@camstack/addon-pipeline 1.2.134 → 1.2.136

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { At as hydrateSchema, Bt as array, Dt as DeviceFeature, E as RecordingConfigSchema, Gt as number, I as customAction, Jt as string, K as evaluateSensorEdge, Kt as object, Lt as selectAssignedProfileSlots, N as batteryCapability, Ot as DeviceType, Pt as nodePin, R as defineCustomActions, T as RECORDING_EXPORT_MAX_READ_BYTES, Tt as BaseAddon, V as deriveRecordingMode, Vt as boolean, X as isFirstLevelMacroClass, Xt as EventCategory, _ as ExportRecordSchema, ct as recordingCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, h as EVENT_PAD_MS, ht as storageEvictableCapability, i as BatteryStatusSchema, lt as recordingExportCapability, pt as resolveRecordingProfiles, qt as record, x as OpsLogEntrySchema, yt as errMsg, z as deriveBatteryPresence } from "../dist-Dsn9NGO3.mjs";
+import { $t as EventCategory, At as DeviceFeature, B as defineCustomActions, Bt as selectAssignedProfileSlots, E as RecordingConfigSchema, J as evaluateSensorEdge, Jt as number, L as customAction, Lt as nodePin, N as batteryCapability, Nt as hydrateSchema, Ot as BaseAddon, Q as isFirstLevelMacroClass, St as errMsg, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as array, V as deriveBatteryPresence, Wt as boolean, Xt as record, Yt as object, Zt as string, _ as ExportRecordSchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as recordingCapability, ft as recordingExportCapability, gt as resolveRecordingProfiles, h as EVENT_PAD_MS, i as BatteryStatusSchema, jt as DeviceType, vt as storageEvictableCapability, x as OpsLogEntrySchema } from "../dist-C1dXLLQq.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CgBCF-mE.mjs";
@@ -236,81 +236,6 @@ var EventMap = class {
 	}
 };
 //#endregion
-//#region src/recorder/redundant-segments.ts
-/**
-* Return the indices (into `segs`) of segments safe to delete: those fully
-* contained within a kept segment `[coverStart, coverEnd]`. Sorting by start
-* ascending, then by end DESCENDING, guarantees the containing (longer) segment
-* is seen first and kept, and any shorter segment nested inside it is removed.
-*/
-function selectRedundantSegments(segs) {
-	if (segs.length < 2) return [];
-	const order = segs.map((s, i) => ({
-		start: s.startMs,
-		end: s.startMs + s.durMs,
-		i
-	})).toSorted((a, b) => a.start - b.start || b.end - a.end);
-	const remove = [];
-	let coverStart = Number.NEGATIVE_INFINITY;
-	let coverEnd = Number.NEGATIVE_INFINITY;
-	for (const seg of order) if (seg.start >= coverStart && seg.end <= coverEnd && seg.end > seg.start) remove.push(seg.i);
-	else {
-		coverStart = seg.start;
-		coverEnd = seg.end;
-	}
-	return remove;
-}
-//#endregion
-//#region src/recorder/janitor.ts
-/** Group an array by a string key. */
-function groupBy(items, key) {
-	const out = /* @__PURE__ */ new Map();
-	for (const it of items) {
-		const k = key(it);
-		const arr = out.get(k);
-		if (arr) arr.push(it);
-		else out.set(k, [it]);
-	}
-	return out;
-}
-async function runRedundancyJanitor(deps) {
-	let files = 0;
-	let bytes = 0;
-	for (const deviceId of deps.deviceIds) {
-		const byProfile = groupBy(deps.segmentsFor(deviceId), (r) => r.profile);
-		for (const [profile, rows] of byProfile) {
-			const sorted = [...rows].toSorted((a, b) => a.startMs - b.startMs);
-			const redundant = selectRedundantSegments(sorted);
-			if (redundant.length === 0) continue;
-			const victims = redundant.map((i) => sorted[i]);
-			for (const [location, vrows] of groupBy(victims, (v) => v.locationId)) try {
-				const reclaimed = await deps.evict(location, vrows);
-				files += vrows.length;
-				bytes += reclaimed;
-			} catch (err) {
-				deps.logger.warn("janitor: evict failed (skipping)", {
-					tags: { deviceId },
-					meta: {
-						deviceId,
-						profile,
-						location,
-						count: vrows.length,
-						error: err instanceof Error ? err.message : String(err)
-					}
-				});
-			}
-		}
-	}
-	if (files > 0) deps.logger.info("janitor: removed redundant recording segments", { meta: {
-		files,
-		bytes
-	} });
-	return {
-		files,
-		bytes
-	};
-}
-//#endregion
 //#region src/recorder/init-info.ts
 /** Walk sibling boxes in [from, to), yielding [type, start, end]. */
 function* boxes$1(buf, view, from, to) {
@@ -1290,69 +1215,6 @@ var RecordingIndex = class {
 		for (const m of this.byDevice.values()) for (const s of m.values()) if (s.locationId === locationId) out.push(s);
 		return out.toSorted((a, b) => a.startMs - b.startMs);
 	}
-	/**
-	* All segments across a SET of storage locations (one eviction DOMAIN — the
-	* locations that alias one physical filesystem root), oldest-first across the
-	* whole pool. This is the correct unit for byte-eviction: two location ids over
-	* the same disk must be reclaimed as ONE oldest-first stream, never partitioned.
-	*/
-	segmentsOnLocations(locationIds) {
-		const out = [];
-		for (const m of this.byDevice.values()) for (const s of m.values()) if (locationIds.has(s.locationId)) out.push(s);
-		return out.toSorted((a, b) => a.startMs - b.startMs);
-	}
-	/** Aggregate accounting across a SET of storage locations (one eviction domain). */
-	accountingForLocations(locationIds) {
-		let bytes = 0;
-		let count = 0;
-		let oldestMs = Infinity;
-		let newestMs = -Infinity;
-		for (const m of this.byDevice.values()) for (const s of m.values()) {
-			if (!locationIds.has(s.locationId)) continue;
-			bytes += s.bytes;
-			count += 1;
-			if (s.startMs < oldestMs) oldestMs = s.startMs;
-			if (s.startMs > newestMs) newestMs = s.startMs;
-		}
-		if (count === 0) return {
-			bytes: 0,
-			count: 0,
-			oldestMs: null,
-			newestMs: null
-		};
-		return {
-			bytes,
-			count,
-			oldestMs,
-			newestMs
-		};
-	}
-	/** Aggregate accounting for a storage location across every device. */
-	accountingForLocation(locationId) {
-		let bytes = 0;
-		let count = 0;
-		let oldestMs = Infinity;
-		let newestMs = -Infinity;
-		for (const m of this.byDevice.values()) for (const s of m.values()) {
-			if (s.locationId !== locationId) continue;
-			bytes += s.bytes;
-			count += 1;
-			if (s.startMs < oldestMs) oldestMs = s.startMs;
-			if (s.startMs > newestMs) newestMs = s.startMs;
-		}
-		if (count === 0) return {
-			bytes: 0,
-			count: 0,
-			oldestMs: null,
-			newestMs: null
-		};
-		return {
-			bytes,
-			count,
-			oldestMs,
-			newestMs
-		};
-	}
 	/** Binary-search a start-sorted slice for the segment containing epochMs. */
 	segmentAtIn(segs, epochMs) {
 		if (segs.length === 0) return null;
@@ -2255,12 +2117,36 @@ var StorageEvictableProvider = class {
 		for (const id of domain) if (!this.deps.isReadOnly(id)) writable.add(id);
 		return writable;
 	}
+	/**
+	* How many bytes this domain holds — ONE aggregation, no rows returned.
+	*
+	* The storage-pressure sweep asks this per managed location every 60 s, and
+	* two locations aliasing one root make it twice a minute. It used to be a
+	* walk over every indexed segment on the node (7.1 M rows live), which is
+	* also why the whole archive had to stay resident to be walked.
+	*/
 	async getEvictableUsage(input) {
-		return { bytes: this.deps.index.accountingForLocations(this.domainOf(input.locationId)).bytes };
+		const archive = this.deps.archive();
+		if (archive === null) {
+			this.deps.logger.warn("recorder: evictable usage unavailable — no footage archive to measure, reporting 0 evictable bytes", { meta: { locationId: input.locationId } });
+			return { bytes: 0 };
+		}
+		return { bytes: (await archive.accountingForLocations(this.domainOf(input.locationId))).bytes };
 	}
 	async evict(input) {
-		const onDomain = this.deps.index.segmentsOnLocations(this.domainOf(input.locationId));
-		const victims = selectEvictionsByBytes(onDomain, input.targetBytes);
+		const archive = this.deps.archive();
+		if (archive === null) {
+			this.deps.logger.warn("recorder: disk-pressure eviction skipped — no footage archive to pick the oldest from", { meta: {
+				locationId: input.locationId,
+				targetBytes: input.targetBytes
+			} });
+			return {
+				reclaimedBytes: 0,
+				exhausted: true
+			};
+		}
+		const oldest = await archive.oldestSegments(this.domainOf(input.locationId), input.targetBytes);
+		const victims = selectEvictionsByBytes(oldest.rows, input.targetBytes);
 		const byLocation = /* @__PURE__ */ new Map();
 		for (const v of victims) {
 			const group = byLocation.get(v.locationId);
@@ -2270,7 +2156,7 @@ var StorageEvictableProvider = class {
 		let reclaimedBytes = 0;
 		for (const [locationId, rows] of byLocation) reclaimedBytes += await this.deps.store.evict(locationId, rows);
 		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims));
-		const exhausted = victims.length >= onDomain.length;
+		const exhausted = oldest.exhausted && victims.length >= oldest.rows.length;
 		return {
 			reclaimedBytes,
 			exhausted
@@ -3067,6 +2953,7 @@ var CENSUS_MAX_WINDOW_MS = 10 * 6e4;
 var CENSUSED_PROCEDURES = new Set([
 	"query",
 	"count",
+	"aggregate",
 	"get",
 	"histogram",
 	"getAll"
@@ -5556,7 +5443,7 @@ function buildRecordingProvider(deps) {
 					locationId: first.id,
 					locationIds: ids,
 					root: first.root,
-					usedBytes: deps.index.accountingForLocations(new Set(ids)).bytes,
+					usedBytes: (await deps.archiveAccounting?.(new Set(ids)))?.bytes ?? 0,
 					availableBytes: cap.availableBytes,
 					totalBytes: cap.totalBytes
 				};
@@ -6336,6 +6223,7 @@ Object.freeze({
 		"listProfiles",
 		"listRuntimeNodes"
 	],
+	"log-channels": ["list"],
 	"log-destination": ["query"],
 	"login-method": ["getLoginMethods"],
 	"mqtt-broker": ["listBrokers"],
@@ -7086,61 +6974,6 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 }
 /** Entries classified between yields in {@link hydrateDeviceFromStorage}. */
 var HYDRATE_CHUNK = 2e4;
-/**
-* Device walks in flight at once in {@link hydrateDevicesFromStorage}.
-*
-* The walk is `readdir` latency on a network/FUSE share, not CPU: measured on
-* the live hub, 24 cold hour directories cost 31 s one at a time and 16.7 s
-* eight at a time. Four is the conservative point on that curve — enough to
-* hide most of the latency, few enough that the boot walk never becomes the
-* reason a live SegmentWriter waits. libuv's default threadpool is 4, so a
-* higher number here mostly queues.
-*/
-var HYDRATE_DEVICE_CONCURRENCY = 4;
-/**
-* Walk the archive for a whole fleet: bounded-parallel, and each camera becomes
-* authoritative the moment ITS OWN walk lands (D167).
-*
-* Two things this fixes, both measured on the live hub on 2026-08-15:
-*
-* - The caller was `for (const id of ids) await hydrateDeviceFromStorage(...)`,
-*   so seven cameras' 357 s of `readdir` WAS the 362 s wall clock. Nothing in
-*   the walk contends for CPU — it is share latency — so overlapping is free.
-* - `markHydratedAll` ran in a SECOND loop after every device. A camera whose
-*   walk finished at minute 1 still reported `hydrationOf → 'unknown'` until
-*   minute 6, and every read of it in that window paid for an on-demand walk
-*   over rows already in the index, competing with the walk still running for
-*   the others.
-*
-* A device whose walk throws is NOT marked: `unknown` is the honest answer, and
-* it is what keeps the read path walking that window on demand.
-*/
-async function hydrateDevicesFromStorage(api, index, deviceIds, locations, logger, options = {}) {
-	const concurrency = Math.max(1, options.concurrency ?? HYDRATE_DEVICE_CONCURRENCY);
-	const queue = [...deviceIds];
-	const walkOptions = {
-		...options.yieldBetween ? { yieldBetween: options.yieldBetween } : {},
-		...options.chunkSize !== void 0 ? { chunkSize: options.chunkSize } : {}
-	};
-	const lane = async () => {
-		for (;;) {
-			const deviceId = queue.shift();
-			if (deviceId === void 0) return;
-			try {
-				options.onDeviceStarted?.(deviceId);
-				await hydrateDeviceFromStorage(api, index, deviceId, locations, logger, walkOptions);
-				index.markHydratedAll(deviceId);
-				options.onDeviceHydrated?.(deviceId);
-			} catch (err) {
-				logger.warn("recorder: device hydrate failed — window stays unknown, reads will walk it", {
-					tags: { deviceId },
-					meta: { error: errMsg(err) }
-				});
-			}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, lane));
-}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -7711,7 +7544,7 @@ var PlacementService = class {
 				limits.push(capacity.availableBytes - floor);
 			}
 			if (location.maxUsedGb !== void 0) {
-				const used = this.deps.usedOnLocation?.(location.id) ?? 0;
+				const used = await this.deps.usedOnLocation?.(location.id) ?? 0;
 				limits.push(location.maxUsedGb * 1e9 - used);
 			}
 			out.push({
@@ -8899,6 +8732,38 @@ var RESTART_MAX_MS = 1e4;
 /** A process that ran at least this long is "stable" → reset the restart count,
 *  so sporadic blips over a long lifetime never accumulate into a give-up. */
 var STABLE_RUN_MS = 3e4;
+/**
+* The window the SECOND budget counts over — and it counts EVERY restart,
+* whatever that run lasted.
+*
+* `STABLE_RUN_MS` above is a reset, and a reset is a blind spot: measured on
+* 2026-08-27, `SegmentWriter restarting` fired **1 814 times in 12 h** and
+* almost every `ranMs` was over 30 s (122 620 / 165 255 / 345 420 / 394 522 ms
+* are four consecutive real samples), so `attempt` never left 1, `onGaveUp`
+* never fired, and `recoverWriterGaveUp` never ran. The storm could have lasted
+* forever without a single line saying anything was wrong.
+*
+* A window cannot be zeroed by a long run, which is the whole point. Modelled
+* on `CrashSupervisor` (kernel, D6): timestamps age out of `windowMs`, and the
+* count inside it is the budget.
+*/
+var RESTART_WINDOW_MS = 60 * 6e4;
+/**
+* Restarts inside {@link RESTART_WINDOW_MS} before the writer stops respawning
+* and escalates to the controller.
+*
+* 15/hour, from the measured distribution. Per writer over the same 12 h:
+* 1441/high 549 (**45.8/h**), 615/high 241 (20.1/h), 618/high 217 (18.1/h),
+* 592/high 211 (17.6/h), 590/high 195 (16.3/h) — every one of them a storm and
+* every one of them silent — against `low` profiles at 4–15 per 12 h (≤1.3/h),
+* which is what a healthy writer looks like. 15 separates them with room for a
+* camera that blips hourly and is otherwise fine.
+*
+* It never shadows {@link MAX_RESTARTS}: 10 CONSECUTIVE rapid failures happen
+* inside ~90 s, so the rapid breaker still trips first on a hard failure. This
+* one exists for the slow storm the rapid breaker structurally cannot see.
+*/
+var MAX_RESTARTS_IN_WINDOW = 15;
 /** Grace between the SIGTERM in stop() and the escalated SIGKILL. */
 var KILL_GRACE_MS = 500;
 /** Supervises one passthrough ffmpeg for a single (camera, profile). */
@@ -8908,6 +8773,12 @@ var SegmentWriter = class {
 	proc = null;
 	stopped = false;
 	restarts = 0;
+	/**
+	* Epoch-ms of every termination still inside {@link RESTART_WINDOW_MS}.
+	* Replaced, never mutated in place, so a reader can never observe a
+	* half-pruned window.
+	*/
+	restartWindow = [];
 	restartTimer = null;
 	startedAt = 0;
 	exitWait = null;
@@ -8941,10 +8812,11 @@ var SegmentWriter = class {
 			settled = true;
 			this.onTermination(termination, stderrTail);
 		};
-		proc.on("exit", (code) => {
+		proc.on("exit", (code, signal) => {
 			terminate({
 				reason: "exit",
-				exitCode: typeof code === "number" ? code : null
+				exitCode: typeof code === "number" ? code : null,
+				signal: typeof signal === "string" ? signal : null
 			});
 		});
 		proc.on("error", (raw) => {
@@ -8960,32 +8832,51 @@ var SegmentWriter = class {
 	/**
 	* The ONE restart policy, reached from both `exit` and `error`.
 	*
-	* `deps.logger` is the device-scoped child the controller binds
-	* (`logger.withTags({ deviceId })`), so every line below carries
-	* `tags: { deviceId }` — "why is 617 worse than 615" is always asked per
-	* camera, and a writer that stops recording one camera must be greppable by
-	* that camera.
+	* Every line below carries `tags: { deviceId }` from `deps.deviceId` — "why
+	* is 617 worse than 615" is always asked per camera, and a writer that stops
+	* recording one camera must be greppable by that camera.
 	*/
 	onTermination(termination, stderrTail) {
 		this.resolveExit?.();
 		this.resolveExit = null;
 		this.proc = null;
 		if (this.stopped) return;
-		const ranMs = Date.now() - this.startedAt;
+		const now = Date.now();
+		const ranMs = now - this.startedAt;
 		if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
-		if (termination.reason === "spawn-error") {
-			this.deps.logger.warn("SegmentWriter ffmpeg spawn failed", { meta: {
+		this.restartWindow = [...this.restartWindow.filter((at) => at > now - RESTART_WINDOW_MS), now];
+		const restartsInWindow = this.restartWindow.length;
+		if (termination.reason === "exit") this.deps.logger.warn("SegmentWriter ffmpeg exited", {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
 				outDir: this.cfg.outDir,
-				errorCode: termination.errorCode,
-				error: termination.message,
-				permanent: termination.permanent
-			} });
-			if (termination.permanent) {
-				this.deps.logger.error("SegmentWriter giving up: ffmpeg cannot be executed on this node", { meta: {
+				exitCode: termination.exitCode,
+				signal: termination.signal,
+				ranMs,
+				restartsInWindow,
+				windowMs: RESTART_WINDOW_MS,
+				stderrTail: stderrTail.join(" | ")
+			}
+		});
+		if (termination.reason === "spawn-error") {
+			this.deps.logger.warn("SegmentWriter ffmpeg spawn failed", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
 					outDir: this.cfg.outDir,
 					errorCode: termination.errorCode,
-					error: termination.message
-				} });
+					error: termination.message,
+					permanent: termination.permanent
+				}
+			});
+			if (termination.permanent) {
+				this.deps.logger.error("SegmentWriter giving up: ffmpeg cannot be executed on this node", {
+					tags: { deviceId: this.deps.deviceId },
+					meta: {
+						outDir: this.cfg.outDir,
+						errorCode: termination.errorCode,
+						error: termination.message
+					}
+				});
 				this.stopped = true;
 				this.deps.onGaveUp?.();
 				return;
@@ -8993,25 +8884,51 @@ var SegmentWriter = class {
 			this.deps.onResourcePressure?.();
 		}
 		if (this.restarts >= MAX_RESTARTS) {
-			this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
-				outDir: this.cfg.outDir,
-				reason: termination.reason,
-				code: termination.reason === "exit" ? termination.exitCode : termination.errorCode,
-				stderrTail: stderrTail.join(" | ")
-			} });
+			this.deps.logger.warn("SegmentWriter giving up after max restarts", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					outDir: this.cfg.outDir,
+					reason: termination.reason,
+					code: termination.reason === "exit" ? termination.exitCode : termination.errorCode,
+					stderrTail: stderrTail.join(" | ")
+				}
+			});
+			this.stopped = true;
+			this.deps.onGaveUp?.();
+			return;
+		}
+		if (restartsInWindow >= MAX_RESTARTS_IN_WINDOW) {
+			this.deps.logger.warn("SegmentWriter giving up: restart storm", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					outDir: this.cfg.outDir,
+					restartsInWindow,
+					windowMs: RESTART_WINDOW_MS,
+					budget: MAX_RESTARTS_IN_WINDOW,
+					attempt: this.restarts,
+					ranMs,
+					reason: termination.reason,
+					code: termination.reason === "exit" ? termination.exitCode : termination.errorCode,
+					stderrTail: stderrTail.join(" | ")
+				}
+			});
 			this.stopped = true;
 			this.deps.onGaveUp?.();
 			return;
 		}
 		this.restarts++;
 		const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
-		this.deps.logger.info("SegmentWriter restarting", { meta: {
-			outDir: this.cfg.outDir,
-			attempt: this.restarts,
-			delayMs,
-			ranMs,
-			reason: termination.reason
-		} });
+		this.deps.logger.info("SegmentWriter restarting", {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				outDir: this.cfg.outDir,
+				attempt: this.restarts,
+				restartsInWindow,
+				delayMs,
+				ranMs,
+				reason: termination.reason
+			}
+		});
 		this.restartTimer = setTimeout(() => {
 			this.restartTimer = null;
 			this.start();
@@ -10275,6 +10192,7 @@ var RecordingController = class {
 		}, {
 			spawn: this.deps.spawn,
 			logger: deviceLog,
+			deviceId,
 			onGaveUp: () => {
 				this.recoverWriterGaveUp(deviceId, profile);
 			},
@@ -10698,6 +10616,209 @@ function buildRecordingExportProvider(deps) {
 */
 var resolveRecordingHubHostname = resolveHubHostname;
 //#endregion
+//#region src/recorder/redundant-segments.ts
+/**
+* Return the indices (into `segs`) of segments safe to delete: those fully
+* contained within a kept segment `[coverStart, coverEnd]`. Sorting by start
+* ascending, then by end DESCENDING, guarantees the containing (longer) segment
+* is seen first and kept, and any shorter segment nested inside it is removed.
+*/
+function selectRedundantSegments(segs) {
+	if (segs.length < 2) return [];
+	const order = segs.map((s, i) => ({
+		start: s.startMs,
+		end: s.startMs + s.durMs,
+		i
+	})).toSorted((a, b) => a.start - b.start || b.end - a.end);
+	const remove = [];
+	let coverStart = Number.NEGATIVE_INFINITY;
+	let coverEnd = Number.NEGATIVE_INFINITY;
+	for (const seg of order) if (seg.start >= coverStart && seg.end <= coverEnd && seg.end > seg.start) remove.push(seg.i);
+	else {
+		coverStart = seg.start;
+		coverEnd = seg.end;
+	}
+	return remove;
+}
+//#endregion
+//#region src/recorder/addon/redundancy-sweep.ts
+/**
+* Periodic redundancy sweep — the only thing that removes duplicated footage.
+*
+* WHY IT EXISTS AGAIN
+* ───────────────────
+* Every `SegmentWriter` restart re-dials the broker with `withRecordingIntent`,
+* and the broker answers a RECORDING dial with its pre-roll ring (≈10 s). So a
+* restart does not resume at the live edge: it re-writes ~10 s of media that is
+* already on disk. At the 2026-08-27 measurement — **1 814 restarts in 12 h** —
+* that is ~5 hours of duplicated `high`-profile footage per day, on a fuse
+* share that was already at 90 % full.
+*
+* The pruner that used to remove it, `runRedundancyJanitor`, was reachable ONLY
+* from `runFullArchiveWalk`, which was reachable only from
+* `scheduleDeferredFullWalk`, which had no caller at all — so on 2026-08-27
+* (commit `9308428b4`) all three were deleted together as dead code. That was
+* correct about the walk and left the system with **no duplicate pruner
+* whatsoever**. The precedent for letting this class of waste run unattended is
+* the 179 GB of stranded staging segments in `staging-reconcile.ts`.
+*
+* WHAT IS DIFFERENT FROM THE ONE THAT WAS DELETED
+* ───────────────────────────────────────────────
+* The old janitor ran once, after a walk of the WHOLE archive, and asked the
+* in-RAM index for `segments(deviceId)` — a full copy plus a sort of every row
+* the device owns. At the live shape (7.1 M rows) that copy alone was measured
+* at ~560 MB of transient heap, which is precisely the cost D248 had just
+* finished removing from the pressure sweep. Reconnecting it in that shape
+* would have traded one regression for another.
+*
+* So this one is bounded by a LOOKBACK WINDOW, not by the archive: duplicates
+* are made by a restart, restarts are now, and `segmentsStartingIn` slices the
+* sorted view instead of copying it. Cost grows with footage RECORDED in the
+* window — the invariant the recorder is supposed to satisfy — never with rows
+* already indexed.
+*
+* WHAT IT WILL NOT DO
+* ───────────────────
+* It never deletes a segment that contributes unique coverage:
+* {@link selectRedundantSegments} selects only segments fully contained inside
+* another segment that is KEPT, and staggered partial overlaps are always kept.
+* The delete itself is `SegmentStore.evict` — the same audited path
+* disk-pressure eviction uses, so a removed segment is de-indexed exactly as an
+* evicted one is. A failure for one (device, profile, location) is logged and
+* never aborts the pass.
+*/
+/** The profiles a recorder writes. Same set `staging-reconcile` sweeps. */
+var SWEPT_PROFILES = [
+	"high",
+	"mid",
+	"low"
+];
+/** Group rows by the location that owns them. `evict` is per-location. */
+function byLocation(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const found = out.get(row.locationId);
+		if (found) found.push(row);
+		else out.set(row.locationId, [row]);
+	}
+	return out;
+}
+/**
+* Owns its timer and a single-flight guard, the same shape the retention sweep
+* and the export janitor already use — a slow pass is never overlapped by the
+* next tick.
+*/
+var RedundancySweeper = class {
+	deps;
+	timer = null;
+	sweeping = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Arm the sweep on its interval. Idempotent.
+	*
+	* Deliberately NOT run immediately: boot is when the writers are attaching,
+	* the staging reconcile is relocating thousands of files over shfs and the
+	* first viewer is painting. A duplicate that has waited an hour can wait
+	* another one; the write path cannot.
+	*/
+	start() {
+		if (this.timer !== null) return;
+		this.timer = setInterval(() => {
+			this.sweep();
+		}, this.deps.intervalMs);
+		this.timer.unref?.();
+	}
+	/** Stop the timer. Idempotent. An in-flight pass still completes. */
+	stop() {
+		if (this.timer !== null) {
+			clearInterval(this.timer);
+			this.timer = null;
+		}
+	}
+	/**
+	* One pass. Never throws: a device-list read failure aborts THIS pass
+	* (logged), a per-location evict failure is logged and the pass continues.
+	*/
+	async sweep() {
+		const empty = {
+			files: 0,
+			bytes: 0,
+			devices: 0
+		};
+		if (this.sweeping) {
+			this.deps.logger.debug("recorder: redundancy sweep already running — skipping this tick");
+			return empty;
+		}
+		this.sweeping = true;
+		try {
+			let deviceIds;
+			try {
+				deviceIds = await this.deps.deviceIds();
+			} catch (err) {
+				this.deps.logger.warn("recorder: redundancy sweep could not read the device list", { meta: { error: errMsg(err) } });
+				return empty;
+			}
+			const toMs = (this.deps.now ?? Date.now)();
+			const fromMs = toMs - this.deps.lookbackMs;
+			let files = 0;
+			let bytes = 0;
+			let devices = 0;
+			for (const deviceId of deviceIds) {
+				let removedHere = 0;
+				for (const profile of SWEPT_PROFILES) {
+					const rows = this.deps.segmentsInWindow(deviceId, profile, fromMs, toMs);
+					const redundant = selectRedundantSegments(rows);
+					if (redundant.length === 0) continue;
+					const victims = redundant.map((i) => rows[i]).filter((row) => row !== void 0);
+					for (const [locationId, group] of byLocation(victims)) try {
+						const reclaimed = await this.deps.evict(locationId, group);
+						files += group.length;
+						bytes += reclaimed;
+						removedHere += group.length;
+					} catch (err) {
+						this.deps.logger.warn("recorder: redundancy sweep could not evict duplicates", {
+							tags: { deviceId },
+							meta: {
+								profile,
+								locationId,
+								count: group.length,
+								error: errMsg(err)
+							}
+						});
+					}
+				}
+				if (removedHere > 0) {
+					devices += 1;
+					this.deps.logger.info("recorder: removed duplicated segments for device", {
+						tags: { deviceId },
+						meta: {
+							files: removedHere,
+							fromMs,
+							toMs
+						}
+					});
+				}
+			}
+			this.deps.logger.info("recorder: redundancy sweep complete", { meta: {
+				devices,
+				files,
+				bytes,
+				lookbackMs: this.deps.lookbackMs,
+				deviceCount: deviceIds.length
+			} });
+			return {
+				files,
+				bytes,
+				devices
+			};
+		} finally {
+			this.sweeping = false;
+		}
+	}
+};
+//#endregion
 //#region src/recorder/addon/retention-sweep.ts
 /**
 * Periodic footage-retention sweep (recording-spec §6).
@@ -11090,6 +11211,14 @@ var HOUR_MS$1 = 36e5;
 *   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
 var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+/**
+* The four aggregate columns exist so "how much footage is on this disk" is a
+* `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
+* segment rows. They are DERIVED from `paths` — never a second authority — and
+* {@link hourAggregate} is the only place that derives them, so a row loaded
+* from a database that predates these columns is corrected in the mirror the
+* moment it is read and repaired on disk by {@link SegmentHourLedger.repairAggregates}.
+*/
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
 		name: "key",
@@ -11121,15 +11250,85 @@ var RECORDING_SEGMENT_HOURS_COLUMNS = [
 		name: "paths",
 		type: "TEXT",
 		notNull: true
+	},
+	{
+		name: "bytes",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "segments",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "minStartMs",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "maxStartMs",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
 	}
 ];
-var RECORDING_SEGMENT_HOURS_INDEXES = [{
-	name: "idx_recorder_segment_hours_device",
-	columns: ["deviceId"]
-}, {
-	name: "idx_recorder_segment_hours_hour",
-	columns: ["hourStartMs"]
-}];
+var RECORDING_SEGMENT_HOURS_INDEXES = [
+	{
+		name: "idx_recorder_segment_hours_device",
+		columns: ["deviceId"]
+	},
+	{
+		name: "idx_recorder_segment_hours_hour",
+		columns: ["hourStartMs"]
+	},
+	(
+	/** The eviction read: one oldest-first stream across a SET of location ids.
+	*  Location leads so `locationId IN (…)` is a range scan and `hourStartMs`
+	*  supplies the order without a sort. */
+	{
+		name: "idx_recorder_segment_hours_loc_hour",
+		columns: ["locationId", "hourStartMs"]
+	})
+];
+/**
+* Bytes / count / oldest / newest for one hour's paths.
+*
+* Every field of a segment path encodes its own facts (`parseSegmentPath`), so
+* this is a derivation, not a measurement: it can never disagree with the paths
+* it was computed from. A path the parser refuses contributes nothing — it is
+* not a segment, and counting it would inflate a disk report.
+*/
+function hourAggregate(paths) {
+	let bytes = 0;
+	let segments = 0;
+	let minStartMs = 0;
+	let maxStartMs = 0;
+	for (const path of paths) {
+		const p = parseSegmentPath(path);
+		if (p === null) continue;
+		bytes += p.bytes;
+		if (segments === 0 || p.startMs < minStartMs) minStartMs = p.startMs;
+		if (segments === 0 || p.startMs > maxStartMs) maxStartMs = p.startMs;
+		segments += 1;
+	}
+	return {
+		bytes,
+		segments,
+		minStartMs,
+		maxStartMs
+	};
+}
+/** Build the persisted row for an hour from its paths — the ONE constructor. */
+function segmentHourRow(base) {
+	return {
+		...base,
+		...hourAggregate(base.paths)
+	};
+}
 /**
 * The largest share of a device's held hours a single walk may delete.
 *
@@ -11141,6 +11340,49 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [{
 * `readdir` over an unmounted root deletes all of it.
 */
 var LEDGER_PRUNE_MAX_SHARE = .5;
+/** Backstop on the oldest-first probe. A bounded read must stay bounded even if
+*  a caller asks for a target no archive can cover. */
+var OLDEST_MAX_PAGES = 16;
+/** Phase-one columns: everything the accumulation needs and nothing fat. */
+var OLDEST_PROBE_COLUMNS = [
+	"hourStartMs",
+	"bytes",
+	"locationId"
+];
+/** Aggregate-repair probe: the primary key always comes back, so this asks for
+*  the predicate column alone. */
+var REPAIR_PROBE_COLUMNS = ["segments"];
+/** Rows repaired per boot. The live archive is ~19 k hour rows. */
+var REPAIR_MAX_ROWS = 5e4;
+/** The four scalars an accounting answer is made of, asked in one statement. */
+var ACCOUNTING_FIELDS = [
+	{
+		as: "bytes",
+		field: "bytes",
+		op: "sum"
+	},
+	{
+		as: "segments",
+		field: "segments",
+		op: "sum"
+	},
+	{
+		as: "oldestMs",
+		field: "minStartMs",
+		op: "min"
+	},
+	{
+		as: "newestMs",
+		field: "maxStartMs",
+		op: "max"
+	}
+];
+var EMPTY_ACCOUNTING = {
+	bytes: 0,
+	count: 0,
+	oldestMs: null,
+	newestMs: null
+};
 function hourStartMs(startMs) {
 	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
 }
@@ -11176,7 +11418,11 @@ function rowToValue(row) {
 		profile: row.profile,
 		locationId: row.locationId,
 		hourStartMs: row.hourStartMs,
-		paths: JSON.stringify(row.paths)
+		paths: JSON.stringify(row.paths),
+		bytes: row.bytes,
+		segments: row.segments,
+		minStartMs: row.minStartMs,
+		maxStartMs: row.maxStartMs
 	};
 }
 function recordToRow(key, data) {
@@ -11191,14 +11437,14 @@ function recordToRow(key, data) {
 		return null;
 	}
 	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
-	return {
+	return segmentHourRow({
 		key,
 		deviceId,
 		profile,
 		locationId,
 		hourStartMs: hour,
 		paths: raw
-	};
+	});
 }
 var SPEC = {
 	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
@@ -11214,9 +11460,15 @@ var SPEC = {
 var SegmentHourLedger = class {
 	ledger;
 	logger;
+	/** Held for the two ARCHIVE reads below, which are queries rather than mirror
+	*  lookups. Every DECISION path (`recordSegment`, `dropSegments`, the prune
+	*  refusals) still answers from the mirror alone — D49 is about gates, and an
+	*  accounting number is not a gate. */
+	store;
 	isLocationUsable;
 	constructor(deps) {
 		this.logger = deps.logger;
+		this.store = deps.store;
 		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
 		this.ledger = new DurableLedger({
 			spec: SPEC,
@@ -11251,19 +11503,178 @@ var SegmentHourLedger = class {
 	hydrateIndex(index) {
 		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
 	}
+	/**
+	* Bytes / count / oldest / newest across a SET of storage locations, as ONE
+	* `SUM`/`COUNT`/`MIN`/`MAX` over the hour rows.
+	*
+	* The set is the eviction DOMAIN — the location ids that alias one physical
+	* root. It goes into a single statement as `locationId IN (…)`, never a loop
+	* per location: two ids over one disk are one pool, and asking twice is how
+	* an answer about a disk gets partitioned.
+	*/
+	async accountingForLocations(locationIds) {
+		const ids = [...locationIds];
+		if (ids.length === 0) return EMPTY_ACCOUNTING;
+		const out = await this.store.aggregate.query({
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+			fields: ACCOUNTING_FIELDS,
+			filter: { whereIn: { locationId: ids } }
+		});
+		const segments = out.values["segments"];
+		if (out.count === 0 || segments === null || segments === void 0) return EMPTY_ACCOUNTING;
+		return {
+			bytes: out.values["bytes"] ?? 0,
+			count: segments,
+			oldestMs: out.values["oldestMs"] ?? null,
+			newestMs: out.values["newestMs"] ?? null
+		};
+	}
+	/**
+	* The OLDEST segments across a set of storage locations — enough of them to
+	* cover `targetBytes`, and no more.
+	*
+	* ## The constraint this read exists to keep
+	*
+	* Locations aliasing one physical root must be reclaimed as ONE oldest-first
+	* stream. That is not a property of the CALLER here, it is a property of the
+	* STATEMENT: every id of the domain rides in a single
+	* `locationId IN (…) ORDER BY hourStartMs ASC`. A query per location plus a
+	* merge would be the age-partition data-loss bug rebuilt in a second place.
+	*
+	* ## Why two phases
+	*
+	* Phase one reads only the small columns and walks oldest-first until the
+	* accumulated bytes cover the target — normally one page. `paths` is by far
+	* the fattest column in the row and phase one never touches it. Phase two
+	* fetches paths for exactly the hours phase one chose.
+	*
+	* `exhausted` means the stream ran out before the target was met — the
+	* caller's stop condition, and the one thing a bounded read must still be
+	* able to say truthfully.
+	*/
+	async oldestSegments(locationIds, targetBytes) {
+		const ids = [...locationIds];
+		if (ids.length === 0 || targetBytes <= 0) return {
+			rows: [],
+			exhausted: true
+		};
+		const chosen = [];
+		let covered = 0;
+		let offset = 0;
+		let exhausted = false;
+		for (let page = 0; page < OLDEST_MAX_PAGES && covered < targetBytes; page++) {
+			const records = await this.store.query.query({
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				columns: OLDEST_PROBE_COLUMNS,
+				filter: {
+					whereIn: { locationId: ids },
+					orderBy: {
+						field: "hourStartMs",
+						direction: "asc"
+					},
+					limit: 32,
+					offset
+				}
+			});
+			for (const record of records) {
+				chosen.push(record.id);
+				const bytes = record.data["bytes"];
+				covered += typeof bytes === "number" ? bytes : 0;
+			}
+			offset += records.length;
+			if (records.length < 32) {
+				exhausted = true;
+				break;
+			}
+		}
+		if (chosen.length === 0) return {
+			rows: [],
+			exhausted: true
+		};
+		const full = await this.store.query.query({
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+			filter: {
+				whereIn: { key: chosen },
+				limit: chosen.length
+			}
+		});
+		const rows = [];
+		for (const record of full) {
+			const hour = recordToRow(record.id, record.data);
+			if (hour === null) continue;
+			for (const path of hour.paths) {
+				const parsed = parseSegmentPath(path);
+				if (parsed === null) continue;
+				rows.push({
+					deviceId: parsed.deviceId,
+					profile: parsed.profile,
+					startMs: parsed.startMs,
+					durMs: parsed.durMs,
+					bytes: parsed.bytes,
+					path,
+					locationId: hour.locationId
+				});
+			}
+		}
+		return {
+			rows: rows.toSorted((a, b) => a.startMs - b.startMs),
+			exhausted
+		};
+	}
+	/**
+	* Rewrite, once, the rows whose aggregate columns are still the schema
+	* default.
+	*
+	* `declareCollection` adds a column additively, so every row written before
+	* the aggregate columns existed holds `segments = 0` — and an hour row with
+	* no segments cannot exist any other way (`dropSegments` forgets an hour that
+	* empties). So `segments = 0` IS the backfill predicate, and after one pass
+	* it selects nothing. A partial repair finishes on the next boot; until then
+	* the affected disks UNDER-report, which prunes less and never more.
+	*/
+	async repairAggregates() {
+		let repaired = 0;
+		try {
+			const stale = await this.store.query.query({
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				columns: REPAIR_PROBE_COLUMNS,
+				filter: {
+					where: { segments: 0 },
+					limit: REPAIR_MAX_ROWS
+				}
+			});
+			for (const record of stale) {
+				const held = this.ledger.get(record.id);
+				if (held === void 0 || held.segments === 0) continue;
+				await this.ledger.put(held);
+				repaired += 1;
+			}
+		} catch (err) {
+			this.logger.warn("recorder: segment-hour aggregate repair failed — disks under-report", { meta: {
+				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+				error: String(err)
+			} });
+			return repaired;
+		}
+		if (repaired > 0) this.logger.info("recorder: segment-hour aggregate columns backfilled", { meta: {
+			rows: repaired,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return repaired;
+	}
 	/** Write-behind: a just-finalized segment joins its hour row. */
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
 		const held = this.ledger.get(key);
 		if (held !== void 0 && held.paths.includes(row.path)) return;
-		await this.ledger.put({
+		await this.ledger.put(segmentHourRow({
 			key,
 			deviceId: row.deviceId,
 			profile: row.profile,
 			locationId: row.locationId,
 			hourStartMs: hour,
 			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
-		});
+		}));
 	}
 	/**
 	* Eviction confirmed these paths are gone from disk. Drop them; forget the
@@ -11289,10 +11700,10 @@ var SegmentHourLedger = class {
 				continue;
 			}
 			if (next.length === held.paths.length) continue;
-			await this.ledger.put({
+			await this.ledger.put(segmentHourRow({
 				...held,
 				paths: next
-			});
+			}));
 		}
 	}
 	/**
@@ -11319,18 +11730,18 @@ var SegmentHourLedger = class {
 		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
 			const { key, hourStartMs: hour } = hourOf(seg);
 			const existing = fromIndex.get(key);
-			if (existing === void 0) fromIndex.set(key, {
+			if (existing === void 0) fromIndex.set(key, segmentHourRow({
 				key,
 				deviceId: seg.deviceId,
 				profile: seg.profile,
 				locationId: seg.locationId,
 				hourStartMs: hour,
 				paths: [seg.path]
-			});
-			else fromIndex.set(key, {
+			}));
+			else fromIndex.set(key, segmentHourRow({
 				...existing,
 				paths: [...existing.paths, seg.path]
-			});
+			}));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
 		for (const row of this.ledger.snapshot()) {
@@ -11344,10 +11755,10 @@ var SegmentHourLedger = class {
 			}
 			if (additiveOnly) {
 				const union = uniquePaths([...disk.paths, ...row.paths]);
-				if (!samePaths(union, row.paths)) await this.ledger.put({
+				if (!samePaths(union, row.paths)) await this.ledger.put(segmentHourRow({
 					...row,
 					paths: union
-				});
+				}));
 				continue;
 			}
 			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
@@ -11968,22 +12379,26 @@ var EXPORT_SWEEP_INTERVAL_MS = 5 * 6e4;
 *  hourly cadence keeps the storage.list/evict cost negligible while honouring
 *  the recording-spec §6 periodic retention. */
 var RETENTION_SWEEP_INTERVAL_MS = 60 * 6e4;
-/**
-* How long after boot the FULL-archive index walk starts.
-*
-* The walk is a recursive `readdir` per device over the whole recordings
-* subtree — minutes of network-FS latency on a real archive (measured: 240 s
-* for ONE 43 017-entry device, 2026-08-15) and it is the read model for
-* playback/retention/footprint, NOT the write path. Every read self-hydrates
-* the window it is asked about, and the whole-archive consumers
-* (retention sweep, redundancy janitor, disk-pressure eviction) only ever
-* under-report while the index is partial — so the walk waits out the boot
-* storm (writers attaching, staging reconcile relocating, first viewer paint)
-* instead of competing with it. Five minutes because the storm is measured in
-* seconds-to-a-minute and the consumers re-run on their own cadences anyway
-* (retention hourly, eviction on pressure).
-*/
-var FULL_WALK_DEFER_MS = 5 * 6e4;
+/** How often the redundancy sweep removes footage a writer restart duplicated. */
+var REDUNDANCY_SWEEP_INTERVAL_MS = 60 * 6e4;
+/**
+* How far back each redundancy pass looks.
+*
+* Twice the interval, so a pass that is skipped (single-flight) or delayed by a
+* slow predecessor still covers the window its predecessor was supposed to.
+* It is deliberately NOT "the whole archive": duplicates are made by a writer
+* restart, restarts are recent, and a full-archive selection is the ~560 MB
+* transient copy D248 removed. See `redundancy-sweep.ts`.
+*/
+var REDUNDANCY_SWEEP_LOOKBACK_MS = 2 * REDUNDANCY_SWEEP_INTERVAL_MS;
+/** What the per-volume usage row reports when the hour ledger is unavailable:
+*  nothing measured, rather than a total counted off a partial RAM index. */
+var EMPTY_ARCHIVE_ACCOUNTING = {
+	bytes: 0,
+	count: 0,
+	oldestMs: null,
+	newestMs: null
+};
 /** Grace after a completed download before a `deleteAfterDownload` file is removed. */
 var EXPORT_DELETE_GRACE_MS = 6e4;
 /** Only `.mp4` export ids matching this shape are servable (traversal guard). */
@@ -12122,17 +12537,15 @@ var RecorderV2Addon = class extends BaseAddon {
 	exportEngine = null;
 	/** Periodic export-expiry sweep timer. Cleared on shutdown. */
 	exportSweepTimer = null;
-	/** Timer arming the deferred full-archive index walk. Null once fired. */
-	fullWalkTimer = null;
-	/** Single-flight guard for the full-archive walk (onHubReachable can re-enter
-	*  on a hub reconnect while a deferred walk is still running). */
-	fullWalkInFlight = false;
 	/** The `recording` cap provider — retained so the periodic retention sweep can
 	*  call its `pruneFootage`. Null until built in `onInitialize`. */
 	recordingProvider = null;
 	/** Periodic footage-retention sweep (owns its timer + single-flight guard).
 	*  Constructed + started in `onHubReachable`, stopped on shutdown. */
 	retentionSweeper = null;
+	/** Periodic duplicate-footage sweep — the ONLY pruner of media a writer
+	*  restart re-wrote. Constructed + started in `onHubReachable`. */
+	redundancySweeper = null;
 	/** Reversible migration pause lease; never reflected in RecordingConfig. */
 	storageMigrationLeaseId = null;
 	/**
@@ -12293,7 +12706,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			opsLog,
 			alert: (input) => this.emitPlacementAlert(input),
 			capacityFor: (location) => this.locationCapacity(location.root),
-			usedOnLocation: (locationId) => this.index.accountingForLocation(locationId).bytes,
+			usedOnLocation: async (locationId) => (await this.segmentHours?.accountingForLocations(new Set([locationId])))?.bytes ?? 0,
 			dailyBytesFor: (deviceId, profile) => this.dailyBytesFor(deviceId, profile)
 		});
 		this.controller = new RecordingController({
@@ -12405,6 +12818,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			locations: () => this.resolvedLocations,
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
+			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
 			reconcileHourLedger: async (deviceId) => {
 				await this.segmentHours?.reconcileFromIndex(this.index, [deviceId], Date.now());
@@ -12435,7 +12849,8 @@ var RecorderV2Addon = class extends BaseAddon {
 		const recordingProvider = buildRecordingProvider(recordingDeps);
 		this.recordingProvider = recordingProvider;
 		const evictableProvider = new StorageEvictableProvider({
-			index: this.index,
+			archive: () => this.segmentHours,
+			logger: this.ctx.logger,
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
 			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
@@ -12619,10 +13034,8 @@ var RecorderV2Addon = class extends BaseAddon {
 		}
 		this.retentionSweeper?.stop();
 		this.retentionSweeper = null;
-		if (this.fullWalkTimer !== null) {
-			clearTimeout(this.fullWalkTimer);
-			this.fullWalkTimer = null;
-		}
+		this.redundancySweeper?.stop();
+		this.redundancySweeper = null;
 		this.exportEngine = null;
 		this.recordingProvider = null;
 	}
@@ -12734,6 +13147,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		try {
 			await this.segmentHours?.load();
 			this.segmentHours?.hydrateIndex(this.index);
+			this.segmentHours?.repairAggregates();
 		} catch (err) {
 			this.ctx.logger.warn("recorder: segment-hour ledger load failed — hours stay unknown until a read walks them", { meta: { error: errMsg(err) } });
 		}
@@ -12761,6 +13175,16 @@ var RecorderV2Addon = class extends BaseAddon {
 			intervalMs: RETENTION_SWEEP_INTERVAL_MS
 		});
 		this.retentionSweeper?.start();
+		const store = this.segmentStore;
+		if (store && this.redundancySweeper === null) this.redundancySweeper = new RedundancySweeper({
+			deviceIds: async () => [...(await readDeviceConfigs(this.configStore())).keys()],
+			segmentsInWindow: (deviceId, profile, fromMs, toMs) => this.index.segmentsStartingIn(deviceId, profile, fromMs, toMs),
+			evict: (locationId, rows) => store.evict(locationId, rows),
+			logger: this.ctx.logger,
+			intervalMs: REDUNDANCY_SWEEP_INTERVAL_MS,
+			lookbackMs: REDUNDANCY_SWEEP_LOOKBACK_MS
+		});
+		this.redundancySweeper?.start();
 	}
 	/**
 	* Rebuild the sensor trigger's reverse index from the persisted configs.
@@ -13222,85 +13646,6 @@ var RecorderV2Addon = class extends BaseAddon {
 		} });
 	}
 	/**
-	* Opt-in fleet walk — NOT armed at boot (2026-08-22: starved scrub/play).
-	* Kept so an operator path can still request a full reconcile later.
-	*
-	* ⚠ That operator path DOES NOT EXIST YET. This is the only caller of
-	* `runFullArchiveWalk`, so today the whole walk is unreachable — `tsc` was
-	* flagging it as unused and it was one of the errors keeping this package
-	* red. Made public rather than deleted, because deleting it would have taken
-	* the 100-line walk with it; but a comment promising a path nobody built is
-	* exactly the leftover that reads as verification. Wire it or drop it.
-	*/
-	scheduleDeferredFullWalk(deviceIds) {
-		if (this.fullWalkTimer !== null || this.fullWalkInFlight) return;
-		this.fullWalkTimer = setTimeout(() => {
-			this.fullWalkTimer = null;
-			this.runFullArchiveWalk(deviceIds);
-		}, FULL_WALK_DEFER_MS);
-		this.fullWalkTimer.unref?.();
-		this.ctx.logger.info("recorder: full-archive index walk deferred", { meta: {
-			deferMs: FULL_WALK_DEFER_MS,
-			deviceCount: deviceIds.length
-		} });
-	}
-	/**
-	* The deferred boot walk itself: hydrate every configured device from the
-	* recordings roots, then run the two consumers that need the COMPLETE index
-	* (the eviction-domain span log and the redundancy janitor). Bounded-parallel
-	* per device, and each camera is marked hydrated at ITS OWN completion — not
-	* after the fleet (D167). Never overlaps itself.
-	*/
-	async runFullArchiveWalk(deviceIds) {
-		if (this.fullWalkInFlight) return;
-		this.fullWalkInFlight = true;
-		const hydrateStartedMs = Date.now();
-		try {
-			await hydrateDevicesFromStorage(this.ctx.api, this.index, deviceIds, this.resolvedLocations, this.ctx.logger);
-			this.ctx.logger.info("recorder: hydrated index from storage", { meta: {
-				deviceCount: deviceIds.length,
-				locationCount: this.resolvedLocations.length,
-				ms: Date.now() - hydrateStartedMs
-			} });
-			try {
-				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
-			} catch (err) {
-				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: errMsg(err) } });
-			}
-			const loggedDomains = /* @__PURE__ */ new Set();
-			for (const loc of this.resolvedLocations) {
-				const domain = this.locationDomain(loc.id);
-				const domainKey = [...domain].toSorted().join("+");
-				if (loggedDomains.has(domainKey)) continue;
-				loggedDomains.add(domainKey);
-				const acct = this.index.accountingForLocations(domain);
-				this.ctx.logger.info("recorder: eviction domain footage span at hydrate", { meta: {
-					locationIds: [...domain].toSorted(),
-					root: loc.root,
-					count: acct.count,
-					bytes: acct.bytes,
-					oldestMs: acct.oldestMs,
-					newestMs: acct.newestMs
-				} });
-			}
-			const store = this.segmentStore;
-			if (store) try {
-				await runRedundancyJanitor({
-					deviceIds,
-					segmentsFor: (deviceId, profile) => this.index.segments(deviceId, profile),
-					evict: (location, rows) => store.evict(location, rows),
-					logger: this.ctx.logger
-				});
-			} catch (err) {
-				this.ctx.logger.warn("recorder: redundancy janitor failed", { meta: { error: errMsg(err) } });
-			}
-		} catch (err) {
-			this.ctx.logger.warn("recorder: full-archive walk failed", { meta: { error: errMsg(err) } });
-		} finally {
-			this.fullWalkInFlight = false;
-		}
-	}
-	/**
 	* Declare the three row collections that replaced the `recordingConfigs`,
 	* `recordingExports` and `recordingOpsLog` blob keys. Idempotent — a
 	* re-declaration of the same shape is a no-op in the engine.