@camstack/addon-pipeline 1.2.77 → 1.2.79

package/dist/stream-broker/index.mjs

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "../chunk-DnnnRqeS.mjs";
-import { At as string, Ct as boolean, D as cameraStreamsCapability, Dt as number, Et as literal, F as egressTranscodeSharingKey, I as egressTransportFromRequest, Mt as EventCategory, O as createHwAccelCache, Ot as object, Q as streamBrokerCapability, S as RingBuffer, St as array, V as maskUrlCredentials, Y as resolveEgressDecodeHwAccel, at as invocationFromEncodeProfile, ct as CAM_PROFILE_ORDER, dt as createEvent, et as webrtcSessionCapability, f as EncodeProfileSchema, gt as nodePin, ht as makeSourceBrokerId, it as buildFfmpegArgs$1, jt as union, kt as record, lt as DeviceFeature, mt as makeProfileBrokerId, nt as AUDIO_PRESETS, ot as isSoftwareDecode, pt as isEvent, rt as Fmp4BoxSplitter, st as BaseAddon, tt as errMsg, ut as DeviceType, v as RATE_CONTROL_RELAXED, vt as parseProfileBrokerId, w as addonWidgetsSourceCapability, wt as discriminatedUnion, xt as _enum, y as RATE_CONTROL_TIGHT } from "../dist-HhcoV-Ky.mjs";
+import { At as string, Ct as boolean, D as cameraStreamsCapability, Dt as number, Et as literal, F as egressTranscodeSharingKey, I as egressTransportFromRequest, Mt as EventCategory, O as createHwAccelCache, Ot as object, Q as streamBrokerCapability, S as RingBuffer, St as array, V as maskUrlCredentials, Y as resolveEgressDecodeHwAccel, at as invocationFromEncodeProfile, ct as CAM_PROFILE_ORDER, dt as createEvent, et as webrtcSessionCapability, f as EncodeProfileSchema, gt as nodePin, ht as makeSourceBrokerId, it as buildFfmpegArgs$1, jt as union, kt as record, lt as DeviceFeature, mt as makeProfileBrokerId, nt as AUDIO_PRESETS, ot as isSoftwareDecode, pt as isEvent, rt as Fmp4BoxSplitter, st as BaseAddon, tt as errMsg, ut as DeviceType, v as RATE_CONTROL_RELAXED, vt as parseProfileBrokerId, w as addonWidgetsSourceCapability, wt as discriminatedUnion, xt as _enum, y as RATE_CONTROL_TIGHT } from "../dist-BfTf6doa.mjs";
 import { n as profileForStreamId, r as parseRestreamPath } from "../remote-restream-Ci7RXNGb.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
@@ -22534,11 +22534,31 @@ var MonotonicClock = class {
 		this.rate = rate;
 	}
 };
+var SCRUB_FRAGMENT_CACHE_MAX_BYTES = 24 * 1024 * 1024;
+var SCRUB_FRAGMENT_CACHE_OTHER_MAX_BYTES = 2 * 1024 * 1024;
+/** Demuxed bytes an entry holds — what the byte bound actually counts. */
+function fragmentBytes(frag) {
+	let total = 0;
+	for (const au of frag.aus) total += au.data.length;
+	return total;
+}
 var ScrubFragmentCache = class {
-	max;
+	maxBytes;
+	otherMaxBytes;
 	map = /* @__PURE__ */ new Map();
-	constructor(max = 8) {
-		this.max = max;
+	/**
+	* Bytes held PER PROFILE. Budgets are per profile and so is eviction: a
+	* `high` entry must never be able to evict the `low` segments the drag is
+	* running on, and the reverse would be just as wrong.
+	*/
+	bytesByProfile = /* @__PURE__ */ new Map();
+	constructor(maxBytes = SCRUB_FRAGMENT_CACHE_MAX_BYTES, otherMaxBytes = SCRUB_FRAGMENT_CACHE_OTHER_MAX_BYTES) {
+		this.maxBytes = maxBytes;
+		this.otherMaxBytes = otherMaxBytes;
+	}
+	/** The byte budget for a profile — the scrub profile gets the real one. */
+	budgetFor(profile) {
+		return profile === "low" ? this.maxBytes : this.otherMaxBytes;
 	}
 	key(profile, startMs) {
 		return `${profile}|${startMs}`;
@@ -22569,17 +22589,45 @@ var ScrubFragmentCache = class {
 		}
 		return null;
 	}
-	/** Insert (or refresh) a fragment, evicting the oldest past the bound. */
+	/** Insert (or refresh) a fragment, evicting that PROFILE's oldest past its bound. */
 	put(profile, frag) {
 		const k = this.key(profile, frag.startMs);
+		const held = this.map.get(k);
+		let bytes = this.bytesByProfile.get(profile) ?? 0;
+		if (held) bytes -= fragmentBytes(held);
 		this.map.delete(k);
 		this.map.set(k, frag);
-		while (this.map.size > this.max) {
-			const oldest = this.map.keys().next().value;
+		bytes += fragmentBytes(frag);
+		this.bytesByProfile.set(profile, bytes);
+		const budget = this.budgetFor(profile);
+		const prefix = `${profile}|`;
+		while ((this.bytesByProfile.get(profile) ?? 0) > budget && this.entriesFor(profile) > 4) {
+			const oldest = this.oldestKeyWithPrefix(prefix);
 			if (oldest === void 0) break;
+			const evicted = this.map.get(oldest);
 			this.map.delete(oldest);
+			if (evicted) this.bytesByProfile.set(profile, (this.bytesByProfile.get(profile) ?? 0) - fragmentBytes(evicted));
 		}
 	}
+	oldestKeyWithPrefix(prefix) {
+		for (const k of this.map.keys()) if (k.startsWith(prefix)) return k;
+	}
+	entriesFor(profile) {
+		const prefix = `${profile}|`;
+		let n = 0;
+		for (const k of this.map.keys()) if (k.startsWith(prefix)) n += 1;
+		return n;
+	}
+	/** Demuxed bytes currently held across every profile. */
+	get byteSize() {
+		let total = 0;
+		for (const bytes of this.bytesByProfile.values()) total += bytes;
+		return total;
+	}
+	/** Demuxed bytes held for one profile — the number its MB bound governs. */
+	byteSizeFor(profile) {
+		return this.bytesByProfile.get(profile) ?? 0;
+	}
 	get size() {
 		return this.map.size;
 	}
@@ -22645,6 +22693,10 @@ var ScrubDragStats = class {
 	wholeReads = 0;
 	readBytes = 0;
 	parks = 0;
+	prefetchReads = 0;
+	prefetchBytes = 0;
+	prefetchHits = 0;
+	prefetchSuppressed = 0;
 	ackTimeouts = 0;
 	failures = 0;
 	firstPushMs = null;
@@ -22692,6 +22744,19 @@ var ScrubDragStats = class {
 	recordPark() {
 		this.parks += 1;
 	}
+	/** One speculative GOP read and what it cost the disk. */
+	recordPrefetchRead(bytes) {
+		this.prefetchReads += 1;
+		this.prefetchBytes += bytes;
+	}
+	/** Speculation declined: the disk is already the constraint. */
+	recordPrefetchSuppressed() {
+		this.prefetchSuppressed += 1;
+	}
+	/** A tick served by a fragment speculation had already landed. */
+	recordPrefetchHit() {
+		this.prefetchHits += 1;
+	}
 	/** Pushes written off after the ack timeout — dropped work, never silent. */
 	recordAckTimeout(pushes) {
 		this.ackTimeouts += pushes;
@@ -22745,6 +22810,10 @@ var ScrubDragStats = class {
 			travel: this.travel,
 			bytes: this.bytes,
 			parks: this.parks,
+			prefetchReads: this.prefetchReads,
+			prefetchBytes: this.prefetchBytes,
+			prefetchHits: this.prefetchHits,
+			prefetchSuppressed: this.prefetchSuppressed,
 			ackTimeouts: this.ackTimeouts,
 			failures: this.failures,
 			creditEndedAt: this.creditEndedAt,
@@ -22840,6 +22909,73 @@ var SCRUB_JUMP_TRAVEL_MAX_STILLS = 3;
 */
 var SCRUB_PREFETCH_DIR_THRESHOLD = 2;
 /**
+* How many speculative GOP reads may be in flight at once, i.e. how many drag
+* steps ahead the feeder reads.
+*
+* The scrub tick IS the read: measured on salone 590 over `low`,
+* `tickMsP50 = 270` of which `readMsP50 = 263` — a cold ~135 KB fragment off
+* the HDD array through shfs/FUSE, `demuxMsP50 = 1`. One read at a time is a
+* hard ~3.8 push/s ceiling no cache can lift, because a drag whose steps are
+* tens of seconds apart revisits nothing. Reading N steps ahead is the only
+* thing that converts wall-clock the drag is ALREADY spending into pushes.
+*
+* 2 and not more: these reads land on the same spindles the recorder is writing
+* every camera to, and past a small number concurrent random reads stop
+* overlapping and start thrashing. Raise it only against a measured
+* `prefetchHits` / `readMsP50` pair — it is the knob, and the census carries
+* both halves of the evidence.
+*/
+var SCRUB_PREFETCH_MAX_INFLIGHT = 2;
+/**
+* The profile whose scrub read unit is the WHOLE SEGMENT.
+*
+* Every drag is pinned to `low` by the client, and a `low` segment is ~230 KB
+* for 10 s of timeline. Reading it whole is ONE sequential read; the GOP
+* byte-range it replaces was three random seeks (a 2 KB tail probe for the
+* `mfra` index, the `ftyp`+`moov` head, then the fragment) for ~135 KB of those
+* ~230 KB — and it bought nothing reusable, because the next tick inside the
+* same segment paid all three again. On a spindle that is also absorbing every
+* camera's writes, seeks are the cost and bytes are nearly free.
+*
+* The win is not the single read, it is what the read leaves behind: ten
+* seconds of demuxed access units. A drag inside one segment then costs zero
+* I/O and zero demux — which is the regime the operator spends most of a
+* careful gesture in.
+*/
+var SCRUB_WHOLE_SEGMENT_PROFILE = "low";
+/**
+* Safety ceiling on the whole-segment read. `low` is ~230 KB per 10 s, so this
+* is ~6× headroom for a camera whose substream is unusually fat — but a
+* segment past it (a mis-pinned `high` at ~5 MB) falls back to the GOP range,
+* because reading 5 MB to push one keyframe is the trade this change exists to
+* avoid, in the other direction.
+*/
+var SCRUB_WHOLE_SEGMENT_MAX_BYTES = 15e5;
+/**
+* How far the entry warm-up reaches, backward and forward from the playhead the
+* drag starts on.
+*
+* Asymmetric because the gesture is: a drag that begins at the live edge — or
+* at a notification's moment — is looking for what ALREADY happened. 90 s back
+* against 30 s forward is 12 segments ≈ 2.8 MB at `low`, read sequentially in
+* the background while the operator is still deciding where to drag.
+*/
+var SCRUB_WARM_BACK_MS = 9e4;
+var SCRUB_WARM_FWD_MS = 3e4;
+/** Hard bound on warm reads, whatever the spans above resolve to. */
+var SCRUB_WARM_MAX_SEGMENTS = 14;
+/**
+* Median recent read time at or above which the feeder STOPS speculating.
+*
+* Speculation is a bet that spare I/O exists. When reads are this slow there is
+* no spare I/O — the array is saturated — and a prefetch is not free work, it
+* is another random seek queued ahead of the read the operator is waiting on.
+* The field regime that forced this: 54 prefetch reads for 9 hits with the disk
+* at 98% busy. Suppression is counted (`prefetchSuppressed`) so the decision is
+* visible, and it lifts by itself as soon as reads come back.
+*/
+var SCRUB_SLOW_READ_MS = 600;
+/**
 * Max forward TARGET delta (ms of timeline, between consecutive drag targets)
 * that SWEEPS predicted frames instead of jumping. A steady forward drag is
 * playback with a moving target: once a keyframe decoded, the predicted frames
@@ -23058,12 +23194,29 @@ var RecordedFeeder = class {
 	*/
 	scrubDirRun = 0;
 	/**
-	* The SECOND bounded concurrency slot: `true` while a direction-aware prefetch
-	* demux is in flight. At most one prefetch runs at a time and it only fills
-	* `scrubCache` — it never pushes, never touches the pending/timer/latest-wins
-	* state, and never blocks the live coalesced tick.
-	*/
-	scrubPrefetchInFlight = false;
+	* Prefetch reads in flight. Bounded by {@link SCRUB_PREFETCH_MAX_INFLIGHT}:
+	* these are the SPECULATIVE concurrency slots, and they only fill
+	* `scrubCache` — they never push, never touch the pending/timer/latest-wins
+	* state, and never block the live coalesced tick.
+	*
+	* More than one because the read IS the tick (263 of 270 ms measured): with a
+	* single slot the drag can never go faster than one cold read, however well
+	* the speculation guesses.
+	*/
+	scrubPrefetchInFlight = 0;
+	/** Probe instants currently being read, so two horizons never duplicate one. */
+	scrubPrefetchProbes = /* @__PURE__ */ new Set();
+	/**
+	* Fragment starts this drag put in the cache SPECULATIVELY. A later tick that
+	* hits one of them is what makes speculation provably worth its I/O
+	* (`prefetchHits`) — without this the feeder could double the load on the disk
+	* that is the bottleneck and the census would look calm.
+	*/
+	scrubPrefetched = /* @__PURE__ */ new Set();
+	/** Recent read durations — the evidence speculation is suspended on. */
+	scrubReadMsWindow = [];
+	/** Warm-up runs once per drag, from the playhead the finger went down on. */
+	scrubWarmStarted = false;
 	constructor(deps) {
 		this.deps = deps;
 		this.audioClock = new MonotonicClock(deps.audioClockRateHz ?? 8e3);
@@ -23353,6 +23506,7 @@ var RecordedFeeder = class {
 		this.scrubCredit = SCRUB_CREDIT_CAP;
 		this.scrubPrevTarget = null;
 		this.scrubDirRun = 0;
+		this.scrubPrefetched = /* @__PURE__ */ new Set();
 		this.scrubCursor = null;
 		this.scrubNoFootageLogged = false;
 		this.scrubParkLogged = false;
@@ -23370,6 +23524,88 @@ var RecordedFeeder = class {
 			this.scrubTimer = null;
 		}
 		this.stopPositionReports();
+		this.scrubWarmStarted = false;
+		this.scrubReadMsWindow = [];
+		if (this.cursorMs > 0 && this.deps.profile === SCRUB_WHOLE_SEGMENT_PROFILE) this.startScrubWarm(this.cursorMs, this.scrubToken);
+	}
+	/**
+	* Warm the window the drag is about to move through: {@link SCRUB_WARM_BACK_MS}
+	* back and {@link SCRUB_WARM_FWD_MS} forward from the entry playhead, one
+	* segment at a time, backward first.
+	*
+	* Once per drag, always in the background, and never on the tick's path — a
+	* tick that arrives against a cold cache pays its own read exactly as before.
+	* It walks segment to segment through `locate` rather than assuming a segment
+	* length, so a recorder configured with a different `segmentSeconds` warms the
+	* same SPAN rather than the same count.
+	*/
+	startScrubWarm(centreMs, gen) {
+		if (this.scrubWarmStarted) return;
+		this.scrubWarmStarted = true;
+		this.warmScrubWindow(centreMs, gen);
+	}
+	async warmScrubWindow(centreMs, gen) {
+		const spent = await this.warmScrubDirection(centreMs, -1, SCRUB_WARM_BACK_MS, 0, gen);
+		await this.warmScrubDirection(centreMs, 1, SCRUB_WARM_FWD_MS, spent, gen);
+	}
+	/**
+	* Walk `dir` from `fromMs` until `spanMs` of timeline is warm (or the shared
+	* bound is hit), reading each segment that is not already cached. Returns the
+	* running total of segments read, so the two directions share one budget.
+	*/
+	async warmScrubDirection(fromMs, dir, spanMs, spent, gen) {
+		let read = spent;
+		let probeMs = fromMs;
+		for (let i = 0; i < SCRUB_WARM_MAX_SEGMENTS; i++) {
+			if (this.disposed || !this.scrubbing || gen !== this.scrubToken) return read;
+			if (read >= SCRUB_WARM_MAX_SEGMENTS) return read;
+			if (Math.abs(probeMs - fromMs) > spanMs) return read;
+			if (this.scrubReadsAreSlow()) {
+				this.scrubStats?.recordPrefetchSuppressed();
+				return read;
+			}
+			const seg = await this.warmOneScrubSegment(probeMs, gen);
+			if (seg === null) return read;
+			if (seg.fetched) read += 1;
+			probeMs = dir === -1 ? seg.startMs - 1 : seg.startMs + seg.durMs + 1;
+			if (probeMs < 0) return read;
+		}
+		return read;
+	}
+	/**
+	* One warm step: locate the segment covering `probeMs` and, unless it is
+	* already cached, read and demux it into the cache. Returns the segment's span
+	* so the walk can step to its neighbour, or null when the walk must stop (a
+	* gap, a failure, or teardown).
+	*/
+	async warmOneScrubSegment(probeMs, gen) {
+		try {
+			const warm = this.scrubCache.covering(this.deps.profile, probeMs);
+			if (warm) return {
+				startMs: warm.startMs,
+				durMs: warm.durMs,
+				fetched: false
+			};
+			const loc = await this.withTimeout(this.deps.locate({
+				deviceId: this.deps.deviceId,
+				profile: this.deps.profile,
+				epochMs: probeMs
+			}));
+			if (this.disposed || !this.scrubbing || gen !== this.scrubToken) return null;
+			if (loc.kind !== "segment") return null;
+			const load = await this.loadScrubFragment(loc, probeMs);
+			if (load !== null) this.scrubStats?.recordPrefetchRead(load.readBytes);
+			if (this.disposed || !this.scrubbing || gen !== this.scrubToken || load === null) return null;
+			this.scrubCache.put(this.deps.profile, load.seg);
+			this.scrubPrefetched.add(load.seg.startMs);
+			return {
+				startMs: load.seg.startMs,
+				durMs: load.seg.durMs,
+				fetched: true
+			};
+		} catch {
+			return null;
+		}
 	}
 	/**
 	* EXPERIMENTAL feeder-scrub: register a drag target. Records the newest target
@@ -23528,7 +23764,10 @@ var RecordedFeeder = class {
 				coverage = "memo";
 			} else {
 				seg = this.scrubCache.covering(this.deps.profile, target);
-				if (seg) coverage = "cache";
+				if (seg) {
+					coverage = "cache";
+					if (this.scrubPrefetched.has(seg.startMs)) this.scrubStats?.recordPrefetchHit();
+				}
 			}
 			if (!seg) {
 				const locateStartMs = performance.now();
@@ -23630,7 +23869,7 @@ var RecordedFeeder = class {
 				firstIdx = this.pickScrubIndex(seg, effTarget, true);
 				const kf = seg.aus[firstIdx];
 				aus = kf === void 0 ? [] : [kf];
-				if (prevTarget !== null && kf !== void 0) jumpTravel = this.collectWarmTravelStills(prevTarget, effTarget, seg.startMs);
+				if (prevTarget !== null && kf !== void 0) jumpTravel = this.collectWarmTravelStills(prevTarget, effTarget, seg.startMs, firstIdx);
 			}
 			const lastAu = aus[aus.length - 1];
 			if (lastAu === void 0) {
@@ -23736,15 +23975,19 @@ var RecordedFeeder = class {
 		return idx;
 	}
 	/**
-	* Load the scrub fragment covering `effTarget` inside the located segment:
-	* the GOP byte-range read (D31 — one moof/mdat plus the moov head, 41–173 KB
-	* on `low`) when the provider offers `readGop`, else the whole-segment read
-	* (100–600 KB on `low` — the documented degradation for an older provider).
+	* Load the scrub unit covering `effTarget`.
+	*
+	* For the scrub profile that unit is the WHOLE SEGMENT — one sequential read
+	* of ~230 KB that leaves ten seconds of demuxed access units behind, so every
+	* later tick landing in it costs nothing at all. Everything else keeps the
+	* GOP byte-range (D31): a `high` segment is ~5 MB and reading it to push one
+	* keyframe would be this same trade made backwards.
+	*
 	* Null when superseded mid-flight. Video-only: scrub never plays audio.
 	*/
 	async loadScrubFragment(loc, effTarget) {
 		const readGop = this.deps.readGop;
-		if (readGop) {
+		if (readGop && !this.readsWholeSegment(loc)) {
 			const token = this.seekToken;
 			const readStartMs = performance.now();
 			const gop = await this.withTimeout(readGop({
@@ -23758,6 +24001,7 @@ var RecordedFeeder = class {
 			if (this.disposed || token !== this.seekToken) return null;
 			const aus = await this.withTimeout(this.deps.demux(gop.bytes));
 			if (this.disposed || token !== this.seekToken) return null;
+			this.noteScrubReadMs(readEndMs - readStartMs);
 			return {
 				seg: {
 					startMs: gop.gopStartMs,
@@ -23770,22 +24014,60 @@ var RecordedFeeder = class {
 				wholeSegmentRead: false
 			};
 		}
-		const wholeStartMs = performance.now();
-		const loaded = await this.loadAus(loc.startMs, false);
-		if (loaded === null) return null;
+		const token = this.seekToken;
+		const readStartMs = performance.now();
+		const bytes = await this.withTimeout(this.deps.readBytes({
+			deviceId: this.deps.deviceId,
+			profile: this.deps.profile,
+			startMs: loc.startMs
+		}));
+		const readEndMs = performance.now();
+		if (this.disposed || token !== this.seekToken) return null;
+		const aus = await this.withTimeout(this.deps.demux(bytes));
+		if (this.disposed || token !== this.seekToken) return null;
+		this.noteScrubReadMs(readEndMs - readStartMs);
 		return {
 			seg: {
 				startMs: loc.startMs,
 				durMs: loc.durMs,
-				aus: loaded.video
+				aus
 			},
-			readMs: performance.now() - wholeStartMs,
-			readBytes: loc.bytes,
-			demuxMs: null,
+			readMs: readEndMs - readStartMs,
+			readBytes: bytes.length,
+			demuxMs: performance.now() - readEndMs,
 			wholeSegmentRead: true
 		};
 	}
 	/**
+	* Whether this located segment is read WHOLE. The scrub profile is, up to a
+	* safety ceiling on the byte size — see {@link SCRUB_WHOLE_SEGMENT_PROFILE}.
+	* A `locate` that does not report a size is trusted for the scrub profile,
+	* where the shape is known and small.
+	*/
+	readsWholeSegment(loc) {
+		if (this.deps.profile !== SCRUB_WHOLE_SEGMENT_PROFILE) return false;
+		return loc.bytes === void 0 || loc.bytes <= SCRUB_WHOLE_SEGMENT_MAX_BYTES;
+	}
+	/**
+	* Fold one read into the recent-read window that governs speculation. The
+	* window is short on purpose: suppression must track what the disk is doing
+	* NOW, and lift as soon as it recovers.
+	*/
+	noteScrubReadMs(readMs) {
+		this.scrubReadMsWindow = [...this.scrubReadMsWindow, readMs].slice(-5);
+	}
+	/**
+	* Is the disk the problem right now? Median of the recent reads against
+	* {@link SCRUB_SLOW_READ_MS}. Median and not mean because one slow read is
+	* noise and the decision must not swing on it; and never before a few
+	* samples, or a cold first read would suppress the whole drag.
+	*/
+	scrubReadsAreSlow() {
+		if (this.scrubReadMsWindow.length < 3) return false;
+		const sorted = this.scrubReadMsWindow.toSorted((a, b) => a - b);
+		return (sorted[Math.floor(sorted.length / 2)] ?? 0) >= (this.deps.slowReadMs ?? SCRUB_SLOW_READ_MS);
+	}
+	/**
 	* A single slow `locate` gets its own line, throttled per drag. Reserved for
 	* the pathological case on purpose: D68 moved this RPC off the warm path, so
 	* a slow one still landing there is the finding — and if it is NOT rare, the
@@ -23917,18 +24199,21 @@ var RecordedFeeder = class {
 	* deduped by fragment, excluding the fragments that cover the endpoints
 	* (one is on screen, the other is the jump's own push).
 	*/
-	collectWarmTravelStills(fromMs, toMs, excludeFragStartMs) {
+	collectWarmTravelStills(fromMs, toMs, excludeFragStartMs, excludeKfIdx) {
 		const stills = [];
-		const seen = new Set([excludeFragStartMs]);
+		const seen = /* @__PURE__ */ new Set();
 		const samples = SCRUB_JUMP_TRAVEL_MAX_STILLS;
 		for (let i = 1; i <= samples; i++) {
 			const tMs = Math.round(fromMs + (toMs - fromMs) * i / 4);
 			const seg = this.scrubCache.covering(this.deps.profile, tMs);
-			if (!seg || seen.has(seg.startMs) || fragmentCovers(seg, fromMs)) continue;
+			if (!seg || fragmentCovers(seg, fromMs)) continue;
 			const kfIdx = this.pickScrubIndex(seg, tMs, true);
 			const au = seg.aus[kfIdx];
 			if (au === void 0 || !au.keyframe) continue;
-			seen.add(seg.startMs);
+			if (seg.startMs === excludeFragStartMs && kfIdx === excludeKfIdx) continue;
+			const key = `${seg.startMs}|${kfIdx}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
 			stills.push({
 				seg,
 				au,
@@ -23950,28 +24235,45 @@ var RecordedFeeder = class {
 			this.scrubDirRun = 0;
 			return;
 		}
-		const dir = target > prev ? 1 : target < prev ? -1 : 0;
+		const stepMs = target - prev;
+		const dir = stepMs > 0 ? 1 : stepMs < 0 ? -1 : 0;
 		if (dir === 0) {
 			this.scrubDirRun = 0;
 			return;
 		}
 		this.scrubDirRun = Math.sign(this.scrubDirRun) === dir ? this.scrubDirRun + dir : dir;
 		if (Math.abs(this.scrubDirRun) < SCRUB_PREFETCH_DIR_THRESHOLD) return;
-		if (this.scrubPrefetchInFlight) return;
-		const probeMs = dir === 1 ? seg.startMs + seg.durMs + 1 : seg.startMs - 1;
-		if (probeMs < 0) return;
-		this.scrubPrefetch(probeMs, gen);
+		if (this.scrubReadsAreSlow()) {
+			this.scrubStats?.recordPrefetchSuppressed();
+			return;
+		}
+		const aheadMs = Math.max(Math.abs(stepMs), seg.durMs + 1);
+		const horizons = Math.abs(stepMs) > seg.durMs ? SCRUB_PREFETCH_MAX_INFLIGHT : 1;
+		for (let horizon = 1; horizon <= horizons; horizon++) {
+			if (this.scrubPrefetchInFlight >= SCRUB_PREFETCH_MAX_INFLIGHT) return;
+			const probeMs = target + dir * aheadMs * horizon;
+			if (probeMs < 0) continue;
+			if (this.scrubPrefetchProbes.has(probeMs)) continue;
+			if (this.scrubCache.covering(this.deps.profile, probeMs)) continue;
+			this.scrubPrefetch(probeMs, gen);
+		}
 	}
 	/**
-	* Background (second-slot) prefetch: locate + read + demux the fragment
-	* covering `probeMs` into `scrubCache`. Bounded to one in flight; aborts at any
+	* Speculative read: locate + read + demux the fragment covering `probeMs` into
+	* `scrubCache`. Bounded by {@link SCRUB_PREFETCH_MAX_INFLIGHT}; aborts at any
 	* teardown (`disposed` / left scrub / a bumped `scrubToken`); a failure is
-	* swallowed (the neighbour just demuxes on demand). Never pushes and never
+	* swallowed (the fragment just demuxes on demand). Never pushes and never
 	* mutates latest-wins state.
+	*
+	* Every read it issues is COUNTED (`prefetchReads` / `prefetchBytes`), and the
+	* fragment it lands is remembered so a later tick hitting it counts as a
+	* `prefetchHit`. Speculation that cannot be shown to pay for itself is just
+	* load on the disk the drag is already waiting for.
 	*/
 	async scrubPrefetch(probeMs, gen) {
-		if (this.scrubPrefetchInFlight) return;
-		this.scrubPrefetchInFlight = true;
+		if (this.scrubPrefetchInFlight >= SCRUB_PREFETCH_MAX_INFLIGHT) return;
+		this.scrubPrefetchInFlight += 1;
+		this.scrubPrefetchProbes.add(probeMs);
 		try {
 			if (this.disposed || !this.scrubbing || gen !== this.scrubToken) return;
 			if (this.scrubCache.covering(this.deps.profile, probeMs)) return;
@@ -23983,10 +24285,13 @@ var RecordedFeeder = class {
 			if (this.disposed || !this.scrubbing || gen !== this.scrubToken) return;
 			if (loc.kind !== "segment") return;
 			const load = await this.loadScrubFragment(loc, probeMs);
+			if (load !== null) this.scrubStats?.recordPrefetchRead(load.readBytes);
 			if (this.disposed || !this.scrubbing || gen !== this.scrubToken || load === null) return;
 			this.scrubCache.put(this.deps.profile, load.seg);
+			this.scrubPrefetched.add(load.seg.startMs);
 		} catch {} finally {
-			this.scrubPrefetchInFlight = false;
+			this.scrubPrefetchInFlight -= 1;
+			this.scrubPrefetchProbes.delete(probeMs);
 		}
 	}
 	/**

package/dist/stream-broker/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-De_xzvjU.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-BohtrVou.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/dist/{worker-protocol-DZVGVAPU.js → worker-protocol-BaLcYcOo.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DQZzL0Ri.js");
+const require_dist = require("./dist-BUIpqu3E.js");
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.

package/dist/{worker-protocol-BNlLGLBV.mjs → worker-protocol-BdOv9Ujl.mjs}

@@ -1,4 +1,4 @@
-import { g as NativeLeaseSettingsSchema, h as NativeLeaseAdmissionSchema, l as DEFAULT_NATIVE_LEASE_SETTINGS } from "./dist-HhcoV-Ky.mjs";
+import { g as NativeLeaseSettingsSchema, h as NativeLeaseAdmissionSchema, l as DEFAULT_NATIVE_LEASE_SETTINGS } from "./dist-BfTf6doa.mjs";
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.77",
+  "version": "1.2.79",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",