@camstack/types 1.2.161 → 1.2.163

package/dist/node.mjs

@@ -2,9 +2,9 @@ import { n as Fmp4BoxSplitter, o as buildFfmpegArgs, t as canonicalHash, u as is
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
-import { chmodSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import * as path from "node:path";
-import { basename, join } from "node:path";
+import { chmodSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import * as path$1 from "node:path";
+import path, { basename, join } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 import { execFileSync, spawn } from "node:child_process";
@@ -435,448 +435,513 @@ async function installPythonRequirements(pythonPath, requirementsFile, logger) {
 	} });
 }
 //#endregion
-//#region src/process/child-cost-registry.ts
+//#region src/ffmpeg/fmp4-fragment-child.ts
+var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
+var FRAGMENT_LOG_EVERY = 30;
+var Fmp4FragmentChild = class {
+	deps;
+	args;
+	child = null;
+	splitter = new Fmp4BoxSplitter();
+	stopped = false;
+	unitsOut = 0;
+	activeHwAccel = null;
+	constructor(deps, args) {
+		this.deps = deps;
+		this.args = args;
+	}
+	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+	async start() {
+		const requested = this.args.invocation.decodeHwAccel;
+		this.activeHwAccel = requested;
+		try {
+			await this.spawnAttempt(requested);
+			return;
+		} catch (err) {
+			if (this.stopped) throw err;
+			if (requested === null || isSoftwareDecode(requested)) throw err;
+			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					decodeHwAccel: requested,
+					error: errMsg(err)
+				}
+			});
+			this.killChild();
+			this.splitter = new Fmp4BoxSplitter();
+			this.activeHwAccel = null;
+			await this.spawnAttempt(null);
+		}
+	}
+	/** The backend the child ACTUALLY ran with — `null` for software. */
+	activeDecodeHwAccel() {
+		const value = this.activeHwAccel;
+		return value === null || value === "none" || value === "copy" ? null : value;
+	}
+	/** Kill ffmpeg and end the plane. Idempotent. */
+	async stop() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.killChild();
+		this.args.plane.end("the fragment child stopped");
+	}
+	spawnAttempt(decodeHwAccel) {
+		const args = buildFfmpegArgs({
+			...this.args.invocation,
+			decodeHwAccel,
+			sink: {
+				kind: "stdout",
+				container: "mp4",
+				fragmentMs: this.args.fragmentMs
+			}
+		});
+		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				fragmentMs: this.args.fragmentMs,
+				decodeHwAccel: decodeHwAccel ?? "software",
+				argv: args.join(" ")
+			}
+		});
+		return new Promise((resolve, reject) => {
+			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			this.child = child;
+			let settled = false;
+			/**
+			* This attempt FAILED. Set before the kill, because SIGTERM makes the
+			* child exit and that exit must not be reported as a death: the retry —
+			* or the caller's rejection — already owns what happens next. Without it
+			* the timeout path ends the plane the software retry is about to fill,
+			* and the consumer sees a stream that stopped for no reason. A "which
+			* spawn is current" counter does NOT cover this: the retry has not been
+			* spawned when the kill's exit arrives.
+			*/
+			let failed = false;
+			/**
+			* This attempt is still the live producer: it has not failed (a failure
+			* hands ownership to the retry, or to the caller's rejection) and nothing
+			* has stopped the child. Those two cover every way an attempt stops being
+			* current — `start` only respawns after a rejection.
+			*/
+			const isCurrent = () => !this.stopped && !failed;
+			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+			const settle = (fail) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				if (fail) {
+					failed = true;
+					reject(fail);
+				} else resolve();
+			};
+			const timer = setTimeout(() => {
+				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+				this.killChild();
+			}, timeoutMs);
+			timer.unref?.();
+			child.stdout?.on("data", (chunk) => {
+				for (const unit of this.splitter.push(chunk)) {
+					this.unitsOut += 1;
+					this.args.plane.publish(unit);
+					if (unit.kind === "init") {
+						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+							tags: { deviceId: this.args.deviceId },
+							meta: {
+								sourceId: this.args.sourceId,
+								bytes: unit.data.length
+							}
+						});
+						settle();
+					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+						tags: { deviceId: this.args.deviceId },
+						meta: {
+							sourceId: this.args.sourceId,
+							unitsOut: this.unitsOut,
+							bytes: unit.data.length,
+							subscribers: this.args.plane.subscriberCount
+						}
+					});
+				}
+				const fault = this.splitter.fault;
+				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+			});
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (line) => {
+				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						line: line.trim()
+					}
+				});
+			});
+			child.once("error", (err) => {
+				if (!settled) {
+					settle(err);
+					return;
+				}
+				if (!isCurrent()) return;
+				this.args.plane.end("the fragment child errored");
+				this.deps.onChildExit?.(err);
+			});
+			child.once("exit", (code, signal) => {
+				if (!settled) {
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
+		});
+	}
+	/**
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
+	*/
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
+			}
+		});
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
+	}
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/ffmpeg/fmp4-fragment-plane.ts
 /**
-* The registry an addon claims its OWN child processes in — the spawn-site
-* half of `load-contribution.cap.ts`.
-*
-* ## Where a claim is made, and where it is released
-*
-* At the spawn site, and nowhere else. It is the only place that knows both
-* halves: the recorder's controller knows it is starting ffmpeg for camera 615
-* profile `high`; the decode coordinator knows the session it is forking a
-* worker for. Nothing has to deduce it afterwards, and no entity needs a
-* global list of which pid belongs to which camera.
+* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
+* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
 *
-* {@link ChildCostRegistry.claim} returns a HANDLE, and the handle is the only
-* way to release. That is not decoration: the alternative — `release(pid)` —
-* lets a late release from a dead generation delete the live claim of a
-* process that inherited the same pid, which is precisely how a per-camera
-* chart charges one camera for another camera's work. A handle can only ever
-* remove the entry it created.
+* ## Why a plane and not a callback
 *
-* ## What the registry does NOT do
+* The operator's requirement for HKSV was explicit: the live fMP4 source built
+* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
+* CamStack as an additional videoclip source alongside the recorder and the NC
+* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
+* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
+* a second ffmpeg child of the same camera. So this is the same shape the
+* broker's other multi-consumer surfaces already have
+* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
+* one producer.
 *
-* It keeps no history, no counters and no timers. It holds live claims and
-* answers questions about them; when the process holding it dies, every claim
-* in it dies with it, which is correct — those children were its children.
+* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
+* clip source; both are named here so the seam is not re-invented, and neither
+* is built.
 *
-* ## The numbers
+* ## The init segment is RETAINED
 *
-* {@link ChildCostRegistry.contributions} reads each claimed child's
-* CUMULATIVE CPU seconds and resident bytes out of `/proc/<pid>` at the moment
-* it is asked. On demand, never on a timer: a new periodic per-node sampler is
-* the defect half of `docs/architecture/load-ledger.md` documents. A counter
-* can be differenced by whoever already keeps a history; a rate cannot be
-* un-averaged.
+* A subscriber that attaches mid-stream — the clip consumer joining an already
+* running HKSV session, which is the whole dual-use case — receives the
+* retained `ftyp`+`moov` as its first packet and then live fragments. Without
+* retention its fragments are undecodable and the failure looks like a codec
+* problem.
 *
-* Where `/proc` does not exist (macOS, Windows) or the read fails, the numbers
-* are ABSENT — never zero. Zero would say the camera cost nothing.
-*/
-/**
-* Kernel jiffies per second (`USER_HZ`). Same constant, same reasoning, as
-* `packages/system/src/builtins/native-metrics/thread-cpu-sampler.ts`:
-* `sysconf(_SC_CLK_TCK)` is not exposed to Node and this has been 100 on every
-* kernel configuration we ship to. A wrong value would scale every CPU number
-* by a constant — visible immediately, not a silent skew.
-*/
-var CLOCK_TICKS_PER_SEC = 100;
-/** Bytes per page, for `/proc/<pid>/statm`'s page counts. */
-var PAGE_BYTES = 4096;
-/**
-* The handle a spawn site gets when nobody is collecting — a test harness, or
-* a runner built before its addon registered a registry. Reporting nothing is
-* the correct behaviour: the process still appears in the node's process
-* snapshot, unclaimed, which is exactly what "nobody reported this" should
-* look like.
-*/
-var NO_COST_CLAIM = { release: () => void 0 };
-var nodeProcStatReader = {
-	readStat: (pid) => readFile(`/proc/${pid}/stat`, "utf8"),
-	readStatm: (pid) => readFile(`/proc/${pid}/statm`, "utf8")
-};
-/**
-* Cumulative CPU seconds from a `/proc/<pid>/stat` line.
+* ## A slow subscriber is CLOSED, never silently gapped
 *
-* The `comm` field is field 2, wrapped in parentheses, and can itself contain
-* spaces and parentheses — so the only correct parse cuts at the LAST `)` and
-* indexes from there. After the cut, field 3 (`state`) is index 0, so `utime`
-* (field 14) is index 11 and `stime` (field 15) is index 12.
+* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
+* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
+* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
+* shows a clip that fails to play with nothing anywhere saying why. So a
+* subscription whose queue overflows is ENDED with a reason, loudly, and the
+* other subscriptions are untouched.
 *
-* `null` for a line that does not parse: a process that exited between the
-* claim and the read leaves a truncated or empty file, and that is normal.
-*/
-function parseProcCpuSeconds(line) {
-	const close = line.lastIndexOf(")");
-	if (close < 0) return null;
-	const rest = line.slice(close + 1).trim().split(/\s+/);
-	const utime = Number(rest[11]);
-	const stime = Number(rest[12]);
-	if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-	return (utime + stime) / CLOCK_TICKS_PER_SEC;
-}
-/**
-* Resident bytes from a `/proc/<pid>/statm` line — field 2 is the resident set
-* in pages. `null` when the line does not parse.
-*/
-function parseProcRssBytes(line) {
-	const fields = line.trim().split(/\s+/);
-	const residentPages = Number(fields[1]);
-	if (!Number.isFinite(residentPages)) return null;
-	return residentPages * PAGE_BYTES;
-}
-/**
-* What the OS will say about one process right now: cumulative CPU seconds and
-* resident bytes, each ABSENT when it cannot be read.
+* ## The PREBUFFER (phase 3)
 *
-* Exported because not every cost has a spawn site inside a registry. The
-* shared inference pool is the case that forced it: its process is created
-* deep inside the engine factory and belongs to no camera, so it is reported
-* as an `unattributable` contribution built from the live pool's pids rather
-* than from a claim — but its numbers must be read the same way, by the same
-* parsers, or two "CPU seconds" in one payload would mean two things.
+* HKSV asks for context BEFORE the trigger — `CameraRecordingOptions.prebufferLength`
+* is a HAP-mandated minimum of 4000 ms — and a subscriber that attaches at the
+* motion edge has none. So the plane optionally retains the last few fragments
+* and replays them to a subscriber that asks for them.
+*
+* Three things this ring gets right, each of which is a measured fact rather
+* than a preference (see [D84](../../../../docs/decisions/adr-0084.md)):
+*
+*  - **It is bounded by TIME *and* BYTES.** On the live fleet a 720p copy
+*    fragment is ~255 KB and a 4K one is ~6.35 MB — a 25× spread over the same
+*    window. A time-only bound is a per-camera RAM figure nobody can predict.
+*  - **The window is measured on ARRIVAL, not parsed from `tfdt`.** The
+*    splitter deliberately never computes a fragment's duration (a second
+*    opinion about a fact the muxer owns), and a prebuffer cares about how long
+*    ago the bytes turned up, which is exactly what arrival time answers.
+*  - **A replay is not backlog.** A subscriber taking N retained fragments gets
+*    its queue capacity raised by N for them, because closing a subscriber as a
+*    slow consumer for the prebuffer it explicitly asked for would be the
+*    stupidest possible failure — and, with `DEFAULT_QUEUE_CAPACITY` of 4 and a
+*    ring of 4, the guaranteed one.
+*
+* ## `isLast`
+*
+* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
+* `isLast` — a generator that finishes without it produces the twelve-second
+* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
+* plane therefore computes it at DELIVERY time: a packet is last when the plane
+* has ended and nothing remains queued behind it. A subscription that ends
+* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
+* the future delegate must not open an HDS stream it cannot feed.
 */
-async function readProcessCost(pid, reader = nodeProcStatReader) {
-	let cpuSeconds = null;
-	let rssBytes = null;
-	try {
-		cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
-	} catch {
-		cpuSeconds = null;
-	}
-	try {
-		rssBytes = parseProcRssBytes(await reader.readStatm(pid));
-	} catch {
-		rssBytes = null;
-	}
-	return {
-		...cpuSeconds === null ? {} : { cpuSeconds },
-		...rssBytes === null ? {} : { rssBytes }
-	};
-}
-var ChildCostRegistry = class {
-	reader;
+var DEFAULT_QUEUE_CAPACITY = 4;
+var Fmp4FragmentPlane = class {
+	logger;
+	prebuffer;
 	now;
-	claims = /* @__PURE__ */ new Map();
-	constructor(reader = nodeProcStatReader, now = Date.now) {
-		this.reader = reader;
+	subscriptions = /* @__PURE__ */ new Map();
+	/** The last init unit seen, handed to every later subscriber. */
+	retainedInit = null;
+	ended = false;
+	/** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
+	ring = [];
+	ringBytes = 0;
+	constructor(logger, prebuffer, now = Date.now) {
+		this.logger = logger;
+		this.prebuffer = prebuffer;
 		this.now = now;
 	}
-	/**
-	* Record one child. The returned handle is the only way to remove it.
-	*
-	* A claim with no pid is dropped rather than stored: it could carry no
-	* measurement, and an entry with a camera and no numbers reads on a chart as
-	* a camera that cost nothing.
-	*/
-	claim(input) {
-		const pid = input.pid;
-		if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
-		const key = Symbol("child-cost-claim");
-		this.claims.set(key, {
-			role: input.role,
-			deviceId: input.deviceId,
-			unit: input.unit,
-			attribution: input.attribution ?? "measured",
-			pid,
-			startedAtMs: this.now()
-		});
-		return { release: () => {
-			this.claims.delete(key);
-		} };
+	get subscriberCount() {
+		return this.subscriptions.size;
 	}
-	/** Live claims, in claim order. Diagnostics and tests; not a contribution. */
-	list() {
-		return [...this.claims.values()].map((c) => ({
-			role: c.role,
-			deviceId: c.deviceId,
-			unit: c.unit,
-			attribution: c.attribution,
-			pid: c.pid
-		}));
+	/** True once {@link end} has been called — no further units are accepted. */
+	get isEnded() {
+		return this.ended;
+	}
+	/** What the prebuffer ring holds right now. All zeroes when disabled. */
+	prebufferStats() {
+		const oldest = this.ring[0];
+		return {
+			fragments: this.ring.length,
+			bytes: this.ringBytes,
+			spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
+		};
+	}
+	subscribe(input) {
+		const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
+		const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
+		const sub = {
+			id: `fmp4-${randomUUID()}`,
+			tag: input.tag,
+			subscribedAt: this.now(),
+			capacity: requested + replay.length,
+			queue: [],
+			delivered: 0,
+			closedReason: null,
+			wake: null,
+			iterating: false
+		};
+		this.subscriptions.set(sub.id, sub);
+		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
+		for (const retained of replay) this.enqueue(sub, retained.unit);
+		if (this.ended) this.closeSubscription(sub, "ended");
+		this.logger?.info("fmp4 plane: subscribed", { meta: {
+			subscriptionId: sub.id,
+			tag: sub.tag,
+			hasRetainedInit: this.retainedInit !== null,
+			prebufferFragments: replay.length,
+			prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
+		} });
+		return this.facade(sub);
 	}
 	/**
-	* This addon's contribution: one entry per live claim, with whatever the OS
-	* will tell us about that child right now.
-	*
-	* A child that has exited between the claim and this read contributes an
-	* entry with no numbers rather than no entry — the unit exists, the addon
-	* believes it is running, and hiding it would make a dying writer look like
-	* a writer that was never started.
+	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
+	* emits exactly one per child, and a second means the child was respawned, in
+	* which case the old one describes a stream that no longer exists.
 	*/
-	async contributions() {
-		const out = [];
-		for (const claim of this.claims.values()) out.push({
-			role: claim.role,
-			deviceId: claim.deviceId,
-			attribution: claim.attribution,
-			unit: claim.unit,
-			pid: claim.pid,
-			startedAtMs: claim.startedAtMs,
-			...await readProcessCost(claim.pid, this.reader)
-		});
-		return out;
+	publish(unit) {
+		if (this.ended) return;
+		if (unit.kind === "init") {
+			this.retainedInit = unit;
+			this.ring.length = 0;
+			this.ringBytes = 0;
+		} else this.retain(unit);
+		for (const sub of this.subscriptions.values()) {
+			if (sub.closedReason !== null) continue;
+			this.enqueue(sub, unit);
+		}
 	}
-};
-//#endregion
-//#region src/storage/filesystem-storage-provider.ts
-var STORAGE_LOCATION_TYPES = [
-	"data",
-	"media",
-	"recordings",
-	"recordings-high",
-	"recordings-low",
-	"recordings-clips",
-	"event-images",
-	"models",
-	"addons-data",
-	"cache",
-	"logs",
-	"backups"
-];
-var DEFAULT_LOCATION_SUBDIRS = {
-	data: "db",
-	media: "media",
-	recordings: "recordings",
-	"recordings-high": "recordings-high",
-	"recordings-low": "recordings-low",
-	"recordings-clips": "recordings-clips",
-	"event-images": "event-images",
-	models: "models",
-	"addons-data": "addons-data",
-	cache: "/tmp/camstack-cache",
-	logs: "logs",
-	backups: "backups"
-};
-/**
-* Filesystem storage provider — serves all location types from a local directory tree.
-*
-* Default layout:
-*   {rootPath}/recordings-high/
-*   {rootPath}/recordings-low/
-*   {rootPath}/recordings-clips/
-*   {rootPath}/event-images/
-*   {rootPath}/models/
-*   {rootPath}/addons-data/
-*   {rootPath}/logs/
-*   /tmp/camstack-cache/   (cache is always local)
-*
-* Individual location paths can be overridden.
-*/
-var FilesystemStorageProvider = class {
-	id = "local";
-	name = "Local Filesystem";
-	supportedLocations = [...STORAGE_LOCATION_TYPES];
-	rootPath;
-	locationPaths;
-	constructor(rootPath, overrides) {
-		this.rootPath = path.resolve(rootPath);
-		this.locationPaths = /* @__PURE__ */ new Map();
-		for (const loc of STORAGE_LOCATION_TYPES) {
-			const override = overrides?.[loc];
-			if (override) this.locationPaths.set(loc, path.resolve(override));
-			else {
-				const subdir = DEFAULT_LOCATION_SUBDIRS[loc] ?? loc;
-				this.locationPaths.set(loc, path.isAbsolute(subdir) ? subdir : path.join(this.rootPath, subdir));
-			}
-		}
-		for (const [loc, override] of Object.entries(overrides ?? {})) if (typeof override === "string" && !this.locationPaths.has(loc)) this.locationPaths.set(loc, path.resolve(override));
+	/**
+	* The producer stopped. Every subscriber drains what it holds; its final
+	* packet carries `isLast`, and its generator then completes.
+	*/
+	end(reason = "producer ended") {
+		if (this.ended) return;
+		this.ended = true;
+		this.logger?.info("fmp4 plane: ended", { meta: {
+			reason,
+			subscribers: this.subscriptions.size
+		} });
+		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
 	}
-	async resolve({ location, relativePath }) {
-		const base = this.locationPaths.get(location) ?? path.join(this.rootPath, location);
-		return path.join(base, relativePath);
+	listSubscribers() {
+		return [...this.subscriptions.values()].map((s) => ({
+			tag: s.tag,
+			subscribedAt: s.subscribedAt,
+			delivered: s.delivered,
+			closedReason: s.closedReason
+		}));
 	}
-	async write({ location, relativePath, data }) {
-		const filePath = await this.resolve({
-			location,
-			relativePath
+	/** End and forget everything. Idempotent. */
+	dispose() {
+		this.end("disposed");
+		this.subscriptions.clear();
+		this.retainedInit = null;
+		this.ring.length = 0;
+		this.ringBytes = 0;
+	}
+	/**
+	* Add one fragment to the ring and evict from the front until BOTH bounds
+	* hold. Eviction is oldest-first, which is the one place in this file where
+	* dropping is correct: the ring is context, not stream — nobody is mid-decode
+	* on it, and a subscriber only ever receives a contiguous tail of it.
+	*/
+	retain(unit) {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return;
+		const arrivedAt = this.now();
+		this.ring.push({
+			unit,
+			arrivedAt
 		});
-		await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
-		if (Buffer.isBuffer(data)) await fs.promises.writeFile(filePath, data);
-		else {
-			const writeStream = fs.createWriteStream(filePath);
-			await new Promise((resolve, reject) => {
-				data.pipe(writeStream);
-				writeStream.on("finish", resolve);
-				writeStream.on("error", reject);
-			});
+		this.ringBytes += unit.data.length;
+		const cutoff = arrivedAt - prebuffer.windowMs;
+		while (this.ring.length > 0) {
+			const oldest = this.ring[0];
+			if (oldest === void 0) break;
+			const tooOld = oldest.arrivedAt < cutoff;
+			const tooBig = this.ringBytes > prebuffer.maxBytes;
+			if (!tooOld && !tooBig || this.ring.length === 1) break;
+			this.ring.shift();
+			this.ringBytes -= oldest.unit.data.length;
 		}
 	}
-	async read({ location, relativePath }) {
-		return fs.promises.readFile(await this.resolve({
-			location,
-			relativePath
-		}));
+	/**
+	* The ring as a subscriber should receive it — window applied AT SUBSCRIBE
+	* time, not only at publish time. A camera that went quiet keeps its last
+	* fragment in the ring indefinitely (see the never-evict-the-newest rule),
+	* and replaying a 40-second-old fragment as "prebuffer" would put stale video
+	* at the head of a clip iOS presents as the moment of the event.
+	*/
+	trimmedRing() {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return [];
+		const cutoff = this.now() - prebuffer.windowMs;
+		return this.ring.filter((r) => r.arrivedAt >= cutoff);
 	}
-	async exists({ location, relativePath }) {
-		try {
-			await fs.promises.access(await this.resolve({
-				location,
-				relativePath
-			}));
-			return true;
-		} catch {
-			return false;
+	enqueue(sub, unit) {
+		if (sub.queue.length >= sub.capacity) {
+			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
+				subscriptionId: sub.id,
+				tag: sub.tag,
+				capacity: sub.capacity,
+				delivered: sub.delivered
+			} });
+			this.closeSubscription(sub, "slow-consumer");
+			return;
 		}
+		sub.queue.push({
+			kind: unit.kind,
+			data: unit.data,
+			sequence: unit.sequence,
+			isLast: false
+		});
+		this.wake(sub);
 	}
-	async list({ location, prefix }) {
-		const base = this.locationPaths.get(location);
-		if (!base) return [];
-		const dir = prefix ? path.join(base, prefix) : base;
-		try {
-			return (await fs.promises.readdir(dir, { withFileTypes: true })).map((e) => prefix ? `${prefix}/${e.name}` : e.name);
-		} catch {
-			return [];
-		}
+	closeSubscription(sub, reason) {
+		if (sub.closedReason !== null) return;
+		sub.closedReason = reason;
+		if (reason === "slow-consumer") sub.queue.length = 0;
+		this.wake(sub);
 	}
-	async delete({ location, relativePath }) {
-		const filePath = await this.resolve({
-			location,
-			relativePath
-		});
-		await fs.promises.rm(filePath, { force: true });
+	wake(sub) {
+		const resume = sub.wake;
+		sub.wake = null;
+		resume?.();
 	}
-	async getAvailableSpace({ location }) {
-		const base = this.locationPaths.get(location);
-		if (!base) return null;
-		try {
-			let target = base;
-			while (!fs.existsSync(target)) {
-				const parent = path.dirname(target);
-				if (!parent || parent === target) return null;
-				target = parent;
+	facade(sub) {
+		const plane = this;
+		return {
+			id: sub.id,
+			tag: sub.tag,
+			get delivered() {
+				return sub.delivered;
+			},
+			get closedReason() {
+				return sub.closedReason;
+			},
+			packets: () => plane.iterate(sub),
+			release: () => {
+				plane.closeSubscription(sub, "released");
+				plane.subscriptions.delete(sub.id);
 			}
-			const stats = await fs.promises.statfs(target);
-			return stats.bavail * stats.bsize;
-		} catch {
-			return null;
-		}
-	}
-	/** Get the resolved path for a location type (addon-declared ids fall back
-	*  to `<rootPath>/<id>`). */
-	getLocationPath(location) {
-		return this.locationPaths.get(location) ?? path.join(this.rootPath, location);
+		};
 	}
-	/** Get the root path */
-	getRootPath() {
-		return this.rootPath;
+	async *iterate(sub) {
+		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
+		sub.iterating = true;
+		for (;;) {
+			const next = sub.queue.shift();
+			if (next === void 0) {
+				if (sub.closedReason !== null) return;
+				await new Promise((resolve) => {
+					sub.wake = resolve;
+				});
+				continue;
+			}
+			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
+			sub.delivered += 1;
+			yield {
+				...next,
+				isLast
+			};
+			if (isLast) return;
+		}
 	}
 };
 //#endregion
-//#region src/utils/expiring-url-signature.ts
+//#region src/ffmpeg/process.ts
 /**
-* The ONE derivation of "a signed, expiring URL".
-*
-* This repo mints unguessable, self-expiring links in three places now — the
-* notification artifact plane, the Home Assistant media plane, and the snapshot
-* link plane. The first two grew independently and are byte-identical logic
-* (`hmac(secret, "<id>:<exp>")`, expiry checked before a constant-time compare),
-* each restating the crypto locally because **addons never import each other**.
-*
-* That reason is real, and the conclusion drawn from it was wrong. Two copies of
-* a signing scheme is how one of them quietly ends up with a different TTL, a
-* different compare, or a missing expiry check, and nothing fails until a link
-* that should have died keeps working. The fix is the same one D52 applies to
-* crop geometry: one derivation, in a place every addon may depend on. A
-* framework package is exactly that place — `@camstack/types/node`, off the root
-* entry because `node:crypto` must never be traversed by a browser bundler.
-*
-* What this module deliberately does NOT decide: the TTL, the base URL, the
-* shape of `id`, and the access level of the route. Those are per-plane policy
-* and each caller states them where a reader can see them.
-*/
-/**
-* The signature over `(id, expMs)`.
-*
-* `id` is whatever the plane uses to name the thing being served — an artifact
-* id, a track id, a `<deviceId>:<width>` pair. It is joined with `:` so a caller
-* must not put a `:` inside a field whose boundary matters; where a plane has
-* more than one field, it composes them itself and owns that ambiguity.
-*/
-function signExpiringUrl(secret, id, expMs) {
-	return createHmac("sha256", secret).update(`${id}:${String(expMs)}`).digest("hex");
-}
-/**
-* Verify a request's `(id, exp, sig)`.
-*
-* **Expiry is checked BEFORE the compare**, so an expired link is refused
-* whether or not its signature is valid — a leaked URL stops working on its own
-* and cannot be kept alive by holding a correct signature. The compare itself is
-* constant-time so a public route cannot be probed for the signature byte by
-* byte.
-*/
-function verifyExpiringUrl(input) {
-	const { secret, id, exp, sig, nowMs } = input;
-	if (exp === void 0 || sig === void 0) return false;
-	const expMs = typeof exp === "number" ? exp : Number(exp);
-	if (!Number.isFinite(expMs)) return false;
-	if (expMs <= nowMs) return false;
-	const expected = signExpiringUrl(secret, id, expMs);
-	const a = Buffer.from(expected, "utf8");
-	const b = Buffer.from(sig, "utf8");
-	if (a.length !== b.length) return false;
-	return timingSafeEqual(a, b);
-}
-//#endregion
-//#region src/utils/export-reconciler.ts
-/**
-* Compute the stable 64-char lowercase-hex fingerprint of a device's
-* export-relevant shape. Two structurally-equal shapes (any feature order,
-* any duplicates, any deviceId) hash identically.
-*/
-function canonicalDeviceFingerprint(shape) {
-	const features = [...new Set(shape.features)].toSorted();
-	return canonicalHash({
-		deviceType: shape.deviceType,
-		features
-	});
-}
-/**
-* Pure 3-way diff of desired export state against the persisted
-* last-advertised state, keyed by `deviceId`.
-*
-* - `desired` — one entry per device to advertise this cycle, each carrying
-*   the freshly-computed `fingerprint`.
-* - `lastAdvertised` — the exporter's persisted per-target sync state.
-*
-* Neither input is mutated.
-*/
-function diffExportTargets(desired, lastAdvertised) {
-	const toAdd = [];
-	const toUpdate = [];
-	const desiredIds = /* @__PURE__ */ new Set();
-	for (const entry of desired) {
-		desiredIds.add(entry.deviceId);
-		const previous = lastAdvertised.get(entry.deviceId);
-		if (previous === void 0) toAdd.push(entry);
-		else if (previous.fingerprint !== entry.fingerprint) toUpdate.push(entry);
-	}
-	const toRemove = [];
-	for (const deviceId of lastAdvertised.keys()) if (!desiredIds.has(deviceId)) toRemove.push(deviceId);
-	return {
-		toAdd,
-		toUpdate,
-		toRemove
-	};
-}
-/**
-* Resolve the fingerprint an exporter should feed into `diffExportTargets`
-* for one device this cycle.
-*
-* When a device is NOT yet probe-ready, carry forward its last-advertised
-* (persisted) fingerprint so it nets to NO CHANGE in `diffExportTargets`
-* (neither update nor remove) — never advertise a partial mid-probe shape. A
-* brand-new un-probed device with no persisted entry falls back to `fresh` so
-* it can advertise once.
-*/
-function resolveExportFingerprint(input) {
-	if (input.ready) return input.fresh;
-	return input.persisted ?? input.fresh;
-}
-//#endregion
-//#region src/ffmpeg/process.ts
-/**
-* `FfmpegProcess` — the ONE spawn/lifecycle wrapper for a live-media ffmpeg.
+* `FfmpegProcess` — the ONE spawn/lifecycle wrapper for a live-media ffmpeg.
 *
 * Extracted from `TranscodeEgress.spawnAttempt`, which was already the most
 * complete of the repo's hand-rolled lifecycles: first-data deadline, hardware
@@ -1139,508 +1204,500 @@ var FfmpegProcess = class {
 	}
 };
 //#endregion
-//#region src/ffmpeg/fmp4-fragment-plane.ts
+//#region src/process/child-cost-registry.ts
 /**
-* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
-* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
-*
-* ## Why a plane and not a callback
-*
-* The operator's requirement for HKSV was explicit: the live fMP4 source built
-* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
-* CamStack as an additional videoclip source alongside the recorder and the NC
-* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
-* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
-* a second ffmpeg child of the same camera. So this is the same shape the
-* broker's other multi-consumer surfaces already have
-* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
-* one producer.
+* The registry an addon claims its OWN child processes in — the spawn-site
+* half of `load-contribution.cap.ts`.
 *
-* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
-* clip source; both are named here so the seam is not re-invented, and neither
-* is built.
+* ## Where a claim is made, and where it is released
 *
-* ## The init segment is RETAINED
+* At the spawn site, and nowhere else. It is the only place that knows both
+* halves: the recorder's controller knows it is starting ffmpeg for camera 615
+* profile `high`; the decode coordinator knows the session it is forking a
+* worker for. Nothing has to deduce it afterwards, and no entity needs a
+* global list of which pid belongs to which camera.
 *
-* A subscriber that attaches mid-stream — the clip consumer joining an already
-* running HKSV session, which is the whole dual-use case — receives the
-* retained `ftyp`+`moov` as its first packet and then live fragments. Without
-* retention its fragments are undecodable and the failure looks like a codec
-* problem.
+* {@link ChildCostRegistry.claim} returns a HANDLE, and the handle is the only
+* way to release. That is not decoration: the alternative — `release(pid)` —
+* lets a late release from a dead generation delete the live claim of a
+* process that inherited the same pid, which is precisely how a per-camera
+* chart charges one camera for another camera's work. A handle can only ever
+* remove the entry it created.
 *
-* ## A slow subscriber is CLOSED, never silently gapped
+* ## What the registry does NOT do
 *
-* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
-* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
-* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
-* shows a clip that fails to play with nothing anywhere saying why. So a
-* subscription whose queue overflows is ENDED with a reason, loudly, and the
-* other subscriptions are untouched.
+* It keeps no history, no counters and no timers. It holds live claims and
+* answers questions about them; when the process holding it dies, every claim
+* in it dies with it, which is correct — those children were its children.
 *
-* ## The PREBUFFER (phase 3)
+* ## The numbers
 *
-* HKSV asks for context BEFORE the trigger — `CameraRecordingOptions.prebufferLength`
-* is a HAP-mandated minimum of 4000 ms — and a subscriber that attaches at the
-* motion edge has none. So the plane optionally retains the last few fragments
-* and replays them to a subscriber that asks for them.
+* {@link ChildCostRegistry.contributions} reads each claimed child's
+* CUMULATIVE CPU seconds and resident bytes out of `/proc/<pid>` at the moment
+* it is asked. On demand, never on a timer: a new periodic per-node sampler is
+* the defect half of `docs/architecture/load-ledger.md` documents. A counter
+* can be differenced by whoever already keeps a history; a rate cannot be
+* un-averaged.
 *
-* Three things this ring gets right, each of which is a measured fact rather
-* than a preference (see [D84](../../../../docs/decisions/adr-0084.md)):
+* Where `/proc` does not exist (macOS, Windows) or the read fails, the numbers
+* are ABSENT — never zero. Zero would say the camera cost nothing.
+*/
+/**
+* Kernel jiffies per second (`USER_HZ`). Same constant, same reasoning, as
+* `packages/system/src/builtins/native-metrics/thread-cpu-sampler.ts`:
+* `sysconf(_SC_CLK_TCK)` is not exposed to Node and this has been 100 on every
+* kernel configuration we ship to. A wrong value would scale every CPU number
+* by a constant — visible immediately, not a silent skew.
+*/
+var CLOCK_TICKS_PER_SEC = 100;
+/** Bytes per page, for `/proc/<pid>/statm`'s page counts. */
+var PAGE_BYTES = 4096;
+/**
+* The handle a spawn site gets when nobody is collecting — a test harness, or
+* a runner built before its addon registered a registry. Reporting nothing is
+* the correct behaviour: the process still appears in the node's process
+* snapshot, unclaimed, which is exactly what "nobody reported this" should
+* look like.
+*/
+var NO_COST_CLAIM = { release: () => void 0 };
+var nodeProcStatReader = {
+	readStat: (pid) => readFile(`/proc/${pid}/stat`, "utf8"),
+	readStatm: (pid) => readFile(`/proc/${pid}/statm`, "utf8")
+};
+/**
+* Cumulative CPU seconds from a `/proc/<pid>/stat` line.
 *
-*  - **It is bounded by TIME *and* BYTES.** On the live fleet a 720p copy
-*    fragment is ~255 KB and a 4K one is ~6.35 MB — a 25× spread over the same
-*    window. A time-only bound is a per-camera RAM figure nobody can predict.
-*  - **The window is measured on ARRIVAL, not parsed from `tfdt`.** The
-*    splitter deliberately never computes a fragment's duration (a second
-*    opinion about a fact the muxer owns), and a prebuffer cares about how long
-*    ago the bytes turned up, which is exactly what arrival time answers.
-*  - **A replay is not backlog.** A subscriber taking N retained fragments gets
-*    its queue capacity raised by N for them, because closing a subscriber as a
-*    slow consumer for the prebuffer it explicitly asked for would be the
-*    stupidest possible failure — and, with `DEFAULT_QUEUE_CAPACITY` of 4 and a
-*    ring of 4, the guaranteed one.
+* The `comm` field is field 2, wrapped in parentheses, and can itself contain
+* spaces and parentheses — so the only correct parse cuts at the LAST `)` and
+* indexes from there. After the cut, field 3 (`state`) is index 0, so `utime`
+* (field 14) is index 11 and `stime` (field 15) is index 12.
 *
-* ## `isLast`
+* `null` for a line that does not parse: a process that exited between the
+* claim and the read leaves a truncated or empty file, and that is normal.
+*/
+function parseProcCpuSeconds(line) {
+	const close = line.lastIndexOf(")");
+	if (close < 0) return null;
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+	return (utime + stime) / CLOCK_TICKS_PER_SEC;
+}
+/**
+* Resident bytes from a `/proc/<pid>/statm` line — field 2 is the resident set
+* in pages. `null` when the line does not parse.
+*/
+function parseProcRssBytes(line) {
+	const fields = line.trim().split(/\s+/);
+	const residentPages = Number(fields[1]);
+	if (!Number.isFinite(residentPages)) return null;
+	return residentPages * PAGE_BYTES;
+}
+/**
+* What the OS will say about one process right now: cumulative CPU seconds and
+* resident bytes, each ABSENT when it cannot be read.
 *
-* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
-* `isLast` — a generator that finishes without it produces the twelve-second
-* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
-* plane therefore computes it at DELIVERY time: a packet is last when the plane
-* has ended and nothing remains queued behind it. A subscription that ends
-* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
-* the future delegate must not open an HDS stream it cannot feed.
+* Exported because not every cost has a spawn site inside a registry. The
+* shared inference pool is the case that forced it: its process is created
+* deep inside the engine factory and belongs to no camera, so it is reported
+* as an `unattributable` contribution built from the live pool's pids rather
+* than from a claim — but its numbers must be read the same way, by the same
+* parsers, or two "CPU seconds" in one payload would mean two things.
 */
-var DEFAULT_QUEUE_CAPACITY = 4;
-var Fmp4FragmentPlane = class {
-	logger;
-	prebuffer;
-	now;
-	subscriptions = /* @__PURE__ */ new Map();
-	/** The last init unit seen, handed to every later subscriber. */
-	retainedInit = null;
-	ended = false;
-	/** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
-	ring = [];
-	ringBytes = 0;
-	constructor(logger, prebuffer, now = Date.now) {
-		this.logger = logger;
-		this.prebuffer = prebuffer;
-		this.now = now;
-	}
-	get subscriberCount() {
-		return this.subscriptions.size;
-	}
-	/** True once {@link end} has been called — no further units are accepted. */
-	get isEnded() {
-		return this.ended;
-	}
-	/** What the prebuffer ring holds right now. All zeroes when disabled. */
-	prebufferStats() {
-		const oldest = this.ring[0];
-		return {
-			fragments: this.ring.length,
-			bytes: this.ringBytes,
-			spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
-		};
+async function readProcessCost(pid, reader = nodeProcStatReader) {
+	let cpuSeconds = null;
+	let rssBytes = null;
+	try {
+		cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
+	} catch {
+		cpuSeconds = null;
 	}
-	subscribe(input) {
-		const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
-		const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
-		const sub = {
-			id: `fmp4-${randomUUID()}`,
-			tag: input.tag,
-			subscribedAt: this.now(),
-			capacity: requested + replay.length,
-			queue: [],
-			delivered: 0,
-			closedReason: null,
-			wake: null,
-			iterating: false
-		};
-		this.subscriptions.set(sub.id, sub);
-		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
-		for (const retained of replay) this.enqueue(sub, retained.unit);
-		if (this.ended) this.closeSubscription(sub, "ended");
-		this.logger?.info("fmp4 plane: subscribed", { meta: {
-			subscriptionId: sub.id,
-			tag: sub.tag,
-			hasRetainedInit: this.retainedInit !== null,
-			prebufferFragments: replay.length,
-			prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
-		} });
-		return this.facade(sub);
+	try {
+		rssBytes = parseProcRssBytes(await reader.readStatm(pid));
+	} catch {
+		rssBytes = null;
 	}
-	/**
-	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
-	* emits exactly one per child, and a second means the child was respawned, in
-	* which case the old one describes a stream that no longer exists.
-	*/
-	publish(unit) {
-		if (this.ended) return;
-		if (unit.kind === "init") {
-			this.retainedInit = unit;
-			this.ring.length = 0;
-			this.ringBytes = 0;
-		} else this.retain(unit);
-		for (const sub of this.subscriptions.values()) {
-			if (sub.closedReason !== null) continue;
-			this.enqueue(sub, unit);
-		}
+	return {
+		...cpuSeconds === null ? {} : { cpuSeconds },
+		...rssBytes === null ? {} : { rssBytes }
+	};
+}
+var ChildCostRegistry = class {
+	reader;
+	now;
+	claims = /* @__PURE__ */ new Map();
+	constructor(reader = nodeProcStatReader, now = Date.now) {
+		this.reader = reader;
+		this.now = now;
 	}
 	/**
-	* The producer stopped. Every subscriber drains what it holds; its final
-	* packet carries `isLast`, and its generator then completes.
+	* Record one child. The returned handle is the only way to remove it.
+	*
+	* A claim with no pid is dropped rather than stored: it could carry no
+	* measurement, and an entry with a camera and no numbers reads on a chart as
+	* a camera that cost nothing.
 	*/
-	end(reason = "producer ended") {
-		if (this.ended) return;
-		this.ended = true;
-		this.logger?.info("fmp4 plane: ended", { meta: {
-			reason,
-			subscribers: this.subscriptions.size
-		} });
-		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+	claim(input) {
+		const pid = input.pid;
+		if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
+		const key = Symbol("child-cost-claim");
+		this.claims.set(key, {
+			role: input.role,
+			deviceId: input.deviceId,
+			unit: input.unit,
+			attribution: input.attribution ?? "measured",
+			pid,
+			startedAtMs: this.now()
+		});
+		return { release: () => {
+			this.claims.delete(key);
+		} };
 	}
-	listSubscribers() {
-		return [...this.subscriptions.values()].map((s) => ({
-			tag: s.tag,
-			subscribedAt: s.subscribedAt,
-			delivered: s.delivered,
-			closedReason: s.closedReason
+	/** Live claims, in claim order. Diagnostics and tests; not a contribution. */
+	list() {
+		return [...this.claims.values()].map((c) => ({
+			role: c.role,
+			deviceId: c.deviceId,
+			unit: c.unit,
+			attribution: c.attribution,
+			pid: c.pid
 		}));
 	}
-	/** End and forget everything. Idempotent. */
-	dispose() {
-		this.end("disposed");
-		this.subscriptions.clear();
-		this.retainedInit = null;
-		this.ring.length = 0;
-		this.ringBytes = 0;
-	}
 	/**
-	* Add one fragment to the ring and evict from the front until BOTH bounds
-	* hold. Eviction is oldest-first, which is the one place in this file where
-	* dropping is correct: the ring is context, not stream — nobody is mid-decode
-	* on it, and a subscriber only ever receives a contiguous tail of it.
-	*/
-	retain(unit) {
-		const prebuffer = this.prebuffer;
-		if (prebuffer === void 0) return;
-		const arrivedAt = this.now();
-		this.ring.push({
-			unit,
-			arrivedAt
-		});
-		this.ringBytes += unit.data.length;
-		const cutoff = arrivedAt - prebuffer.windowMs;
-		while (this.ring.length > 0) {
-			const oldest = this.ring[0];
-			if (oldest === void 0) break;
-			const tooOld = oldest.arrivedAt < cutoff;
-			const tooBig = this.ringBytes > prebuffer.maxBytes;
-			if (!tooOld && !tooBig || this.ring.length === 1) break;
-			this.ring.shift();
-			this.ringBytes -= oldest.unit.data.length;
-		}
-	}
-	/**
-	* The ring as a subscriber should receive it — window applied AT SUBSCRIBE
-	* time, not only at publish time. A camera that went quiet keeps its last
-	* fragment in the ring indefinitely (see the never-evict-the-newest rule),
-	* and replaying a 40-second-old fragment as "prebuffer" would put stale video
-	* at the head of a clip iOS presents as the moment of the event.
+	* This addon's contribution: one entry per live claim, with whatever the OS
+	* will tell us about that child right now.
+	*
+	* A child that has exited between the claim and this read contributes an
+	* entry with no numbers rather than no entry — the unit exists, the addon
+	* believes it is running, and hiding it would make a dying writer look like
+	* a writer that was never started.
 	*/
-	trimmedRing() {
-		const prebuffer = this.prebuffer;
-		if (prebuffer === void 0) return [];
-		const cutoff = this.now() - prebuffer.windowMs;
-		return this.ring.filter((r) => r.arrivedAt >= cutoff);
-	}
-	enqueue(sub, unit) {
-		if (sub.queue.length >= sub.capacity) {
-			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
-				subscriptionId: sub.id,
-				tag: sub.tag,
-				capacity: sub.capacity,
-				delivered: sub.delivered
-			} });
-			this.closeSubscription(sub, "slow-consumer");
-			return;
-		}
-		sub.queue.push({
-			kind: unit.kind,
-			data: unit.data,
-			sequence: unit.sequence,
-			isLast: false
+	async contributions() {
+		const out = [];
+		for (const claim of this.claims.values()) out.push({
+			role: claim.role,
+			deviceId: claim.deviceId,
+			attribution: claim.attribution,
+			unit: claim.unit,
+			pid: claim.pid,
+			startedAtMs: claim.startedAtMs,
+			...await readProcessCost(claim.pid, this.reader)
 		});
-		this.wake(sub);
-	}
-	closeSubscription(sub, reason) {
-		if (sub.closedReason !== null) return;
-		sub.closedReason = reason;
-		if (reason === "slow-consumer") sub.queue.length = 0;
-		this.wake(sub);
-	}
-	wake(sub) {
-		const resume = sub.wake;
-		sub.wake = null;
-		resume?.();
-	}
-	facade(sub) {
-		const plane = this;
-		return {
-			id: sub.id,
-			tag: sub.tag,
-			get delivered() {
-				return sub.delivered;
-			},
-			get closedReason() {
-				return sub.closedReason;
-			},
-			packets: () => plane.iterate(sub),
-			release: () => {
-				plane.closeSubscription(sub, "released");
-				plane.subscriptions.delete(sub.id);
-			}
-		};
-	}
-	async *iterate(sub) {
-		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
-		sub.iterating = true;
-		for (;;) {
-			const next = sub.queue.shift();
-			if (next === void 0) {
-				if (sub.closedReason !== null) return;
-				await new Promise((resolve) => {
-					sub.wake = resolve;
-				});
-				continue;
-			}
-			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
-			sub.delivered += 1;
-			yield {
-				...next,
-				isLast
-			};
-			if (isLast) return;
-		}
+		return out;
 	}
 };
 //#endregion
-//#region src/ffmpeg/fmp4-fragment-child.ts
-var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
-/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
-var FRAGMENT_LOG_EVERY = 30;
-var Fmp4FragmentChild = class {
-	deps;
-	args;
-	child = null;
-	splitter = new Fmp4BoxSplitter();
-	stopped = false;
-	unitsOut = 0;
-	activeHwAccel = null;
-	constructor(deps, args) {
-		this.deps = deps;
-		this.args = args;
-	}
-	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
-	async start() {
-		const requested = this.args.invocation.decodeHwAccel;
-		this.activeHwAccel = requested;
-		try {
-			await this.spawnAttempt(requested);
-			return;
-		} catch (err) {
-			if (this.stopped) throw err;
-			if (requested === null || isSoftwareDecode(requested)) throw err;
-			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					decodeHwAccel: requested,
-					error: errMsg(err)
-				}
-			});
-			this.killChild();
-			this.splitter = new Fmp4BoxSplitter();
-			this.activeHwAccel = null;
-			await this.spawnAttempt(null);
-		}
-	}
-	/** The backend the child ACTUALLY ran with — `null` for software. */
-	activeDecodeHwAccel() {
-		const value = this.activeHwAccel;
-		return value === null || value === "none" || value === "copy" ? null : value;
-	}
-	/** Kill ffmpeg and end the plane. Idempotent. */
-	async stop() {
-		if (this.stopped) return;
-		this.stopped = true;
-		this.killChild();
-		this.args.plane.end("the fragment child stopped");
-	}
-	spawnAttempt(decodeHwAccel) {
-		const args = buildFfmpegArgs({
-			...this.args.invocation,
-			decodeHwAccel,
-			sink: {
-				kind: "stdout",
-				container: "mp4",
-				fragmentMs: this.args.fragmentMs
-			}
-		});
-		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				fragmentMs: this.args.fragmentMs,
-				decodeHwAccel: decodeHwAccel ?? "software",
-				argv: args.join(" ")
-			}
-		});
-		return new Promise((resolve, reject) => {
-			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			] });
-			this.child = child;
-			let settled = false;
-			/**
-			* This attempt FAILED. Set before the kill, because SIGTERM makes the
-			* child exit and that exit must not be reported as a death: the retry —
-			* or the caller's rejection — already owns what happens next. Without it
-			* the timeout path ends the plane the software retry is about to fill,
-			* and the consumer sees a stream that stopped for no reason. A "which
-			* spawn is current" counter does NOT cover this: the retry has not been
-			* spawned when the kill's exit arrives.
-			*/
-			let failed = false;
-			/**
-			* This attempt is still the live producer: it has not failed (a failure
-			* hands ownership to the retry, or to the caller's rejection) and nothing
-			* has stopped the child. Those two cover every way an attempt stops being
-			* current — `start` only respawns after a rejection.
-			*/
-			const isCurrent = () => !this.stopped && !failed;
-			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
-			const settle = (fail) => {
-				if (settled) return;
-				settled = true;
-				clearTimeout(timer);
-				if (fail) {
-					failed = true;
-					reject(fail);
-				} else resolve();
-			};
-			const timer = setTimeout(() => {
-				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
-				this.killChild();
-			}, timeoutMs);
-			timer.unref?.();
-			child.stdout?.on("data", (chunk) => {
-				for (const unit of this.splitter.push(chunk)) {
-					this.unitsOut += 1;
-					this.args.plane.publish(unit);
-					if (unit.kind === "init") {
-						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
-							tags: { deviceId: this.args.deviceId },
-							meta: {
-								sourceId: this.args.sourceId,
-								bytes: unit.data.length
-							}
-						});
-						settle();
-					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
-						tags: { deviceId: this.args.deviceId },
-						meta: {
-							sourceId: this.args.sourceId,
-							unitsOut: this.unitsOut,
-							bytes: unit.data.length,
-							subscribers: this.args.plane.subscriberCount
-						}
-					});
-				}
-				const fault = this.splitter.fault;
-				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
-			});
-			child.stderr?.setEncoding("utf8");
-			child.stderr?.on("data", (line) => {
-				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						line: line.trim()
-					}
-				});
-			});
-			child.once("error", (err) => {
-				if (!settled) {
-					settle(err);
-					return;
-				}
-				if (!isCurrent()) return;
-				this.args.plane.end("the fragment child errored");
-				this.deps.onChildExit?.(err);
-			});
-			child.once("exit", (code, signal) => {
-				if (!settled) {
-					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
-					return;
-				}
-				if (!isCurrent()) return;
-				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
-				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						code,
-						signal,
-						unitsOut: this.unitsOut
-					}
-				});
-				this.args.plane.end("the fragment child exited");
-				this.deps.onChildExit?.(error);
+//#region src/storage/filesystem-storage-provider.ts
+var STORAGE_LOCATION_TYPES = [
+	"data",
+	"media",
+	"recordings",
+	"recordings-high",
+	"recordings-low",
+	"recordings-clips",
+	"event-images",
+	"models",
+	"addons-data",
+	"cache",
+	"logs",
+	"backups"
+];
+var DEFAULT_LOCATION_SUBDIRS = {
+	data: "db",
+	media: "media",
+	recordings: "recordings",
+	"recordings-high": "recordings-high",
+	"recordings-low": "recordings-low",
+	"recordings-clips": "recordings-clips",
+	"event-images": "event-images",
+	models: "models",
+	"addons-data": "addons-data",
+	cache: "/tmp/camstack-cache",
+	logs: "logs",
+	backups: "backups"
+};
+/**
+* Filesystem storage provider — serves all location types from a local directory tree.
+*
+* Default layout:
+*   {rootPath}/recordings-high/
+*   {rootPath}/recordings-low/
+*   {rootPath}/recordings-clips/
+*   {rootPath}/event-images/
+*   {rootPath}/models/
+*   {rootPath}/addons-data/
+*   {rootPath}/logs/
+*   /tmp/camstack-cache/   (cache is always local)
+*
+* Individual location paths can be overridden.
+*/
+var FilesystemStorageProvider = class {
+	id = "local";
+	name = "Local Filesystem";
+	supportedLocations = [...STORAGE_LOCATION_TYPES];
+	rootPath;
+	locationPaths;
+	constructor(rootPath, overrides) {
+		this.rootPath = path$1.resolve(rootPath);
+		this.locationPaths = /* @__PURE__ */ new Map();
+		for (const loc of STORAGE_LOCATION_TYPES) {
+			const override = overrides?.[loc];
+			if (override) this.locationPaths.set(loc, path$1.resolve(override));
+			else {
+				const subdir = DEFAULT_LOCATION_SUBDIRS[loc] ?? loc;
+				this.locationPaths.set(loc, path$1.isAbsolute(subdir) ? subdir : path$1.join(this.rootPath, subdir));
+			}
+		}
+		for (const [loc, override] of Object.entries(overrides ?? {})) if (typeof override === "string" && !this.locationPaths.has(loc)) this.locationPaths.set(loc, path$1.resolve(override));
+	}
+	async resolve({ location, relativePath }) {
+		const base = this.locationPaths.get(location) ?? path$1.join(this.rootPath, location);
+		return path$1.join(base, relativePath);
+	}
+	async write({ location, relativePath, data }) {
+		const filePath = await this.resolve({
+			location,
+			relativePath
+		});
+		await fs.promises.mkdir(path$1.dirname(filePath), { recursive: true });
+		if (Buffer.isBuffer(data)) await fs.promises.writeFile(filePath, data);
+		else {
+			const writeStream = fs.createWriteStream(filePath);
+			await new Promise((resolve, reject) => {
+				data.pipe(writeStream);
+				writeStream.on("finish", resolve);
+				writeStream.on("error", reject);
 			});
+		}
+	}
+	async read({ location, relativePath }) {
+		return fs.promises.readFile(await this.resolve({
+			location,
+			relativePath
+		}));
+	}
+	async exists({ location, relativePath }) {
+		try {
+			await fs.promises.access(await this.resolve({
+				location,
+				relativePath
+			}));
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async list({ location, prefix }) {
+		const base = this.locationPaths.get(location);
+		if (!base) return [];
+		const dir = prefix ? path$1.join(base, prefix) : base;
+		try {
+			return (await fs.promises.readdir(dir, { withFileTypes: true })).map((e) => prefix ? `${prefix}/${e.name}` : e.name);
+		} catch {
+			return [];
+		}
+	}
+	async delete({ location, relativePath }) {
+		const filePath = await this.resolve({
+			location,
+			relativePath
 		});
+		await fs.promises.rm(filePath, { force: true });
 	}
-	/**
-	* The byte stream stopped being splittable. Not recoverable — the splitter
-	* cannot resynchronise mid-box — so the child is a corpse and every consumer
-	* has to be told, loudly, with the reason.
-	*/
-	onFault(reason, wasLive, current, settle) {
-		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
-		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				unitsOut: this.unitsOut,
-				interstitial: this.splitter.discardedInterstitialTypes,
-				reason
+	async getAvailableSpace({ location }) {
+		const base = this.locationPaths.get(location);
+		if (!base) return null;
+		try {
+			let target = base;
+			while (!fs.existsSync(target)) {
+				const parent = path$1.dirname(target);
+				if (!parent || parent === target) return null;
+				target = parent;
 			}
-		});
-		this.killChild();
-		settle(error);
-		if (wasLive && current) {
-			this.args.plane.end("the fragment child produced unsplittable output");
-			this.deps.onChildExit?.(error);
+			const stats = await fs.promises.statfs(target);
+			return stats.bavail * stats.bsize;
+		} catch {
+			return null;
 		}
 	}
-	killChild() {
-		const child = this.child;
-		this.child = null;
-		if (child && !child.killed) try {
-			child.kill("SIGTERM");
-		} catch (err) {
-			this.deps.logger.warn("fmp4 fragment child: kill error", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					error: errMsg(err)
-				}
-			});
-		}
+	/** Get the resolved path for a location type (addon-declared ids fall back
+	*  to `<rootPath>/<id>`). */
+	getLocationPath(location) {
+		return this.locationPaths.get(location) ?? path$1.join(this.rootPath, location);
+	}
+	/** Get the root path */
+	getRootPath() {
+		return this.rootPath;
 	}
 };
 //#endregion
-export { ChildCostRegistry, FfmpegProcess, FilesystemStorageProvider, Fmp4FragmentChild, Fmp4FragmentPlane, NO_COST_CLAIM, PYTHON_VERSION, buildBinaryPath, canonicalDeviceFingerprint, canonicalHash, diffExportTargets, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements, nodeProcStatReader, parseProcCpuSeconds, parseProcRssBytes, readProcessCost, resolveExportFingerprint, signExpiringUrl, verifyExpiringUrl };
+//#region src/storage/physical-root.ts
+/**
+* The PHYSICAL root behind a storage-location path — ONE derivation, shared.
+*
+* A symlink or a bind mount reaches one disk under two names, and a string
+* comparison misses exactly the case that matters: two locations that look
+* distinct in the config and are the same directory. Every consumer that has to
+* answer "are these the same disk" resolves it here.
+*
+* Two consumers today, and they need different things from the SAME derivation,
+* which is why the resolution failure is reported rather than swallowed:
+*
+*  - the recorder's eviction domain merges same-root aliases into one
+*    oldest-first pool. It wants a key either way — an unresolvable root falls
+*    back to the lexically-resolved path, which can only ever OVER-partition
+*    (treat one disk as two) and never merge two different disks. That is the
+*    safe failure mode for a data-loss guard.
+*  - the orchestrator's collision refusal (D389) must NOT refuse on a root it
+*    could not resolve: a location on another node, or behind a remote
+*    provider, is unresolvable from here, and refusing on an unanswerable read
+*    blocks the operator on a doubt (D49's spirit). It needs to know.
+*
+* Node-only (`node:fs`), so it lives off the root entry and is re-exported from
+* `@camstack/types/node`.
+*/
+/** Resolve a location root to its physical key. Never throws. */
+function physicalRootOf(root, realpath = realpathSync) {
+	const resolved = path.resolve(root);
+	try {
+		return {
+			key: realpath(resolved),
+			resolved: true
+		};
+	} catch {
+		return {
+			key: resolved,
+			resolved: false
+		};
+	}
+}
+/**
+* Is `inner` the same directory as `outer`, or nested inside it?
+*
+* Containment matters as much as equality: a location inside another's tree is
+* WORSE than two equal roots, because the occupancy accounting silently
+* overlaps and a deletion under the outer one can take the inner one's footage
+* with it.
+*
+* Compared on path SEGMENTS, never as a string prefix — `/mnt/disk1` is not
+* inside `/mnt/disk` even though the string says so.
+*/
+function containsOrEquals(outer, inner) {
+	if (outer === inner) return true;
+	const relative = path.relative(outer, inner);
+	return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+//#endregion
+//#region src/utils/expiring-url-signature.ts
+/**
+* The ONE derivation of "a signed, expiring URL".
+*
+* This repo mints unguessable, self-expiring links in three places now — the
+* notification artifact plane, the Home Assistant media plane, and the snapshot
+* link plane. The first two grew independently and are byte-identical logic
+* (`hmac(secret, "<id>:<exp>")`, expiry checked before a constant-time compare),
+* each restating the crypto locally because **addons never import each other**.
+*
+* That reason is real, and the conclusion drawn from it was wrong. Two copies of
+* a signing scheme is how one of them quietly ends up with a different TTL, a
+* different compare, or a missing expiry check, and nothing fails until a link
+* that should have died keeps working. The fix is the same one D52 applies to
+* crop geometry: one derivation, in a place every addon may depend on. A
+* framework package is exactly that place — `@camstack/types/node`, off the root
+* entry because `node:crypto` must never be traversed by a browser bundler.
+*
+* What this module deliberately does NOT decide: the TTL, the base URL, the
+* shape of `id`, and the access level of the route. Those are per-plane policy
+* and each caller states them where a reader can see them.
+*/
+/**
+* The signature over `(id, expMs)`.
+*
+* `id` is whatever the plane uses to name the thing being served — an artifact
+* id, a track id, a `<deviceId>:<width>` pair. It is joined with `:` so a caller
+* must not put a `:` inside a field whose boundary matters; where a plane has
+* more than one field, it composes them itself and owns that ambiguity.
+*/
+function signExpiringUrl(secret, id, expMs) {
+	return createHmac("sha256", secret).update(`${id}:${String(expMs)}`).digest("hex");
+}
+/**
+* Verify a request's `(id, exp, sig)`.
+*
+* **Expiry is checked BEFORE the compare**, so an expired link is refused
+* whether or not its signature is valid — a leaked URL stops working on its own
+* and cannot be kept alive by holding a correct signature. The compare itself is
+* constant-time so a public route cannot be probed for the signature byte by
+* byte.
+*/
+function verifyExpiringUrl(input) {
+	const { secret, id, exp, sig, nowMs } = input;
+	if (exp === void 0 || sig === void 0) return false;
+	const expMs = typeof exp === "number" ? exp : Number(exp);
+	if (!Number.isFinite(expMs)) return false;
+	if (expMs <= nowMs) return false;
+	const expected = signExpiringUrl(secret, id, expMs);
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(sig, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+//#endregion
+//#region src/utils/export-reconciler.ts
+/**
+* Compute the stable 64-char lowercase-hex fingerprint of a device's
+* export-relevant shape. Two structurally-equal shapes (any feature order,
+* any duplicates, any deviceId) hash identically.
+*/
+function canonicalDeviceFingerprint(shape) {
+	const features = [...new Set(shape.features)].toSorted();
+	return canonicalHash({
+		deviceType: shape.deviceType,
+		features
+	});
+}
+/**
+* Pure 3-way diff of desired export state against the persisted
+* last-advertised state, keyed by `deviceId`.
+*
+* - `desired` — one entry per device to advertise this cycle, each carrying
+*   the freshly-computed `fingerprint`.
+* - `lastAdvertised` — the exporter's persisted per-target sync state.
+*
+* Neither input is mutated.
+*/
+function diffExportTargets(desired, lastAdvertised) {
+	const toAdd = [];
+	const toUpdate = [];
+	const desiredIds = /* @__PURE__ */ new Set();
+	for (const entry of desired) {
+		desiredIds.add(entry.deviceId);
+		const previous = lastAdvertised.get(entry.deviceId);
+		if (previous === void 0) toAdd.push(entry);
+		else if (previous.fingerprint !== entry.fingerprint) toUpdate.push(entry);
+	}
+	const toRemove = [];
+	for (const deviceId of lastAdvertised.keys()) if (!desiredIds.has(deviceId)) toRemove.push(deviceId);
+	return {
+		toAdd,
+		toUpdate,
+		toRemove
+	};
+}
+/**
+* Resolve the fingerprint an exporter should feed into `diffExportTargets`
+* for one device this cycle.
+*
+* When a device is NOT yet probe-ready, carry forward its last-advertised
+* (persisted) fingerprint so it nets to NO CHANGE in `diffExportTargets`
+* (neither update nor remove) — never advertise a partial mid-probe shape. A
+* brand-new un-probed device with no persisted entry falls back to `fresh` so
+* it can advertise once.
+*/
+function resolveExportFingerprint(input) {
+	if (input.ready) return input.fresh;
+	return input.persisted ?? input.fresh;
+}
+//#endregion
+export { ChildCostRegistry, FfmpegProcess, FilesystemStorageProvider, Fmp4FragmentChild, Fmp4FragmentPlane, NO_COST_CLAIM, PYTHON_VERSION, buildBinaryPath, canonicalDeviceFingerprint, canonicalHash, containsOrEquals, diffExportTargets, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements, nodeProcStatReader, parseProcCpuSeconds, parseProcRssBytes, physicalRootOf, readProcessCost, resolveExportFingerprint, signExpiringUrl, verifyExpiringUrl };