@camstack/addon-pipeline 1.2.103 → 1.2.104

package/dist/recorder/index.mjs

@@ -1,5 +1,6 @@
-import { $ as recordingCapability, Bt as EventCategory, C as RecordingConfigSchema, Dt as selectAssignedProfileSlots, Ft as number, It as object, Lt as record, R as deriveRecordingMode, Rt as string, S as RECORDING_EXPORT_MAX_READ_BYTES, at as storageEvictableCapability, bt as hydrateSchema, et as recordingExportCapability, f as EVENT_PAD_MS, ht as BaseAddon, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, lt as errMsg, m as ExportRecordSchema, rt as resolveRecordingProfiles, v as OpsLogEntrySchema, vt as DeviceType, wt as nodePin } from "../dist-Ccmt3fGJ.mjs";
+import { At as selectAssignedProfileSlots, Bt as record, C as RECORDING_EXPORT_MAX_READ_BYTES, Ct as hydrateSchema, Dt as nodePin, L as deriveBatteryPresence, Rt as number, Ut as EventCategory, Vt as string, bt as DeviceFeature, ct as storageEvictableCapability, ft as errMsg, h as ExportRecordSchema, i as BatteryStatusSchema, j as batteryCapability, nt as recordingExportCapability, ot as resolveRecordingProfiles, p as EVENT_PAD_MS, tt as recordingCapability, u as DEFAULT_EVENTS_BAND_BUFFER_SEC, vt as BaseAddon, w as RecordingConfigSchema, xt as DeviceType, y as OpsLogEntrySchema, z as deriveRecordingMode, zt as object } from "../dist-D9sltFoR.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
+import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
 import { randomUUID } from "node:crypto";
@@ -2801,12 +2802,23 @@ function withStreamTimeDenseRanges(input) {
 *                             `outputFps`, always silent.
 * Distinct from `buildPassthroughArgs` (live segmentation) — do not conflate.
 *
-* A **timelapse of a long HLS concat** is two argv sets, not one. Pass 1
-* (`buildConcatPassArgs`) remuxes the playlist to a single mpegts with `-c
-* copy`. Pass 2 (`buildExportArgs` with that file as `-i`) then selects
-* frames. Selecting WHILE walking `#EXT-X-DISCONTINUITY` (one per 10s
-* segment from `-reset_timestamps`) is what parked a 30h salone job at
-* `rendering 0%` / 0% CPU — ffmpeg never left the concat demuxer.
+* A **timelapse of a long segment concat** is two argv sets, not one. Pass 1
+* (`buildConcatPassArgs`) remuxes the export's FFCONCAT list to a single
+* mpegts with `-c copy`. Pass 2 (`buildExportArgs` with that file as `-i`)
+* then selects frames. Selecting WHILE walking `#EXT-X-DISCONTINUITY` (one
+* per 10s segment from `-reset_timestamps`) is what parked a 30h salone job
+* at `rendering 0%` / 0% CPU — ffmpeg never left the concat demuxer.
+*
+* Pass 1 reads the ffconcat list, NOT the HLS playlist, because of WHOSE
+* clock the concatenation runs on. The dense-range map
+* (`export-dense-map.ts`) sums the segments' DECLARED `durMs`; the HLS
+* demuxer stitches segments by their CONTENT length. On footage whose PTS
+* span disagrees with its declared duration the two clocks drift apart
+* cumulatively — measured ~495 s by the end of camera 615's 10 h night of
+* 2026-08-20, which put every short dense range over a stretch that held no
+* detection. The concat demuxer's `duration` directive pins each segment's
+* start to the SAME cumulative sum the map computes, so the disagreement is
+* bounded per segment and never accumulates.
 */
 /** Widest [min,max] speed a single ffmpeg `atempo` filter accepts. Outside this
 *  band audio is dropped rather than chained (kept simple + predictable). */
@@ -2881,11 +2893,36 @@ function concatPassOutPath(outPath) {
 	const base = path.basename(outPath, path.extname(outPath));
 	return path.join(dir, `${base}.concat.ts`);
 }
-/** Pass 1 of a timelapse: remux the HLS playlist into one continuous file. */
+/** ffconcat `file` directive value: single-quoted, embedded quotes escaped the
+*  shell way (`'\''`), which is what ffmpeg's concat demuxer parses. */
+function concatFileDirective(uri) {
+	return `file '${uri.replaceAll("'", "'\\''")}'`;
+}
+/**
+* The FFCONCAT list pass 1 reads — one `file` + `duration` pair per segment.
+*
+* The `duration` line is load-bearing: it is what makes the concat demuxer
+* start segment k+1 at `Σ durMs[0..k]`, the exact cumulative sum
+* `recordedMsBefore` computes when the dense ranges are mapped. A segment
+* whose content is shorter than its declared duration leaves a sub-second
+* PTS hole; one that is longer overlaps the next start and the mpegts muxer
+* clamps it — both bounded per segment, neither cumulative. The HLS demuxer
+* this replaces had no declared clock at all and drifted without bound.
+*/
+function buildExportConcatList(segments) {
+	return `ffconcat version 1.0\n${segments.map((s) => `${concatFileDirective(s.uri)}\nduration ${sec(s.durMs / 1e3)}`).map((l) => `${l}\n`).join("")}`;
+}
+/** Pass 1 of a timelapse: remux the ffconcat list into one continuous file.
+*  `-safe 0` because the list's paths are absolute — which is exactly what the
+*  per-export source list contains (`export-source-playlist.ts`). */
 function buildConcatPassArgs(input) {
 	return [
+		"-f",
+		"concat",
+		"-safe",
+		"0",
 		"-i",
-		input.inputPlaylist,
+		input.inputConcatList,
 		"-c",
 		"copy",
 		"-an",
@@ -2904,7 +2941,7 @@ function buildExportArgs(input) {
 		return [
 			...inArgs,
 			"-vf",
-			`select='${selectPredicate(everySec, options.timelapse.dense)}',setpts=N/FRAME_RATE/TB,fps=${fps}`,
+			`select='${selectPredicate(everySec, options.timelapse.dense)}',setpts=N/(${fps}*TB),fps=${fps}`,
 			"-an",
 			...X264,
 			...FASTSTART,
@@ -3257,16 +3294,16 @@ var ExportEngine = class {
 			return;
 		}
 		try {
-			await this.spawnRender(id, rec, playlist.path, this.streamTimeOptions(rec, playlist.segments));
+			await this.spawnRender(id, rec, playlist, this.streamTimeOptions(rec, playlist.segments));
 		} finally {
-			if (this.deps.cleanupPlaylist) try {
-				await this.deps.cleanupPlaylist(playlist.path);
+			if (this.deps.cleanupPlaylist) for (const file of [playlist.path, playlist.concatPath]) try {
+				await this.deps.cleanupPlaylist(file);
 			} catch (err) {
 				this.deps.logger.warn("export: source playlist cleanup failed", {
 					tags: { deviceId: rec.deviceId },
 					meta: {
 						exportId: id,
-						playlist: playlist.path,
+						playlist: file,
 						error: err instanceof Error ? err.message : String(err)
 					}
 				});
@@ -3317,16 +3354,16 @@ var ExportEngine = class {
 				exportId: id,
 				deviceId: rec.deviceId,
 				profile: rec.profile,
-				playlist,
+				playlist: playlist.path,
 				outPath
 			}
 		});
 		if (options.timelapse) {
-			await this.spawnTimelapse(id, rec, playlist, outPath, options);
+			await this.spawnTimelapse(id, rec, playlist.concatPath, outPath, options);
 			return;
 		}
 		const args = buildExportArgs({
-			inputPlaylist: playlist,
+			inputPlaylist: playlist.path,
 			outPath,
 			options
 		});
@@ -3338,16 +3375,19 @@ var ExportEngine = class {
 		await this.finish(id, ran.code, outPath, ran.stderrTail);
 	}
 	/**
-	* Concat the HLS pieces into one continuous file, THEN select frames.
+	* Concat the recorded pieces into one continuous file, THEN select frames.
 	* The select filter on a discontinuity-heavy playlist is what parked a
 	* 30h job at `rendering 0%` — pass 1 is `-c copy` into mpegts so pass 2
-	* sees a single timestamp line.
+	* sees a single timestamp line. The input is the export's FFCONCAT list
+	* (declared per-segment durations), never the HLS playlist, so that single
+	* timestamp line runs on the SAME clock the dense map summed — see
+	* `export-ffmpeg-args.ts` for what the HLS demuxer's content-stitching cost.
 	*/
-	async spawnTimelapse(id, rec, playlist, outPath, options) {
+	async spawnTimelapse(id, rec, concatList, outPath, options) {
 		const concatPath = concatPassOutPath(outPath);
 		try {
 			const concatArgs = buildConcatPassArgs({
-				inputPlaylist: playlist,
+				inputConcatList: concatList,
 				outPath: concatPath
 			});
 			const concatRan = await this.runFfmpeg(id, rec.deviceId, concatArgs, {
@@ -4669,6 +4709,13 @@ function exportSourcePlaylistPath(exportsDir, deviceId, exportId) {
 	return path.join(exportsDir, String(deviceId), `${exportId}.src.m3u8`);
 }
 /**
+* Absolute path of the same export's FFCONCAT list — the timelapse pass-1
+* input (`buildConcatPassArgs`). Sibling of the m3u8, same uniqueness rules.
+*/
+function exportSourceConcatPath(exportsDir, deviceId, exportId) {
+	return path.join(exportsDir, String(deviceId), `${exportId}.src.ffconcat`);
+}
+/**
 * Write the export's source playlist and return it, or null when no segment of
 * the requested profile is present on disk for the range (the engine then fails
 * the job with 'no footage for range').
@@ -4677,10 +4724,16 @@ async function writeExportSourcePlaylist(input) {
 	const { segments } = await collectRangeSegments(input.deps, input.deviceId, input.profile, input.fromMs, input.toMs, "absolute");
 	if (segments.length === 0) return null;
 	const playlistPath = exportSourcePlaylistPath(input.exportsDir, input.deviceId, input.exportId);
+	const concatPath = exportSourceConcatPath(input.exportsDir, input.deviceId, input.exportId);
 	await promises.mkdir(path.dirname(playlistPath), { recursive: true });
 	await promises.writeFile(playlistPath, buildVariantPlaylist(segments), "utf8");
+	await promises.writeFile(concatPath, buildExportConcatList(segments.map((s) => ({
+		uri: s.uri,
+		durMs: s.durMs
+	}))), "utf8");
 	return {
 		path: playlistPath,
+		concatPath,
 		segments: segments.map((s) => ({
 			startMs: s.startMs,
 			durMs: s.durMs
@@ -4798,6 +4851,7 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 		};
 	} finally {
 		await promises.rm(playlist.path, { force: true }).catch(() => {});
+		await promises.rm(playlist.concatPath, { force: true }).catch(() => {});
 		await promises.rm(outPath, { force: true }).catch(() => {});
 	}
 }
@@ -6275,6 +6329,82 @@ function eventsBandCanEverDemand(band) {
 	if (band.mode !== "events") return true;
 	return (band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0) && resolveBandBufferMs(band).postMs > 0;
 }
+/** No trigger has been seen for this device yet. */
+var EMPTY_TRIGGER_STATE = {
+	motion: [],
+	audio: []
+};
+/**
+* How long a window is retained PAST the end of its own keep span
+* (`lastMs + postBufferSec`).
+*
+* A window may still be needed by a segment that has not been finalized yet.
+* The oldest such segment started one `segmentSeconds` ago, was named up to
+* {@link FIRST_SEGMENT_GRACE_MS} after the writer spawned, and is handed to the
+* keep gate after the finalize lag. 120 s covers a 60 s segment plus both, with
+* room to spare, while bounding a busy camera to a handful of windows.
+*/
+var TRIGGER_HISTORY_MARGIN_MS = 12e4;
+/** The windows for a source, in the order they opened. */
+function windowsFor(state, source) {
+	return source === "motion" ? state.motion : state.audio;
+}
+function withWindows(state, source, windows) {
+	return source === "motion" ? {
+		...state,
+		motion: windows
+	} : {
+		...state,
+		audio: windows
+	};
+}
+/**
+* Fold one qualifying trigger into the history, immutably. It EXTENDS the newest
+* window when it lands within `postBufferSec` of it (same episode — the recorder
+* never stopped in between), and opens a new one otherwise.
+*
+* An out-of-order trigger (`atMs` older than the newest window's `lastMs`, which
+* a bus lag spike can produce) never rewinds `lastMs`: it widens `firstMs` if it
+* predates the episode, so the keep span can only ever grow.
+*/
+function recordTrigger(state, source, atMs, mergeGapMs) {
+	const windows = windowsFor(state, source);
+	const newest = windows[windows.length - 1];
+	const merged = newest !== void 0 && atMs - newest.lastMs <= mergeGapMs && atMs >= newest.firstMs - mergeGapMs ? [...windows.slice(0, -1), {
+		firstMs: Math.min(newest.firstMs, atMs),
+		lastMs: Math.max(newest.lastMs, atMs)
+	}] : [...windows, {
+		firstMs: atMs,
+		lastMs: atMs
+	}];
+	const evicted = Math.max(0, merged.length - 32);
+	return {
+		state: withWindows(state, source, evicted > 0 ? merged.slice(evicted) : merged),
+		evicted
+	};
+}
+/**
+* Drop windows whose keep span ended more than {@link TRIGGER_HISTORY_MARGIN_MS}
+* ago — nothing still to be finalized can intersect them. Pure; the caller
+* clocks it. Returns the SAME object when nothing expired, so a caller can skip
+* a write.
+*/
+function pruneTriggerHistory(state, postMs, nowMs) {
+	const cutoffMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
+	const live = (w) => w.lastMs >= cutoffMs;
+	const motion = state.motion.filter(live);
+	const audio = state.audio.filter(live);
+	if (motion.length === state.motion.length && audio.length === state.audio.length) return state;
+	return {
+		motion,
+		audio
+	};
+}
+/** Most recent trigger for a source, or null when none is retained. */
+function latestTriggerMs(state, source) {
+	const windows = windowsFor(state, source);
+	return windows[windows.length - 1]?.lastMs ?? null;
+}
 /**
 * Is an `events` band's live demand window open at `atMs`? True iff a trigger
 * the band listens for fired within `postBufferSec` of now. `preBufferSec` is
@@ -6283,8 +6413,8 @@ function eventsBandCanEverDemand(band) {
 function eventsBandDemanded(band, triggers, atMs) {
 	const { postMs } = resolveBandBufferMs(band);
 	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
-	if (band.triggers?.motion && fresh(triggers.lastMotionMs)) return true;
-	if (band.triggers?.audioThresholdDbfs != null && fresh(triggers.lastAudioMs)) return true;
+	if (band.triggers?.motion && fresh(latestTriggerMs(triggers, "motion"))) return true;
+	if (band.triggers?.audioThresholdDbfs != null && fresh(latestTriggerMs(triggers, "audio"))) return true;
 	return false;
 }
 /**
@@ -6351,14 +6481,13 @@ function attachRetainDeadlineMs(attach) {
 function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach) {
 	const { preMs, postMs } = resolveBandBufferMs(band);
 	const deadlineMs = attachRetainDeadlineMs(attach);
-	const overlaps = (lastMs) => {
-		if (lastMs == null) return false;
-		if (segEndMs < lastMs - preMs) return false;
-		if (segStartMs <= lastMs + postMs) return true;
-		return attach.attachedAtMs <= lastMs + postMs && segStartMs <= deadlineMs;
+	const overlaps = (window) => {
+		if (segEndMs < window.firstMs - preMs) return false;
+		if (segStartMs <= window.lastMs + postMs) return true;
+		return attach.attachedAtMs <= window.lastMs + postMs && segStartMs <= deadlineMs;
 	};
-	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
-	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
+	if (band.triggers?.motion && triggers.motion.some(overlaps)) return true;
+	if (band.triggers?.audioThresholdDbfs != null && triggers.audio.some(overlaps)) return true;
 	return false;
 }
 /**
@@ -6377,14 +6506,137 @@ function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach)
 function segmentMissedByMs(segStartMs, band, triggers, attach) {
 	const { postMs } = resolveBandBufferMs(band);
 	const deadlineMs = attachRetainDeadlineMs(attach);
-	const latestKeptStart = (lastMs) => {
-		if (lastMs == null) return null;
-		const windowEndMs = lastMs + postMs;
+	const latestKeptStart = (window) => {
+		const windowEndMs = window.lastMs + postMs;
 		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
 	};
-	const bounds = [band.triggers?.motion === true ? latestKeptStart(triggers.lastMotionMs) : null, band.triggers?.audioThresholdDbfs != null ? latestKeptStart(triggers.lastAudioMs) : null].filter((ms) => ms != null);
-	if (bounds.length === 0) return null;
-	return segStartMs - Math.max(...bounds);
+	const considered = [...band.triggers?.motion === true ? triggers.motion : [], ...band.triggers?.audioThresholdDbfs != null ? triggers.audio : []];
+	if (considered.length === 0) return null;
+	return segStartMs - Math.max(...considered.map(latestKeptStart));
+}
+/**
+* Fold DURABLE trigger rows (the analytics store's motion timestamps) into the
+* history, immutably.
+*
+* ## Why this exists next to {@link recordTrigger}
+*
+* `recordTrigger` is fed by the event bus, and an event is telemetry that may
+* be DROPPED (D8/D11). What it feeds is not telemetry: a window the gate never
+* learned about means every segment of that episode is unlinked, and footage
+* deleted is gone. D11's own rule for that shape is "an event plus an RPC
+* reconcile", and this is the reconcile half — the same merge, over rows that
+* were persisted rather than broadcast.
+*
+* It is deliberately the SAME merge and not a second policy: a reconcile that
+* built windows by a different rule than the fast path would produce keep spans
+* that depend on which path saw the trigger, which is the two-authorities
+* failure D62 names. `recordTrigger` is called per row.
+*
+* Rows are sorted before folding: a store is free to answer newest-first, and
+* while `recordTrigger` tolerates one out-of-order arrival, a whole batch in
+* reverse would open a window per row instead of merging one episode.
+* Non-finite and non-positive timestamps are dropped rather than folded — a
+* window opened at `NaN` compares false against every segment for ever.
+*/
+function foldDurableTriggers(state, source, timestamps, mergeGapMs) {
+	const rows = timestamps.filter((t) => Number.isFinite(t) && t > 0).toSorted((a, b) => a - b);
+	let next = state;
+	let recovered = 0;
+	let evicted = 0;
+	for (const atMs of rows) {
+		const before = windowsFor(next, source);
+		const folded = recordTrigger(next, source, atMs, mergeGapMs);
+		evicted += folded.evicted;
+		const after = windowsFor(folded.state, source);
+		if (folded.evicted > 0 || after.length !== before.length || after.some((w, i) => w.firstMs !== before[i]?.firstMs || w.lastMs !== before[i]?.lastMs)) recovered++;
+		next = folded.state;
+	}
+	return {
+		state: recovered === 0 && evicted === 0 ? state : next,
+		recovered,
+		evicted
+	};
+}
+//#endregion
+//#region src/recorder/addon/battery-wake.ts
+/**
+* Waking a BATTERY camera for a recording trigger.
+*
+* ## Why the recorder needs this at all
+*
+* A battery camera is asleep between events. Every other demand consumer in
+* this system already wakes it — the live/WebRTC path does, through
+* `battery.wakeForStream` (D173) — but the recorder did not, so an `events`
+* band pointed at a battery camera attached to a broker with no source and
+* produced nothing. Measured on camera 3629 (audit 2026-08-20): **48.9 % of its
+* episodes recorded zero footage.**
+*
+* A recording trigger IS demand, in exactly the sense D173 defines: something
+* the operator asked for is happening NOW and needs media. It therefore takes
+* the demand path — which bypasses the provider's proactive-wake cooldown while
+* still stamping it — and not the proactive path.
+*
+* ## What this module deliberately does NOT do
+*
+* - It does not re-derive presence. `deriveBatteryPresence` is THE derivation
+*   (D52); a caller writing `sleeping === true` has undone the third state that
+*   exists so a nap stops being rendered as breakage.
+* - It does not guess battery-operation. An UNKNOWN verdict never wakes (D49):
+*   a failed registry read must not look like a battery camera.
+* - It does not wait for the broker to settle. The recorder already has that
+*   machinery — a failed attach queues on the readiness-restore queue and is
+*   retried on the next broker-ready transition, with the periodic reconcile as
+*   backstop. Duplicating `battery-wake-on-play.ts`'s settle loop here would be
+*   a second implementation of a convergence this addon already owns.
+*/
+/**
+* Bound on the wake itself, matched to the live path's
+* `WAKE_FOR_STREAM_TIMEOUT_MS`. Deliberately the same number: a battery camera
+* does not wake faster because a recorder asked instead of a viewer, and two
+* different bounds for one physical act is the kind of drift that makes a
+* timeout unattributable.
+*/
+var WAKE_FOR_RECORDING_TIMEOUT_MS = 8e3;
+/**
+* Wake `deviceId` if it is a sleeping battery camera. Never throws — a wake
+* that fails must degrade to "attach anyway and let the existing retry
+* machinery converge", never to a rejection escaping into the trigger path
+* (that path is fire-and-forget and an escape prints a runner CRASH marker).
+*/
+async function wakeForRecording(deviceId, deps) {
+	const isBattery = await deps.isBatteryDevice(deviceId).catch(() => null);
+	if (isBattery === false) return { outcome: "not-battery" };
+	if (isBattery === null) return { outcome: "unknown" };
+	const facts = await deps.readBatteryFacts(deviceId).catch(() => null);
+	const presence = deriveBatteryPresence({
+		status: facts === null ? null : {
+			sleeping: facts.sleeping,
+			lastContactAt: facts.lastContactAt
+		},
+		nowMs: deps.nowMs()
+	});
+	if (presence === "awake") return { outcome: "already-awake" };
+	if (presence === "unreachable") return { outcome: "unreachable" };
+	try {
+		const wake = await deps.wakeForStream(deviceId, WAKE_FOR_RECORDING_TIMEOUT_MS);
+		return {
+			outcome: wake.awoke ? "woken" : "did-not-wake",
+			durationMs: wake.durationMs
+		};
+	} catch (err) {
+		return {
+			outcome: "wake-failed",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+/**
+* Did this outcome leave the camera unable to produce footage for the episode
+* that asked? Those are the branches that DROP work, and the caller warns on
+* them — camera 3629 lost half its episodes without a single line saying so.
+*/
+function wakeOutcomeLosesFootage(outcome) {
+	return outcome === "unreachable" || outcome === "did-not-wake" || outcome === "wake-failed";
 }
 /** Local-calendar instant for `HH:MM` on the given local Y/M/D (day may overflow). */
 function localInstantMs(year, month, day, hhmm) {
@@ -6443,8 +6695,10 @@ function eventsWindowCloseMs(band, triggers, nowMs) {
 	if (band.mode !== "events") return null;
 	const { postMs } = resolveBandBufferMs(band);
 	const ends = [];
-	if (band.triggers?.motion === true && triggers.lastMotionMs != null) ends.push(triggers.lastMotionMs + postMs);
-	if (band.triggers?.audioThresholdDbfs != null && triggers.lastAudioMs != null) ends.push(triggers.lastAudioMs + postMs);
+	const motionMs = latestTriggerMs(triggers, "motion");
+	const audioMs = latestTriggerMs(triggers, "audio");
+	if (band.triggers?.motion === true && motionMs != null) ends.push(motionMs + postMs);
+	if (band.triggers?.audioThresholdDbfs != null && audioMs != null) ends.push(audioMs + postMs);
 	const open = ends.filter((ms) => ms >= nowMs);
 	if (open.length === 0) return null;
 	return Math.max(...open) + 1;
@@ -6655,70 +6909,6 @@ var ReadinessRestore = class {
 		}
 	}
 };
-/** Adaptive bound for the recorder's attach parallelism. */
-var SpawnPressureGovernor = class {
-	deps;
-	limit;
-	min;
-	recoverAfterMs;
-	/** When the limit last MOVED — the clock both directions are measured from. */
-	lastChangeAt;
-	underPressure = false;
-	constructor(deps) {
-		this.deps = deps;
-		this.min = Math.max(1, deps.minConcurrency ?? 1);
-		this.limit = Math.max(this.min, deps.maxConcurrency);
-		this.recoverAfterMs = deps.recoverAfterMs ?? 3e4;
-		this.lastChangeAt = this.now();
-	}
-	/**
-	* How many attaches may overlap right now.
-	*
-	* Reading is what drives recovery: there is no timer to leak, no interval to
-	* lose to a runner respawn, and a recorder that stops attaching entirely
-	* simply keeps its reduced bound until it tries again — which is correct.
-	*/
-	get concurrency() {
-		const max = Math.max(this.min, this.deps.maxConcurrency);
-		if (this.limit >= max) return max;
-		const elapsed = this.now() - this.lastChangeAt;
-		if (elapsed < this.recoverAfterMs) return this.limit;
-		const lanes = Math.floor(elapsed / this.recoverAfterMs);
-		this.limit = Math.min(max, this.limit + lanes);
-		this.lastChangeAt += lanes * this.recoverAfterMs;
-		if (this.limit >= max && this.underPressure) {
-			this.underPressure = false;
-			this.deps.logger?.info("recorder: spawn pressure cleared — attach concurrency restored", { meta: { concurrency: this.limit } });
-		} else this.deps.logger?.info("recorder: recovering attach concurrency", { meta: {
-			concurrency: this.limit,
-			max
-		} });
-		return this.limit;
-	}
-	/**
-	* A transient spawn failure happened on `deviceId`'s writer.
-	*
-	* Halves the CURRENT limit, not the max: two waves of pressure inside one
-	* recovery window must compound, or a host under sustained load is asked for
-	* the same too-large batch over and over.
-	*/
-	report(deviceId) {
-		const before = this.limit;
-		this.limit = Math.max(this.min, Math.floor(this.limit / 2));
-		this.lastChangeAt = this.now();
-		this.underPressure = true;
-		this.deps.logger?.warn("recorder: spawn pressure — reducing attach concurrency", {
-			tags: { deviceId },
-			meta: {
-				from: before,
-				to: this.limit
-			}
-		});
-	}
-	now() {
-		return this.deps.now?.() ?? Date.now();
-	}
-};
 //#endregion
 //#region src/recorder/addon/segment-watcher.ts
 /**
@@ -6761,17 +6951,6 @@ var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
 */
 var PENDING_GRACE_MS = 3e4;
 /**
-* How far before the writer's own start a segment may be named and still be
-* treated as belonging to THIS run.
-*
-* ffmpeg names segments with whole-second `%s`, so the first segment of a run
-* carries the second that was already in progress when the process spawned —
-* up to ~1 s "before" the writer started. Without this tolerance the very first
-* segment of every recording would be classified as a previous run's leftover
-* and dropped.
-*/
-var PREVIOUS_RUN_SKEW_MS$1 = 1e3;
-/**
 * Decide whether a missing flat file is a late flush or a previous run's entry.
 *
 * ffmpeg opens `-segment_list` in TRUNCATE mode when it spawns, but not
@@ -6792,7 +6971,7 @@ var PREVIOUS_RUN_SKEW_MS$1 = 1e3;
 * entries a playlist does name.
 */
 function classifyMissingEntry(input) {
-	return input.segmentStartMs < input.writerStartedMs - PREVIOUS_RUN_SKEW_MS$1 ? "stale-previous-run" : "pending";
+	return input.segmentStartMs < input.writerStartedMs - 1e3 ? "stale-previous-run" : "pending";
 }
 /** Whether a pending entry has outlived its grace. Pure — the caller clocks it. */
 function shouldGiveUpOnPending(input) {
@@ -7025,7 +7204,7 @@ function buildPassthroughArgs(a) {
 		"-rtsp_transport",
 		"tcp",
 		"-user_agent",
-		"recorder",
+		a.consumerTag,
 		"-i",
 		a.rtspUrl,
 		"-map",
@@ -7217,6 +7396,70 @@ var SegmentWriter = class {
 		await exitWait;
 	}
 };
+/** Adaptive bound for the recorder's attach parallelism. */
+var SpawnPressureGovernor = class {
+	deps;
+	limit;
+	min;
+	recoverAfterMs;
+	/** When the limit last MOVED — the clock both directions are measured from. */
+	lastChangeAt;
+	underPressure = false;
+	constructor(deps) {
+		this.deps = deps;
+		this.min = Math.max(1, deps.minConcurrency ?? 1);
+		this.limit = Math.max(this.min, deps.maxConcurrency);
+		this.recoverAfterMs = deps.recoverAfterMs ?? 3e4;
+		this.lastChangeAt = this.now();
+	}
+	/**
+	* How many attaches may overlap right now.
+	*
+	* Reading is what drives recovery: there is no timer to leak, no interval to
+	* lose to a runner respawn, and a recorder that stops attaching entirely
+	* simply keeps its reduced bound until it tries again — which is correct.
+	*/
+	get concurrency() {
+		const max = Math.max(this.min, this.deps.maxConcurrency);
+		if (this.limit >= max) return max;
+		const elapsed = this.now() - this.lastChangeAt;
+		if (elapsed < this.recoverAfterMs) return this.limit;
+		const lanes = Math.floor(elapsed / this.recoverAfterMs);
+		this.limit = Math.min(max, this.limit + lanes);
+		this.lastChangeAt += lanes * this.recoverAfterMs;
+		if (this.limit >= max && this.underPressure) {
+			this.underPressure = false;
+			this.deps.logger?.info("recorder: spawn pressure cleared — attach concurrency restored", { meta: { concurrency: this.limit } });
+		} else this.deps.logger?.info("recorder: recovering attach concurrency", { meta: {
+			concurrency: this.limit,
+			max
+		} });
+		return this.limit;
+	}
+	/**
+	* A transient spawn failure happened on `deviceId`'s writer.
+	*
+	* Halves the CURRENT limit, not the max: two waves of pressure inside one
+	* recovery window must compound, or a host under sustained load is asked for
+	* the same too-large batch over and over.
+	*/
+	report(deviceId) {
+		const before = this.limit;
+		this.limit = Math.max(this.min, Math.floor(this.limit / 2));
+		this.lastChangeAt = this.now();
+		this.underPressure = true;
+		this.deps.logger?.warn("recorder: spawn pressure — reducing attach concurrency", {
+			tags: { deviceId },
+			meta: {
+				from: before,
+				to: this.limit
+			}
+		});
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+};
 //#endregion
 //#region src/recorder/addon/recording-controller.ts
 /**
@@ -7362,6 +7605,21 @@ function passSlowAfterMs(intervalMs) {
 * promise, so a post-deadline settlement can never surface as a process-level
 * `unhandledRejection`.
 */
+/**
+* Bound on the two registry reads the battery-wake policy makes. They run
+* before any broker call on every attach, battery camera or not, so they are
+* the cheapest place for an unresponsive durable store to cost a recording.
+* Short on purpose: the answer is a cached registry field, not a camera.
+*/
+var BATTERY_READ_TIMEOUT_MS = 3e3;
+/**
+* How stale a trigger may be on arrival before it is worth a warn. A recording
+* window is opened from `now`, but its POST-buffer is measured from the trigger
+* instant, so every millisecond of lag is a millisecond of the operator's
+* window already gone. 2 s is well clear of normal bus jitter and well under
+* the shipped 30 s post-buffer.
+*/
+var TRIGGER_LAG_WARN_MS = 2e3;
 function withDeadline(promise, ms, label) {
 	return new Promise((resolve, reject) => {
 		const timer = setTimeout(() => {
@@ -7428,7 +7686,28 @@ var RecordingController = class {
 	/** Every attach admitted before a maintenance pause. The pause waits these
 	* promises before it snapshots/drains active writers. */
 	attachingTasks = /* @__PURE__ */ new Map();
-	/** Latest qualifying trigger timestamps per device — drives `events`-band gating. */
+	/** `deviceId:profile` keys whose current attach has already logged its first
+	*  segment — the measurement is per ATTACH, not per segment. Cleared on
+	*  teardown with the rest of the per-attach state. */
+	firstSegmentSeen = /* @__PURE__ */ new Set();
+	/**
+	* Monotonic attach counter, the last component of the CONSUMER TAG this
+	* recorder puts on its RTSP dial (`recorder/<deviceId>/<profile>/<n>`).
+	*
+	* The tag is the join key between the broker's pre-roll accounting and the
+	* files on disk. `deviceId/profile` alone is not enough: a device that
+	* re-attaches names the same pair again, and two attaches minutes apart both
+	* matching a broker line is exactly the ambiguity that made the 2026-08-20
+	* measurements unreconcilable. A wall-clock stamp would collide under a fake
+	* clock (and this controller's clock is injected); a counter cannot.
+	*/
+	attachSeq = 0;
+	/** In-flight battery wake per device — concurrent attaches join it rather
+	*  than issuing a second wake at the same radio. */
+	batteryWakes = /* @__PURE__ */ new Map();
+	/** Qualifying trigger HISTORY per device — drives `events`-band gating. A
+	*  bounded list of merged windows, NOT the last timestamp: see
+	*  {@link TriggerState}. */
 	triggers = /* @__PURE__ */ new Map();
 	/**
 	* Last sign of life per `deviceId:profile` — seeded at attach (so the grace
@@ -7639,6 +7918,7 @@ var RecordingController = class {
 	async reconcile() {
 		if (this.stopped) return;
 		await runBounded(await this.trackedDeviceIds(), this.spawnPressure.concurrency, async (id) => {
+			await this.reconcileTriggerHistory(id);
 			try {
 				await this.evaluateDevice(id);
 			} catch (err) {
@@ -7650,6 +7930,62 @@ var RecordingController = class {
 		});
 	}
 	/**
+	* Rebuild this device's motion trigger windows from the DURABLE rows.
+	*
+	* The trigger event is the fast path and stays so — this never opens a
+	* recording any sooner. What it covers is the case the event path cannot: a
+	* trigger the bus dropped, or one that arrived after its own window had
+	* closed (a `busLagMs` of 142 173 has been measured on this cluster). In both
+	* the keep gate has NO window for an episode that happened, so every segment
+	* of it is discarded and the footage is gone for ever — durable state resting
+	* on telemetry, which D8/D11 forbid.
+	*
+	* Motion only. Audio triggers have no durable counterpart the recorder can
+	* ask for at the same granularity, and a reconcile that silently covered one
+	* source and not the other would read as covering both.
+	*
+	* Never throws: this runs at the head of the reconcile beat and an escape
+	* here would cancel the evaluate for the whole device.
+	*/
+	async reconcileTriggerHistory(deviceId) {
+		const load = this.deps.loadMotionEvents;
+		if (load === void 0 || this.stopped) return;
+		try {
+			const config = await this.deps.loadConfig(deviceId);
+			if (config.enabled !== true) return;
+			const nowMs = this.now();
+			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
+			if (!band || band.mode !== "events" || band.triggers?.motion !== true) return;
+			const { postMs } = resolveBandBufferMs(band);
+			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
+			const rows = await load(deviceId, sinceMs, nowMs);
+			if (this.stopped || rows.length === 0) return;
+			const folded = foldDurableTriggers(pruneTriggerHistory(this.triggersFor(deviceId), postMs, this.now()), "motion", rows, postMs);
+			this.triggers.set(deviceId, folded.state);
+			if (folded.recovered > 0) this.deps.logger.info("recorder: trigger windows recovered from the durable rows — the bus had not delivered them", {
+				tags: { deviceId },
+				meta: {
+					rows: rows.length,
+					recovered: folded.recovered,
+					sinceMs,
+					postMs
+				}
+			});
+			if (folded.evicted > 0) this.deps.logger.warn("recorder: trigger history full during reconcile — oldest window(s) evicted", {
+				tags: { deviceId },
+				meta: {
+					evicted: folded.evicted,
+					maxWindows: 32
+				}
+			});
+		} catch (err) {
+			this.deps.logger.warn("recorder: trigger reconcile failed — retries on the next beat", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+	/**
 	* Re-evaluate one device after a config change (called from `setDeviceConfig`).
 	* Failures propagate so the caller can surface them, but the persisted config
 	* has already been written by the time this runs.
@@ -7722,10 +8058,7 @@ var RecordingController = class {
 	}
 	/** Current trigger state for a device (cold default = no triggers seen). */
 	triggersFor(deviceId) {
-		return this.triggers.get(deviceId) ?? {
-			lastMotionMs: null,
-			lastAudioMs: null
-		};
+		return this.triggers.get(deviceId) ?? EMPTY_TRIGGER_STATE;
 	}
 	/**
 	* Record a qualifying trigger (motion/audio) for a device and converge: an
@@ -7742,11 +8075,17 @@ var RecordingController = class {
 	*/
 	async onTrigger(deviceId, source, atMs) {
 		if (this.stopped) return;
-		const prev = this.triggersFor(deviceId);
-		this.triggers.set(deviceId, {
-			lastMotionMs: source === "motion" ? atMs : prev.lastMotionMs,
-			lastAudioMs: source === "audio" ? atMs : prev.lastAudioMs
+		const receivedLagMs = this.now() - atMs;
+		if (receivedLagMs > TRIGGER_LAG_WARN_MS) this.deps.logger.warn("recorder: trigger arrived late — part of its window is already spent", {
+			tags: { deviceId },
+			meta: {
+				source,
+				atMs,
+				receivedLagMs
+			}
 		});
+		this.recordTriggerWindow(deviceId, source, atMs, await this.postBufferMsFor(deviceId, atMs));
+		if (this.stopped) return;
 		try {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
@@ -7761,6 +8100,48 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* The post-buffer that governs this device's trigger history right now: it is
+	* both the MERGE GAP (a trigger landing inside the open live window belongs to
+	* the running episode) and the retention horizon. Falls back to the shipped
+	* default when the config cannot be read — a trigger must never be lost to a
+	* failed config read, and a default window is the conservative choice: it
+	* keeps footage rather than dropping it.
+	*/
+	async postBufferMsFor(deviceId, atMs) {
+		try {
+			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			if (band) return resolveBandBufferMs(band).postMs;
+		} catch (err) {
+			this.deps.logger.warn("recorder: trigger history using the DEFAULT post-buffer — config read failed", {
+				tags: { deviceId },
+				meta: {
+					atMs,
+					error: errMsg(err)
+				}
+			});
+		}
+		return DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec * 1e3;
+	}
+	/**
+	* Fold a qualifying trigger into this device's history and prune what can no
+	* longer keep anything. Synchronous and self-contained so the write cannot
+	* interleave with an await.
+	*/
+	recordTriggerWindow(deviceId, source, atMs, postMs) {
+		const { state, evicted } = recordTrigger(pruneTriggerHistory(this.triggersFor(deviceId), postMs, this.now()), source, atMs, postMs);
+		this.triggers.set(deviceId, state);
+		if (evicted > 0) this.deps.logger.warn("recorder: trigger history full — oldest window(s) evicted, their footage may be discarded", {
+			tags: { deviceId },
+			meta: {
+				source,
+				atMs,
+				postMs,
+				evicted,
+				maxWindows: 32
+			}
+		});
+	}
+	/**
 	* Decide-and-converge for one device: if its active band demands recording now
 	* (continuous always; events within `postBufferSec` of a trigger) and the
 	* device is enabled, ensure its writer set is running; otherwise stop it.
@@ -7784,7 +8165,13 @@ var RecordingController = class {
 			if (this.skippedProfiles.has(deviceId)) await this.fillMissingProfiles(deviceId, config);
 			return;
 		}
-		if (this.attaching.has(deviceId)) return;
+		if (this.attaching.has(deviceId)) {
+			this.deps.logger.debug("recorder: evaluate coalesced into an in-flight attach", {
+				tags: { deviceId },
+				meta: { reconcileTickMs: RECONCILE_TICK_MS }
+			});
+			return;
+		}
 		this.attaching.add(deviceId);
 		const attaching = this.performAttach(deviceId, config);
 		this.attachingTasks.set(deviceId, attaching);
@@ -7850,9 +8237,74 @@ var RecordingController = class {
 	* ZERO footage for hours. If every profile fails, throw so the restore queue
 	* retries the device.
 	*/
+	/**
+	* Wake `deviceId` if it is a sleeping battery camera, once per device at a
+	* time. Concurrent attaches (two profiles, a trigger racing the reconcile)
+	* join the in-flight wake instead of issuing a second one at the radio.
+	*/
+	async wakeBatteryDevice(deviceId) {
+		const inFlight = this.batteryWakes.get(deviceId);
+		if (inFlight) {
+			await inFlight;
+			return;
+		}
+		const wake = this.runBatteryWake(deviceId);
+		this.batteryWakes.set(deviceId, wake);
+		try {
+			await wake;
+		} finally {
+			this.batteryWakes.delete(deviceId);
+		}
+	}
+	/** One wake attempt, fully reported. Absorbs its own failures. */
+	async runBatteryWake(deviceId) {
+		const api = this.deps.api;
+		const result = await wakeForRecording(deviceId, {
+			isBatteryDevice: async (id) => {
+				const dev = await withDeadline(api.deviceManager.getDevice.query({ deviceId: id }), BATTERY_READ_TIMEOUT_MS, "getDevice").catch(() => null);
+				if (!dev) return null;
+				return dev.features.includes(DeviceFeature.BatteryOperated);
+			},
+			readBatteryFacts: async (id) => {
+				const slice = await withDeadline(api.deviceState.getCapSlice.query({
+					deviceId: id,
+					capName: batteryCapability.name
+				}), BATTERY_READ_TIMEOUT_MS, "getCapSlice").catch(() => null);
+				const parsed = BatteryStatusSchema.safeParse(slice);
+				if (!parsed.success) return null;
+				return {
+					sleeping: parsed.data.sleeping,
+					lastContactAt: parsed.data.lastContactAt
+				};
+			},
+			wakeForStream: async (id, timeoutMs) => api.battery.wakeForStream.mutate({
+				deviceId: id,
+				timeoutMs
+			}),
+			nowMs: () => this.now()
+		});
+		if (result.outcome === "not-battery" || result.outcome === "unknown") return;
+		const meta = {
+			outcome: result.outcome,
+			...result.durationMs !== void 0 ? { wakeMs: result.durationMs } : {},
+			...result.error !== void 0 ? { error: result.error } : {}
+		};
+		if (wakeOutcomeLosesFootage(result.outcome)) {
+			this.deps.logger.warn("recorder: battery camera not woken for this trigger — the episode may record NOTHING", {
+				tags: { deviceId },
+				meta
+			});
+			return;
+		}
+		this.deps.logger.info("recorder: battery camera ready for recording", {
+			tags: { deviceId },
+			meta
+		});
+	}
 	async performAttach(deviceId, config) {
 		this.restore?.add(deviceId, true);
 		this.failFastIfBrokerCold(deviceId);
+		await this.wakeBatteryDevice(deviceId);
 		const profiles = await this.resolveProfiles(deviceId, config.profiles);
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
@@ -7975,6 +8427,7 @@ var RecordingController = class {
 	* that feeds finalized flat segments into `SegmentStore.onFinalized`.
 	*/
 	async attachProfile(deviceId, profile, segmentSeconds) {
+		const attachProfileStartMs = this.now();
 		const placement = await this.resolvePlacement(deviceId, profile);
 		const source = await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.getStreamWithCodec.mutate({
 			deviceId,
@@ -7984,14 +8437,28 @@ var RecordingController = class {
 			...this.deps.consumerHostname !== void 0 ? { hostname: this.deps.consumerHostname } : {},
 			tag: `recorder:${deviceId}/${profile}`
 		}, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "getStreamWithCodec"));
+		const streamAcquiredMs = this.now();
+		const rtspUrl = withRecordingIntent(source.url);
+		this.attachSeq++;
+		const consumerTag = `recorder/${deviceId}/${profile}/${this.attachSeq}`;
+		if (rtspUrl === source.url) this.deps.logger.info("recorder: dial carries no recording intent — no pre-roll", {
+			tags: { deviceId },
+			meta: {
+				profile,
+				url: source.url
+			}
+		});
+		const placementDoneMs = this.now();
 		const outDir = path.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
 		await promises.mkdir(outDir, { recursive: true });
+		const mkdirDoneMs = this.now();
 		const deviceLog = this.deps.logger.withTags({ deviceId });
 		const writer = new SegmentWriter({
-			rtspUrl: source.url,
+			rtspUrl,
 			outDir,
 			segmentSeconds,
-			videoCodec: source.videoCodec
+			videoCodec: source.videoCodec,
+			consumerTag
 		}, {
 			spawn: this.deps.spawn,
 			logger: deviceLog,
@@ -8002,6 +8469,18 @@ var RecordingController = class {
 		});
 		const writerStartedMs = this.now();
 		writer.start();
+		this.deps.logger.info("recorder: writer spawned", {
+			tags: { deviceId },
+			meta: {
+				profile,
+				consumer: consumerTag,
+				placementMs: placementDoneMs - attachProfileStartMs,
+				getStreamMs: streamAcquiredMs - placementDoneMs,
+				mkdirMs: mkdirDoneMs - streamAcquiredMs,
+				attachProfileMs: writerStartedMs - attachProfileStartMs,
+				segmentSeconds
+			}
+		});
 		this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
 		return {
 			profile,
@@ -8013,6 +8492,22 @@ var RecordingController = class {
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
+					if (startMs >= writerStartedMs - 1e3 && !this.firstSegmentSeen.has(idleKey(deviceId, profile))) {
+						this.firstSegmentSeen.add(idleKey(deviceId, profile));
+						this.deps.logger.info("recorder: first segment of this attach", {
+							tags: { deviceId },
+							meta: {
+								profile,
+								consumer: consumerTag,
+								file: path.basename(flatAbsPath),
+								durMs,
+								spawnToFirstSegmentMs: startMs - writerStartedMs,
+								finalizeLagMs: this.now() - (startMs + durMs),
+								graceMs: FIRST_SEGMENT_GRACE_MS,
+								segmentSeconds
+							}
+						});
+					}
 					await this.handleFinalizedSegment(deviceId, profile, placement, {
 						attachedAtMs: writerStartedMs,
 						segmentSeconds
@@ -8083,8 +8578,14 @@ var RecordingController = class {
 			profile,
 			startMs,
 			durMs,
-			lastMotionMs: triggers.lastMotionMs,
-			lastAudioMs: triggers.lastAudioMs,
+			motionWindows: triggers.motion.map((w) => ({
+				firstMs: w.firstMs,
+				lastMs: w.lastMs
+			})),
+			audioWindows: triggers.audio.map((w) => ({
+				firstMs: w.firstMs,
+				lastMs: w.lastMs
+			})),
 			postMs,
 			preMs,
 			attachedAtMs: attach.attachedAtMs,
@@ -8158,6 +8659,7 @@ var RecordingController = class {
 		for (const r of recordings) {
 			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
 			this.attachRetained.delete(idleKey(deviceId, r.profile));
+			this.firstSegmentSeen.delete(idleKey(deviceId, r.profile));
 		}
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
@@ -9643,6 +10145,16 @@ var MARKER_PAD_PRE_MS = EVENT_PAD_MS.preMs;
 var MARKER_PAD_POST_MS = EVENT_PAD_MS.postMs;
 /** This addon's manifest id + the playback data-plane prefix — together they
 *  form the hub reverse-proxy client path `/addon/recorder/playback`. */
+/**
+* Row cap for one device's trigger reconcile query.
+*
+* The window asked for is `postBufferSec + TRIGGER_HISTORY_MARGIN_MS` (165 s at
+* the shipped defaults) and the rows all merge into a handful of windows, so
+* this bounds a pathological detector — not normal traffic. Well under the
+* cap's own `MAX_EVENT_QUERY_LIMIT`, because a truncated answer here loses the
+* OLDEST rows, which are the ones carrying an episode's start edge.
+*/
+var TRIGGER_RECONCILE_ROW_LIMIT = 2e3;
 var RECORDER_ADDON_ID = "recorder";
 var PLAYBACK_PREFIX = "playback";
 /** Data-plane prefix for on-demand single stills →
@@ -9946,6 +10458,24 @@ var RecorderV2Addon = class extends BaseAddon {
 			segmentStore: this.segmentStore,
 			loadConfig: (deviceId) => loadDeviceConfig(this.configStore(), deviceId),
 			enabledDeviceIds: async () => [...(await readDeviceConfigs(this.configStore())).keys()],
+			/**
+			* The DURABLE half of the trigger path (D8/D11). `pipelineAnalytics` rows
+			* are single-timestamp SQLite records — the same upstream motion signal
+			* the bus carries, persisted rather than broadcast, so a dropped or
+			* badly-delayed event cannot cost the keep gate an episode.
+			*
+			* `slim` because only `timestamp` is read: the full projection carries a
+			* regions array per row and this runs per camera on every reconcile beat.
+			*/
+			loadMotionEvents: async (deviceId, sinceMs, untilMs) => {
+				return (await this.ctx.api.pipelineAnalytics.getMotionEvents.query({
+					deviceId,
+					since: sinceMs,
+					until: untilMs,
+					limit: TRIGGER_RECONCILE_ROW_LIMIT,
+					projection: "slim"
+				})).map((event) => event.timestamp);
+			},
 			locations: () => this.resolvedLocations,
 			placeProfile: (deviceId, profile) => this.placeProfile(deviceId, profile),
 			onPlacementTick: (deviceIds) => this.recomputePlacement(deviceIds),