@camstack/addon-pipeline 1.2.70 → 1.2.72

package/dist/{dist-cR-pvD_z.js → dist-DwBdGpkx.js}

@@ -12056,7 +12056,14 @@ var cameraStreamsCapability = {
 			low: string().optional()
 		}),
 		lastChangedAt: number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
@@ -14431,7 +14438,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -15758,6 +15781,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -16134,15 +16160,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -16378,6 +16404,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -16477,6 +16527,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -16495,6 +16546,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -16646,7 +16698,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -16671,6 +16736,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -25860,13 +25929,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -32774,6 +32854,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -33152,10 +33233,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -33182,25 +33264,32 @@ var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -33226,22 +33315,45 @@ var NativeLeaseSettingsSchema = object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
@@ -33251,7 +33363,7 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -33285,25 +33397,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an

package/dist/{event-loop-stall-monitor-STRdnQWm.js → event-loop-stall-monitor-1o85rEbu.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-cR-pvD_z.js");
+const require_dist = require("./dist-DwBdGpkx.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{event-loop-stall-monitor-B79REtL2.mjs → event-loop-stall-monitor-EvJwrf2f.mjs}

@@ -1,4 +1,4 @@
-import { a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS, z as hfModelUrl } from "./dist-BPaa4_z6.mjs";
+import { a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS, z as hfModelUrl } from "./dist-CNYUiN27.mjs";
 import { PerformanceObserver } from "node:perf_hooks";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-cR-pvD_z.js");
+const require_dist = require("../dist-DwBdGpkx.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-BPaa4_z6.mjs";
+import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-CNYUiN27.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-cR-pvD_z.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-STRdnQWm.js");
-const require_worker_protocol = require("../worker-protocol-C7V1qIIA.js");
+const require_dist = require("../dist-DwBdGpkx.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-1o85rEbu.js");
+const require_worker_protocol = require("../worker-protocol-D0H-aG2_.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
@@ -17,28 +17,6 @@ let node_perf_hooks = require("node:perf_hooks");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/session-decode/fork-decode-worker.ts
-/**
-* Real `fork` implementation for the session-decode coordinator — Epic C P1,
-* Task 4.
-*
-* Spawns the decode-worker child (`decode-worker-child.ts`, Task 2) as a
-* dedicated `child_process.fork` and adapts the returned `ChildProcess` to the
-* coordinator's minimal {@link ForkedChildLike} contract WITHOUT any cast —
-* an explicit forwarding wrapper, so a wider Node `ChildProcess` signature
-* never has to structurally satisfy the narrower interface.
-*
-* `serialization: 'advanced'` is MANDATORY: Node's default 'json' IPC
-* base64-serialises the `buffer` reply's `Uint8Array`, breaking the "raw
-* bytes, not base64" contract the coordinator + `worker-protocol.ts`'s
-* `value.bytes instanceof Uint8Array` guard both depend on. Advanced (V8
-* structured-clone) preserves the typed array on the wire.
-*
-* The child entry is resolved relative to THIS module's built location. Both
-* this module and `pipeline-runner/index.ts` bundle into the SAME entry
-* (`dist/pipeline-runner/index.js`, `manualChunks: () => null`), so
-* `import.meta.url` here is that file's URL and the sibling child lands at
-* `dist/session-decode/decode-worker-child.js` (its own vite build entry).
-*/
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = (0, node_url.fileURLToPath)(new URL("../session-decode/decode-worker-child.js", require("url").pathToFileURL(__filename).href));
 /**
@@ -696,8 +674,24 @@ var SessionDecodeSession = class {
 		});
 	}
 	/**
-	* Prompt-release the worker's RAM native-frame lease for `frameId`. Fire and
-	* forget (no reply): a lease also self-expires on its TTL, so a dropped
+	* The runner has this frame's detections: cut one native subject tile per box
+	* and END the hold on `frameId`. Fire and forget (no reply) so the encode can
+	* never delay the runner; a dropped message costs only the tiles.
+	*
+	* An EMPTY box list is still sent — it is how a frame that detected nothing
+	* releases its hold, and that is the common case.
+	*/
+	cutTiles(frameId, bboxes) {
+		if (this.exited) return;
+		this.trySend({
+			kind: "cutTiles",
+			frameId,
+			bboxes
+		});
+	}
+	/**
+	* Prompt-release the worker's RAM native-frame hold for `frameId`. Fire and
+	* forget (no reply): the hold is also bounded by a frame count, so a dropped
 	* release only defers reclaim. No-op once the worker has exited.
 	*/
 	releaseLease(frameId) {
@@ -977,6 +971,7 @@ function buildFrameImage(session, reply) {
 			return session.requestBuffer(reply.frameId, opts);
 		},
 		nativeCrop: (bbox, maxWidth) => session.requestNativeCrop(reply.frameId, bbox, maxWidth),
+		cutTiles: (bboxes) => session.cutTiles(reply.frameId, bboxes),
 		releaseNativeLease: () => session.releaseLease(reply.frameId),
 		markInferred: () => session.markInferred(reply.frameId),
 		close: () => {
@@ -1117,6 +1112,7 @@ function startSessionDecodePump(deps) {
 					const image = frame.image;
 					const cropFn = image.nativeCrop;
 					const nativeCrop = cropFn ? Object.assign((bbox, maxWidth) => cropFn(bbox, maxWidth), {
+						cutTiles: (bboxes) => image.cutTiles?.(bboxes),
 						release: () => image.releaseNativeLease?.(),
 						markInferred: () => image.markInferred?.()
 					}) : void 0;
@@ -2525,7 +2521,7 @@ var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
 * old value.
 */
 function sameOverride(a, b) {
-	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
+	return a.holdFrames === b.holdFrames && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission && a.tileBudgetMb === b.tileBudgetMb;
 }
 /**
 * TTL-cached read of the cluster native-lease knobs.
@@ -3802,6 +3798,42 @@ async function runStatelessStep(deps, input) {
 		details
 	};
 }
+/**
+* Normalised boxes for the subjects worth a tile, highest confidence first,
+* capped.
+*
+* Returns an empty array for a frame with no usable detections — and the caller
+* still sends it: an empty `cutTiles` is how a frame that detected nothing ends
+* its hold, which is the majority of frames and the whole reason this design
+* costs less than the one it replaces.
+*
+* A degenerate or non-finite box is DROPPED rather than clamped: a zero-area
+* container serves nothing, and a NaN one would poison the worker's geometry.
+*/
+function planTileCuts(detections, frame, maxSubjects = 4) {
+	if (frame.width <= 0 || frame.height <= 0) return [];
+	const ordered = [...detections.filter((d) => isUsable(d.bbox))].sort((a, b) => b.score - a.score);
+	const out = [];
+	for (const detection of ordered.slice(0, Math.max(0, maxSubjects))) {
+		const { x, y, width, height } = detection.bbox;
+		out.push({
+			x: x / frame.width,
+			y: y / frame.height,
+			w: width / frame.width,
+			h: height / frame.height
+		});
+	}
+	return out;
+}
+function isUsable(bbox) {
+	if (![
+		bbox.x,
+		bbox.y,
+		bbox.width,
+		bbox.height
+	].every((v) => Number.isFinite(v))) return false;
+	return bbox.width > 0 && bbox.height > 0;
+}
 //#endregion
 //#region src/pipeline-runner/index.ts
 var DEFAULT_CONFIG = {
@@ -4290,6 +4322,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 			this.handleDetectionStreamChange(deviceId, action);
 		});
 		this.runner.onResult(async (deviceId, frame, result, _streamType, handle) => {
+			this.cutSubjectTiles(deviceId, result, handle);
 			this.emitInferenceResult(deviceId, frame, result, handle);
 			const detectionCount = result.detections?.length ?? 0;
 			this.runner?.noteDetectionResult(deviceId, detectionCount);
@@ -5111,6 +5144,40 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 		}, resolved.tier, input.encodeJpeg);
 	}
 	/**
+	* Turn a finished frame into subject TILES and end its hold — the runner half
+	* of R2 (`docs/design/2026-08-13-native-lease-two-tier-redesign.md`).
+	*
+	* Called from the result callback, which is the last instant at which the
+	* frame's native pixels exist and its detections are known at the same time.
+	* Every path through here ends the hold, including the one where there is
+	* nothing to cut: a frame that detected nothing is the majority of frames and
+	* releasing it promptly is most of the RAM this redesign gives back.
+	*
+	* Deliberately synchronous and unawaited. The worker replies to nothing, so
+	* there is nothing to wait for, and a detection result must never be delayed
+	* by an encode.
+	*/
+	cutSubjectTiles(deviceId, result, handle) {
+		if (!handle) return;
+		const found = this.nativeCropRegistry.get(handle);
+		if (!found) return;
+		const boxes = planTileCuts(result.detections ?? [], {
+			width: result.width,
+			height: result.height
+		});
+		try {
+			found.request.cutTiles(boxes);
+		} catch (err) {
+			this.ctx.logger.debug("subject tile cut could not be dispatched", {
+				tags: { deviceId },
+				meta: {
+					subjects: boxes.length,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	/**
 	* The native-lease half of {@link getNativeCrop}, extracted so the DETAIL path
 	* can keep the miss REASON the cap's `null` return has no room for. Both
 	* callers share this one decision — a second copy of the tier arithmetic is