@camstack/addon-pipeline 1.2.128 → 1.2.130

package/dist/pipeline-runner/index.mjs

@@ -1,6 +1,6 @@
-import { Bt as lazy, Et as createEvent, F as customAction, Gt as string, Ht as number, It as _enum, L as defineCustomActions, Lt as array, Rt as boolean, St as BaseAddon, Ut as object, Vt as literal, f as DEFAULT_NATIVE_LEASE_SETTINGS, gt as errMsg, it as pipelineRunnerCapability, jt as nodePin, nt as pickNativeLeaseOverride, p as DEVICE_BACKEND_TO_FORMAT, qt as EventCategory, tt as pickDetailCropConvention, u as DEFAULT_DETAIL_CROP_CONVENTION, z as deriveDetailCropRect } from "../dist-HLAOw6Pe.mjs";
-import { i as resolveFrameViewGeometry, r as localFrameRegistry, t as attributeStall, u as getStepDefinition } from "../event-loop-stall-monitor-BH-cL_hg.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-h7Smb_0i.mjs";
+import { Bt as lazy, Et as createEvent, F as customAction, Gt as string, Ht as number, It as _enum, L as defineCustomActions, Lt as array, Rt as boolean, St as BaseAddon, Ut as object, Vt as literal, f as DEFAULT_NATIVE_LEASE_SETTINGS, gt as errMsg, it as pipelineRunnerCapability, jt as nodePin, nt as pickNativeLeaseOverride, p as DEVICE_BACKEND_TO_FORMAT, qt as EventCategory, tt as pickDetailCropConvention, u as DEFAULT_DETAIL_CROP_CONVENTION, z as deriveDetailCropRect } from "../dist-Wt81pN5Y.mjs";
+import { i as resolveFrameViewGeometry, r as localFrameRegistry, t as attributeStall, u as getStepDefinition } from "../event-loop-stall-monitor-CtQCOZqm.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-rpnr7Ldd.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";

package/dist/{process-memory-CDPRLalN.mjs → process-memory-1_D3EZT9.mjs}

@@ -1,4 +1,4 @@
-import { Q as parseProcStatus } from "./dist-HLAOw6Pe.mjs";
+import { Q as parseProcStatus } from "./dist-Wt81pN5Y.mjs";
 import { execFile } from "node:child_process";
 import * as fs from "node:fs";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-Dh1SyzdJ.js → process-memory-D9H5qjDl.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BZUXb5S5.js");
+const require_dist = require("./dist-DOw-izoI.js");
 let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);

package/dist/recorder/index.js

@@ -1,7 +1,7 @@
-const require_dist = require("../dist-BZUXb5S5.js");
+const require_dist = require("../dist-DOw-izoI.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
-const require_addon_utils = require("../addon-utils-BnprivSs.js");
+const require_addon_utils = require("../addon-utils-DH78p79i.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
@@ -336,6 +336,70 @@ function fragmentRangeFor(index, offsetTicks) {
 		sampleIndex: chosen
 	};
 }
+/**
+* Convert a byte budget into the SET of consecutive fragments that fits,
+* starting at the fragment covering `offsetTicks` and walking FORWARD —
+* matching the read direction a scrub or a sequential-forward strategy
+* actually uses. Pure: `index` is the already-parsed `tfra` table, so this
+* never touches the segment's payload.
+*
+* Greedy: adds the next fragment only while the running total stays within
+* `maxBytes`. The anchor fragment is ALWAYS included, even when it alone
+* exceeds `maxBytes` — {@link FragmentBudgetPlan.oversizeFragment} says so
+* explicitly rather than the caller receiving an empty set and reading it as
+* "nothing to read" (D49's letter, applied to a byte budget: a fallible
+* computation must never silently look like an unbind).
+*/
+function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	let lo = 0;
+	let hi = samples.length - 1;
+	let anchor = 0;
+	while (lo <= hi) {
+		const mid = lo + hi >> 1;
+		const s = samples[mid];
+		if (s === void 0) break;
+		if (s.timeTicks <= offsetTicks) {
+			anchor = mid;
+			lo = mid + 1;
+		} else hi = mid - 1;
+	}
+	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
+	const anchorStart = samples[anchor]?.moofOffset ?? 0;
+	const anchorEnd = endOf(anchor);
+	const fragments = [{
+		start: anchorStart,
+		end: anchorEnd,
+		sampleIndex: anchor
+	}];
+	let total = anchorEnd - anchorStart;
+	const oversizeFragment = total > maxBytes;
+	let i = anchor;
+	while (i + 1 < samples.length) {
+		const nextIndex = i + 1;
+		const nextSample = samples[nextIndex];
+		if (nextSample === void 0) break;
+		const nextStart = nextSample.moofOffset;
+		const nextEnd = endOf(nextIndex);
+		const nextSize = nextEnd - nextStart;
+		if (total + nextSize > maxBytes) break;
+		fragments.push({
+			start: nextStart,
+			end: nextEnd,
+			sampleIndex: nextIndex
+		});
+		total += nextSize;
+		i = nextIndex;
+	}
+	const last = fragments[fragments.length - 1];
+	return {
+		fragments,
+		start: fragments[0].start,
+		end: last.end,
+		reachesSegmentEnd: last.end >= mfraOffset,
+		oversizeFragment
+	};
+}
 //#endregion
 //#region src/recorder/mfra-capture.ts
 /**
@@ -2737,6 +2801,272 @@ function activeModeForConfig(config) {
 	return require_dist.deriveRecordingMode(config);
 }
 //#endregion
+//#region src/recorder/addon/store/read-census.ts
+/**
+* Longest window the census may be armed for, in ms.
+*
+* Ten minutes is several report windows - enough to catch a sweep that fires
+* every few minutes - and short enough that an operator who forgets about it
+* pays for ten minutes, not until the next restart.
+*/
+var CENSUS_MAX_WINDOW_MS = 10 * 6e4;
+/** Store procedures worth attributing. Reads only: a write is an operator
+*  gesture or a pipeline product, and neither is a mystery. */
+var CENSUSED_PROCEDURES = new Set([
+	"query",
+	"count",
+	"get",
+	"histogram",
+	"getAll"
+]);
+/**
+* Can `new Proxy` wrap this, and is it worth wrapping?
+*
+* Functions count. The generated store client is a **tRPC proxy** and every
+* intermediate node of one is CALLABLE — `typeof client.query` is `'function'`,
+* not `'object'`. A wrapper that tested only for `'object'` handed the whole
+* client back unwrapped, deployed, and reported zero `query` and zero `count`
+* call sites while the engine was recording thousands a minute against the same
+* tables. Silence read as "nobody in this addon does it".
+*/
+function isProxyable(value) {
+	return typeof value === "object" && value !== null || typeof value === "function";
+}
+function rowsOf(value) {
+	if (Array.isArray(value)) return value.length;
+	if (typeof value === "number") return value;
+	if (value === void 0 || value === null) return 0;
+	return 1;
+}
+/**
+* One V8 stack line reduced to `Function@line`.
+*
+* A deployed addon is ONE bundled file, so the path is identical on every frame
+* and carries no information; the line number does. A frame that parses as
+* neither keeps its trimmed text rather than being dropped - an unrecognised
+* frame is still an attribution, and dropping it would silently shift the site
+* one frame up.
+*/
+function compactFrame(line) {
+	const trimmed = line.trim().replace(/^at\s+/, "");
+	const named = /^(.+?)\s+\((?:.*?):(\d+):\d+\)$/.exec(trimmed);
+	if (named !== null) return `${named[1]}@${named[2]}`;
+	const bare = /^(?:.*?):(\d+):\d+$/.exec(trimmed);
+	if (bare !== null) return `@${bare[1]}`;
+	return trimmed;
+}
+/** The census's view of a stack: the top {@link CENSUS_STACK_FRAMES} frames,
+*  innermost first, joined by ` < ` so a line reads caller-ward. */
+function siteFromStack(stack) {
+	if (stack === void 0) return "unknown";
+	const frames = stack.split("\n").slice(1, 4);
+	if (frames.length === 0) return "unknown";
+	return frames.map(compactFrame).join(" < ");
+}
+/**
+* Armed-window call-site counter.
+*
+* Disarmed it is one comparison per read and captures nothing - the stack is
+* the whole cost, and it is not taken.
+*/
+var StoreReadCensus = class {
+	now;
+	counts = /* @__PURE__ */ new Map();
+	armedUntil = 0;
+	armedAt = 0;
+	constructor(now = () => Date.now()) {
+		this.now = now;
+	}
+	/** Arm for `forMs`, clamped to {@link CENSUS_MAX_WINDOW_MS}. Re-arming
+	*  restarts the window and CLEARS the counts: two overlapping measurements in
+	*  one table is a table nobody can divide by a duration. */
+	arm(forMs) {
+		const at = this.now();
+		this.counts.clear();
+		this.armedAt = at;
+		this.armedUntil = at + Math.max(0, Math.min(forMs, CENSUS_MAX_WINDOW_MS));
+	}
+	disarm() {
+		this.armedUntil = 0;
+	}
+	get armed() {
+		return this.now() < this.armedUntil;
+	}
+	/** How long the current (or just-finished) window collected, in ms. The
+	*  divisor for a calls-per-minute rate - a count without it is a number that
+	*  cannot be compared to the next one. */
+	elapsedMs() {
+		const at = this.now();
+		return Math.max(0, Math.min(at, this.armedUntil) - this.armedAt);
+	}
+	/**
+	* The call site of whoever called `cutoff`, or `null` when disarmed.
+	*
+	* **Taken BEFORE the await, always.** The first version of this class
+	* captured the stack next to the counter, after the wrapped call had
+	* resolved - and by then the synchronous caller is gone: V8 stitches an async
+	* frame in its place and the site reads
+	* `Proxy.<anonymous> < processTicksAndRejections`, which is the census
+	* describing itself. It passed one of its own tests anyway, because that one
+	* caller happened to RETURN the promise rather than await it. An instrument
+	* that reports its own frames is worse than no instrument: the counts are
+	* real, so the wrong name gets believed.
+	*
+	* `cutoff` is the wrapper function itself, so every frame from the wrapper
+	* inwards is dropped and frame 0 is the code that asked.
+	*/
+	siteOf(cutoff) {
+		if (!this.armed) return null;
+		const holder = {};
+		Error.captureStackTrace(holder, cutoff);
+		return siteFromStack(holder.stack);
+	}
+	/**
+	* Count one read at an already-captured site.
+	*
+	* A `null` site means the census was disarmed when the call STARTED. It is
+	* not counted even if it lands inside a later window - a read belongs to the
+	* window that issued it.
+	*/
+	record(op, site, result) {
+		if (site === null) return;
+		const key = `${op} ${site}`;
+		const existing = this.counts.get(key);
+		if (existing === void 0) {
+			this.counts.set(key, {
+				op,
+				site,
+				calls: 1,
+				rows: rowsOf(result)
+			});
+			return;
+		}
+		existing.calls += 1;
+		existing.rows += rowsOf(result);
+	}
+	/** Busiest first. Does NOT clear - a window may be read as many times as the
+	*  operator likes and always describes the same window. */
+	rows() {
+		return [...this.counts.values()].map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			rows: r.rows
+		})).sort((a, b) => b.calls - a.calls);
+	}
+};
+/**
+* Wrap a settings-store client so every read is counted.
+*
+* A `Proxy` over the generated tRPC client rather than a hand-written facade:
+* the client has a procedure per cap method and a facade would need updating
+* every time the cap gains one - which is how a diagnostic quietly stops seeing
+* half the traffic. Unrecognised procedures pass straight through.
+*/
+function censusStoreClient(client, census) {
+	return new Proxy(client, { get(target, prop, receiver) {
+		const procedure = Reflect.get(target, prop, receiver);
+		if (typeof prop !== "string" || !CENSUSED_PROCEDURES.has(prop)) return procedure;
+		if (!isProxyable(procedure)) return procedure;
+		const op = prop;
+		return new Proxy(procedure, { get(procTarget, procProp, procReceiver) {
+			const call = Reflect.get(procTarget, procProp, procReceiver);
+			if (procProp !== "query" && procProp !== "mutate") return call;
+			if (typeof call !== "function") return call;
+			const wrapped = async (...args) => {
+				const site = census.siteOf(wrapped);
+				const result = await Reflect.apply(call, procTarget, args);
+				census.record(op, site, result);
+				return result;
+			};
+			return wrapped;
+		} });
+	} });
+}
+/** Log the census as one line, including when it collected nothing - silence
+*  after an arm is indistinguishable from a census that never armed. */
+function logCensus(census, logger, topN) {
+	const rows = census.rows();
+	const elapsedMs = census.elapsedMs();
+	const perMin = (calls) => elapsedMs === 0 ? 0 : Math.round(calls * 6e4 / elapsedMs);
+	logger.info("store read census", { meta: {
+		elapsedMs,
+		sites: rows.length,
+		calls: rows.reduce((acc, r) => acc + r.calls, 0),
+		top: rows.slice(0, topN).map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			perMin: perMin(r.calls),
+			rows: r.rows
+		}))
+	} });
+	return rows;
+}
+/**
+* `armMs: 0` (or omitted) READS the window that already ran — that is how a
+* measurement is collected after its window closed, and re-arming to read
+* would throw away exactly the numbers being asked for (`StoreReadCensus.arm`
+* clears on every call).
+*/
+var StoreCensusInputSchema = require_dist.object({
+	armMs: require_dist.number().int().min(0).max(CENSUS_MAX_WINDOW_MS).optional(),
+	limit: require_dist.number().int().positive().max(200).optional()
+});
+var StoreCensusRowSchema = require_dist.object({
+	op: require_dist.string(),
+	site: require_dist.string(),
+	calls: require_dist.number(),
+	/** Calls extrapolated to a minute, directly comparable with the live-hub
+	*  profiler's own `get recorder:recording-configs` rate. */
+	perMin: require_dist.number(),
+	rows: require_dist.number()
+});
+var StoreCensusOutputSchema = require_dist.object({
+	armed: require_dist.boolean(),
+	elapsedMs: require_dist.number(),
+	sites: require_dist.number(),
+	calls: require_dist.number(),
+	rows: require_dist.array(StoreCensusRowSchema).readonly()
+});
+var recorderDebugActions = require_dist.defineCustomActions({ "debug.storeCensus": require_dist.customAction(StoreCensusInputSchema, StoreCensusOutputSchema, { auth: "admin" }) });
+/**
+* Arm-or-read, pulled out of the addon class so it is testable without
+* booting `RecorderV2Addon` — feed it a bare `StoreReadCensus` and a logger.
+*
+* The result is also logged (via {@link logCensus}), because a measurement
+* that exists only in an HTTP response is a measurement that is gone when the
+* next session asks what happened.
+*/
+function handleStoreCensusAction(census, logger, input) {
+	const limit = input.limit ?? 200;
+	if (input.armMs !== void 0 && input.armMs > 0) {
+		census.arm(input.armMs);
+		return {
+			armed: true,
+			elapsedMs: 0,
+			sites: 0,
+			calls: 0,
+			rows: []
+		};
+	}
+	const rows = logCensus(census, logger, limit);
+	const elapsedMs = census.elapsedMs();
+	return {
+		armed: census.armed,
+		elapsedMs,
+		sites: rows.length,
+		calls: rows.reduce((acc, r) => acc + r.calls, 0),
+		rows: rows.slice(0, limit).map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			perMin: elapsedMs === 0 ? 0 : Math.round(r.calls * 6e4 / elapsedMs),
+			rows: r.rows
+		}))
+	};
+}
+//#endregion
 //#region src/recorder/addon/directory-handler.ts
 var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
@@ -4094,6 +4424,18 @@ function buildMasterPlaylist(variants) {
 * against a real captured segment with every read recorded — "never the whole
 * file" is asserted in bytes.
 */
+/**
+* Byte budget for the `readGopBytes` fallback read, used with
+* {@link GopRangeArgs.maxBytes}.
+*
+* Same conceptual ceiling as `SCRUB_WHOLE_SEGMENT_MAX_BYTES` in
+* `stream-broker/recorded/recorded-feeder.ts` (D163, 1.5 MB) — declared here
+* independently rather than imported, because that module is the CLIENT
+* feeder (a different addon-internal concern; importing its whole dependency
+* graph for one number is the wrong direction). If D163's number moves,
+* this one moves with it.
+*/
+var SCRUB_GOP_BUDGET_MAX_BYTES = 15e5;
 /** Ticks → ms on the video timescale, rounded like the demux anchors samples. */
 function ticksToMs(ticks, timescale) {
 	return Math.round(ticks / timescale * 1e3);
@@ -4123,11 +4465,36 @@ async function readGopRange(file, args) {
 	if (init === null) return null;
 	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
 	if (videoIndex === null) return null;
-	const { start, end, sampleIndex } = fragmentRangeFor(videoIndex, Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale);
+	const offsetTicks = Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale;
+	let start;
+	let end;
+	let firstSampleIndex;
+	let lastSampleIndex;
+	let reachesSegmentEnd;
+	let oversizeFragment;
+	if (args.maxBytes === void 0) {
+		const single = fragmentRangeFor(videoIndex, offsetTicks);
+		start = single.start;
+		end = single.end;
+		firstSampleIndex = single.sampleIndex;
+		lastSampleIndex = single.sampleIndex;
+		reachesSegmentEnd = videoIndex.samples[single.sampleIndex + 1] === void 0;
+		oversizeFragment = false;
+	} else {
+		const plan = fragmentsWithinBudget(videoIndex, offsetTicks, args.maxBytes);
+		const firstFragment = plan.fragments[0];
+		const lastFragment = plan.fragments[plan.fragments.length - 1];
+		start = plan.start;
+		end = plan.end;
+		firstSampleIndex = firstFragment.sampleIndex;
+		lastSampleIndex = lastFragment.sampleIndex;
+		reachesSegmentEnd = plan.reachesSegmentEnd;
+		oversizeFragment = plan.oversizeFragment;
+	}
 	if (start <= 0 || end <= start || end > file.size) return null;
 	const fragment = await read(start, end - start);
-	const startTicks = videoIndex.samples[sampleIndex]?.timeTicks ?? 0;
-	const nextTicks = videoIndex.samples[sampleIndex + 1]?.timeTicks;
+	const startTicks = videoIndex.samples[firstSampleIndex]?.timeTicks ?? 0;
+	const nextTicks = videoIndex.samples[lastSampleIndex + 1]?.timeTicks;
 	const gopStartOffsetMs = ticksToMs(startTicks, init.videoTimescale);
 	const gopDurMs = nextTicks !== void 0 ? ticksToMs(nextTicks - startTicks, init.videoTimescale) : Math.max(1, args.segmentDurMs - gopStartOffsetMs);
 	const data = new Uint8Array(head.length + fragment.length);
@@ -4137,7 +4504,9 @@ async function readGopRange(file, args) {
 		data,
 		gopStartMs: args.segmentStartMs + gopStartOffsetMs,
 		gopDurMs,
-		bytesRead
+		bytesRead,
+		reachesSegmentEnd,
+		oversizeFragment
 	};
 }
 /**
@@ -4670,6 +5039,30 @@ function resolveSegmentFile(deps, deviceId, profile, startMs) {
 		abs: node_path.default.join(loc.root, seg.path)
 	};
 }
+/**
+* The log line's `meta`, or null when `readGopBytes` served nothing worth a
+* line. Split out from the handler so the decision is testable against a
+* plain object — no real fMP4 bytes needed to prove a >1.5 MB fragment
+* triggers it.
+*
+* The single-fragment budget overshoot is the notable case, not the routine
+* one: a `high`/`mid` scrub goes through this path on every tick by design
+* (client-side `profile-degraded`, already logged once per drag on the
+* feeder), and logging every such call here would spam nothing new. A
+* fragment that alone exceeds the budget is different — it is never returned
+* empty (never-empty is {@link fragmentsWithinBudget}'s contract), but an
+* operator debugging a slow drag needs to know it happened.
+*/
+function oversizeFragmentLogMeta(gop, args) {
+	if (!gop.oversizeFragment) return null;
+	return {
+		profile: args.profile,
+		startMs: args.startMs,
+		epochMs: args.epochMs,
+		fragmentBytes: gop.data.length,
+		maxBytes: SCRUB_GOP_BUDGET_MAX_BYTES
+	};
+}
 /** Default ranged opener: ONE `fs.open` per GOP answer serving all its reads. */
 async function openRangeFromDisk(absPath, size) {
 	const handle = await node_fs.promises.open(absPath, "r");
@@ -4889,13 +5282,25 @@ function buildRecordingProvider(deps) {
 					segmentStartMs: seg.startMs,
 					segmentDurMs: seg.durMs,
 					epochMs,
-					seededIndex: deps.mfraFor?.(deviceId, profile, startMs)
+					seededIndex: deps.mfraFor?.(deviceId, profile, startMs),
+					maxBytes: SCRUB_GOP_BUDGET_MAX_BYTES
 				});
-				if (gop !== null) return {
-					data: gop.data,
-					gopStartMs: gop.gopStartMs,
-					gopDurMs: gop.gopDurMs
-				};
+				if (gop !== null) {
+					const oversizeMeta = oversizeFragmentLogMeta(gop, {
+						profile,
+						startMs,
+						epochMs
+					});
+					if (oversizeMeta !== null) deps.logger.warn("recording: readGopBytes served one fragment that alone exceeds the scrub budget", {
+						tags: { deviceId },
+						meta: oversizeMeta
+					});
+					return {
+						data: gop.data,
+						gopStartMs: gop.gopStartMs,
+						gopDurMs: gop.gopDurMs
+					};
+				}
 			} finally {
 				await file.close();
 			}
@@ -11176,6 +11581,23 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	retentionSweeper = null;
 	/** Reversible migration pause lease; never reflected in RecordingConfig. */
 	storageMigrationLeaseId = null;
+	/**
+	* Call-site attribution for `recorder:recording-configs` / `-exports` /
+	* `-ops-log` row reads (`store/read-census.ts`).
+	*
+	* Disarmed by default; armed for a bounded window through
+	* `debug.storeCensus`. It exists because the live-hub profiler names a
+	* TABLE — `get recorder:recording-configs` ran 581-892 calls/min on
+	* 2026-08-26, finding a row only ~56% of the time — and cannot say WHICH of
+	* `loadDeviceConfig`'s several cap-handler call sites (`getStatus`,
+	* `getDeviceConfig`, `rescanStorage`, `pruneFootage`) is issuing them.
+	* Picking the reader that LOOKS like a loop has cost this repo half a day
+	* twice, wrong both times — this measures instead.
+	*/
+	readCensus = new StoreReadCensus();
+	/** Memoised so every `configStore()` / `exportsStore()` / `opsLogStore()`
+	*  call shares ONE census instead of each wrapping the raw client afresh. */
+	censusedSettingsStoreClient = null;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -11580,20 +12002,24 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			}
 		});
 		warnLostBands(this.configStore(), this.ctx.logger);
-		return { providers: [
-			{
-				capability: require_dist.recordingCapability,
-				provider: recordingProvider
-			},
-			{
-				capability: require_dist.storageEvictableCapability,
-				provider: evictableProvider
-			},
-			{
-				capability: require_dist.recordingExportCapability,
-				provider: exportProvider
-			}
-		] };
+		return {
+			providers: [
+				{
+					capability: require_dist.recordingCapability,
+					provider: recordingProvider
+				},
+				{
+					capability: require_dist.storageEvictableCapability,
+					provider: evictableProvider
+				},
+				{
+					capability: require_dist.recordingExportCapability,
+					provider: exportProvider
+				}
+			],
+			customActions: recorderDebugActions,
+			actionHandlers: { "debug.storeCensus": async (input) => handleStoreCensusAction(this.readCensus, this.ctx.logger.child("Census"), input) }
+		};
 	}
 	async onShutdown() {
 		this.eventUnsub?.();
@@ -12242,17 +12668,29 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("recorder: retiring the flattened settings keys failed", { meta: { error: require_dist.errMsg(err) } });
 		}
 	}
+	/**
+	* `ctx.api.settingsStore`, wrapped ONCE through {@link censusStoreClient}.
+	*
+	* LAZY (see `calendar` above): `ctx` is not assigned until `initialize()`
+	* runs, so this cannot be a field initialiser. The wrap is permanent and
+	* cheap when disarmed (one `get` trap and a comparison) — what is armed and
+	* disarmed is `this.readCensus`, through `debug.storeCensus`, not this seam.
+	*/
+	censusedSettingsStore() {
+		this.censusedSettingsStoreClient ??= censusStoreClient(this.ctx.api.settingsStore, this.readCensus);
+		return this.censusedSettingsStoreClient;
+	}
 	configStore() {
-		return recordingConfigsState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingConfigsState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the exportId→ExportRecord blob (same `BaseAddon.state()`
 	*  wrapper as the config store). */
 	exportsStore() {
-		return recordingExportsState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingExportsState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the bounded recordings ops-log ring. */
 	opsLogStore() {
-		return recordingOpsLogState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingOpsLogState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the recorder-owned placement blob (assignments + volume ids). */
 	placementStore() {