@camstack/addon-pipeline 1.2.133 → 1.2.135

package/dist/recorder/index.js

@@ -1,7 +1,7 @@
-const require_dist = require("../dist-DsnZUYTs.js");
+const require_dist = require("../dist-BzLiQ8Ue.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
-const require_addon_utils = require("../addon-utils-FV2O25id.js");
+const require_addon_utils = require("../addon-utils-CKf8kbwh.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
@@ -237,81 +237,6 @@ var EventMap = class {
 	}
 };
 //#endregion
-//#region src/recorder/redundant-segments.ts
-/**
-* Return the indices (into `segs`) of segments safe to delete: those fully
-* contained within a kept segment `[coverStart, coverEnd]`. Sorting by start
-* ascending, then by end DESCENDING, guarantees the containing (longer) segment
-* is seen first and kept, and any shorter segment nested inside it is removed.
-*/
-function selectRedundantSegments(segs) {
-	if (segs.length < 2) return [];
-	const order = segs.map((s, i) => ({
-		start: s.startMs,
-		end: s.startMs + s.durMs,
-		i
-	})).toSorted((a, b) => a.start - b.start || b.end - a.end);
-	const remove = [];
-	let coverStart = Number.NEGATIVE_INFINITY;
-	let coverEnd = Number.NEGATIVE_INFINITY;
-	for (const seg of order) if (seg.start >= coverStart && seg.end <= coverEnd && seg.end > seg.start) remove.push(seg.i);
-	else {
-		coverStart = seg.start;
-		coverEnd = seg.end;
-	}
-	return remove;
-}
-//#endregion
-//#region src/recorder/janitor.ts
-/** Group an array by a string key. */
-function groupBy(items, key) {
-	const out = /* @__PURE__ */ new Map();
-	for (const it of items) {
-		const k = key(it);
-		const arr = out.get(k);
-		if (arr) arr.push(it);
-		else out.set(k, [it]);
-	}
-	return out;
-}
-async function runRedundancyJanitor(deps) {
-	let files = 0;
-	let bytes = 0;
-	for (const deviceId of deps.deviceIds) {
-		const byProfile = groupBy(deps.segmentsFor(deviceId), (r) => r.profile);
-		for (const [profile, rows] of byProfile) {
-			const sorted = [...rows].toSorted((a, b) => a.startMs - b.startMs);
-			const redundant = selectRedundantSegments(sorted);
-			if (redundant.length === 0) continue;
-			const victims = redundant.map((i) => sorted[i]);
-			for (const [location, vrows] of groupBy(victims, (v) => v.locationId)) try {
-				const reclaimed = await deps.evict(location, vrows);
-				files += vrows.length;
-				bytes += reclaimed;
-			} catch (err) {
-				deps.logger.warn("janitor: evict failed (skipping)", {
-					tags: { deviceId },
-					meta: {
-						deviceId,
-						profile,
-						location,
-						count: vrows.length,
-						error: err instanceof Error ? err.message : String(err)
-					}
-				});
-			}
-		}
-	}
-	if (files > 0) deps.logger.info("janitor: removed redundant recording segments", { meta: {
-		files,
-		bytes
-	} });
-	return {
-		files,
-		bytes
-	};
-}
-//#endregion
 //#region src/recorder/init-info.ts
 /** Walk sibling boxes in [from, to), yielding [type, start, end]. */
 function* boxes$1(buf, view, from, to) {
@@ -1291,69 +1216,6 @@ var RecordingIndex = class {
 		for (const m of this.byDevice.values()) for (const s of m.values()) if (s.locationId === locationId) out.push(s);
 		return out.toSorted((a, b) => a.startMs - b.startMs);
 	}
-	/**
-	* All segments across a SET of storage locations (one eviction DOMAIN — the
-	* locations that alias one physical filesystem root), oldest-first across the
-	* whole pool. This is the correct unit for byte-eviction: two location ids over
-	* the same disk must be reclaimed as ONE oldest-first stream, never partitioned.
-	*/
-	segmentsOnLocations(locationIds) {
-		const out = [];
-		for (const m of this.byDevice.values()) for (const s of m.values()) if (locationIds.has(s.locationId)) out.push(s);
-		return out.toSorted((a, b) => a.startMs - b.startMs);
-	}
-	/** Aggregate accounting across a SET of storage locations (one eviction domain). */
-	accountingForLocations(locationIds) {
-		let bytes = 0;
-		let count = 0;
-		let oldestMs = Infinity;
-		let newestMs = -Infinity;
-		for (const m of this.byDevice.values()) for (const s of m.values()) {
-			if (!locationIds.has(s.locationId)) continue;
-			bytes += s.bytes;
-			count += 1;
-			if (s.startMs < oldestMs) oldestMs = s.startMs;
-			if (s.startMs > newestMs) newestMs = s.startMs;
-		}
-		if (count === 0) return {
-			bytes: 0,
-			count: 0,
-			oldestMs: null,
-			newestMs: null
-		};
-		return {
-			bytes,
-			count,
-			oldestMs,
-			newestMs
-		};
-	}
-	/** Aggregate accounting for a storage location across every device. */
-	accountingForLocation(locationId) {
-		let bytes = 0;
-		let count = 0;
-		let oldestMs = Infinity;
-		let newestMs = -Infinity;
-		for (const m of this.byDevice.values()) for (const s of m.values()) {
-			if (s.locationId !== locationId) continue;
-			bytes += s.bytes;
-			count += 1;
-			if (s.startMs < oldestMs) oldestMs = s.startMs;
-			if (s.startMs > newestMs) newestMs = s.startMs;
-		}
-		if (count === 0) return {
-			bytes: 0,
-			count: 0,
-			oldestMs: null,
-			newestMs: null
-		};
-		return {
-			bytes,
-			count,
-			oldestMs,
-			newestMs
-		};
-	}
 	/** Binary-search a start-sorted slice for the segment containing epochMs. */
 	segmentAtIn(segs, epochMs) {
 		if (segs.length === 0) return null;
@@ -2256,12 +2118,36 @@ var StorageEvictableProvider = class {
 		for (const id of domain) if (!this.deps.isReadOnly(id)) writable.add(id);
 		return writable;
 	}
+	/**
+	* How many bytes this domain holds — ONE aggregation, no rows returned.
+	*
+	* The storage-pressure sweep asks this per managed location every 60 s, and
+	* two locations aliasing one root make it twice a minute. It used to be a
+	* walk over every indexed segment on the node (7.1 M rows live), which is
+	* also why the whole archive had to stay resident to be walked.
+	*/
 	async getEvictableUsage(input) {
-		return { bytes: this.deps.index.accountingForLocations(this.domainOf(input.locationId)).bytes };
+		const archive = this.deps.archive();
+		if (archive === null) {
+			this.deps.logger.warn("recorder: evictable usage unavailable — no footage archive to measure, reporting 0 evictable bytes", { meta: { locationId: input.locationId } });
+			return { bytes: 0 };
+		}
+		return { bytes: (await archive.accountingForLocations(this.domainOf(input.locationId))).bytes };
 	}
 	async evict(input) {
-		const onDomain = this.deps.index.segmentsOnLocations(this.domainOf(input.locationId));
-		const victims = selectEvictionsByBytes(onDomain, input.targetBytes);
+		const archive = this.deps.archive();
+		if (archive === null) {
+			this.deps.logger.warn("recorder: disk-pressure eviction skipped — no footage archive to pick the oldest from", { meta: {
+				locationId: input.locationId,
+				targetBytes: input.targetBytes
+			} });
+			return {
+				reclaimedBytes: 0,
+				exhausted: true
+			};
+		}
+		const oldest = await archive.oldestSegments(this.domainOf(input.locationId), input.targetBytes);
+		const victims = selectEvictionsByBytes(oldest.rows, input.targetBytes);
 		const byLocation = /* @__PURE__ */ new Map();
 		for (const v of victims) {
 			const group = byLocation.get(v.locationId);
@@ -2271,7 +2157,7 @@ var StorageEvictableProvider = class {
 		let reclaimedBytes = 0;
 		for (const [locationId, rows] of byLocation) reclaimedBytes += await this.deps.store.evict(locationId, rows);
 		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims));
-		const exhausted = victims.length >= onDomain.length;
+		const exhausted = oldest.exhausted && victims.length >= oldest.rows.length;
 		return {
 			reclaimedBytes,
 			exhausted
@@ -3068,6 +2954,7 @@ var CENSUS_MAX_WINDOW_MS = 10 * 6e4;
 var CENSUSED_PROCEDURES = new Set([
 	"query",
 	"count",
+	"aggregate",
 	"get",
 	"histogram",
 	"getAll"
@@ -5558,7 +5445,7 @@ function buildRecordingProvider(deps) {
 					locationId: first.id,
 					locationIds: ids,
 					root: first.root,
-					usedBytes: deps.index.accountingForLocations(new Set(ids)).bytes,
+					usedBytes: (await deps.archiveAccounting?.(new Set(ids)))?.bytes ?? 0,
 					availableBytes: cap.availableBytes,
 					totalBytes: cap.totalBytes
 				};
@@ -6338,6 +6225,7 @@ Object.freeze({
 		"listProfiles",
 		"listRuntimeNodes"
 	],
+	"log-channels": ["list"],
 	"log-destination": ["query"],
 	"login-method": ["getLoginMethods"],
 	"mqtt-broker": ["listBrokers"],
@@ -7088,61 +6976,6 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 }
 /** Entries classified between yields in {@link hydrateDeviceFromStorage}. */
 var HYDRATE_CHUNK = 2e4;
-/**
-* Device walks in flight at once in {@link hydrateDevicesFromStorage}.
-*
-* The walk is `readdir` latency on a network/FUSE share, not CPU: measured on
-* the live hub, 24 cold hour directories cost 31 s one at a time and 16.7 s
-* eight at a time. Four is the conservative point on that curve — enough to
-* hide most of the latency, few enough that the boot walk never becomes the
-* reason a live SegmentWriter waits. libuv's default threadpool is 4, so a
-* higher number here mostly queues.
-*/
-var HYDRATE_DEVICE_CONCURRENCY = 4;
-/**
-* Walk the archive for a whole fleet: bounded-parallel, and each camera becomes
-* authoritative the moment ITS OWN walk lands (D167).
-*
-* Two things this fixes, both measured on the live hub on 2026-08-15:
-*
-* - The caller was `for (const id of ids) await hydrateDeviceFromStorage(...)`,
-*   so seven cameras' 357 s of `readdir` WAS the 362 s wall clock. Nothing in
-*   the walk contends for CPU — it is share latency — so overlapping is free.
-* - `markHydratedAll` ran in a SECOND loop after every device. A camera whose
-*   walk finished at minute 1 still reported `hydrationOf → 'unknown'` until
-*   minute 6, and every read of it in that window paid for an on-demand walk
-*   over rows already in the index, competing with the walk still running for
-*   the others.
-*
-* A device whose walk throws is NOT marked: `unknown` is the honest answer, and
-* it is what keeps the read path walking that window on demand.
-*/
-async function hydrateDevicesFromStorage(api, index, deviceIds, locations, logger, options = {}) {
-	const concurrency = Math.max(1, options.concurrency ?? HYDRATE_DEVICE_CONCURRENCY);
-	const queue = [...deviceIds];
-	const walkOptions = {
-		...options.yieldBetween ? { yieldBetween: options.yieldBetween } : {},
-		...options.chunkSize !== void 0 ? { chunkSize: options.chunkSize } : {}
-	};
-	const lane = async () => {
-		for (;;) {
-			const deviceId = queue.shift();
-			if (deviceId === void 0) return;
-			try {
-				options.onDeviceStarted?.(deviceId);
-				await hydrateDeviceFromStorage(api, index, deviceId, locations, logger, walkOptions);
-				index.markHydratedAll(deviceId);
-				options.onDeviceHydrated?.(deviceId);
-			} catch (err) {
-				logger.warn("recorder: device hydrate failed — window stays unknown, reads will walk it", {
-					tags: { deviceId },
-					meta: { error: require_dist.errMsg(err) }
-				});
-			}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, lane));
-}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -7713,7 +7546,7 @@ var PlacementService = class {
 				limits.push(capacity.availableBytes - floor);
 			}
 			if (location.maxUsedGb !== void 0) {
-				const used = this.deps.usedOnLocation?.(location.id) ?? 0;
+				const used = await this.deps.usedOnLocation?.(location.id) ?? 0;
 				limits.push(location.maxUsedGb * 1e9 - used);
 			}
 			out.push({
@@ -11092,6 +10925,14 @@ var HOUR_MS$1 = 36e5;
 *   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
 var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+/**
+* The four aggregate columns exist so "how much footage is on this disk" is a
+* `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
+* segment rows. They are DERIVED from `paths` — never a second authority — and
+* {@link hourAggregate} is the only place that derives them, so a row loaded
+* from a database that predates these columns is corrected in the mirror the
+* moment it is read and repaired on disk by {@link SegmentHourLedger.repairAggregates}.
+*/
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
 		name: "key",
@@ -11123,15 +10964,85 @@ var RECORDING_SEGMENT_HOURS_COLUMNS = [
 		name: "paths",
 		type: "TEXT",
 		notNull: true
+	},
+	{
+		name: "bytes",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "segments",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "minStartMs",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "maxStartMs",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
 	}
 ];
-var RECORDING_SEGMENT_HOURS_INDEXES = [{
-	name: "idx_recorder_segment_hours_device",
-	columns: ["deviceId"]
-}, {
-	name: "idx_recorder_segment_hours_hour",
-	columns: ["hourStartMs"]
-}];
+var RECORDING_SEGMENT_HOURS_INDEXES = [
+	{
+		name: "idx_recorder_segment_hours_device",
+		columns: ["deviceId"]
+	},
+	{
+		name: "idx_recorder_segment_hours_hour",
+		columns: ["hourStartMs"]
+	},
+	(
+	/** The eviction read: one oldest-first stream across a SET of location ids.
+	*  Location leads so `locationId IN (…)` is a range scan and `hourStartMs`
+	*  supplies the order without a sort. */
+	{
+		name: "idx_recorder_segment_hours_loc_hour",
+		columns: ["locationId", "hourStartMs"]
+	})
+];
+/**
+* Bytes / count / oldest / newest for one hour's paths.
+*
+* Every field of a segment path encodes its own facts (`parseSegmentPath`), so
+* this is a derivation, not a measurement: it can never disagree with the paths
+* it was computed from. A path the parser refuses contributes nothing — it is
+* not a segment, and counting it would inflate a disk report.
+*/
+function hourAggregate(paths) {
+	let bytes = 0;
+	let segments = 0;
+	let minStartMs = 0;
+	let maxStartMs = 0;
+	for (const path of paths) {
+		const p = parseSegmentPath(path);
+		if (p === null) continue;
+		bytes += p.bytes;
+		if (segments === 0 || p.startMs < minStartMs) minStartMs = p.startMs;
+		if (segments === 0 || p.startMs > maxStartMs) maxStartMs = p.startMs;
+		segments += 1;
+	}
+	return {
+		bytes,
+		segments,
+		minStartMs,
+		maxStartMs
+	};
+}
+/** Build the persisted row for an hour from its paths — the ONE constructor. */
+function segmentHourRow(base) {
+	return {
+		...base,
+		...hourAggregate(base.paths)
+	};
+}
 /**
 * The largest share of a device's held hours a single walk may delete.
 *
@@ -11143,6 +11054,49 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [{
 * `readdir` over an unmounted root deletes all of it.
 */
 var LEDGER_PRUNE_MAX_SHARE = .5;
+/** Backstop on the oldest-first probe. A bounded read must stay bounded even if
+*  a caller asks for a target no archive can cover. */
+var OLDEST_MAX_PAGES = 16;
+/** Phase-one columns: everything the accumulation needs and nothing fat. */
+var OLDEST_PROBE_COLUMNS = [
+	"hourStartMs",
+	"bytes",
+	"locationId"
+];
+/** Aggregate-repair probe: the primary key always comes back, so this asks for
+*  the predicate column alone. */
+var REPAIR_PROBE_COLUMNS = ["segments"];
+/** Rows repaired per boot. The live archive is ~19 k hour rows. */
+var REPAIR_MAX_ROWS = 5e4;
+/** The four scalars an accounting answer is made of, asked in one statement. */
+var ACCOUNTING_FIELDS = [
+	{
+		as: "bytes",
+		field: "bytes",
+		op: "sum"
+	},
+	{
+		as: "segments",
+		field: "segments",
+		op: "sum"
+	},
+	{
+		as: "oldestMs",
+		field: "minStartMs",
+		op: "min"
+	},
+	{
+		as: "newestMs",
+		field: "maxStartMs",
+		op: "max"
+	}
+];
+var EMPTY_ACCOUNTING = {
+	bytes: 0,
+	count: 0,
+	oldestMs: null,
+	newestMs: null
+};
 function hourStartMs(startMs) {
 	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
 }
@@ -11178,7 +11132,11 @@ function rowToValue(row) {
 		profile: row.profile,
 		locationId: row.locationId,
 		hourStartMs: row.hourStartMs,
-		paths: JSON.stringify(row.paths)
+		paths: JSON.stringify(row.paths),
+		bytes: row.bytes,
+		segments: row.segments,
+		minStartMs: row.minStartMs,
+		maxStartMs: row.maxStartMs
 	};
 }
 function recordToRow(key, data) {
@@ -11193,14 +11151,14 @@ function recordToRow(key, data) {
 		return null;
 	}
 	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
-	return {
+	return segmentHourRow({
 		key,
 		deviceId,
 		profile,
 		locationId,
 		hourStartMs: hour,
 		paths: raw
-	};
+	});
 }
 var SPEC = {
 	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
@@ -11216,9 +11174,15 @@ var SPEC = {
 var SegmentHourLedger = class {
 	ledger;
 	logger;
+	/** Held for the two ARCHIVE reads below, which are queries rather than mirror
+	*  lookups. Every DECISION path (`recordSegment`, `dropSegments`, the prune
+	*  refusals) still answers from the mirror alone — D49 is about gates, and an
+	*  accounting number is not a gate. */
+	store;
 	isLocationUsable;
 	constructor(deps) {
 		this.logger = deps.logger;
+		this.store = deps.store;
 		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
 		this.ledger = new DurableLedger({
 			spec: SPEC,
@@ -11253,19 +11217,178 @@ var SegmentHourLedger = class {
 	hydrateIndex(index) {
 		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
 	}
+	/**
+	* Bytes / count / oldest / newest across a SET of storage locations, as ONE
+	* `SUM`/`COUNT`/`MIN`/`MAX` over the hour rows.
+	*
+	* The set is the eviction DOMAIN — the location ids that alias one physical
+	* root. It goes into a single statement as `locationId IN (…)`, never a loop
+	* per location: two ids over one disk are one pool, and asking twice is how
+	* an answer about a disk gets partitioned.
+	*/
+	async accountingForLocations(locationIds) {
+		const ids = [...locationIds];
+		if (ids.length === 0) return EMPTY_ACCOUNTING;
+		const out = await this.store.aggregate.query({
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+			fields: ACCOUNTING_FIELDS,
+			filter: { whereIn: { locationId: ids } }
+		});
+		const segments = out.values["segments"];
+		if (out.count === 0 || segments === null || segments === void 0) return EMPTY_ACCOUNTING;
+		return {
+			bytes: out.values["bytes"] ?? 0,
+			count: segments,
+			oldestMs: out.values["oldestMs"] ?? null,
+			newestMs: out.values["newestMs"] ?? null
+		};
+	}
+	/**
+	* The OLDEST segments across a set of storage locations — enough of them to
+	* cover `targetBytes`, and no more.
+	*
+	* ## The constraint this read exists to keep
+	*
+	* Locations aliasing one physical root must be reclaimed as ONE oldest-first
+	* stream. That is not a property of the CALLER here, it is a property of the
+	* STATEMENT: every id of the domain rides in a single
+	* `locationId IN (…) ORDER BY hourStartMs ASC`. A query per location plus a
+	* merge would be the age-partition data-loss bug rebuilt in a second place.
+	*
+	* ## Why two phases
+	*
+	* Phase one reads only the small columns and walks oldest-first until the
+	* accumulated bytes cover the target — normally one page. `paths` is by far
+	* the fattest column in the row and phase one never touches it. Phase two
+	* fetches paths for exactly the hours phase one chose.
+	*
+	* `exhausted` means the stream ran out before the target was met — the
+	* caller's stop condition, and the one thing a bounded read must still be
+	* able to say truthfully.
+	*/
+	async oldestSegments(locationIds, targetBytes) {
+		const ids = [...locationIds];
+		if (ids.length === 0 || targetBytes <= 0) return {
+			rows: [],
+			exhausted: true
+		};
+		const chosen = [];
+		let covered = 0;
+		let offset = 0;
+		let exhausted = false;
+		for (let page = 0; page < OLDEST_MAX_PAGES && covered < targetBytes; page++) {
+			const records = await this.store.query.query({
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				columns: OLDEST_PROBE_COLUMNS,
+				filter: {
+					whereIn: { locationId: ids },
+					orderBy: {
+						field: "hourStartMs",
+						direction: "asc"
+					},
+					limit: 32,
+					offset
+				}
+			});
+			for (const record of records) {
+				chosen.push(record.id);
+				const bytes = record.data["bytes"];
+				covered += typeof bytes === "number" ? bytes : 0;
+			}
+			offset += records.length;
+			if (records.length < 32) {
+				exhausted = true;
+				break;
+			}
+		}
+		if (chosen.length === 0) return {
+			rows: [],
+			exhausted: true
+		};
+		const full = await this.store.query.query({
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+			filter: {
+				whereIn: { key: chosen },
+				limit: chosen.length
+			}
+		});
+		const rows = [];
+		for (const record of full) {
+			const hour = recordToRow(record.id, record.data);
+			if (hour === null) continue;
+			for (const path of hour.paths) {
+				const parsed = parseSegmentPath(path);
+				if (parsed === null) continue;
+				rows.push({
+					deviceId: parsed.deviceId,
+					profile: parsed.profile,
+					startMs: parsed.startMs,
+					durMs: parsed.durMs,
+					bytes: parsed.bytes,
+					path,
+					locationId: hour.locationId
+				});
+			}
+		}
+		return {
+			rows: rows.toSorted((a, b) => a.startMs - b.startMs),
+			exhausted
+		};
+	}
+	/**
+	* Rewrite, once, the rows whose aggregate columns are still the schema
+	* default.
+	*
+	* `declareCollection` adds a column additively, so every row written before
+	* the aggregate columns existed holds `segments = 0` — and an hour row with
+	* no segments cannot exist any other way (`dropSegments` forgets an hour that
+	* empties). So `segments = 0` IS the backfill predicate, and after one pass
+	* it selects nothing. A partial repair finishes on the next boot; until then
+	* the affected disks UNDER-report, which prunes less and never more.
+	*/
+	async repairAggregates() {
+		let repaired = 0;
+		try {
+			const stale = await this.store.query.query({
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				columns: REPAIR_PROBE_COLUMNS,
+				filter: {
+					where: { segments: 0 },
+					limit: REPAIR_MAX_ROWS
+				}
+			});
+			for (const record of stale) {
+				const held = this.ledger.get(record.id);
+				if (held === void 0 || held.segments === 0) continue;
+				await this.ledger.put(held);
+				repaired += 1;
+			}
+		} catch (err) {
+			this.logger.warn("recorder: segment-hour aggregate repair failed — disks under-report", { meta: {
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				error: String(err)
+			} });
+			return repaired;
+		}
+		if (repaired > 0) this.logger.info("recorder: segment-hour aggregate columns backfilled", { meta: {
+			rows: repaired,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return repaired;
+	}
 	/** Write-behind: a just-finalized segment joins its hour row. */
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
 		const held = this.ledger.get(key);
 		if (held !== void 0 && held.paths.includes(row.path)) return;
-		await this.ledger.put({
+		await this.ledger.put(segmentHourRow({
 			key,
 			deviceId: row.deviceId,
 			profile: row.profile,
 			locationId: row.locationId,
 			hourStartMs: hour,
 			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
-		});
+		}));
 	}
 	/**
 	* Eviction confirmed these paths are gone from disk. Drop them; forget the
@@ -11291,10 +11414,10 @@ var SegmentHourLedger = class {
 				continue;
 			}
 			if (next.length === held.paths.length) continue;
-			await this.ledger.put({
+			await this.ledger.put(segmentHourRow({
 				...held,
 				paths: next
-			});
+			}));
 		}
 	}
 	/**
@@ -11321,18 +11444,18 @@ var SegmentHourLedger = class {
 		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
 			const { key, hourStartMs: hour } = hourOf(seg);
 			const existing = fromIndex.get(key);
-			if (existing === void 0) fromIndex.set(key, {
+			if (existing === void 0) fromIndex.set(key, segmentHourRow({
 				key,
 				deviceId: seg.deviceId,
 				profile: seg.profile,
 				locationId: seg.locationId,
 				hourStartMs: hour,
 				paths: [seg.path]
-			});
-			else fromIndex.set(key, {
+			}));
+			else fromIndex.set(key, segmentHourRow({
 				...existing,
 				paths: [...existing.paths, seg.path]
-			});
+			}));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
 		for (const row of this.ledger.snapshot()) {
@@ -11346,10 +11469,10 @@ var SegmentHourLedger = class {
 			}
 			if (additiveOnly) {
 				const union = uniquePaths([...disk.paths, ...row.paths]);
-				if (!samePaths(union, row.paths)) await this.ledger.put({
+				if (!samePaths(union, row.paths)) await this.ledger.put(segmentHourRow({
 					...row,
 					paths: union
-				});
+				}));
 				continue;
 			}
 			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
@@ -11970,22 +12093,14 @@ var EXPORT_SWEEP_INTERVAL_MS = 5 * 6e4;
 *  hourly cadence keeps the storage.list/evict cost negligible while honouring
 *  the recording-spec §6 periodic retention. */
 var RETENTION_SWEEP_INTERVAL_MS = 60 * 6e4;
-/**
-* How long after boot the FULL-archive index walk starts.
-*
-* The walk is a recursive `readdir` per device over the whole recordings
-* subtree — minutes of network-FS latency on a real archive (measured: 240 s
-* for ONE 43 017-entry device, 2026-08-15) and it is the read model for
-* playback/retention/footprint, NOT the write path. Every read self-hydrates
-* the window it is asked about, and the whole-archive consumers
-* (retention sweep, redundancy janitor, disk-pressure eviction) only ever
-* under-report while the index is partial — so the walk waits out the boot
-* storm (writers attaching, staging reconcile relocating, first viewer paint)
-* instead of competing with it. Five minutes because the storm is measured in
-* seconds-to-a-minute and the consumers re-run on their own cadences anyway
-* (retention hourly, eviction on pressure).
-*/
-var FULL_WALK_DEFER_MS = 5 * 6e4;
+/** What the per-volume usage row reports when the hour ledger is unavailable:
+*  nothing measured, rather than a total counted off a partial RAM index. */
+var EMPTY_ARCHIVE_ACCOUNTING = {
+	bytes: 0,
+	count: 0,
+	oldestMs: null,
+	newestMs: null
+};
 /** Grace after a completed download before a `deleteAfterDownload` file is removed. */
 var EXPORT_DELETE_GRACE_MS = 6e4;
 /** Only `.mp4` export ids matching this shape are servable (traversal guard). */
@@ -12124,11 +12239,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	exportEngine = null;
 	/** Periodic export-expiry sweep timer. Cleared on shutdown. */
 	exportSweepTimer = null;
-	/** Timer arming the deferred full-archive index walk. Null once fired. */
-	fullWalkTimer = null;
-	/** Single-flight guard for the full-archive walk (onHubReachable can re-enter
-	*  on a hub reconnect while a deferred walk is still running). */
-	fullWalkInFlight = false;
 	/** The `recording` cap provider — retained so the periodic retention sweep can
 	*  call its `pruneFootage`. Null until built in `onInitialize`. */
 	recordingProvider = null;
@@ -12295,7 +12405,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			opsLog,
 			alert: (input) => this.emitPlacementAlert(input),
 			capacityFor: (location) => this.locationCapacity(location.root),
-			usedOnLocation: (locationId) => this.index.accountingForLocation(locationId).bytes,
+			usedOnLocation: async (locationId) => (await this.segmentHours?.accountingForLocations(new Set([locationId])))?.bytes ?? 0,
 			dailyBytesFor: (deviceId, profile) => this.dailyBytesFor(deviceId, profile)
 		});
 		this.controller = new RecordingController({
@@ -12407,6 +12517,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			locations: () => this.resolvedLocations,
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
+			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
 			reconcileHourLedger: async (deviceId) => {
 				await this.segmentHours?.reconcileFromIndex(this.index, [deviceId], Date.now());
@@ -12437,7 +12548,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		const recordingProvider = buildRecordingProvider(recordingDeps);
 		this.recordingProvider = recordingProvider;
 		const evictableProvider = new StorageEvictableProvider({
-			index: this.index,
+			archive: () => this.segmentHours,
+			logger: this.ctx.logger,
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
 			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
@@ -12621,10 +12733,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		}
 		this.retentionSweeper?.stop();
 		this.retentionSweeper = null;
-		if (this.fullWalkTimer !== null) {
-			clearTimeout(this.fullWalkTimer);
-			this.fullWalkTimer = null;
-		}
 		this.exportEngine = null;
 		this.recordingProvider = null;
 	}
@@ -12736,6 +12844,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		try {
 			await this.segmentHours?.load();
 			this.segmentHours?.hydrateIndex(this.index);
+			this.segmentHours?.repairAggregates();
 		} catch (err) {
 			this.ctx.logger.warn("recorder: segment-hour ledger load failed — hours stay unknown until a read walks them", { meta: { error: require_dist.errMsg(err) } });
 		}
@@ -13224,85 +13333,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		} });
 	}
 	/**
-	* Opt-in fleet walk — NOT armed at boot (2026-08-22: starved scrub/play).
-	* Kept so an operator path can still request a full reconcile later.
-	*
-	* ⚠ That operator path DOES NOT EXIST YET. This is the only caller of
-	* `runFullArchiveWalk`, so today the whole walk is unreachable — `tsc` was
-	* flagging it as unused and it was one of the errors keeping this package
-	* red. Made public rather than deleted, because deleting it would have taken
-	* the 100-line walk with it; but a comment promising a path nobody built is
-	* exactly the leftover that reads as verification. Wire it or drop it.
-	*/
-	scheduleDeferredFullWalk(deviceIds) {
-		if (this.fullWalkTimer !== null || this.fullWalkInFlight) return;
-		this.fullWalkTimer = setTimeout(() => {
-			this.fullWalkTimer = null;
-			this.runFullArchiveWalk(deviceIds);
-		}, FULL_WALK_DEFER_MS);
-		this.fullWalkTimer.unref?.();
-		this.ctx.logger.info("recorder: full-archive index walk deferred", { meta: {
-			deferMs: FULL_WALK_DEFER_MS,
-			deviceCount: deviceIds.length
-		} });
-	}
-	/**
-	* The deferred boot walk itself: hydrate every configured device from the
-	* recordings roots, then run the two consumers that need the COMPLETE index
-	* (the eviction-domain span log and the redundancy janitor). Bounded-parallel
-	* per device, and each camera is marked hydrated at ITS OWN completion — not
-	* after the fleet (D167). Never overlaps itself.
-	*/
-	async runFullArchiveWalk(deviceIds) {
-		if (this.fullWalkInFlight) return;
-		this.fullWalkInFlight = true;
-		const hydrateStartedMs = Date.now();
-		try {
-			await hydrateDevicesFromStorage(this.ctx.api, this.index, deviceIds, this.resolvedLocations, this.ctx.logger);
-			this.ctx.logger.info("recorder: hydrated index from storage", { meta: {
-				deviceCount: deviceIds.length,
-				locationCount: this.resolvedLocations.length,
-				ms: Date.now() - hydrateStartedMs
-			} });
-			try {
-				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
-			} catch (err) {
-				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: require_dist.errMsg(err) } });
-			}
-			const loggedDomains = /* @__PURE__ */ new Set();
-			for (const loc of this.resolvedLocations) {
-				const domain = this.locationDomain(loc.id);
-				const domainKey = [...domain].toSorted().join("+");
-				if (loggedDomains.has(domainKey)) continue;
-				loggedDomains.add(domainKey);
-				const acct = this.index.accountingForLocations(domain);
-				this.ctx.logger.info("recorder: eviction domain footage span at hydrate", { meta: {
-					locationIds: [...domain].toSorted(),
-					root: loc.root,
-					count: acct.count,
-					bytes: acct.bytes,
-					oldestMs: acct.oldestMs,
-					newestMs: acct.newestMs
-				} });
-			}
-			const store = this.segmentStore;
-			if (store) try {
-				await runRedundancyJanitor({
-					deviceIds,
-					segmentsFor: (deviceId, profile) => this.index.segments(deviceId, profile),
-					evict: (location, rows) => store.evict(location, rows),
-					logger: this.ctx.logger
-				});
-			} catch (err) {
-				this.ctx.logger.warn("recorder: redundancy janitor failed", { meta: { error: require_dist.errMsg(err) } });
-			}
-		} catch (err) {
-			this.ctx.logger.warn("recorder: full-archive walk failed", { meta: { error: require_dist.errMsg(err) } });
-		} finally {
-			this.fullWalkInFlight = false;
-		}
-	}
-	/**
 	* Declare the three row collections that replaced the `recordingConfigs`,
 	* `recordingExports` and `recordingOpsLog` blob keys. Idempotent — a
 	* re-declaration of the same shape is a no-op in the engine.