@camstack/addon-pipeline 1.2.70 → 1.2.71

package/dist/audio-analyzer/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-cR-pvD_z.js");
+const require_dist = require("../dist-CtOVWTCi.js");
 const require_node_topology_platform = require("../node-topology-platform-CFZ7F4xW.js");
 const require_addon_utils = require("../addon-utils-CQs-AjTJ.js");
 let node_fs = require("node:fs");

package/dist/audio-analyzer/index.mjs

@@ -1,5 +1,5 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { B as mapAudioLabelToMacro, E as audioAnalyzerCapability, T as audioAnalysisCapability, ft as hydrateSchema, m as HF_BASE_URL, n as AUDIO_BACKEND_CHOICES, o as DEFAULT_AUDIO_ANALYZER_CONFIG, st as BaseAddon, tt as errMsg } from "../dist-BPaa4_z6.mjs";
+import { B as mapAudioLabelToMacro, E as audioAnalyzerCapability, T as audioAnalysisCapability, ft as hydrateSchema, m as HF_BASE_URL, n as AUDIO_BACKEND_CHOICES, o as DEFAULT_AUDIO_ANALYZER_CONFIG, st as BaseAddon, tt as errMsg } from "../dist-D1Xk5Tji.mjs";
 import { t as pickNodePlatformArch } from "../node-topology-platform-BkR_k6WT.mjs";
 import { i as downloadFile } from "../addon-utils-CZ2xo67g.mjs";
 import * as fs from "node:fs";

package/dist/detection-pipeline/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-cR-pvD_z.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-STRdnQWm.js");
+const require_dist = require("../dist-CtOVWTCi.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BJs7Yws7.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_node_topology_platform = require("../node-topology-platform-CFZ7F4xW.js");
 const require_addon_utils = require("../addon-utils-CQs-AjTJ.js");

package/dist/detection-pipeline/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $ as supportedRuntimes$1, A as defaultDeviceFor$1, At as string, C as YAMNET_TO_MACRO, G as pipelineExecutorCapability, L as enumerateInferenceDevices, Mt as EventCategory, Ot as object, P as detectionPipelineCapability, R as evaluateZoneRules, St as array, X as runtimeDevices$1, _t as parseJsonUnknown, bt as sleep, dt as createEvent, ft as hydrateSchema, gt as nodePin, jt as union, st as BaseAddon, t as APPLE_SA_TO_MACRO, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT } from "../dist-BPaa4_z6.mjs";
-import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, n as startEventLoopStallMonitor, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep } from "../event-loop-stall-monitor-B79REtL2.mjs";
+import { $ as supportedRuntimes$1, A as defaultDeviceFor$1, At as string, C as YAMNET_TO_MACRO, G as pipelineExecutorCapability, L as enumerateInferenceDevices, Mt as EventCategory, Ot as object, P as detectionPipelineCapability, R as evaluateZoneRules, St as array, X as runtimeDevices$1, _t as parseJsonUnknown, bt as sleep, dt as createEvent, ft as hydrateSchema, gt as nodePin, jt as union, st as BaseAddon, t as APPLE_SA_TO_MACRO, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT } from "../dist-D1Xk5Tji.mjs";
+import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, n as startEventLoopStallMonitor, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep } from "../event-loop-stall-monitor-Cmbt664E.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { t as pickNodePlatformArch } from "../node-topology-platform-BkR_k6WT.mjs";
 import { a as ensureModel, o as isModelDownloaded, r as deleteModelFromDisk } from "../addon-utils-CZ2xo67g.mjs";

package/dist/{dist-cR-pvD_z.js → dist-CtOVWTCi.js}

@@ -25860,13 +25860,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -33152,10 +33163,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -33182,25 +33194,32 @@ var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -33226,22 +33245,45 @@ var NativeLeaseSettingsSchema = object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
@@ -33251,7 +33293,7 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -33285,25 +33327,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an

package/dist/{dist-BPaa4_z6.mjs → dist-D1Xk5Tji.mjs}

@@ -25860,13 +25860,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -33152,10 +33163,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -33182,25 +33194,32 @@ var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -33226,22 +33245,45 @@ var NativeLeaseSettingsSchema = object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
@@ -33251,7 +33293,7 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -33285,25 +33327,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an

package/dist/{event-loop-stall-monitor-STRdnQWm.js → event-loop-stall-monitor-BJs7Yws7.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-cR-pvD_z.js");
+const require_dist = require("./dist-CtOVWTCi.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{event-loop-stall-monitor-B79REtL2.mjs → event-loop-stall-monitor-Cmbt664E.mjs}

@@ -1,4 +1,4 @@
-import { a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS, z as hfModelUrl } from "./dist-BPaa4_z6.mjs";
+import { a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS, z as hfModelUrl } from "./dist-D1Xk5Tji.mjs";
 import { PerformanceObserver } from "node:perf_hooks";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-cR-pvD_z.js");
+const require_dist = require("../dist-CtOVWTCi.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-BPaa4_z6.mjs";
+import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-D1Xk5Tji.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-cR-pvD_z.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-STRdnQWm.js");
-const require_worker_protocol = require("../worker-protocol-C7V1qIIA.js");
+const require_dist = require("../dist-CtOVWTCi.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BJs7Yws7.js");
+const require_worker_protocol = require("../worker-protocol-DEV7g32b.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
@@ -17,28 +17,6 @@ let node_perf_hooks = require("node:perf_hooks");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/session-decode/fork-decode-worker.ts
-/**
-* Real `fork` implementation for the session-decode coordinator — Epic C P1,
-* Task 4.
-*
-* Spawns the decode-worker child (`decode-worker-child.ts`, Task 2) as a
-* dedicated `child_process.fork` and adapts the returned `ChildProcess` to the
-* coordinator's minimal {@link ForkedChildLike} contract WITHOUT any cast —
-* an explicit forwarding wrapper, so a wider Node `ChildProcess` signature
-* never has to structurally satisfy the narrower interface.
-*
-* `serialization: 'advanced'` is MANDATORY: Node's default 'json' IPC
-* base64-serialises the `buffer` reply's `Uint8Array`, breaking the "raw
-* bytes, not base64" contract the coordinator + `worker-protocol.ts`'s
-* `value.bytes instanceof Uint8Array` guard both depend on. Advanced (V8
-* structured-clone) preserves the typed array on the wire.
-*
-* The child entry is resolved relative to THIS module's built location. Both
-* this module and `pipeline-runner/index.ts` bundle into the SAME entry
-* (`dist/pipeline-runner/index.js`, `manualChunks: () => null`), so
-* `import.meta.url` here is that file's URL and the sibling child lands at
-* `dist/session-decode/decode-worker-child.js` (its own vite build entry).
-*/
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = (0, node_url.fileURLToPath)(new URL("../session-decode/decode-worker-child.js", require("url").pathToFileURL(__filename).href));
 /**
@@ -696,8 +674,24 @@ var SessionDecodeSession = class {
 		});
 	}
 	/**
-	* Prompt-release the worker's RAM native-frame lease for `frameId`. Fire and
-	* forget (no reply): a lease also self-expires on its TTL, so a dropped
+	* The runner has this frame's detections: cut one native subject tile per box
+	* and END the hold on `frameId`. Fire and forget (no reply) so the encode can
+	* never delay the runner; a dropped message costs only the tiles.
+	*
+	* An EMPTY box list is still sent — it is how a frame that detected nothing
+	* releases its hold, and that is the common case.
+	*/
+	cutTiles(frameId, bboxes) {
+		if (this.exited) return;
+		this.trySend({
+			kind: "cutTiles",
+			frameId,
+			bboxes
+		});
+	}
+	/**
+	* Prompt-release the worker's RAM native-frame hold for `frameId`. Fire and
+	* forget (no reply): the hold is also bounded by a frame count, so a dropped
 	* release only defers reclaim. No-op once the worker has exited.
 	*/
 	releaseLease(frameId) {
@@ -977,6 +971,7 @@ function buildFrameImage(session, reply) {
 			return session.requestBuffer(reply.frameId, opts);
 		},
 		nativeCrop: (bbox, maxWidth) => session.requestNativeCrop(reply.frameId, bbox, maxWidth),
+		cutTiles: (bboxes) => session.cutTiles(reply.frameId, bboxes),
 		releaseNativeLease: () => session.releaseLease(reply.frameId),
 		markInferred: () => session.markInferred(reply.frameId),
 		close: () => {
@@ -1117,6 +1112,7 @@ function startSessionDecodePump(deps) {
 					const image = frame.image;
 					const cropFn = image.nativeCrop;
 					const nativeCrop = cropFn ? Object.assign((bbox, maxWidth) => cropFn(bbox, maxWidth), {
+						cutTiles: (bboxes) => image.cutTiles?.(bboxes),
 						release: () => image.releaseNativeLease?.(),
 						markInferred: () => image.markInferred?.()
 					}) : void 0;
@@ -2525,7 +2521,7 @@ var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
 * old value.
 */
 function sameOverride(a, b) {
-	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
+	return a.holdFrames === b.holdFrames && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission && a.tileBudgetMb === b.tileBudgetMb;
 }
 /**
 * TTL-cached read of the cluster native-lease knobs.
@@ -3802,6 +3798,42 @@ async function runStatelessStep(deps, input) {
 		details
 	};
 }
+/**
+* Normalised boxes for the subjects worth a tile, highest confidence first,
+* capped.
+*
+* Returns an empty array for a frame with no usable detections — and the caller
+* still sends it: an empty `cutTiles` is how a frame that detected nothing ends
+* its hold, which is the majority of frames and the whole reason this design
+* costs less than the one it replaces.
+*
+* A degenerate or non-finite box is DROPPED rather than clamped: a zero-area
+* container serves nothing, and a NaN one would poison the worker's geometry.
+*/
+function planTileCuts(detections, frame, maxSubjects = 4) {
+	if (frame.width <= 0 || frame.height <= 0) return [];
+	const ordered = [...detections.filter((d) => isUsable(d.bbox))].sort((a, b) => b.score - a.score);
+	const out = [];
+	for (const detection of ordered.slice(0, Math.max(0, maxSubjects))) {
+		const { x, y, width, height } = detection.bbox;
+		out.push({
+			x: x / frame.width,
+			y: y / frame.height,
+			w: width / frame.width,
+			h: height / frame.height
+		});
+	}
+	return out;
+}
+function isUsable(bbox) {
+	if (![
+		bbox.x,
+		bbox.y,
+		bbox.width,
+		bbox.height
+	].every((v) => Number.isFinite(v))) return false;
+	return bbox.width > 0 && bbox.height > 0;
+}
 //#endregion
 //#region src/pipeline-runner/index.ts
 var DEFAULT_CONFIG = {
@@ -4290,6 +4322,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 			this.handleDetectionStreamChange(deviceId, action);
 		});
 		this.runner.onResult(async (deviceId, frame, result, _streamType, handle) => {
+			this.cutSubjectTiles(deviceId, result, handle);
 			this.emitInferenceResult(deviceId, frame, result, handle);
 			const detectionCount = result.detections?.length ?? 0;
 			this.runner?.noteDetectionResult(deviceId, detectionCount);
@@ -5111,6 +5144,40 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 		}, resolved.tier, input.encodeJpeg);
 	}
 	/**
+	* Turn a finished frame into subject TILES and end its hold — the runner half
+	* of R2 (`docs/design/2026-08-13-native-lease-two-tier-redesign.md`).
+	*
+	* Called from the result callback, which is the last instant at which the
+	* frame's native pixels exist and its detections are known at the same time.
+	* Every path through here ends the hold, including the one where there is
+	* nothing to cut: a frame that detected nothing is the majority of frames and
+	* releasing it promptly is most of the RAM this redesign gives back.
+	*
+	* Deliberately synchronous and unawaited. The worker replies to nothing, so
+	* there is nothing to wait for, and a detection result must never be delayed
+	* by an encode.
+	*/
+	cutSubjectTiles(deviceId, result, handle) {
+		if (!handle) return;
+		const found = this.nativeCropRegistry.get(handle);
+		if (!found) return;
+		const boxes = planTileCuts(result.detections ?? [], {
+			width: result.width,
+			height: result.height
+		});
+		try {
+			found.request.cutTiles(boxes);
+		} catch (err) {
+			this.ctx.logger.debug("subject tile cut could not be dispatched", {
+				tags: { deviceId },
+				meta: {
+					subjects: boxes.length,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	/**
 	* The native-lease half of {@link getNativeCrop}, extracted so the DETAIL path
 	* can keep the miss REASON the cap's `null` return has no room for. Both
 	* callers share this one decision — a second copy of the tier arithmetic is