@camstack/addon-pipeline 0.1.20 → 0.2.0

package/dist/recorder/index.mjs

@@ -1,2209 +1,2095 @@
-import { spawn } from "node:child_process";
-import path__default from "node:path";
-import { promises, mkdirSync } from "node:fs";
-import { e as errMsg, Q as record, Z as RecordingConfigSchema, s as string, $ as createDurableState, o as object, a as array, a0 as RecordingRetentionSchema, n as number, a1 as literal, d as defineCustomActions, c as customAction, a2 as RecordingRuleSchema, a3 as CamProfileSchema, B as BaseAddon, a4 as recordingCapability, a5 as storageEvictableCapability, E as EventCategory, O as makeProfileBrokerId, r as hydrateSchema, a6 as selectAssignedProfileSlots } from "../index-5aYef068.mjs";
+import { G as recordingCapability, J as storageEvictableCapability, K as selectAssignedProfileSlots, P as hydrateSchema, T as createDurableState, at as record, g as RecordingConfigSchema, i as BaseAddon, j as errMsg, ot as string, p as EventCategory, z as migrateConfigToBands } from "../dist-C5jnNl0n.mjs";
+import { promises } from "node:fs";
+import path from "node:path";
 import { createFileDataPlaneHandler } from "@camstack/core";
-const pad = (n, w = 2) => String(n).padStart(w, "0");
-const DEFAULT_SUBTREE = "continuous";
-function hourBucketRelPath(startMs) {
-  const d = new Date(startMs);
-  return `${d.getUTCFullYear()}/${pad(d.getUTCMonth() + 1)}/${pad(d.getUTCDate())}/${pad(d.getUTCHours())}`;
+import { spawn } from "node:child_process";
+//#region src/recorder/segment-path.ts
+function segmentRelPath(deviceId, profile, startMs, durMs, bytes) {
+	if (profile.includes("/")) throw new Error(`segmentRelPath: profile must not contain '/': ${profile}`);
+	const d = new Date(startMs);
+	const p2 = (n) => String(n).padStart(2, "0");
+	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}/${startMs}-${durMs}-${bytes}.m4s`;
 }
-function bucketRelPath(camera, profile, subtree, startMs) {
-  return `${camera}/${profile}/${subtree}/${hourBucketRelPath(startMs)}`;
+var SEG_RE = /^(\d+)\/([^/]+)\/\d{4}\/\d{2}\/\d{2}\/\d{2}\/(\d+)-(\d+)-(\d+)\.m4s$/;
+function parseSegmentPath(relPath) {
+	const m = SEG_RE.exec(relPath);
+	if (!m) return null;
+	return {
+		deviceId: Number(m[1]),
+		profile: m[2],
+		startMs: Number(m[3]),
+		durMs: Number(m[4]),
+		bytes: Number(m[5])
+	};
 }
-function segmentRelPath(camera, profile, subtree, startMs, durMs) {
-  return `${bucketRelPath(camera, profile, subtree, startMs)}/${startMs}-${durMs}.m4s`;
+//#endregion
+//#region src/recorder/merge-ranges.ts
+function mergeRanges(segments, gapToleranceMs) {
+	if (segments.length === 0) return [];
+	const sorted = [...segments].toSorted((a, b) => a.startMs - b.startMs);
+	const out = [];
+	let curStart = sorted[0].startMs;
+	let curEnd = sorted[0].startMs + sorted[0].durMs;
+	for (let i = 1; i < sorted.length; i++) {
+		const s = sorted[i];
+		if (s.startMs <= curEnd + gapToleranceMs) curEnd = Math.max(curEnd, s.startMs + s.durMs);
+		else {
+			out.push({
+				startMs: curStart,
+				endMs: curEnd
+			});
+			curStart = s.startMs;
+			curEnd = s.startMs + s.durMs;
+		}
+	}
+	out.push({
+		startMs: curStart,
+		endMs: curEnd
+	});
+	return out;
 }
-function parseSegmentRelPath(rel) {
-  const parts = rel.split("/");
-  const hasSubtree = parts.length === 8;
-  if (parts.length !== 7 && parts.length !== 8) return null;
-  const camera = parts[0];
-  const profile = parts[1];
-  const subtreeRaw = hasSubtree ? parts[2] : DEFAULT_SUBTREE;
-  if (subtreeRaw !== "continuous" && subtreeRaw !== "events") return null;
-  const file = parts[parts.length - 1];
-  const m = /^(\d+)-(\d+)\.m4s$/.exec(file);
-  if (!m) return null;
-  return { camera, profile, subtree: subtreeRaw, startMs: Number(m[1]), durMs: Number(m[2]) };
+//#endregion
+//#region src/recorder/recording-index.ts
+/**
+* In-memory footage index, keyed by deviceId → (relativePath → SegmentRow).
+* The framework `storage` cap's `list()` is the ground truth: `hydrateDevice`
+* rebuilds a camera's set from a `list()` result, and `addSegment`/`removeSegments`
+* keep it write-through on finalize/evict. Because every row is derived from a
+* segment path (which encodes start/dur/bytes), the index can never drift from
+* disk. No SQLite, no persistence of its own.
+*/
+var RecordingIndex = class {
+	byDevice = /* @__PURE__ */ new Map();
+	mapFor(deviceId) {
+		let m = this.byDevice.get(deviceId);
+		if (!m) {
+			m = /* @__PURE__ */ new Map();
+			this.byDevice.set(deviceId, m);
+		}
+		return m;
+	}
+	/**
+	* Replace a device's segments FOR ONE LOCATION from a `storage.list` result (paths relative to that
+	* location root). Rows on other locations are preserved. Non-segment paths and other devices are ignored.
+	*/
+	hydrateDevice(deviceId, locationId, relPaths) {
+		const m = this.mapFor(deviceId);
+		for (const [path, existing] of m) if (existing.locationId === locationId) m.delete(path);
+		for (const path of relPaths) {
+			const p = parseSegmentPath(path);
+			if (!p || p.deviceId !== deviceId) continue;
+			m.set(path, {
+				deviceId: p.deviceId,
+				profile: p.profile,
+				startMs: p.startMs,
+				durMs: p.durMs,
+				bytes: p.bytes,
+				path,
+				locationId
+			});
+		}
+	}
+	/** Insert/replace one finalized segment (idempotent by path). */
+	addSegment(s) {
+		this.mapFor(s.deviceId).set(s.path, s);
+	}
+	/** Remove segments by relative path, routing each path to the correct device map via its encoded deviceId. */
+	removeSegments(paths) {
+		for (const p of paths) {
+			const parsed = parseSegmentPath(p);
+			if (!parsed) continue;
+			this.byDevice.get(parsed.deviceId)?.delete(p);
+		}
+	}
+	/** Rows for a device (optionally one profile), sorted by start. */
+	segments(deviceId, profile) {
+		const m = this.byDevice.get(deviceId);
+		if (!m) return [];
+		return [...m.values()].filter((s) => profile == null || s.profile === profile).toSorted((a, b) => a.startMs - b.startMs);
+	}
+	/** Aggregate accounting for a device across ALL its locations (use `accountingForLocation` for one location). */
+	accounting(deviceId) {
+		const m = this.byDevice.get(deviceId);
+		if (!m || m.size === 0) return {
+			bytes: 0,
+			count: 0,
+			oldestMs: null,
+			newestMs: null
+		};
+		let bytes = 0;
+		let oldestMs = Infinity;
+		let newestMs = -Infinity;
+		for (const s of m.values()) {
+			bytes += s.bytes;
+			if (s.startMs < oldestMs) oldestMs = s.startMs;
+			if (s.startMs > newestMs) newestMs = s.startMs;
+		}
+		return {
+			bytes,
+			count: m.size,
+			oldestMs,
+			newestMs
+		};
+	}
+	/** All segments on a storage location across every device, oldest-first. */
+	segmentsOnLocation(locationId) {
+		const out = [];
+		for (const m of this.byDevice.values()) for (const s of m.values()) if (s.locationId === locationId) out.push(s);
+		return out.toSorted((a, b) => a.startMs - b.startMs);
+	}
+	/** Aggregate accounting for a storage location across every device. */
+	accountingForLocation(locationId) {
+		let bytes = 0;
+		let count = 0;
+		let oldestMs = Infinity;
+		let newestMs = -Infinity;
+		for (const m of this.byDevice.values()) for (const s of m.values()) {
+			if (s.locationId !== locationId) continue;
+			bytes += s.bytes;
+			count += 1;
+			if (s.startMs < oldestMs) oldestMs = s.startMs;
+			if (s.startMs > newestMs) newestMs = s.startMs;
+		}
+		if (count === 0) return {
+			bytes: 0,
+			count: 0,
+			oldestMs: null,
+			newestMs: null
+		};
+		return {
+			bytes,
+			count,
+			oldestMs,
+			newestMs
+		};
+	}
+	/** Binary-search a start-sorted slice for the segment containing epochMs. */
+	segmentAtIn(segs, epochMs) {
+		if (segs.length === 0) return null;
+		let lo = 0;
+		let hi = segs.length - 1;
+		let cand = -1;
+		while (lo <= hi) {
+			const mid = lo + hi >> 1;
+			if (segs[mid].startMs <= epochMs) {
+				cand = mid;
+				lo = mid + 1;
+			} else hi = mid - 1;
+		}
+		if (cand < 0) return null;
+		const seg = segs[cand];
+		return epochMs < seg.startMs + seg.durMs ? seg : null;
+	}
+	/** The segment whose [startMs, startMs+durMs) window contains `epochMs`, or null if `epochMs` falls in a gap / there is no footage. */
+	segmentAt(deviceId, profile, epochMs) {
+		return this.segmentAtIn(this.segments(deviceId, profile), epochMs);
+	}
+	/**
+	* If epochMs is covered, returns it unchanged. Otherwise returns the start of the
+	* next covered segment forward. Returns null if there is no forward coverage
+	* (epoch past all footage, or no footage at all). Only snaps forward — never backward.
+	*/
+	nearestCoveredEdge(deviceId, profile, epochMs) {
+		const segs = this.segments(deviceId, profile);
+		if (segs.length === 0) return null;
+		if (this.segmentAtIn(segs, epochMs) !== null) return epochMs;
+		const next = segs.find((s) => s.startMs >= epochMs);
+		return next ? next.startMs : null;
+	}
+	ranges(deviceId, profile, fromMs, toMs, gapToleranceMs) {
+		return mergeRanges(this.segments(deviceId, profile).filter((s) => s.startMs + s.durMs > fromMs && s.startMs < toMs), gapToleranceMs).map((r) => ({
+			startMs: Math.max(r.startMs, fromMs),
+			endMs: Math.min(r.endMs, toMs)
+		}));
+	}
+};
+//#endregion
+//#region src/recorder/segment-store.ts
+var SegmentStore = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async hydrate(deviceId, location) {
+		const paths = await this.deps.list({
+			location,
+			prefix: `${deviceId}/`
+		});
+		this.deps.index.hydrateDevice(deviceId, location, paths);
+	}
+	async onFinalized(input) {
+		let bytes;
+		try {
+			bytes = await this.deps.statBytes(input.flatAbsPath);
+		} catch (err) {
+			this.deps.logger.warn("segment stat failed", err);
+			return null;
+		}
+		if (bytes <= 0) return null;
+		const relPath = segmentRelPath(input.deviceId, input.profile, input.startMs, input.durMs, bytes);
+		const toAbs = `${input.locationRoot}/${relPath}`;
+		try {
+			await this.deps.moveFile(input.flatAbsPath, toAbs);
+		} catch (err) {
+			this.deps.logger.warn("segment relocate failed", err);
+			return null;
+		}
+		const row = {
+			deviceId: input.deviceId,
+			profile: input.profile,
+			startMs: input.startMs,
+			durMs: input.durMs,
+			bytes,
+			path: relPath,
+			locationId: input.locationId
+		};
+		this.deps.index.addSegment(row);
+		return row;
+	}
+	/**
+	* Delete `rows` via the storage cap under `location` and de-index the ones that delete
+	* successfully; returns the reclaimed byte total. Precondition: every row must belong to
+	* `location` (`row.locationId === location`) — the caller guarantees this (e.g. the evictable
+	* provider feeds rows from `segmentsOnLocation(location)`). Mixed-location rows would be deleted
+	* against the wrong location.
+	*/
+	async evict(location, rows) {
+		let reclaimed = 0;
+		const removed = [];
+		for (const r of rows) try {
+			await this.deps.deletePath({
+				location,
+				relativePath: r.path
+			});
+			removed.push(r.path);
+			reclaimed += r.bytes;
+		} catch (err) {
+			this.deps.logger.warn("segment delete failed", err);
+		}
+		if (removed.length > 0) this.deps.index.removeSegments(removed);
+		return reclaimed;
+	}
+};
+//#endregion
+//#region src/recorder/evict-select.ts
+var DAY_MS$2 = 1440 * 60 * 1e3;
+var GB = 1e9;
+function selectEvictions(segments, limits) {
+	const oldestFirst = [...segments].toSorted((a, b) => a.startMs - b.startMs);
+	const selected = /* @__PURE__ */ new Set();
+	const out = [];
+	const select = (s) => {
+		if (selected.has(s.path)) return;
+		selected.add(s.path);
+		out.push(s);
+	};
+	if (limits.maxAgeDays != null && limits.maxAgeDays > 0) {
+		const cutoff = limits.nowMs - limits.maxAgeDays * DAY_MS$2;
+		for (const s of oldestFirst) if (s.startMs < cutoff) select(s);
+	}
+	if (limits.maxSizeGb != null && limits.maxSizeGb > 0) {
+		const cap = limits.maxSizeGb * GB;
+		let remaining = 0;
+		for (const s of oldestFirst) if (!selected.has(s.path)) remaining += s.bytes;
+		for (const s of oldestFirst) {
+			if (remaining <= cap) break;
+			if (selected.has(s.path)) continue;
+			select(s);
+			remaining -= s.bytes;
+		}
+	}
+	return out;
 }
-const HOUR_MS$1 = 36e5;
-class RamIndex {
-  byCam = /* @__PURE__ */ new Map();
-  static fromScan(entries) {
-    const idx = new RamIndex();
-    for (const e of entries) {
-      const p = parseSegmentRelPath(e.relPath);
-      if (p) idx.add(p.camera, p.profile, p.startMs, p.durMs, e.bytes, e.locationId, p.subtree);
-    }
-    return idx;
-  }
-  add(camera, profile, startMs, durMs, bytes, locationId, subtree = DEFAULT_SUBTREE) {
-    let profiles = this.byCam.get(camera);
-    if (!profiles) {
-      profiles = /* @__PURE__ */ new Map();
-      this.byCam.set(camera, profiles);
-    }
-    let segs = profiles.get(profile);
-    if (!segs) {
-      segs = [];
-      profiles.set(profile, segs);
-    }
-    if (segs.some((s) => s.startMs === startMs)) return;
-    segs.push({ startMs, durMs, bytes, locationId, subtree });
-    segs.sort((a, b) => a.startMs - b.startMs);
-  }
-  remove(camera, profile, startMs) {
-    const segs = this.byCam.get(camera)?.get(profile);
-    if (!segs) return;
-    const i = segs.findIndex((s) => s.startMs === startMs);
-    if (i >= 0) segs.splice(i, 1);
-  }
-  /** Profiles that have at least one segment for this camera. */
-  profiles(camera) {
-    return [...this.byCam.get(camera)?.keys() ?? []];
-  }
-  /** Camera keys with at least one indexed segment. */
-  cameras() {
-    return [...this.byCam.keys()];
-  }
-  totalBytes(camera) {
-    let total = 0;
-    for (const segs of this.byCam.get(camera)?.values() ?? []) {
-      for (const s of segs) total += s.bytes;
-    }
-    return total;
-  }
-  /**
-   * Raw segments for a single (camera,profile) overlapping [fromMs,toMs],
-   * sorted ascending by start. Unlike `availability` (which merges
-   * contiguous segments into ranges) this returns the individual
-   * fragments — the input needed to build a VOD variant playlist.
-   */
-  listSegments(camera, profile, fromMs, toMs) {
-    const segs = this.byCam.get(camera)?.get(profile);
-    if (!segs) return [];
-    const out = [];
-    for (const s of segs) {
-      const segEnd = s.startMs + s.durMs;
-      if (segEnd <= fromMs || s.startMs >= toMs) continue;
-      out.push({ startMs: s.startMs, durMs: s.durMs, locationId: s.locationId, subtree: s.subtree });
-    }
-    return out;
-  }
-  /**
-   * Aggregate this camera's segments into UTC hour buckets — the unit
-   * retention deletes. Each bucket carries its dir rel path, hour-start ms,
-   * summed bytes (the RAM size counter the retention math prunes on), the
-   * storage `locationId` its segments live on, and the `subtree` (continuous vs
-   * events). Each distinct (subtree, hour, location) is a separate bucket — so
-   * mixed combinations split apart and each is `rm`'d from the right root under
-   * its own per-subtree retention policy. Buckets are per profile, ascending.
-   */
-  hourBuckets(camera) {
-    const out = [];
-    for (const [profile, segs] of this.byCam.get(camera) ?? []) {
-      const byBucket = /* @__PURE__ */ new Map();
-      for (const s of segs) {
-        const hourStartMs = Math.floor(s.startMs / HOUR_MS$1) * HOUR_MS$1;
-        const key = `${s.subtree} ${hourStartMs} ${s.locationId ?? ""}`;
-        const cur = byBucket.get(key);
-        if (cur) {
-          cur.bytes += s.bytes;
-          cur.count += 1;
-        } else byBucket.set(key, { hourStartMs, locationId: s.locationId, subtree: s.subtree, bytes: s.bytes, count: 1 });
-      }
-      for (const b of byBucket.values()) {
-        out.push({
-          relPath: `${camera}/${profile}/${b.subtree}/${hourBucketRelPath(b.hourStartMs)}`,
-          hourStartMs: b.hourStartMs,
-          bytes: b.bytes,
-          segmentCount: b.count,
-          locationId: b.locationId,
-          subtree: b.subtree
-        });
-      }
-    }
-    return out;
-  }
-  /**
-   * Drop every segment in the hour bucket named by `relPath`
-   * (`<camera>/<profile>/<subtree>/<Y>/<M>/<D>/<H>`) whose `locationId` matches
-   * (exact, incl. `undefined === undefined` for legacy single-root segments).
-   * Scoping by both subtree (in the path) and location keeps the hour's
-   * other-subtree / other-location segments intact when one bucket is `rm`'d.
-   * Returns the count removed; a non-bucket or unknown path is a no-op. The
-   * on-disk dir is removed by the sweeper — this keeps the size counter in sync.
-   */
-  removeBucketByRelPath(relPath, locationId) {
-    const parts = relPath.split("/");
-    if (parts.length !== 7) return 0;
-    const [camera, profile, subtree, y, mo, d, h] = parts;
-    if (subtree !== "continuous" && subtree !== "events") return 0;
-    const hourStartMs = Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h));
-    if (Number.isNaN(hourStartMs)) return 0;
-    const segs = this.byCam.get(camera)?.get(profile);
-    if (!segs) return 0;
-    let removed = 0;
-    for (let i = segs.length - 1; i >= 0; i--) {
-      const s = segs[i];
-      if (Math.floor(s.startMs / HOUR_MS$1) * HOUR_MS$1 === hourStartMs && s.locationId === locationId && s.subtree === subtree) {
-        segs.splice(i, 1);
-        removed++;
-      }
-    }
-    return removed;
-  }
-  /**
-   * Un-retained segments (the modes-engine policy reaper's work list). A
-   * segment stays a candidate until {@link markRetained} confirms it falls in a
-   * trigger window — then the reaper leaves it alone (only retention prunes it).
-   */
-  policyCandidates(camera) {
-    const out = [];
-    for (const [profile, segs] of this.byCam.get(camera) ?? []) {
-      for (const s of segs) {
-        if (s.retained) continue;
-        out.push({ profile, startMs: s.startMs, durMs: s.durMs, endMs: s.startMs + s.durMs, locationId: s.locationId, subtree: s.subtree });
-      }
-    }
-    return out;
-  }
-  /** Mark a segment as policy-retained so the reaper stops reconsidering it. */
-  markRetained(camera, profile, startMs) {
-    const seg = this.byCam.get(camera)?.get(profile)?.find((s) => s.startMs === startMs);
-    if (seg) seg.retained = true;
-  }
-  /**
-   * The earliest `startMs` of any segment for this camera across all profiles
-   * and subtrees, or `null` when the camera has no indexed segments.
-   */
-  oldestStartMs(camera) {
-    let oldest = null;
-    for (const segs of this.byCam.get(camera)?.values() ?? []) {
-      for (const s of segs) {
-        if (oldest === null || s.startMs < oldest) oldest = s.startMs;
-      }
-    }
-    return oldest;
-  }
-  /** Merged availability ranges overlapping [fromMs,toMs], per profile. */
-  availability(camera, fromMs, toMs) {
-    const out = [];
-    for (const [profile, segs] of this.byCam.get(camera) ?? []) {
-      let cur = null;
-      for (const s of segs) {
-        const segEnd = s.startMs + s.durMs;
-        if (segEnd <= fromMs || s.startMs >= toMs) {
-          if (cur) {
-            out.push(cur);
-            cur = null;
-          }
-          continue;
-        }
-        if (cur && s.startMs === cur.endMs) {
-          cur.endMs = segEnd;
-        } else {
-          if (cur) out.push(cur);
-          cur = { profile, startMs: s.startMs, endMs: segEnd };
-        }
-      }
-      if (cur) out.push(cur);
-    }
-    return out;
-  }
+/**
+* Pick the oldest segments whose cumulative bytes reach `targetBytes` (free ≈ targetBytes).
+* Oldest-first, no pinning. Returns all segments if the target exceeds the total; empty for a non-positive target.
+*
+* Selection is segment-granular: the actual reclaimable bytes may EXCEED `targetBytes` by up to
+* the size of the last selected segment (a 1-byte target still evicts one whole segment). Callers
+* sizing a reclaim share (e.g. StoragePressureManager) should expect this overshoot.
+*/
+function selectEvictionsByBytes(segments, targetBytes) {
+	if (targetBytes <= 0) return [];
+	const oldestFirst = [...segments].toSorted((a, b) => a.startMs - b.startMs);
+	const out = [];
+	let freed = 0;
+	for (const s of oldestFirst) {
+		if (freed >= targetBytes) break;
+		out.push(s);
+		freed += s.bytes;
+	}
+	return out;
 }
-const HOUR_MS = 36e5;
-function planRetention(buckets, policy, nowMs) {
-  const sorted = [...buckets].sort((a, b) => a.hourStartMs - b.hourStartMs);
-  const survivors = [];
-  const doomed = [];
-  if (policy.maxAgeMs != null) {
-    const cutoff = nowMs - policy.maxAgeMs;
-    for (const b of sorted) {
-      if (b.hourStartMs + HOUR_MS <= cutoff) doomed.push({ ...b, reason: "age" });
-      else survivors.push(b);
-    }
-  } else {
-    survivors.push(...sorted);
-  }
-  if (policy.maxSizeBytes != null) {
-    let total = survivors.reduce((sum, b) => sum + b.bytes, 0);
-    while (total > policy.maxSizeBytes && survivors.length > 1) {
-      const oldest = survivors.shift();
-      total -= oldest.bytes;
-      doomed.push({ ...oldest, reason: "size" });
-    }
-  }
-  doomed.sort((a, b) => a.hourStartMs - b.hourStartMs);
-  return {
-    deleteBuckets: doomed,
-    reclaimedBytes: doomed.reduce((sum, b) => sum + b.bytes, 0)
-  };
+//#endregion
+//#region src/recorder/storage-evictable-provider.ts
+/**
+* Implements the `storage-evictable` cap surface for recording footage. The core
+* StoragePressureManager owns the trigger (per-location free-space monitoring); this
+* provider decides WHAT footage is expendable (oldest-first, no pinning) and deletes it
+* via `SegmentStore.evict`, which removes the file through the `storage` cap and de-indexes.
+*
+* The cap's `locationId` is used directly as the storage `location` (identity); see Plan 2d
+* notes. Wiring this class to the cap + the SegmentStore happens in Plan 2e.
+*/
+var StorageEvictableProvider = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async getEvictableUsage(input) {
+		return { bytes: this.deps.index.accountingForLocation(input.locationId).bytes };
+	}
+	async evict(input) {
+		const onLocation = this.deps.index.segmentsOnLocation(input.locationId);
+		const victims = selectEvictionsByBytes(onLocation, input.targetBytes);
+		return {
+			reclaimedBytes: await this.deps.store.evict(input.locationId, victims),
+			exhausted: victims.length >= onLocation.length
+		};
+	}
+};
+//#endregion
+//#region src/recorder/redundant-segments.ts
+/**
+* Return the indices (into `segs`) of segments safe to delete: those fully
+* contained within a kept segment `[coverStart, coverEnd]`. Sorting by start
+* ascending, then by end DESCENDING, guarantees the containing (longer) segment
+* is seen first and kept, and any shorter segment nested inside it is removed.
+*/
+function selectRedundantSegments(segs) {
+	if (segs.length < 2) return [];
+	const order = segs.map((s, i) => ({
+		start: s.startMs,
+		end: s.startMs + s.durMs,
+		i
+	})).toSorted((a, b) => a.start - b.start || b.end - a.end);
+	const remove = [];
+	let coverStart = Number.NEGATIVE_INFINITY;
+	let coverEnd = Number.NEGATIVE_INFINITY;
+	for (const seg of order) if (seg.start >= coverStart && seg.end <= coverEnd && seg.end > seg.start) remove.push(seg.i);
+	else {
+		coverStart = seg.start;
+		coverEnd = seg.end;
+	}
+	return remove;
+}
+//#endregion
+//#region src/recorder/janitor.ts
+/** Group an array by a string key. */
+function groupBy(items, key) {
+	const out = /* @__PURE__ */ new Map();
+	for (const it of items) {
+		const k = key(it);
+		const arr = out.get(k);
+		if (arr) arr.push(it);
+		else out.set(k, [it]);
+	}
+	return out;
 }
-function toMinutes(hhmm) {
-  const [h, m] = hhmm.split(":");
-  return Number(h) * 60 + Number(m);
+async function runRedundancyJanitor(deps) {
+	let files = 0;
+	let bytes = 0;
+	for (const deviceId of deps.deviceIds) {
+		const byProfile = groupBy(deps.segmentsFor(deviceId), (r) => r.profile);
+		for (const [profile, rows] of byProfile) {
+			const sorted = [...rows].toSorted((a, b) => a.startMs - b.startMs);
+			const redundant = selectRedundantSegments(sorted);
+			if (redundant.length === 0) continue;
+			const victims = redundant.map((i) => sorted[i]);
+			for (const [location, vrows] of groupBy(victims, (v) => v.locationId)) try {
+				const reclaimed = await deps.evict(location, vrows);
+				files += vrows.length;
+				bytes += reclaimed;
+			} catch (err) {
+				deps.logger.warn("janitor: evict failed (skipping)", { meta: {
+					deviceId,
+					profile,
+					location,
+					count: vrows.length,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			}
+		}
+	}
+	if (files > 0) deps.logger.info("janitor: removed redundant recording segments", { meta: {
+		files,
+		bytes
+	} });
+	return {
+		files,
+		bytes
+	};
 }
-function isScheduleActive(schedule, clock) {
-  if (schedule.kind === "always") return true;
-  if (schedule.days && !schedule.days.includes(clock.weekday)) return false;
-  const start = toMinutes(schedule.start);
-  const end = toMinutes(schedule.end);
-  const m = clock.minutesOfDay;
-  if (start === end) return false;
-  if (start < end) return m >= start && m < end;
-  return m >= start || m < end;
+//#endregion
+//#region src/recorder/event-map.ts
+var EventMap = class {
+	byDevice = /* @__PURE__ */ new Map();
+	record(deviceId, marker) {
+		const list = this.byDevice.get(deviceId) ?? [];
+		list.push({ ...marker });
+		this.byDevice.set(deviceId, list);
+	}
+	events(deviceId, fromMs, toMs) {
+		const list = this.byDevice.get(deviceId);
+		if (!list) return [];
+		return list.filter((e) => e.t >= fromMs && e.t <= toMs).toSorted((a, b) => a.t - b.t);
+	}
+	prune(nowMs, maxAgeMs) {
+		const cutoff = nowMs - maxAgeMs;
+		let dropped = 0;
+		for (const [deviceId, list] of this.byDevice) {
+			const kept = list.filter((e) => e.t >= cutoff);
+			dropped += list.length - kept.length;
+			this.byDevice.set(deviceId, kept);
+		}
+		return dropped;
+	}
+};
+//#endregion
+//#region src/recorder/event-capture.ts
+function markerFromMotion(data, pad) {
+	if (!data.detected) return null;
+	return {
+		t: data.timestamp,
+		startMs: data.timestamp - pad.padPreMs,
+		endMs: data.timestamp + pad.padPostMs,
+		source: "motion",
+		...data.regions !== void 0 ? { metadata: { regions: data.regions } } : {}
+	};
 }
-function isRecordingDemanded(rules, clock, triggers, nowMs) {
-  for (const r of rules) {
-    if (!isScheduleActive(r.schedule, clock)) continue;
-    if (r.mode === "continuous") return true;
-    const lastMs = r.mode === "onMotion" ? triggers.lastMotionMs : triggers.lastAudioMs;
-    if (lastMs != null && nowMs - lastMs <= r.postBufferSec * 1e3) return true;
-  }
-  return false;
+function subscribeEventCapture(deps) {
+	const { eventBus, map, padPreMs, padPostMs, onMotion } = deps;
+	return eventBus.subscribe({ category: EventCategory.MotionOnMotionChanged }, (event) => {
+		const mk = markerFromMotion(event.data, {
+			padPreMs,
+			padPostMs
+		});
+		if (!mk) return;
+		map.record(event.data.deviceId, mk);
+		onMotion?.(event.data.deviceId, event.data.timestamp);
+	});
 }
-function isContinuousActive(rules, clock) {
-  return rules.some((r) => r.mode === "continuous" && isScheduleActive(r.schedule, clock));
+//#endregion
+//#region src/recorder/day-bucket.ts
+/** Pure helpers to bucket recording segment starts into local calendar days. */
+var DAY_MS$1 = 1440 * 60 * 1e3;
+/**
+* Epoch (UTC ms) of the local midnight that starts the day containing `ms`.
+* `tzOffsetMinutes` is minutes to ADD to UTC to get local time — i.e. the client
+* sends `-new Date().getTimezoneOffset()`. Returning a UTC epoch (not a date
+* string) lets the viewer compare directly against the epoch it computes per
+* calendar cell, so markers line up regardless of timezone.
+*/
+function localMidnightEpoch(ms, tzOffsetMinutes) {
+	const off = tzOffsetMinutes * 6e4;
+	const local = ms + off;
+	return local - (local % DAY_MS$1 + DAY_MS$1) % DAY_MS$1 - off;
 }
-function isSegmentDemanded(rules, clock, triggers, segStartMs, segEndMs) {
-  for (const r of rules) {
-    if (!isScheduleActive(r.schedule, clock)) continue;
-    if (r.mode === "continuous") return true;
-    const lastMs = r.mode === "onMotion" ? triggers.lastMotionMs : triggers.lastAudioMs;
-    if (lastMs == null) continue;
-    const winStart = lastMs - r.preBufferSec * 1e3;
-    const winEnd = lastMs + r.postBufferSec * 1e3;
-    if (segEndMs >= winStart && segStartMs <= winEnd) return true;
-  }
-  return false;
+/**
+* Sorted, distinct local-midnight epochs for every segment start in [fromMs, toMs).
+*/
+function distinctRecordingDays(startsMs, fromMs, toMs, tzOffsetMinutes) {
+	const days = /* @__PURE__ */ new Set();
+	for (const s of startsMs) {
+		if (s < fromMs || s >= toMs) continue;
+		days.add(localMidnightEpoch(s, tzOffsetMinutes));
+	}
+	return [...days].toSorted((a, b) => a - b);
 }
-class RecorderCore {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  cameras = /* @__PURE__ */ new Map();
-  /**
-   * Index of ALL recordings on disk (attached or not), rebuilt from a periodic
-   * disk scan. Read-only fallback for queries about a camera that isn't
-   * currently attached — so past recordings stay playable after detach/restart.
-   */
-  playbackIndex = new RamIndex();
-  /** Replace the playback index from a fresh disk scan (boot + periodic). */
-  setPlaybackIndex(entries) {
-    this.playbackIndex = RamIndex.fromScan(entries);
-  }
-  /** The index that answers queries for a camera: its live one if attached,
-   *  else the scanned playback index. */
-  indexFor(deviceId) {
-    return this.cameras.get(deviceId)?.index ?? this.playbackIndex;
-  }
-  /**
-   * Start continuous recording for a camera: one passthrough writer per
-   * profile, each pulling its resolved RTSP url into a per-profile output
-   * directory. Idempotent-ish — re-attaching a live camera detaches first.
-   */
-  async attach(input) {
-    if (input.profiles.length === 0) {
-      throw new Error(`RecorderCore.attach: no profiles for device ${input.deviceId}`);
-    }
-    if (this.cameras.has(input.deviceId)) await this.detach(input.deviceId);
-    const index = new RamIndex();
-    const writers = [];
-    const pipelineKeys = [];
-    for (const profile of input.profiles) {
-      const source = await this.deps.acquireSource(input.deviceId, profile);
-      const outDir = input.outDirs?.[profile] ?? `${this.deps.dataDir}/${input.deviceId}/${profile}`;
-      const writer = this.deps.makeWriter({ rtspUrl: source.url, outDir, segmentSeconds: input.segmentSeconds });
-      writer.start();
-      writers.push(writer);
-      pipelineKeys.push(source.pipelineKey);
-    }
-    this.cameras.set(input.deviceId, {
-      index,
-      writers,
-      profiles: [...input.profiles],
-      pipelineKeys,
-      rules: input.rules ? [...input.rules] : [],
-      triggers: {}
-    });
-    this.deps.logger.info("recorder attached", {
-      meta: {
-        deviceId: input.deviceId,
-        profiles: input.profiles,
-        segmentSeconds: input.segmentSeconds,
-        ruleCount: input.rules?.length ?? 0
-      }
-    });
-  }
-  /**
-   * Record a motion / audio trigger for a camera (drives `onMotion` /
-   * `onAudioThreshold` rules). The caller applies the threshold test (motion
-   * happened / audio over `thresholdDbfs`) before calling — the core only
-   * stores the latest qualifying timestamp. No-op for an unattached camera.
-   */
-  recordTrigger(deviceId, kind, tsMs) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) return;
-    if (kind === "motion") cam.triggers.lastMotionMs = tsMs;
-    else cam.triggers.lastAudioMs = tsMs;
-  }
-  /**
-   * Feed an audio level (dBFS) sample for a camera. Records an audio trigger
-   * iff some `onAudioThreshold` rule's `thresholdDbfs` is met (louder = dBFS
-   * closer to 0, so `dbfs >= thresholdDbfs`). The threshold lives on the rule,
-   * so the comparison stays here rather than in the event-bus glue. No-op for an
-   * unattached camera or one with no audio rule.
-   */
-  onAudioLevel(deviceId, dbfs, tsMs) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) return;
-    const over = cam.rules.some(
-      (r) => r.mode === "onAudioThreshold" && r.thresholdDbfs != null && dbfs >= r.thresholdDbfs
-    );
-    if (over) cam.triggers.lastAudioMs = tsMs;
-  }
-  /**
-   * Decide whether a finalized segment `[segStartMs, segEndMs]` should be
-   * kept (relocated into the permanent tree + indexed) or discarded. No rules
-   * = continuous (always keep). Trigger modes keep only when recording is
-   * demanded at the segment's end (within `postBufferSec` of a trigger).
-   * `preBufferSec` (retroactive retain BEFORE a trigger) is NOT handled here —
-   * that's increment B. Unknown camera → discard.
-   */
-  shouldRetainSegment(deviceId, _segStartMs, segEndMs, clock) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) return false;
-    if (cam.rules.length === 0) return true;
-    return isRecordingDemanded(cam.rules, clock, cam.triggers, segEndMs);
-  }
-  /** Mark an indexed segment policy-retained (reaper stops reconsidering it). */
-  markSegmentRetained(deviceId, profile, startMs) {
-    this.cameras.get(deviceId)?.index.markRetained(String(deviceId), profile, startMs);
-  }
-  /**
-   * Policy reaper — the pre/post-buffer enforcement (modes engine increment B).
-   * For every rules-camera, walk its un-retained (candidate) segments:
-   *  - inside a trigger window (incl. `preBufferSec` BEFORE a trigger) → mark
-   *    retained so it survives (only retention prunes it after);
-   *  - else, once the segment is older than the longest `preBufferSec` (so a
-   *    late trigger can no longer claim it retroactively) → delete it;
-   *  - otherwise hold it — re-checked next sweep.
-   * Cameras with NO rules are pure-continuous: skipped here (retention-only).
-   */
-  async sweepPolicy(toClock, nowMs, deleteSegment) {
-    for (const [deviceId, cam] of this.cameras) {
-      if (cam.rules.length === 0) continue;
-      const maxPreBufferMs = Math.max(0, ...cam.rules.map((r) => r.preBufferSec)) * 1e3;
-      const camKey = String(deviceId);
-      for (const c of cam.index.policyCandidates(camKey)) {
-        if (isSegmentDemanded(cam.rules, toClock(c.endMs), cam.triggers, c.startMs, c.endMs)) {
-          cam.index.markRetained(camKey, c.profile, c.startMs);
-        } else if (c.endMs + maxPreBufferMs <= nowMs) {
-          try {
-            await deleteSegment(deviceId, c.profile, c.startMs, c.durMs, c.locationId, c.subtree);
-            cam.index.remove(camKey, c.profile, c.startMs);
-          } catch (err) {
-            this.deps.logger.warn("recorder policy reap rm failed", {
-              tags: { deviceId },
-              meta: { deviceId, profile: c.profile, startMs: c.startMs, error: String(err) }
-            });
-          }
-        }
-      }
-    }
-  }
-  /** Record a finalized segment into the camera's in-memory index. `locationId`
-   *  is the storage location its file was written to; `subtree` the
-   *  continuous/events subtree it was relocated into (per-subtree retention +
-   *  path resolution). */
-  onSegmentFinalized(deviceId, profile, startMs, durMs, bytes, locationId, subtree = "continuous") {
-    this.cameras.get(deviceId)?.index.add(String(deviceId), profile, startMs, durMs, bytes, locationId, subtree);
-  }
-  /**
-   * Seed a camera's live index with pre-existing on-disk segments discovered by
-   * a sized scan. Idempotent: `RamIndex.add` already dedupes by `(profile,
-   * startMs)` — re-seeding or a concurrent `onSegmentFinalized` for the same
-   * start timestamp is silently ignored, so there is no double-count.
-   *
-   * MUST be called AFTER `core.attach(deviceId, …)` so the seed lands in the
-   * camera's live index. If the camera is not attached (i.e. `attach` was never
-   * called or already detached), this is a no-op — warn and return.
-   */
-  seedIndexFromScan(deviceId, entries) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) {
-      this.deps.logger.warn("recorder seedIndexFromScan: device not attached, skipping seed", { tags: { deviceId }, meta: { deviceId } });
-      return;
-    }
-    const camKey = String(deviceId);
-    for (const e of entries) {
-      cam.index.add(camKey, e.profile, e.startMs, e.durMs, e.bytes, e.locationId, e.subtree);
-    }
-  }
-  /** Raw segments for one (camera,profile) overlapping [fromMs,toMs]. Falls
-   *  back to the scanned playback index when the camera isn't attached. Each
-   *  ref carries its `locationId` + `subtree` so playback resolves the path. */
-  listSegments(deviceId, profile, fromMs, toMs) {
-    return this.indexFor(deviceId).listSegments(String(deviceId), profile, fromMs, toMs);
-  }
-  /**
-   * Classify a finalized segment ending at `segEndMs` into its on-disk subtree:
-   * `continuous` when continuous recording is active at that time (a continuous
-   * rule's schedule applies, or the camera has NO rules = pure continuous),
-   * else `events` (kept only by a motion/audio trigger). Drives where the
-   * watcher relocates the segment and how it's retained. Unknown camera →
-   * `continuous` (harmless default; an unattached camera never finalizes).
-   */
-  classifySubtree(deviceId, _segEndMs, clock) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam || cam.rules.length === 0) return "continuous";
-    return isContinuousActive(cam.rules, clock) ? "continuous" : "events";
-  }
-  /** Profiles this camera has recordings for — live profiles if attached, else
-   *  whatever the disk scan found. */
-  getProfiles(deviceId) {
-    const cam = this.cameras.get(deviceId);
-    return cam ? cam.profiles : this.playbackIndex.profiles(String(deviceId));
-  }
-  getAvailability(deviceId, fromMs, toMs) {
-    return { deviceId, ranges: this.indexFor(deviceId).availability(String(deviceId), fromMs, toMs) };
-  }
-  getStatus(deviceId) {
-    const cam = this.cameras.get(deviceId);
-    const enabled = (cam?.writers.length ?? 0) > 0;
-    return {
-      deviceId,
-      enabled,
-      activeMode: enabled ? "continuous" : "off",
-      nodeId: this.deps.nodeId,
-      storageBytes: this.indexFor(deviceId).totalBytes(String(deviceId))
-    };
-  }
-  /**
-   * Prune aged-out / over-cap hour buckets for every attached camera, applying
-   * the `continuous` and `events` subtree policies INDEPENDENTLY (spec §6 —
-   * event footage usually outlives continuous).
-   *
-   * Per camera: aggregate the RAM index into hour buckets, split them by
-   * subtree, ask {@link planRetention} which to delete using that subtree's
-   * policy, `rm` each bucket dir, and — only on a successful `rm` — drop its
-   * segments from the index so the storage counter stays truthful. A failed
-   * `rm` leaves the bucket in the index for the next sweep to retry (no silent
-   * byte-counter drift). Pure decision, injected I/O.
-   */
-  async sweepRetention(resolvePolicy, nowMs, removeBucketDir) {
-    const results = [];
-    for (const [deviceId, cam] of this.cameras) {
-      const { deletedBuckets, reclaimedBytes } = await this.pruneSubtrees(
-        deviceId,
-        cam.index,
-        resolvePolicy,
-        nowMs,
-        removeBucketDir,
-        "recorder retention rm failed"
-      );
-      results.push({ deviceId, deletedBuckets, reclaimedBytes });
-    }
-    return results;
-  }
-  /**
-   * Shared per-device retention prune used by {@link sweepRetention} and
-   * {@link pruneFootageForDevice}: split the camera's hour buckets by subtree,
-   * `rm` each doomed bucket, sync the index only on a successful `rm`, and emit
-   * one structured `recorder eviction` INFO line per (subtree, reason) group
-   * that actually deleted something — carrying the reason, segment + byte
-   * totals, and the policy condition that triggered the eviction.
-   */
-  async pruneSubtrees(deviceId, index, resolvePolicy, nowMs, removeBucketDir, rmFailedMsg) {
-    const camKey = String(deviceId);
-    let deletedBuckets = 0;
-    let reclaimedBytes = 0;
-    const bySubtree = /* @__PURE__ */ new Map();
-    for (const b of index.hourBuckets(camKey)) {
-      const st = b.subtree ?? "continuous";
-      const arr = bySubtree.get(st);
-      if (arr) arr.push(b);
-      else bySubtree.set(st, [b]);
-    }
-    for (const [subtree, buckets] of bySubtree) {
-      const policy = resolvePolicy(deviceId, subtree);
-      const usedBytesBefore = index.totalBytes(camKey);
-      const plan = planRetention(buckets, policy, nowMs);
-      const byReason = /* @__PURE__ */ new Map();
-      for (const b of plan.deleteBuckets) {
-        try {
-          await removeBucketDir(b.relPath, b.locationId);
-        } catch (err) {
-          this.deps.logger.warn(rmFailedMsg, {
-            tags: { deviceId },
-            meta: { deviceId, relPath: b.relPath, locationId: b.locationId, error: String(err) }
-          });
-          continue;
-        }
-        const before = index.totalBytes(camKey);
-        index.removeBucketByRelPath(b.relPath, b.locationId);
-        const reclaimed = before - index.totalBytes(camKey);
-        reclaimedBytes += reclaimed;
-        deletedBuckets++;
-        const prev = byReason.get(b.reason);
-        byReason.set(b.reason, {
-          deletedBuckets: (prev?.deletedBuckets ?? 0) + 1,
-          deletedSegments: (prev?.deletedSegments ?? 0) + b.segmentCount,
-          reclaimedBytes: (prev?.reclaimedBytes ?? 0) + reclaimed
-        });
-      }
-      for (const [reason, tally] of byReason) {
-        this.deps.logger.info("recorder eviction", {
-          tags: { deviceId },
-          meta: {
-            deviceId,
-            reason,
-            subtree,
-            deletedBuckets: tally.deletedBuckets,
-            deletedSegments: tally.deletedSegments,
-            reclaimedBytes: tally.reclaimedBytes,
-            condition: reason === "age" ? { maxAgeDays: policy.maxAgeMs != null ? policy.maxAgeMs / 864e5 : null } : { maxSizeGb: policy.maxSizeBytes != null ? policy.maxSizeBytes / 1e9 : null, usedBytesBefore }
-          }
-        });
-      }
-    }
-    return { deletedBuckets, reclaimedBytes };
-  }
-  /**
-   * Apply this device's retention policy to its footage RIGHT NOW for one
-   * device, returning the oldest surviving segment start (the "retention
-   * floor") plus deletion accounting. The floor is the key output B3 uses to
-   * prune analytics events to the same boundary.
-   *
-   * Mirrors the per-device inner loop of {@link sweepRetention} but operates
-   * on a single camera and exposes the result — reuses the same
-   * `planRetention` + `removeBucketDir` path so the math stays consistent.
-   *
-   * @param deviceId       Camera to prune.
-   * @param nowMs          Wall-clock time for the age cutoff.
-   * @param resolvePolicy  Returns the retention policy for each subtree.
-   * @param removeBucketDir Injected `rm -rf` for one hour-bucket dir.
-   */
-  async pruneFootageForDevice(deviceId, nowMs, resolvePolicy, removeBucketDir) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) {
-      return { floorMs: null, deletedBuckets: 0, reclaimedBytes: 0 };
-    }
-    const camKey = String(deviceId);
-    const { deletedBuckets, reclaimedBytes } = await this.pruneSubtrees(
-      deviceId,
-      cam.index,
-      resolvePolicy,
-      nowMs,
-      removeBucketDir,
-      "recorder pruneFootage rm failed"
-    );
-    const floorMs = cam.index.oldestStartMs(camKey);
-    return { floorMs, deletedBuckets, reclaimedBytes };
-  }
-  /**
-   * Every device with recordings on this node — attached cameras (live RAM
-   * index) plus detached ones surfaced by the disk-scan playback index. The
-   * free-space guard frees space "from every device", so it walks the union.
-   */
-  recordedDeviceIds() {
-    const ids = /* @__PURE__ */ new Set();
-    for (const id of this.cameras.keys()) ids.add(id);
-    for (const cam of this.playbackIndex.cameras()) {
-      const n = Number(cam);
-      if (Number.isFinite(n)) ids.add(n);
-    }
-    return [...ids];
-  }
-  /**
-   * Total footage bytes stored on a location, across every recorded device.
-   * Backs the `storage-evictable` provider's `getEvictableUsage` so the core
-   * StoragePressureManager can fan out a deficit proportionally.
-   */
-  evictableBytesOnLocation(locationId) {
-    let total = 0;
-    for (const deviceId of this.recordedDeviceIds()) {
-      const camKey = String(deviceId);
-      for (const b of this.indexFor(deviceId).hourBuckets(camKey)) {
-        if (b.locationId === locationId) total += b.bytes;
-      }
-    }
-    return total;
-  }
-  /**
-   * Free ~`targetBytes` of footage on a location by deleting the OLDEST hour
-   * buckets first, globally across devices (oldest-anywhere wins). Backs the
-   * `storage-evictable` provider's `evict`. Only successfully-removed buckets
-   * count toward `reclaimedBytes`. `exhausted` = ran out of buckets before
-   * hitting the target. Per-device eviction is logged device-tagged.
-   */
-  async evictBytesOnLocation(locationId, targetBytes, removeBucketDir) {
-    const candidates = [];
-    for (const deviceId of this.recordedDeviceIds()) {
-      const camKey = String(deviceId);
-      for (const b of this.indexFor(deviceId).hourBuckets(camKey)) {
-        if (b.locationId === locationId) candidates.push({ deviceId, bucket: b });
-      }
-    }
-    candidates.sort((a, b) => a.bucket.hourStartMs - b.bucket.hourStartMs);
-    let reclaimed = 0;
-    const perDevice = /* @__PURE__ */ new Map();
-    let hitTarget = false;
-    for (const { deviceId, bucket } of candidates) {
-      if (reclaimed >= targetBytes) {
-        hitTarget = true;
-        break;
-      }
-      try {
-        await removeBucketDir(bucket.relPath, bucket.locationId);
-      } catch (err) {
-        this.deps.logger.warn("recorder free-space rm failed", {
-          tags: { deviceId },
-          meta: { deviceId, relPath: bucket.relPath, locationId: bucket.locationId, error: String(err) }
-        });
-        continue;
-      }
-      const index = this.indexFor(deviceId);
-      const camKey = String(deviceId);
-      const before = index.totalBytes(camKey);
-      index.removeBucketByRelPath(bucket.relPath, bucket.locationId);
-      const r = before - index.totalBytes(camKey);
-      reclaimed += r;
-      const tally = perDevice.get(deviceId) ?? { buckets: 0, bytes: 0 };
-      tally.buckets += 1;
-      tally.bytes += r;
-      perDevice.set(deviceId, tally);
-    }
-    for (const [deviceId, tally] of perDevice) {
-      if (tally.buckets > 0) {
-        this.deps.logger.info("recorder eviction", {
-          tags: { deviceId },
-          meta: { deviceId, reason: "free-space", locationId, deletedBuckets: tally.buckets, reclaimedBytes: tally.bytes }
-        });
-      }
-    }
-    return { reclaimedBytes: reclaimed, exhausted: !hitTarget };
-  }
-  /**
-   * Clear the live index for an attached camera so it can be re-seeded from a
-   * fresh sized disk scan. All writers and policy state are preserved — only the
-   * segment byte accounting is reset. No-op when the camera is not attached
-   * (matches the `seedIndexFromScan` contract: seeding a non-attached device is
-   * also a no-op, so a clear+reseed pair is always safe to call unconditionally).
-   *
-   * Intended usage (see `rescanStorage` provider in `index.ts`):
-   *   1. `core.rescanDevice(deviceId)`   — drop stale index entries
-   *   2. `await seedIndexForDevice(core, deviceId)` — re-populate from disk
-   *   3. `core.getStatus(deviceId)` — now reflects true on-disk bytes
-   */
-  rescanDevice(deviceId) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) return;
-    this.cameras.set(deviceId, { ...cam, index: new RamIndex() });
-  }
-  /**
-   * Stop all writers for a camera, release its broker sources, and drop its
-   * index. Writers are stopped FIRST (ffmpeg disconnects from the restream)
-   * before the broker demand is released, so the broker can idle cleanly.
-   */
-  async detach(deviceId) {
-    const cam = this.cameras.get(deviceId);
-    if (!cam) return;
-    for (const w of cam.writers) w.stop();
-    this.cameras.delete(deviceId);
-    const releases = await Promise.allSettled(
-      cam.pipelineKeys.map((key) => this.deps.releaseSource(key))
-    );
-    for (const r of releases) {
-      if (r.status === "rejected") {
-        this.deps.logger.warn("recorder source release failed", {
-          tags: { deviceId },
-          meta: { deviceId, error: String(r.reason) }
-        });
-      }
-    }
-    this.deps.logger.info("recorder detached", { tags: { deviceId }, meta: { deviceId } });
-  }
-  /** Stop every camera — used on addon shutdown. */
-  async detachAll() {
-    await Promise.all([...this.cameras.keys()].map((deviceId) => this.detach(deviceId)));
-  }
-  /** Device ids currently recording. */
-  attachedDevices() {
-    return [...this.cameras.keys()];
-  }
+//#endregion
+//#region src/recorder/playlist.ts
+/** A VOD variant playlist with an absolute wall-clock anchor per segment. */
+function buildVariantPlaylist(segments) {
+	const maxDur = segments.reduce((m, s) => Math.max(m, s.durMs), 0);
+	const lines = [
+		"#EXTM3U",
+		"#EXT-X-VERSION:7",
+		"#EXT-X-PLAYLIST-TYPE:VOD",
+		`#EXT-X-TARGETDURATION:${Math.ceil(maxDur / 1e3)}`,
+		"#EXT-X-MEDIA-SEQUENCE:0"
+	];
+	segments.forEach((s, i) => {
+		if (i > 0) lines.push("#EXT-X-DISCONTINUITY");
+		lines.push(`#EXT-X-PROGRAM-DATE-TIME:${new Date(s.startMs).toISOString()}`);
+		lines.push(`#EXTINF:${(s.durMs / 1e3).toFixed(3)},`);
+		lines.push(s.uri);
+	});
+	lines.push("#EXT-X-ENDLIST");
+	return lines.join("\n") + "\n";
 }
-async function pruneDeviceWithEvents(core, deviceId, nowMs, resolvePolicy, removeBucketDir, api, logger) {
-  const result = await core.pruneFootageForDevice(
-    deviceId,
-    nowMs,
-    resolvePolicy,
-    removeBucketDir
-  );
-  if (result.deletedBuckets > 0) {
-    logger.info("recorder footage eviction", {
-      meta: {
-        deviceId,
-        deletedBuckets: result.deletedBuckets,
-        reclaimedBytes: result.reclaimedBytes,
-        floorMs: result.floorMs
-      }
-    });
-  }
-  if (result.floorMs == null) return;
-  try {
-    await api.pipelineAnalytics.pruneEventsBefore.mutate({ deviceId, cutoffMs: result.floorMs });
-  } catch (err) {
-    logger.warn("recorder: pruneEventsBefore failed", {
-      meta: { deviceId, error: errMsg(err) }
-    });
-  }
+/** A master (multi-variant) playlist enabling client ABR / profile selection. */
+function buildMasterPlaylist(variants) {
+	const lines = ["#EXTM3U", "#EXT-X-VERSION:7"];
+	for (const v of variants) {
+		const attrs = [`BANDWIDTH=${v.bandwidth}`];
+		if (v.resolution) attrs.push(`RESOLUTION=${v.resolution.width}x${v.resolution.height}`);
+		if (v.codecs) attrs.push(`CODECS="${v.codecs}"`);
+		attrs.push(`NAME="${v.profile}"`);
+		lines.push(`#EXT-X-STREAM-INF:${attrs.join(",")}`);
+		lines.push(v.uri);
+	}
+	return lines.join("\n") + "\n";
 }
-const MS_PER_DAY = 864e5;
-const BYTES_PER_GB = 1e9;
-function resolveDeviceRetention(override, defaultAgeDays, defaultSizeGb) {
-  const ageDays = override?.maxAgeDays && override.maxAgeDays > 0 ? override.maxAgeDays : defaultAgeDays;
-  const sizeGb = override?.maxSizeGb && override.maxSizeGb > 0 ? override.maxSizeGb : defaultSizeGb;
-  return {
-    maxAgeMs: ageDays > 0 ? ageDays * MS_PER_DAY : void 0,
-    maxSizeBytes: sizeGb > 0 ? sizeGb * BYTES_PER_GB : void 0
-  };
+//#endregion
+//#region src/recorder/recording-device-settings.ts
+function buildRecordingDeviceSchema() {
+	return { sections: [{
+		id: "recording-playback",
+		tab: "recording",
+		location: "top-tab",
+		title: "Recording",
+		order: 10,
+		fields: [{
+			type: "widget",
+			key: "_recordingPanel",
+			label: "",
+			widgetId: "host/recording-panel"
+		}]
+	}] };
 }
-const RecordingTargetSchema = RecordingConfigSchema;
-const RecordingTargetsBlobSchema = record(string(), RecordingTargetSchema);
-const RECORDING_TARGETS_KEY = "recordingTargets";
-function targetsState(store) {
-  return createDurableState({
-    key: RECORDING_TARGETS_KEY,
-    schema: RecordingTargetsBlobSchema,
-    fallback: {},
-    read: () => store.readAddonStore(),
-    write: (patch) => store.writeAddonStore(patch)
-  });
+//#endregion
+//#region src/recorder/addon/config-store.ts
+/**
+* Per-device recording-config persistence for the recorder addon.
+*
+* Every camera's `RecordingConfig` lives in ONE addon-store blob keyed by
+* (stringified) numeric deviceId — enumerable for boot hydrate (so the addon
+* knows which devices have persisted footage to index without scanning every
+* device store). The whole Zod-validated blob round-trips on every read/write
+* via a {@link createDurableState} handle, so no per-device field can be
+* silently dropped on persist. A corrupt blob reads back as EMPTY rather than
+* crashing boot.
+*
+* On read the legacy `mode`/`schedules`/`triggers` fields are derived once into
+* the authoritative `bands` via `migrateConfigToBands`, then persisted, so the
+* UI reads `bands` directly forever after.
+*/
+/** The addon-store key holding the deviceId → RecordingConfig map. */
+var RECORDING_CONFIGS_KEY = "recordingConfigs";
+/** Persisted shape: stringified numeric deviceId → full RecordingConfig. */
+var RecordingConfigsBlobSchema = record(string(), RecordingConfigSchema);
+/** Cold-start default for a camera that has never been configured: disabled, no bands. */
+var DEFAULT_DEVICE_CONFIG = {
+	enabled: false,
+	bands: []
+};
+function blobState(store) {
+	return createDurableState({
+		key: RECORDING_CONFIGS_KEY,
+		schema: RecordingConfigsBlobSchema,
+		fallback: {},
+		read: () => store.readAddonStore(),
+		write: (patch) => store.writeAddonStore(patch)
+	});
 }
-async function readRecordingTargets(store) {
-  const blob = await targetsState(store).get();
-  const map = /* @__PURE__ */ new Map();
-  for (const [key, target] of Object.entries(blob)) {
-    const id = Number(key);
-    if (Number.isInteger(id)) map.set(id, target);
-  }
-  return map;
+function serialize(map) {
+	const out = {};
+	for (const [id, config] of map) out[String(id)] = config;
+	return out;
 }
-async function upsertRecordingTarget(store, deviceId, target) {
-  const map = await readRecordingTargets(store);
-  map.set(deviceId, target);
-  await targetsState(store).set(serialize(map));
+/** Read every persisted device config, keyed by numeric deviceId. */
+async function readDeviceConfigs(store) {
+	const blob = await blobState(store).get();
+	const map = /* @__PURE__ */ new Map();
+	for (const [key, config] of Object.entries(blob)) {
+		const id = Number(key);
+		if (Number.isInteger(id)) map.set(id, config);
+	}
+	return map;
 }
-async function removeRecordingTarget(store, deviceId) {
-  const map = await readRecordingTargets(store);
-  if (!map.delete(deviceId)) return;
-  await targetsState(store).set(serialize(map));
+/**
+* The persisted config for a device with `bands` guaranteed materialized.
+* Legacy blobs (mode/schedules/triggers, no bands) are migrated into bands and
+* re-persisted so the stored shape converges on the authoritative model. An
+* unconfigured device returns {@link DEFAULT_DEVICE_CONFIG}.
+*/
+async function loadDeviceConfig(store, deviceId) {
+	const stored = (await readDeviceConfigs(store)).get(deviceId);
+	if (!stored) return DEFAULT_DEVICE_CONFIG;
+	if (stored.bands) return stored;
+	const migrated = {
+		...stored,
+		bands: migrateConfigToBands(stored)
+	};
+	await saveDeviceConfig(store, deviceId, migrated);
+	return migrated;
 }
-function serialize(map) {
-  const out = {};
-  for (const [id, target] of map) out[String(id)] = target;
-  return out;
+/**
+* Persist (insert or replace) a device's config. Validates against
+* `RecordingConfigSchema` at the boundary (untrusted cap input). Returns the
+* validated config that was persisted.
+*/
+async function saveDeviceConfig(store, deviceId, config) {
+	const validated = RecordingConfigSchema.parse(config);
+	const map = await readDeviceConfigs(store);
+	map.set(deviceId, validated);
+	await blobState(store).set(serialize(map));
+	return validated;
 }
-function buildRecordingDeviceSchema() {
-  return {
-    sections: [
-      {
-        id: "recording-playback",
-        tab: "recording",
-        location: "top-tab",
-        title: "Recording",
-        order: 10,
-        fields: [
-          { type: "widget", key: "_recordingPanel", label: "", widgetId: "host/recording-panel" }
-        ]
-      }
-    ]
-  };
+/**
+* Determine the active recording mode for a config's bands — the value the
+* `recording` cap status reports. `continuous` wins when any band records
+* continuously, else `events` when any band exists, else `off`.
+*/
+function activeModeForConfig(config) {
+	const bands = config.bands ?? [];
+	if (!config.enabled || bands.length === 0) return "off";
+	if (bands.some((b) => b.mode === "continuous")) return "continuous";
+	return "events";
 }
-const RecordingPlacementBlobSchema = object({
-  assignments: record(string(), array(string())).optional()
-});
-const DEFAULT_RECORDING_PLACEMENT = {
-  high: ["recordings:default"],
-  mid: ["recordings:default"],
-  low: ["recordingsLow:default"],
-  scrub: ["recordingsLow:default"]
+//#endregion
+//#region src/recorder/addon/recording-provider.ts
+/**
+* Builds the `recording` cap provider (`IRecordingProvider`) on the recorder
+* core. NO ffmpeg / segment writing here — that arrives in B2/B3. This shell
+* answers reads from the v2 `RecordingIndex` (hydrated from `storage.list`),
+* persists per-device config via durable-state, and prunes footage through
+* `selectEvictions` + `SegmentStore.evict`.
+*/
+/** Bandwidth hint per profile for the master playlist (real bitrate is a later refinement). */
+var PROFILE_BANDWIDTH = {
+	high: 4e6,
+	mid: 15e5,
+	low: 5e5
 };
-function resolveAssignedLocations(placement, key) {
-  return placement.assignments[key] ?? [];
+var DEFAULT_BANDWIDTH = 1e6;
+/**
+* Max gap (ms) between consecutive segments still treated as ONE continuous
+* availability range. Absorbs the few-ms EXTINF-rounding jitter at every segment
+* boundary and a single dropped/late ~4s segment; a larger gap (recorder off,
+* multiple missing segments) splits the ranges so real discontinuities show.
+*/
+var RANGE_MERGE_GAP_MS = 5e3;
+/** Empty "no playback" manifest. */
+function noPlayback(deviceId) {
+	return {
+		deviceId,
+		localMasterPath: null,
+		playbackUrl: null,
+		playbackEndpoints: []
+	};
 }
-function chooseWriteLocation(locationIds, free) {
-  let best = null;
-  let bestBytes = -Infinity;
-  for (const id of locationIds) {
-    const entry = free.find((f) => f.locationId === id);
-    const bytes = entry?.availableBytes ?? -1;
-    if (best === null || bytes > bestBytes) {
-      best = id;
-      bestBytes = bytes;
-    }
-  }
-  return best;
+/** Absolute dir the playback playlists for a device are written to (served root = `<dataDir>/playback`). */
+function playbackDirFor(dataDir, deviceId) {
+	return path.join(dataDir, "playback", String(deviceId));
 }
-function buildPassthroughArgs(a) {
-  return [
-    "-rtsp_transport",
-    "tcp",
-    "-i",
-    a.rtspUrl,
-    // Map ALL input streams (video + audio). Without this the segment muxer
-    // selects nothing and ffmpeg aborts with "Output file does not contain
-    // any stream".
-    "-map",
-    "0",
-    // Copy the (already-fragmentable) video, but always re-encode audio to AAC.
-    // The MP4 segment muxer rejects raw G.711 (pcm_mulaw/pcm_alaw, common on
-    // Hikvision/ONVIF) with "codec not currently supported in container",
-    // which made ffmpeg exit before writing a single frame → 0-byte segments,
-    // no playlist, empty availability. The broker cannot report the source
-    // audio codec reliably (it advertises AAC even for µ-law streams), so we
-    // unconditionally transcode audio to AAC: cheap (low-bitrate mono/stereo)
-    // and muxable across every vendor. An `-c:a` with no audio stream is a no-op.
-    "-c:v",
-    "copy",
-    "-c:a",
-    "aac",
-    "-f",
-    "segment",
-    "-segment_time",
-    String(a.segmentSeconds),
-    "-segment_format",
-    "mp4",
-    "-segment_format_options",
-    "movflags=+frag_keyframe+empty_moov+default_base_moof",
-    "-reset_timestamps",
-    "1",
-    "-strftime",
-    "1",
-    "-segment_list",
-    `${a.outDir}/live.m3u8`,
-    "-segment_list_type",
-    "m3u8",
-    // FLAT epoch-named segments directly under `outDir`. We deliberately do
-    // NOT let ffmpeg write the date buckets: its segment muxer cannot create
-    // directories on this ffmpeg build (`-strftime_mkdir` is absent) and its
-    // `-strftime` expands in LOCAL time, whereas the playback layout
-    // (`segmentRelPath`) is UTC. The watcher relocates into the UTC bucket so
-    // disk + playback URIs stay consistent.
-    `${a.outDir}/%s.m4s`
-  ];
+/**
+* Build a master + per-profile variant HLS playlist on disk for the requested
+* window and return a RELATIVE playback URL through the hub's data-plane
+* reverse-proxy. Only segments actually present on disk are referenced (a
+* missing file would 404 mid-playlist). Returns "no playback" when the device
+* has no footage in range or the data-plane isn't served yet. Variant/segment
+* URIs are relative so the master + variants + segments form a self-contained
+* tree the player resolves against the master URL.
+*/
+async function buildPlaybackManifest(deps, deviceId, fromMs, toMs) {
+	const base = deps.playbackBaseUrl();
+	if (base === null) return noPlayback(deviceId);
+	const rootById = new Map(deps.locations().map((l) => [l.id, l.root]));
+	const playbackDir = playbackDirFor(deps.dataDir, deviceId);
+	const profiles = [...new Set(deps.index.segments(deviceId).map((s) => s.profile))];
+	const variants = [];
+	for (const profile of profiles) {
+		const segs = deps.index.segments(deviceId, profile).filter((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs).toSorted((a, b) => a.startMs - b.startMs);
+		if (segs.length === 0) continue;
+		const variantSegments = [];
+		for (const s of segs) {
+			const rel = segmentRelPath(deviceId, profile, s.startMs, s.durMs, s.bytes);
+			const root = rootById.get(s.locationId);
+			if (root === void 0) continue;
+			try {
+				await promises.stat(path.join(root, rel));
+			} catch {
+				continue;
+			}
+			variantSegments.push({
+				uri: rel.split("/").slice(1).join("/"),
+				startMs: s.startMs,
+				durMs: s.durMs
+			});
+		}
+		if (variantSegments.length === 0) continue;
+		await promises.mkdir(playbackDir, { recursive: true });
+		await promises.writeFile(path.join(playbackDir, `${profile}.m3u8`), buildVariantPlaylist(variantSegments), "utf8");
+		variants.push({
+			profile,
+			bandwidth: PROFILE_BANDWIDTH[profile] ?? DEFAULT_BANDWIDTH,
+			uri: `${profile}.m3u8`
+		});
+	}
+	if (variants.length === 0) return noPlayback(deviceId);
+	await promises.mkdir(playbackDir, { recursive: true });
+	const masterPath = path.join(playbackDir, "master.m3u8");
+	await promises.writeFile(masterPath, buildMasterPlaylist(variants), "utf8");
+	const playbackUrl = `${base}/${deviceId}/master.m3u8?from=${fromMs}&to=${toMs}`;
+	return {
+		deviceId,
+		localMasterPath: masterPath,
+		playbackUrl,
+		playbackEndpoints: [playbackUrl]
+	};
 }
-const MAX_RESTARTS = 10;
-const STDERR_TAIL_LINES = 12;
-class SegmentWriter {
-  constructor(cfg, deps) {
-    this.cfg = cfg;
-    this.deps = deps;
-  }
-  proc = null;
-  stopped = false;
-  restarts = 0;
-  start() {
-    if (this.stopped || this.proc) return;
-    const args = buildPassthroughArgs(this.cfg);
-    const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
-    this.proc = proc;
-    const stderrTail = [];
-    proc.stderr?.on("data", (chunk) => {
-      const text = chunk instanceof Buffer ? chunk.toString("utf8") : String(chunk);
-      for (const line of text.split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        stderrTail.push(trimmed);
-        if (stderrTail.length > STDERR_TAIL_LINES) stderrTail.shift();
-      }
-    });
-    proc.on("exit", (code) => {
-      this.proc = null;
-      if (this.stopped) return;
-      if (this.restarts >= MAX_RESTARTS) {
-        this.deps.logger.warn("SegmentWriter giving up after max restarts", {
-          meta: { outDir: this.cfg.outDir, code, stderrTail: stderrTail.join(" | ") }
-        });
-        return;
-      }
-      this.restarts++;
-      this.deps.logger.info("SegmentWriter restarting", { meta: { outDir: this.cfg.outDir, attempt: this.restarts } });
-      this.start();
-    });
-  }
-  stop() {
-    this.stopped = true;
-    this.proc?.kill();
-    this.proc = null;
-  }
+/** Number of days in ms — for the retention floor returned by `pruneFootage`. */
+var DAY_MS = 1440 * 60 * 1e3;
+function statusFor(deps, deviceId, config) {
+	return {
+		deviceId,
+		enabled: config.enabled,
+		activeMode: activeModeForConfig(config),
+		nodeId: deps.nodeId,
+		storageBytes: deps.index.accounting(deviceId).bytes
+	};
 }
-function buildVariantPlaylist(segments) {
-  const maxDur = segments.reduce((m, s) => Math.max(m, s.durMs), 0);
-  const lines = [
-    "#EXTM3U",
-    "#EXT-X-VERSION:7",
-    "#EXT-X-PLAYLIST-TYPE:VOD",
-    `#EXT-X-TARGETDURATION:${Math.ceil(maxDur / 1e3)}`,
-    "#EXT-X-MEDIA-SEQUENCE:0"
-  ];
-  segments.forEach((s, i) => {
-    if (i > 0) lines.push("#EXT-X-DISCONTINUITY");
-    lines.push(`#EXT-X-PROGRAM-DATE-TIME:${new Date(s.startMs).toISOString()}`);
-    lines.push(`#EXTINF:${(s.durMs / 1e3).toFixed(3)},`);
-    lines.push(s.uri);
-  });
-  lines.push("#EXT-X-ENDLIST");
-  return lines.join("\n") + "\n";
+/** Group a device's segments by their storage location id. */
+function segmentsByLocation(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const r of rows) {
+		const list = out.get(r.locationId);
+		if (list) list.push(r);
+		else out.set(r.locationId, [r]);
+	}
+	return out;
 }
-function buildMasterPlaylist(variants) {
-  const lines = ["#EXTM3U", "#EXT-X-VERSION:7"];
-  for (const v of variants) {
-    const attrs = [`BANDWIDTH=${v.bandwidth}`];
-    if (v.resolution) attrs.push(`RESOLUTION=${v.resolution.width}x${v.resolution.height}`);
-    if (v.codecs) attrs.push(`CODECS="${v.codecs}"`);
-    attrs.push(`NAME="${v.profile}"`);
-    lines.push(`#EXT-X-STREAM-INF:${attrs.join(",")}`);
-    lines.push(v.uri);
-  }
-  return lines.join("\n") + "\n";
+/**
+* Build the `IRecordingProvider`. The provider is a thin façade over the v2
+* core; all storage I/O flows through the injected deps.
+*/
+function buildRecordingProvider(deps) {
+	const readFile = deps.readFile ?? ((absPath) => promises.readFile(absPath));
+	return {
+		getStatus: async ({ deviceId }) => {
+			return statusFor(deps, deviceId, await loadDeviceConfig(deps.configStore, deviceId));
+		},
+		getAvailability: async ({ deviceId, fromMs, toMs }) => {
+			return {
+				deviceId,
+				ranges: [...new Set(deps.index.segments(deviceId).map((s) => s.profile))].flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
+					profile,
+					startMs: r.startMs,
+					endMs: r.endMs
+				})))
+			};
+		},
+		getDaysWithRecordings: async ({ deviceId, fromMs, toMs, tzOffsetMinutes }) => {
+			return {
+				deviceId,
+				days: distinctRecordingDays(deps.index.segments(deviceId).map((s) => s.startMs), fromMs, toMs, tzOffsetMinutes)
+			};
+		},
+		getPlaybackManifest: ({ deviceId, fromMs, toMs }) => buildPlaybackManifest(deps, deviceId, fromMs, toMs),
+		getStorageUsage: async () => {
+			const locations = deps.locations();
+			const devices = [];
+			const seenDevices = /* @__PURE__ */ new Set();
+			for (const loc of locations) for (const row of deps.index.segmentsOnLocation(loc.id)) seenDevices.add(row.deviceId);
+			let totalUsedBytes = 0;
+			for (const deviceId of seenDevices) {
+				const usedBytes = deps.index.accounting(deviceId).bytes;
+				totalUsedBytes += usedBytes;
+				devices.push({
+					deviceId,
+					usedBytes
+				});
+			}
+			const locationUsages = await Promise.all(locations.map(async (loc) => {
+				const cap = await deps.capacity(loc.root);
+				return {
+					locationId: loc.id,
+					usedBytes: deps.index.accountingForLocation(loc.id).bytes,
+					availableBytes: cap.availableBytes,
+					totalBytes: cap.totalBytes
+				};
+			}));
+			devices.sort((a, b) => b.usedBytes - a.usedBytes);
+			return {
+				nodeId: deps.nodeId,
+				totalUsedBytes,
+				devices,
+				locations: locationUsages
+			};
+		},
+		getDeviceConfig: async ({ deviceId }) => loadDeviceConfig(deps.configStore, deviceId),
+		locateSegment: async ({ deviceId, profile, epochMs }) => {
+			const seg = deps.index.segmentAt(deviceId, profile, epochMs);
+			if (seg) return {
+				kind: "segment",
+				startMs: seg.startMs,
+				durMs: seg.durMs,
+				bytes: seg.bytes
+			};
+			return {
+				kind: "gap",
+				nearestEdgeMs: deps.index.nearestCoveredEdge(deviceId, profile, epochMs)
+			};
+		},
+		readSegmentBytes: async ({ deviceId, profile, startMs }) => {
+			const seg = deps.index.segments(deviceId, profile).find((s) => s.startMs === startMs);
+			if (!seg) throw new Error(`recording: no segment at start ${startMs} for ${deviceId}/${profile}`);
+			const loc = deps.locations().find((l) => l.id === seg.locationId);
+			if (!loc) throw new Error(`recording: unknown location ${seg.locationId}`);
+			const data = await readFile(path.join(loc.root, seg.path));
+			return { data: Uint8Array.from(data) };
+		},
+		setDeviceConfig: async ({ deviceId, config }) => {
+			const saved = await saveDeviceConfig(deps.configStore, deviceId, config);
+			if (deps.onConfigChanged) try {
+				await deps.onConfigChanged(deviceId);
+			} catch (err) {
+				deps.logger.warn("recorder: re-evaluate after setDeviceConfig failed", {
+					tags: { deviceId },
+					meta: { error: errMsg(err) }
+				});
+			}
+			return saved;
+		},
+		rescanStorage: async ({ deviceId }) => {
+			const locations = await deps.refreshLocations();
+			await deps.hydrateDevice(deviceId, locations);
+			return statusFor(deps, deviceId, await loadDeviceConfig(deps.configStore, deviceId));
+		},
+		pruneFootage: async ({ deviceId }) => {
+			const retention = (await loadDeviceConfig(deps.configStore, deviceId)).retention;
+			const nowMs = Date.now();
+			const victims = selectEvictions(deps.index.segments(deviceId), {
+				maxAgeDays: retention?.maxAgeDays,
+				maxSizeGb: retention?.maxSizeGb,
+				nowMs
+			});
+			let reclaimedBytes = 0;
+			let deletedBuckets = 0;
+			for (const [locationId, locVictims] of segmentsByLocation(victims)) try {
+				const freed = await deps.segmentStore.evict(locationId, locVictims);
+				reclaimedBytes += freed;
+				if (freed > 0) deletedBuckets += locVictims.length;
+			} catch (err) {
+				deps.logger.warn("recorder pruneFootage evict failed for location", {
+					tags: { deviceId },
+					meta: {
+						locationId,
+						error: errMsg(err)
+					}
+				});
+			}
+			return {
+				floorMs: deps.index.accounting(deviceId).oldestMs ?? (retention?.maxAgeDays ? nowMs - retention.maxAgeDays * DAY_MS : null),
+				deletedBuckets,
+				reclaimedBytes
+			};
+		},
+		getDeviceSettingsContribution: async () => hydrateSchema(buildRecordingDeviceSchema(), {}),
+		getDeviceLiveContribution: async () => null,
+		applyDeviceSettingsPatch: async ({ patch }) => {
+			const keys = Object.keys(patch ?? {});
+			if (keys.length > 0) deps.logger.debug("recorder: ignoring legacy settings patch (widget owns settings)", { meta: { keys } });
+			return { success: true };
+		}
+	};
+}
+//#endregion
+//#region src/recorder/addon/roots.ts
+/**
+* Storage-root resolution + boot hydrate for the recorder addon.
+*
+* Recordings live in the managed `recordings` / `recordingsLow` storage
+* locations (operator-configurable, multi-disk-ready), resolved through the
+* `storage` cap. The v2 `RecordingIndex` is hydrated by walking each location
+* root's `<deviceId>/` subtree on disk — segment paths encode start/dur/bytes,
+* so the in-memory index can never drift from disk. (We walk the filesystem
+* directly instead of `storage.list` because that cap lists only a directory's
+* IMMEDIATE children, not the `<deviceId>/<profile>/Y/M/D/H/*.m4s` tree — using
+* it dropped the entire index to ~empty on every restart/rescan; the recorder
+* already does local fs I/O for stat/move on these same roots.)
+*/
+/** The two recordings location types the recorder addon writes/reads. */
+var RECORDING_LOCATION_TYPES = new Set(["recordings", "recordingsLow"]);
+/**
+* Resolve every recordings storage location (`recordings` + `recordingsLow`)
+* to `{ id, root }`. Returns an empty list when the storage cap is unreachable
+* or no recordings location exists — callers degrade rather than crash.
+*/
+async function resolveRecordingsLocations(api, logger) {
+	try {
+		const recordings = (await api.storage.listLocations.query({})).filter((l) => RECORDING_LOCATION_TYPES.has(l.type));
+		return Promise.all(recordings.map(async (l) => ({
+			id: l.id,
+			root: await api.storage.resolve.query({
+				location: l.id,
+				relativePath: ""
+			})
+		})));
+	} catch (err) {
+		logger.warn("recorder: listLocations failed — no recordings locations resolved", { meta: { error: errMsg(err) } });
+		return [];
+	}
+}
+/**
+* Hydrate the v2 `RecordingIndex` for one device from every recordings location
+* by recursively walking `<root>/<deviceId>/` for `*.m4s` segments and feeding
+* the location-relative paths (`<deviceId>/<profile>/Y/M/D/H/<file>.m4s`, which
+* `parseSegmentPath` understands) to `index.hydrateDevice`. A missing device dir
+* (no footage yet) and any per-location failure are warned + skipped
+* (best-effort), so one bad volume never blocks the rest of the hydrate.
+*/
+async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger) {
+	for (const loc of locations) {
+		const deviceDir = path.join(loc.root, String(deviceId));
+		let entries;
+		try {
+			entries = await promises.readdir(deviceDir, { recursive: true });
+		} catch (err) {
+			if (err.code !== "ENOENT") logger.warn("recorder: hydrateDevice walk failed for location", {
+				tags: { deviceId },
+				meta: {
+					locationId: loc.id,
+					error: errMsg(err)
+				}
+			});
+			continue;
+		}
+		const relPaths = entries.filter((e) => e.endsWith(".m4s")).map((e) => `${deviceId}/${e.split(path.sep).join("/")}`);
+		index.hydrateDevice(deviceId, loc.id, relPaths);
+	}
+}
+//#endregion
+//#region src/recorder/addon/ffmpeg-args.ts
+/** ffmpeg argv: pull RTSP (TCP), copy video / transcode audio to AAC, write
+*  fragmented-mp4 segments named by epoch seconds FLAT under `outDir`, plus a
+*  rolling `live.m3u8` playlist. The recorder segment-watcher tails the
+*  playlist and hands each finalized flat file to `SegmentStore.onFinalized`,
+*  which stats + relocates it into the bucket tree (`segmentRelPath`). */
+function buildPassthroughArgs(a) {
+	return [
+		"-rtsp_transport",
+		"tcp",
+		"-i",
+		a.rtspUrl,
+		"-map",
+		"0",
+		"-c:v",
+		"copy",
+		"-c:a",
+		"aac",
+		"-f",
+		"segment",
+		"-segment_time",
+		String(a.segmentSeconds),
+		"-segment_format",
+		"mp4",
+		"-segment_format_options",
+		"movflags=+frag_keyframe+empty_moov+default_base_moof",
+		"-reset_timestamps",
+		"1",
+		"-strftime",
+		"1",
+		"-segment_list",
+		`${a.outDir}/live.m3u8`,
+		"-segment_list_type",
+		"m3u8",
+		`${a.outDir}/%s.m4s`
+	];
 }
-const EPOCH_NAME_RE = /^(\d+)\.m4s$/;
-const MAX_PENDING_TICKS = 8;
+//#endregion
+//#region src/recorder/addon/segment-writer.ts
+/** Max CONSECUTIVE rapid restarts before giving up (reset by a stable run). */
+var MAX_RESTARTS = 10;
+/** How many trailing ffmpeg stderr lines to keep for the give-up diagnostic. */
+var STDERR_TAIL_LINES = 12;
+/** Restart backoff: base delay, doubled per consecutive attempt, capped. */
+var RESTART_BASE_MS = 500;
+var RESTART_MAX_MS = 1e4;
+/** A process that ran at least this long is "stable" → reset the restart count,
+*  so sporadic blips over a long lifetime never accumulate into a give-up. */
+var STABLE_RUN_MS = 3e4;
+/** Supervises one passthrough ffmpeg for a single (camera, profile). */
+var SegmentWriter = class {
+	cfg;
+	deps;
+	proc = null;
+	stopped = false;
+	restarts = 0;
+	restartTimer = null;
+	startedAt = 0;
+	constructor(cfg, deps) {
+		this.cfg = cfg;
+		this.deps = deps;
+	}
+	start() {
+		if (this.stopped || this.proc) return;
+		const args = buildPassthroughArgs(this.cfg);
+		const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
+		this.proc = proc;
+		this.startedAt = Date.now();
+		const stderrTail = [];
+		proc.stderr?.on("data", (chunk) => {
+			const text = chunk instanceof Buffer ? chunk.toString("utf8") : String(chunk);
+			for (const line of text.split("\n")) {
+				const trimmed = line.trim();
+				if (!trimmed) continue;
+				stderrTail.push(trimmed);
+				if (stderrTail.length > STDERR_TAIL_LINES) stderrTail.shift();
+			}
+		});
+		proc.on("exit", (code) => {
+			this.proc = null;
+			if (this.stopped) return;
+			const ranMs = Date.now() - this.startedAt;
+			if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
+			if (this.restarts >= MAX_RESTARTS) {
+				this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
+					outDir: this.cfg.outDir,
+					code,
+					stderrTail: stderrTail.join(" | ")
+				} });
+				this.stopped = true;
+				this.deps.onGaveUp?.();
+				return;
+			}
+			this.restarts++;
+			const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
+			this.deps.logger.info("SegmentWriter restarting", { meta: {
+				outDir: this.cfg.outDir,
+				attempt: this.restarts,
+				delayMs,
+				ranMs
+			} });
+			this.restartTimer = setTimeout(() => {
+				this.restartTimer = null;
+				this.start();
+			}, delayMs);
+		});
+	}
+	stop() {
+		this.stopped = true;
+		if (this.restartTimer) {
+			clearTimeout(this.restartTimer);
+			this.restartTimer = null;
+		}
+		this.proc?.kill();
+		this.proc = null;
+	}
+};
+//#endregion
+//#region src/recorder/addon/segment-watcher.ts
+/**
+* Poll-based tail of an ffmpeg `-segment_list` (`live.m3u8`) for one
+* (camera, profile) output dir — recorder variant.
+*
+* Adapted from the old recorder (`addon-pipeline/src/recorder/segment-watcher.ts`).
+* The robust playlist-tailing core is unchanged: it polls `live.m3u8`, derives
+* `startMs` from the flat `<epochSec>.m4s` filename, corrects the inflated
+* first-segment EXTINF duration against the successor's start, and handles
+* pending/phantom (file-not-yet-flushed) entries with a bounded retry.
+*
+* KEY ADAPTATION vs the old watcher: this watcher does NOT relocate the flat
+* file, does NOT classify a continuous/events subtree, and does NOT touch a RAM
+* index. For each finalized flat segment it simply calls
+* `onFinalized(startMs, durMs, flatAbsPath)` and lets the v2 `SegmentStore`
+* (`onFinalized`) do the stat + relocate-into-bucket + index. The watcher only
+* verifies the flat file is on disk (so `onFinalized` does not race the flush)
+* before handing it off; the SegmentStore re-stats for the authoritative byte
+* count that goes into the path. B2 records CONTINUOUS bands only, so there is
+* no subtree to classify.
+*/
+var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
+/** How many consecutive ticks to wait for a finalized segment's flat file to
+*  land before giving up on it (a genuine phantom). At a 2s watch interval this
+*  is ~16s — far longer than ffmpeg's slow-first-segment flush. */
+var MAX_PENDING_TICKS = 8;
+/**
+* Derive `startMs` (epoch milliseconds) from a flat ffmpeg segment path
+* (`<epochSec>.m4s`, possibly absolute). Returns null for any non-epoch path.
+*/
 function parseEpochStartMs(segPath) {
-  const m = EPOCH_NAME_RE.exec(path__default.basename(segPath));
-  if (!m) return null;
-  const epochSec = Number(m[1]);
-  return Number.isFinite(epochSec) ? epochSec * 1e3 : null;
+	const m = EPOCH_NAME_RE.exec(path.basename(segPath));
+	if (!m) return null;
+	const epochSec = Number(m[1]);
+	return Number.isFinite(epochSec) ? epochSec * 1e3 : null;
 }
+/**
+* Correct a finalized segment's duration. ffmpeg's first-segment `#EXTINF` is
+* unreliable under `-c copy` from RTSP — it is inflated by the initial PTS
+* offset (observed: 87.961s for a segment whose successor starts only 12s
+* later). A segment physically cannot outlast the start of the next segment, so
+* when a successor exists we clamp the rounded EXTINF to the inter-segment gap.
+* For normal segments EXTINF (millisecond-accurate) is below the
+* integer-second start gap and wins, preserving sub-second precision. When
+* there is no successor (genuine last segment) or the gap is non-positive
+* (restart / same-second), we trust EXTINF.
+*/
 function correctedDurMs(durSeconds, startMs, nextStartMs) {
-  const extinfMs = Math.round(durSeconds * 1e3);
-  if (nextStartMs === null) return extinfMs;
-  const gapMs = nextStartMs - startMs;
-  if (gapMs <= 0) return extinfMs;
-  return Math.min(extinfMs, gapMs);
+	const extinfMs = Math.round(durSeconds * 1e3);
+	if (nextStartMs === null) return extinfMs;
+	const gapMs = nextStartMs - startMs;
+	if (gapMs <= 0) return extinfMs;
+	return Math.min(extinfMs, gapMs);
 }
+/** Parse a `live.m3u8` body into ordered `#EXTINF` → segment-path pairs. */
 function parseLivePlaylist(body) {
-  const lines = body.split("\n");
-  const out = [];
-  let pendingDur = null;
-  for (const raw of lines) {
-    const line = raw.trim();
-    if (line.length === 0) continue;
-    if (line.startsWith("#EXTINF:")) {
-      const v = line.slice("#EXTINF:".length).replace(/,.*$/, "");
-      const dur = Number(v);
-      pendingDur = Number.isFinite(dur) ? dur : null;
-      continue;
-    }
-    if (line.startsWith("#")) continue;
-    if (pendingDur !== null) {
-      out.push({ durSeconds: pendingDur, segPath: line });
-      pendingDur = null;
-    }
-  }
-  return out;
-}
-function resolveFinalizedSegment(outDir, segPath, durMs, subtree) {
-  const abs = path__default.isAbsolute(segPath) ? segPath : path__default.join(outDir, segPath);
-  const startMs = parseEpochStartMs(abs);
-  if (startMs === null) return null;
-  const newAbs = path__default.join(outDir, subtree, hourBucketRelPath(startMs), `${startMs}-${durMs}.m4s`);
-  return { startMs, durMs, oldAbs: abs, newAbs };
+	const lines = body.split("\n");
+	const out = [];
+	let pendingDur = null;
+	for (const raw of lines) {
+		const line = raw.trim();
+		if (line.length === 0) continue;
+		if (line.startsWith("#EXTINF:")) {
+			const v = line.slice(8).replace(/,.*$/, "");
+			const dur = Number(v);
+			pendingDur = Number.isFinite(dur) ? dur : null;
+			continue;
+		}
+		if (line.startsWith("#")) continue;
+		if (pendingDur !== null) {
+			out.push({
+				durSeconds: pendingDur,
+				segPath: line
+			});
+			pendingDur = null;
+		}
+	}
+	return out;
 }
+/** `fs.stat` size, or null when the path does not exist. */
 async function statSize(p) {
-  try {
-    return (await promises.stat(p)).size;
-  } catch {
-    return null;
-  }
+	try {
+		return (await promises.stat(p)).size;
+	} catch {
+		return null;
+	}
 }
-async function handleSegmentEntry(outDir, entry, durMs, classify, onSegment, logger) {
-  const startMs = parseEpochStartMs(path__default.isAbsolute(entry.segPath) ? entry.segPath : path__default.join(outDir, entry.segPath));
-  if (startMs === null) return "skipped";
-  const subtree = classify(startMs, durMs);
-  const resolved = resolveFinalizedSegment(outDir, entry.segPath, durMs, subtree);
-  if (!resolved) return "skipped";
-  const existing = await statSize(resolved.newAbs);
-  if (existing !== null) {
-    onSegment(resolved.startMs, resolved.durMs, existing, subtree);
-    return "retained";
-  }
-  if (await statSize(resolved.oldAbs) === null) {
-    logger.debug?.("segment flat file not on disk yet — will retry", { meta: { path: resolved.oldAbs } });
-    return "pending";
-  }
-  try {
-    await promises.mkdir(path__default.dirname(resolved.newAbs), { recursive: true });
-    await promises.rename(resolved.oldAbs, resolved.newAbs);
-  } catch {
-    logger.debug?.("segment relocate failed", { meta: { from: resolved.oldAbs, to: resolved.newAbs } });
-  }
-  const bytes = await statSize(resolved.newAbs);
-  if (bytes === null) return "pending";
-  onSegment(resolved.startMs, resolved.durMs, bytes, subtree);
-  return "retained";
+/**
+* Process ONE finalized playlist entry: verify the flat file is on disk and, if
+* so, hand it to `onFinalized` (the v2 SegmentStore stats + relocates + indexes
+* it). Returns:
+*   - `'retained'` — the flat file is on disk and was handed off;
+*   - `'skipped'`  — not a relocatable epoch-named segment (caller advances past it);
+*   - `'pending'`  — a valid segment whose flat file has NOT landed on disk yet.
+*      ffmpeg's first segment is slow to flush, so the caller must RETRY this
+*      entry on a later tick instead of orphaning it.
+*
+* Unlike the old recorder, this watcher does NOT relocate or re-stat: the
+* SegmentStore owns the move + the authoritative byte count.
+*/
+async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger) {
+	const flatAbsPath = path.isAbsolute(entry.segPath) ? entry.segPath : path.join(outDir, entry.segPath);
+	const startMs = parseEpochStartMs(flatAbsPath);
+	if (startMs === null) return "skipped";
+	if (await statSize(flatAbsPath) === null) {
+		logger.debug("segment flat file not on disk yet — will retry", { meta: { path: flatAbsPath } });
+		return "pending";
+	}
+	onFinalized(startMs, durMs, flatAbsPath);
+	return "retained";
 }
+/**
+* Decide which playlist entries are FINALIZABLE this tick and their corrected
+* durations, given the previously-processed high-water mark. Pure (no I/O) so
+* the tick loop is just: read file → plan → hand each off → advance mark.
+*
+* The live tail entry is held back while recording continues: a segment's true
+* duration needs its SUCCESSOR's start (ffmpeg's first-segment EXTINF is
+* inflated by the initial PTS offset). Once `#EXT-X-ENDLIST` appears the tail
+* is flushed too — by then it is never the unreliable first segment.
+*/
 function planFinalizations(body, processed) {
-  const entries = parseLivePlaylist(body);
-  const endlist = body.includes("#EXT-X-ENDLIST");
-  const hw = entries.length < processed ? 0 : processed;
-  const finalizable = endlist ? entries.length : Math.max(0, entries.length - 1);
-  const toHandle = [];
-  for (let i = hw; i < finalizable; i++) {
-    const entry = entries[i];
-    const startMs = parseEpochStartMs(entry.segPath);
-    const nextStartMs = i + 1 < entries.length ? parseEpochStartMs(entries[i + 1].segPath) : null;
-    const durMs = startMs === null ? Math.round(entry.durSeconds * 1e3) : correctedDurMs(entry.durSeconds, startMs, nextStartMs);
-    toHandle.push({ entry, durMs });
-  }
-  return { toHandle, from: hw, processed: Math.max(hw, finalizable) };
+	const entries = parseLivePlaylist(body);
+	const endlist = body.includes("#EXT-X-ENDLIST");
+	const hw = entries.length < processed ? 0 : processed;
+	const finalizable = endlist ? entries.length : Math.max(0, entries.length - 1);
+	const toHandle = [];
+	for (let i = hw; i < finalizable; i++) {
+		const entry = entries[i];
+		const startMs = parseEpochStartMs(entry.segPath);
+		const nextStartMs = i + 1 < entries.length ? parseEpochStartMs(entries[i + 1].segPath) : null;
+		const durMs = startMs === null ? Math.round(entry.durSeconds * 1e3) : correctedDurMs(entry.durSeconds, startMs, nextStartMs);
+		toHandle.push({
+			entry,
+			durMs
+		});
+	}
+	return {
+		toHandle,
+		from: hw,
+		processed: Math.max(hw, finalizable)
+	};
 }
+/**
+* Start polling `<outDir>/live.m3u8`. Returns a handle whose `stop()`
+* cancels the timer. Errors during a tick are swallowed (logged at debug)
+* — a transient read race self-corrects on the next interval.
+*/
 function startSegmentWatcher(deps) {
-  const playlistPath = path__default.join(deps.outDir, "live.m3u8");
-  let processed = 0;
-  let stopped = false;
-  let ticking = false;
-  let pendingIndex = -1;
-  let pendingTicks = 0;
-  const tick = async () => {
-    if (stopped || ticking) return;
-    ticking = true;
-    try {
-      let body;
-      try {
-        body = await promises.readFile(playlistPath, "utf8");
-      } catch {
-        return;
-      }
-      const plan = planFinalizations(body, processed);
-      let index = plan.from;
-      for (const { entry, durMs } of plan.toHandle) {
-        const status = await handleSegmentEntry(deps.outDir, entry, durMs, deps.classify, deps.onSegment, deps.logger);
-        if (status === "pending") {
-          if (pendingIndex === index) {
-            pendingTicks++;
-            if (pendingTicks >= MAX_PENDING_TICKS) {
-              deps.logger.warn("segment file never landed — skipping", { meta: { seg: entry.segPath } });
-              pendingIndex = -1;
-              pendingTicks = 0;
-              index++;
-              continue;
-            }
-          } else {
-            pendingIndex = index;
-            pendingTicks = 1;
-          }
-          break;
-        }
-        index++;
-      }
-      if (pendingIndex !== index) {
-        pendingIndex = -1;
-        pendingTicks = 0;
-      }
-      processed = index;
-    } finally {
-      ticking = false;
-    }
-  };
-  const timer = setInterval(() => {
-    void tick();
-  }, deps.intervalMs);
-  timer.unref?.();
-  return {
-    stop() {
-      stopped = true;
-      clearInterval(timer);
-    }
-  };
+	const playlistPath = path.join(deps.outDir, "live.m3u8");
+	let processed = 0;
+	let stopped = false;
+	let ticking = false;
+	let pendingIndex = -1;
+	let pendingTicks = 0;
+	const tick = async () => {
+		if (stopped || ticking) return;
+		ticking = true;
+		try {
+			let body;
+			try {
+				body = await promises.readFile(playlistPath, "utf8");
+			} catch {
+				return;
+			}
+			const plan = planFinalizations(body, processed);
+			let index = plan.from;
+			for (const { entry, durMs } of plan.toHandle) {
+				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger) === "pending") {
+					if (pendingIndex === index) {
+						pendingTicks++;
+						if (pendingTicks >= MAX_PENDING_TICKS) {
+							deps.logger.warn("segment file never landed — skipping", { meta: { seg: entry.segPath } });
+							pendingIndex = -1;
+							pendingTicks = 0;
+							index++;
+							continue;
+						}
+					} else {
+						pendingIndex = index;
+						pendingTicks = 1;
+					}
+					break;
+				}
+				index++;
+			}
+			if (pendingIndex !== index) {
+				pendingIndex = -1;
+				pendingTicks = 0;
+			}
+			processed = index;
+		} finally {
+			ticking = false;
+		}
+	};
+	const timer = setInterval(() => {
+		tick();
+	}, deps.intervalMs);
+	timer.unref?.();
+	return { stop() {
+		stopped = true;
+		clearInterval(timer);
+	} };
 }
-async function scanRecordings(rootDir, opts) {
-  const locationId = opts?.locationId;
-  const withSizes = opts?.withSizes ?? false;
-  let names;
-  try {
-    names = await promises.readdir(rootDir, { recursive: true });
-  } catch {
-    return [];
-  }
-  const entries = [];
-  for (const name of names) {
-    const rel = name.split(path__default.sep).join("/");
-    if (!parseSegmentRelPath(rel)) continue;
-    if (withSizes) {
-      let st;
-      try {
-        st = await promises.stat(path__default.join(rootDir, name));
-      } catch {
-        continue;
-      }
-      entries.push({ relPath: rel, bytes: st.size, locationId });
-    } else {
-      entries.push({ relPath: rel, bytes: 0, locationId });
-    }
-  }
-  return entries;
+//#endregion
+//#region src/recorder/addon/readiness-restore.ts
+var ReadinessRestore = class {
+	deps;
+	pending = /* @__PURE__ */ new Map();
+	draining = false;
+	rerun = false;
+	unsub = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Seed the pending set, subscribe to readiness, and drain once immediately
+	*  (covers the already-ready case). Returns when the first drain settles. */
+	async start(items) {
+		for (const [k, v] of items) this.pending.set(k, v);
+		if (this.unsub === null) this.unsub = this.deps.subscribeReady(() => {
+			this.drain();
+		});
+		await this.drain();
+	}
+	/** Add (or replace) one pending item without re-subscribing. Does NOT drain. */
+	add(key, value) {
+		this.pending.set(key, value);
+	}
+	/** Remove one pending item (e.g. the camera was disabled before it attached). */
+	remove(key) {
+		this.pending.delete(key);
+	}
+	/** Unsubscribe from readiness. Call on shutdown. */
+	stop() {
+		this.unsub?.();
+		this.unsub = null;
+		this.pending.clear();
+	}
+	get pendingCount() {
+		return this.pending.size;
+	}
+	hasPending(key) {
+		return this.pending.has(key);
+	}
+	/** Attempt every still-pending item; repeat once if a readiness signal arrived
+	*  mid-flight. Re-entrant and self-coalescing. */
+	async drain() {
+		if (this.draining) {
+			this.rerun = true;
+			return;
+		}
+		if (this.pending.size === 0) return;
+		this.draining = true;
+		try {
+			do {
+				this.rerun = false;
+				for (const [key, value] of [...this.pending]) try {
+					await this.deps.attempt(key, value);
+					this.pending.delete(key);
+				} catch (err) {
+					this.deps.onDefer?.(key, value, err);
+				}
+			} while (this.rerun && this.pending.size > 0);
+		} finally {
+			this.draining = false;
+		}
+	}
+};
+//#endregion
+//#region src/recorder/band-engine.ts
+function toMin(hhmm) {
+	const [h, m] = hhmm.split(":");
+	return Number(h) * 60 + Number(m);
 }
-async function sizeRecordingsTree(rootDir) {
-  let names;
-  try {
-    names = await promises.readdir(rootDir, { recursive: true });
-  } catch {
-    return { perDevice: /* @__PURE__ */ new Map(), totalBytes: 0 };
-  }
-  const perDevice = /* @__PURE__ */ new Map();
-  let totalBytes = 0;
-  for (const name of names) {
-    const rel = name.split(path__default.sep).join("/");
-    const parsed = parseSegmentRelPath(rel);
-    if (!parsed) continue;
-    let size;
-    try {
-      size = (await promises.stat(path__default.join(rootDir, name))).size;
-    } catch {
-      continue;
-    }
-    perDevice.set(parsed.camera, (perDevice.get(parsed.camera) ?? 0) + size);
-    totalBytes += size;
-  }
-  return { perDevice, totalBytes };
+function bandActiveAt(band, date) {
+	const wd = date.getDay();
+	const prevWd = (wd + 6) % 7;
+	const t = date.getHours() * 60 + date.getMinutes();
+	const s = toMin(band.start);
+	const e = toMin(band.end);
+	const applies = (d) => band.days.length === 0 || band.days.includes(d);
+	if (s < e) return applies(wd) && t >= s && t < e;
+	if (s > e) return applies(wd) && t >= s || applies(prevWd) && t < e;
+	return applies(wd);
 }
-function mergeRootUsage(usages) {
-  const perDevice = /* @__PURE__ */ new Map();
-  let totalBytes = 0;
-  for (const u of usages) {
-    for (const [device, bytes] of u.perDevice) {
-      perDevice.set(device, (perDevice.get(device) ?? 0) + bytes);
-    }
-    totalBytes += u.totalBytes;
-  }
-  return { perDevice, totalBytes };
+function activeBandAt(config, date) {
+	return config.bands.find((b) => bandActiveAt(b, date)) ?? null;
 }
-const CONTAINER_BOXES = /* @__PURE__ */ new Set(["moov", "trak", "mdia", "minf", "stbl"]);
-const H264_CODINGS = /* @__PURE__ */ new Set(["avc1", "avc3"]);
-const HEVC_CODINGS = /* @__PURE__ */ new Set(["hvc1", "hev1"]);
-function readBoxHeader(buf, o) {
-  if (o + 8 > buf.length) return null;
-  let size = buf.readUInt32BE(o);
-  let headerSize = 8;
-  if (size === 1) {
-    if (o + 16 > buf.length) return null;
-    size = Number(buf.readBigUInt64BE(o + 8));
-    headerSize = 16;
-  }
-  const type = buf.toString("latin1", o + 4, o + 8);
-  if (size < headerSize) return null;
-  return { size, type, headerSize };
+//#endregion
+//#region src/recorder/addon/band-decision.ts
+/**
+* Is an `events` band's live demand window open at `atMs`? True iff a trigger
+* the band listens for fired within `postBufferSec` of now. `preBufferSec` is
+* deliberately NOT consulted here (see file header).
+*/
+function eventsBandDemanded(band, triggers, atMs) {
+	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
+	if (band.triggers?.motion && fresh(triggers.lastMotionMs)) return true;
+	if (band.triggers?.audioThresholdDbfs != null && fresh(triggers.lastAudioMs)) return true;
+	return false;
 }
-function findChild(buf, start, end, wanted) {
-  let o = start;
-  while (o + 8 <= end) {
-    const h = readBoxHeader(buf, o);
-    if (!h) return null;
-    if (h.type === wanted) return { contentStart: o + h.headerSize, end: Math.min(o + h.size, end) };
-    o += h.size;
-  }
-  return null;
+/**
+* Should recording (any mode) be active for this device at `at`? The live
+* attach/detach gate: enabled + a band covers `at` + that band demands now
+* (continuous always; events within `postBufferSec` of a qualifying trigger).
+*/
+function shouldRecordAt(config, triggers, at) {
+	if (!config.enabled) return false;
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return false;
+	const band = activeBandAt({ bands }, at);
+	if (!band) return false;
+	if (band.mode === "continuous") return true;
+	return eventsBandDemanded(band, triggers, at.getTime());
 }
-function avcCodecString(buf, avcCContentStart) {
-  const profile = buf.readUInt8(avcCContentStart + 1);
-  const compat = buf.readUInt8(avcCContentStart + 2);
-  const level = buf.readUInt8(avcCContentStart + 3);
-  const hex = (n) => n.toString(16).padStart(2, "0");
-  return `avc1.${hex(profile)}${hex(compat)}${hex(level)}`;
+/**
+* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
+* `events` band be KEPT (else discarded)? Kept iff it overlaps any qualifying
+* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]`.
+* This is where `preBufferSec` retroactively retains pre-trigger footage.
+*/
+function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
+	const preMs = (band.preBufferSec ?? 0) * 1e3;
+	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
+	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
+	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
+	return false;
 }
-function extractVideoCodecInfo(buf) {
-  let result = null;
-  const walk = (start, end) => {
-    let o = start;
-    while (o + 8 <= end && !result) {
-      const h = readBoxHeader(buf, o);
-      if (!h) return;
-      const boxEnd = Math.min(o + h.size, end);
-      if (CONTAINER_BOXES.has(h.type)) {
-        walk(o + h.headerSize, boxEnd);
-      } else if (h.type === "stsd") {
-        let p = o + h.headerSize + 8;
-        while (p + 8 <= boxEnd && !result) {
-          const e = readBoxHeader(buf, p);
-          if (!e) break;
-          const isH264 = H264_CODINGS.has(e.type);
-          const isHevc = HEVC_CODINGS.has(e.type);
-          if (isH264 || isHevc) {
-            const width = p + 34 <= boxEnd ? buf.readUInt16BE(p + 32) : 0;
-            const height = p + 36 <= boxEnd ? buf.readUInt16BE(p + 34) : 0;
-            let codec;
-            if (isH264) {
-              const avcC = findChild(buf, p + 8 + 78, Math.min(p + e.size, boxEnd), "avcC");
-              codec = avcC ? avcCodecString(buf, avcC.contentStart) : "avc1.640029";
-            } else {
-              codec = `${e.type}.1.6.L120.B0`;
-            }
-            result = { codec, width, height };
-          }
-          p += e.size;
-        }
-      }
-      o += h.size;
-    }
-  };
-  walk(0, buf.length);
-  return result;
+//#endregion
+//#region src/recorder/addon/recording-controller.ts
+/**
+* recorder recording controller — the B2 continuous-band write path.
+*
+* Owns, per (deviceId, profile), the lifecycle of:
+*   - a broker stream lease (`getStreamWithCodec`, released on detach),
+*   - an ffmpeg `SegmentWriter` (passthrough segmenter into a temp outDir),
+*   - a `live.m3u8` `SegmentWatcher` that hands each finalized flat segment to
+*     the v2 `SegmentStore.onFinalized` (stat + relocate + index).
+*
+* Per device it decides whether a CONTINUOUS band is active right now
+* (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
+* It re-evaluates on three triggers:
+*   1. `setDeviceConfig` (operator changed the bands / enable),
+*   2. a periodic tick (catches band boundaries crossed with no config change),
+*   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
+*
+* EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
+* trigger-gating. The enable intent is persisted in durable-state by the
+* config-store, so `restoreEnabledDevices` on boot re-attaches every device
+* whose persisted config records continuously now.
+*
+* Source acquisition rides the broker's single source dial: the controller
+* gates each broker call on the broker's readiness via the cached capability
+* handle (`useCapability(...).call(fn)`) — no bespoke retry/backoff, the
+* `ReadinessRegistry` is the single source of truth.
+*/
+var DEFAULT_WATCH_INTERVAL_MS = 2e3;
+/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
+var TICK_MS = 3e4;
+var RecordingController = class {
+	deps;
+	active = /* @__PURE__ */ new Map();
+	/** Latest qualifying trigger timestamps per device — drives `events`-band gating. */
+	triggers = /* @__PURE__ */ new Map();
+	restore = null;
+	tickTimer = null;
+	stopped = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	/**
+	* Boot restore: seed the readiness-gated queue with every persisted device and
+	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
+	* periodic tick. Idempotent — safe to call once after the index is hydrated.
+	*/
+	async start() {
+		if (this.stopped) return;
+		let ids;
+		try {
+			ids = await this.deps.enabledDeviceIds();
+		} catch (err) {
+			this.deps.logger.warn("recorder controller: reading persisted devices failed", { meta: { error: errMsg(err) } });
+			ids = [];
+		}
+		this.restore = new ReadinessRestore({
+			subscribeReady: (handler) => this.deps.onBrokerReady(handler),
+			attempt: async (deviceId) => {
+				await this.evaluateDevice(deviceId);
+			},
+			onDefer: (deviceId, _v, err) => this.deps.logger.warn("recorder controller: device evaluate deferred (retries on next broker ready)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			})
+		});
+		if (this.tickTimer === null) {
+			this.tickTimer = setInterval(() => {
+				this.tick();
+			}, TICK_MS);
+			this.tickTimer.unref?.();
+		}
+		await this.restore.start(ids.map((id) => [id, true]));
+	}
+	/** Re-evaluate every currently-tracked OR active device on the periodic tick. */
+	async tick() {
+		if (this.stopped) return;
+		const ids = new Set(this.active.keys());
+		let persisted = [];
+		try {
+			persisted = await this.deps.enabledDeviceIds();
+		} catch {}
+		for (const id of persisted) ids.add(id);
+		for (const id of ids) try {
+			await this.evaluateDevice(id);
+		} catch (err) {
+			this.deps.logger.warn("recorder controller: tick evaluate failed", {
+				tags: { deviceId: id },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+	/**
+	* Re-evaluate one device after a config change (called from `setDeviceConfig`).
+	* Failures propagate so the caller can surface them, but the persisted config
+	* has already been written by the time this runs.
+	*/
+	async onConfigChanged(deviceId) {
+		if (this.stopped) return;
+		await this.evaluateDevice(deviceId);
+	}
+	/**
+	* One profile's ffmpeg writer exhausted its bounded inner restarts and gave
+	* up. The device is still in `active` with a dead writer, so `evaluateDevice`
+	* would short-circuit at "already recording — converged" and never recover.
+	* Detach the WHOLE device (releases every broker lease + stops watchers, so the
+	* idle source can re-dial cleanly), then re-evaluate: if the band still demands
+	* recording, `evaluateDevice` re-queues + re-attaches a fresh writer set. If
+	* the broker is not ready, the re-attach throws and the device stays on the
+	* readiness queue (retried on the next broker ready) — and the periodic tick is
+	* the backstop. Bounded OUTER retry (TICK_MS cadence), never a tight loop.
+	*/
+	async recoverWriterGaveUp(deviceId) {
+		if (this.stopped) return;
+		this.deps.logger.warn("recorder: writer gave up — detaching + re-evaluating device", { tags: { deviceId } });
+		try {
+			await this.detachDevice(deviceId);
+			await this.evaluateDevice(deviceId);
+		} catch (err) {
+			this.restore?.add(deviceId, true);
+			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/tick)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+	/** Current trigger state for a device (cold default = no triggers seen). */
+	triggersFor(deviceId) {
+		return this.triggers.get(deviceId) ?? {
+			lastMotionMs: null,
+			lastAudioMs: null
+		};
+	}
+	/**
+	* Record a qualifying trigger (motion/audio) for a device and converge: an
+	* `events` band whose window this opens attaches now; the periodic tick
+	* detaches it once `postBufferSec` elapses. Called from the addon's
+	* EventCapture subscription. The qualification test (motion detected / audio
+	* over threshold) is done upstream — by the time we're here, it qualified.
+	*/
+	async onTrigger(deviceId, source, atMs) {
+		if (this.stopped) return;
+		const prev = this.triggersFor(deviceId);
+		this.triggers.set(deviceId, {
+			lastMotionMs: source === "motion" ? atMs : prev.lastMotionMs,
+			lastAudioMs: source === "audio" ? atMs : prev.lastAudioMs
+		});
+		await this.evaluateDevice(deviceId);
+	}
+	/**
+	* Decide-and-converge for one device: if its active band demands recording now
+	* (continuous always; events within `postBufferSec` of a trigger) and the
+	* device is enabled, ensure its writer set is running; otherwise stop it.
+	* Re-attaches via the readiness queue if the broker is not ready (the broker
+	* call throws → `ReadinessRestore.attempt` defers → retried on next ready).
+	*/
+	async evaluateDevice(deviceId) {
+		if (this.stopped) return;
+		const config = await this.deps.loadConfig(deviceId);
+		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+			await this.detachDevice(deviceId);
+			this.restore?.remove(deviceId);
+			return;
+		}
+		if (this.active.has(deviceId)) return;
+		this.restore?.add(deviceId, true);
+		const profiles = await this.resolveProfiles(deviceId, config.profiles);
+		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
+		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
+		const recordings = [];
+		try {
+			for (const profile of profiles) recordings.push(await this.attachProfile(deviceId, profile, segmentSeconds));
+		} catch (err) {
+			for (const r of recordings) await this.teardownProfile(deviceId, r);
+			throw err;
+		}
+		this.active.set(deviceId, recordings);
+		this.deps.logger.info("recorder pinned broker source(s) for recording", {
+			tags: { deviceId },
+			meta: {
+				profiles,
+				segmentSeconds,
+				pipelineKeys: recordings.map((r) => r.pipelineKey)
+			}
+		});
+	}
+	/**
+	* Pick which profiles to record. The broker enumerates assigned profile slots,
+	* deduped by physical source (`selectAssignedProfileSlots`) so the same camera
+	* encoder is never recorded twice. An operator `override` DISABLES the
+	* unselected profiles (assigned ∩ selection); a selection matching none of the
+	* assigned sources is ignored (record every assigned source — minimum of 1).
+	*/
+	async resolveProfiles(deviceId, override) {
+		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => this.deps.api.streamBroker.listAllProfileSlots.query()), deviceId).map((slot) => slot.profile);
+		if (!override || override.length === 0) return assigned;
+		const selected = assigned.filter((p) => override.includes(p));
+		return selected.length > 0 ? selected : assigned;
+	}
+	/**
+	* Attach one (device, profile): acquire the broker source, mkdir the temp
+	* outDir, spawn the SegmentWriter, and start the watcher that feeds finalized
+	* flat segments into `SegmentStore.onFinalized`.
+	*/
+	async attachProfile(deviceId, profile, segmentSeconds) {
+		const source = await this.deps.brokerCall(() => this.deps.api.streamBroker.getStreamWithCodec.mutate({
+			deviceId,
+			video: "copy",
+			audio: "aac",
+			profile,
+			...this.deps.consumerHostname !== void 0 ? { hostname: this.deps.consumerHostname } : {},
+			tag: `recorder:${deviceId}/${profile}`
+		}));
+		const outDir = path.join(this.deps.tmpRoot, String(deviceId), profile);
+		await promises.mkdir(outDir, { recursive: true });
+		const writer = new SegmentWriter({
+			rtspUrl: source.url,
+			outDir,
+			segmentSeconds
+		}, {
+			spawn: this.deps.spawn,
+			logger: this.deps.logger,
+			onGaveUp: () => {
+				this.recoverWriterGaveUp(deviceId);
+			}
+		});
+		writer.start();
+		const placement = this.resolvePlacement(profile);
+		return {
+			profile,
+			writer,
+			watcher: startSegmentWatcher({
+				outDir,
+				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
+				onFinalized: (startMs, durMs, flatAbsPath) => {
+					this.handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath);
+				},
+				logger: this.deps.logger
+			}),
+			pipelineKey: source.pipelineKey,
+			outDir
+		};
+	}
+	/**
+	* Index a finalized segment — unless it was recorded under an `events` band
+	* and falls OUTSIDE every trigger's `[trigger-preBufferSec, trigger+postBufferSec]`
+	* window, in which case it is discarded (deleted, never indexed). Continuous
+	* footage (or any segment with no active events band) is always indexed: the
+	* keep/discard gate touches `events`-mode segments only, so the continuous
+	* path is unchanged.
+	*/
+	async handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath) {
+		try {
+			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
+			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, this.triggersFor(deviceId))) {
+				await promises.unlink(flatAbsPath).catch(() => {});
+				return;
+			}
+			await this.deps.segmentStore.onFinalized({
+				deviceId,
+				profile,
+				locationId: placement.id,
+				locationRoot: placement.root,
+				flatAbsPath,
+				startMs,
+				durMs
+			});
+		} catch (err) {
+			this.deps.logger.warn("recorder: onFinalized failed", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+	/**
+	* Resolve the storage location a profile writes to: `low` → the recordingsLow
+	* location when present, every other profile → the recordings location. Falls
+	* back to the first resolved location when the preferred type is absent — both
+	* types resolve to the same path today, so the split is free-and-future-proof.
+	*/
+	resolvePlacement(profile) {
+		const locations = this.deps.locations();
+		if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
+		const preferLow = profile === "low";
+		return locations.find((l) => preferLow ? l.id === "recordingsLow" : l.id === "recordings") ?? locations[0];
+	}
+	/** Stop one profile's writer + watcher and release its broker lease. */
+	async teardownProfile(deviceId, r) {
+		try {
+			r.watcher.stop();
+		} catch {}
+		try {
+			r.writer.stop();
+		} catch {}
+		try {
+			await this.deps.api.streamBroker.releaseStreamWithCodec.mutate({ pipelineKey: r.pipelineKey });
+		} catch (err) {
+			this.deps.logger.warn("recorder: releaseStreamWithCodec failed", {
+				tags: { deviceId },
+				meta: {
+					profile: r.profile,
+					pipelineKey: r.pipelineKey,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+	/** Stop every profile recording for a device (no-op when not recording). */
+	async detachDevice(deviceId) {
+		const recordings = this.active.get(deviceId);
+		if (!recordings) return;
+		this.active.delete(deviceId);
+		for (const r of recordings) await this.teardownProfile(deviceId, r);
+		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
+			tags: { deviceId },
+			meta: { pipelineKeys: recordings.map((r) => r.pipelineKey) }
+		});
+	}
+	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
+	async stop() {
+		this.stopped = true;
+		if (this.tickTimer !== null) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = null;
+		}
+		this.restore?.stop();
+		this.restore = null;
+		for (const deviceId of [...this.active.keys()]) await this.detachDevice(deviceId);
+	}
+};
+/** Build a `stream-broker` readiness scope for one node. */
+function brokerScope(nodeId) {
+	return {
+		type: "node",
+		nodeId
+	};
 }
-const AttachCameraInputSchema = object({
-  deviceId: number().int().nonnegative(),
-  profiles: array(CamProfileSchema).optional(),
-  segmentSeconds: number().int().positive().optional(),
-  rules: array(RecordingRuleSchema).optional(),
-  retention: RecordingRetentionSchema.optional()
-});
-const AttachCameraResultSchema = object({
-  success: literal(true)
-});
-const DetachCameraInputSchema = object({
-  deviceId: number().int().nonnegative()
-});
-const DetachCameraResultSchema = object({
-  success: literal(true)
-});
-const SetPlacementInputSchema = object({
-  assignments: record(string(), array(string()))
-});
-const SetPlacementResultSchema = object({
-  success: literal(true)
-});
-const recorderActions = defineCustomActions({
-  attachCamera: customAction(AttachCameraInputSchema, AttachCameraResultSchema, { kind: "mutation" }),
-  detachCamera: customAction(DetachCameraInputSchema, DetachCameraResultSchema, { kind: "mutation" }),
-  setPlacement: customAction(SetPlacementInputSchema, SetPlacementResultSchema, { kind: "mutation" })
-});
-function configFromTarget(target) {
-  if (!target) return { enabled: false, rules: [] };
-  return {
-    enabled: target.enabled,
-    profiles: target.profiles,
-    segmentSeconds: target.segmentSeconds,
-    rules: target.rules ?? [],
-    retention: target.retention
-  };
+/** Default broker readiness gate timeout (ms) — matches the old recorder. */
+var BROKER_READY_TIMEOUT_MS = 1e4;
+/** Wrap a cached capability handle into the `brokerCall` gate the controller needs. */
+function makeBrokerCall(handle) {
+	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
-function targetFromConfig(config) {
-  return {
-    enabled: config.enabled,
-    profiles: config.profiles,
-    segmentSeconds: config.segmentSeconds,
-    rules: config.rules,
-    retention: config.retention
-  };
+//#endregion
+//#region src/recorder/addon/recording-hub-host.ts
+/**
+* Resolve the host a REMOTE recording node should use to dial the hub-only
+* stream-broker's restream port.
+*
+* The broker mints `127.0.0.1` restream URLs (hub-local). When the operator
+* designates an AGENT as the recording node, that agent's recorder must pull
+* from the hub, so it needs the hub's cluster-resolvable host. Resolution
+* order:
+*
+*   1. `override` — the `recordingHubHostname` global setting, when the
+*      operator set one explicitly (e.g. the auto-derived host isn't reachable
+*      for RTSP on the recording interface).
+*   2. `hubUrl` — derived from the agent's `CAMSTACK_HUB_URL` (the address it
+*      already uses to reach the hub). The RTSP restream port differs from the
+*      hub API port, but the HOST is the same — only the host is extracted.
+*
+* Returns `undefined` when neither yields a host (the caller logs and the pull
+* stays hub-local, which simply won't reach a remote node — never a crash).
+*
+* Pure: the env string is passed in (not read here) so it can be unit-tested.
+*/
+function resolveRecordingHubHostname(override, hubUrl) {
+	const trimmedOverride = override?.trim();
+	if (trimmedOverride !== void 0 && trimmedOverride.length > 0) return trimmedOverride;
+	return extractHost(hubUrl);
 }
-function resolveStorageBytes(input) {
-  const { indexBytes, hasRanges, statSize: statSize2 } = input;
-  if (indexBytes > 0) return indexBytes;
-  if (hasRanges) return statSize2;
-  return 0;
+/** Extract the bare host from a URL/authority string, scheme + port optional. */
+function extractHost(raw) {
+	const value = raw?.trim();
+	if (value === void 0 || value.length === 0) return void 0;
+	try {
+		const parsed = new URL(value);
+		if (parsed.hostname.length > 0) return parsed.hostname;
+	} catch {}
+	const authority = value.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "").split("/")[0] ?? "";
+	if (authority.startsWith("[")) {
+		const end = authority.indexOf("]");
+		if (end > 0) return authority.slice(0, end + 1);
+	}
+	const host = authority.split(":")[0] ?? "";
+	return host.length > 0 ? host : void 0;
 }
-const STAT_CACHE_TTL_MS = 3e4;
-const DEFAULT_CONFIG = {
-  segmentSeconds: 4,
-  watchIntervalMs: 2e3,
-  // Sane default so an attached camera can't fill the disk unbounded; the
-  // operator raises/lowers it via global addon settings (and, in P6, per
-  // device). Age-only by default — size cap is opt-in.
-  retentionMaxAgeDays: 14,
-  retentionMaxSizeGb: 0,
-  // 0 = inherit the global default; operator raises the event window for longer
-  // motion/audio-clip retention. Present in defaults so resolveConfig reads them.
-  continuousRetentionMaxAgeDays: 0,
-  continuousRetentionMaxSizeGb: 0,
-  eventRetentionMaxAgeDays: 0,
-  eventRetentionMaxSizeGb: 0,
-  retentionSweepIntervalMs: 15 * 6e4,
-  policySweepIntervalMs: 5e3,
-  playbackRescanIntervalMs: 5 * 6e4,
-  // Present in defaults so `BaseAddon.resolveConfig` reads it from the store
-  // (it only merges keys that exist in defaults). Seeded to the standard
-  // placement so a fresh install routes high/mid → recordings, low/scrub →
-  // recordingsLow automatically, without operator intervention.
-  recordingPlacement: { assignments: DEFAULT_RECORDING_PLACEMENT }
+//#endregion
+//#region src/recorder/addon/index.ts
+/**
+* recorder addon SHELL — recording + storage-evictable providers on the
+* unit-tested recorder core (`recorder/*.ts`).
+*
+* B1 scope (THIS file): the addon lifecycle + provider wiring with NO ffmpeg
+* and NO live recording. It resolves the `recordings` / `recordingsLow`
+* storage roots via the `storage` cap, hydrates the v2 `RecordingIndex` from
+* `storage.list` for every persisted-config device on boot, persists per-device
+* band config via durable-state, answers the `recording` cap reads from the
+* index, prunes footage via `selectEvictions` + `SegmentStore.evict`, and
+* mounts the v2 `StorageEvictableProvider` for disk-pressure eviction.
+*
+* DEFERRED to B2/B3 (search "B2/B3 HOOK" below for the exact insertion points):
+*   - ffmpeg `SegmentWriter` (per-profile passthrough segmenter)
+*   - segment watcher → `SegmentStore.onFinalized` (stat + relocate + index)
+*   - `BandEngine` attach/detach on enable/disable (`activeBandAt`/`bandActiveAt`)
+*   - `EventCapture` (motion/audio markers feeding events-mode bands)
+*   - playback data-plane (getPlaybackManifest currently STUBs null)
+*
+* The old recorder (`addon-pipeline/src/recorder`) stays the live `recording`
+* provider until the controller swaps the manifest entry in a later step — this
+* file ships dormant (separate tree, not wired into the manifest yet).
+*/
+var DEFAULT_CONFIG = {
+	segmentSeconds: 4,
+	watchIntervalMs: 2e3
 };
-const PROFILE_BANDWIDTH = {
-  high: 4e6,
-  mid: 15e5,
-  low: 5e5
-};
-const DEFAULT_BANDWIDTH = 2e6;
-class RecorderAddon extends BaseAddon {
-  core = null;
-  nodeId = "hub";
-  dataDir = "";
-  /** Storage location recordings are written to (the managed `recordings`
-   *  location). `undefined` = legacy addon-local fallback (storage cap down). */
-  recordingLocationId = void 0;
-  /** Resolved placement: profile/track → location ids. NO fallback — an
-   *  unassigned profile fails to record, explicitly. */
-  placement = { assignments: {} };
-  /** Durable handle over the `recordingPlacement` addon-store key. Both the
-   *  boot load and `setPlacement` route through it so the WHOLE blob round-trips
-   *  (no hand-listed field can be dropped on save). Built in `onInitialize`. */
-  placementState = null;
-  /** Cache of locationId → absolute root path (via `storage.resolve`). */
-  locationRootCache = /* @__PURE__ */ new Map();
-  /** Cache of `${deviceId}/${profile}` → master-playlist codec/resolution,
-   *  probed once from a segment's moov (codec is stable per camera profile). */
-  profileCodecCache = /* @__PURE__ */ new Map();
-  /** GLOBAL write location chosen per profile/track. Cached so EVERY camera
-   *  records a given profile to the SAME location (assignment is global, not
-   *  per-camera). Reset on addon restart (re-config). */
-  profileWriteLocation = /* @__PURE__ */ new Map();
-  /** One watcher per (deviceId, profile). Keyed `${deviceId}/${profile}`. */
-  watchers = /* @__PURE__ */ new Map();
-  /** Periodic retention sweep; cleared on shutdown. */
-  retentionTimer = null;
-  /** Periodic modes-engine policy reaper (pre/post-buffer enforcement). */
-  policyTimer = null;
-  /** Playback HTTP data-plane (hub reverse-proxies to it); null until served. */
-  playbackDataPlane = null;
-  /** Periodic disk rescan rebuilding the playback index (past recordings). */
-  playbackRescanTimer = null;
-  /** In-memory mirror of persisted targets so the SYNC retention resolver can
-   *  read per-device overrides without I/O. Refreshed on attach/detach/setConfig
-   *  and boot-restore. */
-  deviceTargets = /* @__PURE__ */ new Map();
-  /** Short-lived stat-based byte counts keyed by deviceId — used ONLY in the
-   *  `getStatus` fallback path (index === 0 && footage exists). Entries expire
-   *  after {@link STAT_CACHE_TTL_MS} so repeated polls don't re-stat on every
-   *  call, yet the value stays reasonably fresh. */
-  statSizeCache = /* @__PURE__ */ new Map();
-  constructor() {
-    super({ ...DEFAULT_CONFIG });
-  }
-  async onInitialize() {
-    const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
-    this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
-    const loc = await this.resolveRecordingsLocation();
-    this.dataDir = loc.root;
-    this.recordingLocationId = loc.locationId;
-    if (loc.locationId) this.locationRootCache.set(loc.locationId, loc.root);
-    const fallbackAssignments = {};
-    for (const [key, ids] of Object.entries(this.config.recordingPlacement?.assignments ?? {})) {
-      fallbackAssignments[key] = [...ids];
-    }
-    this.placementState = this.state(
-      "recordingPlacement",
-      RecordingPlacementBlobSchema,
-      { assignments: fallbackAssignments }
-    );
-    const loadedPlacement = await this.placementState.get();
-    this.placement = { assignments: loadedPlacement.assignments ?? {} };
-    this.core = new RecorderCore({
-      dataDir: this.dataDir,
-      nodeId: this.nodeId,
-      acquireSource: (deviceId, profile) => this.acquireSource(deviceId, profile),
-      releaseSource: (pipelineKey) => this.releaseSource(pipelineKey),
-      makeWriter: (cfg) => {
-        mkdirSync(cfg.outDir, { recursive: true });
-        return new SegmentWriter(cfg, { spawn, logger: this.ctx.logger });
-      },
-      logger: this.ctx.logger
-    });
-    this.startRetentionTimer();
-    this.startPolicyTimer();
-    this.subscribeTriggers();
-    try {
-      const handler = createFileDataPlaneHandler({ getRoots: () => this.playbackRoots() });
-      this.playbackDataPlane = await this.ctx.dataPlane?.serve({ prefix: "playback", access: "admin", handler }) ?? null;
-      this.ctx.logger.info("recorder playback data-plane served", {
-        meta: { baseUrl: this.playbackDataPlane?.baseUrl ?? "(no dataPlane facility)" }
-      });
-    } catch (err) {
-      this.ctx.logger.warn("recorder playback data-plane failed to serve", { meta: { error: errMsg(err) } });
-    }
-    await this.rescanPlayback();
-    this.startPlaybackRescanTimer();
-    this.ctx.logger.info("recorder addon started", {
-      tags: { nodeId: this.nodeId },
-      meta: {
-        dataDir: this.dataDir,
-        segmentSeconds: this.config.segmentSeconds,
-        retentionMaxAgeDays: this.config.retentionMaxAgeDays,
-        retentionMaxSizeGb: this.config.retentionMaxSizeGb,
-        placement: this.placement
-      }
-    });
-    const provider = {
-      getStatus: async ({ deviceId }) => {
-        if (!this.core) return null;
-        const status = this.core.getStatus(deviceId);
-        const indexBytes = status.storageBytes;
-        if (indexBytes > 0) return status;
-        const availability = this.core.getAvailability(deviceId, 0, Date.now());
-        const hasRanges = availability.ranges.length > 0;
-        const statSize2 = await this.deviceStatSize(deviceId, hasRanges);
-        return { ...status, storageBytes: resolveStorageBytes({ indexBytes, hasRanges, statSize: statSize2 }) };
-      },
-      getAvailability: async ({ deviceId, fromMs, toMs }) => {
-        if (!this.core) return { deviceId, ranges: [] };
-        return this.core.getAvailability(deviceId, fromMs, toMs);
-      },
-      getPlaybackManifest: ({ deviceId, fromMs, toMs }) => this.buildPlaybackManifest(deviceId, fromMs, toMs),
-      getStorageUsage: () => this.buildStorageUsage(),
-      getDeviceConfig: async ({ deviceId }) => {
-        const settings = this.ctxIfReady?.settings;
-        const target = settings ? (await readRecordingTargets(settings)).get(deviceId) : void 0;
-        return configFromTarget(target);
-      },
-      rescanStorage: async ({ deviceId }) => {
-        const core = this.core;
-        if (!core) return {
-          deviceId,
-          enabled: false,
-          activeMode: "off",
-          nodeId: this.nodeId,
-          storageBytes: 0
-        };
-        core.rescanDevice(deviceId);
-        await this.seedIndexForDevice(core, deviceId);
-        this.statSizeCache.delete(deviceId);
-        const status = core.getStatus(deviceId);
-        const indexBytes = status.storageBytes;
-        if (indexBytes > 0) return status;
-        const availability = core.getAvailability(deviceId, 0, Date.now());
-        const hasRanges = availability.ranges.length > 0;
-        const statSize2 = await this.deviceStatSize(deviceId, hasRanges);
-        return { ...status, storageBytes: resolveStorageBytes({ indexBytes, hasRanges, statSize: statSize2 }) };
-      },
-      setDeviceConfig: async ({ deviceId, config }) => {
-        const next = targetFromConfig(config);
-        if (next.enabled) {
-          await this.attachCamera({ deviceId, profiles: next.profiles, segmentSeconds: next.segmentSeconds, rules: next.rules, retention: next.retention });
-        } else {
-          await this.detachCamera({ deviceId });
-          const disabledSettings = this.ctx.settings;
-          if (disabledSettings) {
-            await upsertRecordingTarget(disabledSettings, deviceId, next);
-          }
-        }
-        this.deviceTargets.set(deviceId, next);
-        return configFromTarget(next);
-      },
-      // Per-device recording settings surfaced in device-details (the system
-      // contributions pass consults this cap even though it isn't device-bound).
-      getDeviceSettingsContribution: (_input) => this.buildDeviceSettingsContribution(),
-      getDeviceLiveContribution: async () => null,
-      applyDeviceSettingsPatch: async ({ patch }) => {
-        const keys = Object.keys(patch ?? {});
-        if (keys.length > 0) {
-          this.ctx.logger.debug("recorder: ignoring legacy settings patch (widget owns settings)", { meta: { keys } });
-        }
-        return { success: true };
-      },
-      pruneFootage: async ({ deviceId }) => {
-        const core = this.core;
-        if (!core) return { floorMs: null, deletedBuckets: 0, reclaimedBytes: 0 };
-        return core.pruneFootageForDevice(
-          deviceId,
-          Date.now(),
-          (id, subtree) => this.resolveRetentionPolicy(id, subtree),
-          (relPath, locationId) => this.removeBucketDir(relPath, locationId)
-        );
-      }
-    };
-    const evictableProvider = {
-      getEvictableUsage: async ({ locationId }) => {
-        const core = this.core;
-        return { bytes: core ? core.evictableBytesOnLocation(locationId) : 0 };
-      },
-      evict: async ({ locationId, targetBytes }) => {
-        const core = this.core;
-        if (!core) return { reclaimedBytes: 0, exhausted: true };
-        return core.evictBytesOnLocation(
-          locationId,
-          targetBytes,
-          (relPath, locId) => this.removeBucketDir(relPath, locId)
-        );
-      }
-    };
-    return {
-      providers: [
-        { capability: recordingCapability, provider },
-        { capability: storageEvictableCapability, provider: evictableProvider }
-      ],
-      customActions: recorderActions,
-      actionHandlers: {
-        attachCamera: async (input) => this.attachCamera(input),
-        detachCamera: async (input) => this.detachCamera(input),
-        setPlacement: async (input) => this.setPlacement(input)
-      }
-    };
-  }
-  async onShutdown() {
-    if (this.retentionTimer) {
-      clearInterval(this.retentionTimer);
-      this.retentionTimer = null;
-    }
-    if (this.policyTimer) {
-      clearInterval(this.policyTimer);
-      this.policyTimer = null;
-    }
-    if (this.playbackRescanTimer) {
-      clearInterval(this.playbackRescanTimer);
-      this.playbackRescanTimer = null;
-    }
-    for (const handle of this.watchers.values()) handle.stop();
-    this.watchers.clear();
-    await this.playbackDataPlane?.dispose();
-    this.playbackDataPlane = null;
-    await this.core?.detachAll();
-    this.core = null;
-  }
-  // ── Modes engine triggers ──────────────────────────────────────────────
-  /**
-   * Feed motion events into the policy engine. A `detected:true` transition for
-   * a camera records a motion trigger; `onMotion` rules then retain segments
-   * for their `postBufferSec`. Recording continuously-connected cameras get the
-   * event even though the recorder is a separate process (UDS event bridge).
-   * `onAudioThreshold` ingestion is deferred (audio analysis is stream-demand
-   * gated) — the policy schema already supports it.
-   */
-  subscribeTriggers() {
-    this.ctx.eventBus.subscribe({ category: EventCategory.MotionOnMotionChanged }, (event) => {
-      if (!event.data.detected) return;
-      this.core?.recordTrigger(event.data.deviceId, "motion", event.data.timestamp);
-    });
-    this.ctx.eventBus.subscribe({ category: EventCategory.PipelineAudioInferenceResult }, (event) => {
-      const dbfs = event.data.frame.level?.dbfs;
-      if (dbfs == null) return;
-      this.core?.onAudioLevel(event.data.deviceId, dbfs, event.data.frame.timestamp);
-    });
-  }
-  // ── Modes engine policy reaper (pre/post-buffer enforcement) ────────────
-  startPolicyTimer() {
-    const timer = setInterval(() => void this.sweepPolicy(), this.config.policySweepIntervalMs);
-    timer.unref?.();
-    this.policyTimer = timer;
-  }
-  /** Run one policy sweep: retain triggered segments, reap expired-untriggered. */
-  async sweepPolicy() {
-    const core = this.core;
-    if (!core) return;
-    try {
-      await core.sweepPolicy(
-        localClock,
-        Date.now(),
-        (deviceId, profile, startMs, durMs, locationId, subtree) => this.deleteSegmentFile(deviceId, profile, startMs, durMs, locationId, subtree)
-      );
-    } catch (err) {
-      this.ctx.logger.warn("recorder policy sweep failed", { meta: { error: errMsg(err) } });
-    }
-  }
-  /** Delete one relocated segment file under its storage location's root, in the
-   *  subtree it was written to. */
-  async deleteSegmentFile(deviceId, profile, startMs, durMs, locationId, subtree) {
-    const root = await this.locationRootOrDefault(locationId);
-    const abs = path__default.resolve(root, segmentRelPath(String(deviceId), profile, subtree, startMs, durMs));
-    await promises.rm(abs, { force: true });
-  }
-  // ── Retention ──────────────────────────────────────────────────────────
-  startRetentionTimer() {
-    const intervalMs = this.config.retentionSweepIntervalMs;
-    const timer = setInterval(() => void this.sweepRetention(), intervalMs);
-    timer.unref?.();
-    this.retentionTimer = timer;
-  }
-  /** Run one retention sweep across every attached camera, then enforce the
-   *  disk-pressure free-space guard across every device. */
-  async sweepRetention() {
-    const core = this.core;
-    if (!core) return;
-    const nowMs = Date.now();
-    for (const deviceId of core.attachedDevices()) {
-      try {
-        await pruneDeviceWithEvents(
-          core,
-          deviceId,
-          nowMs,
-          (id, subtree) => this.resolveRetentionPolicy(id, subtree),
-          (relPath, locationId) => this.removeBucketDir(relPath, locationId),
-          this.ctx.api,
-          this.ctx.logger
-        );
-      } catch (err) {
-        this.ctx.logger.warn("recorder retention sweep failed for device", { tags: { deviceId }, meta: { error: errMsg(err) } });
-      }
-    }
-  }
-  /** Available + total bytes on a volume (`statfs`); null when unstattable. */
-  async rootCapacity(root) {
-    try {
-      const st = await promises.statfs(root);
-      return { availableBytes: st.bavail * st.bsize, totalBytes: st.blocks * st.bsize };
-    } catch {
-      return null;
-    }
-  }
-  // ── Storage-usage report (stat-based, on-demand) ───────────────────────
-  /**
-   * Accurate recordings storage usage for this node: global total + per-camera
-   * (summed over every profile/subtree/location) + per-location used/available.
-   * Stat-based so detached cameras count correctly (the playback index is
-   * name-only). Includes the read-only legacy root (locationId null) in the
-   * totals + per-camera, but never as a guarded managed location.
-   */
-  async buildStorageUsage() {
-    const managed = await this.listRecordingsLocations();
-    const roots = managed.map((l) => ({ id: l.id ?? null, root: l.root }));
-    const sized = await Promise.all(
-      roots.map(async (r) => ({ ...r, usage: await sizeRecordingsTree(r.root) }))
-    );
-    const merged = mergeRootUsage(sized.map((s) => s.usage));
-    const devices = [...merged.perDevice].map(([camera, usedBytes]) => ({ deviceId: Number(camera), usedBytes })).filter((d) => Number.isFinite(d.deviceId)).sort((a, b) => b.usedBytes - a.usedBytes);
-    const locations = await Promise.all(
-      sized.map(async (s) => {
-        const cap = await this.rootCapacity(s.root);
-        return {
-          locationId: s.id,
-          usedBytes: s.usage.totalBytes,
-          availableBytes: cap?.availableBytes ?? null,
-          totalBytes: cap?.totalBytes ?? null
-        };
-      })
-    );
-    return { nodeId: this.nodeId, totalUsedBytes: merged.totalBytes, devices, locations };
-  }
-  /**
-   * Stat the on-disk tree for a single device and return its total bytes.
-   * Uses a short-lived cache ({@link STAT_CACHE_TTL_MS}) so repeated `getStatus`
-   * polls on the zero-index fallback path don't re-stat on every call.
-   *
-   * Called ONLY when `indexBytes === 0 && hasRanges` — not on the common
-   * non-zero path, so disk I/O cost is limited to the edge case.
-   *
-   * @param deviceId   The device to size.
-   * @param hasRanges  If false the call is skipped and 0 is returned immediately.
-   */
-  async deviceStatSize(deviceId, hasRanges) {
-    if (!hasRanges) return 0;
-    const now = Date.now();
-    const cached = this.statSizeCache.get(deviceId);
-    if (cached && now < cached.expiresAt) return cached.bytes;
-    const roots = this.playbackRoots();
-    const key = String(deviceId);
-    let total = 0;
-    for (const root of roots) {
-      const usage = await sizeRecordingsTree(root);
-      total += usage.perDevice.get(key) ?? 0;
-    }
-    this.statSizeCache.set(deviceId, { bytes: total, expiresAt: now + STAT_CACHE_TTL_MS });
-    return total;
-  }
-  /**
-   * Resolve the retention policy for a device's `continuous` vs `events`
-   * subtree: the per-subtree override (`> 0`) wins, else the global default.
-   * P2: global addon config only (per-device override arrives with the
-   * per-device settings UI in P6 — `deviceId` is already threaded for that swap).
-   */
-  resolveRetentionPolicy(deviceId, subtree) {
-    const c = this.config;
-    const pick = (ovr, base) => ovr > 0 ? ovr : base;
-    const defaultAgeDays = subtree === "events" ? pick(c.eventRetentionMaxAgeDays, c.retentionMaxAgeDays) : pick(c.continuousRetentionMaxAgeDays, c.retentionMaxAgeDays);
-    const defaultSizeGb = subtree === "events" ? pick(c.eventRetentionMaxSizeGb, c.retentionMaxSizeGb) : pick(c.continuousRetentionMaxSizeGb, c.retentionMaxSizeGb);
-    const override = this.deviceTargets.get(deviceId)?.retention;
-    return resolveDeviceRetention(override, defaultAgeDays, defaultSizeGb);
-  }
-  /**
-   * `rm -rf` one hour-bucket directory under its storage location's root.
-   * `relPath` originates from our own RAM index
-   * (`<deviceId>/<profile>/<Y>/<M>/<D>/<H>`) and `locationId` is the location it
-   * lives on; resolve against that location's root and refuse anything that
-   * escapes it as a defense-in-depth guard.
-   */
-  async removeBucketDir(relPath, locationId) {
-    const root = path__default.resolve(await this.locationRootOrDefault(locationId));
-    const abs = path__default.resolve(root, relPath);
-    if (abs !== root && !abs.startsWith(root + path__default.sep)) {
-      throw new Error(`recorder retention: refusing to rm outside location root: ${relPath}`);
-    }
-    await promises.rm(abs, { recursive: true, force: true });
-  }
-  // ── Custom actions ────────────────────────────────────────────────────
-  async attachCamera(input) {
-    const core = this.core;
-    if (!core) throw new Error("RecorderAddon: attachCamera called before initialize completed");
-    const profiles = await this.resolveRecordingProfiles(input.deviceId, input.profiles);
-    if (profiles.length === 0) {
-      throw new Error(
-        `RecorderAddon.attachCamera: no assigned broker sources for device ${input.deviceId}`
-      );
-    }
-    const segmentSeconds = input.segmentSeconds ?? this.config.segmentSeconds;
-    const rules = input.rules ?? [];
-    this.stopWatchers(input.deviceId);
-    const placements = await this.resolveProfilePlacements(input.deviceId, profiles);
-    const outDirs = {};
-    for (const [profile, pl] of placements) outDirs[profile] = pl.outDir;
-    await core.attach({ deviceId: input.deviceId, profiles, segmentSeconds, rules, outDirs });
-    for (const profile of profiles) {
-      const pl = placements.get(profile);
-      const key = makeProfileBrokerId(input.deviceId, profile);
-      const handle = startSegmentWatcher({
-        outDir: pl.outDir,
-        intervalMs: this.config.watchIntervalMs,
-        // Classify each finalized segment into its continuous/events subtree
-        // (node-local clock) so the watcher relocates it into the right tree.
-        classify: (startMs, durMs) => this.core?.classifySubtree(input.deviceId, startMs + durMs, localClock(startMs + durMs)) ?? "continuous",
-        onSegment: (startMs, durMs, bytes, subtree) => {
-          const core2 = this.core;
-          if (!core2) return;
-          core2.onSegmentFinalized(input.deviceId, profile, startMs, durMs, bytes, pl.locationId, subtree);
-          if (core2.shouldRetainSegment(input.deviceId, startMs, startMs + durMs, localClock(startMs + durMs))) {
-            core2.markSegmentRetained(input.deviceId, profile, startMs);
-          }
-        },
-        logger: this.ctx.logger
-      });
-      this.watchers.set(key, handle);
-    }
-    await this.persistTarget(input);
-    this.deviceTargets.set(input.deviceId, {
-      enabled: true,
-      profiles: input.profiles ? [...input.profiles] : void 0,
-      segmentSeconds: input.segmentSeconds,
-      rules: input.rules ? [...input.rules] : void 0,
-      retention: input.retention
-    });
-    await this.seedIndexForDevice(core, input.deviceId);
-    this.ctx.logger.info("recorder attachCamera", {
-      tags: { deviceId: input.deviceId },
-      meta: { profiles, segmentSeconds }
-    });
-    return { success: true };
-  }
-  /**
-   * Set the GLOBAL recording placement (profile/track → location ids). Persists
-   * to the addon store (so it survives restarts) and rebuilds `this.placement`
-   * + clears the per-profile location cache so the next attach re-resolves. The
-   * admin UI (and the live-verification path) call this.
-   */
-  async setPlacement(input) {
-    const assignments = {};
-    for (const [key, ids] of Object.entries(input.assignments ?? {})) assignments[key] = [...ids];
-    await this.placementState?.set({ assignments });
-    this.placement = { assignments: input.assignments ?? {} };
-    this.profileWriteLocation.clear();
-    this.ctx.logger.info("recorder placement updated", { meta: { assignments: input.assignments } });
-    return { success: true };
-  }
-  async detachCamera(input) {
-    await this.clearTarget(input.deviceId);
-    this.stopWatchers(input.deviceId);
-    await this.core?.detach(input.deviceId);
-    await this.rescanPlayback();
-    this.ctx.logger.info("recorder detachCamera", { tags: { deviceId: input.deviceId } });
-    return { success: true };
-  }
-  // ── Boot-time index seeding (sized scan per device) ──────────────────────
-  /**
-   * Scan every recordings location for this device's sub-tree (with sizes) and
-   * seed the live RAM index so `storageBytes` and size-retention reflect ALL
-   * on-disk footage, not just segments finalized since the last attach. Scoping
-   * the scan to `<root>/<deviceId>/` keeps it cheap on large volumes.
-   *
-   * Must be called after `core.attach(deviceId, …)` so the seed lands in the
-   * camera's live index (not a stale pre-attach sentinel). Best-effort: any
-   * per-location failure is warned and skipped.
-   */
-  async seedIndexForDevice(core, deviceId) {
-    let locations;
-    try {
-      locations = await this.listRecordingsLocations();
-    } catch (err) {
-      this.ctx.logger.warn("recorder seedIndex: could not list locations", {
-        tags: { deviceId },
-        meta: { error: errMsg(err) }
-      });
-      return;
-    }
-    const roots = [...locations];
-    const segments = [];
-    for (const loc of roots) {
-      const deviceRoot = path__default.join(loc.root, String(deviceId));
-      try {
-        const entries = await scanRecordings(deviceRoot, { locationId: loc.id, withSizes: true });
-        for (const e of entries) {
-          const fullRelPath = `${deviceId}/${e.relPath}`;
-          const parsed = parseSegmentRelPath(fullRelPath);
-          if (!parsed) continue;
-          segments.push({
-            profile: parsed.profile,
-            startMs: parsed.startMs,
-            durMs: parsed.durMs,
-            bytes: e.bytes,
-            locationId: e.locationId,
-            subtree: parsed.subtree
-          });
-        }
-      } catch (err) {
-        this.ctx.logger.warn("recorder seedIndex: scan failed for location", {
-          tags: { deviceId },
-          meta: { locationId: loc.id, error: errMsg(err) }
-        });
-      }
-    }
-    if (segments.length === 0) return;
-    core.seedIndexFromScan(deviceId, segments);
-    this.ctx.logger.info("recorder seedIndex: seeded from disk scan", {
-      tags: { deviceId },
-      meta: { segmentCount: segments.length }
-    });
-  }
-  // ── Playback index (past recordings via disk scan) ──────────────────────
-  startPlaybackRescanTimer() {
-    const timer = setInterval(() => void this.rescanPlayback(), this.config.playbackRescanIntervalMs);
-    timer.unref?.();
-    this.playbackRescanTimer = timer;
-  }
-  /** Rebuild the playback index from a shallow disk scan of EVERY recordings
-   *  storage location plus the read-only legacy root, stamping each segment with
-   *  the location it came from. */
-  async rescanPlayback() {
-    const core = this.core;
-    if (!core) return;
-    try {
-      const locations = await this.listRecordingsLocations();
-      const scanRoots = [...locations];
-      const scanned = await Promise.all(scanRoots.map((l) => scanRecordings(l.root, { locationId: l.id })));
-      core.setPlaybackIndex(scanned.flat());
-    } catch (err) {
-      this.ctx.logger.warn("recorder playback rescan failed", { meta: { error: errMsg(err) } });
-    }
-  }
-  /** All recordings storage locations (every `recordings*` type) as
-   *  `{ id, root }`, resolving (and caching) each root. Falls back to the
-   *  single default root when the storage cap is unreachable. */
-  async listRecordingsLocations() {
-    try {
-      const locs = await this.ctx.api.storage.listLocations.query({});
-      const recordings = locs.filter((l) => l.type === "recordings" || l.type === "recordingsLow");
-      if (recordings.length > 0) {
-        return Promise.all(recordings.map(async (l) => ({ id: l.id, root: await this.resolveLocationRoot(l.id) })));
-      }
-    } catch (err) {
-      this.ctx.logger.warn("recorder: listLocations failed — scanning default root only", { meta: { error: errMsg(err) } });
-    }
-    return [{ id: this.recordingLocationId, root: this.dataDir }];
-  }
-  /**
-   * Resolve the recordings write root via the `storage` cap (the default
-   * `recordings` location). Falls back to the addon-local data dir with no
-   * locationId when the storage cap is unreachable at boot, so recording still
-   * works degraded rather than not at all.
-   */
-  async resolveRecordingsLocation() {
-    try {
-      const def = await this.ctx.api.storage.getDefaultLocation.query({ type: "recordings" });
-      if (def) {
-        const root = await this.ctx.api.storage.resolve.query({ location: def.id, relativePath: "" });
-        return { root, locationId: def.id };
-      }
-      this.ctx.logger.warn("recorder: no default recordings storage location — using addon data dir");
-    } catch (err) {
-      this.ctx.logger.warn("recorder: storage cap unreachable — using addon data dir", { meta: { error: errMsg(err) } });
-    }
-    return { root: path__default.join(this.ctx.dataDir, "recordings"), locationId: void 0 };
-  }
-  /** Distinct recordings roots the playback server searches: the default
-   *  location root plus every location root we've resolved (write or scan). */
-  playbackRoots() {
-    return [.../* @__PURE__ */ new Set([this.dataDir, ...this.locationRootCache.values()])];
-  }
-  /** Absolute root of a storage location (cached `storage.resolve(id, '')`). */
-  async resolveLocationRoot(locationId) {
-    const cached = this.locationRootCache.get(locationId);
-    if (cached) return cached;
-    const root = await this.ctx.api.storage.resolve.query({ location: locationId, relativePath: "" });
-    this.locationRootCache.set(locationId, root);
-    return root;
-  }
-  /** A location's absolute root, or the default recordings root when the id is
-   *  absent (legacy) or unresolvable. */
-  async locationRootOrDefault(locationId) {
-    if (!locationId) return this.dataDir;
-    try {
-      return await this.resolveLocationRoot(locationId);
-    } catch {
-      return this.dataDir;
-    }
-  }
-  /** Free bytes available on a location's volume (`statfs`); null on failure. */
-  async locationFreeBytes(locationId) {
-    try {
-      const st = await promises.statfs(await this.resolveLocationRoot(locationId));
-      return st.bavail * st.bsize;
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * The GLOBAL write location for a profile/track — camera-independent, so all
-   * cameras record that profile to the SAME location. The placement-assigned
-   * location(s) are chosen by free space (least-full wins) ONCE and cached.
-   * Returns `null` when the profile is UNASSIGNED — there is no fallback; the
-   * caller must fail the recording explicitly. (Free-space-driven switching
-   * when a disk fills is part of the deferred multi-location structure rework.)
-   */
-  async resolveGlobalProfileLocation(profile) {
-    const cached = this.profileWriteLocation.get(profile);
-    if (cached) return cached;
-    const ids = resolveAssignedLocations(this.placement, profile);
-    if (ids.length === 0) return null;
-    const free = await Promise.all(
-      ids.map(async (id) => ({ locationId: id, availableBytes: await this.locationFreeBytes(id) }))
-    );
-    const chosen = chooseWriteLocation(ids, free);
-    if (chosen === null) return null;
-    const choice = { locationId: chosen, root: await this.resolveLocationRoot(chosen) };
-    this.profileWriteLocation.set(profile, choice);
-    return choice;
-  }
-  /**
-   * Resolve where each profile's segments are written for this camera: the
-   * global per-profile location's root + `<deviceId>/<profile>`. THROWS a clear
-   * error when any profile has no assigned storage location — recording must
-   * fail explicitly rather than write somewhere unintended.
-   */
-  async resolveProfilePlacements(deviceId, profiles) {
-    const out = /* @__PURE__ */ new Map();
-    const unassigned = [];
-    for (const profile of profiles) {
-      const choice = await this.resolveGlobalProfileLocation(profile);
-      if (choice === null) {
-        unassigned.push(profile);
-        continue;
-      }
-      out.set(profile, { outDir: path__default.join(choice.root, String(deviceId), profile), locationId: choice.locationId });
-    }
-    if (unassigned.length > 0) {
-      throw new Error(
-        `recorder: no storage location assigned for profile(s) [${unassigned.join(", ")}] — assign one in recording settings before enabling recording`
-      );
-    }
-    return out;
-  }
-  // ── Per-device settings (device-details recording widget) ─────────────
-  /** Build the device-details recording contribution: the widget section only. */
-  async buildDeviceSettingsContribution() {
-    if (!this.ctxIfReady?.settings) return null;
-    return hydrateSchema(buildRecordingDeviceSchema(), {});
-  }
-  // ── Durable enable (persisted recording targets) ───────────────────────
-  /** Best-effort persist of one camera's recording intent. */
-  async persistTarget(input) {
-    const settings = this.ctx.settings;
-    if (!settings) return;
-    try {
-      await upsertRecordingTarget(settings, input.deviceId, {
-        enabled: true,
-        profiles: input.profiles ? [...input.profiles] : void 0,
-        segmentSeconds: input.segmentSeconds,
-        rules: input.rules ? [...input.rules] : void 0,
-        retention: input.retention
-      });
-    } catch (err) {
-      this.ctx.logger.warn("recorder persist target failed", {
-        meta: { deviceId: input.deviceId, error: errMsg(err) }
-      });
-    }
-  }
-  /** Best-effort removal of one camera's persisted recording intent. */
-  async clearTarget(deviceId) {
-    const settings = this.ctx.settings;
-    if (!settings) return;
-    try {
-      await removeRecordingTarget(settings, deviceId);
-    } catch (err) {
-      this.ctx.logger.warn("recorder clear target failed", { meta: { deviceId, error: errMsg(err) } });
-    }
-  }
-  /**
-   * Re-attach every persisted enabled camera once the hub is reachable
-   * (`ctx.api.*` is safe here, not in `onInitialize`). Per-device failures —
-   * a camera that's offline at boot — are logged and kept (they resume on the
-   * next attach), never aborting the rest of the restore.
-   */
-  async onHubReachable() {
-    const settings = this.ctx.settings;
-    if (!settings) return;
-    const targets = await readRecordingTargets(settings);
-    const enabled = [...targets].filter(([, t]) => t.enabled);
-    if (enabled.length === 0) return;
-    try {
-      await this.ctx.acquireCapability("stream-broker", { type: "node", nodeId: this.nodeId }, { timeoutMs: 6e4 });
-    } catch (err) {
-      this.ctx.logger.warn("recorder restore: stream-broker not ready in time, attempting anyway", {
-        meta: { error: errMsg(err) }
-      });
-    }
-    this.ctx.logger.info("recorder restoring recording targets", { meta: { count: enabled.length } });
-    for (const [deviceId, target] of enabled) {
-      this.deviceTargets.set(deviceId, target);
-      try {
-        await this.attachCamera({ deviceId, profiles: target.profiles, segmentSeconds: target.segmentSeconds, rules: target.rules, retention: target.retention });
-      } catch (err) {
-        this.ctx.logger.warn("recorder restore attach failed", {
-          tags: { deviceId },
-          meta: { error: errMsg(err) }
-        });
-      }
-    }
-  }
-  stopWatchers(deviceId) {
-    const prefix = `${deviceId}/`;
-    for (const [key, handle] of [...this.watchers]) {
-      if (!key.startsWith(prefix)) continue;
-      handle.stop();
-      this.watchers.delete(key);
-    }
-  }
-  // ── Source resolution (broker single-dial) ─────────────────────────────
-  /**
-   * Pick which profiles to record for a device. The recorder enumerates the
-   * broker's ASSIGNED profile slots, deduped by physical source
-   * (`selectAssignedProfileSlots`) so the same camera encoder is never recorded
-   * twice. An operator `override` (the per-device "Profiles" multiselect)
-   * DISABLES the unselected profiles: the result is the assigned set INTERSECTED
-   * with the selection. Per the spec, recording keeps a MINIMUM OF 1 — if the
-   * selection matches none of the assigned sources (stale pick / wrong camera),
-   * it's ignored and every assigned profile is recorded. Empty/absent override =
-   * record every assigned source.
-   */
-  async resolveRecordingProfiles(deviceId, override) {
-    const api = this.ctx.api;
-    if (!api) throw new Error(`RecorderAddon.resolveRecordingProfiles: ctx.api unavailable (device ${deviceId})`);
-    const slots = await api.streamBroker.listAllProfileSlots.query();
-    const assigned = selectAssignedProfileSlots(slots, deviceId).map((slot) => slot.profile);
-    if (!override || override.length === 0) return assigned;
-    const selected = assigned.filter((p) => override.includes(p));
-    return selected.length > 0 ? selected : assigned;
-  }
-  /**
-   * Acquire a demand-counted broker stream for one (deviceId, profile) via
-   * `getStreamWithCodec` (passthrough — `video:'copy'`). The returned
-   * `pipelineKey` is released on detach, so the recorder rides the broker's
-   * single source dial instead of opening a second camera connection.
-   */
-  async acquireSource(deviceId, profile) {
-    const api = this.ctx.api;
-    if (!api) throw new Error(`RecorderAddon.acquireSource: ctx.api unavailable (device ${deviceId})`);
-    const source = await api.streamBroker.getStreamWithCodec.mutate({
-      deviceId,
-      video: "copy",
-      audio: "aac",
-      profile,
-      tag: `recorder:${deviceId}/${profile}`
-    });
-    return { url: source.url, pipelineKey: source.pipelineKey };
-  }
-  async releaseSource(pipelineKey) {
-    const api = this.ctx.api;
-    if (!api) return;
-    try {
-      await api.streamBroker.releaseStreamWithCodec.mutate({ pipelineKey });
-    } catch (err) {
-      this.ctx.logger.warn("releaseStreamWithCodec failed", {
-        meta: { pipelineKey, error: errMsg(err) }
-      });
-    }
-  }
-  // ── Playback manifest ─────────────────────────────────────────────────
-  /**
-   * Build a master + per-profile variant playlist on disk for the
-   * requested window and return the local master path. Returns
-   * `localMasterPath: null` when the camera has no recorded segments in
-   * the range.
-   */
-  /**
-   * Probe a profile's video codec + resolution for the master playlist, reading
-   * only the head of one segment (the `moov` sits at the start) and caching per
-   * (device, profile) — the camera's encoding is stable. Returns null on any
-   * read/parse failure (the variant then ships without CODECS, as before).
-   */
-  async probeProfileCodec(deviceId, profile, segAbsPath) {
-    const key = `${deviceId}/${profile}`;
-    const cached = this.profileCodecCache.get(key);
-    if (cached) return cached;
-    try {
-      const fh = await promises.open(segAbsPath, "r");
-      try {
-        const buf = Buffer.alloc(65536);
-        const { bytesRead } = await fh.read(buf, 0, buf.length, 0);
-        const info = extractVideoCodecInfo(buf.subarray(0, bytesRead));
-        if (!info) return null;
-        const result = { codecs: info.codec, resolution: { width: info.width, height: info.height } };
-        this.profileCodecCache.set(key, result);
-        return result;
-      } finally {
-        await fh.close();
-      }
-    } catch {
-      return null;
-    }
-  }
-  async buildPlaybackManifest(deviceId, fromMs, toMs) {
-    const core = this.core;
-    if (!core) return { deviceId, localMasterPath: null, playbackUrl: null, playbackEndpoints: [] };
-    const profiles = core.getProfiles(deviceId);
-    const deviceDir = path__default.join(this.dataDir, String(deviceId));
-    const variants = [];
-    for (const profile of profiles) {
-      const segments = core.listSegments(deviceId, profile, fromMs, toMs);
-      if (segments.length === 0) continue;
-      const variantSegments = [];
-      let firstSegAbs = null;
-      for (const s of segments) {
-        const rel = segmentRelPath(String(deviceId), profile, s.subtree, s.startMs, s.durMs);
-        const segRoot = await this.locationRootOrDefault(s.locationId);
-        const segAbs = path__default.join(segRoot, rel);
-        try {
-          await promises.stat(segAbs);
-        } catch {
-          continue;
-        }
-        if (firstSegAbs === null) firstSegAbs = segAbs;
-        variantSegments.push({ uri: rel.split("/").slice(1).join("/"), startMs: s.startMs, durMs: s.durMs });
-      }
-      if (variantSegments.length === 0) continue;
-      const variantBody = buildVariantPlaylist(variantSegments);
-      const variantPath = path__default.join(deviceDir, `${profile}.m3u8`);
-      await promises.mkdir(deviceDir, { recursive: true });
-      await promises.writeFile(variantPath, variantBody, "utf8");
-      const codec = firstSegAbs ? await this.probeProfileCodec(deviceId, profile, firstSegAbs) : null;
-      variants.push({
-        profile,
-        bandwidth: PROFILE_BANDWIDTH[profile] ?? DEFAULT_BANDWIDTH,
-        uri: `${profile}.m3u8`,
-        ...codec ? { codecs: codec.codecs, resolution: codec.resolution } : {}
-      });
-    }
-    if (variants.length === 0) return { deviceId, localMasterPath: null, playbackUrl: null, playbackEndpoints: [] };
-    const masterPath = path__default.join(deviceDir, "master.m3u8");
-    await promises.mkdir(deviceDir, { recursive: true });
-    await promises.writeFile(masterPath, buildMasterPlaylist(variants), "utf8");
-    const playbackUrl = `/addon/recorder/playback/${deviceId}/master.m3u8?from=${fromMs}&to=${toMs}`;
-    return { deviceId, localMasterPath: masterPath, playbackUrl, playbackEndpoints: [playbackUrl] };
-  }
-}
-function localClock(ms) {
-  const d = new Date(ms);
-  return { weekday: d.getDay(), minutesOfDay: d.getHours() * 60 + d.getMinutes() };
-}
-export {
-  RecorderCore,
-  recorderActions as customActions,
-  RecorderAddon as default
+/** Playback-marker window padding around a motion event (EventMap only; the
+*  controller's events-band gating uses the raw trigger ms, not this pad). */
+var MARKER_PAD_PRE_MS = 2e3;
+var MARKER_PAD_POST_MS = 5e3;
+/** This addon's manifest id + the playback data-plane prefix — together they
+*  form the hub reverse-proxy client path `/addon/recorder/playback`. */
+var RECORDER_ADDON_ID = "recorder";
+var PLAYBACK_PREFIX = "playback";
+/** Default designated recording node (`recordingNodeId` global setting). The
+*  stream-broker is hub-only and recording is a single-node global function, so
+*  the hub is the safe default — mirrors pipeline-analytics' post-processing
+*  node gate. */
+var RECORDING_NODE_DEFAULT = "hub";
+/** Node the hub-only `stream-broker` runs on. Every recorder — on the hub or on
+*  a designated agent — gates on, and pulls from, THIS node's broker. */
+var BROKER_HOST_NODE_ID = "hub";
+var RecorderV2Addon = class extends BaseAddon {
+	nodeId = "hub";
+	/** True when THIS node is the designated recording node (`recordingNodeId`).
+	*  Every other node stays fully inert — registers no providers, serves no
+	*  playback, runs no controller. Resolved in `onInitialize`. */
+	isRecordingNode = true;
+	index = new RecordingIndex();
+	segmentStore = null;
+	/** Continuous + events band write-path controller (ffmpeg writers + watchers). */
+	controller = null;
+	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
+	eventMap = new EventMap();
+	/** Unsubscribe handle for the EventCapture motion subscription. */
+	eventUnsub = null;
+	/** Resolved recordings locations (id + root). Refreshed on boot + rescan. */
+	resolvedLocations = [];
+	/** Base URL of the playback HTTP data-plane, null until served in onHubReachable. */
+	playbackBaseUrl = null;
+	constructor() {
+		super({ ...DEFAULT_CONFIG });
+	}
+	async onInitialize() {
+		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
+		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
+		const store = await this.ctx.settings?.readAddonStore() ?? {};
+		const rawNode = store["recordingNodeId"];
+		const designated = typeof rawNode === "string" && rawNode.length > 0 ? rawNode : RECORDING_NODE_DEFAULT;
+		this.isRecordingNode = this.nodeId === designated;
+		if (!this.isRecordingNode) {
+			this.ctx.logger.info("recorder INERT on this node — recording assigned elsewhere", { meta: {
+				ownNodeId: this.nodeId,
+				designatedNode: designated
+			} });
+			return { providers: [] };
+		}
+		const rawHubHostname = store["recordingHubHostname"];
+		const consumerHostname = this.nodeId === BROKER_HOST_NODE_ID ? void 0 : resolveRecordingHubHostname(typeof rawHubHostname === "string" ? rawHubHostname : void 0, process.env["CAMSTACK_HUB_URL"]);
+		if (this.nodeId !== BROKER_HOST_NODE_ID) {
+			this.ctx.logger.info("recorder is a REMOTE recording node — pulling broker streams cross-node", { meta: {
+				ownNodeId: this.nodeId,
+				brokerHost: BROKER_HOST_NODE_ID,
+				consumerHostname: consumerHostname ?? "(unresolved)"
+			} });
+			if (consumerHostname === void 0) this.ctx.logger.warn("recorder: could not resolve the hub host for cross-node pull — set the `recordingHubHostname` global setting or CAMSTACK_HUB_URL; recording will not reach this node", { meta: { ownNodeId: this.nodeId } });
+		}
+		const segmentStoreDeps = {
+			index: this.index,
+			list: (input) => this.ctx.api.storage.list.query(input),
+			deletePath: (input) => this.ctx.api.storage.delete.mutate(input),
+			statBytes: async (absPath) => (await promises.stat(absPath)).size,
+			moveFile: async (fromAbs, toAbs) => {
+				await promises.mkdir(path.dirname(toAbs), { recursive: true });
+				await promises.rename(fromAbs, toAbs);
+			},
+			logger: { warn: (message, extras) => this.ctx.logger.warn(message, { meta: { extras } }) }
+		};
+		this.segmentStore = new SegmentStore(segmentStoreDeps);
+		const tmpRoot = path.join(this.ctx.dataDir, "rec-tmp");
+		const brokerHandle = this.ctx.useCapability("stream-broker", brokerScope(BROKER_HOST_NODE_ID));
+		this.controller = new RecordingController({
+			api: this.ctx.api,
+			logger: this.ctx.logger,
+			nodeId: this.nodeId,
+			segmentStore: this.segmentStore,
+			loadConfig: (deviceId) => loadDeviceConfig(this.configStore(), deviceId),
+			enabledDeviceIds: async () => [...(await readDeviceConfigs(this.configStore())).keys()],
+			locations: () => this.resolvedLocations,
+			tmpRoot,
+			spawn,
+			segmentSeconds: this.config.segmentSeconds,
+			watchIntervalMs: this.config.watchIntervalMs,
+			...consumerHostname !== void 0 ? { consumerHostname } : {},
+			onBrokerReady: (handler) => this.ctx.onCapabilityStateChange("stream-broker", brokerScope(BROKER_HOST_NODE_ID), (state) => {
+				if (state === "ready") handler();
+			}),
+			brokerCall: makeBrokerCall(brokerHandle)
+		});
+		const recordingProvider = buildRecordingProvider({
+			index: this.index,
+			segmentStore: this.segmentStore,
+			nodeId: this.nodeId,
+			logger: this.ctx.logger,
+			configStore: this.configStore(),
+			locations: () => this.resolvedLocations,
+			refreshLocations: () => this.refreshLocations(),
+			capacity: (root) => this.locationCapacity(root),
+			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
+			onConfigChanged: (deviceId) => this.controller?.onConfigChanged(deviceId) ?? Promise.resolve(),
+			dataDir: this.ctx.dataDir,
+			playbackBaseUrl: () => this.playbackBaseUrl
+		});
+		const evictableProvider = new StorageEvictableProvider({
+			index: this.index,
+			store: this.segmentStore
+		});
+		try {
+			const handler = createFileDataPlaneHandler({ getRoots: () => this.playbackRoots() });
+			const served = await this.ctx.dataPlane?.serve({
+				prefix: PLAYBACK_PREFIX,
+				access: "authenticated",
+				handler
+			});
+			this.playbackBaseUrl = served ? `/addon/${RECORDER_ADDON_ID}/${PLAYBACK_PREFIX}` : null;
+			this.ctx.logger.info("recorder playback data-plane served", { meta: {
+				clientBase: this.playbackBaseUrl ?? "(no dataPlane facility)",
+				internal: served?.baseUrl
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("recorder playback data-plane failed to serve", { meta: { error: errMsg(err) } });
+		}
+		this.ctx.logger.info("recorder addon started (continuous write path active)", {
+			tags: { nodeId: this.nodeId },
+			meta: {
+				segmentSeconds: this.config.segmentSeconds,
+				watchIntervalMs: this.config.watchIntervalMs
+			}
+		});
+		return { providers: [{
+			capability: recordingCapability,
+			provider: recordingProvider
+		}, {
+			capability: storageEvictableCapability,
+			provider: evictableProvider
+		}] };
+	}
+	async onShutdown() {
+		this.eventUnsub?.();
+		this.eventUnsub = null;
+		await this.controller?.stop();
+		this.controller = null;
+		this.segmentStore = null;
+	}
+	/**
+	* Boot hydrate: once the hub is reachable (`ctx.api.*` safe), resolve the
+	* recordings locations and rebuild the in-memory index from `storage.list`
+	* for every device that has a persisted config. The list result is the
+	* ground truth — segment paths encode start/dur/bytes, so the index can never
+	* drift from disk.
+	*/
+	async onHubReachable() {
+		if (!this.isRecordingNode) return;
+		this.resolvedLocations = await resolveRecordingsLocations(this.ctx.api, this.ctx.logger);
+		if (this.resolvedLocations.length === 0) {
+			this.ctx.logger.warn("recorder: no recordings storage locations resolved — index not hydrated");
+			return;
+		}
+		let configs;
+		try {
+			configs = await readDeviceConfigs(this.configStore());
+		} catch (err) {
+			this.ctx.logger.warn("recorder: reading persisted device configs failed — skipping hydrate", { meta: { error: errMsg(err) } });
+			return;
+		}
+		for (const deviceId of configs.keys()) await hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, this.resolvedLocations, this.ctx.logger);
+		this.ctx.logger.info("recorder: hydrated index from storage", { meta: {
+			deviceCount: configs.size,
+			locationCount: this.resolvedLocations.length
+		} });
+		const store = this.segmentStore;
+		if (store) try {
+			await runRedundancyJanitor({
+				deviceIds: [...configs.keys()],
+				segmentsFor: (deviceId, profile) => this.index.segments(deviceId, profile),
+				evict: (location, rows) => store.evict(location, rows),
+				logger: this.ctx.logger
+			});
+		} catch (err) {
+			this.ctx.logger.warn("recorder: redundancy janitor failed", { meta: { error: errMsg(err) } });
+		}
+		try {
+			await this.controller?.start();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: controller start failed", { meta: { error: errMsg(err) } });
+		}
+		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
+			eventBus: this.ctx.eventBus,
+			map: this.eventMap,
+			padPreMs: MARKER_PAD_PRE_MS,
+			padPostMs: MARKER_PAD_POST_MS,
+			onMotion: (deviceId, atMs) => {
+				this.controller?.onTrigger(deviceId, "motion", atMs);
+			}
+		});
+	}
+	/** Re-resolve recordings locations (rescanStorage picks up newly-added disks). */
+	async refreshLocations() {
+		this.resolvedLocations = await resolveRecordingsLocations(this.ctx.api, this.ctx.logger);
+		return this.resolvedLocations;
+	}
+	/**
+	* Roots the playback data-plane handler searches, IN ORDER: `<dataDir>/playback`
+	* FIRST (the freshly-written master/variant `.m3u8` playlists), then every
+	* recordings location root (the segment `.m4s` files at
+	* `<root>/<deviceId>/<profile>/Y/M/D/H/<file>`). Playlists-first matters: the
+	* OLD recorder left stale `<recordingsRoot>/<deviceId>/master.m3u8` playlists
+	* that would otherwise shadow ours; segments never collide (only `.m4s` live in
+	* the location roots, only `.m3u8` in the playback dir), so the two form one
+	* served tree with our playlists authoritative.
+	*/
+	playbackRoots() {
+		return [path.join(this.ctx.dataDir, "playback"), ...this.resolvedLocations.map((l) => l.root)];
+	}
+	/** Free + total bytes on a location's volume (`statfs`); null when unstattable. */
+	async locationCapacity(root) {
+		try {
+			const st = await promises.statfs(root);
+			return {
+				availableBytes: st.bavail * st.bsize,
+				totalBytes: st.blocks * st.bsize
+			};
+		} catch {
+			return {
+				availableBytes: null,
+				totalBytes: null
+			};
+		}
+	}
+	/**
+	* Global settings surfaced in the admin UI (and persisted to the addon
+	* store). The cluster Recording tab drives `recordingNodeId` via a node
+	* picker; `recordingHubHostname` is an advanced override for cross-node
+	* pulls. Both take effect on addon restart (read once in `onInitialize`).
+	*/
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "cluster-recording",
+			title: "Cluster recording",
+			description: "Which node runs recording (continuous + events write path). A SINGLE node — no multi-node balancing; every other node stays fully inert. Default: hub.",
+			columns: 1,
+			fields: [{
+				type: "text",
+				key: "recordingNodeId",
+				label: "Recording node",
+				description: "Node id that records + serves playback (e.g. \"hub\"). Leave \"hub\" unless you intentionally move recording to an agent. Takes effect on addon restart.",
+				default: RECORDING_NODE_DEFAULT
+			}, {
+				type: "text",
+				key: "recordingHubHostname",
+				label: "Hub host (cross-node)",
+				description: "Advanced: only used when the recording node is an AGENT. The hub's host the agent dials to pull broker streams (the RTSP restream port must be reachable there). Leave empty to auto-derive from the agent's hub connection.",
+				default: ""
+			}]
+		}] });
+	}
+	/** The addon-store slice config-store reads/writes the deviceId→config blob on. */
+	configStore() {
+		const settings = this.ctx.settings;
+		if (!settings) throw new Error("RecorderV2Addon: ctx.settings unavailable — cannot persist recording config");
+		return {
+			readAddonStore: () => settings.readAddonStore(),
+			writeAddonStore: (patch) => settings.writeAddonStore(patch)
+		};
+	}
 };
-//# sourceMappingURL=index.mjs.map
+//#endregion
+export { RecorderV2Addon as default };