@camstack/addon-pipeline 1.2.122 → 1.2.123

package/dist/recorder/index.js

@@ -5288,6 +5288,338 @@ function runFfmpeg(renderDeps, args, ext) {
 		});
 	});
 }
+Object.freeze({
+	"addons": { "getLogs": { "limit": 100 } },
+	"audio-analyzer": { "analyseChunk": { "settings": { "__nested__": {
+		"minConfidence": .3,
+		"allowedClasses": []
+	} } } },
+	"audio-codec": {
+		"pullEncoded": { "maxCount": 8 },
+		"pullPcm": { "maxCount": 8 }
+	},
+	"battery": { "wakeForStream": { "timeoutMs": 8e3 } },
+	"decoder": {
+		"createSession": {
+			"maxFps": 0,
+			"outputFormat": "jpeg",
+			"scale": 1,
+			"frameSink": "callback"
+		},
+		"pullFrames": { "maxCount": 1 },
+		"pullHandles": { "maxCount": 1 }
+	},
+	"device-adoption": { "listCandidates": {
+		"page": 1,
+		"pageSize": 50
+	} },
+	"device-manager": { "adoptionListCandidates": {
+		"page": 1,
+		"pageSize": 50
+	} },
+	"llm": { "upsertProfile": { "profile": { "__nested__": {
+		"timeoutMs": 6e4,
+		"connectTimeoutMs": 1e4,
+		"firstTokenTimeoutMs": 12e4,
+		"idleTimeoutMs": 6e4,
+		"retry": {
+			"enabled": false,
+			"maxAttempts": 1
+		},
+		"toolsEnabled": false
+	} } } },
+	"llm-runtime": {
+		"complete": { "runtime": { "__nested__": {
+			"contextSize": 4096,
+			"gpuLayers": 0,
+			"parallel": 1,
+			"flashAttention": false,
+			"mlock": false,
+			"noMmap": false,
+			"extraArgs": [],
+			"autoStart": false,
+			"idleStopMinutes": 30
+		} } },
+		"ensureStarted": { "runtime": { "__nested__": {
+			"contextSize": 4096,
+			"gpuLayers": 0,
+			"parallel": 1,
+			"flashAttention": false,
+			"mlock": false,
+			"noMmap": false,
+			"extraArgs": [],
+			"autoStart": false,
+			"idleStopMinutes": 30
+		} } }
+	},
+	"mqtt-broker": { "startEmbeddedBroker": {
+		"port": 1883,
+		"allowAnonymous": false
+	} },
+	"nodes": { "getCapUsageGraph": { "windowSeconds": 60 } },
+	"notification-output": { "send": { "notification": { "__nested__": {
+		"format": "text",
+		"priority": 3
+	} } } },
+	"notification-rules": {
+		"createRule": { "rule": { "__nested__": {
+			"enabled": true,
+			"conditions": {},
+			"media": { "attach": "best" },
+			"throttle": {
+				"cooldownSec": 60,
+				"scope": "rule-device"
+			},
+			"priority": 3
+		} } },
+		"getHistory": { "filter": { "limit": 100 } },
+		"testRule": {
+			"rule": { "__nested__": {
+				"enabled": true,
+				"conditions": {},
+				"media": { "attach": "best" },
+				"throttle": {
+					"cooldownSec": 60,
+					"scope": "rule-device"
+				},
+				"priority": 3
+			} },
+			"lookbackMinutes": 60
+		}
+	},
+	"osd-manager": { "setSlotBinding": { "binding": { "__nested__": {
+		"enabled": true,
+		"template": "${value}",
+		"maxDecimals": 1,
+		"fallbackText": ""
+	} } } },
+	"pipeline-analytics": {
+		"getAudioEvents": { "limit": 1e3 },
+		"getKeyEvents": { "limit": 50 },
+		"getMotionEvents": { "limit": 1e3 },
+		"getObjectEvents": { "limit": 1e3 },
+		"getSensorEvents": { "limit": 1e3 },
+		"listGroups": { "limit": 40 },
+		"listRecentTracks": { "limit": 200 },
+		"searchObjectEvents": {
+			"limit": 50,
+			"minScore": .2
+		}
+	},
+	"pipeline-runner": {
+		"attachCamera": {
+			"detectionMode": "on-motion",
+			"audioMode": "always-on",
+			"motionCooldownMs": 3e4,
+			"motionFps": 4,
+			"detectionFps": 10,
+			"motionSources": ["analyzer"],
+			"pipelineEnabled": true,
+			"zones": [],
+			"onboardMotionDrivesAnalyzer": true,
+			"occupancyRecheckEnabled": true,
+			"occupancyRecheckSec": 300,
+			"occupancyRecheckFrames": 4,
+			"frameSource": { "kind": "local-broker" }
+		},
+		"reportMotion": { "source": "analyzer" }
+	},
+	"recording": {
+		"renderClip": {
+			"preRollSec": 3,
+			"postRollSec": 7,
+			"maxWidth": 640
+		},
+		"renderGif": {
+			"preRollSec": 2,
+			"postRollSec": 5,
+			"maxWidth": 480,
+			"fps": 5
+		},
+		"setDeviceConfig": { "config": { "__nested__": { "bands": [] } } }
+	},
+	"storage": { "upsertLocation": {
+		"isDefault": false,
+		"isSystem": false
+	} },
+	"storage-provider": {
+		"beginDownload": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"beginUpload": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"delete": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"exists": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"getAvailableSpace": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"list": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"read": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"resolve": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } },
+		"write": { "location": { "__nested__": {
+			"isDefault": false,
+			"isSystem": false
+		} } }
+	},
+	"stream-broker": {
+		"produceEventMedia": {
+			"preSeconds": 4,
+			"postSeconds": 6,
+			"kinds": ["mp4"],
+			"gifMaxWidth": 640,
+			"gifFps": 12,
+			"gifSpeed": 4,
+			"speed": 4
+		},
+		"pullAudioChunks": { "maxCount": 8 },
+		"pullFrameHandles": { "maxCount": 4 },
+		"renderPreBufferClip": {
+			"preRollSec": 3,
+			"postRollSec": 5,
+			"format": "gif",
+			"maxWidth": 480,
+			"fps": 5,
+			"speed": 2
+		}
+	},
+	"terminal-session": { "pullOutput": { "waitMs": 0 } },
+	"user-management": {
+		"createApiKey": { "isAdmin": false },
+		"createUser": { "isAdmin": false }
+	},
+	"vector-store": { "declareIndex": { "metric": "cosine" } },
+	"zones": {
+		"addZone": { "zone": { "__nested__": {
+			"kind": "polygon",
+			"color": "#3b82f6"
+		} } },
+		"updateZone": { "zone": { "__nested__": {
+			"kind": "polygon",
+			"color": "#3b82f6"
+		} } }
+	}
+});
+Object.freeze({
+	"addon-pages-source": ["listPages"],
+	"addon-routes": ["getRoutes"],
+	"addon-widgets-source": ["listWidgets"],
+	"broker": ["list", "listProviders"],
+	"custom-model-registry": ["listModels"],
+	"data-store-provider": ["histogram", "query"],
+	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
+	"device-provider": ["discoverDevices", "getDevices"],
+	"llm": [
+		"getDefaults",
+		"getUsage",
+		"listModelCatalog",
+		"listModels",
+		"listNodeModels",
+		"listProfileKinds",
+		"listProfiles",
+		"listRuntimeNodes"
+	],
+	"log-destination": ["query"],
+	"login-method": ["getLoginMethods"],
+	"mqtt-broker": ["listBrokers"],
+	"network-access": ["listEndpoints"],
+	"notification-output": [
+		"discoverTargets",
+		"listTargetKinds",
+		"listTargets"
+	],
+	"storage-provider": ["list"],
+	"turn-provider": ["getTurnServers"],
+	"user-passkeys": ["listPasskeys"]
+});
+//#endregion
+//#region src/recorder/addon/last-known-config.ts
+/**
+* Wrap `load` so a failed read serves the last value that succeeded.
+*
+* Returns a drop-in replacement for {@link LoadDeviceConfigFn}: every existing
+* call site gains the fallback without changing, which is the point — the
+* trigger post-buffer was the path that got CAUGHT writing a wrong number, but
+* it is one of five reads and the other four fail the same way.
+*/
+function withLastKnownConfig(deps) {
+	const now = deps.now ?? (() => Date.now());
+	const cache = /* @__PURE__ */ new Map();
+	return async (deviceId) => {
+		try {
+			const config = await deps.load(deviceId);
+			cache.set(deviceId, {
+				config,
+				atMs: now()
+			});
+			return config;
+		} catch (err) {
+			const cached = cache.get(deviceId);
+			if (cached === void 0) {
+				deps.logger.warn("recorder: config read failed and NOTHING is cached for this camera — no last-known-good to serve", {
+					tags: { deviceId },
+					meta: { error: require_dist.errMsg(err) }
+				});
+				throw err;
+			}
+			const ageMs = now() - cached.atMs;
+			deps.logger.warn("recorder: config read failed — serving the LAST-KNOWN-GOOD config (not the shipped default)", {
+				tags: { deviceId },
+				meta: {
+					ageMs,
+					error: require_dist.errMsg(err)
+				}
+			});
+			return cached.config;
+		}
+	};
+}
+//#endregion
+//#region src/recorder/addon/location-capacity.ts
+/** Human-readable failure text for a thrown value of unknown shape. */
+function reasonOf(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Free + total bytes on the volume backing `root`.
+*
+* Never throws: an unreachable volume is one degraded ROW, not a failed
+* `getStorageUsage` — a NAS that stops answering must not blank the capacity of
+* every other disk on the node.
+*/
+async function readLocationCapacity(root, statfs) {
+	try {
+		const st = await statfs(root);
+		return {
+			availableBytes: st.bavail * st.bsize,
+			totalBytes: st.blocks * st.bsize
+		};
+	} catch (err) {
+		return {
+			availableBytes: null,
+			totalBytes: null,
+			error: reasonOf(err)
+		};
+	}
+}
 //#endregion
 //#region src/recorder/addon/ops-log-store.ts
 /**
@@ -9178,223 +9510,494 @@ function makeBrokerCall(handle) {
 	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
 //#endregion
-//#region src/recorder/addon/location-capacity.ts
-/** Human-readable failure text for a thrown value of unknown shape. */
-function reasonOf(err) {
-	return err instanceof Error ? err.message : String(err);
-}
+//#region src/recorder/addon/recording-export-provider.ts
+/** Content type of every rendered export — the engine only ever writes MP4. */
+var EXPORT_CONTENT_TYPE = "video/mp4";
+/** Filename bound, extension included. Long enough to stay recognisable. */
+var EXPORT_NAME_MAX = 64;
 /**
-* Free + total bytes on the volume backing `root`.
+* The filename a RECIPIENT sees on the attachment.
 *
-* Never throws: an unreachable volume is one degraded ROW, not a failed
-* `getStorageUsage` — a NAS that stops answering must not blank the capacity of
-* every other disk on the node.
+* Derived from the operator's own export title so a delivered video is
+* identifiable in a chat thread, but slugified and BOUNDED: the title field
+* accepts 200 characters and several notifier backends silently mangle a
+* filename that long. No usable title degrades to the export id, never to an
+* empty name.
 */
-async function readLocationCapacity(root, statfs) {
-	try {
-		const st = await statfs(root);
-		return {
-			availableBytes: st.bavail * st.bsize,
-			totalBytes: st.blocks * st.bsize
-		};
-	} catch (err) {
-		return {
-			availableBytes: null,
-			totalBytes: null,
-			error: reasonOf(err)
-		};
-	}
+function exportFileName(rec) {
+	const slug = (rec.title ?? "").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, EXPORT_NAME_MAX - 4).replace(/-+$/g, "");
+	return slug.length > 0 ? `${slug}.mp4` : `export-${rec.id}.mp4`;
 }
-//#endregion
-//#region src/recorder/addon/retired-root-keys.ts
-var RECORDER_RETIRED_ROOT_KEYS = [
-	{
-		key: "recordingOpsLog",
-		successor: RECORDING_OPS_LOG_COLLECTION,
-		reason: "the audit ring is one row per operation since the flatten; as a blob it was 147 KB of the 201 KB root row, re-parsed by every unrelated reader of that row"
-	},
-	{
-		key: "recordingExports",
-		successor: RECORDING_EXPORTS_COLLECTION,
-		reason: "one row per export job since the flatten; as a blob a once-a-second progress patch rewrote 201 KB, and an overlapping createExport erased the row (2026-08-14)"
-	},
-	{
-		key: "recordingConfigs",
-		successor: RECORDING_CONFIGS_COLLECTION,
-		reason: "one row per camera since the flatten; as a blob, asking what camera 617 records parsed every camera in the installation"
-	}
-];
-//#endregion
-//#region src/durable/durable-ledger.ts
-/** Default reseed cap — every current consumer's row set is installation-bounded. */
-var DEFAULT_LOAD_LIMIT = 1e5;
-var DurableLedger = class DurableLedger {
-	mirror = /* @__PURE__ */ new Map();
-	spec;
-	store;
-	logger;
-	constructor(deps) {
-		this.spec = deps.spec;
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	/**
-	* Register the collection. MUST run at boot, before any read or write: the
-	* SQLite backend answers 412 for an undeclared collection and takes the whole
-	* runner down with it (the addon-ai boot-crash lesson).
-	*/
-	static declare(store, spec) {
-		return store.declareCollection.mutate({
-			collection: spec.collection,
-			columns: [...spec.columns],
-			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
-		});
-	}
-	declare() {
-		return DurableLedger.declare(this.store, this.spec);
-	}
-	/** The collection this ledger owns — for the caller's own log lines. */
-	get collection() {
-		return this.spec.collection;
-	}
-	/**
-	* Boot reseed. Replaces the mirror with what the store holds and returns the
-	* rows, so a caller that must hydrate something else (a watcher, a registry)
-	* gets them without a second read.
-	*
-	* **A failure returns what is already mirrored** rather than clearing it —
-	* see contract rule 2. The count is worth logging out loud at the call site:
-	* "loaded 0" after a container recreate is the one line that explains a
-	* silent flood.
-	*/
-	async load() {
-		try {
-			const records = await this.store.query.query({
-				collection: this.spec.collection,
-				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
-			});
-			const next = /* @__PURE__ */ new Map();
-			let skipped = 0;
-			for (const record of records) {
-				const row = this.spec.fromRecord(record.id, record.data);
-				if (row === null) {
-					skipped += 1;
-					continue;
-				}
-				next.set(this.spec.keyOf(row), row);
+/**
+* True when at least one indexed segment overlaps `[fromMs, toMs)`. Mirrors the
+* `buildPlaybackManifest` overlap idiom: a segment `[startMs, startMs+durMs)`
+* overlaps the window iff it starts before the window ends AND ends after the
+* window starts.
+*/
+async function hasFootage(index, deviceId, profile, fromMs, toMs) {
+	return (await index.segmentsInWindow(deviceId, profile, fromMs, toMs)).some((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs);
+}
+/** Canonical `profiles[]`, falling back to the legacy singular `profile`. */
+function resolveExportProfiles(input) {
+	if (input.profiles !== void 0 && input.profiles.length > 0) return [...input.profiles];
+	if (typeof input.profile === "string" && input.profile.length > 0) return [input.profile];
+	return [];
+}
+/** Load a record or throw a clear NOT_FOUND-style error. */
+async function requireRecord(state, exportId) {
+	const rec = await getExportRecord(state, exportId);
+	if (!rec) throw new Error(`recording-export: unknown export "${exportId}"`);
+	return rec;
+}
+/** Build the `recordingExport` provider over the injected deps. */
+function buildRecordingExportProvider(deps) {
+	return {
+		createExport: async (input) => {
+			const { deviceId, fromMs, toMs, options } = input;
+			const profiles = resolveExportProfiles(input);
+			if (profiles.length < 1) throw new Error("recording-export: profiles must contain at least one profile");
+			if (!(fromMs < toMs)) throw new Error(`recording-export: invalid range ${fromMs}..${toMs}`);
+			for (const profile of profiles) if (!await hasFootage(deps.index, deviceId, profile, fromMs, toMs)) throw new Error(`recording-export: no footage for ${deviceId}/${profile} in ${fromMs}..${toMs}`);
+			const now = deps.now();
+			let first = null;
+			for (const profile of profiles) {
+				const record = {
+					id: deps.newId(),
+					deviceId,
+					profile,
+					fromMs,
+					toMs,
+					options,
+					state: "queued",
+					progressPct: null,
+					fileBytes: null,
+					expiresAt: now + options.maxLifeMs,
+					deleteAfterDownload: options.deleteAfterDownload,
+					downloadedAt: null,
+					createdAt: now,
+					createdBy: deps.createdBy(),
+					error: null
+				};
+				const saved = await upsertExport(deps.state, record);
+				deps.engine.enqueue(saved.id);
+				first ??= saved;
 			}
-			this.mirror.clear();
-			for (const [key, row] of next) this.mirror.set(key, row);
-			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
-				collection: this.spec.collection,
-				skipped
-			} });
-			return [...this.mirror.values()];
-		} catch (err) {
-			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
-				collection: this.spec.collection,
-				error: String(err),
-				held: this.mirror.size
-			} });
-			return [...this.mirror.values()];
+			return first;
+		},
+		listExports: ({ deviceId }) => listExportsFor(deps.state, deviceId),
+		getExport: ({ exportId }) => requireRecord(deps.state, exportId),
+		cancelExport: async ({ exportId }) => {
+			const existing = await requireRecord(deps.state, exportId);
+			await deps.engine.cancel(exportId);
+			return await getExportRecord(deps.state, exportId) ?? existing;
+		},
+		deleteExport: async ({ exportId }) => {
+			const existing = await requireRecord(deps.state, exportId);
+			await deps.removeFile(deps.outPath(existing));
+			return await patchExport(deps.state, exportId, {
+				state: "deleted",
+				fileBytes: null
+			}) ?? existing;
+		},
+		getDownloadUrl: async ({ exportId }) => {
+			await requireRecord(deps.state, exportId);
+			const url = deps.downloadUrlFor(exportId);
+			return {
+				url,
+				endpoints: [url]
+			};
+		},
+		readExportBytes: async ({ exportId }) => {
+			const rec = await requireRecord(deps.state, exportId);
+			const tags = { deviceId: rec.deviceId };
+			if (rec.state !== "ready") {
+				deps.logger.warn("export byte read refused: export is not ready", {
+					tags,
+					meta: {
+						exportId,
+						state: rec.state
+					}
+				});
+				throw new Error(`recording-export: export "${exportId}" is not ready (${rec.state})`);
+			}
+			if (deps.now() >= rec.expiresAt) {
+				deps.logger.warn("export byte read refused: export has expired", {
+					tags,
+					meta: {
+						exportId,
+						expiresAt: rec.expiresAt
+					}
+				});
+				throw new Error(`recording-export: export "${exportId}" has expired`);
+			}
+			const file = deps.outPath(rec);
+			let size;
+			try {
+				size = await deps.statBytes(file);
+			} catch (err) {
+				deps.logger.warn("export byte read refused: file is missing", {
+					tags,
+					meta: {
+						exportId,
+						error: String(err)
+					}
+				});
+				throw new Error(`recording-export: export "${exportId}" has no file on disk`, { cause: err });
+			}
+			if (size > 52428800) {
+				deps.logger.warn("export byte read refused: file is too large to inline", {
+					tags,
+					meta: {
+						exportId,
+						bytes: size,
+						maxBytes: require_dist.RECORDING_EXPORT_MAX_READ_BYTES
+					}
+				});
+				throw new Error(`recording-export: export "${exportId}" is too large to read inline (${size} > ${require_dist.RECORDING_EXPORT_MAX_READ_BYTES} bytes)`);
+			}
+			const bytes = await deps.readFile(file);
+			return {
+				base64: bytes.toString("base64"),
+				contentType: EXPORT_CONTENT_TYPE,
+				name: exportFileName({
+					id: rec.id,
+					...rec.options.title !== void 0 ? { title: rec.options.title } : {}
+				}),
+				bytes: bytes.byteLength
+			};
 		}
-	}
-	/** Every mirrored row, insertion-ordered. */
-	snapshot() {
-		return [...this.mirror.values()];
-	}
-	/** The row currently held for a key, if any. Pure RAM — never I/O. */
-	get(key) {
-		return this.mirror.get(key);
-	}
-	has(key) {
-		return this.mirror.has(key);
-	}
-	get size() {
-		return this.mirror.size;
+	};
+}
+//#endregion
+//#region src/recorder/addon/recording-hub-host.ts
+/**
+* Resolve the host a REMOTE recording node should use to dial the hub-only
+* stream-broker's restream port.
+*
+* The implementation was promoted to the package-shared
+* `src/shared/hub-hostname.ts` in P2d (cross-node Phase 2) so the
+* pipeline-runner's remote-source leg shares the exact same resolver instead
+* of copying it. This module keeps the recorder-facing name as a thin alias —
+* resolution order and semantics are unchanged (operator override first, then
+* the host extracted from `CAMSTACK_HUB_URL`).
+*/
+var resolveRecordingHubHostname = require_hub_hostname.resolveHubHostname;
+//#endregion
+//#region src/recorder/addon/retention-sweep.ts
+/**
+* Periodic footage-retention sweep (recording-spec §6).
+*
+* The disk-pressure eviction path only fires when a volume is TOO FULL
+* (`shouldSaveDiskSpace` + `minFreePercent`); it never enforces a camera's
+* age/size policy. This sweeper closes that gap: on an hourly cadence it prunes
+* footage for every device whose operator set an actionable `retention` policy,
+* delegating the actual selection + delete to the `recording` cap's
+* `pruneFootage` (which owns the retention FLOOR via `selectEvictions` — this
+* sweeper only decides WHICH devices to prune and WHEN).
+*
+* Owns its own timer + single-flight guard so a slow sweep is never overlapped
+* by the next tick — the same subsystem-owns-its-timer shape as the
+* export janitor. Pure over injected deps (config read + prune + logger +
+* clock via `setInterval`), so it is unit-testable with fake timers and a mock
+* `prune`. Every pass is best-effort: a per-device prune failure is logged and
+* never aborts the rest, and the sweep never throws.
+*/
+/**
+* True when the operator set an ACTIONABLE retention policy on a device — at
+* least one of `maxAgeDays` / `maxSizeGb` is present and positive. Mirrors the
+* `> 0` guards `selectEvictions` itself applies, so a `0`/absent limit (which
+* inherits the node default = "keep forever") is treated as NO policy and the
+* device is skipped. NEVER prune a device without an explicit policy — that
+* would delete footage the operator never asked to age out.
+*/
+function hasRetentionPolicy(config) {
+	const retention = config.retention;
+	if (!retention) return false;
+	const byAge = retention.maxAgeDays != null && retention.maxAgeDays > 0;
+	const bySize = retention.maxSizeGb != null && retention.maxSizeGb > 0;
+	return byAge || bySize;
+}
+var RetentionSweeper = class {
+	deps;
+	timer = null;
+	/** Single-flight guard: true while a sweep is in flight. */
+	sweeping = false;
+	constructor(deps) {
+		this.deps = deps;
 	}
 	/**
-	* Judge ONE observation against what the ledger already accepted, and advance
-	* it.
-	*
-	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
-	* alone, so a decision can never be gated on an I/O that might fail (D49).
-	* The durable write is kicked off behind it and its failure changes no
-	* verdict.
-	*
-	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
-	* carries, which therefore means "when this key last CHANGED", not "when it
-	* last spoke". That is the timestamp anyone reading the table wants.
+	* Arm the sweep: run immediately, then on the interval. Idempotent — a second
+	* `start()` while already armed is a no-op. The timer is `unref`'d so it never
+	* keeps the process alive.
 	*/
-	observe(row) {
-		const equalFact = this.spec.equalFact;
-		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
-		const key = this.spec.keyOf(row);
-		const held = this.mirror.get(key);
-		if (held !== void 0 && equalFact(held, row)) return "no-flip";
-		this.mirror.set(key, row);
-		this.persist(row);
-		return held === void 0 ? "seeded" : "flip";
+	start() {
+		if (this.timer !== null) return;
+		const tick = () => {
+			this.sweep();
+		};
+		tick();
+		this.timer = setInterval(tick, this.deps.intervalMs);
+		this.timer.unref?.();
 	}
-	/**
-	* Upsert a row without a verdict — the write path for a ledger whose owner
-	* has already decided the value changed.
-	*
-	* The order of the mirror advance and the durable write is the spec's
-	* {@link DurableWriteMode}, not the call site's: two call sites that
-	* disagreed about it would be two different durability guarantees on one
-	* collection.
-	*/
-	async put(row) {
-		const key = this.spec.keyOf(row);
-		if (this.spec.writeMode === "write-behind") {
-			this.mirror.set(key, row);
-			await this.persist(row);
-			return;
+	/** Stop the sweep timer. Idempotent. An in-flight sweep still completes. */
+	stop() {
+		if (this.timer !== null) {
+			clearInterval(this.timer);
+			this.timer = null;
 		}
-		await this.store.set.mutate({
-			collection: this.spec.collection,
-			key,
-			value: this.spec.toValue(row)
-		});
-		this.mirror.set(key, row);
-	}
-	/**
-	* Advance the mirror WITHOUT persisting, for an owner that deliberately
-	* coalesces its writes.
-	*
-	* The stationary registry is the reason this exists: a parked car is
-	* re-confirmed on every processed frame (5–30 Hz), and persisting each
-	* confirmation would offer thousands of commits a day to the checkpoint
-	* lottery (D96) to maintain a handful of rows. It stages the advance and
-	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
-	*
-	* **The cost is stated, not hidden**: a staged value that is never flushed
-	* is lost on a crash. An owner may only stage a field whose staleness its
-	* own TTL absorbs. Anything that GATES work must go through {@link put} or
-	* {@link observe}.
-	*/
-	stage(row) {
-		this.mirror.set(this.spec.keyOf(row), row);
-	}
-	/**
-	* Drop a key from the MIRROR only — the durable row survives.
-	*
-	* What a scope-unbind needs: this process stops holding the value, and a
-	* rebind reloads it from the store. Deliberately distinct from
-	* {@link forget}, which deletes; conflating the two is how an unbind turns
-	* into a wipe.
-	*/
-	evict(key) {
-		this.mirror.delete(key);
 	}
 	/**
-	* Drop one key, mirror and row. Best-effort on the durable half: a failed
-	* delete leaves a row that the next load will re-mirror, which is a stale
-	* value rather than a lost one.
+	* One retention pass. Single-flighted: a call that fires while a previous
+	* sweep is still running is a no-op. Never throws — a config-read failure
+	* aborts THIS pass (logged); a per-device prune failure is logged and the
+	* sweep continues with the remaining devices.
 	*/
-	async forget(key) {
-		this.mirror.delete(key);
+	async sweep() {
+		if (this.sweeping) {
+			this.deps.logger.debug("recorder: retention sweep already running — skipping this tick");
+			return;
+		}
+		this.sweeping = true;
+		try {
+			let configs;
+			try {
+				configs = await this.deps.readConfigs();
+			} catch (err) {
+				this.deps.logger.warn("recorder: retention sweep could not read device configs", { meta: { error: require_dist.errMsg(err) } });
+				return;
+			}
+			const withPolicy = [...configs].filter(([, config]) => hasRetentionPolicy(config));
+			const devicesSkipped = configs.size - withPolicy.length;
+			this.deps.logger.info("recorder: retention sweep starting", { meta: {
+				devices: withPolicy.map(([deviceId]) => deviceId),
+				skipped: devicesSkipped
+			} });
+			let devicesSwept = 0;
+			let bucketsPruned = 0;
+			let bytesReclaimed = 0;
+			for (const [deviceId] of withPolicy) {
+				const startedMs = Date.now();
+				try {
+					const result = await this.deps.prune(deviceId);
+					devicesSwept += 1;
+					bucketsPruned += result.deletedBuckets;
+					bytesReclaimed += result.reclaimedBytes;
+					this.deps.logger.info("recorder: retention prune complete for device", {
+						tags: { deviceId },
+						meta: {
+							deletedBuckets: result.deletedBuckets,
+							reclaimedBytes: result.reclaimedBytes,
+							ms: Date.now() - startedMs
+						}
+					});
+				} catch (err) {
+					this.deps.logger.warn("recorder: retention prune failed for device", {
+						tags: { deviceId },
+						meta: { error: require_dist.errMsg(err) }
+					});
+				}
+			}
+			this.deps.logger.info("recorder: retention sweep complete", { meta: {
+				devicesSwept,
+				devicesSkipped,
+				bucketsPruned,
+				bytesReclaimed
+			} });
+		} finally {
+			this.sweeping = false;
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/retired-root-keys.ts
+var RECORDER_RETIRED_ROOT_KEYS = [
+	{
+		key: "recordingOpsLog",
+		successor: RECORDING_OPS_LOG_COLLECTION,
+		reason: "the audit ring is one row per operation since the flatten; as a blob it was 147 KB of the 201 KB root row, re-parsed by every unrelated reader of that row"
+	},
+	{
+		key: "recordingExports",
+		successor: RECORDING_EXPORTS_COLLECTION,
+		reason: "one row per export job since the flatten; as a blob a once-a-second progress patch rewrote 201 KB, and an overlapping createExport erased the row (2026-08-14)"
+	},
+	{
+		key: "recordingConfigs",
+		successor: RECORDING_CONFIGS_COLLECTION,
+		reason: "one row per camera since the flatten; as a blob, asking what camera 617 records parsed every camera in the installation"
+	}
+];
+//#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
 		try {
 			await this.store.delete.mutate({
 				collection: this.spec.collection,
@@ -9416,707 +10019,408 @@ var DurableLedger = class DurableLedger {
 	* is a method a feature opts into rather than a policy the primitive runs.
 	* Best-effort per row: a failed delete keeps the key (retried next prune)
 	* rather than aborting the sweep.
-	*/
-	async pruneExcept(activeKeys) {
-		let pruned = 0;
-		for (const key of [...this.mirror.keys()]) {
-			if (activeKeys.has(key)) continue;
-			try {
-				await this.store.delete.mutate({
-					collection: this.spec.collection,
-					key
-				});
-				this.mirror.delete(key);
-				pruned += 1;
-			} catch (err) {
-				this.logger.debug("durable prune delete failed", { meta: {
-					collection: this.spec.collection,
-					key,
-					error: String(err)
-				} });
-			}
-		}
-		return pruned;
-	}
-	/**
-	* Write-behind durable upsert. Best-effort and logged, never thrown at the
-	* decision path: the mirror already holds the truth for this process, and the
-	* worst a lost write can do is one silent re-seed after the next restart.
-	*/
-	async persist(row) {
-		const deviceId = this.spec.deviceIdOf?.(row);
-		try {
-			await this.store.set.mutate({
-				collection: this.spec.collection,
-				key: this.spec.keyOf(row),
-				value: this.spec.toValue(row)
-			});
-		} catch (err) {
-			this.logger.warn("durable persist failed — this key may re-seed on boot", {
-				...deviceId !== void 0 ? { tags: { deviceId } } : {},
-				meta: {
-					collection: this.spec.collection,
-					key: this.spec.keyOf(row),
-					error: String(err)
-				}
-			});
-		}
-	}
-};
-//#endregion
-//#region src/recorder/addon/segment-hour-ledger.ts
-var HOUR_MS$1 = 36e5;
-/**
-* @durable class=mirror owner=recorder
-*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
-*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
-*/
-var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
-var RECORDING_SEGMENT_HOURS_COLUMNS = [
-	{
-		name: "key",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "profile",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "locationId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "hourStartMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "paths",
-		type: "TEXT",
-		notNull: true
-	}
-];
-var RECORDING_SEGMENT_HOURS_INDEXES = [{
-	name: "idx_recorder_segment_hours_device",
-	columns: ["deviceId"]
-}, {
-	name: "idx_recorder_segment_hours_hour",
-	columns: ["hourStartMs"]
-}];
-/**
-* The largest share of a device's held hours a single walk may delete.
-*
-* On 2026-08-19 the recorder respawned while `/recordings` was an empty tmpfs —
-* the UD disk had not mounted — and one walk took the ledger from 873 hours to
-* 32 (a 96% drop). The ledger is precisely what lets the NEXT boot skip a
-* ~400 s recursive walk, so a single bad walk taxed every boot after it. A
-* retention sweep does not delete half a camera's archive in one pass; a
-* `readdir` over an unmounted root deletes all of it.
-*/
-var LEDGER_PRUNE_MAX_SHARE = .5;
-function hourStartMs(startMs) {
-	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
-}
-function segmentHourKey(deviceId, profile, locationId, hour) {
-	return `${deviceId}|${profile}|${locationId}|${hour}`;
-}
-function hourOf(row) {
-	const hour = hourStartMs(row.startMs);
-	return {
-		hourStartMs: hour,
-		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
-	};
-}
-function uniquePaths(paths) {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const p of paths) {
-		if (seen.has(p)) continue;
-		seen.add(p);
-		out.push(p);
-	}
-	return out;
-}
-function samePaths(a, b) {
-	if (a.length !== b.length) return false;
-	const set = new Set(a);
-	for (const p of b) if (!set.has(p)) return false;
-	return true;
-}
-function rowToValue(row) {
-	return {
-		deviceId: row.deviceId,
-		profile: row.profile,
-		locationId: row.locationId,
-		hourStartMs: row.hourStartMs,
-		paths: JSON.stringify(row.paths)
-	};
-}
-function recordToRow(key, data) {
-	const deviceId = Number(data["deviceId"]);
-	const profile = data["profile"];
-	const locationId = data["locationId"];
-	const hour = Number(data["hourStartMs"]);
-	let raw = data["paths"];
-	if (typeof raw === "string") try {
-		raw = JSON.parse(raw);
-	} catch {
-		return null;
-	}
-	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
-	return {
-		key,
-		deviceId,
-		profile,
-		locationId,
-		hourStartMs: hour,
-		paths: raw
-	};
-}
-var SPEC = {
-	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
-	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
-	writeMode: "write-behind",
-	loadLimit: 1e5,
-	keyOf: (row) => row.key,
-	toValue: rowToValue,
-	fromRecord: recordToRow,
-	deviceIdOf: (row) => row.deviceId
-};
-var SegmentHourLedger = class {
-	ledger;
-	logger;
-	isLocationUsable;
-	constructor(deps) {
-		this.logger = deps.logger;
-		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
-		this.ledger = new DurableLedger({
-			spec: SPEC,
-			store: deps.store,
-			logger: deps.logger
-		});
-	}
-	static declare(store) {
-		return DurableLedger.declare(store, SPEC);
-	}
-	declare() {
-		return this.ledger.declare();
-	}
-	async load() {
-		const rows = await this.ledger.load();
-		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
-			hours: rows.length,
-			collection: RECORDING_SEGMENT_HOURS_COLLECTION
-		} });
-		return rows;
-	}
-	snapshot() {
-		return this.ledger.snapshot();
-	}
-	/**
-	* Seed {@link RecordingIndex} from the mirrored hour rows.
-	*
-	* Hours present in the ledger become `hydrated` so a seek in those windows
-	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
-	* — that is the fail-toward-walk direction.
-	*/
-	hydrateIndex(index) {
-		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
-	}
-	/** Write-behind: a just-finalized segment joins its hour row. */
-	async recordSegment(row) {
-		const { key, hourStartMs: hour } = hourOf(row);
-		const held = this.ledger.get(key);
-		if (held !== void 0 && held.paths.includes(row.path)) return;
-		await this.ledger.put({
-			key,
-			deviceId: row.deviceId,
-			profile: row.profile,
-			locationId: row.locationId,
-			hourStartMs: hour,
-			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
-		});
-	}
-	/**
-	* Eviction confirmed these paths are gone from disk. Drop them; forget the
-	* hour when it holds nothing.
-	*/
-	async dropSegments(rows) {
-		const doomed = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			const { key } = hourOf(row);
-			let set = doomed.get(key);
-			if (!set) {
-				set = /* @__PURE__ */ new Set();
-				doomed.set(key, set);
-			}
-			set.add(row.path);
-		}
-		for (const [key, paths] of doomed) {
-			const held = this.ledger.get(key);
-			if (held === void 0) continue;
-			const next = held.paths.filter((p) => !paths.has(p));
-			if (next.length === 0) {
-				await this.ledger.forget(key);
-				continue;
-			}
-			if (next.length === held.paths.length) continue;
-			await this.ledger.put({
-				...held,
-				paths: next
-			});
-		}
-	}
-	/**
-	* After a disk walk of `deviceIds`, make the ledger match the index — with
-	* two D148 exceptions:
-	*
-	*  - an hour the walk did not see is dropped ONLY if it is in the past;
-	*    the current hour may still hold a live writer whose file the readdir
-	*    raced;
-	*  - the current hour UNIONs ledger paths with index paths rather than
-	*    replacing, for the same race.
-	*
-	* Devices not in `deviceIds` are left untouched (a partial walk must not
-	* prune cameras it did not look at).
-	*
-	* And a walk this ledger does not TRUST prunes nothing at all — see
-	* {@link refusedPrunes}. What such a walk FOUND is still real, so its paths
-	* are unioned in; what it did not find decides nothing (D49).
-	*/
-	async reconcileFromIndex(index, deviceIds, nowMs) {
-		const walked = new Set(deviceIds);
-		const currentHour = hourStartMs(nowMs);
-		const fromIndex = /* @__PURE__ */ new Map();
-		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
-			const { key, hourStartMs: hour } = hourOf(seg);
-			const existing = fromIndex.get(key);
-			if (existing === void 0) fromIndex.set(key, {
-				key,
-				deviceId: seg.deviceId,
-				profile: seg.profile,
-				locationId: seg.locationId,
-				hourStartMs: hour,
-				paths: [seg.path]
-			});
-			else fromIndex.set(key, {
-				...existing,
-				paths: [...existing.paths, seg.path]
-			});
-		}
-		const refused = this.refusedPrunes(walked, fromIndex);
-		for (const row of this.ledger.snapshot()) {
-			if (!walked.has(row.deviceId)) continue;
-			const disk = fromIndex.get(row.key);
-			const additiveOnly = row.hourStartMs === currentHour || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
-			if (disk === void 0) {
-				if (additiveOnly) continue;
-				await this.ledger.forget(row.key);
-				continue;
-			}
-			if (additiveOnly) {
-				const union = uniquePaths([...disk.paths, ...row.paths]);
-				if (!samePaths(union, row.paths)) await this.ledger.put({
-					...row,
-					paths: union
-				});
-				continue;
-			}
-			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
-		}
-		for (const [key, disk] of fromIndex) {
-			if (this.ledger.has(key)) continue;
-			await this.ledger.put(disk);
-		}
-	}
-	/**
-	* Which of this walk's deletions are REFUSED, and why.
-	*
-	* Two independent reasons, because the live fault of 2026-08-19 would have
-	* escaped either one alone:
-	*
-	* - **the volume said no.** `PlacementService`'s marker probe knows the bytes
-	*   under a root are not the bytes we wrote. A walk of such a root found
-	*   nothing because nothing is mounted there, not because the footage is
-	*   gone.
-	* - **the magnitude said no.** At BOOT the probe has not run yet — it runs at
-	*   the first writer attach — so on the morning the recorder respawned onto an
-	*   empty tmpfs the volume was not flagged and the prune went through: 873
-	*   hours to 32. A walk that deletes more than
-	*   {@link LEDGER_PRUNE_MAX_SHARE} of a device's held hours is refused on its
-	*   size alone.
-	*
-	* A refusal is one line per device (or per device+location), carrying the
-	* delta, tagged with `deviceId` — a ledger that silently declined to prune and
-	* a ledger with nothing to prune must never read the same.
-	*/
-	refusedPrunes(walked, fromIndex) {
-		const heldByDevice = /* @__PURE__ */ new Map();
-		const unusable = /* @__PURE__ */ new Map();
-		for (const row of this.ledger.snapshot()) {
-			if (!walked.has(row.deviceId)) continue;
-			heldByDevice.set(row.deviceId, (heldByDevice.get(row.deviceId) ?? 0) + 1);
-			if (this.isLocationUsable(row.locationId)) continue;
-			const key = locationKey(row.deviceId, row.locationId);
-			const seen = unusable.get(key);
-			unusable.set(key, seen === void 0 ? {
-				deviceId: row.deviceId,
-				locationId: row.locationId,
-				held: 1
-			} : {
-				...seen,
-				held: seen.held + 1
-			});
-		}
-		const onDiskByDevice = /* @__PURE__ */ new Map();
-		for (const row of fromIndex.values()) onDiskByDevice.set(row.deviceId, (onDiskByDevice.get(row.deviceId) ?? 0) + 1);
-		const devices = /* @__PURE__ */ new Set();
-		for (const [deviceId, held] of heldByDevice) {
-			if (held < 8) continue;
-			const onDisk = onDiskByDevice.get(deviceId) ?? 0;
-			if (onDisk >= held * .5) continue;
-			devices.add(deviceId);
-			this.logger.warn("recorder: segment-hour ledger prune REFUSED — this walk would delete most of the camera archive, which is what an unmounted root looks like; keeping the previous ledger", {
-				tags: { deviceId },
-				meta: {
-					held,
-					onDisk,
-					dropped: held - onDisk,
-					maxShare: LEDGER_PRUNE_MAX_SHARE
-				}
-			});
-		}
-		const locations = /* @__PURE__ */ new Set();
-		for (const [key, entry] of unusable) {
-			if (devices.has(entry.deviceId)) continue;
-			locations.add(key);
-			this.logger.warn("recorder: segment-hour ledger prune REFUSED — the volume under this location failed its probe, so the walk found nothing because nothing is mounted there", {
-				tags: { deviceId: entry.deviceId },
-				meta: {
-					locationId: entry.locationId,
-					held: entry.held,
-					onDisk: onDiskByDevice.get(entry.deviceId) ?? 0
-				}
-			});
-		}
-		return {
-			devices,
-			locations
-		};
-	}
-};
-function locationKey(deviceId, locationId) {
-	return `${deviceId}|${locationId}`;
-}
-//#endregion
-//#region src/recorder/addon/recording-export-provider.ts
-/** Content type of every rendered export — the engine only ever writes MP4. */
-var EXPORT_CONTENT_TYPE = "video/mp4";
-/** Filename bound, extension included. Long enough to stay recognisable. */
-var EXPORT_NAME_MAX = 64;
-/**
-* The filename a RECIPIENT sees on the attachment.
-*
-* Derived from the operator's own export title so a delivered video is
-* identifiable in a chat thread, but slugified and BOUNDED: the title field
-* accepts 200 characters and several notifier backends silently mangle a
-* filename that long. No usable title degrades to the export id, never to an
-* empty name.
-*/
-function exportFileName(rec) {
-	const slug = (rec.title ?? "").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, EXPORT_NAME_MAX - 4).replace(/-+$/g, "");
-	return slug.length > 0 ? `${slug}.mp4` : `export-${rec.id}.mp4`;
-}
-/**
-* True when at least one indexed segment overlaps `[fromMs, toMs)`. Mirrors the
-* `buildPlaybackManifest` overlap idiom: a segment `[startMs, startMs+durMs)`
-* overlaps the window iff it starts before the window ends AND ends after the
-* window starts.
-*/
-async function hasFootage(index, deviceId, profile, fromMs, toMs) {
-	return (await index.segmentsInWindow(deviceId, profile, fromMs, toMs)).some((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs);
-}
-/** Canonical `profiles[]`, falling back to the legacy singular `profile`. */
-function resolveExportProfiles(input) {
-	if (input.profiles !== void 0 && input.profiles.length > 0) return [...input.profiles];
-	if (typeof input.profile === "string" && input.profile.length > 0) return [input.profile];
-	return [];
-}
-/** Load a record or throw a clear NOT_FOUND-style error. */
-async function requireRecord(state, exportId) {
-	const rec = await getExportRecord(state, exportId);
-	if (!rec) throw new Error(`recording-export: unknown export "${exportId}"`);
-	return rec;
-}
-/** Build the `recordingExport` provider over the injected deps. */
-function buildRecordingExportProvider(deps) {
-	return {
-		createExport: async (input) => {
-			const { deviceId, fromMs, toMs, options } = input;
-			const profiles = resolveExportProfiles(input);
-			if (profiles.length < 1) throw new Error("recording-export: profiles must contain at least one profile");
-			if (!(fromMs < toMs)) throw new Error(`recording-export: invalid range ${fromMs}..${toMs}`);
-			for (const profile of profiles) if (!await hasFootage(deps.index, deviceId, profile, fromMs, toMs)) throw new Error(`recording-export: no footage for ${deviceId}/${profile} in ${fromMs}..${toMs}`);
-			const now = deps.now();
-			let first = null;
-			for (const profile of profiles) {
-				const record = {
-					id: deps.newId(),
-					deviceId,
-					profile,
-					fromMs,
-					toMs,
-					options,
-					state: "queued",
-					progressPct: null,
-					fileBytes: null,
-					expiresAt: now + options.maxLifeMs,
-					deleteAfterDownload: options.deleteAfterDownload,
-					downloadedAt: null,
-					createdAt: now,
-					createdBy: deps.createdBy(),
-					error: null
-				};
-				const saved = await upsertExport(deps.state, record);
-				deps.engine.enqueue(saved.id);
-				first ??= saved;
-			}
-			return first;
-		},
-		listExports: ({ deviceId }) => listExportsFor(deps.state, deviceId),
-		getExport: ({ exportId }) => requireRecord(deps.state, exportId),
-		cancelExport: async ({ exportId }) => {
-			const existing = await requireRecord(deps.state, exportId);
-			await deps.engine.cancel(exportId);
-			return await getExportRecord(deps.state, exportId) ?? existing;
-		},
-		deleteExport: async ({ exportId }) => {
-			const existing = await requireRecord(deps.state, exportId);
-			await deps.removeFile(deps.outPath(existing));
-			return await patchExport(deps.state, exportId, {
-				state: "deleted",
-				fileBytes: null
-			}) ?? existing;
-		},
-		getDownloadUrl: async ({ exportId }) => {
-			await requireRecord(deps.state, exportId);
-			const url = deps.downloadUrlFor(exportId);
-			return {
-				url,
-				endpoints: [url]
-			};
-		},
-		readExportBytes: async ({ exportId }) => {
-			const rec = await requireRecord(deps.state, exportId);
-			const tags = { deviceId: rec.deviceId };
-			if (rec.state !== "ready") {
-				deps.logger.warn("export byte read refused: export is not ready", {
-					tags,
-					meta: {
-						exportId,
-						state: rec.state
-					}
-				});
-				throw new Error(`recording-export: export "${exportId}" is not ready (${rec.state})`);
-			}
-			if (deps.now() >= rec.expiresAt) {
-				deps.logger.warn("export byte read refused: export has expired", {
-					tags,
-					meta: {
-						exportId,
-						expiresAt: rec.expiresAt
-					}
-				});
-				throw new Error(`recording-export: export "${exportId}" has expired`);
-			}
-			const file = deps.outPath(rec);
-			let size;
-			try {
-				size = await deps.statBytes(file);
-			} catch (err) {
-				deps.logger.warn("export byte read refused: file is missing", {
-					tags,
-					meta: {
-						exportId,
-						error: String(err)
-					}
-				});
-				throw new Error(`recording-export: export "${exportId}" has no file on disk`, { cause: err });
-			}
-			if (size > 52428800) {
-				deps.logger.warn("export byte read refused: file is too large to inline", {
-					tags,
-					meta: {
-						exportId,
-						bytes: size,
-						maxBytes: require_dist.RECORDING_EXPORT_MAX_READ_BYTES
-					}
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
 				});
-				throw new Error(`recording-export: export "${exportId}" is too large to read inline (${size} > ${require_dist.RECORDING_EXPORT_MAX_READ_BYTES} bytes)`);
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
 			}
-			const bytes = await deps.readFile(file);
-			return {
-				base64: bytes.toString("base64"),
-				contentType: EXPORT_CONTENT_TYPE,
-				name: exportFileName({
-					id: rec.id,
-					...rec.options.title !== void 0 ? { title: rec.options.title } : {}
-				}),
-				bytes: bytes.byteLength
-			};
 		}
-	};
-}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
 //#endregion
-//#region src/recorder/addon/recording-hub-host.ts
+//#region src/recorder/addon/segment-hour-ledger.ts
+var HOUR_MS$1 = 36e5;
 /**
-* Resolve the host a REMOTE recording node should use to dial the hub-only
-* stream-broker's restream port.
-*
-* The implementation was promoted to the package-shared
-* `src/shared/hub-hostname.ts` in P2d (cross-node Phase 2) so the
-* pipeline-runner's remote-source leg shares the exact same resolver instead
-* of copying it. This module keeps the recorder-facing name as a thin alias —
-* resolution order and semantics are unchanged (operator override first, then
-* the host extracted from `CAMSTACK_HUB_URL`).
+* @durable class=mirror owner=recorder
+*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
-var resolveRecordingHubHostname = require_hub_hostname.resolveHubHostname;
-//#endregion
-//#region src/recorder/addon/retention-sweep.ts
+var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+var RECORDING_SEGMENT_HOURS_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "profile",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "locationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "hourStartMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "paths",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var RECORDING_SEGMENT_HOURS_INDEXES = [{
+	name: "idx_recorder_segment_hours_device",
+	columns: ["deviceId"]
+}, {
+	name: "idx_recorder_segment_hours_hour",
+	columns: ["hourStartMs"]
+}];
 /**
-* Periodic footage-retention sweep (recording-spec §6).
-*
-* The disk-pressure eviction path only fires when a volume is TOO FULL
-* (`shouldSaveDiskSpace` + `minFreePercent`); it never enforces a camera's
-* age/size policy. This sweeper closes that gap: on an hourly cadence it prunes
-* footage for every device whose operator set an actionable `retention` policy,
-* delegating the actual selection + delete to the `recording` cap's
-* `pruneFootage` (which owns the retention FLOOR via `selectEvictions` — this
-* sweeper only decides WHICH devices to prune and WHEN).
+* The largest share of a device's held hours a single walk may delete.
 *
-* Owns its own timer + single-flight guard so a slow sweep is never overlapped
-* by the next tick — the same subsystem-owns-its-timer shape as the
-* export janitor. Pure over injected deps (config read + prune + logger +
-* clock via `setInterval`), so it is unit-testable with fake timers and a mock
-* `prune`. Every pass is best-effort: a per-device prune failure is logged and
-* never aborts the rest, and the sweep never throws.
-*/
-/**
-* True when the operator set an ACTIONABLE retention policy on a device — at
-* least one of `maxAgeDays` / `maxSizeGb` is present and positive. Mirrors the
-* `> 0` guards `selectEvictions` itself applies, so a `0`/absent limit (which
-* inherits the node default = "keep forever") is treated as NO policy and the
-* device is skipped. NEVER prune a device without an explicit policy — that
-* would delete footage the operator never asked to age out.
+* On 2026-08-19 the recorder respawned while `/recordings` was an empty tmpfs —
+* the UD disk had not mounted — and one walk took the ledger from 873 hours to
+* 32 (a 96% drop). The ledger is precisely what lets the NEXT boot skip a
+* ~400 s recursive walk, so a single bad walk taxed every boot after it. A
+* retention sweep does not delete half a camera's archive in one pass; a
+* `readdir` over an unmounted root deletes all of it.
 */
-function hasRetentionPolicy(config) {
-	const retention = config.retention;
-	if (!retention) return false;
-	const byAge = retention.maxAgeDays != null && retention.maxAgeDays > 0;
-	const bySize = retention.maxSizeGb != null && retention.maxSizeGb > 0;
-	return byAge || bySize;
+var LEDGER_PRUNE_MAX_SHARE = .5;
+function hourStartMs(startMs) {
+	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
 }
-var RetentionSweeper = class {
-	deps;
-	timer = null;
-	/** Single-flight guard: true while a sweep is in flight. */
-	sweeping = false;
+function segmentHourKey(deviceId, profile, locationId, hour) {
+	return `${deviceId}|${profile}|${locationId}|${hour}`;
+}
+function hourOf(row) {
+	const hour = hourStartMs(row.startMs);
+	return {
+		hourStartMs: hour,
+		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
+	};
+}
+function uniquePaths(paths) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const p of paths) {
+		if (seen.has(p)) continue;
+		seen.add(p);
+		out.push(p);
+	}
+	return out;
+}
+function samePaths(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	for (const p of b) if (!set.has(p)) return false;
+	return true;
+}
+function rowToValue(row) {
+	return {
+		deviceId: row.deviceId,
+		profile: row.profile,
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: JSON.stringify(row.paths)
+	};
+}
+function recordToRow(key, data) {
+	const deviceId = Number(data["deviceId"]);
+	const profile = data["profile"];
+	const locationId = data["locationId"];
+	const hour = Number(data["hourStartMs"]);
+	let raw = data["paths"];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
+	return {
+		key,
+		deviceId,
+		profile,
+		locationId,
+		hourStartMs: hour,
+		paths: raw
+	};
+}
+var SPEC = {
+	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
+	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
+	writeMode: "write-behind",
+	loadLimit: 1e5,
+	keyOf: (row) => row.key,
+	toValue: rowToValue,
+	fromRecord: recordToRow,
+	deviceIdOf: (row) => row.deviceId
+};
+var SegmentHourLedger = class {
+	ledger;
+	logger;
+	isLocationUsable;
 	constructor(deps) {
-		this.deps = deps;
+		this.logger = deps.logger;
+		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
+		this.ledger = new DurableLedger({
+			spec: SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, SPEC);
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	async load() {
+		const rows = await this.ledger.load();
+		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
+			hours: rows.length,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return rows;
+	}
+	snapshot() {
+		return this.ledger.snapshot();
 	}
 	/**
-	* Arm the sweep: run immediately, then on the interval. Idempotent — a second
-	* `start()` while already armed is a no-op. The timer is `unref`'d so it never
-	* keeps the process alive.
+	* Seed {@link RecordingIndex} from the mirrored hour rows.
+	*
+	* Hours present in the ledger become `hydrated` so a seek in those windows
+	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
+	* — that is the fail-toward-walk direction.
 	*/
-	start() {
-		if (this.timer !== null) return;
-		const tick = () => {
-			this.sweep();
-		};
-		tick();
-		this.timer = setInterval(tick, this.deps.intervalMs);
-		this.timer.unref?.();
+	hydrateIndex(index) {
+		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
 	}
-	/** Stop the sweep timer. Idempotent. An in-flight sweep still completes. */
-	stop() {
-		if (this.timer !== null) {
-			clearInterval(this.timer);
-			this.timer = null;
+	/** Write-behind: a just-finalized segment joins its hour row. */
+	async recordSegment(row) {
+		const { key, hourStartMs: hour } = hourOf(row);
+		const held = this.ledger.get(key);
+		if (held !== void 0 && held.paths.includes(row.path)) return;
+		await this.ledger.put({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour,
+			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
+		});
+	}
+	/**
+	* Eviction confirmed these paths are gone from disk. Drop them; forget the
+	* hour when it holds nothing.
+	*/
+	async dropSegments(rows) {
+		const doomed = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const { key } = hourOf(row);
+			let set = doomed.get(key);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				doomed.set(key, set);
+			}
+			set.add(row.path);
+		}
+		for (const [key, paths] of doomed) {
+			const held = this.ledger.get(key);
+			if (held === void 0) continue;
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) {
+				await this.ledger.forget(key);
+				continue;
+			}
+			if (next.length === held.paths.length) continue;
+			await this.ledger.put({
+				...held,
+				paths: next
+			});
 		}
 	}
 	/**
-	* One retention pass. Single-flighted: a call that fires while a previous
-	* sweep is still running is a no-op. Never throws — a config-read failure
-	* aborts THIS pass (logged); a per-device prune failure is logged and the
-	* sweep continues with the remaining devices.
+	* After a disk walk of `deviceIds`, make the ledger match the index — with
+	* two D148 exceptions:
+	*
+	*  - an hour the walk did not see is dropped ONLY if it is in the past;
+	*    the current hour may still hold a live writer whose file the readdir
+	*    raced;
+	*  - the current hour UNIONs ledger paths with index paths rather than
+	*    replacing, for the same race.
+	*
+	* Devices not in `deviceIds` are left untouched (a partial walk must not
+	* prune cameras it did not look at).
+	*
+	* And a walk this ledger does not TRUST prunes nothing at all — see
+	* {@link refusedPrunes}. What such a walk FOUND is still real, so its paths
+	* are unioned in; what it did not find decides nothing (D49).
 	*/
-	async sweep() {
-		if (this.sweeping) {
-			this.deps.logger.debug("recorder: retention sweep already running — skipping this tick");
-			return;
+	async reconcileFromIndex(index, deviceIds, nowMs) {
+		const walked = new Set(deviceIds);
+		const currentHour = hourStartMs(nowMs);
+		const fromIndex = /* @__PURE__ */ new Map();
+		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
+			const { key, hourStartMs: hour } = hourOf(seg);
+			const existing = fromIndex.get(key);
+			if (existing === void 0) fromIndex.set(key, {
+				key,
+				deviceId: seg.deviceId,
+				profile: seg.profile,
+				locationId: seg.locationId,
+				hourStartMs: hour,
+				paths: [seg.path]
+			});
+			else fromIndex.set(key, {
+				...existing,
+				paths: [...existing.paths, seg.path]
+			});
 		}
-		this.sweeping = true;
-		try {
-			let configs;
-			try {
-				configs = await this.deps.readConfigs();
-			} catch (err) {
-				this.deps.logger.warn("recorder: retention sweep could not read device configs", { meta: { error: require_dist.errMsg(err) } });
-				return;
+		const refused = this.refusedPrunes(walked, fromIndex);
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			const disk = fromIndex.get(row.key);
+			const additiveOnly = row.hourStartMs === currentHour || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
+			if (disk === void 0) {
+				if (additiveOnly) continue;
+				await this.ledger.forget(row.key);
+				continue;
 			}
-			const withPolicy = [...configs].filter(([, config]) => hasRetentionPolicy(config));
-			const devicesSkipped = configs.size - withPolicy.length;
-			this.deps.logger.info("recorder: retention sweep starting", { meta: {
-				devices: withPolicy.map(([deviceId]) => deviceId),
-				skipped: devicesSkipped
-			} });
-			let devicesSwept = 0;
-			let bucketsPruned = 0;
-			let bytesReclaimed = 0;
-			for (const [deviceId] of withPolicy) {
-				const startedMs = Date.now();
-				try {
-					const result = await this.deps.prune(deviceId);
-					devicesSwept += 1;
-					bucketsPruned += result.deletedBuckets;
-					bytesReclaimed += result.reclaimedBytes;
-					this.deps.logger.info("recorder: retention prune complete for device", {
-						tags: { deviceId },
-						meta: {
-							deletedBuckets: result.deletedBuckets,
-							reclaimedBytes: result.reclaimedBytes,
-							ms: Date.now() - startedMs
-						}
-					});
-				} catch (err) {
-					this.deps.logger.warn("recorder: retention prune failed for device", {
-						tags: { deviceId },
-						meta: { error: require_dist.errMsg(err) }
-					});
-				}
+			if (additiveOnly) {
+				const union = uniquePaths([...disk.paths, ...row.paths]);
+				if (!samePaths(union, row.paths)) await this.ledger.put({
+					...row,
+					paths: union
+				});
+				continue;
 			}
-			this.deps.logger.info("recorder: retention sweep complete", { meta: {
-				devicesSwept,
-				devicesSkipped,
-				bucketsPruned,
-				bytesReclaimed
-			} });
-		} finally {
-			this.sweeping = false;
+			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+		}
+		for (const [key, disk] of fromIndex) {
+			if (this.ledger.has(key)) continue;
+			await this.ledger.put(disk);
+		}
+	}
+	/**
+	* Which of this walk's deletions are REFUSED, and why.
+	*
+	* Two independent reasons, because the live fault of 2026-08-19 would have
+	* escaped either one alone:
+	*
+	* - **the volume said no.** `PlacementService`'s marker probe knows the bytes
+	*   under a root are not the bytes we wrote. A walk of such a root found
+	*   nothing because nothing is mounted there, not because the footage is
+	*   gone.
+	* - **the magnitude said no.** At BOOT the probe has not run yet — it runs at
+	*   the first writer attach — so on the morning the recorder respawned onto an
+	*   empty tmpfs the volume was not flagged and the prune went through: 873
+	*   hours to 32. A walk that deletes more than
+	*   {@link LEDGER_PRUNE_MAX_SHARE} of a device's held hours is refused on its
+	*   size alone.
+	*
+	* A refusal is one line per device (or per device+location), carrying the
+	* delta, tagged with `deviceId` — a ledger that silently declined to prune and
+	* a ledger with nothing to prune must never read the same.
+	*/
+	refusedPrunes(walked, fromIndex) {
+		const heldByDevice = /* @__PURE__ */ new Map();
+		const unusable = /* @__PURE__ */ new Map();
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			heldByDevice.set(row.deviceId, (heldByDevice.get(row.deviceId) ?? 0) + 1);
+			if (this.isLocationUsable(row.locationId)) continue;
+			const key = locationKey(row.deviceId, row.locationId);
+			const seen = unusable.get(key);
+			unusable.set(key, seen === void 0 ? {
+				deviceId: row.deviceId,
+				locationId: row.locationId,
+				held: 1
+			} : {
+				...seen,
+				held: seen.held + 1
+			});
+		}
+		const onDiskByDevice = /* @__PURE__ */ new Map();
+		for (const row of fromIndex.values()) onDiskByDevice.set(row.deviceId, (onDiskByDevice.get(row.deviceId) ?? 0) + 1);
+		const devices = /* @__PURE__ */ new Set();
+		for (const [deviceId, held] of heldByDevice) {
+			if (held < 8) continue;
+			const onDisk = onDiskByDevice.get(deviceId) ?? 0;
+			if (onDisk >= held * .5) continue;
+			devices.add(deviceId);
+			this.logger.warn("recorder: segment-hour ledger prune REFUSED — this walk would delete most of the camera archive, which is what an unmounted root looks like; keeping the previous ledger", {
+				tags: { deviceId },
+				meta: {
+					held,
+					onDisk,
+					dropped: held - onDisk,
+					maxShare: LEDGER_PRUNE_MAX_SHARE
+				}
+			});
+		}
+		const locations = /* @__PURE__ */ new Set();
+		for (const [key, entry] of unusable) {
+			if (devices.has(entry.deviceId)) continue;
+			locations.add(key);
+			this.logger.warn("recorder: segment-hour ledger prune REFUSED — the volume under this location failed its probe, so the walk found nothing because nothing is mounted there", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					locationId: entry.locationId,
+					held: entry.held,
+					onDisk: onDiskByDevice.get(entry.deviceId) ?? 0
+				}
+			});
 		}
+		return {
+			devices,
+			locations
+		};
 	}
 };
+function locationKey(deviceId, locationId) {
+	return `${deviceId}|${locationId}`;
+}
 //#endregion
 //#region src/recorder/loop-pacer.ts
 var DEFAULT_BUSY_LAG_MS = 25;
@@ -10737,6 +11041,23 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	});
 	/** Continuous + events band write-path controller (ffmpeg writers + watchers). */
 	controller = null;
+	/**
+	* The controller's config read, with last-known-good fallback.
+	*
+	* Built ONCE and memoized, because the cache lives INSIDE the wrapper:
+	* rebuilding it per call would throw away the very value the fallback exists
+	* to serve. Lazy rather than a field initializer — a field initializer runs
+	* before the constructor assigns `this.ctx`, so `this.ctx.logger` would be
+	* `undefined` at that point.
+	*/
+	lastKnownGoodRead = null;
+	get loadConfigLastKnownGood() {
+		this.lastKnownGoodRead ??= withLastKnownConfig({
+			load: (deviceId) => loadDeviceConfig(this.configStore(), deviceId),
+			logger: this.ctx.logger
+		});
+		return this.lastKnownGoodRead;
+	}
 	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
 	eventMap = new EventMap();
 	/** Unsubscribe handle for the EventCapture motion subscription. */
@@ -10919,7 +11240,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			nodeId: this.nodeId,
 			ownerNodeId: ingestOwner.ownerNodeId,
 			segmentStore: this.segmentStore,
-			loadConfig: (deviceId) => loadDeviceConfig(this.configStore(), deviceId),
+			loadConfig: this.loadConfigLastKnownGood,
 			enabledDeviceIds: async () => [...(await readDeviceConfigs(this.configStore())).keys()],
 			/**
 			* The DURABLE half of the trigger path (D8/D11). `pipelineAnalytics` rows