@camstack/addon-pipeline 1.2.142 → 1.2.143

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
-const require_dist = require("../dist-3bEUjzHN.js");
-const require_node = require("../node-Cn9gEOs4.js");
+const require_dist = require("../dist-CmqMW5r3.js");
+const require_node = require("../node-COf9Ht20.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
@@ -11,26 +11,41 @@ let node_child_process = require("node:child_process");
 let node_fs_promises = require("node:fs/promises");
 let _camstack_system_addon_utils = require("@camstack/system/addon-utils");
 //#region src/recorder/event-capture.ts
-function markerFromMotion(data, pad) {
-	if (!data.detected) return null;
-	return {
-		t: data.timestamp,
-		startMs: data.timestamp - pad.padPreMs,
-		endMs: data.timestamp + pad.padPostMs,
-		source: "motion",
-		...data.regions !== void 0 ? { metadata: { regions: data.regions } } : {}
-	};
+/**
+* La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
+*
+* ## Cosa NON c'è più qui (2026-08-29)
+*
+* Fino al 2026-08-29 questo file costruiva anche un `EventMarker` per evento e
+* lo spingeva in un `EventMap` per-device — annotazioni di playback in RAM, con
+* dentro il payload `regions` grezzo del provider. `EventMap.events()` e
+* `EventMap.prune()` non avevano **nessun chiamante in tutto il repo**: la
+* mappa veniva solo scritta, e cresceva con l'uptime del runner.
+*
+* È stata cancellata, non cablata, e la ragione è nel suo stesso header: la
+* timeline che l'operatore vede viene dalle righe durabili di
+* `pipelineAnalytics` (`getMotionEvents`/`getObjectEvents`/`getAudioEvents`), i
+* marker non erano esposti su nessuna cap (`recording.getPlaybackManifest`
+* restituisce solo URL di playlist) e ADR-0194 aveva già rifiutato
+* esplicitamente di costruirci sopra il reconcile dei trigger, perché una
+* struttura in RAM non sopravvive né alla perdita dell'evento né al respawn del
+* runner. Un lettore non è mai esistito e non ne era previsto uno: tenerla
+* sarebbe stato "un residuo che descrive il design giusto", cioè una verifica
+* che non verifica niente.
+*
+* Quello che resta è l'unica cosa che qualcuno leggeva davvero: il fronte di
+* salita della motion che apre una finestra della banda `events` (B3).
+*/
+/** Solo il fronte `detected: true` è un trigger. Il fronte di discesa non apre
+*  niente — la finestra la chiude il post-buffer, non l'evento. */
+function isMotionTrigger(data) {
+	return data.detected;
 }
 function subscribeEventCapture(deps) {
-	const { eventBus, map, padPreMs, padPostMs, onMotion } = deps;
+	const { eventBus, onMotion } = deps;
 	return eventBus.subscribe({ category: require_dist.EventCategory.MotionOnMotionChanged }, (event) => {
-		const mk = markerFromMotion(event.data, {
-			padPreMs,
-			padPostMs
-		});
-		if (!mk) return;
-		map.record(event.data.deviceId, mk);
-		onMotion?.(event.data.deviceId, event.data.timestamp);
+		if (!isMotionTrigger(event.data)) return;
+		onMotion(event.data.deviceId, event.data.timestamp);
 	});
 }
 //#endregion
@@ -47,44 +62,180 @@ function subscribeEventCapture(deps) {
 * Puro: nessun bus, nessun orologio, nessuna config. La scelta di QUALI classi
 * ascoltare è della banda (`bandTriggerSources`); qui si decide solo se
 * l'evento è una detection utilizzabile e di che macro classe è.
-*/
+*
+* ## Perché la forma è DISCRIMINATA su `kind` (2026-08-29)
+*
+* Fino al 2026-08-29 questo file dichiarava UNA sola forma piatta — quella
+* dell'evento `object` — e la pretendeva da OGNI payload del topic. Ma
+* `EventCategory.PipelineAnalyticsDetectionEvent` è un topic condiviso da tre
+* emettitori in `addon-post-analysis/src/pipeline-analytics/index.ts`: object
+* (`className`, `source`, `confidence`, `zones`), motion e audio — e motion e
+* audio non portano `className`, perché non ne hanno una. Il risultato misurato:
+* `malformed` su **394 righe campionate su 394**, a 3.3–3.9 eventi/s, per
+* settimane. `malformed` significa "l'emettitore è andato in deriva" ed era
+* invece il traffico normale del topic; l'unico secchio che poteva segnalare
+* una vera rottura di protocollo era saturo al 100% di eventi sani, quindi
+* inservibile — ed è stato letto come "il trigger object non ha mai funzionato".
+*
+* Quindi: si valida prima la BUSTA comune (`deviceId`, `kind`, `timestamp`),
+* poi si discrimina su `kind`, e solo il ramo `object` pretende i campi
+* dell'object. Un `object` senza `className` resta un difetto e ha il suo nome
+* (`malformed-object`), distinto da una busta illeggibile.
+*/
+/** Il `kind` dell'unico ramo del topic che può aprire una finestra. */
+var OBJECT_EVENT_KIND = "object";
+/** La sorgente implicita delle righe legacy senza `source` (`DetectionSourceSchema`). */
+var DEFAULT_DETECTION_SOURCE = "pipeline";
 /** Type guard, non cast: `event.data` è `unknown` finché non passa di qui. */
-function isDetectionEventData(value) {
+function isDetectionEventEnvelope(value) {
 	if (typeof value !== "object" || value === null) return false;
 	if (!("deviceId" in value) || typeof value.deviceId !== "number") return false;
+	if (!Number.isFinite(value.deviceId)) return false;
 	if (!("kind" in value) || typeof value.kind !== "string") return false;
 	if (!("timestamp" in value) || typeof value.timestamp !== "number") return false;
 	if (!Number.isFinite(value.timestamp) || value.timestamp <= 0) return false;
+	return true;
+}
+/** I campi che SOLO il ramo object porta. Chiamata dopo la busta. */
+function isObjectDetectionEventData(value) {
 	if (!("className" in value) || typeof value.className !== "string") return false;
 	if ("source" in value && value.source !== void 0 && typeof value.source !== "string") return false;
 	return true;
 }
 function qualifyObjectTrigger(data) {
-	if (!isDetectionEventData(data)) return {
+	if (!isDetectionEventEnvelope(data)) return {
 		qualified: false,
 		reason: "malformed"
 	};
-	if (data.kind !== "object") return {
+	const deviceId = data.deviceId;
+	if (data.kind !== OBJECT_EVENT_KIND) return {
+		qualified: false,
+		reason: "not-object",
+		deviceId
+	};
+	if (!isObjectDetectionEventData(data)) return {
 		qualified: false,
-		reason: "not-object"
+		reason: "malformed-object",
+		deviceId
 	};
-	if ((data.source ?? "pipeline") !== "pipeline") return {
+	if ((data.source ?? DEFAULT_DETECTION_SOURCE) !== DEFAULT_DETECTION_SOURCE) return {
 		qualified: false,
-		reason: "not-pipeline"
+		reason: "not-pipeline",
+		deviceId
 	};
 	const className = data.className.trim().toLowerCase();
 	if (!require_dist.isFirstLevelMacroClass(className)) return {
 		qualified: false,
-		reason: "not-a-macro"
+		reason: "not-a-macro",
+		deviceId
 	};
 	return {
 		qualified: true,
-		deviceId: data.deviceId,
+		deviceId,
 		macroClass: className,
 		atMs: data.timestamp
 	};
 }
 //#endregion
+//#region src/recorder/object-trigger-health.ts
+/** Ampiezza della finestra di aggregazione. Un minuto: abbastanza corto perché
+*  la riga arrivi entro il primo minuto di un deploy rotto, abbastanza lungo
+*  perché a 4 eventi/s il campione sia significativo. */
+var OBJECT_TRIGGER_HEALTH_WINDOW_MS = 6e4;
+function emptyTally() {
+	return {
+		objectEvents: 0,
+		qualified: 0,
+		otherKinds: 0,
+		byReason: /* @__PURE__ */ new Map()
+	};
+}
+function dominantReason(byReason) {
+	let reason = null;
+	let best = 0;
+	const counts = {};
+	for (const [r, n] of byReason) {
+		counts[r] = n;
+		if (n > best) {
+			best = n;
+			reason = r;
+		}
+	}
+	return {
+		reason,
+		counts
+	};
+}
+var ObjectTriggerHealth = class {
+	windowMs;
+	minSample;
+	buckets = /* @__PURE__ */ new Map();
+	windowStartMs = null;
+	constructor(windowMs = OBJECT_TRIGGER_HEALTH_WINDOW_MS, minSample = 5) {
+		this.windowMs = windowMs;
+		this.minSample = minSample;
+	}
+	/**
+	* Registra un verdetto e, se la finestra si è chiusa con questo evento,
+	* restituisce i report da stampare (e riapre la finestra). Nessun timer:
+	* il feed viaggia a ~4/s, quindi la chiusura arriva sempre in tempo, e una
+	* finestra che non si chiude è una finestra in cui non è successo nulla.
+	*/
+	record(verdict, nowMs) {
+		const reports = this.windowStartMs !== null && nowMs - this.windowStartMs >= this.windowMs ? this.drain(nowMs) : [];
+		this.windowStartMs ??= nowMs;
+		this.count(verdict);
+		return reports;
+	}
+	count(verdict) {
+		if (verdict.qualified) {
+			const t = this.bucket(verdict.deviceId);
+			t.objectEvents += 1;
+			t.qualified += 1;
+			return;
+		}
+		if (verdict.reason === "not-object") {
+			this.bucket(verdict.deviceId).otherKinds += 1;
+			return;
+		}
+		const key = verdict.reason === "malformed" ? null : verdict.deviceId;
+		const t = this.bucket(key);
+		t.objectEvents += 1;
+		t.byReason.set(verdict.reason, (t.byReason.get(verdict.reason) ?? 0) + 1);
+	}
+	bucket(key) {
+		const existing = this.buckets.get(key);
+		if (existing !== void 0) return existing;
+		const fresh = emptyTally();
+		this.buckets.set(key, fresh);
+		return fresh;
+	}
+	/** Chiude la finestra e restituisce un report per secchio non vuoto. */
+	drain(nowMs) {
+		const windowMs = this.windowStartMs === null ? 0 : nowMs - this.windowStartMs;
+		const out = [];
+		for (const [deviceId, t] of this.buckets) {
+			if (t.objectEvents === 0 && t.otherKinds === 0) continue;
+			const rejected = t.objectEvents - t.qualified;
+			const { reason, counts } = dominantReason(t.byReason);
+			out.push({
+				deviceId,
+				windowMs,
+				objectEvents: t.objectEvents,
+				qualified: t.qualified,
+				rejectedPct: t.objectEvents === 0 ? 0 : Math.round(rejected / t.objectEvents * 100),
+				otherKinds: t.otherKinds,
+				topReason: reason,
+				byReason: counts,
+				totalRejection: t.objectEvents >= this.minSample && t.qualified === 0
+			});
+		}
+		this.buckets.clear();
+		this.windowStartMs = nowMs;
+		return out;
+	}
+};
+//#endregion
 //#region src/recorder/sensor-trigger.ts
 /**
 * Da `DeviceStateChanged` a "quali camere devono registrare".
@@ -213,31 +364,6 @@ var SensorTriggerRouter = class {
 	}
 };
 //#endregion
-//#region src/recorder/event-map.ts
-var EventMap = class {
-	byDevice = /* @__PURE__ */ new Map();
-	record(deviceId, marker) {
-		const list = this.byDevice.get(deviceId) ?? [];
-		list.push({ ...marker });
-		this.byDevice.set(deviceId, list);
-	}
-	events(deviceId, fromMs, toMs) {
-		const list = this.byDevice.get(deviceId);
-		if (!list) return [];
-		return list.filter((e) => e.t >= fromMs && e.t <= toMs).toSorted((a, b) => a.t - b.t);
-	}
-	prune(nowMs, maxAgeMs) {
-		const cutoff = nowMs - maxAgeMs;
-		let dropped = 0;
-		for (const [deviceId, list] of this.byDevice) {
-			const kept = list.filter((e) => e.t >= cutoff);
-			dropped += list.length - kept.length;
-			this.byDevice.set(deviceId, kept);
-		}
-		return dropped;
-	}
-};
-//#endregion
 //#region src/recorder/init-info.ts
 /** Walk sibling boxes in [from, to), yielding [type, start, end]. */
 function* boxes$1(buf, view, from, to) {
@@ -8599,6 +8725,47 @@ var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
 */
 var PENDING_GRACE_MS = 3e4;
 /**
+* How many entries ffmpeg's `-segment_list` must retain — the argument for
+* `-segment_list_size`.
+*
+* ## Why the list is bounded at all
+*
+* It was not, and the muxer default (0) means "keep every segment for the
+* writer's whole life". `parseLivePlaylist` re-splits and re-objectifies the
+* WHOLE body on every 2 s tick, per writer: at 10 s segments a 5-hour writer
+* holds 1 800 entries ⇒ ~220 KB/tick ⇒ **3.3 MB/s across 30 writers**, growing
+* linearly with uptime and bounded by nothing. It is latent today only because
+* writers restart constantly (59 restarts in 16 minutes, measured 2026-08-29)
+* and ffmpeg truncates the list on every spawn.
+*
+* ## Why THIS size
+*
+* The size is what the PARSER has to be able to answer, and the parser has
+* exactly two questions open at any moment:
+*
+*   1. the live tail, which is deliberately held back until its successor
+*      exists ({@link correctedDurMs}) — **1 entry**;
+*   2. every entry whose flat file has not landed yet. That entry stays this
+*      watcher's business for at most {@link PENDING_GRACE_MS}, after which the
+*      pass gives up on it and advances — and the pass that gives up may be as
+*      far as {@link WATCHER_PASS_WORST_MS} behind the one that first saw it.
+*
+* So the window is `1 + (grace + worst pass) / segment length`, rounded up.
+* At the default 10 s segments that is 1 + ceil(132/10) = **15 entries**
+* (~2.5 minutes of playlist, ~1.8 KB) instead of an unbounded list. A shorter
+* segment length buys proportionally more entries, which is exactly right: the
+* bound is denominated in TIME, and the entry count is only how that time is
+* spelled for a given `-segment_time`.
+*
+* Undersizing does not lose footage — a segment that rolls off unhandled stays
+* flat in staging and `staging-reconcile` recovers it at the next boot — but it
+* delays it by a whole process lifetime, so the tick loop reports it
+* ({@link FinalizationPlan.rolledOff}) rather than advancing in silence.
+*/
+function segmentListSize(segmentSeconds) {
+	return 1 + Math.ceil(132e3 / ((segmentSeconds > 0 ? segmentSeconds : 1) * 1e3));
+}
+/**
 * Decide whether a missing flat file is a late flush or a previous run's entry.
 *
 * ffmpeg opens `-segment_list` in TRUNCATE mode when it spawns, but not
@@ -8653,6 +8820,27 @@ function correctedDurMs(durSeconds, startMs, nextStartMs) {
 	if (gapMs <= 0) return extinfMs;
 	return Math.min(extinfMs, gapMs);
 }
+var MEDIA_SEQUENCE_RE = /^#EXT-X-MEDIA-SEQUENCE:(\d+)/m;
+/**
+* How many entries ffmpeg has already dropped off the FRONT of this playlist.
+*
+* With `-segment_list_size` the list is a sliding window, so an index into the
+* body is not a stable name for a segment: index 0 means a different file every
+* time the window advances. `#EXT-X-MEDIA-SEQUENCE` is the offset that turns a
+* body index back into a monotone global one, and ffmpeg maintains it for
+* exactly this purpose — verified against the ffmpeg 6.1.1 build the hub image
+* ships (12 segments, `-segment_list_size 4` ⇒ 4 entries and
+* `#EXT-X-MEDIA-SEQUENCE:8`; unbounded ⇒ 12 entries and `:0`).
+*
+* Absent (an unbounded list, or a pre-truncation body) it is 0, which is the
+* old behaviour exactly.
+*/
+function parseMediaSequence(body) {
+	const m = MEDIA_SEQUENCE_RE.exec(body);
+	if (m?.[1] === void 0) return 0;
+	const n = Number(m[1]);
+	return Number.isFinite(n) && n >= 0 ? n : 0;
+}
 /** Parse a `live.m3u8` body into ordered `#EXTINF` → segment-path pairs. */
 function parseLivePlaylist(body) {
 	const lines = body.split("\n");
@@ -8730,14 +8918,30 @@ async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger, wri
 * duration needs its SUCCESSOR's start (ffmpeg's first-segment EXTINF is
 * inflated by the initial PTS offset). Once `#EXT-X-ENDLIST` appears the tail
 * is flushed too — by then it is never the unreliable first segment.
+*
+* ## The mark is GLOBAL, not an index into the body
+*
+* `-segment_list_size` (see {@link segmentListSize}) makes the playlist a
+* sliding window, and the moment it starts sliding a body index stops naming a
+* segment: entry 0 is a different file after every roll. A high-water mark kept
+* as a body index would sit at `entries.length - 1` forever and finalize
+* NOTHING while ffmpeg kept writing — a bounded list without this rebase would
+* have stopped the recorder indexing footage while looking like a memory fix.
+* So the mark counts segments since the writer's first, `#EXT-X-MEDIA-SEQUENCE`
+* supplies the offset, and an unbounded list (sequence 0) behaves exactly as
+* before.
 */
 function planFinalizations(body, processed, forceFinal = false) {
 	const entries = parseLivePlaylist(body);
 	const endlist = body.includes("#EXT-X-ENDLIST");
-	const hw = entries.length < processed ? 0 : processed;
-	const finalizable = endlist || forceFinal ? entries.length : Math.max(0, entries.length - 1);
+	const base = parseMediaSequence(body);
+	const restarted = base + entries.length < processed;
+	const rolledOff = restarted ? 0 : Math.max(0, base - processed);
+	const hw = restarted ? base : Math.max(processed, base);
+	const finalizable = base + (endlist || forceFinal ? entries.length : Math.max(0, entries.length - 1));
 	const toHandle = [];
-	for (let i = hw; i < finalizable; i++) {
+	for (let g = hw; g < finalizable; g++) {
+		const i = g - base;
 		const entry = entries[i];
 		const startMs = parseEpochStartMs(entry.segPath);
 		const nextStartMs = i + 1 < entries.length ? parseEpochStartMs(entries[i + 1].segPath) : null;
@@ -8750,7 +8954,8 @@ function planFinalizations(body, processed, forceFinal = false) {
 	return {
 		toHandle,
 		from: hw,
-		processed: Math.max(hw, finalizable)
+		processed: Math.max(hw, finalizable),
+		rolledOff
 	};
 }
 /**
@@ -8778,6 +8983,11 @@ function startSegmentWatcher(deps) {
 				return;
 			}
 			const plan = planFinalizations(body, processed, forceFinal);
+			if (plan.rolledOff > 0) deps.logger.warn("segment playlist rolled past entries this watcher had not handled", { meta: {
+				rolledOff: plan.rolledOff,
+				processed,
+				from: plan.from
+			} });
 			let index = plan.from;
 			for (const { entry, durMs } of plan.toHandle) {
 				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger, deps.writerStartedMs) === "pending") {
@@ -8842,6 +9052,23 @@ function startSegmentWatcher(deps) {
 }
 //#endregion
 //#region src/recorder/addon/ffmpeg-args.ts
+/**
+* ffmpeg argv builder for recorder passthrough segmentation.
+*
+* Copied from the old recorder (`addon-pipeline/src/recorder/ffmpeg-args.ts`)
+* essentially verbatim — the passthrough + Opus-audio + fragmented-mp4 segment
+* recipe is proven across every vendor. The ONLY behavioural difference from
+* the old recorder lives in the WATCHER (recorder relocates via the v2
+* `SegmentStore.onFinalized`, not inline) — the ffmpeg invocation is identical:
+* FLAT epoch-named `.m4s` segments under `outDir` plus a rolling `live.m3u8`.
+*
+* Audio is re-encoded to **Opus** (`-c:a libopus`, in an `Opus`/`dOps`
+* ISOBMFF sample entry, verified muxable + mp4box-readable on the ffmpeg 7.x
+* builds shipped in dev/hub/agent images). Opus is what the WebRTC audio sender
+* already passes through un-transcoded (live PCMU/PCMA/OPUS => copy), so a
+* recorded fragment's audio can be read in-process (mp4box) and pushed straight
+* to the Opus sender with no per-fragment ffmpeg spawn on playback.
+*/
 /** ffmpeg argv: pull RTSP (TCP), copy video / transcode audio to Opus, write
 *  fragmented-mp4 segments named by epoch seconds FLAT under `outDir`, plus a
 *  rolling `live.m3u8` playlist. The recorder segment-watcher tails the
@@ -8880,6 +9107,8 @@ function buildPassthroughArgs(a) {
 		`${a.outDir}/live.m3u8`,
 		"-segment_list_type",
 		"m3u8",
+		"-segment_list_size",
+		String(segmentListSize(a.segmentSeconds)),
 		`${a.outDir}/%s.m4s`
 	];
 }
@@ -12566,15 +12795,6 @@ var DEFAULT_CONFIG = {
 	recordingNodeId: RECORDING_NODE_DEFAULT,
 	recordingHubHostname: ""
 };
-/** Playback-marker window padding around a motion event (EventMap only; the
-*  controller's events-band gating uses the raw trigger ms, not this pad).
-*  Derived from the SHARED `EVENT_PAD_MS` (R5/C1): markers are ephemeral
-*  in-RAM and consumed by nothing today, but aligning their window with the
-*  canonical clip pad means that IF they are ever surfaced, their boundaries
-*  match the videoclips/admin-ui clip window for the same event — one pad
-*  convention, not three. */
-var MARKER_PAD_PRE_MS = require_dist.EVENT_PAD_MS.preMs;
-var MARKER_PAD_POST_MS = require_dist.EVENT_PAD_MS.postMs;
 /** This addon's manifest id + the playback data-plane prefix — together they
 *  form the hub reverse-proxy client path `/addon/recorder/playback`. */
 /**
@@ -12738,8 +12958,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		return this.lastKnownGoodRead;
 	}
-	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
-	eventMap = new EventMap();
 	/** Unsubscribe handle for the EventCapture motion subscription. */
 	eventUnsub = null;
 	/**
@@ -12757,6 +12975,14 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	detectionTriggerUnsub = null;
 	/**
+	* Per-window, per-camera tally behind the detection-trigger subscription. A
+	* per-event `debug` line cannot say "NOTHING qualifies any more", which is the
+	* regime this feed sat in — 100% rejected at 3.3–3.9/s — from the day it was
+	* wired until 2026-08-29. This is what turns that into one `warn` a minute
+	* naming the camera and the dominant reason.
+	*/
+	detectionTriggerHealth = new ObjectTriggerHealth();
+	/**
 	* Unsubscribe handle for the `DeviceStateChanged` subscription — the feed
 	* behind `RecordingTriggers.sensorDeviceIds` (Traccia B).
 	*/
@@ -13345,9 +13571,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.recoverStagedOrphans(stagingBootMs);
 		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
 			eventBus: this.ctx.eventBus,
-			map: this.eventMap,
-			padPreMs: MARKER_PAD_PRE_MS,
-			padPostMs: MARKER_PAD_POST_MS,
 			onMotion: (deviceId, atMs) => {
 				this.controller?.onTrigger(deviceId, { kind: "motion" }, atMs);
 			}
@@ -13359,8 +13582,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		if (this.detectionTriggerUnsub === null) this.detectionTriggerUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.PipelineAnalyticsDetectionEvent }, (event) => {
 			const verdict = qualifyObjectTrigger(event.data);
+			for (const report of this.detectionTriggerHealth.record(verdict, Date.now())) this.logDetectionTriggerHealth(report);
 			if (!verdict.qualified) {
-				this.ctx.logger.debug("recorder: detection event did not qualify as a trigger", { meta: { reason: verdict.reason } });
+				this.ctx.logger.debug("recorder: detection event did not qualify as a trigger", {
+					...verdict.reason === "malformed" ? {} : { tags: { deviceId: verdict.deviceId } },
+					meta: { reason: verdict.reason }
+				});
 				return;
 			}
 			this.controller?.onTrigger(verdict.deviceId, {
@@ -13442,6 +13669,44 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.redundancySweeper?.start();
 	}
 	/**
+	* Print one window of detection-trigger health.
+	*
+	* The level is the whole point: a window in which SOME object detections
+	* opened a recording is normal operation and stays at `debug`; a window in
+	* which a camera produced object detections and NONE of them opened one is a
+	* dead feature, and it goes out at `warn` with the camera and the dominant
+	* reason on it. The unbucketable `malformed` envelopes are the only line here
+	* without a `deviceId`, because a payload whose envelope did not parse names
+	* no camera — and that line is always `warn`, since after 2026-08-29
+	* `malformed` can only mean the emitter drifted.
+	*/
+	logDetectionTriggerHealth(report) {
+		const meta = {
+			objectEvents: report.objectEvents,
+			qualified: report.qualified,
+			rejectedPct: report.rejectedPct,
+			otherKinds: report.otherKinds,
+			topReason: report.topReason,
+			byReason: report.byReason,
+			windowMs: report.windowMs
+		};
+		if (report.deviceId === null) {
+			this.ctx.logger.warn("recorder: detection events with an UNREADABLE envelope — the emitter and this consumer disagree", { meta });
+			return;
+		}
+		if (report.totalRejection) {
+			this.ctx.logger.warn("recorder: EVERY object detection was rejected in this window — the object recording trigger is doing nothing for this camera", {
+				tags: { deviceId: report.deviceId },
+				meta
+			});
+			return;
+		}
+		this.ctx.logger.debug("recorder: object trigger window", {
+			tags: { deviceId: report.deviceId },
+			meta
+		});
+	}
+	/**
 	* Rebuild the sensor trigger's reverse index from the persisted configs.
 	*
 	* D49: this is a MIRROR refreshed off the event path — at boot and on every