@camstack/addon-pipeline 1.2.129 → 1.2.131

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { B as deriveRecordingMode, Dt as hydrateSchema, Gt as string, Ht as number, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-CMio-1qq.mjs";
+import { B as deriveRecordingMode, Dt as hydrateSchema, F as customAction, Gt as string, Ht as number, L as defineCustomActions, Lt as array, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, Rt as boolean, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-DO0UVhOk.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CgBCF-mE.mjs";
@@ -335,6 +335,70 @@ function fragmentRangeFor(index, offsetTicks) {
 		sampleIndex: chosen
 	};
 }
+/**
+* Convert a byte budget into the SET of consecutive fragments that fits,
+* starting at the fragment covering `offsetTicks` and walking FORWARD —
+* matching the read direction a scrub or a sequential-forward strategy
+* actually uses. Pure: `index` is the already-parsed `tfra` table, so this
+* never touches the segment's payload.
+*
+* Greedy: adds the next fragment only while the running total stays within
+* `maxBytes`. The anchor fragment is ALWAYS included, even when it alone
+* exceeds `maxBytes` — {@link FragmentBudgetPlan.oversizeFragment} says so
+* explicitly rather than the caller receiving an empty set and reading it as
+* "nothing to read" (D49's letter, applied to a byte budget: a fallible
+* computation must never silently look like an unbind).
+*/
+function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	let lo = 0;
+	let hi = samples.length - 1;
+	let anchor = 0;
+	while (lo <= hi) {
+		const mid = lo + hi >> 1;
+		const s = samples[mid];
+		if (s === void 0) break;
+		if (s.timeTicks <= offsetTicks) {
+			anchor = mid;
+			lo = mid + 1;
+		} else hi = mid - 1;
+	}
+	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
+	const anchorStart = samples[anchor]?.moofOffset ?? 0;
+	const anchorEnd = endOf(anchor);
+	const fragments = [{
+		start: anchorStart,
+		end: anchorEnd,
+		sampleIndex: anchor
+	}];
+	let total = anchorEnd - anchorStart;
+	const oversizeFragment = total > maxBytes;
+	let i = anchor;
+	while (i + 1 < samples.length) {
+		const nextIndex = i + 1;
+		const nextSample = samples[nextIndex];
+		if (nextSample === void 0) break;
+		const nextStart = nextSample.moofOffset;
+		const nextEnd = endOf(nextIndex);
+		const nextSize = nextEnd - nextStart;
+		if (total + nextSize > maxBytes) break;
+		fragments.push({
+			start: nextStart,
+			end: nextEnd,
+			sampleIndex: nextIndex
+		});
+		total += nextSize;
+		i = nextIndex;
+	}
+	const last = fragments[fragments.length - 1];
+	return {
+		fragments,
+		start: fragments[0].start,
+		end: last.end,
+		reachesSegmentEnd: last.end >= mfraOffset,
+		oversizeFragment
+	};
+}
 //#endregion
 //#region src/recorder/mfra-capture.ts
 /**
@@ -2736,6 +2800,271 @@ function activeModeForConfig(config) {
 	return deriveRecordingMode(config);
 }
 //#endregion
+//#region src/recorder/addon/store/read-census.ts
+/**
+* Longest window the census may be armed for, in ms.
+*
+* Ten minutes is several report windows - enough to catch a sweep that fires
+* every few minutes - and short enough that an operator who forgets about it
+* pays for ten minutes, not until the next restart.
+*/
+var CENSUS_MAX_WINDOW_MS = 10 * 6e4;
+/** Store procedures worth attributing. Reads only: a write is an operator
+*  gesture or a pipeline product, and neither is a mystery. */
+var CENSUSED_PROCEDURES = new Set([
+	"query",
+	"count",
+	"get",
+	"histogram",
+	"getAll"
+]);
+/**
+* Can `new Proxy` wrap this, and is it worth wrapping?
+*
+* Functions count. The generated store client is a **tRPC proxy** and every
+* intermediate node of one is CALLABLE — `typeof client.query` is `'function'`,
+* not `'object'`. A wrapper that tested only for `'object'` handed the whole
+* client back unwrapped, deployed, and reported zero `query` and zero `count`
+* call sites while the engine was recording thousands a minute against the same
+* tables. Silence read as "nobody in this addon does it".
+*/
+function isProxyable(value) {
+	return typeof value === "object" && value !== null || typeof value === "function";
+}
+function rowsOf(value) {
+	if (Array.isArray(value)) return value.length;
+	if (typeof value === "number") return value;
+	if (value === void 0 || value === null) return 0;
+	return 1;
+}
+/**
+* One V8 stack line reduced to `Function@line`.
+*
+* A deployed addon is ONE bundled file, so the path is identical on every frame
+* and carries no information; the line number does. A frame that parses as
+* neither keeps its trimmed text rather than being dropped - an unrecognised
+* frame is still an attribution, and dropping it would silently shift the site
+* one frame up.
+*/
+function compactFrame(line) {
+	const trimmed = line.trim().replace(/^at\s+/, "");
+	const named = /^(.+?)\s+\((?:.*?):(\d+):\d+\)$/.exec(trimmed);
+	if (named !== null) return `${named[1]}@${named[2]}`;
+	const bare = /^(?:.*?):(\d+):\d+$/.exec(trimmed);
+	if (bare !== null) return `@${bare[1]}`;
+	return trimmed;
+}
+/** The census's view of a stack: the top {@link CENSUS_STACK_FRAMES} frames,
+*  innermost first, joined by ` < ` so a line reads caller-ward. */
+function siteFromStack(stack) {
+	if (stack === void 0) return "unknown";
+	const frames = stack.split("\n").slice(1, 4);
+	if (frames.length === 0) return "unknown";
+	return frames.map(compactFrame).join(" < ");
+}
+/**
+* Armed-window call-site counter.
+*
+* Disarmed it is one comparison per read and captures nothing - the stack is
+* the whole cost, and it is not taken.
+*/
+var StoreReadCensus = class {
+	now;
+	counts = /* @__PURE__ */ new Map();
+	armedUntil = 0;
+	armedAt = 0;
+	constructor(now = () => Date.now()) {
+		this.now = now;
+	}
+	/** Arm for `forMs`, clamped to {@link CENSUS_MAX_WINDOW_MS}. Re-arming
+	*  restarts the window and CLEARS the counts: two overlapping measurements in
+	*  one table is a table nobody can divide by a duration. */
+	arm(forMs) {
+		const at = this.now();
+		this.counts.clear();
+		this.armedAt = at;
+		this.armedUntil = at + Math.max(0, Math.min(forMs, CENSUS_MAX_WINDOW_MS));
+	}
+	disarm() {
+		this.armedUntil = 0;
+	}
+	get armed() {
+		return this.now() < this.armedUntil;
+	}
+	/** How long the current (or just-finished) window collected, in ms. The
+	*  divisor for a calls-per-minute rate - a count without it is a number that
+	*  cannot be compared to the next one. */
+	elapsedMs() {
+		const at = this.now();
+		return Math.max(0, Math.min(at, this.armedUntil) - this.armedAt);
+	}
+	/**
+	* The call site of whoever called `cutoff`, or `null` when disarmed.
+	*
+	* **Taken BEFORE the await, always.** The first version of this class
+	* captured the stack next to the counter, after the wrapped call had
+	* resolved - and by then the synchronous caller is gone: V8 stitches an async
+	* frame in its place and the site reads
+	* `Proxy.<anonymous> < processTicksAndRejections`, which is the census
+	* describing itself. It passed one of its own tests anyway, because that one
+	* caller happened to RETURN the promise rather than await it. An instrument
+	* that reports its own frames is worse than no instrument: the counts are
+	* real, so the wrong name gets believed.
+	*
+	* `cutoff` is the wrapper function itself, so every frame from the wrapper
+	* inwards is dropped and frame 0 is the code that asked.
+	*/
+	siteOf(cutoff) {
+		if (!this.armed) return null;
+		const holder = {};
+		Error.captureStackTrace(holder, cutoff);
+		return siteFromStack(holder.stack);
+	}
+	/**
+	* Count one read at an already-captured site.
+	*
+	* A `null` site means the census was disarmed when the call STARTED. It is
+	* not counted even if it lands inside a later window - a read belongs to the
+	* window that issued it.
+	*/
+	record(op, site, result) {
+		if (site === null) return;
+		const key = `${op} ${site}`;
+		const existing = this.counts.get(key);
+		if (existing === void 0) {
+			this.counts.set(key, {
+				op,
+				site,
+				calls: 1,
+				rows: rowsOf(result)
+			});
+			return;
+		}
+		existing.calls += 1;
+		existing.rows += rowsOf(result);
+	}
+	/** Busiest first. Does NOT clear - a window may be read as many times as the
+	*  operator likes and always describes the same window. */
+	rows() {
+		return [...this.counts.values()].map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			rows: r.rows
+		})).sort((a, b) => b.calls - a.calls);
+	}
+};
+/**
+* Wrap a settings-store client so every read is counted.
+*
+* A `Proxy` over the generated tRPC client rather than a hand-written facade:
+* the client has a procedure per cap method and a facade would need updating
+* every time the cap gains one - which is how a diagnostic quietly stops seeing
+* half the traffic. Unrecognised procedures pass straight through.
+*/
+function censusStoreClient(client, census) {
+	return new Proxy(client, { get(target, prop, receiver) {
+		const procedure = Reflect.get(target, prop, receiver);
+		if (typeof prop !== "string" || !CENSUSED_PROCEDURES.has(prop)) return procedure;
+		if (!isProxyable(procedure)) return procedure;
+		const op = prop;
+		return new Proxy(procedure, { get(procTarget, procProp, procReceiver) {
+			const call = Reflect.get(procTarget, procProp, procReceiver);
+			if (procProp !== "query" && procProp !== "mutate") return call;
+			if (typeof call !== "function") return call;
+			const wrapped = async (...args) => {
+				const site = census.siteOf(wrapped);
+				const result = await Reflect.apply(call, procTarget, args);
+				census.record(op, site, result);
+				return result;
+			};
+			return wrapped;
+		} });
+	} });
+}
+/** Log the census as one line, including when it collected nothing - silence
+*  after an arm is indistinguishable from a census that never armed. */
+function logCensus(census, logger, topN) {
+	const rows = census.rows();
+	const elapsedMs = census.elapsedMs();
+	const perMin = (calls) => elapsedMs === 0 ? 0 : Math.round(calls * 6e4 / elapsedMs);
+	logger.info("store read census", { meta: {
+		elapsedMs,
+		sites: rows.length,
+		calls: rows.reduce((acc, r) => acc + r.calls, 0),
+		top: rows.slice(0, topN).map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			perMin: perMin(r.calls),
+			rows: r.rows
+		}))
+	} });
+	return rows;
+}
+/**
+* `armMs: 0` (or omitted) READS the window that already ran — that is how a
+* measurement is collected after its window closed, and re-arming to read
+* would throw away exactly the numbers being asked for (`StoreReadCensus.arm`
+* clears on every call).
+*/
+var StoreCensusInputSchema = object({
+	armMs: number().int().min(0).max(CENSUS_MAX_WINDOW_MS).optional(),
+	limit: number().int().positive().max(200).optional()
+});
+var StoreCensusRowSchema = object({
+	op: string(),
+	site: string(),
+	calls: number(),
+	/** Calls extrapolated to a minute, directly comparable with the live-hub
+	*  profiler's own `get recorder:recording-configs` rate. */
+	perMin: number(),
+	rows: number()
+});
+var recorderDebugActions = defineCustomActions({ "debug.storeCensus": customAction(StoreCensusInputSchema, object({
+	armed: boolean(),
+	elapsedMs: number(),
+	sites: number(),
+	calls: number(),
+	rows: array(StoreCensusRowSchema).readonly()
+}), { auth: "admin" }) });
+/**
+* Arm-or-read, pulled out of the addon class so it is testable without
+* booting `RecorderV2Addon` — feed it a bare `StoreReadCensus` and a logger.
+*
+* The result is also logged (via {@link logCensus}), because a measurement
+* that exists only in an HTTP response is a measurement that is gone when the
+* next session asks what happened.
+*/
+function handleStoreCensusAction(census, logger, input) {
+	const limit = input.limit ?? 200;
+	if (input.armMs !== void 0 && input.armMs > 0) {
+		census.arm(input.armMs);
+		return {
+			armed: true,
+			elapsedMs: 0,
+			sites: 0,
+			calls: 0,
+			rows: []
+		};
+	}
+	const rows = logCensus(census, logger, limit);
+	const elapsedMs = census.elapsedMs();
+	return {
+		armed: census.armed,
+		elapsedMs,
+		sites: rows.length,
+		calls: rows.reduce((acc, r) => acc + r.calls, 0),
+		rows: rows.slice(0, limit).map((r) => ({
+			op: r.op,
+			site: r.site,
+			calls: r.calls,
+			perMin: elapsedMs === 0 ? 0 : Math.round(r.calls * 6e4 / elapsedMs),
+			rows: r.rows
+		}))
+	};
+}
+//#endregion
 //#region src/recorder/addon/directory-handler.ts
 var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
@@ -4093,6 +4422,18 @@ function buildMasterPlaylist(variants) {
 * against a real captured segment with every read recorded — "never the whole
 * file" is asserted in bytes.
 */
+/**
+* Byte budget for the `readGopBytes` fallback read, used with
+* {@link GopRangeArgs.maxBytes}.
+*
+* Same conceptual ceiling as `SCRUB_WHOLE_SEGMENT_MAX_BYTES` in
+* `stream-broker/recorded/recorded-feeder.ts` (D163, 1.5 MB) — declared here
+* independently rather than imported, because that module is the CLIENT
+* feeder (a different addon-internal concern; importing its whole dependency
+* graph for one number is the wrong direction). If D163's number moves,
+* this one moves with it.
+*/
+var SCRUB_GOP_BUDGET_MAX_BYTES = 15e5;
 /** Ticks → ms on the video timescale, rounded like the demux anchors samples. */
 function ticksToMs(ticks, timescale) {
 	return Math.round(ticks / timescale * 1e3);
@@ -4122,11 +4463,36 @@ async function readGopRange(file, args) {
 	if (init === null) return null;
 	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
 	if (videoIndex === null) return null;
-	const { start, end, sampleIndex } = fragmentRangeFor(videoIndex, Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale);
+	const offsetTicks = Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale;
+	let start;
+	let end;
+	let firstSampleIndex;
+	let lastSampleIndex;
+	let reachesSegmentEnd;
+	let oversizeFragment;
+	if (args.maxBytes === void 0) {
+		const single = fragmentRangeFor(videoIndex, offsetTicks);
+		start = single.start;
+		end = single.end;
+		firstSampleIndex = single.sampleIndex;
+		lastSampleIndex = single.sampleIndex;
+		reachesSegmentEnd = videoIndex.samples[single.sampleIndex + 1] === void 0;
+		oversizeFragment = false;
+	} else {
+		const plan = fragmentsWithinBudget(videoIndex, offsetTicks, args.maxBytes);
+		const firstFragment = plan.fragments[0];
+		const lastFragment = plan.fragments[plan.fragments.length - 1];
+		start = plan.start;
+		end = plan.end;
+		firstSampleIndex = firstFragment.sampleIndex;
+		lastSampleIndex = lastFragment.sampleIndex;
+		reachesSegmentEnd = plan.reachesSegmentEnd;
+		oversizeFragment = plan.oversizeFragment;
+	}
 	if (start <= 0 || end <= start || end > file.size) return null;
 	const fragment = await read(start, end - start);
-	const startTicks = videoIndex.samples[sampleIndex]?.timeTicks ?? 0;
-	const nextTicks = videoIndex.samples[sampleIndex + 1]?.timeTicks;
+	const startTicks = videoIndex.samples[firstSampleIndex]?.timeTicks ?? 0;
+	const nextTicks = videoIndex.samples[lastSampleIndex + 1]?.timeTicks;
 	const gopStartOffsetMs = ticksToMs(startTicks, init.videoTimescale);
 	const gopDurMs = nextTicks !== void 0 ? ticksToMs(nextTicks - startTicks, init.videoTimescale) : Math.max(1, args.segmentDurMs - gopStartOffsetMs);
 	const data = new Uint8Array(head.length + fragment.length);
@@ -4136,7 +4502,9 @@ async function readGopRange(file, args) {
 		data,
 		gopStartMs: args.segmentStartMs + gopStartOffsetMs,
 		gopDurMs,
-		bytesRead
+		bytesRead,
+		reachesSegmentEnd,
+		oversizeFragment
 	};
 }
 /**
@@ -4669,6 +5037,30 @@ function resolveSegmentFile(deps, deviceId, profile, startMs) {
 		abs: path.join(loc.root, seg.path)
 	};
 }
+/**
+* The log line's `meta`, or null when `readGopBytes` served nothing worth a
+* line. Split out from the handler so the decision is testable against a
+* plain object — no real fMP4 bytes needed to prove a >1.5 MB fragment
+* triggers it.
+*
+* The single-fragment budget overshoot is the notable case, not the routine
+* one: a `high`/`mid` scrub goes through this path on every tick by design
+* (client-side `profile-degraded`, already logged once per drag on the
+* feeder), and logging every such call here would spam nothing new. A
+* fragment that alone exceeds the budget is different — it is never returned
+* empty (never-empty is {@link fragmentsWithinBudget}'s contract), but an
+* operator debugging a slow drag needs to know it happened.
+*/
+function oversizeFragmentLogMeta(gop, args) {
+	if (!gop.oversizeFragment) return null;
+	return {
+		profile: args.profile,
+		startMs: args.startMs,
+		epochMs: args.epochMs,
+		fragmentBytes: gop.data.length,
+		maxBytes: SCRUB_GOP_BUDGET_MAX_BYTES
+	};
+}
 /** Default ranged opener: ONE `fs.open` per GOP answer serving all its reads. */
 async function openRangeFromDisk(absPath, size) {
 	const handle = await promises.open(absPath, "r");
@@ -4888,13 +5280,25 @@ function buildRecordingProvider(deps) {
 					segmentStartMs: seg.startMs,
 					segmentDurMs: seg.durMs,
 					epochMs,
-					seededIndex: deps.mfraFor?.(deviceId, profile, startMs)
+					seededIndex: deps.mfraFor?.(deviceId, profile, startMs),
+					maxBytes: SCRUB_GOP_BUDGET_MAX_BYTES
 				});
-				if (gop !== null) return {
-					data: gop.data,
-					gopStartMs: gop.gopStartMs,
-					gopDurMs: gop.gopDurMs
-				};
+				if (gop !== null) {
+					const oversizeMeta = oversizeFragmentLogMeta(gop, {
+						profile,
+						startMs,
+						epochMs
+					});
+					if (oversizeMeta !== null) deps.logger.warn("recording: readGopBytes served one fragment that alone exceeds the scrub budget", {
+						tags: { deviceId },
+						meta: oversizeMeta
+					});
+					return {
+						data: gop.data,
+						gopStartMs: gop.gopStartMs,
+						gopDurMs: gop.gopDurMs
+					};
+				}
 			} finally {
 				await file.close();
 			}
@@ -7116,7 +7520,46 @@ function resolveBandBufferMs(band) {
 */
 function eventsBandCanEverDemand(band) {
 	if (band.mode !== "events") return true;
-	return (band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0) && resolveBandBufferMs(band).postMs > 0;
+	return bandTriggerSources(band).length > 0 && resolveBandBufferMs(band).postMs > 0;
+}
+/**
+* LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
+* una banda diventano `TriggerSource[]`. `eventsBandCanEverDemand` e
+* `RecordingController.reportUnrecordable` lo leggono invece di ripetere
+* l'if-ladder motion/audio a mano.
+*/
+function bandTriggerSources(band) {
+	const t = band.triggers;
+	if (t === void 0) return [];
+	const sources = [];
+	if (t.motion === true) sources.push("motion");
+	if (t.audioThresholdDbfs !== void 0) sources.push("audio");
+	return sources;
+}
+/**
+* Does this audio window's level clear the ACTIVE band's configured
+* threshold?
+*
+* `PipelineAudioInferenceResultPayload.frame.level.dbfs`
+* (`packages/types/src/types/detection.ts:448`) and
+* `RecordingTriggers.audioThresholdDbfs` are the SAME unit and the SAME
+* scale — dBFS, 0 = full scale, more negative = quieter — produced by
+* `audio-analyzer-provider.ts:77` (`20 * log10(rms)`). No conversion exists
+* between them because none is needed: the one other place in this repo that
+* compares the two values does the same bare `>=`
+* (`notification-center/audio-rule-matcher.ts:221`). Inventing a conversion
+* here would recreate the exact defect this track exists to close, only
+* harder to see because a wrong scale still fires occasionally.
+*
+* `band` must be the band ACTIVE AT the audio window's own timestamp — a
+* device can carry several bands with different thresholds (day/night), and
+* only one is ever "the" threshold at a given instant. The caller
+* (`RecordingController.onAudioLevel`) resolves it the same way
+* `postBufferMsFor` resolves the post-buffer.
+*/
+function audioLevelQualifies(band, dbfs) {
+	const threshold = band?.triggers?.audioThresholdDbfs;
+	return threshold !== void 0 && dbfs >= threshold;
 }
 /** No trigger has been seen for this device yet. */
 var EMPTY_TRIGGER_STATE = {
@@ -8979,6 +9422,43 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Feed one audio window's LEVEL into the trigger pipeline — the counterpart
+	* of `onTrigger('motion', …)` for the `audioThresholdDbfs` source, and the
+	* feed that source was missing until 2026-08-26 (D62: authorized by the UI,
+	* read by every pure function in `band-decision.ts`, alimented by nobody).
+	*
+	* Qualification happens HERE, not upstream like motion's `data.detected`,
+	* because it depends on a PER-BAND threshold: `audioThresholdDbfs` is
+	* authored per band, not once per device, so it needs the same config read
+	* {@link postBufferMsFor} already does to resolve which band is active at
+	* `atMs` before it can know which threshold applies.
+	*
+	* Fed from the event bus (telemetry, may be dropped — D8/D11), so a
+	* config-read failure here drops only THIS window's qualification test
+	* rather than guessing a threshold — logged, never silent, and never fatal:
+	* the device's recordability does not depend on any single audio sample,
+	* the next window (or motion) can still open the band.
+	*/
+	async onAudioLevel(deviceId, dbfs, atMs) {
+		if (this.stopped) return;
+		let band;
+		try {
+			band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+		} catch (err) {
+			this.deps.logger.warn("recorder: audio trigger qualification skipped — config read failed", {
+				tags: { deviceId },
+				meta: {
+					atMs,
+					dbfs,
+					error: errMsg(err)
+				}
+			});
+			return;
+		}
+		if (!audioLevelQualifies(band, dbfs)) return;
+		await this.onTrigger(deviceId, "audio", atMs);
+	}
+	/**
 	* The post-buffer that governs this device's trigger history right now: it is
 	* both the MERGE GAP (a trigger landing inside the open live window belongs to
 	* the running episode) and the retention horizon. Falls back to the shipped
@@ -9093,7 +9573,7 @@ var RecordingController = class {
 			meta: {
 				postBufferSec: band.postBufferSec,
 				triggers: band.triggers,
-				reason: band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0 ? "postBufferSec is 0" : "no trigger configured"
+				reason: bandTriggerSources(band).length > 0 ? "postBufferSec is 0" : "no trigger configured"
 			}
 		});
 	}
@@ -11147,6 +11627,14 @@ var RecorderV2Addon = class extends BaseAddon {
 	eventMap = new EventMap();
 	/** Unsubscribe handle for the EventCapture motion subscription. */
 	eventUnsub = null;
+	/**
+	* Unsubscribe handle for the `PipelineAudioInferenceResult` audio-level
+	* subscription — the feed `audioThresholdDbfs` was missing (D62, Traccia 0
+	* of `docs/design/plans/2026-08-26-trigger-detection-e-sensori.md`). Kept
+	* separate from `eventUnsub` (a distinct bus category) but guarded and torn
+	* down the same way, idempotent re-entry included.
+	*/
+	audioTriggerUnsub = null;
 	/** Resolved recordings locations (id + root). Refreshed on boot + rescan.
 	*  Already ALIAS-GUARDED: a writable same-type duplicate of another
 	*  location's physical root arrives here demoted to read-only. */
@@ -11175,6 +11663,23 @@ var RecorderV2Addon = class extends BaseAddon {
 	retentionSweeper = null;
 	/** Reversible migration pause lease; never reflected in RecordingConfig. */
 	storageMigrationLeaseId = null;
+	/**
+	* Call-site attribution for `recorder:recording-configs` / `-exports` /
+	* `-ops-log` row reads (`store/read-census.ts`).
+	*
+	* Disarmed by default; armed for a bounded window through
+	* `debug.storeCensus`. It exists because the live-hub profiler names a
+	* TABLE — `get recorder:recording-configs` ran 581-892 calls/min on
+	* 2026-08-26, finding a row only ~56% of the time — and cannot say WHICH of
+	* `loadDeviceConfig`'s several cap-handler call sites (`getStatus`,
+	* `getDeviceConfig`, `rescanStorage`, `pruneFootage`) is issuing them.
+	* Picking the reader that LOOKS like a loop has cost this repo half a day
+	* twice, wrong both times — this measures instead.
+	*/
+	readCensus = new StoreReadCensus();
+	/** Memoised so every `configStore()` / `exportsStore()` / `opsLogStore()`
+	*  call shares ONE census instead of each wrapping the raw client afresh. */
+	censusedSettingsStoreClient = null;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -11579,24 +12084,30 @@ var RecorderV2Addon = class extends BaseAddon {
 			}
 		});
 		warnLostBands(this.configStore(), this.ctx.logger);
-		return { providers: [
-			{
-				capability: recordingCapability,
-				provider: recordingProvider
-			},
-			{
-				capability: storageEvictableCapability,
-				provider: evictableProvider
-			},
-			{
-				capability: recordingExportCapability,
-				provider: exportProvider
-			}
-		] };
+		return {
+			providers: [
+				{
+					capability: recordingCapability,
+					provider: recordingProvider
+				},
+				{
+					capability: storageEvictableCapability,
+					provider: evictableProvider
+				},
+				{
+					capability: recordingExportCapability,
+					provider: exportProvider
+				}
+			],
+			customActions: recorderDebugActions,
+			actionHandlers: { "debug.storeCensus": async (input) => handleStoreCensusAction(this.readCensus, this.ctx.logger.child("Census"), input) }
+		};
 	}
 	async onShutdown() {
 		this.eventUnsub?.();
 		this.eventUnsub = null;
+		this.audioTriggerUnsub?.();
+		this.audioTriggerUnsub = null;
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
@@ -11671,6 +12182,11 @@ var RecorderV2Addon = class extends BaseAddon {
 				this.controller?.onTrigger(deviceId, "motion", atMs);
 			}
 		});
+		if (this.audioTriggerUnsub === null) this.audioTriggerUnsub = this.ctx.eventBus.subscribe({ category: EventCategory.PipelineAudioInferenceResult }, (event) => {
+			const dbfs = event.data.frame.level?.dbfs;
+			if (dbfs === void 0) return;
+			this.controller?.onAudioLevel(event.data.deviceId, dbfs, event.data.frame.timestamp);
+		});
 		try {
 			await this.segmentHours?.load();
 			this.segmentHours?.hydrateIndex(this.index);
@@ -12241,17 +12757,29 @@ var RecorderV2Addon = class extends BaseAddon {
 			this.ctx.logger.warn("recorder: retiring the flattened settings keys failed", { meta: { error: errMsg(err) } });
 		}
 	}
+	/**
+	* `ctx.api.settingsStore`, wrapped ONCE through {@link censusStoreClient}.
+	*
+	* LAZY (see `calendar` above): `ctx` is not assigned until `initialize()`
+	* runs, so this cannot be a field initialiser. The wrap is permanent and
+	* cheap when disarmed (one `get` trap and a comparison) — what is armed and
+	* disarmed is `this.readCensus`, through `debug.storeCensus`, not this seam.
+	*/
+	censusedSettingsStore() {
+		this.censusedSettingsStoreClient ??= censusStoreClient(this.ctx.api.settingsStore, this.readCensus);
+		return this.censusedSettingsStoreClient;
+	}
 	configStore() {
-		return recordingConfigsState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingConfigsState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the exportId→ExportRecord blob (same `BaseAddon.state()`
 	*  wrapper as the config store). */
 	exportsStore() {
-		return recordingExportsState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingExportsState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the bounded recordings ops-log ring. */
 	opsLogStore() {
-		return recordingOpsLogState(this.ctx.api.settingsStore, this.ctx.logger);
+		return recordingOpsLogState(this.censusedSettingsStore(), this.ctx.logger);
 	}
 	/** Durable handle over the recorder-owned placement blob (assignments + volume ids). */
 	placementStore() {