child produced ZERO
+* packets *and* the software retry proved the same argv otherwise works, which
+* is a statement about the backend and not about the source. And the cost of
+* being wrong is bounded and already being paid — the egress encodes with
+* `libx264` either way, so an over-long quarantine costs a software DECODE on a
+* path that is decoding in software today, 100 % of the time.
+*
+* The invalidations are motivated, and there are exactly three:
+*
+*  1. **The window elapses.** The next acquire probes hardware once. If it
+*     works, {@link DeadDecodeBackends.markAlive} clears the record and the
+*     escalation starts from zero again.
+*  2. **The backend changes.** The record is keyed by backend name, so an
+*     operator switching the decoder from vaapi to qsv is obeyed immediately —
+*     qsv has no record.
+*  3. **The runner respawns.** This is instance state on the broker manager,
+*     never a module global, for the same reason `HwAccelCache` is: a module
+*     global outlives an addon respawn, and an addon respawn is exactly the
+*     event after which a stale verdict must not survive.
+*
+* ## Why it lives here and not in `@camstack/types`
+*
+* `addon-export-hap` has the identical gap (its `failedBackend` memo forgets on
+* the same 60 s cadence) and this is deliberately NOT shared with it yet: a
+* framework package is only live once a `@camstack/server` containing it is
+* installed, whereas this ships with `camstack deploy packages/addon-pipeline`.
+* The cross-PROCESS gap D67 names — addons may not import each other and no cap
+* carries "this backend is dead on this node right now" — is unchanged either
+* way; what is closed here is the broker's own repetition of the cost.
+*/
+/**
+* How long a backend stays quarantined after its 1st, 2nd, 3rd+ consecutive
+* failure. Escalating rather than fixed, and it starts at HALF AN HOUR: a
+* client watchdog cycles in seconds, so any first rung measured in minutes is
+* re-paid by the very churn this exists to stop. The last rung makes a
+* permanently-broken backend cost ~nothing while still being re-probed.
+*/
+var DEAD_BACKEND_QUARANTINE_MS = [
+	18e5,
+	72e5,
+	216e5
+];
+/**
+* The decoder's answer, overruled while the backend it names is quarantined.
+*
+* Composed rather than folded into `resolveEgressDecodeHwAccel`: that function
+* answers "what SHOULD decode this", which is a per-node property of the
+* hardware; this answers "what has been observed to work in THIS process",
+* which is a property of the runner. Keeping them apart is what stops a
+* runner-local ENOMEM from being mistaken for a node that has no accelerator —
+* the first is a flow bug to fix, the second a capability limit to accept.
+*/
+async function resolveWithQuarantine(input) {
+	const backend = await input.resolve();
+	if (backend === null || !input.dead.isQuarantined(backend)) return {
+		backend,
+		veto: null
+	};
+	return {
+		backend: null,
+		veto: {
+			backend,
+			failures: input.dead.failuresOf(backend),
+			remainingMs: input.dead.remainingMs(backend)
+		}
+	};
+}
+function createDeadDecodeBackends(options = {}) {
+	const now = options.now ?? (() => Date.now());
+	const records = /* @__PURE__ */ new Map();
+	const quarantineFor = (failures) => {
+		return DEAD_BACKEND_QUARANTINE_MS[Math.min(failures, DEAD_BACKEND_QUARANTINE_MS.length) - 1] ?? DEAD_BACKEND_QUARANTINE_MS[0] ?? 0;
+	};
+	return {
+		markDead(backend) {
+			const failures = (records.get(backend)?.failures ?? 0) + 1;
+			const quarantineMs = quarantineFor(failures);
+			records.set(backend, {
+				failures,
+				until: now() + quarantineMs
+			});
+			return {
+				backend,
+				failures,
+				quarantineMs
+			};
+		},
+		markAlive(backend) {
+			records.delete(backend);
+		},
+		isQuarantined(backend) {
+			const record = records.get(backend);
+			return record !== void 0 && now() < record.until;
+		},
+		remainingMs(backend) {
+			const record = records.get(backend);
+			if (record === void 0) return 0;
+			return Math.max(0, record.until - now());
+		},
+		failuresOf(backend) {
+			return records.get(backend)?.failures ?? 0;
+		}
+	};
+}
 //#endregion
 //#region src/stream-broker/stream-broker/ffmpeg-invocation.ts
 /** The full set of hwaccel settings (for validation + option surfaces). */
@@ -4360,6 +4574,7 @@ var EgressTranscodeManager = class {
 		}
 		const actualHwAccel = child.decodeHwAccel();
 		if (decodeHwAccel !== null && !require_dist.isSoftwareDecode(decodeHwAccel) && actualHwAccel === null) this.opts.onDecodeHwAccelFailed?.(decodeHwAccel);
+		else if (actualHwAccel !== null && !require_dist.isSoftwareDecode(actualHwAccel)) this.opts.onDecodeHwAccelSucceeded?.(actualHwAccel);
 		const entry = {
 			key,
 			deviceId,
@@ -4889,6 +5104,190 @@ var EgressTranscodeManager = class {
 		};
 	}
 };
+var EventMediaStore = class {
+	deps;
+	/** Insertion-ordered — `Map` iteration order IS the eviction order. */
+	items = /* @__PURE__ */ new Map();
+	totalBytes = 0;
+	constructor(deps = {}) {
+		this.deps = deps;
+	}
+	get size() {
+		return this.items.size;
+	}
+	get bytes() {
+		return this.totalBytes;
+	}
+	/** Store one artifact and return its handle. */
+	put(input) {
+		const now = this.deps.now ?? Date.now;
+		this.sweep();
+		const handle = `evm_${input.deviceId}_${(this.deps.makeId ?? defaultId)()}`;
+		this.items.set(handle, {
+			handle,
+			storedAt: now(),
+			...input
+		});
+		this.totalBytes += input.bytes.length;
+		const maxBytes = this.deps.maxBytes ?? 67108864;
+		while (this.totalBytes > maxBytes && this.items.size > 1) {
+			const oldest = this.items.keys().next().value;
+			if (oldest === void 0) break;
+			this.drop(oldest);
+		}
+		return handle;
+	}
+	/** Redeem a handle. `null` when it never existed or has expired. */
+	get(handle) {
+		this.sweep();
+		return this.items.get(handle) ?? null;
+	}
+	/** Drop everything — shutdown. */
+	clear() {
+		this.items.clear();
+		this.totalBytes = 0;
+	}
+	sweep() {
+		const now = (this.deps.now ?? Date.now)();
+		const ttl = this.deps.ttlMs ?? 3e5;
+		for (const [handle, item] of this.items) {
+			if (now - item.storedAt < ttl) break;
+			this.drop(handle);
+		}
+	}
+	drop(handle) {
+		const item = this.items.get(handle);
+		if (item === void 0) return;
+		this.items.delete(handle);
+		this.totalBytes -= item.bytes.length;
+	}
+};
+var counter = 0;
+function defaultId() {
+	counter += 1;
+	return `${Date.now().toString(36)}${counter.toString(36)}`;
+}
+/** A derive that has not finished by now will not finish inside the drain. */
+var GIF_RENDER_TIMEOUT_MS = 2e4;
+/**
+* The filter chain. Extracted so a test can assert the palette pair without
+* spawning ffmpeg — an argv test cannot see quality, but it can see a filter
+* that somebody deleted.
+*/
+function gifFilterComplex(input) {
+	const setpts = input.speed !== 1 ? `,setpts=PTS/${input.speed}` : "";
+	return `[0:v]fps=${input.fps}${setpts},scale=${input.maxWidth}:-2:flags=lanczos,split[a][b];[a]palettegen=stats_mode=diff[p];[b][p]paletteuse=dither=bayer:bayer_scale=5:diff_mode=rectangle`;
+}
+/** The full argv, for the same reason. */
+function gifFromMp4Args(input) {
+	return [
+		"-y",
+		"-v",
+		"error",
+		"-f",
+		"mp4",
+		"-i",
+		"pipe:0",
+		"-filter_complex",
+		gifFilterComplex(input),
+		"-loop",
+		"0",
+		"-f",
+		"gif",
+		"pipe:1"
+	];
+}
+/**
+* Derive the gif. `null` on every failure — a notification that lost its gif is
+* a notification, and one that failed is not.
+*
+* The child is guaranteed dead before this settles: these run on every
+* notification that asks for a gif, and a leaked ffmpeg accumulates on the node
+* until somebody notices the host is slow.
+*/
+async function gifFromMp4(input) {
+	const args = gifFromMp4Args({
+		maxWidth: input.maxWidth ?? 640,
+		fps: input.fps ?? 8,
+		speed: input.speed ?? 1
+	});
+	const startedAt = Date.now();
+	try {
+		const bytes = await runGif(input, args);
+		input.logger?.info("nc gif: derived from the notification video", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				sourceBytes: input.mp4.length,
+				gifBytes: bytes.length,
+				width: input.maxWidth ?? 640,
+				fps: input.fps ?? 8,
+				encodeMs: Date.now() - startedAt
+			}
+		});
+		return bytes;
+	} catch (err) {
+		input.logger?.warn("nc gif: the derive failed — this notification ships without a gif", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				sourceBytes: input.mp4.length,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	}
+}
+function runGif(input, args) {
+	return new Promise((resolve, reject) => {
+		const proc = input.spawnFn(input.ffmpegPath ?? "ffmpeg", [...args], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		const chunks = [];
+		let stderrTail = "";
+		let done = false;
+		let timer = null;
+		const settle = (err, out) => {
+			if (done) return;
+			done = true;
+			if (timer !== null) clearTimeout(timer);
+			if (proc.exitCode === null && proc.signalCode === null) try {
+				proc.kill("SIGKILL");
+			} catch {}
+			try {
+				proc.stdout?.removeAllListeners();
+				proc.stderr?.removeAllListeners();
+				proc.stdin?.destroy();
+			} catch {}
+			if (err !== null) reject(err);
+			else resolve(out ?? new Uint8Array(0));
+		};
+		timer = setTimeout(() => settle(/* @__PURE__ */ new Error("gif derive timed out")), GIF_RENDER_TIMEOUT_MS);
+		timer.unref?.();
+		proc.stdout?.on("data", (c) => chunks.push(c));
+		proc.stderr?.on("data", (c) => {
+			stderrTail = (stderrTail + c.toString()).slice(-400);
+		});
+		proc.on("error", (err) => settle(err instanceof Error ? err : new Error(String(err))));
+		proc.on("close", (code) => {
+			if (code !== 0) {
+				settle(/* @__PURE__ */ new Error(`ffmpeg gif derive exited ${code}: ${stderrTail}`));
+				return;
+			}
+			const out = Buffer.concat(chunks);
+			if (out.byteLength === 0) {
+				settle(/* @__PURE__ */ new Error("gif derive produced no bytes"));
+				return;
+			}
+			const bytes = new Uint8Array(out.byteLength);
+			bytes.set(out);
+			settle(null, bytes);
+		});
+		proc.stdin?.on("error", () => {});
+		proc.stdin?.write(Buffer.from(input.mp4));
+		proc.stdin?.end();
+	});
+}
 //#endregion
 //#region src/stream-broker/webrtc/nal-utils.ts
 var NAL_START_CODE_4B = Buffer.from([
@@ -5413,6 +5812,46 @@ function pickClipProfile(assigned, requested) {
 	return null;
 }
 /**
+* The tallest rendition an event clip is cut from.
+*
+* 1080 and not 720: the attachment is native-resolution H.264 that nothing
+* re-encodes, and the operator asked for a clip they could actually watch. A
+* few seconds of 4K copy is megabytes, which is the difference between "every
+* notifier takes it" and "pushover drops it at 5 MiB".
+*/
+var EVENT_CLIP_MAX_HEIGHT = 1080;
+/**
+* The rendition an EVENT production should cut from — the opposite default to
+* {@link pickClipProfile}.
+*
+* `pickClipProfile` takes the cheapest assigned slot, which was right when a
+* notification attachment was a 480 px thumbnail with motion. It is wrong now:
+* on this fleet the cheapest slot is a 640×360 substream, and a gif derived
+* from it is the "de-pixellated" attachment the operator reported. So an event
+* production prefers the LARGEST H.264 rendition at or below
+* {@link EVENT_CLIP_MAX_HEIGHT}:
+*
+*  - **H.264, because that is what can be COPIED.** An H.265 slot forces a
+*    re-encode, which is both expensive and not universally playable on the
+*    phones notifications land on.
+*  - **At or below 1080p**, falling back to the smallest slot above it when a
+*    camera offers nothing else — a 4K-only camera still gets a clip, it just
+*    pays for it.
+*
+* `null` when no rendition qualifies; the caller then falls back to
+* `pickClipProfile` and the answer reports which was used.
+*/
+function pickBestClipProfile(candidates) {
+	const usable = candidates.filter((c) => normaliseCodec$1(c.codec) === "h264" && (c.height ?? 0) > 0 && (c.width ?? 0) > 0);
+	if (usable.length === 0) return null;
+	const within = usable.filter((c) => (c.height ?? 0) <= EVENT_CLIP_MAX_HEIGHT);
+	return [...within.length > 0 ? within : usable].sort((a, b) => within.length > 0 ? (b.height ?? 0) - (a.height ?? 0) : (a.height ?? 0) - (b.height ?? 0))[0]?.profile ?? null;
+}
+/** Publishers spell H.265 four ways; the same normalisation the broker uses. */
+function normaliseCodec$1(codec) {
+	return (codec ?? "").toLowerCase().replace(/[.\s-]/g, "");
+}
+/**
 * Placeholder packets ("RECONNECTING"/"SLEEPING" keyframes the broker pumps at
 * 1 Hz while no RTP flows) are a DIFFERENT resolution and parameter set —
 * muxing them into a clip corrupts the decode and produces a file that freezes
@@ -5469,6 +5908,33 @@ function windowAround(input) {
 	if (momentPts > newest.pts || momentPts < oldest.pts) return [];
 	return sliceFromKeyframe(video, startPts, endPts);
 }
+/**
+* What the selected window covers, in WALL CLOCK.
+*
+* The same anchoring {@link windowAround} selects by, and for the same reason:
+* `pts` is a stream clock with an arbitrary origin, so the only fixed point is
+* that the newest retained packet arrived (near enough) at `nowMs`. Every
+* earlier packet is `newest.pts − p.pts` milliseconds before it.
+*
+* This exists so a caller can say "the clip starts 4.1 s BEFORE the event"
+* instead of inferring it from a duration and a hope. A production whose
+* `fromTs` is after the event has no pre-roll, which is precisely the defect
+* that has to be visible rather than plausible.
+*/
+function windowCoverage(packets, window, nowMs) {
+	const video = decodableVideo(packets);
+	const newest = video[video.length - 1];
+	const first = window[0];
+	const last = window[window.length - 1];
+	if (newest === void 0 || first === void 0 || last === void 0) return {
+		fromTs: nowMs,
+		toTs: nowMs
+	};
+	return {
+		fromTs: nowMs - (newest.pts - first.pts),
+		toTs: nowMs - (newest.pts - last.pts)
+	};
+}
 /** True for an HEVC packet — the container flag and the demuxer both differ. */
 function isHevcPacket(packet) {
 	const codec = (packet?.codec ?? "h264").toLowerCase();
@@ -5501,6 +5967,36 @@ function toElementaryStream(window, sdpParameterSets) {
 	return Buffer.concat(parts);
 }
 var RENDER_TIMEOUT_MS = 2e4;
+/**
+* Whether this render can COPY the camera's own H.264 instead of re-encoding it.
+*
+* The ring already holds the camera's elementary stream. Re-encoding it is only
+* ever necessary to change something, so the question is entirely "is anything
+* being changed":
+*
+*  - **A scale is a change.** Only when the caller asks for at least the
+*    source's own width is the `scale` filter an identity. `sourceWidth === 0`
+*    means nobody knows the source's width, and a copy would then be a guess —
+*    so it re-encodes, which is what it always did.
+*  - **A speed is a change.** `setpts` rewrites the timeline.
+*  - **H.265 is a change we WANT.** The mp4 lands on phones, and HEVC in an mp4
+*    is not universally playable there; transcoding an H.265 camera's clip to
+*    H.264 is the one case where the re-encode is the feature. (It is also why
+*    the clip ring remains the fallback for an H.265-only camera rather than
+*    something to delete.)
+*  - **A GIF is a re-encode by definition.**
+*
+* Copying is what makes a notification clip the camera's own 1280×720 picture
+* rather than `libx264 -crf 28` at 480 px — measured on 615, the same eleven
+* seconds are 224 KB copied against a visibly softer re-encode, and the gif
+* derived from it stops looking pixellated for the same reason.
+*/
+function clipCanCopy(input) {
+	if (input.format !== "mp4") return false;
+	if (input.hevc === true) return false;
+	if ((input.speed ?? 2) !== 1) return false;
+	return input.sourceWidth > 0 && input.maxWidth >= input.sourceWidth;
+}
 /** ffmpeg args for the chosen container, reading an annex-B stream from stdin. */
 function clipFfmpegArgs(input) {
 	const scale = `scale=${input.maxWidth}:-2:flags=lanczos`;
@@ -5521,6 +6017,21 @@ function clipFfmpegArgs(input) {
 		"gif",
 		"pipe:1"
 	];
+	if (input.copyVideo === true) return [
+		"-y",
+		"-f",
+		demuxer,
+		"-i",
+		"pipe:0",
+		"-c:v",
+		"copy",
+		"-movflags",
+		"frag_keyframe+empty_moov",
+		"-an",
+		"-f",
+		"mp4",
+		"pipe:1"
+	];
 	return [
 		"-y",
 		"-f",
@@ -5557,9 +6068,17 @@ async function renderPreBufferClip(input) {
 	if (window.length === 0) throw new Error("pre-buffer holds no decodable video for this window");
 	return new Promise((resolve, reject) => {
 		const hevc = isHevcPacket(window[0]);
+		const copyVideo = clipCanCopy({
+			format: input.format,
+			maxWidth: input.maxWidth,
+			...input.speed !== void 0 ? { speed: input.speed } : {},
+			hevc,
+			sourceWidth: input.sourceWidth ?? 0
+		});
 		const proc = input.spawn(input.ffmpegPath ?? "ffmpeg", clipFfmpegArgs({
 			...input,
-			hevc
+			hevc,
+			copyVideo
 		}));
 		const chunks = [];
 		let stderrTail = "";
@@ -12399,79 +12918,6 @@ function hexToBytes(hex) {
 	}
 	return out;
 }
-/**
-* Minimum gap between two re-dials of the same device. A re-dial costs a
-* ~2 s video interruption on every source of the camera; at the 30 s
-* reconcile cadence, an un-cooled loop against a camera whose audio genuinely
-* cannot come back would be a permanent stutter.
-*/
-var AUDIO_PLANE_REDIAL_COOLDOWN_MS = 5 * 6e4;
-var EMPTY_AUDIO_PLANE_STATE = {
-	disagreements: 0,
-	redials: 0,
-	lastRedialMs: 0,
-	gaveUp: false
-};
-/**
-* Decide what one pass should do. Pure: no clock, no I/O, no broker.
-*
-* `nowMs` is passed in rather than read so the cooldown is testable without
-* waiting five minutes for it.
-*/
-function decideAudioPlaneAction(observation, state, nowMs) {
-	switch (observation.kind) {
-		case "broker-muted":
-		case "no-live-source":
-		case "audio-present":
-		case "declared-off": return {
-			action: { kind: "none" },
-			nextState: EMPTY_AUDIO_PLANE_STATE
-		};
-		case "read-failed":
-		case "audio-unknown": return {
-			action: { kind: "none" },
-			nextState: state
-		};
-		case "declared-on": {
-			if (state.gaveUp) return {
-				action: { kind: "none" },
-				nextState: state
-			};
-			const disagreements = state.disagreements + 1;
-			if (disagreements < 2) return {
-				action: { kind: "await-second-pass" },
-				nextState: {
-					...state,
-					disagreements
-				}
-			};
-			if (state.redials >= 3) return {
-				action: { kind: "give-up" },
-				nextState: {
-					...state,
-					disagreements,
-					gaveUp: true
-				}
-			};
-			if (state.lastRedialMs > 0 && nowMs - state.lastRedialMs < 3e5) return {
-				action: { kind: "cooldown" },
-				nextState: {
-					...state,
-					disagreements: 2
-				}
-			};
-			return {
-				action: { kind: "redial" },
-				nextState: {
-					disagreements: 0,
-					redials: state.redials + 1,
-					lastRedialMs: nowMs,
-					gaveUp: false
-				}
-			};
-		}
-	}
-}
 //#endregion
 //#region src/stream-broker/stream-broker/transcode-pipeline.ts
 /**
@@ -13034,13 +13480,6 @@ function formatClockHHMM(at) {
 *  reach `streaming` with audio detected, and the stats poll cadence. */
 var PROBE_STREAM_TIMEOUT_MS = 6e3;
 var PROBE_STREAM_POLL_MS = 250;
-/**
-* Seconds of encoded video kept for notification clips, on the cheapest
-* assigned profile only. Sized to cover the longest allowed pre-roll (20 s)
-* plus the seconds a rule takes to reach the dispatcher; the low-profile
-* rendition costs a few MB for that window, and nothing at all while the
-* camera is idle.
-*/
 var CLIP_RETENTION_SEC = 25;
 /** Cheapest-first — the profile a clip is cut from when the rule says nothing. */
 var CLIP_PROFILE_BY_COST = [
@@ -13316,6 +13755,15 @@ var StreamBrokerManager = class StreamBrokerManager {
 	*/
 	egressHwAccelCache = require_dist.createHwAccelCache({ ttlMs: 6e4 });
 	/**
+	* Backends that could not create a device in THIS process. Separate from the
+	* memo above on purpose: the memo answers "what should decode this" on a read
+	* cadence and expires in a minute, so folding the failure into it meant the
+	* next cold child one minute later re-paid the same ~3 s death — measured
+	* seven times on 615 between 22:17 and 22:52 on 2026-08-07. See
+	* `dead-decode-backends.ts`.
+	*/
+	deadDecodeBackends = createDeadDecodeBackends();
+	/**
 	* Snapshot of the system `ffmpeg` config section (binaryPath / hwAccel /
 	* threadCount). Refreshed by the host addon via `setFfmpegConfig`; the
 	* transcode manager reads it live per spawn. Defaults are safe (PATH ffmpeg,
@@ -13515,8 +13963,17 @@ var StreamBrokerManager = class StreamBrokerManager {
 					};
 				},
 				onDecodeHwAccelFailed: (backend) => {
-					this.egressHwAccelCache.write(null);
-					this.logger.warn("egress transcode: decode backend FAILED in this process — software until the memo expires", { meta: { backend } });
+					const verdict = this.deadDecodeBackends.markDead(backend);
+					this.logger.warn("egress transcode: decode backend FAILED in this process — QUARANTINED, software until it is re-probed", { meta: {
+						backend,
+						failures: verdict.failures,
+						quarantineMs: verdict.quarantineMs
+					} });
+				},
+				onDecodeHwAccelSucceeded: (backend) => {
+					if (this.deadDecodeBackends.failuresOf(backend) === 0) return;
+					this.deadDecodeBackends.markAlive(backend);
+					this.logger.info("egress transcode: decode backend RECOVERED in this process — the quarantine is lifted", { meta: { backend } });
 				}
 			});
 		}
@@ -13539,6 +13996,22 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* hub).
 	*/
 	async resolveEgressHwAccel(deviceId, override) {
+		const resolved = await resolveWithQuarantine({
+			resolve: () => this.readEgressHwAccel(deviceId, override),
+			dead: this.deadDecodeBackends
+		});
+		if (resolved.veto !== null) this.logger.warn("egress transcode: decoding in SOFTWARE — the backend is QUARANTINED after failing in this process", {
+			tags: { deviceId },
+			meta: {
+				backend: resolved.veto.backend,
+				failures: resolved.veto.failures,
+				remainingMs: resolved.veto.remainingMs
+			}
+		});
+		return resolved.backend;
+	}
+	/** The decoder addon's answer for this node — before the process quarantine. */
+	async readEgressHwAccel(deviceId, override) {
 		const decoderApi = this.buildDecoderCapApi(deviceId);
 		return require_dist.resolveEgressDecodeHwAccel({
 			readDecoderBackend: async () => {
@@ -14729,6 +15202,156 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* of the event, not of the present.
 	*/
 	async renderPreBufferClip(input) {
+		const cut = await this.selectClipWindow({
+			deviceId: input.deviceId,
+			aroundMs: input.aroundMs,
+			preRollSec: input.preRollSec,
+			postRollSec: input.postRollSec,
+			...input.profile !== void 0 ? { profile: input.profile } : {}
+		});
+		const bytes = await this.muxClipWindow(cut, {
+			format: input.format,
+			maxWidth: input.maxWidth,
+			fps: input.fps,
+			...input.speed !== void 0 ? { speed: input.speed } : {}
+		});
+		const first = cut.window[0];
+		const last = cut.window[cut.window.length - 1];
+		return {
+			base64: Buffer.from(bytes).toString("base64"),
+			mime: input.format === "gif" ? "image/gif" : "video/mp4",
+			bytes: bytes.byteLength,
+			profile: cut.profile,
+			durationMs: first && last ? Math.max(0, last.pts - first.pts) : 0
+		};
+	}
+	/**
+	* ONE cut of an event, in every container the caller asked for — the
+	* production point every consumer of event media goes through.
+	*
+	* See the cap docblock for why this is one method rather than one call per
+	* format. The short version is that `renderPreBufferClip` renders one format
+	* per call, so a caller wanting a gif AND a video made two calls, got two
+	* windows, and shipped a notification whose two attachments showed different
+	* moments.
+	*
+	* The window comes out of the broker's own AnnexB retention ring — packets
+	* that were already in RAM — so a production reaches BACKWARDS from the event
+	* with nothing spawned and nothing kept warm. The mp4 is muxed once, COPYING
+	* the camera's own H.264 whenever nothing is being changed, and any gif is
+	* derived from that same mp4 rather than rendered a second time from the
+	* packets: same window, same pixels, by construction.
+	*/
+	async produceEventMedia(input) {
+		const preferred = input.profile ?? this.bestClipProfile(input.deviceId) ?? void 0;
+		const cut = await this.selectClipWindow({
+			deviceId: input.deviceId,
+			aroundMs: input.aroundMs,
+			preRollSec: input.preSeconds,
+			postRollSec: input.postSeconds,
+			...preferred !== void 0 ? { profile: preferred } : {}
+		});
+		const mp4 = await this.muxClipWindow(cut, {
+			format: "mp4",
+			maxWidth: Math.max(1, cut.sourceWidth),
+			fps: 0,
+			speed: input.speed
+		});
+		const media = [];
+		if (input.kinds.includes("mp4")) media.push({
+			kind: "mp4",
+			handle: this.eventMedia.put({
+				deviceId: input.deviceId,
+				kind: "mp4",
+				mime: "video/mp4",
+				bytes: mp4
+			}),
+			nodeId: this.localNodeId ?? "",
+			mime: "video/mp4",
+			bytes: mp4.byteLength,
+			width: cut.sourceWidth,
+			height: cut.sourceHeight
+		});
+		if (input.kinds.includes("gif")) {
+			const gif = await gifFromMp4({
+				mp4,
+				deviceId: input.deviceId,
+				maxWidth: input.gifMaxWidth,
+				fps: input.gifFps,
+				speed: 1,
+				...this.logger !== void 0 ? { logger: this.logger } : {},
+				spawnFn: node_child_process.spawn,
+				...this.ffmpegConfig.binaryPath !== void 0 ? { ffmpegPath: this.ffmpegConfig.binaryPath } : {}
+			});
+			if (gif !== null) {
+				const height = cut.sourceWidth > 0 ? Math.round(input.gifMaxWidth / cut.sourceWidth * cut.sourceHeight) : 0;
+				media.push({
+					kind: "gif",
+					handle: this.eventMedia.put({
+						deviceId: input.deviceId,
+						kind: "gif",
+						mime: "image/gif",
+						bytes: gif
+					}),
+					nodeId: this.localNodeId ?? "",
+					mime: "image/gif",
+					bytes: gif.byteLength,
+					width: input.gifMaxWidth,
+					height
+				});
+			}
+		}
+		const video = this.clipVideoMode(cut, {
+			format: "mp4",
+			maxWidth: Math.max(1, cut.sourceWidth),
+			speed: input.speed
+		});
+		this.logger?.info("event media produced — one window, every container", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				profile: cut.profile,
+				video,
+				resolution: `${cut.sourceWidth}x${cut.sourceHeight}`,
+				packets: cut.window.length,
+				kinds: [...input.kinds].join(","),
+				artifacts: media.map((m) => `${m.kind}:${m.bytes}`).join(" "),
+				startOffsetMs: cut.coverage.fromTs - input.aroundMs,
+				endOffsetMs: cut.coverage.toTs - input.aroundMs
+			}
+		});
+		return {
+			media,
+			coverage: {
+				fromTs: cut.coverage.fromTs,
+				toTs: cut.coverage.toTs,
+				packets: cut.window.length
+			},
+			profile: cut.profile,
+			video
+		};
+	}
+	/** Redeem an artifact handle. `null` once it has expired (see
+	*  {@link EventMediaStore}). */
+	async fetchEventMedia(input) {
+		const item = this.eventMedia.get(input.handle);
+		if (item === null) {
+			this.logger?.warn("event media: handle expired or unknown — nothing to fetch", { meta: { handle: input.handle } });
+			return null;
+		}
+		return {
+			base64: Buffer.from(item.bytes).toString("base64"),
+			mime: item.mime,
+			bytes: item.bytes.length
+		};
+	}
+	/**
+	* Wait out the post-roll, then select the retained window around the moment.
+	*
+	* Shared by `renderPreBufferClip` and `produceEventMedia` deliberately: two
+	* copies of "which profile, which packets, which resolution" is exactly how
+	* the two paths would start disagreeing again.
+	*/
+	async selectClipWindow(input) {
 		const map = this.assignments.get(input.deviceId)?.map ?? {};
 		const assigned = CLIP_PROFILE_BY_COST.filter((p) => map[p] !== void 0);
 		const wanted = pickClipProfile(assigned, input.profile);
@@ -14739,19 +15362,26 @@ var StreamBrokerManager = class StreamBrokerManager {
 		const candidates = [wanted, ...assigned.filter((p) => p !== wanted)];
 		let profile = null;
 		let window = [];
+		let coverage = {
+			fromTs: input.aroundMs,
+			toTs: input.aroundMs
+		};
 		for (const candidate of candidates) {
 			const broker = this.brokerFor(input.deviceId, map[candidate]);
 			if (!broker) continue;
+			const packets = broker.getClipBuffer();
+			const nowMs = Date.now();
 			const found = windowAround({
-				packets: broker.getClipBuffer(),
+				packets,
 				aroundMs: input.aroundMs,
 				preRollSec: input.preRollSec,
 				postRollSec: input.postRollSec,
-				nowMs: Date.now()
+				nowMs
 			});
 			if (found.length > 0) {
 				profile = candidate;
 				window = found;
+				coverage = windowCoverage(packets, found, nowMs);
 				break;
 			}
 		}
@@ -14765,29 +15395,77 @@ var StreamBrokerManager = class StreamBrokerManager {
 		});
 		const broker = this.brokerFor(input.deviceId, map[profile]);
 		if (!broker) throw new Error(`No live broker for device ${input.deviceId} (${profile})`);
-		const bytes = await renderPreBufferClip({
+		const cam = this.cameraStreams.get(input.deviceId)?.get(map[profile] ?? "");
+		return {
+			deviceId: input.deviceId,
+			profile,
 			window,
-			format: input.format,
-			maxWidth: input.maxWidth,
-			fps: input.fps,
-			...input.speed !== void 0 ? { speed: input.speed } : {},
+			coverage,
+			broker,
+			sourceWidth: cam?.resolution?.width ?? 0,
+			sourceHeight: cam?.resolution?.height ?? 0
+		};
+	}
+	/** The rendition an event production prefers for this camera, or null when
+	*  nothing qualifies (every slot H.265, or none publishes a resolution). */
+	bestClipProfile(deviceId) {
+		const map = this.assignments.get(deviceId)?.map ?? {};
+		const streams = this.cameraStreams.get(deviceId);
+		const candidates = [];
+		for (const profile of CLIP_PROFILE_BY_COST) {
+			const camStreamId = map[profile];
+			if (camStreamId === void 0) continue;
+			const cam = streams?.get(camStreamId);
+			candidates.push({
+				profile,
+				...cam?.codec !== void 0 ? { codec: cam.codec } : {},
+				...cam?.resolution?.width !== void 0 ? { width: cam.resolution.width } : {},
+				...cam?.resolution?.height !== void 0 ? { height: cam.resolution.height } : {}
+			});
+		}
+		return pickBestClipProfile(candidates);
+	}
+	/** `copy` or `encode` for this cut — reported, never inferred from a size. */
+	clipVideoMode(cut, render) {
+		return clipCanCopy({
+			format: render.format,
+			maxWidth: render.maxWidth,
+			...render.speed !== void 0 ? { speed: render.speed } : {},
+			hevc: isHevcPacket(cut.window[0]),
+			sourceWidth: cut.sourceWidth
+		}) ? "copy" : "encode";
+	}
+	async muxClipWindow(cut, render) {
+		const bytes = await renderPreBufferClip({
+			window: cut.window,
+			format: render.format,
+			maxWidth: render.maxWidth,
+			fps: render.fps,
+			sourceWidth: cut.sourceWidth,
+			...render.speed !== void 0 ? { speed: render.speed } : {},
 			spawn: (cmd, args) => (0, node_child_process.spawn)(cmd, [...args], { stdio: [
 				"pipe",
 				"pipe",
 				"pipe"
 			] }),
 			ffmpegPath: this.ffmpegConfig.binaryPath,
-			sdpParameterSets: broker.getSdpParameterSets()
+			sdpParameterSets: cut.broker.getSdpParameterSets()
 		});
-		const first = window[0];
-		const last = window[window.length - 1];
-		return {
-			base64: bytes.toString("base64"),
-			mime: input.format === "gif" ? "image/gif" : "video/mp4",
-			bytes: bytes.byteLength,
-			profile,
-			durationMs: first && last ? Math.max(0, last.pts - first.pts) : 0
-		};
+		this.logger?.info("pre-buffer clip rendered", {
+			tags: { deviceId: cut.deviceId },
+			meta: {
+				profile: cut.profile,
+				format: render.format,
+				video: this.clipVideoMode(cut, render),
+				sourceWidth: cut.sourceWidth,
+				maxWidth: render.maxWidth,
+				speed: render.speed ?? null,
+				packets: cut.window.length,
+				bytes: bytes.byteLength,
+				coverageMs: cut.coverage.toTs - cut.coverage.fromTs
+			}
+		});
+		return bytes;
 	}
 	getCameraStreamsForDevice(deviceId) {
 		const streamMap = this.cameraStreams.get(deviceId);
@@ -16227,6 +16905,8 @@ var StreamBrokerManager = class StreamBrokerManager {
 	* within the minute — a rule asking for `high` fell back to `low` forever
 	* and looked like the choice did nothing.
 	*/
+	/** Produced event artifacts waiting to be fetched by handle (D9/D18). */
+	eventMedia = new EventMediaStore();
 	clipRetentionArmed = /* @__PURE__ */ new Map();
 	armClipRetention(deviceId, profile) {
 		const armed = this.clipRetentionArmed.get(deviceId) ?? /* @__PURE__ */ new Set();
@@ -18247,6 +18927,17 @@ var AdaptiveSession = class AdaptiveSession {
 	acquireTranscodeEgress;
 	/** The acquired egress, while this session holds a reference to it. */
 	transcodeEgressLeg = null;
+	/**
+	* An acquire started at the ANSWER and not yet consumed by the feed.
+	*
+	* Read-and-null-out is the whole ownership protocol: whichever of
+	* `startTranscodeFeed` and `releaseTranscodeEgress` reads a non-null value
+	* owns the release, and since both read it synchronously exactly one can.
+	* Without that, a session closing while its prewarm is in flight either
+	* double-releases (the manager logs it as a consumer bookkeeping bug) or
+	* leaks a child the primitive has no TTL to reclaim.
+	*/
+	transcodeEgressPending = null;
 	/** Unsubscribe from the acquired egress's video plane. */
 	detachTranscodeEgress = null;
 	/** Codec actually negotiated with the browser after SDP answer. */
@@ -18886,6 +19577,7 @@ var AdaptiveSession = class AdaptiveSession {
 			negotiated: this.negotiatedCodec,
 			needsTranscode: this.needsTranscode
 		} });
+		this.prewarmTranscodeEgress();
 		if (this.debug) this.logger.info("Codec negotiation detail", { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
@@ -19084,6 +19776,7 @@ var AdaptiveSession = class AdaptiveSession {
 			setRemoteMs,
 			createAnswerMs
 		} });
+		this.prewarmTranscodeEgress();
 		if (this.debug) this.logger.info("Codec negotiation detail (client-offer)", { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
@@ -19804,6 +20497,51 @@ var AdaptiveSession = class AdaptiveSession {
 	* unchanged — the request asks for `audio: 'passthrough'` precisely so the
 	* child does not encode a plane this session never reads.
 	*/
+	/**
+	* Start the egress acquire NOW, in parallel with ICE and DTLS.
+	*
+	* `needsTranscode` is final the moment the answer's codec is known — the
+	* "Codec negotiated" line already prints it — but the acquire used to happen
+	* inside `startFeedingFrames`, which runs only after the DTLS wait. On camera
+	* 615 that put the leg ~2 s after session creation and the first packet ~5 s
+	* after that, against a browser watchdog that re-offers every ~5 s: the viewer
+	* was always gone before the media existed, and the next session paid for a
+	* cold child again. Three minutes of that on 2026-08-07 22:17–22:20.
+	*
+	* Only the ffmpeg moves. The ATTACH stays behind DTLS, because `sendRtp`
+	* silently drops before the transport is connected.
+	*
+	* Idempotent and safe to call from any negotiation path; a session that needs
+	* no transcode does nothing. Public for the same reason
+	* {@link armSourceSilenceWatchdog} is — the acquire/release contract is
+	* testable without standing up werift.
+	*/
+	prewarmTranscodeEgress() {
+		if (this.closed) return;
+		if (!this.needsTranscode) return;
+		if (this.transcodeEgressPending !== null || this.transcodeEgressLeg !== null) return;
+		const acquire = this.acquireTranscodeEgress;
+		if (acquire === null) return;
+		this.logger.info("Transcode leg: prewarming the egress while ICE/DTLS negotiate", { meta: {
+			phase: "session",
+			sessionId: this.sessionId,
+			deviceId: this.deviceId,
+			sourceCodec: this.sourceCodec
+		} });
+		this.transcodeEgressPending = acquire({
+			profile: this.transcodeProfile,
+			sessionId: this.sessionId
+		});
+	}
+	/**
+	* Take ownership of the in-flight prewarm, if there is one. Nulls the field
+	* synchronously so the release path can never also claim it — see the field.
+	*/
+	claimPrewarmedEgress() {
+		const pending = this.transcodeEgressPending;
+		this.transcodeEgressPending = null;
+		return pending;
+	}
 	startTranscodeFeed(signal) {
 		const acquire = this.acquireTranscodeEgress;
 		if (acquire === null) {
@@ -19815,20 +20553,32 @@ var AdaptiveSession = class AdaptiveSession {
 			if (!this.closed) this.close();
 			return;
 		}
+		const prewarmed = this.claimPrewarmedEgress();
 		this.logger.info(`Starting ${this.sourceCodec}→H.264 Baseline transcode leg`, { meta: {
 			phase: "session",
 			sessionId: this.sessionId,
 			deviceId: this.deviceId,
 			sourceCodec: this.sourceCodec,
-			mode: "egress-primitive"
+			mode: "egress-primitive",
+			prewarmed: prewarmed !== null
 		} });
+		const acquireNow = () => acquire({
+			profile: this.transcodeProfile,
+			sessionId: this.sessionId
+		});
 		(async () => {
 			let leg;
 			try {
-				leg = await acquire({
-					profile: this.transcodeProfile,
-					sessionId: this.sessionId
-				});
+				leg = await (prewarmed === null ? acquireNow() : prewarmed.catch((err) => {
+					if (signal.aborted || this.closed) throw err;
+					this.logger.warn("Transcode leg: the prewarmed acquire failed — retrying now that the feed has started", { meta: {
+						phase: "session",
+						sessionId: this.sessionId,
+						deviceId: this.deviceId,
+						error: require_dist.errMsg(err)
+					} });
+					return acquireNow();
+				}));
 			} catch (err) {
 				this.logger.error("Transcode feed: acquiring the egress transcode FAILED", { meta: {
 					phase: "session",
@@ -19896,6 +20646,14 @@ var AdaptiveSession = class AdaptiveSession {
 		try {
 			detach?.();
 		} catch {}
+		const orphan = this.claimPrewarmedEgress();
+		if (orphan !== null) orphan.then((prewarmedLeg) => prewarmedLeg.release()).catch((err) => {
+			this.logger.debug("Transcode leg: the unclaimed prewarm ended without a handle", { meta: {
+				phase: "session",
+				sessionId: this.sessionId,
+				error: require_dist.errMsg(err)
+			} });
+		});
 		const leg = this.transcodeEgressLeg;
 		this.transcodeEgressLeg = null;
 		if (!leg) return;