@camstack/addon-pipeline 1.2.141 → 1.2.143

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
-const require_dist = require("../dist-3bEUjzHN.js");
-const require_node = require("../node-Cn9gEOs4.js");
+const require_dist = require("../dist-CmqMW5r3.js");
+const require_node = require("../node-COf9Ht20.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
@@ -11,26 +11,41 @@ let node_child_process = require("node:child_process");
 let node_fs_promises = require("node:fs/promises");
 let _camstack_system_addon_utils = require("@camstack/system/addon-utils");
 //#region src/recorder/event-capture.ts
-function markerFromMotion(data, pad) {
-	if (!data.detected) return null;
-	return {
-		t: data.timestamp,
-		startMs: data.timestamp - pad.padPreMs,
-		endMs: data.timestamp + pad.padPostMs,
-		source: "motion",
-		...data.regions !== void 0 ? { metadata: { regions: data.regions } } : {}
-	};
+/**
+* La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
+*
+* ## Cosa NON c'è più qui (2026-08-29)
+*
+* Fino al 2026-08-29 questo file costruiva anche un `EventMarker` per evento e
+* lo spingeva in un `EventMap` per-device — annotazioni di playback in RAM, con
+* dentro il payload `regions` grezzo del provider. `EventMap.events()` e
+* `EventMap.prune()` non avevano **nessun chiamante in tutto il repo**: la
+* mappa veniva solo scritta, e cresceva con l'uptime del runner.
+*
+* È stata cancellata, non cablata, e la ragione è nel suo stesso header: la
+* timeline che l'operatore vede viene dalle righe durabili di
+* `pipelineAnalytics` (`getMotionEvents`/`getObjectEvents`/`getAudioEvents`), i
+* marker non erano esposti su nessuna cap (`recording.getPlaybackManifest`
+* restituisce solo URL di playlist) e ADR-0194 aveva già rifiutato
+* esplicitamente di costruirci sopra il reconcile dei trigger, perché una
+* struttura in RAM non sopravvive né alla perdita dell'evento né al respawn del
+* runner. Un lettore non è mai esistito e non ne era previsto uno: tenerla
+* sarebbe stato "un residuo che descrive il design giusto", cioè una verifica
+* che non verifica niente.
+*
+* Quello che resta è l'unica cosa che qualcuno leggeva davvero: il fronte di
+* salita della motion che apre una finestra della banda `events` (B3).
+*/
+/** Solo il fronte `detected: true` è un trigger. Il fronte di discesa non apre
+*  niente — la finestra la chiude il post-buffer, non l'evento. */
+function isMotionTrigger(data) {
+	return data.detected;
 }
 function subscribeEventCapture(deps) {
-	const { eventBus, map, padPreMs, padPostMs, onMotion } = deps;
+	const { eventBus, onMotion } = deps;
 	return eventBus.subscribe({ category: require_dist.EventCategory.MotionOnMotionChanged }, (event) => {
-		const mk = markerFromMotion(event.data, {
-			padPreMs,
-			padPostMs
-		});
-		if (!mk) return;
-		map.record(event.data.deviceId, mk);
-		onMotion?.(event.data.deviceId, event.data.timestamp);
+		if (!isMotionTrigger(event.data)) return;
+		onMotion(event.data.deviceId, event.data.timestamp);
 	});
 }
 //#endregion
@@ -47,44 +62,180 @@ function subscribeEventCapture(deps) {
 * Puro: nessun bus, nessun orologio, nessuna config. La scelta di QUALI classi
 * ascoltare è della banda (`bandTriggerSources`); qui si decide solo se
 * l'evento è una detection utilizzabile e di che macro classe è.
-*/
+*
+* ## Perché la forma è DISCRIMINATA su `kind` (2026-08-29)
+*
+* Fino al 2026-08-29 questo file dichiarava UNA sola forma piatta — quella
+* dell'evento `object` — e la pretendeva da OGNI payload del topic. Ma
+* `EventCategory.PipelineAnalyticsDetectionEvent` è un topic condiviso da tre
+* emettitori in `addon-post-analysis/src/pipeline-analytics/index.ts`: object
+* (`className`, `source`, `confidence`, `zones`), motion e audio — e motion e
+* audio non portano `className`, perché non ne hanno una. Il risultato misurato:
+* `malformed` su **394 righe campionate su 394**, a 3.3–3.9 eventi/s, per
+* settimane. `malformed` significa "l'emettitore è andato in deriva" ed era
+* invece il traffico normale del topic; l'unico secchio che poteva segnalare
+* una vera rottura di protocollo era saturo al 100% di eventi sani, quindi
+* inservibile — ed è stato letto come "il trigger object non ha mai funzionato".
+*
+* Quindi: si valida prima la BUSTA comune (`deviceId`, `kind`, `timestamp`),
+* poi si discrimina su `kind`, e solo il ramo `object` pretende i campi
+* dell'object. Un `object` senza `className` resta un difetto e ha il suo nome
+* (`malformed-object`), distinto da una busta illeggibile.
+*/
+/** Il `kind` dell'unico ramo del topic che può aprire una finestra. */
+var OBJECT_EVENT_KIND = "object";
+/** La sorgente implicita delle righe legacy senza `source` (`DetectionSourceSchema`). */
+var DEFAULT_DETECTION_SOURCE = "pipeline";
 /** Type guard, non cast: `event.data` è `unknown` finché non passa di qui. */
-function isDetectionEventData(value) {
+function isDetectionEventEnvelope(value) {
 	if (typeof value !== "object" || value === null) return false;
 	if (!("deviceId" in value) || typeof value.deviceId !== "number") return false;
+	if (!Number.isFinite(value.deviceId)) return false;
 	if (!("kind" in value) || typeof value.kind !== "string") return false;
 	if (!("timestamp" in value) || typeof value.timestamp !== "number") return false;
 	if (!Number.isFinite(value.timestamp) || value.timestamp <= 0) return false;
+	return true;
+}
+/** I campi che SOLO il ramo object porta. Chiamata dopo la busta. */
+function isObjectDetectionEventData(value) {
 	if (!("className" in value) || typeof value.className !== "string") return false;
 	if ("source" in value && value.source !== void 0 && typeof value.source !== "string") return false;
 	return true;
 }
 function qualifyObjectTrigger(data) {
-	if (!isDetectionEventData(data)) return {
+	if (!isDetectionEventEnvelope(data)) return {
 		qualified: false,
 		reason: "malformed"
 	};
-	if (data.kind !== "object") return {
+	const deviceId = data.deviceId;
+	if (data.kind !== OBJECT_EVENT_KIND) return {
+		qualified: false,
+		reason: "not-object",
+		deviceId
+	};
+	if (!isObjectDetectionEventData(data)) return {
 		qualified: false,
-		reason: "not-object"
+		reason: "malformed-object",
+		deviceId
 	};
-	if ((data.source ?? "pipeline") !== "pipeline") return {
+	if ((data.source ?? DEFAULT_DETECTION_SOURCE) !== DEFAULT_DETECTION_SOURCE) return {
 		qualified: false,
-		reason: "not-pipeline"
+		reason: "not-pipeline",
+		deviceId
 	};
 	const className = data.className.trim().toLowerCase();
 	if (!require_dist.isFirstLevelMacroClass(className)) return {
 		qualified: false,
-		reason: "not-a-macro"
+		reason: "not-a-macro",
+		deviceId
 	};
 	return {
 		qualified: true,
-		deviceId: data.deviceId,
+		deviceId,
 		macroClass: className,
 		atMs: data.timestamp
 	};
 }
 //#endregion
+//#region src/recorder/object-trigger-health.ts
+/** Ampiezza della finestra di aggregazione. Un minuto: abbastanza corto perché
+*  la riga arrivi entro il primo minuto di un deploy rotto, abbastanza lungo
+*  perché a 4 eventi/s il campione sia significativo. */
+var OBJECT_TRIGGER_HEALTH_WINDOW_MS = 6e4;
+function emptyTally() {
+	return {
+		objectEvents: 0,
+		qualified: 0,
+		otherKinds: 0,
+		byReason: /* @__PURE__ */ new Map()
+	};
+}
+function dominantReason(byReason) {
+	let reason = null;
+	let best = 0;
+	const counts = {};
+	for (const [r, n] of byReason) {
+		counts[r] = n;
+		if (n > best) {
+			best = n;
+			reason = r;
+		}
+	}
+	return {
+		reason,
+		counts
+	};
+}
+var ObjectTriggerHealth = class {
+	windowMs;
+	minSample;
+	buckets = /* @__PURE__ */ new Map();
+	windowStartMs = null;
+	constructor(windowMs = OBJECT_TRIGGER_HEALTH_WINDOW_MS, minSample = 5) {
+		this.windowMs = windowMs;
+		this.minSample = minSample;
+	}
+	/**
+	* Registra un verdetto e, se la finestra si è chiusa con questo evento,
+	* restituisce i report da stampare (e riapre la finestra). Nessun timer:
+	* il feed viaggia a ~4/s, quindi la chiusura arriva sempre in tempo, e una
+	* finestra che non si chiude è una finestra in cui non è successo nulla.
+	*/
+	record(verdict, nowMs) {
+		const reports = this.windowStartMs !== null && nowMs - this.windowStartMs >= this.windowMs ? this.drain(nowMs) : [];
+		this.windowStartMs ??= nowMs;
+		this.count(verdict);
+		return reports;
+	}
+	count(verdict) {
+		if (verdict.qualified) {
+			const t = this.bucket(verdict.deviceId);
+			t.objectEvents += 1;
+			t.qualified += 1;
+			return;
+		}
+		if (verdict.reason === "not-object") {
+			this.bucket(verdict.deviceId).otherKinds += 1;
+			return;
+		}
+		const key = verdict.reason === "malformed" ? null : verdict.deviceId;
+		const t = this.bucket(key);
+		t.objectEvents += 1;
+		t.byReason.set(verdict.reason, (t.byReason.get(verdict.reason) ?? 0) + 1);
+	}
+	bucket(key) {
+		const existing = this.buckets.get(key);
+		if (existing !== void 0) return existing;
+		const fresh = emptyTally();
+		this.buckets.set(key, fresh);
+		return fresh;
+	}
+	/** Chiude la finestra e restituisce un report per secchio non vuoto. */
+	drain(nowMs) {
+		const windowMs = this.windowStartMs === null ? 0 : nowMs - this.windowStartMs;
+		const out = [];
+		for (const [deviceId, t] of this.buckets) {
+			if (t.objectEvents === 0 && t.otherKinds === 0) continue;
+			const rejected = t.objectEvents - t.qualified;
+			const { reason, counts } = dominantReason(t.byReason);
+			out.push({
+				deviceId,
+				windowMs,
+				objectEvents: t.objectEvents,
+				qualified: t.qualified,
+				rejectedPct: t.objectEvents === 0 ? 0 : Math.round(rejected / t.objectEvents * 100),
+				otherKinds: t.otherKinds,
+				topReason: reason,
+				byReason: counts,
+				totalRejection: t.objectEvents >= this.minSample && t.qualified === 0
+			});
+		}
+		this.buckets.clear();
+		this.windowStartMs = nowMs;
+		return out;
+	}
+};
+//#endregion
 //#region src/recorder/sensor-trigger.ts
 /**
 * Da `DeviceStateChanged` a "quali camere devono registrare".
@@ -213,31 +364,6 @@ var SensorTriggerRouter = class {
 	}
 };
 //#endregion
-//#region src/recorder/event-map.ts
-var EventMap = class {
-	byDevice = /* @__PURE__ */ new Map();
-	record(deviceId, marker) {
-		const list = this.byDevice.get(deviceId) ?? [];
-		list.push({ ...marker });
-		this.byDevice.set(deviceId, list);
-	}
-	events(deviceId, fromMs, toMs) {
-		const list = this.byDevice.get(deviceId);
-		if (!list) return [];
-		return list.filter((e) => e.t >= fromMs && e.t <= toMs).toSorted((a, b) => a.t - b.t);
-	}
-	prune(nowMs, maxAgeMs) {
-		const cutoff = nowMs - maxAgeMs;
-		let dropped = 0;
-		for (const [deviceId, list] of this.byDevice) {
-			const kept = list.filter((e) => e.t >= cutoff);
-			dropped += list.length - kept.length;
-			this.byDevice.set(deviceId, kept);
-		}
-		return dropped;
-	}
-};
-//#endregion
 //#region src/recorder/init-info.ts
 /** Walk sibling boxes in [from, to), yielding [type, start, end]. */
 function* boxes$1(buf, view, from, to) {
@@ -848,6 +974,23 @@ function upperBoundByStart(rows, startMs) {
 	}
 	return lo;
 }
+/**
+* Index of the FIRST element whose `startMs` is at-or-after `startMs` (lower
+* bound). On a start-sorted view this is exactly where a linear
+* `find(s => s.startMs === x)` and a linear `find(s => s.startMs >= x)` would
+* have stopped — which is what makes the binary-search replacements of those
+* two scans row-for-row identical, duplicate starts included.
+*/
+function lowerBoundByStart(rows, startMs) {
+	let lo = 0;
+	let hi = rows.length;
+	while (lo < hi) {
+		const mid = lo + hi >> 1;
+		if (rows[mid].startMs < startMs) lo = mid + 1;
+		else hi = mid;
+	}
+	return lo;
+}
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
 	/** Start-sorted views. Built lazily on first read (one copy+sort), then kept
@@ -866,6 +1009,27 @@ var RecordingIndex = class {
 	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
 	*  "there is nothing" — see {@link hydrationOf}. */
 	walked = /* @__PURE__ */ new Map();
+	/**
+	* Upper bound on the `durMs` of any row the index holds — the ONLY thing that
+	* turns "walk the whole sorted view" into "walk backwards a bounded number of
+	* rows".
+	*
+	* A start-sorted view answers "which row STARTS at/before X" by binary
+	* search, but every backward question here ("which row still COVERS X",
+	* "which footage ENDS at/before X") depends on `startMs + durMs`, which is
+	* not sorted. This scalar closes that: a row at `startMs` can never end later
+	* than `startMs + maxDurMs`, so once a candidate's ceiling can no longer beat
+	* the best answer found, no earlier row can either — and the walk stops.
+	*
+	* Monotonically non-decreasing on purpose. It is only ever an OVER-estimate
+	* (a longer walk, never a wrong answer); shrinking it on eviction would buy
+	* nothing and could only make it wrong.
+	*/
+	maxDurMs = 0;
+	/** Widen {@link maxDurMs} for a row entering the index. */
+	noteDuration(durMs) {
+		if (durMs > this.maxDurMs) this.maxDurMs = durMs;
+	}
 	mapFor(deviceId) {
 		let m = this.byDevice.get(deviceId);
 		if (!m) {
@@ -954,11 +1118,13 @@ var RecordingIndex = class {
 		const prev = held.get(path);
 		if (prev !== void 0 && prev.locationId === locationId) {
 			this.rowsReused += 1;
+			this.noteDuration(prev.durMs);
 			return prev;
 		}
 		const p = parseSegmentPath(path);
 		if (!p || p.deviceId !== deviceId) return null;
 		this.rowsAllocated += 1;
+		this.noteDuration(p.durMs);
 		return {
 			deviceId: p.deviceId,
 			profile: p.profile,
@@ -1056,6 +1222,7 @@ var RecordingIndex = class {
 	*/
 	addSegment(s) {
 		const m = this.mapFor(s.deviceId);
+		this.noteDuration(s.durMs);
 		const replacing = m.has(s.path);
 		m.set(s.path, s);
 		if (replacing) {
@@ -1093,6 +1260,55 @@ var RecordingIndex = class {
 		while (end < segs.length && segs[end].startMs < toMs) end += 1;
 		return lo === 0 && end === segs.length ? segs : segs.slice(lo, end);
 	}
+	/**
+	* The row whose `startMs` is EXACTLY `startMs`, or null.
+	*
+	* The point lookup every byte read is: `readSegmentBytes` / `readGopBytes` /
+	* `readWindowBytes` all address a segment by its exact start, which is what
+	* the playback manifest and the locate answer handed the client. It used to
+	* be `segments(deviceId, profile).find(...)` — a full COPY of the
+	* device-profile archive plus a linear scan, per scrub tick and per playback
+	* fetch (~10 k rows copied to reach one of them on the live hub).
+	*
+	* Returns the FIRST row with that start, which is what `.find` returned on
+	* the same start-sorted view: a restart can leave two rows sharing a start,
+	* and the byte reader must keep resolving to the same one it always did.
+	*/
+	segmentStartingAt(deviceId, profile, startMs) {
+		const segs = this.sortedSegments(deviceId, profile);
+		const at = segs[lowerBoundByStart(segs, startMs)];
+		return at !== void 0 && at.startMs === startMs ? at : null;
+	}
+	/**
+	* Start-sorted rows whose SPAN `[startMs, startMs+durMs)` overlaps
+	* `[fromMs, toMs)` — i.e. `startMs < toMs && startMs + durMs > fromMs`.
+	*
+	* The overlap-inclusive twin of {@link segmentsStartingIn}, and the reason it
+	* cannot just slice from the `fromMs` lower bound: the segment an operator is
+	* actually watching at `fromMs` STARTED before it. Dropping it truncates the
+	* first segment of every playback window — silently, because the window still
+	* renders, just short. The boundary convention is the caller's, preserved
+	* from the whole-archive filter this replaces: a segment ending EXACTLY at
+	* `fromMs` is excluded (`end > fromMs`), a segment starting exactly at `toMs`
+	* is excluded (`start < toMs`), and a segment straddling `fromMs` is IN.
+	*
+	* The backward reach is {@link maxDurMs}, not "one element": with overlapping
+	* rows (a restart re-recording an hour) more than one predecessor can still
+	* cover `fromMs`, and the ceiling is the only bound that cannot miss one.
+	*/
+	segmentsOverlapping(deviceId, profile, fromMs, toMs) {
+		const segs = this.sortedSegments(deviceId, profile);
+		const end = lowerBoundByStart(segs, toMs);
+		let head = lowerBoundByStart(segs, fromMs);
+		const reach = fromMs - this.maxDurMs;
+		while (head > 0 && segs[head - 1].startMs > reach) head -= 1;
+		const out = [];
+		for (let i = head; i < end; i++) {
+			const s = segs[i];
+			if (s.startMs + s.durMs > fromMs) out.push(s);
+		}
+		return out;
+	}
 	/** True when `relPath` is currently indexed for `deviceId`. O(1). */
 	hasSegment(deviceId, relPath) {
 		return this.byDevice.get(deviceId)?.has(relPath) === true;
@@ -1211,6 +1427,26 @@ var RecordingIndex = class {
 		}
 		return [...out.values()];
 	}
+	/**
+	* WHICH devices hold footage on any of `locationIds` — the census, without
+	* the archive.
+	*
+	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
+	* location: a full multi-device COPY of every row on the disk plus a sort of
+	* it (294 k rows on the live hub), to read one number off each row and throw
+	* the array away. This visits each device only until its first matching row.
+	* Same membership rule as before — a device is listed when at least one of
+	* its rows sits on one of the given locations, so footage stranded on a
+	* location id that no longer resolves stays invisible here exactly as it was.
+	*/
+	deviceIdsOnLocations(locationIds) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
+			out.add(deviceId);
+			break;
+		}
+		return out;
+	}
 	/** All segments on a storage location across every device, oldest-first. */
 	segmentsOnLocation(locationId) {
 		const out = [];
@@ -1247,20 +1483,59 @@ var RecordingIndex = class {
 		const segs = this.sortedSegments(deviceId, profile);
 		if (segs.length === 0) return null;
 		if (this.segmentAtIn(segs, epochMs) !== null) return epochMs;
-		const next = segs.find((s) => s.startMs >= epochMs);
+		const next = segs[lowerBoundByStart(segs, epochMs)];
 		return next ? next.startMs : null;
 	}
 	/**
+	* The end of the newest footage for a (device, profile), or null when there
+	* is none — "how far can an export reach?", asked once per render.
+	*
+	* NOT simply the last row's end: the view is sorted by START, and an earlier,
+	* longer segment can end later. Walks backwards from the newest row only
+	* while an earlier start could still, at {@link maxDurMs}, beat the best end
+	* seen — which on a uniform-length archive is one comparison.
+	*/
+	latestEnd(deviceId, profile) {
+		const segs = this.sortedSegments(deviceId, profile);
+		let best = null;
+		for (let i = segs.length - 1; i >= 0; i--) {
+			const s = segs[i];
+			if (best !== null && s.startMs + this.maxDurMs <= best) break;
+			const end = s.startMs + s.durMs;
+			if (best === null || end > best) best = end;
+		}
+		return best;
+	}
+	/**
 	* The exclusive END of the nearest footage ending at-or-before `epochMs`
 	* (the backward covered edge), or null when no footage ends at or before it.
 	* Backward counterpart of `nearestCoveredEdge`: consecutive segments leave
 	* small cracks (`startMs + durMs` < next `startMs` by ~11-17 ms), so a
 	* backward frame-step probing `startMs − 1` lands in a crack — this edge
 	* lets the caller hop to the true previous segment.
+	*
+	* ## Why this is a search and not a scan
+	*
+	* Called on EVERY locate that lands in a gap — during a drag across sparse
+	* footage, every tick — and it used to walk the device-profile's whole sorted
+	* view to do it. Two bounds replace the walk, and the second is the one that
+	* has to be right:
+	*
+	* 1. A row starting AFTER `epochMs` ends after it too (`durMs >= 0`), so
+	*    nothing at-or-past the upper bound of `epochMs` can qualify.
+	* 2. Below that bound the answer is NOT the predecessor. A row starting
+	*    before the cursor can still COVER it (disqualified: its end is past
+	*    `epochMs`), while an even earlier row ends cleanly before it and is the
+	*    true edge. So the walk continues backwards, and only {@link maxDurMs}
+	*    says when to stop: earlier rows start no later than this one, so none of
+	*    them can end past `startMs + maxDurMs`.
 	*/
 	coveredEdgeBefore(deviceId, profile, epochMs) {
+		const segs = this.sortedSegments(deviceId, profile);
 		let best = null;
-		for (const s of this.sortedSegments(deviceId, profile)) {
+		for (let i = upperBoundByStart(segs, epochMs) - 1; i >= 0; i--) {
+			const s = segs[i];
+			if (best !== null && s.startMs + this.maxDurMs <= best) break;
 			const end = s.startMs + s.durMs;
 			if (end <= epochMs && (best === null || end > best)) best = end;
 		}
@@ -1902,6 +2177,11 @@ var macrotask$2 = () => new Promise((resolve) => {
 * segment's start. Returns the LAST segment whose half-open span
 * `[startMs, startMs+durMs)` contains the instant (segments can overlap after a
 * restart; the newest wins). Null when no segment covers the instant.
+*
+* `segments` may be a CANDIDATE WINDOW rather than the device's whole archive —
+* the caller narrows it with an index search. The membership test below stays
+* regardless: narrowing may only remove rows that could not have won, never
+* decide which of the survivors does.
 */
 function resolveStillSource(segments, epochMs) {
 	let match = null;
@@ -1969,16 +2249,22 @@ var StillFrameService = class {
 	* caller replies 204 → the dialog shows its placeholder).
 	*/
 	async getStill(deviceId, epochMs) {
-		const source = resolveStillSource(this.deps.listLowSegments(deviceId), epochMs);
-		if (source === null) return null;
+		const source = resolveStillSource(this.deps.lowSegmentsAt(deviceId, epochMs), epochMs);
+		if (source === null) {
+			this.deps.logger.debug("still: no low segment covers the instant", {
+				tags: { deviceId },
+				meta: { epochMs }
+			});
+			return null;
+		}
 		const abs = this.deps.resolveAbsPath(source.row);
 		const now = (this.deps.now ?? Date.now)();
 		const immutable = source.row.startMs + source.row.durMs < now;
 		if (!await this.acquireSlot()) {
-			this.deps.logger.debug("still: decode queue saturated, dropping request", { meta: {
-				deviceId,
-				epochMs
-			} });
+			this.deps.logger.debug("still: decode queue saturated, dropping request", {
+				tags: { deviceId },
+				meta: { epochMs }
+			});
 			return null;
 		}
 		try {
@@ -5079,7 +5365,7 @@ async function collectRangeSegments(deps, deviceId, profile, fromMs, toMs, uriMo
 	if (deps.index.hydrationOf(deviceId, fromMs, toMs) !== "hydrated") await deps.hydrateWindow?.(deviceId, fromMs, toMs);
 	const hydration = deps.index.hydrationOf(deviceId, fromMs, toMs);
 	const rootById = new Map(deps.locations().map((l) => [l.id, l.root]));
-	const candidates = deps.index.segments(deviceId, profile).filter((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs).toSorted((a, b) => a.startMs - b.startMs).flatMap((s) => {
+	const candidates = deps.index.segmentsOverlapping(deviceId, profile, fromMs, toMs).flatMap((s) => {
 		const root = rootById.get(s.locationId);
 		if (root === void 0) return [];
 		const rel = segmentRelPath(deviceId, profile, s.startMs, s.durMs, s.bytes);
@@ -5245,7 +5531,7 @@ async function evictVictims(deps, deviceId, victims) {
 * and GOP byte-range reads so the two paths cannot drift on resolution.
 */
 function resolveSegmentFile(deps, deviceId, profile, startMs) {
-	const seg = deps.index.segments(deviceId, profile).find((s) => s.startMs === startMs);
+	const seg = deps.index.segmentStartingAt(deviceId, profile, startMs);
 	if (!seg) throw new Error(`recording: no segment at start ${startMs} for ${deviceId}/${profile}`);
 	const loc = deps.locations().find((l) => l.id === seg.locationId);
 	if (!loc) throw new Error(`recording: unknown location ${seg.locationId}`);
@@ -5414,8 +5700,7 @@ function buildRecordingProvider(deps) {
 		getStorageUsage: async () => {
 			const locations = deps.locations();
 			const devices = [];
-			const seenDevices = /* @__PURE__ */ new Set();
-			for (const loc of locations) for (const row of deps.index.segmentsOnLocation(loc.id)) seenDevices.add(row.deviceId);
+			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
 			let totalUsedBytes = 0;
 			for (const deviceId of seenDevices) {
 				const accounting = deps.index.accounting(deviceId);
@@ -5919,15 +6204,14 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 		await node_fs.promises.rm(outPath, { force: true }).catch(() => {});
 	}
 }
-/** The end of the newest FINALIZED `low` segment, or null when none exists. */
+/**
+* The end of the newest FINALIZED `low` segment, or null when none exists.
+*
+* One scalar off the tail of the live sorted view — it used to COPY the
+* device's whole `low` archive to fold a maximum out of it, per render.
+*/
 function latestFinalizedEnd(renderDeps, deviceId) {
-	const rows = renderDeps.deps.index.segments(deviceId, "low");
-	let end = null;
-	for (const s of rows) {
-		const candidate = s.startMs + s.durMs;
-		if (end === null || candidate > end) end = candidate;
-	}
-	return end;
+	return renderDeps.deps.index.latestEnd(deviceId, "low");
 }
 /**
 * Run one ffmpeg and GUARANTEE the child is gone before the promise settles.
@@ -8441,6 +8725,47 @@ var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
 */
 var PENDING_GRACE_MS = 3e4;
 /**
+* How many entries ffmpeg's `-segment_list` must retain — the argument for
+* `-segment_list_size`.
+*
+* ## Why the list is bounded at all
+*
+* It was not, and the muxer default (0) means "keep every segment for the
+* writer's whole life". `parseLivePlaylist` re-splits and re-objectifies the
+* WHOLE body on every 2 s tick, per writer: at 10 s segments a 5-hour writer
+* holds 1 800 entries ⇒ ~220 KB/tick ⇒ **3.3 MB/s across 30 writers**, growing
+* linearly with uptime and bounded by nothing. It is latent today only because
+* writers restart constantly (59 restarts in 16 minutes, measured 2026-08-29)
+* and ffmpeg truncates the list on every spawn.
+*
+* ## Why THIS size
+*
+* The size is what the PARSER has to be able to answer, and the parser has
+* exactly two questions open at any moment:
+*
+*   1. the live tail, which is deliberately held back until its successor
+*      exists ({@link correctedDurMs}) — **1 entry**;
+*   2. every entry whose flat file has not landed yet. That entry stays this
+*      watcher's business for at most {@link PENDING_GRACE_MS}, after which the
+*      pass gives up on it and advances — and the pass that gives up may be as
+*      far as {@link WATCHER_PASS_WORST_MS} behind the one that first saw it.
+*
+* So the window is `1 + (grace + worst pass) / segment length`, rounded up.
+* At the default 10 s segments that is 1 + ceil(132/10) = **15 entries**
+* (~2.5 minutes of playlist, ~1.8 KB) instead of an unbounded list. A shorter
+* segment length buys proportionally more entries, which is exactly right: the
+* bound is denominated in TIME, and the entry count is only how that time is
+* spelled for a given `-segment_time`.
+*
+* Undersizing does not lose footage — a segment that rolls off unhandled stays
+* flat in staging and `staging-reconcile` recovers it at the next boot — but it
+* delays it by a whole process lifetime, so the tick loop reports it
+* ({@link FinalizationPlan.rolledOff}) rather than advancing in silence.
+*/
+function segmentListSize(segmentSeconds) {
+	return 1 + Math.ceil(132e3 / ((segmentSeconds > 0 ? segmentSeconds : 1) * 1e3));
+}
+/**
 * Decide whether a missing flat file is a late flush or a previous run's entry.
 *
 * ffmpeg opens `-segment_list` in TRUNCATE mode when it spawns, but not
@@ -8495,6 +8820,27 @@ function correctedDurMs(durSeconds, startMs, nextStartMs) {
 	if (gapMs <= 0) return extinfMs;
 	return Math.min(extinfMs, gapMs);
 }
+var MEDIA_SEQUENCE_RE = /^#EXT-X-MEDIA-SEQUENCE:(\d+)/m;
+/**
+* How many entries ffmpeg has already dropped off the FRONT of this playlist.
+*
+* With `-segment_list_size` the list is a sliding window, so an index into the
+* body is not a stable name for a segment: index 0 means a different file every
+* time the window advances. `#EXT-X-MEDIA-SEQUENCE` is the offset that turns a
+* body index back into a monotone global one, and ffmpeg maintains it for
+* exactly this purpose — verified against the ffmpeg 6.1.1 build the hub image
+* ships (12 segments, `-segment_list_size 4` ⇒ 4 entries and
+* `#EXT-X-MEDIA-SEQUENCE:8`; unbounded ⇒ 12 entries and `:0`).
+*
+* Absent (an unbounded list, or a pre-truncation body) it is 0, which is the
+* old behaviour exactly.
+*/
+function parseMediaSequence(body) {
+	const m = MEDIA_SEQUENCE_RE.exec(body);
+	if (m?.[1] === void 0) return 0;
+	const n = Number(m[1]);
+	return Number.isFinite(n) && n >= 0 ? n : 0;
+}
 /** Parse a `live.m3u8` body into ordered `#EXTINF` → segment-path pairs. */
 function parseLivePlaylist(body) {
 	const lines = body.split("\n");
@@ -8572,14 +8918,30 @@ async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger, wri
 * duration needs its SUCCESSOR's start (ffmpeg's first-segment EXTINF is
 * inflated by the initial PTS offset). Once `#EXT-X-ENDLIST` appears the tail
 * is flushed too — by then it is never the unreliable first segment.
+*
+* ## The mark is GLOBAL, not an index into the body
+*
+* `-segment_list_size` (see {@link segmentListSize}) makes the playlist a
+* sliding window, and the moment it starts sliding a body index stops naming a
+* segment: entry 0 is a different file after every roll. A high-water mark kept
+* as a body index would sit at `entries.length - 1` forever and finalize
+* NOTHING while ffmpeg kept writing — a bounded list without this rebase would
+* have stopped the recorder indexing footage while looking like a memory fix.
+* So the mark counts segments since the writer's first, `#EXT-X-MEDIA-SEQUENCE`
+* supplies the offset, and an unbounded list (sequence 0) behaves exactly as
+* before.
 */
 function planFinalizations(body, processed, forceFinal = false) {
 	const entries = parseLivePlaylist(body);
 	const endlist = body.includes("#EXT-X-ENDLIST");
-	const hw = entries.length < processed ? 0 : processed;
-	const finalizable = endlist || forceFinal ? entries.length : Math.max(0, entries.length - 1);
+	const base = parseMediaSequence(body);
+	const restarted = base + entries.length < processed;
+	const rolledOff = restarted ? 0 : Math.max(0, base - processed);
+	const hw = restarted ? base : Math.max(processed, base);
+	const finalizable = base + (endlist || forceFinal ? entries.length : Math.max(0, entries.length - 1));
 	const toHandle = [];
-	for (let i = hw; i < finalizable; i++) {
+	for (let g = hw; g < finalizable; g++) {
+		const i = g - base;
 		const entry = entries[i];
 		const startMs = parseEpochStartMs(entry.segPath);
 		const nextStartMs = i + 1 < entries.length ? parseEpochStartMs(entries[i + 1].segPath) : null;
@@ -8592,7 +8954,8 @@ function planFinalizations(body, processed, forceFinal = false) {
 	return {
 		toHandle,
 		from: hw,
-		processed: Math.max(hw, finalizable)
+		processed: Math.max(hw, finalizable),
+		rolledOff
 	};
 }
 /**
@@ -8620,6 +8983,11 @@ function startSegmentWatcher(deps) {
 				return;
 			}
 			const plan = planFinalizations(body, processed, forceFinal);
+			if (plan.rolledOff > 0) deps.logger.warn("segment playlist rolled past entries this watcher had not handled", { meta: {
+				rolledOff: plan.rolledOff,
+				processed,
+				from: plan.from
+			} });
 			let index = plan.from;
 			for (const { entry, durMs } of plan.toHandle) {
 				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger, deps.writerStartedMs) === "pending") {
@@ -8684,6 +9052,23 @@ function startSegmentWatcher(deps) {
 }
 //#endregion
 //#region src/recorder/addon/ffmpeg-args.ts
+/**
+* ffmpeg argv builder for recorder passthrough segmentation.
+*
+* Copied from the old recorder (`addon-pipeline/src/recorder/ffmpeg-args.ts`)
+* essentially verbatim — the passthrough + Opus-audio + fragmented-mp4 segment
+* recipe is proven across every vendor. The ONLY behavioural difference from
+* the old recorder lives in the WATCHER (recorder relocates via the v2
+* `SegmentStore.onFinalized`, not inline) — the ffmpeg invocation is identical:
+* FLAT epoch-named `.m4s` segments under `outDir` plus a rolling `live.m3u8`.
+*
+* Audio is re-encoded to **Opus** (`-c:a libopus`, in an `Opus`/`dOps`
+* ISOBMFF sample entry, verified muxable + mp4box-readable on the ffmpeg 7.x
+* builds shipped in dev/hub/agent images). Opus is what the WebRTC audio sender
+* already passes through un-transcoded (live PCMU/PCMA/OPUS => copy), so a
+* recorded fragment's audio can be read in-process (mp4box) and pushed straight
+* to the Opus sender with no per-fragment ffmpeg spawn on playback.
+*/
 /** ffmpeg argv: pull RTSP (TCP), copy video / transcode audio to Opus, write
 *  fragmented-mp4 segments named by epoch seconds FLAT under `outDir`, plus a
 *  rolling `live.m3u8` playlist. The recorder segment-watcher tails the
@@ -8722,6 +9107,8 @@ function buildPassthroughArgs(a) {
 		`${a.outDir}/live.m3u8`,
 		"-segment_list_type",
 		"m3u8",
+		"-segment_list_size",
+		String(segmentListSize(a.segmentSeconds)),
 		`${a.outDir}/%s.m4s`
 	];
 }
@@ -11234,10 +11621,12 @@ var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
 /**
 * The four aggregate columns exist so "how much footage is on this disk" is a
 * `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
-* segment rows. They are DERIVED from `paths` — never a second authority — and
-* {@link hourAggregate} is the only place that derives them, so a row loaded
-* from a database that predates these columns is corrected in the mirror the
-* moment it is read and repaired on disk by {@link SegmentHourLedger.repairAggregates}.
+* segment rows. They are DERIVED from `paths` — never a second authority — by
+* {@link withSegmentPath} and nothing else: {@link hourAggregate} is that step
+* over every path and {@link appendSegmentPath} is that step over one, so there
+* is no second derivation to drift. A row loaded from a database that predates
+* these columns is corrected in the mirror the moment it is read and repaired
+* on disk by {@link SegmentHourLedger.repairAggregates}.
 */
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
@@ -11314,33 +11703,57 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 		columns: ["locationId", "hourStartMs"]
 	})
 ];
+/** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
+var EMPTY_HOUR_AGGREGATE = {
+	bytes: 0,
+	segments: 0,
+	minStartMs: 0,
+	maxStartMs: 0
+};
 /**
-* Bytes / count / oldest / newest for one hour's paths.
+* ONE path folded into an aggregate — the whole derivation, expressed as its
+* single step.
+*
+* {@link hourAggregate} is this step over every path, and {@link
+* SegmentHourLedger.recordSegment} is this step over the one path that just
+* arrived. That is not two implementations that happen to agree: the full
+* derivation is *defined* as this function repeated, so an append is the fold
+* resumed from the state the held row already carries — a `SegmentHourRow`'s
+* aggregate half IS the fold state over its `paths`.
+*
+* Why it had to become a step: `recordSegment` re-derived the whole hour on
+* every finalize. Σ1..360 ≈ 65 k path parses per camera-profile-hour at 10 s
+* segments, Σ1..1708 ≈ 1.46 M in the restart-storm hours of 2026-08-29, at
+* ~3.4 finalizes/s fleet-wide, forever.
+*
+* A path the parser refuses contributes nothing — it is not a segment, and
+* counting it would inflate a disk report. `segments === 0` is the first-path
+* sentinel for min/max, so an aggregate with no segments carries 0/0 rather
+* than a sentinel nobody can compare against.
+*/
+function withSegmentPath(agg, path) {
+	const p = parseSegmentPath(path);
+	if (p === null) return agg;
+	return {
+		bytes: agg.bytes + p.bytes,
+		segments: agg.segments + 1,
+		minStartMs: agg.segments === 0 || p.startMs < agg.minStartMs ? p.startMs : agg.minStartMs,
+		maxStartMs: agg.segments === 0 || p.startMs > agg.maxStartMs ? p.startMs : agg.maxStartMs
+	};
+}
+/**
+* Bytes / count / oldest / newest for one hour's paths — the sole FULL
+* derivation, used by rebuilds ({@link recordToRow}, `dropSegments`) and never
+* by the append path.
 *
 * Every field of a segment path encodes its own facts (`parseSegmentPath`), so
 * this is a derivation, not a measurement: it can never disagree with the paths
-* it was computed from. A path the parser refuses contributes nothing — it is
-* not a segment, and counting it would inflate a disk report.
+* it was computed from.
 */
 function hourAggregate(paths) {
-	let bytes = 0;
-	let segments = 0;
-	let minStartMs = 0;
-	let maxStartMs = 0;
-	for (const path of paths) {
-		const p = parseSegmentPath(path);
-		if (p === null) continue;
-		bytes += p.bytes;
-		if (segments === 0 || p.startMs < minStartMs) minStartMs = p.startMs;
-		if (segments === 0 || p.startMs > maxStartMs) maxStartMs = p.startMs;
-		segments += 1;
-	}
-	return {
-		bytes,
-		segments,
-		minStartMs,
-		maxStartMs
-	};
+	let agg = EMPTY_HOUR_AGGREGATE;
+	for (const path of paths) agg = withSegmentPath(agg, path);
+	return agg;
 }
 /** Build the persisted row for an hour from its paths — the ONE constructor. */
 function segmentHourRow(base) {
@@ -11350,6 +11763,33 @@ function segmentHourRow(base) {
 	};
 }
 /**
+* The row an hour becomes when ONE more path joins it.
+*
+* Identical to `segmentHourRow({ ...held, paths: [...held.paths, path] })` and
+* strictly cheaper: the aggregate half of `held` is already the fold over
+* `held.paths`, so this resumes that fold instead of restarting it. The
+* equality is not an assumption — `segment-hour-append.spec.ts` pins it on
+* generated hours including out-of-order arrival, duplicate paths, unparseable
+* paths and storm-sized hours.
+*
+* The four fields are named rather than spread on purpose. {@link
+* withSegmentPath} hands its argument straight back for a path the parser
+* refuses, and `held` is a whole row — spreading that return would put the
+* PREVIOUS `paths` array back over the appended one. Which is exactly what it
+* did until the generated-hours test caught it.
+*/
+function appendSegmentPath(held, path) {
+	const { bytes, segments, minStartMs, maxStartMs } = withSegmentPath(held, path);
+	return {
+		...held,
+		paths: [...held.paths, path],
+		bytes,
+		segments,
+		minStartMs,
+		maxStartMs
+	};
+}
+/**
 * The largest share of a device's held hours a single walk may delete.
 *
 * On 2026-08-19 the recorder respawned while `/recordings` was an empty tmpfs —
@@ -11682,19 +12122,31 @@ var SegmentHourLedger = class {
 		} });
 		return repaired;
 	}
-	/** Write-behind: a just-finalized segment joins its hour row. */
+	/**
+	* Write-behind: a just-finalized segment joins its hour row.
+	*
+	* THE hot path — every profile-writer lands here every `segmentSeconds`,
+	* ~3.4 times a second fleet-wide. The append is {@link appendSegmentPath}:
+	* one `parseSegmentPath` and four scalar updates, whatever the hour already
+	* holds. It used to re-derive the whole hour, which made one hour
+	* O(N²) — 65 k parses at 360 segments, 1.46 M in a restart-storm hour.
+	*/
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
 		const held = this.ledger.get(key);
-		if (held !== void 0 && held.paths.includes(row.path)) return;
-		await this.ledger.put(segmentHourRow({
-			key,
-			deviceId: row.deviceId,
-			profile: row.profile,
-			locationId: row.locationId,
-			hourStartMs: hour,
-			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
-		}));
+		if (held === void 0) {
+			await this.ledger.put(segmentHourRow({
+				key,
+				deviceId: row.deviceId,
+				profile: row.profile,
+				locationId: row.locationId,
+				hourStartMs: hour,
+				paths: [row.path]
+			}));
+			return;
+		}
+		if (held.paths.includes(row.path)) return;
+		await this.ledger.put(appendSegmentPath(held, row.path));
 	}
 	/**
 	* Eviction confirmed these paths are gone from disk. Drop them; forget the
@@ -11758,10 +12210,7 @@ var SegmentHourLedger = class {
 				hourStartMs: hour,
 				paths: [seg.path]
 			}));
-			else fromIndex.set(key, segmentHourRow({
-				...existing,
-				paths: [...existing.paths, seg.path]
-			}));
+			else fromIndex.set(key, appendSegmentPath(existing, seg.path));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
 		for (const row of this.ledger.snapshot()) {
@@ -12346,15 +12795,6 @@ var DEFAULT_CONFIG = {
 	recordingNodeId: RECORDING_NODE_DEFAULT,
 	recordingHubHostname: ""
 };
-/** Playback-marker window padding around a motion event (EventMap only; the
-*  controller's events-band gating uses the raw trigger ms, not this pad).
-*  Derived from the SHARED `EVENT_PAD_MS` (R5/C1): markers are ephemeral
-*  in-RAM and consumed by nothing today, but aligning their window with the
-*  canonical clip pad means that IF they are ever surfaced, their boundaries
-*  match the videoclips/admin-ui clip window for the same event — one pad
-*  convention, not three. */
-var MARKER_PAD_PRE_MS = require_dist.EVENT_PAD_MS.preMs;
-var MARKER_PAD_POST_MS = require_dist.EVENT_PAD_MS.postMs;
 /** This addon's manifest id + the playback data-plane prefix — together they
 *  form the hub reverse-proxy client path `/addon/recorder/playback`. */
 /**
@@ -12518,8 +12958,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		return this.lastKnownGoodRead;
 	}
-	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
-	eventMap = new EventMap();
 	/** Unsubscribe handle for the EventCapture motion subscription. */
 	eventUnsub = null;
 	/**
@@ -12537,6 +12975,14 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	detectionTriggerUnsub = null;
 	/**
+	* Per-window, per-camera tally behind the detection-trigger subscription. A
+	* per-event `debug` line cannot say "NOTHING qualifies any more", which is the
+	* regime this feed sat in — 100% rejected at 3.3–3.9/s — from the day it was
+	* wired until 2026-08-29. This is what turns that into one `warn` a minute
+	* naming the camera and the dominant reason.
+	*/
+	detectionTriggerHealth = new ObjectTriggerHealth();
+	/**
 	* Unsubscribe handle for the `DeviceStateChanged` subscription — the feed
 	* behind `RecordingTriggers.sensorDeviceIds` (Traccia B).
 	*/
@@ -12991,7 +13437,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		}
 		try {
 			const stillService = new StillFrameService({
-				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
+				lowSegmentsAt: (deviceId, epochMs) => this.index.segmentsOverlapping(deviceId, "low", epochMs, epochMs + 1),
 				resolveAbsPath: (row) => this.resolveSegmentAbsPath(row),
 				logger: this.ctx.logger.child("Still")
 			});
@@ -13125,9 +13571,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.recoverStagedOrphans(stagingBootMs);
 		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
 			eventBus: this.ctx.eventBus,
-			map: this.eventMap,
-			padPreMs: MARKER_PAD_PRE_MS,
-			padPostMs: MARKER_PAD_POST_MS,
 			onMotion: (deviceId, atMs) => {
 				this.controller?.onTrigger(deviceId, { kind: "motion" }, atMs);
 			}
@@ -13139,8 +13582,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		if (this.detectionTriggerUnsub === null) this.detectionTriggerUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.PipelineAnalyticsDetectionEvent }, (event) => {
 			const verdict = qualifyObjectTrigger(event.data);
+			for (const report of this.detectionTriggerHealth.record(verdict, Date.now())) this.logDetectionTriggerHealth(report);
 			if (!verdict.qualified) {
-				this.ctx.logger.debug("recorder: detection event did not qualify as a trigger", { meta: { reason: verdict.reason } });
+				this.ctx.logger.debug("recorder: detection event did not qualify as a trigger", {
+					...verdict.reason === "malformed" ? {} : { tags: { deviceId: verdict.deviceId } },
+					meta: { reason: verdict.reason }
+				});
 				return;
 			}
 			this.controller?.onTrigger(verdict.deviceId, {
@@ -13222,6 +13669,44 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.redundancySweeper?.start();
 	}
 	/**
+	* Print one window of detection-trigger health.
+	*
+	* The level is the whole point: a window in which SOME object detections
+	* opened a recording is normal operation and stays at `debug`; a window in
+	* which a camera produced object detections and NONE of them opened one is a
+	* dead feature, and it goes out at `warn` with the camera and the dominant
+	* reason on it. The unbucketable `malformed` envelopes are the only line here
+	* without a `deviceId`, because a payload whose envelope did not parse names
+	* no camera — and that line is always `warn`, since after 2026-08-29
+	* `malformed` can only mean the emitter drifted.
+	*/
+	logDetectionTriggerHealth(report) {
+		const meta = {
+			objectEvents: report.objectEvents,
+			qualified: report.qualified,
+			rejectedPct: report.rejectedPct,
+			otherKinds: report.otherKinds,
+			topReason: report.topReason,
+			byReason: report.byReason,
+			windowMs: report.windowMs
+		};
+		if (report.deviceId === null) {
+			this.ctx.logger.warn("recorder: detection events with an UNREADABLE envelope — the emitter and this consumer disagree", { meta });
+			return;
+		}
+		if (report.totalRejection) {
+			this.ctx.logger.warn("recorder: EVERY object detection was rejected in this window — the object recording trigger is doing nothing for this camera", {
+				tags: { deviceId: report.deviceId },
+				meta
+			});
+			return;
+		}
+		this.ctx.logger.debug("recorder: object trigger window", {
+			tags: { deviceId: report.deviceId },
+			meta
+		});
+	}
+	/**
 	* Rebuild the sensor trigger's reverse index from the persisted configs.
 	*
 	* D49: this is a MIRROR refreshed off the event path — at boot and on every